@productcraft/auth 1.0.1 → 1.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/README.md +33 -2
  2. package/api.md +547 -230
  3. package/dist/index.cjs +868 -231
  4. package/dist/index.cjs.map +1 -1
  5. package/dist/index.d.cts +996 -262
  6. package/dist/index.d.ts +996 -262
  7. package/dist/index.js +868 -231
  8. package/dist/index.js.map +1 -1
  9. package/manifest.json +210 -210
  10. package/package.json +2 -2
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/_generated/resources.ts","../src/jwt/errors.ts","../src/jwt/jwks-cache.ts","../src/jwt/verify.ts","../src/passkeys.ts","../src/consumer.ts","../src/base.ts","../src/_generated/types.ts","../src/_generated/client.ts","../src/_generated/errors.ts","../src/index.ts"],"names":["joseErrors","Auth","APIError"],"mappings":";;;;;;;AAiBA,SAAS,SAAA,CAAa,QAAW,KAAA,EAAiB;AAChD,EAAA,IAAI,KAAA,CAAM,QAAA,KAAa,MAAA,EAAW,OAAO,MAAA;AACzC,EAAA,MAAM,CAAA,GAAK,UAAU,EAAC;AACtB,EAAA,OAAQ,CAAA,CAAE,aAAa,MAAA,GAAY,EAAE,GAAG,CAAA,EAAG,QAAA,EAAU,KAAA,CAAM,QAAA,EAAS,GAAI,CAAA;AAC1E;AAGA,SAAS,SAAS,MAAA,EAAsC;AACtD,EAAA,MAAM,IAAA,GAAO,IAAI,QAAA,EAAS;AAC1B,EAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,IAAU,EAAE,CAAA,EAAG;AACjD,IAAA,IAAI,CAAA,KAAM,MAAA,IAAa,CAAA,KAAM,IAAA,EAAM;AACnC,IAAA,IAAI,CAAA,YAAa,IAAA,EAAM,IAAA,CAAK,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,SAClC,IAAA,CAAK,MAAA,CAAO,CAAA,EAAG,OAAO,CAAA,KAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,CAAC,CAAA,GAAI,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EAC3E;AACA,EAAA,OAAO,IAAA;AACT;AAEO,IAAM,cAAN,MAAkB;AAAA,EACJ,OAAA;AAAA;AAAA,EAEA,EAAA;AAAA,EACnB,WAAA,CAAY,MAAA,EAAmB,KAAA,GAAe,EAAC,EAAG;AAChD,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AACf,IAAA,IAAA,CAAK,EAAA,GAAK,KAAA;AAAA,EACZ;AACF,CAAA;AAKO,IAAM,YAAA,GAAN,cAA2B,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwB5C,MAAA,CAAO,QAA2B,OAAA,EAAiE;AACjG,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,UAAA,EAAY,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC3G;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAA,CAAO,OAAe,OAAA,EAA4C;AAChE,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,QAAQ,QAAA,EAAU,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAA,EAAM,IAAK,OAAO,CAAA;AAAA,EACrH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,IAAA,CAAK,QAA0B,OAAA,EAA8C;AAC3E,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,UAAA,EAAY,KAAA,EAAO,MAAA,EAAO,EAAG,OAAO,CAAA;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,QAAA,CAAS,OAAe,OAAA,EAAiE;AACvF,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAA,EAAM,IAAK,OAAO,CAAA;AAAA,EAClH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAA,CAAO,KAAA,EAAe,MAAA,EAA4B,OAAA,EAAiE;AACjH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,SAAS,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,QAAQ,KAAA,EAAM,EAAG,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAClI;AACF,CAAA;AAGO,IAAM,aAAA,GAAN,cAA4B,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiB7C,EAAA,CAAG,QAA0B,OAAA,EAA+E;AAC1G,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,cAAA,EAAgB,KAAA,EAAO,MAAA,EAAO,EAAG,OAAO,CAAA;AAAA,EAC7F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,QAAA,CAAS,QAAgC,OAAA,EAAgF;AACvH,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,qCAAA,EAAuC,KAAA,EAAO,MAAA,EAAO,EAAG,OAAO,CAAA;AAAA,EACpH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,GAAA,CAAI,QAA0B,OAAA,EAA+E;AAC3G,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,cAAA,EAAgB,KAAA,EAAO,MAAA,EAAO,EAAG,OAAO,CAAA;AAAA,EAC7F;AACF,CAAA;AAGO,IAAM,gBAAA,GAAN,cAA+B,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQhD,OAAO,MAAA,EAA0D;AAC/D,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,aAAA,CAAkC,MAAA,EAAQ,kCAAkC,CAAA;AAAA,EAClG;AACF,CAAA;AAGO,IAAM,aAAA,GAAN,cAA4B,WAAA,CAAY;AAAA,EAC7C,KAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,IAAI,IAAA,GAAqB;AACvB,IAAA,OAAQ,KAAK,KAAA,KAAU,IAAI,aAAa,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC/D;AAAA,EACA,IAAI,KAAA,GAAuB;AACzB,IAAA,OAAQ,KAAK,MAAA,KAAW,IAAI,cAAc,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACjE;AAAA,EACA,IAAI,QAAA,GAA6B;AAC/B,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,iBAAiB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACvE;AACF,CAAA;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBlD,MAAA,CAAO,QAA8B,OAAA,EAA0E;AAC7G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAA,CAAO,OAAe,OAAA,EAA4C;AAChE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,QAAQ,KAAA,EAAM,IAAK,OAAO,CAAA;AAAA,EAC/J;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,IAAA,CAAK,QAA6B,OAAA,EAAwD;AACxF,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EAChJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAA,CAAO,KAAA,EAAe,MAAA,EAA+B,OAAA,EAA0E;AAC7H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,4CAAA,EAA8C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,QAAQ,KAAA,EAAM,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EACpM;AACF,CAAA;AAGO,IAAM,oBAAA,GAAN,cAAmC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBpD,MAAA,CAAO,QAAiC,OAAA,EAAgD;AACtF,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,GAAG,MAAA,EAAO,EAAG,KAAA,EAAO,SAAA,CAAU,MAAA,EAAQ,IAAA,CAAK,EAAE,CAAA,EAAG,GAAA,EAAK,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC3L;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,IAAA,CAAK,QAA+B,OAAA,EAAwD;AAC1F,IAAA,OAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,8BAAA,EAAgC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,SAAA,CAAU,QAAQ,IAAA,CAAK,EAAE,CAAA,EAAE,EAAG,OAAO,CAAA;AAAA,EACtK;AACF,CAAA;AAGO,IAAM,oBAAA,GAAN,cAAmC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBpD,WAAW,OAAA,EAA4C;AACrD,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,8BAAA,EAAgC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACzI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,OAAA,CAAQ,QAAkC,OAAA,EAAiF;AACzH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,8BAAA,EAAgC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACpJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,SAAS,OAAA,EAAuE;AAC9E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,8BAAA,EAAgC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACtI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,aAAa,OAAA,EAAiF;AAC5F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,4CAAA,EAA8C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACrJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,YAAY,OAAA,EAAyE;AACnF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,2CAAA,EAA6C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACnJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,KAAK,OAAA,EAAiF;AACpF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,mCAAA,EAAqC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC9J;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAA,CAAO,QAAkC,OAAA,EAAuE;AAC9G,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,8BAAA,EAAgC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACtJ;AACF,CAAA;AAGO,IAAM,8BAAA,GAAN,cAA6C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoB9D,KAAA,CAAM,UAAkB,OAAA,EAA2E;AACjG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,0DAAA,EAA4D,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC7K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,KAAK,OAAA,EAA4F;AAC/F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,yCAAA,EAA2C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACjJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,OAAA,CAAQ,QAAA,EAAkB,MAAA,EAA2C,OAAA,EAA4E;AAC/I,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,GAAG,MAAA,EAAQ,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACpL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,QAAA,CAAS,UAAkB,OAAA,EAA4E;AACrG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACtK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAA,CAAO,QAAA,EAAkB,MAAA,EAA2C,OAAA,EAA4E;AAC9I,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,GAAG,MAAA,EAAQ,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACtL;AACF,CAAA;AAGO,IAAM,qBAAA,GAAN,cAAoC,WAAA,CAAY;AAAA,EACrD,UAAA;AAAA,EACA,IAAI,SAAA,GAA4C;AAC9C,IAAA,OAAQ,KAAK,UAAA,KAAe,IAAI,+BAA+B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,SAAS,OAAA,EAAwE;AAC/E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,+BAAA,EAAiC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACvI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,QAAmC,OAAA,EAAwE;AAChH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,+BAAA,EAAiC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACvJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,OAAA,EAAwE;AAC1E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,+BAAA,EAAiC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACvI;AACF,CAAA;AAGO,IAAM,sBAAA,GAAN,cAAqC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBtD,MAAA,CAAO,QAAkC,OAAA,EAA6E;AACpH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,iCAAiC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACxK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,2CAAA,EAA6C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC3K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,IAAA,CAAK,QAAiC,OAAA,EAA2D;AAC/F,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,+BAAA,EAAiC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACnJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,QAAA,CAAS,UAAkB,OAAA,EAA6E;AACtG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,2CAAA,EAA6C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACxK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAA,CAAO,UAAkB,OAAA,EAA6E;AACpG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,kDAAA,EAAoD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAChL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,QAAA,EAAkB,MAAA,EAAmC,OAAA,EAA6E;AACvI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,6CAA6C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACxL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,YAAA,CAAa,QAAA,EAAkB,MAAA,EAAwC,OAAA,EAA4F;AACjK,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,oDAAoD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC7L;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,GAAA,CAAI,UAAkB,OAAA,EAA6E;AACjG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,2CAAA,EAA6C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACxK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAA,CAAa,UAAkB,OAAA,EAA6E;AAC1G,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,kDAAA,EAAoD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAChL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAA,CAAU,QAAA,EAAkB,MAAA,EAAwC,OAAA,EAA4F;AAC9J,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,oDAAoD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC7L;AACF,CAAA;AAGO,IAAM,wBAAA,GAAN,cAAuC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBxD,KAAA,CAAM,QAAA,EAAkB,MAAA,EAAmC,OAAA,EAAqF;AAC9I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAClN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,KAAA,CAAM,UAAkB,OAAA,EAA0E;AAChG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAClL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,QAAoC,OAAA,EAA0E;AACnH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,oCAAoC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC3K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,8CAAA,EAAgD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC9K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,QAAA,EAAkB,MAAA,EAAoC,OAAA,EAAgD;AAC3G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,qDAAA,EAAuD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,EAAG,OAAO,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC5M;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,KAAK,OAAA,EAAuD;AAC1D,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,kCAAA,EAAoC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACvI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,QAAA,CAAS,UAAkB,OAAA,EAA0E;AACnG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,8CAAA,EAAgD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC3K;AACF,CAAA;AAGO,IAAM,+BAAA,GAAN,cAA8C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkB/D,QAAA,CAAS,QAAgB,OAAA,EAAmF;AAC1G,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,qDAAA,EAAuD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC9K;AACF,CAAA;AAGO,IAAM,0BAAA,GAAN,cAAyC,WAAA,CAAY;AAAA,EAC1D,MAAA;AAAA,EACA,IAAI,KAAA,GAAyC;AAC3C,IAAA,OAAQ,KAAK,MAAA,KAAW,IAAI,gCAAgC,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,SAAS,OAAA,EAA6E;AACpF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC7I;AACF,CAAA;AAGO,IAAM,2BAAA,GAAN,cAA0C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoB3D,MAAA,CAAO,MAAA,EAAgB,MAAA,EAAsC,OAAA,EAA4E;AACvI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,gDAAA,EAAkD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC1M;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,MAAA,EAAgB,SAAA,EAAmB,OAAA,EAA4C;AACpF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,QAAA,EAAU,IAAA,EAAM,+DAA+D,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,OAAA,EAAS,MAAA,EAAQ,YAAY,SAAA,EAAU,IAAK,OAAO,CAAA;AAAA,EAChN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,IAAA,CAAK,QAAgB,OAAA,EAAgF;AACnG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,gDAAA,EAAkD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,OAAA,CAAQ,MAAA,EAAgB,SAAA,EAAmB,OAAA,EAA4C;AACrF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,uEAAuE,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,OAAA,EAAS,MAAA,EAAQ,YAAY,SAAA,EAAU,IAAK,OAAO,CAAA;AAAA,EACtN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,kBAAA,CAAmB,MAAA,EAAgB,SAAA,EAAmB,OAAA,EAAoF;AACxI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,mFAAmF,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,OAAA,EAAS,MAAA,EAAQ,YAAY,SAAA,EAAU,IAAK,OAAO,CAAA;AAAA,EAClO;AACF,CAAA;AAGO,IAAM,0BAAA,GAAN,cAAyC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoB1D,OAAO,OAAA,EAAuE;AAC5E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,oCAAA,EAAsC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC/J;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,QAAA,CAAS,OAAe,OAAA,EAAuE;AAC7F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,6CAAA,EAA+C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,QAAQ,KAAA,EAAM,IAAK,OAAO,CAAA;AAAA,EACpK;AACF,CAAA;AAGO,IAAM,0BAAA,GAAN,cAAyC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiB1D,MAAA,CAAO,QAAqC,OAAA,EAA2E;AACrH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,uCAAuC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC9K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,iDAAA,EAAmD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACjL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,IAAA,CAAK,QAAoC,OAAA,EAAwD;AAC/F,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACzJ;AACF,CAAA;AAGO,IAAM,sBAAA,GAAN,cAAqC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBtD,mBAAA,CAAoB,QAAgB,OAAA,EAAoF;AACtH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,gEAAA,EAAkE,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC1L;AACF,CAAA;AAGO,IAAM,2BAAA,GAAN,cAA0C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiB3D,SAAA,CAAU,QAAgB,OAAA,EAA4C;AACpE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,2DAAA,EAA6D,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACrL;AACF,CAAA;AAGO,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAA,EACnD,SAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA,EACA,IAAI,QAAA,GAAwC;AAC1C,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,4BAA4B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAClF;AAAA,EACA,IAAI,OAAA,GAAsC;AACxC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,2BAA2B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAChF;AAAA,EACA,IAAI,OAAA,GAAsC;AACxC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,2BAA2B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAChF;AAAA,EACA,IAAI,GAAA,GAA8B;AAChC,IAAA,OAAQ,KAAK,IAAA,KAAS,IAAI,uBAAuB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACxE;AAAA,EACA,IAAI,QAAA,GAAwC;AAC1C,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,4BAA4B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,UAAA,CAAW,QAAmC,OAAA,EAA+E;AAC3H,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,yCAAA,EAA2C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAChK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,kBAAA,CAAmB,QAA2C,OAAA,EAA+E;AAC3I,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,kDAAA,EAAoD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,cAAA,CAAe,QAAuC,OAAA,EAA+E;AACnI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,8CAAA,EAAgD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,gBAAA,CAAiB,QAAyC,OAAA,EAA+E;AACvI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,gDAAA,EAAkD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACvK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,QAAgB,OAAA,EAA4C;AACjE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,uCAAA,EAAyC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACnK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,QAAgC,OAAA,EAAgD;AACrF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,sCAAsC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,KAAA,EAAO,QAAQ,GAAA,EAAK,IAAA,IAAQ,OAAO,CAAA;AAAA,EACtK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,IAAA,CAAK,QAA8B,OAAA,EAAyD;AAC1F,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,6BAAA,EAA+B,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACjJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,kBAAA,CAAmB,QAAgB,OAAA,EAAoF;AACrH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,2DAAA,EAA6D,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACrL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,QAAA,CAAS,QAAgB,OAAA,EAA4E;AACnG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,uCAAA,EAAyC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAChK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,MAAA,EAAgB,MAAA,EAAgC,OAAA,EAA4E;AACjI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,yCAAyC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,OAAA,EAAS,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAChL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAmC,OAAA,EAAmF;AAC/I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,8CAA8C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,OAAA,EAAS,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACrL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,YAAA,CAAa,MAAA,EAAgB,MAAA,EAAqC,OAAA,EAA4E;AAC5I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,gDAAgD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,OAAA,EAAS,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACvL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,GAAA,CAAI,QAAgB,OAAA,EAA4E;AAC9F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,uCAAA,EAAyC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAChK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAAA,CAAkB,QAAgB,OAAA,EAA4C;AAC5E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,2DAAA,EAA6D,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACrL;AACF,CAAA;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMlD,MAAA,CAAO,QAAqC,OAAA,EAA2E;AACrH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,uCAAuC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC9K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAA,CAAK,QAAoC,OAAA,EAAwD;AAC/F,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACzJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,iDAAA,EAAmD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACjL;AACF,CAAA;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBlD,MAAA,CAAO,WAAmB,OAAA,EAA4C;AACpE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,wCAAA,EAA0C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,YAAY,SAAA,EAAU,IAAK,OAAO,CAAA;AAAA,EAC1K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,IAAA,CAAK,QAA6B,OAAA,EAA2D;AAC3F,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,2BAAA,EAA6B,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EAC/I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,WAAmB,OAAA,EAA4C;AACpE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,wCAAA,EAA0C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,YAAY,SAAA,EAAU,IAAK,OAAO,CAAA;AAAA,EAC1K;AACF,CAAA;AAGO,IAAM,+BAAA,GAAN,cAA8C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkB/D,SAAS,OAAA,EAAqF;AAC5F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,yCAAA,EAA2C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACjJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,QAA4C,OAAA,EAAqF;AACtI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,yCAAA,EAA2C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACjK;AACF,CAAA;AAGO,IAAM,wBAAA,GAAN,cAAuC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBxD,IAAA,CAAK,MAAc,OAAA,EAA8E;AAC/F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,6CAAA,EAA+C,UAAA,EAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,GAAG,MAAA,EAAQ,IAAA,IAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC9K;AACF,CAAA;AAGO,IAAM,iCAAA,GAAN,cAAgD,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBjE,KAAK,OAAA,EAAiF;AACpF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,2CAAA,EAA6C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACnJ;AACF,CAAA;AAGO,IAAM,sBAAA,GAAN,cAAqC,WAAA,CAAY;AAAA,EACtD,YAAA;AAAA,EACA,IAAI,WAAA,GAAiD;AACnD,IAAA,OAAQ,KAAK,YAAA,KAAiB,IAAI,kCAAkC,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,QAA2C,OAAA,EAAwE;AACxH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,iCAAiC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACxK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAA,CAAO,eAAuB,OAAA,EAA4C;AACxE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,gDAAA,EAAkD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,gBAAgB,aAAA,EAAc,IAAK,OAAO,CAAA;AAAA,EAC1L;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,KAAK,OAAA,EAA6F;AAChG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,+BAAA,EAAiC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACvI;AACF,CAAA;AAGO,IAAM,2BAAA,GAAN,cAA0C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgB3D,KAAK,OAAA,EAAwF;AAC3F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC7I;AACF,CAAA;AAGO,IAAM,gBAAA,GAAN,cAA+B,WAAA,CAAY;AAAA,EAChD,YAAA;AAAA,EACA,IAAI,WAAA,GAA2C;AAC7C,IAAA,OAAQ,KAAK,YAAA,KAAiB,IAAI,4BAA4B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACrF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAA,CAAO,QAA4B,OAAA,EAA2E;AAC5G,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,gCAAA,EAAkC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACvJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,QAAqC,OAAA,EAAkE;AAC5G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,2BAA2B,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAClK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,IAAA,CAAK,QAAoC,OAAA,EAA+C;AACtF,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,yBAAA,EAA2B,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EAC7I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,QAAA,CAAS,UAAkB,OAAA,EAAiF;AAC1G,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAClK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,QAAA,EAAkB,MAAA,EAAsC,OAAA,EAAkE;AAC/H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,uCAAuC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAClL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,iBAAA,CAAkB,QAAA,EAAkB,MAAA,EAAgD,OAAA,EAAoG;AACtL,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,mDAAmD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC5L;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,GAAA,CAAI,UAAkB,OAAA,EAAiF;AACrG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAClK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,gBAAgB,OAAA,EAAwF;AACtG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC7I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAA,CAAe,QAAA,EAAkB,MAAA,EAAgD,OAAA,EAAoG;AACnL,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,mDAAmD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC5L;AACF,CAAA;AAGO,IAAM,sBAAA,GAAN,cAAqC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBtD,SAAS,OAAA,EAAyE;AAChF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,gCAAA,EAAkC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACxI;AACF,CAAA;AAGO,IAAM,sBAAA,GAAN,cAAqC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBtD,MAAA,CAAO,QAAkC,OAAA,EAAwE;AAC/G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,mCAAmC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC1K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,QAAA,CAAS,QAAgB,OAAA,EAAwE;AAC/F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,2CAAA,EAA6C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACpK;AACF,CAAA;AAGO,IAAM,8BAAA,GAAN,cAA6C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkB9D,SAAS,OAAA,EAAiF;AACxF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,0CAAA,EAA4C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAClJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,QAAoD,OAAA,EAAiF;AAC1I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,4CAA4C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAClL;AACF,CAAA;AAGO,IAAM,wBAAA,GAAN,cAAuC,WAAA,CAAY;AAAA,EACxD,OAAA;AAAA,EACA,IAAI,MAAA,GAAyC;AAC3C,IAAA,OAAQ,KAAK,OAAA,KAAY,IAAI,+BAA+B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,OAAe,OAAA,EAA4C;AAChE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,4CAAA,EAA8C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,QAAQ,KAAA,EAAM,IAAK,OAAO,CAAA;AAAA,EACtK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,IAAA,CAAK,QAA4C,OAAA,EAA+D;AAC9G,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,mCAAA,EAAqC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACvJ;AACF,CAAA;AAGO,IAAM,yBAAA,GAAN,cAAwC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBzD,MAAA,CAAO,QAAA,EAAkB,MAAA,EAA6C,OAAA,EAAgF;AACpJ,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,+CAAA,EAAiD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC7M;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAA,CAAO,QAAA,EAAkB,QAAA,EAAkB,OAAA,EAA4C;AACrF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,QAAA,EAAU,IAAA,EAAM,6DAA6D,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,EAAU,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAChN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,IAAA,CAAK,QAAA,EAAkB,MAAA,EAA4C,OAAA,EAAuD;AACxH,IAAA,OAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,iDAAiD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACxL;AACF,CAAA;AAGO,IAAM,yBAAA,GAAN,cAAwC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBzD,MAAA,CAAO,QAAA,EAAkB,MAAA,EAA6C,OAAA,EAAuE;AAC3I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,+CAAA,EAAiD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC7M;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAA,CAAO,QAAA,EAAkB,SAAA,EAAmB,OAAA,EAA4C;AACtF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,QAAA,EAAU,IAAA,EAAM,8DAA8D,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,EAAU,YAAY,SAAA,EAAU,IAAK,OAAO,CAAA;AAAA,EACnN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,IAAA,CAAK,QAAA,EAAkB,MAAA,EAA4C,OAAA,EAA2D;AAC5H,IAAA,OAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,iDAAiD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACxL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAA,CAAO,QAAA,EAAkB,SAAA,EAAmB,MAAA,EAA6C,OAAA,EAA8E;AACrK,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,4DAAA,EAA8D,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAU,UAAA,EAAY,WAAU,EAAG,IAAA,EAAM,MAAA,EAAO,EAAG,OAAO,CAAA;AAAA,EAChO;AACF,CAAA;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAA,EAClD,QAAA;AAAA,EACA,QAAA;AAAA,EACA,IAAI,OAAA,GAAqC;AACvC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,0BAA0B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC/E;AAAA,EACA,IAAI,OAAA,GAAqC;AACvC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,0BAA0B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,QAAuC,OAAA,EAAoE;AAChH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,6BAA6B,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACpK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,uCAAA,EAAyC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACvK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,IAAA,CAAK,QAAsC,OAAA,EAAiD;AAC1F,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,2BAAA,EAA6B,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EAC/I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,QAAA,CAAS,UAAkB,OAAA,EAAoE;AAC7F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,uCAAA,EAAyC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACpK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAA,CAAO,QAAA,EAAkB,MAAA,EAAwC,OAAA,EAAoE;AACnI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,yCAAyC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACpL;AACF,CAAA;AAGO,IAAM,kCAAA,GAAN,cAAiD,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBlE,SAAS,OAAA,EAA2F;AAClG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,6CAAA,EAA+C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACrJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,GAAA,CAAI,QAA6C,OAAA,EAAwF;AACvI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,mDAAmD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC1L;AACF,CAAA;AAGO,IAAM,yBAAA,GAAN,cAAwC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBzD,SAAS,OAAA,EAA4E;AACnF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,mCAAA,EAAqC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC3I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAA,CAAO,QAAsC,OAAA,EAA4E;AACvH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,mCAAA,EAAqC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACzJ;AACF,CAAA;AAGO,IAAM,4BAAA,GAAN,cAA2C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsB5D,MAAA,CAAO,QAAuC,OAAA,EAAuF;AACnI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,wCAAwC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC/K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAA,CAAO,YAAoB,OAAA,EAA4C;AACrE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,aAAa,UAAA,EAAW,IAAK,OAAO,CAAA;AAAA,EACxL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,KAAK,OAAA,EAA0D;AAC7D,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,sCAAA,EAAwC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC3I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,QAAA,CAAS,YAAoB,OAAA,EAA6E;AACxG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,aAAa,UAAA,EAAW,IAAK,OAAO,CAAA;AAAA,EACrL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,YAAA,CAAa,UAAA,EAAoB,MAAA,EAA8C,OAAA,EAAuF;AACpK,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,kEAAA,EAAoE,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,aAAa,UAAA,EAAW,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EACpO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,IAAA,CAAK,UAAA,EAAoB,MAAA,EAAqC,OAAA,EAAoF;AAChJ,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,yDAAA,EAA2D,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,aAAa,UAAA,EAAW,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC3N;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAA,CAAO,UAAA,EAAoB,MAAA,EAAwC,OAAA,EAA6E;AAC9I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,aAAa,UAAA,EAAW,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EACvN;AACF,CAAA;AAGO,IAAM,6BAAA,GAAN,cAA4C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkB7D,KAAK,OAAA,EAAmF;AACtF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,wCAAA,EAA0C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAChJ;AACF,CAAA;AAGO,IAAM,yBAAA,GAAN,cAAwC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBzD,IAAA,CAAK,QAAmC,OAAA,EAAuD;AAC7F,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,mCAAA,EAAqC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACvJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,OAAA,EAAiB,MAAA,EAAqC,OAAA,EAAgF;AAC3I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,qDAAA,EAAuD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,UAAU,OAAA,EAAQ,EAAG,OAAO,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAClN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,QAAA,CAAS,SAAiB,OAAA,EAAgF;AACxG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,8CAAA,EAAgD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,UAAU,OAAA,EAAQ,IAAK,OAAO,CAAA;AAAA,EACzK;AACF,CAAA;AAGO,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAA,EACnD,UAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,IAAI,SAAA,GAA0C;AAC5C,IAAA,OAAQ,KAAK,UAAA,KAAe,IAAI,6BAA6B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACpF;AAAA,EACA,IAAI,UAAA,GAA4C;AAC9C,IAAA,OAAQ,KAAK,WAAA,KAAgB,IAAI,8BAA8B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACtF;AAAA,EACA,IAAI,MAAA,GAAoC;AACtC,IAAA,OAAQ,KAAK,OAAA,KAAY,IAAI,0BAA0B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC9E;AACF,CAAA;AAGO,IAAM,OAAA,GAAN,cAAsB,WAAA,CAAY;AAAA,EACvC,QAAA;AAAA,EACA,UAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,qBAAA;AAAA,EACA,cAAA;AAAA,EACA,YAAA;AAAA,EACA,MAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA,EACA,QAAA;AAAA,EACA,wBAAA;AAAA,EACA,eAAA;AAAA,EACA,SAAA;AAAA;AAAA,EAEA,IAAI,KAAA,GAAgB;AAClB,IAAA,OAAO,KAAK,EAAA,CAAG,MAAA;AAAA,EACjB;AAAA,EACA,IAAI,OAAA,GAA8B;AAChC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,mBAAmB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACxE;AAAA,EACA,IAAI,SAAA,GAAkC;AACpC,IAAA,OAAQ,KAAK,UAAA,KAAe,IAAI,qBAAqB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC5E;AAAA,EACA,IAAI,SAAA,GAAkC;AACpC,IAAA,OAAQ,KAAK,UAAA,KAAe,IAAI,qBAAqB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC5E;AAAA,EACA,IAAI,UAAA,GAAoC;AACtC,IAAA,OAAQ,KAAK,WAAA,KAAgB,IAAI,sBAAsB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC9E;AAAA,EACA,IAAI,WAAA,GAAsC;AACxC,IAAA,OAAQ,KAAK,YAAA,KAAiB,IAAI,uBAAuB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAChF;AAAA,EACA,IAAI,aAAA,GAA0C;AAC5C,IAAA,OAAQ,KAAK,cAAA,KAAmB,IAAI,yBAAyB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACpF;AAAA,EACA,IAAI,eAAA,GAA8C;AAChD,IAAA,OAAQ,KAAK,gBAAA,KAAqB,IAAI,2BAA2B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACxF;AAAA,EACA,IAAI,QAAA,GAAgC;AAClC,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,oBAAoB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC1E;AAAA;AAAA,EAEA,IAAI,OAAA,GAA8B;AAChC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,mBAAmB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACxE;AAAA,EACA,IAAI,OAAA,GAA8B;AAChC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,mBAAmB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACxE;AAAA,EACA,IAAI,oBAAA,GAAwD;AAC1D,IAAA,OAAQ,KAAK,qBAAA,KAA0B,IAAI,gCAAgC,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAClG;AAAA,EACA,IAAI,aAAA,GAA0C;AAC5C,IAAA,OAAQ,KAAK,cAAA,KAAmB,IAAI,yBAAyB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACpF;AAAA,EACA,IAAI,WAAA,GAAsC;AACxC,IAAA,OAAQ,KAAK,YAAA,KAAiB,IAAI,uBAAuB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAChF;AAAA,EACA,IAAI,KAAA,GAA0B;AAC5B,IAAA,OAAQ,KAAK,MAAA,KAAW,IAAI,iBAAiB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACpE;AAAA,EACA,IAAI,WAAA,GAAsC;AACxC,IAAA,OAAQ,KAAK,YAAA,KAAiB,IAAI,uBAAuB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAChF;AAAA,EACA,IAAI,WAAA,GAAsC;AACxC,IAAA,OAAQ,KAAK,YAAA,KAAiB,IAAI,uBAAuB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAChF;AAAA,EACA,IAAI,aAAA,GAA0C;AAC5C,IAAA,OAAQ,KAAK,cAAA,KAAmB,IAAI,yBAAyB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACpF;AAAA,EACA,IAAI,OAAA,GAA8B;AAChC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,mBAAmB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACxE;AAAA,EACA,IAAI,uBAAA,GAA8D;AAChE,IAAA,OAAQ,KAAK,wBAAA,KAA6B,IAAI,mCAAmC,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACxG;AAAA,EACA,IAAI,cAAA,GAA4C;AAC9C,IAAA,OAAQ,KAAK,eAAA,KAAoB,IAAI,0BAA0B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACtF;AAAA,EACA,IAAI,QAAA,GAAgC;AAClC,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,oBAAoB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,KAAA,CAAM,QAAuB,OAAA,EAAsE;AACjG,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,2BAA2B,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAClK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,YAAA,CAAa,QAA8B,OAAA,EAAiE;AAC1G,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,0BAAA,EAA4B,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAClJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,OAAA,EAA4C;AACjD,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC9H;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,OAAA,EAAiE;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC3H;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,QAA4B,OAAA,EAAiE;AAClG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC3I;AACF;AAGO,IAAM,oBAAA,GAAN,cAAmC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMpD,YAAA,CAAa,QAA8B,OAAA,EAAkF;AAC3H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,qCAAqC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC5K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,QAAwB,OAAA,EAA4C;AACzE,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAA,CAAQ,QAAyB,OAAA,EAA2E;AAC1G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,+BAA+B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACtK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAA,CAAa,QAAuC,OAAA,EAA+E;AACjI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,4CAAA,EAA8C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACvK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,mBAAA,CAAoB,QAAsC,OAAA,EAA+E;AACvI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,0CAAA,EAA4C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAA,CAAc,QAA+B,OAAA,EAA4C;AACvF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,sCAAsC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC7K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,sBAAA,CAAuB,QAAwC,OAAA,EAAkF;AAC/I,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,+CAAA,EAAiD,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC1K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,qBAAA,CAAsB,QAAuC,OAAA,EAAkF;AAC7I,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,6CAAA,EAA+C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACxK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,QAAwB,OAAA,EAA4E;AACzG,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAAA,CAAmB,MAAyD,OAAA,EAAwF;AAClK,IAAA,MAAM,EAAE,QAAA,EAAU,GAAG,MAAA,EAAO,GAAI,IAAA;AAChC,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,wCAAwC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,QAAA,EAAS,EAAG,MAAM,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EACzL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,QAAwB,OAAA,EAA4E;AACzG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACvJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,QAA6B,OAAA,EAA4E;AAC9G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AACF,CAAA;AAGO,IAAM,0BAAA,GAAN,cAAyC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkB1D,KAAK,OAAA,EAA0D;AAC7D,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACrI;AACF,CAAA;AAGO,IAAM,0BAAA,GAAN,cAAyC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmB1D,MAAA,CAAO,QAAiC,OAAA,EAAuE;AAC7G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAA,CAAO,IAAY,OAAA,EAA4C;AAC7D,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,iCAAA,EAAmC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,EAAA,EAAG,IAAK,OAAO,CAAA;AAAA,EACpJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,KAAK,OAAA,EAAwE;AAC3E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACxI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,OAAA,CAAQ,IAAY,OAAA,EAA4C;AAC9D,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,yCAAA,EAA2C,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,EAAA,EAAG,IAAK,OAAO,CAAA;AAAA,EAC1J;AACF,CAAA;AAGO,IAAM,4BAAA,GAAN,cAA2C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqB5D,MAAA,CAAO,QAAmC,OAAA,EAA6E;AACrH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,iCAAiC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC5K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAA,CAAO,IAAY,OAAA,EAA4C;AAC7D,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,oCAAA,EAAsC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,EAAA,EAAG,IAAK,OAAO,CAAA;AAAA,EACvJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,KAAK,OAAA,EAAwE;AAC3E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,+BAAA,EAAiC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC3I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,EAAA,EAAY,MAAA,EAAoC,OAAA,EAA+E;AACpI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,2CAAA,EAA6C,UAAA,EAAY,EAAE,QAAA,EAAU,IAAA,CAAK,GAAG,QAAA,EAAU,EAAA,IAAM,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC1K;AACF,CAAA;AAGO,IAAM,kCAAA,GAAN,cAAiD,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBlE,WAAW,OAAA,EAA2E;AACpF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,iDAAA,EAAmD,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC9J;AACF,CAAA;AAGO,IAAM,mCAAA,GAAN,cAAkD,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBnE,QAAQ,OAAA,EAA6E;AACnF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,gDAAA,EAAkD,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC7J;AACF,CAAA;AAGO,IAAM,2BAAA,GAAN,cAA0C,WAAA,CAAY;AAAA,EAC3D,SAAA;AAAA,EACA,IAAI,QAAA,GAAgD;AAClD,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,oCAAoC,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,QAAA,CAAS,QAAsC,OAAA,EAA4E;AACzH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,yCAAA,EAA2C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACpK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAA,CAAO,QAAoC,OAAA,EAAoE;AAC7G,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,+BAAA,EAAiC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC1J;AACF,CAAA;AAGO,IAAM,qBAAA,GAAN,cAAoC,WAAA,CAAY;AAAA,EACrD,QAAA;AAAA,EACA,cAAA;AAAA,EACA,OAAA;AAAA,EACA,IAAI,OAAA,GAAwC;AAC1C,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,6BAA6B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAClF;AAAA,EACA,IAAI,aAAA,GAAoD;AACtD,IAAA,OAAQ,KAAK,cAAA,KAAmB,IAAI,mCAAmC,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC9F;AAAA,EACA,IAAI,MAAA,GAAsC;AACxC,IAAA,OAAQ,KAAK,OAAA,KAAY,IAAI,4BAA4B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAChF;AACF,CAAA;AAGO,IAAM,0BAAA,GAAN,cAAyC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkB1D,MAAA,CAAO,IAAY,OAAA,EAA4C;AAC7D,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,iCAAA,EAAmC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,EAAA,EAAG,IAAK,OAAO,CAAA;AAAA,EACpJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,KAAK,OAAA,EAAoD;AACvD,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACrI;AACF,CAAA;AAGO,IAAM,+BAAA,GAAN,cAA8C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqB/D,MAAA,CAAO,QAAsC,OAAA,EAAkF;AAC7H,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,yCAAA,EAA2C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACpK;AACF,CAAA;AAGO,IAAM,yBAAA,GAAN,cAAwC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBzD,KAAK,OAAA,EAAuE;AAC1E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,gCAAA,EAAkC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC5I;AACF,CAAA;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAA,EAClD,SAAA;AAAA,EACA,SAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA,EACA,cAAA;AAAA,EACA,QAAA;AAAA,EACA,IAAI,QAAA,GAAuC;AACzC,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,2BAA2B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACjF;AAAA,EACA,IAAI,QAAA,GAAuC;AACzC,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,2BAA2B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACjF;AAAA,EACA,IAAI,GAAA,GAA6B;AAC/B,IAAA,OAAQ,KAAK,IAAA,KAAS,IAAI,sBAAsB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACvE;AAAA,EACA,IAAI,QAAA,GAAuC;AACzC,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,2BAA2B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACjF;AAAA,EACA,IAAI,aAAA,GAAiD;AACnD,IAAA,OAAQ,KAAK,cAAA,KAAmB,IAAI,gCAAgC,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC3F;AAAA,EACA,IAAI,OAAA,GAAqC;AACvC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,0BAA0B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,cAAA,CAAe,QAAkC,OAAA,EAA4C;AAC3F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,mCAAA,EAAqC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC9J;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,cAAc,OAAA,EAA4C;AACxD,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAClI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,aAAa,OAAA,EAA4C;AACvD,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,0BAAA,EAA4B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACzI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,YAAY,OAAA,EAA2E;AACrF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,+BAAA,EAAiC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC3I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,SAAS,OAAA,EAAuE;AAC9E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC/H;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAA,CAAO,QAA2B,OAAA,EAA8E;AAC9G,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC/I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,YAAA,CAAa,QAAgC,OAAA,EAAuE;AAClH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,4BAA4B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,SAAS,MAAM,CAAA,IAAK,OAAO,CAAA;AAAA,EAC/J;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,OAAA,EAA0D;AACpE,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACrI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAW,OAAA,EAAuE;AAChF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC/H;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAa,OAAA,EAAoD;AAC/D,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACrI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAA,CAAc,IAAY,OAAA,EAA4C;AACpE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,iCAAA,EAAmC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,EAAA,EAAG,IAAK,OAAO,CAAA;AAAA,EACpJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAA,CAAc,QAA2B,OAAA,EAA8E;AACrH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC/I;AACF,CAAA;AAGO,IAAM,2BAAA,GAAN,cAA0C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsB3D,OAAA,CAAQ,QAAoC,OAAA,EAAqF;AAC/H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,4CAA4C,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACnL;AACF,CAAA;AAGO,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAA,EACnD,SAAA;AAAA,EACA,IAAI,QAAA,GAAwC;AAC1C,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,4BAA4B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,QAA2B,OAAA,EAA6E;AAC7G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,kCAAkC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,OAAA,CAAQ,QAA4B,OAAA,EAA2E;AAC7G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,mCAAmC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC1K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,QAAA,CAAS,QAA6B,OAAA,EAAiF;AACrH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,qCAAqC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC5K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,QAA2B,OAAA,EAA2E;AAC3G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,kCAAkC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,gBAAA,CAAiB,QAAqC,OAAA,EAAqF;AACzI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,yCAAyC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAChL;AACF,CAAA;AAGO,IAAM,qBAAA,GAAN,cAAoC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBrD,UAAA,CAAW,QAAkC,OAAA,EAAwE;AACnH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,iCAAA,EAAmC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC5J;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,KAAA,CAAM,QAA4B,OAAA,EAAwE;AACxG,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAAA,CAAkB,QAA4B,OAAA,EAAwE;AACpH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AACF,CAAA;AAGO,IAAM,uBAAA,GAAN,cAAsC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBvD,OAAA,CAAQ,QAAiC,OAAA,EAAqF;AAC5H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,uCAAuC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC9K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,QAA+B,OAAA,EAA2E;AAC/G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,sCAAsC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC7K;AACF,CAAA;AAGO,IAAM,2BAAA,GAAN,cAA0C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkB3D,MAAA,CAAO,QAAgD,OAAA,EAAqF;AAC1I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,oCAAoC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC/K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAA,CAAO,eAAuB,OAAA,EAA4C;AACxE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,mDAAA,EAAqD,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,gBAAgB,aAAA,EAAc,IAAK,OAAO,CAAA;AAAA,EACjM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,KAAK,OAAA,EAAkG;AACrG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,kCAAA,EAAoC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC9I;AACF,CAAA;AAGO,IAAM,qBAAA,GAAN,cAAoC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBrD,MAAA,CAAO,QAA0C,OAAA,EAA0E;AACzH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,wCAAA,EAA0C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC5K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,IAAA,CAAK,QAAyC,OAAA,EAAuD;AACnG,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACpJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,QAAA,CAAS,UAAkB,OAAA,EAAyF;AAClH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,wCAAA,EAA0C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,QAAA,EAAkB,MAAA,EAA2C,OAAA,EAA0E;AAC5I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,0CAA0C,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACzL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,iBAAA,CAAkB,QAAA,EAAkB,MAAA,EAAqD,OAAA,EAAyG;AAChM,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,sDAAsD,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACnM;AACF,CAAA;AAGO,IAAM,mCAAA,GAAN,cAAkD,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBnE,SAAS,OAAA,EAAiF;AACxF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,uCAAA,EAAyC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACnJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,QAAyD,OAAA,EAAiF;AAC/I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,yCAAyC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACnL;AACF,CAAA;AAGO,IAAM,6BAAA,GAAN,cAA4C,WAAA,CAAY;AAAA,EAC7D,OAAA;AAAA,EACA,IAAI,MAAA,GAA8C;AAChD,IAAA,OAAQ,KAAK,OAAA,KAAY,IAAI,oCAAoC,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,QAAoC,OAAA,EAAoF;AAC7H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,kCAAkC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC7K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,OAAe,OAAA,EAA4C;AAChE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,yCAAA,EAA2C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,QAAQ,KAAA,EAAM,IAAK,OAAO,CAAA;AAAA,EACvK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,UAAA,CAAW,QAAwC,OAAA,EAAuF;AACxI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,2CAAA,EAA6C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACtK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,IAAA,CAAK,QAAiD,OAAA,EAAuD;AAC3G,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,gCAAA,EAAkC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACxJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,KAAA,EAAe,MAAA,EAAqC,OAAA,EAAoF;AAC7I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,gDAAA,EAAkD,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,QAAQ,KAAA,EAAM,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC5M;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAA,CAAO,OAAe,OAAA,EAAgF;AACpG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,gDAAA,EAAkD,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,QAAQ,KAAA,EAAM,IAAK,OAAO,CAAA;AAAA,EAC3K;AACF,CAAA;AAGO,IAAM,8BAAA,GAAN,cAA6C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsB9D,MAAA,CAAO,QAAA,EAAkB,MAAA,EAAkD,OAAA,EAAgF;AACzJ,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,4CAAA,EAA8C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,WAAW,QAAA,EAAS,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC9M;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAA,CAAO,QAAA,EAAkB,QAAA,EAAkB,OAAA,EAA4C;AACrF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,QAAA,EAAU,IAAA,EAAM,0DAA0D,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,SAAA,EAAW,QAAA,EAAU,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACjN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,IAAA,CAAK,QAAA,EAAkB,MAAA,EAAiD,OAAA,EAAuD;AAC7H,IAAA,OAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,8CAA8C,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,SAAA,EAAW,QAAA,IAAY,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACzL;AACF,CAAA;AAGO,IAAM,8BAAA,GAAN,cAA6C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmB9D,MAAA,CAAO,QAAA,EAAkB,MAAA,EAAkD,OAAA,EAA+E;AACxJ,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,4CAAA,EAA8C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,WAAW,QAAA,EAAS,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC9M;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAA,CAAO,QAAA,EAAkB,SAAA,EAAmB,OAAA,EAA4C;AACtF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,QAAA,EAAU,IAAA,EAAM,2DAA2D,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,SAAA,EAAW,QAAA,EAAU,YAAY,SAAA,EAAU,IAAK,OAAO,CAAA;AAAA,EACpN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,IAAA,CAAK,QAAA,EAAkB,MAAA,EAAiD,OAAA,EAAmE;AACzI,IAAA,OAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,8CAA8C,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,SAAA,EAAW,QAAA,IAAY,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACzL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,QAAA,EAAkB,SAAA,EAAmB,MAAA,EAAkD,OAAA,EAAsF;AAClL,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,yDAAA,EAA2D,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,WAAW,QAAA,EAAU,UAAA,EAAY,WAAU,EAAG,IAAA,EAAM,MAAA,EAAO,EAAG,OAAO,CAAA;AAAA,EACjO;AACF,CAAA;AAGO,IAAM,uBAAA,GAAN,cAAsC,WAAA,CAAY;AAAA,EACvD,QAAA;AAAA,EACA,QAAA;AAAA,EACA,IAAI,OAAA,GAA0C;AAC5C,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,+BAA+B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACpF;AAAA,EACA,IAAI,OAAA,GAA0C;AAC5C,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,+BAA+B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,QAA4C,OAAA,EAA4E;AAC7H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,0BAA0B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,oCAAA,EAAsC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACxK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,IAAA,CAAK,QAA2C,OAAA,EAAyD;AACvG,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,wBAAA,EAA0B,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EAChJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,QAAA,CAAS,UAAkB,OAAA,EAA4E;AACrG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,oCAAA,EAAsC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,QAAA,EAAkB,MAAA,EAA6C,OAAA,EAA4E;AAChJ,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,sCAAsC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACrL;AACF,CAAA;AAGO,IAAM,4BAAA,GAAN,cAA2C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuB5D,MAAA,CAAO,MAAA,EAAgB,MAAA,EAAkC,OAAA,EAAkF;AACzI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,wCAAA,EAA0C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,SAAS,MAAA,EAAO,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EACtM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,MAAA,EAAgB,QAAA,EAAkB,OAAA,EAA4C;AACnF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,QAAA,EAAU,IAAA,EAAM,sDAAsD,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,OAAA,EAAS,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACzM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,IAAA,CAAK,QAAgB,OAAA,EAAwE;AAC3F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,wCAAA,EAA0C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACrK;AACF,CAAA;AAGO,IAAM,qBAAA,GAAN,cAAoC,WAAA,CAAY;AAAA,EACrD,QAAA;AAAA,EACA,IAAI,OAAA,GAAwC;AAC1C,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,6BAA6B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,QAA4B,OAAA,EAAsF;AACvH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,QAAgB,OAAA,EAA4C;AACjE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,sCAAA,EAAwC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACtK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,IAAA,CAAK,QAA2B,OAAA,EAA+D;AAC7F,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACpJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,QAAA,CAAS,QAAgB,OAAA,EAAkF;AACzG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,sCAAA,EAAwC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACnK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,MAAA,EAAgB,MAAA,EAA6B,OAAA,EAAkF;AACpI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,wCAAwC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,OAAA,EAAS,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACnL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgC,OAAA,EAAyF;AAClJ,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,6CAA6C,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,OAAA,EAAS,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACxL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,YAAA,CAAa,MAAA,EAAgB,MAAA,EAAkC,OAAA,EAAkF;AAC/I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,+CAA+C,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,OAAA,EAAS,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC1L;AACF,CAAA;AAGO,IAAM,sBAAA,GAAN,cAAqC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBtD,SAAA,CAAU,QAAkC,OAAA,EAAuE;AACjH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,4BAA4B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACnK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,cAAA,CAAe,QAAsC,OAAA,EAA4E;AAC/H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,kCAAkC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,KAAA,CAAM,QAA8B,OAAA,EAAoE;AACtG,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,yBAAyB,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAChK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,QAA8B,OAAA,EAAoE;AACvG,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,yBAAyB,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAChK;AACF,CAAA;AAGO,IAAM,yBAAA,GAAN,cAAwC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBzD,KAAK,OAAA,EAAkE;AACrE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,mCAAA,EAAqC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC7J;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,oBAAoB,OAAA,EAAiF;AACnG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,8CAAA,EAAgD,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACxK;AACF,CAAA;AAGO,IAAM,YAAA,GAAN,cAA2B,WAAA,CAAY;AAAA,EAC5C,KAAA;AAAA,EACA,GAAA;AAAA,EACA,IAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,MAAA;AAAA,EACA,cAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA;AAAA,EAEA,IAAI,IAAA,GAA6B;AAC/B,IAAA,OAAQ,KAAK,KAAA,KAAU,IAAI,qBAAqB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACvE;AAAA,EACA,IAAI,EAAA,GAAyB;AAC3B,IAAA,OAAQ,KAAK,GAAA,KAAQ,IAAI,mBAAmB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACnE;AAAA,EACA,IAAI,GAAA,GAA2B;AAC7B,IAAA,OAAQ,KAAK,IAAA,KAAS,IAAI,oBAAoB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACrE;AAAA,EACA,IAAI,KAAA,GAA+B;AACjC,IAAA,OAAQ,KAAK,MAAA,KAAW,IAAI,sBAAsB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACzE;AAAA,EACA,IAAI,OAAA,GAAmC;AACrC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,wBAAwB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC7E;AAAA,EACA,IAAI,WAAA,GAA2C;AAC7C,IAAA,OAAQ,KAAK,YAAA,KAAiB,IAAI,4BAA4B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACrF;AAAA,EACA,IAAI,KAAA,GAA+B;AACjC,IAAA,OAAQ,KAAK,MAAA,KAAW,IAAI,sBAAsB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACzE;AAAA,EACA,IAAI,aAAA,GAA+C;AACjD,IAAA,OAAQ,KAAK,cAAA,KAAmB,IAAI,8BAA8B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACzF;AAAA,EACA,IAAI,OAAA,GAAmC;AACrC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,wBAAwB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC7E;AAAA,EACA,IAAI,KAAA,GAA+B;AACjC,IAAA,OAAQ,KAAK,MAAA,KAAW,IAAI,sBAAsB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACzE;AAAA,EACA,IAAI,MAAA,GAAiC;AACnC,IAAA,OAAQ,KAAK,OAAA,KAAY,IAAI,uBAAuB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC3E;AAAA,EACA,IAAI,SAAA,GAAuC;AACzC,IAAA,OAAQ,KAAK,UAAA,KAAe,IAAI,0BAA0B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,YAAA,CAAa,QAA8B,OAAA,EAAkF;AAC3H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,qCAAqC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC5K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,kBAAA,CAAmB,QAAoC,OAAA,EAA2E;AAChI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,4CAA4C,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACnL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,oBAAA,CAAqB,QAAsC,OAAA,EAAsE;AAC/H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,sCAAsC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC7K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,QAAwB,OAAA,EAA4C;AACzE,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,OAAA,CAAQ,QAAyB,OAAA,EAA2E;AAC1G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,+BAA+B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACtK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,oBAAA,CAAqB,QAAuC,OAAA,EAA+E;AACzI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,4CAAA,EAA8C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACvK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,mBAAA,CAAoB,QAAsC,OAAA,EAA+E;AACvI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,0CAAA,EAA4C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,aAAA,CAAc,QAA+B,OAAA,EAA4C;AACvF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,sCAAsC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC7K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,sBAAA,CAAuB,QAAwC,OAAA,EAAkF;AAC/I,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,+CAAA,EAAiD,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC1K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoCA,qBAAA,CAAsB,QAAuC,OAAA,EAAkF;AAC7I,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,6CAAA,EAA+C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACxK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,QAAwB,OAAA,EAA4E;AACzG,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,kBAAA,CAAmB,QAAA,EAAkB,MAAA,EAAoC,OAAA,EAAwF;AAC/J,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,wCAAwC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,QAAA,EAAS,EAAG,MAAM,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EACzL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2BA,MAAA,CAAO,QAAwB,OAAA,EAA4E;AACzG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACvJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,YAAA,CAAa,QAA8B,OAAA,EAA2E;AACpH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,mCAAA,EAAqC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC9J;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,WAAA,CAAY,QAA6B,OAAA,EAA4E;AACnH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AACF,CAAA;;;AC12KO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EACxB,IAAA;AAAA,EAEhB,WAAA,CAAY,IAAA,EAAc,OAAA,EAAiB,OAAA,EAA+B;AACxE,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAGO,IAAM,eAAA,GAAN,cAA8B,cAAA,CAAe;AAAA,EAClD,WAAA,CAAY,SAAiB,OAAA,EAA+B;AAC1D,IAAA,KAAA,CAAM,iBAAA,EAAmB,SAAS,OAAO,CAAA;AACzC,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EACd;AACF;AAGO,IAAM,eAAA,GAAN,cAA8B,cAAA,CAAe;AAAA,EAClC,SAAA;AAAA,EAChB,WAAA,CAAY,OAAA,EAAiB,SAAA,EAAkB,OAAA,EAA+B;AAC5E,IAAA,KAAA,CAAM,iBAAA,EAAmB,SAAS,OAAO,CAAA;AACzC,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AACF;AAGO,IAAM,mBAAA,GAAN,cAAkC,cAAA,CAAe;AAAA,EACtD,WAAA,CAAY,SAAiB,OAAA,EAA+B;AAC1D,IAAA,KAAA,CAAM,uBAAA,EAAyB,SAAS,OAAO,CAAA;AAC/C,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAOO,IAAM,oBAAA,GAAN,cAAmC,cAAA,CAAe;AAAA,EACvD,WAAA,CAAY,OAAA,GAAU,gDAAA,EAAkD,OAAA,EAA+B;AACrG,IAAA,KAAA,CAAM,uBAAA,EAAyB,SAAS,OAAO,CAAA;AAC/C,IAAA,IAAA,CAAK,IAAA,GAAO,sBAAA;AAAA,EACd;AACF;AAGO,IAAM,sBAAA,GAAN,cAAqC,cAAA,CAAe;AAAA,EACzD,WAAA,CAAY,SAAiB,OAAA,EAA+B;AAC1D,IAAA,KAAA,CAAM,sBAAA,EAAwB,SAAS,OAAO,CAAA;AAC9C,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AAAA,EACd;AACF;AAGO,IAAM,wBAAA,GAAN,cAAuC,cAAA,CAAe;AAAA,EAC3D,WAAA,CAAY,SAAiB,OAAA,EAA+B;AAC1D,IAAA,KAAA,CAAM,sBAAA,EAAwB,SAAS,OAAO,CAAA;AAC9C,IAAA,IAAA,CAAK,IAAA,GAAO,0BAAA;AAAA,EACd;AACF;AAGO,IAAM,oBAAA,GAAN,cAAmC,cAAA,CAAe;AAAA,EACvC,GAAA;AAAA,EAChB,WAAA,CAAY,KAAyB,OAAA,EAA+B;AAClE,IAAA,KAAA;AAAA,MACE,wBAAA;AAAA,MACA,CAAA,6BAAA,EAAgC,OAAO,WAAW,CAAA,CAAA;AAAA,MAClD;AAAA,KACF;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,sBAAA;AACZ,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AAAA,EACb;AACF;AAGO,IAAM,cAAA,GAAN,cAA6B,cAAA,CAAe;AAAA,EACjD,WAAA,CAAY,SAAiB,OAAA,EAA+B;AAC1D,IAAA,KAAA,CAAM,gBAAA,EAAkB,SAAS,OAAO,CAAA;AACxC,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AAAA,EACd;AACF;;;AC/CO,IAAM,YAAN,MAAgB;AAAA,EACL,GAAA;AAAA,EACC,KAAA;AAAA,EAEjB,YAAY,OAAA,EAA2B;AACrC,IAAA,IAAA,CAAK,MAAM,OAAA,CAAQ,GAAA;AAKnB,IAAA,MAAM,QAAA,GAA6C;AAAA,MACjD,WAAA,EAAa,OAAA,CAAQ,KAAA,IAAS,EAAA,GAAK,EAAA,GAAK,GAAA;AAAA,MACxC,gBAAA,EAAkB,QAAQ,UAAA,IAAc,GAAA;AAAA,MACxC,eAAA,EAAiB,QAAQ,SAAA,IAAa;AAAA,KACxC;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,QAAA,CAAS,WAAW,IAAI,OAAA,CAAQ,KAAA;AAAA,IAClC;AACA,IAAA,IAAA,CAAK,KAAA,GAAQ,kBAAA;AAAA,MACX,OAAA,CAAQ,GAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQS,MAAA,GAAuB,OAAO,MAAA,EAAQ,KAAA,KAAU;AACvD,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAA;AAAA,IACvC,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAeA,OAAW,iBAAA,EAAmB;AAC/C,QAAA,MAAM,IAAI,oBAAA,CAAqB,MAAA,EAAQ,KAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,MAC5D;AACA,MAAA,IACE,GAAA,YAAeA,OAAW,WAAA,IAC1B,GAAA,YAAeA,OAAW,WAAA,IAC1B,GAAA,YAAeA,OAAW,SAAA,EAC1B;AACA,QAAA,MAAM,IAAI,cAAA;AAAA,UACR,4BAA4B,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,EAAA,EAAK,IAAI,OAAO,CAAA,CAAA;AAAA,UACzD,EAAE,OAAO,GAAA;AAAI,SACf;AAAA,MACF;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAA,GAAgB;AAAA,EAKhB;AACF;ACzBO,SAAS,eAAe,MAAA,EAA6D;AAC1F,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,OAAO,MAAA,CAAO,SAAA,KAAc,SAAA,IAAa,MAAA,CAAO,IAAA,KAAS,SAAA;AAC3D;AAcA,eAAsB,eAAA,CACpB,KAAA,EACA,MAAA,EACA,IAAA,GAAsB,EAAC,EACF;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,SAAA,CAAU,OAAO,MAAA,EAAQ;AAAA,MACjD,YAAY,IAAA,CAAK,UAAA,IAAc,CAAC,OAAA,EAAS,SAAS,OAAO,CAAA;AAAA,MACzD,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,cAAA,EAAgB,KAAK,cAAA,IAAkB,CAAA;AAAA,MACvC,gBAAgB,IAAA,CAAK,cAAA;AAAA,MACrB,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,aAAa,IAAA,CAAK;AAAA,KACnB,CAAA;AACD,IAAA,IAAI,cAAA,CAAe,OAAO,CAAA,EAAG,MAAM,IAAI,oBAAA,EAAqB;AAC5D,IAAA,OAAO,OAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,mBAAmB,GAAG,CAAA;AAAA,EAC9B;AACF;AAEA,SAAS,mBAAmB,GAAA,EAA8B;AAGxD,EAAA,IACE,GAAA,YAAe,oBAAA,IACf,GAAA,YAAe,cAAA,IACf,eAAe,cAAA,EACf;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAIA,EAAA,MAAM,IAAA,GAAQ,KAAuC,IAAA,IAAQ,EAAA;AAC7D,EAAA,MAAM,OAAA,GAAW,KAA2B,OAAA,IAAW,yBAAA;AAEvD,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,iBAAA;AACH,MAAA,OAAO,IAAI,eAAA,CAAgB,OAAA,EAAS,QAAW,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,IAC/D,KAAK,iCAAA,EAAmC;AAEtC,MAAA,MAAM,QAAS,GAAA,EAAwC,KAAA;AACvD,MAAA,IAAI,KAAA,KAAU,OAAO,OAAO,IAAI,uBAAuB,OAAA,EAAS,EAAE,KAAA,EAAO,GAAA,EAAK,CAAA;AAC9E,MAAA,IAAI,KAAA,KAAU,OAAO,OAAO,IAAI,yBAAyB,OAAA,EAAS,EAAE,KAAA,EAAO,GAAA,EAAK,CAAA;AAChF,MAAA,IAAI,KAAA,KAAU,OAAO,OAAO,IAAI,oBAAoB,OAAA,EAAS,EAAE,KAAA,EAAO,GAAA,EAAK,CAAA;AAC3E,MAAA,OAAO,IAAI,eAAA,CAAgB,OAAA,EAAS,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,IACpD;AAAA,IACA,KAAK,uCAAA;AAAA,IACL,KAAK,iBAAA;AAAA,IACL,KAAK,iBAAA;AACH,MAAA,OAAO,IAAI,eAAA,CAAgB,OAAA,EAAS,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,IACpD;AACE,MAAA,OAAO,IAAI,eAAA,CAAgB,OAAA,EAAS,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA;AAExD;;;AC7HO,SAAS,OAAO,GAAA,EAA4C;AACjE,EAAA,MAAM,KAAA,GACJ,GAAA,YAAe,WAAA,GACX,IAAI,WAAW,GAAG,CAAA,GAClB,IAAI,UAAA,CAAW,GAAA,CAAI,MAAA,EAAQ,GAAA,CAAI,UAAA,EAAY,IAAI,UAAU,CAAA;AAG/D,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,IAAO,MAAA,CAAO,YAAA,CAAa,KAAA,CAAM,CAAC,CAAE,CAAA;AAC3E,EAAA,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC5E;AAGO,SAAS,SAAS,CAAA,EAAuB;AAC9C,EAAA,MAAM,GAAA,GAAM,EAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAClD,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,MAAA,GAAS,CAAC,CAAA,GAAI,CAAA,EAAG,GAAG,CAAC,CAAA;AAC/D,EAAA,OAAO,UAAA,CAAW,KAAK,GAAA,EAAK,CAAC,MAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAC,CAAA;AACpD;AAgBA,IAAM,YAAA,GAAe,CAAC,CAAA,KACpB,CAAA,CAAE,OAAA,CAAQ,cAAA,EAAgB,CAAC,CAAA,EAAG,CAAA,KAAc,CAAA,CAAE,WAAA,EAAa,CAAA;AAW7D,SAAS,aAAa,KAAA,EAAyB;AAC7C,EAAA,IAAI,MAAM,OAAA,CAAQ,KAAK,GAAG,OAAO,KAAA,CAAM,IAAI,YAAY,CAAA;AACvD,EAAA,IAAI,SAAS,OAAO,KAAA,KAAU,QAAA,IAAY,EAAE,iBAAiB,UAAA,CAAA,EAAa;AACxE,IAAA,MAAM,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAgC,CAAA,EAAG;AACrE,MAAA,GAAA,CAAI,YAAA,CAAa,CAAC,CAAC,CAAA,GAAI,aAAa,CAAC,CAAA;AAAA,IACvC;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT;AA0BO,SAAS,cACd,SAAA,EACuB;AACvB,EAAA,MAAM,EAAA,GAAK,aAAa,SAAoC,CAAA;AAC5D,EAAA,MAAM,GAAA,GAA+B;AAAA,IACnC,GAAG,EAAA;AAAA,IACH,SAAA,EAAW,QAAA,CAAS,EAAA,CAAG,SAAS;AAAA,GAClC;AACA,EAAA,IAAI,GAAG,IAAA,EAAM;AACX,IAAA,GAAA,CAAI,IAAA,GAAO,EAAE,GAAG,EAAA,CAAG,IAAA,EAAM,IAAI,QAAA,CAAS,EAAA,CAAG,IAAA,CAAK,EAAE,CAAA,EAAE;AAAA,EACpD;AACA,EAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,oBAAA,EAAsB,kBAAkB,CAAA,EAAY;AACtE,IAAA,MAAM,OAAA,GAAU,GAAG,IAAI,CAAA;AACvB,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,GAAA,CAAI,IAAI,CAAA,GAAI,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,MAAO,EAAE,GAAG,CAAA,EAAG,EAAA,EAAI,QAAA,CAAS,CAAA,CAAE,EAAE,GAAE,CAAE,CAAA;AAAA,IAC/D;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAwCO,SAAS,iBACd,IAAA,EAC0B;AAC1B,EAAA,MAAM,IAAI,IAAA,CAAK,QAAA;AACf,EAAA,MAAM,QAAA,GAAiD;AAAA,IACrD,cAAA,EAAgB,MAAA,CAAO,CAAA,CAAE,cAAc;AAAA,GACzC;AACA,EAAA,IAAI,EAAE,iBAAA,EAAmB,QAAA,CAAS,iBAAA,GAAoB,MAAA,CAAO,EAAE,iBAAiB,CAAA;AAChF,EAAA,IAAI,EAAE,iBAAA,EAAmB,QAAA,CAAS,iBAAA,GAAoB,MAAA,CAAO,EAAE,iBAAiB,CAAA;AAChF,EAAA,IAAI,EAAE,SAAA,EAAW,QAAA,CAAS,SAAA,GAAY,MAAA,CAAO,EAAE,SAAS,CAAA;AACxD,EAAA,IAAI,EAAE,UAAA,EAAY,QAAA,CAAS,UAAA,GAAa,MAAA,CAAO,EAAE,UAAU,CAAA;AAC3D,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,CAAK,EAAA,EAAI,QAAA,EAAS;AACjC;AA+CO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtB,IAAA;AAAA,EACS,KAAA;AAAA,EAEzB,WAAA,CAAY,IAAA,EAAwB,OAAA,EAAiB,KAAA,EAAiB;AACpE,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AAEA,SAAS,kBAAA,GAA8D;AACrE,EAAA,MAAM,MAAO,UAAA,CAAyD,SAAA;AACtE,EAAA,MAAM,QAAQ,GAAA,EAAK,WAAA;AACnB,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA,CAAM,WAAW,UAAA,IAAc,OAAO,KAAA,CAAM,GAAA,KAAQ,UAAA,EAAY;AACnF,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT;AASO,SAAS,kBAAA,GAA8B;AAC5C,EAAA,MAAM,CAAA,GAAI,UAAA;AAKV,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC5C,EAAA,IAAI,OAAO,CAAA,CAAE,mBAAA,KAAwB,UAAA,EAAY,OAAO,KAAA;AACxD,EAAA,IAAI,CAAA,CAAE,eAAA,KAAoB,KAAA,EAAO,OAAO,KAAA;AACxC,EAAA,OAAO,oBAAmB,KAAM,MAAA;AAClC;AAEA,SAAS,YAAY,GAAA,EAA4B;AAC/C,EAAA,MAAM,OAAQ,GAAA,EAAkC,IAAA;AAChD,EAAA,MAAM,OAAA,GAAW,GAAA,EAAqC,OAAA,IAAW,MAAA,CAAO,GAAG,CAAA;AAC3E,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,iBAAA;AACH,MAAA,OAAO,IAAI,YAAA;AAAA,QACT,WAAA;AAAA,QACA,mEAAmE,OAAO,CAAA,CAAA;AAAA,QAC1E;AAAA,OACF;AAAA,IACF,KAAK,mBAAA;AACH,MAAA,OAAO,IAAI,YAAA,CAAa,eAAA,EAAiB,CAAA,uBAAA,EAA0B,OAAO,IAAI,GAAG,CAAA;AAAA,IACnF,KAAK,eAAA;AACH,MAAA,OAAO,IAAI,YAAA;AAAA,QACT,UAAA;AAAA,QACA,+CAA+C,OAAO,CAAA,CAAA;AAAA,QACtD;AAAA,OACF;AAAA,IACF,KAAK,YAAA;AACH,MAAA,OAAO,IAAI,YAAA,CAAa,WAAA,EAAa,CAAA,0BAAA,EAA6B,OAAO,IAAI,GAAG,CAAA;AAAA,IAClF,KAAK,cAAA;AACH,MAAA,OAAO,IAAI,YAAA;AAAA,QACT,SAAA;AAAA,QACA,8DAA8D,OAAO,CAAA,CAAA;AAAA,QACrE;AAAA,OACF;AAAA,IACF;AACE,MAAA,OAAO,IAAI,YAAA,CAAa,SAAA,EAAW,CAAA,8BAAA,EAAiC,OAAO,IAAI,GAAG,CAAA;AAAA;AAExF;AAmBO,SAAS,kBAAA,CACd,IAAA,GAA8B,EAAC,EACF;AAC7B,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,IAAe,kBAAA,EAAmB;AACrD,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,aAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,iBAAiB,KAAA,EAAgD;AACxE,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,UAAU,OAAO,KAAA;AAChD,EAAA,MAAM,CAAA,GAAI,KAAA;AACV,EAAA,OAAO,OAAO,CAAA,CAAE,EAAA,KAAO,QAAA,IAAY,CAAC,CAAC,CAAA,CAAE,QAAA,IAAY,OAAO,CAAA,CAAE,QAAA,KAAa,QAAA;AAC3E;AAOA,eAAsB,uBAAA,CACpB,SAAA,EACA,IAAA,GAA8B,EAAC,EACI;AACnC,EAAA,MAAM,KAAA,GAAQ,mBAAmB,IAAI,CAAA;AACrC,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,KAAA,CAAM,MAAA,CAAO,EAAE,SAAA,EAAW,aAAA,CAAc,SAAS,CAAA,EAAG,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,CAAA;AAAA,EACxF,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,YAAY,GAAG,CAAA;AAAA,EACvB;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAI,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,eAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,iBAAiB,IAAI,CAAA;AAC9B;AAOA,eAAsB,oBAAA,CACpB,SAAA,EACA,IAAA,GAAiE,EAAC,EAC/B;AACnC,EAAA,MAAM,KAAA,GAAQ,mBAAmB,IAAI,CAAA;AACrC,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,MAAM,GAAA,CAAI;AAAA,MACrB,SAAA,EAAW,cAAc,SAAS,CAAA;AAAA,MAClC,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,YAAY,GAAG,CAAA;AAAA,EACvB;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAI,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,eAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,iBAAiB,IAAI,CAAA;AAC9B;;;ACvWO,IAAM,kBAAA,GAAqB;AAY3B,SAAS,cAAA,CAAe,SAAiB,OAAA,EAAiB;AAC/D,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,OAAO,CAAA;AAC9B,EAAA,MAAA,CAAO,QAAA,GAAW,IAAI,OAAO,CAAA,CAAA;AAC7B,EAAA,MAAM,iBAAiB,MAAA,CAAO,QAAA,EAAS,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC1D,EAAA,OAAO;AAAA,IACL,cAAA;AAAA,IACA,gBAAA,EAAkB,OAAA;AAAA,IAClB,eAAA,EAAiB,CAAC,cAAA,EAAgB,kBAAkB,CAAA;AAAA,IACpD,SAAS,IAAI,GAAA,CAAI,CAAA,CAAA,EAAI,OAAO,0BAA0B,OAAO;AAAA,GAC/D;AACF;AAGA,IAAM,IAAA,GAAO,CAAC,UAAA,MAA0C,EAAE,EAAA,EAAI,UAAA,CAAW,EAAA,EAAI,QAAA,EAAU,EAAE,GAAG,UAAA,CAAW,QAAA,EAAS,EAAE,CAAA;AAE3G,IAAM,aAAA,GAAN,cAA4B,YAAA,CAAa;AAAA;AAAA,EAErC,OAAA;AAAA;AAAA,EAEA,cAAA;AAAA;AAAA,EAEA,gBAAA;AAAA;AAAA,EAEA,eAAA;AAAA;AAAA,EAEA,IAAA;AAAA,EAET,WAAA,CAAY,MAAA,EAAmB,KAAA,EAA6B,OAAA,GAAgC,EAAC,EAAG;AAC9F,IAAA,KAAA,CAAM,QAAQ,KAAK,CAAA;AACnB,IAAA,MAAM,GAAA,GAAM,cAAA,CAAe,MAAA,CAAO,OAAA,EAAS,MAAM,QAAQ,CAAA;AACzD,IAAA,IAAA,CAAK,UAAU,KAAA,CAAM,QAAA;AACrB,IAAA,IAAA,CAAK,iBAAiB,GAAA,CAAI,cAAA;AAC1B,IAAA,IAAA,CAAK,mBAAmB,GAAA,CAAI,gBAAA;AAC5B,IAAA,IAAA,CAAK,kBAAkB,GAAA,CAAI,eAAA;AAC3B,IAAA,IAAA,CAAK,IAAA,GAAO,OAAA,CAAQ,IAAA,IAAQ,IAAI,UAAU,EAAE,GAAA,EAAK,GAAA,CAAI,OAAA,EAAS,OAAO,OAAA,CAAQ,SAAA,EAAW,KAAA,EAAO,OAAA,CAAQ,OAAO,CAAA;AAAA,EAChH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAA,CAAY,KAAA,EAAe,IAAA,GAAsB,EAAC,EAAwB;AACxE,IAAA,OAAO,eAAA,CAAgB,KAAA,EAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ;AAAA,MAC9C,QAAQ,IAAA,CAAK,eAAA;AAAA,MACb,UAAU,IAAA,CAAK,gBAAA;AAAA,MACf,GAAG;AAAA,KACJ,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMS,QAAA,GAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMlB,MAAA,EAAQ,OAAO,IAAA,GAAmD,EAAC,KAAoC;AAErG,MAAA,MAAM,WAAA,GAAc,mBAAmB,IAAI,CAAA;AAC3C,MAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,EAAA,CAAG,IAAI,OAAA,CAAQ,MAAA,CAAO,EAAE,IAAA,EAAM,UAAA,EAAY,GAAI,IAAA,CAAK,KAAA,GAAQ,EAAE,KAAA,EAAO,IAAA,CAAK,OAAM,GAAI,IAAK,CAAA;AACjH,MAAA,MAAM,SAAA,GAAa,MAAM,UAAA,CAAwC,UAAA;AACjE,MAAA,MAAM,UAAA,GAAa,MAAM,uBAAA,CAAwB,SAAA,EAAW,EAAE,GAAG,IAAA,EAAM,aAAa,CAAA;AACpF,MAAA,OAAO,IAAA,CAAK,EAAA,CAAG,GAAA,CAAI,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,EAAA,EAAI,EAAE,UAAA,EAAY,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,IACrF,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAA,EAAQ,OACN,IAAA,GAAqF,EAAC,KACzD;AAC7B,MAAA,MAAM,WAAA,GAAc,mBAAmB,IAAI,CAAA;AAC3C,MAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,KAAK,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,SAAA,GAAY,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,EAAU,GAAI,EAAE,CAAA;AACrG,MAAA,MAAM,UAAA,GAAa,MAAM,oBAAA,CAAqB,UAAA,EAAuC,EAAE,GAAG,IAAA,EAAM,aAAa,CAAA;AAC7G,MAAA,OAAO,IAAA,CAAK,QAAQ,MAAA,CAAO,EAAE,YAAY,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,IAC7D,CAAA;AAAA;AAAA,IAGA,oBAAA,EAAsB,OACpB,IAAA,KAC6B;AAC7B,MAAA,MAAM,EAAE,SAAA,EAAW,GAAG,WAAA,EAAY,GAAI,IAAA;AACtC,MAAA,MAAM,WAAA,GAAc,mBAAmB,WAAW,CAAA;AAClD,MAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,IAAA,CAAK,IAAI,QAAA,CAAS,OAAA,CAAQ,EAAE,SAAA,EAAW,CAAA;AACpE,MAAA,MAAM,UAAA,GAAa,MAAM,oBAAA,CAAqB,UAAA,EAAuC,EAAE,GAAG,WAAA,EAAa,aAAa,CAAA;AACpH,MAAA,OAAO,IAAA,CAAK,IAAI,MAAA,CAAO,EAAE,WAAW,UAAA,EAAY,IAAA,CAAK,UAAU,CAAA,EAAG,CAAA;AAAA,IACpE,CAAA;AAAA;AAAA,IAGA,MAAA,EAAQ,OAAO,IAAA,GAAiE,EAAC,KAAyB;AACxG,MAAA,MAAM,WAAA,GAAc,mBAAmB,IAAI,CAAA;AAC3C,MAAA,MAAM,EAAE,YAAW,GAAI,MAAM,KAAK,EAAA,CAAG,GAAA,CAAI,MAAA,CAAO,QAAA,CAAS,OAAA,EAAQ;AACjE,MAAA,MAAM,UAAA,GAAa,MAAM,oBAAA,CAAqB,UAAA,EAAuC,EAAE,GAAG,IAAA,EAAM,aAAa,CAAA;AAC7G,MAAA,OAAO,IAAA,CAAK,EAAA,CAAG,GAAA,CAAI,MAAA,CAAO,MAAA,CAAO,EAAE,UAAA,EAAY,IAAA,CAAK,UAAU,CAAA,EAAG,CAAA;AAAA,IACnE;AAAA,GACF;AACF;;;ACrHO,IAAM,QAAA,GAAN,cAAuB,aAAA,CAAc;AAAA,EACjC,QAAA;AAAA,EACA,eAAA;AAAA,EACA,KAAA,uBAAY,GAAA,EAAuB;AAAA,EAE5C,WAAA,CAAY,MAAA,EAAmB,OAAA,EAAsB,UAAA,EAAmD;AACtG,IAAA,KAAA,CAAM,MAAM,CAAA;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,OAAA;AAChB,IAAA,IAAA,CAAK,kBAAkB,UAAA,CAAW,EAAE,GAAG,OAAA,EAAS,iBAAA,EAAmB,OAAO,CAAA;AAAA,EAC5E;AAAA,EAEA,OAAO,IAAA,EAAyB;AAC9B,IAAA,IAAI,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAA;AAC/B,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,eAAe,IAAA,CAAK,OAAA,CAAQ,SAAS,IAAI,CAAA;AAC7D,MAAA,KAAA,GAAQ,IAAI,SAAA,CAAU,EAAE,GAAA,EAAK,OAAA,EAAS,KAAA,EAAO,IAAA,CAAK,QAAA,CAAS,SAAA,EAAW,KAAA,EAAO,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA;AAClG,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAA,EAAM,KAAK,CAAA;AAAA,IAC5B;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAS,OAAA,EAAiC;AACxC,IAAA,MAAM,IAAA,GAAO,OAAA,IAAW,OAAA,CAAQ,eAAe,CAAA;AAC/C,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,kBAAA,CAAmB,CAAA,+CAAA,EAAkD,eAAe,CAAA,CAAA,CAAG,CAAA;AAC5G,IAAA,OAAO,IAAI,aAAA,CAAc,IAAA,CAAK,eAAA,EAAiB,EAAE,QAAA,EAAU,IAAA,EAAK,EAAG,EAAE,IAAA,EAAM,IAAA,CAAK,MAAA,CAAO,IAAI,GAAG,CAAA;AAAA,EAChG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,WAAA,CAAY,KAAA,EAAe,OAAA,GAA4C,EAAC,EAAwB;AAC9F,IAAA,MAAM,EAAE,GAAA,EAAK,GAAG,MAAA,EAAO,GAAI,OAAA;AAC3B,IAAA,OAAO,KAAK,QAAA,CAAS,GAAG,CAAA,CAAE,WAAA,CAAY,OAAO,MAAM,CAAA;AAAA,EACrD;AACF,CAAA;;;ACjDO,IAAM,eAAe,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,SAAA,EAAW,SAAS,CAAA,EAAW;AAGzE,IAAM,iBAAiB,EAAE,MAAA,EAAQ,CAAC,YAAA,EAAc,SAAA,EAAW,aAAa,CAAA,EAAW;AAGnF,IAAM,YAAY,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,WAAA,EAAa,UAAU,CAAA,EAAW;AAGzE,IAAM,kBAAkB,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,MAAM,CAAA,EAAW;AAG9D,IAAM,kBAAkB,EAAE,MAAA,EAAQ,CAAC,SAAA,EAAW,WAAA,EAAa,QAAQ,CAAA,EAAW;AAG9E,IAAM,uBAAuB,EAAE,MAAA,EAAQ,CAAC,OAAA,EAAS,MAAM,CAAA,EAAW;AAGlE,IAAM,iBAAiB,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,QAAA,EAAU,eAAe,CAAA,EAAW;AAGhF,IAAM,eAAA,GAAkB,EAAE,MAAA,EAAQ,CAAC,cAAc,CAAA,EAAW;AAG5D,IAAM,wBAAwB,EAAE,MAAA,EAAQ,CAAC,WAAA,EAAa,UAAU,CAAA,EAAW;AAG3E,IAAM,cAAc,EAAE,MAAA,EAAQ,CAAC,OAAA,EAAS,OAAO,CAAA,EAAW;AAG1D,IAAM,2BAA2B,EAAE,MAAA,EAAQ,CAAC,+BAAA,EAAiC,mBAAmB,CAAA,EAAW;AAG3G,IAAM,qBAAqB,EAAE,MAAA,EAAQ,CAAC,SAAA,EAAW,QAAA,EAAU,SAAS,CAAA,EAAW;AAG/E,IAAM,sBAAsB,EAAE,MAAA,EAAQ,CAAC,UAAA,EAAY,SAAS,CAAA,EAAW;AAGvE,IAAM,cAAc,EAAE,MAAA,EAAQ,CAAC,YAAA,EAAc,cAAc,CAAA,EAAW;AAGtE,IAAM,mBAAmB,EAAE,MAAA,EAAQ,CAAC,SAAA,EAAW,WAAW,CAAA,EAAW;AAGrE,IAAM,cAAA,GAAiB,EAAE,MAAA,EAAQ,CAAC,aAAa,aAAA,EAAe,UAAA,EAAY,UAAA,EAAY,eAAe,CAAA,EAAW;AAGhH,IAAM,gBAAgB,EAAE,MAAA,EAAQ,CAAC,OAAA,EAAS,KAAK,CAAA,EAAW;AAG1D,IAAM,gBAAgB,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,WAAA,EAAa,aAAa,CAAA,EAAW;AAGhF,IAAM,iBAAiB,EAAE,MAAA,EAAQ,CAAC,MAAA,EAAQ,OAAA,EAAS,UAAU,CAAA,EAAW;AAGxE,IAAM,eAAA,GAAkB,EAAE,MAAA,EAAQ,CAAC,UAAU,SAAA,EAAW,WAAA,EAAa,QAAQ,CAAA,EAAW;AAGxF,IAAM,wBAAwB,EAAE,MAAA,EAAQ,CAAC,KAAA,EAAO,UAAU,CAAA,EAAW;AAGrE,IAAM,MAAA,GAAS,EAAE,MAAA,EAAQ,CAAC,KAAK,CAAA,EAAW;AAG1C,IAAM,YAAY,EAAE,MAAA,EAAQ,CAAC,UAAA,EAAY,UAAU,CAAA,EAAW;AAG9D,IAAM,kBAAkB,EAAE,MAAA,EAAQ,CAAC,MAAA,EAAQ,SAAA,EAAW,QAAQ,CAAA,EAAW;AAGzE,IAAM,gBAAgB,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,QAAA,EAAU,OAAO,CAAA,EAAW;AAGvE,IAAM,sBAAsB,EAAE,MAAA,EAAQ,CAAC,KAAA,EAAO,MAAA,EAAQ,OAAO,CAAA,EAAW;AAGxE,IAAM,wBAAwB,EAAE,MAAA,EAAQ,CAAC,qBAAA,EAAuB,qBAAA,EAAuB,sBAAsB,CAAA,EAAW;AAGxH,IAAM,sBAAsB,EAAE,MAAA,EAAQ,CAAC,mBAAA,EAAqB,sBAAA,EAAwB,cAAc,CAAA,EAAW;AAG7G,IAAM,cAAA,GAAiB,EAAE,MAAA,EAAQ,CAAC,SAAS,SAAA,EAAW,UAAA,EAAY,gBAAgB,CAAA,EAAW;AAG7F,IAAM,kBAAA,GAAqB,EAAE,MAAA,EAAQ,CAAC,aAAA,EAAe,SAAA,EAAW,oBAAA,EAAsB,UAAA,EAAY,mBAAA,EAAqB,QAAA,EAAU,UAAA,EAAY,SAAA,EAAW,WAAW,CAAA,EAAW;AAG9K,IAAM,eAAe,EAAE,MAAA,EAAQ,CAAC,WAAA,EAAa,QAAQ,CAAA,EAAW;AAGhE,IAAM,aAAA,GAAgB,EAAE,MAAA,EAAQ,CAAC,QAAQ,WAAA,EAAa,SAAA,EAAW,SAAS,CAAA,EAAW;AAGrF,IAAM,eAAe,EAAE,MAAA,EAAQ,CAAC,SAAA,EAAW,cAAA,EAAgB,yBAAyB,CAAA,EAAW;AAG/F,IAAM,yBAAA,GAA4B,EAAE,MAAA,EAAQ,CAAC,YAAA,EAAc,wBAAwB,wBAAA,EAA0B,yBAAA,EAA2B,mBAAA,EAAqB,mBAAmB,CAAA,EAAW;AAG3L,IAAM,mBAAmB,EAAE,MAAA,EAAQ,CAAC,OAAA,EAAS,UAAA,EAAY,KAAK,CAAA,EAAW;AAGzE,IAAM,oBAAoB,EAAE,MAAA,EAAQ,CAAC,wBAAA,EAA0B,cAAc,CAAA,EAAW;AAGxF,IAAM,kBAAkB,EAAE,MAAA,EAAQ,CAAC,SAAA,EAAW,WAAA,EAAa,QAAQ,CAAA,EAAW;AAG9E,IAAM,gBAAA,GAAmB,EAAE,MAAA,EAAQ,CAAC,KAAK,CAAA,EAAW;AAGpD,IAAM,cAAc,EAAE,MAAA,EAAQ,CAAC,IAAA,EAAM,IAAA,EAAM,KAAK,CAAA,EAAW;AAG3D,IAAM,sBAAA,GAAyB,EAAE,MAAA,EAAQ,CAAC,UAAU,SAAA,EAAW,SAAA,EAAW,UAAU,CAAA,EAAW;AAG/F,IAAM,2BAAA,GAA8B,EAAE,MAAA,EAAQ,CAAC,UAAU,SAAA,EAAW,SAAA,EAAW,UAAA,EAAY,WAAW,CAAA,EAAW;AAGjH,IAAM,kBAAkB,EAAE,MAAA,EAAQ,CAAC,MAAA,EAAQ,MAAM,CAAA,EAAW;AAG5D,IAAM,6BAA6B,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,gBAAgB,CAAA,EAAW;AAGnF,IAAM,wBAAA,GAA2B,EAAE,MAAA,EAAQ,CAAC,UAAU,SAAA,EAAW,gBAAA,EAAkB,gBAAgB,CAAA,EAAW;AAG9G,IAAM,oBAAoB,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,SAAA,EAAW,SAAS,CAAA,EAAW;AAG9E,IAAM,kBAAA,GAAqB,EAAE,MAAA,EAAQ,CAAC,WAAW,SAAA,EAAW,SAAA,EAAW,MAAM,CAAA,EAAW;AAGxF,IAAM,eAAe,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,WAAA,EAAa,UAAU,CAAA,EAAW;AAG5E,IAAM,SAAA,GAAY,EAAE,MAAA,EAAQ,CAAC,QAAQ,CAAA,EAAW;AAGhD,IAAM,iBAAiB,EAAE,MAAA,EAAQ,CAAC,OAAA,EAAS,QAAA,EAAU,eAAe,CAAA,EAAW;AAG/E,IAAM,iBAAA,GAAoB,EAAE,MAAA,EAAQ,CAAC,oBAAoB,CAAA,EAAW;AAGpE,IAAM,cAAA,GAAiB,EAAE,MAAA,EAAQ,CAAC,YAAY,eAAA,EAAiB,gBAAA,EAAkB,MAAM,CAAA,EAAW;AAGlG,IAAM,wBAAwB,EAAE,MAAA,EAAQ,CAAC,WAAA,EAAa,QAAA,EAAU,MAAM,CAAA,EAAW;AAGjF,IAAM,gCAAgC,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,SAAS,CAAA,EAAW;AAG/E,IAAM,wBAAwB,EAAE,MAAA,EAAQ,CAAC,SAAA,EAAW,UAAA,EAAY,eAAe,CAAA,EAAW;AAG1F,IAAM,kBAAA,GAAqB,EAAE,MAAA,EAAQ,CAAC,WAAW,WAAA,EAAa,QAAA,EAAU,UAAU,CAAA,EAAW;AAM7F,IAAM,gBAAA,GAAmB,EAAE,MAAA,EAAQ,CAAC,eAAe,aAAA,EAAe,gBAAA,EAAkB,kBAAA,EAAoB,iBAAA,EAAmB,mBAAA,EAAqB,cAAA,EAAgB,uBAAA,EAAyB,qBAAA,EAAuB,iCAAiC,+BAAA,EAAiC,0BAAA,EAA4B,0BAAA,EAA4B,6BAAA,EAA+B,4BAAA,EAA8B,yBAAA,EAA2B,8BAAA,EAAgC,gCAAA,EAAkC,kBAAkB,gBAAA,EAAkB,gBAAA,EAAkB,qBAAA,EAAuB,uBAAA,EAAyB,4BAAA,EAA8B,uBAAA,EAAyB,wBAAA,EAA0B,uBAAA,EAAyB,kBAAkB,CAAA,EAAW;;;AC9KxtB,IAAM,OAAA,GAAmD,OAAA,CAAqB;AAYvE,IAAM,IAAA,GAAN,cAAmB,QAAA,CAAS;AAAA,EACjC,QAAA;AAAA,EACA,WAAA,CAAY,OAAA,GAAuB,EAAC,EAAG;AACrC,IAAA,MAAM,GAAA,GAAM,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,OAAA,EAAQ;AAC7C,IAAA,KAAA,CAAM,IAAI,SAAA,CAAU,OAAA,EAAS,WAAA,CAAY,IAAA,EAAM,GAAG,CAAA,EAAG,OAAA,EAAS,CAAC,CAAA,KAAqB,IAAI,SAAA,CAAU,CAAA,EAAG,WAAA,CAAY,IAAA,EAAM,GAAG,CAAC,CAAA;AAAA,EAC7H;AAAA;AAAA,EAEA,IAAI,MAAA,GAAwB;AAC1B,IAAA,OAAQ,IAAA,CAAK,QAAA,KAAa,mBAAA,CAA2B,IAAA,CAAK,OAAO,CAAA;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA,EAIA,IAAI,KAAA,GAAyC;AAC3C,IAAA,MAAM,SAAS,IAAA,CAAK,OAAA;AACpB,IAAA,OAAO;AAAA,MACL,GAAA,EAAK,CAAC,KAAA,KAAkB,IAAI,QAAQ,MAAA,EAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO;AAAA,KAC/D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,KAAA,EAAwB;AAC1B,IAAA,OAAO,IAAI,OAAA,CAAQ,IAAA,CAAK,SAAS,EAAE,MAAA,EAAQ,OAAO,CAAA;AAAA,EACpD;AACF;AAAA,CAgbO,CAAUC,KAAAA,KAAV;AAIE,EAAMA,MAAA,YAAA,GAAiB,YAAA;AAEvB,EAAMA,MAAA,cAAA,GAAmB,cAAA;AAEzB,EAAMA,MAAA,SAAA,GAAc,SAAA;AAEpB,EAAMA,MAAA,eAAA,GAAoB,eAAA;AAE1B,EAAMA,MAAA,eAAA,GAAoB,eAAA;AAE1B,EAAMA,MAAA,oBAAA,GAAyB,oBAAA;AAE/B,EAAMA,MAAA,cAAA,GAAmB,cAAA;AAEzB,EAAMA,MAAA,eAAA,GAAoB,eAAA;AAE1B,EAAMA,MAAA,qBAAA,GAA0B,qBAAA;AAEhC,EAAMA,MAAA,WAAA,GAAgB,WAAA;AAEtB,EAAMA,MAAA,wBAAA,GAA6B,wBAAA;AAEnC,EAAMA,MAAA,kBAAA,GAAuB,kBAAA;AAE7B,EAAMA,MAAA,mBAAA,GAAwB,mBAAA;AAE9B,EAAMA,MAAA,WAAA,GAAgB,WAAA;AAEtB,EAAMA,MAAA,gBAAA,GAAqB,gBAAA;AAE3B,EAAMA,MAAA,cAAA,GAAmB,cAAA;AAEzB,EAAMA,MAAA,aAAA,GAAkB,aAAA;AAExB,EAAMA,MAAA,aAAA,GAAkB,aAAA;AAExB,EAAMA,MAAA,cAAA,GAAmB,cAAA;AAEzB,EAAMA,MAAA,eAAA,GAAoB,eAAA;AAE1B,EAAMA,MAAA,qBAAA,GAA0B,qBAAA;AAEhC,EAAMA,MAAA,MAAA,GAAW,MAAA;AAEjB,EAAMA,MAAA,SAAA,GAAc,SAAA;AAEpB,EAAMA,MAAA,eAAA,GAAoB,eAAA;AAE1B,EAAMA,MAAA,aAAA,GAAkB,aAAA;AAExB,EAAMA,MAAA,mBAAA,GAAwB,mBAAA;AAE9B,EAAMA,MAAA,qBAAA,GAA0B,qBAAA;AAEhC,EAAMA,MAAA,mBAAA,GAAwB,mBAAA;AAE9B,EAAMA,MAAA,cAAA,GAAmB,cAAA;AAEzB,EAAMA,MAAA,kBAAA,GAAuB,kBAAA;AAE7B,EAAMA,MAAA,YAAA,GAAiB,YAAA;AAEvB,EAAMA,MAAA,aAAA,GAAkB,aAAA;AAExB,EAAMA,MAAA,YAAA,GAAiB,YAAA;AAEvB,EAAMA,MAAA,yBAAA,GAA8B,yBAAA;AAEpC,EAAMA,MAAA,gBAAA,GAAqB,gBAAA;AAE3B,EAAMA,MAAA,iBAAA,GAAsB,iBAAA;AAE5B,EAAMA,MAAA,eAAA,GAAoB,eAAA;AAE1B,EAAMA,MAAA,gBAAA,GAAqB,gBAAA;AAE3B,EAAMA,MAAA,WAAA,GAAgB,WAAA;AAEtB,EAAMA,MAAA,sBAAA,GAA2B,sBAAA;AAEjC,EAAMA,MAAA,2BAAA,GAAgC,2BAAA;AAEtC,EAAMA,MAAA,eAAA,GAAoB,eAAA;AAE1B,EAAMA,MAAA,0BAAA,GAA+B,0BAAA;AAErC,EAAMA,MAAA,wBAAA,GAA6B,wBAAA;AAEnC,EAAMA,MAAA,iBAAA,GAAsB,iBAAA;AAE5B,EAAMA,MAAA,kBAAA,GAAuB,kBAAA;AAE7B,EAAMA,MAAA,YAAA,GAAiB,YAAA;AAEvB,EAAMA,MAAA,SAAA,GAAc,SAAA;AAEpB,EAAMA,MAAA,cAAA,GAAmB,cAAA;AAEzB,EAAMA,MAAA,iBAAA,GAAsB,iBAAA;AAE5B,EAAMA,MAAA,cAAA,GAAmB,cAAA;AAEzB,EAAMA,MAAA,qBAAA,GAA0B,qBAAA;AAEhC,EAAMA,MAAA,6BAAA,GAAkC,6BAAA;AAExC,EAAMA,MAAA,qBAAA,GAA0B,qBAAA;AAEhC,EAAMA,MAAA,kBAAA,GAAuB,kBAAA;AAE7B,EAAMA,MAAA,gBAAA,GAAqB,gBAAA;AAAA,CAAA,EAlHnB,IAAA,KAAA,IAAA,GAAA,EAAA,CAAA,CAAA;AC5dV,IAAM,aAAA,GAAgB,EAAE,MAAA,EAAQ,CAAC,aAAA,EAAe,kBAAA,EAAoB,cAAA,EAAgB,kBAAA,EAAoB,WAAA,EAAa,WAAA,EAAa,oBAAA,EAAsB,gBAAA,EAAkB,iBAAA,EAAmB,YAAY,MAAA,EAAQ,qBAAA,EAAuB,mBAAA,EAAqB,wBAAA,EAA0B,sBAAA,EAAwB,uBAAA,EAAyB,cAAA,EAAgB,uBAAA,EAAyB,iBAAA,EAAmB,aAAA,EAAe,qBAAA,EAAuB,iBAAA,EAAmB,qBAAA,EAAuB,qBAAA,EAAuB,mBAAmB,mBAAA,EAAqB,wBAAA,EAA0B,mBAAA,EAAqB,uBAAA,EAAyB,uBAAA,EAAyB,0BAAA,EAA4B,yBAAA,EAA2B,wBAAA,EAA0B,4BAAA,EAA8B,iCAAA,EAAmC,yBAAA,EAA2B,4BAAA,EAA8B,gBAAA,EAAkB,mBAAA,EAAqB,qBAAqB,oBAAA,EAAsB,cAAA,EAAgB,sBAAA,EAAwB,eAAA,EAAiB,eAAA,EAAiB,2BAAA,EAA6B,qBAAA,EAAuB,uBAAA,EAAyB,kBAAA,EAAoB,kBAAA,EAAoB,uBAAA,EAAyB,yBAAA,EAA2B,4BAAA,EAA8B,sBAAA,EAAwB,4BAA4B,yBAAA,EAA2B,0BAAA,EAA4B,eAAA,EAAiB,kCAAA,EAAoC,mBAAA,EAAqB,iBAAA,EAAmB,6BAAA,EAA+B,+BAAA,EAAiC,qBAAA,EAAuB,mBAAA,EAAqB,gBAAA,EAAkB,0BAAA,EAA4B,gBAAA,EAAkB,kBAAA,EAAoB,sBAAsB,kBAAA,EAAoB,cAAA,EAAgB,kBAAA,EAAoB,wBAAA,EAA0B,mBAAA,EAAqB,qBAAA,EAAuB,gBAAA,EAAkB,4BAAA,EAA8B,yBAAA,EAA2B,sBAAA,EAAwB,yBAAA,EAA2B,aAAA,EAAe,yBAAA,EAA2B,iBAAA,EAAmB,wBAAwB,YAAA,EAAc,kBAAA,EAAoB,gCAAA,EAAkC,2BAAA,EAA6B,6BAAA,EAA+B,2BAAA,EAA6B,+BAAA,EAAiC,2BAAA,EAA6B,wCAAA,EAA0C,8BAAA,EAAgC,+BAAA,EAAiC,sBAAA,EAAwB,2BAAA,EAA6B,0BAAA,EAA4B,sCAAsC,oCAAA,EAAsC,yBAAA,EAA2B,4BAAA,EAA8B,mBAAA,EAAqB,eAAA,EAAiB,eAAA,EAAiB,eAAA,EAAiB,gBAAA,EAAkB,wCAAA,EAA0C,mCAAA,EAAqC,eAAA,EAAiB,kBAAkB,CAAA;;;ACWznF,IAAM,aAAA,GAAgBC","file":"index.js","sourcesContent":["// Generated by scripts/gen-sdk.mjs from Specs/auth.json. Do not edit.\n\nimport type { APIClient, APIPromise, PagePromise, PollOptions, RequestOptions } from \"@productcraft/core\";\nimport type * as T from \"./types.js\";\nimport type { UnwrapWebhookEvent, WebhookUnwrapParams } from \"./webhooks.js\";\n\ntype Bound = Readonly<Record<string, string | undefined>>;\n\n/** Split params into [picked, rest] by key. */\nfunction split(params: object | undefined, keys: readonly string[]): [Record<string, unknown>, Record<string, unknown>] {\n const picked: Record<string, unknown> = {};\n const rest: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(params ?? {})) (keys.includes(k) ? picked : rest)[k] = v;\n return [picked, rest];\n}\n\n/** Fill `actor_id` from a scope bound with `.as(actorId)`, unless the call passes one. */\nfunction fillActor<P>(params: P, bound: Bound): P {\n if (bound.actor_id === undefined) return params;\n const p = (params ?? {}) as Record<string, unknown>;\n return (p.actor_id === undefined ? { ...p, actor_id: bound.actor_id } : p) as P;\n}\n\n/** A form upload as FormData: Blobs (and Files, with their names) as they are, everything else as a string. */\nfunction formData(fields: object | undefined): FormData {\n const form = new FormData();\n for (const [k, v] of Object.entries(fields ?? {})) {\n if (v === undefined || v === null) continue;\n if (v instanceof Blob) form.append(k, v);\n else form.append(k, typeof v === \"object\" ? JSON.stringify(v) : String(v));\n }\n return form;\n}\n\nexport class APIResource {\n protected readonly _client: APIClient;\n /** Path parameters (and `actor_id`) bound by the enclosing scope. */\n protected readonly _b: Bound;\n constructor(client: APIClient, bound: Bound = {}) {\n this._client = client;\n this._b = bound;\n }\n}\n\nvoid split;\nvoid fillActor;\n/** `apps` */\nexport class AppsResource extends APIResource {\n /**\n * Create a new app owned by the caller\n *\n * The new app starts with emails to its users turned on: they go out from the workspace default sender chosen in Mail, and the default verification, welcome, password-reset, invite and sign-in code templates are created in the workspace's Mail templates (an existing template with the same name is reused). Change or turn this off with `PATCH /v1/apps/{appId}/notification-settings`.\n *\n * @param params - `Auth.AppCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (slug, display name, or workspaceId).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller email not verified, or caller lacks `auth.create` on the target workspace.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Slug already taken. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps\n * @example\n * ```ts\n * const app = await auth.apps.create({\n * display_name: \"Acme\",\n * slug: \"acme-app\",\n * workspace_id: \"835015dc-7bde-4a8a-b306-c066d4733b90\",\n * });\n * ```\n */\n create(params: T.AppCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.App>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps\", body: params, idempotent: true }, options);\n }\n /**\n * Delete an app permanently\n *\n * @param appId - Id of the app.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.delete`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found or caller is not a member.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id\n * @example\n * ```ts\n * await auth.apps.delete(\"app\");\n * ```\n */\n delete(appId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}\", pathParams: { app_id: appId } }, options);\n }\n /**\n * List apps in workspaces the caller is a member of. Pass `workspace_id` to scope the result to a single workspace — required from the per-workspace console page so cross-tenant memberships do not leak.\n *\n * @param params - `Auth.AppListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid pagination cursor.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps\n * @example\n * ```ts\n * for await (const app of auth.apps.list()) {\n * console.log(app);\n * }\n * const page = await auth.apps.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.AppListParams, options?: RequestOptions): PagePromise<T.App> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps\", query: params }, options);\n }\n /**\n * Get app details\n *\n * @param appId - Id of the app.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id\n * @example\n * ```ts\n * const app = await auth.apps.retrieve(\"app\");\n * ```\n */\n retrieve(appId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.App>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}\", pathParams: { app_id: appId } }, options);\n }\n /**\n * Update app display name, slug, metadata, and retention settings\n *\n * @param appId - Id of the app.\n * @param params - `Auth.AppUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, AUTH_SETTINGS_IN_METADATA: Validation failure — including a retention value outside 30-3650 days (audit) or 7-365 days (webhook attempts), or `AUTH_SETTINGS_IN_METADATA`: `metadata.auth` differs from the stored sign-in settings (change those with `PATCH /v1/apps/{appId}/auth-config`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id\n * @example\n * ```ts\n * const app = await auth.apps.update(\"app\", { audit_retention_days: 365 });\n * ```\n */\n update(appId: string, params?: T.AppUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.App>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}\", pathParams: { app_id: appId }, body: params }, options);\n }\n}\n\n/** `stats` */\nexport class StatsResource extends APIResource {\n /**\n * Aggregate counts for the signed-in PlatformUser\n *\n * Returns total Auth apps owned by workspaces the caller is a member of, end-users across those apps, and active API keys across those apps. Pass `workspace_id` to scope the counts to a single workspace — required from the dashboard so cross-tenant data does not bleed into the totals.\n *\n * @param params - `Auth.StatsMeParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/stats/me\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-stats-me\n * @example\n * ```ts\n * const platformUserStats = await auth.stats.me();\n * ```\n */\n me(params?: T.StatsMeParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.PlatformUserStats>> {\n return this._client.request({ method: \"GET\", path: \"/v1/stats/me\", query: params }, options);\n }\n /**\n * Auth stats for a workspace\n *\n * Active end users over 1, 7 and 30 days, total and new end users, production app count, last end-user activity and a daily active-users series, for the workspace's **production** apps only.\n *\n * **Active** means the end user signed in successfully or refreshed a session. Customer backends verify access tokens locally against the JWKS, so use between two refreshes is invisible to ProductCraft; resolution is bounded by each app's access-token lifetime.\n *\n * Days are UTC. Counts only: no end-user identifiers. Cached for up to 60 seconds (`generated_at`).\n *\n * @param params - `Auth.StatsRetrieveParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `workspaceId` is not a UUID or `window` is not one of 1d, 7d, 30d.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, SERVICE_NOT_ENABLED: Caller lacks `auth.read` on the workspace (including non-members), or Auth is not enabled on it (`SERVICE_NOT_ENABLED`).\n * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found. Today an unknown workspace answers 403 like every other workspace route, so callers cannot probe which ids exist.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/workspaces/{workspace_id}/stats\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-workspaces-workspace-id-stats\n * @example\n * ```ts\n * const authWorkspaceStats = await auth.stats.retrieve();\n * ```\n */\n retrieve(params?: T.StatsRetrieveParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuthWorkspaceStats>> {\n return this._client.request({ method: \"GET\", path: \"/v1/workspaces/{workspace_id}/stats\", query: params }, options);\n }\n /**\n * 0.x name for `auth.stats.me()` (GET /v1/stats/me).\n *\n * @deprecated Use `auth.stats.me()`. Kept for 0.x callers; removed in 2.0.\n */\n get(params?: T.StatsMeParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.PlatformUserStats>> {\n return this._client.request({ method: \"GET\", path: \"/v1/stats/me\", query: params }, options);\n }\n}\n\n/** `webhooks` */\nexport class WebhooksResource extends APIResource {\n /**\n * Verify a webhook's signature and parse it (Standard Webhooks, and the legacy `t=…,v1=…` scheme).\n *\n * @param params - The raw body, the request headers and optionally the secret.\n * @throws {WebhookVerificationError} The signature, timestamp or payload is invalid.\n * @throws {ConfigurationError} No secret was passed or configured.\n */\n unwrap(params: WebhookUnwrapParams): Promise<UnwrapWebhookEvent> {\n return this._client.unwrapWebhook<UnwrapWebhookEvent>(params, \"PRODUCTCRAFT_AUTH_WEBHOOK_SECRET\");\n }\n}\n\n/** `auth` */\nexport class AuthResources extends APIResource {\n #apps?: AppsResource;\n #stats?: StatsResource;\n #webhooks?: WebhooksResource;\n get apps(): AppsResource {\n return (this.#apps ??= new AppsResource(this._client, this._b));\n }\n get stats(): StatsResource {\n return (this.#stats ??= new StatsResource(this._client, this._b));\n }\n get webhooks(): WebhooksResource {\n return (this.#webhooks ??= new WebhooksResource(this._client, this._b));\n }\n}\n\n/** `apiKeys` */\nexport class AppApiKeysResource extends APIResource {\n /**\n * Mint a new hdk_live_* API key with an explicit permission scope. The raw key is returned ONCE.\n *\n * @param params - `Auth.ApiKeyCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (name, empty `permissions`, a permission not matching `resource.action`, unsupported `expiresInDays`), or a malformed `Idempotency-Key`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.create` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: `Idempotency-Key` reused with a different request body. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/api-keys\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-api-keys\n * @example\n * ```ts\n * const createApiKey = await auth.admin.app(\"app\").apiKeys.create({ name: \"CI deploy bot\", permissions: [\"user.read\", \"user.list\"] });\n * ```\n */\n create(params: T.ApiKeyCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CreateApiKey>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/api-keys\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Revoke an API key. The key stops authenticating immediately; the row is kept (soft delete) so the list and the audit trail can still answer who revoked it and when.\n *\n * @param keyId - Id of the key.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: No such key in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/api-keys/{key_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-api-keys-key-id\n * @example\n * ```ts\n * await auth.admin.app(\"app\").apiKeys.delete(\"key\");\n * ```\n */\n delete(keyId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/api-keys/{key_id}\", pathParams: { app_id: this._b.app_id, key_id: keyId } }, options);\n }\n /**\n * List API keys for an app (no raw secret), newest first. Cursor-paginated: 20/page by default, 100 max.\n *\n * @param params - `Auth.ApiKeyListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/api-keys\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-api-keys\n * @example\n * ```ts\n * for await (const apiKey of auth.admin.app(\"app\").apiKeys.list()) {\n * console.log(apiKey);\n * }\n * const page = await auth.admin.app(\"app\").apiKeys.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.ApiKeyListParams, options?: RequestOptions): PagePromise<T.ApiKeySummary> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/api-keys\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n /**\n * Mint a replacement for an existing key, carrying its name and permissions over. The outgoing key keeps working for `grace_hours` (24 by default) so a fleet can roll over without downtime. The raw key is returned ONCE.\n *\n * @param keyId - Id of the key.\n * @param params - `Auth.ApiKeyRotateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: No such key in this app.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: The key is revoked or already expired. There is nothing to roll over from — mint a new key instead. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/api-keys/{key_id}/rotate\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-api-keys-key-id-rotate\n * @example\n * ```ts\n * const rotateApiKey = await auth.admin.app(\"app\").apiKeys.rotate(\"key\", { grace_hours: 24 });\n * ```\n */\n rotate(keyId: string, params?: T.ApiKeyRotateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.RotateApiKey>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/api-keys/{key_id}/rotate\", pathParams: { app_id: this._b.app_id, key_id: keyId }, body: params, idempotent: true }, options);\n }\n}\n\n/** `auditLogs` */\nexport class AppAuditLogsResource extends APIResource {\n /**\n * Stream this app's audit log as NDJSON or CSV, applying the same `?action=` / `?actor_id=` / `?since=` / `?until=` filters as the list. Newest first. Reading the export is itself audited as `audit.exported`.\n *\n * The response is streamed: rows are walked in keyset batches and written as they are read, so neither the service nor the client has to hold the whole result set. Works on both lanes — a platform bearer token and a `pcft_live_*` Platform API Key with `auth.audit.read` hit the same route. Hard cap of 1,000,000 rows per call; a wider request is refused with 413 before any body is written, so a truncated file can never masquerade as a complete one.\n *\n * @param params - `Auth.AuditLogExportParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `format`, or malformed `since` / `until`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.audit.read`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found or caller is not a member.\n * @throws {APIError} 413 PAYLOAD_TOO_LARGE: More than 1,000,000 rows match. Narrow the window with `since` / `until` (or a tighter `action` / `actor_id` filter) and retry.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/audit-logs/export\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-audit-logs-export\n * @example\n * ```ts\n * const response = await auth.admin.app(\"app\").auditLogs.export();\n * const text = await response.text();\n * ```\n */\n export(params?: T.AuditLogExportParams, options?: RequestOptions): APIPromise<Response> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/audit-logs/export\", pathParams: { app_id: this._b.app_id }, query: fillActor(params, this._b), raw: true }, options);\n }\n /**\n * Append-only audit log for this app, newest first. Filter by `?action=`, `?actor_id=`, and/or the `?since=` / `?until=` date range. 20/page (max 100), cursor-paginated.\n *\n * @param params - `Auth.AuditLogListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`, `since`, or `until`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.audit.read`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found or caller is not a member.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/audit-logs\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-audit-logs\n * @example\n * ```ts\n * for await (const auditLog of auth.admin.app(\"app\").auditLogs.list()) {\n * console.log(auditLog);\n * }\n * const page = await auth.admin.app(\"app\").auditLogs.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.AuditLogListParams, options?: RequestOptions): PagePromise<T.AuditLogEntry> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/audit-logs\", pathParams: { app_id: this._b.app_id }, query: fillActor(params, this._b) }, options);\n }\n}\n\n/** `auditSink` */\nexport class AppAuditSinkResource extends APIResource {\n /**\n * Remove the audit sink. Shipping stops immediately; the audit log itself is untouched.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.\n * @throws {NotFoundError} 404 NOT_FOUND: No audit sink configured.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/audit-sink\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-audit-sink\n * @example\n * ```ts\n * await auth.admin.app(\"app\").auditSink.disconnect();\n * ```\n */\n disconnect(options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/audit-sink\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Create or replace the audit sink. Returns a freshly generated signing secret exactly once.\n *\n * Audit rows are POSTed in batches of up to 100, signed with the same `X-Auth-Signature: t=<unix>,v1=<hex>` HMAC header as the outbound webhooks. Delivery is at-least-once: the cursor advances only after a 2xx, so a batch that times out after the receiver processed it is re-sent. Every record carries its immutable `audit_log` id, so dedupe on that. A new sink starts from the moment it is created — configuring one does not replay the existing history into your SIEM. Replacing an existing sink clears the auto-disabled state (the same \"I fixed my receiver\" signal a webhook PUT carries) but does NOT rewind the cursor.\n *\n * @param params - `Auth.AuditSinkReplaceParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: URL is not HTTPS, or the SSRF guard refused it (private address, unresolvable host, non-public TLD).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PUT /v1/apps/{app_id}/audit-sink\n * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-audit-sink\n * @example\n * ```ts\n * const auditSinkWithSecret = await auth.admin.app(\"app\").auditSink.replace({ url: \"https://siem.customer.example.com/ingest/productcraft-auth\" });\n * ```\n */\n replace(params: T.AuditSinkReplaceParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuditSinkWithSecret>> {\n return this._client.request({ method: \"PUT\", path: \"/v1/apps/{app_id}/audit-sink\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n /**\n * Current audit sink for this app, or 404 when none is configured. Never returns the signing secret — only its last-4 hint.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read`.\n * @throws {NotFoundError} 404 NOT_FOUND: No audit sink configured.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/audit-sink\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-audit-sink\n * @example\n * ```ts\n * const auditSink = await auth.admin.app(\"app\").auditSink.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuditSink>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/audit-sink\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Issue a new signing secret, returned exactly once.\n *\n * The new secret signs every batch from now on; the old one stops at once. Update your receiver right away: batches it rejects in between are retried every minute (the position only moves after a 2xx), so nothing is lost, but export stops after 20 failures in a row. Clears the receiver-test proof.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.\n * @throws {NotFoundError} 404 NOT_FOUND: No audit sink configured.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/audit-sink/rotate-secret\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-audit-sink-rotate-secret\n * @example\n * ```ts\n * const auditSinkWithSecret = await auth.admin.app(\"app\").auditSink.rotateSecret();\n * ```\n */\n rotateSecret(options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuditSinkWithSecret>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/audit-sink/rotate-secret\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Get the audit export checklist: destination, receiver test and delivery.\n *\n * Rows, in order: `destination` (not_set until a sink exists), `test_batch` (pass once the receiver accepted a test batch with the current address and secret; blocked when the last test was refused; carries `test.action: audit_sink.test`, run with `POST /v1/apps/{appId}/audit-sink/test`), and `delivery` (blocked when export stopped after repeated failures, attention while paused or while recent batches fail). Computed from the stored sink on every request; answers 200 whether or not a sink exists.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read`, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/audit-sink/setup-status\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-audit-sink-setup-status\n * @example\n * ```ts\n * const setupStatus = await auth.admin.app(\"app\").auditSink.setupStatus();\n * ```\n */\n setupStatus(options?: RequestOptions): APIPromise<T.WithLastResponse<T.SetupStatus>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/audit-sink/setup-status\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Send a test batch to the receiver now and report what it answered.\n *\n * POSTs one signed batch, shaped exactly like a real one (`type: audit.batch`, same headers and signature), with `test: true` and a single synthetic record whose `id` starts with `test_`. Works while export is paused or stopped, so a fix can be proven before export is turned back on. The outcome is recorded on the sink (`last_attempt_*`, `last_test_succeeded_at`) but never moves the position in the audit log or counts toward the automatic stop. A refused test is still a 200 with `delivered: false`. At most 20 tests per app per hour.\n *\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.\n * @throws {NotFoundError} 404 NOT_FOUND: No audit sink configured.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: More than 20 tests for this app in the last hour (`RATE_LIMITED`).\n * @see POST /v1/apps/{app_id}/audit-sink/test\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-audit-sink-test\n * @example\n * ```ts\n * const auditSinkTestResult = await auth.admin.app(\"app\").auditSink.test();\n * ```\n */\n test(options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuditSinkTestResult>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/audit-sink/test\", pathParams: { app_id: this._b.app_id }, idempotent: true }, options);\n }\n /**\n * Change the address or switch export on or off, keeping the signing secret.\n *\n * Send `url`, `enabled` or both. `enabled: false` pauses export; `enabled: true` resumes it and clears a stop after repeated failures and the failure count. The position in the audit log is never moved: nothing is skipped and nothing is replayed twice on purpose. A new `url` is checked by the same address guard as `PUT`.\n *\n * @param params - `Auth.AuditSinkUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: URL is not HTTPS, or the address guard refused it (private address, unresolvable host).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.\n * @throws {NotFoundError} 404 NOT_FOUND: No audit sink configured.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/audit-sink\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-audit-sink\n * @example\n * ```ts\n * const auditSink = await auth.admin.app(\"app\").auditSink.update({ enabled: true });\n * ```\n */\n update(params?: T.AuditSinkUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuditSink>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/audit-sink\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n}\n\n/** `authConfig.providers` */\nexport class AppAuthConfigProvidersResource extends APIResource {\n /**\n * Check the saved provider credentials with the provider.\n *\n * Calls the provider's token endpoint with a dummy sign-in code. If the provider refuses the client (`invalid_client`, GitHub `incorrect_client_credentials` or `unknown_client`), the result is `credentials_rejected` and the provider shows as `blocked` with reason `credentials_rejected` until the credentials are fixed. If it only refuses the code (`invalid_grant`, `bad_verification_code`), the credentials are valid. Nobody is signed in. The result is saved on the provider (`last_check_*`). The same check runs automatically whenever the credentials are saved. Works for a provider that is saved but not switched on yet.\n *\n * @param provider - The sign-in provider: `google`, `github` or `apple`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown provider id, or the saved config can no longer be read.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or the provider is not configured for this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/auth-config/providers/{provider}/check\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-auth-config-providers-provider-check\n * @example\n * ```ts\n * const providerCheck = await auth.admin.app(\"app\").authConfig.providers.check(\"provider\");\n * ```\n */\n check(provider: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ProviderCheck>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/auth-config/providers/{provider}/check\", pathParams: { app_id: this._b.app_id, provider } }, options);\n }\n /**\n * Remove the config for an (app, provider). Existing identity rows (people who already signed in with this provider) stay; they just lose the ability to sign in again until config is re-uploaded.\n *\n * @param provider - The sign-in provider: `google`, `github` or `apple`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown provider id.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/auth-config/providers/{provider}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-auth-config-providers-provider\n * @example\n * ```ts\n * await auth.admin.app(\"app\").authConfig.providers.delete(\"provider\");\n * ```\n */\n delete(provider: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/auth-config/providers/{provider}\", pathParams: { app_id: this._b.app_id, provider } }, options);\n }\n /**\n * List federated sign-in providers Auth supports, with their setup status for this app.\n *\n * Each entry carries `status` (`ready` | `blocked` | `disabled` | `not_configured`) and `blocked_reasons`, computed on the server with the same rule the web sign-in flow enforces, so a provider shown as `ready` is one people can actually sign in with.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/auth-config/providers\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-auth-config-providers\n * @example\n * ```ts\n * const result = await auth.admin.app(\"app\").authConfig.providers.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuthConfigProviderListResponse>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/auth-config/providers\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Write or replace the config for an (app, provider). Validates the body via the provider impl's `parseConfig` before encrypting; malformed config 400s. Default `enabled=false`.\n *\n * @param provider - The sign-in provider: `google`, `github` or `apple`.\n * @param params - `Auth.AuthConfigProviderReplaceParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown provider or malformed config.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PUT /v1/apps/{app_id}/auth-config/providers/{provider}\n * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-auth-config-providers-provider\n * @example\n * ```ts\n * const providerDetail = await auth.admin.app(\"app\").authConfig.providers.replace(\"provider\", { config: {} });\n * ```\n */\n replace(provider: string, params: T.AuthConfigProviderReplaceParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ProviderDetail>> {\n return this._client.request({ method: \"PUT\", path: \"/v1/apps/{app_id}/auth-config/providers/{provider}\", pathParams: { app_id: this._b.app_id, provider }, body: params }, options);\n }\n /**\n * Get the config for one (app, provider). Secrets are redacted — `private_key_present: true` is the only acknowledgement that a private key is on file.\n *\n * @param provider - The sign-in provider: `google`, `github` or `apple`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown provider id.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Provider not configured for this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/auth-config/providers/{provider}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-auth-config-providers-provider\n * @example\n * ```ts\n * const providerDetail = await auth.admin.app(\"app\").authConfig.providers.retrieve(\"provider\");\n * ```\n */\n retrieve(provider: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ProviderDetail>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/auth-config/providers/{provider}\", pathParams: { app_id: this._b.app_id, provider } }, options);\n }\n /**\n * Partially update the config for an (app, provider). Only top-level keys present in `config` are changed; omitted keys — secrets included — keep their stored values. The merged config is validated by the provider impl's `parseConfig`; 404 if the provider is not configured yet (create it with PUT).\n *\n * @param provider - The sign-in provider: `google`, `github` or `apple`.\n * @param params - `Auth.AuthConfigProviderUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown provider or merged config invalid.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Provider not configured for this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/auth-config/providers/{provider}\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-auth-config-providers-provider\n * @example\n * ```ts\n * const providerDetail = await auth.admin.app(\"app\").authConfig.providers.update(\"provider\", { config: {} });\n * ```\n */\n update(provider: string, params?: T.AuthConfigProviderUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ProviderDetail>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/auth-config/providers/{provider}\", pathParams: { app_id: this._b.app_id, provider }, body: params }, options);\n }\n}\n\n/** `authConfig` */\nexport class AppAuthConfigResource extends APIResource {\n #providers?: AppAuthConfigProvidersResource;\n get providers(): AppAuthConfigProvidersResource {\n return (this.#providers ??= new AppAuthConfigProvidersResource(this._client, this._b));\n }\n /**\n * Get the per-app auth config (signup, signin, password policy, sessions).\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/auth-config\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-auth-config\n * @example\n * ```ts\n * const authConfig = await auth.admin.app(\"app\").authConfig.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuthConfig>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/auth-config\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Update the per-app auth config. Only fields you pass are changed.\n *\n * @param params - `Auth.AuthConfigUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure — a value out of range (password length, token/session lifetimes, lockout threshold, max sessions, MFA grace days, unverified-account window), an unknown enum value, a `signup_default_role` that does not exist in this app, or a `bot_protection` change that cannot stand: no provider or site key on first setup, a hostname that is not a hostname, or `enabled: true` with no secret stored or sent.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, APP_HAS_NO_WORKSPACE: `APP_HAS_NO_WORKSPACE`: `signup_requires_pak: true` on an app that belongs to no workspace, so no Platform API Key could ever be accepted for its sign-ups.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/auth-config\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-auth-config\n * @example\n * ```ts\n * const authConfig = await auth.admin.app(\"app\").authConfig.update({ access_token_minutes: 60 });\n * ```\n */\n update(params?: T.AuthConfigUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuthConfig>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/auth-config\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).authConfig.retrieve()` (GET /v1/apps/{app_id}/auth-config).\n *\n * @deprecated Use `auth.admin.app(…).authConfig.retrieve()`. Kept for 0.x callers; removed in 2.0.\n */\n get(options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuthConfig>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/auth-config\", pathParams: { app_id: this._b.app_id } }, options);\n }\n}\n\n/** `credentials` */\nexport class AppCredentialsResource extends APIResource {\n /**\n * Create a new M2M client\n *\n * @param params - `Auth.CredentialCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (missing or invalid name).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller email not verified, or lacks `auth.create`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found or caller is not a member.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/credentials\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-credentials\n * @example\n * ```ts\n * const m2mClientCreate = await auth.admin.app(\"app\").credentials.create({ name: \"CI Pipeline\" });\n * ```\n */\n create(params: T.CredentialCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.M2mClientCreate>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/credentials\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Delete an M2M client\n *\n * @param clientId - Id of the client.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.delete`.\n * @throws {NotFoundError} 404 NOT_FOUND: M2M client not found in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/credentials/{client_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-credentials-client-id\n * @example\n * ```ts\n * await auth.admin.app(\"app\").credentials.delete(\"client\");\n * ```\n */\n delete(clientId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/credentials/{client_id}\", pathParams: { app_id: this._b.app_id, client_id: clientId } }, options);\n }\n /**\n * List M2M clients\n *\n * @param params - `Auth.CredentialListParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.list` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/credentials\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-credentials\n * @example\n * ```ts\n * for await (const credential of auth.admin.app(\"app\").credentials.list()) {\n * console.log(credential);\n * }\n * const page = await auth.admin.app(\"app\").credentials.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.CredentialListParams, options?: RequestOptions): PagePromise<T.M2mClientSummary> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/credentials\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n /**\n * Get M2M client details\n *\n * @param clientId - Id of the client.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such M2M client in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/credentials/{client_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-credentials-client-id\n * @example\n * ```ts\n * const m2mClientDetail = await auth.admin.app(\"app\").credentials.retrieve(\"client\");\n * ```\n */\n retrieve(clientId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.M2mClientDetail>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/credentials/{client_id}\", pathParams: { app_id: this._b.app_id, client_id: clientId } }, options);\n }\n /**\n * Rotate M2M client secret\n *\n * @param clientId - Id of the client.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.rotate-secret`.\n * @throws {NotFoundError} 404 NOT_FOUND: M2M client not found in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/credentials/{client_id}/rotate\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-credentials-client-id-rotate\n * @example\n * ```ts\n * const m2mRotateSecret = await auth.admin.app(\"app\").credentials.rotate(\"client\");\n * ```\n */\n rotate(clientId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.M2mRotateSecret>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/credentials/{client_id}/rotate\", pathParams: { app_id: this._b.app_id, client_id: clientId } }, options);\n }\n /**\n * Update M2M client status\n *\n * @param clientId - Id of the client.\n * @param params - `Auth.CredentialUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `isActive` missing or not a boolean.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such M2M client in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/credentials/{client_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-credentials-client-id\n * @example\n * ```ts\n * const m2mClientDetail = await auth.admin.app(\"app\").credentials.update(\"client\", { is_active: true });\n * ```\n */\n update(clientId: string, params?: T.CredentialUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.M2mClientDetail>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/credentials/{client_id}\", pathParams: { app_id: this._b.app_id, client_id: clientId }, body: params }, options);\n }\n /**\n * Set scopes for an M2M client\n *\n * @param clientId - Id of the client.\n * @param params - `Auth.CredentialUpdateScopesParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `permissions` is not a string array, or names a permission unknown to this app.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such M2M client in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PUT /v1/apps/{app_id}/credentials/{client_id}/scopes\n * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-credentials-client-id-scopes\n * @example\n * ```ts\n * const result = await auth.admin.app(\"app\").credentials.updateScopes(\"client\", { permissions: [\"user.read\", \"app.read\"] });\n * ```\n */\n updateScopes(clientId: string, params: T.CredentialUpdateScopesParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CredentialUpdateScopesResponse>> {\n return this._client.request({ method: \"PUT\", path: \"/v1/apps/{app_id}/credentials/{client_id}/scopes\", pathParams: { app_id: this._b.app_id, client_id: clientId }, body: params }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).credentials.retrieve()` (GET /v1/apps/{app_id}/credentials/{client_id}).\n *\n * @deprecated Use `auth.admin.app(…).credentials.retrieve()`. Kept for 0.x callers; removed in 2.0.\n */\n get(clientId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.M2mClientDetail>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/credentials/{client_id}\", pathParams: { app_id: this._b.app_id, client_id: clientId } }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).credentials.rotate()` (POST /v1/apps/{app_id}/credentials/{client_id}/rotate).\n *\n * @deprecated Use `auth.admin.app(…).credentials.rotate()`. Kept for 0.x callers; removed in 2.0.\n */\n rotateSecret(clientId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.M2mRotateSecret>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/credentials/{client_id}/rotate\", pathParams: { app_id: this._b.app_id, client_id: clientId } }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).credentials.updateScopes()` (PUT /v1/apps/{app_id}/credentials/{client_id}/scopes).\n *\n * @deprecated Use `auth.admin.app(…).credentials.updateScopes()`. Kept for 0.x callers; removed in 2.0.\n */\n setScopes(clientId: string, params: T.CredentialUpdateScopesParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CredentialUpdateScopesResponse>> {\n return this._client.request({ method: \"PUT\", path: \"/v1/apps/{app_id}/credentials/{client_id}/scopes\", pathParams: { app_id: this._b.app_id, client_id: clientId }, body: params }, options);\n }\n}\n\n/** `customDomains` */\nexport class AppCustomDomainsResource extends APIResource {\n /**\n * Set up the custom domain's DNS records in one step with a short-lived Cloudflare or DigitalOcean API token.\n *\n * Reads the zone through the provider's API and plans both records: `create`, or `skip` when already there. Nothing is ever changed or deleted, and only names at or under the custom host are written (Cloudflare records are DNS-only, not proxied). Anything in the way (another CNAME at the host, A/MX/TXT records where the CNAME must go) refuses the whole apply with 409 and the plan, before anything is written. `dry_run: true` returns the plan and changes nothing; `dry_run: false` writes exactly that plan and runs a check straight away (the records are usually `propagating` for a few minutes). The token is used for this request only: never stored, logged, queued or returned; revoke it afterwards (`warnings` says so when it could see more than this zone).\n *\n * @param domainId - Id of the domain.\n * @param params - `Auth.CustomDomainApplyParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, IDEMPOTENCY_KEY_REQUIRED, INVALID_ZONE, PROVIDER_TOKEN_REJECTED, PROVIDER_PERMISSION_DENIED, PROVIDER_ZONE_NOT_FOUND, APEX_NOT_SUPPORTED: Validation failure; `Idempotency-Key` missing (`IDEMPOTENCY_KEY_REQUIRED`); `zone` is not the host or a parent (`INVALID_ZONE`); the provider rejected the token (`PROVIDER_TOKEN_REJECTED`), it lacks DNS rights (`PROVIDER_PERMISSION_DENIED`), or it cannot see a zone for the host (`PROVIDER_ZONE_NOT_FOUND`); the host is a zone root (`APEX_NOT_SUPPORTED`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, CUSTOM_DOMAIN_NOT_FOUND: App or custom domain not found (`CUSTOM_DOMAIN_NOT_FOUND`).\n * @throws {ConflictError} 409 CONFLICT, DNS_CONFLICTS, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: `DNS_CONFLICTS`: something at the names blocks a record. Nothing was written; the body carries the full `plan` and `conflicts` next to `code` and `message`. Or `IDEMPOTENCY_KEY_REUSE`. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @throws {InternalServerError} 502 BAD_GATEWAY, PROVIDER_UNAVAILABLE, PROVIDER_ERROR: The provider failed or did not answer (`PROVIDER_UNAVAILABLE`, `PROVIDER_ERROR`). Nothing was written unless the plan items say so.\n * @see POST /v1/apps/{app_id}/custom-domains/{domain_id}/apply\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-custom-domains-domain-id-apply\n * @example\n * ```ts\n * const customDomainApplyResult = await auth.admin.app(\"app\").customDomains.apply(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\", { dry_run: true, provider: \"cloudflare\", token: \"cf-token-from-your-dashboard\" });\n * ```\n */\n apply(domainId: string, params: T.CustomDomainApplyParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CustomDomainApplyResult>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/custom-domains/{domain_id}/apply\", pathParams: { app_id: this._b.app_id, domain_id: domainId }, body: params, idempotent: true }, options);\n }\n /**\n * Check the custom domain's DNS records now.\n *\n * Asks the zone's own nameservers and a public resolver for both records, stores each record's state and conflicts, and moves the status: `active` once both are verified; an active domain turns `failing` only when a record is definitely gone or blocked (a DNS outage never takes a working domain down). Safe to repeat.\n *\n * @param domainId - Id of the domain.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `domainId` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, CUSTOM_DOMAIN_NOT_FOUND: App or custom domain not found (`CUSTOM_DOMAIN_NOT_FOUND`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/custom-domains/{domain_id}/check\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-custom-domains-domain-id-check\n * @example\n * ```ts\n * const customDomain = await auth.admin.app(\"app\").customDomains.check(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\");\n * ```\n */\n check(domainId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CustomDomain>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/custom-domains/{domain_id}/check\", pathParams: { app_id: this._b.app_id, domain_id: domainId } }, options);\n }\n /**\n * Add a custom domain (such as auth.acme.com) for this app's sign-in.\n *\n * Returns the two records to publish: a CNAME from the host to `edge_target`, and a TXT token at `_productcraft-auth.<host>` that proves the domain is yours. The zone and its DNS provider are detected, and the first check runs straight away, so `records[].state` and `conflicts` already say what is missing or in the way. Publish the records by hand, import `…/export`, or let `…/apply` write them with a short-lived provider token. The domain turns `active` once both records are seen. Sign-in tokens keep the canonical issuer (`https://api.auth.productcraft.co/{slug}`), so nothing changes for code that verifies them. One custom domain per app. While the feature is in early access it is switched on per workspace.\n *\n * @param params - `Auth.CustomDomainCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, INVALID_HOSTNAME, HOSTNAME_RESERVED, APEX_NOT_SUPPORTED: Not a usable host name (`INVALID_HOSTNAME`), one of ours (`HOSTNAME_RESERVED`), or the root of a DNS zone, which cannot hold a CNAME (`APEX_NOT_SUPPORTED`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, FEATURE_NOT_ENABLED: Caller lacks `auth.update` on this app, the app is suspended or archived, or custom domains are not switched on for the workspace (`FEATURE_NOT_ENABLED`).\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, CUSTOM_DOMAIN_EXISTS, HOSTNAME_TAKEN, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: The app already has a custom domain (`CUSTOM_DOMAIN_EXISTS`), the host is set up on another app (`HOSTNAME_TAKEN`), or the Idempotency-Key was reused with a different body (`IDEMPOTENCY_KEY_REUSE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/custom-domains\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-custom-domains\n * @example\n * ```ts\n * const customDomain = await auth.admin.app(\"app\").customDomains.create({ hostname: \"auth.acme.com\" });\n * ```\n */\n create(params: T.CustomDomainCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CustomDomain>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/custom-domains\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Remove the custom domain.\n *\n * The host stops serving this app at once and its certificate is no longer renewed. Your DNS records are not touched: delete the CNAME and the `_productcraft-auth` TXT record at your DNS provider. Sign-ins on the canonical host are unaffected.\n *\n * @param domainId - Id of the domain.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `domainId` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, CUSTOM_DOMAIN_NOT_FOUND: App or custom domain not found (`CUSTOM_DOMAIN_NOT_FOUND`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/custom-domains/{domain_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-custom-domains-domain-id\n * @example\n * ```ts\n * await auth.admin.app(\"app\").customDomains.delete(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\");\n * ```\n */\n delete(domainId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/custom-domains/{domain_id}\", pathParams: { app_id: this._b.app_id, domain_id: domainId } }, options);\n }\n /**\n * Download the custom domain's DNS records as a BIND zone fragment or a CSV.\n *\n * `format=bind`: a zone-file fragment (`$ORIGIN <zone>.`, `$TTL 3600`, names relative to the zone, a comment per record with its purpose and any conflict) that Cloudflare and Route 53 import directly. `format=csv`: `type,name,value,priority,ttl,purpose,required`, fully qualified names. By default only records not verified yet; `all=true` for both. Served as an attachment.\n *\n * @param domainId - Id of the domain.\n * @param params - `Auth.CustomDomainExportParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, INVALID_FORMAT: `format` missing or not `bind` / `csv` (`INVALID_FORMAT`), or `domainId` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, CUSTOM_DOMAIN_NOT_FOUND: App or custom domain not found (`CUSTOM_DOMAIN_NOT_FOUND`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/custom-domains/{domain_id}/export\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-custom-domains-domain-id-export\n * @example\n * ```ts\n * const response = await auth.admin.app(\"app\").customDomains.export(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\", { format: \"bind\" });\n * const text = await response.text();\n * ```\n */\n export(domainId: string, params: T.CustomDomainExportParams, options?: RequestOptions): APIPromise<Response> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/custom-domains/{domain_id}/export\", pathParams: { app_id: this._b.app_id, domain_id: domainId }, query: params, raw: true }, options);\n }\n /**\n * List the app's custom domains (at most one).\n *\n * Each with its status and the last check of its records, plus `available`: whether custom domains are switched on for the workspace. Always a single page.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/custom-domains\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-custom-domains\n * @example\n * ```ts\n * for await (const customDomain of auth.admin.app(\"app\").customDomains.list()) {\n * console.log(customDomain);\n * }\n * ```\n */\n list(options?: RequestOptions): PagePromise<T.CustomDomain> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/custom-domains\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Get a custom domain and the last check of its records.\n *\n * Reads stored state only; `POST …/check` runs a new DNS check.\n *\n * @param domainId - Id of the domain.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `domainId` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, CUSTOM_DOMAIN_NOT_FOUND: App or custom domain not found (`CUSTOM_DOMAIN_NOT_FOUND`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/custom-domains/{domain_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-custom-domains-domain-id\n * @example\n * ```ts\n * const customDomain = await auth.admin.app(\"app\").customDomains.retrieve(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\");\n * ```\n */\n retrieve(domainId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CustomDomain>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/custom-domains/{domain_id}\", pathParams: { app_id: this._b.app_id, domain_id: domainId } }, options);\n }\n}\n\n/** `endUserInsights.users` */\nexport class AppEndUserInsightsUsersResource extends APIResource {\n /**\n * One end-user's recorded activity: their audit trail, their sessions with device/IP, and their enrolled factors. `noActivityRecorded` distinguishes \"nothing happened\" from \"no data\".\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `appId` or `userId` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.audit.read` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: No such end-user in this app. Same response as an account in another app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/end-user-insights/users/{user_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-user-insights-users-user-id\n * @example\n * ```ts\n * const endUserDetailInsights = await auth.admin.app(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\").endUserInsights.users.retrieve(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\");\n * ```\n */\n retrieve(userId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserDetailInsights>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/end-user-insights/users/{user_id}\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n}\n\n/** `endUserInsights` */\nexport class AppEndUserInsightsResource extends APIResource {\n #users?: AppEndUserInsightsUsersResource;\n get users(): AppEndUserInsightsUsersResource {\n return (this.#users ??= new AppEndUserInsightsUsersResource(this._client, this._b));\n }\n /**\n * Auth health for this app over the last 30 days: verification completion, sign-in failure rate, MFA adoption, password-reset follow-through, and session counts. Rates are null when there is nothing to divide by.\n *\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `appId` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.audit.read` on this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/end-user-insights\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-user-insights\n * @example\n * ```ts\n * const endUserInsights = await auth.admin.app(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\").endUserInsights.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserInsights>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/end-user-insights\", pathParams: { app_id: this._b.app_id } }, options);\n }\n}\n\n/** `endUsers.contacts` */\nexport class AppEndUsersContactsResource extends APIResource {\n /**\n * Add a contact for an end-user (unverified).\n *\n * @param userId - Id of the user.\n * @param params - `Auth.EndUserContactCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid body: unsupported `type`, malformed or empty `value`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such end-user in this app.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Contact value already in use in this app. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/{user_id}/contacts\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-contacts\n * @example\n * ```ts\n * const accountContact = await auth.admin.app(\"app\").endUsers.contacts.create(\"user\", { type: \"email\", value: \"string\" });\n * ```\n */\n create(userId: string, params: T.EndUserContactCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AccountContact>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/{user_id}/contacts\", pathParams: { app_id: this._b.app_id, user_id: userId }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a contact from an end-user.\n *\n * @param userId - Id of the user.\n * @param contactId - Id of the contact.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App, end-user or contact not found.\n * @throws {ConflictError} 409 CONFLICT: Contact is the verified primary email; promote another email first.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/end-users/{user_id}/contacts/{contact_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-end-users-user-id-contacts-contact-id\n * @example\n * ```ts\n * await auth.admin.app(\"app\").endUsers.contacts.delete(\"user\", \"contact\");\n * ```\n */\n delete(userId: string, contactId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/end-users/{user_id}/contacts/{contact_id}\", pathParams: { app_id: this._b.app_id, user_id: userId, contact_id: contactId } }, options);\n }\n /**\n * List an end-user's contacts.\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such end-user in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/end-users/{user_id}/contacts\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-user-id-contacts\n * @example\n * ```ts\n * const accountContactList = await auth.admin.app(\"app\").endUsers.contacts.list(\"user\");\n * ```\n */\n list(userId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AccountContactList>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/end-users/{user_id}/contacts\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n /**\n * Promote a verified contact to primary.\n *\n * @param userId - Id of the user.\n * @param contactId - Id of the contact.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App, end-user or contact not found.\n * @throws {ConflictError} 409 CONFLICT: Contact is not verified.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/{user_id}/contacts/{contact_id}/promote\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-contacts-contact-id-promote\n * @example\n * ```ts\n * await auth.admin.app(\"app\").endUsers.contacts.promote(\"user\", \"contact\");\n * ```\n */\n promote(userId: string, contactId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/{user_id}/contacts/{contact_id}/promote\", pathParams: { app_id: this._b.app_id, user_id: userId, contact_id: contactId } }, options);\n }\n /**\n * Reissue a verification code for a contact.\n *\n * @param userId - Id of the user.\n * @param contactId - Id of the contact.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App, end-user or contact not found.\n * @throws {ConflictError} 409 CONFLICT: Contact is already verified.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/{user_id}/contacts/{contact_id}/resend-verification\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-contacts-contact-id-resend-verification\n * @example\n * ```ts\n * const issuedVerificationCode = await auth.admin.app(\"app\").endUsers.contacts.resendVerification(\"user\", \"contact\");\n * ```\n */\n resendVerification(userId: string, contactId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.IssuedVerificationCode>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/{user_id}/contacts/{contact_id}/resend-verification\", pathParams: { app_id: this._b.app_id, user_id: userId, contact_id: contactId } }, options);\n }\n}\n\n/** `endUsers.imports` */\nexport class AppEndUsersImportsResource extends APIResource {\n /**\n * Queue a bulk end-user import. Body is NDJSON — one JSON object per line. Returns 202 with a job id; poll `GET .../import/:jobId` for progress and the per-row error report.\n *\n * Row fields: `email` (required), `username`, `display_name`, `role`, `tenant_slugs` (array), `external_id`, `metadata`, `email_verified`, and `password_hash` + `password_hash_algorithm`. `password_hash_algorithm` is `argon2id` or `bcrypt`. **argon2id** hashes are accepted at any parameters. **bcrypt** hashes (`$2a$`, `$2b$`, `$2y$` — Auth0, PHP `password_hash`, Spring, node `bcrypt`, Devise / Rails, Laravel, Django) are accepted at any valid cost (4-31), verified on the user's first signin and replaced by an argon2id hash of the same password in that request, so the user keeps their password and never notices. Signin pads a bcrypt verify up to the argon2id floor, so at cost 10 and below an imported account cannot be told apart by timing; at cost 11 and above the verify is slower than the floor and answers when it finishes — a small timing difference on migrated accounts only, gone after each one's first signin. A re-run is idempotent: rows match on `external_id` first, then the primary email, and update rather than duplicate. An existing password, an already-verified address and an existing member's role are never overwritten — see the module docs for why each one.\n *\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Body is empty or contains no NDJSON rows.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.user.import`.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {APIError} 413 PAYLOAD_TOO_LARGE: Body exceeds 20 MiB or 50,000 rows. Split and retry.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/import\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-import\n * @example\n * ```ts\n * const importJob = await auth.admin.app(\"app\").endUsers.imports.create();\n * ```\n */\n create(options?: RequestOptions): APIPromise<T.WithLastResponse<T.ImportJob>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/import\", pathParams: { app_id: this._b.app_id }, idempotent: true }, options);\n }\n /**\n * Import job status and per-row error report. Never returns the uploaded file.\n *\n * `status: succeeded` means the job RAN TO COMPLETION, not that every row landed — read `failed_count` and `errors` for that. `errors` is capped at the first 500 entries; the counts stay exact.\n *\n * @param jobId - Id of the job.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.user.import`.\n * @throws {NotFoundError} 404 NOT_FOUND: No such import job in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/end-users/import/{job_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-import-job-id\n * @example\n * ```ts\n * const importJob = await auth.admin.app(\"app\").endUsers.imports.retrieve(\"job\");\n * ```\n */\n retrieve(jobId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ImportJob>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/end-users/import/{job_id}\", pathParams: { app_id: this._b.app_id, job_id: jobId } }, options);\n }\n}\n\n/** `endUsers.invites` */\nexport class AppEndUsersInvitesResource extends APIResource {\n /**\n * Pre-allocate an EndUser invite. Dispatches an invitation email via the workspace's Mail sender.\n *\n * @param params - `Auth.EndUserInviteCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown role, or maxUses / expiresInHours out of range.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: An EndUser with this email already exists in the app. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/invites\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-invites\n * @example\n * ```ts\n * const endUserInvite = await auth.admin.app(\"app\").endUsers.invites.create({ email: \"alice@example.com\" });\n * ```\n */\n create(params: T.EndUserInviteCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserInvite>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/invites\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Revoke an EndUser invite (soft-delete).\n *\n * @param inviteId - Id of the invite.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.revoke` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such invite in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/end-users/invites/{invite_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-end-users-invites-invite-id\n * @example\n * ```ts\n * await auth.admin.app(\"app\").endUsers.invites.delete(\"invite\");\n * ```\n */\n delete(inviteId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/end-users/invites/{invite_id}\", pathParams: { app_id: this._b.app_id, invite_id: inviteId } }, options);\n }\n /**\n * List EndUser invites for this app, newest first. Filter by `?status=`.\n *\n * @param params - `Auth.EndUserInviteListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` value.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/end-users/invites\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-invites\n * @example\n * ```ts\n * for await (const invite of auth.admin.app(\"app\").endUsers.invites.list()) {\n * console.log(invite);\n * }\n * const page = await auth.admin.app(\"app\").endUsers.invites.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.EndUserInviteListParams, options?: RequestOptions): PagePromise<T.EndUserInvite> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/end-users/invites\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n}\n\n/** `endUsers.mfa` */\nexport class AppEndUsersMfaResource extends APIResource {\n /**\n * Force an end-user back through MFA enrolment\n *\n * Disables every enabled factor on the account, destroys its recovery codes, and revokes every live session. The next sign-in on an app running `auth_config.mfa: \"required\"` returns `mfa_enrollment_required` and the user must enrol a new factor before a session is minted. On an app running `mfa: \"optional\"` the user simply ends up with no MFA, which is the pre-existing meaning of deleting their factors. All three steps matter: leaving the recovery codes alive would let whoever holds the old printout complete `/auth/mfa/recover` and skip enrolment entirely. Audited, and emits `user.mfa.factor_disabled` per factor plus one `user.mfa.reenrollment_required`. Idempotent.\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller's workspace policy does not allow `auth.user.factors.delete` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: No such end-user in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/{user_id}/mfa/require-reenrollment\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-mfa-require-reenrollment\n * @example\n * ```ts\n * const requireMfaReenrollment = await auth.admin.app(\"app\").endUsers.mfa.requireReenrollment(\"user\");\n * ```\n */\n requireReenrollment(userId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.RequireMfaReenrollment>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/{user_id}/mfa/require-reenrollment\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n}\n\n/** `endUsers.sessions` */\nexport class AppEndUsersSessionsResource extends APIResource {\n /**\n * Revoke every active session for an end-user.\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such end-user in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/{user_id}/sessions/revoke-all\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-sessions-revoke-all\n * @example\n * ```ts\n * await auth.admin.app(\"app\").endUsers.sessions.revokeAll(\"user\");\n * ```\n */\n revokeAll(userId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/{user_id}/sessions/revoke-all\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n}\n\n/** `endUsers` */\nexport class AppEndUsersResource extends APIResource {\n #contacts?: AppEndUsersContactsResource;\n #imports?: AppEndUsersImportsResource;\n #invites?: AppEndUsersInvitesResource;\n #mfa?: AppEndUsersMfaResource;\n #sessions?: AppEndUsersSessionsResource;\n get contacts(): AppEndUsersContactsResource {\n return (this.#contacts ??= new AppEndUsersContactsResource(this._client, this._b));\n }\n get imports(): AppEndUsersImportsResource {\n return (this.#imports ??= new AppEndUsersImportsResource(this._client, this._b));\n }\n get invites(): AppEndUsersInvitesResource {\n return (this.#invites ??= new AppEndUsersInvitesResource(this._client, this._b));\n }\n get mfa(): AppEndUsersMfaResource {\n return (this.#mfa ??= new AppEndUsersMfaResource(this._client, this._b));\n }\n get sessions(): AppEndUsersSessionsResource {\n return (this.#sessions ??= new AppEndUsersSessionsResource(this._client, this._b));\n }\n /**\n * Bulk-delete accounts across a selection.\n *\n * Deletes every matched account in one transaction. Each deleted account gets an `auth.account.deleted` audit row (`via: platform_bulk`) whose metadata carries the `selection` (`{ mode: \"ids\" }`, or `{ mode: \"filter\", filter }`), so a filter sweep reads as one. The workspace audit log gets one `auth.end_users.deleted` row with the count. `user.deleted` (`via: \"platform_bulk\"`) fires per account only when 100 or fewer were deleted.\n *\n * @param params - `Auth.EndUserBulkDeleteParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `selection` body, or an unfiltered selection without `confirm_all_in_app: true` (including more than 5,000 ids).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.delete` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/bulk-delete\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-bulk-delete\n * @example\n * ```ts\n * const bulkAffectedUsers = await auth.admin.app(\"app\").endUsers.bulkDelete({ selection: { mode: \"ids\" } });\n * ```\n */\n bulkDelete(params: T.EndUserBulkDeleteParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.BulkAffectedUsers>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/bulk-delete\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n /**\n * Bulk-revoke sessions across a selection.\n *\n * @param params - `Auth.EndUserBulkRevokeSessionsParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `selection` body (including more than 5,000 ids).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/bulk-revoke-sessions\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-bulk-revoke-sessions\n * @example\n * ```ts\n * const bulkAffectedUsers = await auth.admin.app(\"app\").endUsers.bulkRevokeSessions({ selection: { mode: \"ids\" } });\n * ```\n */\n bulkRevokeSessions(params: T.EndUserBulkRevokeSessionsParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.BulkAffectedUsers>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/bulk-revoke-sessions\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n /**\n * Bulk-assign a role across a selection.\n *\n * @param params - `Auth.EndUserBulkUpdateRoleParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `selection` body or empty `roleName`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.assign` on this app, cannot grant every permission the role carries, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App or role not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/bulk-update-role\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-bulk-update-role\n * @example\n * ```ts\n * const bulkAffectedUsers = await auth.admin.app(\"app\").endUsers.bulkUpdateRole({ role_name: \"string\", selection: { mode: \"ids\" } });\n * ```\n */\n bulkUpdateRole(params: T.EndUserBulkUpdateRoleParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.BulkAffectedUsers>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/bulk-update-role\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n /**\n * Bulk-update status across a selection.\n *\n * @param params - `Auth.EndUserBulkUpdateStatusParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `selection` body, or `status` is not one of active, suspended, deactivated.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/bulk-update-status\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-bulk-update-status\n * @example\n * ```ts\n * const bulkAffectedUsers = await auth.admin.app(\"app\").endUsers.bulkUpdateStatus({ selection: { mode: \"ids\" }, status: \"suspended\" });\n * ```\n */\n bulkUpdateStatus(params: T.EndUserBulkUpdateStatusParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.BulkAffectedUsers>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/bulk-update-status\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n /**\n * Delete an end-user permanently.\n *\n * Removes the account with its contacts, sessions and tenant memberships. Writes one `auth.account.deleted` audit row (`via: platform`) in the same transaction, mirrors the deletion into the workspace audit log as `auth.end_users.deleted`, and fires `user.deleted` with `via: \"platform\"`.\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.delete` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such end-user in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/end-users/{user_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-end-users-user-id\n * @example\n * ```ts\n * await auth.admin.app(\"app\").endUsers.delete(\"user\");\n * ```\n */\n delete(userId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/end-users/{user_id}\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n /**\n * Stream this app's end-user directory as NDJSON or CSV, applying the list's `?status=` / `?search=` / `?provider=` filters. Audited as `users.exported`.\n *\n * Streamed in keyset batches — neither the service nor the client holds the whole directory. Ordered oldest-first by `(created_at, id)` so a re-run is stable. Gated on `auth.user.export`, which is escalation class: this hands over every address in the directory in one call, where `auth.list` pages it. Hard cap of 1,000,000 rows; a wider request is refused with 413 before any body is written.\n *\n * @param params - `Auth.EndUserExportParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `format`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.user.export`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {APIError} 413 PAYLOAD_TOO_LARGE: More than 1,000,000 end-users match. Narrow the filters.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/end-users/export\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-export\n * @example\n * ```ts\n * const response = await auth.admin.app(\"app\").endUsers.export();\n * const text = await response.text();\n * ```\n */\n export(params?: T.EndUserExportParams, options?: RequestOptions): APIPromise<Response> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/end-users/export\", pathParams: { app_id: this._b.app_id }, query: params, raw: true }, options);\n }\n /**\n * List end-users in this app (cursor-paginated).\n *\n * @param params - `Auth.EndUserListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `signal` / `sort` / `order`, or a `cursor` minted under a different ordering than the one requested.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/end-users\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users\n * @example\n * ```ts\n * for await (const endUser of auth.admin.app(\"app\").endUsers.list()) {\n * console.log(endUser);\n * }\n * const page = await auth.admin.app(\"app\").endUsers.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.EndUserListParams, options?: RequestOptions): PagePromise<T.EndUserSummary> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/end-users\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n /**\n * Resend verification to the primary email contact.\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such end-user in this app.\n * @throws {ConflictError} 409 CONFLICT: End-user has no primary email contact, or it is already verified.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/{user_id}/resend-verification\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-resend-verification\n * @example\n * ```ts\n * const issuedVerificationCode = await auth.admin.app(\"app\").endUsers.resendVerification(\"user\");\n * ```\n */\n resendVerification(userId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.IssuedVerificationCode>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/{user_id}/resend-verification\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n /**\n * Get one end-user.\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such end-user in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/end-users/{user_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-user-id\n * @example\n * ```ts\n * const endUserSummary = await auth.admin.app(\"app\").endUsers.retrieve(\"user\");\n * ```\n */\n retrieve(userId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserSummary>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/end-users/{user_id}\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n /**\n * Update end-user display name, primary email, or metadata keys (merged).\n *\n * @param userId - Id of the user.\n * @param params - `Auth.EndUserUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid body: empty `displayName`, malformed `email`, `metadata` not an object, or metadata over 8 KB.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such end-user in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/end-users/{user_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-end-users-user-id\n * @example\n * ```ts\n * const endUserSummary = await auth.admin.app(\"app\").endUsers.update(\"user\", { display_name: \"string\" });\n * ```\n */\n update(userId: string, params?: T.EndUserUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserSummary>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/end-users/{user_id}\", pathParams: { app_id: this._b.app_id, user_id: userId }, body: params }, options);\n }\n /**\n * Assign an end-user a role.\n *\n * @param userId - Id of the user.\n * @param params - `Auth.EndUserUpdateRoleParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `roleName` missing or empty.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.assign` on this app, cannot grant every permission the role carries, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App, end-user or role not found in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/end-users/{user_id}/role\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-end-users-user-id-role\n * @example\n * ```ts\n * const endUserRoleAssignment = await auth.admin.app(\"app\").endUsers.updateRole(\"user\", { role_name: \"admin\" });\n * ```\n */\n updateRole(userId: string, params: T.EndUserUpdateRoleParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserRoleAssignment>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/end-users/{user_id}/role\", pathParams: { app_id: this._b.app_id, user_id: userId }, body: params }, options);\n }\n /**\n * Change end-user status (active / suspended / deactivated).\n *\n * @param userId - Id of the user.\n * @param params - `Auth.EndUserUpdateStatusParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `status` is not one of active, suspended, deactivated.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such end-user in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/end-users/{user_id}/status\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-end-users-user-id-status\n * @example\n * ```ts\n * const endUserSummary = await auth.admin.app(\"app\").endUsers.updateStatus(\"user\", { status: \"suspended\" });\n * ```\n */\n updateStatus(userId: string, params: T.EndUserUpdateStatusParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserSummary>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/end-users/{user_id}/status\", pathParams: { app_id: this._b.app_id, user_id: userId }, body: params }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).endUsers.retrieve()` (GET /v1/apps/{app_id}/end-users/{user_id}).\n *\n * @deprecated Use `auth.admin.app(…).endUsers.retrieve()`. Kept for 0.x callers; removed in 2.0.\n */\n get(userId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserSummary>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/end-users/{user_id}\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).endUsers.sessions.revokeAll()` (POST /v1/apps/{app_id}/end-users/{user_id}/sessions/revoke-all).\n *\n * @deprecated Use `auth.admin.app(…).endUsers.sessions.revokeAll()`. Kept for 0.x callers; removed in 2.0.\n */\n revokeAllSessions(userId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/{user_id}/sessions/revoke-all\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n}\n\n/** `invites` */\nexport class AppInvitesResource extends APIResource {\n /**\n * 0.x name for `auth.admin.app(…).endUsers.invites.create()` (POST /v1/apps/{app_id}/end-users/invites).\n *\n * @deprecated Use `auth.admin.app(…).endUsers.invites.create()`. Kept for 0.x callers; removed in 2.0.\n */\n create(params: T.EndUserInviteCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserInvite>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/invites\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).endUsers.invites.list()` (GET /v1/apps/{app_id}/end-users/invites).\n *\n * @deprecated Use `auth.admin.app(…).endUsers.invites.list()`. Kept for 0.x callers; removed in 2.0.\n */\n list(params?: T.EndUserInviteListParams, options?: RequestOptions): PagePromise<T.EndUserInvite> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/end-users/invites\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).endUsers.invites.delete()` (DELETE /v1/apps/{app_id}/end-users/invites/{invite_id}).\n *\n * @deprecated Use `auth.admin.app(…).endUsers.invites.delete()`. Kept for 0.x callers; removed in 2.0.\n */\n revoke(inviteId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/end-users/invites/{invite_id}\", pathParams: { app_id: this._b.app_id, invite_id: inviteId } }, options);\n }\n}\n\n/** `members` */\nexport class AppMembersResource extends APIResource {\n /**\n * Remove a member from the app\n *\n * @param accountId - Id of the account.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.delete` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or the account is not a member of this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/members/{account_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-members-account-id\n * @example\n * ```ts\n * await auth.admin.app(\"app\").members.delete(\"account\");\n * ```\n */\n delete(accountId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/members/{account_id}\", pathParams: { app_id: this._b.app_id, account_id: accountId } }, options);\n }\n /**\n * List app members (PlatformUser view of EndUser memberships)\n *\n * @param params - `Auth.MemberListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid pagination cursor.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.list` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/members\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-members\n * @example\n * ```ts\n * for await (const member of auth.admin.app(\"app\").members.list()) {\n * console.log(member);\n * }\n * const page = await auth.admin.app(\"app\").members.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.MemberListParams, options?: RequestOptions): PagePromise<T.AppMemberSummary> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/members\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).members.delete()` (DELETE /v1/apps/{app_id}/members/{account_id}).\n *\n * @deprecated Use `auth.admin.app(…).members.delete()`. Kept for 0.x callers; removed in 2.0.\n */\n remove(accountId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/members/{account_id}\", pathParams: { app_id: this._b.app_id, account_id: accountId } }, options);\n }\n}\n\n/** `notificationSettings` */\nexport class AppNotificationSettingsResource extends APIResource {\n /**\n * Read the per-app notification settings. Absent row reads as defaults (notifications_via_envoi: false, sender_mode: workspace, every template slot null).\n *\n * `effective_sender` is the sender emails actually go out from, checked live in Mail with your own access (the workspace default sender, or the app's custom address).\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/notification-settings\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-notification-settings\n * @example\n * ```ts\n * const appNotificationSettings = await auth.admin.app(\"app\").notificationSettings.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.AppNotificationSettings>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/notification-settings\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Update the per-app notification settings. Each field is independently optional; null clears that slot.\n *\n * Turning `notifications_via_envoi` on (from off) creates the default template of every empty slot in the workspace's Mail templates (`auth-verification`, `auth-welcome`, `auth-password-reset`, `auth-invite`, `auth-mfa-code`), reusing a template that already has that name, and fills the slot. Templates are created with your own Mail access; a slot that could not be created stays empty. A slot you clear later is not refilled until emails are switched off and on again.\n *\n * @param params - `Auth.NotificationSettingUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid payload.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {UnprocessableEntityError} 422 UNPROCESSABLE_ENTITY, SENDER_ADDRESS_REQUIRED: `SENDER_ADDRESS_REQUIRED`: `sender_mode: custom` with no `default_sender_address` (in the body or already saved).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/notification-settings\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-notification-settings\n * @example\n * ```ts\n * const appNotificationSettings = await auth.admin.app(\"app\").notificationSettings.update({ default_sender_address: \"ada@example.com\" });\n * ```\n */\n update(params?: T.NotificationSettingUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AppNotificationSettings>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/notification-settings\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n}\n\n/** `notifications` */\nexport class AppNotificationsResource extends APIResource {\n /**\n * Send me a test of one email.\n *\n * Sends the slot's real Mail template, with this app's real sender (the workspace default or the custom address) and example values for every variable, to your own verified account address. It cannot be sent anywhere else. It uses your own Mail access, goes through the same send path as real emails, and shows up in Mail > Emails. At most 10 tests per person per hour. Not available to API keys (a key has no inbox).\n *\n * @param slot - The email to test.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `slot`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, the app is suspended or archived, or Mail refused the send for your role (you need Mail send access in this workspace).\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or the slot's template no longer exists in Mail.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {APIError} 412 PRECONDITION_FAILED, ENVOI_TEMPLATE_NOT_CONFIGURED, ENVOI_SENDER_NOT_CONFIGURED, ENVOI_APP_NOT_BOUND_TO_WORKSPACE: `ENVOI_TEMPLATE_NOT_CONFIGURED`: the slot has no template. `ENVOI_SENDER_NOT_CONFIGURED`: `sender_mode: custom` with no address. `ENVOI_APP_NOT_BOUND_TO_WORKSPACE`.\n * @throws {UnprocessableEntityError} 422 UNPROCESSABLE_ENTITY: `operator_email_unavailable`: the caller has no verified account email (API keys included). From Mail: `no_default_sender` (workspace mode and no default sender set in Mail), `from_domain_not_verified`, `domain_not_verified_by_provider`, a suppressed address, or a render failure.\n * @throws {RateLimitError} 429 RATE_LIMITED: More than 10 tests by you in the last hour (`RATE_LIMITED`), or over a Mail send limit.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE, MAIL_UNREACHABLE: `MAIL_UNREACHABLE`: Mail did not answer.\n * @see POST /v1/apps/{app_id}/notifications/{slot}/test\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-notifications-slot-test\n * @example\n * ```ts\n * const notificationTest = await auth.admin.app(\"app\").notifications.test(\"slot\");\n * ```\n */\n test(slot: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.NotificationTest>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/notifications/{slot}/test\", pathParams: { app_id: this._b.app_id, slot }, idempotent: true }, options);\n }\n}\n\n/** `permissions.enforcement` */\nexport class AppPermissionsEnforcementResource extends APIResource {\n /**\n * List permissions that at least one Consumer-API route enforces\n *\n * Returns the deduplicated set of permission strings that any handler in this users-api build gates via `@RequireAppPermission`. Drives the console \"Enforced\" badge — a customer who binds `user.delete` to a role can see whether any route in this deploy actually checks for it. App-agnostic in shape; the path parameter is included for URN symmetry with the rest of the per-app surface, not to narrow the response.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/permissions/enforcement\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-permissions-enforcement\n * @example\n * ```ts\n * const enforcedPermissions = await auth.admin.app(\"app\").permissions.enforcement.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.EnforcedPermissions>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/permissions/enforcement\", pathParams: { app_id: this._b.app_id } }, options);\n }\n}\n\n/** `permissions` */\nexport class AppPermissionsResource extends APIResource {\n #enforcement?: AppPermissionsEnforcementResource;\n get enforcement(): AppPermissionsEnforcementResource {\n return (this.#enforcement ??= new AppPermissionsEnforcementResource(this._client, this._b));\n }\n /**\n * Create a custom permission\n *\n * @param params - `Auth.AppScopedPermissionCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`resource` / `action` segment format, or `description` over 256 chars).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Permission collides with a system permission or already exists in this app, or the app has reached its custom-permission limit (`code` set). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/permissions\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-permissions\n * @example\n * ```ts\n * const permission = await auth.admin.app(\"app\").permissions.create({ action: \"read\", resource: \"project\" });\n * ```\n */\n create(params: T.AppScopedPermissionCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Permission>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/permissions\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a custom permission\n *\n * @param permissionKey - Permission key, `resource.action` (e.g. `invoice.read`).\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `permissionKey` is not in `resource.action` format.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived, or the key names a system permission.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such custom permission in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/permissions/{permission_key}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-permissions-permission-key\n * @example\n * ```ts\n * await auth.admin.app(\"app\").permissions.delete(\"permission_key\");\n * ```\n */\n delete(permissionKey: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/permissions/{permission_key}\", pathParams: { app_id: this._b.app_id, permission_key: permissionKey } }, options);\n }\n /**\n * List all permissions (system + custom)\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/permissions\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-permissions\n * @example\n * ```ts\n * const result = await auth.admin.app(\"app\").permissions.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.AppScopedPermissionListResponse>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/permissions\", pathParams: { app_id: this._b.app_id } }, options);\n }\n}\n\n/** `roles.permissions` */\nexport class AppRolesPermissionsResource extends APIResource {\n /**\n * List all available permissions\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/roles/permissions\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-roles-permissions\n * @example\n * ```ts\n * const result = await auth.admin.app(\"app\").roles.permissions.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.RolePermissionListResponse>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/roles/permissions\", pathParams: { app_id: this._b.app_id } }, options);\n }\n}\n\n/** `roles` */\nexport class AppRolesResource extends APIResource {\n #permissions?: AppRolesPermissionsResource;\n get permissions(): AppRolesPermissionsResource {\n return (this.#permissions ??= new AppRolesPermissionsResource(this._client, this._b));\n }\n /**\n * Assign a role to a user\n *\n * @param params - `Auth.RoleAssignParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`accountId` not a UUID, or `role` empty / over 64 chars).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.assign` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, no such role in this app, or the account is not a member of this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/roles/assign\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-roles-assign\n * @example\n * ```ts\n * const appMembership = await auth.admin.app(\"app\").roles.assign({ account_id: \"string\", role: \"admin\" });\n * ```\n */\n assign(params: T.RoleAssignParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AppMembership>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/roles/assign\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n /**\n * Create a new role (no permissions yet — set them via PUT /:roleName/permissions)\n *\n * @param params - `Auth.AppScopedRoleCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`name` 1-64 chars, `description` up to 256).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: A role with this name already exists in this app. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/roles\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-roles\n * @example\n * ```ts\n * const role = await auth.admin.app(\"app\").roles.create({ name: \"editor\" });\n * ```\n */\n create(params: T.AppScopedRoleCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Role>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/roles\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a custom role\n *\n * @param roleName - Name of the role (e.g. `admin`).\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.delete` on this app, or the app is suspended or archived, or the role is a system role.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such role in this app.\n * @throws {ConflictError} 409 CONFLICT: Role is still assigned to members (`code: ROLE_IN_USE`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/roles/{role_name}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-roles-role-name\n * @example\n * ```ts\n * await auth.admin.app(\"app\").roles.delete(\"role_name\");\n * ```\n */\n delete(roleName: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/roles/{role_name}\", pathParams: { app_id: this._b.app_id, role_name: roleName } }, options);\n }\n /**\n * List all roles in an app. Filter by `?search=` on the role name.\n *\n * @param params - `Auth.AppScopedRoleListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/roles\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-roles\n * @example\n * ```ts\n * for await (const role of auth.admin.app(\"app\").roles.list()) {\n * console.log(role);\n * }\n * const page = await auth.admin.app(\"app\").roles.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.AppScopedRoleListParams, options?: RequestOptions): PagePromise<T.Role> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/roles\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n /**\n * Get role details with permissions\n *\n * @param roleName - Name of the role (e.g. `admin`).\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such role in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/roles/{role_name}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-roles-role-name\n * @example\n * ```ts\n * const roleWithPermissions = await auth.admin.app(\"app\").roles.retrieve(\"role_name\");\n * ```\n */\n retrieve(roleName: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.RoleWithPermissions>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/roles/{role_name}\", pathParams: { app_id: this._b.app_id, role_name: roleName } }, options);\n }\n /**\n * Update role name or description\n *\n * @param roleName - Name of the role (e.g. `admin`).\n * @param params - `Auth.AppScopedRoleUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`description` over 256 chars).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such role in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/roles/{role_name}\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-roles-role-name\n * @example\n * ```ts\n * const role = await auth.admin.app(\"app\").roles.update(\"role_name\", { description: \"Updated description\" });\n * ```\n */\n update(roleName: string, params?: T.AppScopedRoleUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Role>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/roles/{role_name}\", pathParams: { app_id: this._b.app_id, role_name: roleName }, body: params }, options);\n }\n /**\n * Set permissions for a role (caller-narrowed: caller must hold every requested permission)\n *\n * @param roleName - Name of the role (e.g. `admin`).\n * @param params - `Auth.AppScopedRoleUpdatePermissionsParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (a permission not in `resource.action` format), or a permission not in the app catalogue.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived, or the caller does not hold every permission it is trying to grant.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such role in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PUT /v1/apps/{app_id}/roles/{role_name}/permissions\n * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-roles-role-name-permissions\n * @example\n * ```ts\n * const result = await auth.admin.app(\"app\").roles.updatePermissions(\"role_name\", { permissions: [\"user.read\", \"role.create\"] });\n * ```\n */\n updatePermissions(roleName: string, params: T.AppScopedRoleUpdatePermissionsParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AppScopedRoleUpdatePermissionsResponse>> {\n return this._client.request({ method: \"PUT\", path: \"/v1/apps/{app_id}/roles/{role_name}/permissions\", pathParams: { app_id: this._b.app_id, role_name: roleName }, body: params }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).roles.retrieve()` (GET /v1/apps/{app_id}/roles/{role_name}).\n *\n * @deprecated Use `auth.admin.app(…).roles.retrieve()`. Kept for 0.x callers; removed in 2.0.\n */\n get(roleName: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.RoleWithPermissions>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/roles/{role_name}\", pathParams: { app_id: this._b.app_id, role_name: roleName } }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).roles.permissions.list()` (GET /v1/apps/{app_id}/roles/permissions).\n *\n * @deprecated Use `auth.admin.app(…).roles.permissions.list()`. Kept for 0.x callers; removed in 2.0.\n */\n listPermissions(options?: RequestOptions): APIPromise<T.WithLastResponse<T.RolePermissionListResponse>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/roles/permissions\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).roles.updatePermissions()` (PUT /v1/apps/{app_id}/roles/{role_name}/permissions).\n *\n * @deprecated Use `auth.admin.app(…).roles.updatePermissions()`. Kept for 0.x callers; removed in 2.0.\n */\n setPermissions(roleName: string, params: T.AppScopedRoleUpdatePermissionsParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AppScopedRoleUpdatePermissionsResponse>> {\n return this._client.request({ method: \"PUT\", path: \"/v1/apps/{app_id}/roles/{role_name}/permissions\", pathParams: { app_id: this._b.app_id, role_name: roleName }, body: params }, options);\n }\n}\n\n/** `setupStatus` */\nexport class AppSetupStatusResource extends APIResource {\n /**\n * Get the setup checklist for an app: what works, what is missing, and where to fix it.\n *\n * Rows, in order: `signups` (attention while sign-ups are off), `redirect_origins` (blocked until at least one site may start sign-in), one `provider_<id>` row per switched-on sign-in provider (blocked while its status is blocked), `email` (sender chosen and a template for every email; attention while emails are off), `api_key` (attention until an active app key exists), `webhook` (attention until an endpoint has accepted a delivery), and `passkeys` (only while passkeys are on; blocked when no allowed redirect origin is on the passkey site). `complete` is true once no row is `not_set` or `blocked`. Each `fix.href` is a console path to the exact setting. Computed on every request from stored settings, plus the workspace default sender read from Mail with your own access when emails use it: nothing here calls DNS or a sign-in provider (a provider whose last credential check was rejected shows as blocked). A ready provider row carries `test.action: sign_in.try`: run it with `POST /v1/apps/{appId}/sign-in-tests` `{ method: \"oauth\", provider }`.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/setup-status\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-setup-status\n * @example\n * ```ts\n * const setupStatus = await auth.admin.app(\"app\").setupStatus.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.SetupStatus>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/setup-status\", pathParams: { app_id: this._b.app_id } }, options);\n }\n}\n\n/** `signInTests` */\nexport class AppSignInTestsResource extends APIResource {\n /**\n * Start a sign-in test: prove sign-in works without creating a user.\n *\n * For `oauth`, the server first checks what it can on its own (an allowed redirect origin, saved credentials, and the provider credential check). If one fails, the test comes back `failed` at once with the fix. Otherwise open `start_url` in a popup: the person signs in at the provider, the provider returns to Auth, Auth resolves who it is exactly as a real sign-in would, records `would_sign_in_existing` or `would_create` (or the provider error mapped to its fix), creates no account and issues no token, then sends the popup to the console result page. Poll `GET …/sign-in-tests/{id}` until `state` is not `pending`. Works with a provider that is saved but not switched on yet. For `password` / `otp`, the test runs now: it checks the sign-up or sign-in rules for your own email and sends the real email to your own verified address. At most 20 tests per app per hour; tests are deleted after 24 hours.\n *\n * @param params - `Auth.SignInTestCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, CUSTOM_DOMAIN_OAUTH_ONLY: Unknown `method` or provider, `provider` missing for `oauth`, or `custom_domain` on a `password` / `otp` test (`CUSTOM_DOMAIN_OAUTH_ONLY`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, CUSTOM_DOMAIN_NOT_ACTIVE, IDEMPOTENCY_IN_PROGRESS: Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`), or `custom_domain: true` while the app has no active custom domain (`CUSTOM_DOMAIN_NOT_ACTIVE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: More than 20 tests for this app in the last hour (`RATE_LIMITED`).\n * @see POST /v1/apps/{app_id}/sign-in-tests\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-sign-in-tests\n * @example\n * ```ts\n * const signInTest = await auth.admin.app(\"app\").signInTests.create({ method: \"oauth\" });\n * ```\n */\n create(params: T.SignInTestCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.SignInTest>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/sign-in-tests\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Get a sign-in test and its result.\n *\n * Poll this after opening `start_url`. `state` turns `succeeded` (with `outcome` and `identity`) or `failed` (with `error.fix`). A test that is never finished turns `failed` with code `expired` 15 minutes after it was created.\n *\n * @param testId - Id of the test.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `testId` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App or sign-in test not found (tests are deleted after 24 hours).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/sign-in-tests/{test_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-sign-in-tests-test-id\n * @example\n * ```ts\n * const signInTest = await auth.admin.app(\"app\").signInTests.retrieve(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\");\n * ```\n */\n retrieve(testId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.SignInTest>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/sign-in-tests/{test_id}\", pathParams: { app_id: this._b.app_id, test_id: testId } }, options);\n }\n}\n\n/** `tenantApiKeys.config` */\nexport class AppTenantApiKeysConfigResource extends APIResource {\n /**\n * Read the app's tenant API key settings\n *\n * Includes the platform kill switch `suspended`. Requires `auth.read` on the app.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/tenant-api-keys/config\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenant-api-keys-config\n * @example\n * ```ts\n * const tenantApiKeysConfig = await auth.admin.app(\"app\").tenantApiKeys.config.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantApiKeysConfig>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/tenant-api-keys/config\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Change the app's tenant API key settings, or suspend its keys\n *\n * Fields you leave out keep their stored value. `suspended: true` is the kill switch: introspection answers `{\"active\": false}` for every key of the app at once, and key management is refused, until you set it back to `false`. The app's own config push (`PUT /:appSlug/v1/tenant-api-keys/config`) can never change it. Requires `auth.update` on the app.\n *\n * @param params - `Auth.AppScopedTenantApiKeyConfigUpdateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, TENANT_API_KEYS_SCOPE_INVALID, TENANT_API_KEYS_UNKNOWN_ROLE, TENANT_API_KEY_EXPIRY_INVALID, TENANT_API_KEYS_NO_SCOPES: `VALIDATION_ERROR`, `TENANT_API_KEYS_SCOPE_INVALID`, `TENANT_API_KEYS_UNKNOWN_ROLE`, `TENANT_API_KEY_EXPIRY_INVALID`, `TENANT_API_KEYS_NO_SCOPES`, or a malformed `Idempotency-Key`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: `IDEMPOTENCY_KEY_REUSE`. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PUT /v1/apps/{app_id}/tenant-api-keys/config\n * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-tenant-api-keys-config\n * @example\n * ```ts\n * const tenantApiKeysConfig = await auth.admin.app(\"app\").tenantApiKeys.config.update({ default_expiry_days: 7 });\n * ```\n */\n update(params?: T.AppScopedTenantApiKeyConfigUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantApiKeysConfig>> {\n return this._client.request({ method: \"PUT\", path: \"/v1/apps/{app_id}/tenant-api-keys/config\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n}\n\n/** `tenantApiKeys` */\nexport class AppTenantApiKeysResource extends APIResource {\n #config?: AppTenantApiKeysConfigResource;\n get config(): AppTenantApiKeysConfigResource {\n return (this.#config ??= new AppTenantApiKeysConfigResource(this._client, this._b));\n }\n /**\n * Revoke a tenant's API key\n *\n * Immediate and final; recorded as revoked by you (`revoked_by_type: platform_user`) in the key and in the audit log. Idempotent: revoking a revoked key is a 204 that changes nothing. Requires `auth.revoke` on the app.\n *\n * @param keyId - Key id (UUID) or display id (`tak_…`).\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.revoke` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND, TENANT_API_KEY_NOT_FOUND: `TENANT_API_KEY_NOT_FOUND`: no such key in this app (or app not found).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/tenant-api-keys/{key_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-tenant-api-keys-key-id\n * @example\n * ```ts\n * await auth.admin.app(\"app\").tenantApiKeys.delete(\"key\");\n * ```\n */\n delete(keyId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/tenant-api-keys/{key_id}\", pathParams: { app_id: this._b.app_id, key_id: keyId } }, options);\n }\n /**\n * List the app's tenant API keys\n *\n * Every tenant of the app, newest first, cursor-paginated (20 per page, max 100). Secrets are never returned. Each key names its creator (`created_by`), and its `status` is `orphaned` when it is neither revoked nor expired but its creator left the tenant or the tenant is not active (introspection refuses it). Requires `auth.read` on the app.\n *\n * @param params - `Auth.AppScopedTenantApiKeyListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` or malformed `cursor`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or `tenant_id` names no tenant of this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/tenant-api-keys\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenant-api-keys\n * @example\n * ```ts\n * for await (const tenantApiKey of auth.admin.app(\"app\").tenantApiKeys.list()) {\n * console.log(tenantApiKey);\n * }\n * const page = await auth.admin.app(\"app\").tenantApiKeys.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.AppScopedTenantApiKeyListParams, options?: RequestOptions): PagePromise<T.PlatformTenantApiKey> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/tenant-api-keys\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n}\n\n/** `tenants.invites` */\nexport class AppTenantsInvitesResource extends APIResource {\n /**\n * Invite an email address into a tenant. Returns the plaintext code once; only its SHA-256 digest is stored.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.AppScopedTenantInviteCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid email, unknown role, or maxUses/expiresInHours out of range.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: That email is already a member of the tenant, or already has a pending invite to it. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/tenants/{tenant_id}/invites\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-tenants-tenant-id-invites\n * @example\n * ```ts\n * const createTenantInvite = await auth.admin.app(\"app\").tenants.invites.create(\"tenant\", { email: \"alice@example.com\", role_name: \"member\" });\n * ```\n */\n create(tenantId: string, params: T.AppScopedTenantInviteCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CreateTenantInvite>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}/invites\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId }, body: params, idempotent: true }, options);\n }\n /**\n * Revoke a pending invite. Idempotent — a second revoke is a 204 no-op and fires no second webhook.\n *\n * @param tenantId - Id of the tenant.\n * @param inviteId - Id of the invite.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant or invite not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/tenants/{tenant_id}/invites/{invite_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-tenants-tenant-id-invites-invite-id\n * @example\n * ```ts\n * await auth.admin.app(\"app\").tenants.invites.delete(\"tenant\", \"invite\");\n * ```\n */\n delete(tenantId: string, inviteId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}/invites/{invite_id}\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId, invite_id: inviteId } }, options);\n }\n /**\n * List a tenant's invites, newest first. Optional `?status=pending|revoked|expired|used`. Codes are never returned.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.AppScopedTenantInviteListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` value.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/tenants/{tenant_id}/invites\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenants-tenant-id-invites\n * @example\n * ```ts\n * for await (const invite of auth.admin.app(\"app\").tenants.invites.list(\"tenant\")) {\n * console.log(invite);\n * }\n * const page = await auth.admin.app(\"app\").tenants.invites.list(\"tenant\", {}, { timeout: 5_000 });\n * ```\n */\n list(tenantId: string, params?: T.AppScopedTenantInviteListParams, options?: RequestOptions): PagePromise<T.TenantInvite> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}/invites\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId }, query: params }, options);\n }\n}\n\n/** `tenants.members` */\nexport class AppTenantsMembersResource extends APIResource {\n /**\n * Add a member to a tenant.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.AppScopedTenantMemberCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid body, neither or both of `accountId` / `email`, or unknown role.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.members.add` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App, tenant or account not found in this app.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Account is already a member of this tenant. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/tenants/{tenant_id}/members\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-tenants-tenant-id-members\n * @example\n * ```ts\n * const addMember = await auth.admin.app(\"app\").tenants.members.create(\"tenant\", { role_name: \"member\" });\n * ```\n */\n create(tenantId: string, params: T.AppScopedTenantMemberCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AddMember>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}/members\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId }, body: params, idempotent: true }, options);\n }\n /**\n * Remove a member from a tenant.\n *\n * @param tenantId - Id of the tenant.\n * @param accountId - Id of the account.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.members.remove` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App, tenant or membership not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/tenants/{tenant_id}/members/{account_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-tenants-tenant-id-members-account-id\n * @example\n * ```ts\n * await auth.admin.app(\"app\").tenants.members.delete(\"tenant\", \"account\");\n * ```\n */\n delete(tenantId: string, accountId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}/members/{account_id}\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId, account_id: accountId } }, options);\n }\n /**\n * List members of a tenant, newest membership first. Filter by `?search=` and/or `?role=`.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.AppScopedTenantMemberListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `search` or `role` exceeds its max length.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App or tenant not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/tenants/{tenant_id}/members\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenants-tenant-id-members\n * @example\n * ```ts\n * for await (const member of auth.admin.app(\"app\").tenants.members.list(\"tenant\")) {\n * console.log(member);\n * }\n * const page = await auth.admin.app(\"app\").tenants.members.list(\"tenant\", {}, { timeout: 5_000 });\n * ```\n */\n list(tenantId: string, params?: T.AppScopedTenantMemberListParams, options?: RequestOptions): PagePromise<T.TenantMembership> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}/members\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId }, query: params }, options);\n }\n /**\n * Change a member's role inside a tenant.\n *\n * @param tenantId - Id of the tenant.\n * @param accountId - Id of the account.\n * @param params - `Auth.AppScopedTenantMemberUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid body or unknown role.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.members.update-role` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App, tenant or membership not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/tenants/{tenant_id}/members/{account_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-tenants-tenant-id-members-account-id\n * @example\n * ```ts\n * const tenantMembership = await auth.admin.app(\"app\").tenants.members.update(\"tenant\", \"account\", { role_name: \"admin\" });\n * ```\n */\n update(tenantId: string, accountId: string, params: T.AppScopedTenantMemberUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantMembership>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}/members/{account_id}\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId, account_id: accountId }, body: params }, options);\n }\n}\n\n/** `tenants` */\nexport class AppTenantsResource extends APIResource {\n #invites?: AppTenantsInvitesResource;\n #members?: AppTenantsMembersResource;\n get invites(): AppTenantsInvitesResource {\n return (this.#invites ??= new AppTenantsInvitesResource(this._client, this._b));\n }\n get members(): AppTenantsMembersResource {\n return (this.#members ??= new AppTenantsMembersResource(this._client, this._b));\n }\n /**\n * Create a tenant in this app. Auth-admin lane; requires auth.tenant.create on the app URN.\n *\n * @param params - `Auth.AppScopedTenantCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid body, empty `displayName`, or `slug` not 1-64 chars of [a-z0-9-].\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.create` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Slug already taken in this app, or no unique slug could be derived. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/tenants\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-tenants\n * @example\n * ```ts\n * const tenant = await auth.admin.app(\"app\").tenants.create({ display_name: \"Acme Co\" });\n * ```\n */\n create(params: T.AppScopedTenantCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Tenant>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/tenants\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a tenant.\n *\n * @param tenantId - Id of the tenant.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.delete` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App or tenant not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/tenants/{tenant_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-tenants-tenant-id\n * @example\n * ```ts\n * await auth.admin.app(\"app\").tenants.delete(\"tenant\");\n * ```\n */\n delete(tenantId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId } }, options);\n }\n /**\n * List tenants in this app, paginated by created_at desc.\n *\n * @param params - `Auth.AppScopedTenantListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` value.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/tenants\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenants\n * @example\n * ```ts\n * for await (const tenant of auth.admin.app(\"app\").tenants.list()) {\n * console.log(tenant);\n * }\n * const page = await auth.admin.app(\"app\").tenants.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.AppScopedTenantListParams, options?: RequestOptions): PagePromise<T.Tenant> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/tenants\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n /**\n * Get a single tenant by id or display id.\n *\n * @param tenantId - Id of the tenant.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App or tenant not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/tenants/{tenant_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenants-tenant-id\n * @example\n * ```ts\n * const tenant = await auth.admin.app(\"app\").tenants.retrieve(\"tenant\");\n * ```\n */\n retrieve(tenantId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Tenant>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId } }, options);\n }\n /**\n * Update a tenant (display_name, slug, status, metadata).\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.AppScopedTenantUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid body, unknown `status`, or malformed `slug`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App or tenant not found.\n * @throws {ConflictError} 409 CONFLICT: Slug already taken in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/tenants/{tenant_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-tenants-tenant-id\n * @example\n * ```ts\n * const tenant = await auth.admin.app(\"app\").tenants.update(\"tenant\", { display_name: \"string\" });\n * ```\n */\n update(tenantId: string, params?: T.AppScopedTenantUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Tenant>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId }, body: params }, options);\n }\n}\n\n/** `unverifiedAccountExpiry` */\nexport class AppUnverifiedAccountExpiryResource extends APIResource {\n /**\n * Get the unverified-account expiry setting and how many accounts it deleted in the last 30 days.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/unverified-account-expiry\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-unverified-account-expiry\n * @example\n * ```ts\n * const unverifiedAccountExpiryStatus = await auth.admin.app(\"app\").unverifiedAccountExpiry.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.UnverifiedAccountExpiryStatus>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/unverified-account-expiry\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Run the unverified-account expiry for this app now (or as a dry run).\n *\n * Permanently deletes every account that qualifies under the app's `unverified_account_ttl_days`, exactly as the nightly job does: each deletion is audited as `auth.account.expired_unverified` and fires `user.deleted` with `reason: \"unverified_expired\"`. Use `dry_run: true` to preview.\n *\n * @param params - `Auth.UnverifiedAccountExpiryRunParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`min_age_minutes` out of range).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.delete` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Expiry is off for this app and the request is not a dry run. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {UnprocessableEntityError} 422 UNPROCESSABLE_ENTITY: `min_age_minutes` was sent for an app that is not a development app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/unverified-account-expiry/run\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-unverified-account-expiry-run\n * @example\n * ```ts\n * const unverifiedAccountExpiryRun = await auth.admin.app(\"app\").unverifiedAccountExpiry.run({ dry_run: false });\n * ```\n */\n run(params?: T.UnverifiedAccountExpiryRunParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.UnverifiedAccountExpiryRun>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/unverified-account-expiry/run\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n}\n\n/** `webauthnConfig` */\nexport class AppWebauthnConfigResource extends APIResource {\n /**\n * Get the per-app passkey (WebAuthn) relying-party settings.\n *\n * Returns defaults with `enabled: false` and a null `rp_id` when passkeys have never been configured for the app.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/webauthn-config\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webauthn-config\n * @example\n * ```ts\n * const webauthnConfig = await auth.admin.app(\"app\").webauthnConfig.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebauthnConfig>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/webauthn-config\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Set the per-app passkey (WebAuthn) relying-party settings.\n *\n * @param params - `Auth.WebauthnConfigUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `rp_id` is malformed, or is not a registrable suffix of any origin in `allowed_redirect_origins`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {ConflictError} 409 CONFLICT: `rp_id` differs from the stored one while passkeys are registered. Every existing credential is bound to the old value and would stop verifying; remove them first.\n * @throws {APIError} 412 PRECONDITION_FAILED: The app has no `allowed_redirect_origins` configured, so `rp_id` cannot be validated.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PUT /v1/apps/{app_id}/webauthn-config\n * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-webauthn-config\n * @example\n * ```ts\n * const webauthnConfig = await auth.admin.app(\"app\").webauthnConfig.update({ enabled: true, rp_id: \"example.com\" });\n * ```\n */\n update(params: T.WebauthnConfigUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebauthnConfig>> {\n return this._client.request({ method: \"PUT\", path: \"/v1/apps/{app_id}/webauthn-config\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n}\n\n/** `webhooks.endpoints` */\nexport class AppWebhooksEndpointsResource extends APIResource {\n /**\n * Add a webhook endpoint. Returns its signing secret once.\n *\n * Deliveries are signed with the Standard Webhooks headers `webhook-id`, `webhook-timestamp` and `webhook-signature` (`v1,<base64 HMAC-SHA256 of \"<id>.<timestamp>.<body>\">`); the returned `whsec_…` secret works unchanged with any Standard Webhooks library. Failed deliveries are retried after 1 min, 5 min, 30 min, 2 h, 6 h and 24 h.\n *\n * @param params - `Auth.WebhookEndpointCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, WEBHOOK_EVENT_TYPE_UNKNOWN: Validation failure: URL not https with a public host, or an unknown event type (`WEBHOOK_EVENT_TYPE_UNKNOWN`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, WEBHOOK_ENDPOINT_LIMIT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Already 10 endpoints (`WEBHOOK_ENDPOINT_LIMIT`), or Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {UnprocessableEntityError} 422 UNPROCESSABLE_ENTITY: The URL points at a private, loopback or internal address.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/webhooks/endpoints\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-webhooks-endpoints\n * @example\n * ```ts\n * const webhookEndpointWithSecret = await auth.admin.app(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\").webhooks.endpoints.create({ url: \"https://api.acme.com/webhooks\" });\n * ```\n */\n create(params: T.WebhookEndpointCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebhookEndpointWithSecret>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/webhooks/endpoints\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a webhook endpoint.\n *\n * Queued retries are dropped. Its past attempts stay in the event log until the events expire.\n *\n * @param endpointId - Id of the endpoint.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `endpoint_id` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, WEBHOOK_ENDPOINT_NOT_FOUND: No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-webhooks-endpoints-endpoint-id\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\").webhooks.endpoints.delete(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\");\n * ```\n */\n delete(endpointId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}\", pathParams: { app_id: this._b.app_id, endpoint_id: endpointId } }, options);\n }\n /**\n * List webhook endpoints, oldest first.\n *\n * At most 10, so this is always one page. Signing secrets are never returned here, only their last 4 characters.\n *\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: The scope id in the path is malformed.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/webhooks/endpoints\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-endpoints\n * @example\n * ```ts\n * for await (const endpoint of auth.admin.app(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\").webhooks.endpoints.list()) {\n * console.log(endpoint);\n * }\n * ```\n */\n list(options?: RequestOptions): PagePromise<T.WebhookEndpoint> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/webhooks/endpoints\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Get one webhook endpoint (without its secret).\n *\n * The endpoint's URL, subscription, on/off state, failure streak and the last 4 characters of its signing secret. The full secret is only returned when the endpoint is created or its secret is rotated.\n *\n * @param endpointId - Id of the endpoint.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `endpoint_id` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, WEBHOOK_ENDPOINT_NOT_FOUND: No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-endpoints-endpoint-id\n * @example\n * ```ts\n * const webhookEndpoint = await auth.admin.app(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\").webhooks.endpoints.retrieve(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\");\n * ```\n */\n retrieve(endpointId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebhookEndpoint>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}\", pathParams: { app_id: this._b.app_id, endpoint_id: endpointId } }, options);\n }\n /**\n * Rotate the signing secret. The new one is returned once.\n *\n * For `grace_hours` (default 24) the previous secret keeps signing too: `webhook-signature` then lists one `v1,` signature per secret, so receivers can switch over without dropping a delivery.\n *\n * @param endpointId - Id of the endpoint.\n * @param params - `Auth.WebhookEndpointRotateSecretParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `grace_hours` out of range, or `endpoint_id` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, WEBHOOK_ENDPOINT_NOT_FOUND: No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`).\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}/rotate-secret\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-webhooks-endpoints-endpoint-id-rotate-secret\n * @example\n * ```ts\n * const webhookEndpointWithSecret = await auth.admin.app(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\").webhooks.endpoints.rotateSecret(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\", { grace_hours: 24 });\n * ```\n */\n rotateSecret(endpointId: string, params?: T.WebhookEndpointRotateSecretParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebhookEndpointWithSecret>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}/rotate-secret\", pathParams: { app_id: this._b.app_id, endpoint_id: endpointId }, body: params, idempotent: true }, options);\n }\n /**\n * Send a test event to this endpoint now and return the result.\n *\n * Delivers the catalogue example of `event_type`, signed like any delivery, with `\"test\": true` in the body. Works while the endpoint is switched off or not subscribed to that type, is logged in the event log, and is never retried or counted toward an automatic disable. Waits up to 15 s for your receiver.\n *\n * @param endpointId - Id of the endpoint.\n * @param params - `Auth.WebhookEndpointTestParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `event_type`, or `endpoint_id` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, WEBHOOK_ENDPOINT_NOT_FOUND: No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`).\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}/test\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-webhooks-endpoints-endpoint-id-test\n * @example\n * ```ts\n * const webhookDeliveryAttempt = await auth.admin.app(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\").webhooks.endpoints.test(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\", { event_type: \"user.signup\" });\n * ```\n */\n test(endpointId: string, params: T.WebhookEndpointTestParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebhookDeliveryAttempt>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}/test\", pathParams: { app_id: this._b.app_id, endpoint_id: endpointId }, body: params, idempotent: true }, options);\n }\n /**\n * Change a webhook endpoint: URL, description, events, on/off.\n *\n * Only the fields sent change. `enabled: true` (or a new URL) also clears an automatic disable. Switching off cancels queued retries. The secret is unchanged; rotate it with `POST …/rotate-secret`.\n *\n * @param endpointId - Id of the endpoint.\n * @param params - `Auth.WebhookEndpointUpdateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure, or `endpoint_id` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, WEBHOOK_ENDPOINT_NOT_FOUND: No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`).\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {UnprocessableEntityError} 422 UNPROCESSABLE_ENTITY: The new URL points at a private, loopback or internal address.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-webhooks-endpoints-endpoint-id\n * @example\n * ```ts\n * const webhookEndpoint = await auth.admin.app(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\").webhooks.endpoints.update(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\", { description: \"Production receiver\" });\n * ```\n */\n update(endpointId: string, params?: T.WebhookEndpointUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebhookEndpoint>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}\", pathParams: { app_id: this._b.app_id, endpoint_id: endpointId }, body: params, idempotent: true }, options);\n }\n}\n\n/** `webhooks.eventTypes` */\nexport class AppWebhooksEventTypesResource extends APIResource {\n /**\n * List the events an endpoint can subscribe to.\n *\n * Each type with a plain description, its group and an example `data` object (what \"Send test\" delivers).\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/webhooks/event-types\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-event-types\n * @example\n * ```ts\n * const listWebhookEventTypes = await auth.admin.app(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\").webhooks.eventTypes.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.ListWebhookEventTypes>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/webhooks/event-types\", pathParams: { app_id: this._b.app_id } }, options);\n }\n}\n\n/** `webhooks.events` */\nexport class AppWebhooksEventsResource extends APIResource {\n /**\n * List webhook events, newest first (kept for 30 days).\n *\n * Every event logged while at least one endpoint existed, with the latest state per endpoint and when the next retry is due.\n *\n * @param params - `Auth.WebhookEventListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid filter value or cursor.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/webhooks/events\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-events\n * @example\n * ```ts\n * for await (const event of auth.admin.app(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\").webhooks.events.list()) {\n * console.log(event);\n * }\n * const page = await auth.admin.app(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\").webhooks.events.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.WebhookEventListParams, options?: RequestOptions): PagePromise<T.WebhookEvent> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/webhooks/events\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n /**\n * Send a logged event again, to its endpoints or to one endpoint.\n *\n * Same body and `webhook-id`, freshly signed, to every switched-on endpoint that receives this event type now, or only to `endpoint_id`. Waits for the receivers (up to 15 s each) and returns the attempts. A success cancels a retry still queued for that endpoint.\n *\n * @param eventId - The event id, `evt_<uuid>`.\n * @param params - `Auth.WebhookEventReplayParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `event_id` is not `evt_<uuid>`, or `endpoint_id` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, WEBHOOK_EVENT_NOT_FOUND, WEBHOOK_ENDPOINT_NOT_FOUND: No such event here (`WEBHOOK_EVENT_NOT_FOUND`); events are kept for 30 days. Or No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`).\n * @throws {ConflictError} 409 CONFLICT, WEBHOOK_ENDPOINT_NOT_SUBSCRIBED, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: `endpoint_id` is switched off or does not receive this event type (`WEBHOOK_ENDPOINT_NOT_SUBSCRIBED`), or Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/webhooks/events/{event_id}/replay\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-webhooks-events-event-id-replay\n * @example\n * ```ts\n * const replayWebhookEvent = await auth.admin.app(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\").webhooks.events.replay(\"event\");\n * ```\n */\n replay(eventId: string, params?: T.WebhookEventReplayParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ReplayWebhookEvent>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/webhooks/events/{event_id}/replay\", pathParams: { app_id: this._b.app_id, event_id: eventId }, query: params, idempotent: true }, options);\n }\n /**\n * Get one webhook event with every delivery attempt.\n *\n * The event as it was sent (`type`, `data`) and every delivery attempt to every endpoint, with its trigger, HTTP status, error and the start of the response body. Use it to debug a receiver, then `replay` to send it again.\n *\n * @param eventId - The event id, `evt_<uuid>`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `event_id` is not `evt_<uuid>`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, WEBHOOK_EVENT_NOT_FOUND: No such event here (`WEBHOOK_EVENT_NOT_FOUND`); events are kept for 30 days.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/webhooks/events/{event_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-events-event-id\n * @example\n * ```ts\n * const webhookEventDetail = await auth.admin.app(\"3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b\").webhooks.events.retrieve(\"event\");\n * ```\n */\n retrieve(eventId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebhookEventDetail>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/webhooks/events/{event_id}\", pathParams: { app_id: this._b.app_id, event_id: eventId } }, options);\n }\n}\n\n/** `webhooks` */\nexport class AppWebhooksResource extends APIResource {\n #endpoints?: AppWebhooksEndpointsResource;\n #eventTypes?: AppWebhooksEventTypesResource;\n #events?: AppWebhooksEventsResource;\n get endpoints(): AppWebhooksEndpointsResource {\n return (this.#endpoints ??= new AppWebhooksEndpointsResource(this._client, this._b));\n }\n get eventTypes(): AppWebhooksEventTypesResource {\n return (this.#eventTypes ??= new AppWebhooksEventTypesResource(this._client, this._b));\n }\n get events(): AppWebhooksEventsResource {\n return (this.#events ??= new AppWebhooksEventsResource(this._client, this._b));\n }\n}\n\n/** `auth.app(…)`: Admin calls for one app (end users, roles, keys, config). Needs a workspace API key or a platform session. */\nexport class AuthApp extends APIResource {\n #apiKeys?: AppApiKeysResource;\n #auditLogs?: AppAuditLogsResource;\n #auditSink?: AppAuditSinkResource;\n #authConfig?: AppAuthConfigResource;\n #credentials?: AppCredentialsResource;\n #customDomains?: AppCustomDomainsResource;\n #endUserInsights?: AppEndUserInsightsResource;\n #endUsers?: AppEndUsersResource;\n #invites?: AppInvitesResource;\n #members?: AppMembersResource;\n #notificationSettings?: AppNotificationSettingsResource;\n #notifications?: AppNotificationsResource;\n #permissions?: AppPermissionsResource;\n #roles?: AppRolesResource;\n #setupStatus?: AppSetupStatusResource;\n #signInTests?: AppSignInTestsResource;\n #tenantApiKeys?: AppTenantApiKeysResource;\n #tenants?: AppTenantsResource;\n #unverifiedAccountExpiry?: AppUnverifiedAccountExpiryResource;\n #webauthnConfig?: AppWebauthnConfigResource;\n #webhooks?: AppWebhooksResource;\n /** The `{app_id}` this scope is bound to. */\n get appId(): string {\n return this._b.app_id as string;\n }\n get apiKeys(): AppApiKeysResource {\n return (this.#apiKeys ??= new AppApiKeysResource(this._client, this._b));\n }\n get auditLogs(): AppAuditLogsResource {\n return (this.#auditLogs ??= new AppAuditLogsResource(this._client, this._b));\n }\n get auditSink(): AppAuditSinkResource {\n return (this.#auditSink ??= new AppAuditSinkResource(this._client, this._b));\n }\n get authConfig(): AppAuthConfigResource {\n return (this.#authConfig ??= new AppAuthConfigResource(this._client, this._b));\n }\n get credentials(): AppCredentialsResource {\n return (this.#credentials ??= new AppCredentialsResource(this._client, this._b));\n }\n get customDomains(): AppCustomDomainsResource {\n return (this.#customDomains ??= new AppCustomDomainsResource(this._client, this._b));\n }\n get endUserInsights(): AppEndUserInsightsResource {\n return (this.#endUserInsights ??= new AppEndUserInsightsResource(this._client, this._b));\n }\n get endUsers(): AppEndUsersResource {\n return (this.#endUsers ??= new AppEndUsersResource(this._client, this._b));\n }\n /** @deprecated 0.x namespace: every method in it is a deprecated alias (see its methods). Removed in 2.0. */\n get invites(): AppInvitesResource {\n return (this.#invites ??= new AppInvitesResource(this._client, this._b));\n }\n get members(): AppMembersResource {\n return (this.#members ??= new AppMembersResource(this._client, this._b));\n }\n get notificationSettings(): AppNotificationSettingsResource {\n return (this.#notificationSettings ??= new AppNotificationSettingsResource(this._client, this._b));\n }\n get notifications(): AppNotificationsResource {\n return (this.#notifications ??= new AppNotificationsResource(this._client, this._b));\n }\n get permissions(): AppPermissionsResource {\n return (this.#permissions ??= new AppPermissionsResource(this._client, this._b));\n }\n get roles(): AppRolesResource {\n return (this.#roles ??= new AppRolesResource(this._client, this._b));\n }\n get setupStatus(): AppSetupStatusResource {\n return (this.#setupStatus ??= new AppSetupStatusResource(this._client, this._b));\n }\n get signInTests(): AppSignInTestsResource {\n return (this.#signInTests ??= new AppSignInTestsResource(this._client, this._b));\n }\n get tenantApiKeys(): AppTenantApiKeysResource {\n return (this.#tenantApiKeys ??= new AppTenantApiKeysResource(this._client, this._b));\n }\n get tenants(): AppTenantsResource {\n return (this.#tenants ??= new AppTenantsResource(this._client, this._b));\n }\n get unverifiedAccountExpiry(): AppUnverifiedAccountExpiryResource {\n return (this.#unverifiedAccountExpiry ??= new AppUnverifiedAccountExpiryResource(this._client, this._b));\n }\n get webauthnConfig(): AppWebauthnConfigResource {\n return (this.#webauthnConfig ??= new AppWebauthnConfigResource(this._client, this._b));\n }\n get webhooks(): AppWebhooksResource {\n return (this.#webhooks ??= new AppWebhooksResource(this._client, this._b));\n }\n /**\n * Create a second app in the same workspace whose configuration matches this one — the \"staging app\" flow. Copies the auth config, roles, permissions, notification settings and the webhook target (with a NEW signing secret), and optionally tenants. Never copies credentials, end-users, sessions, signing keys, federated provider configs or audit history.\n *\n * @param params - `Auth.CloneParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure, or the slug matches the source.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.create` on the source app.\n * @throws {NotFoundError} 404 NOT_FOUND: Source app not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Slug already taken (including as a live rename alias). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/clone\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-clone\n * @example\n * ```ts\n * const cloneApp = await auth.admin.app(\"app\").clone({ environment: \"staging\", slug: \"acme-app-staging\" });\n * ```\n */\n clone(params: T.CloneParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CloneApp>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/clone\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Update app status (active, suspended, archived)\n *\n * @param params - `Auth.UpdateStatusParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid status transition (e.g. archived → active).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found or caller is not a member.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/status\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-status\n * @example\n * ```ts\n * const app = await auth.admin.app(\"app\").updateStatus({ status: \"suspended\" });\n * ```\n */\n updateStatus(params: T.UpdateStatusParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.App>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/status\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n /**\n * 0.x name for `auth.apps.delete()` (DELETE /v1/apps/{app_id}).\n *\n * @deprecated Use `auth.apps.delete()`. Kept for 0.x callers; removed in 2.0.\n */\n delete(options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * 0.x name for `auth.apps.retrieve()` (GET /v1/apps/{app_id}).\n *\n * @deprecated Use `auth.apps.retrieve()`. Kept for 0.x callers; removed in 2.0.\n */\n get(options?: RequestOptions): APIPromise<T.WithLastResponse<T.App>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * 0.x name for `auth.apps.update()` (PATCH /v1/apps/{app_id}).\n *\n * @deprecated Use `auth.apps.update()`. Kept for 0.x callers; removed in 2.0.\n */\n update(params?: T.AppUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.App>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n}\n\n/** `auth` */\nexport class ConsumerAuthResource extends APIResource {\n /**\n * 0.x name for `auth.consumer(…).acceptInvite()` (POST /{app_slug}/v1/auth/accept-invite).\n *\n * @deprecated Use `auth.consumer(…).acceptInvite()`. Kept for 0.x callers; removed in 2.0.\n */\n acceptInvite(params: T.AcceptInviteParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AcceptInviteResponse>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/accept-invite\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).logout()` (POST /{app_slug}/v1/auth/logout).\n *\n * @deprecated Use `auth.consumer(…).logout()`. Kept for 0.x callers; removed in 2.0.\n */\n logout(params: T.LogoutParams, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/logout\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).refresh()` (POST /{app_slug}/v1/auth/refresh).\n *\n * @deprecated Use `auth.consumer(…).refresh()`. Kept for 0.x callers; removed in 2.0.\n */\n refresh(params: T.RefreshParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/refresh\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).requestPasswordReset()` (POST /{app_slug}/v1/auth/request-password-reset).\n *\n * @deprecated Use `auth.consumer(…).requestPasswordReset()`. Kept for 0.x callers; removed in 2.0.\n */\n requestReset(params?: T.RequestPasswordResetParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerCodeIssue>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/request-password-reset\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).requestVerification()` (POST /{app_slug}/v1/auth/request-verification).\n *\n * @deprecated Use `auth.consumer(…).requestVerification()`. Kept for 0.x callers; removed in 2.0.\n */\n requestVerification(params?: T.RequestVerificationParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerCodeIssue>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/request-verification\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).resetPassword()` (POST /{app_slug}/v1/auth/reset-password).\n *\n * @deprecated Use `auth.consumer(…).resetPassword()`. Kept for 0.x callers; removed in 2.0.\n */\n resetPassword(params: T.ResetPasswordParams, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/reset-password\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).sendPasswordResetEmail()` (POST /{app_slug}/v1/auth/send-password-reset-email).\n *\n * @deprecated Use `auth.consumer(…).sendPasswordResetEmail()`. Kept for 0.x callers; removed in 2.0.\n */\n sendPasswordResetEmail(params: T.SendPasswordResetEmailParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerCodeDispatch>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/send-password-reset-email\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).sendVerificationEmail()` (POST /{app_slug}/v1/auth/send-verification-email).\n *\n * @deprecated Use `auth.consumer(…).sendVerificationEmail()`. Kept for 0.x callers; removed in 2.0.\n */\n sendVerificationEmail(params: T.SendVerificationEmailParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerCodeDispatch>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/send-verification-email\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).signin()` (POST /{app_slug}/v1/auth/signin).\n *\n * @deprecated Use `auth.consumer(…).signin()`. Kept for 0.x callers; removed in 2.0.\n */\n signin(params: T.SigninParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.SigninResponse>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/signin\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).signinWithProvider()` (POST /{app_slug}/v1/auth/oauth/{provider}).\n *\n * @deprecated Use `auth.consumer(…).signinWithProvider()`. Kept for 0.x callers; removed in 2.0.\n */\n signinWithProvider(args: { provider: string } & T.SigninWithProviderParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.SigninWithProviderResponse>> {\n const { provider, ...params } = args;\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/oauth/{provider}\", pathParams: { app_slug: this._b.app_slug, provider }, body: params, public: true }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).signup()` (POST /{app_slug}/v1/auth/signup).\n *\n * @deprecated Use `auth.consumer(…).signup()`. Kept for 0.x callers; removed in 2.0.\n */\n signup(params: T.SignupParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.SignupResponse>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/signup\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).verifyEmail()` (POST /{app_slug}/v1/auth/verify).\n *\n * @deprecated Use `auth.consumer(…).verifyEmail()`. Kept for 0.x callers; removed in 2.0.\n */\n verify(params: T.VerifyEmailParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerVerify>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/verify\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n}\n\n/** `me.activity` */\nexport class ConsumerMeActivityResource extends APIResource {\n /**\n * Recent account activity\n *\n * Login events, password changes, and other security-relevant records, scoped to this EndUser.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/me/activity\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-activity\n * @example\n * ```ts\n * for await (const activity of auth.consumer(\"app\").me.activity.list()) {\n * console.log(activity);\n * }\n * ```\n */\n list(options?: RequestOptions): PagePromise<T.MeActivityEntry> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/me/activity\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n}\n\n/** `me.contacts` */\nexport class ConsumerMeContactsResource extends APIResource {\n /**\n * Add a new contact (unverified, non-primary)\n *\n * Adds an email or phone contact to the EndUser. The contact starts unverified and non-primary. Verification is a separate flow — call /auth/request-verification with the contact value and the customer's PAK to mint a code, then submit via /auth/verify.\n *\n * @param params - `Auth.MeContactCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: unsupported `type`, invalid email, or empty/over-long `value`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Contact value already in use for this app. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): `/me/contacts` is in the strict `auth` bucket (10 requests per minute per IP).\n * @see POST /{app_slug}/v1/me/contacts\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-contacts\n * @example\n * ```ts\n * const meContact = await auth.consumer(\"app\").me.contacts.create({ type: \"email\", value: \"string\" });\n * ```\n */\n create(params: T.MeContactCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.MeContact>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/contacts\", pathParams: { app_slug: this._b.app_slug }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a contact\n *\n * @param id - Id of the contact.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {NotFoundError} 404 NOT_FOUND: Contact not found on this account.\n * @throws {ConflictError} 409 CONFLICT: Cannot delete the primary verified email; promote another email first.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): `/me/contacts` is in the strict `auth` bucket (10 requests per minute per IP).\n * @see DELETE /{app_slug}/v1/me/contacts/{id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me-contacts-id\n * @example\n * ```ts\n * await auth.consumer(\"app\").me.contacts.delete(\"id\");\n * ```\n */\n delete(id: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/me/contacts/{id}\", pathParams: { app_slug: this._b.app_slug, id } }, options);\n }\n /**\n * List the EndUser's contacts\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): the general bucket, 60 requests per minute per IP. Adding, verifying or removing a contact is in the strict `auth` bucket (10 per minute).\n * @see GET /{app_slug}/v1/me/contacts\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-contacts\n * @example\n * ```ts\n * const meContacts = await auth.consumer(\"app\").me.contacts.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.MeContacts>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/me/contacts\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * Promote a verified contact to primary\n *\n * Demotes the previous primary of the same type. Refused (409) when the target contact is unverified — promoting an unverified contact would let an attacker who registered the contact bypass verification by routing reset codes through it.\n *\n * @param id - Id of the contact.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {NotFoundError} 404 NOT_FOUND: Contact not found on this account.\n * @throws {ConflictError} 409 CONFLICT: Contact is unverified and cannot be promoted to primary.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): `/me/contacts` is in the strict `auth` bucket (10 requests per minute per IP).\n * @see POST /{app_slug}/v1/me/contacts/{id}/promote\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-contacts-id-promote\n * @example\n * ```ts\n * await auth.consumer(\"app\").me.contacts.promote(\"id\");\n * ```\n */\n promote(id: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/contacts/{id}/promote\", pathParams: { app_slug: this._b.app_slug, id } }, options);\n }\n}\n\n/** `me.mfa.factors` */\nexport class ConsumerMeMfaFactorsResource extends APIResource {\n /**\n * Begin enrollment of a new MFA factor\n *\n * Creates a pending factor and returns the type-specific enrollment payload. TOTP: the otpauth URI, QR data URL, and shared secret; confirm with two consecutive codes. Email: a 6-digit code is sent to the bound verified email contact (primary by default, `contact_id` to override); confirm with that single code. The factor stays disabled until `/factors/:id/verify` succeeds.\n *\n * @param params - `Auth.MeMfaFactorCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: unsupported `type`, over-long `label`, or `contact_id` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {NotFoundError} 404 NOT_FOUND: Email factors: `contact_id` names no email contact on this account.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {APIError} 412 PRECONDITION_FAILED: Email factors: the contact (or primary email) is unverified, or the app has not completed Mail setup for MFA codes. Passkeys: not enabled or not fully configured for this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/me/mfa/factors\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-factors\n * @example\n * ```ts\n * const startEnrollment = await auth.consumer(\"app\").me.mfa.factors.create({ type: \"totp\" });\n * ```\n */\n create(params: T.MeMfaFactorCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.StartEnrollment>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/mfa/factors\", pathParams: { app_slug: this._b.app_slug }, body: params, idempotent: true }, options);\n }\n /**\n * Disable an MFA factor\n *\n * Soft-disable. The row is preserved (with `disabled_at` set) for audit. Has no effect on existing sessions — their `amr` claim still reflects whatever satisfied sign-in at the time. Disabling the only enabled factor removes the MFA requirement on future sign-ins.\n *\n * @param id - Id of the factor.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {NotFoundError} 404 NOT_FOUND: Factor not found on this account.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/me/mfa/factors/{id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me-mfa-factors-id\n * @example\n * ```ts\n * await auth.consumer(\"app\").me.mfa.factors.delete(\"id\");\n * ```\n */\n delete(id: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/me/mfa/factors/{id}\", pathParams: { app_slug: this._b.app_slug, id } }, options);\n }\n /**\n * List the authenticated EndUser's MFA factors\n *\n * Includes factors in any state (pending enrollment + enabled). Disabled factors are not listed.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/me/mfa/factors\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-mfa-factors\n * @example\n * ```ts\n * const factorList = await auth.consumer(\"app\").me.mfa.factors.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.FactorList>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/me/mfa/factors\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * Confirm enrollment of a pending factor\n *\n * TOTP: submit two `codes` from consecutive 30-second windows. Email: submit the emailed 6-digit `code`. On success the factor flips to enabled, recovery codes are minted (returned once), and prior recovery codes for the account are invalidated. Subsequent calls with the same `:id` fail with 400.\n *\n * @param id - Id of the factor.\n * @param params - `Auth.MeMfaFactorVerifyParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid or repeated codes.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/me/mfa/factors/{id}/verify\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-factors-id-verify\n * @example\n * ```ts\n * const confirmEnrollment = await auth.consumer(\"app\").me.mfa.factors.verify(\"id\", { code: \"123456\" });\n * ```\n */\n verify(id: string, params?: T.MeMfaFactorVerifyParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConfirmEnrollment>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/mfa/factors/{id}/verify\", pathParams: { app_slug: this._b.app_slug, id }, body: params }, options);\n }\n}\n\n/** `me.mfa.recoveryCodes` */\nexport class ConsumerMeMfaRecoveryCodesResource extends APIResource {\n /**\n * Regenerate the recovery-code set\n *\n * Mints a fresh set of single-use recovery codes and invalidates every prior code for the account. The new codes are returned once — store them now.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/me/mfa/recovery-codes/regenerate\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-recovery-codes-regenerate\n * @example\n * ```ts\n * const recoveryCodes = await auth.consumer(\"app\").me.mfa.recoveryCodes.regenerate();\n * ```\n */\n regenerate(options?: RequestOptions): APIPromise<T.WithLastResponse<T.RecoveryCodes>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/mfa/recovery-codes/regenerate\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n}\n\n/** `me.mfa.stepUp.webauthn` */\nexport class ConsumerMeMfaStepUpWebauthnResource extends APIResource {\n /**\n * Get passkey assertion options for step-up\n *\n * Mints a single-use WebAuthn challenge for the enabled passkeys on this account and returns the `publicKey` member for `navigator.credentials.get()`. Submit the result to `/step-up` as `credential`. Refused while step-up is locked on this session — a locked session must not be able to keep minting challenges.\n *\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: No passkey is enrolled on this account.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {APIError} 412 PRECONDITION_FAILED: Passkeys are not enabled or not fully configured for this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Step-up is locked on this session.\n * @see POST /{app_slug}/v1/me/mfa/step-up/webauthn/options\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-step-up-webauthn-options\n * @example\n * ```ts\n * const webauthnOptions = await auth.consumer(\"app\").me.mfa.stepUp.webauthn.options();\n * ```\n */\n options(options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebauthnOptions>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/mfa/step-up/webauthn/options\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n}\n\n/** `me.mfa.stepUp` */\nexport class ConsumerMeMfaStepUpResource extends APIResource {\n #webauthn?: ConsumerMeMfaStepUpWebauthnResource;\n get webauthn(): ConsumerMeMfaStepUpWebauthnResource {\n return (this.#webauthn ??= new ConsumerMeMfaStepUpWebauthnResource(this._client, this._b));\n }\n /**\n * Email a step-up code\n *\n * Mints a single-use 6-digit code against one of the account's enabled email factors and delivers it to the bound address. Follow with `/step-up` submitting the code. Codes expire after 5 minutes; sends are throttled per contact (30s between sends, shared with the sign-in path). Refused while step-up is locked on this session.\n *\n * @param params - `Auth.MeMfaStepUpSendCodeParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Account has no enabled email factor (or the named factor is not an email factor).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {APIError} 410 GONE: The bound email contact no longer exists or is no longer verified.\n * @throws {APIError} 412 PRECONDITION_FAILED: The app has not completed Mail notification setup for MFA codes.\n * @throws {RateLimitError} 429 RATE_LIMITED: Send throttled, or step-up is locked on this session.\n * @see POST /{app_slug}/v1/me/mfa/step-up/send-code\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-step-up-send-code\n * @example\n * ```ts\n * const stepUpSendCode = await auth.consumer(\"app\").me.mfa.stepUp.sendCode({ factor_id: \"9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b\" });\n * ```\n */\n sendCode(params?: T.MeMfaStepUpSendCodeParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.StepUpSendCode>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/mfa/step-up/send-code\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Bump this session's MFA recency\n *\n * Verify a fresh code (TOTP, emailed via `/step-up/send-code`, or recovery) against any enabled factor on the account, and update the session's `auth_methods` + `mfa_at`. Call `/auth/refresh` after this to mint a token whose claims reflect the new state. Customers reading `mfa_at` from access tokens to gate sensitive actions should require a `/step-up` + refresh cycle when the timestamp is older than their policy window. 5 consecutive wrong codes lock step-up on this session for 15 minutes.\n *\n * @param params - `Auth.MeMfaStepUpVerifyParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Code did not match any enabled factor or recovery code.\n * @throws {RateLimitError} 429 RATE_LIMITED: Step-up locked on this session after too many failures.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/me/mfa/step-up\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-step-up\n * @example\n * ```ts\n * const stepUp = await auth.consumer(\"app\").me.mfa.stepUp.verify({ code: \"123456\" });\n * ```\n */\n verify(params?: T.MeMfaStepUpVerifyParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.StepUp>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/mfa/step-up\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n}\n\n/** `me.mfa` */\nexport class ConsumerMeMfaResource extends APIResource {\n #factors?: ConsumerMeMfaFactorsResource;\n #recoveryCodes?: ConsumerMeMfaRecoveryCodesResource;\n #stepUp?: ConsumerMeMfaStepUpResource;\n get factors(): ConsumerMeMfaFactorsResource {\n return (this.#factors ??= new ConsumerMeMfaFactorsResource(this._client, this._b));\n }\n get recoveryCodes(): ConsumerMeMfaRecoveryCodesResource {\n return (this.#recoveryCodes ??= new ConsumerMeMfaRecoveryCodesResource(this._client, this._b));\n }\n get stepUp(): ConsumerMeMfaStepUpResource {\n return (this.#stepUp ??= new ConsumerMeMfaStepUpResource(this._client, this._b));\n }\n}\n\n/** `me.sessions` */\nexport class ConsumerMeSessionsResource extends APIResource {\n /**\n * Revoke a session\n *\n * Sign the EndUser out of one device. The session's refresh token is destroyed; its access token expires on its TTL. Requires the `session.revoke` permission when the app's `enforce_app_permissions` flag is on; otherwise (the default) any valid token can call this. Self-revoke (revoking your own session as a member with no perms) is something to enforce separately if needed; this guard does not exempt the principal from the role check.\n *\n * @param id - Id of the session.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: The app enforces permissions and the caller's role (or M2M scopes) lacks `session.revoke`.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/me/sessions/{id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me-sessions-id\n * @example\n * ```ts\n * await auth.consumer(\"app\").me.sessions.delete(\"id\");\n * ```\n */\n delete(id: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/me/sessions/{id}\", pathParams: { app_slug: this._b.app_slug, id } }, options);\n }\n /**\n * List all active sessions for the EndUser\n *\n * Each session includes a `current` flag identifying the one belonging to the bearer token used for this request.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/me/sessions\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-sessions\n * @example\n * ```ts\n * for await (const session of auth.consumer(\"app\").me.sessions.list()) {\n * console.log(session);\n * }\n * ```\n */\n list(options?: RequestOptions): PagePromise<T.MeSession> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/me/sessions\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n}\n\n/** `me.tenantInvites` */\nexport class ConsumerMeTenantInvitesResource extends APIResource {\n /**\n * Accept a tenant invite as the signed-in EndUser\n *\n * Adds the caller to the invited tenant with the role the invite names, and consumes the invite. Requires the invited address to be one of the caller's own VERIFIED email contacts in this app — holding the code is not sufficient, because whoever minted the invite also holds it, and an unverified contact is not proof of owning the address. A refused accept leaves the invite redeemable.\n *\n * @param params - `Auth.MeTenantInviteAcceptParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Two cases, told apart by `error.code`: `FORBIDDEN` — the invite was issued to an address that is not a contact of this account; `invite_email_unverified` — the invited address is a contact of this account but is not verified yet. Verify the address, then retry with the same code.\n * @throws {NotFoundError} 404 NOT_FOUND: No such invite in this app.\n * @throws {ConflictError} 409 CONFLICT: Already a member of that tenant.\n * @throws {APIError} 410 GONE: Invite revoked, expired, or fully used.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/me/tenant-invites/accept\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-tenant-invites-accept\n * @example\n * ```ts\n * const acceptedTenantInvite = await auth.consumer(\"app\").me.tenantInvites.accept({ code: \"tinv_9dK2mQ7pR4vXbN1sT6yZ0hLcJeW3fAgU\" });\n * ```\n */\n accept(params: T.MeTenantInviteAcceptParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AcceptedTenantInvite>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/tenant-invites/accept\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n}\n\n/** `me.tenants` */\nexport class ConsumerMeTenantsResource extends APIResource {\n /**\n * List the EndUser's tenant memberships in this app\n *\n * Returns each tenant the caller is a member of, including the tenant slug + display name and the member's role. Powers a tenant-switcher UI on the customer's product.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing / invalid bearer, or the session behind the token is revoked, expired or no longer exists.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see GET /{app_slug}/v1/auth/me/tenants\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-auth-me-tenants\n * @example\n * ```ts\n * const myTenants = await auth.consumer(\"app\").me.tenants.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.MyTenants>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/auth/me/tenants\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n}\n\n/** `me` */\nexport class ConsumerMeResource extends APIResource {\n #activity?: ConsumerMeActivityResource;\n #contacts?: ConsumerMeContactsResource;\n #mfa?: ConsumerMeMfaResource;\n #sessions?: ConsumerMeSessionsResource;\n #tenantInvites?: ConsumerMeTenantInvitesResource;\n #tenants?: ConsumerMeTenantsResource;\n get activity(): ConsumerMeActivityResource {\n return (this.#activity ??= new ConsumerMeActivityResource(this._client, this._b));\n }\n get contacts(): ConsumerMeContactsResource {\n return (this.#contacts ??= new ConsumerMeContactsResource(this._client, this._b));\n }\n get mfa(): ConsumerMeMfaResource {\n return (this.#mfa ??= new ConsumerMeMfaResource(this._client, this._b));\n }\n get sessions(): ConsumerMeSessionsResource {\n return (this.#sessions ??= new ConsumerMeSessionsResource(this._client, this._b));\n }\n get tenantInvites(): ConsumerMeTenantInvitesResource {\n return (this.#tenantInvites ??= new ConsumerMeTenantInvitesResource(this._client, this._b));\n }\n get tenants(): ConsumerMeTenantsResource {\n return (this.#tenants ??= new ConsumerMeTenantsResource(this._client, this._b));\n }\n /**\n * Change the password of the signed-in EndUser\n *\n * Verifies `current_password`, sets the new hash, and revokes every OTHER active session for the account (the calling session is preserved). 401 if the current password is wrong or the account has no password credential — admin-provisioned accounts without an initial password should use the reset flow instead. The new password is held to exactly the same policy as signup: the app's length + character-class rules, the common-password deny-list, and the breach corpus.\n *\n * @param params - `Auth.MeChangePasswordParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, PASSWORD_TOO_COMMON, PASSWORD_BREACHED: The new password fails the app-configured policy, is on the common-password deny-list (`PASSWORD_TOO_COMMON`), appears in a public breach corpus (`PASSWORD_BREACHED`), or is identical to the current one.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Current password incorrect or no credential.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/me/change-password\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-change-password\n * @example\n * ```ts\n * await auth.consumer(\"app\").me.changePassword({ current_password: \"string\", new_password: \"string\" });\n * ```\n */\n changePassword(params: T.MeChangePasswordParams, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/change-password\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Permanently delete the signed-in EndUser account\n *\n * Removes the EndUser, all sessions, and all related records inside this app. Cannot be undone. The app audit log keeps one `auth.account.deleted` row (`via: self`; username and email domain only, never the address), and `user.deleted` fires with `via: \"self\"`.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/me\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me\n * @example\n * ```ts\n * await auth.consumer(\"app\").me.deleteAccount();\n * ```\n */\n deleteAccount(options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/me\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * Remove the EndUser avatar\n *\n * Clears both the uploaded avatar and any provider-captured picture, and deletes the stored object. A later Google/GitHub sign-in re-populates the provider picture — that is \"sync from provider\" behavior, by design.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {NotFoundError} 404 NOT_FOUND, ACCOUNT_NOT_FOUND: Account not found in this app (`ACCOUNT_NOT_FOUND`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/me/avatar\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me-avatar\n * @example\n * ```ts\n * await auth.consumer(\"app\").me.deleteAvatar();\n * ```\n */\n deleteAvatar(options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/me/avatar\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * Resolve the signed-in EndUser's effective permissions\n *\n * Returns the union of the app-level role permissions and the tenant-level role permissions (when the token carries an `org_id`). Resolved per-request through a 60-second LRU — role-permission edits propagate within ~1 minute. Use this instead of decoding a `permissions[]` claim from the JWT, which is no longer included. M2M tokens cannot call this — use `POST /:appSlug/v1/oauth/introspect` to inspect M2M scopes.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/me/permissions\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-permissions\n * @example\n * ```ts\n * const mePermissions = await auth.consumer(\"app\").me.permissions();\n * ```\n */\n permissions(options?: RequestOptions): APIPromise<T.WithLastResponse<T.MePermissions>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/me/permissions\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * Get the signed-in EndUser profile\n *\n * Returns the EndUser identity, app membership, and role name. The flat `permissions[]` array is intentionally NOT included — permissions resolve from the role on demand. Call `GET /me/permissions` for the flat list when the client needs it for UI gating.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Account not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/me\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me\n * @example\n * ```ts\n * const meProfile = await auth.consumer(\"app\").me.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.MeProfile>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/me\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * Update the signed-in EndUser profile\n *\n * Editable fields: `display_name` and `username`. The username is unique per app (case-insensitive, same rule as signup); sending the current username is a no-op. Usernames cannot be cleared.\n *\n * @param params - `Auth.MeUpdateParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {ConflictError} 409 CONFLICT, USERNAME_TAKEN: Requested username is already held by another account in this app (`USERNAME_TAKEN`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /{app_slug}/v1/me\n * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-me\n * @example\n * ```ts\n * const meUpdatedAccount = await auth.consumer(\"app\").me.update({ display_name: \"Ada Lovelace\" });\n * ```\n */\n update(params?: T.MeUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.MeUpdatedAccount>> {\n return this._client.request({ method: \"PATCH\", path: \"/{app_slug}/v1/me\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Upload (or replace) the EndUser avatar\n *\n * PNG/JPEG/WEBP only — SVG is rejected (stored-XSS vector). ≤2 MB. Magic bytes are sniffed; a mislabeled file is rejected. The image is re-encoded server-side (orientation baked in, all metadata incl. EXIF/GPS stripped, bounded to 512×512, webp). An uploaded avatar takes precedence over a provider-captured picture.\n *\n * @param params - `Auth.MeUploadAvatarParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {APIError} 413 PAYLOAD_TOO_LARGE, AVATAR_TOO_LARGE: File exceeds 2 MB (`AVATAR_TOO_LARGE`).\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE, AVATAR_INVALID_TYPE, AVATAR_MAGIC_MISMATCH: Wrong mimetype, undecodable image, or content does not match the declared type (`AVATAR_INVALID_TYPE` / `AVATAR_MAGIC_MISMATCH`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/me/avatar\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-avatar\n * @example\n * ```ts\n * const avatarUrl = await auth.consumer(\"app\").me.uploadAvatar({ file: new File([\"…\"], \"image.png\", { type: \"image/png\" }) });\n * ```\n */\n uploadAvatar(params: T.MeUploadAvatarParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AvatarUrl>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/avatar\", pathParams: { app_slug: this._b.app_slug }, body: formData(params) }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).me.activity.list()` (GET /{app_slug}/v1/me/activity).\n *\n * @deprecated Use `auth.consumer(…).me.activity.list()`. Kept for 0.x callers; removed in 2.0.\n */\n getActivity(options?: RequestOptions): PagePromise<T.MeActivityEntry> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/me/activity\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).me.retrieve()` (GET /{app_slug}/v1/me).\n *\n * @deprecated Use `auth.consumer(…).me.retrieve()`. Kept for 0.x callers; removed in 2.0.\n */\n getProfile(options?: RequestOptions): APIPromise<T.WithLastResponse<T.MeProfile>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/me\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).me.sessions.list()` (GET /{app_slug}/v1/me/sessions).\n *\n * @deprecated Use `auth.consumer(…).me.sessions.list()`. Kept for 0.x callers; removed in 2.0.\n */\n listSessions(options?: RequestOptions): PagePromise<T.MeSession> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/me/sessions\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).me.sessions.delete()` (DELETE /{app_slug}/v1/me/sessions/{id}).\n *\n * @deprecated Use `auth.consumer(…).me.sessions.delete()`. Kept for 0.x callers; removed in 2.0.\n */\n revokeSession(id: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/me/sessions/{id}\", pathParams: { app_slug: this._b.app_slug, id } }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).me.update()` (PATCH /{app_slug}/v1/me).\n *\n * @deprecated Use `auth.consumer(…).me.update()`. Kept for 0.x callers; removed in 2.0.\n */\n updateProfile(params?: T.MeUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.MeUpdatedAccount>> {\n return this._client.request({ method: \"PATCH\", path: \"/{app_slug}/v1/me\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n}\n\n/** `mfa.webauthn` */\nexport class ConsumerMfaWebauthnResource extends APIResource {\n /**\n * Get passkey assertion options for an open MFA challenge\n *\n * Mints a single-use WebAuthn challenge scoped to the account behind `mfa_token` and returns the `publicKey` member for `navigator.credentials.get()`. Submit the result to `/auth/mfa/verify` as `credential` instead of `code`. Possession of the `mfa_token` (i.e. a correct password) is the authority — nothing here reveals whether an account exists or holds passkeys until that token has been presented.\n *\n * @param params - `Auth.MfaWebauthnOptionsParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: No passkey is enrolled on the account behind this challenge.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Invalid or expired challenge.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 412 PRECONDITION_FAILED: Passkeys are not enabled, or no allowed redirect origin matches the configured relying-party id.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Too many failed attempts on the challenge. Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/mfa/webauthn/options\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-webauthn-options\n * @example\n * ```ts\n * const consumerWebauthnOptions = await auth.consumer(\"app\").mfa.webauthn.options({ mfa_token: \"string\" });\n * ```\n */\n options(params: T.MfaWebauthnOptionsParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerWebauthnOptions>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/mfa/webauthn/options\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n}\n\n/** `mfa` */\nexport class ConsumerMfaResource extends APIResource {\n #webauthn?: ConsumerMfaWebauthnResource;\n get webauthn(): ConsumerMfaWebauthnResource {\n return (this.#webauthn ??= new ConsumerMfaWebauthnResource(this._client, this._b));\n }\n /**\n * Begin MFA enrolment against an enrolment token\n *\n * For apps running `auth_config.mfa: \"required\"`. When a user proves their password but holds no enabled factor, `/auth/signin` returns `{ mfa_enrollment_required: true, mfa_token, expires_at }` and mints NO session; this endpoint starts the enrolment that `mfa_token` authorises. Same body and same response as `POST /{app_slug}/v1/me/mfa/factors`, but authenticated by the token rather than by a session — there is no session yet. TOTP returns the otpauth URI, QR data URL and shared secret; email sends a 6-digit code to the bound verified contact. The factor stays disabled until `/auth/mfa/enroll/verify` succeeds. The token is single-purpose: `/auth/mfa/verify`, `/auth/mfa/send-code` and `/auth/mfa/recover` all refuse it with 401, it is not an access token so `/me/*` refuses it, and `/auth/refresh` does not accept it.\n *\n * @param params - `Auth.MfaEnrollParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unsupported factor type, or the account already holds a factor.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Enrolment token invalid, expired, already used, or minted for a different app. A sign-in `mfa_token` (an MFA challenge, not an enrolment token) gets the same 401 — the response never says which kind of token was presented.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 412 PRECONDITION_FAILED: Email factor requested but the bound contact is unverified, or the app has not completed Mail notification setup.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/mfa/enroll\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-enroll\n * @example\n * ```ts\n * const startEnrollment = await auth.consumer(\"app\").mfa.enroll({ mfa_token: \"string\", type: \"totp\" });\n * ```\n */\n enroll(params: T.MfaEnrollParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.StartEnrollment>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/mfa/enroll\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Complete an MFA challenge with a recovery code\n *\n * Same flow as `/auth/mfa/verify` but consumes a single-use recovery code (16 hex chars; hyphens optional). Mints tokens with `amr: [\"pwd\",\"recovery_code\"]`. After successful recovery, the user should regenerate their recovery codes via `/me/mfa/recovery-codes/regenerate`.\n *\n * @param params - `Auth.MfaRecoverParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Invalid or expired challenge, or wrong recovery code.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Too many failed attempts against this challenge (5 locks it). Per-IP rate limit (`RATE_LIMITED`): this path is in the `verify_code` bucket — 5 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/auth/mfa/recover\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-recover\n * @example\n * ```ts\n * const consumerToken = await auth.consumer(\"app\").mfa.recover({ mfa_token: \"string\", recovery_code: \"1a2b-3c4d-5e6f-7890\" });\n * ```\n */\n recover(params: T.MfaRecoverParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/mfa/recover\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Email a sign-in code for an email MFA factor\n *\n * Delivers a single-use 6-digit code to the masked address of an `email` factor listed on the challenge. Submit the code via `/auth/mfa/verify`. Requires the `mfa_token` from the signin response — possession of it (i.e. a correct password) is the authority. Throttled per challenge: max 3 sends, 30s between sends; each send supersedes the prior code.\n *\n * @param params - `Auth.MfaSendCodeParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Factor is not an email factor on this challenge, or request validation failed (missing / malformed body field) in the global `ValidationPipe`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Invalid or expired challenge.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 410 GONE: The bound email contact no longer exists or is no longer verified.\n * @throws {APIError} 412 PRECONDITION_FAILED: The app has not completed Mail notification setup for MFA codes.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Send throttled (max 3 sends per challenge, 30s apart), or too many failed attempts on the challenge. Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/mfa/send-code\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-send-code\n * @example\n * ```ts\n * const consumerMfaSendCode = await auth.consumer(\"app\").mfa.sendCode({ factor_id: \"9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b\", mfa_token: \"string\" });\n * ```\n */\n sendCode(params: T.MfaSendCodeParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerMfaSendCode>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/mfa/send-code\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Complete an MFA challenge with a TOTP or emailed code\n *\n * Submit the `mfa_token` from a `mfa_required: true` signin response, plus EITHER a `code` (a current TOTP code, or the emailed code requested via `/auth/mfa/send-code`) OR a `credential` (a passkey assertion for the options from `/auth/mfa/webauthn/options`). Mints session + tokens with `amr: [\"pwd\", \"<factor type>\"]` and `mfa_at` set to now. The challenge is single-use; 5 wrong attempts locks it.\n *\n * @param params - `Auth.MfaVerifyParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Invalid or expired challenge, or wrong code.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Too many failed attempts against this challenge (5 locks it). Per-IP rate limit (`RATE_LIMITED`): this path is in the `verify_code` bucket — 5 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/mfa/verify\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-verify\n * @example\n * ```ts\n * const consumerToken = await auth.consumer(\"app\").mfa.verify({ mfa_token: \"string\" });\n * ```\n */\n verify(params: T.MfaVerifyParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/mfa/verify\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Confirm the enrolled factor and receive the withheld session\n *\n * Completes the flow started by `/auth/mfa/enroll`. TOTP: submit two `codes` from consecutive 30-second windows. Email: submit the emailed 6-digit `code`. On success the factor is enabled, a fresh set of recovery codes is minted and returned ONCE (invalidating any prior set), and the session sign-in withheld is finally minted with `amr: [\"pwd\",\"mfa\"]` and `mfa_at` set to now. A wrong code counts against the token exactly as it does on the sign-in challenge; 5 failures lock it and the user must sign in again.\n *\n * @param params - `Auth.MfaVerifyEnrollmentParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid or repeated codes, the factor is not pending, or the factor does not belong to the account the token was minted for.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Enrolment token invalid, expired, already used, or minted for a different app.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Too many failed attempts against this enrolment token (5 locks it). Per-IP rate limit (`RATE_LIMITED`): this path is in the `verify_code` bucket — 5 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/mfa/enroll/verify\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-enroll-verify\n * @example\n * ```ts\n * const consumerMfaEnrollVerify = await auth.consumer(\"app\").mfa.verifyEnrollment({ factor_id: \"9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b\", mfa_token: \"string\" });\n * ```\n */\n verifyEnrollment(params: T.MfaVerifyEnrollmentParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerMfaEnrollVerify>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/mfa/enroll/verify\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n}\n\n/** `oauth` */\nexport class ConsumerOauthResource extends APIResource {\n /**\n * Introspect the bearer access token (RFC 7662)\n *\n * OAuth 2.0 token introspection. Send the access token via `Authorization: Bearer <token>` and receive either `{ active: false }` (invalid / expired / wrong app, or a session that is revoked, past its `expires_at`, or gone because the end user was deleted) or the active claim set including `scopes` (M2M) or `role` (EndUser), `exp`, `iat`, `iss`, `aid`. The body `token` field is optional and, if present, must match the bearer — RFC 7662 allows a separate `token` body field but we deliberately refuse cross-token introspection so a stolen token can't be probed against another active credential. The endpoint accepts both M2M and EndUser tokens — use it as the canonical way for a service to know what its own token can do, instead of decoding the JWT by hand. Returns 401 when the bearer is missing.\n *\n * @param params - `Auth.OauthIntrospectParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed in the global `ValidationPipe`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: No `Authorization: Bearer` header, or a `token` in the body that does not match the bearer. Every failure ABOUT THE TOKEN — bad signature, unknown / cross-app `kid`, wrong `aid`, expired, or a session that is revoked, past its `expires_at` or gone because the end user was deleted — is a 200 with `{ active: false }`, on purpose. A bad `:appSlug` is NOT one of those: it is a 404 (see below), decided by `AppStatusGuard` before this handler runs.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`).\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app. Raised by `AppStatusGuard`, which runs before the handler — so an introspection against a misspelled app slug is a 404, not an `{ active: false }`. About the **app**, decided before the token is parsed, so it says nothing about the token.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/oauth/introspect\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-oauth-introspect\n * @example\n * ```ts\n * const introspect = await auth.consumer(\"app\").oauth.introspect({ token: \"string\" });\n * ```\n */\n introspect(params?: T.OauthIntrospectParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Introspect>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/oauth/introspect\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Exchange client_credentials for an access token\n *\n * Standard OAuth 2.0 client_credentials grant. Returns an app-scoped access token whose `scopes[]` claim is the union of the client's configured scopes. Use for service-to-service calls.\n *\n * @param params - `Auth.OauthTokenParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `grant_type` is missing or is not `client_credentials`, or request validation failed in the global `ValidationPipe`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: `Invalid client credentials`. The SINGLE answer for an unknown `client_id`, a deactivated client, a wrong secret and a credential whose stored hash predates the SHA-256 migration — identical in status, message, DB round trips, wall time and CPU cost, so the endpoint is neither a client-existence oracle nor a way for an anonymous caller to spend our CPU. If you need to know whether a credential was deactivated, read it on the authenticated admin surface; if a credential minted before the migration stopped working, rotate its secret.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`).\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app. About the **app**, not the client — decided before `client_id` is looked at.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `token_exchange` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/oauth/token\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-oauth-token\n * @example\n * ```ts\n * const oAuthToken = await auth.consumer(\"app\").oauth.token({\n * client_id: \"m2m_a1b2c3d4e5f6...\",\n * client_secret: \"string\",\n * grant_type: \"client_credentials\",\n * });\n * ```\n */\n token(params: T.OauthTokenParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.OAuthToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/oauth/token\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).oauth.token()` (POST /{app_slug}/v1/oauth/token).\n *\n * @deprecated Use `auth.consumer(…).oauth.token()`. Kept for 0.x callers; removed in 2.0.\n */\n clientCredentials(params: T.OauthTokenParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.OAuthToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/oauth/token\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n}\n\n/** `passkey` */\nexport class ConsumerPasskeyResource extends APIResource {\n /**\n * Begin a passwordless passkey sign-in\n *\n * Returns a single-use WebAuthn challenge for `navigator.credentials.get()`. `allowCredentials` is ALWAYS empty and the response is shaped identically for every caller: this endpoint does not take an identifier and does not look one up, because returning a credential list for a registered address and an empty list for an unregistered one would be a single-request account-existence oracle. Sign-in therefore requires a discoverable (resident) credential — the authenticator finds its own passkey for the relying-party id. Submit the result to `/auth/passkey/verify`.\n *\n * @param params - `Auth.PasskeyOptionsParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Signin is disabled for this app.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 412 PRECONDITION_FAILED: Passkeys are not enabled, or no allowed redirect origin matches the configured relying-party id.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP burst limit. The endpoint does no credential work — one random challenge and one insert — so the bucket is the whole bound. Per-IP rate limit (`RATE_LIMITED`): this path is in the `auth` bucket — 10 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/passkey/options\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-passkey-options\n * @example\n * ```ts\n * const consumerWebauthnOptions = await auth.consumer(\"app\").passkey.options({ tenant_id: \"9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b\" });\n * ```\n */\n options(params?: T.PasskeyOptionsParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerWebauthnOptions>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/passkey/options\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Complete a passwordless passkey sign-in\n *\n * Verifies the assertion against the challenge from `/auth/passkey/options` and mints a session. The authenticator MUST have performed user verification (biometric / PIN) — a presence-only tap is refused on this path whatever the app policy says, because the passkey is the only authentication happening. Tokens carry `amr: [\"webauthn\"]` and a fresh `mfa_at`, so a passkey sign-in satisfies MFA-recency policies without a second step.\n *\n * @param params - `Auth.PasskeyVerifyParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Invalid credentials. Returned identically for a forged assertion, an unknown credential, a challenge that was never issued, one already used, and one that has expired — the endpoint is not an account-existence oracle.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Signin is disabled for this app, or the account is suspended / deactivated. The status refusal is only reachable once the assertion has verified.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP burst limit on credential consumption. Per-IP rate limit (`RATE_LIMITED`): this path is in the `verify_code` bucket — 5 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/passkey/verify\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-passkey-verify\n * @example\n * ```ts\n * const consumerToken = await auth.consumer(\"app\").passkey.verify({ credential: {} });\n * ```\n */\n verify(params: T.PasskeyVerifyParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/passkey/verify\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n}\n\n/** `permissions` */\nexport class ConsumerPermissionsResource extends APIResource {\n /**\n * Create a custom permission\n *\n * Inserts a `<resource>.<action>` row in the per-app permission catalogue. The resource and action segments must each match `^[a-z][a-z0-9_-]{1,47}$`. Conflicts with a system permission name return 409. Customers usually then bind the new permission to a role via `PUT /admin/roles/:roleName/permissions`.\n *\n * @param params - `Auth.ConsumerScopedPermissionCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Conflicts with a system permission or already exists in this app. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/admin/permissions\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-admin-permissions\n * @example\n * ```ts\n * const consumerAdminPermission = await auth.consumer(\"app\").permissions.create({ action: \"read\", resource: \"project\" });\n * ```\n */\n create(params: T.ConsumerScopedPermissionCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerAdminPermission>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/admin/permissions\", pathParams: { app_slug: this._b.app_slug }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a custom permission\n *\n * The `permissionKey` path parameter is the literal `<resource>.<action>` string. System permissions cannot be deleted — attempts return 403. Removing a permission also removes every `role_permission` row that bound it (cascade); role lookups dropped of that perm on the next request.\n *\n * @param permissionKey - Permission key, `resource.action` (e.g. `invoice.read`).\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: permissionKey must be in `resource.action` format.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Cannot delete system permissions.\n * @throws {NotFoundError} 404 NOT_FOUND: Permission not found in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/admin/permissions/{permission_key}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-admin-permissions-permission-key\n * @example\n * ```ts\n * await auth.consumer(\"app\").permissions.delete(\"permission_key\");\n * ```\n */\n delete(permissionKey: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/admin/permissions/{permission_key}\", pathParams: { app_slug: this._b.app_slug, permission_key: permissionKey } }, options);\n }\n /**\n * List all permissions visible to this app\n *\n * Returns the union of system permissions (shared across every app — `is_system: true` in the response) and any custom entries this app has defined (`is_system: false`). Useful for driving a role-editor UI that picks from the full catalogue.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended or archived (`APP_SUSPENDED` / `APP_ARCHIVED`), or the caller lacks `permission.read`: an app API key always needs it in its permissions; a role or M2M scopes need it once the app enforces permissions.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/admin/permissions\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-permissions\n * @example\n * ```ts\n * const result = await auth.consumer(\"app\").permissions.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerScopedPermissionListResponse>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/admin/permissions\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n}\n\n/** `roles` */\nexport class ConsumerRolesResource extends APIResource {\n /**\n * Create a role\n *\n * Creates a role with no permissions bound yet. Use `PUT /:roleName/permissions` to attach a permission set after creation — that route also runs caller-narrowing so an EndUser admin can't grant verbs they don't themselves hold.\n *\n * @param params - `Auth.ConsumerScopedRoleCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Role name already exists in this app. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/admin/roles\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-admin-roles\n * @example\n * ```ts\n * const consumerRole = await auth.consumer(\"app\").roles.create({ name: \"editor\" });\n * ```\n */\n create(params: T.ConsumerScopedRoleCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerRole>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/admin/roles\", pathParams: { app_slug: this._b.app_slug }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a custom role\n *\n * System roles (`owner`, `admin`, `member`) cannot be deleted — attempts return 403. Roles currently assigned to any member return 409 `ROLE_IN_USE`; reassign the affected members first.\n *\n * @param roleName - Name of the role (e.g. `admin`).\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Cannot delete a system role.\n * @throws {ConflictError} 409 CONFLICT: Role is in use by at least one member.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/admin/roles/{role_name}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-admin-roles-role-name\n * @example\n * ```ts\n * await auth.consumer(\"app\").roles.delete(\"role_name\");\n * ```\n */\n delete(roleName: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/admin/roles/{role_name}\", pathParams: { app_slug: this._b.app_slug, role_name: roleName } }, options);\n }\n /**\n * List roles in this app\n *\n * Cursor-paginated by `created_at`. Use the returned `next_cursor` in subsequent calls — offset pagination is not exposed.\n *\n * @param params - `Auth.ConsumerScopedRoleListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended or archived (`APP_SUSPENDED` / `APP_ARCHIVED`), or the caller lacks `role.read`: an app API key always needs it in its permissions; a role or M2M scopes need it once the app enforces permissions.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/admin/roles\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-roles\n * @example\n * ```ts\n * for await (const role of auth.consumer(\"app\").roles.list()) {\n * console.log(role);\n * }\n * const page = await auth.consumer(\"app\").roles.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.ConsumerScopedRoleListParams, options?: RequestOptions): PagePromise<T.ConsumerRole> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/admin/roles\", pathParams: { app_slug: this._b.app_slug }, query: params }, options);\n }\n /**\n * Read one role with its permission set\n *\n * Returns the role plus the flat `permissions[]` array currently bound. Use this to drive a \"configure role\" UI in the customer product without having to call `/permissions` separately.\n *\n * @param roleName - Name of the role (e.g. `admin`).\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Role not found in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/admin/roles/{role_name}\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-roles-role-name\n * @example\n * ```ts\n * const consumerRoleWithPermissions = await auth.consumer(\"app\").roles.retrieve(\"role_name\");\n * ```\n */\n retrieve(roleName: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerRoleWithPermissions>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/admin/roles/{role_name}\", pathParams: { app_slug: this._b.app_slug, role_name: roleName } }, options);\n }\n /**\n * Update a role's description\n *\n * Renames are intentionally NOT supported — the role name is part of every issued EndUser JWT, so changing it would silently break live sessions. Create a new role and migrate users instead.\n *\n * @param roleName - Name of the role (e.g. `admin`).\n * @param params - `Auth.ConsumerScopedRoleUpdateParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Role not found in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /{app_slug}/v1/admin/roles/{role_name}\n * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-admin-roles-role-name\n * @example\n * ```ts\n * const consumerRole = await auth.consumer(\"app\").roles.update(\"role_name\", { description: \"Updated description\" });\n * ```\n */\n update(roleName: string, params?: T.ConsumerScopedRoleUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerRole>> {\n return this._client.request({ method: \"PATCH\", path: \"/{app_slug}/v1/admin/roles/{role_name}\", pathParams: { app_slug: this._b.app_slug, role_name: roleName }, body: params }, options);\n }\n /**\n * Replace a role's permission set\n *\n * Destructive — the role's permission set is replaced wholesale with the supplied array. Caller-narrowed: the caller must hold every permission in the request, otherwise 403 `Cannot grant actions you don't have: ...`. For EndUser callers the caller-held set is their app-membership role's effective permissions. For M2M callers the held set is the token's `scopes[]` claim — the M2M cannot grant a role any verb that wasn't configured on the M2M credential. Unknown permission strings return 400.\n *\n * @param roleName - Name of the role (e.g. `admin`).\n * @param params - `Auth.ConsumerScopedRoleUpdatePermissionsParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown permission(s) in the request.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller is missing one or more permissions they're trying to grant.\n * @throws {NotFoundError} 404 NOT_FOUND: Role not found in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PUT /{app_slug}/v1/admin/roles/{role_name}/permissions\n * @see https://productcraft.co/docs/auth/api-reference#put-app-slug-v1-admin-roles-role-name-permissions\n * @example\n * ```ts\n * const result = await auth.consumer(\"app\").roles.updatePermissions(\"role_name\", { permissions: [\"user.read\", \"role.create\"] });\n * ```\n */\n updatePermissions(roleName: string, params: T.ConsumerScopedRoleUpdatePermissionsParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerScopedRoleUpdatePermissionsResponse>> {\n return this._client.request({ method: \"PUT\", path: \"/{app_slug}/v1/admin/roles/{role_name}/permissions\", pathParams: { app_slug: this._b.app_slug, role_name: roleName }, body: params }, options);\n }\n}\n\n/** `tenantApiKeys.config` */\nexport class ConsumerTenantApiKeysConfigResource extends APIResource {\n /**\n * Read this app's tenant API key settings\n *\n * Requires `auth.tenant.api_keys.configure` on the app.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or revoked Platform API Key (`Authorization: Bearer pcft_live_…`).\n * @throws {PermissionDeniedError} 403 FORBIDDEN, PAK_WORKSPACE_MISMATCH: `PAK_WORKSPACE_MISMATCH` (the PAK belongs to another workspace than the app), or the PAK's policy does not allow `auth.tenant.api_keys.configure` on `pcft:heimdall:app/<appId>`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT: The app has no workspace binding, so no PAK can act on it.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/tenant-api-keys/config\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenant-api-keys-config\n * @example\n * ```ts\n * const tenantApiKeysConfig = await auth.consumer(\"app\").tenantApiKeys.config.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantApiKeysConfig>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/tenant-api-keys/config\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * Push this app's tenant API key settings\n *\n * Call it on boot: your code is the source of truth for the scopes a key can carry. Fields you leave out keep their stored value. `suspended` is the platform's kill switch: this route never changes it, and a body that carries it is refused. Requires `auth.tenant.api_keys.configure` on the app.\n *\n * @param params - `Auth.ConsumerScopedTenantApiKeyConfigUpdateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, TENANT_API_KEYS_SCOPE_INVALID, TENANT_API_KEYS_UNKNOWN_ROLE, TENANT_API_KEY_EXPIRY_INVALID, TENANT_API_KEYS_NO_SCOPES, TENANT_API_KEYS_SUSPENDED_NOT_WRITABLE: `VALIDATION_ERROR`, `TENANT_API_KEYS_SCOPE_INVALID` (`details.scopes`), `TENANT_API_KEYS_UNKNOWN_ROLE` (`details.roles`: `manage_roles` names a role this app does not have), `TENANT_API_KEY_EXPIRY_INVALID`, `TENANT_API_KEYS_NO_SCOPES` (enabling with no scope), `TENANT_API_KEYS_SUSPENDED_NOT_WRITABLE` (the body carries `suspended`), or a malformed `Idempotency-Key`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or revoked Platform API Key (`Authorization: Bearer pcft_live_…`).\n * @throws {PermissionDeniedError} 403 FORBIDDEN, PAK_WORKSPACE_MISMATCH: `PAK_WORKSPACE_MISMATCH` (the PAK belongs to another workspace than the app), or the PAK's policy does not allow `auth.tenant.api_keys.configure` on `pcft:heimdall:app/<appId>`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: The app has no workspace binding, so no PAK can act on it. Or `IDEMPOTENCY_KEY_REUSE`. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PUT /{app_slug}/v1/tenant-api-keys/config\n * @see https://productcraft.co/docs/auth/api-reference#put-app-slug-v1-tenant-api-keys-config\n * @example\n * ```ts\n * const tenantApiKeysConfig = await auth.consumer(\"app\").tenantApiKeys.config.update({ default_expiry_days: 7 });\n * ```\n */\n update(params?: T.ConsumerScopedTenantApiKeyConfigUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantApiKeysConfig>> {\n return this._client.request({ method: \"PUT\", path: \"/{app_slug}/v1/tenant-api-keys/config\", pathParams: { app_slug: this._b.app_slug }, body: params, idempotent: true }, options);\n }\n}\n\n/** `tenantApiKeys` */\nexport class ConsumerTenantApiKeysResource extends APIResource {\n #config?: ConsumerTenantApiKeysConfigResource;\n get config(): ConsumerTenantApiKeysConfigResource {\n return (this.#config ??= new ConsumerTenantApiKeysConfigResource(this._client, this._b));\n }\n /**\n * Create an API key for the active tenant\n *\n * Returns the secret ONCE (`key`). Scopes must be grantable by the app and held by your own tenant role. At most 25 active keys per tenant. If the app requires recent MFA, verify a factor first (403 `step_up_required`). Responses carry `Cache-Control: no-store`.\n *\n * @param params - `Auth.TenantApiKeyCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, TENANT_API_KEY_SCOPE_NOT_GRANTABLE, TENANT_API_KEY_EXPIRY_INVALID: `VALIDATION_ERROR`, `TENANT_API_KEY_SCOPE_NOT_GRANTABLE` (`details.scopes`), `TENANT_API_KEY_EXPIRY_INVALID` (`details.allowed`), or a malformed `Idempotency-Key`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid end-user bearer token (M2M tokens, PAKs and API keys are refused).\n * @throws {PermissionDeniedError} 403 FORBIDDEN, TENANT_API_KEYS_NOT_ENABLED, TENANT_API_KEYS_SUSPENDED, TENANT_API_KEYS_APP_PROXY_ONLY, TENANT_CONTEXT_REQUIRED, TENANT_MEMBERSHIP_REQUIRED, TENANT_NOT_ACTIVE, TENANT_API_KEYS_FORBIDDEN, TENANT_API_KEY_SCOPE_ABOVE_CEILING, step_up_required: `TENANT_API_KEYS_NOT_ENABLED` (the app has not enabled tenant API keys), `TENANT_API_KEYS_SUSPENDED`, `TENANT_API_KEYS_APP_PROXY_ONLY` (the app manages keys through its own backend; call it instead), `TENANT_CONTEXT_REQUIRED` (no active tenant on the session: switch tenant first), `TENANT_MEMBERSHIP_REQUIRED`, `TENANT_NOT_ACTIVE`, `TENANT_API_KEYS_FORBIDDEN` (your tenant role is not in the app's `manage_roles`), or a PAK refusal on `X-Heimdall-App-Key`. Also `TENANT_API_KEY_SCOPE_ABOVE_CEILING` (`details.scopes`: scopes your role does not hold) and `step_up_required` (`details.max_age_minutes`).\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, TENANT_API_KEY_LIMIT, idempotency_secret_not_replayable, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: `TENANT_API_KEY_LIMIT` (25 active keys), `idempotency_secret_not_replayable` (`details.key_id`), or `IDEMPOTENCY_KEY_REUSE`. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/tenant-api-keys\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenant-api-keys\n * @example\n * ```ts\n * const tenantApiKeyWithSecret = await auth.consumer(\"app\").tenantApiKeys.create({ name: \"CI e2e\", scopes: [\"disputes.read\", \"audit.read\"] });\n * ```\n */\n create(params: T.TenantApiKeyCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantApiKeyWithSecret>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/tenant-api-keys\", pathParams: { app_slug: this._b.app_slug }, body: params, idempotent: true }, options);\n }\n /**\n * Revoke an API key\n *\n * Immediate and final. Idempotent: revoking a revoked key is a 204 that changes nothing.\n *\n * @param keyId - Key id (UUID) or display id (`tak_…`).\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid end-user bearer token (M2M tokens, PAKs and API keys are refused).\n * @throws {PermissionDeniedError} 403 FORBIDDEN, TENANT_API_KEYS_NOT_ENABLED, TENANT_API_KEYS_SUSPENDED, TENANT_API_KEYS_APP_PROXY_ONLY, TENANT_CONTEXT_REQUIRED, TENANT_MEMBERSHIP_REQUIRED, TENANT_NOT_ACTIVE, TENANT_API_KEYS_FORBIDDEN: `TENANT_API_KEYS_NOT_ENABLED` (the app has not enabled tenant API keys), `TENANT_API_KEYS_SUSPENDED`, `TENANT_API_KEYS_APP_PROXY_ONLY` (the app manages keys through its own backend; call it instead), `TENANT_CONTEXT_REQUIRED` (no active tenant on the session: switch tenant first), `TENANT_MEMBERSHIP_REQUIRED`, `TENANT_NOT_ACTIVE`, `TENANT_API_KEYS_FORBIDDEN` (your tenant role is not in the app's `manage_roles`), or a PAK refusal on `X-Heimdall-App-Key`.\n * @throws {NotFoundError} 404 NOT_FOUND, TENANT_API_KEY_NOT_FOUND: `TENANT_API_KEY_NOT_FOUND`: no such key in your active tenant (or app not found).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/tenant-api-keys/{key_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-tenant-api-keys-key-id\n * @example\n * ```ts\n * await auth.consumer(\"app\").tenantApiKeys.delete(\"key\");\n * ```\n */\n delete(keyId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/tenant-api-keys/{key_id}\", pathParams: { app_slug: this._b.app_slug, key_id: keyId } }, options);\n }\n /**\n * Verify a tenant API key (RFC 7662 shape)\n *\n * For your backend: is this `pctk_` key, presented to YOUR API, usable right now, for which tenant and with which scopes? A key of another app is `{\"active\": false}`. Cache answers by the key's SHA-256: positives up to 30 s (never past `expires_at`), negatives up to 60 s. Intersect `scopes` with the permissions of `created_by.tenant_role` in your app. Requires `auth.tenant.api_keys.introspect` on the app. Not audited per call; `last_used_at` records use (5-minute granularity). This route has its own per-app rate bucket (1200 calls a minute by default), separate from your PAK's other calls; over it the answer is 429 with `Retry-After`, never a false `active: false`, so keep serving keys you hold a fresh positive for.\n *\n * @param params - `Auth.TenantApiKeyIntrospectParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `key` missing or not a string.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or revoked Platform API Key (`Authorization: Bearer pcft_live_…`).\n * @throws {PermissionDeniedError} 403 FORBIDDEN, PAK_WORKSPACE_MISMATCH: `PAK_WORKSPACE_MISMATCH` (the PAK belongs to another workspace than the app), or the PAK's policy does not allow `auth.tenant.api_keys.introspect` on `pcft:heimdall:app/<appId>`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT: The app has no workspace binding, so no PAK can act on it.\n * @throws {RateLimitError} 429 RATE_LIMITED: `RATE_LIMITED`: this app's introspect bucket is exhausted for the current minute. `Retry-After` says when it refills.\n * @see POST /{app_slug}/v1/tenant-api-keys/introspect\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenant-api-keys-introspect\n * @example\n * ```ts\n * const tenantApiKeyIntrospection = await auth.consumer(\"app\").tenantApiKeys.introspect({ key: \"pctk_live_4fQ2aZ0000000000000000000000000000000000000_1a2B3c\" });\n * ```\n */\n introspect(params: T.TenantApiKeyIntrospectParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantApiKeyIntrospection>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/tenant-api-keys/introspect\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * List the active tenant's API keys\n *\n * Newest first, cursor-paginated (20 per page, max 100). Secrets are never returned; `key_prefix` and `last4` identify a key.\n *\n * @param params - `Auth.ConsumerScopedTenantApiKeyListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` or malformed `cursor`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid end-user bearer token (M2M tokens, PAKs and API keys are refused).\n * @throws {PermissionDeniedError} 403 FORBIDDEN, TENANT_API_KEYS_NOT_ENABLED, TENANT_API_KEYS_SUSPENDED, TENANT_API_KEYS_APP_PROXY_ONLY, TENANT_CONTEXT_REQUIRED, TENANT_MEMBERSHIP_REQUIRED, TENANT_NOT_ACTIVE, TENANT_API_KEYS_FORBIDDEN: `TENANT_API_KEYS_NOT_ENABLED` (the app has not enabled tenant API keys), `TENANT_API_KEYS_SUSPENDED`, `TENANT_API_KEYS_APP_PROXY_ONLY` (the app manages keys through its own backend; call it instead), `TENANT_CONTEXT_REQUIRED` (no active tenant on the session: switch tenant first), `TENANT_MEMBERSHIP_REQUIRED`, `TENANT_NOT_ACTIVE`, `TENANT_API_KEYS_FORBIDDEN` (your tenant role is not in the app's `manage_roles`), or a PAK refusal on `X-Heimdall-App-Key`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/tenant-api-keys\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenant-api-keys\n * @example\n * ```ts\n * for await (const tenantApiKey of auth.consumer(\"app\").tenantApiKeys.list()) {\n * console.log(tenantApiKey);\n * }\n * const page = await auth.consumer(\"app\").tenantApiKeys.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.ConsumerScopedTenantApiKeyListParams, options?: RequestOptions): PagePromise<T.TenantApiKey> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/tenant-api-keys\", pathParams: { app_slug: this._b.app_slug }, query: params }, options);\n }\n /**\n * Rotate an API key\n *\n * Mints a replacement with the same name and scopes and returns its secret ONCE. You become the replacement's creator, so its scopes must be within your own tenant role. The outgoing key is revoked now (`grace_hours: 0`, the default) or keeps working for up to 24 hours. To kill a leaked key, revoke it. Responses carry `Cache-Control: no-store`.\n *\n * @param keyId - Key id (UUID) or display id (`tak_…`).\n * @param params - `Auth.TenantApiKeyRotateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, TENANT_API_KEY_EXPIRY_INVALID: `VALIDATION_ERROR` (`grace_hours` outside 0-24), `TENANT_API_KEY_EXPIRY_INVALID`, or a malformed `Idempotency-Key`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid end-user bearer token (M2M tokens, PAKs and API keys are refused).\n * @throws {PermissionDeniedError} 403 FORBIDDEN, TENANT_API_KEYS_NOT_ENABLED, TENANT_API_KEYS_SUSPENDED, TENANT_API_KEYS_APP_PROXY_ONLY, TENANT_CONTEXT_REQUIRED, TENANT_MEMBERSHIP_REQUIRED, TENANT_NOT_ACTIVE, TENANT_API_KEYS_FORBIDDEN, TENANT_API_KEY_SCOPE_ABOVE_CEILING, step_up_required: `TENANT_API_KEYS_NOT_ENABLED` (the app has not enabled tenant API keys), `TENANT_API_KEYS_SUSPENDED`, `TENANT_API_KEYS_APP_PROXY_ONLY` (the app manages keys through its own backend; call it instead), `TENANT_CONTEXT_REQUIRED` (no active tenant on the session: switch tenant first), `TENANT_MEMBERSHIP_REQUIRED`, `TENANT_NOT_ACTIVE`, `TENANT_API_KEYS_FORBIDDEN` (your tenant role is not in the app's `manage_roles`), or a PAK refusal on `X-Heimdall-App-Key`. Also `TENANT_API_KEY_SCOPE_ABOVE_CEILING` and `step_up_required`.\n * @throws {NotFoundError} 404 NOT_FOUND, TENANT_API_KEY_NOT_FOUND: `TENANT_API_KEY_NOT_FOUND`: no such key in your active tenant (or app not found).\n * @throws {ConflictError} 409 CONFLICT, TENANT_API_KEY_NOT_ACTIVE, TENANT_API_KEY_SCOPE_NOT_GRANTABLE, idempotency_secret_not_replayable, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: `TENANT_API_KEY_NOT_ACTIVE` (revoked or expired keys cannot be rotated), `TENANT_API_KEY_SCOPE_NOT_GRANTABLE` (the app no longer offers one of its scopes), `idempotency_secret_not_replayable`, or `IDEMPOTENCY_KEY_REUSE`. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/tenant-api-keys/{key_id}/rotate\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenant-api-keys-key-id-rotate\n * @example\n * ```ts\n * const tenantApiKeyWithSecret = await auth.consumer(\"app\").tenantApiKeys.rotate(\"key\", { expires_in_days: 7 });\n * ```\n */\n rotate(keyId: string, params?: T.TenantApiKeyRotateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantApiKeyWithSecret>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/tenant-api-keys/{key_id}/rotate\", pathParams: { app_slug: this._b.app_slug, key_id: keyId }, body: params, idempotent: true }, options);\n }\n /**\n * Why a tenant API key is (in)active\n *\n * For your own audit trail: record why a key you saw go inactive died (revoked in the console, creator left the tenant, expired, keys suspended). Only keys of this app; another app's key is 404. Requires `auth.tenant.api_keys.introspect` on the app.\n *\n * @param keyId - Key id (UUID) or display id (`tak_…`), as `introspect` returned it.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or revoked Platform API Key (`Authorization: Bearer pcft_live_…`).\n * @throws {PermissionDeniedError} 403 FORBIDDEN, PAK_WORKSPACE_MISMATCH: `PAK_WORKSPACE_MISMATCH` (the PAK belongs to another workspace than the app), or the PAK's policy does not allow `auth.tenant.api_keys.introspect` on `pcft:heimdall:app/<appId>`.\n * @throws {NotFoundError} 404 NOT_FOUND, TENANT_API_KEY_NOT_FOUND: `TENANT_API_KEY_NOT_FOUND`: no such key in this app (or app not found).\n * @throws {ConflictError} 409 CONFLICT: The app has no workspace binding, so no PAK can act on it.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/tenant-api-keys/{key_id}/status\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenant-api-keys-key-id-status\n * @example\n * ```ts\n * const tenantApiKeyStatus = await auth.consumer(\"app\").tenantApiKeys.status(\"key\");\n * ```\n */\n status(keyId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantApiKeyStatus>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/tenant-api-keys/{key_id}/status\", pathParams: { app_slug: this._b.app_slug, key_id: keyId } }, options);\n }\n}\n\n/** `tenants.invites` */\nexport class ConsumerTenantsInvitesResource extends APIResource {\n /**\n * Invite an email address into a tenant. Mints a pending invite, mails the code through the app's `invite_template_name` Envoi slot, and returns the plaintext code ONCE. PAK must hold auth.tenant.members.add.\n *\n * Unlike `POST /members`, nothing is granted until the invitee accepts at `POST /:appSlug/v1/auth/accept-tenant-invite`. Only a SHA-256 digest of the code is stored, so the `code` in this response is unrecoverable afterwards.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.ConsumerScopedTenantInviteCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid email, unknown role, or maxUses/expiresInHours out of range.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: PAK missing.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: PAK policy denies action.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: That email is already a member of the tenant, or already has a pending invite to it. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/tenants/{tenant_id}/invites\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenants-tenant-id-invites\n * @example\n * ```ts\n * const createTenantInvite = await auth.consumer(\"app\").tenants.invites.create(\"tenant\", { email: \"alice@example.com\", role_name: \"member\" });\n * ```\n */\n create(tenantId: string, params: T.ConsumerScopedTenantInviteCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CreateTenantInvite>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/tenants/{tenant_id}/invites\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId }, body: params, idempotent: true }, options);\n }\n /**\n * Revoke a pending invite. Idempotent — revoking an already-revoked invite is a 204 no-op and fires no second webhook. PAK must hold auth.tenant.members.remove.\n *\n * @param tenantId - Id of the tenant.\n * @param inviteId - Id of the invite.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant or invite not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/tenants/{tenant_id}/invites/{invite_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-tenants-tenant-id-invites-invite-id\n * @example\n * ```ts\n * await auth.consumer(\"app\").tenants.invites.delete(\"tenant\", \"invite\");\n * ```\n */\n delete(tenantId: string, inviteId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/tenants/{tenant_id}/invites/{invite_id}\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId, invite_id: inviteId } }, options);\n }\n /**\n * List a tenant's invites, newest first. Optional `?status=pending|revoked|expired|used`. PAK must hold auth.tenant.read.\n *\n * Codes are never returned here — only the digest is stored. Use `status=pending` to show outstanding invitations.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.ConsumerScopedTenantInviteListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` value.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/tenants/{tenant_id}/invites\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenants-tenant-id-invites\n * @example\n * ```ts\n * for await (const invite of auth.consumer(\"app\").tenants.invites.list(\"tenant\")) {\n * console.log(invite);\n * }\n * const page = await auth.consumer(\"app\").tenants.invites.list(\"tenant\", {}, { timeout: 5_000 });\n * ```\n */\n list(tenantId: string, params?: T.ConsumerScopedTenantInviteListParams, options?: RequestOptions): PagePromise<T.TenantInvite> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/tenants/{tenant_id}/invites\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId }, query: params }, options);\n }\n}\n\n/** `tenants.members` */\nexport class ConsumerTenantsMembersResource extends APIResource {\n /**\n * Add a member to a tenant. Pass `accountId` for an existing user, or `email` (+ optional `display_name`/`username`) to auto-create the account inline. PAK must hold auth.tenant.members.add.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.ConsumerScopedTenantMemberCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid body (missing accountId/email or unknown role).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant or account not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Account is already a member of this tenant. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/tenants/{tenant_id}/members\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenants-tenant-id-members\n * @example\n * ```ts\n * const consumerAddMember = await auth.consumer(\"app\").tenants.members.create(\"tenant\", { role_name: \"member\" });\n * ```\n */\n create(tenantId: string, params: T.ConsumerScopedTenantMemberCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerAddMember>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/tenants/{tenant_id}/members\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId }, body: params, idempotent: true }, options);\n }\n /**\n * Remove a member from a tenant. The underlying account row stays in the app — only the tenant_membership row is deleted. PAK must hold auth.tenant.members.remove.\n *\n * @param tenantId - Id of the tenant.\n * @param accountId - Id of the account.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant or membership not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/tenants/{tenant_id}/members/{account_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-tenants-tenant-id-members-account-id\n * @example\n * ```ts\n * await auth.consumer(\"app\").tenants.members.delete(\"tenant\", \"account\");\n * ```\n */\n delete(tenantId: string, accountId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/tenants/{tenant_id}/members/{account_id}\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId, account_id: accountId } }, options);\n }\n /**\n * List members of a tenant. Cursor-paginated by joined_at desc. Filter by `?search=` and/or `?role=`. PAK must hold auth.tenant.read.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.ConsumerScopedTenantMemberListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Over-long `search` / `role` filter or malformed `cursor`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: PAK missing, malformed, unknown or revoked.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: PAK policy denies `auth.tenant.read` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: App or tenant not found (or the PAK belongs to another workspace).\n * @throws {ConflictError} 409 CONFLICT: App has no workspace binding; PAK access refused.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/tenants/{tenant_id}/members\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenants-tenant-id-members\n * @example\n * ```ts\n * for await (const member of auth.consumer(\"app\").tenants.members.list(\"tenant\")) {\n * console.log(member);\n * }\n * const page = await auth.consumer(\"app\").tenants.members.list(\"tenant\", {}, { timeout: 5_000 });\n * ```\n */\n list(tenantId: string, params?: T.ConsumerScopedTenantMemberListParams, options?: RequestOptions): PagePromise<T.ConsumerTenantMembership> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/tenants/{tenant_id}/members\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId }, query: params }, options);\n }\n /**\n * Change a member's role. PAK must hold auth.tenant.members.update-role.\n *\n * @param tenantId - Id of the tenant.\n * @param accountId - Id of the account.\n * @param params - `Auth.ConsumerScopedTenantMemberUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown role.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant or membership not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /{app_slug}/v1/tenants/{tenant_id}/members/{account_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-tenants-tenant-id-members-account-id\n * @example\n * ```ts\n * const consumerTenantMembership = await auth.consumer(\"app\").tenants.members.update(\"tenant\", \"account\", { role_name: \"admin\" });\n * ```\n */\n update(tenantId: string, accountId: string, params: T.ConsumerScopedTenantMemberUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerTenantMembership>> {\n return this._client.request({ method: \"PATCH\", path: \"/{app_slug}/v1/tenants/{tenant_id}/members/{account_id}\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId, account_id: accountId }, body: params }, options);\n }\n}\n\n/** `tenants` */\nexport class ConsumerTenantsResource extends APIResource {\n #invites?: ConsumerTenantsInvitesResource;\n #members?: ConsumerTenantsMembersResource;\n get invites(): ConsumerTenantsInvitesResource {\n return (this.#invites ??= new ConsumerTenantsInvitesResource(this._client, this._b));\n }\n get members(): ConsumerTenantsMembersResource {\n return (this.#members ??= new ConsumerTenantsMembersResource(this._client, this._b));\n }\n /**\n * Create a tenant inside this app. Returns the new tenant with a `display_id` (`tnt_<12hex>`). PAK must hold auth.tenant.create.\n *\n * @param params - `Auth.ConsumerScopedTenantCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid display_name or slug.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: PAK missing.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: PAK policy denies action.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Slug already taken in this app. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/tenants\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenants\n * @example\n * ```ts\n * const consumerTenant = await auth.consumer(\"app\").tenants.create({ display_name: \"Acme Co\" });\n * ```\n */\n create(params: T.ConsumerScopedTenantCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerTenant>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/tenants\", pathParams: { app_slug: this._b.app_slug }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a tenant. Cascades to tenant_membership rows; account rows are unaffected. PAK must hold auth.tenant.delete.\n *\n * @param tenantId - Id of the tenant.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/tenants/{tenant_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-tenants-tenant-id\n * @example\n * ```ts\n * await auth.consumer(\"app\").tenants.delete(\"tenant\");\n * ```\n */\n delete(tenantId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/tenants/{tenant_id}\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId } }, options);\n }\n /**\n * List tenants in this app, paginated by created_at desc. PAK must hold auth.tenant.read.\n *\n * @param params - `Auth.ConsumerScopedTenantListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `status` filter or malformed `cursor`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: PAK missing, malformed, unknown or revoked.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: PAK policy denies `auth.tenant.read` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found (or the PAK belongs to another workspace).\n * @throws {ConflictError} 409 CONFLICT: App has no workspace binding; PAK access refused.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/tenants\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenants\n * @example\n * ```ts\n * for await (const tenant of auth.consumer(\"app\").tenants.list()) {\n * console.log(tenant);\n * }\n * const page = await auth.consumer(\"app\").tenants.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.ConsumerScopedTenantListParams, options?: RequestOptions): PagePromise<T.ConsumerTenant> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/tenants\", pathParams: { app_slug: this._b.app_slug }, query: params }, options);\n }\n /**\n * Fetch a single tenant by its UUID or `tnt_<12hex>` display id. PAK must hold auth.tenant.read.\n *\n * @param tenantId - Id of the tenant.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/tenants/{tenant_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenants-tenant-id\n * @example\n * ```ts\n * const consumerTenant = await auth.consumer(\"app\").tenants.retrieve(\"tenant\");\n * ```\n */\n retrieve(tenantId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerTenant>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/tenants/{tenant_id}\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId } }, options);\n }\n /**\n * Patch a tenant. Any subset of {display_name, slug, status, metadata}. PAK must hold auth.tenant.update.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.ConsumerScopedTenantUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid patch.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant not found.\n * @throws {ConflictError} 409 CONFLICT: Slug collision.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /{app_slug}/v1/tenants/{tenant_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-tenants-tenant-id\n * @example\n * ```ts\n * const consumerTenant = await auth.consumer(\"app\").tenants.update(\"tenant\", { display_name: \"string\" });\n * ```\n */\n update(tenantId: string, params?: T.ConsumerScopedTenantUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerTenant>> {\n return this._client.request({ method: \"PATCH\", path: \"/{app_slug}/v1/tenants/{tenant_id}\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId }, body: params }, options);\n }\n}\n\n/** `users.factors` */\nexport class ConsumerUsersFactorsResource extends APIResource {\n /**\n * Provision an MFA factor on behalf of a user\n *\n * Creates the factor in the enabled state. TOTP: returns the cleartext secret + otpauth URI + recovery codes in the response — intended for synthetic-account-style flows where the caller bundles credentials and ships them out once. Email: binds the user's verified email contact (primary by default, `contact_id` to override; 412 when unverified) and returns the masked address + recovery codes — sign-in codes are then delivered on demand via `/auth/mfa/send-code`.\n *\n * @param userId - Id of the user.\n * @param params - `Auth.UserFactorCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed (unsupported `type`, over-long `label`, non-UUID `contact_id`), or `type` is `webauthn` — passkeys cannot be provisioned out-of-band.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing bearer token, or the Platform API Key is malformed, unknown or revoked.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: The PAK policy denies `auth.user.factors.provision` on this app's URN.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app (or the PAK belongs to another workspace), or the user is not in this app. Email factors: `contact_id` names no email contact on the account.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: The app has no workspace binding, so PAK access is refused until configured. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {APIError} 412 PRECONDITION_FAILED: Email factors: the contact (or primary email) is unverified, or the app has not completed Mail setup for MFA codes.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/users/{user_id}/factors\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-users-user-id-factors\n * @example\n * ```ts\n * const adminProvisionFactor = await auth.consumer(\"app\").users.factors.create(\"user\", { type: \"totp\" });\n * ```\n */\n create(userId: string, params: T.UserFactorCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AdminProvisionFactor>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/users/{user_id}/factors\", pathParams: { app_slug: this._b.app_slug, user_id: userId }, body: params, idempotent: true }, options);\n }\n /**\n * Disable a user's MFA factor\n *\n * @param userId - Id of the user.\n * @param factorId - Id of the factor.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing bearer token, or the Platform API Key is malformed, unknown or revoked.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: The PAK policy denies `auth.user.factors.delete` on this app's URN.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app (or the PAK belongs to another workspace), or the user is not in this app. Also when the factor is not on that user.\n * @throws {ConflictError} 409 CONFLICT: The app has no workspace binding, so PAK access is refused until configured.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/users/{user_id}/factors/{factor_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-users-user-id-factors-factor-id\n * @example\n * ```ts\n * await auth.consumer(\"app\").users.factors.delete(\"user\", \"factor\");\n * ```\n */\n delete(userId: string, factorId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/users/{user_id}/factors/{factor_id}\", pathParams: { app_slug: this._b.app_slug, user_id: userId, factor_id: factorId } }, options);\n }\n /**\n * List a user's MFA factors\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing bearer token, or the Platform API Key is malformed, unknown or revoked.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: The PAK policy denies `auth.user.factors.read` on this app's URN.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app (or the PAK belongs to another workspace), or the user is not in this app.\n * @throws {ConflictError} 409 CONFLICT: The app has no workspace binding, so PAK access is refused until configured.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/users/{user_id}/factors\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-users-user-id-factors\n * @example\n * ```ts\n * const factorList = await auth.consumer(\"app\").users.factors.list(\"user\");\n * ```\n */\n list(userId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.FactorList>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/users/{user_id}/factors\", pathParams: { app_slug: this._b.app_slug, user_id: userId } }, options);\n }\n}\n\n/** `users` */\nexport class ConsumerUsersResource extends APIResource {\n #factors?: ConsumerUsersFactorsResource;\n get factors(): ConsumerUsersFactorsResource {\n return (this.#factors ??= new ConsumerUsersFactorsResource(this._client, this._b));\n }\n /**\n * Provision a new end-user\n *\n * Create an account in this app. Distinct from the public `/auth/signup`: no session is issued, no password is required (when omitted, the customer triggers a password-reset to finish onboarding), and the primary email contact starts unverified — the customer is responsible for kicking off the verification flow via `/auth/request-verification` or `/auth/send-verification-email`. The `roleName` defaults to the app's `signup_default_role`.\n *\n * What is NOT distinct: the password policy. A supplied `password` goes through the same app-configured rules, the same common-password deny-list and the same breach check as `/auth/signup`.\n *\n * @param params - `Auth.UserCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, PASSWORD_TOO_COMMON, PASSWORD_BREACHED: Invalid email, unknown role, or a password that fails the app policy — `PASSWORD_TOO_COMMON` / `PASSWORD_BREACHED`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Email or username already in use. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/admin/users\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-admin-users\n * @example\n * ```ts\n * const consumerAdminCreatedUser = await auth.consumer(\"app\").users.create({ email: \"string\" });\n * ```\n */\n create(params: T.UserCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerAdminCreatedUser>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/admin/users\", pathParams: { app_slug: this._b.app_slug }, body: params, idempotent: true }, options);\n }\n /**\n * Permanently delete an end-user\n *\n * Removes the account, its sessions, contacts, and tenant memberships. Audit rows are preserved, and the deletion itself is audited as `auth.account.deleted` with `via: consumer_admin` and the caller as actor. Fires `user.deleted` with `via: \"consumer_admin\"`.\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended or archived (`APP_SUSPENDED` / `APP_ARCHIVED`), or the caller lacks `user.delete`: an app API key always needs it in its permissions; a role or M2M scopes need it once the app enforces permissions.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/admin/users/{user_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-admin-users-user-id\n * @example\n * ```ts\n * await auth.consumer(\"app\").users.delete(\"user\");\n * ```\n */\n delete(userId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/admin/users/{user_id}\", pathParams: { app_slug: this._b.app_slug, user_id: userId } }, options);\n }\n /**\n * List end-users in this app\n *\n * Cursor-paginated. Supports the same `status` and `search` filters as the auth-admin equivalent. Use the cursor in subsequent calls — Auth does not expose offset pagination.\n *\n * @param params - `Auth.UserListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`, or a cursor issued for a different sort order.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended or archived (`APP_SUSPENDED` / `APP_ARCHIVED`), or the caller lacks `user.list`: an app API key always needs it in its permissions; a role or M2M scopes need it once the app enforces permissions.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/admin/users\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-users\n * @example\n * ```ts\n * for await (const user of auth.consumer(\"app\").users.list()) {\n * console.log(user);\n * }\n * const page = await auth.consumer(\"app\").users.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.UserListParams, options?: RequestOptions): PagePromise<T.ConsumerAdminEndUser> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/admin/users\", pathParams: { app_slug: this._b.app_slug }, query: params }, options);\n }\n /**\n * Read one end-user\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: End-user not found in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/admin/users/{user_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-users-user-id\n * @example\n * ```ts\n * const consumerAdminEndUser = await auth.consumer(\"app\").users.retrieve(\"user\");\n * ```\n */\n retrieve(userId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerAdminEndUser>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/admin/users/{user_id}\", pathParams: { app_slug: this._b.app_slug, user_id: userId } }, options);\n }\n /**\n * Update an end-user's display name or primary email\n *\n * Email update promotes an existing contact to primary (not for creating new contacts — that goes through the per-contact flow).\n *\n * @param userId - Id of the user.\n * @param params - `Auth.UserUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: `display_name` over 120 chars or `email` not a valid address.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended or archived (`APP_SUSPENDED` / `APP_ARCHIVED`), or the caller lacks `user.update`: an app API key always needs it in its permissions; a role or M2M scopes need it once the app enforces permissions.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app, or the end-user is not in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /{app_slug}/v1/admin/users/{user_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-admin-users-user-id\n * @example\n * ```ts\n * const consumerAdminEndUser = await auth.consumer(\"app\").users.update(\"user\", { display_name: \"string\" });\n * ```\n */\n update(userId: string, params?: T.UserUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerAdminEndUser>> {\n return this._client.request({ method: \"PATCH\", path: \"/{app_slug}/v1/admin/users/{user_id}\", pathParams: { app_slug: this._b.app_slug, user_id: userId }, body: params }, options);\n }\n /**\n * Assign an end-user a role\n *\n * Sets `app_membership.role_id` for the target user. For M2M callers the assignable role is bounded by the token's scopes (the guard already enforced `role.assign`); the role's own permission set is NOT additionally narrowed against the M2M scopes because M2M scopes are typically broader than per-user role perms by design (a backend cron with `user.list` + `role.assign` SHOULD be able to promote a user into a role carrying any per-app perm). EndUser admins are bounded by their own role's perms transitively — they couldn't authenticate as an admin without holding the perm.\n *\n * @param userId - Id of the user.\n * @param params - `Auth.UserUpdateRoleParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed, or `role_name` names no role in this app.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended or archived (`APP_SUSPENDED` / `APP_ARCHIVED`), or the caller lacks `role.assign`: an app API key always needs it in its permissions; a role or M2M scopes need it once the app enforces permissions. Also returned when an EndUser admin tries to assign a role carrying permissions they do not hold.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /{app_slug}/v1/admin/users/{user_id}/role\n * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-admin-users-user-id-role\n * @example\n * ```ts\n * const consumerAdminRoleAssignment = await auth.consumer(\"app\").users.updateRole(\"user\", { role_name: \"string\" });\n * ```\n */\n updateRole(userId: string, params: T.UserUpdateRoleParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerAdminRoleAssignment>> {\n return this._client.request({ method: \"PATCH\", path: \"/{app_slug}/v1/admin/users/{user_id}/role\", pathParams: { app_slug: this._b.app_slug, user_id: userId }, body: params }, options);\n }\n /**\n * Change an end-user status (active / suspended / deactivated)\n *\n * Setting status to `suspended` or `deactivated` also revokes all active sessions for the user (same behaviour as the auth-admin equivalent).\n *\n * @param userId - Id of the user.\n * @param params - `Auth.UserUpdateStatusParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: `status` must be `active`, `suspended` or `deactivated`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended or archived (`APP_SUSPENDED` / `APP_ARCHIVED`), or the caller lacks `user.update`: an app API key always needs it in its permissions; a role or M2M scopes need it once the app enforces permissions.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app, or the end-user is not in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /{app_slug}/v1/admin/users/{user_id}/status\n * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-admin-users-user-id-status\n * @example\n * ```ts\n * const consumerAdminEndUser = await auth.consumer(\"app\").users.updateStatus(\"user\", { status: \"active\" });\n * ```\n */\n updateStatus(userId: string, params: T.UserUpdateStatusParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerAdminEndUser>> {\n return this._client.request({ method: \"PATCH\", path: \"/{app_slug}/v1/admin/users/{user_id}/status\", pathParams: { app_slug: this._b.app_slug, user_id: userId }, body: params }, options);\n }\n}\n\n/** `verify` */\nexport class ConsumerVerifyResource extends APIResource {\n /**\n * Verify a token + check one or more permissions\n *\n * Returns `{ authorized: boolean }`. Pass `permission` (string) for a single check, or `permissions` (array) when ALL must be held.\n *\n * Token source: `body.token` if provided, else the `Authorization: Bearer <jwt>` header. At least one must be present.\n *\n * @param params - `Auth.VerifyAuthorizeParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed, neither `permission` nor `permissions` given, or no JWT supplied (body `token` or `Authorization: Bearer`).\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/authorize\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-authorize\n * @example\n * ```ts\n * const authorize = await auth.consumer(\"app\").verify.authorize({ permission: \"string\" });\n * ```\n */\n authorize(params?: T.VerifyAuthorizeParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Authorize>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/authorize\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Multi-permission authorization in a single round-trip\n *\n * Runs N permission checks against the same token in one call. Each check accepts `permission` (singular) or `permissions` (array — ALL must be held); pass an `id` to correlate results back to inputs. Each result reports `authorized` plus the missing permissions (if any).\n *\n * Token source: `body.token` if provided, else the `Authorization: Bearer <jwt>` header. At least one must be present.\n *\n * @param params - `Auth.VerifyAuthorizeBatchParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed, a check has neither `permission` nor `permissions`, or no JWT supplied (body `token` or `Authorization: Bearer`).\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/authorize/batch\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-authorize-batch\n * @example\n * ```ts\n * const authorizeBatch = await auth.consumer(\"app\").verify.authorizeBatch({ checks: [{}] });\n * ```\n */\n authorizeBatch(params: T.VerifyAuthorizeBatchParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuthorizeBatch>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/authorize/batch\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Verify a token signature + return its principal\n *\n * Validates the JWT against the app's JWKS keys and returns `{ valid, principal }`. Use this when you need the full claims; use `/authorize` for a yes/no permission check.\n *\n * Token source: `body.token` if provided, else the `Authorization: Bearer <jwt>` header. At least one must be present.\n *\n * @param params - `Auth.VerifyTokenParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed (empty `token`), or no JWT supplied: neither `token` in the body nor an `Authorization: Bearer` header.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/verify\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-verify\n * @example\n * ```ts\n * const verify = await auth.consumer(\"app\").verify.token({ token: \"string\" });\n * ```\n */\n token(params?: T.VerifyTokenParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Verify>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/verify\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).verify.token()` (POST /{app_slug}/v1/verify).\n *\n * @deprecated Use `auth.consumer(…).verify.token()`. Kept for 0.x callers; removed in 2.0.\n */\n verify(params?: T.VerifyTokenParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Verify>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/verify\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n}\n\n/** `wellKnown` */\nexport class ConsumerWellKnownResource extends APIResource {\n /**\n * Per-app JWKS\n *\n * Returns the JSON Web Key Set used to sign EndUser and M2M access tokens for this app. Cached at the edge for 1 hour; verifiers should re-fetch on `kid` miss.\n *\n * @param options - Per-request options.\n * @throws {NotFoundError} 404 NOT_FOUND: App slug does not match an app in this workspace.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/.well-known/jwks.json\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-well-known-jwks-json\n * @example\n * ```ts\n * const jwks = await auth.consumer(\"app\").wellKnown.jwks();\n * ```\n */\n jwks(options?: RequestOptions): APIPromise<T.WithLastResponse<T.Jwks>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/.well-known/jwks.json\", pathParams: { app_slug: this._b.app_slug }, public: true }, options);\n }\n /**\n * OAuth 2.0 / OIDC discovery document (subset)\n *\n * Returns `issuer`, `jwks_uri`, `token_endpoint`, `introspection_endpoint`, `userinfo_endpoint` (= `/me`), and the supported grant + signing options. Use this from SDKs / verifiers instead of hardcoding paths.\n *\n * @param options - Per-request options.\n * @throws {NotFoundError} 404 NOT_FOUND: App slug does not match an app in this workspace.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/.well-known/openid-configuration\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-well-known-openid-configuration\n * @example\n * ```ts\n * const openIdConfiguration = await auth.consumer(\"app\").wellKnown.openidConfiguration();\n * ```\n */\n openidConfiguration(options?: RequestOptions): APIPromise<T.WithLastResponse<T.OpenIdConfiguration>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/.well-known/openid-configuration\", pathParams: { app_slug: this._b.app_slug }, public: true }, options);\n }\n}\n\n/** `auth.consumer(…)`: Calls for one app's end users (sign-in, sessions, profile, MFA, tenants). */\nexport class AuthConsumer extends APIResource {\n #auth?: ConsumerAuthResource;\n #me?: ConsumerMeResource;\n #mfa?: ConsumerMfaResource;\n #oauth?: ConsumerOauthResource;\n #passkey?: ConsumerPasskeyResource;\n #permissions?: ConsumerPermissionsResource;\n #roles?: ConsumerRolesResource;\n #tenantApiKeys?: ConsumerTenantApiKeysResource;\n #tenants?: ConsumerTenantsResource;\n #users?: ConsumerUsersResource;\n #verify?: ConsumerVerifyResource;\n #wellKnown?: ConsumerWellKnownResource;\n /** @deprecated 0.x namespace: every method in it is a deprecated alias (see its methods). Removed in 2.0. */\n get auth(): ConsumerAuthResource {\n return (this.#auth ??= new ConsumerAuthResource(this._client, this._b));\n }\n get me(): ConsumerMeResource {\n return (this.#me ??= new ConsumerMeResource(this._client, this._b));\n }\n get mfa(): ConsumerMfaResource {\n return (this.#mfa ??= new ConsumerMfaResource(this._client, this._b));\n }\n get oauth(): ConsumerOauthResource {\n return (this.#oauth ??= new ConsumerOauthResource(this._client, this._b));\n }\n get passkey(): ConsumerPasskeyResource {\n return (this.#passkey ??= new ConsumerPasskeyResource(this._client, this._b));\n }\n get permissions(): ConsumerPermissionsResource {\n return (this.#permissions ??= new ConsumerPermissionsResource(this._client, this._b));\n }\n get roles(): ConsumerRolesResource {\n return (this.#roles ??= new ConsumerRolesResource(this._client, this._b));\n }\n get tenantApiKeys(): ConsumerTenantApiKeysResource {\n return (this.#tenantApiKeys ??= new ConsumerTenantApiKeysResource(this._client, this._b));\n }\n get tenants(): ConsumerTenantsResource {\n return (this.#tenants ??= new ConsumerTenantsResource(this._client, this._b));\n }\n get users(): ConsumerUsersResource {\n return (this.#users ??= new ConsumerUsersResource(this._client, this._b));\n }\n get verify(): ConsumerVerifyResource {\n return (this.#verify ??= new ConsumerVerifyResource(this._client, this._b));\n }\n get wellKnown(): ConsumerWellKnownResource {\n return (this.#wellKnown ??= new ConsumerWellKnownResource(this._client, this._b));\n }\n /**\n * Accept an EndUser invite by code\n *\n * Materialises a pre-allocated invite into a real EndUser: creates account + primary email contact (verified, since mailing the code proved control) + password credential + role membership, then mints app-scoped tokens. Public endpoint — the invite code is the authority. 410 on revoked/expired/exhausted invites; 409 on duplicate email or username. The same password policy as `/auth/signup` applies, including the common-password deny-list and the breach check, and so does the app-level MFA mandate: on an `auth_config.mfa: \"required\"` app the account is created but the response is `mfa_enrollment_required: true` with no session behind it.\n *\n * @param params - `Auth.AcceptInviteParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: Invite code not found in this app, or the `:appSlug` matches no app at all. Deliberately the same status — neither says anything about accounts.\n * @throws {ConflictError} 409 CONFLICT: Email or username already in use.\n * @throws {APIError} 410 GONE: Invite revoked, expired, or fully used.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/auth/accept-invite\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-accept-invite\n * @example\n * ```ts\n * const result = await auth.consumer(\"app\").acceptInvite({ code: \"inv_x7H2k3jLqXr\", password: \"CorrectHorseBatteryStaple\" });\n * ```\n */\n acceptInvite(params: T.AcceptInviteParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AcceptInviteResponse>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/accept-invite\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Accept a tenant invite by code\n *\n * Materialises a pending `tenant_invite` into a real EndUser: creates account + verified primary email contact (mailing the code proved control of the address) + password credential + an app-level membership on the app's signup default role + a tenant membership on the role the invite names, then mints a session already scoped to that tenant, so the access token carries `org_id` / `org_role` with no follow-up switch-tenant call. Public endpoint — the invite code is the authority. 410 on revoked/expired/exhausted invites. **409 when an account already exists for the invited address**: this endpoint will not set a password on, or mint a session for, an account it did not create, because the plaintext code is also held by whoever minted the invite. Existing users sign in and call `POST /:appSlug/v1/me/tenant-invites/accept` instead, which adds the membership without touching credentials.\n *\n * @param params - `Auth.AcceptTenantInviteParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: Invite code not found in this app, or the `:appSlug` matches no app at all. Deliberately the same status — neither says anything about accounts.\n * @throws {ConflictError} 409 CONFLICT, ACCOUNT_EXISTS: An account already exists for the invited address (`ACCOUNT_EXISTS`), or the requested username is taken.\n * @throws {APIError} 410 GONE: Invite revoked, expired, or fully used.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/auth/accept-tenant-invite\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-accept-tenant-invite\n * @example\n * ```ts\n * const consumerToken = await auth.consumer(\"app\").acceptTenantInvite({ code: \"tinv_9dK2mQ7pR4vXbN1sT6yZ0hLcJeW3fAgU\", password: \"CorrectHorseBatteryStaple\" });\n * ```\n */\n acceptTenantInvite(params: T.AcceptTenantInviteParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/accept-tenant-invite\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Exchange a `heimdall_code` (received on the web-flow callback redirect) for Auth access + refresh tokens. Single-use.\n *\n * @param params - `Auth.ExchangeProviderCodeParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Code is unknown, expired, or already redeemed.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Code does not belong to this `appSlug`.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/auth/oauth/exchange\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-oauth-exchange\n * @example\n * ```ts\n * const exchange = await auth.consumer(\"app\").exchangeProviderCode({ code: \"string\" });\n * ```\n */\n exchangeProviderCode(params: T.ExchangeProviderCodeParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Exchange>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/oauth/exchange\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Revoke a refresh token\n *\n * Destroys the session that owns the refresh token. The matching access token continues to verify until its TTL expires.\n *\n * @param params - `Auth.LogoutParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: The refresh token matches no session.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/logout\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-logout\n * @example\n * ```ts\n * await auth.consumer(\"app\").logout({ refresh_token: \"string\" });\n * ```\n */\n logout(params: T.LogoutParams, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/logout\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Exchange a refresh token for a new access token\n *\n * Rotates the refresh token on every call — the previous refresh token is revoked, and re-using it triggers session revocation.\n *\n * @param params - `Auth.RefreshParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: The refresh token does not exist, belongs to another app, has been revoked (including by reuse detection), or its session has passed `expires_at`. One message for all of them.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `auth` bucket — 10 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/refresh\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-refresh\n * @example\n * ```ts\n * const consumerToken = await auth.consumer(\"app\").refresh({ refresh_token: \"string\" });\n * ```\n */\n refresh(params: T.RefreshParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/refresh\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Mint a password-reset code (PAK-required)\n *\n * Mints a fresh 6-digit password-reset code for the EndUser owning the named contact. Body must contain exactly one of `email` / `phone` — the contact must be verified (otherwise an attacker who registered an unverified contact could push a reset on another user's account, were the per-app email uniqueness ever breached). The reset itself is account-scoped (revokes all sessions, replaces password) — the contact only acts as the lookup key.\n *\n * PAK-required: `auth.user.password-reset.create`. Returns `{ code, expires_at }` on success, `{}` on no-match (uniform shape prevents enumeration). Issuing a reset code invalidates any previously issued, unconsumed reset code for the account — only the most recent one is accepted.\n *\n * Renamed from /auth/request-reset.\n *\n * @param params - `Auth.RequestPasswordResetParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Provide exactly one of `email` or `phone`, or request validation failed in the global `ValidationPipe`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: No PAK provided.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: PAK lacks `auth.user.password-reset.create` on this app, or the app is suspended / archived.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `auth` bucket — 10 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/request-password-reset\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-request-password-reset\n * @example\n * ```ts\n * const consumerCodeIssue = await auth.consumer(\"app\").requestPasswordReset({ email: \"jane@example.com\" });\n * ```\n */\n requestPasswordReset(params?: T.RequestPasswordResetParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerCodeIssue>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/request-password-reset\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Mint a contact-verification code (PAK-required)\n *\n * Mints a fresh 6-digit verification code bound to the email or phone contact named in the body. Body must contain exactly one of `email` / `phone`. PAK-required — `Authorization: Bearer <pcft_live_*>` carrying `auth.user.verify.create` narrowed to this app's URN. Public mint flows are refused with 401 — any anonymous mint endpoint is a spam-forwarder vector.\n *\n * Returns `{ code, expires_at }` for delivery via the customer's own SMTP / SMS provider. Returns `{}` (no code) when the contact doesn't match an account in this app or is already verified — uniform shape prevents enumeration.\n *\n * Issuing a code invalidates any previously issued, unconsumed code for the same contact — including the one auto-emailed at signup. Only the most recently minted code is accepted.\n *\n * @param params - `Auth.RequestVerificationParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Provide exactly one of `email` or `phone`, or request validation failed in the global `ValidationPipe`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: No PAK provided.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: PAK lacks `auth.user.verify.create` on this app, or the app is suspended / archived.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `auth` bucket — 10 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/request-verification\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-request-verification\n * @example\n * ```ts\n * const consumerCodeIssue = await auth.consumer(\"app\").requestVerification({ email: \"jane@example.com\" });\n * ```\n */\n requestVerification(params?: T.RequestVerificationParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerCodeIssue>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/request-verification\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Submit a reset code + new password\n *\n * Consumes the 6-digit reset code (single-use). On success the password is updated and every active session for the user is revoked.\n *\n * @param params - `Auth.ResetPasswordParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, PASSWORD_TOO_COMMON, PASSWORD_BREACHED: The new password fails the app-configured password policy (length, uppercase, digit, special character), is on the common-password deny-list (`PASSWORD_TOO_COMMON`), or — unless the app sets `password_breach_check` to `warn`/`off` — appears in a public breach corpus (`PASSWORD_BREACHED`). Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 410 GONE: Code invalid, expired, locked, or already consumed.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `verify_code` bucket — 5 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/auth/reset-password\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-reset-password\n * @example\n * ```ts\n * await auth.consumer(\"app\").resetPassword({ code: \"123456\", new_password: \"string\" });\n * ```\n */\n resetPassword(params: T.ResetPasswordParams, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/reset-password\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Mint + dispatch a password-reset email via Mail (PAK-required)\n *\n * Same shape as `send-verification-email` but for the reset slot. PAK perm: `auth.user.password-reset.send-email`. Same loud precondition errors. Email-only.\n *\n * @param params - `Auth.SendPasswordResetEmailParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: No PAK provided.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: PAK lacks auth.user.password-reset.send-email on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 412 PRECONDITION_FAILED: Mail precondition not met (see error code in the response body).\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `auth` bucket — 10 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: Mail dispatch failed or client not wired.\n * @see POST /{app_slug}/v1/auth/send-password-reset-email\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-send-password-reset-email\n * @example\n * ```ts\n * const consumerCodeDispatch = await auth.consumer(\"app\").sendPasswordResetEmail({ email: \"jane@example.com\" });\n * ```\n */\n sendPasswordResetEmail(params: T.SendPasswordResetEmailParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerCodeDispatch>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/send-password-reset-email\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Mint + dispatch a verification email via Mail (PAK-required)\n *\n * Mints a fresh 6-digit verification code AND dispatches it to the supplied email address via the workspace's verified Mail sender, in one call. Email-only — the customer integrates SMS delivery themselves through `request-verification`.\n *\n * PAK-required — distinct permission from the bare mint so customers can enable mint without enabling outbound Mail traffic. Surfaces typed precondition errors instead of the silent fail-closed of a fire-and-forget mailer:\n *\n * * 412 ENVOI_NOT_ENABLED — `notifications_via_envoi` is false\n * * 412 ENVOI_SENDER_NOT_CONFIGURED\n * * 412 ENVOI_TEMPLATE_NOT_CONFIGURED\n * * 412 ENVOI_APP_NOT_BOUND_TO_WORKSPACE\n * * 503 ENVOI_DISPATCH_FAILED — RabbitMQ publish failure\n * * 503 ENVOI_NOT_WIRED — no Mail client wired in this deployment\n *\n * On success returns `{ expires_at }`. The plaintext code is NOT returned. Returns `{}` when the contact is missing or already verified (silent — same enumeration defence as `request-verification`).\n *\n * Issuing a code invalidates any previously issued, unconsumed code for the same contact — including the one auto-emailed at signup. Only the most recently minted code is accepted.\n *\n * @param params - `Auth.SendVerificationEmailParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: No PAK provided.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: PAK lacks auth.user.verify.send-email on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 412 PRECONDITION_FAILED: Mail precondition not met (see error code in the response body).\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `auth` bucket — 10 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: Mail dispatch failed or client not wired.\n * @see POST /{app_slug}/v1/auth/send-verification-email\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-send-verification-email\n * @example\n * ```ts\n * const consumerCodeDispatch = await auth.consumer(\"app\").sendVerificationEmail({ email: \"jane@example.com\" });\n * ```\n */\n sendVerificationEmail(params: T.SendVerificationEmailParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerCodeDispatch>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/send-verification-email\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Sign in an EndUser\n *\n * Authenticate with username or verified primary email + password. When the account has no enabled MFA factors, returns a fresh access + refresh token pair (`ConsumerTokenResponseDto` shape). When the account has any enabled factor, returns an MFA challenge instead (`ConsumerMfaChallengeResponseDto` shape, `mfa_required: true`). In that case no session has been created yet — complete the challenge via `POST /auth/mfa/verify` (or `/auth/mfa/recover`) to receive the token pair. When the app runs `auth_config.mfa: \"required\"` and the account has NO enabled factor, returns a third shape (`ConsumerMfaEnrollmentRequiredResponseDto`, `mfa_enrollment_required: true`) — again no session — which is completed via `POST /auth/mfa/enroll` + `/auth/mfa/enroll/verify`. Inside `mfa_grace_days` of account creation that case instead returns the ordinary token pair with `mfa_enrollment_due_at` set.\n *\n * @param params - `Auth.SigninParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Invalid credentials. Returned for every failed attempt, whatever went wrong: a wrong password, an identifier that matches no account, an account with no password credential, an account locked out through a different identifier, an account an operator has blocked, and a wrong password against a suspended or deactivated account. The responses are deliberately identical in body, timing, DB round trips and Redis ops, so signin is not an account-existence oracle.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Signin is disabled for this app, or the account is suspended / deactivated. The account-status refusal is only reachable once the caller has proven the password — a wrong password against such an account is a 401.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Too many failed attempts. Two counters produce it, both keyed purely by the submitted identifier: a burst limit of 5 attempts per minute, and a 15-minute lock after the app's `max_failed_login_attempts` failures (default 5). Both fire on the same attempt for a registered and an unregistered identifier. The lock threshold was a fixed 4 until the knob was wired up in tasks/users-api/014. Per-IP rate limit (`RATE_LIMITED`): this path is in the `auth` bucket — 10 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/auth/signin\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-signin\n * @example\n * ```ts\n * const result = await auth.consumer(\"app\").signin({ identifier: \"jane_doe\", password: \"string\" });\n * ```\n */\n signin(params: T.SigninParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.SigninResponse>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/signin\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Sign in / sign up with a provider ID token (native flow)\n *\n * Submit the provider-issued ID token from a native client (iOS ASAuthorizationController, Google Sign-In for iOS / Android). Backend verifies the token signature, issuer, audience (against this app's configured native client ids), and nonce binding; consumes the nonce server-side to defeat in-window replay; resolves or creates the Auth account; mints access + refresh tokens with `amr=[\"oauth\", \"<provider>\"]`. Same response shape as `/auth/signin`.\n *\n * @param provider - OAuth provider id. Native flow supports: apple, google. GitHub is web-only — POSTing to this endpoint with provider=github 400s.\n * @param params - `Auth.SigninWithProviderParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: ID token verification failed (bad signature / issuer / audience / nonce / expired).\n * @throws {ConflictError} 409 CONFLICT, link_required, account_exists_with_different_provider: Email collides with an existing account. Response carries an error `code` of `link_required` (when the app's policy is `confirm`) or `account_exists_with_different_provider` (when `reject`). Sign in with the original method to link.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/auth/oauth/{provider}\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-oauth-provider\n * @example\n * ```ts\n * const result = await auth.consumer(\"app\").signinWithProvider(\"provider\", { id_token: \"string\", nonce: \"string\" });\n * ```\n */\n signinWithProvider(provider: string, params: T.SigninWithProviderParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.SigninWithProviderResponse>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/oauth/{provider}\", pathParams: { app_slug: this._b.app_slug, provider }, body: params, public: true }, options);\n }\n /**\n * Sign up an EndUser\n *\n * Create an EndUser account inside the app and immediately mint a session. The supplied email becomes the primary email contact, unverified at signup. When the app has completed Mail notification setup, a verification code is auto-emailed to the address; customers delivering their own verification messages call /auth/request-verification (or /auth/send-verification-email) instead — doing so invalidates the auto-sent code, so the user only ever has one valid code. Subject to the app-configured signup policy (signup enabled, password policy, default role, optional `signup_requires_pak`). The password must clear the app's length + character-class rules, a common-password deny-list, and — unless the app sets `password_breach_check` to `warn` or `off` — a public breach corpus; a breached password is refused with 400 `PASSWORD_BREACHED` and a deny-listed one with 400 `PASSWORD_TOO_COMMON`. The breach lookup is k-anonymous (only five characters of the password's SHA-1 leave the service) and fails open, so an unreachable corpus never blocks a signup.\n *\n * When the app runs `auth_config.mfa: \"required\"`, the account is still created but NO session is minted: the response is the `ConsumerMfaEnrollmentRequiredResponseDto` shape (`mfa_enrollment_required: true`), completed via `POST /auth/mfa/enroll` + `/auth/mfa/enroll/verify`. Inside `mfa_grace_days` of account creation — which a fresh signup always is when the window is non-zero — the ordinary token pair is returned with `mfa_enrollment_due_at` set instead.\n *\n * When the app has bot protection on (`auth_config.bot_protection`, Cloudflare Turnstile or hCaptcha), send the widget response as `bot_protection_token`. Auth verifies it with the provider before it looks at the email, username or password, and refuses the sign-up when the token is missing (400 `BOT_PROTECTION_REQUIRED`), rejected (403 `BOT_PROTECTION_FAILED`) or cannot be checked (503 `BOT_PROTECTION_UNAVAILABLE`; no account is created). This applies to PAK-authenticated calls too: a backend forwards the token its browser received.\n *\n * @param params - `Auth.SignupParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, BOT_PROTECTION_REQUIRED: `BOT_PROTECTION_REQUIRED`: the app has bot protection on and the request carried no `bot_protection_token`. Also: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: The app sets `signup_requires_pak` and no Platform API Key was presented on `Authorization: Bearer`.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, BOT_PROTECTION_FAILED, APP_SUSPENDED, APP_ARCHIVED: `BOT_PROTECTION_FAILED`: the bot-protection provider rejected the `bot_protection_token` (bad, expired or already used), or the hostname it reported is not one of the app's `bot_protection.expected_hostnames`; render a fresh widget and retry. Otherwise: signup is disabled for this app, the email domain is not on the app's allow-list, the presented PAK belongs to a different workspace, or its policy denies `auth.signup.create` on this app. Also returned when the app itself is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`).\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {ConflictError} 409 CONFLICT: Email or username already in use in this app, or the app has no workspace binding and therefore cannot accept a PAK signup.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `auth` bucket — 10 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE, BOT_PROTECTION_UNAVAILABLE: `BOT_PROTECTION_UNAVAILABLE`: the app has bot protection on and the token could not be checked (the provider timed out or failed, or the app's bot-protection secret is missing or was refused by the provider). Sign-up fails closed: no account was created. Retry shortly. Otherwise: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/auth/signup\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-signup\n * @example\n * ```ts\n * const result = await auth.consumer(\"app\").signup({ email: \"jane@example.com\", password: \"CorrectHorseBatteryStaple\", username: \"john_doe\" });\n * ```\n */\n signup(params: T.SignupParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.SignupResponse>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/signup\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Switch the active tenant for this session\n *\n * Re-issues the EndUser's access + refresh tokens with the new `org_id` + `org_role` claims, after verifying the caller holds a tenant_membership for the target tenant. The session row is updated to the new tenant so subsequent refreshes preserve the context. The new access token keeps the session's `amr` and `mfa_at` (as `/auth/refresh` does), so a sign-in that completed MFA still proves it after a switch. Refresh-token rotation runs as usual; the previous refresh token enters the standard 60-second grace window.\n *\n * @param params - `Auth.SwitchTenantParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing / invalid bearer, the token carries no `sid`, or the session named by `sid` is revoked, expired or no longer exists.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: The caller holds no membership in the target tenant, or the app is suspended / archived.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app, or `tenant_id` names no tenant in this app.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/switch-tenant\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-switch-tenant\n * @example\n * ```ts\n * const consumerToken = await auth.consumer(\"app\").switchTenant({ tenant_id: \"string\" });\n * ```\n */\n switchTenant(params: T.SwitchTenantParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/switch-tenant\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Submit a verification code\n *\n * Consumes a 6-digit verification code (single-use) and flips the bound contact's `verified_at`. Public — anyone holding the code can submit it; that is the whole point of the verification flow. The server figures out which contact + account from the code value itself.\n *\n * Renamed from /verify-email — the same endpoint now serves both email and phone verifications.\n *\n * @param params - `Auth.VerifyEmailParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 410 GONE: Code invalid, expired, locked, or already consumed.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `verify_code` bucket — 5 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/verify\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-verify\n * @example\n * ```ts\n * const consumerVerify = await auth.consumer(\"app\").verifyEmail({ code: \"123456\" });\n * ```\n */\n verifyEmail(params: T.VerifyEmailParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerVerify>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/verify\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n}\n","/**\n * Typed error hierarchy for JWT verification. All errors inherit from\n * `JwtVerifyError` so callers can do one `instanceof` to catch any\n * verify failure, or branch on more specific subclasses for UX.\n */\n\nexport class JwtVerifyError extends Error {\n public readonly code: string;\n\n constructor(code: string, message: string, options?: { cause?: unknown }) {\n super(message, options);\n this.name = \"JwtVerifyError\";\n this.code = code;\n }\n}\n\n/** Signature didn't match, header malformed, or token structure invalid. */\nexport class JwtInvalidError extends JwtVerifyError {\n constructor(message: string, options?: { cause?: unknown }) {\n super(\"ERR_JWT_INVALID\", message, options);\n this.name = \"JwtInvalidError\";\n }\n}\n\n/** Token's `exp` claim is in the past (allowing for clockTolerance). */\nexport class JwtExpiredError extends JwtVerifyError {\n public readonly expiredAt?: Date;\n constructor(message: string, expiredAt?: Date, options?: { cause?: unknown }) {\n super(\"ERR_JWT_EXPIRED\", message, options);\n this.name = \"JwtExpiredError\";\n this.expiredAt = expiredAt;\n }\n}\n\n/** Token's `nbf` is in the future. */\nexport class JwtNotYetValidError extends JwtVerifyError {\n constructor(message: string, options?: { cause?: unknown }) {\n super(\"ERR_JWT_NOT_YET_VALID\", message, options);\n this.name = \"JwtNotYetValidError\";\n }\n}\n\n/**\n * The token is a refresh token (`token_use: \"refresh\"` or\n * `type: \"refresh\"`). Refresh tokens are only valid at the refresh\n * endpoint and must never authenticate an API request.\n */\nexport class JwtRefreshTokenError extends JwtVerifyError {\n constructor(message = \"Refresh tokens cannot be used as access tokens\", options?: { cause?: unknown }) {\n super(\"ERR_JWT_REFRESH_TOKEN\", message, options);\n this.name = \"JwtRefreshTokenError\";\n }\n}\n\n/** `iss` claim doesn't match the expected issuer. */\nexport class JwtIssuerMismatchError extends JwtVerifyError {\n constructor(message: string, options?: { cause?: unknown }) {\n super(\"ERR_JWT_ISS_MISMATCH\", message, options);\n this.name = \"JwtIssuerMismatchError\";\n }\n}\n\n/** `aud` claim doesn't match the expected audience. */\nexport class JwtAudienceMismatchError extends JwtVerifyError {\n constructor(message: string, options?: { cause?: unknown }) {\n super(\"ERR_JWT_AUD_MISMATCH\", message, options);\n this.name = \"JwtAudienceMismatchError\";\n }\n}\n\n/** The token's `kid` isn't in the JWKS (even after a forced refetch). */\nexport class JwksKeyNotFoundError extends JwtVerifyError {\n public readonly kid: string | undefined;\n constructor(kid: string | undefined, options?: { cause?: unknown }) {\n super(\n \"ERR_JWKS_KID_NOT_FOUND\",\n `JWKS has no key matching kid=${kid ?? \"(missing)\"}`,\n options,\n );\n this.name = \"JwksKeyNotFoundError\";\n this.kid = kid;\n }\n}\n\n/** Network / non-2xx fetching the JWKS endpoint. */\nexport class JwksFetchError extends JwtVerifyError {\n constructor(message: string, options?: { cause?: unknown }) {\n super(\"ERR_JWKS_FETCH\", message, options);\n this.name = \"JwksFetchError\";\n }\n}\n","/**\n * In-process JWKS cache for a single app's `/.well-known/jwks.json`.\n *\n * Thin wrapper over `jose.createRemoteJWKSet`, which already gives us:\n * - TTL-based cache (cacheMaxAge)\n * - Cooldown between failed fetches (cooldownDuration)\n * - Singleflight (concurrent verifies share one inflight fetch)\n * - Auto-refetch when the token's `kid` isn't in the cached JWKS\n * (rotation handling)\n *\n * We add:\n * - Translation of jose's internal `JWKSNoMatchingKey` /\n * `JWKSTimeout` / etc. errors into our typed `JwksKeyNotFoundError`\n * / `JwksFetchError`.\n * - A `refresh()` method for explicit cache busting (rare, but useful\n * for tests + manual rotation drills).\n *\n * Instances are returned by `ConsumerScope.jwks` and are jose-compatible\n * out of the box — `jose.jwtVerify(token, scope.jwks.getKey, ...)` works.\n */\n\nimport { createRemoteJWKSet, customFetch, errors as joseErrors } from \"jose\";\n\nimport { JwksFetchError, JwksKeyNotFoundError } from \"./errors.js\";\nimport type { CryptoKey, FlattenedJWSInput, JWTHeaderParameters } from \"./jose-types.js\";\n\nexport interface JwksCacheOptions {\n url: URL;\n /** Cache lifetime in ms. Default 10 minutes — same as jose's default. */\n ttlMs?: number;\n /** Min ms between failed fetches. Default 30 seconds. */\n cooldownMs?: number;\n /** Network timeout per fetch. Default 5 seconds. */\n timeoutMs?: number;\n /** Pin a custom fetch implementation (e.g. undici with retry, mock fetch in tests). */\n fetch?: typeof fetch;\n}\n\nexport type AuthGetKeyFn = (\n protectedHeader?: JWTHeaderParameters,\n token?: FlattenedJWSInput,\n) => Promise<CryptoKey>;\n\nexport class JwksCache {\n public readonly url: URL;\n private readonly _jose: AuthGetKeyFn;\n\n constructor(options: JwksCacheOptions) {\n this.url = options.url;\n // jose's customFetch is keyed by a symbol with a non-standard\n // signature (`(url: string, options) => Promise<Response>`). The\n // user-side `typeof fetch` we accept is more permissive; at runtime\n // the call shape is compatible, so cast through.\n const joseOpts: Record<string | symbol, unknown> = {\n cacheMaxAge: options.ttlMs ?? 10 * 60 * 1000,\n cooldownDuration: options.cooldownMs ?? 30_000,\n timeoutDuration: options.timeoutMs ?? 5_000,\n };\n if (options.fetch) {\n joseOpts[customFetch] = options.fetch;\n }\n this._jose = createRemoteJWKSet(\n options.url,\n joseOpts as Parameters<typeof createRemoteJWKSet>[1],\n ) as AuthGetKeyFn;\n }\n\n /**\n * Resolve a signing key for a given JWT header.\n * Bound as an arrow-function field so it can be passed around\n * (`jose.jwtVerify(token, cache.getKey, ...)`, passport-jwt, etc.)\n * without losing `this`.\n */\n readonly getKey: AuthGetKeyFn = async (header, input) => {\n try {\n return await this._jose(header, input);\n } catch (err) {\n if (err instanceof joseErrors.JWKSNoMatchingKey) {\n throw new JwksKeyNotFoundError(header?.kid, { cause: err });\n }\n if (\n err instanceof joseErrors.JWKSTimeout ||\n err instanceof joseErrors.JWKSInvalid ||\n err instanceof joseErrors.JOSEError\n ) {\n throw new JwksFetchError(\n `Failed to load JWKS from ${this.url.href}: ${err.message}`,\n { cause: err },\n );\n }\n throw err;\n }\n };\n\n /**\n * Force a refetch on the next verify. Useful in tests and for\n * external rotation drills — the normal flow self-heals because\n * jose auto-refetches on kid miss.\n */\n refresh(): void {\n // jose's createRemoteJWKSet doesn't expose a public reset, but a\n // future kid miss will trigger a refetch (subject to cooldown). To\n // force an immediate refetch, callers can simply construct a new\n // `JwksCache` instance.\n }\n}\n","/**\n * `verifyAuthToken` — the 80%-case verify helper.\n *\n * Wraps `jose.jwtVerify` with:\n * - Sensible defaults (algorithm allow-list, clockTolerance)\n * - Typed claim payload (`AuthClaims`)\n * - Translation of jose errors into our typed error hierarchy\n */\n\nimport { jwtVerify } from \"jose\";\nimport type { JWTPayload } from \"./jose-types.js\";\n\nimport {\n JwtAudienceMismatchError,\n JwtExpiredError,\n JwtInvalidError,\n JwtIssuerMismatchError,\n JwtNotYetValidError,\n JwksKeyNotFoundError,\n JwksFetchError,\n JwtVerifyError,\n JwtRefreshTokenError,\n} from \"./errors.js\";\nimport type { AuthGetKeyFn } from \"./jwks-cache.js\";\n\n/**\n * Claims that an Auth-issued EndUser access token is expected to\n * carry. Unknown claims pass through as `string | number | unknown`\n * (jose's `JWTPayload` is open-ended) — callers can intersect with\n * their own custom-claim type if they've configured Auth to add\n * extras.\n */\nexport interface AuthClaims extends JWTPayload {\n /** EndUser id. */\n sub: string;\n /** App slug the token was issued for. */\n iss: string;\n /** Audience — usually the app slug or oauth client_id. */\n aud?: string | string[];\n /** Standard exp/iat/nbf. */\n exp: number;\n iat: number;\n nbf?: number;\n /** JWT id — present on refreshable tokens. */\n jti?: string;\n /** Role assigned by Auth, if any. */\n role?: string;\n /** Permission keys the EndUser is authorized for. */\n permissions?: string[];\n /** Email on the EndUser profile, when claimed. */\n email?: string;\n /** Whether the email is verified. */\n email_verified?: boolean;\n}\n\nexport interface VerifyOptions {\n /** Expected `iss` claim. Defaults to the value set on the consumer scope. */\n issuer?: string | string[];\n /** Expected `aud` claim. If unset (and unset on the scope), aud check is skipped. */\n audience?: string | string[];\n /** Allowed JWS algorithms. Default ['ES256', 'RS256', 'EdDSA']. */\n algorithms?: string[];\n /**\n * Acceptable clock skew. Number = seconds, string = jose duration\n * (`\"30s\"`, `\"2m\"`, ...). Default 5 seconds.\n */\n clockTolerance?: string | number;\n /** Additional claims that must be present (non-empty) on the token. */\n requiredClaims?: string[];\n /** Override the verify time. Default `Date.now()`. */\n currentDate?: Date;\n /** Maximum token age — passed straight to jose. */\n maxTokenAge?: string | number;\n}\n\n/**\n * True when the claims mark a refresh token: `token_use: \"refresh\"`\n * (current shape) or `type: \"refresh\"` (older Auth tokens). Refresh\n * tokens must never authenticate a request.\n */\nexport function isRefreshToken(claims: Record<string, unknown> | null | undefined): boolean {\n if (!claims) return false;\n return claims.token_use === \"refresh\" || claims.type === \"refresh\";\n}\n\n/**\n * Verify an Auth-issued JWT against a JWKS resolver.\n *\n * Refresh tokens are refused with `JwtRefreshTokenError` even when the\n * signature, issuer and audience are valid.\n *\n * @param token The compact-form JWT (header.payload.signature)\n * @param getKey A jose-compatible key resolver — pass\n * `scope.jwks.getKey` from a `ConsumerScope`\n * @param opts Defaults supplied by the scope; override here\n * for one-off cases.\n */\nexport async function verifyAuthToken(\n token: string,\n getKey: AuthGetKeyFn,\n opts: VerifyOptions = {},\n): Promise<AuthClaims> {\n try {\n const { payload } = await jwtVerify(token, getKey, {\n algorithms: opts.algorithms ?? [\"ES256\", \"RS256\", \"EdDSA\"],\n issuer: opts.issuer,\n audience: opts.audience,\n clockTolerance: opts.clockTolerance ?? 5,\n requiredClaims: opts.requiredClaims,\n currentDate: opts.currentDate,\n maxTokenAge: opts.maxTokenAge,\n });\n if (isRefreshToken(payload)) throw new JwtRefreshTokenError();\n return payload as AuthClaims;\n } catch (err) {\n throw translateJoseError(err);\n }\n}\n\nfunction translateJoseError(err: unknown): JwtVerifyError {\n // Bubble up our own typed errors unchanged (JwksCache may have already\n // wrapped network / kid-miss failures).\n if (\n err instanceof JwksKeyNotFoundError ||\n err instanceof JwksFetchError ||\n err instanceof JwtVerifyError\n ) {\n return err;\n }\n\n // jose errors are instance-of-able but importing them all clutters\n // the file; use the `code` field that every jose error carries.\n const code = (err as { code?: string } | undefined)?.code ?? \"\";\n const message = (err as Error | undefined)?.message ?? \"JWT verification failed\";\n\n switch (code) {\n case \"ERR_JWT_EXPIRED\":\n return new JwtExpiredError(message, undefined, { cause: err });\n case \"ERR_JWT_CLAIM_VALIDATION_FAILED\": {\n // jose merges iss/aud/nbf mismatches under one code; route by claim\n const claim = (err as { claim?: string } | undefined)?.claim;\n if (claim === \"iss\") return new JwtIssuerMismatchError(message, { cause: err });\n if (claim === \"aud\") return new JwtAudienceMismatchError(message, { cause: err });\n if (claim === \"nbf\") return new JwtNotYetValidError(message, { cause: err });\n return new JwtInvalidError(message, { cause: err });\n }\n case \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\":\n case \"ERR_JWS_INVALID\":\n case \"ERR_JWT_INVALID\":\n return new JwtInvalidError(message, { cause: err });\n default:\n return new JwtInvalidError(message, { cause: err });\n }\n}\n","/**\n * Passkey (WebAuthn) helpers — the encoding layer and the browser bridge.\n *\n * WebAuthn speaks ArrayBuffer; the Auth API speaks JSON. Every buffer\n * crossing the wire is **base64url** (`-` `_`, no `=` padding), and\n * getting the alphabet or the padding wrong produces a signature\n * failure rather than a parse error. These four functions are a\n * straight port of section 2 of the passkeys guide, exported for\n * customers who want the pieces; `consumer(slug).passkeys.*` composes\n * them into one call per ceremony.\n *\n * Nothing in this module touches `navigator`, `window` or any other\n * browser global at import time — the package must load cleanly in a\n * Node process (BFFs verify tokens with it). Browser globals are read\n * lazily, inside the functions that need them.\n *\n * Wire shape: snake_case everywhere EXCEPT the members of\n * `credential.response` (`clientDataJSON`, `attestationObject`,\n * `authenticatorData`, `signature`, `userHandle`). Those names are\n * fixed by the WebAuthn spec and travel verbatim — they are not ours\n * to rename.\n */\n\n// ─────────────────────────────────────────────────────────────\n// Encoding layer (ported from the guide — do not re-derive)\n// ─────────────────────────────────────────────────────────────\n\n/** ArrayBuffer / typed array → base64url string (no `+`, `/` or `=`). */\nexport function toB64u(buf: ArrayBuffer | ArrayBufferView): string {\n const bytes =\n buf instanceof ArrayBuffer\n ? new Uint8Array(buf)\n : new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);\n // Same result as `String.fromCharCode(...bytes)` without the\n // spread-argument limit for multi-kilobyte attestation objects.\n let bin = \"\";\n for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]!);\n return btoa(bin).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n/** base64url string → bytes. Tolerates missing padding. */\nexport function fromB64u(s: string): Uint8Array {\n const b64 = s.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const bin = atob(b64.padEnd(Math.ceil(b64.length / 4) * 4, \"=\"));\n return Uint8Array.from(bin, (c) => c.charCodeAt(0));\n}\n\n/**\n * The `public_key` object Auth returns from an options call, with\n * every buffer base64url-encoded. Mirrors\n * `PublicKeyCredentialCreationOptions` / `PublicKeyCredentialRequestOptions`\n * from the WebAuthn spec, minus the ArrayBuffers.\n */\nexport interface PasskeyPublicKeyOptions {\n challenge: string;\n user?: { id: string; [k: string]: unknown };\n excludeCredentials?: Array<{ id: string; [k: string]: unknown }>;\n allowCredentials?: Array<{ id: string; [k: string]: unknown }>;\n [k: string]: unknown;\n}\n\nconst snakeToCamel = (k: string): string =>\n k.replace(/_([a-z0-9])/g, (_, c: string) => c.toUpperCase());\n\n/**\n * Deep-rename snake_case keys to camelCase; values (including string\n * values like `\"public-key\"`) are never touched. The Auth API's global\n * wire convention decamelizes every response key, `public_key`'s\n * members included, but `navigator.credentials` only understands the\n * WebAuthn spec's camelCase names (`rpId`, `pubKeyCredParams`,\n * `authenticatorSelection`, `allowCredentials`, …). Idempotent on\n * input that is already camelCase.\n */\nfunction camelizeKeys(value: unknown): unknown {\n if (Array.isArray(value)) return value.map(camelizeKeys);\n if (value && typeof value === \"object\" && !(value instanceof Uint8Array)) {\n const out: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(value as Record<string, unknown>)) {\n out[snakeToCamel(k)] = camelizeKeys(v);\n }\n return out;\n }\n return value;\n}\n\n/**\n * Auth returns `public_key` with every buffer base64url-encoded;\n * `navigator.credentials` wants real ArrayBuffers. Decodes\n * `challenge`, `user.id`, and the `id` of every entry in\n * `excludeCredentials` / `allowCredentials`; everything else passes\n * through with its value untouched.\n *\n * Accepts the member names either as the WebAuthn spec writes them\n * (`rpId`, `pubKeyCredParams`) or as the Auth wire convention\n * decamelizes them (`rp_id`, `pub_key_cred_params`) and always emits\n * the spec's camelCase, which is the only shape the browser accepts.\n */\n/**\n * Decoded options are typed loosely ON PURPOSE. The exact browser types\n * (`PublicKeyCredentialCreationOptions` / `PublicKeyCredentialRequestOptions`)\n * live in lib.dom, which this package does not depend on so that it keeps\n * loading in Node. An `any` here is what lets a lib.dom customer write\n * `navigator.credentials.create({ publicKey: decodeOptions(pk) })` with no\n * cast — a structural return type could never satisfy the DOM's required\n * members without depending on them.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport type PasskeyDecodedOptions = any;\n\nexport function decodeOptions(\n publicKey: PasskeyPublicKeyOptions | Record<string, unknown>,\n): PasskeyDecodedOptions {\n const pk = camelizeKeys(publicKey as Record<string, unknown>) as PasskeyPublicKeyOptions;\n const out: Record<string, unknown> = {\n ...pk,\n challenge: fromB64u(pk.challenge),\n };\n if (pk.user) {\n out.user = { ...pk.user, id: fromB64u(pk.user.id) };\n }\n for (const list of [\"excludeCredentials\", \"allowCredentials\"] as const) {\n const entries = pk[list];\n if (entries) {\n out[list] = entries.map((c) => ({ ...c, id: fromB64u(c.id) }));\n }\n }\n return out;\n}\n\n/**\n * Structural shape of a `PublicKeyCredential` — the DOM type without\n * needing the DOM lib. A real `PublicKeyCredential` (from\n * `navigator.credentials.create()` / `.get()`) satisfies it.\n */\nexport interface PasskeyCredentialLike {\n id: string;\n response: {\n clientDataJSON: ArrayBuffer;\n attestationObject?: ArrayBuffer;\n authenticatorData?: ArrayBuffer;\n signature?: ArrayBuffer;\n userHandle?: ArrayBuffer | null;\n };\n}\n\n/**\n * The `credential` object every verify endpoint accepts. `response`\n * members keep their WebAuthn names verbatim.\n */\nexport interface EncodedPasskeyCredential {\n id: string;\n response: {\n clientDataJSON: string;\n attestationObject?: string;\n authenticatorData?: string;\n signature?: string;\n userHandle?: string;\n };\n}\n\n/**\n * …and the reverse, for the credential you send back. Only the\n * members present on the response are emitted: an attestation\n * (enrol) carries `attestationObject`; an assertion (sign-in /\n * step-up) carries `authenticatorData` + `signature` (+ `userHandle`\n * when the authenticator supplies one).\n */\nexport function encodeCredential(\n cred: PasskeyCredentialLike,\n): EncodedPasskeyCredential {\n const r = cred.response;\n const response: EncodedPasskeyCredential[\"response\"] = {\n clientDataJSON: toB64u(r.clientDataJSON),\n };\n if (r.attestationObject) response.attestationObject = toB64u(r.attestationObject);\n if (r.authenticatorData) response.authenticatorData = toB64u(r.authenticatorData);\n if (r.signature) response.signature = toB64u(r.signature);\n if (r.userHandle) response.userHandle = toB64u(r.userHandle);\n return { id: cred.id, response };\n}\n\n// ─────────────────────────────────────────────────────────────\n// Browser bridge — reads globals lazily, never at import time\n// ─────────────────────────────────────────────────────────────\n\n/**\n * Minimal view of `navigator.credentials`, typed structurally so the\n * package compiles without the DOM lib and so tests can inject a\n * stand-in.\n */\nexport interface PasskeyCredentialsContainer {\n create(options?: { publicKey?: unknown; signal?: AbortSignal }): Promise<unknown>;\n get(options?: {\n publicKey?: unknown;\n mediation?: PasskeyMediation;\n signal?: AbortSignal;\n }): Promise<unknown>;\n}\n// The real `navigator.credentials` (lib.dom `CredentialsContainer`) is\n// assignable to this: its options are a superset and it resolves\n// `Credential | null`, which the helpers narrow with `isCredentialLike`.\n\n/** `CredentialMediationRequirement` from the Credential Management spec. */\nexport type PasskeyMediation = \"silent\" | \"optional\" | \"conditional\" | \"required\";\n\nexport type PasskeyErrorCode =\n /** No WebAuthn in this environment — see {@link isPasskeySupported}. */\n | \"unsupported\"\n /** The user dismissed the prompt, or no passkey matched (`NotAllowedError`). */\n | \"cancelled\"\n /** The prompt ran out of time — the options' `timeout` or your `signal` fired (`TimeoutError`). */\n | \"timeout\"\n /** The authenticator refused (e.g. credential already registered — `InvalidStateError`). */\n | \"invalid_state\"\n /** The page origin does not match the app's `rp_id` (`SecurityError`). */\n | \"security\"\n /** The browser returned no credential without throwing. */\n | \"no_credential\"\n /** Any other `navigator.credentials` failure; `cause` carries the original. */\n | \"unknown\";\n\n/**\n * Thrown by the ceremony helpers when the *browser* side fails. HTTP\n * failures from Auth keep surfacing as `AuthHttpError` so a caller can\n * tell \"the user cancelled\" from \"the server said 401\".\n */\nexport class PasskeyError extends Error {\n public readonly code: PasskeyErrorCode;\n public override readonly cause?: unknown;\n\n constructor(code: PasskeyErrorCode, message: string, cause?: unknown) {\n super(message);\n this.name = \"PasskeyError\";\n this.code = code;\n this.cause = cause;\n }\n}\n\nfunction browserCredentials(): PasskeyCredentialsContainer | undefined {\n const nav = (globalThis as { navigator?: { credentials?: unknown } }).navigator;\n const creds = nav?.credentials as PasskeyCredentialsContainer | undefined;\n if (!creds || typeof creds.create !== \"function\" || typeof creds.get !== \"function\") {\n return undefined;\n }\n return creds;\n}\n\n/**\n * `true` when this environment can run a passkey ceremony: a\n * `window` with `PublicKeyCredential`, `navigator.credentials.create`\n * / `.get`, and a secure context (https, or http on localhost).\n * Always `false` in Node — use it to hide the button rather than\n * showing one that throws. Never throws itself.\n */\nexport function isPasskeySupported(): boolean {\n const g = globalThis as {\n window?: unknown;\n PublicKeyCredential?: unknown;\n isSecureContext?: boolean;\n };\n if (typeof g.window === \"undefined\") return false;\n if (typeof g.PublicKeyCredential !== \"function\") return false;\n if (g.isSecureContext === false) return false;\n return browserCredentials() !== undefined;\n}\n\nfunction mapDomError(err: unknown): PasskeyError {\n const name = (err as { name?: string } | null)?.name;\n const message = (err as { message?: string } | null)?.message ?? String(err);\n switch (name) {\n case \"NotAllowedError\":\n return new PasskeyError(\n \"cancelled\",\n `Passkey prompt was cancelled, timed out, or no passkey matched: ${message}`,\n err,\n );\n case \"InvalidStateError\":\n return new PasskeyError(\"invalid_state\", `Authenticator refused: ${message}`, err);\n case \"SecurityError\":\n return new PasskeyError(\n \"security\",\n `Page origin does not match the app's rp_id: ${message}`,\n err,\n );\n case \"AbortError\":\n return new PasskeyError(\"cancelled\", `Passkey ceremony aborted: ${message}`, err);\n case \"TimeoutError\":\n return new PasskeyError(\n \"timeout\",\n `Passkey prompt timed out before a credential was produced: ${message}`,\n err,\n );\n default:\n return new PasskeyError(\"unknown\", `navigator.credentials failed: ${message}`, err);\n }\n}\n\nexport interface PasskeyBrowserOptions {\n /** Abort the browser prompt (e.g. on route change). */\n signal?: AbortSignal;\n /**\n * Override `navigator.credentials` — for tests, or non-browser\n * runtimes that expose a compatible container. Defaults to the\n * global one, read at call time.\n */\n credentials?: PasskeyCredentialsContainer;\n}\n\n/**\n * The credentials container a ceremony will use, or a {@link PasskeyError}\n * with code `unsupported` if there is none. The ceremony helpers call this\n * BEFORE their options request, so an unsupported client never mints a\n * server-side challenge it can never answer.\n */\nexport function resolveCredentials(\n opts: PasskeyBrowserOptions = {},\n): PasskeyCredentialsContainer {\n const creds = opts.credentials ?? browserCredentials();\n if (!creds) {\n throw new PasskeyError(\n \"unsupported\",\n \"navigator.credentials is not available — passkeys need a browser with WebAuthn (check isPasskeySupported())\",\n );\n }\n return creds;\n}\n\nfunction isCredentialLike(value: unknown): value is PasskeyCredentialLike {\n if (!value || typeof value !== \"object\") return false;\n const v = value as { id?: unknown; response?: unknown };\n return typeof v.id === \"string\" && !!v.response && typeof v.response === \"object\";\n}\n\n/**\n * `navigator.credentials.create()` with base64url handled: takes the\n * `public_key` from an Auth enrolment response, returns the encoded\n * `credential` to POST back. Throws {@link PasskeyError}.\n */\nexport async function createPasskeyCredential(\n publicKey: PasskeyPublicKeyOptions | Record<string, unknown>,\n opts: PasskeyBrowserOptions = {},\n): Promise<EncodedPasskeyCredential> {\n const creds = resolveCredentials(opts);\n let cred: unknown;\n try {\n cred = await creds.create({ publicKey: decodeOptions(publicKey), signal: opts.signal });\n } catch (err) {\n throw mapDomError(err);\n }\n if (!isCredentialLike(cred)) {\n throw new PasskeyError(\n \"no_credential\",\n \"navigator.credentials.create() returned no usable credential\",\n );\n }\n return encodeCredential(cred);\n}\n\n/**\n * `navigator.credentials.get()` with base64url handled: takes the\n * `public_key` from an Auth options response, returns the encoded\n * `credential` to POST back. Throws {@link PasskeyError}.\n */\nexport async function getPasskeyCredential(\n publicKey: PasskeyPublicKeyOptions | Record<string, unknown>,\n opts: PasskeyBrowserOptions & { mediation?: PasskeyMediation } = {},\n): Promise<EncodedPasskeyCredential> {\n const creds = resolveCredentials(opts);\n let cred: unknown;\n try {\n cred = await creds.get({\n publicKey: decodeOptions(publicKey),\n mediation: opts.mediation,\n signal: opts.signal,\n });\n } catch (err) {\n throw mapDomError(err);\n }\n if (!isCredentialLike(cred)) {\n throw new PasskeyError(\n \"no_credential\",\n \"navigator.credentials.get() returned no usable credential\",\n );\n }\n return encodeCredential(cred);\n}\n","/**\n * `auth.consumer(slug)`: the generated consumer scope plus what the\n * generator cannot write (docs/sdk-standard.md section 6): offline token\n * verification against the app's JWKS, and the browser passkey ceremonies.\n * Every HTTP method comes from the generated `AuthConsumer`.\n */\n\nimport type { APIClient } from \"@productcraft/core\";\nimport { AuthConsumer } from \"./_generated/resources.js\";\nimport type * as T from \"./_generated/types.js\";\nimport { JwksCache, verifyAuthToken, type AuthClaims, type VerifyOptions } from \"./jwt/index.js\";\nimport {\n createPasskeyCredential,\n getPasskeyCredential,\n resolveCredentials,\n type EncodedPasskeyCredential,\n type PasskeyBrowserOptions,\n type PasskeyMediation,\n type PasskeyPublicKeyOptions,\n} from \"./passkeys.js\";\n\n/**\n * Legacy `iss` claim Auth tokens were minted with before the 2026-05-24\n * per-app-issuer migration. New tokens carry `${baseUrl}/${appSlug}`\n * (`scope.expectedIssuer`).\n */\nexport const AUTH_LEGACY_ISSUER = \"heimdall\";\n\nexport interface ConsumerScopeOptions {\n /** Per-app JWKS cache lifetime in ms. Default 10 minutes. */\n jwksTtlMs?: number;\n /** Custom fetch for the JWKS download (tests, proxies). */\n fetch?: typeof fetch;\n /** Reuse an existing cache for this app (the client keeps one per slug). */\n jwks?: JwksCache;\n}\n\n/** The issuer, audience and JWKS URL of one app's tokens. */\nexport function appTokenConfig(baseUrl: string, appSlug: string) {\n const origin = new URL(baseUrl);\n origin.pathname = `/${appSlug}`;\n const expectedIssuer = origin.toString().replace(/\\/$/, \"\");\n return {\n expectedIssuer,\n expectedAudience: appSlug,\n acceptedIssuers: [expectedIssuer, AUTH_LEGACY_ISSUER] as readonly string[],\n jwksUrl: new URL(`/${appSlug}/.well-known/jwks.json`, baseUrl),\n };\n}\n\n/** The encoded credential as the free-form JSON object the API declares. */\nconst wire = (credential: EncodedPasskeyCredential) => ({ id: credential.id, response: { ...credential.response } });\n\nexport class ConsumerScope extends AuthConsumer {\n /** The app slug this scope is bound to. */\n readonly appSlug: string;\n /** Issuer stamped on this app's tokens (`https://api.auth.productcraft.co/<slug>`). */\n readonly expectedIssuer: string;\n /** Audience stamped on this app's tokens: the app slug. */\n readonly expectedAudience: string;\n /** `expectedIssuer` plus the legacy `\"heimdall\"` literal; what `verifyToken` accepts by default. */\n readonly acceptedIssuers: readonly string[];\n /** jose-compatible JWKS resolver (`jose.jwtVerify(token, scope.jwks.getKey, …)`, passport-jwt). */\n readonly jwks: JwksCache;\n\n constructor(client: APIClient, bound: { app_slug: string }, options: ConsumerScopeOptions = {}) {\n super(client, bound);\n const cfg = appTokenConfig(client.baseUrl, bound.app_slug);\n this.appSlug = bound.app_slug;\n this.expectedIssuer = cfg.expectedIssuer;\n this.expectedAudience = cfg.expectedAudience;\n this.acceptedIssuers = cfg.acceptedIssuers;\n this.jwks = options.jwks ?? new JwksCache({ url: cfg.jwksUrl, ttlMs: options.jwksTtlMs, fetch: options.fetch });\n }\n\n /**\n * Verify an Auth access token offline against this app's JWKS: signature,\n * expiry, `iss` (per-app URL or the legacy literal) and `aud` (the slug).\n * Refresh tokens are refused (`JwtRefreshTokenError`).\n */\n verifyToken(token: string, opts: VerifyOptions = {}): Promise<AuthClaims> {\n return verifyAuthToken(token, this.jwks.getKey, {\n issuer: this.acceptedIssuers as string[],\n audience: this.expectedAudience,\n ...opts,\n });\n }\n\n /**\n * WebAuthn ceremonies, one call each. Browser only at call time (they drive\n * `navigator.credentials`); importing is safe anywhere.\n */\n readonly passkeys = {\n /**\n * Enrol a passkey as an MFA factor for the signed-in end user (the client\n * carries the user's access token). Resolves with the enabled factor and\n * the recovery codes; show those once.\n */\n enroll: async (opts: PasskeyBrowserOptions & { label?: string } = {}): Promise<T.ConfirmEnrollment> => {\n // Fail before the options call: an unsupported client must not mint a challenge.\n const credentials = resolveCredentials(opts);\n const start = await this.me.mfa.factors.create({ type: \"webauthn\", ...(opts.label ? { label: opts.label } : {}) });\n const publicKey = (start.enrollment as { public_key?: unknown }).public_key as PasskeyPublicKeyOptions;\n const credential = await createPasskeyCredential(publicKey, { ...opts, credentials });\n return this.me.mfa.factors.verify(start.factor.id, { credential: wire(credential) });\n },\n\n /**\n * Passwordless sign-in with a discoverable passkey. Rejects with\n * `PasskeyError` (`cancelled`) when the user dismisses the prompt, and with\n * `AuthenticationError` (401) for a forged, unknown or replayed assertion.\n */\n signIn: async (\n opts: PasskeyBrowserOptions & { mediation?: PasskeyMediation; tenant_id?: string } = {},\n ): Promise<T.ConsumerToken> => {\n const credentials = resolveCredentials(opts);\n const { public_key } = await this.passkey.options(opts.tenant_id ? { tenant_id: opts.tenant_id } : {});\n const credential = await getPasskeyCredential(public_key as PasskeyPublicKeyOptions, { ...opts, credentials });\n return this.passkey.verify({ credential: wire(credential) }) as Promise<T.ConsumerToken>;\n },\n\n /** Answer the MFA step of a password sign-in (`result: \"mfa_required\"`) with a passkey. */\n completeMfaChallenge: async (\n args: PasskeyBrowserOptions & { mfa_token: string; mediation?: PasskeyMediation },\n ): Promise<T.ConsumerToken> => {\n const { mfa_token, ...browserOpts } = args;\n const credentials = resolveCredentials(browserOpts);\n const { public_key } = await this.mfa.webauthn.options({ mfa_token });\n const credential = await getPasskeyCredential(public_key as PasskeyPublicKeyOptions, { ...browserOpts, credentials });\n return this.mfa.verify({ mfa_token, credential: wire(credential) }) as Promise<T.ConsumerToken>;\n },\n\n /** Re-confirm the signed-in user inside a live session before a sensitive action. */\n stepUp: async (opts: PasskeyBrowserOptions & { mediation?: PasskeyMediation } = {}): Promise<T.StepUp> => {\n const credentials = resolveCredentials(opts);\n const { public_key } = await this.me.mfa.stepUp.webauthn.options();\n const credential = await getPasskeyCredential(public_key as PasskeyPublicKeyOptions, { ...opts, credentials });\n return this.me.mfa.stepUp.verify({ credential: wire(credential) });\n },\n };\n}\n","/**\n * Hand-written base of the generated `Auth` class (SURFACES `root` in\n * scripts/gen-sdk.mjs). It adds what is not an HTTP call:\n *\n * - `consumer(slug)`, whose client never reads a credential from the\n * environment: consumer routes act for an end user, so a workspace key in\n * `PRODUCTCRAFT_API_KEY` must not leak onto them. Pass `auth`/`apiKey`\n * explicitly for the PAK-only consumer routes.\n * - `verifyToken(jwt, { app })` at the top level, with one JWKS cache per app.\n */\n\nimport { ConfigurationError, PC_AUTH_APP_ENV, readEnv, type APIClient, type ClientOptions } from \"@productcraft/core\";\nimport { AuthResources } from \"./_generated/resources.js\";\nimport { ConsumerScope, appTokenConfig } from \"./consumer.js\";\nimport { JwksCache, type AuthClaims, type VerifyOptions } from \"./jwt/index.js\";\n\nexport interface AuthOptions extends ClientOptions {\n /** Custom `fetch`, also used for JWKS downloads. */\n fetch?: typeof fetch;\n /** Per-app JWKS cache lifetime in ms. Default 10 minutes. */\n jwksTtlMs?: number;\n}\n\nexport class AuthBase extends AuthResources {\n readonly #options: AuthOptions;\n readonly #consumerClient: APIClient;\n readonly #jwks = new Map<string, JwksCache>();\n\n constructor(client: APIClient, options: AuthOptions, makeClient: (options: ClientOptions) => APIClient) {\n super(client);\n this.#options = options;\n this.#consumerClient = makeClient({ ...options, credentialFromEnv: false });\n }\n\n #cache(slug: string): JwksCache {\n let cache = this.#jwks.get(slug);\n if (!cache) {\n const { jwksUrl } = appTokenConfig(this._client.baseUrl, slug);\n cache = new JwksCache({ url: jwksUrl, ttlMs: this.#options.jwksTtlMs, fetch: this.#options.fetch });\n this.#jwks.set(slug, cache);\n }\n return cache;\n }\n\n /**\n * Calls for one app's end users (sign-in, sessions, profile, MFA, tenants),\n * plus `verifyToken` and the passkey ceremonies.\n *\n * @param appSlug - The app's slug. Default: `PRODUCTCRAFT_AUTH_APP`.\n */\n consumer(appSlug?: string): ConsumerScope {\n const slug = appSlug ?? readEnv(PC_AUTH_APP_ENV);\n if (!slug) throw new ConfigurationError(`consumer() needs an app slug. Pass one, or set ${PC_AUTH_APP_ENV}.`);\n return new ConsumerScope(this.#consumerClient, { app_slug: slug }, { jwks: this.#cache(slug) });\n }\n\n /**\n * Verify an Auth access token offline against the app's JWKS (signature,\n * expiry, issuer, audience; refresh tokens refused). Same as\n * `auth.consumer(app).verifyToken(jwt)`, with the JWKS cached per app.\n *\n * @param options.app - The app slug the token was issued for. Default: `PRODUCTCRAFT_AUTH_APP`.\n */\n verifyToken(token: string, options: VerifyOptions & { app?: string } = {}): Promise<AuthClaims> {\n const { app, ...verify } = options;\n return this.consumer(app).verifyToken(token, verify);\n }\n}\n","// Generated by scripts/gen-sdk.mjs from Specs/auth.json. Do not edit.\n\nimport type { LastResponse } from \"@productcraft/core\";\nimport type { components, paths } from \"./paths.js\";\n\ntype IsUnion<T, U = T> = T extends unknown ? ([U] extends [T] ? false : true) : never;\ntype OpenString<T extends string> = string extends T ? T : true extends IsUnion<T> ? T | (string & {}) : T;\ntype OpenValue<T> = [T] extends [string] ? OpenString<T> : T extends readonly (infer I)[] ? Open<I>[] : T extends object ? { [K in keyof T]: Open<T[K]> } : T;\n/** A response type: string-literal unions also accept values added after this SDK was built. */\nexport type Open<T> = OpenValue<Exclude<T, null | undefined>> | Extract<T, null | undefined>;\n/** What a method resolves to: the parsed body plus non-enumerable `lastResponse`. */\nexport type WithLastResponse<T> = T & { readonly lastResponse: LastResponse };\n/** Params inside a scope bound with `.as(actorId)`: `actor_id` may be left out. */\nexport type WithOptionalActor<P> = P extends { actor_id: unknown } ? Omit<P, \"actor_id\"> & { actor_id?: P[\"actor_id\"] } : P;\n/** A polled model whose free-form `K` the caller types as `R` (`createAndPoll<R>`); optional and nullable stay as declared. */\nexport type WithResult<M, K extends keyof M, R> = Omit<M, K> & { [P in keyof M as P extends K ? P : never]: R | Extract<M[P], null> };\n\nexport type ApiKeyStatus = components[\"schemas\"][\"ApiKeyStatus\"];\nexport const ApiKeyStatus = { values: [\"active\", \"expired\", \"revoked\"] as const };\n\nexport type AppEnvironment = components[\"schemas\"][\"AppEnvironment\"];\nexport const AppEnvironment = { values: [\"production\", \"staging\", \"development\"] as const };\n\nexport type AppStatus = components[\"schemas\"][\"AppStatus\"];\nexport const AppStatus = { values: [\"active\", \"suspended\", \"archived\"] as const };\n\nexport type ApplyPlanAction = components[\"schemas\"][\"ApplyPlanAction\"];\nexport const ApplyPlanAction = { values: [\"create\", \"skip\"] as const };\n\nexport type ApplyPlanResult = components[\"schemas\"][\"ApplyPlanResult\"];\nexport const ApplyPlanResult = { values: [\"created\", \"unchanged\", \"failed\"] as const };\n\nexport type AuditSinkAttemptKind = components[\"schemas\"][\"AuditSinkAttemptKind\"];\nexport const AuditSinkAttemptKind = { values: [\"batch\", \"test\"] as const };\n\nexport type AuditSinkState = components[\"schemas\"][\"AuditSinkState\"];\nexport const AuditSinkState = { values: [\"active\", \"paused\", \"auto_disabled\"] as const };\n\nexport type AuthStatsMetric = components[\"schemas\"][\"AuthStatsMetric\"];\nexport const AuthStatsMetric = { values: [\"active_users\"] as const };\n\nexport type BotProtectionProvider = components[\"schemas\"][\"BotProtectionProvider\"];\nexport const BotProtectionProvider = { values: [\"turnstile\", \"hcaptcha\"] as const };\n\nexport type ContactType = components[\"schemas\"][\"ContactType\"];\nexport const ContactType = { values: [\"email\", \"phone\"] as const };\n\nexport type CustomDomainApplyWarning = components[\"schemas\"][\"CustomDomainApplyWarning\"];\nexport const CustomDomainApplyWarning = { values: [\"token_scope_broader_than_zone\", \"partially_applied\"] as const };\n\nexport type CustomDomainStatus = components[\"schemas\"][\"CustomDomainStatus\"];\nexport const CustomDomainStatus = { values: [\"pending\", \"active\", \"failing\"] as const };\n\nexport type DnsConflictSeverity = components[\"schemas\"][\"DnsConflictSeverity\"];\nexport const DnsConflictSeverity = { values: [\"blocking\", \"warning\"] as const };\n\nexport type DnsProvider = components[\"schemas\"][\"DnsProvider\"];\nexport const DnsProvider = { values: [\"cloudflare\", \"digitalocean\"] as const };\n\nexport type DnsRecordPurpose = components[\"schemas\"][\"DnsRecordPurpose\"];\nexport const DnsRecordPurpose = { values: [\"routing\", \"ownership\"] as const };\n\nexport type DnsRecordState = components[\"schemas\"][\"DnsRecordState\"];\nexport const DnsRecordState = { values: [\"not_found\", \"propagating\", \"verified\", \"conflict\", \"lookup_failed\"] as const };\n\nexport type DnsRecordType = components[\"schemas\"][\"DnsRecordType\"];\nexport const DnsRecordType = { values: [\"CNAME\", \"TXT\"] as const };\n\nexport type EndUserStatus = components[\"schemas\"][\"EndUserStatus\"];\nexport const EndUserStatus = { values: [\"active\", \"suspended\", \"deactivated\"] as const };\n\nexport type EnrollmentType = components[\"schemas\"][\"EnrollmentType\"];\nexport const EnrollmentType = { values: [\"totp\", \"email\", \"webauthn\"] as const };\n\nexport type ImportJobStatus = components[\"schemas\"][\"ImportJobStatus\"];\nexport const ImportJobStatus = { values: [\"queued\", \"running\", \"succeeded\", \"failed\"] as const };\n\nexport type IntrospectedTokenType = components[\"schemas\"][\"IntrospectedTokenType\"];\nexport const IntrospectedTokenType = { values: [\"m2m\", \"end_user\"] as const };\n\nexport type JwkUse = components[\"schemas\"][\"JwkUse\"];\nexport const JwkUse = { values: [\"sig\"] as const };\n\nexport type MfaPolicy = components[\"schemas\"][\"MfaPolicy\"];\nexport const MfaPolicy = { values: [\"optional\", \"required\"] as const };\n\nexport type OAuthLinkPolicy = components[\"schemas\"][\"OAuthLinkPolicy\"];\nexport const OAuthLinkPolicy = { values: [\"auto\", \"confirm\", \"reject\"] as const };\n\nexport type OAuthProvider = components[\"schemas\"][\"OAuthProvider\"];\nexport const OAuthProvider = { values: [\"google\", \"github\", \"apple\"] as const };\n\nexport type PasswordBreachCheck = components[\"schemas\"][\"PasswordBreachCheck\"];\nexport const PasswordBreachCheck = { values: [\"off\", \"warn\", \"block\"] as const };\n\nexport type ProviderBlockedReason = components[\"schemas\"][\"ProviderBlockedReason\"];\nexport const ProviderBlockedReason = { values: [\"no_redirect_origins\", \"missing_credentials\", \"credentials_rejected\"] as const };\n\nexport type ProviderCheckResult = components[\"schemas\"][\"ProviderCheckResult\"];\nexport const ProviderCheckResult = { values: [\"credentials_valid\", \"credentials_rejected\", \"inconclusive\"] as const };\n\nexport type ProviderStatus = components[\"schemas\"][\"ProviderStatus\"];\nexport const ProviderStatus = { values: [\"ready\", \"blocked\", \"disabled\", \"not_configured\"] as const };\n\nexport type SenderDomainStatus = components[\"schemas\"][\"SenderDomainStatus\"];\nexport const SenderDomainStatus = { values: [\"not_started\", \"pending\", \"partially_verified\", \"verified\", \"temporary_failure\", \"failed\", \"disabled\", \"deleted\", \"not_found\"] as const };\n\nexport type SenderSource = components[\"schemas\"][\"SenderSource\"];\nexport const SenderSource = { values: [\"workspace\", \"custom\"] as const };\n\nexport type SetupRowState = components[\"schemas\"][\"SetupRowState\"];\nexport const SetupRowState = { values: [\"pass\", \"attention\", \"not_set\", \"blocked\"] as const };\n\nexport type SignInResult = components[\"schemas\"][\"SignInResult\"];\nexport const SignInResult = { values: [\"session\", \"mfa_required\", \"mfa_enrollment_required\"] as const };\n\nexport type SignInTestEmailNoticeCode = components[\"schemas\"][\"SignInTestEmailNoticeCode\"];\nexport const SignInTestEmailNoticeCode = { values: [\"emails_off\", \"email_sender_missing\", \"email_template_missing\", \"email_workspace_missing\", \"email_unavailable\", \"email_send_failed\"] as const };\n\nexport type SignInTestMethod = components[\"schemas\"][\"SignInTestMethod\"];\nexport const SignInTestMethod = { values: [\"oauth\", \"password\", \"otp\"] as const };\n\nexport type SignInTestOutcome = components[\"schemas\"][\"SignInTestOutcome\"];\nexport const SignInTestOutcome = { values: [\"would_sign_in_existing\", \"would_create\"] as const };\n\nexport type SignInTestState = components[\"schemas\"][\"SignInTestState\"];\nexport const SignInTestState = { values: [\"pending\", \"succeeded\", \"failed\"] as const };\n\nexport type StatsGranularity = components[\"schemas\"][\"StatsGranularity\"];\nexport const StatsGranularity = { values: [\"day\"] as const };\n\nexport type StatsWindow = components[\"schemas\"][\"StatsWindow\"];\nexport const StatsWindow = { values: [\"1d\", \"7d\", \"30d\"] as const };\n\nexport type TenantApiKeyAdminState = components[\"schemas\"][\"TenantApiKeyAdminState\"];\nexport const TenantApiKeyAdminState = { values: [\"active\", \"expired\", \"revoked\", \"orphaned\"] as const };\n\nexport type TenantApiKeyEffectiveStatus = components[\"schemas\"][\"TenantApiKeyEffectiveStatus\"];\nexport const TenantApiKeyEffectiveStatus = { values: [\"active\", \"expired\", \"revoked\", \"orphaned\", \"suspended\"] as const };\n\nexport type TenantApiKeyEnv = components[\"schemas\"][\"TenantApiKeyEnv\"];\nexport const TenantApiKeyEnv = { values: [\"live\", \"test\"] as const };\n\nexport type TenantApiKeyManagementLane = components[\"schemas\"][\"TenantApiKeyManagementLane\"];\nexport const TenantApiKeyManagementLane = { values: [\"direct\", \"app_proxy_only\"] as const };\n\nexport type TenantApiKeyRevokeReason = components[\"schemas\"][\"TenantApiKeyRevokeReason\"];\nexport const TenantApiKeyRevokeReason = { values: [\"manual\", \"rotated\", \"member_removed\", \"tenant_deleted\"] as const };\n\nexport type TenantApiKeyState = components[\"schemas\"][\"TenantApiKeyState\"];\nexport const TenantApiKeyState = { values: [\"active\", \"expired\", \"revoked\"] as const };\n\nexport type TenantInviteStatus = components[\"schemas\"][\"TenantInviteStatus\"];\nexport const TenantInviteStatus = { values: [\"pending\", \"revoked\", \"expired\", \"used\"] as const };\n\nexport type TenantStatus = components[\"schemas\"][\"TenantStatus\"];\nexport const TenantStatus = { values: [\"active\", \"suspended\", \"archived\"] as const };\n\nexport type TokenType = components[\"schemas\"][\"TokenType\"];\nexport const TokenType = { values: [\"Bearer\"] as const };\n\nexport type UserCreatedVia = components[\"schemas\"][\"UserCreatedVia\"];\nexport const UserCreatedVia = { values: [\"admin\", \"invite\", \"tenant_invite\"] as const };\n\nexport type UserDeletedReason = components[\"schemas\"][\"UserDeletedReason\"];\nexport const UserDeletedReason = { values: [\"unverified_expired\"] as const };\n\nexport type UserDeletedVia = components[\"schemas\"][\"UserDeletedVia\"];\nexport const UserDeletedVia = { values: [\"platform\", \"platform_bulk\", \"consumer_admin\", \"self\"] as const };\n\nexport type WebhookAttemptTrigger = components[\"schemas\"][\"WebhookAttemptTrigger\"];\nexport const WebhookAttemptTrigger = { values: [\"automatic\", \"replay\", \"test\"] as const };\n\nexport type WebhookEndpointDisabledReason = components[\"schemas\"][\"WebhookEndpointDisabledReason\"];\nexport const WebhookEndpointDisabledReason = { values: [\"manual\", \"failing\"] as const };\n\nexport type WebhookEndpointStatus = components[\"schemas\"][\"WebhookEndpointStatus\"];\nexport const WebhookEndpointStatus = { values: [\"enabled\", \"disabled\", \"auto_disabled\"] as const };\n\nexport type WebhookEventStatus = components[\"schemas\"][\"WebhookEventStatus\"];\nexport const WebhookEventStatus = { values: [\"pending\", \"delivered\", \"failed\", \"not_sent\"] as const };\n\n/**\n * Every event type this product sends; `x-webhooks` maps each to its payload schema. New types can be added, so treat it as open.\n */\nexport type WebhookEventType = components[\"schemas\"][\"WebhookEventType\"];\nexport const WebhookEventType = { values: [\"user.signup\", \"user.signin\", \"user.suspended\", \"user.deactivated\", \"user.reinstated\", \"user.role_changed\", \"user.deleted\", \"user.contact_verified\", \"user.email_verified\", \"user.password_reset.requested\", \"user.password_reset.completed\", \"user.mfa.factor_enrolled\", \"user.mfa.factor_disabled\", \"user.mfa.recovery_code_used\", \"user.mfa.step_up_succeeded\", \"user.mfa.step_up_locked\", \"user.mfa.enrollment_required\", \"user.mfa.reenrollment_required\", \"tenant.created\", \"tenant.updated\", \"tenant.deleted\", \"tenant.member.added\", \"tenant.member.removed\", \"tenant.member.role_changed\", \"tenant.invite.created\", \"tenant.invite.accepted\", \"tenant.invite.revoked\", \"app.slug_changed\"] as const };\n\nexport type AcceptedTenantInvite = Open<components[\"schemas\"][\"AcceptedTenantInviteResponseDto\"]>;\nexport type AccountContact = Open<components[\"schemas\"][\"AccountContactDto\"]>;\nexport type AccountContactList = Open<components[\"schemas\"][\"AccountContactListResponseDto\"]>;\nexport type AddMember = Open<components[\"schemas\"][\"AddMemberResponseDto\"]>;\nexport type AdminProvisionFactor = Open<components[\"schemas\"][\"AdminProvisionFactorResponseDto\"]>;\nexport type ApiKeyList = Open<components[\"schemas\"][\"ApiKeyListResponseDto\"]>;\nexport type ApiKeySummary = Open<components[\"schemas\"][\"ApiKeySummaryDto\"]>;\nexport type AppList = Open<components[\"schemas\"][\"AppListResponseDto\"]>;\nexport type AppMemberList = Open<components[\"schemas\"][\"AppMemberListResponseDto\"]>;\nexport type AppMemberSummary = Open<components[\"schemas\"][\"AppMemberSummaryDto\"]>;\nexport type AppMembership = Open<components[\"schemas\"][\"AppMembershipResponseDto\"]>;\nexport type AppNotificationSettings = Open<components[\"schemas\"][\"AppNotificationSettingsResponseDto\"]>;\nexport type AppPermissionCatalogEntry = Open<components[\"schemas\"][\"AppPermissionCatalogEntryDto\"]>;\nexport type App = Open<components[\"schemas\"][\"AppResponseDto\"]>;\nexport type AppSlugChangedEventData = Open<components[\"schemas\"][\"AppSlugChangedEventDataDto\"]>;\nexport type ApplyConflict = Open<components[\"schemas\"][\"ApplyConflictDto\"]>;\nexport type ApplyCounts = Open<components[\"schemas\"][\"ApplyCountsDto\"]>;\nexport type ApplyPlanItem = Open<components[\"schemas\"][\"ApplyPlanItemDto\"]>;\nexport type AuditLogEntry = Open<components[\"schemas\"][\"AuditLogEntryDto\"]>;\nexport type AuditLogList = Open<components[\"schemas\"][\"AuditLogListResponseDto\"]>;\nexport type AuditSink = Open<components[\"schemas\"][\"AuditSinkResponseDto\"]>;\nexport type AuditSinkTestResult = Open<components[\"schemas\"][\"AuditSinkTestResultDto\"]>;\nexport type AuditSinkWithSecret = Open<components[\"schemas\"][\"AuditSinkWithSecretResponseDto\"]>;\nexport type AuthConfig = Open<components[\"schemas\"][\"AuthConfigResponseDto\"]>;\nexport type AuthStatsInWindow = Open<components[\"schemas\"][\"AuthStatsInWindowDto\"]>;\nexport type AuthStatsSeries = Open<components[\"schemas\"][\"AuthStatsSeriesDto\"]>;\nexport type AuthStatsTotals = Open<components[\"schemas\"][\"AuthStatsTotalsDto\"]>;\nexport type AuthWorkspaceStats = Open<components[\"schemas\"][\"AuthWorkspaceStatsDto\"]>;\nexport type AuthorizeBatch = Open<components[\"schemas\"][\"AuthorizeBatchResponseDto\"]>;\nexport type AuthorizeBatchResult = Open<components[\"schemas\"][\"AuthorizeBatchResultDto\"]>;\nexport type Authorize = Open<components[\"schemas\"][\"AuthorizeResponseDto\"]>;\nexport type AvatarUrl = Open<components[\"schemas\"][\"AvatarUrlResponseDto\"]>;\nexport type BotProtection = Open<components[\"schemas\"][\"BotProtectionResponseDto\"]>;\nexport type BulkAffectedUsers = Open<components[\"schemas\"][\"BulkAffectedUsersResponseDto\"]>;\nexport type CloneApp = Open<components[\"schemas\"][\"CloneAppResponseDto\"]>;\nexport type ConfirmEnrollment = Open<components[\"schemas\"][\"ConfirmEnrollmentResponseDto\"]>;\nexport type ConsumerAddMember = Open<components[\"schemas\"][\"ConsumerAddMemberResponseDto\"]>;\nexport type ConsumerAdminCreatedUser = Open<components[\"schemas\"][\"ConsumerAdminCreatedUserDto\"]>;\nexport type ConsumerAdminEndUser = Open<components[\"schemas\"][\"ConsumerAdminEndUserDto\"]>;\nexport type ConsumerAdminEndUserList = Open<components[\"schemas\"][\"ConsumerAdminEndUserListResponseDto\"]>;\nexport type ConsumerAdminPermission = Open<components[\"schemas\"][\"ConsumerAdminPermissionDto\"]>;\nexport type ConsumerAdminPermissionListEntry = Open<components[\"schemas\"][\"ConsumerAdminPermissionListEntryDto\"]>;\nexport type ConsumerAdminRoleAssignment = Open<components[\"schemas\"][\"ConsumerAdminRoleAssignmentResponseDto\"]>;\nexport type ConsumerCodeDispatch = Open<components[\"schemas\"][\"ConsumerCodeDispatchResponseDto\"]>;\nexport type ConsumerCodeIssue = Open<components[\"schemas\"][\"ConsumerCodeIssueResponseDto\"]>;\nexport type ConsumerMfaChallengeFactor = Open<components[\"schemas\"][\"ConsumerMfaChallengeFactorDto\"]>;\nexport type ConsumerMfaChallenge = Open<components[\"schemas\"][\"ConsumerMfaChallengeResponseDto\"]>;\nexport type ConsumerMfaEnrollVerify = Open<components[\"schemas\"][\"ConsumerMfaEnrollVerifyResponseDto\"]>;\nexport type ConsumerMfaEnrollmentRequired = Open<components[\"schemas\"][\"ConsumerMfaEnrollmentRequiredResponseDto\"]>;\nexport type ConsumerMfaSendCode = Open<components[\"schemas\"][\"ConsumerMfaSendCodeResponseDto\"]>;\nexport type ConsumerRoleList = Open<components[\"schemas\"][\"ConsumerRoleListResponseDto\"]>;\nexport type ConsumerRolePermissionEntry = Open<components[\"schemas\"][\"ConsumerRolePermissionEntryDto\"]>;\nexport type ConsumerRole = Open<components[\"schemas\"][\"ConsumerRoleResponseDto\"]>;\nexport type ConsumerRoleWithPermissions = Open<components[\"schemas\"][\"ConsumerRoleWithPermissionsResponseDto\"]>;\nexport type ConsumerTenantList = Open<components[\"schemas\"][\"ConsumerTenantListResponseDto\"]>;\nexport type ConsumerTenantMembershipList = Open<components[\"schemas\"][\"ConsumerTenantMembershipListResponseDto\"]>;\nexport type ConsumerTenantMembership = Open<components[\"schemas\"][\"ConsumerTenantMembershipResponseDto\"]>;\nexport type ConsumerTenant = Open<components[\"schemas\"][\"ConsumerTenantResponseDto\"]>;\nexport type ConsumerToken = Open<components[\"schemas\"][\"ConsumerTokenResponseDto\"]>;\nexport type ConsumerVerify = Open<components[\"schemas\"][\"ConsumerVerifyResponseDto\"]>;\nexport type ConsumerWebauthnOptions = Open<components[\"schemas\"][\"ConsumerWebauthnOptionsResponseDto\"]>;\nexport type CreateApiKey = Open<components[\"schemas\"][\"CreateApiKeyResponseDto\"]>;\nexport type CreateTenantInvite = Open<components[\"schemas\"][\"CreateTenantInviteResponseDto\"]>;\nexport type CustomDomainApplyResult = Open<components[\"schemas\"][\"CustomDomainApplyResultDto\"]>;\nexport type CustomDomainCallbackUrls = Open<components[\"schemas\"][\"CustomDomainCallbackUrlsDto\"]>;\nexport type CustomDomain = Open<components[\"schemas\"][\"CustomDomainDto\"]>;\nexport type CustomDomainList = Open<components[\"schemas\"][\"CustomDomainListDto\"]>;\nexport type CustomDomainRecord = Open<components[\"schemas\"][\"CustomDomainRecordDto\"]>;\nexport type DnsConflict = Open<components[\"schemas\"][\"DnsConflictDto\"]>;\nexport type DnsProviderRef = Open<components[\"schemas\"][\"DnsProviderRefDto\"]>;\nexport type EffectiveSender = Open<components[\"schemas\"][\"EffectiveSenderDto\"]>;\nexport type EmailEnrollmentData = Open<components[\"schemas\"][\"EmailEnrollmentDataDto\"]>;\nexport type EndUserActionCount = Open<components[\"schemas\"][\"EndUserActionCountDto\"]>;\nexport type EndUserActivityEntry = Open<components[\"schemas\"][\"EndUserActivityEntryDto\"]>;\nexport type EndUserDetailInsights = Open<components[\"schemas\"][\"EndUserDetailInsightsDto\"]>;\nexport type EndUserFactorEntry = Open<components[\"schemas\"][\"EndUserFactorEntryDto\"]>;\nexport type EndUserInsights = Open<components[\"schemas\"][\"EndUserInsightsDto\"]>;\nexport type EndUserInviteList = Open<components[\"schemas\"][\"EndUserInviteListResponseDto\"]>;\nexport type EndUserInvite = Open<components[\"schemas\"][\"EndUserInviteResponseDto\"]>;\nexport type EndUserList = Open<components[\"schemas\"][\"EndUserListResponseDto\"]>;\nexport type EndUserRoleAssignment = Open<components[\"schemas\"][\"EndUserRoleAssignmentResponseDto\"]>;\nexport type EndUserSessionEntry = Open<components[\"schemas\"][\"EndUserSessionEntryDto\"]>;\nexport type EndUserSummary = Open<components[\"schemas\"][\"EndUserSummaryDto\"]>;\nexport type EnforcedPermissions = Open<components[\"schemas\"][\"EnforcedPermissionsResponseDto\"]>;\nexport type Exchange = Open<components[\"schemas\"][\"ExchangeResponseDto\"]>;\nexport type FactorList = Open<components[\"schemas\"][\"FactorListResponseDto\"]>;\nexport type GrantableScope = Open<components[\"schemas\"][\"GrantableScopeDto\"]>;\nexport type IdpMfaEnrollmentRequired = Open<components[\"schemas\"][\"IdpMfaEnrollmentRequiredResponseDto\"]>;\nexport type IdpToken = Open<components[\"schemas\"][\"IdpTokenResponseDto\"]>;\nexport type ImportJobError = Open<components[\"schemas\"][\"ImportJobErrorDto\"]>;\nexport type ImportJob = Open<components[\"schemas\"][\"ImportJobResponseDto\"]>;\nexport type InsightsMfa = Open<components[\"schemas\"][\"InsightsMfaDto\"]>;\nexport type InsightsPasswordReset = Open<components[\"schemas\"][\"InsightsPasswordResetDto\"]>;\nexport type InsightsSessions = Open<components[\"schemas\"][\"InsightsSessionsDto\"]>;\nexport type InsightsSignin = Open<components[\"schemas\"][\"InsightsSigninDto\"]>;\nexport type InsightsUsers = Open<components[\"schemas\"][\"InsightsUsersDto\"]>;\nexport type InsightsVerification = Open<components[\"schemas\"][\"InsightsVerificationDto\"]>;\nexport type Introspect = Open<components[\"schemas\"][\"IntrospectResponseDto\"]>;\nexport type IntrospectionCreator = Open<components[\"schemas\"][\"IntrospectionCreatorDto\"]>;\nexport type IssuedVerificationCode = Open<components[\"schemas\"][\"IssuedVerificationCodeResponseDto\"]>;\nexport type Jwk = Open<components[\"schemas\"][\"JwkDto\"]>;\nexport type Jwks = Open<components[\"schemas\"][\"JwksResponseDto\"]>;\nexport type ListWebhookEndpoints = Open<components[\"schemas\"][\"ListWebhookEndpointsResponseDto\"]>;\nexport type ListWebhookEventTypes = Open<components[\"schemas\"][\"ListWebhookEventTypesResponseDto\"]>;\nexport type ListWebhookEvents = Open<components[\"schemas\"][\"ListWebhookEventsResponseDto\"]>;\nexport type M2mClientCreate = Open<components[\"schemas\"][\"M2mClientCreateResponseDto\"]>;\nexport type M2mClientDetail = Open<components[\"schemas\"][\"M2mClientDetailResponseDto\"]>;\nexport type M2mClientList = Open<components[\"schemas\"][\"M2mClientListResponseDto\"]>;\nexport type M2mClientSummary = Open<components[\"schemas\"][\"M2mClientSummaryDto\"]>;\nexport type M2mRotateSecret = Open<components[\"schemas\"][\"M2mRotateSecretResponseDto\"]>;\nexport type M2mScopeEntry = Open<components[\"schemas\"][\"M2mScopeEntryDto\"]>;\nexport type MeActivityEntry = Open<components[\"schemas\"][\"MeActivityEntryDto\"]>;\nexport type MeActivity = Open<components[\"schemas\"][\"MeActivityResponseDto\"]>;\nexport type MeContact = Open<components[\"schemas\"][\"MeContactDto\"]>;\nexport type MeContacts = Open<components[\"schemas\"][\"MeContactsResponseDto\"]>;\nexport type MePermissions = Open<components[\"schemas\"][\"MePermissionsResponseDto\"]>;\nexport type MeProfile = Open<components[\"schemas\"][\"MeProfileResponseDto\"]>;\nexport type MeSession = Open<components[\"schemas\"][\"MeSessionDto\"]>;\nexport type MeSessions = Open<components[\"schemas\"][\"MeSessionsResponseDto\"]>;\nexport type MeUpdatedAccount = Open<components[\"schemas\"][\"MeUpdatedAccountResponseDto\"]>;\nexport type MfaEnrollmentRequiredEventData = Open<components[\"schemas\"][\"MfaEnrollmentRequiredEventDataDto\"]>;\nexport type MfaFactorEventData = Open<components[\"schemas\"][\"MfaFactorEventDataDto\"]>;\nexport type MfaRecoveryCodeUsedEventData = Open<components[\"schemas\"][\"MfaRecoveryCodeUsedEventDataDto\"]>;\nexport type MfaStepUpLockedEventData = Open<components[\"schemas\"][\"MfaStepUpLockedEventDataDto\"]>;\nexport type MfaStepUpSucceededEventData = Open<components[\"schemas\"][\"MfaStepUpSucceededEventDataDto\"]>;\nexport type MyTenants = Open<components[\"schemas\"][\"MyTenantsResponseDto\"]>;\nexport type NotificationTest = Open<components[\"schemas\"][\"NotificationTestResponseDto\"]>;\nexport type OAuthToken = Open<components[\"schemas\"][\"OAuthTokenResponseDto\"]>;\nexport type OpenIdConfiguration = Open<components[\"schemas\"][\"OpenIdConfigurationDto\"]>;\nexport type Pagination = Open<components[\"schemas\"][\"PaginationDto\"]>;\nexport type Permission = Open<components[\"schemas\"][\"PermissionDto\"]>;\nexport type PlatformTenantApiKey = Open<components[\"schemas\"][\"PlatformTenantApiKeyDto\"]>;\nexport type PlatformTenantApiKeyList = Open<components[\"schemas\"][\"PlatformTenantApiKeyListResponseDto\"]>;\nexport type PlatformUserStats = Open<components[\"schemas\"][\"PlatformUserStatsResponseDto\"]>;\nexport type ProviderCheck = Open<components[\"schemas\"][\"ProviderCheckDto\"]>;\nexport type ProviderDetail = Open<components[\"schemas\"][\"ProviderDetailDto\"]>;\nexport type ProviderListEntry = Open<components[\"schemas\"][\"ProviderListEntryDto\"]>;\nexport type PublicFactor = Open<components[\"schemas\"][\"PublicFactorDto\"]>;\nexport type RecoveryCodes = Open<components[\"schemas\"][\"RecoveryCodesResponseDto\"]>;\nexport type ReplayWebhookEvent = Open<components[\"schemas\"][\"ReplayWebhookEventResponseDto\"]>;\nexport type RequireMfaReenrollment = Open<components[\"schemas\"][\"RequireMfaReenrollmentResponseDto\"]>;\nexport type RoleList = Open<components[\"schemas\"][\"RoleListResponseDto\"]>;\nexport type RolePermissionEntry = Open<components[\"schemas\"][\"RolePermissionEntryDto\"]>;\nexport type Role = Open<components[\"schemas\"][\"RoleResponseDto\"]>;\nexport type RoleWithPermissions = Open<components[\"schemas\"][\"RoleWithPermissionsResponseDto\"]>;\nexport type RotateApiKey = Open<components[\"schemas\"][\"RotateApiKeyResponseDto\"]>;\nexport type SetupRow = Open<components[\"schemas\"][\"SetupRowDto\"]>;\nexport type SetupRowFix = Open<components[\"schemas\"][\"SetupRowFixDto\"]>;\nexport type SetupRowTest = Open<components[\"schemas\"][\"SetupRowTestDto\"]>;\nexport type SetupStatus = Open<components[\"schemas\"][\"SetupStatusDto\"]>;\nexport type SignInTest = Open<components[\"schemas\"][\"SignInTestDto\"]>;\nexport type SignInTestEmailDelivery = Open<components[\"schemas\"][\"SignInTestEmailDeliveryDto\"]>;\nexport type SignInTestEmailNotice = Open<components[\"schemas\"][\"SignInTestEmailNoticeDto\"]>;\nexport type SignInTestError = Open<components[\"schemas\"][\"SignInTestErrorDto\"]>;\nexport type SignInTestIdentity = Open<components[\"schemas\"][\"SignInTestIdentityDto\"]>;\nexport type StartEnrollment = Open<components[\"schemas\"][\"StartEnrollmentResponseDto\"]>;\nexport type StatsSeriesPoint = Open<components[\"schemas\"][\"StatsSeriesPointDto\"]>;\nexport type StepUp = Open<components[\"schemas\"][\"StepUpResponseDto\"]>;\nexport type StepUpSendCode = Open<components[\"schemas\"][\"StepUpSendCodeResponseDto\"]>;\nexport type TenantApiKeyCreator = Open<components[\"schemas\"][\"TenantApiKeyCreatorDto\"]>;\nexport type TenantApiKey = Open<components[\"schemas\"][\"TenantApiKeyDto\"]>;\nexport type TenantApiKeyIntrospection = Open<components[\"schemas\"][\"TenantApiKeyIntrospectionDto\"]>;\nexport type TenantApiKeyList = Open<components[\"schemas\"][\"TenantApiKeyListResponseDto\"]>;\nexport type TenantApiKeyStatus = Open<components[\"schemas\"][\"TenantApiKeyStatusDto\"]>;\nexport type TenantApiKeyWithSecret = Open<components[\"schemas\"][\"TenantApiKeyWithSecretDto\"]>;\nexport type TenantApiKeysConfig = Open<components[\"schemas\"][\"TenantApiKeysConfigDto\"]>;\nexport type TenantEventData = Open<components[\"schemas\"][\"TenantEventDataDto\"]>;\nexport type TenantInviteAcceptedEventData = Open<components[\"schemas\"][\"TenantInviteAcceptedEventDataDto\"]>;\nexport type TenantInviteCreatedEventData = Open<components[\"schemas\"][\"TenantInviteCreatedEventDataDto\"]>;\nexport type TenantInviteList = Open<components[\"schemas\"][\"TenantInviteListResponseDto\"]>;\nexport type TenantInvite = Open<components[\"schemas\"][\"TenantInviteResponseDto\"]>;\nexport type TenantInviteRevokedEventData = Open<components[\"schemas\"][\"TenantInviteRevokedEventDataDto\"]>;\nexport type TenantList = Open<components[\"schemas\"][\"TenantListResponseDto\"]>;\nexport type TenantMemberAddedEventData = Open<components[\"schemas\"][\"TenantMemberAddedEventDataDto\"]>;\nexport type TenantMemberRemovedEventData = Open<components[\"schemas\"][\"TenantMemberRemovedEventDataDto\"]>;\nexport type TenantMemberRoleChangedEventData = Open<components[\"schemas\"][\"TenantMemberRoleChangedEventDataDto\"]>;\nexport type TenantMembershipForMe = Open<components[\"schemas\"][\"TenantMembershipForMeDto\"]>;\nexport type TenantMembershipList = Open<components[\"schemas\"][\"TenantMembershipListResponseDto\"]>;\nexport type TenantMembership = Open<components[\"schemas\"][\"TenantMembershipResponseDto\"]>;\nexport type Tenant = Open<components[\"schemas\"][\"TenantResponseDto\"]>;\nexport type TotpEnrollmentData = Open<components[\"schemas\"][\"TotpEnrollmentDataDto\"]>;\nexport type UnverifiedAccountExpiryRun = Open<components[\"schemas\"][\"UnverifiedAccountExpiryRunDto\"]>;\nexport type UnverifiedAccountExpiryStatus = Open<components[\"schemas\"][\"UnverifiedAccountExpiryStatusDto\"]>;\nexport type UserContactVerifiedEventData = Open<components[\"schemas\"][\"UserContactVerifiedEventDataDto\"]>;\nexport type UserDeletedEventData = Open<components[\"schemas\"][\"UserDeletedEventDataDto\"]>;\nexport type UserEmailVerifiedEventData = Open<components[\"schemas\"][\"UserEmailVerifiedEventDataDto\"]>;\nexport type UserEventData = Open<components[\"schemas\"][\"UserEventDataDto\"]>;\nexport type UserPasswordResetRequestedEventData = Open<components[\"schemas\"][\"UserPasswordResetRequestedEventDataDto\"]>;\nexport type UserRoleChangedEventData = Open<components[\"schemas\"][\"UserRoleChangedEventDataDto\"]>;\nexport type UserSigninEventData = Open<components[\"schemas\"][\"UserSigninEventDataDto\"]>;\nexport type UserSignupEventData = Open<components[\"schemas\"][\"UserSignupEventDataDto\"]>;\nexport type VerifyPrincipal = Open<components[\"schemas\"][\"VerifyPrincipalDto\"]>;\nexport type Verify = Open<components[\"schemas\"][\"VerifyResponseDto\"]>;\nexport type WebauthnConfig = Open<components[\"schemas\"][\"WebauthnConfigResponseDto\"]>;\nexport type WebauthnEnrollmentData = Open<components[\"schemas\"][\"WebauthnEnrollmentDataDto\"]>;\nexport type WebauthnOptions = Open<components[\"schemas\"][\"WebauthnOptionsResponseDto\"]>;\nexport type WebhookDeliveryAttempt = Open<components[\"schemas\"][\"WebhookDeliveryAttemptDto\"]>;\nexport type WebhookEndpoint = Open<components[\"schemas\"][\"WebhookEndpointDto\"]>;\nexport type WebhookEndpointWithSecret = Open<components[\"schemas\"][\"WebhookEndpointWithSecretDto\"]>;\nexport type WebhookEventDelivery = Open<components[\"schemas\"][\"WebhookEventDeliveryDto\"]>;\nexport type WebhookEventDetail = Open<components[\"schemas\"][\"WebhookEventDetailDto\"]>;\nexport type WebhookEvent = Open<components[\"schemas\"][\"WebhookEventDto\"]>;\nexport type WebhookEventTypeInfo = Open<components[\"schemas\"][\"WebhookEventTypeDto\"]>;\nexport type WebhookPagination = Open<components[\"schemas\"][\"WebhookPaginationDto\"]>;\n\n/** Params for `apps.list` (GET /v1/apps). */\nexport type AppListParams = NonNullable<paths[\"/v1/apps\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `apps.create` (POST /v1/apps). */\nexport type AppCreateParams = NonNullable<paths[\"/v1/apps\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `apps.update` (PATCH /v1/apps/{app_id}). */\nexport type AppUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `apiKeys.list` (GET /v1/apps/{app_id}/api-keys). */\nexport type ApiKeyListParams = NonNullable<paths[\"/v1/apps/{app_id}/api-keys\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `apiKeys.create` (POST /v1/apps/{app_id}/api-keys). */\nexport type ApiKeyCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/api-keys\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `apiKeys.rotate` (POST /v1/apps/{app_id}/api-keys/{key_id}/rotate). */\nexport type ApiKeyRotateParams = NonNullable<paths[\"/v1/apps/{app_id}/api-keys/{key_id}/rotate\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `auditLogs.list` (GET /v1/apps/{app_id}/audit-logs). */\nexport type AuditLogListParams = NonNullable<paths[\"/v1/apps/{app_id}/audit-logs\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `auditLogs.export` (GET /v1/apps/{app_id}/audit-logs/export). */\nexport type AuditLogExportParams = NonNullable<paths[\"/v1/apps/{app_id}/audit-logs/export\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `auditSink.replace` (PUT /v1/apps/{app_id}/audit-sink). */\nexport type AuditSinkReplaceParams = NonNullable<paths[\"/v1/apps/{app_id}/audit-sink\"][\"put\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `auditSink.update` (PATCH /v1/apps/{app_id}/audit-sink). */\nexport type AuditSinkUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/audit-sink\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `authConfig.update` (PATCH /v1/apps/{app_id}/auth-config). */\nexport type AuthConfigUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/auth-config\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `authConfig.providers.list`. */\nexport type AuthConfigProviderListResponse = Open<paths[\"/v1/apps/{app_id}/auth-config/providers\"][\"get\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `authConfig.providers.replace` (PUT /v1/apps/{app_id}/auth-config/providers/{provider}). */\nexport type AuthConfigProviderReplaceParams = NonNullable<paths[\"/v1/apps/{app_id}/auth-config/providers/{provider}\"][\"put\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `authConfig.providers.update` (PATCH /v1/apps/{app_id}/auth-config/providers/{provider}). */\nexport type AuthConfigProviderUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/auth-config/providers/{provider}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `clone` (POST /v1/apps/{app_id}/clone). */\nexport type CloneParams = NonNullable<paths[\"/v1/apps/{app_id}/clone\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `credentials.list` (GET /v1/apps/{app_id}/credentials). */\nexport type CredentialListParams = NonNullable<paths[\"/v1/apps/{app_id}/credentials\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `credentials.create` (POST /v1/apps/{app_id}/credentials). */\nexport type CredentialCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/credentials\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `credentials.update` (PATCH /v1/apps/{app_id}/credentials/{client_id}). */\nexport type CredentialUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/credentials/{client_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `credentials.updateScopes` (PUT /v1/apps/{app_id}/credentials/{client_id}/scopes). */\nexport type CredentialUpdateScopesParams = NonNullable<paths[\"/v1/apps/{app_id}/credentials/{client_id}/scopes\"][\"put\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `credentials.updateScopes`. */\nexport type CredentialUpdateScopesResponse = Open<paths[\"/v1/apps/{app_id}/credentials/{client_id}/scopes\"][\"put\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `customDomains.create` (POST /v1/apps/{app_id}/custom-domains). */\nexport type CustomDomainCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/custom-domains\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `customDomains.apply` (POST /v1/apps/{app_id}/custom-domains/{domain_id}/apply). */\nexport type CustomDomainApplyParams = NonNullable<paths[\"/v1/apps/{app_id}/custom-domains/{domain_id}/apply\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `customDomains.export` (GET /v1/apps/{app_id}/custom-domains/{domain_id}/export). */\nexport type CustomDomainExportParams = NonNullable<paths[\"/v1/apps/{app_id}/custom-domains/{domain_id}/export\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `endUsers.list` (GET /v1/apps/{app_id}/end-users). */\nexport type EndUserListParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `endUsers.bulkDelete` (POST /v1/apps/{app_id}/end-users/bulk-delete). */\nexport type EndUserBulkDeleteParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/bulk-delete\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `endUsers.bulkRevokeSessions` (POST /v1/apps/{app_id}/end-users/bulk-revoke-sessions). */\nexport type EndUserBulkRevokeSessionsParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/bulk-revoke-sessions\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `endUsers.bulkUpdateRole` (POST /v1/apps/{app_id}/end-users/bulk-update-role). */\nexport type EndUserBulkUpdateRoleParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/bulk-update-role\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `endUsers.bulkUpdateStatus` (POST /v1/apps/{app_id}/end-users/bulk-update-status). */\nexport type EndUserBulkUpdateStatusParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/bulk-update-status\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `endUsers.export` (GET /v1/apps/{app_id}/end-users/export). */\nexport type EndUserExportParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/export\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `endUsers.invites.list` (GET /v1/apps/{app_id}/end-users/invites). */\nexport type EndUserInviteListParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/invites\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `endUsers.invites.create` (POST /v1/apps/{app_id}/end-users/invites). */\nexport type EndUserInviteCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/invites\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `endUsers.update` (PATCH /v1/apps/{app_id}/end-users/{user_id}). */\nexport type EndUserUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/{user_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `endUsers.contacts.create` (POST /v1/apps/{app_id}/end-users/{user_id}/contacts). */\nexport type EndUserContactCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/{user_id}/contacts\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `endUsers.updateRole` (PATCH /v1/apps/{app_id}/end-users/{user_id}/role). */\nexport type EndUserUpdateRoleParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/{user_id}/role\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `endUsers.updateStatus` (PATCH /v1/apps/{app_id}/end-users/{user_id}/status). */\nexport type EndUserUpdateStatusParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/{user_id}/status\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `members.list` (GET /v1/apps/{app_id}/members). */\nexport type MemberListParams = NonNullable<paths[\"/v1/apps/{app_id}/members\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `notificationSettings.update` (PATCH /v1/apps/{app_id}/notification-settings). */\nexport type NotificationSettingUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/notification-settings\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `permissions.list`. */\nexport type AppScopedPermissionListResponse = Open<paths[\"/v1/apps/{app_id}/permissions\"][\"get\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `permissions.create` (POST /v1/apps/{app_id}/permissions). */\nexport type AppScopedPermissionCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/permissions\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `roles.list` (GET /v1/apps/{app_id}/roles). */\nexport type AppScopedRoleListParams = NonNullable<paths[\"/v1/apps/{app_id}/roles\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `roles.create` (POST /v1/apps/{app_id}/roles). */\nexport type AppScopedRoleCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/roles\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `roles.assign` (POST /v1/apps/{app_id}/roles/assign). */\nexport type RoleAssignParams = NonNullable<paths[\"/v1/apps/{app_id}/roles/assign\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `roles.permissions.list`. */\nexport type RolePermissionListResponse = Open<paths[\"/v1/apps/{app_id}/roles/permissions\"][\"get\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `roles.update` (PATCH /v1/apps/{app_id}/roles/{role_name}). */\nexport type AppScopedRoleUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/roles/{role_name}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `roles.updatePermissions` (PUT /v1/apps/{app_id}/roles/{role_name}/permissions). */\nexport type AppScopedRoleUpdatePermissionsParams = NonNullable<paths[\"/v1/apps/{app_id}/roles/{role_name}/permissions\"][\"put\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `roles.updatePermissions`. */\nexport type AppScopedRoleUpdatePermissionsResponse = Open<paths[\"/v1/apps/{app_id}/roles/{role_name}/permissions\"][\"put\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `signInTests.create` (POST /v1/apps/{app_id}/sign-in-tests). */\nexport type SignInTestCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/sign-in-tests\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `updateStatus` (PATCH /v1/apps/{app_id}/status). */\nexport type UpdateStatusParams = NonNullable<paths[\"/v1/apps/{app_id}/status\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenantApiKeys.list` (GET /v1/apps/{app_id}/tenant-api-keys). */\nexport type AppScopedTenantApiKeyListParams = NonNullable<paths[\"/v1/apps/{app_id}/tenant-api-keys\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `tenantApiKeys.config.update` (PUT /v1/apps/{app_id}/tenant-api-keys/config). */\nexport type AppScopedTenantApiKeyConfigUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/tenant-api-keys/config\"][\"put\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.list` (GET /v1/apps/{app_id}/tenants). */\nexport type AppScopedTenantListParams = NonNullable<paths[\"/v1/apps/{app_id}/tenants\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `tenants.create` (POST /v1/apps/{app_id}/tenants). */\nexport type AppScopedTenantCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/tenants\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.update` (PATCH /v1/apps/{app_id}/tenants/{tenant_id}). */\nexport type AppScopedTenantUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/tenants/{tenant_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.invites.list` (GET /v1/apps/{app_id}/tenants/{tenant_id}/invites). */\nexport type AppScopedTenantInviteListParams = NonNullable<paths[\"/v1/apps/{app_id}/tenants/{tenant_id}/invites\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `tenants.invites.create` (POST /v1/apps/{app_id}/tenants/{tenant_id}/invites). */\nexport type AppScopedTenantInviteCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/tenants/{tenant_id}/invites\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.members.list` (GET /v1/apps/{app_id}/tenants/{tenant_id}/members). */\nexport type AppScopedTenantMemberListParams = NonNullable<paths[\"/v1/apps/{app_id}/tenants/{tenant_id}/members\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `tenants.members.create` (POST /v1/apps/{app_id}/tenants/{tenant_id}/members). */\nexport type AppScopedTenantMemberCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/tenants/{tenant_id}/members\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.members.update` (PATCH /v1/apps/{app_id}/tenants/{tenant_id}/members/{account_id}). */\nexport type AppScopedTenantMemberUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/tenants/{tenant_id}/members/{account_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `unverifiedAccountExpiry.run` (POST /v1/apps/{app_id}/unverified-account-expiry/run). */\nexport type UnverifiedAccountExpiryRunParams = NonNullable<paths[\"/v1/apps/{app_id}/unverified-account-expiry/run\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `webauthnConfig.update` (PUT /v1/apps/{app_id}/webauthn-config). */\nexport type WebauthnConfigUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/webauthn-config\"][\"put\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `webhooks.endpoints.create` (POST /v1/apps/{app_id}/webhooks/endpoints). */\nexport type WebhookEndpointCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/webhooks/endpoints\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `webhooks.endpoints.update` (PATCH /v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}). */\nexport type WebhookEndpointUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `webhooks.endpoints.rotateSecret` (POST /v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}/rotate-secret). */\nexport type WebhookEndpointRotateSecretParams = NonNullable<paths[\"/v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}/rotate-secret\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `webhooks.endpoints.test` (POST /v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}/test). */\nexport type WebhookEndpointTestParams = NonNullable<paths[\"/v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}/test\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `webhooks.events.list` (GET /v1/apps/{app_id}/webhooks/events). */\nexport type WebhookEventListParams = NonNullable<paths[\"/v1/apps/{app_id}/webhooks/events\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `webhooks.events.replay` (POST /v1/apps/{app_id}/webhooks/events/{event_id}/replay). */\nexport type WebhookEventReplayParams = NonNullable<paths[\"/v1/apps/{app_id}/webhooks/events/{event_id}/replay\"][\"post\"][\"parameters\"][\"query\"]>;\n/** Params for `stats.me` (GET /v1/stats/me). */\nexport type StatsMeParams = NonNullable<paths[\"/v1/stats/me\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `stats.retrieve` (GET /v1/workspaces/{workspace_id}/stats). */\nexport type StatsRetrieveParams = NonNullable<paths[\"/v1/workspaces/{workspace_id}/stats\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Response of `permissions.list`. */\nexport type ConsumerScopedPermissionListResponse = Open<paths[\"/{app_slug}/v1/admin/permissions\"][\"get\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `permissions.create` (POST /{app_slug}/v1/admin/permissions). */\nexport type ConsumerScopedPermissionCreateParams = NonNullable<paths[\"/{app_slug}/v1/admin/permissions\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `roles.list` (GET /{app_slug}/v1/admin/roles). */\nexport type ConsumerScopedRoleListParams = NonNullable<paths[\"/{app_slug}/v1/admin/roles\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `roles.create` (POST /{app_slug}/v1/admin/roles). */\nexport type ConsumerScopedRoleCreateParams = NonNullable<paths[\"/{app_slug}/v1/admin/roles\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `roles.update` (PATCH /{app_slug}/v1/admin/roles/{role_name}). */\nexport type ConsumerScopedRoleUpdateParams = NonNullable<paths[\"/{app_slug}/v1/admin/roles/{role_name}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `roles.updatePermissions` (PUT /{app_slug}/v1/admin/roles/{role_name}/permissions). */\nexport type ConsumerScopedRoleUpdatePermissionsParams = NonNullable<paths[\"/{app_slug}/v1/admin/roles/{role_name}/permissions\"][\"put\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `roles.updatePermissions`. */\nexport type ConsumerScopedRoleUpdatePermissionsResponse = Open<paths[\"/{app_slug}/v1/admin/roles/{role_name}/permissions\"][\"put\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `users.list` (GET /{app_slug}/v1/admin/users). */\nexport type UserListParams = NonNullable<paths[\"/{app_slug}/v1/admin/users\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `users.create` (POST /{app_slug}/v1/admin/users). */\nexport type UserCreateParams = NonNullable<paths[\"/{app_slug}/v1/admin/users\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `users.update` (PATCH /{app_slug}/v1/admin/users/{user_id}). */\nexport type UserUpdateParams = NonNullable<paths[\"/{app_slug}/v1/admin/users/{user_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `users.updateRole` (PATCH /{app_slug}/v1/admin/users/{user_id}/role). */\nexport type UserUpdateRoleParams = NonNullable<paths[\"/{app_slug}/v1/admin/users/{user_id}/role\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `users.updateStatus` (PATCH /{app_slug}/v1/admin/users/{user_id}/status). */\nexport type UserUpdateStatusParams = NonNullable<paths[\"/{app_slug}/v1/admin/users/{user_id}/status\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `acceptInvite` (POST /{app_slug}/v1/auth/accept-invite). */\nexport type AcceptInviteParams = NonNullable<paths[\"/{app_slug}/v1/auth/accept-invite\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `acceptInvite`. */\nexport type AcceptInviteResponse = Open<paths[\"/{app_slug}/v1/auth/accept-invite\"][\"post\"][\"responses\"][201][\"content\"][\"application/json\"]>;\n/** Params for `acceptTenantInvite` (POST /{app_slug}/v1/auth/accept-tenant-invite). */\nexport type AcceptTenantInviteParams = NonNullable<paths[\"/{app_slug}/v1/auth/accept-tenant-invite\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `logout` (POST /{app_slug}/v1/auth/logout). */\nexport type LogoutParams = NonNullable<paths[\"/{app_slug}/v1/auth/logout\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `mfa.enroll` (POST /{app_slug}/v1/auth/mfa/enroll). */\nexport type MfaEnrollParams = NonNullable<paths[\"/{app_slug}/v1/auth/mfa/enroll\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `mfa.verifyEnrollment` (POST /{app_slug}/v1/auth/mfa/enroll/verify). */\nexport type MfaVerifyEnrollmentParams = NonNullable<paths[\"/{app_slug}/v1/auth/mfa/enroll/verify\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `mfa.recover` (POST /{app_slug}/v1/auth/mfa/recover). */\nexport type MfaRecoverParams = NonNullable<paths[\"/{app_slug}/v1/auth/mfa/recover\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `mfa.sendCode` (POST /{app_slug}/v1/auth/mfa/send-code). */\nexport type MfaSendCodeParams = NonNullable<paths[\"/{app_slug}/v1/auth/mfa/send-code\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `mfa.verify` (POST /{app_slug}/v1/auth/mfa/verify). */\nexport type MfaVerifyParams = NonNullable<paths[\"/{app_slug}/v1/auth/mfa/verify\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `mfa.webauthn.options` (POST /{app_slug}/v1/auth/mfa/webauthn/options). */\nexport type MfaWebauthnOptionsParams = NonNullable<paths[\"/{app_slug}/v1/auth/mfa/webauthn/options\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `exchangeProviderCode` (POST /{app_slug}/v1/auth/oauth/exchange). */\nexport type ExchangeProviderCodeParams = NonNullable<paths[\"/{app_slug}/v1/auth/oauth/exchange\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `signinWithProvider` (POST /{app_slug}/v1/auth/oauth/{provider}). */\nexport type SigninWithProviderParams = NonNullable<paths[\"/{app_slug}/v1/auth/oauth/{provider}\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `signinWithProvider`. */\nexport type SigninWithProviderResponse = Open<paths[\"/{app_slug}/v1/auth/oauth/{provider}\"][\"post\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `passkey.options` (POST /{app_slug}/v1/auth/passkey/options). */\nexport type PasskeyOptionsParams = NonNullable<paths[\"/{app_slug}/v1/auth/passkey/options\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `passkey.verify` (POST /{app_slug}/v1/auth/passkey/verify). */\nexport type PasskeyVerifyParams = NonNullable<paths[\"/{app_slug}/v1/auth/passkey/verify\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `refresh` (POST /{app_slug}/v1/auth/refresh). */\nexport type RefreshParams = NonNullable<paths[\"/{app_slug}/v1/auth/refresh\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `requestPasswordReset` (POST /{app_slug}/v1/auth/request-password-reset). */\nexport type RequestPasswordResetParams = NonNullable<paths[\"/{app_slug}/v1/auth/request-password-reset\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `requestVerification` (POST /{app_slug}/v1/auth/request-verification). */\nexport type RequestVerificationParams = NonNullable<paths[\"/{app_slug}/v1/auth/request-verification\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `resetPassword` (POST /{app_slug}/v1/auth/reset-password). */\nexport type ResetPasswordParams = NonNullable<paths[\"/{app_slug}/v1/auth/reset-password\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `sendPasswordResetEmail` (POST /{app_slug}/v1/auth/send-password-reset-email). */\nexport type SendPasswordResetEmailParams = NonNullable<paths[\"/{app_slug}/v1/auth/send-password-reset-email\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `sendVerificationEmail` (POST /{app_slug}/v1/auth/send-verification-email). */\nexport type SendVerificationEmailParams = NonNullable<paths[\"/{app_slug}/v1/auth/send-verification-email\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `signin` (POST /{app_slug}/v1/auth/signin). */\nexport type SigninParams = NonNullable<paths[\"/{app_slug}/v1/auth/signin\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `signin`. */\nexport type SigninResponse = Open<paths[\"/{app_slug}/v1/auth/signin\"][\"post\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `signup` (POST /{app_slug}/v1/auth/signup). */\nexport type SignupParams = NonNullable<paths[\"/{app_slug}/v1/auth/signup\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `signup`. */\nexport type SignupResponse = Open<paths[\"/{app_slug}/v1/auth/signup\"][\"post\"][\"responses\"][201][\"content\"][\"application/json\"]>;\n/** Params for `switchTenant` (POST /{app_slug}/v1/auth/switch-tenant). */\nexport type SwitchTenantParams = NonNullable<paths[\"/{app_slug}/v1/auth/switch-tenant\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `verifyEmail` (POST /{app_slug}/v1/auth/verify). */\nexport type VerifyEmailParams = NonNullable<paths[\"/{app_slug}/v1/auth/verify\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `verify.authorize` (POST /{app_slug}/v1/authorize). */\nexport type VerifyAuthorizeParams = NonNullable<paths[\"/{app_slug}/v1/authorize\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `verify.authorizeBatch` (POST /{app_slug}/v1/authorize/batch). */\nexport type VerifyAuthorizeBatchParams = NonNullable<paths[\"/{app_slug}/v1/authorize/batch\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `me.update` (PATCH /{app_slug}/v1/me). */\nexport type MeUpdateParams = NonNullable<paths[\"/{app_slug}/v1/me\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `me.uploadAvatar` (POST /{app_slug}/v1/me/avatar). */\nexport type MeUploadAvatarParams = { /** PNG, JPEG, or WEBP image, ≤2 MB. */ file: Blob };\n/** Params for `me.changePassword` (POST /{app_slug}/v1/me/change-password). */\nexport type MeChangePasswordParams = NonNullable<paths[\"/{app_slug}/v1/me/change-password\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `me.contacts.create` (POST /{app_slug}/v1/me/contacts). */\nexport type MeContactCreateParams = NonNullable<paths[\"/{app_slug}/v1/me/contacts\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `me.mfa.factors.create` (POST /{app_slug}/v1/me/mfa/factors). */\nexport type MeMfaFactorCreateParams = NonNullable<paths[\"/{app_slug}/v1/me/mfa/factors\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `me.mfa.factors.verify` (POST /{app_slug}/v1/me/mfa/factors/{id}/verify). */\nexport type MeMfaFactorVerifyParams = NonNullable<paths[\"/{app_slug}/v1/me/mfa/factors/{id}/verify\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `me.mfa.stepUp.verify` (POST /{app_slug}/v1/me/mfa/step-up). */\nexport type MeMfaStepUpVerifyParams = NonNullable<paths[\"/{app_slug}/v1/me/mfa/step-up\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `me.mfa.stepUp.sendCode` (POST /{app_slug}/v1/me/mfa/step-up/send-code). */\nexport type MeMfaStepUpSendCodeParams = NonNullable<paths[\"/{app_slug}/v1/me/mfa/step-up/send-code\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `me.tenantInvites.accept` (POST /{app_slug}/v1/me/tenant-invites/accept). */\nexport type MeTenantInviteAcceptParams = NonNullable<paths[\"/{app_slug}/v1/me/tenant-invites/accept\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `oauth.introspect` (POST /{app_slug}/v1/oauth/introspect). */\nexport type OauthIntrospectParams = NonNullable<paths[\"/{app_slug}/v1/oauth/introspect\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `oauth.token` (POST /{app_slug}/v1/oauth/token). */\nexport type OauthTokenParams = NonNullable<paths[\"/{app_slug}/v1/oauth/token\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenantApiKeys.list` (GET /{app_slug}/v1/tenant-api-keys). */\nexport type ConsumerScopedTenantApiKeyListParams = NonNullable<paths[\"/{app_slug}/v1/tenant-api-keys\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `tenantApiKeys.create` (POST /{app_slug}/v1/tenant-api-keys). */\nexport type TenantApiKeyCreateParams = NonNullable<paths[\"/{app_slug}/v1/tenant-api-keys\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenantApiKeys.config.update` (PUT /{app_slug}/v1/tenant-api-keys/config). */\nexport type ConsumerScopedTenantApiKeyConfigUpdateParams = NonNullable<paths[\"/{app_slug}/v1/tenant-api-keys/config\"][\"put\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenantApiKeys.introspect` (POST /{app_slug}/v1/tenant-api-keys/introspect). */\nexport type TenantApiKeyIntrospectParams = NonNullable<paths[\"/{app_slug}/v1/tenant-api-keys/introspect\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenantApiKeys.rotate` (POST /{app_slug}/v1/tenant-api-keys/{key_id}/rotate). */\nexport type TenantApiKeyRotateParams = NonNullable<paths[\"/{app_slug}/v1/tenant-api-keys/{key_id}/rotate\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.list` (GET /{app_slug}/v1/tenants). */\nexport type ConsumerScopedTenantListParams = NonNullable<paths[\"/{app_slug}/v1/tenants\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `tenants.create` (POST /{app_slug}/v1/tenants). */\nexport type ConsumerScopedTenantCreateParams = NonNullable<paths[\"/{app_slug}/v1/tenants\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.update` (PATCH /{app_slug}/v1/tenants/{tenant_id}). */\nexport type ConsumerScopedTenantUpdateParams = NonNullable<paths[\"/{app_slug}/v1/tenants/{tenant_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.invites.list` (GET /{app_slug}/v1/tenants/{tenant_id}/invites). */\nexport type ConsumerScopedTenantInviteListParams = NonNullable<paths[\"/{app_slug}/v1/tenants/{tenant_id}/invites\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `tenants.invites.create` (POST /{app_slug}/v1/tenants/{tenant_id}/invites). */\nexport type ConsumerScopedTenantInviteCreateParams = NonNullable<paths[\"/{app_slug}/v1/tenants/{tenant_id}/invites\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.members.list` (GET /{app_slug}/v1/tenants/{tenant_id}/members). */\nexport type ConsumerScopedTenantMemberListParams = NonNullable<paths[\"/{app_slug}/v1/tenants/{tenant_id}/members\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `tenants.members.create` (POST /{app_slug}/v1/tenants/{tenant_id}/members). */\nexport type ConsumerScopedTenantMemberCreateParams = NonNullable<paths[\"/{app_slug}/v1/tenants/{tenant_id}/members\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.members.update` (PATCH /{app_slug}/v1/tenants/{tenant_id}/members/{account_id}). */\nexport type ConsumerScopedTenantMemberUpdateParams = NonNullable<paths[\"/{app_slug}/v1/tenants/{tenant_id}/members/{account_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `users.factors.create` (POST /{app_slug}/v1/users/{user_id}/factors). */\nexport type UserFactorCreateParams = NonNullable<paths[\"/{app_slug}/v1/users/{user_id}/factors\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `verify.token` (POST /{app_slug}/v1/verify). */\nexport type VerifyTokenParams = NonNullable<paths[\"/{app_slug}/v1/verify\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n","// Generated by scripts/gen-sdk.mjs from Specs/auth.json. Do not edit.\n\nimport { APIClient, createOpenAPIClient, PC_BASE_URL, type ClientOptions, type PollOptions as CorePollOptions, type RequestOptions as CoreRequestOptions } from \"@productcraft/core\";\nimport type { Client } from \"openapi-fetch\";\nimport type * as E from \"./errors.js\";\nimport type { paths } from \"./paths.js\";\nimport { AuthApp } from \"./resources.js\";\nimport { AuthBase, type AuthOptions } from \"../base.js\";\nimport * as T from \"./types.js\";\nimport type * as W from \"./webhooks.js\";\n\ndeclare const __PC_SDK_VERSION__: string | undefined;\nconst VERSION = typeof __PC_SDK_VERSION__ === \"string\" ? __PC_SDK_VERSION__ : \"0.0.0-dev\";\n\n/**\n * ProductCraft Auth API client (apps, end users, roles, sign-in flows, sessions, MFA and tenants). Every method is generated from the API's OpenAPI document.\n *\n * @example\n * ```ts\n * import { Auth } from \"@productcraft/auth\";\n * const auth = new Auth({ apiKey: process.env.PRODUCTCRAFT_API_KEY });\n * ```\n */\n\nexport class Auth extends AuthBase {\n #openapi?: Client<paths>;\n constructor(options: AuthOptions = {}) {\n const sdk = { name: \"auth\", version: VERSION };\n super(new APIClient(options, PC_BASE_URL.auth, sdk), options, (o: ClientOptions) => new APIClient(o, PC_BASE_URL.auth, sdk));\n }\n /** The typed `openapi-fetch` escape hatch over the same credential and base URL. It does not retry. */\n get client(): Client<paths> {\n return (this.#openapi ??= createOpenAPIClient<paths>(this._client));\n }\n /**\n * Scoped namespaces under `admin`: `admin.app(…)`.\n */\n get admin(): { app(appId: string): AuthApp } {\n const client = this._client;\n return {\n app: (appId: string) => new AuthApp(client, { app_id: appId }),\n };\n }\n /**\n * Alias of `auth.admin.app(…)`.\n * @param appId - `{app_id}`\n */\n app(appId: string): AuthApp {\n return new AuthApp(this._client, { app_id: appId });\n }\n}\n\ntype __RequestOptions = CoreRequestOptions;\ntype __PollOptions = CorePollOptions;\ntype __ApiKeyStatus = T.ApiKeyStatus;\ntype __AppEnvironment = T.AppEnvironment;\ntype __AppStatus = T.AppStatus;\ntype __ApplyPlanAction = T.ApplyPlanAction;\ntype __ApplyPlanResult = T.ApplyPlanResult;\ntype __AuditSinkAttemptKind = T.AuditSinkAttemptKind;\ntype __AuditSinkState = T.AuditSinkState;\ntype __AuthStatsMetric = T.AuthStatsMetric;\ntype __BotProtectionProvider = T.BotProtectionProvider;\ntype __ContactType = T.ContactType;\ntype __CustomDomainApplyWarning = T.CustomDomainApplyWarning;\ntype __CustomDomainStatus = T.CustomDomainStatus;\ntype __DnsConflictSeverity = T.DnsConflictSeverity;\ntype __DnsProvider = T.DnsProvider;\ntype __DnsRecordPurpose = T.DnsRecordPurpose;\ntype __DnsRecordState = T.DnsRecordState;\ntype __DnsRecordType = T.DnsRecordType;\ntype __EndUserStatus = T.EndUserStatus;\ntype __EnrollmentType = T.EnrollmentType;\ntype __ImportJobStatus = T.ImportJobStatus;\ntype __IntrospectedTokenType = T.IntrospectedTokenType;\ntype __JwkUse = T.JwkUse;\ntype __MfaPolicy = T.MfaPolicy;\ntype __OAuthLinkPolicy = T.OAuthLinkPolicy;\ntype __OAuthProvider = T.OAuthProvider;\ntype __PasswordBreachCheck = T.PasswordBreachCheck;\ntype __ProviderBlockedReason = T.ProviderBlockedReason;\ntype __ProviderCheckResult = T.ProviderCheckResult;\ntype __ProviderStatus = T.ProviderStatus;\ntype __SenderDomainStatus = T.SenderDomainStatus;\ntype __SenderSource = T.SenderSource;\ntype __SetupRowState = T.SetupRowState;\ntype __SignInResult = T.SignInResult;\ntype __SignInTestEmailNoticeCode = T.SignInTestEmailNoticeCode;\ntype __SignInTestMethod = T.SignInTestMethod;\ntype __SignInTestOutcome = T.SignInTestOutcome;\ntype __SignInTestState = T.SignInTestState;\ntype __StatsGranularity = T.StatsGranularity;\ntype __StatsWindow = T.StatsWindow;\ntype __TenantApiKeyAdminState = T.TenantApiKeyAdminState;\ntype __TenantApiKeyEffectiveStatus = T.TenantApiKeyEffectiveStatus;\ntype __TenantApiKeyEnv = T.TenantApiKeyEnv;\ntype __TenantApiKeyManagementLane = T.TenantApiKeyManagementLane;\ntype __TenantApiKeyRevokeReason = T.TenantApiKeyRevokeReason;\ntype __TenantApiKeyState = T.TenantApiKeyState;\ntype __TenantInviteStatus = T.TenantInviteStatus;\ntype __TenantStatus = T.TenantStatus;\ntype __TokenType = T.TokenType;\ntype __UserCreatedVia = T.UserCreatedVia;\ntype __UserDeletedReason = T.UserDeletedReason;\ntype __UserDeletedVia = T.UserDeletedVia;\ntype __WebhookAttemptTrigger = T.WebhookAttemptTrigger;\ntype __WebhookEndpointDisabledReason = T.WebhookEndpointDisabledReason;\ntype __WebhookEndpointStatus = T.WebhookEndpointStatus;\ntype __WebhookEventStatus = T.WebhookEventStatus;\ntype __WebhookEventType = T.WebhookEventType;\ntype __AcceptedTenantInvite = T.AcceptedTenantInvite;\ntype __AccountContact = T.AccountContact;\ntype __AccountContactList = T.AccountContactList;\ntype __AddMember = T.AddMember;\ntype __AdminProvisionFactor = T.AdminProvisionFactor;\ntype __ApiKeyList = T.ApiKeyList;\ntype __ApiKeySummary = T.ApiKeySummary;\ntype __AppList = T.AppList;\ntype __AppMemberList = T.AppMemberList;\ntype __AppMemberSummary = T.AppMemberSummary;\ntype __AppMembership = T.AppMembership;\ntype __AppNotificationSettings = T.AppNotificationSettings;\ntype __AppPermissionCatalogEntry = T.AppPermissionCatalogEntry;\ntype __App = T.App;\ntype __AppSlugChangedEventData = T.AppSlugChangedEventData;\ntype __ApplyConflict = T.ApplyConflict;\ntype __ApplyCounts = T.ApplyCounts;\ntype __ApplyPlanItem = T.ApplyPlanItem;\ntype __AuditLogEntry = T.AuditLogEntry;\ntype __AuditLogList = T.AuditLogList;\ntype __AuditSink = T.AuditSink;\ntype __AuditSinkTestResult = T.AuditSinkTestResult;\ntype __AuditSinkWithSecret = T.AuditSinkWithSecret;\ntype __AuthConfig = T.AuthConfig;\ntype __AuthStatsInWindow = T.AuthStatsInWindow;\ntype __AuthStatsSeries = T.AuthStatsSeries;\ntype __AuthStatsTotals = T.AuthStatsTotals;\ntype __AuthWorkspaceStats = T.AuthWorkspaceStats;\ntype __AuthorizeBatch = T.AuthorizeBatch;\ntype __AuthorizeBatchResult = T.AuthorizeBatchResult;\ntype __Authorize = T.Authorize;\ntype __AvatarUrl = T.AvatarUrl;\ntype __BotProtection = T.BotProtection;\ntype __BulkAffectedUsers = T.BulkAffectedUsers;\ntype __CloneApp = T.CloneApp;\ntype __ConfirmEnrollment = T.ConfirmEnrollment;\ntype __ConsumerAddMember = T.ConsumerAddMember;\ntype __ConsumerAdminCreatedUser = T.ConsumerAdminCreatedUser;\ntype __ConsumerAdminEndUser = T.ConsumerAdminEndUser;\ntype __ConsumerAdminEndUserList = T.ConsumerAdminEndUserList;\ntype __ConsumerAdminPermission = T.ConsumerAdminPermission;\ntype __ConsumerAdminPermissionListEntry = T.ConsumerAdminPermissionListEntry;\ntype __ConsumerAdminRoleAssignment = T.ConsumerAdminRoleAssignment;\ntype __ConsumerCodeDispatch = T.ConsumerCodeDispatch;\ntype __ConsumerCodeIssue = T.ConsumerCodeIssue;\ntype __ConsumerMfaChallengeFactor = T.ConsumerMfaChallengeFactor;\ntype __ConsumerMfaChallenge = T.ConsumerMfaChallenge;\ntype __ConsumerMfaEnrollVerify = T.ConsumerMfaEnrollVerify;\ntype __ConsumerMfaEnrollmentRequired = T.ConsumerMfaEnrollmentRequired;\ntype __ConsumerMfaSendCode = T.ConsumerMfaSendCode;\ntype __ConsumerRoleList = T.ConsumerRoleList;\ntype __ConsumerRolePermissionEntry = T.ConsumerRolePermissionEntry;\ntype __ConsumerRole = T.ConsumerRole;\ntype __ConsumerRoleWithPermissions = T.ConsumerRoleWithPermissions;\ntype __ConsumerTenantList = T.ConsumerTenantList;\ntype __ConsumerTenantMembershipList = T.ConsumerTenantMembershipList;\ntype __ConsumerTenantMembership = T.ConsumerTenantMembership;\ntype __ConsumerTenant = T.ConsumerTenant;\ntype __ConsumerToken = T.ConsumerToken;\ntype __ConsumerVerify = T.ConsumerVerify;\ntype __ConsumerWebauthnOptions = T.ConsumerWebauthnOptions;\ntype __CreateApiKey = T.CreateApiKey;\ntype __CreateTenantInvite = T.CreateTenantInvite;\ntype __CustomDomainApplyResult = T.CustomDomainApplyResult;\ntype __CustomDomainCallbackUrls = T.CustomDomainCallbackUrls;\ntype __CustomDomain = T.CustomDomain;\ntype __CustomDomainList = T.CustomDomainList;\ntype __CustomDomainRecord = T.CustomDomainRecord;\ntype __DnsConflict = T.DnsConflict;\ntype __DnsProviderRef = T.DnsProviderRef;\ntype __EffectiveSender = T.EffectiveSender;\ntype __EmailEnrollmentData = T.EmailEnrollmentData;\ntype __EndUserActionCount = T.EndUserActionCount;\ntype __EndUserActivityEntry = T.EndUserActivityEntry;\ntype __EndUserDetailInsights = T.EndUserDetailInsights;\ntype __EndUserFactorEntry = T.EndUserFactorEntry;\ntype __EndUserInsights = T.EndUserInsights;\ntype __EndUserInviteList = T.EndUserInviteList;\ntype __EndUserInvite = T.EndUserInvite;\ntype __EndUserList = T.EndUserList;\ntype __EndUserRoleAssignment = T.EndUserRoleAssignment;\ntype __EndUserSessionEntry = T.EndUserSessionEntry;\ntype __EndUserSummary = T.EndUserSummary;\ntype __EnforcedPermissions = T.EnforcedPermissions;\ntype __Exchange = T.Exchange;\ntype __FactorList = T.FactorList;\ntype __GrantableScope = T.GrantableScope;\ntype __IdpMfaEnrollmentRequired = T.IdpMfaEnrollmentRequired;\ntype __IdpToken = T.IdpToken;\ntype __ImportJobError = T.ImportJobError;\ntype __ImportJob = T.ImportJob;\ntype __InsightsMfa = T.InsightsMfa;\ntype __InsightsPasswordReset = T.InsightsPasswordReset;\ntype __InsightsSessions = T.InsightsSessions;\ntype __InsightsSignin = T.InsightsSignin;\ntype __InsightsUsers = T.InsightsUsers;\ntype __InsightsVerification = T.InsightsVerification;\ntype __Introspect = T.Introspect;\ntype __IntrospectionCreator = T.IntrospectionCreator;\ntype __IssuedVerificationCode = T.IssuedVerificationCode;\ntype __Jwk = T.Jwk;\ntype __Jwks = T.Jwks;\ntype __ListWebhookEndpoints = T.ListWebhookEndpoints;\ntype __ListWebhookEventTypes = T.ListWebhookEventTypes;\ntype __ListWebhookEvents = T.ListWebhookEvents;\ntype __M2mClientCreate = T.M2mClientCreate;\ntype __M2mClientDetail = T.M2mClientDetail;\ntype __M2mClientList = T.M2mClientList;\ntype __M2mClientSummary = T.M2mClientSummary;\ntype __M2mRotateSecret = T.M2mRotateSecret;\ntype __M2mScopeEntry = T.M2mScopeEntry;\ntype __MeActivityEntry = T.MeActivityEntry;\ntype __MeActivity = T.MeActivity;\ntype __MeContact = T.MeContact;\ntype __MeContacts = T.MeContacts;\ntype __MePermissions = T.MePermissions;\ntype __MeProfile = T.MeProfile;\ntype __MeSession = T.MeSession;\ntype __MeSessions = T.MeSessions;\ntype __MeUpdatedAccount = T.MeUpdatedAccount;\ntype __MfaEnrollmentRequiredEventData = T.MfaEnrollmentRequiredEventData;\ntype __MfaFactorEventData = T.MfaFactorEventData;\ntype __MfaRecoveryCodeUsedEventData = T.MfaRecoveryCodeUsedEventData;\ntype __MfaStepUpLockedEventData = T.MfaStepUpLockedEventData;\ntype __MfaStepUpSucceededEventData = T.MfaStepUpSucceededEventData;\ntype __MyTenants = T.MyTenants;\ntype __NotificationTest = T.NotificationTest;\ntype __OAuthToken = T.OAuthToken;\ntype __OpenIdConfiguration = T.OpenIdConfiguration;\ntype __Pagination = T.Pagination;\ntype __Permission = T.Permission;\ntype __PlatformTenantApiKey = T.PlatformTenantApiKey;\ntype __PlatformTenantApiKeyList = T.PlatformTenantApiKeyList;\ntype __PlatformUserStats = T.PlatformUserStats;\ntype __ProviderCheck = T.ProviderCheck;\ntype __ProviderDetail = T.ProviderDetail;\ntype __ProviderListEntry = T.ProviderListEntry;\ntype __PublicFactor = T.PublicFactor;\ntype __RecoveryCodes = T.RecoveryCodes;\ntype __ReplayWebhookEvent = T.ReplayWebhookEvent;\ntype __RequireMfaReenrollment = T.RequireMfaReenrollment;\ntype __RoleList = T.RoleList;\ntype __RolePermissionEntry = T.RolePermissionEntry;\ntype __Role = T.Role;\ntype __RoleWithPermissions = T.RoleWithPermissions;\ntype __RotateApiKey = T.RotateApiKey;\ntype __SetupRow = T.SetupRow;\ntype __SetupRowFix = T.SetupRowFix;\ntype __SetupRowTest = T.SetupRowTest;\ntype __SetupStatus = T.SetupStatus;\ntype __SignInTest = T.SignInTest;\ntype __SignInTestEmailDelivery = T.SignInTestEmailDelivery;\ntype __SignInTestEmailNotice = T.SignInTestEmailNotice;\ntype __SignInTestError = T.SignInTestError;\ntype __SignInTestIdentity = T.SignInTestIdentity;\ntype __StartEnrollment = T.StartEnrollment;\ntype __StatsSeriesPoint = T.StatsSeriesPoint;\ntype __StepUp = T.StepUp;\ntype __StepUpSendCode = T.StepUpSendCode;\ntype __TenantApiKeyCreator = T.TenantApiKeyCreator;\ntype __TenantApiKey = T.TenantApiKey;\ntype __TenantApiKeyIntrospection = T.TenantApiKeyIntrospection;\ntype __TenantApiKeyList = T.TenantApiKeyList;\ntype __TenantApiKeyStatus = T.TenantApiKeyStatus;\ntype __TenantApiKeyWithSecret = T.TenantApiKeyWithSecret;\ntype __TenantApiKeysConfig = T.TenantApiKeysConfig;\ntype __TenantEventData = T.TenantEventData;\ntype __TenantInviteAcceptedEventData = T.TenantInviteAcceptedEventData;\ntype __TenantInviteCreatedEventData = T.TenantInviteCreatedEventData;\ntype __TenantInviteList = T.TenantInviteList;\ntype __TenantInvite = T.TenantInvite;\ntype __TenantInviteRevokedEventData = T.TenantInviteRevokedEventData;\ntype __TenantList = T.TenantList;\ntype __TenantMemberAddedEventData = T.TenantMemberAddedEventData;\ntype __TenantMemberRemovedEventData = T.TenantMemberRemovedEventData;\ntype __TenantMemberRoleChangedEventData = T.TenantMemberRoleChangedEventData;\ntype __TenantMembershipForMe = T.TenantMembershipForMe;\ntype __TenantMembershipList = T.TenantMembershipList;\ntype __TenantMembership = T.TenantMembership;\ntype __Tenant = T.Tenant;\ntype __TotpEnrollmentData = T.TotpEnrollmentData;\ntype __UnverifiedAccountExpiryRun = T.UnverifiedAccountExpiryRun;\ntype __UnverifiedAccountExpiryStatus = T.UnverifiedAccountExpiryStatus;\ntype __UserContactVerifiedEventData = T.UserContactVerifiedEventData;\ntype __UserDeletedEventData = T.UserDeletedEventData;\ntype __UserEmailVerifiedEventData = T.UserEmailVerifiedEventData;\ntype __UserEventData = T.UserEventData;\ntype __UserPasswordResetRequestedEventData = T.UserPasswordResetRequestedEventData;\ntype __UserRoleChangedEventData = T.UserRoleChangedEventData;\ntype __UserSigninEventData = T.UserSigninEventData;\ntype __UserSignupEventData = T.UserSignupEventData;\ntype __VerifyPrincipal = T.VerifyPrincipal;\ntype __Verify = T.Verify;\ntype __WebauthnConfig = T.WebauthnConfig;\ntype __WebauthnEnrollmentData = T.WebauthnEnrollmentData;\ntype __WebauthnOptions = T.WebauthnOptions;\ntype __WebhookDeliveryAttempt = T.WebhookDeliveryAttempt;\ntype __WebhookEndpoint = T.WebhookEndpoint;\ntype __WebhookEndpointWithSecret = T.WebhookEndpointWithSecret;\ntype __WebhookEventDelivery = T.WebhookEventDelivery;\ntype __WebhookEventDetail = T.WebhookEventDetail;\ntype __WebhookEvent = T.WebhookEvent;\ntype __WebhookEventTypeInfo = T.WebhookEventTypeInfo;\ntype __WebhookPagination = T.WebhookPagination;\ntype __AppListParams = T.AppListParams;\ntype __AppCreateParams = T.AppCreateParams;\ntype __AppUpdateParams = T.AppUpdateParams;\ntype __ApiKeyListParams = T.ApiKeyListParams;\ntype __ApiKeyCreateParams = T.ApiKeyCreateParams;\ntype __ApiKeyRotateParams = T.ApiKeyRotateParams;\ntype __AuditLogListParams = T.AuditLogListParams;\ntype __AuditLogExportParams = T.AuditLogExportParams;\ntype __AuditSinkReplaceParams = T.AuditSinkReplaceParams;\ntype __AuditSinkUpdateParams = T.AuditSinkUpdateParams;\ntype __AuthConfigUpdateParams = T.AuthConfigUpdateParams;\ntype __AuthConfigProviderListResponse = T.AuthConfigProviderListResponse;\ntype __AuthConfigProviderReplaceParams = T.AuthConfigProviderReplaceParams;\ntype __AuthConfigProviderUpdateParams = T.AuthConfigProviderUpdateParams;\ntype __CloneParams = T.CloneParams;\ntype __CredentialListParams = T.CredentialListParams;\ntype __CredentialCreateParams = T.CredentialCreateParams;\ntype __CredentialUpdateParams = T.CredentialUpdateParams;\ntype __CredentialUpdateScopesParams = T.CredentialUpdateScopesParams;\ntype __CredentialUpdateScopesResponse = T.CredentialUpdateScopesResponse;\ntype __CustomDomainCreateParams = T.CustomDomainCreateParams;\ntype __CustomDomainApplyParams = T.CustomDomainApplyParams;\ntype __CustomDomainExportParams = T.CustomDomainExportParams;\ntype __EndUserListParams = T.EndUserListParams;\ntype __EndUserBulkDeleteParams = T.EndUserBulkDeleteParams;\ntype __EndUserBulkRevokeSessionsParams = T.EndUserBulkRevokeSessionsParams;\ntype __EndUserBulkUpdateRoleParams = T.EndUserBulkUpdateRoleParams;\ntype __EndUserBulkUpdateStatusParams = T.EndUserBulkUpdateStatusParams;\ntype __EndUserExportParams = T.EndUserExportParams;\ntype __EndUserInviteListParams = T.EndUserInviteListParams;\ntype __EndUserInviteCreateParams = T.EndUserInviteCreateParams;\ntype __EndUserUpdateParams = T.EndUserUpdateParams;\ntype __EndUserContactCreateParams = T.EndUserContactCreateParams;\ntype __EndUserUpdateRoleParams = T.EndUserUpdateRoleParams;\ntype __EndUserUpdateStatusParams = T.EndUserUpdateStatusParams;\ntype __MemberListParams = T.MemberListParams;\ntype __NotificationSettingUpdateParams = T.NotificationSettingUpdateParams;\ntype __AppScopedPermissionListResponse = T.AppScopedPermissionListResponse;\ntype __AppScopedPermissionCreateParams = T.AppScopedPermissionCreateParams;\ntype __AppScopedRoleListParams = T.AppScopedRoleListParams;\ntype __AppScopedRoleCreateParams = T.AppScopedRoleCreateParams;\ntype __RoleAssignParams = T.RoleAssignParams;\ntype __RolePermissionListResponse = T.RolePermissionListResponse;\ntype __AppScopedRoleUpdateParams = T.AppScopedRoleUpdateParams;\ntype __AppScopedRoleUpdatePermissionsParams = T.AppScopedRoleUpdatePermissionsParams;\ntype __AppScopedRoleUpdatePermissionsResponse = T.AppScopedRoleUpdatePermissionsResponse;\ntype __SignInTestCreateParams = T.SignInTestCreateParams;\ntype __UpdateStatusParams = T.UpdateStatusParams;\ntype __AppScopedTenantApiKeyListParams = T.AppScopedTenantApiKeyListParams;\ntype __AppScopedTenantApiKeyConfigUpdateParams = T.AppScopedTenantApiKeyConfigUpdateParams;\ntype __AppScopedTenantListParams = T.AppScopedTenantListParams;\ntype __AppScopedTenantCreateParams = T.AppScopedTenantCreateParams;\ntype __AppScopedTenantUpdateParams = T.AppScopedTenantUpdateParams;\ntype __AppScopedTenantInviteListParams = T.AppScopedTenantInviteListParams;\ntype __AppScopedTenantInviteCreateParams = T.AppScopedTenantInviteCreateParams;\ntype __AppScopedTenantMemberListParams = T.AppScopedTenantMemberListParams;\ntype __AppScopedTenantMemberCreateParams = T.AppScopedTenantMemberCreateParams;\ntype __AppScopedTenantMemberUpdateParams = T.AppScopedTenantMemberUpdateParams;\ntype __UnverifiedAccountExpiryRunParams = T.UnverifiedAccountExpiryRunParams;\ntype __WebauthnConfigUpdateParams = T.WebauthnConfigUpdateParams;\ntype __WebhookEndpointCreateParams = T.WebhookEndpointCreateParams;\ntype __WebhookEndpointUpdateParams = T.WebhookEndpointUpdateParams;\ntype __WebhookEndpointRotateSecretParams = T.WebhookEndpointRotateSecretParams;\ntype __WebhookEndpointTestParams = T.WebhookEndpointTestParams;\ntype __WebhookEventListParams = T.WebhookEventListParams;\ntype __WebhookEventReplayParams = T.WebhookEventReplayParams;\ntype __StatsMeParams = T.StatsMeParams;\ntype __StatsRetrieveParams = T.StatsRetrieveParams;\ntype __ConsumerScopedPermissionListResponse = T.ConsumerScopedPermissionListResponse;\ntype __ConsumerScopedPermissionCreateParams = T.ConsumerScopedPermissionCreateParams;\ntype __ConsumerScopedRoleListParams = T.ConsumerScopedRoleListParams;\ntype __ConsumerScopedRoleCreateParams = T.ConsumerScopedRoleCreateParams;\ntype __ConsumerScopedRoleUpdateParams = T.ConsumerScopedRoleUpdateParams;\ntype __ConsumerScopedRoleUpdatePermissionsParams = T.ConsumerScopedRoleUpdatePermissionsParams;\ntype __ConsumerScopedRoleUpdatePermissionsResponse = T.ConsumerScopedRoleUpdatePermissionsResponse;\ntype __UserListParams = T.UserListParams;\ntype __UserCreateParams = T.UserCreateParams;\ntype __UserUpdateParams = T.UserUpdateParams;\ntype __UserUpdateRoleParams = T.UserUpdateRoleParams;\ntype __UserUpdateStatusParams = T.UserUpdateStatusParams;\ntype __AcceptInviteParams = T.AcceptInviteParams;\ntype __AcceptInviteResponse = T.AcceptInviteResponse;\ntype __AcceptTenantInviteParams = T.AcceptTenantInviteParams;\ntype __LogoutParams = T.LogoutParams;\ntype __MfaEnrollParams = T.MfaEnrollParams;\ntype __MfaVerifyEnrollmentParams = T.MfaVerifyEnrollmentParams;\ntype __MfaRecoverParams = T.MfaRecoverParams;\ntype __MfaSendCodeParams = T.MfaSendCodeParams;\ntype __MfaVerifyParams = T.MfaVerifyParams;\ntype __MfaWebauthnOptionsParams = T.MfaWebauthnOptionsParams;\ntype __ExchangeProviderCodeParams = T.ExchangeProviderCodeParams;\ntype __SigninWithProviderParams = T.SigninWithProviderParams;\ntype __SigninWithProviderResponse = T.SigninWithProviderResponse;\ntype __PasskeyOptionsParams = T.PasskeyOptionsParams;\ntype __PasskeyVerifyParams = T.PasskeyVerifyParams;\ntype __RefreshParams = T.RefreshParams;\ntype __RequestPasswordResetParams = T.RequestPasswordResetParams;\ntype __RequestVerificationParams = T.RequestVerificationParams;\ntype __ResetPasswordParams = T.ResetPasswordParams;\ntype __SendPasswordResetEmailParams = T.SendPasswordResetEmailParams;\ntype __SendVerificationEmailParams = T.SendVerificationEmailParams;\ntype __SigninParams = T.SigninParams;\ntype __SigninResponse = T.SigninResponse;\ntype __SignupParams = T.SignupParams;\ntype __SignupResponse = T.SignupResponse;\ntype __SwitchTenantParams = T.SwitchTenantParams;\ntype __VerifyEmailParams = T.VerifyEmailParams;\ntype __VerifyAuthorizeParams = T.VerifyAuthorizeParams;\ntype __VerifyAuthorizeBatchParams = T.VerifyAuthorizeBatchParams;\ntype __MeUpdateParams = T.MeUpdateParams;\ntype __MeUploadAvatarParams = T.MeUploadAvatarParams;\ntype __MeChangePasswordParams = T.MeChangePasswordParams;\ntype __MeContactCreateParams = T.MeContactCreateParams;\ntype __MeMfaFactorCreateParams = T.MeMfaFactorCreateParams;\ntype __MeMfaFactorVerifyParams = T.MeMfaFactorVerifyParams;\ntype __MeMfaStepUpVerifyParams = T.MeMfaStepUpVerifyParams;\ntype __MeMfaStepUpSendCodeParams = T.MeMfaStepUpSendCodeParams;\ntype __MeTenantInviteAcceptParams = T.MeTenantInviteAcceptParams;\ntype __OauthIntrospectParams = T.OauthIntrospectParams;\ntype __OauthTokenParams = T.OauthTokenParams;\ntype __ConsumerScopedTenantApiKeyListParams = T.ConsumerScopedTenantApiKeyListParams;\ntype __TenantApiKeyCreateParams = T.TenantApiKeyCreateParams;\ntype __ConsumerScopedTenantApiKeyConfigUpdateParams = T.ConsumerScopedTenantApiKeyConfigUpdateParams;\ntype __TenantApiKeyIntrospectParams = T.TenantApiKeyIntrospectParams;\ntype __TenantApiKeyRotateParams = T.TenantApiKeyRotateParams;\ntype __ConsumerScopedTenantListParams = T.ConsumerScopedTenantListParams;\ntype __ConsumerScopedTenantCreateParams = T.ConsumerScopedTenantCreateParams;\ntype __ConsumerScopedTenantUpdateParams = T.ConsumerScopedTenantUpdateParams;\ntype __ConsumerScopedTenantInviteListParams = T.ConsumerScopedTenantInviteListParams;\ntype __ConsumerScopedTenantInviteCreateParams = T.ConsumerScopedTenantInviteCreateParams;\ntype __ConsumerScopedTenantMemberListParams = T.ConsumerScopedTenantMemberListParams;\ntype __ConsumerScopedTenantMemberCreateParams = T.ConsumerScopedTenantMemberCreateParams;\ntype __ConsumerScopedTenantMemberUpdateParams = T.ConsumerScopedTenantMemberUpdateParams;\ntype __UserFactorCreateParams = T.UserFactorCreateParams;\ntype __VerifyTokenParams = T.VerifyTokenParams;\ntype __ErrorCode = E.AuthErrorCode;\ntype __AppSlugChangedEvent = W.AppSlugChangedEvent;\ntype __TenantCreatedEvent = W.TenantCreatedEvent;\ntype __TenantDeletedEvent = W.TenantDeletedEvent;\ntype __TenantInviteAcceptedEvent = W.TenantInviteAcceptedEvent;\ntype __TenantInviteCreatedEvent = W.TenantInviteCreatedEvent;\ntype __TenantInviteRevokedEvent = W.TenantInviteRevokedEvent;\ntype __TenantMemberAddedEvent = W.TenantMemberAddedEvent;\ntype __TenantMemberRemovedEvent = W.TenantMemberRemovedEvent;\ntype __TenantMemberRoleChangedEvent = W.TenantMemberRoleChangedEvent;\ntype __TenantUpdatedEvent = W.TenantUpdatedEvent;\ntype __UserContactVerifiedEvent = W.UserContactVerifiedEvent;\ntype __UserDeactivatedEvent = W.UserDeactivatedEvent;\ntype __UserDeletedEvent = W.UserDeletedEvent;\ntype __UserEmailVerifiedEvent = W.UserEmailVerifiedEvent;\ntype __UserMfaEnrollmentRequiredEvent = W.UserMfaEnrollmentRequiredEvent;\ntype __UserMfaFactorDisabledEvent = W.UserMfaFactorDisabledEvent;\ntype __UserMfaFactorEnrolledEvent = W.UserMfaFactorEnrolledEvent;\ntype __UserMfaRecoveryCodeUsedEvent = W.UserMfaRecoveryCodeUsedEvent;\ntype __UserMfaReenrollmentRequiredEvent = W.UserMfaReenrollmentRequiredEvent;\ntype __UserMfaStepUpLockedEvent = W.UserMfaStepUpLockedEvent;\ntype __UserMfaStepUpSucceededEvent = W.UserMfaStepUpSucceededEvent;\ntype __UserPasswordResetCompletedEvent = W.UserPasswordResetCompletedEvent;\ntype __UserPasswordResetRequestedEvent = W.UserPasswordResetRequestedEvent;\ntype __UserReinstatedEvent = W.UserReinstatedEvent;\ntype __UserRoleChangedEvent = W.UserRoleChangedEvent;\ntype __UserSigninEvent = W.UserSigninEvent;\ntype __UserSignupEvent = W.UserSignupEvent;\ntype __UserSuspendedEvent = W.UserSuspendedEvent;\ntype __UnknownWebhookEvent = W.UnknownWebhookEvent;\ntype __UnwrapWebhookEvent = W.UnwrapWebhookEvent;\ntype __WebhookUnwrapParams = W.WebhookUnwrapParams;\n/** Public types: `Auth.AcceptedTenantInvite`, `Auth.AppListParams`, … */\nexport namespace Auth {\n export type RequestOptions = __RequestOptions;\n export type PollOptions = __PollOptions;\n export type ApiKeyStatus = __ApiKeyStatus;\n export const ApiKeyStatus = T.ApiKeyStatus;\n export type AppEnvironment = __AppEnvironment;\n export const AppEnvironment = T.AppEnvironment;\n export type AppStatus = __AppStatus;\n export const AppStatus = T.AppStatus;\n export type ApplyPlanAction = __ApplyPlanAction;\n export const ApplyPlanAction = T.ApplyPlanAction;\n export type ApplyPlanResult = __ApplyPlanResult;\n export const ApplyPlanResult = T.ApplyPlanResult;\n export type AuditSinkAttemptKind = __AuditSinkAttemptKind;\n export const AuditSinkAttemptKind = T.AuditSinkAttemptKind;\n export type AuditSinkState = __AuditSinkState;\n export const AuditSinkState = T.AuditSinkState;\n export type AuthStatsMetric = __AuthStatsMetric;\n export const AuthStatsMetric = T.AuthStatsMetric;\n export type BotProtectionProvider = __BotProtectionProvider;\n export const BotProtectionProvider = T.BotProtectionProvider;\n export type ContactType = __ContactType;\n export const ContactType = T.ContactType;\n export type CustomDomainApplyWarning = __CustomDomainApplyWarning;\n export const CustomDomainApplyWarning = T.CustomDomainApplyWarning;\n export type CustomDomainStatus = __CustomDomainStatus;\n export const CustomDomainStatus = T.CustomDomainStatus;\n export type DnsConflictSeverity = __DnsConflictSeverity;\n export const DnsConflictSeverity = T.DnsConflictSeverity;\n export type DnsProvider = __DnsProvider;\n export const DnsProvider = T.DnsProvider;\n export type DnsRecordPurpose = __DnsRecordPurpose;\n export const DnsRecordPurpose = T.DnsRecordPurpose;\n export type DnsRecordState = __DnsRecordState;\n export const DnsRecordState = T.DnsRecordState;\n export type DnsRecordType = __DnsRecordType;\n export const DnsRecordType = T.DnsRecordType;\n export type EndUserStatus = __EndUserStatus;\n export const EndUserStatus = T.EndUserStatus;\n export type EnrollmentType = __EnrollmentType;\n export const EnrollmentType = T.EnrollmentType;\n export type ImportJobStatus = __ImportJobStatus;\n export const ImportJobStatus = T.ImportJobStatus;\n export type IntrospectedTokenType = __IntrospectedTokenType;\n export const IntrospectedTokenType = T.IntrospectedTokenType;\n export type JwkUse = __JwkUse;\n export const JwkUse = T.JwkUse;\n export type MfaPolicy = __MfaPolicy;\n export const MfaPolicy = T.MfaPolicy;\n export type OAuthLinkPolicy = __OAuthLinkPolicy;\n export const OAuthLinkPolicy = T.OAuthLinkPolicy;\n export type OAuthProvider = __OAuthProvider;\n export const OAuthProvider = T.OAuthProvider;\n export type PasswordBreachCheck = __PasswordBreachCheck;\n export const PasswordBreachCheck = T.PasswordBreachCheck;\n export type ProviderBlockedReason = __ProviderBlockedReason;\n export const ProviderBlockedReason = T.ProviderBlockedReason;\n export type ProviderCheckResult = __ProviderCheckResult;\n export const ProviderCheckResult = T.ProviderCheckResult;\n export type ProviderStatus = __ProviderStatus;\n export const ProviderStatus = T.ProviderStatus;\n export type SenderDomainStatus = __SenderDomainStatus;\n export const SenderDomainStatus = T.SenderDomainStatus;\n export type SenderSource = __SenderSource;\n export const SenderSource = T.SenderSource;\n export type SetupRowState = __SetupRowState;\n export const SetupRowState = T.SetupRowState;\n export type SignInResult = __SignInResult;\n export const SignInResult = T.SignInResult;\n export type SignInTestEmailNoticeCode = __SignInTestEmailNoticeCode;\n export const SignInTestEmailNoticeCode = T.SignInTestEmailNoticeCode;\n export type SignInTestMethod = __SignInTestMethod;\n export const SignInTestMethod = T.SignInTestMethod;\n export type SignInTestOutcome = __SignInTestOutcome;\n export const SignInTestOutcome = T.SignInTestOutcome;\n export type SignInTestState = __SignInTestState;\n export const SignInTestState = T.SignInTestState;\n export type StatsGranularity = __StatsGranularity;\n export const StatsGranularity = T.StatsGranularity;\n export type StatsWindow = __StatsWindow;\n export const StatsWindow = T.StatsWindow;\n export type TenantApiKeyAdminState = __TenantApiKeyAdminState;\n export const TenantApiKeyAdminState = T.TenantApiKeyAdminState;\n export type TenantApiKeyEffectiveStatus = __TenantApiKeyEffectiveStatus;\n export const TenantApiKeyEffectiveStatus = T.TenantApiKeyEffectiveStatus;\n export type TenantApiKeyEnv = __TenantApiKeyEnv;\n export const TenantApiKeyEnv = T.TenantApiKeyEnv;\n export type TenantApiKeyManagementLane = __TenantApiKeyManagementLane;\n export const TenantApiKeyManagementLane = T.TenantApiKeyManagementLane;\n export type TenantApiKeyRevokeReason = __TenantApiKeyRevokeReason;\n export const TenantApiKeyRevokeReason = T.TenantApiKeyRevokeReason;\n export type TenantApiKeyState = __TenantApiKeyState;\n export const TenantApiKeyState = T.TenantApiKeyState;\n export type TenantInviteStatus = __TenantInviteStatus;\n export const TenantInviteStatus = T.TenantInviteStatus;\n export type TenantStatus = __TenantStatus;\n export const TenantStatus = T.TenantStatus;\n export type TokenType = __TokenType;\n export const TokenType = T.TokenType;\n export type UserCreatedVia = __UserCreatedVia;\n export const UserCreatedVia = T.UserCreatedVia;\n export type UserDeletedReason = __UserDeletedReason;\n export const UserDeletedReason = T.UserDeletedReason;\n export type UserDeletedVia = __UserDeletedVia;\n export const UserDeletedVia = T.UserDeletedVia;\n export type WebhookAttemptTrigger = __WebhookAttemptTrigger;\n export const WebhookAttemptTrigger = T.WebhookAttemptTrigger;\n export type WebhookEndpointDisabledReason = __WebhookEndpointDisabledReason;\n export const WebhookEndpointDisabledReason = T.WebhookEndpointDisabledReason;\n export type WebhookEndpointStatus = __WebhookEndpointStatus;\n export const WebhookEndpointStatus = T.WebhookEndpointStatus;\n export type WebhookEventStatus = __WebhookEventStatus;\n export const WebhookEventStatus = T.WebhookEventStatus;\n export type WebhookEventType = __WebhookEventType;\n export const WebhookEventType = T.WebhookEventType;\n export type AcceptedTenantInvite = __AcceptedTenantInvite;\n export type AccountContact = __AccountContact;\n export type AccountContactList = __AccountContactList;\n export type AddMember = __AddMember;\n export type AdminProvisionFactor = __AdminProvisionFactor;\n export type ApiKeyList = __ApiKeyList;\n export type ApiKeySummary = __ApiKeySummary;\n export type AppList = __AppList;\n export type AppMemberList = __AppMemberList;\n export type AppMemberSummary = __AppMemberSummary;\n export type AppMembership = __AppMembership;\n export type AppNotificationSettings = __AppNotificationSettings;\n export type AppPermissionCatalogEntry = __AppPermissionCatalogEntry;\n export type App = __App;\n export type AppSlugChangedEventData = __AppSlugChangedEventData;\n export type ApplyConflict = __ApplyConflict;\n export type ApplyCounts = __ApplyCounts;\n export type ApplyPlanItem = __ApplyPlanItem;\n export type AuditLogEntry = __AuditLogEntry;\n export type AuditLogList = __AuditLogList;\n export type AuditSink = __AuditSink;\n export type AuditSinkTestResult = __AuditSinkTestResult;\n export type AuditSinkWithSecret = __AuditSinkWithSecret;\n export type AuthConfig = __AuthConfig;\n export type AuthStatsInWindow = __AuthStatsInWindow;\n export type AuthStatsSeries = __AuthStatsSeries;\n export type AuthStatsTotals = __AuthStatsTotals;\n export type AuthWorkspaceStats = __AuthWorkspaceStats;\n export type AuthorizeBatch = __AuthorizeBatch;\n export type AuthorizeBatchResult = __AuthorizeBatchResult;\n export type Authorize = __Authorize;\n export type AvatarUrl = __AvatarUrl;\n export type BotProtection = __BotProtection;\n export type BulkAffectedUsers = __BulkAffectedUsers;\n export type CloneApp = __CloneApp;\n export type ConfirmEnrollment = __ConfirmEnrollment;\n export type ConsumerAddMember = __ConsumerAddMember;\n export type ConsumerAdminCreatedUser = __ConsumerAdminCreatedUser;\n export type ConsumerAdminEndUser = __ConsumerAdminEndUser;\n export type ConsumerAdminEndUserList = __ConsumerAdminEndUserList;\n export type ConsumerAdminPermission = __ConsumerAdminPermission;\n export type ConsumerAdminPermissionListEntry = __ConsumerAdminPermissionListEntry;\n export type ConsumerAdminRoleAssignment = __ConsumerAdminRoleAssignment;\n export type ConsumerCodeDispatch = __ConsumerCodeDispatch;\n export type ConsumerCodeIssue = __ConsumerCodeIssue;\n export type ConsumerMfaChallengeFactor = __ConsumerMfaChallengeFactor;\n export type ConsumerMfaChallenge = __ConsumerMfaChallenge;\n export type ConsumerMfaEnrollVerify = __ConsumerMfaEnrollVerify;\n export type ConsumerMfaEnrollmentRequired = __ConsumerMfaEnrollmentRequired;\n export type ConsumerMfaSendCode = __ConsumerMfaSendCode;\n export type ConsumerRoleList = __ConsumerRoleList;\n export type ConsumerRolePermissionEntry = __ConsumerRolePermissionEntry;\n export type ConsumerRole = __ConsumerRole;\n export type ConsumerRoleWithPermissions = __ConsumerRoleWithPermissions;\n export type ConsumerTenantList = __ConsumerTenantList;\n export type ConsumerTenantMembershipList = __ConsumerTenantMembershipList;\n export type ConsumerTenantMembership = __ConsumerTenantMembership;\n export type ConsumerTenant = __ConsumerTenant;\n export type ConsumerToken = __ConsumerToken;\n export type ConsumerVerify = __ConsumerVerify;\n export type ConsumerWebauthnOptions = __ConsumerWebauthnOptions;\n export type CreateApiKey = __CreateApiKey;\n export type CreateTenantInvite = __CreateTenantInvite;\n export type CustomDomainApplyResult = __CustomDomainApplyResult;\n export type CustomDomainCallbackUrls = __CustomDomainCallbackUrls;\n export type CustomDomain = __CustomDomain;\n export type CustomDomainList = __CustomDomainList;\n export type CustomDomainRecord = __CustomDomainRecord;\n export type DnsConflict = __DnsConflict;\n export type DnsProviderRef = __DnsProviderRef;\n export type EffectiveSender = __EffectiveSender;\n export type EmailEnrollmentData = __EmailEnrollmentData;\n export type EndUserActionCount = __EndUserActionCount;\n export type EndUserActivityEntry = __EndUserActivityEntry;\n export type EndUserDetailInsights = __EndUserDetailInsights;\n export type EndUserFactorEntry = __EndUserFactorEntry;\n export type EndUserInsights = __EndUserInsights;\n export type EndUserInviteList = __EndUserInviteList;\n export type EndUserInvite = __EndUserInvite;\n export type EndUserList = __EndUserList;\n export type EndUserRoleAssignment = __EndUserRoleAssignment;\n export type EndUserSessionEntry = __EndUserSessionEntry;\n export type EndUserSummary = __EndUserSummary;\n export type EnforcedPermissions = __EnforcedPermissions;\n export type Exchange = __Exchange;\n export type FactorList = __FactorList;\n export type GrantableScope = __GrantableScope;\n export type IdpMfaEnrollmentRequired = __IdpMfaEnrollmentRequired;\n export type IdpToken = __IdpToken;\n export type ImportJobError = __ImportJobError;\n export type ImportJob = __ImportJob;\n export type InsightsMfa = __InsightsMfa;\n export type InsightsPasswordReset = __InsightsPasswordReset;\n export type InsightsSessions = __InsightsSessions;\n export type InsightsSignin = __InsightsSignin;\n export type InsightsUsers = __InsightsUsers;\n export type InsightsVerification = __InsightsVerification;\n export type Introspect = __Introspect;\n export type IntrospectionCreator = __IntrospectionCreator;\n export type IssuedVerificationCode = __IssuedVerificationCode;\n export type Jwk = __Jwk;\n export type Jwks = __Jwks;\n export type ListWebhookEndpoints = __ListWebhookEndpoints;\n export type ListWebhookEventTypes = __ListWebhookEventTypes;\n export type ListWebhookEvents = __ListWebhookEvents;\n export type M2mClientCreate = __M2mClientCreate;\n export type M2mClientDetail = __M2mClientDetail;\n export type M2mClientList = __M2mClientList;\n export type M2mClientSummary = __M2mClientSummary;\n export type M2mRotateSecret = __M2mRotateSecret;\n export type M2mScopeEntry = __M2mScopeEntry;\n export type MeActivityEntry = __MeActivityEntry;\n export type MeActivity = __MeActivity;\n export type MeContact = __MeContact;\n export type MeContacts = __MeContacts;\n export type MePermissions = __MePermissions;\n export type MeProfile = __MeProfile;\n export type MeSession = __MeSession;\n export type MeSessions = __MeSessions;\n export type MeUpdatedAccount = __MeUpdatedAccount;\n export type MfaEnrollmentRequiredEventData = __MfaEnrollmentRequiredEventData;\n export type MfaFactorEventData = __MfaFactorEventData;\n export type MfaRecoveryCodeUsedEventData = __MfaRecoveryCodeUsedEventData;\n export type MfaStepUpLockedEventData = __MfaStepUpLockedEventData;\n export type MfaStepUpSucceededEventData = __MfaStepUpSucceededEventData;\n export type MyTenants = __MyTenants;\n export type NotificationTest = __NotificationTest;\n export type OAuthToken = __OAuthToken;\n export type OpenIdConfiguration = __OpenIdConfiguration;\n export type Pagination = __Pagination;\n export type Permission = __Permission;\n export type PlatformTenantApiKey = __PlatformTenantApiKey;\n export type PlatformTenantApiKeyList = __PlatformTenantApiKeyList;\n export type PlatformUserStats = __PlatformUserStats;\n export type ProviderCheck = __ProviderCheck;\n export type ProviderDetail = __ProviderDetail;\n export type ProviderListEntry = __ProviderListEntry;\n export type PublicFactor = __PublicFactor;\n export type RecoveryCodes = __RecoveryCodes;\n export type ReplayWebhookEvent = __ReplayWebhookEvent;\n export type RequireMfaReenrollment = __RequireMfaReenrollment;\n export type RoleList = __RoleList;\n export type RolePermissionEntry = __RolePermissionEntry;\n export type Role = __Role;\n export type RoleWithPermissions = __RoleWithPermissions;\n export type RotateApiKey = __RotateApiKey;\n export type SetupRow = __SetupRow;\n export type SetupRowFix = __SetupRowFix;\n export type SetupRowTest = __SetupRowTest;\n export type SetupStatus = __SetupStatus;\n export type SignInTest = __SignInTest;\n export type SignInTestEmailDelivery = __SignInTestEmailDelivery;\n export type SignInTestEmailNotice = __SignInTestEmailNotice;\n export type SignInTestError = __SignInTestError;\n export type SignInTestIdentity = __SignInTestIdentity;\n export type StartEnrollment = __StartEnrollment;\n export type StatsSeriesPoint = __StatsSeriesPoint;\n export type StepUp = __StepUp;\n export type StepUpSendCode = __StepUpSendCode;\n export type TenantApiKeyCreator = __TenantApiKeyCreator;\n export type TenantApiKey = __TenantApiKey;\n export type TenantApiKeyIntrospection = __TenantApiKeyIntrospection;\n export type TenantApiKeyList = __TenantApiKeyList;\n export type TenantApiKeyStatus = __TenantApiKeyStatus;\n export type TenantApiKeyWithSecret = __TenantApiKeyWithSecret;\n export type TenantApiKeysConfig = __TenantApiKeysConfig;\n export type TenantEventData = __TenantEventData;\n export type TenantInviteAcceptedEventData = __TenantInviteAcceptedEventData;\n export type TenantInviteCreatedEventData = __TenantInviteCreatedEventData;\n export type TenantInviteList = __TenantInviteList;\n export type TenantInvite = __TenantInvite;\n export type TenantInviteRevokedEventData = __TenantInviteRevokedEventData;\n export type TenantList = __TenantList;\n export type TenantMemberAddedEventData = __TenantMemberAddedEventData;\n export type TenantMemberRemovedEventData = __TenantMemberRemovedEventData;\n export type TenantMemberRoleChangedEventData = __TenantMemberRoleChangedEventData;\n export type TenantMembershipForMe = __TenantMembershipForMe;\n export type TenantMembershipList = __TenantMembershipList;\n export type TenantMembership = __TenantMembership;\n export type Tenant = __Tenant;\n export type TotpEnrollmentData = __TotpEnrollmentData;\n export type UnverifiedAccountExpiryRun = __UnverifiedAccountExpiryRun;\n export type UnverifiedAccountExpiryStatus = __UnverifiedAccountExpiryStatus;\n export type UserContactVerifiedEventData = __UserContactVerifiedEventData;\n export type UserDeletedEventData = __UserDeletedEventData;\n export type UserEmailVerifiedEventData = __UserEmailVerifiedEventData;\n export type UserEventData = __UserEventData;\n export type UserPasswordResetRequestedEventData = __UserPasswordResetRequestedEventData;\n export type UserRoleChangedEventData = __UserRoleChangedEventData;\n export type UserSigninEventData = __UserSigninEventData;\n export type UserSignupEventData = __UserSignupEventData;\n export type VerifyPrincipal = __VerifyPrincipal;\n export type Verify = __Verify;\n export type WebauthnConfig = __WebauthnConfig;\n export type WebauthnEnrollmentData = __WebauthnEnrollmentData;\n export type WebauthnOptions = __WebauthnOptions;\n export type WebhookDeliveryAttempt = __WebhookDeliveryAttempt;\n export type WebhookEndpoint = __WebhookEndpoint;\n export type WebhookEndpointWithSecret = __WebhookEndpointWithSecret;\n export type WebhookEventDelivery = __WebhookEventDelivery;\n export type WebhookEventDetail = __WebhookEventDetail;\n export type WebhookEvent = __WebhookEvent;\n export type WebhookEventTypeInfo = __WebhookEventTypeInfo;\n export type WebhookPagination = __WebhookPagination;\n export type AppListParams = __AppListParams;\n export type AppCreateParams = __AppCreateParams;\n export type AppUpdateParams = __AppUpdateParams;\n export type ApiKeyListParams = __ApiKeyListParams;\n export type ApiKeyCreateParams = __ApiKeyCreateParams;\n export type ApiKeyRotateParams = __ApiKeyRotateParams;\n export type AuditLogListParams = __AuditLogListParams;\n export type AuditLogExportParams = __AuditLogExportParams;\n export type AuditSinkReplaceParams = __AuditSinkReplaceParams;\n export type AuditSinkUpdateParams = __AuditSinkUpdateParams;\n export type AuthConfigUpdateParams = __AuthConfigUpdateParams;\n export type AuthConfigProviderListResponse = __AuthConfigProviderListResponse;\n export type AuthConfigProviderReplaceParams = __AuthConfigProviderReplaceParams;\n export type AuthConfigProviderUpdateParams = __AuthConfigProviderUpdateParams;\n export type CloneParams = __CloneParams;\n export type CredentialListParams = __CredentialListParams;\n export type CredentialCreateParams = __CredentialCreateParams;\n export type CredentialUpdateParams = __CredentialUpdateParams;\n export type CredentialUpdateScopesParams = __CredentialUpdateScopesParams;\n export type CredentialUpdateScopesResponse = __CredentialUpdateScopesResponse;\n export type CustomDomainCreateParams = __CustomDomainCreateParams;\n export type CustomDomainApplyParams = __CustomDomainApplyParams;\n export type CustomDomainExportParams = __CustomDomainExportParams;\n export type EndUserListParams = __EndUserListParams;\n export type EndUserBulkDeleteParams = __EndUserBulkDeleteParams;\n export type EndUserBulkRevokeSessionsParams = __EndUserBulkRevokeSessionsParams;\n export type EndUserBulkUpdateRoleParams = __EndUserBulkUpdateRoleParams;\n export type EndUserBulkUpdateStatusParams = __EndUserBulkUpdateStatusParams;\n export type EndUserExportParams = __EndUserExportParams;\n export type EndUserInviteListParams = __EndUserInviteListParams;\n export type EndUserInviteCreateParams = __EndUserInviteCreateParams;\n export type EndUserUpdateParams = __EndUserUpdateParams;\n export type EndUserContactCreateParams = __EndUserContactCreateParams;\n export type EndUserUpdateRoleParams = __EndUserUpdateRoleParams;\n export type EndUserUpdateStatusParams = __EndUserUpdateStatusParams;\n export type MemberListParams = __MemberListParams;\n export type NotificationSettingUpdateParams = __NotificationSettingUpdateParams;\n export type AppScopedPermissionListResponse = __AppScopedPermissionListResponse;\n export type AppScopedPermissionCreateParams = __AppScopedPermissionCreateParams;\n export type AppScopedRoleListParams = __AppScopedRoleListParams;\n export type AppScopedRoleCreateParams = __AppScopedRoleCreateParams;\n export type RoleAssignParams = __RoleAssignParams;\n export type RolePermissionListResponse = __RolePermissionListResponse;\n export type AppScopedRoleUpdateParams = __AppScopedRoleUpdateParams;\n export type AppScopedRoleUpdatePermissionsParams = __AppScopedRoleUpdatePermissionsParams;\n export type AppScopedRoleUpdatePermissionsResponse = __AppScopedRoleUpdatePermissionsResponse;\n export type SignInTestCreateParams = __SignInTestCreateParams;\n export type UpdateStatusParams = __UpdateStatusParams;\n export type AppScopedTenantApiKeyListParams = __AppScopedTenantApiKeyListParams;\n export type AppScopedTenantApiKeyConfigUpdateParams = __AppScopedTenantApiKeyConfigUpdateParams;\n export type AppScopedTenantListParams = __AppScopedTenantListParams;\n export type AppScopedTenantCreateParams = __AppScopedTenantCreateParams;\n export type AppScopedTenantUpdateParams = __AppScopedTenantUpdateParams;\n export type AppScopedTenantInviteListParams = __AppScopedTenantInviteListParams;\n export type AppScopedTenantInviteCreateParams = __AppScopedTenantInviteCreateParams;\n export type AppScopedTenantMemberListParams = __AppScopedTenantMemberListParams;\n export type AppScopedTenantMemberCreateParams = __AppScopedTenantMemberCreateParams;\n export type AppScopedTenantMemberUpdateParams = __AppScopedTenantMemberUpdateParams;\n export type UnverifiedAccountExpiryRunParams = __UnverifiedAccountExpiryRunParams;\n export type WebauthnConfigUpdateParams = __WebauthnConfigUpdateParams;\n export type WebhookEndpointCreateParams = __WebhookEndpointCreateParams;\n export type WebhookEndpointUpdateParams = __WebhookEndpointUpdateParams;\n export type WebhookEndpointRotateSecretParams = __WebhookEndpointRotateSecretParams;\n export type WebhookEndpointTestParams = __WebhookEndpointTestParams;\n export type WebhookEventListParams = __WebhookEventListParams;\n export type WebhookEventReplayParams = __WebhookEventReplayParams;\n export type StatsMeParams = __StatsMeParams;\n export type StatsRetrieveParams = __StatsRetrieveParams;\n export type ConsumerScopedPermissionListResponse = __ConsumerScopedPermissionListResponse;\n export type ConsumerScopedPermissionCreateParams = __ConsumerScopedPermissionCreateParams;\n export type ConsumerScopedRoleListParams = __ConsumerScopedRoleListParams;\n export type ConsumerScopedRoleCreateParams = __ConsumerScopedRoleCreateParams;\n export type ConsumerScopedRoleUpdateParams = __ConsumerScopedRoleUpdateParams;\n export type ConsumerScopedRoleUpdatePermissionsParams = __ConsumerScopedRoleUpdatePermissionsParams;\n export type ConsumerScopedRoleUpdatePermissionsResponse = __ConsumerScopedRoleUpdatePermissionsResponse;\n export type UserListParams = __UserListParams;\n export type UserCreateParams = __UserCreateParams;\n export type UserUpdateParams = __UserUpdateParams;\n export type UserUpdateRoleParams = __UserUpdateRoleParams;\n export type UserUpdateStatusParams = __UserUpdateStatusParams;\n export type AcceptInviteParams = __AcceptInviteParams;\n export type AcceptInviteResponse = __AcceptInviteResponse;\n export type AcceptTenantInviteParams = __AcceptTenantInviteParams;\n export type LogoutParams = __LogoutParams;\n export type MfaEnrollParams = __MfaEnrollParams;\n export type MfaVerifyEnrollmentParams = __MfaVerifyEnrollmentParams;\n export type MfaRecoverParams = __MfaRecoverParams;\n export type MfaSendCodeParams = __MfaSendCodeParams;\n export type MfaVerifyParams = __MfaVerifyParams;\n export type MfaWebauthnOptionsParams = __MfaWebauthnOptionsParams;\n export type ExchangeProviderCodeParams = __ExchangeProviderCodeParams;\n export type SigninWithProviderParams = __SigninWithProviderParams;\n export type SigninWithProviderResponse = __SigninWithProviderResponse;\n export type PasskeyOptionsParams = __PasskeyOptionsParams;\n export type PasskeyVerifyParams = __PasskeyVerifyParams;\n export type RefreshParams = __RefreshParams;\n export type RequestPasswordResetParams = __RequestPasswordResetParams;\n export type RequestVerificationParams = __RequestVerificationParams;\n export type ResetPasswordParams = __ResetPasswordParams;\n export type SendPasswordResetEmailParams = __SendPasswordResetEmailParams;\n export type SendVerificationEmailParams = __SendVerificationEmailParams;\n export type SigninParams = __SigninParams;\n export type SigninResponse = __SigninResponse;\n export type SignupParams = __SignupParams;\n export type SignupResponse = __SignupResponse;\n export type SwitchTenantParams = __SwitchTenantParams;\n export type VerifyEmailParams = __VerifyEmailParams;\n export type VerifyAuthorizeParams = __VerifyAuthorizeParams;\n export type VerifyAuthorizeBatchParams = __VerifyAuthorizeBatchParams;\n export type MeUpdateParams = __MeUpdateParams;\n export type MeUploadAvatarParams = __MeUploadAvatarParams;\n export type MeChangePasswordParams = __MeChangePasswordParams;\n export type MeContactCreateParams = __MeContactCreateParams;\n export type MeMfaFactorCreateParams = __MeMfaFactorCreateParams;\n export type MeMfaFactorVerifyParams = __MeMfaFactorVerifyParams;\n export type MeMfaStepUpVerifyParams = __MeMfaStepUpVerifyParams;\n export type MeMfaStepUpSendCodeParams = __MeMfaStepUpSendCodeParams;\n export type MeTenantInviteAcceptParams = __MeTenantInviteAcceptParams;\n export type OauthIntrospectParams = __OauthIntrospectParams;\n export type OauthTokenParams = __OauthTokenParams;\n export type ConsumerScopedTenantApiKeyListParams = __ConsumerScopedTenantApiKeyListParams;\n export type TenantApiKeyCreateParams = __TenantApiKeyCreateParams;\n export type ConsumerScopedTenantApiKeyConfigUpdateParams = __ConsumerScopedTenantApiKeyConfigUpdateParams;\n export type TenantApiKeyIntrospectParams = __TenantApiKeyIntrospectParams;\n export type TenantApiKeyRotateParams = __TenantApiKeyRotateParams;\n export type ConsumerScopedTenantListParams = __ConsumerScopedTenantListParams;\n export type ConsumerScopedTenantCreateParams = __ConsumerScopedTenantCreateParams;\n export type ConsumerScopedTenantUpdateParams = __ConsumerScopedTenantUpdateParams;\n export type ConsumerScopedTenantInviteListParams = __ConsumerScopedTenantInviteListParams;\n export type ConsumerScopedTenantInviteCreateParams = __ConsumerScopedTenantInviteCreateParams;\n export type ConsumerScopedTenantMemberListParams = __ConsumerScopedTenantMemberListParams;\n export type ConsumerScopedTenantMemberCreateParams = __ConsumerScopedTenantMemberCreateParams;\n export type ConsumerScopedTenantMemberUpdateParams = __ConsumerScopedTenantMemberUpdateParams;\n export type UserFactorCreateParams = __UserFactorCreateParams;\n export type VerifyTokenParams = __VerifyTokenParams;\n export type ErrorCode = __ErrorCode;\n export type AppSlugChangedEvent = __AppSlugChangedEvent;\n export type TenantCreatedEvent = __TenantCreatedEvent;\n export type TenantDeletedEvent = __TenantDeletedEvent;\n export type TenantInviteAcceptedEvent = __TenantInviteAcceptedEvent;\n export type TenantInviteCreatedEvent = __TenantInviteCreatedEvent;\n export type TenantInviteRevokedEvent = __TenantInviteRevokedEvent;\n export type TenantMemberAddedEvent = __TenantMemberAddedEvent;\n export type TenantMemberRemovedEvent = __TenantMemberRemovedEvent;\n export type TenantMemberRoleChangedEvent = __TenantMemberRoleChangedEvent;\n export type TenantUpdatedEvent = __TenantUpdatedEvent;\n export type UserContactVerifiedEvent = __UserContactVerifiedEvent;\n export type UserDeactivatedEvent = __UserDeactivatedEvent;\n export type UserDeletedEvent = __UserDeletedEvent;\n export type UserEmailVerifiedEvent = __UserEmailVerifiedEvent;\n export type UserMfaEnrollmentRequiredEvent = __UserMfaEnrollmentRequiredEvent;\n export type UserMfaFactorDisabledEvent = __UserMfaFactorDisabledEvent;\n export type UserMfaFactorEnrolledEvent = __UserMfaFactorEnrolledEvent;\n export type UserMfaRecoveryCodeUsedEvent = __UserMfaRecoveryCodeUsedEvent;\n export type UserMfaReenrollmentRequiredEvent = __UserMfaReenrollmentRequiredEvent;\n export type UserMfaStepUpLockedEvent = __UserMfaStepUpLockedEvent;\n export type UserMfaStepUpSucceededEvent = __UserMfaStepUpSucceededEvent;\n export type UserPasswordResetCompletedEvent = __UserPasswordResetCompletedEvent;\n export type UserPasswordResetRequestedEvent = __UserPasswordResetRequestedEvent;\n export type UserReinstatedEvent = __UserReinstatedEvent;\n export type UserRoleChangedEvent = __UserRoleChangedEvent;\n export type UserSigninEvent = __UserSigninEvent;\n export type UserSignupEvent = __UserSignupEvent;\n export type UserSuspendedEvent = __UserSuspendedEvent;\n export type UnknownWebhookEvent = __UnknownWebhookEvent;\n export type UnwrapWebhookEvent = __UnwrapWebhookEvent;\n export type WebhookUnwrapParams = __WebhookUnwrapParams;\n}\n","// Generated by scripts/gen-sdk.mjs from Specs/auth.json. Do not edit.\n\nexport { APIConnectionError, APIError, APITimeoutError, APIUserAbortError, AuthenticationError, BadRequestError, ConfigurationError, ConflictError, IdempotencyKeyReuseError, InternalServerError, NotFoundError, PermissionDeniedError, ProductCraftError, RateLimitError, UnprocessableEntityError, WebhookVerificationError } from \"@productcraft/core\";\n\n/** Error codes this API documents. Open: codes added later still type-check. See https://productcraft.co/docs/errors. */\nexport type AuthErrorCode = \"BAD_REQUEST\" | \"VALIDATION_ERROR\" | \"UNAUTHORIZED\" | \"PAYMENT_REQUIRED\" | \"FORBIDDEN\" | \"NOT_FOUND\" | \"METHOD_NOT_ALLOWED\" | \"NOT_ACCEPTABLE\" | \"REQUEST_TIMEOUT\" | \"CONFLICT\" | \"GONE\" | \"PRECONDITION_FAILED\" | \"PAYLOAD_TOO_LARGE\" | \"UNSUPPORTED_MEDIA_TYPE\" | \"UNPROCESSABLE_ENTITY\" | \"PRECONDITION_REQUIRED\" | \"RATE_LIMITED\" | \"INTERNAL_SERVER_ERROR\" | \"NOT_IMPLEMENTED\" | \"BAD_GATEWAY\" | \"SERVICE_UNAVAILABLE\" | \"GATEWAY_TIMEOUT\" | \"SERVICE_NOT_ENABLED\" | \"INVALID_CREDENTIALS\" | \"SESSION_REVOKED\" | \"MCP_NOT_PERMITTED\" | \"MCP_WORKSPACE_MISMATCH\" | \"PAK_NOT_PERMITTED\" | \"ACTIONS_NOT_GRANTABLE\" | \"IDEMPOTENCY_KEY_REUSE\" | \"IDEMPOTENCY_KEY_REQUIRED\" | \"IDEMPOTENCY_IN_PROGRESS\" | \"WEBHOOK_ENDPOINT_LIMIT\" | \"WEBHOOK_ENDPOINT_NOT_FOUND\" | \"WEBHOOK_ENDPOINT_NOT_SUBSCRIBED\" | \"WEBHOOK_EVENT_NOT_FOUND\" | \"WEBHOOK_EVENT_TYPE_UNKNOWN\" | \"ACCOUNT_EXISTS\" | \"ACCOUNT_NOT_FOUND\" | \"ACCOUNT_SUSPENDED\" | \"APEX_NOT_SUPPORTED\" | \"APP_ARCHIVED\" | \"APP_HAS_NO_WORKSPACE\" | \"APP_NOT_FOUND\" | \"APP_SUSPENDED\" | \"AUTH_SETTINGS_IN_METADATA\" | \"AVATAR_INVALID_TYPE\" | \"AVATAR_MAGIC_MISMATCH\" | \"AVATAR_NOT_FOUND\" | \"AVATAR_TOO_LARGE\" | \"BOT_PROTECTION_FAILED\" | \"BOT_PROTECTION_REQUIRED\" | \"BOT_PROTECTION_UNAVAILABLE\" | \"CUSTOM_DOMAIN_EXISTS\" | \"CUSTOM_DOMAIN_NOT_ACTIVE\" | \"CUSTOM_DOMAIN_NOT_FOUND\" | \"CUSTOM_DOMAIN_OAUTH_ONLY\" | \"DNS_CONFLICTS\" | \"ENVOI_APP_NOT_BOUND_TO_WORKSPACE\" | \"ENVOI_NOT_ENABLED\" | \"ENVOI_NOT_WIRED\" | \"ENVOI_SENDER_NOT_CONFIGURED\" | \"ENVOI_TEMPLATE_NOT_CONFIGURED\" | \"FEATURE_NOT_ENABLED\" | \"HOSTNAME_RESERVED\" | \"HOSTNAME_TAKEN\" | \"INSUFFICIENT_PERMISSIONS\" | \"INVALID_FORMAT\" | \"INVALID_HOSTNAME\" | \"INVALID_IDENTIFIER\" | \"INVALID_PROVIDER\" | \"INVALID_ZONE\" | \"MAIL_UNREACHABLE\" | \"PAK_WORKSPACE_MISMATCH\" | \"PASSWORD_BREACHED\" | \"PASSWORD_TOO_COMMON\" | \"PROVIDER_ERROR\" | \"PROVIDER_PERMISSION_DENIED\" | \"PROVIDER_TOKEN_REJECTED\" | \"PROVIDER_UNAVAILABLE\" | \"PROVIDER_ZONE_NOT_FOUND\" | \"ROLE_IN_USE\" | \"SENDER_ADDRESS_REQUIRED\" | \"SESSION_EXPIRED\" | \"SIGN_IN_TEST_INVALID\" | \"SLUG_TAKEN\" | \"SLUG_UUID_SHAPED\" | \"TENANT_API_KEYS_APP_PROXY_ONLY\" | \"TENANT_API_KEYS_FORBIDDEN\" | \"TENANT_API_KEYS_NOT_ENABLED\" | \"TENANT_API_KEYS_NO_SCOPES\" | \"TENANT_API_KEYS_SCOPE_INVALID\" | \"TENANT_API_KEYS_SUSPENDED\" | \"TENANT_API_KEYS_SUSPENDED_NOT_WRITABLE\" | \"TENANT_API_KEYS_UNKNOWN_ROLE\" | \"TENANT_API_KEY_EXPIRY_INVALID\" | \"TENANT_API_KEY_LIMIT\" | \"TENANT_API_KEY_NOT_ACTIVE\" | \"TENANT_API_KEY_NOT_FOUND\" | \"TENANT_API_KEY_SCOPE_ABOVE_CEILING\" | \"TENANT_API_KEY_SCOPE_NOT_GRANTABLE\" | \"TENANT_CONTEXT_REQUIRED\" | \"TENANT_MEMBERSHIP_REQUIRED\" | \"TENANT_NOT_ACTIVE\" | \"TOKEN_EXPIRED\" | \"TOKEN_INVALID\" | \"TOKEN_REVOKED\" | \"USERNAME_TAKEN\" | \"account_exists_with_different_provider\" | \"idempotency_secret_not_replayable\" | \"link_required\" | \"step_up_required\" | (string & {});\nexport const AuthErrorCode = { values: [\"BAD_REQUEST\", \"VALIDATION_ERROR\", \"UNAUTHORIZED\", \"PAYMENT_REQUIRED\", \"FORBIDDEN\", \"NOT_FOUND\", \"METHOD_NOT_ALLOWED\", \"NOT_ACCEPTABLE\", \"REQUEST_TIMEOUT\", \"CONFLICT\", \"GONE\", \"PRECONDITION_FAILED\", \"PAYLOAD_TOO_LARGE\", \"UNSUPPORTED_MEDIA_TYPE\", \"UNPROCESSABLE_ENTITY\", \"PRECONDITION_REQUIRED\", \"RATE_LIMITED\", \"INTERNAL_SERVER_ERROR\", \"NOT_IMPLEMENTED\", \"BAD_GATEWAY\", \"SERVICE_UNAVAILABLE\", \"GATEWAY_TIMEOUT\", \"SERVICE_NOT_ENABLED\", \"INVALID_CREDENTIALS\", \"SESSION_REVOKED\", \"MCP_NOT_PERMITTED\", \"MCP_WORKSPACE_MISMATCH\", \"PAK_NOT_PERMITTED\", \"ACTIONS_NOT_GRANTABLE\", \"IDEMPOTENCY_KEY_REUSE\", \"IDEMPOTENCY_KEY_REQUIRED\", \"IDEMPOTENCY_IN_PROGRESS\", \"WEBHOOK_ENDPOINT_LIMIT\", \"WEBHOOK_ENDPOINT_NOT_FOUND\", \"WEBHOOK_ENDPOINT_NOT_SUBSCRIBED\", \"WEBHOOK_EVENT_NOT_FOUND\", \"WEBHOOK_EVENT_TYPE_UNKNOWN\", \"ACCOUNT_EXISTS\", \"ACCOUNT_NOT_FOUND\", \"ACCOUNT_SUSPENDED\", \"APEX_NOT_SUPPORTED\", \"APP_ARCHIVED\", \"APP_HAS_NO_WORKSPACE\", \"APP_NOT_FOUND\", \"APP_SUSPENDED\", \"AUTH_SETTINGS_IN_METADATA\", \"AVATAR_INVALID_TYPE\", \"AVATAR_MAGIC_MISMATCH\", \"AVATAR_NOT_FOUND\", \"AVATAR_TOO_LARGE\", \"BOT_PROTECTION_FAILED\", \"BOT_PROTECTION_REQUIRED\", \"BOT_PROTECTION_UNAVAILABLE\", \"CUSTOM_DOMAIN_EXISTS\", \"CUSTOM_DOMAIN_NOT_ACTIVE\", \"CUSTOM_DOMAIN_NOT_FOUND\", \"CUSTOM_DOMAIN_OAUTH_ONLY\", \"DNS_CONFLICTS\", \"ENVOI_APP_NOT_BOUND_TO_WORKSPACE\", \"ENVOI_NOT_ENABLED\", \"ENVOI_NOT_WIRED\", \"ENVOI_SENDER_NOT_CONFIGURED\", \"ENVOI_TEMPLATE_NOT_CONFIGURED\", \"FEATURE_NOT_ENABLED\", \"HOSTNAME_RESERVED\", \"HOSTNAME_TAKEN\", \"INSUFFICIENT_PERMISSIONS\", \"INVALID_FORMAT\", \"INVALID_HOSTNAME\", \"INVALID_IDENTIFIER\", \"INVALID_PROVIDER\", \"INVALID_ZONE\", \"MAIL_UNREACHABLE\", \"PAK_WORKSPACE_MISMATCH\", \"PASSWORD_BREACHED\", \"PASSWORD_TOO_COMMON\", \"PROVIDER_ERROR\", \"PROVIDER_PERMISSION_DENIED\", \"PROVIDER_TOKEN_REJECTED\", \"PROVIDER_UNAVAILABLE\", \"PROVIDER_ZONE_NOT_FOUND\", \"ROLE_IN_USE\", \"SENDER_ADDRESS_REQUIRED\", \"SESSION_EXPIRED\", \"SIGN_IN_TEST_INVALID\", \"SLUG_TAKEN\", \"SLUG_UUID_SHAPED\", \"TENANT_API_KEYS_APP_PROXY_ONLY\", \"TENANT_API_KEYS_FORBIDDEN\", \"TENANT_API_KEYS_NOT_ENABLED\", \"TENANT_API_KEYS_NO_SCOPES\", \"TENANT_API_KEYS_SCOPE_INVALID\", \"TENANT_API_KEYS_SUSPENDED\", \"TENANT_API_KEYS_SUSPENDED_NOT_WRITABLE\", \"TENANT_API_KEYS_UNKNOWN_ROLE\", \"TENANT_API_KEY_EXPIRY_INVALID\", \"TENANT_API_KEY_LIMIT\", \"TENANT_API_KEY_NOT_ACTIVE\", \"TENANT_API_KEY_NOT_FOUND\", \"TENANT_API_KEY_SCOPE_ABOVE_CEILING\", \"TENANT_API_KEY_SCOPE_NOT_GRANTABLE\", \"TENANT_CONTEXT_REQUIRED\", \"TENANT_MEMBERSHIP_REQUIRED\", \"TENANT_NOT_ACTIVE\", \"TOKEN_EXPIRED\", \"TOKEN_INVALID\", \"TOKEN_REVOKED\", \"USERNAME_TAKEN\", \"account_exists_with_different_provider\", \"idempotency_secret_not_replayable\", \"link_required\", \"step_up_required\"] as const };\n","/**\n * @productcraft/auth: `auth.admin.app(id)` (admin) and `auth.consumer(slug)` (end users).\n * HTTP methods, types, errors and mocks are generated (scripts/gen-sdk.mjs); hand-written:\n * jwt/, passkeys.ts, consumer.ts and base.ts.\n */\nimport { APIError } from \"@productcraft/core\";\n\nexport { Auth, Auth as default } from \"./_generated/client.js\";\nexport * from \"./_generated/errors.js\";\nexport type { paths, components } from \"./_generated/paths.js\";\nexport type { AuthOptions, AuthOptions as AuthConfig } from \"./base.js\";\nexport { ConsumerScope, AUTH_LEGACY_ISSUER, type ConsumerScopeOptions } from \"./consumer.js\";\n/** 0.x name of the `auth.admin.app(id)` scope class. */\nexport { AuthApp as AppScope } from \"./_generated/resources.js\";\nexport type { PCAuth, PCClientConfig } from \"@productcraft/core\";\n\n/** @deprecated 0.x name: every API error is an `APIError` (`instanceof AuthHttpError` still works). Removed in 2.0. */\nexport const AuthHttpError = APIError;\n/** @deprecated 0.x name for `APIError`. Removed in 2.0. */\nexport type AuthHttpError = APIError;\n\n/** 0.x type names (`ConsumerSigninDto`, …), each a deprecated alias. */\nexport type * from \"./_generated/compat.js\";\n\nexport {\n JwksCache,\n type AuthClaims,\n type VerifyOptions,\n verifyAuthToken,\n isRefreshToken,\n JwtVerifyError,\n JwtInvalidError,\n JwtExpiredError,\n JwtNotYetValidError,\n JwtIssuerMismatchError,\n JwtAudienceMismatchError,\n JwksKeyNotFoundError,\n JwksFetchError,\n JwtRefreshTokenError,\n} from \"./jwt/index.js\";\n\nexport {\n toB64u,\n fromB64u,\n decodeOptions,\n encodeCredential,\n isPasskeySupported,\n createPasskeyCredential,\n getPasskeyCredential,\n PasskeyError,\n type PasskeyPublicKeyOptions,\n type PasskeyDecodedOptions,\n type PasskeyCredentialLike,\n type EncodedPasskeyCredential,\n type PasskeyCredentialsContainer,\n type PasskeyMediation,\n type PasskeyErrorCode,\n type PasskeyBrowserOptions,\n} from \"./passkeys.js\";\n"]}
1
+ {"version":3,"sources":["../src/_generated/resources.ts","../src/jwt/errors.ts","../src/jwt/jwks-cache.ts","../src/jwt/verify.ts","../src/passkeys.ts","../src/consumer.ts","../src/base.ts","../src/_generated/types.ts","../src/_generated/client.ts","../src/_generated/errors.ts","../src/index.ts"],"names":["joseErrors","Auth","APIError"],"mappings":";;;;;;;AAkBA,SAAS,SAAA,CAAa,QAAW,KAAA,EAAiB;AAChD,EAAA,IAAI,KAAA,CAAM,QAAA,KAAa,MAAA,EAAW,OAAO,MAAA;AACzC,EAAA,MAAM,CAAA,GAAK,UAAU,EAAC;AACtB,EAAA,OAAQ,CAAA,CAAE,aAAa,MAAA,GAAY,EAAE,GAAG,CAAA,EAAG,QAAA,EAAU,KAAA,CAAM,QAAA,EAAS,GAAI,CAAA;AAC1E;AAGA,SAAS,SAAS,MAAA,EAAsC;AACtD,EAAA,MAAM,IAAA,GAAO,IAAI,QAAA,EAAS;AAC1B,EAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,IAAU,EAAE,CAAA,EAAG;AACjD,IAAA,IAAI,CAAA,KAAM,MAAA,IAAa,CAAA,KAAM,IAAA,EAAM;AACnC,IAAA,IAAI,CAAA,YAAa,IAAA,EAAM,IAAA,CAAK,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,SAClC,IAAA,CAAK,MAAA,CAAO,CAAA,EAAG,OAAO,CAAA,KAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,CAAC,CAAA,GAAI,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EAC3E;AACA,EAAA,OAAO,IAAA;AACT;AAEO,IAAM,cAAN,MAAkB;AAAA,EACJ,OAAA;AAAA;AAAA,EAEA,EAAA;AAAA,EACnB,WAAA,CAAY,MAAA,EAAmB,KAAA,GAAe,EAAC,EAAG;AAChD,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AACf,IAAA,IAAA,CAAK,EAAA,GAAK,KAAA;AAAA,EACZ;AACF,CAAA;AAKO,IAAM,YAAA,GAAN,cAA2B,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6B5C,MAAA,CAAO,QAA2B,OAAA,EAAiE;AACjG,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,UAAA,EAAY,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC3G;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAA,CAAO,OAAe,OAAA,EAA4C;AAChE,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,QAAQ,QAAA,EAAU,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAA,EAAM,IAAK,OAAO,CAAA;AAAA,EACrH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,IAAA,CAAK,QAA0B,OAAA,EAA8C;AAC3E,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,UAAA,EAAY,KAAA,EAAO,MAAA,EAAO,EAAG,OAAO,CAAA;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,QAAA,CAAS,OAAe,OAAA,EAAiE;AACvF,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAA,EAAM,IAAK,OAAO,CAAA;AAAA,EAClH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAA,CAAO,KAAA,EAAe,MAAA,EAA4B,OAAA,EAAiE;AACjH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,SAAS,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,QAAQ,KAAA,EAAM,EAAG,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAClI;AACF,CAAA;AAGO,IAAM,aAAA,GAAN,cAA4B,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoB7C,EAAA,CAAG,QAA0B,OAAA,EAA+E;AAC1G,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,cAAA,EAAgB,KAAA,EAAO,MAAA,EAAO,EAAG,OAAO,CAAA;AAAA,EAC7F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2BA,QAAA,CAAS,QAAgC,OAAA,EAAgF;AACvH,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,qCAAA,EAAuC,KAAA,EAAO,MAAA,EAAO,EAAG,OAAO,CAAA;AAAA,EACpH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,GAAA,CAAI,QAA0B,OAAA,EAA+E;AAC3G,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,cAAA,EAAgB,KAAA,EAAO,MAAA,EAAO,EAAG,OAAO,CAAA;AAAA,EAC7F;AACF,CAAA;AAGO,IAAM,gBAAA,GAAN,cAA+B,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQhD,OAAO,MAAA,EAA0D;AAC/D,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,aAAA,CAAkC,MAAA,EAAQ,kCAAkC,CAAA;AAAA,EAClG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,KAAK,MAAA,EAAmD;AACtD,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,WAAA,CAAY,MAAA,EAAQ,kCAAkC,CAAA;AAAA,EAC5E;AACF,CAAA;AAGO,IAAM,aAAA,GAAN,cAA4B,WAAA,CAAY;AAAA,EAC7C,KAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,IAAI,IAAA,GAAqB;AACvB,IAAA,OAAQ,KAAK,KAAA,KAAU,IAAI,aAAa,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC/D;AAAA,EACA,IAAI,KAAA,GAAuB;AACzB,IAAA,OAAQ,KAAK,MAAA,KAAW,IAAI,cAAc,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACjE;AAAA,EACA,IAAI,QAAA,GAA6B;AAC/B,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,iBAAiB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACvE;AACF,CAAA;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBlD,MAAA,CAAO,QAA8B,OAAA,EAA0E;AAC7G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,OAAe,OAAA,EAA4C;AAChE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,QAAQ,KAAA,EAAM,IAAK,OAAO,CAAA;AAAA,EAC/J;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,IAAA,CAAK,QAA6B,OAAA,EAAwD;AACxF,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EAChJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,KAAA,EAAe,MAAA,EAA+B,OAAA,EAA0E;AAC7H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,4CAAA,EAA8C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,QAAQ,KAAA,EAAM,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EACpM;AACF,CAAA;AAGO,IAAM,oBAAA,GAAN,cAAmC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBpD,MAAA,CAAO,QAAiC,OAAA,EAAgD;AACtF,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,GAAG,MAAA,EAAO,EAAG,KAAA,EAAO,SAAA,CAAU,MAAA,EAAQ,IAAA,CAAK,EAAE,CAAA,EAAG,GAAA,EAAK,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC3L;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,IAAA,CAAK,QAA+B,OAAA,EAAwD;AAC1F,IAAA,OAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,8BAAA,EAAgC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,SAAA,CAAU,QAAQ,IAAA,CAAK,EAAE,CAAA,EAAE,EAAG,OAAO,CAAA;AAAA,EACtK;AACF,CAAA;AAGO,IAAM,oBAAA,GAAN,cAAmC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBpD,WAAW,OAAA,EAA4C;AACrD,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,8BAAA,EAAgC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACzI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,OAAA,CAAQ,QAAkC,OAAA,EAAiF;AACzH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,8BAAA,EAAgC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACpJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,SAAS,OAAA,EAAuE;AAC9E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,8BAAA,EAAgC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACtI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,aAAa,OAAA,EAAiF;AAC5F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,4CAAA,EAA8C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACrJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,YAAY,OAAA,EAAyE;AACnF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,2CAAA,EAA6C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACnJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,KAAK,OAAA,EAAiF;AACpF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,mCAAA,EAAqC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC9J;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAA,CAAO,QAAkC,OAAA,EAAuE;AAC9G,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,8BAAA,EAAgC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACtJ;AACF,CAAA;AAGO,IAAM,8BAAA,GAAN,cAA6C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuB9D,KAAA,CAAM,UAAkB,OAAA,EAA2E;AACjG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,0DAAA,EAA4D,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC7K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,KAAK,OAAA,EAA4F;AAC/F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,yCAAA,EAA2C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACjJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,OAAA,CAAQ,QAAA,EAAkB,MAAA,EAA2C,OAAA,EAA4E;AAC/I,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,GAAG,MAAA,EAAQ,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACpL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,QAAA,CAAS,UAAkB,OAAA,EAA4E;AACrG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACtK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,QAAA,EAAkB,MAAA,EAA2C,OAAA,EAA4E;AAC9I,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,GAAG,MAAA,EAAQ,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACtL;AACF,CAAA;AAGO,IAAM,qBAAA,GAAN,cAAoC,WAAA,CAAY;AAAA,EACrD,UAAA;AAAA,EACA,IAAI,SAAA,GAA4C;AAC9C,IAAA,OAAQ,KAAK,UAAA,KAAe,IAAI,+BAA+B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,SAAS,OAAA,EAAwE;AAC/E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,+BAAA,EAAiC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACvI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,QAAmC,OAAA,EAAwE;AAChH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,+BAAA,EAAiC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACvJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,OAAA,EAAwE;AAC1E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,+BAAA,EAAiC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACvI;AACF,CAAA;AAGO,IAAM,sBAAA,GAAN,cAAqC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBtD,MAAA,CAAO,QAAkC,OAAA,EAA6E;AACpH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,iCAAiC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACxK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,2CAAA,EAA6C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC3K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,IAAA,CAAK,QAAiC,OAAA,EAA2D;AAC/F,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,+BAAA,EAAiC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACnJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,QAAA,CAAS,UAAkB,OAAA,EAA6E;AACtG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,2CAAA,EAA6C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACxK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAA,CAAO,UAAkB,OAAA,EAA6E;AACpG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,kDAAA,EAAoD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAChL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,QAAA,EAAkB,MAAA,EAAmC,OAAA,EAA6E;AACvI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,6CAA6C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACxL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,YAAA,CAAa,QAAA,EAAkB,MAAA,EAAwC,OAAA,EAA4F;AACjK,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,oDAAoD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC7L;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,GAAA,CAAI,UAAkB,OAAA,EAA6E;AACjG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,2CAAA,EAA6C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACxK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAA,CAAa,UAAkB,OAAA,EAA6E;AAC1G,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,kDAAA,EAAoD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAChL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAA,CAAU,QAAA,EAAkB,MAAA,EAAwC,OAAA,EAA4F;AAC9J,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,oDAAoD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC7L;AACF,CAAA;AAGO,IAAM,wBAAA,GAAN,cAAuC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BxD,KAAA,CAAM,QAAA,EAAkB,MAAA,EAAmC,OAAA,EAAqF;AAC9I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAClN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,KAAA,CAAM,UAAkB,OAAA,EAA0E;AAChG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAClL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,MAAA,CAAO,QAAoC,OAAA,EAA0E;AACnH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,oCAAoC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC3K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,8CAAA,EAAgD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC9K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,MAAA,CAAO,QAAA,EAAkB,MAAA,EAAoC,OAAA,EAAgD;AAC3G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,qDAAA,EAAuD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,EAAG,OAAO,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC5M;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,KAAK,OAAA,EAAuD;AAC1D,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,kCAAA,EAAoC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACvI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,QAAA,CAAS,UAAkB,OAAA,EAA0E;AACnG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,8CAAA,EAAgD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC3K;AACF,CAAA;AAGO,IAAM,+BAAA,GAAN,cAA8C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqB/D,QAAA,CAAS,QAAgB,OAAA,EAAmF;AAC1G,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,qDAAA,EAAuD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC9K;AACF,CAAA;AAGO,IAAM,0BAAA,GAAN,cAAyC,WAAA,CAAY;AAAA,EAC1D,MAAA;AAAA,EACA,IAAI,KAAA,GAAyC;AAC3C,IAAA,OAAQ,KAAK,MAAA,KAAW,IAAI,gCAAgC,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,SAAS,OAAA,EAA6E;AACpF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC7I;AACF,CAAA;AAGO,IAAM,2BAAA,GAAN,cAA0C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuB3D,MAAA,CAAO,MAAA,EAAgB,MAAA,EAAsC,OAAA,EAA4E;AACvI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,gDAAA,EAAkD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC1M;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,MAAA,EAAgB,SAAA,EAAmB,OAAA,EAA4C;AACpF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,QAAA,EAAU,IAAA,EAAM,+DAA+D,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,OAAA,EAAS,MAAA,EAAQ,YAAY,SAAA,EAAU,IAAK,OAAO,CAAA;AAAA,EAChN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,IAAA,CAAK,QAAgB,OAAA,EAAgF;AACnG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,gDAAA,EAAkD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,OAAA,CAAQ,MAAA,EAAgB,SAAA,EAAmB,OAAA,EAA4C;AACrF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,uEAAuE,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,OAAA,EAAS,MAAA,EAAQ,YAAY,SAAA,EAAU,IAAK,OAAO,CAAA;AAAA,EACtN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,kBAAA,CAAmB,MAAA,EAAgB,SAAA,EAAmB,OAAA,EAAoF;AACxI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,mFAAmF,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,OAAA,EAAS,MAAA,EAAQ,YAAY,SAAA,EAAU,IAAK,OAAO,CAAA;AAAA,EAClO;AACF,CAAA;AAGO,IAAM,0BAAA,GAAN,cAAyC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuB1D,OAAO,OAAA,EAAuE;AAC5E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,oCAAA,EAAsC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC/J;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,QAAA,CAAS,OAAe,OAAA,EAAuE;AAC7F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,6CAAA,EAA+C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,QAAQ,KAAA,EAAM,IAAK,OAAO,CAAA;AAAA,EACpK;AACF,CAAA;AAGO,IAAM,0BAAA,GAAN,cAAyC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoB1D,MAAA,CAAO,QAAqC,OAAA,EAA2E;AACrH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,uCAAuC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC9K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,iDAAA,EAAmD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACjL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,IAAA,CAAK,QAAoC,OAAA,EAAwD;AAC/F,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACzJ;AACF,CAAA;AAGO,IAAM,sBAAA,GAAN,cAAqC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBtD,mBAAA,CAAoB,QAAgB,OAAA,EAAoF;AACtH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,gEAAA,EAAkE,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC1L;AACF,CAAA;AAGO,IAAM,2BAAA,GAAN,cAA0C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoB3D,SAAA,CAAU,QAAgB,OAAA,EAA4C;AACpE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,2DAAA,EAA6D,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACrL;AACF,CAAA;AAGO,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAA,EACnD,SAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA,EACA,IAAI,QAAA,GAAwC;AAC1C,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,4BAA4B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAClF;AAAA,EACA,IAAI,OAAA,GAAsC;AACxC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,2BAA2B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAChF;AAAA,EACA,IAAI,OAAA,GAAsC;AACxC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,2BAA2B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAChF;AAAA,EACA,IAAI,GAAA,GAA8B;AAChC,IAAA,OAAQ,KAAK,IAAA,KAAS,IAAI,uBAAuB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACxE;AAAA,EACA,IAAI,QAAA,GAAwC;AAC1C,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,4BAA4B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,UAAA,CAAW,QAAmC,OAAA,EAA+E;AAC3H,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,yCAAA,EAA2C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAChK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,kBAAA,CAAmB,QAA2C,OAAA,EAA+E;AAC3I,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,kDAAA,EAAoD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,cAAA,CAAe,QAAuC,OAAA,EAA+E;AACnI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,8CAAA,EAAgD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,gBAAA,CAAiB,QAAyC,OAAA,EAA+E;AACvI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,gDAAA,EAAkD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACvK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,QAAgB,OAAA,EAA4C;AACjE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,uCAAA,EAAyC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACnK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,MAAA,CAAO,QAAgC,OAAA,EAAgD;AACrF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,sCAAsC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,KAAA,EAAO,QAAQ,GAAA,EAAK,IAAA,IAAQ,OAAO,CAAA;AAAA,EACtK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,IAAA,CAAK,QAA8B,OAAA,EAAyD;AAC1F,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,6BAAA,EAA+B,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACjJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,kBAAA,CAAmB,QAAgB,OAAA,EAAoF;AACrH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,2DAAA,EAA6D,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACrL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,QAAA,CAAS,QAAgB,OAAA,EAA4E;AACnG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,uCAAA,EAAyC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAChK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,MAAA,EAAgB,MAAA,EAAgC,OAAA,EAA4E;AACjI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,yCAAyC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,OAAA,EAAS,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAChL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAmC,OAAA,EAAmF;AAC/I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,8CAA8C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,OAAA,EAAS,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACrL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,YAAA,CAAa,MAAA,EAAgB,MAAA,EAAqC,OAAA,EAA4E;AAC5I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,gDAAgD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,OAAA,EAAS,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACvL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,GAAA,CAAI,QAAgB,OAAA,EAA4E;AAC9F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,uCAAA,EAAyC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAChK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAAA,CAAkB,QAAgB,OAAA,EAA4C;AAC5E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,2DAAA,EAA6D,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACrL;AACF,CAAA;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMlD,MAAA,CAAO,QAAqC,OAAA,EAA2E;AACrH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,uCAAuC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC9K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAA,CAAK,QAAoC,OAAA,EAAwD;AAC/F,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACzJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,iDAAA,EAAmD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACjL;AACF,CAAA;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBlD,MAAA,CAAO,WAAmB,OAAA,EAA4C;AACpE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,wCAAA,EAA0C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,YAAY,SAAA,EAAU,IAAK,OAAO,CAAA;AAAA,EAC1K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,IAAA,CAAK,QAA6B,OAAA,EAA2D;AAC3F,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,2BAAA,EAA6B,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EAC/I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,WAAmB,OAAA,EAA4C;AACpE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,wCAAA,EAA0C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,YAAY,SAAA,EAAU,IAAK,OAAO,CAAA;AAAA,EAC1K;AACF,CAAA;AAGO,IAAM,+BAAA,GAAN,cAA8C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqB/D,SAAS,OAAA,EAAqF;AAC5F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,yCAAA,EAA2C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACjJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,MAAA,CAAO,QAA4C,OAAA,EAAqF;AACtI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,yCAAA,EAA2C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACjK;AACF,CAAA;AAGO,IAAM,wBAAA,GAAN,cAAuC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2BxD,IAAA,CAAK,MAAc,OAAA,EAA8E;AAC/F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,6CAAA,EAA+C,UAAA,EAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,GAAG,MAAA,EAAQ,IAAA,IAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC9K;AACF,CAAA;AAGO,IAAM,iCAAA,GAAN,cAAgD,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBjE,KAAK,OAAA,EAAiF;AACpF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,2CAAA,EAA6C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACnJ;AACF,CAAA;AAGO,IAAM,sBAAA,GAAN,cAAqC,WAAA,CAAY;AAAA,EACtD,YAAA;AAAA,EACA,IAAI,WAAA,GAAiD;AACnD,IAAA,OAAQ,KAAK,YAAA,KAAiB,IAAI,kCAAkC,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,QAA2C,OAAA,EAAwE;AACxH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,iCAAiC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACxK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,eAAuB,OAAA,EAA4C;AACxE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,gDAAA,EAAkD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,gBAAgB,aAAA,EAAc,IAAK,OAAO,CAAA;AAAA,EAC1L;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,KAAK,OAAA,EAA6F;AAChG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,+BAAA,EAAiC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACvI;AACF,CAAA;AAGO,IAAM,2BAAA,GAAN,cAA0C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmB3D,KAAK,OAAA,EAAwF;AAC3F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC7I;AACF,CAAA;AAGO,IAAM,gBAAA,GAAN,cAA+B,WAAA,CAAY;AAAA,EAChD,YAAA;AAAA,EACA,IAAI,WAAA,GAA2C;AAC7C,IAAA,OAAQ,KAAK,YAAA,KAAiB,IAAI,4BAA4B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACrF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,QAA4B,OAAA,EAA2E;AAC5G,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,gCAAA,EAAkC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACvJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,QAAqC,OAAA,EAAkE;AAC5G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,2BAA2B,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAClK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,IAAA,CAAK,QAAoC,OAAA,EAA+C;AACtF,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,yBAAA,EAA2B,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EAC7I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,QAAA,CAAS,UAAkB,OAAA,EAAiF;AAC1G,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAClK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,QAAA,EAAkB,MAAA,EAAsC,OAAA,EAAkE;AAC/H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,uCAAuC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAClL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,iBAAA,CAAkB,QAAA,EAAkB,MAAA,EAAgD,OAAA,EAAoG;AACtL,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,mDAAmD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC5L;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,GAAA,CAAI,UAAkB,OAAA,EAAiF;AACrG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAClK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,gBAAgB,OAAA,EAAwF;AACtG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,qCAAA,EAAuC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC7I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAA,CAAe,QAAA,EAAkB,MAAA,EAAgD,OAAA,EAAoG;AACnL,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,mDAAmD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC5L;AACF,CAAA;AAGO,IAAM,sBAAA,GAAN,cAAqC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBtD,SAAS,OAAA,EAAyE;AAChF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,gCAAA,EAAkC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACxI;AACF,CAAA;AAGO,IAAM,sBAAA,GAAN,cAAqC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBtD,MAAA,CAAO,QAAkC,OAAA,EAAwE;AAC/G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,mCAAmC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC1K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,QAAA,CAAS,QAAgB,OAAA,EAAwE;AAC/F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,2CAAA,EAA6C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACpK;AACF,CAAA;AAGO,IAAM,8BAAA,GAAN,cAA6C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqB9D,SAAS,OAAA,EAAiF;AACxF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,0CAAA,EAA4C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAClJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,MAAA,CAAO,QAAoD,OAAA,EAAiF;AAC1I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,4CAA4C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAClL;AACF,CAAA;AAGO,IAAM,wBAAA,GAAN,cAAuC,WAAA,CAAY;AAAA,EACxD,OAAA;AAAA,EACA,IAAI,MAAA,GAAyC;AAC3C,IAAA,OAAQ,KAAK,OAAA,KAAY,IAAI,+BAA+B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,OAAe,OAAA,EAA4C;AAChE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,4CAAA,EAA8C,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,QAAQ,KAAA,EAAM,IAAK,OAAO,CAAA;AAAA,EACtK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,IAAA,CAAK,QAA4C,OAAA,EAA+D;AAC9G,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,mCAAA,EAAqC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACvJ;AACF,CAAA;AAGO,IAAM,yBAAA,GAAN,cAAwC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBzD,MAAA,CAAO,QAAA,EAAkB,MAAA,EAA6C,OAAA,EAAgF;AACpJ,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,+CAAA,EAAiD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC7M;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAA,CAAO,QAAA,EAAkB,QAAA,EAAkB,OAAA,EAA4C;AACrF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,QAAA,EAAU,IAAA,EAAM,6DAA6D,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,EAAU,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAChN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,IAAA,CAAK,QAAA,EAAkB,MAAA,EAA4C,OAAA,EAAuD;AACxH,IAAA,OAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,iDAAiD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACxL;AACF,CAAA;AAGO,IAAM,yBAAA,GAAN,cAAwC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBzD,MAAA,CAAO,QAAA,EAAkB,MAAA,EAA6C,OAAA,EAAuE;AAC3I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,+CAAA,EAAiD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC7M;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,QAAA,EAAkB,SAAA,EAAmB,OAAA,EAA4C;AACtF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,QAAA,EAAU,IAAA,EAAM,8DAA8D,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,EAAU,YAAY,SAAA,EAAU,IAAK,OAAO,CAAA;AAAA,EACnN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,IAAA,CAAK,QAAA,EAAkB,MAAA,EAA4C,OAAA,EAA2D;AAC5H,IAAA,OAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,iDAAiD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACxL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAA,CAAO,QAAA,EAAkB,SAAA,EAAmB,MAAA,EAA6C,OAAA,EAA8E;AACrK,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,4DAAA,EAA8D,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAU,UAAA,EAAY,WAAU,EAAG,IAAA,EAAM,MAAA,EAAO,EAAG,OAAO,CAAA;AAAA,EAChO;AACF,CAAA;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAA,EAClD,QAAA;AAAA,EACA,QAAA;AAAA,EACA,IAAI,OAAA,GAAqC;AACvC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,0BAA0B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC/E;AAAA,EACA,IAAI,OAAA,GAAqC;AACvC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,0BAA0B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,QAAuC,OAAA,EAAoE;AAChH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,6BAA6B,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACpK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,uCAAA,EAAyC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACvK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,IAAA,CAAK,QAAsC,OAAA,EAAiD;AAC1F,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,2BAAA,EAA6B,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EAC/I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,QAAA,CAAS,UAAkB,OAAA,EAAoE;AAC7F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,uCAAA,EAAyC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACpK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAA,CAAO,QAAA,EAAkB,MAAA,EAAwC,OAAA,EAAoE;AACnI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,yCAAyC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAQ,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACpL;AACF,CAAA;AAGO,IAAM,kCAAA,GAAN,cAAiD,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBlE,SAAS,OAAA,EAA2F;AAClG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,6CAAA,EAA+C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACrJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,GAAA,CAAI,QAA6C,OAAA,EAAwF;AACvI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,mDAAmD,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC1L;AACF,CAAA;AAGO,IAAM,yBAAA,GAAN,cAAwC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBzD,SAAS,OAAA,EAA4E;AACnF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,mCAAA,EAAqC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC3I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,QAAsC,OAAA,EAA4E;AACvH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,mCAAA,EAAqC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACzJ;AACF,CAAA;AAGO,IAAM,4BAAA,GAAN,cAA2C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyB5D,MAAA,CAAO,QAAuC,OAAA,EAAuF;AACnI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,wCAAwC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC/K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAA,CAAO,YAAoB,OAAA,EAA4C;AACrE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,aAAa,UAAA,EAAW,IAAK,OAAO,CAAA;AAAA,EACxL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,KAAK,OAAA,EAA0D;AAC7D,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,sCAAA,EAAwC,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC3I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,QAAA,CAAS,YAAoB,OAAA,EAA6E;AACxG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,aAAa,UAAA,EAAW,IAAK,OAAO,CAAA;AAAA,EACrL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,YAAA,CAAa,UAAA,EAAoB,MAAA,EAA8C,OAAA,EAAuF;AACpK,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,kEAAA,EAAoE,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,aAAa,UAAA,EAAW,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EACpO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,IAAA,CAAK,UAAA,EAAoB,MAAA,EAAqC,OAAA,EAAoF;AAChJ,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,yDAAA,EAA2D,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,aAAa,UAAA,EAAW,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC3N;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,MAAA,CAAO,UAAA,EAAoB,MAAA,EAAwC,OAAA,EAA6E;AAC9I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,oDAAA,EAAsD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,aAAa,UAAA,EAAW,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EACvN;AACF,CAAA;AAGO,IAAM,6BAAA,GAAN,cAA4C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqB7D,KAAK,OAAA,EAAmF;AACtF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,wCAAA,EAA0C,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAChJ;AACF,CAAA;AAGO,IAAM,yBAAA,GAAN,cAAwC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BzD,IAAA,CAAK,QAAmC,OAAA,EAAuD;AAC7F,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,mCAAA,EAAqC,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACvJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,MAAA,CAAO,OAAA,EAAiB,MAAA,EAAqC,OAAA,EAAgF;AAC3I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,qDAAA,EAAuD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,UAAU,OAAA,EAAQ,EAAG,OAAO,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAClN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,QAAA,CAAS,SAAiB,OAAA,EAAgF;AACxG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,8CAAA,EAAgD,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,EAAQ,UAAU,OAAA,EAAQ,IAAK,OAAO,CAAA;AAAA,EACzK;AACF,CAAA;AAGO,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAA,EACnD,UAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,IAAI,SAAA,GAA0C;AAC5C,IAAA,OAAQ,KAAK,UAAA,KAAe,IAAI,6BAA6B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACpF;AAAA,EACA,IAAI,UAAA,GAA4C;AAC9C,IAAA,OAAQ,KAAK,WAAA,KAAgB,IAAI,8BAA8B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACtF;AAAA,EACA,IAAI,MAAA,GAAoC;AACtC,IAAA,OAAQ,KAAK,OAAA,KAAY,IAAI,0BAA0B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC9E;AACF,CAAA;AAGO,IAAM,OAAA,GAAN,cAAsB,WAAA,CAAY;AAAA,EACvC,QAAA;AAAA,EACA,UAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,qBAAA;AAAA,EACA,cAAA;AAAA,EACA,YAAA;AAAA,EACA,MAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA,EACA,QAAA;AAAA,EACA,wBAAA;AAAA,EACA,eAAA;AAAA,EACA,SAAA;AAAA;AAAA,EAEA,IAAI,KAAA,GAAgB;AAClB,IAAA,OAAO,KAAK,EAAA,CAAG,MAAA;AAAA,EACjB;AAAA,EACA,IAAI,OAAA,GAA8B;AAChC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,mBAAmB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACxE;AAAA,EACA,IAAI,SAAA,GAAkC;AACpC,IAAA,OAAQ,KAAK,UAAA,KAAe,IAAI,qBAAqB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC5E;AAAA,EACA,IAAI,SAAA,GAAkC;AACpC,IAAA,OAAQ,KAAK,UAAA,KAAe,IAAI,qBAAqB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC5E;AAAA,EACA,IAAI,UAAA,GAAoC;AACtC,IAAA,OAAQ,KAAK,WAAA,KAAgB,IAAI,sBAAsB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC9E;AAAA,EACA,IAAI,WAAA,GAAsC;AACxC,IAAA,OAAQ,KAAK,YAAA,KAAiB,IAAI,uBAAuB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAChF;AAAA,EACA,IAAI,aAAA,GAA0C;AAC5C,IAAA,OAAQ,KAAK,cAAA,KAAmB,IAAI,yBAAyB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACpF;AAAA,EACA,IAAI,eAAA,GAA8C;AAChD,IAAA,OAAQ,KAAK,gBAAA,KAAqB,IAAI,2BAA2B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACxF;AAAA,EACA,IAAI,QAAA,GAAgC;AAClC,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,oBAAoB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC1E;AAAA;AAAA,EAEA,IAAI,OAAA,GAA8B;AAChC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,mBAAmB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACxE;AAAA,EACA,IAAI,OAAA,GAA8B;AAChC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,mBAAmB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACxE;AAAA,EACA,IAAI,oBAAA,GAAwD;AAC1D,IAAA,OAAQ,KAAK,qBAAA,KAA0B,IAAI,gCAAgC,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAClG;AAAA,EACA,IAAI,aAAA,GAA0C;AAC5C,IAAA,OAAQ,KAAK,cAAA,KAAmB,IAAI,yBAAyB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACpF;AAAA,EACA,IAAI,WAAA,GAAsC;AACxC,IAAA,OAAQ,KAAK,YAAA,KAAiB,IAAI,uBAAuB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAChF;AAAA,EACA,IAAI,KAAA,GAA0B;AAC5B,IAAA,OAAQ,KAAK,MAAA,KAAW,IAAI,iBAAiB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACpE;AAAA,EACA,IAAI,WAAA,GAAsC;AACxC,IAAA,OAAQ,KAAK,YAAA,KAAiB,IAAI,uBAAuB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAChF;AAAA,EACA,IAAI,WAAA,GAAsC;AACxC,IAAA,OAAQ,KAAK,YAAA,KAAiB,IAAI,uBAAuB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAChF;AAAA,EACA,IAAI,aAAA,GAA0C;AAC5C,IAAA,OAAQ,KAAK,cAAA,KAAmB,IAAI,yBAAyB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACpF;AAAA,EACA,IAAI,OAAA,GAA8B;AAChC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,mBAAmB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACxE;AAAA,EACA,IAAI,uBAAA,GAA8D;AAChE,IAAA,OAAQ,KAAK,wBAAA,KAA6B,IAAI,mCAAmC,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACxG;AAAA,EACA,IAAI,cAAA,GAA4C;AAC9C,IAAA,OAAQ,KAAK,eAAA,KAAoB,IAAI,0BAA0B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACtF;AAAA,EACA,IAAI,QAAA,GAAgC;AAClC,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,oBAAoB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,KAAA,CAAM,QAAuB,OAAA,EAAsE;AACjG,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,2BAA2B,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,QAAO,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAClK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,YAAA,CAAa,QAA8B,OAAA,EAAiE;AAC1G,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,0BAAA,EAA4B,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAClJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,OAAA,EAA4C;AACjD,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC9H;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,OAAA,EAAiE;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,QAAQ,IAAA,CAAK,EAAA,CAAG,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EAC3H;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,QAA4B,OAAA,EAAiE;AAClG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,MAAA,EAAQ,KAAK,EAAA,CAAG,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC3I;AACF;AAGO,IAAM,oBAAA,GAAN,cAAmC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMpD,YAAA,CAAa,QAA8B,OAAA,EAAkF;AAC3H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,qCAAqC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC5K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,QAAwB,OAAA,EAA4C;AACzE,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAA,CAAQ,QAAyB,OAAA,EAA2E;AAC1G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,+BAA+B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACtK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAA,CAAa,QAAuC,OAAA,EAA+E;AACjI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,4CAAA,EAA8C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACvK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,mBAAA,CAAoB,QAAsC,OAAA,EAA+E;AACvI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,0CAAA,EAA4C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAA,CAAc,QAA+B,OAAA,EAA4C;AACvF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,sCAAsC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC7K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,sBAAA,CAAuB,QAAwC,OAAA,EAAkF;AAC/I,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,+CAAA,EAAiD,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC1K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,qBAAA,CAAsB,QAAuC,OAAA,EAAkF;AAC7I,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,6CAAA,EAA+C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACxK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,QAAwB,OAAA,EAA4E;AACzG,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAAA,CAAmB,MAAyD,OAAA,EAAwF;AAClK,IAAA,MAAM,EAAE,QAAA,EAAU,GAAG,MAAA,EAAO,GAAI,IAAA;AAChC,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,wCAAwC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,QAAA,EAAS,EAAG,MAAM,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EACzL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,QAAwB,OAAA,EAA4E;AACzG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACvJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,QAA6B,OAAA,EAA4E;AAC9G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AACF,CAAA;AAGO,IAAM,0BAAA,GAAN,cAAyC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqB1D,KAAK,OAAA,EAA0D;AAC7D,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACrI;AACF,CAAA;AAGO,IAAM,0BAAA,GAAN,cAAyC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsB1D,MAAA,CAAO,QAAiC,OAAA,EAAuE;AAC7G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAA,CAAO,IAAY,OAAA,EAA4C;AAC7D,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,iCAAA,EAAmC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,EAAA,EAAG,IAAK,OAAO,CAAA;AAAA,EACpJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,KAAK,OAAA,EAAwE;AAC3E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACxI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,OAAA,CAAQ,IAAY,OAAA,EAA4C;AAC9D,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,yCAAA,EAA2C,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,EAAA,EAAG,IAAK,OAAO,CAAA;AAAA,EAC1J;AACF,CAAA;AAGO,IAAM,4BAAA,GAAN,cAA2C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwB5D,MAAA,CAAO,QAAmC,OAAA,EAA6E;AACrH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,iCAAiC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC5K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,IAAY,OAAA,EAA4C;AAC7D,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,oCAAA,EAAsC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,EAAA,EAAG,IAAK,OAAO,CAAA;AAAA,EACvJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,KAAK,OAAA,EAAwE;AAC3E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,+BAAA,EAAiC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC3I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,EAAA,EAAY,MAAA,EAAoC,OAAA,EAA+E;AACpI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,2CAAA,EAA6C,UAAA,EAAY,EAAE,QAAA,EAAU,IAAA,CAAK,GAAG,QAAA,EAAU,EAAA,IAAM,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC1K;AACF,CAAA;AAGO,IAAM,kCAAA,GAAN,cAAiD,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBlE,WAAW,OAAA,EAA2E;AACpF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,iDAAA,EAAmD,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC9J;AACF,CAAA;AAGO,IAAM,mCAAA,GAAN,cAAkD,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBnE,QAAQ,OAAA,EAA6E;AACnF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,gDAAA,EAAkD,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC7J;AACF,CAAA;AAGO,IAAM,2BAAA,GAAN,cAA0C,WAAA,CAAY;AAAA,EAC3D,SAAA;AAAA,EACA,IAAI,QAAA,GAAgD;AAClD,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,oCAAoC,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,QAAA,CAAS,QAAsC,OAAA,EAA4E;AACzH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,yCAAA,EAA2C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACpK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,QAAoC,OAAA,EAAoE;AAC7G,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,+BAAA,EAAiC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC1J;AACF,CAAA;AAGO,IAAM,qBAAA,GAAN,cAAoC,WAAA,CAAY;AAAA,EACrD,QAAA;AAAA,EACA,cAAA;AAAA,EACA,OAAA;AAAA,EACA,IAAI,OAAA,GAAwC;AAC1C,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,6BAA6B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAClF;AAAA,EACA,IAAI,aAAA,GAAoD;AACtD,IAAA,OAAQ,KAAK,cAAA,KAAmB,IAAI,mCAAmC,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC9F;AAAA,EACA,IAAI,MAAA,GAAsC;AACxC,IAAA,OAAQ,KAAK,OAAA,KAAY,IAAI,4BAA4B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAChF;AACF,CAAA;AAGO,IAAM,0BAAA,GAAN,cAAyC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqB1D,MAAA,CAAO,IAAY,OAAA,EAA4C;AAC7D,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,iCAAA,EAAmC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,EAAA,EAAG,IAAK,OAAO,CAAA;AAAA,EACpJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,KAAK,OAAA,EAAoD;AACvD,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACrI;AACF,CAAA;AAGO,IAAM,+BAAA,GAAN,cAA8C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwB/D,MAAA,CAAO,QAAsC,OAAA,EAAkF;AAC7H,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,yCAAA,EAA2C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACpK;AACF,CAAA;AAGO,IAAM,yBAAA,GAAN,cAAwC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBzD,KAAK,OAAA,EAAuE;AAC1E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,gCAAA,EAAkC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC5I;AACF,CAAA;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAA,EAClD,SAAA;AAAA,EACA,SAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA,EACA,cAAA;AAAA,EACA,QAAA;AAAA,EACA,IAAI,QAAA,GAAuC;AACzC,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,2BAA2B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACjF;AAAA,EACA,IAAI,QAAA,GAAuC;AACzC,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,2BAA2B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACjF;AAAA,EACA,IAAI,GAAA,GAA6B;AAC/B,IAAA,OAAQ,KAAK,IAAA,KAAS,IAAI,sBAAsB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACvE;AAAA,EACA,IAAI,QAAA,GAAuC;AACzC,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,2BAA2B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACjF;AAAA,EACA,IAAI,aAAA,GAAiD;AACnD,IAAA,OAAQ,KAAK,cAAA,KAAmB,IAAI,gCAAgC,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC3F;AAAA,EACA,IAAI,OAAA,GAAqC;AACvC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,0BAA0B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,cAAA,CAAe,QAAkC,OAAA,EAA4C;AAC3F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,mCAAA,EAAqC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC9J;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,cAAc,OAAA,EAA4C;AACxD,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAClI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,aAAa,OAAA,EAA4C;AACvD,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,0BAAA,EAA4B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACzI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,YAAY,OAAA,EAA2E;AACrF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,+BAAA,EAAiC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC3I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,SAAS,OAAA,EAAuE;AAC9E,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC/H;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,QAA2B,OAAA,EAA8E;AAC9G,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC/I;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,YAAA,CAAa,QAAgC,OAAA,EAAuE;AAClH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,4BAA4B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,SAAS,MAAM,CAAA,IAAK,OAAO,CAAA;AAAA,EAC/J;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,OAAA,EAA0D;AACpE,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACrI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAW,OAAA,EAAuE;AAChF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC/H;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAa,OAAA,EAAoD;AAC/D,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACrI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAA,CAAc,IAAY,OAAA,EAA4C;AACpE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,iCAAA,EAAmC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,EAAA,EAAG,IAAK,OAAO,CAAA;AAAA,EACpJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAA,CAAc,QAA2B,OAAA,EAA8E;AACrH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,mBAAA,EAAqB,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC/I;AACF,CAAA;AAGO,IAAM,2BAAA,GAAN,cAA0C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsB3D,OAAA,CAAQ,QAAoC,OAAA,EAAqF;AAC/H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,4CAA4C,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACnL;AACF,CAAA;AAGO,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAA,EACnD,SAAA;AAAA,EACA,IAAI,QAAA,GAAwC;AAC1C,IAAA,OAAQ,KAAK,SAAA,KAAc,IAAI,4BAA4B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,QAA2B,OAAA,EAA6E;AAC7G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,kCAAkC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,OAAA,CAAQ,QAA4B,OAAA,EAA2E;AAC7G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,mCAAmC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC1K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,QAAA,CAAS,QAA6B,OAAA,EAAiF;AACrH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,qCAAqC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC5K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,QAA2B,OAAA,EAA2E;AAC3G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,kCAAkC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,gBAAA,CAAiB,QAAqC,OAAA,EAAqF;AACzI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,yCAAyC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAChL;AACF,CAAA;AAGO,IAAM,qBAAA,GAAN,cAAoC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBrD,UAAA,CAAW,QAAkC,OAAA,EAAwE;AACnH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,iCAAA,EAAmC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC5J;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,KAAA,CAAM,QAA4B,OAAA,EAAwE;AACxG,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAAA,CAAkB,QAA4B,OAAA,EAAwE;AACpH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AACF,CAAA;AAGO,IAAM,uBAAA,GAAN,cAAsC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBvD,OAAA,CAAQ,QAAiC,OAAA,EAAqF;AAC5H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,uCAAuC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC9K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAA,CAAO,QAA+B,OAAA,EAA2E;AAC/G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,sCAAsC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC7K;AACF,CAAA;AAGO,IAAM,2BAAA,GAAN,cAA0C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuB3D,MAAA,CAAO,QAAgD,OAAA,EAAqF;AAC1I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,oCAAoC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC/K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,MAAA,CAAO,eAAuB,OAAA,EAA4C;AACxE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,mDAAA,EAAqD,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,gBAAgB,aAAA,EAAc,IAAK,OAAO,CAAA;AAAA,EACjM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,KAAK,OAAA,EAAkG;AACrG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,kCAAA,EAAoC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC9I;AACF,CAAA;AAGO,IAAM,qBAAA,GAAN,cAAoC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBrD,MAAA,CAAO,QAA0C,OAAA,EAA0E;AACzH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,wCAAA,EAA0C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EAC5K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BA,IAAA,CAAK,QAAyC,OAAA,EAAuD;AACnG,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACpJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,QAAA,CAAS,UAAkB,OAAA,EAAyF;AAClH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,wCAAA,EAA0C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,MAAA,CAAO,QAAA,EAAkB,MAAA,EAA2C,OAAA,EAA0E;AAC5I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,0CAA0C,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACzL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,iBAAA,CAAkB,QAAA,EAAkB,MAAA,EAAqD,OAAA,EAAyG;AAChM,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,sDAAsD,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACnM;AACF,CAAA;AAGO,IAAM,mCAAA,GAAN,cAAkD,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBnE,SAAS,OAAA,EAAiF;AACxF,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,uCAAA,EAAyC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACnJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,MAAA,CAAO,QAAyD,OAAA,EAAiF;AAC/I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,yCAAyC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACnL;AACF,CAAA;AAGO,IAAM,6BAAA,GAAN,cAA4C,WAAA,CAAY;AAAA,EAC7D,OAAA;AAAA,EACA,IAAI,MAAA,GAA8C;AAChD,IAAA,OAAQ,KAAK,OAAA,KAAY,IAAI,oCAAoC,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,MAAA,CAAO,QAAoC,OAAA,EAAoF;AAC7H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,kCAAkC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC7K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,OAAe,OAAA,EAA4C;AAChE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,yCAAA,EAA2C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,QAAQ,KAAA,EAAM,IAAK,OAAO,CAAA;AAAA,EACvK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,UAAA,CAAW,QAAwC,OAAA,EAAuF;AACxI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,2CAAA,EAA6C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACtK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,IAAA,CAAK,QAAiD,OAAA,EAAuD;AAC3G,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,gCAAA,EAAkC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACxJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,MAAA,CAAO,KAAA,EAAe,MAAA,EAAqC,OAAA,EAAoF;AAC7I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,gDAAA,EAAkD,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,QAAQ,KAAA,EAAM,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC5M;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAA,CAAO,OAAe,OAAA,EAAgF;AACpG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,gDAAA,EAAkD,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,QAAQ,KAAA,EAAM,IAAK,OAAO,CAAA;AAAA,EAC3K;AACF,CAAA;AAGO,IAAM,8BAAA,GAAN,cAA6C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyB9D,MAAA,CAAO,QAAA,EAAkB,MAAA,EAAkD,OAAA,EAAgF;AACzJ,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,4CAAA,EAA8C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,WAAW,QAAA,EAAS,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC9M;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAA,CAAO,QAAA,EAAkB,QAAA,EAAkB,OAAA,EAA4C;AACrF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,QAAA,EAAU,IAAA,EAAM,0DAA0D,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,SAAA,EAAW,QAAA,EAAU,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACjN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,IAAA,CAAK,QAAA,EAAkB,MAAA,EAAiD,OAAA,EAAuD;AAC7H,IAAA,OAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,8CAA8C,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,SAAA,EAAW,QAAA,IAAY,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACzL;AACF,CAAA;AAGO,IAAM,8BAAA,GAAN,cAA6C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsB9D,MAAA,CAAO,QAAA,EAAkB,MAAA,EAAkD,OAAA,EAA+E;AACxJ,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,4CAAA,EAA8C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,WAAW,QAAA,EAAS,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EAC9M;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAA,CAAO,QAAA,EAAkB,SAAA,EAAmB,OAAA,EAA4C;AACtF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,QAAA,EAAU,IAAA,EAAM,2DAA2D,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,SAAA,EAAW,QAAA,EAAU,YAAY,SAAA,EAAU,IAAK,OAAO,CAAA;AAAA,EACpN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,IAAA,CAAK,QAAA,EAAkB,MAAA,EAAiD,OAAA,EAAmE;AACzI,IAAA,OAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,8CAA8C,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,SAAA,EAAW,QAAA,IAAY,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACzL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,QAAA,EAAkB,SAAA,EAAmB,MAAA,EAAkD,OAAA,EAAsF;AAClL,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,yDAAA,EAA2D,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,WAAW,QAAA,EAAU,UAAA,EAAY,WAAU,EAAG,IAAA,EAAM,MAAA,EAAO,EAAG,OAAO,CAAA;AAAA,EACjO;AACF,CAAA;AAGO,IAAM,uBAAA,GAAN,cAAsC,WAAA,CAAY;AAAA,EACvD,QAAA;AAAA,EACA,QAAA;AAAA,EACA,IAAI,OAAA,GAA0C;AAC5C,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,+BAA+B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACpF;AAAA,EACA,IAAI,OAAA,GAA0C;AAC5C,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,+BAA+B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,QAA4C,OAAA,EAA4E;AAC7H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,0BAA0B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAA,CAAO,UAAkB,OAAA,EAA4C;AACnE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,oCAAA,EAAsC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACxK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,IAAA,CAAK,QAA2C,OAAA,EAAyD;AACvG,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,wBAAA,EAA0B,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EAChJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,QAAA,CAAS,UAAkB,OAAA,EAA4E;AACrG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,oCAAA,EAAsC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,QAAA,EAAkB,MAAA,EAA6C,OAAA,EAA4E;AAChJ,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,sCAAsC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,SAAA,EAAW,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACrL;AACF,CAAA;AAGO,IAAM,4BAAA,GAAN,cAA2C,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0B5D,MAAA,CAAO,MAAA,EAAgB,MAAA,EAAkC,OAAA,EAAkF;AACzI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,wCAAA,EAA0C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,SAAS,MAAA,EAAO,EAAG,MAAM,MAAA,EAAQ,UAAA,EAAY,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EACtM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,MAAA,EAAgB,QAAA,EAAkB,OAAA,EAA4C;AACnF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,QAAA,EAAU,IAAA,EAAM,sDAAsD,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,OAAA,EAAS,MAAA,EAAQ,WAAW,QAAA,EAAS,IAAK,OAAO,CAAA;AAAA,EACzM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,IAAA,CAAK,QAAgB,OAAA,EAAwE;AAC3F,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,wCAAA,EAA0C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACrK;AACF,CAAA;AAGO,IAAM,qBAAA,GAAN,cAAoC,WAAA,CAAY;AAAA,EACrD,QAAA;AAAA,EACA,IAAI,OAAA,GAAwC;AAC1C,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,6BAA6B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2BA,MAAA,CAAO,QAA4B,OAAA,EAAsF;AACvH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,UAAA,EAAY,IAAA,IAAQ,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,MAAA,CAAO,QAAgB,OAAA,EAA4C;AACjE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAM,sCAAA,EAAwC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACtK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BA,IAAA,CAAK,QAA2B,OAAA,EAA+D;AAC7F,IAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,KAAA,EAAO,MAAA,IAAU,OAAO,CAAA;AAAA,EACpJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,QAAA,CAAS,QAAgB,OAAA,EAAkF;AACzG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,sCAAA,EAAwC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,EAAU,SAAS,MAAA,EAAO,IAAK,OAAO,CAAA;AAAA,EACnK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,MAAA,CAAO,MAAA,EAAgB,MAAA,EAA6B,OAAA,EAAkF;AACpI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,wCAAwC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,OAAA,EAAS,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACnL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgC,OAAA,EAAyF;AAClJ,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,6CAA6C,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,OAAA,EAAS,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACxL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,YAAA,CAAa,MAAA,EAAgB,MAAA,EAAkC,OAAA,EAAkF;AAC/I,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,OAAA,EAAS,IAAA,EAAM,+CAA+C,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,OAAA,EAAS,MAAA,IAAU,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC1L;AACF,CAAA;AAGO,IAAM,sBAAA,GAAN,cAAqC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBtD,SAAA,CAAU,QAAkC,OAAA,EAAuE;AACjH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,4BAA4B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACnK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,cAAA,CAAe,QAAsC,OAAA,EAA4E;AAC/H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,kCAAkC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACzK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,KAAA,CAAM,QAA8B,OAAA,EAAoE;AACtG,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,yBAAyB,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAChK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,QAA8B,OAAA,EAAoE;AACvG,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,yBAAyB,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAChK;AACF,CAAA;AAGO,IAAM,yBAAA,GAAN,cAAwC,WAAA,CAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBzD,KAAK,OAAA,EAAkE;AACrE,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,mCAAA,EAAqC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC7J;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,oBAAoB,OAAA,EAAiF;AACnG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM,8CAAA,EAAgD,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACxK;AACF,CAAA;AAGO,IAAM,YAAA,GAAN,cAA2B,WAAA,CAAY;AAAA,EAC5C,KAAA;AAAA,EACA,GAAA;AAAA,EACA,IAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,MAAA;AAAA,EACA,cAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA;AAAA,EAEA,IAAI,IAAA,GAA6B;AAC/B,IAAA,OAAQ,KAAK,KAAA,KAAU,IAAI,qBAAqB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACvE;AAAA,EACA,IAAI,EAAA,GAAyB;AAC3B,IAAA,OAAQ,KAAK,GAAA,KAAQ,IAAI,mBAAmB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACnE;AAAA,EACA,IAAI,GAAA,GAA2B;AAC7B,IAAA,OAAQ,KAAK,IAAA,KAAS,IAAI,oBAAoB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACrE;AAAA,EACA,IAAI,KAAA,GAA+B;AACjC,IAAA,OAAQ,KAAK,MAAA,KAAW,IAAI,sBAAsB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACzE;AAAA,EACA,IAAI,OAAA,GAAmC;AACrC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,wBAAwB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC7E;AAAA,EACA,IAAI,WAAA,GAA2C;AAC7C,IAAA,OAAQ,KAAK,YAAA,KAAiB,IAAI,4BAA4B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACrF;AAAA,EACA,IAAI,KAAA,GAA+B;AACjC,IAAA,OAAQ,KAAK,MAAA,KAAW,IAAI,sBAAsB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACzE;AAAA,EACA,IAAI,aAAA,GAA+C;AACjD,IAAA,OAAQ,KAAK,cAAA,KAAmB,IAAI,8BAA8B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACzF;AAAA,EACA,IAAI,OAAA,GAAmC;AACrC,IAAA,OAAQ,KAAK,QAAA,KAAa,IAAI,wBAAwB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC7E;AAAA,EACA,IAAI,KAAA,GAA+B;AACjC,IAAA,OAAQ,KAAK,MAAA,KAAW,IAAI,sBAAsB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACzE;AAAA,EACA,IAAI,MAAA,GAAiC;AACnC,IAAA,OAAQ,KAAK,OAAA,KAAY,IAAI,uBAAuB,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EAC3E;AAAA,EACA,IAAI,SAAA,GAAuC;AACzC,IAAA,OAAQ,KAAK,UAAA,KAAe,IAAI,0BAA0B,IAAA,CAAK,OAAA,EAAS,KAAK,EAAE,CAAA;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,YAAA,CAAa,QAA8B,OAAA,EAAkF;AAC3H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,qCAAqC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC5K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,kBAAA,CAAmB,QAAoC,OAAA,EAA2E;AAChI,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,4CAA4C,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACnL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,oBAAA,CAAqB,QAAsC,OAAA,EAAsE;AAC/H,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,sCAAsC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC7K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAA,CAAO,QAAwB,OAAA,EAA4C;AACzE,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,OAAA,CAAQ,QAAyB,OAAA,EAA2E;AAC1G,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,+BAA+B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACtK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BA,oBAAA,CAAqB,QAAuC,OAAA,EAA+E;AACzI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,4CAAA,EAA8C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACvK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BA,mBAAA,CAAoB,QAAsC,OAAA,EAA+E;AACvI,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,0CAAA,EAA4C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,aAAA,CAAc,QAA+B,OAAA,EAA4C;AACvF,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,sCAAsC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EAC7K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,sBAAA,CAAuB,QAAwC,OAAA,EAAkF;AAC/I,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,+CAAA,EAAiD,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC1K;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuCA,qBAAA,CAAsB,QAAuC,OAAA,EAAkF;AAC7I,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,6CAAA,EAA+C,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACxK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,MAAA,CAAO,QAAwB,OAAA,EAA4E;AACzG,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,kBAAA,CAAmB,QAAA,EAAkB,MAAA,EAAoC,OAAA,EAAwF;AAC/J,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,wCAAwC,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAU,QAAA,EAAS,EAAG,MAAM,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAK,EAAG,OAAO,CAAA;AAAA,EACzL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,MAAA,CAAO,QAAwB,OAAA,EAA4E;AACzG,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,4BAAA,EAA8B,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EACvJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,YAAA,CAAa,QAA8B,OAAA,EAA2E;AACpH,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,mCAAA,EAAqC,UAAA,EAAY,EAAE,QAAA,EAAU,KAAK,EAAA,CAAG,QAAA,IAAY,IAAA,EAAM,MAAA,IAAU,OAAO,CAAA;AAAA,EAC9J;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,WAAA,CAAY,QAA6B,OAAA,EAA4E;AACnH,IAAA,OAAO,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,QAAQ,MAAA,EAAQ,IAAA,EAAM,8BAA8B,UAAA,EAAY,EAAE,UAAU,IAAA,CAAK,EAAA,CAAG,UAAS,EAAG,IAAA,EAAM,QAAQ,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,EACrK;AACF,CAAA;;;ACx+LO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EACxB,IAAA;AAAA,EAEhB,WAAA,CAAY,IAAA,EAAc,OAAA,EAAiB,OAAA,EAA+B;AACxE,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAGO,IAAM,eAAA,GAAN,cAA8B,cAAA,CAAe;AAAA,EAClD,WAAA,CAAY,SAAiB,OAAA,EAA+B;AAC1D,IAAA,KAAA,CAAM,iBAAA,EAAmB,SAAS,OAAO,CAAA;AACzC,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EACd;AACF;AAGO,IAAM,eAAA,GAAN,cAA8B,cAAA,CAAe;AAAA,EAClC,SAAA;AAAA,EAChB,WAAA,CAAY,OAAA,EAAiB,SAAA,EAAkB,OAAA,EAA+B;AAC5E,IAAA,KAAA,CAAM,iBAAA,EAAmB,SAAS,OAAO,CAAA;AACzC,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AACF;AAGO,IAAM,mBAAA,GAAN,cAAkC,cAAA,CAAe;AAAA,EACtD,WAAA,CAAY,SAAiB,OAAA,EAA+B;AAC1D,IAAA,KAAA,CAAM,uBAAA,EAAyB,SAAS,OAAO,CAAA;AAC/C,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAOO,IAAM,oBAAA,GAAN,cAAmC,cAAA,CAAe;AAAA,EACvD,WAAA,CAAY,OAAA,GAAU,gDAAA,EAAkD,OAAA,EAA+B;AACrG,IAAA,KAAA,CAAM,uBAAA,EAAyB,SAAS,OAAO,CAAA;AAC/C,IAAA,IAAA,CAAK,IAAA,GAAO,sBAAA;AAAA,EACd;AACF;AAGO,IAAM,sBAAA,GAAN,cAAqC,cAAA,CAAe;AAAA,EACzD,WAAA,CAAY,SAAiB,OAAA,EAA+B;AAC1D,IAAA,KAAA,CAAM,sBAAA,EAAwB,SAAS,OAAO,CAAA;AAC9C,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AAAA,EACd;AACF;AAGO,IAAM,wBAAA,GAAN,cAAuC,cAAA,CAAe;AAAA,EAC3D,WAAA,CAAY,SAAiB,OAAA,EAA+B;AAC1D,IAAA,KAAA,CAAM,sBAAA,EAAwB,SAAS,OAAO,CAAA;AAC9C,IAAA,IAAA,CAAK,IAAA,GAAO,0BAAA;AAAA,EACd;AACF;AAGO,IAAM,oBAAA,GAAN,cAAmC,cAAA,CAAe;AAAA,EACvC,GAAA;AAAA,EAChB,WAAA,CAAY,KAAyB,OAAA,EAA+B;AAClE,IAAA,KAAA;AAAA,MACE,wBAAA;AAAA,MACA,CAAA,6BAAA,EAAgC,OAAO,WAAW,CAAA,CAAA;AAAA,MAClD;AAAA,KACF;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,sBAAA;AACZ,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AAAA,EACb;AACF;AAGO,IAAM,cAAA,GAAN,cAA6B,cAAA,CAAe;AAAA,EACjD,WAAA,CAAY,SAAiB,OAAA,EAA+B;AAC1D,IAAA,KAAA,CAAM,gBAAA,EAAkB,SAAS,OAAO,CAAA;AACxC,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AAAA,EACd;AACF;;;AC/CO,IAAM,YAAN,MAAgB;AAAA,EACL,GAAA;AAAA,EACC,KAAA;AAAA,EAEjB,YAAY,OAAA,EAA2B;AACrC,IAAA,IAAA,CAAK,MAAM,OAAA,CAAQ,GAAA;AAKnB,IAAA,MAAM,QAAA,GAA6C;AAAA,MACjD,WAAA,EAAa,OAAA,CAAQ,KAAA,IAAS,EAAA,GAAK,EAAA,GAAK,GAAA;AAAA,MACxC,gBAAA,EAAkB,QAAQ,UAAA,IAAc,GAAA;AAAA,MACxC,eAAA,EAAiB,QAAQ,SAAA,IAAa;AAAA,KACxC;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,QAAA,CAAS,WAAW,IAAI,OAAA,CAAQ,KAAA;AAAA,IAClC;AACA,IAAA,IAAA,CAAK,KAAA,GAAQ,kBAAA;AAAA,MACX,OAAA,CAAQ,GAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQS,MAAA,GAAuB,OAAO,MAAA,EAAQ,KAAA,KAAU;AACvD,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAA;AAAA,IACvC,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAeA,OAAW,iBAAA,EAAmB;AAC/C,QAAA,MAAM,IAAI,oBAAA,CAAqB,MAAA,EAAQ,KAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,MAC5D;AACA,MAAA,IACE,GAAA,YAAeA,OAAW,WAAA,IAC1B,GAAA,YAAeA,OAAW,WAAA,IAC1B,GAAA,YAAeA,OAAW,SAAA,EAC1B;AACA,QAAA,MAAM,IAAI,cAAA;AAAA,UACR,4BAA4B,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,EAAA,EAAK,IAAI,OAAO,CAAA,CAAA;AAAA,UACzD,EAAE,OAAO,GAAA;AAAI,SACf;AAAA,MACF;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAA,GAAgB;AAAA,EAKhB;AACF;ACzBO,SAAS,eAAe,MAAA,EAA6D;AAC1F,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,OAAO,MAAA,CAAO,SAAA,KAAc,SAAA,IAAa,MAAA,CAAO,IAAA,KAAS,SAAA;AAC3D;AAcA,eAAsB,eAAA,CACpB,KAAA,EACA,MAAA,EACA,IAAA,GAAsB,EAAC,EACF;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,SAAA,CAAU,OAAO,MAAA,EAAQ;AAAA,MACjD,YAAY,IAAA,CAAK,UAAA,IAAc,CAAC,OAAA,EAAS,SAAS,OAAO,CAAA;AAAA,MACzD,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,cAAA,EAAgB,KAAK,cAAA,IAAkB,CAAA;AAAA,MACvC,gBAAgB,IAAA,CAAK,cAAA;AAAA,MACrB,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,aAAa,IAAA,CAAK;AAAA,KACnB,CAAA;AACD,IAAA,IAAI,cAAA,CAAe,OAAO,CAAA,EAAG,MAAM,IAAI,oBAAA,EAAqB;AAC5D,IAAA,OAAO,OAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,mBAAmB,GAAG,CAAA;AAAA,EAC9B;AACF;AAEA,SAAS,mBAAmB,GAAA,EAA8B;AAGxD,EAAA,IACE,GAAA,YAAe,oBAAA,IACf,GAAA,YAAe,cAAA,IACf,eAAe,cAAA,EACf;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAIA,EAAA,MAAM,IAAA,GAAQ,KAAuC,IAAA,IAAQ,EAAA;AAC7D,EAAA,MAAM,OAAA,GAAW,KAA2B,OAAA,IAAW,yBAAA;AAEvD,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,iBAAA;AACH,MAAA,OAAO,IAAI,eAAA,CAAgB,OAAA,EAAS,QAAW,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,IAC/D,KAAK,iCAAA,EAAmC;AAEtC,MAAA,MAAM,QAAS,GAAA,EAAwC,KAAA;AACvD,MAAA,IAAI,KAAA,KAAU,OAAO,OAAO,IAAI,uBAAuB,OAAA,EAAS,EAAE,KAAA,EAAO,GAAA,EAAK,CAAA;AAC9E,MAAA,IAAI,KAAA,KAAU,OAAO,OAAO,IAAI,yBAAyB,OAAA,EAAS,EAAE,KAAA,EAAO,GAAA,EAAK,CAAA;AAChF,MAAA,IAAI,KAAA,KAAU,OAAO,OAAO,IAAI,oBAAoB,OAAA,EAAS,EAAE,KAAA,EAAO,GAAA,EAAK,CAAA;AAC3E,MAAA,OAAO,IAAI,eAAA,CAAgB,OAAA,EAAS,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,IACpD;AAAA,IACA,KAAK,uCAAA;AAAA,IACL,KAAK,iBAAA;AAAA,IACL,KAAK,iBAAA;AACH,MAAA,OAAO,IAAI,eAAA,CAAgB,OAAA,EAAS,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,IACpD;AACE,MAAA,OAAO,IAAI,eAAA,CAAgB,OAAA,EAAS,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA;AAExD;;;AC7HO,SAAS,OAAO,GAAA,EAA4C;AACjE,EAAA,MAAM,KAAA,GACJ,GAAA,YAAe,WAAA,GACX,IAAI,WAAW,GAAG,CAAA,GAClB,IAAI,UAAA,CAAW,GAAA,CAAI,MAAA,EAAQ,GAAA,CAAI,UAAA,EAAY,IAAI,UAAU,CAAA;AAG/D,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,IAAO,MAAA,CAAO,YAAA,CAAa,KAAA,CAAM,CAAC,CAAE,CAAA;AAC3E,EAAA,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC5E;AAGO,SAAS,SAAS,CAAA,EAAuB;AAC9C,EAAA,MAAM,GAAA,GAAM,EAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAClD,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,MAAA,GAAS,CAAC,CAAA,GAAI,CAAA,EAAG,GAAG,CAAC,CAAA;AAC/D,EAAA,OAAO,UAAA,CAAW,KAAK,GAAA,EAAK,CAAC,MAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAC,CAAA;AACpD;AAgBA,IAAM,YAAA,GAAe,CAAC,CAAA,KACpB,CAAA,CAAE,OAAA,CAAQ,cAAA,EAAgB,CAAC,CAAA,EAAG,CAAA,KAAc,CAAA,CAAE,WAAA,EAAa,CAAA;AAW7D,SAAS,aAAa,KAAA,EAAyB;AAC7C,EAAA,IAAI,MAAM,OAAA,CAAQ,KAAK,GAAG,OAAO,KAAA,CAAM,IAAI,YAAY,CAAA;AACvD,EAAA,IAAI,SAAS,OAAO,KAAA,KAAU,QAAA,IAAY,EAAE,iBAAiB,UAAA,CAAA,EAAa;AACxE,IAAA,MAAM,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAgC,CAAA,EAAG;AACrE,MAAA,GAAA,CAAI,YAAA,CAAa,CAAC,CAAC,CAAA,GAAI,aAAa,CAAC,CAAA;AAAA,IACvC;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT;AA0BO,SAAS,cACd,SAAA,EACuB;AACvB,EAAA,MAAM,EAAA,GAAK,aAAa,SAAoC,CAAA;AAC5D,EAAA,MAAM,GAAA,GAA+B;AAAA,IACnC,GAAG,EAAA;AAAA,IACH,SAAA,EAAW,QAAA,CAAS,EAAA,CAAG,SAAS;AAAA,GAClC;AACA,EAAA,IAAI,GAAG,IAAA,EAAM;AACX,IAAA,GAAA,CAAI,IAAA,GAAO,EAAE,GAAG,EAAA,CAAG,IAAA,EAAM,IAAI,QAAA,CAAS,EAAA,CAAG,IAAA,CAAK,EAAE,CAAA,EAAE;AAAA,EACpD;AACA,EAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,oBAAA,EAAsB,kBAAkB,CAAA,EAAY;AACtE,IAAA,MAAM,OAAA,GAAU,GAAG,IAAI,CAAA;AACvB,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,GAAA,CAAI,IAAI,CAAA,GAAI,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,MAAO,EAAE,GAAG,CAAA,EAAG,EAAA,EAAI,QAAA,CAAS,CAAA,CAAE,EAAE,GAAE,CAAE,CAAA;AAAA,IAC/D;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAwCO,SAAS,iBACd,IAAA,EAC0B;AAC1B,EAAA,MAAM,IAAI,IAAA,CAAK,QAAA;AACf,EAAA,MAAM,QAAA,GAAiD;AAAA,IACrD,cAAA,EAAgB,MAAA,CAAO,CAAA,CAAE,cAAc;AAAA,GACzC;AACA,EAAA,IAAI,EAAE,iBAAA,EAAmB,QAAA,CAAS,iBAAA,GAAoB,MAAA,CAAO,EAAE,iBAAiB,CAAA;AAChF,EAAA,IAAI,EAAE,iBAAA,EAAmB,QAAA,CAAS,iBAAA,GAAoB,MAAA,CAAO,EAAE,iBAAiB,CAAA;AAChF,EAAA,IAAI,EAAE,SAAA,EAAW,QAAA,CAAS,SAAA,GAAY,MAAA,CAAO,EAAE,SAAS,CAAA;AACxD,EAAA,IAAI,EAAE,UAAA,EAAY,QAAA,CAAS,UAAA,GAAa,MAAA,CAAO,EAAE,UAAU,CAAA;AAC3D,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,CAAK,EAAA,EAAI,QAAA,EAAS;AACjC;AA+CO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtB,IAAA;AAAA,EACS,KAAA;AAAA,EAEzB,WAAA,CAAY,IAAA,EAAwB,OAAA,EAAiB,KAAA,EAAiB;AACpE,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AAEA,SAAS,kBAAA,GAA8D;AACrE,EAAA,MAAM,MAAO,UAAA,CAAyD,SAAA;AACtE,EAAA,MAAM,QAAQ,GAAA,EAAK,WAAA;AACnB,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA,CAAM,WAAW,UAAA,IAAc,OAAO,KAAA,CAAM,GAAA,KAAQ,UAAA,EAAY;AACnF,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT;AASO,SAAS,kBAAA,GAA8B;AAC5C,EAAA,MAAM,CAAA,GAAI,UAAA;AAKV,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC5C,EAAA,IAAI,OAAO,CAAA,CAAE,mBAAA,KAAwB,UAAA,EAAY,OAAO,KAAA;AACxD,EAAA,IAAI,CAAA,CAAE,eAAA,KAAoB,KAAA,EAAO,OAAO,KAAA;AACxC,EAAA,OAAO,oBAAmB,KAAM,MAAA;AAClC;AAEA,SAAS,YAAY,GAAA,EAA4B;AAC/C,EAAA,MAAM,OAAQ,GAAA,EAAkC,IAAA;AAChD,EAAA,MAAM,OAAA,GAAW,GAAA,EAAqC,OAAA,IAAW,MAAA,CAAO,GAAG,CAAA;AAC3E,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,iBAAA;AACH,MAAA,OAAO,IAAI,YAAA;AAAA,QACT,WAAA;AAAA,QACA,mEAAmE,OAAO,CAAA,CAAA;AAAA,QAC1E;AAAA,OACF;AAAA,IACF,KAAK,mBAAA;AACH,MAAA,OAAO,IAAI,YAAA,CAAa,eAAA,EAAiB,CAAA,uBAAA,EAA0B,OAAO,IAAI,GAAG,CAAA;AAAA,IACnF,KAAK,eAAA;AACH,MAAA,OAAO,IAAI,YAAA;AAAA,QACT,UAAA;AAAA,QACA,+CAA+C,OAAO,CAAA,CAAA;AAAA,QACtD;AAAA,OACF;AAAA,IACF,KAAK,YAAA;AACH,MAAA,OAAO,IAAI,YAAA,CAAa,WAAA,EAAa,CAAA,0BAAA,EAA6B,OAAO,IAAI,GAAG,CAAA;AAAA,IAClF,KAAK,cAAA;AACH,MAAA,OAAO,IAAI,YAAA;AAAA,QACT,SAAA;AAAA,QACA,8DAA8D,OAAO,CAAA,CAAA;AAAA,QACrE;AAAA,OACF;AAAA,IACF;AACE,MAAA,OAAO,IAAI,YAAA,CAAa,SAAA,EAAW,CAAA,8BAAA,EAAiC,OAAO,IAAI,GAAG,CAAA;AAAA;AAExF;AAmBO,SAAS,kBAAA,CACd,IAAA,GAA8B,EAAC,EACF;AAC7B,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,IAAe,kBAAA,EAAmB;AACrD,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,aAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,iBAAiB,KAAA,EAAgD;AACxE,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,UAAU,OAAO,KAAA;AAChD,EAAA,MAAM,CAAA,GAAI,KAAA;AACV,EAAA,OAAO,OAAO,CAAA,CAAE,EAAA,KAAO,QAAA,IAAY,CAAC,CAAC,CAAA,CAAE,QAAA,IAAY,OAAO,CAAA,CAAE,QAAA,KAAa,QAAA;AAC3E;AAOA,eAAsB,uBAAA,CACpB,SAAA,EACA,IAAA,GAA8B,EAAC,EACI;AACnC,EAAA,MAAM,KAAA,GAAQ,mBAAmB,IAAI,CAAA;AACrC,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,KAAA,CAAM,MAAA,CAAO,EAAE,SAAA,EAAW,aAAA,CAAc,SAAS,CAAA,EAAG,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,CAAA;AAAA,EACxF,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,YAAY,GAAG,CAAA;AAAA,EACvB;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAI,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,eAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,iBAAiB,IAAI,CAAA;AAC9B;AAOA,eAAsB,oBAAA,CACpB,SAAA,EACA,IAAA,GAAiE,EAAC,EAC/B;AACnC,EAAA,MAAM,KAAA,GAAQ,mBAAmB,IAAI,CAAA;AACrC,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,MAAM,GAAA,CAAI;AAAA,MACrB,SAAA,EAAW,cAAc,SAAS,CAAA;AAAA,MAClC,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,YAAY,GAAG,CAAA;AAAA,EACvB;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAI,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,eAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,iBAAiB,IAAI,CAAA;AAC9B;;;ACvWO,IAAM,kBAAA,GAAqB;AAY3B,SAAS,cAAA,CAAe,SAAiB,OAAA,EAAiB;AAC/D,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,OAAO,CAAA;AAC9B,EAAA,MAAA,CAAO,QAAA,GAAW,IAAI,OAAO,CAAA,CAAA;AAC7B,EAAA,MAAM,iBAAiB,MAAA,CAAO,QAAA,EAAS,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC1D,EAAA,OAAO;AAAA,IACL,cAAA;AAAA,IACA,gBAAA,EAAkB,OAAA;AAAA,IAClB,eAAA,EAAiB,CAAC,cAAA,EAAgB,kBAAkB,CAAA;AAAA,IACpD,SAAS,IAAI,GAAA,CAAI,CAAA,CAAA,EAAI,OAAO,0BAA0B,OAAO;AAAA,GAC/D;AACF;AAGA,IAAM,IAAA,GAAO,CAAC,UAAA,MAA0C,EAAE,EAAA,EAAI,UAAA,CAAW,EAAA,EAAI,QAAA,EAAU,EAAE,GAAG,UAAA,CAAW,QAAA,EAAS,EAAE,CAAA;AAE3G,IAAM,aAAA,GAAN,cAA4B,YAAA,CAAa;AAAA;AAAA,EAErC,OAAA;AAAA;AAAA,EAEA,cAAA;AAAA;AAAA,EAEA,gBAAA;AAAA;AAAA,EAEA,eAAA;AAAA;AAAA,EAEA,IAAA;AAAA,EAET,WAAA,CAAY,MAAA,EAAmB,KAAA,EAA6B,OAAA,GAAgC,EAAC,EAAG;AAC9F,IAAA,KAAA,CAAM,QAAQ,KAAK,CAAA;AACnB,IAAA,MAAM,GAAA,GAAM,cAAA,CAAe,MAAA,CAAO,OAAA,EAAS,MAAM,QAAQ,CAAA;AACzD,IAAA,IAAA,CAAK,UAAU,KAAA,CAAM,QAAA;AACrB,IAAA,IAAA,CAAK,iBAAiB,GAAA,CAAI,cAAA;AAC1B,IAAA,IAAA,CAAK,mBAAmB,GAAA,CAAI,gBAAA;AAC5B,IAAA,IAAA,CAAK,kBAAkB,GAAA,CAAI,eAAA;AAC3B,IAAA,IAAA,CAAK,IAAA,GAAO,OAAA,CAAQ,IAAA,IAAQ,IAAI,UAAU,EAAE,GAAA,EAAK,GAAA,CAAI,OAAA,EAAS,OAAO,OAAA,CAAQ,SAAA,EAAW,KAAA,EAAO,OAAA,CAAQ,OAAO,CAAA;AAAA,EAChH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAA,CAAY,KAAA,EAAe,IAAA,GAAsB,EAAC,EAAwB;AACxE,IAAA,OAAO,eAAA,CAAgB,KAAA,EAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ;AAAA,MAC9C,QAAQ,IAAA,CAAK,eAAA;AAAA,MACb,UAAU,IAAA,CAAK,gBAAA;AAAA,MACf,GAAG;AAAA,KACJ,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMS,QAAA,GAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMlB,MAAA,EAAQ,OAAO,IAAA,GAAmD,EAAC,KAAoC;AAErG,MAAA,MAAM,WAAA,GAAc,mBAAmB,IAAI,CAAA;AAC3C,MAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,EAAA,CAAG,IAAI,OAAA,CAAQ,MAAA,CAAO,EAAE,IAAA,EAAM,UAAA,EAAY,GAAI,IAAA,CAAK,KAAA,GAAQ,EAAE,KAAA,EAAO,IAAA,CAAK,OAAM,GAAI,IAAK,CAAA;AACjH,MAAA,MAAM,SAAA,GAAa,MAAM,UAAA,CAAwC,UAAA;AACjE,MAAA,MAAM,UAAA,GAAa,MAAM,uBAAA,CAAwB,SAAA,EAAW,EAAE,GAAG,IAAA,EAAM,aAAa,CAAA;AACpF,MAAA,OAAO,IAAA,CAAK,EAAA,CAAG,GAAA,CAAI,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,EAAA,EAAI,EAAE,UAAA,EAAY,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,IACrF,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAA,EAAQ,OACN,IAAA,GAAqF,EAAC,KACzD;AAC7B,MAAA,MAAM,WAAA,GAAc,mBAAmB,IAAI,CAAA;AAC3C,MAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,KAAK,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,SAAA,GAAY,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,EAAU,GAAI,EAAE,CAAA;AACrG,MAAA,MAAM,UAAA,GAAa,MAAM,oBAAA,CAAqB,UAAA,EAAuC,EAAE,GAAG,IAAA,EAAM,aAAa,CAAA;AAC7G,MAAA,OAAO,IAAA,CAAK,QAAQ,MAAA,CAAO,EAAE,YAAY,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,IAC7D,CAAA;AAAA;AAAA,IAGA,oBAAA,EAAsB,OACpB,IAAA,KAC6B;AAC7B,MAAA,MAAM,EAAE,SAAA,EAAW,GAAG,WAAA,EAAY,GAAI,IAAA;AACtC,MAAA,MAAM,WAAA,GAAc,mBAAmB,WAAW,CAAA;AAClD,MAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,IAAA,CAAK,IAAI,QAAA,CAAS,OAAA,CAAQ,EAAE,SAAA,EAAW,CAAA;AACpE,MAAA,MAAM,UAAA,GAAa,MAAM,oBAAA,CAAqB,UAAA,EAAuC,EAAE,GAAG,WAAA,EAAa,aAAa,CAAA;AACpH,MAAA,OAAO,IAAA,CAAK,IAAI,MAAA,CAAO,EAAE,WAAW,UAAA,EAAY,IAAA,CAAK,UAAU,CAAA,EAAG,CAAA;AAAA,IACpE,CAAA;AAAA;AAAA,IAGA,MAAA,EAAQ,OAAO,IAAA,GAAiE,EAAC,KAAyB;AACxG,MAAA,MAAM,WAAA,GAAc,mBAAmB,IAAI,CAAA;AAC3C,MAAA,MAAM,EAAE,YAAW,GAAI,MAAM,KAAK,EAAA,CAAG,GAAA,CAAI,MAAA,CAAO,QAAA,CAAS,OAAA,EAAQ;AACjE,MAAA,MAAM,UAAA,GAAa,MAAM,oBAAA,CAAqB,UAAA,EAAuC,EAAE,GAAG,IAAA,EAAM,aAAa,CAAA;AAC7G,MAAA,OAAO,IAAA,CAAK,EAAA,CAAG,GAAA,CAAI,MAAA,CAAO,MAAA,CAAO,EAAE,UAAA,EAAY,IAAA,CAAK,UAAU,CAAA,EAAG,CAAA;AAAA,IACnE;AAAA,GACF;AACF;;;ACrHO,IAAM,QAAA,GAAN,cAAuB,aAAA,CAAc;AAAA,EACjC,QAAA;AAAA,EACA,eAAA;AAAA,EACA,KAAA,uBAAY,GAAA,EAAuB;AAAA,EAE5C,WAAA,CAAY,MAAA,EAAmB,OAAA,EAAsB,UAAA,EAAmD;AACtG,IAAA,KAAA,CAAM,MAAM,CAAA;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,OAAA;AAChB,IAAA,IAAA,CAAK,kBAAkB,UAAA,CAAW,EAAE,GAAG,OAAA,EAAS,iBAAA,EAAmB,OAAO,CAAA;AAAA,EAC5E;AAAA,EAEA,OAAO,IAAA,EAAyB;AAC9B,IAAA,IAAI,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAA;AAC/B,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,eAAe,IAAA,CAAK,OAAA,CAAQ,SAAS,IAAI,CAAA;AAC7D,MAAA,KAAA,GAAQ,IAAI,SAAA,CAAU,EAAE,GAAA,EAAK,OAAA,EAAS,KAAA,EAAO,IAAA,CAAK,QAAA,CAAS,SAAA,EAAW,KAAA,EAAO,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA;AAClG,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAA,EAAM,KAAK,CAAA;AAAA,IAC5B;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAS,OAAA,EAAiC;AACxC,IAAA,MAAM,IAAA,GAAO,OAAA,IAAW,OAAA,CAAQ,eAAe,CAAA;AAC/C,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,kBAAA,CAAmB,CAAA,+CAAA,EAAkD,eAAe,CAAA,CAAA,CAAG,CAAA;AAC5G,IAAA,OAAO,IAAI,aAAA,CAAc,IAAA,CAAK,eAAA,EAAiB,EAAE,QAAA,EAAU,IAAA,EAAK,EAAG,EAAE,IAAA,EAAM,IAAA,CAAK,MAAA,CAAO,IAAI,GAAG,CAAA;AAAA,EAChG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,WAAA,CAAY,KAAA,EAAe,OAAA,GAA4C,EAAC,EAAwB;AAC9F,IAAA,MAAM,EAAE,GAAA,EAAK,GAAG,MAAA,EAAO,GAAI,OAAA;AAC3B,IAAA,OAAO,KAAK,QAAA,CAAS,GAAG,CAAA,CAAE,WAAA,CAAY,OAAO,MAAM,CAAA;AAAA,EACrD;AACF,CAAA;;;ACjDO,IAAM,eAAe,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,SAAA,EAAW,SAAS,CAAA,EAAW;AAGzE,IAAM,iBAAiB,EAAE,MAAA,EAAQ,CAAC,YAAA,EAAc,SAAA,EAAW,aAAa,CAAA,EAAW;AAGnF,IAAM,YAAY,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,WAAA,EAAa,UAAU,CAAA,EAAW;AAGzE,IAAM,kBAAkB,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,MAAM,CAAA,EAAW;AAG9D,IAAM,kBAAkB,EAAE,MAAA,EAAQ,CAAC,SAAA,EAAW,WAAA,EAAa,QAAQ,CAAA,EAAW;AAG9E,IAAM,uBAAuB,EAAE,MAAA,EAAQ,CAAC,OAAA,EAAS,MAAM,CAAA,EAAW;AAGlE,IAAM,iBAAiB,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,QAAA,EAAU,eAAe,CAAA,EAAW;AAGhF,IAAM,eAAA,GAAkB,EAAE,MAAA,EAAQ,CAAC,cAAc,CAAA,EAAW;AAG5D,IAAM,wBAAwB,EAAE,MAAA,EAAQ,CAAC,WAAA,EAAa,UAAU,CAAA,EAAW;AAG3E,IAAM,cAAc,EAAE,MAAA,EAAQ,CAAC,OAAA,EAAS,OAAO,CAAA,EAAW;AAG1D,IAAM,2BAA2B,EAAE,MAAA,EAAQ,CAAC,+BAAA,EAAiC,mBAAmB,CAAA,EAAW;AAG3G,IAAM,qBAAqB,EAAE,MAAA,EAAQ,CAAC,SAAA,EAAW,QAAA,EAAU,SAAS,CAAA,EAAW;AAG/E,IAAM,sBAAsB,EAAE,MAAA,EAAQ,CAAC,UAAA,EAAY,SAAS,CAAA,EAAW;AAGvE,IAAM,cAAc,EAAE,MAAA,EAAQ,CAAC,YAAA,EAAc,cAAc,CAAA,EAAW;AAGtE,IAAM,mBAAmB,EAAE,MAAA,EAAQ,CAAC,SAAA,EAAW,WAAW,CAAA,EAAW;AAGrE,IAAM,cAAA,GAAiB,EAAE,MAAA,EAAQ,CAAC,aAAa,aAAA,EAAe,UAAA,EAAY,UAAA,EAAY,eAAe,CAAA,EAAW;AAGhH,IAAM,gBAAgB,EAAE,MAAA,EAAQ,CAAC,OAAA,EAAS,KAAK,CAAA,EAAW;AAG1D,IAAM,gBAAgB,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,WAAA,EAAa,aAAa,CAAA,EAAW;AAGhF,IAAM,iBAAiB,EAAE,MAAA,EAAQ,CAAC,MAAA,EAAQ,OAAA,EAAS,UAAU,CAAA,EAAW;AAGxE,IAAM,eAAA,GAAkB,EAAE,MAAA,EAAQ,CAAC,UAAU,SAAA,EAAW,WAAA,EAAa,QAAQ,CAAA,EAAW;AAGxF,IAAM,wBAAwB,EAAE,MAAA,EAAQ,CAAC,KAAA,EAAO,UAAU,CAAA,EAAW;AAGrE,IAAM,MAAA,GAAS,EAAE,MAAA,EAAQ,CAAC,KAAK,CAAA,EAAW;AAG1C,IAAM,YAAY,EAAE,MAAA,EAAQ,CAAC,UAAA,EAAY,UAAU,CAAA,EAAW;AAG9D,IAAM,kBAAkB,EAAE,MAAA,EAAQ,CAAC,MAAA,EAAQ,SAAA,EAAW,QAAQ,CAAA,EAAW;AAGzE,IAAM,gBAAgB,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,QAAA,EAAU,OAAO,CAAA,EAAW;AAGvE,IAAM,sBAAsB,EAAE,MAAA,EAAQ,CAAC,KAAA,EAAO,MAAA,EAAQ,OAAO,CAAA,EAAW;AAGxE,IAAM,wBAAwB,EAAE,MAAA,EAAQ,CAAC,qBAAA,EAAuB,qBAAA,EAAuB,sBAAsB,CAAA,EAAW;AAGxH,IAAM,sBAAsB,EAAE,MAAA,EAAQ,CAAC,mBAAA,EAAqB,sBAAA,EAAwB,cAAc,CAAA,EAAW;AAG7G,IAAM,cAAA,GAAiB,EAAE,MAAA,EAAQ,CAAC,SAAS,SAAA,EAAW,UAAA,EAAY,gBAAgB,CAAA,EAAW;AAG7F,IAAM,kBAAA,GAAqB,EAAE,MAAA,EAAQ,CAAC,aAAA,EAAe,SAAA,EAAW,oBAAA,EAAsB,UAAA,EAAY,mBAAA,EAAqB,QAAA,EAAU,UAAA,EAAY,SAAA,EAAW,WAAW,CAAA,EAAW;AAG9K,IAAM,eAAe,EAAE,MAAA,EAAQ,CAAC,WAAA,EAAa,QAAQ,CAAA,EAAW;AAGhE,IAAM,aAAA,GAAgB,EAAE,MAAA,EAAQ,CAAC,QAAQ,WAAA,EAAa,SAAA,EAAW,SAAS,CAAA,EAAW;AAGrF,IAAM,eAAe,EAAE,MAAA,EAAQ,CAAC,SAAA,EAAW,cAAA,EAAgB,yBAAyB,CAAA,EAAW;AAG/F,IAAM,yBAAA,GAA4B,EAAE,MAAA,EAAQ,CAAC,YAAA,EAAc,wBAAwB,wBAAA,EAA0B,yBAAA,EAA2B,mBAAA,EAAqB,mBAAmB,CAAA,EAAW;AAG3L,IAAM,mBAAmB,EAAE,MAAA,EAAQ,CAAC,OAAA,EAAS,UAAA,EAAY,KAAK,CAAA,EAAW;AAGzE,IAAM,oBAAoB,EAAE,MAAA,EAAQ,CAAC,wBAAA,EAA0B,cAAc,CAAA,EAAW;AAGxF,IAAM,kBAAkB,EAAE,MAAA,EAAQ,CAAC,SAAA,EAAW,WAAA,EAAa,QAAQ,CAAA,EAAW;AAG9E,IAAM,gBAAA,GAAmB,EAAE,MAAA,EAAQ,CAAC,KAAK,CAAA,EAAW;AAGpD,IAAM,cAAc,EAAE,MAAA,EAAQ,CAAC,IAAA,EAAM,IAAA,EAAM,KAAK,CAAA,EAAW;AAG3D,IAAM,sBAAA,GAAyB,EAAE,MAAA,EAAQ,CAAC,UAAU,SAAA,EAAW,SAAA,EAAW,UAAU,CAAA,EAAW;AAG/F,IAAM,2BAAA,GAA8B,EAAE,MAAA,EAAQ,CAAC,UAAU,SAAA,EAAW,SAAA,EAAW,UAAA,EAAY,WAAW,CAAA,EAAW;AAGjH,IAAM,kBAAkB,EAAE,MAAA,EAAQ,CAAC,MAAA,EAAQ,MAAM,CAAA,EAAW;AAG5D,IAAM,6BAA6B,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,gBAAgB,CAAA,EAAW;AAGnF,IAAM,wBAAA,GAA2B,EAAE,MAAA,EAAQ,CAAC,UAAU,SAAA,EAAW,gBAAA,EAAkB,gBAAgB,CAAA,EAAW;AAG9G,IAAM,oBAAoB,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,SAAA,EAAW,SAAS,CAAA,EAAW;AAG9E,IAAM,kBAAA,GAAqB,EAAE,MAAA,EAAQ,CAAC,WAAW,SAAA,EAAW,SAAA,EAAW,MAAM,CAAA,EAAW;AAGxF,IAAM,eAAe,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,WAAA,EAAa,UAAU,CAAA,EAAW;AAG5E,IAAM,SAAA,GAAY,EAAE,MAAA,EAAQ,CAAC,QAAQ,CAAA,EAAW;AAGhD,IAAM,iBAAiB,EAAE,MAAA,EAAQ,CAAC,OAAA,EAAS,QAAA,EAAU,eAAe,CAAA,EAAW;AAG/E,IAAM,iBAAA,GAAoB,EAAE,MAAA,EAAQ,CAAC,oBAAoB,CAAA,EAAW;AAGpE,IAAM,cAAA,GAAiB,EAAE,MAAA,EAAQ,CAAC,YAAY,eAAA,EAAiB,gBAAA,EAAkB,MAAM,CAAA,EAAW;AAGlG,IAAM,wBAAwB,EAAE,MAAA,EAAQ,CAAC,WAAA,EAAa,QAAA,EAAU,MAAM,CAAA,EAAW;AAGjF,IAAM,gCAAgC,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,SAAS,CAAA,EAAW;AAG/E,IAAM,wBAAwB,EAAE,MAAA,EAAQ,CAAC,SAAA,EAAW,UAAA,EAAY,eAAe,CAAA,EAAW;AAG1F,IAAM,kBAAA,GAAqB,EAAE,MAAA,EAAQ,CAAC,WAAW,WAAA,EAAa,QAAA,EAAU,UAAU,CAAA,EAAW;AAM7F,IAAM,gBAAA,GAAmB,EAAE,MAAA,EAAQ,CAAC,eAAe,aAAA,EAAe,gBAAA,EAAkB,kBAAA,EAAoB,iBAAA,EAAmB,mBAAA,EAAqB,cAAA,EAAgB,uBAAA,EAAyB,qBAAA,EAAuB,iCAAiC,+BAAA,EAAiC,0BAAA,EAA4B,0BAAA,EAA4B,6BAAA,EAA+B,4BAAA,EAA8B,yBAAA,EAA2B,8BAAA,EAAgC,gCAAA,EAAkC,kBAAkB,gBAAA,EAAkB,gBAAA,EAAkB,qBAAA,EAAuB,uBAAA,EAAyB,4BAAA,EAA8B,uBAAA,EAAyB,wBAAA,EAA0B,uBAAA,EAAyB,kBAAkB,CAAA,EAAW;;;AC9KxtB,IAAM,OAAA,GAAmD,OAAA,CAAqB;AAYvE,IAAM,IAAA,GAAN,cAAmB,QAAA,CAAS;AAAA,EACjC,QAAA;AAAA,EACA,WAAA,CAAY,OAAA,GAAuB,EAAC,EAAG;AACrC,IAAA,MAAM,GAAA,GAAM,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,OAAA,EAAQ;AAC7C,IAAA,KAAA,CAAM,IAAI,SAAA,CAAU,OAAA,EAAS,WAAA,CAAY,IAAA,EAAM,GAAG,CAAA,EAAG,OAAA,EAAS,CAAC,CAAA,KAAqB,IAAI,SAAA,CAAU,CAAA,EAAG,WAAA,CAAY,IAAA,EAAM,GAAG,CAAC,CAAA;AAAA,EAC7H;AAAA;AAAA,EAEA,IAAI,MAAA,GAAwB;AAC1B,IAAA,OAAQ,IAAA,CAAK,QAAA,KAAa,mBAAA,CAA2B,IAAA,CAAK,OAAO,CAAA;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA,EAIA,IAAI,KAAA,GAAyC;AAC3C,IAAA,MAAM,SAAS,IAAA,CAAK,OAAA;AACpB,IAAA,OAAO;AAAA,MACL,GAAA,EAAK,CAAC,KAAA,KAAkB,IAAI,QAAQ,MAAA,EAAQ,EAAE,MAAA,EAAQ,KAAA,EAAO;AAAA,KAC/D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,KAAA,EAAwB;AAC1B,IAAA,OAAO,IAAI,OAAA,CAAQ,IAAA,CAAK,SAAS,EAAE,MAAA,EAAQ,OAAO,CAAA;AAAA,EACpD;AACF;AAAA,CAibO,CAAUC,KAAAA,KAAV;AAIE,EAAMA,MAAA,YAAA,GAAiB,YAAA;AAEvB,EAAMA,MAAA,cAAA,GAAmB,cAAA;AAEzB,EAAMA,MAAA,SAAA,GAAc,SAAA;AAEpB,EAAMA,MAAA,eAAA,GAAoB,eAAA;AAE1B,EAAMA,MAAA,eAAA,GAAoB,eAAA;AAE1B,EAAMA,MAAA,oBAAA,GAAyB,oBAAA;AAE/B,EAAMA,MAAA,cAAA,GAAmB,cAAA;AAEzB,EAAMA,MAAA,eAAA,GAAoB,eAAA;AAE1B,EAAMA,MAAA,qBAAA,GAA0B,qBAAA;AAEhC,EAAMA,MAAA,WAAA,GAAgB,WAAA;AAEtB,EAAMA,MAAA,wBAAA,GAA6B,wBAAA;AAEnC,EAAMA,MAAA,kBAAA,GAAuB,kBAAA;AAE7B,EAAMA,MAAA,mBAAA,GAAwB,mBAAA;AAE9B,EAAMA,MAAA,WAAA,GAAgB,WAAA;AAEtB,EAAMA,MAAA,gBAAA,GAAqB,gBAAA;AAE3B,EAAMA,MAAA,cAAA,GAAmB,cAAA;AAEzB,EAAMA,MAAA,aAAA,GAAkB,aAAA;AAExB,EAAMA,MAAA,aAAA,GAAkB,aAAA;AAExB,EAAMA,MAAA,cAAA,GAAmB,cAAA;AAEzB,EAAMA,MAAA,eAAA,GAAoB,eAAA;AAE1B,EAAMA,MAAA,qBAAA,GAA0B,qBAAA;AAEhC,EAAMA,MAAA,MAAA,GAAW,MAAA;AAEjB,EAAMA,MAAA,SAAA,GAAc,SAAA;AAEpB,EAAMA,MAAA,eAAA,GAAoB,eAAA;AAE1B,EAAMA,MAAA,aAAA,GAAkB,aAAA;AAExB,EAAMA,MAAA,mBAAA,GAAwB,mBAAA;AAE9B,EAAMA,MAAA,qBAAA,GAA0B,qBAAA;AAEhC,EAAMA,MAAA,mBAAA,GAAwB,mBAAA;AAE9B,EAAMA,MAAA,cAAA,GAAmB,cAAA;AAEzB,EAAMA,MAAA,kBAAA,GAAuB,kBAAA;AAE7B,EAAMA,MAAA,YAAA,GAAiB,YAAA;AAEvB,EAAMA,MAAA,aAAA,GAAkB,aAAA;AAExB,EAAMA,MAAA,YAAA,GAAiB,YAAA;AAEvB,EAAMA,MAAA,yBAAA,GAA8B,yBAAA;AAEpC,EAAMA,MAAA,gBAAA,GAAqB,gBAAA;AAE3B,EAAMA,MAAA,iBAAA,GAAsB,iBAAA;AAE5B,EAAMA,MAAA,eAAA,GAAoB,eAAA;AAE1B,EAAMA,MAAA,gBAAA,GAAqB,gBAAA;AAE3B,EAAMA,MAAA,WAAA,GAAgB,WAAA;AAEtB,EAAMA,MAAA,sBAAA,GAA2B,sBAAA;AAEjC,EAAMA,MAAA,2BAAA,GAAgC,2BAAA;AAEtC,EAAMA,MAAA,eAAA,GAAoB,eAAA;AAE1B,EAAMA,MAAA,0BAAA,GAA+B,0BAAA;AAErC,EAAMA,MAAA,wBAAA,GAA6B,wBAAA;AAEnC,EAAMA,MAAA,iBAAA,GAAsB,iBAAA;AAE5B,EAAMA,MAAA,kBAAA,GAAuB,kBAAA;AAE7B,EAAMA,MAAA,YAAA,GAAiB,YAAA;AAEvB,EAAMA,MAAA,SAAA,GAAc,SAAA;AAEpB,EAAMA,MAAA,cAAA,GAAmB,cAAA;AAEzB,EAAMA,MAAA,iBAAA,GAAsB,iBAAA;AAE5B,EAAMA,MAAA,cAAA,GAAmB,cAAA;AAEzB,EAAMA,MAAA,qBAAA,GAA0B,qBAAA;AAEhC,EAAMA,MAAA,6BAAA,GAAkC,6BAAA;AAExC,EAAMA,MAAA,qBAAA,GAA0B,qBAAA;AAEhC,EAAMA,MAAA,kBAAA,GAAuB,kBAAA;AAE7B,EAAMA,MAAA,gBAAA,GAAqB,gBAAA;AAAA,CAAA,EAlHnB,IAAA,KAAA,IAAA,GAAA,EAAA,CAAA,CAAA;AC7dV,IAAM,aAAA,GAAgB,EAAE,MAAA,EAAQ,CAAC,aAAA,EAAe,kBAAA,EAAoB,cAAA,EAAgB,kBAAA,EAAoB,WAAA,EAAa,WAAA,EAAa,oBAAA,EAAsB,gBAAA,EAAkB,iBAAA,EAAmB,YAAY,MAAA,EAAQ,qBAAA,EAAuB,mBAAA,EAAqB,wBAAA,EAA0B,sBAAA,EAAwB,uBAAA,EAAyB,cAAA,EAAgB,uBAAA,EAAyB,iBAAA,EAAmB,aAAA,EAAe,qBAAA,EAAuB,iBAAA,EAAmB,qBAAA,EAAuB,qBAAA,EAAuB,mBAAmB,mBAAA,EAAqB,wBAAA,EAA0B,mBAAA,EAAqB,uBAAA,EAAyB,uBAAA,EAAyB,0BAAA,EAA4B,yBAAA,EAA2B,wBAAA,EAA0B,4BAAA,EAA8B,iCAAA,EAAmC,yBAAA,EAA2B,4BAAA,EAA8B,gBAAA,EAAkB,mBAAA,EAAqB,qBAAqB,oBAAA,EAAsB,cAAA,EAAgB,sBAAA,EAAwB,eAAA,EAAiB,eAAA,EAAiB,2BAAA,EAA6B,qBAAA,EAAuB,uBAAA,EAAyB,kBAAA,EAAoB,kBAAA,EAAoB,uBAAA,EAAyB,yBAAA,EAA2B,4BAAA,EAA8B,sBAAA,EAAwB,4BAA4B,yBAAA,EAA2B,0BAAA,EAA4B,eAAA,EAAiB,kCAAA,EAAoC,mBAAA,EAAqB,iBAAA,EAAmB,6BAAA,EAA+B,+BAAA,EAAiC,qBAAA,EAAuB,mBAAA,EAAqB,gBAAA,EAAkB,0BAAA,EAA4B,gBAAA,EAAkB,kBAAA,EAAoB,sBAAsB,kBAAA,EAAoB,cAAA,EAAgB,kBAAA,EAAoB,wBAAA,EAA0B,mBAAA,EAAqB,qBAAA,EAAuB,gBAAA,EAAkB,4BAAA,EAA8B,yBAAA,EAA2B,sBAAA,EAAwB,yBAAA,EAA2B,aAAA,EAAe,yBAAA,EAA2B,iBAAA,EAAmB,wBAAwB,YAAA,EAAc,kBAAA,EAAoB,gCAAA,EAAkC,2BAAA,EAA6B,6BAAA,EAA+B,2BAAA,EAA6B,+BAAA,EAAiC,2BAAA,EAA6B,wCAAA,EAA0C,8BAAA,EAAgC,+BAAA,EAAiC,sBAAA,EAAwB,2BAAA,EAA6B,0BAAA,EAA4B,sCAAsC,oCAAA,EAAsC,yBAAA,EAA2B,4BAAA,EAA8B,mBAAA,EAAqB,eAAA,EAAiB,eAAA,EAAiB,eAAA,EAAiB,gBAAA,EAAkB,wCAAA,EAA0C,mCAAA,EAAqC,eAAA,EAAiB,kBAAkB,CAAA;;;ACWznF,IAAM,aAAA,GAAgBC","file":"index.js","sourcesContent":["// Generated by scripts/gen-sdk.mjs from Specs/auth.json. Do not edit.\n\nimport type { APIClient, APIPromise, PagePromise, PollOptions, RequestOptions } from \"@productcraft/core\";\nimport type * as T from \"./types.js\";\nimport type { UnwrapWebhookEvent, WebhookSignParams, WebhookUnwrapParams } from \"./webhooks.js\";\nimport type { SignedWebhook } from \"@productcraft/core\";\n\ntype Bound = Readonly<Record<string, string | undefined>>;\n\n/** Split params into [picked, rest] by key. */\nfunction split(params: object | undefined, keys: readonly string[]): [Record<string, unknown>, Record<string, unknown>] {\n const picked: Record<string, unknown> = {};\n const rest: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(params ?? {})) (keys.includes(k) ? picked : rest)[k] = v;\n return [picked, rest];\n}\n\n/** Fill `actor_id` from a scope bound with `.as(actorId)`, unless the call passes one. */\nfunction fillActor<P>(params: P, bound: Bound): P {\n if (bound.actor_id === undefined) return params;\n const p = (params ?? {}) as Record<string, unknown>;\n return (p.actor_id === undefined ? { ...p, actor_id: bound.actor_id } : p) as P;\n}\n\n/** A form upload as FormData: Blobs (and Files, with their names) as they are, everything else as a string. */\nfunction formData(fields: object | undefined): FormData {\n const form = new FormData();\n for (const [k, v] of Object.entries(fields ?? {})) {\n if (v === undefined || v === null) continue;\n if (v instanceof Blob) form.append(k, v);\n else form.append(k, typeof v === \"object\" ? JSON.stringify(v) : String(v));\n }\n return form;\n}\n\nexport class APIResource {\n protected readonly _client: APIClient;\n /** Path parameters (and `actor_id`) bound by the enclosing scope. */\n protected readonly _b: Bound;\n constructor(client: APIClient, bound: Bound = {}) {\n this._client = client;\n this._b = bound;\n }\n}\n\nvoid split;\nvoid fillActor;\n/** `apps` */\nexport class AppsResource extends APIResource {\n /**\n * Create a new app owned by the caller\n *\n * The new app starts with emails to its users turned on: they go out from the workspace default sender chosen in Mail, and the default verification, welcome, password-reset, invite and sign-in code templates are created in the workspace's Mail templates (an existing template with the same name is reused). Change or turn this off with `PATCH /v1/apps/{appId}/notification-settings`.\n *\n * **Sign-up starts off.** A new app has `signup_enabled: false`, so `POST /{app_slug}/v1/auth/signup` answers 403 `FORBIDDEN` (\"Signup is disabled for this app\") until you turn it on with `PATCH /v1/apps/{app_id}/auth-config` and `{ \"signup_enabled\": true }`. Sign-in, invites and admin-created users work either way.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.AppCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (slug, display name, or workspaceId).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller email not verified, or caller lacks `auth.create` on the target workspace.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Slug already taken. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps\n * @example\n * ```ts\n * const app = await auth.apps.create({\n * display_name: \"Acme\",\n * slug: \"acme-app\",\n * workspace_id: \"835015dc-7bde-4a8a-b306-c066d4733b90\",\n * });\n * ```\n */\n create(params: T.AppCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.App>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps\", body: params, idempotent: true }, options);\n }\n /**\n * Delete an app permanently\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param appId - Id of the app.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.delete`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found or caller is not a member.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id\n * @example\n * ```ts\n * await auth.apps.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(appId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}\", pathParams: { app_id: appId } }, options);\n }\n /**\n * List apps in workspaces the caller is a member of. Pass `workspace_id` to scope the result to a single workspace — required from the per-workspace console page so cross-tenant memberships do not leak.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.AppListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid pagination cursor.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps\n * @example\n * ```ts\n * for await (const app of auth.apps.list()) {\n * console.log(app);\n * }\n * const page = await auth.apps.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.AppListParams, options?: RequestOptions): PagePromise<T.App> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps\", query: params }, options);\n }\n /**\n * Get app details\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param appId - Id of the app.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id\n * @example\n * ```ts\n * const app = await auth.apps.retrieve(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n retrieve(appId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.App>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}\", pathParams: { app_id: appId } }, options);\n }\n /**\n * Update app display name, slug, metadata, and retention settings\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param appId - Id of the app.\n * @param params - `Auth.AppUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, AUTH_SETTINGS_IN_METADATA: Validation failure — including a retention value outside 30-3650 days (audit) or 7-365 days (webhook attempts), or `AUTH_SETTINGS_IN_METADATA`: `metadata.auth` differs from the stored sign-in settings (change those with `PATCH /v1/apps/{appId}/auth-config`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id\n * @example\n * ```ts\n * const app = await auth.apps.update(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { audit_retention_days: 365 });\n * ```\n */\n update(appId: string, params?: T.AppUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.App>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}\", pathParams: { app_id: appId }, body: params }, options);\n }\n}\n\n/** `stats` */\nexport class StatsResource extends APIResource {\n /**\n * Aggregate counts for the signed-in PlatformUser\n *\n * Returns total Auth apps owned by workspaces the caller is a member of, end-users across those apps, and active API keys across those apps. Pass `workspace_id` to scope the counts to a single workspace — required from the dashboard so cross-tenant data does not bleed into the totals.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.StatsMeParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/stats/me\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-stats-me\n * @example\n * ```ts\n * const platformUserStats = await auth.stats.me();\n * ```\n */\n me(params?: T.StatsMeParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.PlatformUserStats>> {\n return this._client.request({ method: \"GET\", path: \"/v1/stats/me\", query: params }, options);\n }\n /**\n * Auth stats for a workspace\n *\n * Active end users over 1, 7 and 30 days, total and new end users, production app count, last end-user activity and a daily active-users series, for the workspace's **production** apps only.\n *\n * **Active** means the end user signed in successfully or refreshed a session. Customer backends verify access tokens locally against the JWKS, so use between two refreshes is invisible to ProductCraft; resolution is bounded by each app's access-token lifetime.\n *\n * Days are UTC. Counts only: no end-user identifiers. Cached for up to 60 seconds (`generated_at`).\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.StatsRetrieveParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `workspaceId` is not a UUID or `window` is not one of 1d, 7d, 30d.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, SERVICE_NOT_ENABLED: Caller lacks `auth.read` on the workspace (including non-members), or Auth is not enabled on it (`SERVICE_NOT_ENABLED`).\n * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found. Today an unknown workspace answers 403 like every other workspace route, so callers cannot probe which ids exist.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/workspaces/{workspace_id}/stats\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-workspaces-workspace-id-stats\n * @example\n * ```ts\n * const authWorkspaceStats = await auth.stats.retrieve();\n * ```\n */\n retrieve(params?: T.StatsRetrieveParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuthWorkspaceStats>> {\n return this._client.request({ method: \"GET\", path: \"/v1/workspaces/{workspace_id}/stats\", query: params }, options);\n }\n /**\n * 0.x name for `auth.stats.me()` (GET /v1/stats/me).\n *\n * @deprecated Use `auth.stats.me()`. Kept for 0.x callers; removed in 2.0.\n */\n get(params?: T.StatsMeParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.PlatformUserStats>> {\n return this._client.request({ method: \"GET\", path: \"/v1/stats/me\", query: params }, options);\n }\n}\n\n/** `webhooks` */\nexport class WebhooksResource extends APIResource {\n /**\n * Verify a webhook's signature and parse it (Standard Webhooks, and the legacy `t=…,v1=…` scheme).\n *\n * @param params - The raw body, the request headers and optionally the secret.\n * @throws {WebhookVerificationError} The signature, timestamp or payload is invalid.\n * @throws {ConfigurationError} No secret was passed or configured.\n */\n unwrap(params: WebhookUnwrapParams): Promise<UnwrapWebhookEvent> {\n return this._client.unwrapWebhook<UnwrapWebhookEvent>(params, \"PRODUCTCRAFT_AUTH_WEBHOOK_SECRET\");\n }\n /**\n * Sign a test event the way ProductCraft signs deliveries (Standard Webhooks), so a handler\n * test can call `unwrap` without a live delivery. Returns the exact body and the headers.\n *\n * @param params - The event (an object is JSON-encoded), and optionally the secret, `id` and `timestamp`.\n * @throws {ConfigurationError} No secret was passed or configured.\n */\n sign(params: WebhookSignParams): Promise<SignedWebhook> {\n return this._client.signWebhook(params, \"PRODUCTCRAFT_AUTH_WEBHOOK_SECRET\");\n }\n}\n\n/** `auth` */\nexport class AuthResources extends APIResource {\n #apps?: AppsResource;\n #stats?: StatsResource;\n #webhooks?: WebhooksResource;\n get apps(): AppsResource {\n return (this.#apps ??= new AppsResource(this._client, this._b));\n }\n get stats(): StatsResource {\n return (this.#stats ??= new StatsResource(this._client, this._b));\n }\n get webhooks(): WebhooksResource {\n return (this.#webhooks ??= new WebhooksResource(this._client, this._b));\n }\n}\n\n/** `apiKeys` */\nexport class AppApiKeysResource extends APIResource {\n /**\n * Mint a new hdk_live_* API key with an explicit permission scope. The raw key is returned ONCE.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.ApiKeyCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (name, empty `permissions`, a permission not matching `resource.action`, unsupported `expiresInDays`), or a malformed `Idempotency-Key`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.create` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: `Idempotency-Key` reused with a different request body. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/api-keys\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-api-keys\n * @example\n * ```ts\n * const createApiKey = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").apiKeys.create({ name: \"CI deploy bot\", permissions: [\"user.read\", \"user.list\"] });\n * ```\n */\n create(params: T.ApiKeyCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CreateApiKey>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/api-keys\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Revoke an API key. The key stops authenticating immediately; the row is kept (soft delete) so the list and the audit trail can still answer who revoked it and when.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param keyId - Id of the key.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: No such key in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/api-keys/{key_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-api-keys-key-id\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").apiKeys.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(keyId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/api-keys/{key_id}\", pathParams: { app_id: this._b.app_id, key_id: keyId } }, options);\n }\n /**\n * List API keys for an app (no raw secret), newest first. Cursor-paginated: 20/page by default, 100 max.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.ApiKeyListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/api-keys\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-api-keys\n * @example\n * ```ts\n * for await (const apiKey of auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").apiKeys.list()) {\n * console.log(apiKey);\n * }\n * const page = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").apiKeys.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.ApiKeyListParams, options?: RequestOptions): PagePromise<T.ApiKeySummary> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/api-keys\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n /**\n * Mint a replacement for an existing key, carrying its name and permissions over. The outgoing key keeps working for `grace_hours` (24 by default) so a fleet can roll over without downtime. The raw key is returned ONCE.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param keyId - Id of the key.\n * @param params - `Auth.ApiKeyRotateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: No such key in this app.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: The key is revoked or already expired. There is nothing to roll over from — mint a new key instead. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/api-keys/{key_id}/rotate\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-api-keys-key-id-rotate\n * @example\n * ```ts\n * const rotateApiKey = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").apiKeys.rotate(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { grace_hours: 24 });\n * ```\n */\n rotate(keyId: string, params?: T.ApiKeyRotateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.RotateApiKey>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/api-keys/{key_id}/rotate\", pathParams: { app_id: this._b.app_id, key_id: keyId }, body: params, idempotent: true }, options);\n }\n}\n\n/** `auditLogs` */\nexport class AppAuditLogsResource extends APIResource {\n /**\n * Stream this app's audit log as NDJSON or CSV, applying the same `?action=` / `?actor_id=` / `?since=` / `?until=` filters as the list. Newest first. Reading the export is itself audited as `audit.exported`.\n *\n * The response is streamed: rows are walked in keyset batches and written as they are read, so neither the service nor the client has to hold the whole result set. Works on both lanes — a platform bearer token and a `pcft_live_*` Platform API Key with `auth.audit.read` hit the same route. Hard cap of 1,000,000 rows per call; a wider request is refused with 413 before any body is written, so a truncated file can never masquerade as a complete one.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.AuditLogExportParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `format`, or malformed `since` / `until`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.audit.read`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found or caller is not a member.\n * @throws {APIError} 413 PAYLOAD_TOO_LARGE: More than 1,000,000 rows match. Narrow the window with `since` / `until` (or a tighter `action` / `actor_id` filter) and retry.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/audit-logs/export\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-audit-logs-export\n * @example\n * ```ts\n * const response = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").auditLogs.export();\n * const text = await response.text();\n * ```\n */\n export(params?: T.AuditLogExportParams, options?: RequestOptions): APIPromise<Response> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/audit-logs/export\", pathParams: { app_id: this._b.app_id }, query: fillActor(params, this._b), raw: true }, options);\n }\n /**\n * Append-only audit log for this app, newest first. Filter by `?action=`, `?actor_id=`, and/or the `?since=` / `?until=` date range. 20/page (max 100), cursor-paginated.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.AuditLogListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`, `since`, or `until`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.audit.read`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found or caller is not a member.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/audit-logs\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-audit-logs\n * @example\n * ```ts\n * for await (const auditLog of auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").auditLogs.list()) {\n * console.log(auditLog);\n * }\n * const page = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").auditLogs.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.AuditLogListParams, options?: RequestOptions): PagePromise<T.AuditLogEntry> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/audit-logs\", pathParams: { app_id: this._b.app_id }, query: fillActor(params, this._b) }, options);\n }\n}\n\n/** `auditSink` */\nexport class AppAuditSinkResource extends APIResource {\n /**\n * Remove the audit sink. Shipping stops immediately; the audit log itself is untouched.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.\n * @throws {NotFoundError} 404 NOT_FOUND: No audit sink configured.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/audit-sink\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-audit-sink\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").auditSink.disconnect();\n * ```\n */\n disconnect(options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/audit-sink\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Create or replace the audit sink. Returns a freshly generated signing secret exactly once.\n *\n * Audit rows are POSTed in batches of up to 100, signed with the same `X-Auth-Signature: t=<unix>,v1=<hex>` HMAC header as the outbound webhooks. Delivery is at-least-once: the cursor advances only after a 2xx, so a batch that times out after the receiver processed it is re-sent. Every record carries its immutable `audit_log` id, so dedupe on that. A new sink starts from the moment it is created — configuring one does not replay the existing history into your SIEM. Replacing an existing sink clears the auto-disabled state (the same \"I fixed my receiver\" signal a webhook PUT carries) but does NOT rewind the cursor.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.AuditSinkReplaceParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: URL is not HTTPS, or the SSRF guard refused it (private address, unresolvable host, non-public TLD).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PUT /v1/apps/{app_id}/audit-sink\n * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-audit-sink\n * @example\n * ```ts\n * const auditSinkWithSecret = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").auditSink.replace({ url: \"https://siem.customer.example.com/ingest/productcraft-auth\" });\n * ```\n */\n replace(params: T.AuditSinkReplaceParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuditSinkWithSecret>> {\n return this._client.request({ method: \"PUT\", path: \"/v1/apps/{app_id}/audit-sink\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n /**\n * Current audit sink for this app, or 404 when none is configured. Never returns the signing secret — only its last-4 hint.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read`.\n * @throws {NotFoundError} 404 NOT_FOUND: No audit sink configured.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/audit-sink\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-audit-sink\n * @example\n * ```ts\n * const auditSink = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").auditSink.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuditSink>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/audit-sink\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Issue a new signing secret, returned exactly once.\n *\n * The new secret signs every batch from now on; the old one stops at once. Update your receiver right away: batches it rejects in between are retried every minute (the position only moves after a 2xx), so nothing is lost, but export stops after 20 failures in a row. Clears the receiver-test proof.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.\n * @throws {NotFoundError} 404 NOT_FOUND: No audit sink configured.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/audit-sink/rotate-secret\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-audit-sink-rotate-secret\n * @example\n * ```ts\n * const auditSinkWithSecret = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").auditSink.rotateSecret();\n * ```\n */\n rotateSecret(options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuditSinkWithSecret>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/audit-sink/rotate-secret\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Get the audit export checklist: destination, receiver test and delivery.\n *\n * Rows, in order: `destination` (not_set until a sink exists), `test_batch` (pass once the receiver accepted a test batch with the current address and secret; blocked when the last test was refused; carries `test.action: audit_sink.test`, run with `POST /v1/apps/{appId}/audit-sink/test`), and `delivery` (blocked when export stopped after repeated failures, attention while paused or while recent batches fail). Computed from the stored sink on every request; answers 200 whether or not a sink exists.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read`, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/audit-sink/setup-status\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-audit-sink-setup-status\n * @example\n * ```ts\n * const setupStatus = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").auditSink.setupStatus();\n * ```\n */\n setupStatus(options?: RequestOptions): APIPromise<T.WithLastResponse<T.SetupStatus>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/audit-sink/setup-status\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Send a test batch to the receiver now and report what it answered.\n *\n * POSTs one signed batch, shaped exactly like a real one (`type: audit.batch`, same headers and signature), with `test: true` and a single synthetic record whose `id` starts with `test_`. Works while export is paused or stopped, so a fix can be proven before export is turned back on. The outcome is recorded on the sink (`last_attempt_*`, `last_test_succeeded_at`) but never moves the position in the audit log or counts toward the automatic stop. A refused test is still a 200 with `delivered: false`. At most 20 tests per app per hour.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.\n * @throws {NotFoundError} 404 NOT_FOUND: No audit sink configured.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: More than 20 tests for this app in the last hour (`RATE_LIMITED`).\n * @see POST /v1/apps/{app_id}/audit-sink/test\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-audit-sink-test\n * @example\n * ```ts\n * const auditSinkTestResult = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").auditSink.test();\n * ```\n */\n test(options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuditSinkTestResult>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/audit-sink/test\", pathParams: { app_id: this._b.app_id }, idempotent: true }, options);\n }\n /**\n * Change the address or switch export on or off, keeping the signing secret.\n *\n * Send `url`, `enabled` or both. `enabled: false` pauses export; `enabled: true` resumes it and clears a stop after repeated failures and the failure count. The position in the audit log is never moved: nothing is skipped and nothing is replayed twice on purpose. A new `url` is checked by the same address guard as `PUT`.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.AuditSinkUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: URL is not HTTPS, or the address guard refused it (private address, unresolvable host).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.\n * @throws {NotFoundError} 404 NOT_FOUND: No audit sink configured.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/audit-sink\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-audit-sink\n * @example\n * ```ts\n * const auditSink = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").auditSink.update({ enabled: true });\n * ```\n */\n update(params?: T.AuditSinkUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuditSink>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/audit-sink\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n}\n\n/** `authConfig.providers` */\nexport class AppAuthConfigProvidersResource extends APIResource {\n /**\n * Check the saved provider credentials with the provider.\n *\n * Calls the provider's token endpoint with a dummy sign-in code. If the provider refuses the client (`invalid_client`, GitHub `incorrect_client_credentials` or `unknown_client`), the result is `credentials_rejected` and the provider shows as `blocked` with reason `credentials_rejected` until the credentials are fixed. If it only refuses the code (`invalid_grant`, `bad_verification_code`), the credentials are valid. Nobody is signed in. The result is saved on the provider (`last_check_*`). The same check runs automatically whenever the credentials are saved. Works for a provider that is saved but not switched on yet.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param provider - The sign-in provider: `google`, `github` or `apple`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown provider id, or the saved config can no longer be read.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or the provider is not configured for this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/auth-config/providers/{provider}/check\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-auth-config-providers-provider-check\n * @example\n * ```ts\n * const providerCheck = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").authConfig.providers.check(\"google\");\n * ```\n */\n check(provider: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ProviderCheck>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/auth-config/providers/{provider}/check\", pathParams: { app_id: this._b.app_id, provider } }, options);\n }\n /**\n * Remove the config for an (app, provider). Existing identity rows (people who already signed in with this provider) stay; they just lose the ability to sign in again until config is re-uploaded.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param provider - The sign-in provider: `google`, `github` or `apple`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown provider id.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/auth-config/providers/{provider}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-auth-config-providers-provider\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").authConfig.providers.delete(\"google\");\n * ```\n */\n delete(provider: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/auth-config/providers/{provider}\", pathParams: { app_id: this._b.app_id, provider } }, options);\n }\n /**\n * List federated sign-in providers Auth supports, with their setup status for this app.\n *\n * Each entry carries `status` (`ready` | `blocked` | `disabled` | `not_configured`) and `blocked_reasons`, computed on the server with the same rule the web sign-in flow enforces, so a provider shown as `ready` is one people can actually sign in with.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/auth-config/providers\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-auth-config-providers\n * @example\n * ```ts\n * const result = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").authConfig.providers.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuthConfigProviderListResponse>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/auth-config/providers\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Write or replace the config for an (app, provider). Validates the body via the provider impl's `parseConfig` before encrypting; malformed config 400s. Default `enabled=false`.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param provider - The sign-in provider: `google`, `github` or `apple`.\n * @param params - `Auth.AuthConfigProviderReplaceParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown provider or malformed config.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PUT /v1/apps/{app_id}/auth-config/providers/{provider}\n * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-auth-config-providers-provider\n * @example\n * ```ts\n * const providerDetail = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").authConfig.providers.replace(\"google\", { config: {} });\n * ```\n */\n replace(provider: string, params: T.AuthConfigProviderReplaceParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ProviderDetail>> {\n return this._client.request({ method: \"PUT\", path: \"/v1/apps/{app_id}/auth-config/providers/{provider}\", pathParams: { app_id: this._b.app_id, provider }, body: params }, options);\n }\n /**\n * Get the config for one (app, provider). Secrets are redacted — `private_key_present: true` is the only acknowledgement that a private key is on file.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param provider - The sign-in provider: `google`, `github` or `apple`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown provider id.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Provider not configured for this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/auth-config/providers/{provider}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-auth-config-providers-provider\n * @example\n * ```ts\n * const providerDetail = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").authConfig.providers.retrieve(\"google\");\n * ```\n */\n retrieve(provider: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ProviderDetail>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/auth-config/providers/{provider}\", pathParams: { app_id: this._b.app_id, provider } }, options);\n }\n /**\n * Partially update the config for an (app, provider). Only top-level keys present in `config` are changed; omitted keys — secrets included — keep their stored values. The merged config is validated by the provider impl's `parseConfig`; 404 if the provider is not configured yet (create it with PUT).\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param provider - The sign-in provider: `google`, `github` or `apple`.\n * @param params - `Auth.AuthConfigProviderUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown provider or merged config invalid.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Provider not configured for this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/auth-config/providers/{provider}\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-auth-config-providers-provider\n * @example\n * ```ts\n * const providerDetail = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").authConfig.providers.update(\"google\", { config: {} });\n * ```\n */\n update(provider: string, params?: T.AuthConfigProviderUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ProviderDetail>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/auth-config/providers/{provider}\", pathParams: { app_id: this._b.app_id, provider }, body: params }, options);\n }\n}\n\n/** `authConfig` */\nexport class AppAuthConfigResource extends APIResource {\n #providers?: AppAuthConfigProvidersResource;\n get providers(): AppAuthConfigProvidersResource {\n return (this.#providers ??= new AppAuthConfigProvidersResource(this._client, this._b));\n }\n /**\n * Get the per-app auth config (signup, signin, password policy, sessions).\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/auth-config\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-auth-config\n * @example\n * ```ts\n * const authConfig = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").authConfig.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuthConfig>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/auth-config\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Update the per-app auth config. Only fields you pass are changed.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.AuthConfigUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure — a value out of range (password length, token/session lifetimes, lockout threshold, max sessions, MFA grace days, unverified-account window), an unknown enum value, a `signup_default_role` that does not exist in this app, or a `bot_protection` change that cannot stand: no provider or site key on first setup, a hostname that is not a hostname, or `enabled: true` with no secret stored or sent.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, APP_HAS_NO_WORKSPACE: `APP_HAS_NO_WORKSPACE`: `signup_requires_pak: true` on an app that belongs to no workspace, so no Platform API Key could ever be accepted for its sign-ups.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/auth-config\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-auth-config\n * @example\n * ```ts\n * const authConfig = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").authConfig.update({ access_token_minutes: 60 });\n * ```\n */\n update(params?: T.AuthConfigUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuthConfig>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/auth-config\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).authConfig.retrieve()` (GET /v1/apps/{app_id}/auth-config).\n *\n * @deprecated Use `auth.admin.app(…).authConfig.retrieve()`. Kept for 0.x callers; removed in 2.0.\n */\n get(options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuthConfig>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/auth-config\", pathParams: { app_id: this._b.app_id } }, options);\n }\n}\n\n/** `credentials` */\nexport class AppCredentialsResource extends APIResource {\n /**\n * Create a new M2M client\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.CredentialCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (missing or invalid name).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller email not verified, or lacks `auth.create`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found or caller is not a member.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/credentials\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-credentials\n * @example\n * ```ts\n * const m2mClientCreate = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").credentials.create({ name: \"CI Pipeline\" });\n * ```\n */\n create(params: T.CredentialCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.M2mClientCreate>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/credentials\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Delete an M2M client\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param clientId - Id of the client.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.delete`.\n * @throws {NotFoundError} 404 NOT_FOUND: M2M client not found in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/credentials/{client_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-credentials-client-id\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").credentials.delete(\"m2m_a1b2c3d4e5f6\");\n * ```\n */\n delete(clientId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/credentials/{client_id}\", pathParams: { app_id: this._b.app_id, client_id: clientId } }, options);\n }\n /**\n * List M2M clients\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.CredentialListParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.list` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/credentials\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-credentials\n * @example\n * ```ts\n * for await (const credential of auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").credentials.list()) {\n * console.log(credential);\n * }\n * const page = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").credentials.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.CredentialListParams, options?: RequestOptions): PagePromise<T.M2mClientSummary> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/credentials\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n /**\n * Get M2M client details\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param clientId - Id of the client.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such M2M client in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/credentials/{client_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-credentials-client-id\n * @example\n * ```ts\n * const m2mClientDetail = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").credentials.retrieve(\"m2m_a1b2c3d4e5f6\");\n * ```\n */\n retrieve(clientId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.M2mClientDetail>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/credentials/{client_id}\", pathParams: { app_id: this._b.app_id, client_id: clientId } }, options);\n }\n /**\n * Rotate M2M client secret\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param clientId - Id of the client.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.rotate-secret`.\n * @throws {NotFoundError} 404 NOT_FOUND: M2M client not found in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/credentials/{client_id}/rotate\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-credentials-client-id-rotate\n * @example\n * ```ts\n * const m2mRotateSecret = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").credentials.rotate(\"m2m_a1b2c3d4e5f6\");\n * ```\n */\n rotate(clientId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.M2mRotateSecret>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/credentials/{client_id}/rotate\", pathParams: { app_id: this._b.app_id, client_id: clientId } }, options);\n }\n /**\n * Update M2M client status\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param clientId - Id of the client.\n * @param params - `Auth.CredentialUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `isActive` missing or not a boolean.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such M2M client in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/credentials/{client_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-credentials-client-id\n * @example\n * ```ts\n * const m2mClientDetail = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").credentials.update(\"m2m_a1b2c3d4e5f6\", { is_active: true });\n * ```\n */\n update(clientId: string, params?: T.CredentialUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.M2mClientDetail>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/credentials/{client_id}\", pathParams: { app_id: this._b.app_id, client_id: clientId }, body: params }, options);\n }\n /**\n * Set scopes for an M2M client\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param clientId - Id of the client.\n * @param params - `Auth.CredentialUpdateScopesParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `permissions` is not a string array, or names a permission unknown to this app.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such M2M client in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PUT /v1/apps/{app_id}/credentials/{client_id}/scopes\n * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-credentials-client-id-scopes\n * @example\n * ```ts\n * const result = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").credentials.updateScopes(\"m2m_a1b2c3d4e5f6\", { permissions: [\"user.read\", \"app.read\"] });\n * ```\n */\n updateScopes(clientId: string, params: T.CredentialUpdateScopesParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CredentialUpdateScopesResponse>> {\n return this._client.request({ method: \"PUT\", path: \"/v1/apps/{app_id}/credentials/{client_id}/scopes\", pathParams: { app_id: this._b.app_id, client_id: clientId }, body: params }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).credentials.retrieve()` (GET /v1/apps/{app_id}/credentials/{client_id}).\n *\n * @deprecated Use `auth.admin.app(…).credentials.retrieve()`. Kept for 0.x callers; removed in 2.0.\n */\n get(clientId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.M2mClientDetail>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/credentials/{client_id}\", pathParams: { app_id: this._b.app_id, client_id: clientId } }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).credentials.rotate()` (POST /v1/apps/{app_id}/credentials/{client_id}/rotate).\n *\n * @deprecated Use `auth.admin.app(…).credentials.rotate()`. Kept for 0.x callers; removed in 2.0.\n */\n rotateSecret(clientId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.M2mRotateSecret>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/credentials/{client_id}/rotate\", pathParams: { app_id: this._b.app_id, client_id: clientId } }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).credentials.updateScopes()` (PUT /v1/apps/{app_id}/credentials/{client_id}/scopes).\n *\n * @deprecated Use `auth.admin.app(…).credentials.updateScopes()`. Kept for 0.x callers; removed in 2.0.\n */\n setScopes(clientId: string, params: T.CredentialUpdateScopesParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CredentialUpdateScopesResponse>> {\n return this._client.request({ method: \"PUT\", path: \"/v1/apps/{app_id}/credentials/{client_id}/scopes\", pathParams: { app_id: this._b.app_id, client_id: clientId }, body: params }, options);\n }\n}\n\n/** `customDomains` */\nexport class AppCustomDomainsResource extends APIResource {\n /**\n * Set up the custom domain's DNS records in one step with a short-lived Cloudflare or DigitalOcean API token.\n *\n * Reads the zone through the provider's API and plans both records: `create`, or `skip` when already there. Nothing is ever changed or deleted, and only names at or under the custom host are written (Cloudflare records are DNS-only, not proxied). Anything in the way (another CNAME at the host, A/MX/TXT records where the CNAME must go) refuses the whole apply with 409 and the plan, before anything is written. `dry_run: true` returns the plan and changes nothing; `dry_run: false` writes exactly that plan and runs a check straight away (the records are usually `propagating` for a few minutes). The token is used for this request only: never stored, logged, queued or returned; revoke it afterwards (`warnings` says so when it could see more than this zone).\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param domainId - Id of the domain.\n * @param params - `Auth.CustomDomainApplyParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, IDEMPOTENCY_KEY_REQUIRED, INVALID_ZONE, PROVIDER_TOKEN_REJECTED, PROVIDER_PERMISSION_DENIED, PROVIDER_ZONE_NOT_FOUND, APEX_NOT_SUPPORTED: Validation failure; `Idempotency-Key` missing (`IDEMPOTENCY_KEY_REQUIRED`); `zone` is not the host or a parent (`INVALID_ZONE`); the provider rejected the token (`PROVIDER_TOKEN_REJECTED`), it lacks DNS rights (`PROVIDER_PERMISSION_DENIED`), or it cannot see a zone for the host (`PROVIDER_ZONE_NOT_FOUND`); the host is a zone root (`APEX_NOT_SUPPORTED`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, CUSTOM_DOMAIN_NOT_FOUND: App or custom domain not found (`CUSTOM_DOMAIN_NOT_FOUND`).\n * @throws {ConflictError} 409 CONFLICT, DNS_CONFLICTS, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: `DNS_CONFLICTS`: something at the names blocks a record. Nothing was written; the body carries the full `plan` and `conflicts` next to `code` and `message`. Or `IDEMPOTENCY_KEY_REUSE`. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @throws {InternalServerError} 502 BAD_GATEWAY, PROVIDER_UNAVAILABLE, PROVIDER_ERROR: The provider failed or did not answer (`PROVIDER_UNAVAILABLE`, `PROVIDER_ERROR`). Nothing was written unless the plan items say so.\n * @see POST /v1/apps/{app_id}/custom-domains/{domain_id}/apply\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-custom-domains-domain-id-apply\n * @example\n * ```ts\n * const customDomainApplyResult = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").customDomains.apply(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { dry_run: true, provider: \"cloudflare\", token: \"cf-token-from-your-dashboard\" });\n * ```\n */\n apply(domainId: string, params: T.CustomDomainApplyParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CustomDomainApplyResult>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/custom-domains/{domain_id}/apply\", pathParams: { app_id: this._b.app_id, domain_id: domainId }, body: params, idempotent: true }, options);\n }\n /**\n * Check the custom domain's DNS records now.\n *\n * Asks the zone's own nameservers and a public resolver for both records, stores each record's state and conflicts, and moves the status: `active` once both are verified; an active domain turns `failing` only when a record is definitely gone or blocked (a DNS outage never takes a working domain down). Safe to repeat.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param domainId - Id of the domain.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `domainId` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, CUSTOM_DOMAIN_NOT_FOUND: App or custom domain not found (`CUSTOM_DOMAIN_NOT_FOUND`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/custom-domains/{domain_id}/check\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-custom-domains-domain-id-check\n * @example\n * ```ts\n * const customDomain = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").customDomains.check(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n check(domainId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CustomDomain>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/custom-domains/{domain_id}/check\", pathParams: { app_id: this._b.app_id, domain_id: domainId } }, options);\n }\n /**\n * Add a custom domain (such as auth.acme.com) for this app's sign-in.\n *\n * Returns the two records to publish: a CNAME from the host to `edge_target`, and a TXT token at `_productcraft-auth.<host>` that proves the domain is yours. The zone and its DNS provider are detected, and the first check runs straight away, so `records[].state` and `conflicts` already say what is missing or in the way. Publish the records by hand, import `…/export`, or let `…/apply` write them with a short-lived provider token. The domain turns `active` once both records are seen. Sign-in tokens keep the canonical issuer (`https://api.auth.productcraft.co/{slug}`), so nothing changes for code that verifies them. One custom domain per app. While the feature is in early access it is switched on per workspace.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.CustomDomainCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, INVALID_HOSTNAME, HOSTNAME_RESERVED, APEX_NOT_SUPPORTED: Not a usable host name (`INVALID_HOSTNAME`), one of ours (`HOSTNAME_RESERVED`), or the root of a DNS zone, which cannot hold a CNAME (`APEX_NOT_SUPPORTED`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, FEATURE_NOT_ENABLED: Caller lacks `auth.update` on this app, the app is suspended or archived, or custom domains are not switched on for the workspace (`FEATURE_NOT_ENABLED`).\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, CUSTOM_DOMAIN_EXISTS, HOSTNAME_TAKEN, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: The app already has a custom domain (`CUSTOM_DOMAIN_EXISTS`), the host is set up on another app (`HOSTNAME_TAKEN`), or the Idempotency-Key was reused with a different body (`IDEMPOTENCY_KEY_REUSE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/custom-domains\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-custom-domains\n * @example\n * ```ts\n * const customDomain = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").customDomains.create({ hostname: \"auth.acme.com\" });\n * ```\n */\n create(params: T.CustomDomainCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CustomDomain>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/custom-domains\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Remove the custom domain.\n *\n * The host stops serving this app at once and its certificate is no longer renewed. Your DNS records are not touched: delete the CNAME and the `_productcraft-auth` TXT record at your DNS provider. Sign-ins on the canonical host are unaffected.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param domainId - Id of the domain.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `domainId` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, CUSTOM_DOMAIN_NOT_FOUND: App or custom domain not found (`CUSTOM_DOMAIN_NOT_FOUND`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/custom-domains/{domain_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-custom-domains-domain-id\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").customDomains.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(domainId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/custom-domains/{domain_id}\", pathParams: { app_id: this._b.app_id, domain_id: domainId } }, options);\n }\n /**\n * Download the custom domain's DNS records as a BIND zone fragment or a CSV.\n *\n * `format=bind`: a zone-file fragment (`$ORIGIN <zone>.`, `$TTL 3600`, names relative to the zone, a comment per record with its purpose and any conflict) that Cloudflare and Route 53 import directly. `format=csv`: `type,name,value,priority,ttl,purpose,required`, fully qualified names. By default only records not verified yet; `all=true` for both. Served as an attachment.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param domainId - Id of the domain.\n * @param params - `Auth.CustomDomainExportParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, INVALID_FORMAT: `format` missing or not `bind` / `csv` (`INVALID_FORMAT`), or `domainId` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, CUSTOM_DOMAIN_NOT_FOUND: App or custom domain not found (`CUSTOM_DOMAIN_NOT_FOUND`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/custom-domains/{domain_id}/export\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-custom-domains-domain-id-export\n * @example\n * ```ts\n * const response = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").customDomains.export(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { format: \"bind\" });\n * const text = await response.text();\n * ```\n */\n export(domainId: string, params: T.CustomDomainExportParams, options?: RequestOptions): APIPromise<Response> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/custom-domains/{domain_id}/export\", pathParams: { app_id: this._b.app_id, domain_id: domainId }, query: params, raw: true }, options);\n }\n /**\n * List the app's custom domains (at most one).\n *\n * Each with its status and the last check of its records, plus `available`: whether custom domains are switched on for the workspace. Always a single page.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/custom-domains\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-custom-domains\n * @example\n * ```ts\n * for await (const customDomain of auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").customDomains.list()) {\n * console.log(customDomain);\n * }\n * ```\n */\n list(options?: RequestOptions): PagePromise<T.CustomDomain> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/custom-domains\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Get a custom domain and the last check of its records.\n *\n * Reads stored state only; `POST …/check` runs a new DNS check.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param domainId - Id of the domain.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `domainId` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, CUSTOM_DOMAIN_NOT_FOUND: App or custom domain not found (`CUSTOM_DOMAIN_NOT_FOUND`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/custom-domains/{domain_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-custom-domains-domain-id\n * @example\n * ```ts\n * const customDomain = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").customDomains.retrieve(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n retrieve(domainId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CustomDomain>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/custom-domains/{domain_id}\", pathParams: { app_id: this._b.app_id, domain_id: domainId } }, options);\n }\n}\n\n/** `endUserInsights.users` */\nexport class AppEndUserInsightsUsersResource extends APIResource {\n /**\n * One end-user's recorded activity: their audit trail, their sessions with device/IP, and their enrolled factors. `noActivityRecorded` distinguishes \"nothing happened\" from \"no data\".\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `appId` or `userId` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.audit.read` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: No such end-user in this app. Same response as an account in another app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/end-user-insights/users/{user_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-user-insights-users-user-id\n * @example\n * ```ts\n * const endUserDetailInsights = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUserInsights.users.retrieve(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n retrieve(userId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserDetailInsights>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/end-user-insights/users/{user_id}\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n}\n\n/** `endUserInsights` */\nexport class AppEndUserInsightsResource extends APIResource {\n #users?: AppEndUserInsightsUsersResource;\n get users(): AppEndUserInsightsUsersResource {\n return (this.#users ??= new AppEndUserInsightsUsersResource(this._client, this._b));\n }\n /**\n * Auth health for this app over the last 30 days: verification completion, sign-in failure rate, MFA adoption, password-reset follow-through, and session counts. Rates are null when there is nothing to divide by.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `appId` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.audit.read` on this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/end-user-insights\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-user-insights\n * @example\n * ```ts\n * const endUserInsights = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUserInsights.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserInsights>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/end-user-insights\", pathParams: { app_id: this._b.app_id } }, options);\n }\n}\n\n/** `endUsers.contacts` */\nexport class AppEndUsersContactsResource extends APIResource {\n /**\n * Add a contact for an end-user (unverified).\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param userId - Id of the user.\n * @param params - `Auth.EndUserContactCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid body: unsupported `type`, malformed or empty `value`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such end-user in this app.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Contact value already in use in this app. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/{user_id}/contacts\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-contacts\n * @example\n * ```ts\n * const accountContact = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.contacts.create(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { type: \"email\", value: \"ada@example.com\" });\n * ```\n */\n create(userId: string, params: T.EndUserContactCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AccountContact>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/{user_id}/contacts\", pathParams: { app_id: this._b.app_id, user_id: userId }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a contact from an end-user.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param userId - Id of the user.\n * @param contactId - Id of the contact.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App, end-user or contact not found.\n * @throws {ConflictError} 409 CONFLICT: Contact is the verified primary email; promote another email first.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/end-users/{user_id}/contacts/{contact_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-end-users-user-id-contacts-contact-id\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.contacts.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(userId: string, contactId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/end-users/{user_id}/contacts/{contact_id}\", pathParams: { app_id: this._b.app_id, user_id: userId, contact_id: contactId } }, options);\n }\n /**\n * List an end-user's contacts.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such end-user in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/end-users/{user_id}/contacts\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-user-id-contacts\n * @example\n * ```ts\n * const accountContactList = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.contacts.list(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n list(userId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AccountContactList>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/end-users/{user_id}/contacts\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n /**\n * Promote a verified contact to primary.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param userId - Id of the user.\n * @param contactId - Id of the contact.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App, end-user or contact not found.\n * @throws {ConflictError} 409 CONFLICT: Contact is not verified.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/{user_id}/contacts/{contact_id}/promote\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-contacts-contact-id-promote\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.contacts.promote(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n promote(userId: string, contactId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/{user_id}/contacts/{contact_id}/promote\", pathParams: { app_id: this._b.app_id, user_id: userId, contact_id: contactId } }, options);\n }\n /**\n * Reissue a verification code for a contact.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param userId - Id of the user.\n * @param contactId - Id of the contact.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App, end-user or contact not found.\n * @throws {ConflictError} 409 CONFLICT: Contact is already verified.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/{user_id}/contacts/{contact_id}/resend-verification\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-contacts-contact-id-resend-verification\n * @example\n * ```ts\n * const issuedVerificationCode = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.contacts.resendVerification(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n resendVerification(userId: string, contactId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.IssuedVerificationCode>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/{user_id}/contacts/{contact_id}/resend-verification\", pathParams: { app_id: this._b.app_id, user_id: userId, contact_id: contactId } }, options);\n }\n}\n\n/** `endUsers.imports` */\nexport class AppEndUsersImportsResource extends APIResource {\n /**\n * Queue a bulk end-user import. Body is NDJSON — one JSON object per line. Returns 202 with a job id; poll `GET .../import/:jobId` for progress and the per-row error report.\n *\n * Row fields: `email` (required), `username`, `display_name`, `role`, `tenant_slugs` (array), `external_id`, `metadata`, `email_verified`, and `password_hash` + `password_hash_algorithm`. `password_hash_algorithm` is `argon2id` or `bcrypt`. **argon2id** hashes are accepted at any parameters. **bcrypt** hashes (`$2a$`, `$2b$`, `$2y$` — Auth0, PHP `password_hash`, Spring, node `bcrypt`, Devise / Rails, Laravel, Django) are accepted at any valid cost (4-31), verified on the user's first signin and replaced by an argon2id hash of the same password in that request, so the user keeps their password and never notices. Signin pads a bcrypt verify up to the argon2id floor, so at cost 10 and below an imported account cannot be told apart by timing; at cost 11 and above the verify is slower than the floor and answers when it finishes — a small timing difference on migrated accounts only, gone after each one's first signin. A re-run is idempotent: rows match on `external_id` first, then the primary email, and update rather than duplicate. An existing password, an already-verified address and an existing member's role are never overwritten — see the module docs for why each one.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Body is empty or contains no NDJSON rows.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.user.import`.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {APIError} 413 PAYLOAD_TOO_LARGE: Body exceeds 20 MiB or 50,000 rows. Split and retry.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/import\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-import\n * @example\n * ```ts\n * const importJob = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.imports.create();\n * ```\n */\n create(options?: RequestOptions): APIPromise<T.WithLastResponse<T.ImportJob>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/import\", pathParams: { app_id: this._b.app_id }, idempotent: true }, options);\n }\n /**\n * Import job status and per-row error report. Never returns the uploaded file.\n *\n * `status: succeeded` means the job RAN TO COMPLETION, not that every row landed — read `failed_count` and `errors` for that. `errors` is capped at the first 500 entries; the counts stay exact.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param jobId - Id of the job.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.user.import`.\n * @throws {NotFoundError} 404 NOT_FOUND: No such import job in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/end-users/import/{job_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-import-job-id\n * @example\n * ```ts\n * const importJob = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.imports.retrieve(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n retrieve(jobId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ImportJob>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/end-users/import/{job_id}\", pathParams: { app_id: this._b.app_id, job_id: jobId } }, options);\n }\n}\n\n/** `endUsers.invites` */\nexport class AppEndUsersInvitesResource extends APIResource {\n /**\n * Pre-allocate an EndUser invite. Dispatches an invitation email via the workspace's Mail sender.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.EndUserInviteCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown role, or maxUses / expiresInHours out of range.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: An EndUser with this email already exists in the app. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/invites\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-invites\n * @example\n * ```ts\n * const endUserInvite = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.invites.create({ email: \"alice@example.com\" });\n * ```\n */\n create(params: T.EndUserInviteCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserInvite>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/invites\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Revoke an EndUser invite (soft-delete).\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param inviteId - Id of the invite.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.revoke` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such invite in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/end-users/invites/{invite_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-end-users-invites-invite-id\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.invites.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(inviteId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/end-users/invites/{invite_id}\", pathParams: { app_id: this._b.app_id, invite_id: inviteId } }, options);\n }\n /**\n * List EndUser invites for this app, newest first. Filter by `?status=`.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.EndUserInviteListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` value.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/end-users/invites\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-invites\n * @example\n * ```ts\n * for await (const invite of auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.invites.list()) {\n * console.log(invite);\n * }\n * const page = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.invites.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.EndUserInviteListParams, options?: RequestOptions): PagePromise<T.EndUserInvite> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/end-users/invites\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n}\n\n/** `endUsers.mfa` */\nexport class AppEndUsersMfaResource extends APIResource {\n /**\n * Force an end-user back through MFA enrolment\n *\n * Disables every enabled factor on the account, destroys its recovery codes, and revokes every live session. The next sign-in on an app running `auth_config.mfa: \"required\"` returns `mfa_enrollment_required` and the user must enrol a new factor before a session is minted. On an app running `mfa: \"optional\"` the user simply ends up with no MFA, which is the pre-existing meaning of deleting their factors. All three steps matter: leaving the recovery codes alive would let whoever holds the old printout complete `/auth/mfa/recover` and skip enrolment entirely. Audited, and emits `user.mfa.factor_disabled` per factor plus one `user.mfa.reenrollment_required`. Idempotent.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller's workspace policy does not allow `auth.user.factors.delete` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: No such end-user in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/{user_id}/mfa/require-reenrollment\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-mfa-require-reenrollment\n * @example\n * ```ts\n * const requireMfaReenrollment = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.mfa.requireReenrollment(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n requireReenrollment(userId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.RequireMfaReenrollment>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/{user_id}/mfa/require-reenrollment\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n}\n\n/** `endUsers.sessions` */\nexport class AppEndUsersSessionsResource extends APIResource {\n /**\n * Revoke every active session for an end-user.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such end-user in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/{user_id}/sessions/revoke-all\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-sessions-revoke-all\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.sessions.revokeAll(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n revokeAll(userId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/{user_id}/sessions/revoke-all\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n}\n\n/** `endUsers` */\nexport class AppEndUsersResource extends APIResource {\n #contacts?: AppEndUsersContactsResource;\n #imports?: AppEndUsersImportsResource;\n #invites?: AppEndUsersInvitesResource;\n #mfa?: AppEndUsersMfaResource;\n #sessions?: AppEndUsersSessionsResource;\n get contacts(): AppEndUsersContactsResource {\n return (this.#contacts ??= new AppEndUsersContactsResource(this._client, this._b));\n }\n get imports(): AppEndUsersImportsResource {\n return (this.#imports ??= new AppEndUsersImportsResource(this._client, this._b));\n }\n get invites(): AppEndUsersInvitesResource {\n return (this.#invites ??= new AppEndUsersInvitesResource(this._client, this._b));\n }\n get mfa(): AppEndUsersMfaResource {\n return (this.#mfa ??= new AppEndUsersMfaResource(this._client, this._b));\n }\n get sessions(): AppEndUsersSessionsResource {\n return (this.#sessions ??= new AppEndUsersSessionsResource(this._client, this._b));\n }\n /**\n * Bulk-delete accounts across a selection.\n *\n * Deletes every matched account in one transaction. Each deleted account gets an `auth.account.deleted` audit row (`via: platform_bulk`) whose metadata carries the `selection` (`{ mode: \"ids\" }`, or `{ mode: \"filter\", filter }`), so a filter sweep reads as one. The workspace audit log gets one `auth.end_users.deleted` row with the count. `user.deleted` (`via: \"platform_bulk\"`) fires per account only when 100 or fewer were deleted.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.EndUserBulkDeleteParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `selection` body, or an unfiltered selection without `confirm_all_in_app: true` (including more than 5,000 ids).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.delete` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/bulk-delete\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-bulk-delete\n * @example\n * ```ts\n * const bulkAffectedUsers = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.bulkDelete({ selection: { mode: \"ids\" } });\n * ```\n */\n bulkDelete(params: T.EndUserBulkDeleteParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.BulkAffectedUsers>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/bulk-delete\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n /**\n * Bulk-revoke sessions across a selection.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.EndUserBulkRevokeSessionsParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `selection` body (including more than 5,000 ids).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/bulk-revoke-sessions\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-bulk-revoke-sessions\n * @example\n * ```ts\n * const bulkAffectedUsers = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.bulkRevokeSessions({ selection: { mode: \"ids\" } });\n * ```\n */\n bulkRevokeSessions(params: T.EndUserBulkRevokeSessionsParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.BulkAffectedUsers>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/bulk-revoke-sessions\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n /**\n * Bulk-assign a role across a selection.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.EndUserBulkUpdateRoleParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `selection` body or empty `roleName`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.assign` on this app, cannot grant every permission the role carries, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App or role not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/bulk-update-role\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-bulk-update-role\n * @example\n * ```ts\n * const bulkAffectedUsers = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.bulkUpdateRole({ role_name: \"member\", selection: { mode: \"ids\" } });\n * ```\n */\n bulkUpdateRole(params: T.EndUserBulkUpdateRoleParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.BulkAffectedUsers>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/bulk-update-role\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n /**\n * Bulk-update status across a selection.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.EndUserBulkUpdateStatusParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `selection` body, or `status` is not one of active, suspended, deactivated.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/bulk-update-status\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-bulk-update-status\n * @example\n * ```ts\n * const bulkAffectedUsers = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.bulkUpdateStatus({ selection: { mode: \"ids\" }, status: \"suspended\" });\n * ```\n */\n bulkUpdateStatus(params: T.EndUserBulkUpdateStatusParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.BulkAffectedUsers>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/bulk-update-status\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n /**\n * Delete an end-user permanently.\n *\n * Removes the account with its contacts, sessions and tenant memberships. Writes one `auth.account.deleted` audit row (`via: platform`) in the same transaction, mirrors the deletion into the workspace audit log as `auth.end_users.deleted`, and fires `user.deleted` with `via: \"platform\"`.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.delete` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such end-user in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/end-users/{user_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-end-users-user-id\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(userId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/end-users/{user_id}\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n /**\n * Stream this app's end-user directory as NDJSON or CSV, applying the list's `?status=` / `?search=` / `?provider=` filters. Audited as `users.exported`.\n *\n * Streamed in keyset batches — neither the service nor the client holds the whole directory. Ordered oldest-first by `(created_at, id)` so a re-run is stable. Gated on `auth.user.export`, which is escalation class: this hands over every address in the directory in one call, where `auth.list` pages it. Hard cap of 1,000,000 rows; a wider request is refused with 413 before any body is written.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.EndUserExportParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `format`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.user.export`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {APIError} 413 PAYLOAD_TOO_LARGE: More than 1,000,000 end-users match. Narrow the filters.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/end-users/export\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-export\n * @example\n * ```ts\n * const response = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.export();\n * const text = await response.text();\n * ```\n */\n export(params?: T.EndUserExportParams, options?: RequestOptions): APIPromise<Response> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/end-users/export\", pathParams: { app_id: this._b.app_id }, query: params, raw: true }, options);\n }\n /**\n * List end-users in this app (cursor-paginated).\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.EndUserListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `signal` / `sort` / `order`, or a `cursor` minted under a different ordering than the one requested.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/end-users\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users\n * @example\n * ```ts\n * for await (const endUser of auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.list()) {\n * console.log(endUser);\n * }\n * const page = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.EndUserListParams, options?: RequestOptions): PagePromise<T.EndUserSummary> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/end-users\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n /**\n * Resend verification to the primary email contact.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such end-user in this app.\n * @throws {ConflictError} 409 CONFLICT: End-user has no primary email contact, or it is already verified.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/end-users/{user_id}/resend-verification\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-resend-verification\n * @example\n * ```ts\n * const issuedVerificationCode = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.resendVerification(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n resendVerification(userId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.IssuedVerificationCode>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/{user_id}/resend-verification\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n /**\n * Get one end-user.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such end-user in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/end-users/{user_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-user-id\n * @example\n * ```ts\n * const endUserSummary = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.retrieve(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n retrieve(userId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserSummary>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/end-users/{user_id}\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n /**\n * Update end-user display name, primary email, or metadata keys (merged).\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param userId - Id of the user.\n * @param params - `Auth.EndUserUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid body: empty `displayName`, malformed `email`, `metadata` not an object, or metadata over 8 KB.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such end-user in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/end-users/{user_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-end-users-user-id\n * @example\n * ```ts\n * const endUserSummary = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.update(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { display_name: \"Ada Lovelace\" });\n * ```\n */\n update(userId: string, params?: T.EndUserUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserSummary>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/end-users/{user_id}\", pathParams: { app_id: this._b.app_id, user_id: userId }, body: params }, options);\n }\n /**\n * Assign an end-user a role.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param userId - Id of the user.\n * @param params - `Auth.EndUserUpdateRoleParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `roleName` missing or empty.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.assign` on this app, cannot grant every permission the role carries, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App, end-user or role not found in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/end-users/{user_id}/role\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-end-users-user-id-role\n * @example\n * ```ts\n * const endUserRoleAssignment = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.updateRole(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { role_name: \"admin\" });\n * ```\n */\n updateRole(userId: string, params: T.EndUserUpdateRoleParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserRoleAssignment>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/end-users/{user_id}/role\", pathParams: { app_id: this._b.app_id, user_id: userId }, body: params }, options);\n }\n /**\n * Change end-user status (active / suspended / deactivated).\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param userId - Id of the user.\n * @param params - `Auth.EndUserUpdateStatusParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `status` is not one of active, suspended, deactivated.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such end-user in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/end-users/{user_id}/status\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-end-users-user-id-status\n * @example\n * ```ts\n * const endUserSummary = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").endUsers.updateStatus(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { status: \"suspended\" });\n * ```\n */\n updateStatus(userId: string, params: T.EndUserUpdateStatusParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserSummary>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/end-users/{user_id}/status\", pathParams: { app_id: this._b.app_id, user_id: userId }, body: params }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).endUsers.retrieve()` (GET /v1/apps/{app_id}/end-users/{user_id}).\n *\n * @deprecated Use `auth.admin.app(…).endUsers.retrieve()`. Kept for 0.x callers; removed in 2.0.\n */\n get(userId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserSummary>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/end-users/{user_id}\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).endUsers.sessions.revokeAll()` (POST /v1/apps/{app_id}/end-users/{user_id}/sessions/revoke-all).\n *\n * @deprecated Use `auth.admin.app(…).endUsers.sessions.revokeAll()`. Kept for 0.x callers; removed in 2.0.\n */\n revokeAllSessions(userId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/{user_id}/sessions/revoke-all\", pathParams: { app_id: this._b.app_id, user_id: userId } }, options);\n }\n}\n\n/** `invites` */\nexport class AppInvitesResource extends APIResource {\n /**\n * 0.x name for `auth.admin.app(…).endUsers.invites.create()` (POST /v1/apps/{app_id}/end-users/invites).\n *\n * @deprecated Use `auth.admin.app(…).endUsers.invites.create()`. Kept for 0.x callers; removed in 2.0.\n */\n create(params: T.EndUserInviteCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.EndUserInvite>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/end-users/invites\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).endUsers.invites.list()` (GET /v1/apps/{app_id}/end-users/invites).\n *\n * @deprecated Use `auth.admin.app(…).endUsers.invites.list()`. Kept for 0.x callers; removed in 2.0.\n */\n list(params?: T.EndUserInviteListParams, options?: RequestOptions): PagePromise<T.EndUserInvite> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/end-users/invites\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).endUsers.invites.delete()` (DELETE /v1/apps/{app_id}/end-users/invites/{invite_id}).\n *\n * @deprecated Use `auth.admin.app(…).endUsers.invites.delete()`. Kept for 0.x callers; removed in 2.0.\n */\n revoke(inviteId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/end-users/invites/{invite_id}\", pathParams: { app_id: this._b.app_id, invite_id: inviteId } }, options);\n }\n}\n\n/** `members` */\nexport class AppMembersResource extends APIResource {\n /**\n * Remove a member from the app\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param accountId - Id of the account.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.delete` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or the account is not a member of this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/members/{account_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-members-account-id\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").members.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(accountId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/members/{account_id}\", pathParams: { app_id: this._b.app_id, account_id: accountId } }, options);\n }\n /**\n * List app members (PlatformUser view of EndUser memberships)\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.MemberListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid pagination cursor.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.list` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/members\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-members\n * @example\n * ```ts\n * for await (const member of auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").members.list()) {\n * console.log(member);\n * }\n * const page = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").members.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.MemberListParams, options?: RequestOptions): PagePromise<T.AppMemberSummary> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/members\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).members.delete()` (DELETE /v1/apps/{app_id}/members/{account_id}).\n *\n * @deprecated Use `auth.admin.app(…).members.delete()`. Kept for 0.x callers; removed in 2.0.\n */\n remove(accountId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/members/{account_id}\", pathParams: { app_id: this._b.app_id, account_id: accountId } }, options);\n }\n}\n\n/** `notificationSettings` */\nexport class AppNotificationSettingsResource extends APIResource {\n /**\n * Read the per-app notification settings. Absent row reads as defaults (notifications_via_envoi: false, sender_mode: workspace, every template slot null).\n *\n * `effective_sender` is the sender emails actually go out from, checked live in Mail with your own access (the workspace default sender, or the app's custom address).\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/notification-settings\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-notification-settings\n * @example\n * ```ts\n * const appNotificationSettings = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").notificationSettings.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.AppNotificationSettings>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/notification-settings\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Update the per-app notification settings. Each field is independently optional; null clears that slot.\n *\n * Turning `notifications_via_envoi` on (from off) creates the default template of every empty slot in the workspace's Mail templates (`auth-verification`, `auth-welcome`, `auth-password-reset`, `auth-invite`, `auth-mfa-code`), reusing a template that already has that name, and fills the slot. Templates are created with your own Mail access; a slot that could not be created stays empty. A slot you clear later is not refilled until emails are switched off and on again.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.NotificationSettingUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid payload.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {UnprocessableEntityError} 422 UNPROCESSABLE_ENTITY, SENDER_ADDRESS_REQUIRED: `SENDER_ADDRESS_REQUIRED`: `sender_mode: custom` with no `default_sender_address` (in the body or already saved).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/notification-settings\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-notification-settings\n * @example\n * ```ts\n * const appNotificationSettings = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").notificationSettings.update({ default_sender_address: \"ada@example.com\" });\n * ```\n */\n update(params?: T.NotificationSettingUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AppNotificationSettings>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/notification-settings\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n}\n\n/** `notifications` */\nexport class AppNotificationsResource extends APIResource {\n /**\n * Send me a test of one email.\n *\n * Sends the slot's real Mail template, with this app's real sender (the workspace default or the custom address) and example values for every variable, to your own verified account address. It cannot be sent anywhere else. It uses your own Mail access, goes through the same send path as real emails, and shows up in Mail > Emails. At most 10 tests per person per hour. Not available to API keys (a key has no inbox).\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param slot - The email to test.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `slot`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, the app is suspended or archived, or Mail refused the send for your role (you need Mail send access in this workspace).\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or the slot's template no longer exists in Mail.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {APIError} 412 PRECONDITION_FAILED, ENVOI_TEMPLATE_NOT_CONFIGURED, ENVOI_SENDER_NOT_CONFIGURED, ENVOI_APP_NOT_BOUND_TO_WORKSPACE: `ENVOI_TEMPLATE_NOT_CONFIGURED`: the slot has no template. `ENVOI_SENDER_NOT_CONFIGURED`: `sender_mode: custom` with no address. `ENVOI_APP_NOT_BOUND_TO_WORKSPACE`.\n * @throws {UnprocessableEntityError} 422 UNPROCESSABLE_ENTITY: `operator_email_unavailable`: the caller has no verified account email (API keys included). From Mail: `no_default_sender` (workspace mode and no default sender set in Mail), `from_domain_not_verified`, `domain_not_verified_by_provider`, a suppressed address, or a render failure.\n * @throws {RateLimitError} 429 RATE_LIMITED: More than 10 tests by you in the last hour (`RATE_LIMITED`), or over a Mail send limit.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE, MAIL_UNREACHABLE: `MAIL_UNREACHABLE`: Mail did not answer.\n * @see POST /v1/apps/{app_id}/notifications/{slot}/test\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-notifications-slot-test\n * @example\n * ```ts\n * const notificationTest = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").notifications.test(\"verification\");\n * ```\n */\n test(slot: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.NotificationTest>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/notifications/{slot}/test\", pathParams: { app_id: this._b.app_id, slot }, idempotent: true }, options);\n }\n}\n\n/** `permissions.enforcement` */\nexport class AppPermissionsEnforcementResource extends APIResource {\n /**\n * List permissions that at least one Consumer-API route enforces\n *\n * Returns the deduplicated set of permission strings that any handler in this users-api build gates via `@RequireAppPermission`. Drives the console \"Enforced\" badge — a customer who binds `user.delete` to a role can see whether any route in this deploy actually checks for it. App-agnostic in shape; the path parameter is included for URN symmetry with the rest of the per-app surface, not to narrow the response.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/permissions/enforcement\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-permissions-enforcement\n * @example\n * ```ts\n * const enforcedPermissions = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").permissions.enforcement.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.EnforcedPermissions>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/permissions/enforcement\", pathParams: { app_id: this._b.app_id } }, options);\n }\n}\n\n/** `permissions` */\nexport class AppPermissionsResource extends APIResource {\n #enforcement?: AppPermissionsEnforcementResource;\n get enforcement(): AppPermissionsEnforcementResource {\n return (this.#enforcement ??= new AppPermissionsEnforcementResource(this._client, this._b));\n }\n /**\n * Create a custom permission\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.AppScopedPermissionCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`resource` / `action` segment format, or `description` over 256 chars).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Permission collides with a system permission or already exists in this app, or the app has reached its custom-permission limit (`code` set). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/permissions\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-permissions\n * @example\n * ```ts\n * const permission = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").permissions.create({ action: \"read\", resource: \"project\" });\n * ```\n */\n create(params: T.AppScopedPermissionCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Permission>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/permissions\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a custom permission\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param permissionKey - Permission key, `resource.action` (e.g. `invoice.read`).\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `permissionKey` is not in `resource.action` format.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived, or the key names a system permission.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such custom permission in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/permissions/{permission_key}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-permissions-permission-key\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").permissions.delete(\"invoice.read\");\n * ```\n */\n delete(permissionKey: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/permissions/{permission_key}\", pathParams: { app_id: this._b.app_id, permission_key: permissionKey } }, options);\n }\n /**\n * List all permissions (system + custom)\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/permissions\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-permissions\n * @example\n * ```ts\n * const result = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").permissions.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.AppScopedPermissionListResponse>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/permissions\", pathParams: { app_id: this._b.app_id } }, options);\n }\n}\n\n/** `roles.permissions` */\nexport class AppRolesPermissionsResource extends APIResource {\n /**\n * List all available permissions\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/roles/permissions\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-roles-permissions\n * @example\n * ```ts\n * const result = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").roles.permissions.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.RolePermissionListResponse>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/roles/permissions\", pathParams: { app_id: this._b.app_id } }, options);\n }\n}\n\n/** `roles` */\nexport class AppRolesResource extends APIResource {\n #permissions?: AppRolesPermissionsResource;\n get permissions(): AppRolesPermissionsResource {\n return (this.#permissions ??= new AppRolesPermissionsResource(this._client, this._b));\n }\n /**\n * Assign a role to a user\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.RoleAssignParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`accountId` not a UUID, or `role` empty / over 64 chars).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.assign` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, no such role in this app, or the account is not a member of this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/roles/assign\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-roles-assign\n * @example\n * ```ts\n * const appMembership = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").roles.assign({ account_id: \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", role: \"admin\" });\n * ```\n */\n assign(params: T.RoleAssignParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AppMembership>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/roles/assign\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n /**\n * Create a new role (no permissions yet — set them via PUT /:roleName/permissions)\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.AppScopedRoleCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`name` 1-64 chars, `description` up to 256).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: A role with this name already exists in this app. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/roles\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-roles\n * @example\n * ```ts\n * const role = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").roles.create({ name: \"editor\" });\n * ```\n */\n create(params: T.AppScopedRoleCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Role>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/roles\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a custom role\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param roleName - Name of the role (e.g. `admin`).\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.delete` on this app, or the app is suspended or archived, or the role is a system role.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such role in this app.\n * @throws {ConflictError} 409 CONFLICT: Role is still assigned to members (`code: ROLE_IN_USE`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/roles/{role_name}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-roles-role-name\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").roles.delete(\"admin\");\n * ```\n */\n delete(roleName: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/roles/{role_name}\", pathParams: { app_id: this._b.app_id, role_name: roleName } }, options);\n }\n /**\n * List all roles in an app. Filter by `?search=` on the role name.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.AppScopedRoleListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/roles\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-roles\n * @example\n * ```ts\n * for await (const role of auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").roles.list()) {\n * console.log(role);\n * }\n * const page = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").roles.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.AppScopedRoleListParams, options?: RequestOptions): PagePromise<T.Role> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/roles\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n /**\n * Get role details with permissions\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param roleName - Name of the role (e.g. `admin`).\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such role in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/roles/{role_name}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-roles-role-name\n * @example\n * ```ts\n * const roleWithPermissions = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").roles.retrieve(\"admin\");\n * ```\n */\n retrieve(roleName: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.RoleWithPermissions>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/roles/{role_name}\", pathParams: { app_id: this._b.app_id, role_name: roleName } }, options);\n }\n /**\n * Update role name or description\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param roleName - Name of the role (e.g. `admin`).\n * @param params - `Auth.AppScopedRoleUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`description` over 256 chars).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such role in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/roles/{role_name}\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-roles-role-name\n * @example\n * ```ts\n * const role = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").roles.update(\"admin\", { description: \"Updated description\" });\n * ```\n */\n update(roleName: string, params?: T.AppScopedRoleUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Role>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/roles/{role_name}\", pathParams: { app_id: this._b.app_id, role_name: roleName }, body: params }, options);\n }\n /**\n * Set permissions for a role (caller-narrowed: caller must hold every requested permission)\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param roleName - Name of the role (e.g. `admin`).\n * @param params - `Auth.AppScopedRoleUpdatePermissionsParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (a permission not in `resource.action` format), or a permission not in the app catalogue.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived, or the caller does not hold every permission it is trying to grant.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or no such role in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PUT /v1/apps/{app_id}/roles/{role_name}/permissions\n * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-roles-role-name-permissions\n * @example\n * ```ts\n * const result = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").roles.updatePermissions(\"admin\", { permissions: [\"user.read\", \"role.create\"] });\n * ```\n */\n updatePermissions(roleName: string, params: T.AppScopedRoleUpdatePermissionsParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AppScopedRoleUpdatePermissionsResponse>> {\n return this._client.request({ method: \"PUT\", path: \"/v1/apps/{app_id}/roles/{role_name}/permissions\", pathParams: { app_id: this._b.app_id, role_name: roleName }, body: params }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).roles.retrieve()` (GET /v1/apps/{app_id}/roles/{role_name}).\n *\n * @deprecated Use `auth.admin.app(…).roles.retrieve()`. Kept for 0.x callers; removed in 2.0.\n */\n get(roleName: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.RoleWithPermissions>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/roles/{role_name}\", pathParams: { app_id: this._b.app_id, role_name: roleName } }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).roles.permissions.list()` (GET /v1/apps/{app_id}/roles/permissions).\n *\n * @deprecated Use `auth.admin.app(…).roles.permissions.list()`. Kept for 0.x callers; removed in 2.0.\n */\n listPermissions(options?: RequestOptions): APIPromise<T.WithLastResponse<T.RolePermissionListResponse>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/roles/permissions\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * 0.x name for `auth.admin.app(…).roles.updatePermissions()` (PUT /v1/apps/{app_id}/roles/{role_name}/permissions).\n *\n * @deprecated Use `auth.admin.app(…).roles.updatePermissions()`. Kept for 0.x callers; removed in 2.0.\n */\n setPermissions(roleName: string, params: T.AppScopedRoleUpdatePermissionsParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AppScopedRoleUpdatePermissionsResponse>> {\n return this._client.request({ method: \"PUT\", path: \"/v1/apps/{app_id}/roles/{role_name}/permissions\", pathParams: { app_id: this._b.app_id, role_name: roleName }, body: params }, options);\n }\n}\n\n/** `setupStatus` */\nexport class AppSetupStatusResource extends APIResource {\n /**\n * Get the setup checklist for an app: what works, what is missing, and where to fix it.\n *\n * Rows, in order: `signups` (attention while sign-ups are off), `redirect_origins` (blocked until at least one site may start sign-in), one `provider_<id>` row per switched-on sign-in provider (blocked while its status is blocked), `email` (sender chosen and a template for every email; attention while emails are off), `api_key` (attention until an active app key exists), `webhook` (attention until an endpoint has accepted a delivery), and `passkeys` (only while passkeys are on; blocked when no allowed redirect origin is on the passkey site). `complete` is true once no row is `not_set` or `blocked`. Each `fix.href` is a console path to the exact setting. Computed on every request from stored settings, plus the workspace default sender read from Mail with your own access when emails use it: nothing here calls DNS or a sign-in provider (a provider whose last credential check was rejected shows as blocked). A ready provider row carries `test.action: sign_in.try`: run it with `POST /v1/apps/{appId}/sign-in-tests` `{ method: \"oauth\", provider }`.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/setup-status\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-setup-status\n * @example\n * ```ts\n * const setupStatus = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").setupStatus.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.SetupStatus>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/setup-status\", pathParams: { app_id: this._b.app_id } }, options);\n }\n}\n\n/** `signInTests` */\nexport class AppSignInTestsResource extends APIResource {\n /**\n * Start a sign-in test: prove sign-in works without creating a user.\n *\n * For `oauth`, the server first checks what it can on its own (an allowed redirect origin, saved credentials, and the provider credential check). If one fails, the test comes back `failed` at once with the fix. Otherwise open `start_url` in a popup: the person signs in at the provider, the provider returns to Auth, Auth resolves who it is exactly as a real sign-in would, records `would_sign_in_existing` or `would_create` (or the provider error mapped to its fix), creates no account and issues no token, then sends the popup to the console result page. Poll `GET …/sign-in-tests/{id}` until `state` is not `pending`. Works with a provider that is saved but not switched on yet. For `password` / `otp`, the test runs now: it checks the sign-up or sign-in rules for your own email and sends the real email to your own verified address. At most 20 tests per app per hour; tests are deleted after 24 hours.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.SignInTestCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, CUSTOM_DOMAIN_OAUTH_ONLY: Unknown `method` or provider, `provider` missing for `oauth`, or `custom_domain` on a `password` / `otp` test (`CUSTOM_DOMAIN_OAUTH_ONLY`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, CUSTOM_DOMAIN_NOT_ACTIVE, IDEMPOTENCY_IN_PROGRESS: Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`), or `custom_domain: true` while the app has no active custom domain (`CUSTOM_DOMAIN_NOT_ACTIVE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: More than 20 tests for this app in the last hour (`RATE_LIMITED`).\n * @see POST /v1/apps/{app_id}/sign-in-tests\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-sign-in-tests\n * @example\n * ```ts\n * const signInTest = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").signInTests.create({ method: \"oauth\" });\n * ```\n */\n create(params: T.SignInTestCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.SignInTest>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/sign-in-tests\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Get a sign-in test and its result.\n *\n * Poll this after opening `start_url`. `state` turns `succeeded` (with `outcome` and `identity`) or `failed` (with `error.fix`). A test that is never finished turns `failed` with code `expired` 15 minutes after it was created.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param testId - Id of the test.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `testId` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App or sign-in test not found (tests are deleted after 24 hours).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/sign-in-tests/{test_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-sign-in-tests-test-id\n * @example\n * ```ts\n * const signInTest = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").signInTests.retrieve(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n retrieve(testId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.SignInTest>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/sign-in-tests/{test_id}\", pathParams: { app_id: this._b.app_id, test_id: testId } }, options);\n }\n}\n\n/** `tenantApiKeys.config` */\nexport class AppTenantApiKeysConfigResource extends APIResource {\n /**\n * Read the app's tenant API key settings\n *\n * Includes the platform kill switch `suspended`. Requires `auth.read` on the app.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/tenant-api-keys/config\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenant-api-keys-config\n * @example\n * ```ts\n * const tenantApiKeysConfig = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenantApiKeys.config.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantApiKeysConfig>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/tenant-api-keys/config\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Change the app's tenant API key settings, or suspend its keys\n *\n * Fields you leave out keep their stored value. `suspended: true` is the kill switch: introspection answers `{\"active\": false}` for every key of the app at once, and key management is refused, until you set it back to `false`. The app's own config push (`PUT /:appSlug/v1/tenant-api-keys/config`) can never change it. Requires `auth.update` on the app.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.AppScopedTenantApiKeyConfigUpdateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, TENANT_API_KEYS_SCOPE_INVALID, TENANT_API_KEYS_UNKNOWN_ROLE, TENANT_API_KEY_EXPIRY_INVALID, TENANT_API_KEYS_NO_SCOPES: `VALIDATION_ERROR`, `TENANT_API_KEYS_SCOPE_INVALID`, `TENANT_API_KEYS_UNKNOWN_ROLE`, `TENANT_API_KEY_EXPIRY_INVALID`, `TENANT_API_KEYS_NO_SCOPES`, or a malformed `Idempotency-Key`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: `IDEMPOTENCY_KEY_REUSE`. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PUT /v1/apps/{app_id}/tenant-api-keys/config\n * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-tenant-api-keys-config\n * @example\n * ```ts\n * const tenantApiKeysConfig = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenantApiKeys.config.update({ default_expiry_days: 7 });\n * ```\n */\n update(params?: T.AppScopedTenantApiKeyConfigUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantApiKeysConfig>> {\n return this._client.request({ method: \"PUT\", path: \"/v1/apps/{app_id}/tenant-api-keys/config\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n}\n\n/** `tenantApiKeys` */\nexport class AppTenantApiKeysResource extends APIResource {\n #config?: AppTenantApiKeysConfigResource;\n get config(): AppTenantApiKeysConfigResource {\n return (this.#config ??= new AppTenantApiKeysConfigResource(this._client, this._b));\n }\n /**\n * Revoke a tenant's API key\n *\n * Immediate and final; recorded as revoked by you (`revoked_by_type: platform_user`) in the key and in the audit log. Idempotent: revoking a revoked key is a 204 that changes nothing. Requires `auth.revoke` on the app.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param keyId - Key id (UUID) or display id (`tak_…`).\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.revoke` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND, TENANT_API_KEY_NOT_FOUND: `TENANT_API_KEY_NOT_FOUND`: no such key in this app (or app not found).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/tenant-api-keys/{key_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-tenant-api-keys-key-id\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenantApiKeys.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(keyId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/tenant-api-keys/{key_id}\", pathParams: { app_id: this._b.app_id, key_id: keyId } }, options);\n }\n /**\n * List the app's tenant API keys\n *\n * Every tenant of the app, newest first, cursor-paginated (20 per page, max 100). Secrets are never returned. Each key names its creator (`created_by`), and its `status` is `orphaned` when it is neither revoked nor expired but its creator left the tenant or the tenant is not active (introspection refuses it). Requires `auth.read` on the app.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.AppScopedTenantApiKeyListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` or malformed `cursor`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found, or `tenant_id` names no tenant of this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/tenant-api-keys\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenant-api-keys\n * @example\n * ```ts\n * for await (const tenantApiKey of auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenantApiKeys.list()) {\n * console.log(tenantApiKey);\n * }\n * const page = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenantApiKeys.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.AppScopedTenantApiKeyListParams, options?: RequestOptions): PagePromise<T.PlatformTenantApiKey> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/tenant-api-keys\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n}\n\n/** `tenants.invites` */\nexport class AppTenantsInvitesResource extends APIResource {\n /**\n * Invite an email address into a tenant. Returns the plaintext code once; only its SHA-256 digest is stored.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.AppScopedTenantInviteCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid email, unknown role, or maxUses/expiresInHours out of range.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: That email is already a member of the tenant, or already has a pending invite to it. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/tenants/{tenant_id}/invites\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-tenants-tenant-id-invites\n * @example\n * ```ts\n * const createTenantInvite = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenants.invites.create(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { email: \"alice@example.com\", role_name: \"member\" });\n * ```\n */\n create(tenantId: string, params: T.AppScopedTenantInviteCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CreateTenantInvite>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}/invites\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId }, body: params, idempotent: true }, options);\n }\n /**\n * Revoke a pending invite. Idempotent — a second revoke is a 204 no-op and fires no second webhook.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param inviteId - Id of the invite.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant or invite not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/tenants/{tenant_id}/invites/{invite_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-tenants-tenant-id-invites-invite-id\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenants.invites.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(tenantId: string, inviteId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}/invites/{invite_id}\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId, invite_id: inviteId } }, options);\n }\n /**\n * List a tenant's invites, newest first. Optional `?status=pending|revoked|expired|used`. Codes are never returned.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.AppScopedTenantInviteListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` value.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/tenants/{tenant_id}/invites\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenants-tenant-id-invites\n * @example\n * ```ts\n * for await (const invite of auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenants.invites.list(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\")) {\n * console.log(invite);\n * }\n * const page = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenants.invites.list(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", {}, { timeout: 5_000 });\n * ```\n */\n list(tenantId: string, params?: T.AppScopedTenantInviteListParams, options?: RequestOptions): PagePromise<T.TenantInvite> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}/invites\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId }, query: params }, options);\n }\n}\n\n/** `tenants.members` */\nexport class AppTenantsMembersResource extends APIResource {\n /**\n * Add a member to a tenant.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.AppScopedTenantMemberCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid body, neither or both of `accountId` / `email`, or unknown role.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.members.add` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App, tenant or account not found in this app.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Account is already a member of this tenant. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/tenants/{tenant_id}/members\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-tenants-tenant-id-members\n * @example\n * ```ts\n * const addMember = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenants.members.create(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { role_name: \"member\" });\n * ```\n */\n create(tenantId: string, params: T.AppScopedTenantMemberCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AddMember>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}/members\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId }, body: params, idempotent: true }, options);\n }\n /**\n * Remove a member from a tenant.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param accountId - Id of the account.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.members.remove` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App, tenant or membership not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/tenants/{tenant_id}/members/{account_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-tenants-tenant-id-members-account-id\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenants.members.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(tenantId: string, accountId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}/members/{account_id}\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId, account_id: accountId } }, options);\n }\n /**\n * List members of a tenant, newest membership first. Filter by `?search=` and/or `?role=`.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.AppScopedTenantMemberListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `search` or `role` exceeds its max length.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App or tenant not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/tenants/{tenant_id}/members\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenants-tenant-id-members\n * @example\n * ```ts\n * for await (const member of auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenants.members.list(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\")) {\n * console.log(member);\n * }\n * const page = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenants.members.list(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", {}, { timeout: 5_000 });\n * ```\n */\n list(tenantId: string, params?: T.AppScopedTenantMemberListParams, options?: RequestOptions): PagePromise<T.TenantMembership> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}/members\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId }, query: params }, options);\n }\n /**\n * Change a member's role inside a tenant.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param accountId - Id of the account.\n * @param params - `Auth.AppScopedTenantMemberUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid body or unknown role.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.members.update-role` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App, tenant or membership not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/tenants/{tenant_id}/members/{account_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-tenants-tenant-id-members-account-id\n * @example\n * ```ts\n * const tenantMembership = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenants.members.update(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { role_name: \"admin\" });\n * ```\n */\n update(tenantId: string, accountId: string, params: T.AppScopedTenantMemberUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantMembership>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}/members/{account_id}\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId, account_id: accountId }, body: params }, options);\n }\n}\n\n/** `tenants` */\nexport class AppTenantsResource extends APIResource {\n #invites?: AppTenantsInvitesResource;\n #members?: AppTenantsMembersResource;\n get invites(): AppTenantsInvitesResource {\n return (this.#invites ??= new AppTenantsInvitesResource(this._client, this._b));\n }\n get members(): AppTenantsMembersResource {\n return (this.#members ??= new AppTenantsMembersResource(this._client, this._b));\n }\n /**\n * Create a tenant in this app. Auth-admin lane; requires auth.tenant.create on the app URN.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.AppScopedTenantCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid body, empty `displayName`, or `slug` not 1-64 chars of [a-z0-9-].\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.create` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Slug already taken in this app, or no unique slug could be derived. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/tenants\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-tenants\n * @example\n * ```ts\n * const tenant = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenants.create({ display_name: \"Acme Co\" });\n * ```\n */\n create(params: T.AppScopedTenantCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Tenant>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/tenants\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a tenant.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.delete` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App or tenant not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/tenants/{tenant_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-tenants-tenant-id\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenants.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(tenantId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId } }, options);\n }\n /**\n * List tenants in this app, paginated by created_at desc.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.AppScopedTenantListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` value.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/tenants\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenants\n * @example\n * ```ts\n * for await (const tenant of auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenants.list()) {\n * console.log(tenant);\n * }\n * const page = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenants.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.AppScopedTenantListParams, options?: RequestOptions): PagePromise<T.Tenant> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/tenants\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n /**\n * Get a single tenant by id or display id.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App or tenant not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/tenants/{tenant_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenants-tenant-id\n * @example\n * ```ts\n * const tenant = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenants.retrieve(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n retrieve(tenantId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Tenant>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId } }, options);\n }\n /**\n * Update a tenant (display_name, slug, status, metadata).\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.AppScopedTenantUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid body, unknown `status`, or malformed `slug`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.tenant.update` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App or tenant not found.\n * @throws {ConflictError} 409 CONFLICT: Slug already taken in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/tenants/{tenant_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-tenants-tenant-id\n * @example\n * ```ts\n * const tenant = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").tenants.update(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { display_name: \"Acme Inc\" });\n * ```\n */\n update(tenantId: string, params?: T.AppScopedTenantUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Tenant>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/tenants/{tenant_id}\", pathParams: { app_id: this._b.app_id, tenant_id: tenantId }, body: params }, options);\n }\n}\n\n/** `unverifiedAccountExpiry` */\nexport class AppUnverifiedAccountExpiryResource extends APIResource {\n /**\n * Get the unverified-account expiry setting and how many accounts it deleted in the last 30 days.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/unverified-account-expiry\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-unverified-account-expiry\n * @example\n * ```ts\n * const unverifiedAccountExpiryStatus = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").unverifiedAccountExpiry.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.UnverifiedAccountExpiryStatus>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/unverified-account-expiry\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Run the unverified-account expiry for this app now (or as a dry run).\n *\n * Permanently deletes every account that qualifies under the app's `unverified_account_ttl_days`, exactly as the nightly job does: each deletion is audited as `auth.account.expired_unverified` and fires `user.deleted` with `reason: \"unverified_expired\"`. Use `dry_run: true` to preview.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.UnverifiedAccountExpiryRunParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`min_age_minutes` out of range).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.delete` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Expiry is off for this app and the request is not a dry run. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {UnprocessableEntityError} 422 UNPROCESSABLE_ENTITY: `min_age_minutes` was sent for an app that is not a development app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/unverified-account-expiry/run\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-unverified-account-expiry-run\n * @example\n * ```ts\n * const unverifiedAccountExpiryRun = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").unverifiedAccountExpiry.run({ dry_run: false });\n * ```\n */\n run(params?: T.UnverifiedAccountExpiryRunParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.UnverifiedAccountExpiryRun>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/unverified-account-expiry/run\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n}\n\n/** `webauthnConfig` */\nexport class AppWebauthnConfigResource extends APIResource {\n /**\n * Get the per-app passkey (WebAuthn) relying-party settings.\n *\n * Returns defaults with `enabled: false` and a null `rp_id` when passkeys have never been configured for the app.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/webauthn-config\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webauthn-config\n * @example\n * ```ts\n * const webauthnConfig = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").webauthnConfig.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebauthnConfig>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/webauthn-config\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Set the per-app passkey (WebAuthn) relying-party settings.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.WebauthnConfigUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `rp_id` is malformed, or is not a registrable suffix of any origin in `allowed_redirect_origins`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {ConflictError} 409 CONFLICT: `rp_id` differs from the stored one while passkeys are registered. Every existing credential is bound to the old value and would stop verifying; remove them first.\n * @throws {APIError} 412 PRECONDITION_FAILED: The app has no `allowed_redirect_origins` configured, so `rp_id` cannot be validated.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PUT /v1/apps/{app_id}/webauthn-config\n * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-webauthn-config\n * @example\n * ```ts\n * const webauthnConfig = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").webauthnConfig.update({ enabled: true, rp_id: \"example.com\" });\n * ```\n */\n update(params: T.WebauthnConfigUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebauthnConfig>> {\n return this._client.request({ method: \"PUT\", path: \"/v1/apps/{app_id}/webauthn-config\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n}\n\n/** `webhooks.endpoints` */\nexport class AppWebhooksEndpointsResource extends APIResource {\n /**\n * Add a webhook endpoint. Returns its signing secret once.\n *\n * Deliveries are signed with the Standard Webhooks headers `webhook-id`, `webhook-timestamp` and `webhook-signature` (`v1,<base64 HMAC-SHA256 of \"<id>.<timestamp>.<body>\">`); the returned `whsec_…` secret works unchanged with any Standard Webhooks library. Failed deliveries are retried after 1 min, 5 min, 30 min, 2 h, 6 h and 24 h.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.WebhookEndpointCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, WEBHOOK_EVENT_TYPE_UNKNOWN: Validation failure: URL not https with a public host, or an unknown event type (`WEBHOOK_EVENT_TYPE_UNKNOWN`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, WEBHOOK_ENDPOINT_LIMIT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Already 10 endpoints (`WEBHOOK_ENDPOINT_LIMIT`), or Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {UnprocessableEntityError} 422 UNPROCESSABLE_ENTITY: The URL points at a private, loopback or internal address.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/webhooks/endpoints\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-webhooks-endpoints\n * @example\n * ```ts\n * const webhookEndpointWithSecret = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").webhooks.endpoints.create({ url: \"https://api.acme.com/webhooks\" });\n * ```\n */\n create(params: T.WebhookEndpointCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebhookEndpointWithSecret>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/webhooks/endpoints\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a webhook endpoint.\n *\n * Queued retries are dropped. Its past attempts stay in the event log until the events expire.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param endpointId - Id of the endpoint.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `endpoint_id` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, WEBHOOK_ENDPOINT_NOT_FOUND: No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-webhooks-endpoints-endpoint-id\n * @example\n * ```ts\n * await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").webhooks.endpoints.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(endpointId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}\", pathParams: { app_id: this._b.app_id, endpoint_id: endpointId } }, options);\n }\n /**\n * List webhook endpoints, oldest first.\n *\n * At most 10, so this is always one page. Signing secrets are never returned here, only their last 4 characters.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: The scope id in the path is malformed.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/webhooks/endpoints\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-endpoints\n * @example\n * ```ts\n * for await (const endpoint of auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").webhooks.endpoints.list()) {\n * console.log(endpoint);\n * }\n * ```\n */\n list(options?: RequestOptions): PagePromise<T.WebhookEndpoint> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/webhooks/endpoints\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * Get one webhook endpoint (without its secret).\n *\n * The endpoint's URL, subscription, on/off state, failure streak and the last 4 characters of its signing secret. The full secret is only returned when the endpoint is created or its secret is rotated.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param endpointId - Id of the endpoint.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `endpoint_id` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, WEBHOOK_ENDPOINT_NOT_FOUND: No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-endpoints-endpoint-id\n * @example\n * ```ts\n * const webhookEndpoint = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").webhooks.endpoints.retrieve(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n retrieve(endpointId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebhookEndpoint>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}\", pathParams: { app_id: this._b.app_id, endpoint_id: endpointId } }, options);\n }\n /**\n * Rotate the signing secret. The new one is returned once.\n *\n * For `grace_hours` (default 24) the previous secret keeps signing too: `webhook-signature` then lists one `v1,` signature per secret, so receivers can switch over without dropping a delivery.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param endpointId - Id of the endpoint.\n * @param params - `Auth.WebhookEndpointRotateSecretParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `grace_hours` out of range, or `endpoint_id` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, WEBHOOK_ENDPOINT_NOT_FOUND: No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`).\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}/rotate-secret\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-webhooks-endpoints-endpoint-id-rotate-secret\n * @example\n * ```ts\n * const webhookEndpointWithSecret = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").webhooks.endpoints.rotateSecret(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { grace_hours: 24 });\n * ```\n */\n rotateSecret(endpointId: string, params?: T.WebhookEndpointRotateSecretParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebhookEndpointWithSecret>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}/rotate-secret\", pathParams: { app_id: this._b.app_id, endpoint_id: endpointId }, body: params, idempotent: true }, options);\n }\n /**\n * Send a test event to this endpoint now and return the result.\n *\n * Delivers the catalogue example of `event_type`, signed like any delivery, with `\"test\": true` in the body. Works while the endpoint is switched off or not subscribed to that type, is logged in the event log, and is never retried or counted toward an automatic disable. Waits up to 15 s for your receiver.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param endpointId - Id of the endpoint.\n * @param params - `Auth.WebhookEndpointTestParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `event_type`, or `endpoint_id` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, WEBHOOK_ENDPOINT_NOT_FOUND: No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`).\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}/test\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-webhooks-endpoints-endpoint-id-test\n * @example\n * ```ts\n * const webhookDeliveryAttempt = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").webhooks.endpoints.test(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { event_type: \"user.signup\" });\n * ```\n */\n test(endpointId: string, params: T.WebhookEndpointTestParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebhookDeliveryAttempt>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}/test\", pathParams: { app_id: this._b.app_id, endpoint_id: endpointId }, body: params, idempotent: true }, options);\n }\n /**\n * Change a webhook endpoint: URL, description, events, on/off.\n *\n * Only the fields sent change. `enabled: true` (or a new URL) also clears an automatic disable. Switching off cancels queued retries. The secret is unchanged; rotate it with `POST …/rotate-secret`.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param endpointId - Id of the endpoint.\n * @param params - `Auth.WebhookEndpointUpdateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure, or `endpoint_id` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, WEBHOOK_ENDPOINT_NOT_FOUND: No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`).\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {UnprocessableEntityError} 422 UNPROCESSABLE_ENTITY: The new URL points at a private, loopback or internal address.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-webhooks-endpoints-endpoint-id\n * @example\n * ```ts\n * const webhookEndpoint = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").webhooks.endpoints.update(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { description: \"Production receiver\" });\n * ```\n */\n update(endpointId: string, params?: T.WebhookEndpointUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebhookEndpoint>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}\", pathParams: { app_id: this._b.app_id, endpoint_id: endpointId }, body: params, idempotent: true }, options);\n }\n}\n\n/** `webhooks.eventTypes` */\nexport class AppWebhooksEventTypesResource extends APIResource {\n /**\n * List the events an endpoint can subscribe to.\n *\n * Each type with a plain description, its group and an example `data` object (what \"Send test\" delivers).\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/webhooks/event-types\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-event-types\n * @example\n * ```ts\n * const listWebhookEventTypes = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").webhooks.eventTypes.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.ListWebhookEventTypes>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/webhooks/event-types\", pathParams: { app_id: this._b.app_id } }, options);\n }\n}\n\n/** `webhooks.events` */\nexport class AppWebhooksEventsResource extends APIResource {\n /**\n * List webhook events, newest first (kept for 30 days).\n *\n * Every event logged while at least one endpoint existed, with the latest state per endpoint and when the next retry is due.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.WebhookEventListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid filter value or cursor.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/webhooks/events\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-events\n * @example\n * ```ts\n * for await (const event of auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").webhooks.events.list()) {\n * console.log(event);\n * }\n * const page = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").webhooks.events.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.WebhookEventListParams, options?: RequestOptions): PagePromise<T.WebhookEvent> {\n return this._client.list({ method: \"GET\", path: \"/v1/apps/{app_id}/webhooks/events\", pathParams: { app_id: this._b.app_id }, query: params }, options);\n }\n /**\n * Send a logged event again, to its endpoints or to one endpoint.\n *\n * Same body and `webhook-id`, freshly signed, to every switched-on endpoint that receives this event type now, or only to `endpoint_id`. Waits for the receivers (up to 15 s each) and returns the attempts. A success cancels a retry still queued for that endpoint.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param eventId - The event id, `evt_<uuid>`.\n * @param params - `Auth.WebhookEventReplayParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `event_id` is not `evt_<uuid>`, or `endpoint_id` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, WEBHOOK_EVENT_NOT_FOUND, WEBHOOK_ENDPOINT_NOT_FOUND: No such event here (`WEBHOOK_EVENT_NOT_FOUND`); events are kept for 30 days. Or No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`).\n * @throws {ConflictError} 409 CONFLICT, WEBHOOK_ENDPOINT_NOT_SUBSCRIBED, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: `endpoint_id` is switched off or does not receive this event type (`WEBHOOK_ENDPOINT_NOT_SUBSCRIBED`), or Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/webhooks/events/{event_id}/replay\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-webhooks-events-event-id-replay\n * @example\n * ```ts\n * const replayWebhookEvent = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").webhooks.events.replay(\"evt_3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n replay(eventId: string, params?: T.WebhookEventReplayParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ReplayWebhookEvent>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/webhooks/events/{event_id}/replay\", pathParams: { app_id: this._b.app_id, event_id: eventId }, query: params, idempotent: true }, options);\n }\n /**\n * Get one webhook event with every delivery attempt.\n *\n * The event as it was sent (`type`, `data`) and every delivery attempt to every endpoint, with its trigger, HTTP status, error and the start of the response body. Use it to debug a receiver, then `replay` to send it again.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param eventId - The event id, `evt_<uuid>`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `event_id` is not `evt_<uuid>`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.\n * @throws {NotFoundError} 404 NOT_FOUND, WEBHOOK_EVENT_NOT_FOUND: No such event here (`WEBHOOK_EVENT_NOT_FOUND`); events are kept for 30 days.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /v1/apps/{app_id}/webhooks/events/{event_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-events-event-id\n * @example\n * ```ts\n * const webhookEventDetail = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").webhooks.events.retrieve(\"evt_3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n retrieve(eventId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebhookEventDetail>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}/webhooks/events/{event_id}\", pathParams: { app_id: this._b.app_id, event_id: eventId } }, options);\n }\n}\n\n/** `webhooks` */\nexport class AppWebhooksResource extends APIResource {\n #endpoints?: AppWebhooksEndpointsResource;\n #eventTypes?: AppWebhooksEventTypesResource;\n #events?: AppWebhooksEventsResource;\n get endpoints(): AppWebhooksEndpointsResource {\n return (this.#endpoints ??= new AppWebhooksEndpointsResource(this._client, this._b));\n }\n get eventTypes(): AppWebhooksEventTypesResource {\n return (this.#eventTypes ??= new AppWebhooksEventTypesResource(this._client, this._b));\n }\n get events(): AppWebhooksEventsResource {\n return (this.#events ??= new AppWebhooksEventsResource(this._client, this._b));\n }\n}\n\n/** `auth.app(…)`: Admin calls for one app (end users, roles, keys, config). Needs a workspace API key or a platform session. */\nexport class AuthApp extends APIResource {\n #apiKeys?: AppApiKeysResource;\n #auditLogs?: AppAuditLogsResource;\n #auditSink?: AppAuditSinkResource;\n #authConfig?: AppAuthConfigResource;\n #credentials?: AppCredentialsResource;\n #customDomains?: AppCustomDomainsResource;\n #endUserInsights?: AppEndUserInsightsResource;\n #endUsers?: AppEndUsersResource;\n #invites?: AppInvitesResource;\n #members?: AppMembersResource;\n #notificationSettings?: AppNotificationSettingsResource;\n #notifications?: AppNotificationsResource;\n #permissions?: AppPermissionsResource;\n #roles?: AppRolesResource;\n #setupStatus?: AppSetupStatusResource;\n #signInTests?: AppSignInTestsResource;\n #tenantApiKeys?: AppTenantApiKeysResource;\n #tenants?: AppTenantsResource;\n #unverifiedAccountExpiry?: AppUnverifiedAccountExpiryResource;\n #webauthnConfig?: AppWebauthnConfigResource;\n #webhooks?: AppWebhooksResource;\n /** The `{app_id}` this scope is bound to. */\n get appId(): string {\n return this._b.app_id as string;\n }\n get apiKeys(): AppApiKeysResource {\n return (this.#apiKeys ??= new AppApiKeysResource(this._client, this._b));\n }\n get auditLogs(): AppAuditLogsResource {\n return (this.#auditLogs ??= new AppAuditLogsResource(this._client, this._b));\n }\n get auditSink(): AppAuditSinkResource {\n return (this.#auditSink ??= new AppAuditSinkResource(this._client, this._b));\n }\n get authConfig(): AppAuthConfigResource {\n return (this.#authConfig ??= new AppAuthConfigResource(this._client, this._b));\n }\n get credentials(): AppCredentialsResource {\n return (this.#credentials ??= new AppCredentialsResource(this._client, this._b));\n }\n get customDomains(): AppCustomDomainsResource {\n return (this.#customDomains ??= new AppCustomDomainsResource(this._client, this._b));\n }\n get endUserInsights(): AppEndUserInsightsResource {\n return (this.#endUserInsights ??= new AppEndUserInsightsResource(this._client, this._b));\n }\n get endUsers(): AppEndUsersResource {\n return (this.#endUsers ??= new AppEndUsersResource(this._client, this._b));\n }\n /** @deprecated 0.x namespace: every method in it is a deprecated alias (see its methods). Removed in 2.0. */\n get invites(): AppInvitesResource {\n return (this.#invites ??= new AppInvitesResource(this._client, this._b));\n }\n get members(): AppMembersResource {\n return (this.#members ??= new AppMembersResource(this._client, this._b));\n }\n get notificationSettings(): AppNotificationSettingsResource {\n return (this.#notificationSettings ??= new AppNotificationSettingsResource(this._client, this._b));\n }\n get notifications(): AppNotificationsResource {\n return (this.#notifications ??= new AppNotificationsResource(this._client, this._b));\n }\n get permissions(): AppPermissionsResource {\n return (this.#permissions ??= new AppPermissionsResource(this._client, this._b));\n }\n get roles(): AppRolesResource {\n return (this.#roles ??= new AppRolesResource(this._client, this._b));\n }\n get setupStatus(): AppSetupStatusResource {\n return (this.#setupStatus ??= new AppSetupStatusResource(this._client, this._b));\n }\n get signInTests(): AppSignInTestsResource {\n return (this.#signInTests ??= new AppSignInTestsResource(this._client, this._b));\n }\n get tenantApiKeys(): AppTenantApiKeysResource {\n return (this.#tenantApiKeys ??= new AppTenantApiKeysResource(this._client, this._b));\n }\n get tenants(): AppTenantsResource {\n return (this.#tenants ??= new AppTenantsResource(this._client, this._b));\n }\n get unverifiedAccountExpiry(): AppUnverifiedAccountExpiryResource {\n return (this.#unverifiedAccountExpiry ??= new AppUnverifiedAccountExpiryResource(this._client, this._b));\n }\n get webauthnConfig(): AppWebauthnConfigResource {\n return (this.#webauthnConfig ??= new AppWebauthnConfigResource(this._client, this._b));\n }\n get webhooks(): AppWebhooksResource {\n return (this.#webhooks ??= new AppWebhooksResource(this._client, this._b));\n }\n /**\n * Create a second app in the same workspace whose configuration matches this one — the \"staging app\" flow. Copies the auth config, roles, permissions, notification settings and the webhook target (with a NEW signing secret), and optionally tenants. Never copies credentials, end-users, sessions, signing keys, federated provider configs or audit history.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.CloneParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure, or the slug matches the source.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.create` on the source app.\n * @throws {NotFoundError} 404 NOT_FOUND: Source app not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Slug already taken (including as a live rename alias). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /v1/apps/{app_id}/clone\n * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-clone\n * @example\n * ```ts\n * const cloneApp = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").clone({ environment: \"staging\", slug: \"acme-app-staging\" });\n * ```\n */\n clone(params: T.CloneParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CloneApp>> {\n return this._client.request({ method: \"POST\", path: \"/v1/apps/{app_id}/clone\", pathParams: { app_id: this._b.app_id }, body: params, idempotent: true }, options);\n }\n /**\n * Update app status (active, suspended, archived)\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.UpdateStatusParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid status transition (e.g. archived → active).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found or caller is not a member.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /v1/apps/{app_id}/status\n * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-status\n * @example\n * ```ts\n * const app = await auth.admin.app(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\").updateStatus({ status: \"suspended\" });\n * ```\n */\n updateStatus(params: T.UpdateStatusParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.App>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}/status\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n /**\n * 0.x name for `auth.apps.delete()` (DELETE /v1/apps/{app_id}).\n *\n * @deprecated Use `auth.apps.delete()`. Kept for 0.x callers; removed in 2.0.\n */\n delete(options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/v1/apps/{app_id}\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * 0.x name for `auth.apps.retrieve()` (GET /v1/apps/{app_id}).\n *\n * @deprecated Use `auth.apps.retrieve()`. Kept for 0.x callers; removed in 2.0.\n */\n get(options?: RequestOptions): APIPromise<T.WithLastResponse<T.App>> {\n return this._client.request({ method: \"GET\", path: \"/v1/apps/{app_id}\", pathParams: { app_id: this._b.app_id } }, options);\n }\n /**\n * 0.x name for `auth.apps.update()` (PATCH /v1/apps/{app_id}).\n *\n * @deprecated Use `auth.apps.update()`. Kept for 0.x callers; removed in 2.0.\n */\n update(params?: T.AppUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.App>> {\n return this._client.request({ method: \"PATCH\", path: \"/v1/apps/{app_id}\", pathParams: { app_id: this._b.app_id }, body: params }, options);\n }\n}\n\n/** `auth` */\nexport class ConsumerAuthResource extends APIResource {\n /**\n * 0.x name for `auth.consumer(…).acceptInvite()` (POST /{app_slug}/v1/auth/accept-invite).\n *\n * @deprecated Use `auth.consumer(…).acceptInvite()`. Kept for 0.x callers; removed in 2.0.\n */\n acceptInvite(params: T.AcceptInviteParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AcceptInviteResponse>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/accept-invite\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).logout()` (POST /{app_slug}/v1/auth/logout).\n *\n * @deprecated Use `auth.consumer(…).logout()`. Kept for 0.x callers; removed in 2.0.\n */\n logout(params: T.LogoutParams, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/logout\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).refresh()` (POST /{app_slug}/v1/auth/refresh).\n *\n * @deprecated Use `auth.consumer(…).refresh()`. Kept for 0.x callers; removed in 2.0.\n */\n refresh(params: T.RefreshParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/refresh\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).requestPasswordReset()` (POST /{app_slug}/v1/auth/request-password-reset).\n *\n * @deprecated Use `auth.consumer(…).requestPasswordReset()`. Kept for 0.x callers; removed in 2.0.\n */\n requestReset(params?: T.RequestPasswordResetParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerCodeIssue>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/request-password-reset\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).requestVerification()` (POST /{app_slug}/v1/auth/request-verification).\n *\n * @deprecated Use `auth.consumer(…).requestVerification()`. Kept for 0.x callers; removed in 2.0.\n */\n requestVerification(params?: T.RequestVerificationParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerCodeIssue>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/request-verification\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).resetPassword()` (POST /{app_slug}/v1/auth/reset-password).\n *\n * @deprecated Use `auth.consumer(…).resetPassword()`. Kept for 0.x callers; removed in 2.0.\n */\n resetPassword(params: T.ResetPasswordParams, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/reset-password\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).sendPasswordResetEmail()` (POST /{app_slug}/v1/auth/send-password-reset-email).\n *\n * @deprecated Use `auth.consumer(…).sendPasswordResetEmail()`. Kept for 0.x callers; removed in 2.0.\n */\n sendPasswordResetEmail(params: T.SendPasswordResetEmailParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerCodeDispatch>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/send-password-reset-email\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).sendVerificationEmail()` (POST /{app_slug}/v1/auth/send-verification-email).\n *\n * @deprecated Use `auth.consumer(…).sendVerificationEmail()`. Kept for 0.x callers; removed in 2.0.\n */\n sendVerificationEmail(params: T.SendVerificationEmailParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerCodeDispatch>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/send-verification-email\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).signin()` (POST /{app_slug}/v1/auth/signin).\n *\n * @deprecated Use `auth.consumer(…).signin()`. Kept for 0.x callers; removed in 2.0.\n */\n signin(params: T.SigninParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.SigninResponse>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/signin\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).signinWithProvider()` (POST /{app_slug}/v1/auth/oauth/{provider}).\n *\n * @deprecated Use `auth.consumer(…).signinWithProvider()`. Kept for 0.x callers; removed in 2.0.\n */\n signinWithProvider(args: { provider: string } & T.SigninWithProviderParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.SigninWithProviderResponse>> {\n const { provider, ...params } = args;\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/oauth/{provider}\", pathParams: { app_slug: this._b.app_slug, provider }, body: params, public: true }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).signup()` (POST /{app_slug}/v1/auth/signup).\n *\n * @deprecated Use `auth.consumer(…).signup()`. Kept for 0.x callers; removed in 2.0.\n */\n signup(params: T.SignupParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.SignupResponse>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/signup\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).verifyEmail()` (POST /{app_slug}/v1/auth/verify).\n *\n * @deprecated Use `auth.consumer(…).verifyEmail()`. Kept for 0.x callers; removed in 2.0.\n */\n verify(params: T.VerifyEmailParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerVerify>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/verify\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n}\n\n/** `me.activity` */\nexport class ConsumerMeActivityResource extends APIResource {\n /**\n * Recent account activity\n *\n * Login events, password changes, and other security-relevant records, scoped to this EndUser.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/me/activity\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-activity\n * @example\n * ```ts\n * for await (const activity of auth.consumer(\"my-app\").me.activity.list()) {\n * console.log(activity);\n * }\n * ```\n */\n list(options?: RequestOptions): PagePromise<T.MeActivityEntry> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/me/activity\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n}\n\n/** `me.contacts` */\nexport class ConsumerMeContactsResource extends APIResource {\n /**\n * Add a new contact (unverified, non-primary)\n *\n * Adds an email or phone contact to the EndUser. The contact starts unverified and non-primary. Verification is a separate flow — call /auth/request-verification with the contact value and the customer's PAK to mint a code, then submit via /auth/verify.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param params - `Auth.MeContactCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: unsupported `type`, invalid email, or empty/over-long `value`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Contact value already in use for this app. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): `/me/contacts` is in the strict `auth` bucket (10 requests per minute per IP).\n * @see POST /{app_slug}/v1/me/contacts\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-contacts\n * @example\n * ```ts\n * const meContact = await auth.consumer(\"my-app\").me.contacts.create({ type: \"email\", value: \"ada@example.com\" });\n * ```\n */\n create(params: T.MeContactCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.MeContact>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/contacts\", pathParams: { app_slug: this._b.app_slug }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a contact\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param id - Id of the contact.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {NotFoundError} 404 NOT_FOUND: Contact not found on this account.\n * @throws {ConflictError} 409 CONFLICT: Cannot delete the primary verified email; promote another email first.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): `/me/contacts` is in the strict `auth` bucket (10 requests per minute per IP).\n * @see DELETE /{app_slug}/v1/me/contacts/{id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me-contacts-id\n * @example\n * ```ts\n * await auth.consumer(\"my-app\").me.contacts.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(id: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/me/contacts/{id}\", pathParams: { app_slug: this._b.app_slug, id } }, options);\n }\n /**\n * List the EndUser's contacts\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): the general bucket, 60 requests per minute per IP. Adding, verifying or removing a contact is in the strict `auth` bucket (10 per minute).\n * @see GET /{app_slug}/v1/me/contacts\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-contacts\n * @example\n * ```ts\n * const meContacts = await auth.consumer(\"my-app\").me.contacts.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.MeContacts>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/me/contacts\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * Promote a verified contact to primary\n *\n * Demotes the previous primary of the same type. Refused (409) when the target contact is unverified — promoting an unverified contact would let an attacker who registered the contact bypass verification by routing reset codes through it.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param id - Id of the contact.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {NotFoundError} 404 NOT_FOUND: Contact not found on this account.\n * @throws {ConflictError} 409 CONFLICT: Contact is unverified and cannot be promoted to primary.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): `/me/contacts` is in the strict `auth` bucket (10 requests per minute per IP).\n * @see POST /{app_slug}/v1/me/contacts/{id}/promote\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-contacts-id-promote\n * @example\n * ```ts\n * await auth.consumer(\"my-app\").me.contacts.promote(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n promote(id: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/contacts/{id}/promote\", pathParams: { app_slug: this._b.app_slug, id } }, options);\n }\n}\n\n/** `me.mfa.factors` */\nexport class ConsumerMeMfaFactorsResource extends APIResource {\n /**\n * Begin enrollment of a new MFA factor\n *\n * Creates a pending factor and returns the type-specific enrollment payload. TOTP: the otpauth URI, QR data URL, and shared secret; confirm with two consecutive codes. Email: a 6-digit code is sent to the bound verified email contact (primary by default, `contact_id` to override); confirm with that single code. The factor stays disabled until `/factors/:id/verify` succeeds.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param params - `Auth.MeMfaFactorCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: unsupported `type`, over-long `label`, or `contact_id` is not a UUID.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {NotFoundError} 404 NOT_FOUND: Email factors: `contact_id` names no email contact on this account.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {APIError} 412 PRECONDITION_FAILED: Email factors: the contact (or primary email) is unverified, or the app has not completed Mail setup for MFA codes. Passkeys: not enabled or not fully configured for this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/me/mfa/factors\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-factors\n * @example\n * ```ts\n * const startEnrollment = await auth.consumer(\"my-app\").me.mfa.factors.create({ type: \"totp\" });\n * ```\n */\n create(params: T.MeMfaFactorCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.StartEnrollment>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/mfa/factors\", pathParams: { app_slug: this._b.app_slug }, body: params, idempotent: true }, options);\n }\n /**\n * Disable an MFA factor\n *\n * Soft-disable. The row is preserved (with `disabled_at` set) for audit. Has no effect on existing sessions — their `amr` claim still reflects whatever satisfied sign-in at the time. Disabling the only enabled factor removes the MFA requirement on future sign-ins.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param id - Id of the factor.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {NotFoundError} 404 NOT_FOUND: Factor not found on this account.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/me/mfa/factors/{id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me-mfa-factors-id\n * @example\n * ```ts\n * await auth.consumer(\"my-app\").me.mfa.factors.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(id: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/me/mfa/factors/{id}\", pathParams: { app_slug: this._b.app_slug, id } }, options);\n }\n /**\n * List the authenticated EndUser's MFA factors\n *\n * Includes factors in any state (pending enrollment + enabled). Disabled factors are not listed.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/me/mfa/factors\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-mfa-factors\n * @example\n * ```ts\n * const factorList = await auth.consumer(\"my-app\").me.mfa.factors.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.FactorList>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/me/mfa/factors\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * Confirm enrollment of a pending factor\n *\n * TOTP: submit two `codes` from consecutive 30-second windows. Email: submit the emailed 6-digit `code`. On success the factor flips to enabled, recovery codes are minted (returned once), and prior recovery codes for the account are invalidated. Subsequent calls with the same `:id` fail with 400.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param id - Id of the factor.\n * @param params - `Auth.MeMfaFactorVerifyParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid or repeated codes.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/me/mfa/factors/{id}/verify\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-factors-id-verify\n * @example\n * ```ts\n * const confirmEnrollment = await auth.consumer(\"my-app\").me.mfa.factors.verify(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { code: \"123456\" });\n * ```\n */\n verify(id: string, params?: T.MeMfaFactorVerifyParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConfirmEnrollment>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/mfa/factors/{id}/verify\", pathParams: { app_slug: this._b.app_slug, id }, body: params }, options);\n }\n}\n\n/** `me.mfa.recoveryCodes` */\nexport class ConsumerMeMfaRecoveryCodesResource extends APIResource {\n /**\n * Regenerate the recovery-code set\n *\n * Mints a fresh set of single-use recovery codes and invalidates every prior code for the account. The new codes are returned once — store them now.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/me/mfa/recovery-codes/regenerate\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-recovery-codes-regenerate\n * @example\n * ```ts\n * const recoveryCodes = await auth.consumer(\"my-app\").me.mfa.recoveryCodes.regenerate();\n * ```\n */\n regenerate(options?: RequestOptions): APIPromise<T.WithLastResponse<T.RecoveryCodes>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/mfa/recovery-codes/regenerate\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n}\n\n/** `me.mfa.stepUp.webauthn` */\nexport class ConsumerMeMfaStepUpWebauthnResource extends APIResource {\n /**\n * Get passkey assertion options for step-up\n *\n * Mints a single-use WebAuthn challenge for the enabled passkeys on this account and returns the `publicKey` member for `navigator.credentials.get()`. Submit the result to `/step-up` as `credential`. Refused while step-up is locked on this session — a locked session must not be able to keep minting challenges.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: No passkey is enrolled on this account.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {APIError} 412 PRECONDITION_FAILED: Passkeys are not enabled or not fully configured for this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Step-up is locked on this session.\n * @see POST /{app_slug}/v1/me/mfa/step-up/webauthn/options\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-step-up-webauthn-options\n * @example\n * ```ts\n * const webauthnOptions = await auth.consumer(\"my-app\").me.mfa.stepUp.webauthn.options();\n * ```\n */\n options(options?: RequestOptions): APIPromise<T.WithLastResponse<T.WebauthnOptions>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/mfa/step-up/webauthn/options\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n}\n\n/** `me.mfa.stepUp` */\nexport class ConsumerMeMfaStepUpResource extends APIResource {\n #webauthn?: ConsumerMeMfaStepUpWebauthnResource;\n get webauthn(): ConsumerMeMfaStepUpWebauthnResource {\n return (this.#webauthn ??= new ConsumerMeMfaStepUpWebauthnResource(this._client, this._b));\n }\n /**\n * Email a step-up code\n *\n * Mints a single-use 6-digit code against one of the account's enabled email factors and delivers it to the bound address. Follow with `/step-up` submitting the code. Codes expire after 5 minutes; sends are throttled per contact (30s between sends, shared with the sign-in path). Refused while step-up is locked on this session.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param params - `Auth.MeMfaStepUpSendCodeParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Account has no enabled email factor (or the named factor is not an email factor).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {APIError} 410 GONE: The bound email contact no longer exists or is no longer verified.\n * @throws {APIError} 412 PRECONDITION_FAILED: The app has not completed Mail notification setup for MFA codes.\n * @throws {RateLimitError} 429 RATE_LIMITED: Send throttled, or step-up is locked on this session.\n * @see POST /{app_slug}/v1/me/mfa/step-up/send-code\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-step-up-send-code\n * @example\n * ```ts\n * const stepUpSendCode = await auth.consumer(\"my-app\").me.mfa.stepUp.sendCode({ factor_id: \"9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b\" });\n * ```\n */\n sendCode(params?: T.MeMfaStepUpSendCodeParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.StepUpSendCode>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/mfa/step-up/send-code\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Bump this session's MFA recency\n *\n * Verify a fresh code (TOTP, emailed via `/step-up/send-code`, or recovery) against any enabled factor on the account, and update the session's `auth_methods` + `mfa_at`. Call `/auth/refresh` after this to mint a token whose claims reflect the new state. Customers reading `mfa_at` from access tokens to gate sensitive actions should require a `/step-up` + refresh cycle when the timestamp is older than their policy window. 5 consecutive wrong codes lock step-up on this session for 15 minutes.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param params - `Auth.MeMfaStepUpVerifyParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Code did not match any enabled factor or recovery code.\n * @throws {RateLimitError} 429 RATE_LIMITED: Step-up locked on this session after too many failures.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/me/mfa/step-up\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-step-up\n * @example\n * ```ts\n * const stepUp = await auth.consumer(\"my-app\").me.mfa.stepUp.verify({ code: \"123456\" });\n * ```\n */\n verify(params?: T.MeMfaStepUpVerifyParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.StepUp>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/mfa/step-up\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n}\n\n/** `me.mfa` */\nexport class ConsumerMeMfaResource extends APIResource {\n #factors?: ConsumerMeMfaFactorsResource;\n #recoveryCodes?: ConsumerMeMfaRecoveryCodesResource;\n #stepUp?: ConsumerMeMfaStepUpResource;\n get factors(): ConsumerMeMfaFactorsResource {\n return (this.#factors ??= new ConsumerMeMfaFactorsResource(this._client, this._b));\n }\n get recoveryCodes(): ConsumerMeMfaRecoveryCodesResource {\n return (this.#recoveryCodes ??= new ConsumerMeMfaRecoveryCodesResource(this._client, this._b));\n }\n get stepUp(): ConsumerMeMfaStepUpResource {\n return (this.#stepUp ??= new ConsumerMeMfaStepUpResource(this._client, this._b));\n }\n}\n\n/** `me.sessions` */\nexport class ConsumerMeSessionsResource extends APIResource {\n /**\n * Revoke a session\n *\n * Sign the EndUser out of one device. The session's refresh token is destroyed; its access token expires on its TTL. Requires the `session.revoke` permission when the app's `enforce_app_permissions` flag is on; otherwise (the default) any valid token can call this. Self-revoke (revoking your own session as a member with no perms) is something to enforce separately if needed; this guard does not exempt the principal from the role check.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param id - Id of the session.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: The app enforces permissions and the caller's role (or M2M scopes) lacks `session.revoke`.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/me/sessions/{id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me-sessions-id\n * @example\n * ```ts\n * await auth.consumer(\"my-app\").me.sessions.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(id: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/me/sessions/{id}\", pathParams: { app_slug: this._b.app_slug, id } }, options);\n }\n /**\n * List all active sessions for the EndUser\n *\n * Each session includes a `current` flag identifying the one belonging to the bearer token used for this request.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/me/sessions\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-sessions\n * @example\n * ```ts\n * for await (const session of auth.consumer(\"my-app\").me.sessions.list()) {\n * console.log(session);\n * }\n * ```\n */\n list(options?: RequestOptions): PagePromise<T.MeSession> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/me/sessions\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n}\n\n/** `me.tenantInvites` */\nexport class ConsumerMeTenantInvitesResource extends APIResource {\n /**\n * Accept a tenant invite as the signed-in EndUser\n *\n * Adds the caller to the invited tenant with the role the invite names, and consumes the invite. Requires the invited address to be one of the caller's own VERIFIED email contacts in this app — holding the code is not sufficient, because whoever minted the invite also holds it, and an unverified contact is not proof of owning the address. A refused accept leaves the invite redeemable.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param params - `Auth.MeTenantInviteAcceptParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Two cases, told apart by `error.code`: `FORBIDDEN` — the invite was issued to an address that is not a contact of this account; `invite_email_unverified` — the invited address is a contact of this account but is not verified yet. Verify the address, then retry with the same code.\n * @throws {NotFoundError} 404 NOT_FOUND: No such invite in this app.\n * @throws {ConflictError} 409 CONFLICT: Already a member of that tenant.\n * @throws {APIError} 410 GONE: Invite revoked, expired, or fully used.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/me/tenant-invites/accept\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-tenant-invites-accept\n * @example\n * ```ts\n * const acceptedTenantInvite = await auth.consumer(\"my-app\").me.tenantInvites.accept({ code: \"tinv_9dK2mQ7pR4vXbN1sT6yZ0hLcJeW3fAgU\" });\n * ```\n */\n accept(params: T.MeTenantInviteAcceptParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AcceptedTenantInvite>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/tenant-invites/accept\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n}\n\n/** `me.tenants` */\nexport class ConsumerMeTenantsResource extends APIResource {\n /**\n * List the EndUser's tenant memberships in this app\n *\n * Returns each tenant the caller is a member of, including the tenant slug + display name and the member's role. Powers a tenant-switcher UI on the customer's product.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing / invalid bearer, or the session behind the token is revoked, expired or no longer exists.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see GET /{app_slug}/v1/auth/me/tenants\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-auth-me-tenants\n * @example\n * ```ts\n * const myTenants = await auth.consumer(\"my-app\").me.tenants.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.MyTenants>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/auth/me/tenants\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n}\n\n/** `me` */\nexport class ConsumerMeResource extends APIResource {\n #activity?: ConsumerMeActivityResource;\n #contacts?: ConsumerMeContactsResource;\n #mfa?: ConsumerMeMfaResource;\n #sessions?: ConsumerMeSessionsResource;\n #tenantInvites?: ConsumerMeTenantInvitesResource;\n #tenants?: ConsumerMeTenantsResource;\n get activity(): ConsumerMeActivityResource {\n return (this.#activity ??= new ConsumerMeActivityResource(this._client, this._b));\n }\n get contacts(): ConsumerMeContactsResource {\n return (this.#contacts ??= new ConsumerMeContactsResource(this._client, this._b));\n }\n get mfa(): ConsumerMeMfaResource {\n return (this.#mfa ??= new ConsumerMeMfaResource(this._client, this._b));\n }\n get sessions(): ConsumerMeSessionsResource {\n return (this.#sessions ??= new ConsumerMeSessionsResource(this._client, this._b));\n }\n get tenantInvites(): ConsumerMeTenantInvitesResource {\n return (this.#tenantInvites ??= new ConsumerMeTenantInvitesResource(this._client, this._b));\n }\n get tenants(): ConsumerMeTenantsResource {\n return (this.#tenants ??= new ConsumerMeTenantsResource(this._client, this._b));\n }\n /**\n * Change the password of the signed-in EndUser\n *\n * Verifies `current_password`, sets the new hash, and revokes every OTHER active session for the account (the calling session is preserved). 401 if the current password is wrong or the account has no password credential — admin-provisioned accounts without an initial password should use the reset flow instead. The new password is held to exactly the same policy as signup: the app's length + character-class rules, the common-password deny-list, and the breach corpus.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param params - `Auth.MeChangePasswordParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, PASSWORD_TOO_COMMON, PASSWORD_BREACHED: The new password fails the app-configured policy, is on the common-password deny-list (`PASSWORD_TOO_COMMON`), appears in a public breach corpus (`PASSWORD_BREACHED`), or is identical to the current one.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Current password incorrect or no credential.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/me/change-password\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-change-password\n * @example\n * ```ts\n * await auth.consumer(\"my-app\").me.changePassword({\n * current_password: \"correct horse battery staple\",\n * new_password: \"a new long passphrase 42\",\n * });\n * ```\n */\n changePassword(params: T.MeChangePasswordParams, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/change-password\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Permanently delete the signed-in EndUser account\n *\n * Removes the EndUser, all sessions, and all related records inside this app. Cannot be undone. The app audit log keeps one `auth.account.deleted` row (`via: self`; username and email domain only, never the address), and `user.deleted` fires with `via: \"self\"`.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/me\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me\n * @example\n * ```ts\n * await auth.consumer(\"my-app\").me.deleteAccount();\n * ```\n */\n deleteAccount(options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/me\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * Remove the EndUser avatar\n *\n * Clears both the uploaded avatar and any provider-captured picture, and deletes the stored object. A later Google/GitHub sign-in re-populates the provider picture — that is \"sync from provider\" behavior, by design.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {NotFoundError} 404 NOT_FOUND, ACCOUNT_NOT_FOUND: Account not found in this app (`ACCOUNT_NOT_FOUND`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/me/avatar\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me-avatar\n * @example\n * ```ts\n * await auth.consumer(\"my-app\").me.deleteAvatar();\n * ```\n */\n deleteAvatar(options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/me/avatar\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * Resolve the signed-in EndUser's effective permissions\n *\n * Returns the union of the app-level role permissions and the tenant-level role permissions (when the token carries an `org_id`). Resolved per-request through a 60-second LRU — role-permission edits propagate within ~1 minute. Use this instead of decoding a `permissions[]` claim from the JWT, which is no longer included. M2M tokens cannot call this — use `POST /:appSlug/v1/oauth/introspect` to inspect M2M scopes.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/me/permissions\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-permissions\n * @example\n * ```ts\n * const mePermissions = await auth.consumer(\"my-app\").me.permissions();\n * ```\n */\n permissions(options?: RequestOptions): APIPromise<T.WithLastResponse<T.MePermissions>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/me/permissions\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * Get the signed-in EndUser profile\n *\n * Returns the EndUser identity, app membership, and role name. The flat `permissions[]` array is intentionally NOT included — permissions resolve from the role on demand. Call `GET /me/permissions` for the flat list when the client needs it for UI gating.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Account not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/me\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me\n * @example\n * ```ts\n * const meProfile = await auth.consumer(\"my-app\").me.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.MeProfile>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/me\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * Update the signed-in EndUser profile\n *\n * Editable fields: `display_name` and `username`. The username is unique per app (case-insensitive, same rule as signup); sending the current username is a no-op. Usernames cannot be cleared.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param params - `Auth.MeUpdateParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {ConflictError} 409 CONFLICT, USERNAME_TAKEN: Requested username is already held by another account in this app (`USERNAME_TAKEN`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /{app_slug}/v1/me\n * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-me\n * @example\n * ```ts\n * const meUpdatedAccount = await auth.consumer(\"my-app\").me.update({ display_name: \"Ada Lovelace\" });\n * ```\n */\n update(params?: T.MeUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.MeUpdatedAccount>> {\n return this._client.request({ method: \"PATCH\", path: \"/{app_slug}/v1/me\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Upload (or replace) the EndUser avatar\n *\n * PNG/JPEG/WEBP only — SVG is rejected (stored-XSS vector). ≤2 MB. Magic bytes are sniffed; a mislabeled file is rejected. The image is re-encoded server-side (orientation baked in, all metadata incl. EXIF/GPS stripped, bounded to 512×512, webp). An uploaded avatar takes precedence over a provider-captured picture.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param params - `Auth.MeUploadAvatarParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {APIError} 413 PAYLOAD_TOO_LARGE, AVATAR_TOO_LARGE: File exceeds 2 MB (`AVATAR_TOO_LARGE`).\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE, AVATAR_INVALID_TYPE, AVATAR_MAGIC_MISMATCH: Wrong mimetype, undecodable image, or content does not match the declared type (`AVATAR_INVALID_TYPE` / `AVATAR_MAGIC_MISMATCH`).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/me/avatar\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-avatar\n * @example\n * ```ts\n * const avatarUrl = await auth.consumer(\"my-app\").me.uploadAvatar({ file: new File([\"…\"], \"image.png\", { type: \"image/png\" }) });\n * ```\n */\n uploadAvatar(params: T.MeUploadAvatarParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AvatarUrl>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/me/avatar\", pathParams: { app_slug: this._b.app_slug }, body: formData(params) }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).me.activity.list()` (GET /{app_slug}/v1/me/activity).\n *\n * @deprecated Use `auth.consumer(…).me.activity.list()`. Kept for 0.x callers; removed in 2.0.\n */\n getActivity(options?: RequestOptions): PagePromise<T.MeActivityEntry> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/me/activity\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).me.retrieve()` (GET /{app_slug}/v1/me).\n *\n * @deprecated Use `auth.consumer(…).me.retrieve()`. Kept for 0.x callers; removed in 2.0.\n */\n getProfile(options?: RequestOptions): APIPromise<T.WithLastResponse<T.MeProfile>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/me\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).me.sessions.list()` (GET /{app_slug}/v1/me/sessions).\n *\n * @deprecated Use `auth.consumer(…).me.sessions.list()`. Kept for 0.x callers; removed in 2.0.\n */\n listSessions(options?: RequestOptions): PagePromise<T.MeSession> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/me/sessions\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).me.sessions.delete()` (DELETE /{app_slug}/v1/me/sessions/{id}).\n *\n * @deprecated Use `auth.consumer(…).me.sessions.delete()`. Kept for 0.x callers; removed in 2.0.\n */\n revokeSession(id: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/me/sessions/{id}\", pathParams: { app_slug: this._b.app_slug, id } }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).me.update()` (PATCH /{app_slug}/v1/me).\n *\n * @deprecated Use `auth.consumer(…).me.update()`. Kept for 0.x callers; removed in 2.0.\n */\n updateProfile(params?: T.MeUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.MeUpdatedAccount>> {\n return this._client.request({ method: \"PATCH\", path: \"/{app_slug}/v1/me\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n}\n\n/** `mfa.webauthn` */\nexport class ConsumerMfaWebauthnResource extends APIResource {\n /**\n * Get passkey assertion options for an open MFA challenge\n *\n * Mints a single-use WebAuthn challenge scoped to the account behind `mfa_token` and returns the `publicKey` member for `navigator.credentials.get()`. Submit the result to `/auth/mfa/verify` as `credential` instead of `code`. Possession of the `mfa_token` (i.e. a correct password) is the authority — nothing here reveals whether an account exists or holds passkeys until that token has been presented.\n *\n * @param params - `Auth.MfaWebauthnOptionsParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: No passkey is enrolled on the account behind this challenge.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Invalid or expired challenge.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 412 PRECONDITION_FAILED: Passkeys are not enabled, or no allowed redirect origin matches the configured relying-party id.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Too many failed attempts on the challenge. Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/mfa/webauthn/options\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-webauthn-options\n * @example\n * ```ts\n * const consumerWebauthnOptions = await auth.consumer(\"my-app\").mfa.webauthn.options({ mfa_token: \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\" });\n * ```\n */\n options(params: T.MfaWebauthnOptionsParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerWebauthnOptions>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/mfa/webauthn/options\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n}\n\n/** `mfa` */\nexport class ConsumerMfaResource extends APIResource {\n #webauthn?: ConsumerMfaWebauthnResource;\n get webauthn(): ConsumerMfaWebauthnResource {\n return (this.#webauthn ??= new ConsumerMfaWebauthnResource(this._client, this._b));\n }\n /**\n * Begin MFA enrolment against an enrolment token\n *\n * For apps running `auth_config.mfa: \"required\"`. When a user proves their password but holds no enabled factor, `/auth/signin` returns `{ mfa_enrollment_required: true, mfa_token, expires_at }` and mints NO session; this endpoint starts the enrolment that `mfa_token` authorises. Same body and same response as `POST /{app_slug}/v1/me/mfa/factors`, but authenticated by the token rather than by a session — there is no session yet. TOTP returns the otpauth URI, QR data URL and shared secret; email sends a 6-digit code to the bound verified contact. The factor stays disabled until `/auth/mfa/enroll/verify` succeeds. The token is single-purpose: `/auth/mfa/verify`, `/auth/mfa/send-code` and `/auth/mfa/recover` all refuse it with 401, it is not an access token so `/me/*` refuses it, and `/auth/refresh` does not accept it.\n *\n * @param params - `Auth.MfaEnrollParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unsupported factor type, or the account already holds a factor.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Enrolment token invalid, expired, already used, or minted for a different app. A sign-in `mfa_token` (an MFA challenge, not an enrolment token) gets the same 401 — the response never says which kind of token was presented.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 412 PRECONDITION_FAILED: Email factor requested but the bound contact is unverified, or the app has not completed Mail notification setup.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/mfa/enroll\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-enroll\n * @example\n * ```ts\n * const startEnrollment = await auth.consumer(\"my-app\").mfa.enroll({ mfa_token: \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", type: \"totp\" });\n * ```\n */\n enroll(params: T.MfaEnrollParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.StartEnrollment>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/mfa/enroll\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Complete an MFA challenge with a recovery code\n *\n * Same flow as `/auth/mfa/verify` but consumes a single-use recovery code (16 hex chars; hyphens optional). Mints tokens with `amr: [\"pwd\",\"recovery_code\"]`. After successful recovery, the user should regenerate their recovery codes via `/me/mfa/recovery-codes/regenerate`.\n *\n * @param params - `Auth.MfaRecoverParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Invalid or expired challenge, or wrong recovery code.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Too many failed attempts against this challenge (5 locks it). Per-IP rate limit (`RATE_LIMITED`): this path is in the `verify_code` bucket — 5 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/auth/mfa/recover\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-recover\n * @example\n * ```ts\n * const consumerToken = await auth.consumer(\"my-app\").mfa.recover({\n * mfa_token: \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\",\n * recovery_code: \"1a2b-3c4d-5e6f-7890\",\n * });\n * ```\n */\n recover(params: T.MfaRecoverParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/mfa/recover\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Email a sign-in code for an email MFA factor\n *\n * Delivers a single-use 6-digit code to the masked address of an `email` factor listed on the challenge. Submit the code via `/auth/mfa/verify`. Requires the `mfa_token` from the signin response — possession of it (i.e. a correct password) is the authority. Throttled per challenge: max 3 sends, 30s between sends; each send supersedes the prior code.\n *\n * @param params - `Auth.MfaSendCodeParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Factor is not an email factor on this challenge, or request validation failed (missing / malformed body field) in the global `ValidationPipe`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Invalid or expired challenge.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 410 GONE: The bound email contact no longer exists or is no longer verified.\n * @throws {APIError} 412 PRECONDITION_FAILED: The app has not completed Mail notification setup for MFA codes.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Send throttled (max 3 sends per challenge, 30s apart), or too many failed attempts on the challenge. Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/mfa/send-code\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-send-code\n * @example\n * ```ts\n * const consumerMfaSendCode = await auth.consumer(\"my-app\").mfa.sendCode({\n * factor_id: \"9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b\",\n * mfa_token: \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\",\n * });\n * ```\n */\n sendCode(params: T.MfaSendCodeParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerMfaSendCode>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/mfa/send-code\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Complete an MFA challenge with a TOTP or emailed code\n *\n * Submit the `mfa_token` from a `mfa_required: true` signin response, plus EITHER a `code` (a current TOTP code, or the emailed code requested via `/auth/mfa/send-code`) OR a `credential` (a passkey assertion for the options from `/auth/mfa/webauthn/options`). Mints session + tokens with `amr: [\"pwd\", \"<factor type>\"]` and `mfa_at` set to now. The challenge is single-use; 5 wrong attempts locks it.\n *\n * @param params - `Auth.MfaVerifyParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Invalid or expired challenge, or wrong code.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Too many failed attempts against this challenge (5 locks it). Per-IP rate limit (`RATE_LIMITED`): this path is in the `verify_code` bucket — 5 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/mfa/verify\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-verify\n * @example\n * ```ts\n * const consumerToken = await auth.consumer(\"my-app\").mfa.verify({ mfa_token: \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\" });\n * ```\n */\n verify(params: T.MfaVerifyParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/mfa/verify\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Confirm the enrolled factor and receive the withheld session\n *\n * Completes the flow started by `/auth/mfa/enroll`. TOTP: submit two `codes` from consecutive 30-second windows. Email: submit the emailed 6-digit `code`. On success the factor is enabled, a fresh set of recovery codes is minted and returned ONCE (invalidating any prior set), and the session sign-in withheld is finally minted with `amr: [\"pwd\",\"mfa\"]` and `mfa_at` set to now. A wrong code counts against the token exactly as it does on the sign-in challenge; 5 failures lock it and the user must sign in again.\n *\n * @param params - `Auth.MfaVerifyEnrollmentParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid or repeated codes, the factor is not pending, or the factor does not belong to the account the token was minted for.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Enrolment token invalid, expired, already used, or minted for a different app.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Too many failed attempts against this enrolment token (5 locks it). Per-IP rate limit (`RATE_LIMITED`): this path is in the `verify_code` bucket — 5 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/mfa/enroll/verify\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-enroll-verify\n * @example\n * ```ts\n * const consumerMfaEnrollVerify = await auth.consumer(\"my-app\").mfa.verifyEnrollment({\n * factor_id: \"9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b\",\n * mfa_token: \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\",\n * });\n * ```\n */\n verifyEnrollment(params: T.MfaVerifyEnrollmentParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerMfaEnrollVerify>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/mfa/enroll/verify\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n}\n\n/** `oauth` */\nexport class ConsumerOauthResource extends APIResource {\n /**\n * Introspect the bearer access token (RFC 7662)\n *\n * OAuth 2.0 token introspection. Send the access token via `Authorization: Bearer <token>` and receive either `{ active: false }` (invalid / expired / wrong app, or a session that is revoked, past its `expires_at`, or gone because the end user was deleted) or the active claim set including `scopes` (M2M) or `role` (EndUser), `exp`, `iat`, `iss`, `aid`. The body `token` field is optional and, if present, must match the bearer — RFC 7662 allows a separate `token` body field but we deliberately refuse cross-token introspection so a stolen token can't be probed against another active credential. The endpoint accepts both M2M and EndUser tokens — use it as the canonical way for a service to know what its own token can do, instead of decoding the JWT by hand. Returns 401 when the bearer is missing.\n *\n * Credential: one of `m2m_token`, `end_user_token`.\n * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param params - `Auth.OauthIntrospectParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed in the global `ValidationPipe`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: No `Authorization: Bearer` header, or a `token` in the body that does not match the bearer. Every failure ABOUT THE TOKEN — bad signature, unknown / cross-app `kid`, wrong `aid`, expired, or a session that is revoked, past its `expires_at` or gone because the end user was deleted — is a 200 with `{ active: false }`, on purpose. A bad `:appSlug` is NOT one of those: it is a 404 (see below), decided by `AppStatusGuard` before this handler runs.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`).\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app. Raised by `AppStatusGuard`, which runs before the handler — so an introspection against a misspelled app slug is a 404, not an `{ active: false }`. About the **app**, decided before the token is parsed, so it says nothing about the token.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/oauth/introspect\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-oauth-introspect\n * @example\n * ```ts\n * const introspect = await auth.consumer(\"my-app\").oauth.introspect({ token: \"eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJzdWIiOiJ1c3JfMSJ9.c2lnbmF0dXJl\" });\n * ```\n */\n introspect(params?: T.OauthIntrospectParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Introspect>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/oauth/introspect\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Exchange client_credentials for an access token\n *\n * Standard OAuth 2.0 client_credentials grant. Returns an app-scoped access token whose `scopes[]` claim is the union of the client's configured scopes. Use for service-to-service calls.\n *\n * @param params - `Auth.OauthTokenParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `grant_type` is missing or is not `client_credentials`, or request validation failed in the global `ValidationPipe`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: `Invalid client credentials`. The SINGLE answer for an unknown `client_id`, a deactivated client, a wrong secret and a credential whose stored hash predates the SHA-256 migration — identical in status, message, DB round trips, wall time and CPU cost, so the endpoint is neither a client-existence oracle nor a way for an anonymous caller to spend our CPU. If you need to know whether a credential was deactivated, read it on the authenticated admin surface; if a credential minted before the migration stopped working, rotate its secret.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`).\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app. About the **app**, not the client — decided before `client_id` is looked at.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `token_exchange` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/oauth/token\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-oauth-token\n * @example\n * ```ts\n * const oAuthToken = await auth.consumer(\"my-app\").oauth.token({\n * client_id: \"m2m_a1b2c3d4e5f6...\",\n * client_secret: \"the-secret-returned-by-credentials-create\",\n * grant_type: \"client_credentials\",\n * });\n * ```\n */\n token(params: T.OauthTokenParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.OAuthToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/oauth/token\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).oauth.token()` (POST /{app_slug}/v1/oauth/token).\n *\n * @deprecated Use `auth.consumer(…).oauth.token()`. Kept for 0.x callers; removed in 2.0.\n */\n clientCredentials(params: T.OauthTokenParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.OAuthToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/oauth/token\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n}\n\n/** `passkey` */\nexport class ConsumerPasskeyResource extends APIResource {\n /**\n * Begin a passwordless passkey sign-in\n *\n * Returns a single-use WebAuthn challenge for `navigator.credentials.get()`. `allowCredentials` is ALWAYS empty and the response is shaped identically for every caller: this endpoint does not take an identifier and does not look one up, because returning a credential list for a registered address and an empty list for an unregistered one would be a single-request account-existence oracle. Sign-in therefore requires a discoverable (resident) credential — the authenticator finds its own passkey for the relying-party id. Submit the result to `/auth/passkey/verify`.\n *\n * @param params - `Auth.PasskeyOptionsParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Signin is disabled for this app.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 412 PRECONDITION_FAILED: Passkeys are not enabled, or no allowed redirect origin matches the configured relying-party id.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP burst limit. The endpoint does no credential work — one random challenge and one insert — so the bucket is the whole bound. Per-IP rate limit (`RATE_LIMITED`): this path is in the `auth` bucket — 10 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/passkey/options\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-passkey-options\n * @example\n * ```ts\n * const consumerWebauthnOptions = await auth.consumer(\"my-app\").passkey.options({ tenant_id: \"9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b\" });\n * ```\n */\n options(params?: T.PasskeyOptionsParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerWebauthnOptions>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/passkey/options\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Complete a passwordless passkey sign-in\n *\n * Verifies the assertion against the challenge from `/auth/passkey/options` and mints a session. The authenticator MUST have performed user verification (biometric / PIN) — a presence-only tap is refused on this path whatever the app policy says, because the passkey is the only authentication happening. Tokens carry `amr: [\"webauthn\"]` and a fresh `mfa_at`, so a passkey sign-in satisfies MFA-recency policies without a second step.\n *\n * @param params - `Auth.PasskeyVerifyParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Invalid credentials. Returned identically for a forged assertion, an unknown credential, a challenge that was never issued, one already used, and one that has expired — the endpoint is not an account-existence oracle.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Signin is disabled for this app, or the account is suspended / deactivated. The status refusal is only reachable once the assertion has verified.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP burst limit on credential consumption. Per-IP rate limit (`RATE_LIMITED`): this path is in the `verify_code` bucket — 5 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/passkey/verify\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-passkey-verify\n * @example\n * ```ts\n * const consumerToken = await auth.consumer(\"my-app\").passkey.verify({ credential: {} });\n * ```\n */\n verify(params: T.PasskeyVerifyParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/passkey/verify\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n}\n\n/** `permissions` */\nexport class ConsumerPermissionsResource extends APIResource {\n /**\n * Create a custom permission\n *\n * Inserts a `<resource>.<action>` row in the per-app permission catalogue. The resource and action segments must each match `^[a-z][a-z0-9_-]{1,47}$`. Conflicts with a system permission name return 409. Customers usually then bind the new permission to a role via `PUT /admin/roles/:roleName/permissions`.\n *\n * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.\n * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.\n * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param params - `Auth.ConsumerScopedPermissionCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Conflicts with a system permission or already exists in this app. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/admin/permissions\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-admin-permissions\n * @example\n * ```ts\n * const consumerAdminPermission = await auth.consumer(\"my-app\").permissions.create({ action: \"read\", resource: \"project\" });\n * ```\n */\n create(params: T.ConsumerScopedPermissionCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerAdminPermission>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/admin/permissions\", pathParams: { app_slug: this._b.app_slug }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a custom permission\n *\n * The `permissionKey` path parameter is the literal `<resource>.<action>` string. System permissions cannot be deleted — attempts return 403. Removing a permission also removes every `role_permission` row that bound it (cascade); role lookups dropped of that perm on the next request.\n *\n * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.\n * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.\n * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param permissionKey - Permission key, `resource.action` (e.g. `invoice.read`).\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: permissionKey must be in `resource.action` format.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Cannot delete system permissions.\n * @throws {NotFoundError} 404 NOT_FOUND: Permission not found in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/admin/permissions/{permission_key}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-admin-permissions-permission-key\n * @example\n * ```ts\n * await auth.consumer(\"my-app\").permissions.delete(\"invoice.read\");\n * ```\n */\n delete(permissionKey: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/admin/permissions/{permission_key}\", pathParams: { app_slug: this._b.app_slug, permission_key: permissionKey } }, options);\n }\n /**\n * List all permissions visible to this app\n *\n * Returns the union of system permissions (shared across every app — `is_system: true` in the response) and any custom entries this app has defined (`is_system: false`). Useful for driving a role-editor UI that picks from the full catalogue.\n *\n * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.\n * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.\n * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended or archived (`APP_SUSPENDED` / `APP_ARCHIVED`), or the caller lacks `permission.read`: an app API key always needs it in its permissions; a role or M2M scopes need it once the app enforces permissions.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/admin/permissions\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-permissions\n * @example\n * ```ts\n * const result = await auth.consumer(\"my-app\").permissions.list();\n * ```\n */\n list(options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerScopedPermissionListResponse>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/admin/permissions\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n}\n\n/** `roles` */\nexport class ConsumerRolesResource extends APIResource {\n /**\n * Create a role\n *\n * Creates a role with no permissions bound yet. Use `PUT /:roleName/permissions` to attach a permission set after creation — that route also runs caller-narrowing so an EndUser admin can't grant verbs they don't themselves hold.\n *\n * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.\n * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.\n * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param params - `Auth.ConsumerScopedRoleCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Role name already exists in this app. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/admin/roles\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-admin-roles\n * @example\n * ```ts\n * const consumerRole = await auth.consumer(\"my-app\").roles.create({ name: \"editor\" });\n * ```\n */\n create(params: T.ConsumerScopedRoleCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerRole>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/admin/roles\", pathParams: { app_slug: this._b.app_slug }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a custom role\n *\n * System roles (`owner`, `admin`, `member`) cannot be deleted — attempts return 403. Roles currently assigned to any member return 409 `ROLE_IN_USE`; reassign the affected members first.\n *\n * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.\n * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.\n * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param roleName - Name of the role (e.g. `admin`).\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Cannot delete a system role.\n * @throws {ConflictError} 409 CONFLICT: Role is in use by at least one member.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/admin/roles/{role_name}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-admin-roles-role-name\n * @example\n * ```ts\n * await auth.consumer(\"my-app\").roles.delete(\"admin\");\n * ```\n */\n delete(roleName: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/admin/roles/{role_name}\", pathParams: { app_slug: this._b.app_slug, role_name: roleName } }, options);\n }\n /**\n * List roles in this app\n *\n * Cursor-paginated by `created_at`. Use the returned `next_cursor` in subsequent calls — offset pagination is not exposed.\n *\n * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.\n * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.\n * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param params - `Auth.ConsumerScopedRoleListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended or archived (`APP_SUSPENDED` / `APP_ARCHIVED`), or the caller lacks `role.read`: an app API key always needs it in its permissions; a role or M2M scopes need it once the app enforces permissions.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/admin/roles\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-roles\n * @example\n * ```ts\n * for await (const role of auth.consumer(\"my-app\").roles.list()) {\n * console.log(role);\n * }\n * const page = await auth.consumer(\"my-app\").roles.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.ConsumerScopedRoleListParams, options?: RequestOptions): PagePromise<T.ConsumerRole> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/admin/roles\", pathParams: { app_slug: this._b.app_slug }, query: params }, options);\n }\n /**\n * Read one role with its permission set\n *\n * Returns the role plus the flat `permissions[]` array currently bound. Use this to drive a \"configure role\" UI in the customer product without having to call `/permissions` separately.\n *\n * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.\n * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.\n * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param roleName - Name of the role (e.g. `admin`).\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Role not found in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/admin/roles/{role_name}\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-roles-role-name\n * @example\n * ```ts\n * const consumerRoleWithPermissions = await auth.consumer(\"my-app\").roles.retrieve(\"admin\");\n * ```\n */\n retrieve(roleName: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerRoleWithPermissions>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/admin/roles/{role_name}\", pathParams: { app_slug: this._b.app_slug, role_name: roleName } }, options);\n }\n /**\n * Update a role's description\n *\n * Renames are intentionally NOT supported — the role name is part of every issued EndUser JWT, so changing it would silently break live sessions. Create a new role and migrate users instead.\n *\n * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.\n * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.\n * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param roleName - Name of the role (e.g. `admin`).\n * @param params - `Auth.ConsumerScopedRoleUpdateParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Role not found in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /{app_slug}/v1/admin/roles/{role_name}\n * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-admin-roles-role-name\n * @example\n * ```ts\n * const consumerRole = await auth.consumer(\"my-app\").roles.update(\"admin\", { description: \"Updated description\" });\n * ```\n */\n update(roleName: string, params?: T.ConsumerScopedRoleUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerRole>> {\n return this._client.request({ method: \"PATCH\", path: \"/{app_slug}/v1/admin/roles/{role_name}\", pathParams: { app_slug: this._b.app_slug, role_name: roleName }, body: params }, options);\n }\n /**\n * Replace a role's permission set\n *\n * Destructive — the role's permission set is replaced wholesale with the supplied array. Caller-narrowed: the caller must hold every permission in the request, otherwise 403 `Cannot grant actions you don't have: ...`. For EndUser callers the caller-held set is their app-membership role's effective permissions. For M2M callers the held set is the token's `scopes[]` claim — the M2M cannot grant a role any verb that wasn't configured on the M2M credential. Unknown permission strings return 400.\n *\n * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.\n * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.\n * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param roleName - Name of the role (e.g. `admin`).\n * @param params - `Auth.ConsumerScopedRoleUpdatePermissionsParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown permission(s) in the request.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller is missing one or more permissions they're trying to grant.\n * @throws {NotFoundError} 404 NOT_FOUND: Role not found in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PUT /{app_slug}/v1/admin/roles/{role_name}/permissions\n * @see https://productcraft.co/docs/auth/api-reference#put-app-slug-v1-admin-roles-role-name-permissions\n * @example\n * ```ts\n * const result = await auth.consumer(\"my-app\").roles.updatePermissions(\"admin\", { permissions: [\"user.read\", \"role.create\"] });\n * ```\n */\n updatePermissions(roleName: string, params: T.ConsumerScopedRoleUpdatePermissionsParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerScopedRoleUpdatePermissionsResponse>> {\n return this._client.request({ method: \"PUT\", path: \"/{app_slug}/v1/admin/roles/{role_name}/permissions\", pathParams: { app_slug: this._b.app_slug, role_name: roleName }, body: params }, options);\n }\n}\n\n/** `tenantApiKeys.config` */\nexport class ConsumerTenantApiKeysConfigResource extends APIResource {\n /**\n * Read this app's tenant API key settings\n *\n * Requires `auth.tenant.api_keys.configure` on the app.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or revoked Platform API Key (`Authorization: Bearer pcft_live_…`).\n * @throws {PermissionDeniedError} 403 FORBIDDEN, PAK_WORKSPACE_MISMATCH: `PAK_WORKSPACE_MISMATCH` (the PAK belongs to another workspace than the app), or the PAK's policy does not allow `auth.tenant.api_keys.configure` on `pcft:heimdall:app/<appId>`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT: The app has no workspace binding, so no PAK can act on it.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/tenant-api-keys/config\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenant-api-keys-config\n * @example\n * ```ts\n * const tenantApiKeysConfig = await auth.consumer(\"my-app\").tenantApiKeys.config.retrieve();\n * ```\n */\n retrieve(options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantApiKeysConfig>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/tenant-api-keys/config\", pathParams: { app_slug: this._b.app_slug } }, options);\n }\n /**\n * Push this app's tenant API key settings\n *\n * Call it on boot: your code is the source of truth for the scopes a key can carry. Fields you leave out keep their stored value. `suspended` is the platform's kill switch: this route never changes it, and a body that carries it is refused. Requires `auth.tenant.api_keys.configure` on the app.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.ConsumerScopedTenantApiKeyConfigUpdateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, TENANT_API_KEYS_SCOPE_INVALID, TENANT_API_KEYS_UNKNOWN_ROLE, TENANT_API_KEY_EXPIRY_INVALID, TENANT_API_KEYS_NO_SCOPES, TENANT_API_KEYS_SUSPENDED_NOT_WRITABLE: `VALIDATION_ERROR`, `TENANT_API_KEYS_SCOPE_INVALID` (`details.scopes`), `TENANT_API_KEYS_UNKNOWN_ROLE` (`details.roles`: `manage_roles` names a role this app does not have), `TENANT_API_KEY_EXPIRY_INVALID`, `TENANT_API_KEYS_NO_SCOPES` (enabling with no scope), `TENANT_API_KEYS_SUSPENDED_NOT_WRITABLE` (the body carries `suspended`), or a malformed `Idempotency-Key`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or revoked Platform API Key (`Authorization: Bearer pcft_live_…`).\n * @throws {PermissionDeniedError} 403 FORBIDDEN, PAK_WORKSPACE_MISMATCH: `PAK_WORKSPACE_MISMATCH` (the PAK belongs to another workspace than the app), or the PAK's policy does not allow `auth.tenant.api_keys.configure` on `pcft:heimdall:app/<appId>`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: The app has no workspace binding, so no PAK can act on it. Or `IDEMPOTENCY_KEY_REUSE`. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PUT /{app_slug}/v1/tenant-api-keys/config\n * @see https://productcraft.co/docs/auth/api-reference#put-app-slug-v1-tenant-api-keys-config\n * @example\n * ```ts\n * const tenantApiKeysConfig = await auth.consumer(\"my-app\").tenantApiKeys.config.update({ default_expiry_days: 7 });\n * ```\n */\n update(params?: T.ConsumerScopedTenantApiKeyConfigUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantApiKeysConfig>> {\n return this._client.request({ method: \"PUT\", path: \"/{app_slug}/v1/tenant-api-keys/config\", pathParams: { app_slug: this._b.app_slug }, body: params, idempotent: true }, options);\n }\n}\n\n/** `tenantApiKeys` */\nexport class ConsumerTenantApiKeysResource extends APIResource {\n #config?: ConsumerTenantApiKeysConfigResource;\n get config(): ConsumerTenantApiKeysConfigResource {\n return (this.#config ??= new ConsumerTenantApiKeysConfigResource(this._client, this._b));\n }\n /**\n * Create an API key for the active tenant\n *\n * Returns the secret ONCE (`key`). Scopes must be grantable by the app and held by your own tenant role. At most 25 active keys per tenant. If the app requires recent MFA, verify a factor first (403 `step_up_required`). Responses carry `Cache-Control: no-store`.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param params - `Auth.TenantApiKeyCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, TENANT_API_KEY_SCOPE_NOT_GRANTABLE, TENANT_API_KEY_EXPIRY_INVALID: `VALIDATION_ERROR`, `TENANT_API_KEY_SCOPE_NOT_GRANTABLE` (`details.scopes`), `TENANT_API_KEY_EXPIRY_INVALID` (`details.allowed`), or a malformed `Idempotency-Key`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid end-user bearer token (M2M tokens, PAKs and API keys are refused).\n * @throws {PermissionDeniedError} 403 FORBIDDEN, TENANT_API_KEYS_NOT_ENABLED, TENANT_API_KEYS_SUSPENDED, TENANT_API_KEYS_APP_PROXY_ONLY, TENANT_CONTEXT_REQUIRED, TENANT_MEMBERSHIP_REQUIRED, TENANT_NOT_ACTIVE, TENANT_API_KEYS_FORBIDDEN, TENANT_API_KEY_SCOPE_ABOVE_CEILING, step_up_required: `TENANT_API_KEYS_NOT_ENABLED` (the app has not enabled tenant API keys), `TENANT_API_KEYS_SUSPENDED`, `TENANT_API_KEYS_APP_PROXY_ONLY` (the app manages keys through its own backend; call it instead), `TENANT_CONTEXT_REQUIRED` (no active tenant on the session: switch tenant first), `TENANT_MEMBERSHIP_REQUIRED`, `TENANT_NOT_ACTIVE`, `TENANT_API_KEYS_FORBIDDEN` (your tenant role is not in the app's `manage_roles`), or a PAK refusal on `X-Heimdall-App-Key`. Also `TENANT_API_KEY_SCOPE_ABOVE_CEILING` (`details.scopes`: scopes your role does not hold) and `step_up_required` (`details.max_age_minutes`).\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, TENANT_API_KEY_LIMIT, idempotency_secret_not_replayable, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: `TENANT_API_KEY_LIMIT` (25 active keys), `idempotency_secret_not_replayable` (`details.key_id`), or `IDEMPOTENCY_KEY_REUSE`. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/tenant-api-keys\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenant-api-keys\n * @example\n * ```ts\n * const tenantApiKeyWithSecret = await auth.consumer(\"my-app\").tenantApiKeys.create({ name: \"CI e2e\", scopes: [\"disputes.read\", \"audit.read\"] });\n * ```\n */\n create(params: T.TenantApiKeyCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantApiKeyWithSecret>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/tenant-api-keys\", pathParams: { app_slug: this._b.app_slug }, body: params, idempotent: true }, options);\n }\n /**\n * Revoke an API key\n *\n * Immediate and final. Idempotent: revoking a revoked key is a 204 that changes nothing.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param keyId - Key id (UUID) or display id (`tak_…`).\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid end-user bearer token (M2M tokens, PAKs and API keys are refused).\n * @throws {PermissionDeniedError} 403 FORBIDDEN, TENANT_API_KEYS_NOT_ENABLED, TENANT_API_KEYS_SUSPENDED, TENANT_API_KEYS_APP_PROXY_ONLY, TENANT_CONTEXT_REQUIRED, TENANT_MEMBERSHIP_REQUIRED, TENANT_NOT_ACTIVE, TENANT_API_KEYS_FORBIDDEN: `TENANT_API_KEYS_NOT_ENABLED` (the app has not enabled tenant API keys), `TENANT_API_KEYS_SUSPENDED`, `TENANT_API_KEYS_APP_PROXY_ONLY` (the app manages keys through its own backend; call it instead), `TENANT_CONTEXT_REQUIRED` (no active tenant on the session: switch tenant first), `TENANT_MEMBERSHIP_REQUIRED`, `TENANT_NOT_ACTIVE`, `TENANT_API_KEYS_FORBIDDEN` (your tenant role is not in the app's `manage_roles`), or a PAK refusal on `X-Heimdall-App-Key`.\n * @throws {NotFoundError} 404 NOT_FOUND, TENANT_API_KEY_NOT_FOUND: `TENANT_API_KEY_NOT_FOUND`: no such key in your active tenant (or app not found).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/tenant-api-keys/{key_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-tenant-api-keys-key-id\n * @example\n * ```ts\n * await auth.consumer(\"my-app\").tenantApiKeys.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(keyId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/tenant-api-keys/{key_id}\", pathParams: { app_slug: this._b.app_slug, key_id: keyId } }, options);\n }\n /**\n * Verify a tenant API key (RFC 7662 shape)\n *\n * For your backend: is this `pctk_` key, presented to YOUR API, usable right now, for which tenant and with which scopes? A key of another app is `{\"active\": false}`. Cache answers by the key's SHA-256: positives up to 30 s (never past `expires_at`), negatives up to 60 s. Intersect `scopes` with the permissions of `created_by.tenant_role` in your app. Requires `auth.tenant.api_keys.introspect` on the app. Not audited per call; `last_used_at` records use (5-minute granularity). This route has its own per-app rate bucket (1200 calls a minute by default), separate from your PAK's other calls; over it the answer is 429 with `Retry-After`, never a false `active: false`, so keep serving keys you hold a fresh positive for.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.TenantApiKeyIntrospectParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `key` missing or not a string.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or revoked Platform API Key (`Authorization: Bearer pcft_live_…`).\n * @throws {PermissionDeniedError} 403 FORBIDDEN, PAK_WORKSPACE_MISMATCH: `PAK_WORKSPACE_MISMATCH` (the PAK belongs to another workspace than the app), or the PAK's policy does not allow `auth.tenant.api_keys.introspect` on `pcft:heimdall:app/<appId>`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT: The app has no workspace binding, so no PAK can act on it.\n * @throws {RateLimitError} 429 RATE_LIMITED: `RATE_LIMITED`: this app's introspect bucket is exhausted for the current minute. `Retry-After` says when it refills.\n * @see POST /{app_slug}/v1/tenant-api-keys/introspect\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenant-api-keys-introspect\n * @example\n * ```ts\n * const tenantApiKeyIntrospection = await auth.consumer(\"my-app\").tenantApiKeys.introspect({ key: \"pctk_live_4fQ2aZ0000000000000000000000000000000000000_1a2B3c\" });\n * ```\n */\n introspect(params: T.TenantApiKeyIntrospectParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantApiKeyIntrospection>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/tenant-api-keys/introspect\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * List the active tenant's API keys\n *\n * Newest first, cursor-paginated (20 per page, max 100). Secrets are never returned; `key_prefix` and `last4` identify a key.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param params - `Auth.ConsumerScopedTenantApiKeyListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` or malformed `cursor`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid end-user bearer token (M2M tokens, PAKs and API keys are refused).\n * @throws {PermissionDeniedError} 403 FORBIDDEN, TENANT_API_KEYS_NOT_ENABLED, TENANT_API_KEYS_SUSPENDED, TENANT_API_KEYS_APP_PROXY_ONLY, TENANT_CONTEXT_REQUIRED, TENANT_MEMBERSHIP_REQUIRED, TENANT_NOT_ACTIVE, TENANT_API_KEYS_FORBIDDEN: `TENANT_API_KEYS_NOT_ENABLED` (the app has not enabled tenant API keys), `TENANT_API_KEYS_SUSPENDED`, `TENANT_API_KEYS_APP_PROXY_ONLY` (the app manages keys through its own backend; call it instead), `TENANT_CONTEXT_REQUIRED` (no active tenant on the session: switch tenant first), `TENANT_MEMBERSHIP_REQUIRED`, `TENANT_NOT_ACTIVE`, `TENANT_API_KEYS_FORBIDDEN` (your tenant role is not in the app's `manage_roles`), or a PAK refusal on `X-Heimdall-App-Key`.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/tenant-api-keys\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenant-api-keys\n * @example\n * ```ts\n * for await (const tenantApiKey of auth.consumer(\"my-app\").tenantApiKeys.list()) {\n * console.log(tenantApiKey);\n * }\n * const page = await auth.consumer(\"my-app\").tenantApiKeys.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.ConsumerScopedTenantApiKeyListParams, options?: RequestOptions): PagePromise<T.TenantApiKey> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/tenant-api-keys\", pathParams: { app_slug: this._b.app_slug }, query: params }, options);\n }\n /**\n * Rotate an API key\n *\n * Mints a replacement with the same name and scopes and returns its secret ONCE. You become the replacement's creator, so its scopes must be within your own tenant role. The outgoing key is revoked now (`grace_hours: 0`, the default) or keeps working for up to 24 hours. To kill a leaked key, revoke it. Responses carry `Cache-Control: no-store`.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param keyId - Key id (UUID) or display id (`tak_…`).\n * @param params - `Auth.TenantApiKeyRotateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, TENANT_API_KEY_EXPIRY_INVALID: `VALIDATION_ERROR` (`grace_hours` outside 0-24), `TENANT_API_KEY_EXPIRY_INVALID`, or a malformed `Idempotency-Key`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid end-user bearer token (M2M tokens, PAKs and API keys are refused).\n * @throws {PermissionDeniedError} 403 FORBIDDEN, TENANT_API_KEYS_NOT_ENABLED, TENANT_API_KEYS_SUSPENDED, TENANT_API_KEYS_APP_PROXY_ONLY, TENANT_CONTEXT_REQUIRED, TENANT_MEMBERSHIP_REQUIRED, TENANT_NOT_ACTIVE, TENANT_API_KEYS_FORBIDDEN, TENANT_API_KEY_SCOPE_ABOVE_CEILING, step_up_required: `TENANT_API_KEYS_NOT_ENABLED` (the app has not enabled tenant API keys), `TENANT_API_KEYS_SUSPENDED`, `TENANT_API_KEYS_APP_PROXY_ONLY` (the app manages keys through its own backend; call it instead), `TENANT_CONTEXT_REQUIRED` (no active tenant on the session: switch tenant first), `TENANT_MEMBERSHIP_REQUIRED`, `TENANT_NOT_ACTIVE`, `TENANT_API_KEYS_FORBIDDEN` (your tenant role is not in the app's `manage_roles`), or a PAK refusal on `X-Heimdall-App-Key`. Also `TENANT_API_KEY_SCOPE_ABOVE_CEILING` and `step_up_required`.\n * @throws {NotFoundError} 404 NOT_FOUND, TENANT_API_KEY_NOT_FOUND: `TENANT_API_KEY_NOT_FOUND`: no such key in your active tenant (or app not found).\n * @throws {ConflictError} 409 CONFLICT, TENANT_API_KEY_NOT_ACTIVE, TENANT_API_KEY_SCOPE_NOT_GRANTABLE, idempotency_secret_not_replayable, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: `TENANT_API_KEY_NOT_ACTIVE` (revoked or expired keys cannot be rotated), `TENANT_API_KEY_SCOPE_NOT_GRANTABLE` (the app no longer offers one of its scopes), `idempotency_secret_not_replayable`, or `IDEMPOTENCY_KEY_REUSE`. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/tenant-api-keys/{key_id}/rotate\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenant-api-keys-key-id-rotate\n * @example\n * ```ts\n * const tenantApiKeyWithSecret = await auth.consumer(\"my-app\").tenantApiKeys.rotate(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { expires_in_days: 7 });\n * ```\n */\n rotate(keyId: string, params?: T.TenantApiKeyRotateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantApiKeyWithSecret>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/tenant-api-keys/{key_id}/rotate\", pathParams: { app_slug: this._b.app_slug, key_id: keyId }, body: params, idempotent: true }, options);\n }\n /**\n * Why a tenant API key is (in)active\n *\n * For your own audit trail: record why a key you saw go inactive died (revoked in the console, creator left the tenant, expired, keys suspended). Only keys of this app; another app's key is 404. Requires `auth.tenant.api_keys.introspect` on the app.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param keyId - Key id (UUID) or display id (`tak_…`), as `introspect` returned it.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or revoked Platform API Key (`Authorization: Bearer pcft_live_…`).\n * @throws {PermissionDeniedError} 403 FORBIDDEN, PAK_WORKSPACE_MISMATCH: `PAK_WORKSPACE_MISMATCH` (the PAK belongs to another workspace than the app), or the PAK's policy does not allow `auth.tenant.api_keys.introspect` on `pcft:heimdall:app/<appId>`.\n * @throws {NotFoundError} 404 NOT_FOUND, TENANT_API_KEY_NOT_FOUND: `TENANT_API_KEY_NOT_FOUND`: no such key in this app (or app not found).\n * @throws {ConflictError} 409 CONFLICT: The app has no workspace binding, so no PAK can act on it.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/tenant-api-keys/{key_id}/status\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenant-api-keys-key-id-status\n * @example\n * ```ts\n * const tenantApiKeyStatus = await auth.consumer(\"my-app\").tenantApiKeys.status(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n status(keyId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.TenantApiKeyStatus>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/tenant-api-keys/{key_id}/status\", pathParams: { app_slug: this._b.app_slug, key_id: keyId } }, options);\n }\n}\n\n/** `tenants.invites` */\nexport class ConsumerTenantsInvitesResource extends APIResource {\n /**\n * Invite an email address into a tenant. Mints a pending invite, mails the code through the app's `invite_template_name` Envoi slot, and returns the plaintext code ONCE. PAK must hold auth.tenant.members.add.\n *\n * Unlike `POST /members`, nothing is granted until the invitee accepts at `POST /:appSlug/v1/auth/accept-tenant-invite`. Only a SHA-256 digest of the code is stored, so the `code` in this response is unrecoverable afterwards.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.ConsumerScopedTenantInviteCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid email, unknown role, or maxUses/expiresInHours out of range.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: PAK missing.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: PAK policy denies action.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: That email is already a member of the tenant, or already has a pending invite to it. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/tenants/{tenant_id}/invites\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenants-tenant-id-invites\n * @example\n * ```ts\n * const createTenantInvite = await auth.consumer(\"my-app\").tenants.invites.create(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { email: \"alice@example.com\", role_name: \"member\" });\n * ```\n */\n create(tenantId: string, params: T.ConsumerScopedTenantInviteCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.CreateTenantInvite>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/tenants/{tenant_id}/invites\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId }, body: params, idempotent: true }, options);\n }\n /**\n * Revoke a pending invite. Idempotent — revoking an already-revoked invite is a 204 no-op and fires no second webhook. PAK must hold auth.tenant.members.remove.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param inviteId - Id of the invite.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant or invite not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/tenants/{tenant_id}/invites/{invite_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-tenants-tenant-id-invites-invite-id\n * @example\n * ```ts\n * await auth.consumer(\"my-app\").tenants.invites.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(tenantId: string, inviteId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/tenants/{tenant_id}/invites/{invite_id}\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId, invite_id: inviteId } }, options);\n }\n /**\n * List a tenant's invites, newest first. Optional `?status=pending|revoked|expired|used`. PAK must hold auth.tenant.read.\n *\n * Codes are never returned here — only the digest is stored. Use `status=pending` to show outstanding invitations.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.ConsumerScopedTenantInviteListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` value.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/tenants/{tenant_id}/invites\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenants-tenant-id-invites\n * @example\n * ```ts\n * for await (const invite of auth.consumer(\"my-app\").tenants.invites.list(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\")) {\n * console.log(invite);\n * }\n * const page = await auth.consumer(\"my-app\").tenants.invites.list(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", {}, { timeout: 5_000 });\n * ```\n */\n list(tenantId: string, params?: T.ConsumerScopedTenantInviteListParams, options?: RequestOptions): PagePromise<T.TenantInvite> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/tenants/{tenant_id}/invites\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId }, query: params }, options);\n }\n}\n\n/** `tenants.members` */\nexport class ConsumerTenantsMembersResource extends APIResource {\n /**\n * Add a member to a tenant. Pass `accountId` for an existing user, or `email` (+ optional `display_name`/`username`) to auto-create the account inline. PAK must hold auth.tenant.members.add.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.ConsumerScopedTenantMemberCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid body (missing accountId/email or unknown role).\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant or account not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Account is already a member of this tenant. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/tenants/{tenant_id}/members\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenants-tenant-id-members\n * @example\n * ```ts\n * const consumerAddMember = await auth.consumer(\"my-app\").tenants.members.create(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { role_name: \"member\" });\n * ```\n */\n create(tenantId: string, params: T.ConsumerScopedTenantMemberCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerAddMember>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/tenants/{tenant_id}/members\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId }, body: params, idempotent: true }, options);\n }\n /**\n * Remove a member from a tenant. The underlying account row stays in the app — only the tenant_membership row is deleted. PAK must hold auth.tenant.members.remove.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param accountId - Id of the account.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant or membership not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/tenants/{tenant_id}/members/{account_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-tenants-tenant-id-members-account-id\n * @example\n * ```ts\n * await auth.consumer(\"my-app\").tenants.members.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(tenantId: string, accountId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/tenants/{tenant_id}/members/{account_id}\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId, account_id: accountId } }, options);\n }\n /**\n * List members of a tenant. Cursor-paginated by joined_at desc. Filter by `?search=` and/or `?role=`. PAK must hold auth.tenant.read.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.ConsumerScopedTenantMemberListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Over-long `search` / `role` filter or malformed `cursor`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: PAK missing, malformed, unknown or revoked.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: PAK policy denies `auth.tenant.read` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: App or tenant not found (or the PAK belongs to another workspace).\n * @throws {ConflictError} 409 CONFLICT: App has no workspace binding; PAK access refused.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/tenants/{tenant_id}/members\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenants-tenant-id-members\n * @example\n * ```ts\n * for await (const member of auth.consumer(\"my-app\").tenants.members.list(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\")) {\n * console.log(member);\n * }\n * const page = await auth.consumer(\"my-app\").tenants.members.list(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", {}, { timeout: 5_000 });\n * ```\n */\n list(tenantId: string, params?: T.ConsumerScopedTenantMemberListParams, options?: RequestOptions): PagePromise<T.ConsumerTenantMembership> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/tenants/{tenant_id}/members\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId }, query: params }, options);\n }\n /**\n * Change a member's role. PAK must hold auth.tenant.members.update-role.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param accountId - Id of the account.\n * @param params - `Auth.ConsumerScopedTenantMemberUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown role.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant or membership not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /{app_slug}/v1/tenants/{tenant_id}/members/{account_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-tenants-tenant-id-members-account-id\n * @example\n * ```ts\n * const consumerTenantMembership = await auth.consumer(\"my-app\").tenants.members.update(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { role_name: \"admin\" });\n * ```\n */\n update(tenantId: string, accountId: string, params: T.ConsumerScopedTenantMemberUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerTenantMembership>> {\n return this._client.request({ method: \"PATCH\", path: \"/{app_slug}/v1/tenants/{tenant_id}/members/{account_id}\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId, account_id: accountId }, body: params }, options);\n }\n}\n\n/** `tenants` */\nexport class ConsumerTenantsResource extends APIResource {\n #invites?: ConsumerTenantsInvitesResource;\n #members?: ConsumerTenantsMembersResource;\n get invites(): ConsumerTenantsInvitesResource {\n return (this.#invites ??= new ConsumerTenantsInvitesResource(this._client, this._b));\n }\n get members(): ConsumerTenantsMembersResource {\n return (this.#members ??= new ConsumerTenantsMembersResource(this._client, this._b));\n }\n /**\n * Create a tenant inside this app. Returns the new tenant with a `display_id` (`tnt_<12hex>`). PAK must hold auth.tenant.create.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.ConsumerScopedTenantCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid display_name or slug.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: PAK missing.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: PAK policy denies action.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Slug already taken in this app. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/tenants\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenants\n * @example\n * ```ts\n * const consumerTenant = await auth.consumer(\"my-app\").tenants.create({ display_name: \"Acme Co\" });\n * ```\n */\n create(params: T.ConsumerScopedTenantCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerTenant>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/tenants\", pathParams: { app_slug: this._b.app_slug }, body: params, idempotent: true }, options);\n }\n /**\n * Delete a tenant. Cascades to tenant_membership rows; account rows are unaffected. PAK must hold auth.tenant.delete.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/tenants/{tenant_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-tenants-tenant-id\n * @example\n * ```ts\n * await auth.consumer(\"my-app\").tenants.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(tenantId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/tenants/{tenant_id}\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId } }, options);\n }\n /**\n * List tenants in this app, paginated by created_at desc. PAK must hold auth.tenant.read.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.ConsumerScopedTenantListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `status` filter or malformed `cursor`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: PAK missing, malformed, unknown or revoked.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: PAK policy denies `auth.tenant.read` on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: App not found (or the PAK belongs to another workspace).\n * @throws {ConflictError} 409 CONFLICT: App has no workspace binding; PAK access refused.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/tenants\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenants\n * @example\n * ```ts\n * for await (const tenant of auth.consumer(\"my-app\").tenants.list()) {\n * console.log(tenant);\n * }\n * const page = await auth.consumer(\"my-app\").tenants.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.ConsumerScopedTenantListParams, options?: RequestOptions): PagePromise<T.ConsumerTenant> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/tenants\", pathParams: { app_slug: this._b.app_slug }, query: params }, options);\n }\n /**\n * Fetch a single tenant by its UUID or `tnt_<12hex>` display id. PAK must hold auth.tenant.read.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant not found.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/tenants/{tenant_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenants-tenant-id\n * @example\n * ```ts\n * const consumerTenant = await auth.consumer(\"my-app\").tenants.retrieve(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n retrieve(tenantId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerTenant>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/tenants/{tenant_id}\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId } }, options);\n }\n /**\n * Patch a tenant. Any subset of {display_name, slug, status, metadata}. PAK must hold auth.tenant.update.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param tenantId - Id of the tenant.\n * @param params - `Auth.ConsumerScopedTenantUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid patch.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: Tenant not found.\n * @throws {ConflictError} 409 CONFLICT: Slug collision.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /{app_slug}/v1/tenants/{tenant_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-tenants-tenant-id\n * @example\n * ```ts\n * const consumerTenant = await auth.consumer(\"my-app\").tenants.update(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { display_name: \"Acme Inc\" });\n * ```\n */\n update(tenantId: string, params?: T.ConsumerScopedTenantUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerTenant>> {\n return this._client.request({ method: \"PATCH\", path: \"/{app_slug}/v1/tenants/{tenant_id}\", pathParams: { app_slug: this._b.app_slug, tenant_id: tenantId }, body: params }, options);\n }\n}\n\n/** `users.factors` */\nexport class ConsumerUsersFactorsResource extends APIResource {\n /**\n * Provision an MFA factor on behalf of a user\n *\n * Creates the factor in the enabled state. TOTP: returns the cleartext secret + otpauth URI + recovery codes in the response — intended for synthetic-account-style flows where the caller bundles credentials and ships them out once. Email: binds the user's verified email contact (primary by default, `contact_id` to override; 412 when unverified) and returns the masked address + recovery codes — sign-in codes are then delivered on demand via `/auth/mfa/send-code`.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param userId - Id of the user.\n * @param params - `Auth.UserFactorCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed (unsupported `type`, over-long `label`, non-UUID `contact_id`), or `type` is `webauthn` — passkeys cannot be provisioned out-of-band.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing bearer token, or the Platform API Key is malformed, unknown or revoked.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: The PAK policy denies `auth.user.factors.provision` on this app's URN.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app (or the PAK belongs to another workspace), or the user is not in this app. Email factors: `contact_id` names no email contact on the account.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: The app has no workspace binding, so PAK access is refused until configured. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {APIError} 412 PRECONDITION_FAILED: Email factors: the contact (or primary email) is unverified, or the app has not completed Mail setup for MFA codes.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/users/{user_id}/factors\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-users-user-id-factors\n * @example\n * ```ts\n * const adminProvisionFactor = await auth.consumer(\"my-app\").users.factors.create(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { type: \"totp\" });\n * ```\n */\n create(userId: string, params: T.UserFactorCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AdminProvisionFactor>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/users/{user_id}/factors\", pathParams: { app_slug: this._b.app_slug, user_id: userId }, body: params, idempotent: true }, options);\n }\n /**\n * Disable a user's MFA factor\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param userId - Id of the user.\n * @param factorId - Id of the factor.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing bearer token, or the Platform API Key is malformed, unknown or revoked.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: The PAK policy denies `auth.user.factors.delete` on this app's URN.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app (or the PAK belongs to another workspace), or the user is not in this app. Also when the factor is not on that user.\n * @throws {ConflictError} 409 CONFLICT: The app has no workspace binding, so PAK access is refused until configured.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/users/{user_id}/factors/{factor_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-users-user-id-factors-factor-id\n * @example\n * ```ts\n * await auth.consumer(\"my-app\").users.factors.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(userId: string, factorId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/users/{user_id}/factors/{factor_id}\", pathParams: { app_slug: this._b.app_slug, user_id: userId, factor_id: factorId } }, options);\n }\n /**\n * List a user's MFA factors\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing bearer token, or the Platform API Key is malformed, unknown or revoked.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: The PAK policy denies `auth.user.factors.read` on this app's URN.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app (or the PAK belongs to another workspace), or the user is not in this app.\n * @throws {ConflictError} 409 CONFLICT: The app has no workspace binding, so PAK access is refused until configured.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/users/{user_id}/factors\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-users-user-id-factors\n * @example\n * ```ts\n * const factorList = await auth.consumer(\"my-app\").users.factors.list(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n list(userId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.FactorList>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/users/{user_id}/factors\", pathParams: { app_slug: this._b.app_slug, user_id: userId } }, options);\n }\n}\n\n/** `users` */\nexport class ConsumerUsersResource extends APIResource {\n #factors?: ConsumerUsersFactorsResource;\n get factors(): ConsumerUsersFactorsResource {\n return (this.#factors ??= new ConsumerUsersFactorsResource(this._client, this._b));\n }\n /**\n * Provision a new end-user\n *\n * Create an account in this app. Distinct from the public `/auth/signup`: no session is issued, no password is required (when omitted, the customer triggers a password-reset to finish onboarding), and the primary email contact starts unverified — the customer is responsible for kicking off the verification flow via `/auth/request-verification` or `/auth/send-verification-email`. The `roleName` defaults to the app's `signup_default_role`.\n *\n * What is NOT distinct: the password policy. A supplied `password` goes through the same app-configured rules, the same common-password deny-list and the same breach check as `/auth/signup`.\n *\n * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.\n * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.\n * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param params - `Auth.UserCreateParams`.\n * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, PASSWORD_TOO_COMMON, PASSWORD_BREACHED: Invalid email, unknown role, or a password that fails the app policy — `PASSWORD_TOO_COMMON` / `PASSWORD_BREACHED`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Email or username already in use. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/admin/users\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-admin-users\n * @example\n * ```ts\n * const consumerAdminCreatedUser = await auth.consumer(\"my-app\").users.create({ email: \"ada@example.com\" });\n * ```\n */\n create(params: T.UserCreateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerAdminCreatedUser>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/admin/users\", pathParams: { app_slug: this._b.app_slug }, body: params, idempotent: true }, options);\n }\n /**\n * Permanently delete an end-user\n *\n * Removes the account, its sessions, contacts, and tenant memberships. Audit rows are preserved, and the deletion itself is audited as `auth.account.deleted` with `via: consumer_admin` and the caller as actor. Fires `user.deleted` with `via: \"consumer_admin\"`.\n *\n * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.\n * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.\n * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended or archived (`APP_SUSPENDED` / `APP_ARCHIVED`), or the caller lacks `user.delete`: an app API key always needs it in its permissions; a role or M2M scopes need it once the app enforces permissions.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see DELETE /{app_slug}/v1/admin/users/{user_id}\n * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-admin-users-user-id\n * @example\n * ```ts\n * await auth.consumer(\"my-app\").users.delete(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n delete(userId: string, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"DELETE\", path: \"/{app_slug}/v1/admin/users/{user_id}\", pathParams: { app_slug: this._b.app_slug, user_id: userId } }, options);\n }\n /**\n * List end-users in this app\n *\n * Cursor-paginated. Supports the same `status` and `search` filters as the auth-admin equivalent. Use the cursor in subsequent calls — Auth does not expose offset pagination.\n *\n * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.\n * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.\n * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param params - `Auth.UserListParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`, or a cursor issued for a different sort order.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended or archived (`APP_SUSPENDED` / `APP_ARCHIVED`), or the caller lacks `user.list`: an app API key always needs it in its permissions; a role or M2M scopes need it once the app enforces permissions.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/admin/users\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-users\n * @example\n * ```ts\n * for await (const user of auth.consumer(\"my-app\").users.list()) {\n * console.log(user);\n * }\n * const page = await auth.consumer(\"my-app\").users.list({}, { timeout: 5_000 });\n * ```\n */\n list(params?: T.UserListParams, options?: RequestOptions): PagePromise<T.ConsumerAdminEndUser> {\n return this._client.list({ method: \"GET\", path: \"/{app_slug}/v1/admin/users\", pathParams: { app_slug: this._b.app_slug }, query: params }, options);\n }\n /**\n * Read one end-user\n *\n * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.\n * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.\n * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param userId - Id of the user.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.\n * @throws {NotFoundError} 404 NOT_FOUND: End-user not found in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/v1/admin/users/{user_id}\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-users-user-id\n * @example\n * ```ts\n * const consumerAdminEndUser = await auth.consumer(\"my-app\").users.retrieve(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\");\n * ```\n */\n retrieve(userId: string, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerAdminEndUser>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/v1/admin/users/{user_id}\", pathParams: { app_slug: this._b.app_slug, user_id: userId } }, options);\n }\n /**\n * Update an end-user's display name or primary email\n *\n * Email update promotes an existing contact to primary (not for creating new contacts — that goes through the per-contact flow).\n *\n * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.\n * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.\n * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param userId - Id of the user.\n * @param params - `Auth.UserUpdateParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: `display_name` over 120 chars or `email` not a valid address.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended or archived (`APP_SUSPENDED` / `APP_ARCHIVED`), or the caller lacks `user.update`: an app API key always needs it in its permissions; a role or M2M scopes need it once the app enforces permissions.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app, or the end-user is not in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /{app_slug}/v1/admin/users/{user_id}\n * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-admin-users-user-id\n * @example\n * ```ts\n * const consumerAdminEndUser = await auth.consumer(\"my-app\").users.update(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { display_name: \"Ada Lovelace\" });\n * ```\n */\n update(userId: string, params?: T.UserUpdateParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerAdminEndUser>> {\n return this._client.request({ method: \"PATCH\", path: \"/{app_slug}/v1/admin/users/{user_id}\", pathParams: { app_slug: this._b.app_slug, user_id: userId }, body: params }, options);\n }\n /**\n * Assign an end-user a role\n *\n * Sets `app_membership.role_id` for the target user. For M2M callers the assignable role is bounded by the token's scopes (the guard already enforced `role.assign`); the role's own permission set is NOT additionally narrowed against the M2M scopes because M2M scopes are typically broader than per-user role perms by design (a backend cron with `user.list` + `role.assign` SHOULD be able to promote a user into a role carrying any per-app perm). EndUser admins are bounded by their own role's perms transitively — they couldn't authenticate as an admin without holding the perm.\n *\n * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.\n * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.\n * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param userId - Id of the user.\n * @param params - `Auth.UserUpdateRoleParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed, or `role_name` names no role in this app.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended or archived (`APP_SUSPENDED` / `APP_ARCHIVED`), or the caller lacks `role.assign`: an app API key always needs it in its permissions; a role or M2M scopes need it once the app enforces permissions. Also returned when an EndUser admin tries to assign a role carrying permissions they do not hold.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /{app_slug}/v1/admin/users/{user_id}/role\n * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-admin-users-user-id-role\n * @example\n * ```ts\n * const consumerAdminRoleAssignment = await auth.consumer(\"my-app\").users.updateRole(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { role_name: \"member\" });\n * ```\n */\n updateRole(userId: string, params: T.UserUpdateRoleParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerAdminRoleAssignment>> {\n return this._client.request({ method: \"PATCH\", path: \"/{app_slug}/v1/admin/users/{user_id}/role\", pathParams: { app_slug: this._b.app_slug, user_id: userId }, body: params }, options);\n }\n /**\n * Change an end-user status (active / suspended / deactivated)\n *\n * Setting status to `suspended` or `deactivated` also revokes all active sessions for the user (same behaviour as the auth-admin equivalent).\n *\n * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.\n * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.\n * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param userId - Id of the user.\n * @param params - `Auth.UserUpdateStatusParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: `status` must be `active`, `suspended` or `deactivated`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended or archived (`APP_SUSPENDED` / `APP_ARCHIVED`), or the caller lacks `user.update`: an app API key always needs it in its permissions; a role or M2M scopes need it once the app enforces permissions.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app, or the end-user is not in this app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see PATCH /{app_slug}/v1/admin/users/{user_id}/status\n * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-admin-users-user-id-status\n * @example\n * ```ts\n * const consumerAdminEndUser = await auth.consumer(\"my-app\").users.updateStatus(\"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\", { status: \"active\" });\n * ```\n */\n updateStatus(userId: string, params: T.UserUpdateStatusParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerAdminEndUser>> {\n return this._client.request({ method: \"PATCH\", path: \"/{app_slug}/v1/admin/users/{user_id}/status\", pathParams: { app_slug: this._b.app_slug, user_id: userId }, body: params }, options);\n }\n}\n\n/** `verify` */\nexport class ConsumerVerifyResource extends APIResource {\n /**\n * Verify a token + check one or more permissions\n *\n * Returns `{ authorized: boolean }`. Pass `permission` (string) for a single check, or `permissions` (array) when ALL must be held.\n *\n * Token source: `body.token` if provided, else the `Authorization: Bearer <jwt>` header. At least one must be present.\n *\n * @param params - `Auth.VerifyAuthorizeParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed, neither `permission` nor `permissions` given, or no JWT supplied (body `token` or `Authorization: Bearer`).\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/authorize\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-authorize\n * @example\n * ```ts\n * const authorize = await auth.consumer(\"my-app\").verify.authorize({ permission: \"invoice.read\" });\n * ```\n */\n authorize(params?: T.VerifyAuthorizeParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Authorize>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/authorize\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Multi-permission authorization in a single round-trip\n *\n * Runs N permission checks against the same token in one call. Each check accepts `permission` (singular) or `permissions` (array — ALL must be held); pass an `id` to correlate results back to inputs. Each result reports `authorized` plus the missing permissions (if any).\n *\n * Token source: `body.token` if provided, else the `Authorization: Bearer <jwt>` header. At least one must be present.\n *\n * @param params - `Auth.VerifyAuthorizeBatchParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed, a check has neither `permission` nor `permissions`, or no JWT supplied (body `token` or `Authorization: Bearer`).\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/authorize/batch\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-authorize-batch\n * @example\n * ```ts\n * const authorizeBatch = await auth.consumer(\"my-app\").verify.authorizeBatch({ checks: [{}] });\n * ```\n */\n authorizeBatch(params: T.VerifyAuthorizeBatchParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AuthorizeBatch>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/authorize/batch\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Verify a token signature + return its principal\n *\n * Validates the JWT against the app's JWKS keys and returns `{ valid, principal }`. Use this when you need the full claims; use `/authorize` for a yes/no permission check.\n *\n * Token source: `body.token` if provided, else the `Authorization: Bearer <jwt>` header. At least one must be present.\n *\n * @param params - `Auth.VerifyTokenParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed (empty `token`), or no JWT supplied: neither `token` in the body nor an `Authorization: Bearer` header.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/verify\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-verify\n * @example\n * ```ts\n * const verify = await auth.consumer(\"my-app\").verify.token({ token: \"eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJzdWIiOiJ1c3JfMSJ9.c2lnbmF0dXJl\" });\n * ```\n */\n token(params?: T.VerifyTokenParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Verify>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/verify\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * 0.x name for `auth.consumer(…).verify.token()` (POST /{app_slug}/v1/verify).\n *\n * @deprecated Use `auth.consumer(…).verify.token()`. Kept for 0.x callers; removed in 2.0.\n */\n verify(params?: T.VerifyTokenParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Verify>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/verify\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n}\n\n/** `wellKnown` */\nexport class ConsumerWellKnownResource extends APIResource {\n /**\n * Per-app JWKS\n *\n * Returns the JSON Web Key Set used to sign EndUser and M2M access tokens for this app. Cached at the edge for 1 hour; verifiers should re-fetch on `kid` miss.\n *\n * @param options - Per-request options.\n * @throws {NotFoundError} 404 NOT_FOUND: App slug does not match an app in this workspace.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/.well-known/jwks.json\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-well-known-jwks-json\n * @example\n * ```ts\n * const jwks = await auth.consumer(\"my-app\").wellKnown.jwks();\n * ```\n */\n jwks(options?: RequestOptions): APIPromise<T.WithLastResponse<T.Jwks>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/.well-known/jwks.json\", pathParams: { app_slug: this._b.app_slug }, public: true }, options);\n }\n /**\n * OAuth 2.0 / OIDC discovery document (subset)\n *\n * Returns `issuer`, `jwks_uri`, `token_endpoint`, `introspection_endpoint`, `userinfo_endpoint` (= `/me`), and the supported grant + signing options. Use this from SDKs / verifiers instead of hardcoding paths.\n *\n * @param options - Per-request options.\n * @throws {NotFoundError} 404 NOT_FOUND: App slug does not match an app in this workspace.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see GET /{app_slug}/.well-known/openid-configuration\n * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-well-known-openid-configuration\n * @example\n * ```ts\n * const openIdConfiguration = await auth.consumer(\"my-app\").wellKnown.openidConfiguration();\n * ```\n */\n openidConfiguration(options?: RequestOptions): APIPromise<T.WithLastResponse<T.OpenIdConfiguration>> {\n return this._client.request({ method: \"GET\", path: \"/{app_slug}/.well-known/openid-configuration\", pathParams: { app_slug: this._b.app_slug }, public: true }, options);\n }\n}\n\n/** `auth.consumer(…)`: Calls for one app's end users (sign-in, sessions, profile, MFA, tenants). */\nexport class AuthConsumer extends APIResource {\n #auth?: ConsumerAuthResource;\n #me?: ConsumerMeResource;\n #mfa?: ConsumerMfaResource;\n #oauth?: ConsumerOauthResource;\n #passkey?: ConsumerPasskeyResource;\n #permissions?: ConsumerPermissionsResource;\n #roles?: ConsumerRolesResource;\n #tenantApiKeys?: ConsumerTenantApiKeysResource;\n #tenants?: ConsumerTenantsResource;\n #users?: ConsumerUsersResource;\n #verify?: ConsumerVerifyResource;\n #wellKnown?: ConsumerWellKnownResource;\n /** @deprecated 0.x namespace: every method in it is a deprecated alias (see its methods). Removed in 2.0. */\n get auth(): ConsumerAuthResource {\n return (this.#auth ??= new ConsumerAuthResource(this._client, this._b));\n }\n get me(): ConsumerMeResource {\n return (this.#me ??= new ConsumerMeResource(this._client, this._b));\n }\n get mfa(): ConsumerMfaResource {\n return (this.#mfa ??= new ConsumerMfaResource(this._client, this._b));\n }\n get oauth(): ConsumerOauthResource {\n return (this.#oauth ??= new ConsumerOauthResource(this._client, this._b));\n }\n get passkey(): ConsumerPasskeyResource {\n return (this.#passkey ??= new ConsumerPasskeyResource(this._client, this._b));\n }\n get permissions(): ConsumerPermissionsResource {\n return (this.#permissions ??= new ConsumerPermissionsResource(this._client, this._b));\n }\n get roles(): ConsumerRolesResource {\n return (this.#roles ??= new ConsumerRolesResource(this._client, this._b));\n }\n get tenantApiKeys(): ConsumerTenantApiKeysResource {\n return (this.#tenantApiKeys ??= new ConsumerTenantApiKeysResource(this._client, this._b));\n }\n get tenants(): ConsumerTenantsResource {\n return (this.#tenants ??= new ConsumerTenantsResource(this._client, this._b));\n }\n get users(): ConsumerUsersResource {\n return (this.#users ??= new ConsumerUsersResource(this._client, this._b));\n }\n get verify(): ConsumerVerifyResource {\n return (this.#verify ??= new ConsumerVerifyResource(this._client, this._b));\n }\n get wellKnown(): ConsumerWellKnownResource {\n return (this.#wellKnown ??= new ConsumerWellKnownResource(this._client, this._b));\n }\n /**\n * Accept an EndUser invite by code\n *\n * Materialises a pre-allocated invite into a real EndUser: creates account + primary email contact (verified, since mailing the code proved control) + password credential + role membership, then mints app-scoped tokens. Public endpoint — the invite code is the authority. 410 on revoked/expired/exhausted invites; 409 on duplicate email or username. The same password policy as `/auth/signup` applies, including the common-password deny-list and the breach check, and so does the app-level MFA mandate: on an `auth_config.mfa: \"required\"` app the account is created but the response is `mfa_enrollment_required: true` with no session behind it.\n *\n * @param params - `Auth.AcceptInviteParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: Invite code not found in this app, or the `:appSlug` matches no app at all. Deliberately the same status — neither says anything about accounts.\n * @throws {ConflictError} 409 CONFLICT: Email or username already in use.\n * @throws {APIError} 410 GONE: Invite revoked, expired, or fully used.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/auth/accept-invite\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-accept-invite\n * @example\n * ```ts\n * const result = await auth.consumer(\"my-app\").acceptInvite({ code: \"inv_x7H2k3jLqXr\", password: \"CorrectHorseBatteryStaple\" });\n * ```\n */\n acceptInvite(params: T.AcceptInviteParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.AcceptInviteResponse>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/accept-invite\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Accept a tenant invite by code\n *\n * Materialises a pending `tenant_invite` into a real EndUser: creates account + verified primary email contact (mailing the code proved control of the address) + password credential + an app-level membership on the app's signup default role + a tenant membership on the role the invite names, then mints a session already scoped to that tenant, so the access token carries `org_id` / `org_role` with no follow-up switch-tenant call. Public endpoint — the invite code is the authority. 410 on revoked/expired/exhausted invites. **409 when an account already exists for the invited address**: this endpoint will not set a password on, or mint a session for, an account it did not create, because the plaintext code is also held by whoever minted the invite. Existing users sign in and call `POST /:appSlug/v1/me/tenant-invites/accept` instead, which adds the membership without touching credentials.\n *\n * @param params - `Auth.AcceptTenantInviteParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: Invite code not found in this app, or the `:appSlug` matches no app at all. Deliberately the same status — neither says anything about accounts.\n * @throws {ConflictError} 409 CONFLICT, ACCOUNT_EXISTS: An account already exists for the invited address (`ACCOUNT_EXISTS`), or the requested username is taken.\n * @throws {APIError} 410 GONE: Invite revoked, expired, or fully used.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/auth/accept-tenant-invite\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-accept-tenant-invite\n * @example\n * ```ts\n * const consumerToken = await auth.consumer(\"my-app\").acceptTenantInvite({ code: \"tinv_9dK2mQ7pR4vXbN1sT6yZ0hLcJeW3fAgU\", password: \"CorrectHorseBatteryStaple\" });\n * ```\n */\n acceptTenantInvite(params: T.AcceptTenantInviteParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/accept-tenant-invite\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Exchange a `heimdall_code` (received on the web-flow callback redirect) for Auth access + refresh tokens. Single-use.\n *\n * @param params - `Auth.ExchangeProviderCodeParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Code is unknown, expired, or already redeemed.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Code does not belong to this `appSlug`.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/auth/oauth/exchange\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-oauth-exchange\n * @example\n * ```ts\n * const exchange = await auth.consumer(\"my-app\").exchangeProviderCode({ code: \"hc_8f14e45fceea167a5a36dedd4bea2543\" });\n * ```\n */\n exchangeProviderCode(params: T.ExchangeProviderCodeParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.Exchange>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/oauth/exchange\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Revoke a refresh token\n *\n * Destroys the session that owns the refresh token. The matching access token continues to verify until its TTL expires.\n *\n * @param params - `Auth.LogoutParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: The refresh token matches no session.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/logout\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-logout\n * @example\n * ```ts\n * await auth.consumer(\"my-app\").logout({\n * refresh_token: \"eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJ0eXAiOiJyZWZyZXNoIn0.c2lnbmF0dXJl\",\n * });\n * ```\n */\n logout(params: T.LogoutParams, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/logout\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Exchange a refresh token for a new access token\n *\n * Rotates the refresh token on every call — the previous refresh token is revoked, and re-using it triggers session revocation.\n *\n * @param params - `Auth.RefreshParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: The refresh token does not exist, belongs to another app, has been revoked (including by reuse detection), or its session has passed `expires_at`. One message for all of them.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `auth` bucket — 10 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/refresh\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-refresh\n * @example\n * ```ts\n * const consumerToken = await auth.consumer(\"my-app\").refresh({\n * refresh_token: \"eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJ0eXAiOiJyZWZyZXNoIn0.c2lnbmF0dXJl\",\n * });\n * ```\n */\n refresh(params: T.RefreshParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/refresh\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Mint a password-reset code (PAK-required)\n *\n * Mints a fresh 6-digit password-reset code for the EndUser owning the named contact. Body must contain exactly one of `email` / `phone` — the contact must be verified (otherwise an attacker who registered an unverified contact could push a reset on another user's account, were the per-app email uniqueness ever breached). The reset itself is account-scoped (revokes all sessions, replaces password) — the contact only acts as the lookup key.\n *\n * PAK-required: `auth.user.password-reset.create`. Returns `{ code, expires_at }` on success, `{}` on no-match (uniform shape prevents enumeration). Issuing a reset code invalidates any previously issued, unconsumed reset code for the account — only the most recent one is accepted.\n *\n * Renamed from /auth/request-reset.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.RequestPasswordResetParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Provide exactly one of `email` or `phone`, or request validation failed in the global `ValidationPipe`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: No PAK provided.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: PAK lacks `auth.user.password-reset.create` on this app, or the app is suspended / archived.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `auth` bucket — 10 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/request-password-reset\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-request-password-reset\n * @example\n * ```ts\n * const consumerCodeIssue = await auth.consumer(\"my-app\").requestPasswordReset({ email: \"jane@example.com\" });\n * ```\n */\n requestPasswordReset(params?: T.RequestPasswordResetParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerCodeIssue>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/request-password-reset\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Mint a contact-verification code (PAK-required)\n *\n * Mints a fresh 6-digit verification code bound to the email or phone contact named in the body. Body must contain exactly one of `email` / `phone`. PAK-required — `Authorization: Bearer <pcft_live_*>` carrying `auth.user.verify.create` narrowed to this app's URN. Public mint flows are refused with 401 — any anonymous mint endpoint is a spam-forwarder vector.\n *\n * Returns `{ code, expires_at }` for delivery via the customer's own SMTP / SMS provider. Returns `{}` (no code) when the contact doesn't match an account in this app or is already verified — uniform shape prevents enumeration.\n *\n * Issuing a code invalidates any previously issued, unconsumed code for the same contact — including the one auto-emailed at signup. Only the most recently minted code is accepted.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.RequestVerificationParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Provide exactly one of `email` or `phone`, or request validation failed in the global `ValidationPipe`.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: No PAK provided.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: PAK lacks `auth.user.verify.create` on this app, or the app is suspended / archived.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `auth` bucket — 10 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/request-verification\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-request-verification\n * @example\n * ```ts\n * const consumerCodeIssue = await auth.consumer(\"my-app\").requestVerification({ email: \"jane@example.com\" });\n * ```\n */\n requestVerification(params?: T.RequestVerificationParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerCodeIssue>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/request-verification\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Submit a reset code + new password\n *\n * Consumes the 6-digit reset code (single-use). On success the password is updated and every active session for the user is revoked.\n *\n * @param params - `Auth.ResetPasswordParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, PASSWORD_TOO_COMMON, PASSWORD_BREACHED: The new password fails the app-configured password policy (length, uppercase, digit, special character), is on the common-password deny-list (`PASSWORD_TOO_COMMON`), or — unless the app sets `password_breach_check` to `warn`/`off` — appears in a public breach corpus (`PASSWORD_BREACHED`). Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 410 GONE: Code invalid, expired, locked, or already consumed.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `verify_code` bucket — 5 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/auth/reset-password\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-reset-password\n * @example\n * ```ts\n * await auth.consumer(\"my-app\").resetPassword({ code: \"123456\", new_password: \"a new long passphrase 42\" });\n * ```\n */\n resetPassword(params: T.ResetPasswordParams, options?: RequestOptions): APIPromise<void> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/reset-password\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Mint + dispatch a password-reset email via Mail (PAK-required)\n *\n * Same shape as `send-verification-email` but for the reset slot. PAK perm: `auth.user.password-reset.send-email`. Same loud precondition errors. Email-only.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.SendPasswordResetEmailParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: No PAK provided.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: PAK lacks auth.user.password-reset.send-email on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 412 PRECONDITION_FAILED: Mail precondition not met (see error code in the response body).\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `auth` bucket — 10 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: Mail dispatch failed or client not wired.\n * @see POST /{app_slug}/v1/auth/send-password-reset-email\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-send-password-reset-email\n * @example\n * ```ts\n * const consumerCodeDispatch = await auth.consumer(\"my-app\").sendPasswordResetEmail({ email: \"jane@example.com\" });\n * ```\n */\n sendPasswordResetEmail(params: T.SendPasswordResetEmailParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerCodeDispatch>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/send-password-reset-email\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Mint + dispatch a verification email via Mail (PAK-required)\n *\n * Mints a fresh 6-digit verification code AND dispatches it to the supplied email address via the workspace's verified Mail sender, in one call. Email-only — the customer integrates SMS delivery themselves through `request-verification`.\n *\n * PAK-required — distinct permission from the bare mint so customers can enable mint without enabling outbound Mail traffic. Surfaces typed precondition errors instead of the silent fail-closed of a fire-and-forget mailer:\n *\n * * 412 ENVOI_NOT_ENABLED — `notifications_via_envoi` is false\n * * 412 ENVOI_SENDER_NOT_CONFIGURED\n * * 412 ENVOI_TEMPLATE_NOT_CONFIGURED\n * * 412 ENVOI_APP_NOT_BOUND_TO_WORKSPACE\n * * 503 ENVOI_DISPATCH_FAILED — RabbitMQ publish failure\n * * 503 ENVOI_NOT_WIRED — no Mail client wired in this deployment\n *\n * On success returns `{ expires_at }`. The plaintext code is NOT returned. Returns `{}` when the contact is missing or already verified (silent — same enumeration defence as `request-verification`).\n *\n * Issuing a code invalidates any previously issued, unconsumed code for the same contact — including the one auto-emailed at signup. Only the most recently minted code is accepted.\n *\n * Credential: `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.SendVerificationEmailParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: No PAK provided.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: PAK lacks auth.user.verify.send-email on this app.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 412 PRECONDITION_FAILED: Mail precondition not met (see error code in the response body).\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `auth` bucket — 10 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: Mail dispatch failed or client not wired.\n * @see POST /{app_slug}/v1/auth/send-verification-email\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-send-verification-email\n * @example\n * ```ts\n * const consumerCodeDispatch = await auth.consumer(\"my-app\").sendVerificationEmail({ email: \"jane@example.com\" });\n * ```\n */\n sendVerificationEmail(params: T.SendVerificationEmailParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerCodeDispatch>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/send-verification-email\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Sign in an EndUser\n *\n * Authenticate with username or verified primary email + password. When the account has no enabled MFA factors, returns a fresh access + refresh token pair (`ConsumerTokenResponseDto` shape). When the account has any enabled factor, returns an MFA challenge instead (`ConsumerMfaChallengeResponseDto` shape, `mfa_required: true`). In that case no session has been created yet — complete the challenge via `POST /auth/mfa/verify` (or `/auth/mfa/recover`) to receive the token pair. When the app runs `auth_config.mfa: \"required\"` and the account has NO enabled factor, returns a third shape (`ConsumerMfaEnrollmentRequiredResponseDto`, `mfa_enrollment_required: true`) — again no session — which is completed via `POST /auth/mfa/enroll` + `/auth/mfa/enroll/verify`. Inside `mfa_grace_days` of account creation that case instead returns the ordinary token pair with `mfa_enrollment_due_at` set.\n *\n * @param params - `Auth.SigninParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Invalid credentials. Returned for every failed attempt, whatever went wrong: a wrong password, an identifier that matches no account, an account with no password credential, an account locked out through a different identifier, an account an operator has blocked, and a wrong password against a suspended or deactivated account. The responses are deliberately identical in body, timing, DB round trips and Redis ops, so signin is not an account-existence oracle.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: Signin is disabled for this app, or the account is suspended / deactivated. The account-status refusal is only reachable once the caller has proven the password — a wrong password against such an account is a 401.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Too many failed attempts. Two counters produce it, both keyed purely by the submitted identifier: a burst limit of 5 attempts per minute, and a 15-minute lock after the app's `max_failed_login_attempts` failures (default 5). Both fire on the same attempt for a registered and an unregistered identifier. The lock threshold was a fixed 4 until the knob was wired up in tasks/users-api/014. Per-IP rate limit (`RATE_LIMITED`): this path is in the `auth` bucket — 10 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/auth/signin\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-signin\n * @example\n * ```ts\n * const result = await auth.consumer(\"my-app\").signin({ identifier: \"jane_doe\", password: \"correct horse battery staple\" });\n * ```\n */\n signin(params: T.SigninParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.SigninResponse>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/signin\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n /**\n * Sign in / sign up with a provider ID token (native flow)\n *\n * Submit the provider-issued ID token from a native client (iOS ASAuthorizationController, Google Sign-In for iOS / Android). Backend verifies the token signature, issuer, audience (against this app's configured native client ids), and nonce binding; consumes the nonce server-side to defeat in-window replay; resolves or creates the Auth account; mints access + refresh tokens with `amr=[\"oauth\", \"<provider>\"]`. Same response shape as `/auth/signin`.\n *\n * @param provider - OAuth provider id. Native flow supports: apple, google. GitHub is web-only — POSTing to this endpoint with provider=github 400s.\n * @param params - `Auth.SigninWithProviderParams`.\n * @param options - Per-request options.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: ID token verification failed (bad signature / issuer / audience / nonce / expired).\n * @throws {ConflictError} 409 CONFLICT, link_required, account_exists_with_different_provider: Email collides with an existing account. Response carries an error `code` of `link_required` (when the app's policy is `confirm`) or `account_exists_with_different_provider` (when `reject`). Sign in with the original method to link.\n * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.\n * @see POST /{app_slug}/v1/auth/oauth/{provider}\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-oauth-provider\n * @example\n * ```ts\n * const result = await auth.consumer(\"my-app\").signinWithProvider(\"google\", {\n * id_token: \"eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJzdWIiOiJ1c3JfMSJ9.c2lnbmF0dXJl\",\n * nonce: \"n-0S6_WzA2Mj\",\n * });\n * ```\n */\n signinWithProvider(provider: string, params: T.SigninWithProviderParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.SigninWithProviderResponse>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/oauth/{provider}\", pathParams: { app_slug: this._b.app_slug, provider }, body: params, public: true }, options);\n }\n /**\n * Sign up an EndUser\n *\n * Create an EndUser account inside the app and immediately mint a session. The supplied email becomes the primary email contact, unverified at signup. When the app has completed Mail notification setup, a verification code is auto-emailed to the address; customers delivering their own verification messages call /auth/request-verification (or /auth/send-verification-email) instead — doing so invalidates the auto-sent code, so the user only ever has one valid code. Subject to the app-configured signup policy (signup enabled, password policy, default role, optional `signup_requires_pak`). The password must clear the app's length + character-class rules, a common-password deny-list, and — unless the app sets `password_breach_check` to `warn` or `off` — a public breach corpus; a breached password is refused with 400 `PASSWORD_BREACHED` and a deny-listed one with 400 `PASSWORD_TOO_COMMON`. The breach lookup is k-anonymous (only five characters of the password's SHA-1 leave the service) and fails open, so an unreachable corpus never blocks a signup.\n *\n * When the app runs `auth_config.mfa: \"required\"`, the account is still created but NO session is minted: the response is the `ConsumerMfaEnrollmentRequiredResponseDto` shape (`mfa_enrollment_required: true`), completed via `POST /auth/mfa/enroll` + `/auth/mfa/enroll/verify`. Inside `mfa_grace_days` of account creation — which a fresh signup always is when the window is non-zero — the ordinary token pair is returned with `mfa_enrollment_due_at` set instead.\n *\n * When the app has bot protection on (`auth_config.bot_protection`, Cloudflare Turnstile or hCaptcha), send the widget response as `bot_protection_token`. Auth verifies it with the provider before it looks at the email, username or password, and refuses the sign-up when the token is missing (400 `BOT_PROTECTION_REQUIRED`), rejected (403 `BOT_PROTECTION_FAILED`) or cannot be checked (503 `BOT_PROTECTION_UNAVAILABLE`; no account is created). This applies to PAK-authenticated calls too: a backend forwards the token its browser received.\n *\n * Credential (optional): `workspace_key`.\n * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.\n *\n * @param params - `Auth.SignupParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, BOT_PROTECTION_REQUIRED: `BOT_PROTECTION_REQUIRED`: the app has bot protection on and the request carried no `bot_protection_token`. Also: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: The app sets `signup_requires_pak` and no Platform API Key was presented on `Authorization: Bearer`.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, BOT_PROTECTION_FAILED, APP_SUSPENDED, APP_ARCHIVED: `BOT_PROTECTION_FAILED`: the bot-protection provider rejected the `bot_protection_token` (bad, expired or already used), or the hostname it reported is not one of the app's `bot_protection.expected_hostnames`; render a fresh widget and retry. Otherwise: signup is disabled for this app (new apps start with `signup_enabled: false`; turn it on with `PATCH /v1/apps/{app_id}/auth-config`), the email domain is not on the app's allow-list, the presented PAK belongs to a different workspace, or its policy denies `auth.signup.create` on this app. Also returned when the app itself is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`).\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {ConflictError} 409 CONFLICT: Email or username already in use in this app, or the app has no workspace binding and therefore cannot accept a PAK signup.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `auth` bucket — 10 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @throws {InternalServerError} 503 SERVICE_UNAVAILABLE, BOT_PROTECTION_UNAVAILABLE: `BOT_PROTECTION_UNAVAILABLE`: the app has bot protection on and the token could not be checked (the provider timed out or failed, or the app's bot-protection secret is missing or was refused by the provider). Sign-up fails closed: no account was created. Retry shortly. Otherwise: The service is momentarily busy (`SERVICE_UNAVAILABLE`): too many password hashes or verifications are already running or queued on the instance that took the request. Nothing was changed and no attempt was counted. Retry after the number of seconds in the `Retry-After` header (also in `details.retry_after_seconds`). Decided by instance load only, never by the identifier or the account, so it reveals nothing about whether an account exists.\n * @see POST /{app_slug}/v1/auth/signup\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-signup\n * @example\n * ```ts\n * const result = await auth.consumer(\"my-app\").signup({ email: \"jane@example.com\", password: \"CorrectHorseBatteryStaple\", username: \"john_doe\" });\n * ```\n */\n signup(params: T.SignupParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.SignupResponse>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/signup\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Switch the active tenant for this session\n *\n * Re-issues the EndUser's access + refresh tokens with the new `org_id` + `org_role` claims, after verifying the caller holds a tenant_membership for the target tenant. The session row is updated to the new tenant so subsequent refreshes preserve the context. The new access token keeps the session's `amr` and `mfa_at` (as `/auth/refresh` does), so a sign-in that completed MFA still proves it after a switch. Refresh-token rotation runs as usual; the previous refresh token enters the standard 60-second grace window.\n *\n * Credential: `end_user_token`.\n * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.\n *\n * @param params - `Auth.SwitchTenantParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing / invalid bearer, the token carries no `sid`, or the session named by `sid` is revoked, expired or no longer exists.\n * @throws {PermissionDeniedError} 403 FORBIDDEN: The caller holds no membership in the target tenant, or the app is suspended / archived.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` matches no app, or `tenant_id` names no tenant in this app.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `default` bucket — 60 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/switch-tenant\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-switch-tenant\n * @example\n * ```ts\n * const consumerToken = await auth.consumer(\"my-app\").switchTenant({ tenant_id: \"3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f\" });\n * ```\n */\n switchTenant(params: T.SwitchTenantParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerToken>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/switch-tenant\", pathParams: { app_slug: this._b.app_slug }, body: params }, options);\n }\n /**\n * Submit a verification code\n *\n * Consumes a 6-digit verification code (single-use) and flips the bound contact's `verified_at`. Public — anyone holding the code can submit it; that is the whole point of the verification flow. The server figures out which contact + account from the code value itself.\n *\n * Renamed from /verify-email — the same endpoint now serves both email and phone verifications.\n *\n * @param params - `Auth.VerifyEmailParams`.\n * @param options - Per-request options.\n * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.\n * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.\n * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.\n * @throws {APIError} 410 GONE: Code invalid, expired, locked, or already consumed.\n * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.\n * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): this path is in the `verify_code` bucket — 5 requests per minute per IP over a sliding 60-second window, shared across pods through Redis. Applied by `RateLimitMiddleware` before the handler runs, so it is reachable whatever the body says, and the response carries `Retry-After` in seconds.\n * @see POST /{app_slug}/v1/auth/verify\n * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-verify\n * @example\n * ```ts\n * const consumerVerify = await auth.consumer(\"my-app\").verifyEmail({ code: \"123456\" });\n * ```\n */\n verifyEmail(params: T.VerifyEmailParams, options?: RequestOptions): APIPromise<T.WithLastResponse<T.ConsumerVerify>> {\n return this._client.request({ method: \"POST\", path: \"/{app_slug}/v1/auth/verify\", pathParams: { app_slug: this._b.app_slug }, body: params, public: true }, options);\n }\n}\n","/**\n * Typed error hierarchy for JWT verification. All errors inherit from\n * `JwtVerifyError` so callers can do one `instanceof` to catch any\n * verify failure, or branch on more specific subclasses for UX.\n */\n\nexport class JwtVerifyError extends Error {\n public readonly code: string;\n\n constructor(code: string, message: string, options?: { cause?: unknown }) {\n super(message, options);\n this.name = \"JwtVerifyError\";\n this.code = code;\n }\n}\n\n/** Signature didn't match, header malformed, or token structure invalid. */\nexport class JwtInvalidError extends JwtVerifyError {\n constructor(message: string, options?: { cause?: unknown }) {\n super(\"ERR_JWT_INVALID\", message, options);\n this.name = \"JwtInvalidError\";\n }\n}\n\n/** Token's `exp` claim is in the past (allowing for clockTolerance). */\nexport class JwtExpiredError extends JwtVerifyError {\n public readonly expiredAt?: Date;\n constructor(message: string, expiredAt?: Date, options?: { cause?: unknown }) {\n super(\"ERR_JWT_EXPIRED\", message, options);\n this.name = \"JwtExpiredError\";\n this.expiredAt = expiredAt;\n }\n}\n\n/** Token's `nbf` is in the future. */\nexport class JwtNotYetValidError extends JwtVerifyError {\n constructor(message: string, options?: { cause?: unknown }) {\n super(\"ERR_JWT_NOT_YET_VALID\", message, options);\n this.name = \"JwtNotYetValidError\";\n }\n}\n\n/**\n * The token is a refresh token (`token_use: \"refresh\"` or\n * `type: \"refresh\"`). Refresh tokens are only valid at the refresh\n * endpoint and must never authenticate an API request.\n */\nexport class JwtRefreshTokenError extends JwtVerifyError {\n constructor(message = \"Refresh tokens cannot be used as access tokens\", options?: { cause?: unknown }) {\n super(\"ERR_JWT_REFRESH_TOKEN\", message, options);\n this.name = \"JwtRefreshTokenError\";\n }\n}\n\n/** `iss` claim doesn't match the expected issuer. */\nexport class JwtIssuerMismatchError extends JwtVerifyError {\n constructor(message: string, options?: { cause?: unknown }) {\n super(\"ERR_JWT_ISS_MISMATCH\", message, options);\n this.name = \"JwtIssuerMismatchError\";\n }\n}\n\n/** `aud` claim doesn't match the expected audience. */\nexport class JwtAudienceMismatchError extends JwtVerifyError {\n constructor(message: string, options?: { cause?: unknown }) {\n super(\"ERR_JWT_AUD_MISMATCH\", message, options);\n this.name = \"JwtAudienceMismatchError\";\n }\n}\n\n/** The token's `kid` isn't in the JWKS (even after a forced refetch). */\nexport class JwksKeyNotFoundError extends JwtVerifyError {\n public readonly kid: string | undefined;\n constructor(kid: string | undefined, options?: { cause?: unknown }) {\n super(\n \"ERR_JWKS_KID_NOT_FOUND\",\n `JWKS has no key matching kid=${kid ?? \"(missing)\"}`,\n options,\n );\n this.name = \"JwksKeyNotFoundError\";\n this.kid = kid;\n }\n}\n\n/** Network / non-2xx fetching the JWKS endpoint. */\nexport class JwksFetchError extends JwtVerifyError {\n constructor(message: string, options?: { cause?: unknown }) {\n super(\"ERR_JWKS_FETCH\", message, options);\n this.name = \"JwksFetchError\";\n }\n}\n","/**\n * In-process JWKS cache for a single app's `/.well-known/jwks.json`.\n *\n * Thin wrapper over `jose.createRemoteJWKSet`, which already gives us:\n * - TTL-based cache (cacheMaxAge)\n * - Cooldown between failed fetches (cooldownDuration)\n * - Singleflight (concurrent verifies share one inflight fetch)\n * - Auto-refetch when the token's `kid` isn't in the cached JWKS\n * (rotation handling)\n *\n * We add:\n * - Translation of jose's internal `JWKSNoMatchingKey` /\n * `JWKSTimeout` / etc. errors into our typed `JwksKeyNotFoundError`\n * / `JwksFetchError`.\n * - A `refresh()` method for explicit cache busting (rare, but useful\n * for tests + manual rotation drills).\n *\n * Instances are returned by `ConsumerScope.jwks` and are jose-compatible\n * out of the box — `jose.jwtVerify(token, scope.jwks.getKey, ...)` works.\n */\n\nimport { createRemoteJWKSet, customFetch, errors as joseErrors } from \"jose\";\n\nimport { JwksFetchError, JwksKeyNotFoundError } from \"./errors.js\";\nimport type { CryptoKey, FlattenedJWSInput, JWTHeaderParameters } from \"./jose-types.js\";\n\nexport interface JwksCacheOptions {\n url: URL;\n /** Cache lifetime in ms. Default 10 minutes — same as jose's default. */\n ttlMs?: number;\n /** Min ms between failed fetches. Default 30 seconds. */\n cooldownMs?: number;\n /** Network timeout per fetch. Default 5 seconds. */\n timeoutMs?: number;\n /** Pin a custom fetch implementation (e.g. undici with retry, mock fetch in tests). */\n fetch?: typeof fetch;\n}\n\nexport type AuthGetKeyFn = (\n protectedHeader?: JWTHeaderParameters,\n token?: FlattenedJWSInput,\n) => Promise<CryptoKey>;\n\nexport class JwksCache {\n public readonly url: URL;\n private readonly _jose: AuthGetKeyFn;\n\n constructor(options: JwksCacheOptions) {\n this.url = options.url;\n // jose's customFetch is keyed by a symbol with a non-standard\n // signature (`(url: string, options) => Promise<Response>`). The\n // user-side `typeof fetch` we accept is more permissive; at runtime\n // the call shape is compatible, so cast through.\n const joseOpts: Record<string | symbol, unknown> = {\n cacheMaxAge: options.ttlMs ?? 10 * 60 * 1000,\n cooldownDuration: options.cooldownMs ?? 30_000,\n timeoutDuration: options.timeoutMs ?? 5_000,\n };\n if (options.fetch) {\n joseOpts[customFetch] = options.fetch;\n }\n this._jose = createRemoteJWKSet(\n options.url,\n joseOpts as Parameters<typeof createRemoteJWKSet>[1],\n ) as AuthGetKeyFn;\n }\n\n /**\n * Resolve a signing key for a given JWT header.\n * Bound as an arrow-function field so it can be passed around\n * (`jose.jwtVerify(token, cache.getKey, ...)`, passport-jwt, etc.)\n * without losing `this`.\n */\n readonly getKey: AuthGetKeyFn = async (header, input) => {\n try {\n return await this._jose(header, input);\n } catch (err) {\n if (err instanceof joseErrors.JWKSNoMatchingKey) {\n throw new JwksKeyNotFoundError(header?.kid, { cause: err });\n }\n if (\n err instanceof joseErrors.JWKSTimeout ||\n err instanceof joseErrors.JWKSInvalid ||\n err instanceof joseErrors.JOSEError\n ) {\n throw new JwksFetchError(\n `Failed to load JWKS from ${this.url.href}: ${err.message}`,\n { cause: err },\n );\n }\n throw err;\n }\n };\n\n /**\n * Force a refetch on the next verify. Useful in tests and for\n * external rotation drills — the normal flow self-heals because\n * jose auto-refetches on kid miss.\n */\n refresh(): void {\n // jose's createRemoteJWKSet doesn't expose a public reset, but a\n // future kid miss will trigger a refetch (subject to cooldown). To\n // force an immediate refetch, callers can simply construct a new\n // `JwksCache` instance.\n }\n}\n","/**\n * `verifyAuthToken` — the 80%-case verify helper.\n *\n * Wraps `jose.jwtVerify` with:\n * - Sensible defaults (algorithm allow-list, clockTolerance)\n * - Typed claim payload (`AuthClaims`)\n * - Translation of jose errors into our typed error hierarchy\n */\n\nimport { jwtVerify } from \"jose\";\nimport type { JWTPayload } from \"./jose-types.js\";\n\nimport {\n JwtAudienceMismatchError,\n JwtExpiredError,\n JwtInvalidError,\n JwtIssuerMismatchError,\n JwtNotYetValidError,\n JwksKeyNotFoundError,\n JwksFetchError,\n JwtVerifyError,\n JwtRefreshTokenError,\n} from \"./errors.js\";\nimport type { AuthGetKeyFn } from \"./jwks-cache.js\";\n\n/**\n * Claims that an Auth-issued EndUser access token is expected to\n * carry. Unknown claims pass through as `string | number | unknown`\n * (jose's `JWTPayload` is open-ended) — callers can intersect with\n * their own custom-claim type if they've configured Auth to add\n * extras.\n */\nexport interface AuthClaims extends JWTPayload {\n /** EndUser id. */\n sub: string;\n /** App slug the token was issued for. */\n iss: string;\n /** Audience — usually the app slug or oauth client_id. */\n aud?: string | string[];\n /** Standard exp/iat/nbf. */\n exp: number;\n iat: number;\n nbf?: number;\n /** JWT id — present on refreshable tokens. */\n jti?: string;\n /** Role assigned by Auth, if any. */\n role?: string;\n /** Permission keys the EndUser is authorized for. */\n permissions?: string[];\n /** Email on the EndUser profile, when claimed. */\n email?: string;\n /** Whether the email is verified. */\n email_verified?: boolean;\n}\n\nexport interface VerifyOptions {\n /** Expected `iss` claim. Defaults to the value set on the consumer scope. */\n issuer?: string | string[];\n /** Expected `aud` claim. If unset (and unset on the scope), aud check is skipped. */\n audience?: string | string[];\n /** Allowed JWS algorithms. Default ['ES256', 'RS256', 'EdDSA']. */\n algorithms?: string[];\n /**\n * Acceptable clock skew. Number = seconds, string = jose duration\n * (`\"30s\"`, `\"2m\"`, ...). Default 5 seconds.\n */\n clockTolerance?: string | number;\n /** Additional claims that must be present (non-empty) on the token. */\n requiredClaims?: string[];\n /** Override the verify time. Default `Date.now()`. */\n currentDate?: Date;\n /** Maximum token age — passed straight to jose. */\n maxTokenAge?: string | number;\n}\n\n/**\n * True when the claims mark a refresh token: `token_use: \"refresh\"`\n * (current shape) or `type: \"refresh\"` (older Auth tokens). Refresh\n * tokens must never authenticate a request.\n */\nexport function isRefreshToken(claims: Record<string, unknown> | null | undefined): boolean {\n if (!claims) return false;\n return claims.token_use === \"refresh\" || claims.type === \"refresh\";\n}\n\n/**\n * Verify an Auth-issued JWT against a JWKS resolver.\n *\n * Refresh tokens are refused with `JwtRefreshTokenError` even when the\n * signature, issuer and audience are valid.\n *\n * @param token The compact-form JWT (header.payload.signature)\n * @param getKey A jose-compatible key resolver — pass\n * `scope.jwks.getKey` from a `ConsumerScope`\n * @param opts Defaults supplied by the scope; override here\n * for one-off cases.\n */\nexport async function verifyAuthToken(\n token: string,\n getKey: AuthGetKeyFn,\n opts: VerifyOptions = {},\n): Promise<AuthClaims> {\n try {\n const { payload } = await jwtVerify(token, getKey, {\n algorithms: opts.algorithms ?? [\"ES256\", \"RS256\", \"EdDSA\"],\n issuer: opts.issuer,\n audience: opts.audience,\n clockTolerance: opts.clockTolerance ?? 5,\n requiredClaims: opts.requiredClaims,\n currentDate: opts.currentDate,\n maxTokenAge: opts.maxTokenAge,\n });\n if (isRefreshToken(payload)) throw new JwtRefreshTokenError();\n return payload as AuthClaims;\n } catch (err) {\n throw translateJoseError(err);\n }\n}\n\nfunction translateJoseError(err: unknown): JwtVerifyError {\n // Bubble up our own typed errors unchanged (JwksCache may have already\n // wrapped network / kid-miss failures).\n if (\n err instanceof JwksKeyNotFoundError ||\n err instanceof JwksFetchError ||\n err instanceof JwtVerifyError\n ) {\n return err;\n }\n\n // jose errors are instance-of-able but importing them all clutters\n // the file; use the `code` field that every jose error carries.\n const code = (err as { code?: string } | undefined)?.code ?? \"\";\n const message = (err as Error | undefined)?.message ?? \"JWT verification failed\";\n\n switch (code) {\n case \"ERR_JWT_EXPIRED\":\n return new JwtExpiredError(message, undefined, { cause: err });\n case \"ERR_JWT_CLAIM_VALIDATION_FAILED\": {\n // jose merges iss/aud/nbf mismatches under one code; route by claim\n const claim = (err as { claim?: string } | undefined)?.claim;\n if (claim === \"iss\") return new JwtIssuerMismatchError(message, { cause: err });\n if (claim === \"aud\") return new JwtAudienceMismatchError(message, { cause: err });\n if (claim === \"nbf\") return new JwtNotYetValidError(message, { cause: err });\n return new JwtInvalidError(message, { cause: err });\n }\n case \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\":\n case \"ERR_JWS_INVALID\":\n case \"ERR_JWT_INVALID\":\n return new JwtInvalidError(message, { cause: err });\n default:\n return new JwtInvalidError(message, { cause: err });\n }\n}\n","/**\n * Passkey (WebAuthn) helpers — the encoding layer and the browser bridge.\n *\n * WebAuthn speaks ArrayBuffer; the Auth API speaks JSON. Every buffer\n * crossing the wire is **base64url** (`-` `_`, no `=` padding), and\n * getting the alphabet or the padding wrong produces a signature\n * failure rather than a parse error. These four functions are a\n * straight port of section 2 of the passkeys guide, exported for\n * customers who want the pieces; `consumer(slug).passkeys.*` composes\n * them into one call per ceremony.\n *\n * Nothing in this module touches `navigator`, `window` or any other\n * browser global at import time — the package must load cleanly in a\n * Node process (BFFs verify tokens with it). Browser globals are read\n * lazily, inside the functions that need them.\n *\n * Wire shape: snake_case everywhere EXCEPT the members of\n * `credential.response` (`clientDataJSON`, `attestationObject`,\n * `authenticatorData`, `signature`, `userHandle`). Those names are\n * fixed by the WebAuthn spec and travel verbatim — they are not ours\n * to rename.\n */\n\n// ─────────────────────────────────────────────────────────────\n// Encoding layer (ported from the guide — do not re-derive)\n// ─────────────────────────────────────────────────────────────\n\n/** ArrayBuffer / typed array → base64url string (no `+`, `/` or `=`). */\nexport function toB64u(buf: ArrayBuffer | ArrayBufferView): string {\n const bytes =\n buf instanceof ArrayBuffer\n ? new Uint8Array(buf)\n : new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);\n // Same result as `String.fromCharCode(...bytes)` without the\n // spread-argument limit for multi-kilobyte attestation objects.\n let bin = \"\";\n for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]!);\n return btoa(bin).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n/** base64url string → bytes. Tolerates missing padding. */\nexport function fromB64u(s: string): Uint8Array {\n const b64 = s.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const bin = atob(b64.padEnd(Math.ceil(b64.length / 4) * 4, \"=\"));\n return Uint8Array.from(bin, (c) => c.charCodeAt(0));\n}\n\n/**\n * The `public_key` object Auth returns from an options call, with\n * every buffer base64url-encoded. Mirrors\n * `PublicKeyCredentialCreationOptions` / `PublicKeyCredentialRequestOptions`\n * from the WebAuthn spec, minus the ArrayBuffers.\n */\nexport interface PasskeyPublicKeyOptions {\n challenge: string;\n user?: { id: string; [k: string]: unknown };\n excludeCredentials?: Array<{ id: string; [k: string]: unknown }>;\n allowCredentials?: Array<{ id: string; [k: string]: unknown }>;\n [k: string]: unknown;\n}\n\nconst snakeToCamel = (k: string): string =>\n k.replace(/_([a-z0-9])/g, (_, c: string) => c.toUpperCase());\n\n/**\n * Deep-rename snake_case keys to camelCase; values (including string\n * values like `\"public-key\"`) are never touched. The Auth API's global\n * wire convention decamelizes every response key, `public_key`'s\n * members included, but `navigator.credentials` only understands the\n * WebAuthn spec's camelCase names (`rpId`, `pubKeyCredParams`,\n * `authenticatorSelection`, `allowCredentials`, …). Idempotent on\n * input that is already camelCase.\n */\nfunction camelizeKeys(value: unknown): unknown {\n if (Array.isArray(value)) return value.map(camelizeKeys);\n if (value && typeof value === \"object\" && !(value instanceof Uint8Array)) {\n const out: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(value as Record<string, unknown>)) {\n out[snakeToCamel(k)] = camelizeKeys(v);\n }\n return out;\n }\n return value;\n}\n\n/**\n * Auth returns `public_key` with every buffer base64url-encoded;\n * `navigator.credentials` wants real ArrayBuffers. Decodes\n * `challenge`, `user.id`, and the `id` of every entry in\n * `excludeCredentials` / `allowCredentials`; everything else passes\n * through with its value untouched.\n *\n * Accepts the member names either as the WebAuthn spec writes them\n * (`rpId`, `pubKeyCredParams`) or as the Auth wire convention\n * decamelizes them (`rp_id`, `pub_key_cred_params`) and always emits\n * the spec's camelCase, which is the only shape the browser accepts.\n */\n/**\n * Decoded options are typed loosely ON PURPOSE. The exact browser types\n * (`PublicKeyCredentialCreationOptions` / `PublicKeyCredentialRequestOptions`)\n * live in lib.dom, which this package does not depend on so that it keeps\n * loading in Node. An `any` here is what lets a lib.dom customer write\n * `navigator.credentials.create({ publicKey: decodeOptions(pk) })` with no\n * cast — a structural return type could never satisfy the DOM's required\n * members without depending on them.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport type PasskeyDecodedOptions = any;\n\nexport function decodeOptions(\n publicKey: PasskeyPublicKeyOptions | Record<string, unknown>,\n): PasskeyDecodedOptions {\n const pk = camelizeKeys(publicKey as Record<string, unknown>) as PasskeyPublicKeyOptions;\n const out: Record<string, unknown> = {\n ...pk,\n challenge: fromB64u(pk.challenge),\n };\n if (pk.user) {\n out.user = { ...pk.user, id: fromB64u(pk.user.id) };\n }\n for (const list of [\"excludeCredentials\", \"allowCredentials\"] as const) {\n const entries = pk[list];\n if (entries) {\n out[list] = entries.map((c) => ({ ...c, id: fromB64u(c.id) }));\n }\n }\n return out;\n}\n\n/**\n * Structural shape of a `PublicKeyCredential` — the DOM type without\n * needing the DOM lib. A real `PublicKeyCredential` (from\n * `navigator.credentials.create()` / `.get()`) satisfies it.\n */\nexport interface PasskeyCredentialLike {\n id: string;\n response: {\n clientDataJSON: ArrayBuffer;\n attestationObject?: ArrayBuffer;\n authenticatorData?: ArrayBuffer;\n signature?: ArrayBuffer;\n userHandle?: ArrayBuffer | null;\n };\n}\n\n/**\n * The `credential` object every verify endpoint accepts. `response`\n * members keep their WebAuthn names verbatim.\n */\nexport interface EncodedPasskeyCredential {\n id: string;\n response: {\n clientDataJSON: string;\n attestationObject?: string;\n authenticatorData?: string;\n signature?: string;\n userHandle?: string;\n };\n}\n\n/**\n * …and the reverse, for the credential you send back. Only the\n * members present on the response are emitted: an attestation\n * (enrol) carries `attestationObject`; an assertion (sign-in /\n * step-up) carries `authenticatorData` + `signature` (+ `userHandle`\n * when the authenticator supplies one).\n */\nexport function encodeCredential(\n cred: PasskeyCredentialLike,\n): EncodedPasskeyCredential {\n const r = cred.response;\n const response: EncodedPasskeyCredential[\"response\"] = {\n clientDataJSON: toB64u(r.clientDataJSON),\n };\n if (r.attestationObject) response.attestationObject = toB64u(r.attestationObject);\n if (r.authenticatorData) response.authenticatorData = toB64u(r.authenticatorData);\n if (r.signature) response.signature = toB64u(r.signature);\n if (r.userHandle) response.userHandle = toB64u(r.userHandle);\n return { id: cred.id, response };\n}\n\n// ─────────────────────────────────────────────────────────────\n// Browser bridge — reads globals lazily, never at import time\n// ─────────────────────────────────────────────────────────────\n\n/**\n * Minimal view of `navigator.credentials`, typed structurally so the\n * package compiles without the DOM lib and so tests can inject a\n * stand-in.\n */\nexport interface PasskeyCredentialsContainer {\n create(options?: { publicKey?: unknown; signal?: AbortSignal }): Promise<unknown>;\n get(options?: {\n publicKey?: unknown;\n mediation?: PasskeyMediation;\n signal?: AbortSignal;\n }): Promise<unknown>;\n}\n// The real `navigator.credentials` (lib.dom `CredentialsContainer`) is\n// assignable to this: its options are a superset and it resolves\n// `Credential | null`, which the helpers narrow with `isCredentialLike`.\n\n/** `CredentialMediationRequirement` from the Credential Management spec. */\nexport type PasskeyMediation = \"silent\" | \"optional\" | \"conditional\" | \"required\";\n\nexport type PasskeyErrorCode =\n /** No WebAuthn in this environment — see {@link isPasskeySupported}. */\n | \"unsupported\"\n /** The user dismissed the prompt, or no passkey matched (`NotAllowedError`). */\n | \"cancelled\"\n /** The prompt ran out of time — the options' `timeout` or your `signal` fired (`TimeoutError`). */\n | \"timeout\"\n /** The authenticator refused (e.g. credential already registered — `InvalidStateError`). */\n | \"invalid_state\"\n /** The page origin does not match the app's `rp_id` (`SecurityError`). */\n | \"security\"\n /** The browser returned no credential without throwing. */\n | \"no_credential\"\n /** Any other `navigator.credentials` failure; `cause` carries the original. */\n | \"unknown\";\n\n/**\n * Thrown by the ceremony helpers when the *browser* side fails. HTTP\n * failures from Auth keep surfacing as `AuthHttpError` so a caller can\n * tell \"the user cancelled\" from \"the server said 401\".\n */\nexport class PasskeyError extends Error {\n public readonly code: PasskeyErrorCode;\n public override readonly cause?: unknown;\n\n constructor(code: PasskeyErrorCode, message: string, cause?: unknown) {\n super(message);\n this.name = \"PasskeyError\";\n this.code = code;\n this.cause = cause;\n }\n}\n\nfunction browserCredentials(): PasskeyCredentialsContainer | undefined {\n const nav = (globalThis as { navigator?: { credentials?: unknown } }).navigator;\n const creds = nav?.credentials as PasskeyCredentialsContainer | undefined;\n if (!creds || typeof creds.create !== \"function\" || typeof creds.get !== \"function\") {\n return undefined;\n }\n return creds;\n}\n\n/**\n * `true` when this environment can run a passkey ceremony: a\n * `window` with `PublicKeyCredential`, `navigator.credentials.create`\n * / `.get`, and a secure context (https, or http on localhost).\n * Always `false` in Node — use it to hide the button rather than\n * showing one that throws. Never throws itself.\n */\nexport function isPasskeySupported(): boolean {\n const g = globalThis as {\n window?: unknown;\n PublicKeyCredential?: unknown;\n isSecureContext?: boolean;\n };\n if (typeof g.window === \"undefined\") return false;\n if (typeof g.PublicKeyCredential !== \"function\") return false;\n if (g.isSecureContext === false) return false;\n return browserCredentials() !== undefined;\n}\n\nfunction mapDomError(err: unknown): PasskeyError {\n const name = (err as { name?: string } | null)?.name;\n const message = (err as { message?: string } | null)?.message ?? String(err);\n switch (name) {\n case \"NotAllowedError\":\n return new PasskeyError(\n \"cancelled\",\n `Passkey prompt was cancelled, timed out, or no passkey matched: ${message}`,\n err,\n );\n case \"InvalidStateError\":\n return new PasskeyError(\"invalid_state\", `Authenticator refused: ${message}`, err);\n case \"SecurityError\":\n return new PasskeyError(\n \"security\",\n `Page origin does not match the app's rp_id: ${message}`,\n err,\n );\n case \"AbortError\":\n return new PasskeyError(\"cancelled\", `Passkey ceremony aborted: ${message}`, err);\n case \"TimeoutError\":\n return new PasskeyError(\n \"timeout\",\n `Passkey prompt timed out before a credential was produced: ${message}`,\n err,\n );\n default:\n return new PasskeyError(\"unknown\", `navigator.credentials failed: ${message}`, err);\n }\n}\n\nexport interface PasskeyBrowserOptions {\n /** Abort the browser prompt (e.g. on route change). */\n signal?: AbortSignal;\n /**\n * Override `navigator.credentials` — for tests, or non-browser\n * runtimes that expose a compatible container. Defaults to the\n * global one, read at call time.\n */\n credentials?: PasskeyCredentialsContainer;\n}\n\n/**\n * The credentials container a ceremony will use, or a {@link PasskeyError}\n * with code `unsupported` if there is none. The ceremony helpers call this\n * BEFORE their options request, so an unsupported client never mints a\n * server-side challenge it can never answer.\n */\nexport function resolveCredentials(\n opts: PasskeyBrowserOptions = {},\n): PasskeyCredentialsContainer {\n const creds = opts.credentials ?? browserCredentials();\n if (!creds) {\n throw new PasskeyError(\n \"unsupported\",\n \"navigator.credentials is not available — passkeys need a browser with WebAuthn (check isPasskeySupported())\",\n );\n }\n return creds;\n}\n\nfunction isCredentialLike(value: unknown): value is PasskeyCredentialLike {\n if (!value || typeof value !== \"object\") return false;\n const v = value as { id?: unknown; response?: unknown };\n return typeof v.id === \"string\" && !!v.response && typeof v.response === \"object\";\n}\n\n/**\n * `navigator.credentials.create()` with base64url handled: takes the\n * `public_key` from an Auth enrolment response, returns the encoded\n * `credential` to POST back. Throws {@link PasskeyError}.\n */\nexport async function createPasskeyCredential(\n publicKey: PasskeyPublicKeyOptions | Record<string, unknown>,\n opts: PasskeyBrowserOptions = {},\n): Promise<EncodedPasskeyCredential> {\n const creds = resolveCredentials(opts);\n let cred: unknown;\n try {\n cred = await creds.create({ publicKey: decodeOptions(publicKey), signal: opts.signal });\n } catch (err) {\n throw mapDomError(err);\n }\n if (!isCredentialLike(cred)) {\n throw new PasskeyError(\n \"no_credential\",\n \"navigator.credentials.create() returned no usable credential\",\n );\n }\n return encodeCredential(cred);\n}\n\n/**\n * `navigator.credentials.get()` with base64url handled: takes the\n * `public_key` from an Auth options response, returns the encoded\n * `credential` to POST back. Throws {@link PasskeyError}.\n */\nexport async function getPasskeyCredential(\n publicKey: PasskeyPublicKeyOptions | Record<string, unknown>,\n opts: PasskeyBrowserOptions & { mediation?: PasskeyMediation } = {},\n): Promise<EncodedPasskeyCredential> {\n const creds = resolveCredentials(opts);\n let cred: unknown;\n try {\n cred = await creds.get({\n publicKey: decodeOptions(publicKey),\n mediation: opts.mediation,\n signal: opts.signal,\n });\n } catch (err) {\n throw mapDomError(err);\n }\n if (!isCredentialLike(cred)) {\n throw new PasskeyError(\n \"no_credential\",\n \"navigator.credentials.get() returned no usable credential\",\n );\n }\n return encodeCredential(cred);\n}\n","/**\n * `auth.consumer(slug)`: the generated consumer scope plus what the\n * generator cannot write (docs/sdk-standard.md section 6): offline token\n * verification against the app's JWKS, and the browser passkey ceremonies.\n * Every HTTP method comes from the generated `AuthConsumer`.\n */\n\nimport type { APIClient } from \"@productcraft/core\";\nimport { AuthConsumer } from \"./_generated/resources.js\";\nimport type * as T from \"./_generated/types.js\";\nimport { JwksCache, verifyAuthToken, type AuthClaims, type VerifyOptions } from \"./jwt/index.js\";\nimport {\n createPasskeyCredential,\n getPasskeyCredential,\n resolveCredentials,\n type EncodedPasskeyCredential,\n type PasskeyBrowserOptions,\n type PasskeyMediation,\n type PasskeyPublicKeyOptions,\n} from \"./passkeys.js\";\n\n/**\n * Legacy `iss` claim Auth tokens were minted with before the 2026-05-24\n * per-app-issuer migration. New tokens carry `${baseUrl}/${appSlug}`\n * (`scope.expectedIssuer`).\n */\nexport const AUTH_LEGACY_ISSUER = \"heimdall\";\n\nexport interface ConsumerScopeOptions {\n /** Per-app JWKS cache lifetime in ms. Default 10 minutes. */\n jwksTtlMs?: number;\n /** Custom fetch for the JWKS download (tests, proxies). */\n fetch?: typeof fetch;\n /** Reuse an existing cache for this app (the client keeps one per slug). */\n jwks?: JwksCache;\n}\n\n/** The issuer, audience and JWKS URL of one app's tokens. */\nexport function appTokenConfig(baseUrl: string, appSlug: string) {\n const origin = new URL(baseUrl);\n origin.pathname = `/${appSlug}`;\n const expectedIssuer = origin.toString().replace(/\\/$/, \"\");\n return {\n expectedIssuer,\n expectedAudience: appSlug,\n acceptedIssuers: [expectedIssuer, AUTH_LEGACY_ISSUER] as readonly string[],\n jwksUrl: new URL(`/${appSlug}/.well-known/jwks.json`, baseUrl),\n };\n}\n\n/** The encoded credential as the free-form JSON object the API declares. */\nconst wire = (credential: EncodedPasskeyCredential) => ({ id: credential.id, response: { ...credential.response } });\n\nexport class ConsumerScope extends AuthConsumer {\n /** The app slug this scope is bound to. */\n readonly appSlug: string;\n /** Issuer stamped on this app's tokens (`https://api.auth.productcraft.co/<slug>`). */\n readonly expectedIssuer: string;\n /** Audience stamped on this app's tokens: the app slug. */\n readonly expectedAudience: string;\n /** `expectedIssuer` plus the legacy `\"heimdall\"` literal; what `verifyToken` accepts by default. */\n readonly acceptedIssuers: readonly string[];\n /** jose-compatible JWKS resolver (`jose.jwtVerify(token, scope.jwks.getKey, …)`, passport-jwt). */\n readonly jwks: JwksCache;\n\n constructor(client: APIClient, bound: { app_slug: string }, options: ConsumerScopeOptions = {}) {\n super(client, bound);\n const cfg = appTokenConfig(client.baseUrl, bound.app_slug);\n this.appSlug = bound.app_slug;\n this.expectedIssuer = cfg.expectedIssuer;\n this.expectedAudience = cfg.expectedAudience;\n this.acceptedIssuers = cfg.acceptedIssuers;\n this.jwks = options.jwks ?? new JwksCache({ url: cfg.jwksUrl, ttlMs: options.jwksTtlMs, fetch: options.fetch });\n }\n\n /**\n * Verify an Auth access token offline against this app's JWKS: signature,\n * expiry, `iss` (per-app URL or the legacy literal) and `aud` (the slug).\n * Refresh tokens are refused (`JwtRefreshTokenError`).\n */\n verifyToken(token: string, opts: VerifyOptions = {}): Promise<AuthClaims> {\n return verifyAuthToken(token, this.jwks.getKey, {\n issuer: this.acceptedIssuers as string[],\n audience: this.expectedAudience,\n ...opts,\n });\n }\n\n /**\n * WebAuthn ceremonies, one call each. Browser only at call time (they drive\n * `navigator.credentials`); importing is safe anywhere.\n */\n readonly passkeys = {\n /**\n * Enrol a passkey as an MFA factor for the signed-in end user (the client\n * carries the user's access token). Resolves with the enabled factor and\n * the recovery codes; show those once.\n */\n enroll: async (opts: PasskeyBrowserOptions & { label?: string } = {}): Promise<T.ConfirmEnrollment> => {\n // Fail before the options call: an unsupported client must not mint a challenge.\n const credentials = resolveCredentials(opts);\n const start = await this.me.mfa.factors.create({ type: \"webauthn\", ...(opts.label ? { label: opts.label } : {}) });\n const publicKey = (start.enrollment as { public_key?: unknown }).public_key as PasskeyPublicKeyOptions;\n const credential = await createPasskeyCredential(publicKey, { ...opts, credentials });\n return this.me.mfa.factors.verify(start.factor.id, { credential: wire(credential) });\n },\n\n /**\n * Passwordless sign-in with a discoverable passkey. Rejects with\n * `PasskeyError` (`cancelled`) when the user dismisses the prompt, and with\n * `AuthenticationError` (401) for a forged, unknown or replayed assertion.\n */\n signIn: async (\n opts: PasskeyBrowserOptions & { mediation?: PasskeyMediation; tenant_id?: string } = {},\n ): Promise<T.ConsumerToken> => {\n const credentials = resolveCredentials(opts);\n const { public_key } = await this.passkey.options(opts.tenant_id ? { tenant_id: opts.tenant_id } : {});\n const credential = await getPasskeyCredential(public_key as PasskeyPublicKeyOptions, { ...opts, credentials });\n return this.passkey.verify({ credential: wire(credential) }) as Promise<T.ConsumerToken>;\n },\n\n /** Answer the MFA step of a password sign-in (`result: \"mfa_required\"`) with a passkey. */\n completeMfaChallenge: async (\n args: PasskeyBrowserOptions & { mfa_token: string; mediation?: PasskeyMediation },\n ): Promise<T.ConsumerToken> => {\n const { mfa_token, ...browserOpts } = args;\n const credentials = resolveCredentials(browserOpts);\n const { public_key } = await this.mfa.webauthn.options({ mfa_token });\n const credential = await getPasskeyCredential(public_key as PasskeyPublicKeyOptions, { ...browserOpts, credentials });\n return this.mfa.verify({ mfa_token, credential: wire(credential) }) as Promise<T.ConsumerToken>;\n },\n\n /** Re-confirm the signed-in user inside a live session before a sensitive action. */\n stepUp: async (opts: PasskeyBrowserOptions & { mediation?: PasskeyMediation } = {}): Promise<T.StepUp> => {\n const credentials = resolveCredentials(opts);\n const { public_key } = await this.me.mfa.stepUp.webauthn.options();\n const credential = await getPasskeyCredential(public_key as PasskeyPublicKeyOptions, { ...opts, credentials });\n return this.me.mfa.stepUp.verify({ credential: wire(credential) });\n },\n };\n}\n","/**\n * Hand-written base of the generated `Auth` class (SURFACES `root` in\n * scripts/gen-sdk.mjs). It adds what is not an HTTP call:\n *\n * - `consumer(slug)`, whose client never reads a credential from the\n * environment: consumer routes act for an end user, so a workspace key in\n * `PRODUCTCRAFT_API_KEY` must not leak onto them. Pass `auth`/`apiKey`\n * explicitly for the PAK-only consumer routes.\n * - `verifyToken(jwt, { app })` at the top level, with one JWKS cache per app.\n */\n\nimport { ConfigurationError, PC_AUTH_APP_ENV, readEnv, type APIClient, type ClientOptions } from \"@productcraft/core\";\nimport { AuthResources } from \"./_generated/resources.js\";\nimport { ConsumerScope, appTokenConfig } from \"./consumer.js\";\nimport { JwksCache, type AuthClaims, type VerifyOptions } from \"./jwt/index.js\";\n\nexport interface AuthOptions extends ClientOptions {\n /** Custom `fetch`, also used for JWKS downloads. */\n fetch?: typeof fetch;\n /** Per-app JWKS cache lifetime in ms. Default 10 minutes. */\n jwksTtlMs?: number;\n}\n\nexport class AuthBase extends AuthResources {\n readonly #options: AuthOptions;\n readonly #consumerClient: APIClient;\n readonly #jwks = new Map<string, JwksCache>();\n\n constructor(client: APIClient, options: AuthOptions, makeClient: (options: ClientOptions) => APIClient) {\n super(client);\n this.#options = options;\n this.#consumerClient = makeClient({ ...options, credentialFromEnv: false });\n }\n\n #cache(slug: string): JwksCache {\n let cache = this.#jwks.get(slug);\n if (!cache) {\n const { jwksUrl } = appTokenConfig(this._client.baseUrl, slug);\n cache = new JwksCache({ url: jwksUrl, ttlMs: this.#options.jwksTtlMs, fetch: this.#options.fetch });\n this.#jwks.set(slug, cache);\n }\n return cache;\n }\n\n /**\n * Calls for one app's end users (sign-in, sessions, profile, MFA, tenants),\n * plus `verifyToken` and the passkey ceremonies.\n *\n * @param appSlug - The app's slug. Default: `PRODUCTCRAFT_AUTH_APP`.\n */\n consumer(appSlug?: string): ConsumerScope {\n const slug = appSlug ?? readEnv(PC_AUTH_APP_ENV);\n if (!slug) throw new ConfigurationError(`consumer() needs an app slug. Pass one, or set ${PC_AUTH_APP_ENV}.`);\n return new ConsumerScope(this.#consumerClient, { app_slug: slug }, { jwks: this.#cache(slug) });\n }\n\n /**\n * Verify an Auth access token offline against the app's JWKS (signature,\n * expiry, issuer, audience; refresh tokens refused). Same as\n * `auth.consumer(app).verifyToken(jwt)`, with the JWKS cached per app.\n *\n * @param options.app - The app slug the token was issued for. Default: `PRODUCTCRAFT_AUTH_APP`.\n */\n verifyToken(token: string, options: VerifyOptions & { app?: string } = {}): Promise<AuthClaims> {\n const { app, ...verify } = options;\n return this.consumer(app).verifyToken(token, verify);\n }\n}\n","// Generated by scripts/gen-sdk.mjs from Specs/auth.json. Do not edit.\n\nimport type { LastResponse } from \"@productcraft/core\";\nimport type { components, paths } from \"./paths.js\";\n\ntype IsUnion<T, U = T> = T extends unknown ? ([U] extends [T] ? false : true) : never;\ntype OpenString<T extends string> = string extends T ? T : true extends IsUnion<T> ? T | (string & {}) : T;\ntype OpenValue<T> = [T] extends [string] ? OpenString<T> : T extends readonly (infer I)[] ? (OpenValue<Exclude<I, null | undefined>> | Extract<I, null | undefined>)[] : T extends object ? { [K in keyof T]: OpenValue<Exclude<T[K], null | undefined>> | Extract<T[K], null | undefined> } : T;\n/** A response type: string-literal unions also accept values added after this SDK was built. */\nexport type Open<T> = OpenValue<Exclude<T, null | undefined>> | Extract<T, null | undefined>;\n/** What a method resolves to: the parsed body plus non-enumerable `lastResponse`. */\nexport type WithLastResponse<T> = T & { readonly lastResponse: LastResponse };\n/** Params inside a scope bound with `.as(actorId)`: `actor_id` may be left out. */\nexport type WithOptionalActor<P> = P extends { actor_id: unknown } ? Omit<P, \"actor_id\"> & { actor_id?: P[\"actor_id\"] } : P;\n/** A polled model whose free-form `K` the caller types as `R` (`createAndPoll<R>`); optional and nullable stay as declared. */\nexport type WithResult<M, K extends keyof M, R> = Omit<M, K> & { [P in keyof M as P extends K ? P : never]: R | Extract<M[P], null> };\n\nexport type ApiKeyStatus = components[\"schemas\"][\"ApiKeyStatus\"];\nexport const ApiKeyStatus = { values: [\"active\", \"expired\", \"revoked\"] as const };\n\nexport type AppEnvironment = components[\"schemas\"][\"AppEnvironment\"];\nexport const AppEnvironment = { values: [\"production\", \"staging\", \"development\"] as const };\n\nexport type AppStatus = components[\"schemas\"][\"AppStatus\"];\nexport const AppStatus = { values: [\"active\", \"suspended\", \"archived\"] as const };\n\nexport type ApplyPlanAction = components[\"schemas\"][\"ApplyPlanAction\"];\nexport const ApplyPlanAction = { values: [\"create\", \"skip\"] as const };\n\nexport type ApplyPlanResult = components[\"schemas\"][\"ApplyPlanResult\"];\nexport const ApplyPlanResult = { values: [\"created\", \"unchanged\", \"failed\"] as const };\n\nexport type AuditSinkAttemptKind = components[\"schemas\"][\"AuditSinkAttemptKind\"];\nexport const AuditSinkAttemptKind = { values: [\"batch\", \"test\"] as const };\n\nexport type AuditSinkState = components[\"schemas\"][\"AuditSinkState\"];\nexport const AuditSinkState = { values: [\"active\", \"paused\", \"auto_disabled\"] as const };\n\nexport type AuthStatsMetric = components[\"schemas\"][\"AuthStatsMetric\"];\nexport const AuthStatsMetric = { values: [\"active_users\"] as const };\n\nexport type BotProtectionProvider = components[\"schemas\"][\"BotProtectionProvider\"];\nexport const BotProtectionProvider = { values: [\"turnstile\", \"hcaptcha\"] as const };\n\nexport type ContactType = components[\"schemas\"][\"ContactType\"];\nexport const ContactType = { values: [\"email\", \"phone\"] as const };\n\nexport type CustomDomainApplyWarning = components[\"schemas\"][\"CustomDomainApplyWarning\"];\nexport const CustomDomainApplyWarning = { values: [\"token_scope_broader_than_zone\", \"partially_applied\"] as const };\n\nexport type CustomDomainStatus = components[\"schemas\"][\"CustomDomainStatus\"];\nexport const CustomDomainStatus = { values: [\"pending\", \"active\", \"failing\"] as const };\n\nexport type DnsConflictSeverity = components[\"schemas\"][\"DnsConflictSeverity\"];\nexport const DnsConflictSeverity = { values: [\"blocking\", \"warning\"] as const };\n\nexport type DnsProvider = components[\"schemas\"][\"DnsProvider\"];\nexport const DnsProvider = { values: [\"cloudflare\", \"digitalocean\"] as const };\n\nexport type DnsRecordPurpose = components[\"schemas\"][\"DnsRecordPurpose\"];\nexport const DnsRecordPurpose = { values: [\"routing\", \"ownership\"] as const };\n\nexport type DnsRecordState = components[\"schemas\"][\"DnsRecordState\"];\nexport const DnsRecordState = { values: [\"not_found\", \"propagating\", \"verified\", \"conflict\", \"lookup_failed\"] as const };\n\nexport type DnsRecordType = components[\"schemas\"][\"DnsRecordType\"];\nexport const DnsRecordType = { values: [\"CNAME\", \"TXT\"] as const };\n\nexport type EndUserStatus = components[\"schemas\"][\"EndUserStatus\"];\nexport const EndUserStatus = { values: [\"active\", \"suspended\", \"deactivated\"] as const };\n\nexport type EnrollmentType = components[\"schemas\"][\"EnrollmentType\"];\nexport const EnrollmentType = { values: [\"totp\", \"email\", \"webauthn\"] as const };\n\nexport type ImportJobStatus = components[\"schemas\"][\"ImportJobStatus\"];\nexport const ImportJobStatus = { values: [\"queued\", \"running\", \"succeeded\", \"failed\"] as const };\n\nexport type IntrospectedTokenType = components[\"schemas\"][\"IntrospectedTokenType\"];\nexport const IntrospectedTokenType = { values: [\"m2m\", \"end_user\"] as const };\n\nexport type JwkUse = components[\"schemas\"][\"JwkUse\"];\nexport const JwkUse = { values: [\"sig\"] as const };\n\nexport type MfaPolicy = components[\"schemas\"][\"MfaPolicy\"];\nexport const MfaPolicy = { values: [\"optional\", \"required\"] as const };\n\nexport type OAuthLinkPolicy = components[\"schemas\"][\"OAuthLinkPolicy\"];\nexport const OAuthLinkPolicy = { values: [\"auto\", \"confirm\", \"reject\"] as const };\n\nexport type OAuthProvider = components[\"schemas\"][\"OAuthProvider\"];\nexport const OAuthProvider = { values: [\"google\", \"github\", \"apple\"] as const };\n\nexport type PasswordBreachCheck = components[\"schemas\"][\"PasswordBreachCheck\"];\nexport const PasswordBreachCheck = { values: [\"off\", \"warn\", \"block\"] as const };\n\nexport type ProviderBlockedReason = components[\"schemas\"][\"ProviderBlockedReason\"];\nexport const ProviderBlockedReason = { values: [\"no_redirect_origins\", \"missing_credentials\", \"credentials_rejected\"] as const };\n\nexport type ProviderCheckResult = components[\"schemas\"][\"ProviderCheckResult\"];\nexport const ProviderCheckResult = { values: [\"credentials_valid\", \"credentials_rejected\", \"inconclusive\"] as const };\n\nexport type ProviderStatus = components[\"schemas\"][\"ProviderStatus\"];\nexport const ProviderStatus = { values: [\"ready\", \"blocked\", \"disabled\", \"not_configured\"] as const };\n\nexport type SenderDomainStatus = components[\"schemas\"][\"SenderDomainStatus\"];\nexport const SenderDomainStatus = { values: [\"not_started\", \"pending\", \"partially_verified\", \"verified\", \"temporary_failure\", \"failed\", \"disabled\", \"deleted\", \"not_found\"] as const };\n\nexport type SenderSource = components[\"schemas\"][\"SenderSource\"];\nexport const SenderSource = { values: [\"workspace\", \"custom\"] as const };\n\nexport type SetupRowState = components[\"schemas\"][\"SetupRowState\"];\nexport const SetupRowState = { values: [\"pass\", \"attention\", \"not_set\", \"blocked\"] as const };\n\nexport type SignInResult = components[\"schemas\"][\"SignInResult\"];\nexport const SignInResult = { values: [\"session\", \"mfa_required\", \"mfa_enrollment_required\"] as const };\n\nexport type SignInTestEmailNoticeCode = components[\"schemas\"][\"SignInTestEmailNoticeCode\"];\nexport const SignInTestEmailNoticeCode = { values: [\"emails_off\", \"email_sender_missing\", \"email_template_missing\", \"email_workspace_missing\", \"email_unavailable\", \"email_send_failed\"] as const };\n\nexport type SignInTestMethod = components[\"schemas\"][\"SignInTestMethod\"];\nexport const SignInTestMethod = { values: [\"oauth\", \"password\", \"otp\"] as const };\n\nexport type SignInTestOutcome = components[\"schemas\"][\"SignInTestOutcome\"];\nexport const SignInTestOutcome = { values: [\"would_sign_in_existing\", \"would_create\"] as const };\n\nexport type SignInTestState = components[\"schemas\"][\"SignInTestState\"];\nexport const SignInTestState = { values: [\"pending\", \"succeeded\", \"failed\"] as const };\n\nexport type StatsGranularity = components[\"schemas\"][\"StatsGranularity\"];\nexport const StatsGranularity = { values: [\"day\"] as const };\n\nexport type StatsWindow = components[\"schemas\"][\"StatsWindow\"];\nexport const StatsWindow = { values: [\"1d\", \"7d\", \"30d\"] as const };\n\nexport type TenantApiKeyAdminState = components[\"schemas\"][\"TenantApiKeyAdminState\"];\nexport const TenantApiKeyAdminState = { values: [\"active\", \"expired\", \"revoked\", \"orphaned\"] as const };\n\nexport type TenantApiKeyEffectiveStatus = components[\"schemas\"][\"TenantApiKeyEffectiveStatus\"];\nexport const TenantApiKeyEffectiveStatus = { values: [\"active\", \"expired\", \"revoked\", \"orphaned\", \"suspended\"] as const };\n\nexport type TenantApiKeyEnv = components[\"schemas\"][\"TenantApiKeyEnv\"];\nexport const TenantApiKeyEnv = { values: [\"live\", \"test\"] as const };\n\nexport type TenantApiKeyManagementLane = components[\"schemas\"][\"TenantApiKeyManagementLane\"];\nexport const TenantApiKeyManagementLane = { values: [\"direct\", \"app_proxy_only\"] as const };\n\nexport type TenantApiKeyRevokeReason = components[\"schemas\"][\"TenantApiKeyRevokeReason\"];\nexport const TenantApiKeyRevokeReason = { values: [\"manual\", \"rotated\", \"member_removed\", \"tenant_deleted\"] as const };\n\nexport type TenantApiKeyState = components[\"schemas\"][\"TenantApiKeyState\"];\nexport const TenantApiKeyState = { values: [\"active\", \"expired\", \"revoked\"] as const };\n\nexport type TenantInviteStatus = components[\"schemas\"][\"TenantInviteStatus\"];\nexport const TenantInviteStatus = { values: [\"pending\", \"revoked\", \"expired\", \"used\"] as const };\n\nexport type TenantStatus = components[\"schemas\"][\"TenantStatus\"];\nexport const TenantStatus = { values: [\"active\", \"suspended\", \"archived\"] as const };\n\nexport type TokenType = components[\"schemas\"][\"TokenType\"];\nexport const TokenType = { values: [\"Bearer\"] as const };\n\nexport type UserCreatedVia = components[\"schemas\"][\"UserCreatedVia\"];\nexport const UserCreatedVia = { values: [\"admin\", \"invite\", \"tenant_invite\"] as const };\n\nexport type UserDeletedReason = components[\"schemas\"][\"UserDeletedReason\"];\nexport const UserDeletedReason = { values: [\"unverified_expired\"] as const };\n\nexport type UserDeletedVia = components[\"schemas\"][\"UserDeletedVia\"];\nexport const UserDeletedVia = { values: [\"platform\", \"platform_bulk\", \"consumer_admin\", \"self\"] as const };\n\nexport type WebhookAttemptTrigger = components[\"schemas\"][\"WebhookAttemptTrigger\"];\nexport const WebhookAttemptTrigger = { values: [\"automatic\", \"replay\", \"test\"] as const };\n\nexport type WebhookEndpointDisabledReason = components[\"schemas\"][\"WebhookEndpointDisabledReason\"];\nexport const WebhookEndpointDisabledReason = { values: [\"manual\", \"failing\"] as const };\n\nexport type WebhookEndpointStatus = components[\"schemas\"][\"WebhookEndpointStatus\"];\nexport const WebhookEndpointStatus = { values: [\"enabled\", \"disabled\", \"auto_disabled\"] as const };\n\nexport type WebhookEventStatus = components[\"schemas\"][\"WebhookEventStatus\"];\nexport const WebhookEventStatus = { values: [\"pending\", \"delivered\", \"failed\", \"not_sent\"] as const };\n\n/**\n * Every event type this product sends; `x-webhooks` maps each to its payload schema. New types can be added, so treat it as open.\n */\nexport type WebhookEventType = components[\"schemas\"][\"WebhookEventType\"];\nexport const WebhookEventType = { values: [\"user.signup\", \"user.signin\", \"user.suspended\", \"user.deactivated\", \"user.reinstated\", \"user.role_changed\", \"user.deleted\", \"user.contact_verified\", \"user.email_verified\", \"user.password_reset.requested\", \"user.password_reset.completed\", \"user.mfa.factor_enrolled\", \"user.mfa.factor_disabled\", \"user.mfa.recovery_code_used\", \"user.mfa.step_up_succeeded\", \"user.mfa.step_up_locked\", \"user.mfa.enrollment_required\", \"user.mfa.reenrollment_required\", \"tenant.created\", \"tenant.updated\", \"tenant.deleted\", \"tenant.member.added\", \"tenant.member.removed\", \"tenant.member.role_changed\", \"tenant.invite.created\", \"tenant.invite.accepted\", \"tenant.invite.revoked\", \"app.slug_changed\"] as const };\n\nexport type AcceptedTenantInvite = Open<components[\"schemas\"][\"AcceptedTenantInviteResponseDto\"]>;\nexport type AccountContact = Open<components[\"schemas\"][\"AccountContactDto\"]>;\nexport type AccountContactList = Open<components[\"schemas\"][\"AccountContactListResponseDto\"]>;\nexport type AddMember = Open<components[\"schemas\"][\"AddMemberResponseDto\"]>;\nexport type AdminProvisionFactor = Open<components[\"schemas\"][\"AdminProvisionFactorResponseDto\"]>;\nexport type ApiKeyList = Open<components[\"schemas\"][\"ApiKeyListResponseDto\"]>;\nexport type ApiKeySummary = Open<components[\"schemas\"][\"ApiKeySummaryDto\"]>;\nexport type AppList = Open<components[\"schemas\"][\"AppListResponseDto\"]>;\nexport type AppMemberList = Open<components[\"schemas\"][\"AppMemberListResponseDto\"]>;\nexport type AppMemberSummary = Open<components[\"schemas\"][\"AppMemberSummaryDto\"]>;\nexport type AppMembership = Open<components[\"schemas\"][\"AppMembershipResponseDto\"]>;\nexport type AppNotificationSettings = Open<components[\"schemas\"][\"AppNotificationSettingsResponseDto\"]>;\nexport type AppPermissionCatalogEntry = Open<components[\"schemas\"][\"AppPermissionCatalogEntryDto\"]>;\nexport type App = Open<components[\"schemas\"][\"AppResponseDto\"]>;\nexport type AppSlugChangedEventData = Open<components[\"schemas\"][\"AppSlugChangedEventDataDto\"]>;\nexport type ApplyConflict = Open<components[\"schemas\"][\"ApplyConflictDto\"]>;\nexport type ApplyCounts = Open<components[\"schemas\"][\"ApplyCountsDto\"]>;\nexport type ApplyPlanItem = Open<components[\"schemas\"][\"ApplyPlanItemDto\"]>;\nexport type AuditLogEntry = Open<components[\"schemas\"][\"AuditLogEntryDto\"]>;\nexport type AuditLogList = Open<components[\"schemas\"][\"AuditLogListResponseDto\"]>;\nexport type AuditSink = Open<components[\"schemas\"][\"AuditSinkResponseDto\"]>;\nexport type AuditSinkTestResult = Open<components[\"schemas\"][\"AuditSinkTestResultDto\"]>;\nexport type AuditSinkWithSecret = Open<components[\"schemas\"][\"AuditSinkWithSecretResponseDto\"]>;\nexport type AuthConfig = Open<components[\"schemas\"][\"AuthConfigResponseDto\"]>;\nexport type AuthStatsInWindow = Open<components[\"schemas\"][\"AuthStatsInWindowDto\"]>;\nexport type AuthStatsSeries = Open<components[\"schemas\"][\"AuthStatsSeriesDto\"]>;\nexport type AuthStatsTotals = Open<components[\"schemas\"][\"AuthStatsTotalsDto\"]>;\nexport type AuthWorkspaceStats = Open<components[\"schemas\"][\"AuthWorkspaceStatsDto\"]>;\nexport type AuthorizeBatch = Open<components[\"schemas\"][\"AuthorizeBatchResponseDto\"]>;\nexport type AuthorizeBatchResult = Open<components[\"schemas\"][\"AuthorizeBatchResultDto\"]>;\nexport type Authorize = Open<components[\"schemas\"][\"AuthorizeResponseDto\"]>;\nexport type AvatarUrl = Open<components[\"schemas\"][\"AvatarUrlResponseDto\"]>;\nexport type BotProtection = Open<components[\"schemas\"][\"BotProtectionResponseDto\"]>;\nexport type BulkAffectedUsers = Open<components[\"schemas\"][\"BulkAffectedUsersResponseDto\"]>;\nexport type CloneApp = Open<components[\"schemas\"][\"CloneAppResponseDto\"]>;\nexport type ConfirmEnrollment = Open<components[\"schemas\"][\"ConfirmEnrollmentResponseDto\"]>;\nexport type ConsumerAddMember = Open<components[\"schemas\"][\"ConsumerAddMemberResponseDto\"]>;\nexport type ConsumerAdminCreatedUser = Open<components[\"schemas\"][\"ConsumerAdminCreatedUserDto\"]>;\nexport type ConsumerAdminEndUser = Open<components[\"schemas\"][\"ConsumerAdminEndUserDto\"]>;\nexport type ConsumerAdminEndUserList = Open<components[\"schemas\"][\"ConsumerAdminEndUserListResponseDto\"]>;\nexport type ConsumerAdminPermission = Open<components[\"schemas\"][\"ConsumerAdminPermissionDto\"]>;\nexport type ConsumerAdminPermissionListEntry = Open<components[\"schemas\"][\"ConsumerAdminPermissionListEntryDto\"]>;\nexport type ConsumerAdminRoleAssignment = Open<components[\"schemas\"][\"ConsumerAdminRoleAssignmentResponseDto\"]>;\nexport type ConsumerCodeDispatch = Open<components[\"schemas\"][\"ConsumerCodeDispatchResponseDto\"]>;\nexport type ConsumerCodeIssue = Open<components[\"schemas\"][\"ConsumerCodeIssueResponseDto\"]>;\nexport type ConsumerMfaChallengeFactor = Open<components[\"schemas\"][\"ConsumerMfaChallengeFactorDto\"]>;\nexport type ConsumerMfaChallenge = Open<components[\"schemas\"][\"ConsumerMfaChallengeResponseDto\"]>;\nexport type ConsumerMfaEnrollVerify = Open<components[\"schemas\"][\"ConsumerMfaEnrollVerifyResponseDto\"]>;\nexport type ConsumerMfaEnrollmentRequired = Open<components[\"schemas\"][\"ConsumerMfaEnrollmentRequiredResponseDto\"]>;\nexport type ConsumerMfaSendCode = Open<components[\"schemas\"][\"ConsumerMfaSendCodeResponseDto\"]>;\nexport type ConsumerRoleList = Open<components[\"schemas\"][\"ConsumerRoleListResponseDto\"]>;\nexport type ConsumerRolePermissionEntry = Open<components[\"schemas\"][\"ConsumerRolePermissionEntryDto\"]>;\nexport type ConsumerRole = Open<components[\"schemas\"][\"ConsumerRoleResponseDto\"]>;\nexport type ConsumerRoleWithPermissions = Open<components[\"schemas\"][\"ConsumerRoleWithPermissionsResponseDto\"]>;\nexport type ConsumerTenantList = Open<components[\"schemas\"][\"ConsumerTenantListResponseDto\"]>;\nexport type ConsumerTenantMembershipList = Open<components[\"schemas\"][\"ConsumerTenantMembershipListResponseDto\"]>;\nexport type ConsumerTenantMembership = Open<components[\"schemas\"][\"ConsumerTenantMembershipResponseDto\"]>;\nexport type ConsumerTenant = Open<components[\"schemas\"][\"ConsumerTenantResponseDto\"]>;\nexport type ConsumerToken = Open<components[\"schemas\"][\"ConsumerTokenResponseDto\"]>;\nexport type ConsumerVerify = Open<components[\"schemas\"][\"ConsumerVerifyResponseDto\"]>;\nexport type ConsumerWebauthnOptions = Open<components[\"schemas\"][\"ConsumerWebauthnOptionsResponseDto\"]>;\nexport type CreateApiKey = Open<components[\"schemas\"][\"CreateApiKeyResponseDto\"]>;\nexport type CreateTenantInvite = Open<components[\"schemas\"][\"CreateTenantInviteResponseDto\"]>;\nexport type CustomDomainApplyResult = Open<components[\"schemas\"][\"CustomDomainApplyResultDto\"]>;\nexport type CustomDomainCallbackUrls = Open<components[\"schemas\"][\"CustomDomainCallbackUrlsDto\"]>;\nexport type CustomDomain = Open<components[\"schemas\"][\"CustomDomainDto\"]>;\nexport type CustomDomainList = Open<components[\"schemas\"][\"CustomDomainListDto\"]>;\nexport type CustomDomainRecord = Open<components[\"schemas\"][\"CustomDomainRecordDto\"]>;\nexport type DnsConflict = Open<components[\"schemas\"][\"DnsConflictDto\"]>;\nexport type DnsProviderRef = Open<components[\"schemas\"][\"DnsProviderRefDto\"]>;\nexport type EffectiveSender = Open<components[\"schemas\"][\"EffectiveSenderDto\"]>;\nexport type EmailEnrollmentData = Open<components[\"schemas\"][\"EmailEnrollmentDataDto\"]>;\nexport type EndUserActionCount = Open<components[\"schemas\"][\"EndUserActionCountDto\"]>;\nexport type EndUserActivityEntry = Open<components[\"schemas\"][\"EndUserActivityEntryDto\"]>;\nexport type EndUserDetailInsights = Open<components[\"schemas\"][\"EndUserDetailInsightsDto\"]>;\nexport type EndUserFactorEntry = Open<components[\"schemas\"][\"EndUserFactorEntryDto\"]>;\nexport type EndUserInsights = Open<components[\"schemas\"][\"EndUserInsightsDto\"]>;\nexport type EndUserInviteList = Open<components[\"schemas\"][\"EndUserInviteListResponseDto\"]>;\nexport type EndUserInvite = Open<components[\"schemas\"][\"EndUserInviteResponseDto\"]>;\nexport type EndUserList = Open<components[\"schemas\"][\"EndUserListResponseDto\"]>;\nexport type EndUserRoleAssignment = Open<components[\"schemas\"][\"EndUserRoleAssignmentResponseDto\"]>;\nexport type EndUserSessionEntry = Open<components[\"schemas\"][\"EndUserSessionEntryDto\"]>;\nexport type EndUserSummary = Open<components[\"schemas\"][\"EndUserSummaryDto\"]>;\nexport type EnforcedPermissions = Open<components[\"schemas\"][\"EnforcedPermissionsResponseDto\"]>;\nexport type Exchange = Open<components[\"schemas\"][\"ExchangeResponseDto\"]>;\nexport type FactorList = Open<components[\"schemas\"][\"FactorListResponseDto\"]>;\nexport type GrantableScope = Open<components[\"schemas\"][\"GrantableScopeDto\"]>;\nexport type IdpMfaEnrollmentRequired = Open<components[\"schemas\"][\"IdpMfaEnrollmentRequiredResponseDto\"]>;\nexport type IdpToken = Open<components[\"schemas\"][\"IdpTokenResponseDto\"]>;\nexport type ImportJobError = Open<components[\"schemas\"][\"ImportJobErrorDto\"]>;\nexport type ImportJob = Open<components[\"schemas\"][\"ImportJobResponseDto\"]>;\nexport type InsightsMfa = Open<components[\"schemas\"][\"InsightsMfaDto\"]>;\nexport type InsightsPasswordReset = Open<components[\"schemas\"][\"InsightsPasswordResetDto\"]>;\nexport type InsightsSessions = Open<components[\"schemas\"][\"InsightsSessionsDto\"]>;\nexport type InsightsSignin = Open<components[\"schemas\"][\"InsightsSigninDto\"]>;\nexport type InsightsUsers = Open<components[\"schemas\"][\"InsightsUsersDto\"]>;\nexport type InsightsVerification = Open<components[\"schemas\"][\"InsightsVerificationDto\"]>;\nexport type Introspect = Open<components[\"schemas\"][\"IntrospectResponseDto\"]>;\nexport type IntrospectionCreator = Open<components[\"schemas\"][\"IntrospectionCreatorDto\"]>;\nexport type IssuedVerificationCode = Open<components[\"schemas\"][\"IssuedVerificationCodeResponseDto\"]>;\nexport type Jwk = Open<components[\"schemas\"][\"JwkDto\"]>;\nexport type Jwks = Open<components[\"schemas\"][\"JwksResponseDto\"]>;\nexport type ListWebhookEndpoints = Open<components[\"schemas\"][\"ListWebhookEndpointsResponseDto\"]>;\nexport type ListWebhookEventTypes = Open<components[\"schemas\"][\"ListWebhookEventTypesResponseDto\"]>;\nexport type ListWebhookEvents = Open<components[\"schemas\"][\"ListWebhookEventsResponseDto\"]>;\nexport type M2mClientCreate = Open<components[\"schemas\"][\"M2mClientCreateResponseDto\"]>;\nexport type M2mClientDetail = Open<components[\"schemas\"][\"M2mClientDetailResponseDto\"]>;\nexport type M2mClientList = Open<components[\"schemas\"][\"M2mClientListResponseDto\"]>;\nexport type M2mClientSummary = Open<components[\"schemas\"][\"M2mClientSummaryDto\"]>;\nexport type M2mRotateSecret = Open<components[\"schemas\"][\"M2mRotateSecretResponseDto\"]>;\nexport type M2mScopeEntry = Open<components[\"schemas\"][\"M2mScopeEntryDto\"]>;\nexport type MeActivityEntry = Open<components[\"schemas\"][\"MeActivityEntryDto\"]>;\nexport type MeActivity = Open<components[\"schemas\"][\"MeActivityResponseDto\"]>;\nexport type MeContact = Open<components[\"schemas\"][\"MeContactDto\"]>;\nexport type MeContacts = Open<components[\"schemas\"][\"MeContactsResponseDto\"]>;\nexport type MePermissions = Open<components[\"schemas\"][\"MePermissionsResponseDto\"]>;\nexport type MeProfile = Open<components[\"schemas\"][\"MeProfileResponseDto\"]>;\nexport type MeSession = Open<components[\"schemas\"][\"MeSessionDto\"]>;\nexport type MeSessions = Open<components[\"schemas\"][\"MeSessionsResponseDto\"]>;\nexport type MeUpdatedAccount = Open<components[\"schemas\"][\"MeUpdatedAccountResponseDto\"]>;\nexport type MfaEnrollmentRequiredEventData = Open<components[\"schemas\"][\"MfaEnrollmentRequiredEventDataDto\"]>;\nexport type MfaFactorEventData = Open<components[\"schemas\"][\"MfaFactorEventDataDto\"]>;\nexport type MfaRecoveryCodeUsedEventData = Open<components[\"schemas\"][\"MfaRecoveryCodeUsedEventDataDto\"]>;\nexport type MfaStepUpLockedEventData = Open<components[\"schemas\"][\"MfaStepUpLockedEventDataDto\"]>;\nexport type MfaStepUpSucceededEventData = Open<components[\"schemas\"][\"MfaStepUpSucceededEventDataDto\"]>;\nexport type MyTenants = Open<components[\"schemas\"][\"MyTenantsResponseDto\"]>;\nexport type NotificationTest = Open<components[\"schemas\"][\"NotificationTestResponseDto\"]>;\nexport type OAuthToken = Open<components[\"schemas\"][\"OAuthTokenResponseDto\"]>;\nexport type OpenIdConfiguration = Open<components[\"schemas\"][\"OpenIdConfigurationDto\"]>;\nexport type Pagination = Open<components[\"schemas\"][\"PaginationDto\"]>;\nexport type Permission = Open<components[\"schemas\"][\"PermissionDto\"]>;\nexport type PlatformTenantApiKey = Open<components[\"schemas\"][\"PlatformTenantApiKeyDto\"]>;\nexport type PlatformTenantApiKeyList = Open<components[\"schemas\"][\"PlatformTenantApiKeyListResponseDto\"]>;\nexport type PlatformUserStats = Open<components[\"schemas\"][\"PlatformUserStatsResponseDto\"]>;\nexport type ProviderCheck = Open<components[\"schemas\"][\"ProviderCheckDto\"]>;\nexport type ProviderDetail = Open<components[\"schemas\"][\"ProviderDetailDto\"]>;\nexport type ProviderListEntry = Open<components[\"schemas\"][\"ProviderListEntryDto\"]>;\nexport type PublicFactor = Open<components[\"schemas\"][\"PublicFactorDto\"]>;\nexport type RecoveryCodes = Open<components[\"schemas\"][\"RecoveryCodesResponseDto\"]>;\nexport type ReplayWebhookEvent = Open<components[\"schemas\"][\"ReplayWebhookEventResponseDto\"]>;\nexport type RequireMfaReenrollment = Open<components[\"schemas\"][\"RequireMfaReenrollmentResponseDto\"]>;\nexport type RoleList = Open<components[\"schemas\"][\"RoleListResponseDto\"]>;\nexport type RolePermissionEntry = Open<components[\"schemas\"][\"RolePermissionEntryDto\"]>;\nexport type Role = Open<components[\"schemas\"][\"RoleResponseDto\"]>;\nexport type RoleWithPermissions = Open<components[\"schemas\"][\"RoleWithPermissionsResponseDto\"]>;\nexport type RotateApiKey = Open<components[\"schemas\"][\"RotateApiKeyResponseDto\"]>;\nexport type SetupRow = Open<components[\"schemas\"][\"SetupRowDto\"]>;\nexport type SetupRowFix = Open<components[\"schemas\"][\"SetupRowFixDto\"]>;\nexport type SetupRowTest = Open<components[\"schemas\"][\"SetupRowTestDto\"]>;\nexport type SetupStatus = Open<components[\"schemas\"][\"SetupStatusDto\"]>;\nexport type SignInTest = Open<components[\"schemas\"][\"SignInTestDto\"]>;\nexport type SignInTestEmailDelivery = Open<components[\"schemas\"][\"SignInTestEmailDeliveryDto\"]>;\nexport type SignInTestEmailNotice = Open<components[\"schemas\"][\"SignInTestEmailNoticeDto\"]>;\nexport type SignInTestError = Open<components[\"schemas\"][\"SignInTestErrorDto\"]>;\nexport type SignInTestIdentity = Open<components[\"schemas\"][\"SignInTestIdentityDto\"]>;\nexport type StartEnrollment = Open<components[\"schemas\"][\"StartEnrollmentResponseDto\"]>;\nexport type StatsSeriesPoint = Open<components[\"schemas\"][\"StatsSeriesPointDto\"]>;\nexport type StepUp = Open<components[\"schemas\"][\"StepUpResponseDto\"]>;\nexport type StepUpSendCode = Open<components[\"schemas\"][\"StepUpSendCodeResponseDto\"]>;\nexport type TenantApiKeyCreator = Open<components[\"schemas\"][\"TenantApiKeyCreatorDto\"]>;\nexport type TenantApiKey = Open<components[\"schemas\"][\"TenantApiKeyDto\"]>;\nexport type TenantApiKeyIntrospection = Open<components[\"schemas\"][\"TenantApiKeyIntrospectionDto\"]>;\nexport type TenantApiKeyList = Open<components[\"schemas\"][\"TenantApiKeyListResponseDto\"]>;\nexport type TenantApiKeyStatus = Open<components[\"schemas\"][\"TenantApiKeyStatusDto\"]>;\nexport type TenantApiKeyWithSecret = Open<components[\"schemas\"][\"TenantApiKeyWithSecretDto\"]>;\nexport type TenantApiKeysConfig = Open<components[\"schemas\"][\"TenantApiKeysConfigDto\"]>;\nexport type TenantEventData = Open<components[\"schemas\"][\"TenantEventDataDto\"]>;\nexport type TenantInviteAcceptedEventData = Open<components[\"schemas\"][\"TenantInviteAcceptedEventDataDto\"]>;\nexport type TenantInviteCreatedEventData = Open<components[\"schemas\"][\"TenantInviteCreatedEventDataDto\"]>;\nexport type TenantInviteList = Open<components[\"schemas\"][\"TenantInviteListResponseDto\"]>;\nexport type TenantInvite = Open<components[\"schemas\"][\"TenantInviteResponseDto\"]>;\nexport type TenantInviteRevokedEventData = Open<components[\"schemas\"][\"TenantInviteRevokedEventDataDto\"]>;\nexport type TenantList = Open<components[\"schemas\"][\"TenantListResponseDto\"]>;\nexport type TenantMemberAddedEventData = Open<components[\"schemas\"][\"TenantMemberAddedEventDataDto\"]>;\nexport type TenantMemberRemovedEventData = Open<components[\"schemas\"][\"TenantMemberRemovedEventDataDto\"]>;\nexport type TenantMemberRoleChangedEventData = Open<components[\"schemas\"][\"TenantMemberRoleChangedEventDataDto\"]>;\nexport type TenantMembershipForMe = Open<components[\"schemas\"][\"TenantMembershipForMeDto\"]>;\nexport type TenantMembershipList = Open<components[\"schemas\"][\"TenantMembershipListResponseDto\"]>;\nexport type TenantMembership = Open<components[\"schemas\"][\"TenantMembershipResponseDto\"]>;\nexport type Tenant = Open<components[\"schemas\"][\"TenantResponseDto\"]>;\nexport type TotpEnrollmentData = Open<components[\"schemas\"][\"TotpEnrollmentDataDto\"]>;\nexport type UnverifiedAccountExpiryRun = Open<components[\"schemas\"][\"UnverifiedAccountExpiryRunDto\"]>;\nexport type UnverifiedAccountExpiryStatus = Open<components[\"schemas\"][\"UnverifiedAccountExpiryStatusDto\"]>;\nexport type UserContactVerifiedEventData = Open<components[\"schemas\"][\"UserContactVerifiedEventDataDto\"]>;\nexport type UserDeletedEventData = Open<components[\"schemas\"][\"UserDeletedEventDataDto\"]>;\nexport type UserEmailVerifiedEventData = Open<components[\"schemas\"][\"UserEmailVerifiedEventDataDto\"]>;\nexport type UserEventData = Open<components[\"schemas\"][\"UserEventDataDto\"]>;\nexport type UserPasswordResetRequestedEventData = Open<components[\"schemas\"][\"UserPasswordResetRequestedEventDataDto\"]>;\nexport type UserRoleChangedEventData = Open<components[\"schemas\"][\"UserRoleChangedEventDataDto\"]>;\nexport type UserSigninEventData = Open<components[\"schemas\"][\"UserSigninEventDataDto\"]>;\nexport type UserSignupEventData = Open<components[\"schemas\"][\"UserSignupEventDataDto\"]>;\nexport type VerifyPrincipal = Open<components[\"schemas\"][\"VerifyPrincipalDto\"]>;\nexport type Verify = Open<components[\"schemas\"][\"VerifyResponseDto\"]>;\nexport type WebauthnConfig = Open<components[\"schemas\"][\"WebauthnConfigResponseDto\"]>;\nexport type WebauthnEnrollmentData = Open<components[\"schemas\"][\"WebauthnEnrollmentDataDto\"]>;\nexport type WebauthnOptions = Open<components[\"schemas\"][\"WebauthnOptionsResponseDto\"]>;\nexport type WebhookDeliveryAttempt = Open<components[\"schemas\"][\"WebhookDeliveryAttemptDto\"]>;\nexport type WebhookEndpoint = Open<components[\"schemas\"][\"WebhookEndpointDto\"]>;\nexport type WebhookEndpointWithSecret = Open<components[\"schemas\"][\"WebhookEndpointWithSecretDto\"]>;\nexport type WebhookEventDelivery = Open<components[\"schemas\"][\"WebhookEventDeliveryDto\"]>;\nexport type WebhookEventDetail = Open<components[\"schemas\"][\"WebhookEventDetailDto\"]>;\nexport type WebhookEvent = Open<components[\"schemas\"][\"WebhookEventDto\"]>;\nexport type WebhookEventTypeInfo = Open<components[\"schemas\"][\"WebhookEventTypeDto\"]>;\nexport type WebhookPagination = Open<components[\"schemas\"][\"WebhookPaginationDto\"]>;\n\n/** Params for `apps.list` (GET /v1/apps). */\nexport type AppListParams = NonNullable<paths[\"/v1/apps\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `apps.create` (POST /v1/apps). */\nexport type AppCreateParams = NonNullable<paths[\"/v1/apps\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `apps.update` (PATCH /v1/apps/{app_id}). */\nexport type AppUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `apiKeys.list` (GET /v1/apps/{app_id}/api-keys). */\nexport type ApiKeyListParams = NonNullable<paths[\"/v1/apps/{app_id}/api-keys\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `apiKeys.create` (POST /v1/apps/{app_id}/api-keys). */\nexport type ApiKeyCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/api-keys\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `apiKeys.rotate` (POST /v1/apps/{app_id}/api-keys/{key_id}/rotate). */\nexport type ApiKeyRotateParams = NonNullable<paths[\"/v1/apps/{app_id}/api-keys/{key_id}/rotate\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `auditLogs.list` (GET /v1/apps/{app_id}/audit-logs). */\nexport type AuditLogListParams = NonNullable<paths[\"/v1/apps/{app_id}/audit-logs\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `auditLogs.export` (GET /v1/apps/{app_id}/audit-logs/export). */\nexport type AuditLogExportParams = NonNullable<paths[\"/v1/apps/{app_id}/audit-logs/export\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `auditSink.replace` (PUT /v1/apps/{app_id}/audit-sink). */\nexport type AuditSinkReplaceParams = NonNullable<paths[\"/v1/apps/{app_id}/audit-sink\"][\"put\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `auditSink.update` (PATCH /v1/apps/{app_id}/audit-sink). */\nexport type AuditSinkUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/audit-sink\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `authConfig.update` (PATCH /v1/apps/{app_id}/auth-config). */\nexport type AuthConfigUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/auth-config\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `authConfig.providers.list`. */\nexport type AuthConfigProviderListResponse = Open<paths[\"/v1/apps/{app_id}/auth-config/providers\"][\"get\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `authConfig.providers.replace` (PUT /v1/apps/{app_id}/auth-config/providers/{provider}). */\nexport type AuthConfigProviderReplaceParams = NonNullable<paths[\"/v1/apps/{app_id}/auth-config/providers/{provider}\"][\"put\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `authConfig.providers.update` (PATCH /v1/apps/{app_id}/auth-config/providers/{provider}). */\nexport type AuthConfigProviderUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/auth-config/providers/{provider}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `clone` (POST /v1/apps/{app_id}/clone). */\nexport type CloneParams = NonNullable<paths[\"/v1/apps/{app_id}/clone\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `credentials.list` (GET /v1/apps/{app_id}/credentials). */\nexport type CredentialListParams = NonNullable<paths[\"/v1/apps/{app_id}/credentials\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `credentials.create` (POST /v1/apps/{app_id}/credentials). */\nexport type CredentialCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/credentials\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `credentials.update` (PATCH /v1/apps/{app_id}/credentials/{client_id}). */\nexport type CredentialUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/credentials/{client_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `credentials.updateScopes` (PUT /v1/apps/{app_id}/credentials/{client_id}/scopes). */\nexport type CredentialUpdateScopesParams = NonNullable<paths[\"/v1/apps/{app_id}/credentials/{client_id}/scopes\"][\"put\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `credentials.updateScopes`. */\nexport type CredentialUpdateScopesResponse = Open<paths[\"/v1/apps/{app_id}/credentials/{client_id}/scopes\"][\"put\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `customDomains.create` (POST /v1/apps/{app_id}/custom-domains). */\nexport type CustomDomainCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/custom-domains\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `customDomains.apply` (POST /v1/apps/{app_id}/custom-domains/{domain_id}/apply). */\nexport type CustomDomainApplyParams = NonNullable<paths[\"/v1/apps/{app_id}/custom-domains/{domain_id}/apply\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `customDomains.export` (GET /v1/apps/{app_id}/custom-domains/{domain_id}/export). */\nexport type CustomDomainExportParams = NonNullable<paths[\"/v1/apps/{app_id}/custom-domains/{domain_id}/export\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `endUsers.list` (GET /v1/apps/{app_id}/end-users). */\nexport type EndUserListParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `endUsers.bulkDelete` (POST /v1/apps/{app_id}/end-users/bulk-delete). */\nexport type EndUserBulkDeleteParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/bulk-delete\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `endUsers.bulkRevokeSessions` (POST /v1/apps/{app_id}/end-users/bulk-revoke-sessions). */\nexport type EndUserBulkRevokeSessionsParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/bulk-revoke-sessions\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `endUsers.bulkUpdateRole` (POST /v1/apps/{app_id}/end-users/bulk-update-role). */\nexport type EndUserBulkUpdateRoleParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/bulk-update-role\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `endUsers.bulkUpdateStatus` (POST /v1/apps/{app_id}/end-users/bulk-update-status). */\nexport type EndUserBulkUpdateStatusParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/bulk-update-status\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `endUsers.export` (GET /v1/apps/{app_id}/end-users/export). */\nexport type EndUserExportParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/export\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `endUsers.invites.list` (GET /v1/apps/{app_id}/end-users/invites). */\nexport type EndUserInviteListParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/invites\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `endUsers.invites.create` (POST /v1/apps/{app_id}/end-users/invites). */\nexport type EndUserInviteCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/invites\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `endUsers.update` (PATCH /v1/apps/{app_id}/end-users/{user_id}). */\nexport type EndUserUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/{user_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `endUsers.contacts.create` (POST /v1/apps/{app_id}/end-users/{user_id}/contacts). */\nexport type EndUserContactCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/{user_id}/contacts\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `endUsers.updateRole` (PATCH /v1/apps/{app_id}/end-users/{user_id}/role). */\nexport type EndUserUpdateRoleParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/{user_id}/role\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `endUsers.updateStatus` (PATCH /v1/apps/{app_id}/end-users/{user_id}/status). */\nexport type EndUserUpdateStatusParams = NonNullable<paths[\"/v1/apps/{app_id}/end-users/{user_id}/status\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `members.list` (GET /v1/apps/{app_id}/members). */\nexport type MemberListParams = NonNullable<paths[\"/v1/apps/{app_id}/members\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `notificationSettings.update` (PATCH /v1/apps/{app_id}/notification-settings). */\nexport type NotificationSettingUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/notification-settings\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `permissions.list`. */\nexport type AppScopedPermissionListResponse = Open<paths[\"/v1/apps/{app_id}/permissions\"][\"get\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `permissions.create` (POST /v1/apps/{app_id}/permissions). */\nexport type AppScopedPermissionCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/permissions\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `roles.list` (GET /v1/apps/{app_id}/roles). */\nexport type AppScopedRoleListParams = NonNullable<paths[\"/v1/apps/{app_id}/roles\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `roles.create` (POST /v1/apps/{app_id}/roles). */\nexport type AppScopedRoleCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/roles\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `roles.assign` (POST /v1/apps/{app_id}/roles/assign). */\nexport type RoleAssignParams = NonNullable<paths[\"/v1/apps/{app_id}/roles/assign\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `roles.permissions.list`. */\nexport type RolePermissionListResponse = Open<paths[\"/v1/apps/{app_id}/roles/permissions\"][\"get\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `roles.update` (PATCH /v1/apps/{app_id}/roles/{role_name}). */\nexport type AppScopedRoleUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/roles/{role_name}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `roles.updatePermissions` (PUT /v1/apps/{app_id}/roles/{role_name}/permissions). */\nexport type AppScopedRoleUpdatePermissionsParams = NonNullable<paths[\"/v1/apps/{app_id}/roles/{role_name}/permissions\"][\"put\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `roles.updatePermissions`. */\nexport type AppScopedRoleUpdatePermissionsResponse = Open<paths[\"/v1/apps/{app_id}/roles/{role_name}/permissions\"][\"put\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `signInTests.create` (POST /v1/apps/{app_id}/sign-in-tests). */\nexport type SignInTestCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/sign-in-tests\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `updateStatus` (PATCH /v1/apps/{app_id}/status). */\nexport type UpdateStatusParams = NonNullable<paths[\"/v1/apps/{app_id}/status\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenantApiKeys.list` (GET /v1/apps/{app_id}/tenant-api-keys). */\nexport type AppScopedTenantApiKeyListParams = NonNullable<paths[\"/v1/apps/{app_id}/tenant-api-keys\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `tenantApiKeys.config.update` (PUT /v1/apps/{app_id}/tenant-api-keys/config). */\nexport type AppScopedTenantApiKeyConfigUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/tenant-api-keys/config\"][\"put\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.list` (GET /v1/apps/{app_id}/tenants). */\nexport type AppScopedTenantListParams = NonNullable<paths[\"/v1/apps/{app_id}/tenants\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `tenants.create` (POST /v1/apps/{app_id}/tenants). */\nexport type AppScopedTenantCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/tenants\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.update` (PATCH /v1/apps/{app_id}/tenants/{tenant_id}). */\nexport type AppScopedTenantUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/tenants/{tenant_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.invites.list` (GET /v1/apps/{app_id}/tenants/{tenant_id}/invites). */\nexport type AppScopedTenantInviteListParams = NonNullable<paths[\"/v1/apps/{app_id}/tenants/{tenant_id}/invites\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `tenants.invites.create` (POST /v1/apps/{app_id}/tenants/{tenant_id}/invites). */\nexport type AppScopedTenantInviteCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/tenants/{tenant_id}/invites\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.members.list` (GET /v1/apps/{app_id}/tenants/{tenant_id}/members). */\nexport type AppScopedTenantMemberListParams = NonNullable<paths[\"/v1/apps/{app_id}/tenants/{tenant_id}/members\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `tenants.members.create` (POST /v1/apps/{app_id}/tenants/{tenant_id}/members). */\nexport type AppScopedTenantMemberCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/tenants/{tenant_id}/members\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.members.update` (PATCH /v1/apps/{app_id}/tenants/{tenant_id}/members/{account_id}). */\nexport type AppScopedTenantMemberUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/tenants/{tenant_id}/members/{account_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `unverifiedAccountExpiry.run` (POST /v1/apps/{app_id}/unverified-account-expiry/run). */\nexport type UnverifiedAccountExpiryRunParams = NonNullable<paths[\"/v1/apps/{app_id}/unverified-account-expiry/run\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `webauthnConfig.update` (PUT /v1/apps/{app_id}/webauthn-config). */\nexport type WebauthnConfigUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/webauthn-config\"][\"put\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `webhooks.endpoints.create` (POST /v1/apps/{app_id}/webhooks/endpoints). */\nexport type WebhookEndpointCreateParams = NonNullable<paths[\"/v1/apps/{app_id}/webhooks/endpoints\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `webhooks.endpoints.update` (PATCH /v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}). */\nexport type WebhookEndpointUpdateParams = NonNullable<paths[\"/v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `webhooks.endpoints.rotateSecret` (POST /v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}/rotate-secret). */\nexport type WebhookEndpointRotateSecretParams = NonNullable<paths[\"/v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}/rotate-secret\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `webhooks.endpoints.test` (POST /v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}/test). */\nexport type WebhookEndpointTestParams = NonNullable<paths[\"/v1/apps/{app_id}/webhooks/endpoints/{endpoint_id}/test\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `webhooks.events.list` (GET /v1/apps/{app_id}/webhooks/events). */\nexport type WebhookEventListParams = NonNullable<paths[\"/v1/apps/{app_id}/webhooks/events\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `webhooks.events.replay` (POST /v1/apps/{app_id}/webhooks/events/{event_id}/replay). */\nexport type WebhookEventReplayParams = NonNullable<paths[\"/v1/apps/{app_id}/webhooks/events/{event_id}/replay\"][\"post\"][\"parameters\"][\"query\"]>;\n/** Params for `stats.me` (GET /v1/stats/me). */\nexport type StatsMeParams = NonNullable<paths[\"/v1/stats/me\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `stats.retrieve` (GET /v1/workspaces/{workspace_id}/stats). */\nexport type StatsRetrieveParams = NonNullable<paths[\"/v1/workspaces/{workspace_id}/stats\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Response of `permissions.list`. */\nexport type ConsumerScopedPermissionListResponse = Open<paths[\"/{app_slug}/v1/admin/permissions\"][\"get\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `permissions.create` (POST /{app_slug}/v1/admin/permissions). */\nexport type ConsumerScopedPermissionCreateParams = NonNullable<paths[\"/{app_slug}/v1/admin/permissions\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `roles.list` (GET /{app_slug}/v1/admin/roles). */\nexport type ConsumerScopedRoleListParams = NonNullable<paths[\"/{app_slug}/v1/admin/roles\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `roles.create` (POST /{app_slug}/v1/admin/roles). */\nexport type ConsumerScopedRoleCreateParams = NonNullable<paths[\"/{app_slug}/v1/admin/roles\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `roles.update` (PATCH /{app_slug}/v1/admin/roles/{role_name}). */\nexport type ConsumerScopedRoleUpdateParams = NonNullable<paths[\"/{app_slug}/v1/admin/roles/{role_name}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `roles.updatePermissions` (PUT /{app_slug}/v1/admin/roles/{role_name}/permissions). */\nexport type ConsumerScopedRoleUpdatePermissionsParams = NonNullable<paths[\"/{app_slug}/v1/admin/roles/{role_name}/permissions\"][\"put\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `roles.updatePermissions`. */\nexport type ConsumerScopedRoleUpdatePermissionsResponse = Open<paths[\"/{app_slug}/v1/admin/roles/{role_name}/permissions\"][\"put\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `users.list` (GET /{app_slug}/v1/admin/users). */\nexport type UserListParams = NonNullable<paths[\"/{app_slug}/v1/admin/users\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `users.create` (POST /{app_slug}/v1/admin/users). */\nexport type UserCreateParams = NonNullable<paths[\"/{app_slug}/v1/admin/users\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `users.update` (PATCH /{app_slug}/v1/admin/users/{user_id}). */\nexport type UserUpdateParams = NonNullable<paths[\"/{app_slug}/v1/admin/users/{user_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `users.updateRole` (PATCH /{app_slug}/v1/admin/users/{user_id}/role). */\nexport type UserUpdateRoleParams = NonNullable<paths[\"/{app_slug}/v1/admin/users/{user_id}/role\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `users.updateStatus` (PATCH /{app_slug}/v1/admin/users/{user_id}/status). */\nexport type UserUpdateStatusParams = NonNullable<paths[\"/{app_slug}/v1/admin/users/{user_id}/status\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `acceptInvite` (POST /{app_slug}/v1/auth/accept-invite). */\nexport type AcceptInviteParams = NonNullable<paths[\"/{app_slug}/v1/auth/accept-invite\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `acceptInvite`. */\nexport type AcceptInviteResponse = Open<paths[\"/{app_slug}/v1/auth/accept-invite\"][\"post\"][\"responses\"][201][\"content\"][\"application/json\"]>;\n/** Params for `acceptTenantInvite` (POST /{app_slug}/v1/auth/accept-tenant-invite). */\nexport type AcceptTenantInviteParams = NonNullable<paths[\"/{app_slug}/v1/auth/accept-tenant-invite\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `logout` (POST /{app_slug}/v1/auth/logout). */\nexport type LogoutParams = NonNullable<paths[\"/{app_slug}/v1/auth/logout\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `mfa.enroll` (POST /{app_slug}/v1/auth/mfa/enroll). */\nexport type MfaEnrollParams = NonNullable<paths[\"/{app_slug}/v1/auth/mfa/enroll\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `mfa.verifyEnrollment` (POST /{app_slug}/v1/auth/mfa/enroll/verify). */\nexport type MfaVerifyEnrollmentParams = NonNullable<paths[\"/{app_slug}/v1/auth/mfa/enroll/verify\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `mfa.recover` (POST /{app_slug}/v1/auth/mfa/recover). */\nexport type MfaRecoverParams = NonNullable<paths[\"/{app_slug}/v1/auth/mfa/recover\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `mfa.sendCode` (POST /{app_slug}/v1/auth/mfa/send-code). */\nexport type MfaSendCodeParams = NonNullable<paths[\"/{app_slug}/v1/auth/mfa/send-code\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `mfa.verify` (POST /{app_slug}/v1/auth/mfa/verify). */\nexport type MfaVerifyParams = NonNullable<paths[\"/{app_slug}/v1/auth/mfa/verify\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `mfa.webauthn.options` (POST /{app_slug}/v1/auth/mfa/webauthn/options). */\nexport type MfaWebauthnOptionsParams = NonNullable<paths[\"/{app_slug}/v1/auth/mfa/webauthn/options\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `exchangeProviderCode` (POST /{app_slug}/v1/auth/oauth/exchange). */\nexport type ExchangeProviderCodeParams = NonNullable<paths[\"/{app_slug}/v1/auth/oauth/exchange\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `signinWithProvider` (POST /{app_slug}/v1/auth/oauth/{provider}). */\nexport type SigninWithProviderParams = NonNullable<paths[\"/{app_slug}/v1/auth/oauth/{provider}\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `signinWithProvider`. */\nexport type SigninWithProviderResponse = Open<paths[\"/{app_slug}/v1/auth/oauth/{provider}\"][\"post\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `passkey.options` (POST /{app_slug}/v1/auth/passkey/options). */\nexport type PasskeyOptionsParams = NonNullable<paths[\"/{app_slug}/v1/auth/passkey/options\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `passkey.verify` (POST /{app_slug}/v1/auth/passkey/verify). */\nexport type PasskeyVerifyParams = NonNullable<paths[\"/{app_slug}/v1/auth/passkey/verify\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `refresh` (POST /{app_slug}/v1/auth/refresh). */\nexport type RefreshParams = NonNullable<paths[\"/{app_slug}/v1/auth/refresh\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `requestPasswordReset` (POST /{app_slug}/v1/auth/request-password-reset). */\nexport type RequestPasswordResetParams = NonNullable<paths[\"/{app_slug}/v1/auth/request-password-reset\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `requestVerification` (POST /{app_slug}/v1/auth/request-verification). */\nexport type RequestVerificationParams = NonNullable<paths[\"/{app_slug}/v1/auth/request-verification\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `resetPassword` (POST /{app_slug}/v1/auth/reset-password). */\nexport type ResetPasswordParams = NonNullable<paths[\"/{app_slug}/v1/auth/reset-password\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `sendPasswordResetEmail` (POST /{app_slug}/v1/auth/send-password-reset-email). */\nexport type SendPasswordResetEmailParams = NonNullable<paths[\"/{app_slug}/v1/auth/send-password-reset-email\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `sendVerificationEmail` (POST /{app_slug}/v1/auth/send-verification-email). */\nexport type SendVerificationEmailParams = NonNullable<paths[\"/{app_slug}/v1/auth/send-verification-email\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `signin` (POST /{app_slug}/v1/auth/signin). */\nexport type SigninParams = NonNullable<paths[\"/{app_slug}/v1/auth/signin\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `signin`. */\nexport type SigninResponse = Open<paths[\"/{app_slug}/v1/auth/signin\"][\"post\"][\"responses\"][200][\"content\"][\"application/json\"]>;\n/** Params for `signup` (POST /{app_slug}/v1/auth/signup). */\nexport type SignupParams = NonNullable<paths[\"/{app_slug}/v1/auth/signup\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Response of `signup`. */\nexport type SignupResponse = Open<paths[\"/{app_slug}/v1/auth/signup\"][\"post\"][\"responses\"][201][\"content\"][\"application/json\"]>;\n/** Params for `switchTenant` (POST /{app_slug}/v1/auth/switch-tenant). */\nexport type SwitchTenantParams = NonNullable<paths[\"/{app_slug}/v1/auth/switch-tenant\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `verifyEmail` (POST /{app_slug}/v1/auth/verify). */\nexport type VerifyEmailParams = NonNullable<paths[\"/{app_slug}/v1/auth/verify\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `verify.authorize` (POST /{app_slug}/v1/authorize). */\nexport type VerifyAuthorizeParams = NonNullable<paths[\"/{app_slug}/v1/authorize\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `verify.authorizeBatch` (POST /{app_slug}/v1/authorize/batch). */\nexport type VerifyAuthorizeBatchParams = NonNullable<paths[\"/{app_slug}/v1/authorize/batch\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `me.update` (PATCH /{app_slug}/v1/me). */\nexport type MeUpdateParams = NonNullable<paths[\"/{app_slug}/v1/me\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `me.uploadAvatar` (POST /{app_slug}/v1/me/avatar). */\nexport type MeUploadAvatarParams = { /** PNG, JPEG, or WEBP image, ≤2 MB. */ file: Blob };\n/** Params for `me.changePassword` (POST /{app_slug}/v1/me/change-password). */\nexport type MeChangePasswordParams = NonNullable<paths[\"/{app_slug}/v1/me/change-password\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `me.contacts.create` (POST /{app_slug}/v1/me/contacts). */\nexport type MeContactCreateParams = NonNullable<paths[\"/{app_slug}/v1/me/contacts\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `me.mfa.factors.create` (POST /{app_slug}/v1/me/mfa/factors). */\nexport type MeMfaFactorCreateParams = NonNullable<paths[\"/{app_slug}/v1/me/mfa/factors\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `me.mfa.factors.verify` (POST /{app_slug}/v1/me/mfa/factors/{id}/verify). */\nexport type MeMfaFactorVerifyParams = NonNullable<paths[\"/{app_slug}/v1/me/mfa/factors/{id}/verify\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `me.mfa.stepUp.verify` (POST /{app_slug}/v1/me/mfa/step-up). */\nexport type MeMfaStepUpVerifyParams = NonNullable<paths[\"/{app_slug}/v1/me/mfa/step-up\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `me.mfa.stepUp.sendCode` (POST /{app_slug}/v1/me/mfa/step-up/send-code). */\nexport type MeMfaStepUpSendCodeParams = NonNullable<paths[\"/{app_slug}/v1/me/mfa/step-up/send-code\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `me.tenantInvites.accept` (POST /{app_slug}/v1/me/tenant-invites/accept). */\nexport type MeTenantInviteAcceptParams = NonNullable<paths[\"/{app_slug}/v1/me/tenant-invites/accept\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `oauth.introspect` (POST /{app_slug}/v1/oauth/introspect). */\nexport type OauthIntrospectParams = NonNullable<paths[\"/{app_slug}/v1/oauth/introspect\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `oauth.token` (POST /{app_slug}/v1/oauth/token). */\nexport type OauthTokenParams = NonNullable<paths[\"/{app_slug}/v1/oauth/token\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenantApiKeys.list` (GET /{app_slug}/v1/tenant-api-keys). */\nexport type ConsumerScopedTenantApiKeyListParams = NonNullable<paths[\"/{app_slug}/v1/tenant-api-keys\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `tenantApiKeys.create` (POST /{app_slug}/v1/tenant-api-keys). */\nexport type TenantApiKeyCreateParams = NonNullable<paths[\"/{app_slug}/v1/tenant-api-keys\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenantApiKeys.config.update` (PUT /{app_slug}/v1/tenant-api-keys/config). */\nexport type ConsumerScopedTenantApiKeyConfigUpdateParams = NonNullable<paths[\"/{app_slug}/v1/tenant-api-keys/config\"][\"put\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenantApiKeys.introspect` (POST /{app_slug}/v1/tenant-api-keys/introspect). */\nexport type TenantApiKeyIntrospectParams = NonNullable<paths[\"/{app_slug}/v1/tenant-api-keys/introspect\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenantApiKeys.rotate` (POST /{app_slug}/v1/tenant-api-keys/{key_id}/rotate). */\nexport type TenantApiKeyRotateParams = NonNullable<paths[\"/{app_slug}/v1/tenant-api-keys/{key_id}/rotate\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.list` (GET /{app_slug}/v1/tenants). */\nexport type ConsumerScopedTenantListParams = NonNullable<paths[\"/{app_slug}/v1/tenants\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `tenants.create` (POST /{app_slug}/v1/tenants). */\nexport type ConsumerScopedTenantCreateParams = NonNullable<paths[\"/{app_slug}/v1/tenants\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.update` (PATCH /{app_slug}/v1/tenants/{tenant_id}). */\nexport type ConsumerScopedTenantUpdateParams = NonNullable<paths[\"/{app_slug}/v1/tenants/{tenant_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.invites.list` (GET /{app_slug}/v1/tenants/{tenant_id}/invites). */\nexport type ConsumerScopedTenantInviteListParams = NonNullable<paths[\"/{app_slug}/v1/tenants/{tenant_id}/invites\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `tenants.invites.create` (POST /{app_slug}/v1/tenants/{tenant_id}/invites). */\nexport type ConsumerScopedTenantInviteCreateParams = NonNullable<paths[\"/{app_slug}/v1/tenants/{tenant_id}/invites\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.members.list` (GET /{app_slug}/v1/tenants/{tenant_id}/members). */\nexport type ConsumerScopedTenantMemberListParams = NonNullable<paths[\"/{app_slug}/v1/tenants/{tenant_id}/members\"][\"get\"][\"parameters\"][\"query\"]>;\n/** Params for `tenants.members.create` (POST /{app_slug}/v1/tenants/{tenant_id}/members). */\nexport type ConsumerScopedTenantMemberCreateParams = NonNullable<paths[\"/{app_slug}/v1/tenants/{tenant_id}/members\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `tenants.members.update` (PATCH /{app_slug}/v1/tenants/{tenant_id}/members/{account_id}). */\nexport type ConsumerScopedTenantMemberUpdateParams = NonNullable<paths[\"/{app_slug}/v1/tenants/{tenant_id}/members/{account_id}\"][\"patch\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `users.factors.create` (POST /{app_slug}/v1/users/{user_id}/factors). */\nexport type UserFactorCreateParams = NonNullable<paths[\"/{app_slug}/v1/users/{user_id}/factors\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n/** Params for `verify.token` (POST /{app_slug}/v1/verify). */\nexport type VerifyTokenParams = NonNullable<paths[\"/{app_slug}/v1/verify\"][\"post\"][\"requestBody\"]>[\"content\"][\"application/json\"];\n","// Generated by scripts/gen-sdk.mjs from Specs/auth.json. Do not edit.\n\nimport { APIClient, createOpenAPIClient, PC_BASE_URL, type ClientOptions, type PollOptions as CorePollOptions, type RequestOptions as CoreRequestOptions } from \"@productcraft/core\";\nimport type { Client } from \"openapi-fetch\";\nimport type * as E from \"./errors.js\";\nimport type { paths } from \"./paths.js\";\nimport { AuthApp } from \"./resources.js\";\nimport { AuthBase, type AuthOptions } from \"../base.js\";\nimport * as T from \"./types.js\";\nimport type * as W from \"./webhooks.js\";\n\ndeclare const __PC_SDK_VERSION__: string | undefined;\nconst VERSION = typeof __PC_SDK_VERSION__ === \"string\" ? __PC_SDK_VERSION__ : \"0.0.0-dev\";\n\n/**\n * ProductCraft Auth API client (apps, end users, roles, sign-in flows, sessions, MFA and tenants). Every method is generated from the API's OpenAPI document.\n *\n * @example\n * ```ts\n * import { Auth } from \"@productcraft/auth\";\n * const auth = new Auth({ apiKey: process.env.PRODUCTCRAFT_API_KEY });\n * ```\n */\n\nexport class Auth extends AuthBase {\n #openapi?: Client<paths>;\n constructor(options: AuthOptions = {}) {\n const sdk = { name: \"auth\", version: VERSION };\n super(new APIClient(options, PC_BASE_URL.auth, sdk), options, (o: ClientOptions) => new APIClient(o, PC_BASE_URL.auth, sdk));\n }\n /** The typed `openapi-fetch` escape hatch over the same credential and base URL. It does not retry. */\n get client(): Client<paths> {\n return (this.#openapi ??= createOpenAPIClient<paths>(this._client));\n }\n /**\n * Scoped namespaces under `admin`: `admin.app(…)`.\n */\n get admin(): { app(appId: string): AuthApp } {\n const client = this._client;\n return {\n app: (appId: string) => new AuthApp(client, { app_id: appId }),\n };\n }\n /**\n * Alias of `auth.admin.app(…)`.\n * @param appId - `{app_id}`\n */\n app(appId: string): AuthApp {\n return new AuthApp(this._client, { app_id: appId });\n }\n}\n\ntype __RequestOptions = CoreRequestOptions;\ntype __PollOptions = CorePollOptions;\ntype __ApiKeyStatus = T.ApiKeyStatus;\ntype __AppEnvironment = T.AppEnvironment;\ntype __AppStatus = T.AppStatus;\ntype __ApplyPlanAction = T.ApplyPlanAction;\ntype __ApplyPlanResult = T.ApplyPlanResult;\ntype __AuditSinkAttemptKind = T.AuditSinkAttemptKind;\ntype __AuditSinkState = T.AuditSinkState;\ntype __AuthStatsMetric = T.AuthStatsMetric;\ntype __BotProtectionProvider = T.BotProtectionProvider;\ntype __ContactType = T.ContactType;\ntype __CustomDomainApplyWarning = T.CustomDomainApplyWarning;\ntype __CustomDomainStatus = T.CustomDomainStatus;\ntype __DnsConflictSeverity = T.DnsConflictSeverity;\ntype __DnsProvider = T.DnsProvider;\ntype __DnsRecordPurpose = T.DnsRecordPurpose;\ntype __DnsRecordState = T.DnsRecordState;\ntype __DnsRecordType = T.DnsRecordType;\ntype __EndUserStatus = T.EndUserStatus;\ntype __EnrollmentType = T.EnrollmentType;\ntype __ImportJobStatus = T.ImportJobStatus;\ntype __IntrospectedTokenType = T.IntrospectedTokenType;\ntype __JwkUse = T.JwkUse;\ntype __MfaPolicy = T.MfaPolicy;\ntype __OAuthLinkPolicy = T.OAuthLinkPolicy;\ntype __OAuthProvider = T.OAuthProvider;\ntype __PasswordBreachCheck = T.PasswordBreachCheck;\ntype __ProviderBlockedReason = T.ProviderBlockedReason;\ntype __ProviderCheckResult = T.ProviderCheckResult;\ntype __ProviderStatus = T.ProviderStatus;\ntype __SenderDomainStatus = T.SenderDomainStatus;\ntype __SenderSource = T.SenderSource;\ntype __SetupRowState = T.SetupRowState;\ntype __SignInResult = T.SignInResult;\ntype __SignInTestEmailNoticeCode = T.SignInTestEmailNoticeCode;\ntype __SignInTestMethod = T.SignInTestMethod;\ntype __SignInTestOutcome = T.SignInTestOutcome;\ntype __SignInTestState = T.SignInTestState;\ntype __StatsGranularity = T.StatsGranularity;\ntype __StatsWindow = T.StatsWindow;\ntype __TenantApiKeyAdminState = T.TenantApiKeyAdminState;\ntype __TenantApiKeyEffectiveStatus = T.TenantApiKeyEffectiveStatus;\ntype __TenantApiKeyEnv = T.TenantApiKeyEnv;\ntype __TenantApiKeyManagementLane = T.TenantApiKeyManagementLane;\ntype __TenantApiKeyRevokeReason = T.TenantApiKeyRevokeReason;\ntype __TenantApiKeyState = T.TenantApiKeyState;\ntype __TenantInviteStatus = T.TenantInviteStatus;\ntype __TenantStatus = T.TenantStatus;\ntype __TokenType = T.TokenType;\ntype __UserCreatedVia = T.UserCreatedVia;\ntype __UserDeletedReason = T.UserDeletedReason;\ntype __UserDeletedVia = T.UserDeletedVia;\ntype __WebhookAttemptTrigger = T.WebhookAttemptTrigger;\ntype __WebhookEndpointDisabledReason = T.WebhookEndpointDisabledReason;\ntype __WebhookEndpointStatus = T.WebhookEndpointStatus;\ntype __WebhookEventStatus = T.WebhookEventStatus;\ntype __WebhookEventType = T.WebhookEventType;\ntype __AcceptedTenantInvite = T.AcceptedTenantInvite;\ntype __AccountContact = T.AccountContact;\ntype __AccountContactList = T.AccountContactList;\ntype __AddMember = T.AddMember;\ntype __AdminProvisionFactor = T.AdminProvisionFactor;\ntype __ApiKeyList = T.ApiKeyList;\ntype __ApiKeySummary = T.ApiKeySummary;\ntype __AppList = T.AppList;\ntype __AppMemberList = T.AppMemberList;\ntype __AppMemberSummary = T.AppMemberSummary;\ntype __AppMembership = T.AppMembership;\ntype __AppNotificationSettings = T.AppNotificationSettings;\ntype __AppPermissionCatalogEntry = T.AppPermissionCatalogEntry;\ntype __App = T.App;\ntype __AppSlugChangedEventData = T.AppSlugChangedEventData;\ntype __ApplyConflict = T.ApplyConflict;\ntype __ApplyCounts = T.ApplyCounts;\ntype __ApplyPlanItem = T.ApplyPlanItem;\ntype __AuditLogEntry = T.AuditLogEntry;\ntype __AuditLogList = T.AuditLogList;\ntype __AuditSink = T.AuditSink;\ntype __AuditSinkTestResult = T.AuditSinkTestResult;\ntype __AuditSinkWithSecret = T.AuditSinkWithSecret;\ntype __AuthConfig = T.AuthConfig;\ntype __AuthStatsInWindow = T.AuthStatsInWindow;\ntype __AuthStatsSeries = T.AuthStatsSeries;\ntype __AuthStatsTotals = T.AuthStatsTotals;\ntype __AuthWorkspaceStats = T.AuthWorkspaceStats;\ntype __AuthorizeBatch = T.AuthorizeBatch;\ntype __AuthorizeBatchResult = T.AuthorizeBatchResult;\ntype __Authorize = T.Authorize;\ntype __AvatarUrl = T.AvatarUrl;\ntype __BotProtection = T.BotProtection;\ntype __BulkAffectedUsers = T.BulkAffectedUsers;\ntype __CloneApp = T.CloneApp;\ntype __ConfirmEnrollment = T.ConfirmEnrollment;\ntype __ConsumerAddMember = T.ConsumerAddMember;\ntype __ConsumerAdminCreatedUser = T.ConsumerAdminCreatedUser;\ntype __ConsumerAdminEndUser = T.ConsumerAdminEndUser;\ntype __ConsumerAdminEndUserList = T.ConsumerAdminEndUserList;\ntype __ConsumerAdminPermission = T.ConsumerAdminPermission;\ntype __ConsumerAdminPermissionListEntry = T.ConsumerAdminPermissionListEntry;\ntype __ConsumerAdminRoleAssignment = T.ConsumerAdminRoleAssignment;\ntype __ConsumerCodeDispatch = T.ConsumerCodeDispatch;\ntype __ConsumerCodeIssue = T.ConsumerCodeIssue;\ntype __ConsumerMfaChallengeFactor = T.ConsumerMfaChallengeFactor;\ntype __ConsumerMfaChallenge = T.ConsumerMfaChallenge;\ntype __ConsumerMfaEnrollVerify = T.ConsumerMfaEnrollVerify;\ntype __ConsumerMfaEnrollmentRequired = T.ConsumerMfaEnrollmentRequired;\ntype __ConsumerMfaSendCode = T.ConsumerMfaSendCode;\ntype __ConsumerRoleList = T.ConsumerRoleList;\ntype __ConsumerRolePermissionEntry = T.ConsumerRolePermissionEntry;\ntype __ConsumerRole = T.ConsumerRole;\ntype __ConsumerRoleWithPermissions = T.ConsumerRoleWithPermissions;\ntype __ConsumerTenantList = T.ConsumerTenantList;\ntype __ConsumerTenantMembershipList = T.ConsumerTenantMembershipList;\ntype __ConsumerTenantMembership = T.ConsumerTenantMembership;\ntype __ConsumerTenant = T.ConsumerTenant;\ntype __ConsumerToken = T.ConsumerToken;\ntype __ConsumerVerify = T.ConsumerVerify;\ntype __ConsumerWebauthnOptions = T.ConsumerWebauthnOptions;\ntype __CreateApiKey = T.CreateApiKey;\ntype __CreateTenantInvite = T.CreateTenantInvite;\ntype __CustomDomainApplyResult = T.CustomDomainApplyResult;\ntype __CustomDomainCallbackUrls = T.CustomDomainCallbackUrls;\ntype __CustomDomain = T.CustomDomain;\ntype __CustomDomainList = T.CustomDomainList;\ntype __CustomDomainRecord = T.CustomDomainRecord;\ntype __DnsConflict = T.DnsConflict;\ntype __DnsProviderRef = T.DnsProviderRef;\ntype __EffectiveSender = T.EffectiveSender;\ntype __EmailEnrollmentData = T.EmailEnrollmentData;\ntype __EndUserActionCount = T.EndUserActionCount;\ntype __EndUserActivityEntry = T.EndUserActivityEntry;\ntype __EndUserDetailInsights = T.EndUserDetailInsights;\ntype __EndUserFactorEntry = T.EndUserFactorEntry;\ntype __EndUserInsights = T.EndUserInsights;\ntype __EndUserInviteList = T.EndUserInviteList;\ntype __EndUserInvite = T.EndUserInvite;\ntype __EndUserList = T.EndUserList;\ntype __EndUserRoleAssignment = T.EndUserRoleAssignment;\ntype __EndUserSessionEntry = T.EndUserSessionEntry;\ntype __EndUserSummary = T.EndUserSummary;\ntype __EnforcedPermissions = T.EnforcedPermissions;\ntype __Exchange = T.Exchange;\ntype __FactorList = T.FactorList;\ntype __GrantableScope = T.GrantableScope;\ntype __IdpMfaEnrollmentRequired = T.IdpMfaEnrollmentRequired;\ntype __IdpToken = T.IdpToken;\ntype __ImportJobError = T.ImportJobError;\ntype __ImportJob = T.ImportJob;\ntype __InsightsMfa = T.InsightsMfa;\ntype __InsightsPasswordReset = T.InsightsPasswordReset;\ntype __InsightsSessions = T.InsightsSessions;\ntype __InsightsSignin = T.InsightsSignin;\ntype __InsightsUsers = T.InsightsUsers;\ntype __InsightsVerification = T.InsightsVerification;\ntype __Introspect = T.Introspect;\ntype __IntrospectionCreator = T.IntrospectionCreator;\ntype __IssuedVerificationCode = T.IssuedVerificationCode;\ntype __Jwk = T.Jwk;\ntype __Jwks = T.Jwks;\ntype __ListWebhookEndpoints = T.ListWebhookEndpoints;\ntype __ListWebhookEventTypes = T.ListWebhookEventTypes;\ntype __ListWebhookEvents = T.ListWebhookEvents;\ntype __M2mClientCreate = T.M2mClientCreate;\ntype __M2mClientDetail = T.M2mClientDetail;\ntype __M2mClientList = T.M2mClientList;\ntype __M2mClientSummary = T.M2mClientSummary;\ntype __M2mRotateSecret = T.M2mRotateSecret;\ntype __M2mScopeEntry = T.M2mScopeEntry;\ntype __MeActivityEntry = T.MeActivityEntry;\ntype __MeActivity = T.MeActivity;\ntype __MeContact = T.MeContact;\ntype __MeContacts = T.MeContacts;\ntype __MePermissions = T.MePermissions;\ntype __MeProfile = T.MeProfile;\ntype __MeSession = T.MeSession;\ntype __MeSessions = T.MeSessions;\ntype __MeUpdatedAccount = T.MeUpdatedAccount;\ntype __MfaEnrollmentRequiredEventData = T.MfaEnrollmentRequiredEventData;\ntype __MfaFactorEventData = T.MfaFactorEventData;\ntype __MfaRecoveryCodeUsedEventData = T.MfaRecoveryCodeUsedEventData;\ntype __MfaStepUpLockedEventData = T.MfaStepUpLockedEventData;\ntype __MfaStepUpSucceededEventData = T.MfaStepUpSucceededEventData;\ntype __MyTenants = T.MyTenants;\ntype __NotificationTest = T.NotificationTest;\ntype __OAuthToken = T.OAuthToken;\ntype __OpenIdConfiguration = T.OpenIdConfiguration;\ntype __Pagination = T.Pagination;\ntype __Permission = T.Permission;\ntype __PlatformTenantApiKey = T.PlatformTenantApiKey;\ntype __PlatformTenantApiKeyList = T.PlatformTenantApiKeyList;\ntype __PlatformUserStats = T.PlatformUserStats;\ntype __ProviderCheck = T.ProviderCheck;\ntype __ProviderDetail = T.ProviderDetail;\ntype __ProviderListEntry = T.ProviderListEntry;\ntype __PublicFactor = T.PublicFactor;\ntype __RecoveryCodes = T.RecoveryCodes;\ntype __ReplayWebhookEvent = T.ReplayWebhookEvent;\ntype __RequireMfaReenrollment = T.RequireMfaReenrollment;\ntype __RoleList = T.RoleList;\ntype __RolePermissionEntry = T.RolePermissionEntry;\ntype __Role = T.Role;\ntype __RoleWithPermissions = T.RoleWithPermissions;\ntype __RotateApiKey = T.RotateApiKey;\ntype __SetupRow = T.SetupRow;\ntype __SetupRowFix = T.SetupRowFix;\ntype __SetupRowTest = T.SetupRowTest;\ntype __SetupStatus = T.SetupStatus;\ntype __SignInTest = T.SignInTest;\ntype __SignInTestEmailDelivery = T.SignInTestEmailDelivery;\ntype __SignInTestEmailNotice = T.SignInTestEmailNotice;\ntype __SignInTestError = T.SignInTestError;\ntype __SignInTestIdentity = T.SignInTestIdentity;\ntype __StartEnrollment = T.StartEnrollment;\ntype __StatsSeriesPoint = T.StatsSeriesPoint;\ntype __StepUp = T.StepUp;\ntype __StepUpSendCode = T.StepUpSendCode;\ntype __TenantApiKeyCreator = T.TenantApiKeyCreator;\ntype __TenantApiKey = T.TenantApiKey;\ntype __TenantApiKeyIntrospection = T.TenantApiKeyIntrospection;\ntype __TenantApiKeyList = T.TenantApiKeyList;\ntype __TenantApiKeyStatus = T.TenantApiKeyStatus;\ntype __TenantApiKeyWithSecret = T.TenantApiKeyWithSecret;\ntype __TenantApiKeysConfig = T.TenantApiKeysConfig;\ntype __TenantEventData = T.TenantEventData;\ntype __TenantInviteAcceptedEventData = T.TenantInviteAcceptedEventData;\ntype __TenantInviteCreatedEventData = T.TenantInviteCreatedEventData;\ntype __TenantInviteList = T.TenantInviteList;\ntype __TenantInvite = T.TenantInvite;\ntype __TenantInviteRevokedEventData = T.TenantInviteRevokedEventData;\ntype __TenantList = T.TenantList;\ntype __TenantMemberAddedEventData = T.TenantMemberAddedEventData;\ntype __TenantMemberRemovedEventData = T.TenantMemberRemovedEventData;\ntype __TenantMemberRoleChangedEventData = T.TenantMemberRoleChangedEventData;\ntype __TenantMembershipForMe = T.TenantMembershipForMe;\ntype __TenantMembershipList = T.TenantMembershipList;\ntype __TenantMembership = T.TenantMembership;\ntype __Tenant = T.Tenant;\ntype __TotpEnrollmentData = T.TotpEnrollmentData;\ntype __UnverifiedAccountExpiryRun = T.UnverifiedAccountExpiryRun;\ntype __UnverifiedAccountExpiryStatus = T.UnverifiedAccountExpiryStatus;\ntype __UserContactVerifiedEventData = T.UserContactVerifiedEventData;\ntype __UserDeletedEventData = T.UserDeletedEventData;\ntype __UserEmailVerifiedEventData = T.UserEmailVerifiedEventData;\ntype __UserEventData = T.UserEventData;\ntype __UserPasswordResetRequestedEventData = T.UserPasswordResetRequestedEventData;\ntype __UserRoleChangedEventData = T.UserRoleChangedEventData;\ntype __UserSigninEventData = T.UserSigninEventData;\ntype __UserSignupEventData = T.UserSignupEventData;\ntype __VerifyPrincipal = T.VerifyPrincipal;\ntype __Verify = T.Verify;\ntype __WebauthnConfig = T.WebauthnConfig;\ntype __WebauthnEnrollmentData = T.WebauthnEnrollmentData;\ntype __WebauthnOptions = T.WebauthnOptions;\ntype __WebhookDeliveryAttempt = T.WebhookDeliveryAttempt;\ntype __WebhookEndpoint = T.WebhookEndpoint;\ntype __WebhookEndpointWithSecret = T.WebhookEndpointWithSecret;\ntype __WebhookEventDelivery = T.WebhookEventDelivery;\ntype __WebhookEventDetail = T.WebhookEventDetail;\ntype __WebhookEvent = T.WebhookEvent;\ntype __WebhookEventTypeInfo = T.WebhookEventTypeInfo;\ntype __WebhookPagination = T.WebhookPagination;\ntype __AppListParams = T.AppListParams;\ntype __AppCreateParams = T.AppCreateParams;\ntype __AppUpdateParams = T.AppUpdateParams;\ntype __ApiKeyListParams = T.ApiKeyListParams;\ntype __ApiKeyCreateParams = T.ApiKeyCreateParams;\ntype __ApiKeyRotateParams = T.ApiKeyRotateParams;\ntype __AuditLogListParams = T.AuditLogListParams;\ntype __AuditLogExportParams = T.AuditLogExportParams;\ntype __AuditSinkReplaceParams = T.AuditSinkReplaceParams;\ntype __AuditSinkUpdateParams = T.AuditSinkUpdateParams;\ntype __AuthConfigUpdateParams = T.AuthConfigUpdateParams;\ntype __AuthConfigProviderListResponse = T.AuthConfigProviderListResponse;\ntype __AuthConfigProviderReplaceParams = T.AuthConfigProviderReplaceParams;\ntype __AuthConfigProviderUpdateParams = T.AuthConfigProviderUpdateParams;\ntype __CloneParams = T.CloneParams;\ntype __CredentialListParams = T.CredentialListParams;\ntype __CredentialCreateParams = T.CredentialCreateParams;\ntype __CredentialUpdateParams = T.CredentialUpdateParams;\ntype __CredentialUpdateScopesParams = T.CredentialUpdateScopesParams;\ntype __CredentialUpdateScopesResponse = T.CredentialUpdateScopesResponse;\ntype __CustomDomainCreateParams = T.CustomDomainCreateParams;\ntype __CustomDomainApplyParams = T.CustomDomainApplyParams;\ntype __CustomDomainExportParams = T.CustomDomainExportParams;\ntype __EndUserListParams = T.EndUserListParams;\ntype __EndUserBulkDeleteParams = T.EndUserBulkDeleteParams;\ntype __EndUserBulkRevokeSessionsParams = T.EndUserBulkRevokeSessionsParams;\ntype __EndUserBulkUpdateRoleParams = T.EndUserBulkUpdateRoleParams;\ntype __EndUserBulkUpdateStatusParams = T.EndUserBulkUpdateStatusParams;\ntype __EndUserExportParams = T.EndUserExportParams;\ntype __EndUserInviteListParams = T.EndUserInviteListParams;\ntype __EndUserInviteCreateParams = T.EndUserInviteCreateParams;\ntype __EndUserUpdateParams = T.EndUserUpdateParams;\ntype __EndUserContactCreateParams = T.EndUserContactCreateParams;\ntype __EndUserUpdateRoleParams = T.EndUserUpdateRoleParams;\ntype __EndUserUpdateStatusParams = T.EndUserUpdateStatusParams;\ntype __MemberListParams = T.MemberListParams;\ntype __NotificationSettingUpdateParams = T.NotificationSettingUpdateParams;\ntype __AppScopedPermissionListResponse = T.AppScopedPermissionListResponse;\ntype __AppScopedPermissionCreateParams = T.AppScopedPermissionCreateParams;\ntype __AppScopedRoleListParams = T.AppScopedRoleListParams;\ntype __AppScopedRoleCreateParams = T.AppScopedRoleCreateParams;\ntype __RoleAssignParams = T.RoleAssignParams;\ntype __RolePermissionListResponse = T.RolePermissionListResponse;\ntype __AppScopedRoleUpdateParams = T.AppScopedRoleUpdateParams;\ntype __AppScopedRoleUpdatePermissionsParams = T.AppScopedRoleUpdatePermissionsParams;\ntype __AppScopedRoleUpdatePermissionsResponse = T.AppScopedRoleUpdatePermissionsResponse;\ntype __SignInTestCreateParams = T.SignInTestCreateParams;\ntype __UpdateStatusParams = T.UpdateStatusParams;\ntype __AppScopedTenantApiKeyListParams = T.AppScopedTenantApiKeyListParams;\ntype __AppScopedTenantApiKeyConfigUpdateParams = T.AppScopedTenantApiKeyConfigUpdateParams;\ntype __AppScopedTenantListParams = T.AppScopedTenantListParams;\ntype __AppScopedTenantCreateParams = T.AppScopedTenantCreateParams;\ntype __AppScopedTenantUpdateParams = T.AppScopedTenantUpdateParams;\ntype __AppScopedTenantInviteListParams = T.AppScopedTenantInviteListParams;\ntype __AppScopedTenantInviteCreateParams = T.AppScopedTenantInviteCreateParams;\ntype __AppScopedTenantMemberListParams = T.AppScopedTenantMemberListParams;\ntype __AppScopedTenantMemberCreateParams = T.AppScopedTenantMemberCreateParams;\ntype __AppScopedTenantMemberUpdateParams = T.AppScopedTenantMemberUpdateParams;\ntype __UnverifiedAccountExpiryRunParams = T.UnverifiedAccountExpiryRunParams;\ntype __WebauthnConfigUpdateParams = T.WebauthnConfigUpdateParams;\ntype __WebhookEndpointCreateParams = T.WebhookEndpointCreateParams;\ntype __WebhookEndpointUpdateParams = T.WebhookEndpointUpdateParams;\ntype __WebhookEndpointRotateSecretParams = T.WebhookEndpointRotateSecretParams;\ntype __WebhookEndpointTestParams = T.WebhookEndpointTestParams;\ntype __WebhookEventListParams = T.WebhookEventListParams;\ntype __WebhookEventReplayParams = T.WebhookEventReplayParams;\ntype __StatsMeParams = T.StatsMeParams;\ntype __StatsRetrieveParams = T.StatsRetrieveParams;\ntype __ConsumerScopedPermissionListResponse = T.ConsumerScopedPermissionListResponse;\ntype __ConsumerScopedPermissionCreateParams = T.ConsumerScopedPermissionCreateParams;\ntype __ConsumerScopedRoleListParams = T.ConsumerScopedRoleListParams;\ntype __ConsumerScopedRoleCreateParams = T.ConsumerScopedRoleCreateParams;\ntype __ConsumerScopedRoleUpdateParams = T.ConsumerScopedRoleUpdateParams;\ntype __ConsumerScopedRoleUpdatePermissionsParams = T.ConsumerScopedRoleUpdatePermissionsParams;\ntype __ConsumerScopedRoleUpdatePermissionsResponse = T.ConsumerScopedRoleUpdatePermissionsResponse;\ntype __UserListParams = T.UserListParams;\ntype __UserCreateParams = T.UserCreateParams;\ntype __UserUpdateParams = T.UserUpdateParams;\ntype __UserUpdateRoleParams = T.UserUpdateRoleParams;\ntype __UserUpdateStatusParams = T.UserUpdateStatusParams;\ntype __AcceptInviteParams = T.AcceptInviteParams;\ntype __AcceptInviteResponse = T.AcceptInviteResponse;\ntype __AcceptTenantInviteParams = T.AcceptTenantInviteParams;\ntype __LogoutParams = T.LogoutParams;\ntype __MfaEnrollParams = T.MfaEnrollParams;\ntype __MfaVerifyEnrollmentParams = T.MfaVerifyEnrollmentParams;\ntype __MfaRecoverParams = T.MfaRecoverParams;\ntype __MfaSendCodeParams = T.MfaSendCodeParams;\ntype __MfaVerifyParams = T.MfaVerifyParams;\ntype __MfaWebauthnOptionsParams = T.MfaWebauthnOptionsParams;\ntype __ExchangeProviderCodeParams = T.ExchangeProviderCodeParams;\ntype __SigninWithProviderParams = T.SigninWithProviderParams;\ntype __SigninWithProviderResponse = T.SigninWithProviderResponse;\ntype __PasskeyOptionsParams = T.PasskeyOptionsParams;\ntype __PasskeyVerifyParams = T.PasskeyVerifyParams;\ntype __RefreshParams = T.RefreshParams;\ntype __RequestPasswordResetParams = T.RequestPasswordResetParams;\ntype __RequestVerificationParams = T.RequestVerificationParams;\ntype __ResetPasswordParams = T.ResetPasswordParams;\ntype __SendPasswordResetEmailParams = T.SendPasswordResetEmailParams;\ntype __SendVerificationEmailParams = T.SendVerificationEmailParams;\ntype __SigninParams = T.SigninParams;\ntype __SigninResponse = T.SigninResponse;\ntype __SignupParams = T.SignupParams;\ntype __SignupResponse = T.SignupResponse;\ntype __SwitchTenantParams = T.SwitchTenantParams;\ntype __VerifyEmailParams = T.VerifyEmailParams;\ntype __VerifyAuthorizeParams = T.VerifyAuthorizeParams;\ntype __VerifyAuthorizeBatchParams = T.VerifyAuthorizeBatchParams;\ntype __MeUpdateParams = T.MeUpdateParams;\ntype __MeUploadAvatarParams = T.MeUploadAvatarParams;\ntype __MeChangePasswordParams = T.MeChangePasswordParams;\ntype __MeContactCreateParams = T.MeContactCreateParams;\ntype __MeMfaFactorCreateParams = T.MeMfaFactorCreateParams;\ntype __MeMfaFactorVerifyParams = T.MeMfaFactorVerifyParams;\ntype __MeMfaStepUpVerifyParams = T.MeMfaStepUpVerifyParams;\ntype __MeMfaStepUpSendCodeParams = T.MeMfaStepUpSendCodeParams;\ntype __MeTenantInviteAcceptParams = T.MeTenantInviteAcceptParams;\ntype __OauthIntrospectParams = T.OauthIntrospectParams;\ntype __OauthTokenParams = T.OauthTokenParams;\ntype __ConsumerScopedTenantApiKeyListParams = T.ConsumerScopedTenantApiKeyListParams;\ntype __TenantApiKeyCreateParams = T.TenantApiKeyCreateParams;\ntype __ConsumerScopedTenantApiKeyConfigUpdateParams = T.ConsumerScopedTenantApiKeyConfigUpdateParams;\ntype __TenantApiKeyIntrospectParams = T.TenantApiKeyIntrospectParams;\ntype __TenantApiKeyRotateParams = T.TenantApiKeyRotateParams;\ntype __ConsumerScopedTenantListParams = T.ConsumerScopedTenantListParams;\ntype __ConsumerScopedTenantCreateParams = T.ConsumerScopedTenantCreateParams;\ntype __ConsumerScopedTenantUpdateParams = T.ConsumerScopedTenantUpdateParams;\ntype __ConsumerScopedTenantInviteListParams = T.ConsumerScopedTenantInviteListParams;\ntype __ConsumerScopedTenantInviteCreateParams = T.ConsumerScopedTenantInviteCreateParams;\ntype __ConsumerScopedTenantMemberListParams = T.ConsumerScopedTenantMemberListParams;\ntype __ConsumerScopedTenantMemberCreateParams = T.ConsumerScopedTenantMemberCreateParams;\ntype __ConsumerScopedTenantMemberUpdateParams = T.ConsumerScopedTenantMemberUpdateParams;\ntype __UserFactorCreateParams = T.UserFactorCreateParams;\ntype __VerifyTokenParams = T.VerifyTokenParams;\ntype __ErrorCode = E.AuthErrorCode;\ntype __AppSlugChangedEvent = W.AppSlugChangedEvent;\ntype __TenantCreatedEvent = W.TenantCreatedEvent;\ntype __TenantDeletedEvent = W.TenantDeletedEvent;\ntype __TenantInviteAcceptedEvent = W.TenantInviteAcceptedEvent;\ntype __TenantInviteCreatedEvent = W.TenantInviteCreatedEvent;\ntype __TenantInviteRevokedEvent = W.TenantInviteRevokedEvent;\ntype __TenantMemberAddedEvent = W.TenantMemberAddedEvent;\ntype __TenantMemberRemovedEvent = W.TenantMemberRemovedEvent;\ntype __TenantMemberRoleChangedEvent = W.TenantMemberRoleChangedEvent;\ntype __TenantUpdatedEvent = W.TenantUpdatedEvent;\ntype __UserContactVerifiedEvent = W.UserContactVerifiedEvent;\ntype __UserDeactivatedEvent = W.UserDeactivatedEvent;\ntype __UserDeletedEvent = W.UserDeletedEvent;\ntype __UserEmailVerifiedEvent = W.UserEmailVerifiedEvent;\ntype __UserMfaEnrollmentRequiredEvent = W.UserMfaEnrollmentRequiredEvent;\ntype __UserMfaFactorDisabledEvent = W.UserMfaFactorDisabledEvent;\ntype __UserMfaFactorEnrolledEvent = W.UserMfaFactorEnrolledEvent;\ntype __UserMfaRecoveryCodeUsedEvent = W.UserMfaRecoveryCodeUsedEvent;\ntype __UserMfaReenrollmentRequiredEvent = W.UserMfaReenrollmentRequiredEvent;\ntype __UserMfaStepUpLockedEvent = W.UserMfaStepUpLockedEvent;\ntype __UserMfaStepUpSucceededEvent = W.UserMfaStepUpSucceededEvent;\ntype __UserPasswordResetCompletedEvent = W.UserPasswordResetCompletedEvent;\ntype __UserPasswordResetRequestedEvent = W.UserPasswordResetRequestedEvent;\ntype __UserReinstatedEvent = W.UserReinstatedEvent;\ntype __UserRoleChangedEvent = W.UserRoleChangedEvent;\ntype __UserSigninEvent = W.UserSigninEvent;\ntype __UserSignupEvent = W.UserSignupEvent;\ntype __UserSuspendedEvent = W.UserSuspendedEvent;\ntype __UnknownWebhookEvent = W.UnknownWebhookEvent;\ntype __UnwrapWebhookEvent = W.UnwrapWebhookEvent;\ntype __WebhookSignParams = W.WebhookSignParams;\ntype __WebhookUnwrapParams = W.WebhookUnwrapParams;\n/** Public types: `Auth.AcceptedTenantInvite`, `Auth.AppListParams`, … */\nexport namespace Auth {\n export type RequestOptions = __RequestOptions;\n export type PollOptions = __PollOptions;\n export type ApiKeyStatus = __ApiKeyStatus;\n export const ApiKeyStatus = T.ApiKeyStatus;\n export type AppEnvironment = __AppEnvironment;\n export const AppEnvironment = T.AppEnvironment;\n export type AppStatus = __AppStatus;\n export const AppStatus = T.AppStatus;\n export type ApplyPlanAction = __ApplyPlanAction;\n export const ApplyPlanAction = T.ApplyPlanAction;\n export type ApplyPlanResult = __ApplyPlanResult;\n export const ApplyPlanResult = T.ApplyPlanResult;\n export type AuditSinkAttemptKind = __AuditSinkAttemptKind;\n export const AuditSinkAttemptKind = T.AuditSinkAttemptKind;\n export type AuditSinkState = __AuditSinkState;\n export const AuditSinkState = T.AuditSinkState;\n export type AuthStatsMetric = __AuthStatsMetric;\n export const AuthStatsMetric = T.AuthStatsMetric;\n export type BotProtectionProvider = __BotProtectionProvider;\n export const BotProtectionProvider = T.BotProtectionProvider;\n export type ContactType = __ContactType;\n export const ContactType = T.ContactType;\n export type CustomDomainApplyWarning = __CustomDomainApplyWarning;\n export const CustomDomainApplyWarning = T.CustomDomainApplyWarning;\n export type CustomDomainStatus = __CustomDomainStatus;\n export const CustomDomainStatus = T.CustomDomainStatus;\n export type DnsConflictSeverity = __DnsConflictSeverity;\n export const DnsConflictSeverity = T.DnsConflictSeverity;\n export type DnsProvider = __DnsProvider;\n export const DnsProvider = T.DnsProvider;\n export type DnsRecordPurpose = __DnsRecordPurpose;\n export const DnsRecordPurpose = T.DnsRecordPurpose;\n export type DnsRecordState = __DnsRecordState;\n export const DnsRecordState = T.DnsRecordState;\n export type DnsRecordType = __DnsRecordType;\n export const DnsRecordType = T.DnsRecordType;\n export type EndUserStatus = __EndUserStatus;\n export const EndUserStatus = T.EndUserStatus;\n export type EnrollmentType = __EnrollmentType;\n export const EnrollmentType = T.EnrollmentType;\n export type ImportJobStatus = __ImportJobStatus;\n export const ImportJobStatus = T.ImportJobStatus;\n export type IntrospectedTokenType = __IntrospectedTokenType;\n export const IntrospectedTokenType = T.IntrospectedTokenType;\n export type JwkUse = __JwkUse;\n export const JwkUse = T.JwkUse;\n export type MfaPolicy = __MfaPolicy;\n export const MfaPolicy = T.MfaPolicy;\n export type OAuthLinkPolicy = __OAuthLinkPolicy;\n export const OAuthLinkPolicy = T.OAuthLinkPolicy;\n export type OAuthProvider = __OAuthProvider;\n export const OAuthProvider = T.OAuthProvider;\n export type PasswordBreachCheck = __PasswordBreachCheck;\n export const PasswordBreachCheck = T.PasswordBreachCheck;\n export type ProviderBlockedReason = __ProviderBlockedReason;\n export const ProviderBlockedReason = T.ProviderBlockedReason;\n export type ProviderCheckResult = __ProviderCheckResult;\n export const ProviderCheckResult = T.ProviderCheckResult;\n export type ProviderStatus = __ProviderStatus;\n export const ProviderStatus = T.ProviderStatus;\n export type SenderDomainStatus = __SenderDomainStatus;\n export const SenderDomainStatus = T.SenderDomainStatus;\n export type SenderSource = __SenderSource;\n export const SenderSource = T.SenderSource;\n export type SetupRowState = __SetupRowState;\n export const SetupRowState = T.SetupRowState;\n export type SignInResult = __SignInResult;\n export const SignInResult = T.SignInResult;\n export type SignInTestEmailNoticeCode = __SignInTestEmailNoticeCode;\n export const SignInTestEmailNoticeCode = T.SignInTestEmailNoticeCode;\n export type SignInTestMethod = __SignInTestMethod;\n export const SignInTestMethod = T.SignInTestMethod;\n export type SignInTestOutcome = __SignInTestOutcome;\n export const SignInTestOutcome = T.SignInTestOutcome;\n export type SignInTestState = __SignInTestState;\n export const SignInTestState = T.SignInTestState;\n export type StatsGranularity = __StatsGranularity;\n export const StatsGranularity = T.StatsGranularity;\n export type StatsWindow = __StatsWindow;\n export const StatsWindow = T.StatsWindow;\n export type TenantApiKeyAdminState = __TenantApiKeyAdminState;\n export const TenantApiKeyAdminState = T.TenantApiKeyAdminState;\n export type TenantApiKeyEffectiveStatus = __TenantApiKeyEffectiveStatus;\n export const TenantApiKeyEffectiveStatus = T.TenantApiKeyEffectiveStatus;\n export type TenantApiKeyEnv = __TenantApiKeyEnv;\n export const TenantApiKeyEnv = T.TenantApiKeyEnv;\n export type TenantApiKeyManagementLane = __TenantApiKeyManagementLane;\n export const TenantApiKeyManagementLane = T.TenantApiKeyManagementLane;\n export type TenantApiKeyRevokeReason = __TenantApiKeyRevokeReason;\n export const TenantApiKeyRevokeReason = T.TenantApiKeyRevokeReason;\n export type TenantApiKeyState = __TenantApiKeyState;\n export const TenantApiKeyState = T.TenantApiKeyState;\n export type TenantInviteStatus = __TenantInviteStatus;\n export const TenantInviteStatus = T.TenantInviteStatus;\n export type TenantStatus = __TenantStatus;\n export const TenantStatus = T.TenantStatus;\n export type TokenType = __TokenType;\n export const TokenType = T.TokenType;\n export type UserCreatedVia = __UserCreatedVia;\n export const UserCreatedVia = T.UserCreatedVia;\n export type UserDeletedReason = __UserDeletedReason;\n export const UserDeletedReason = T.UserDeletedReason;\n export type UserDeletedVia = __UserDeletedVia;\n export const UserDeletedVia = T.UserDeletedVia;\n export type WebhookAttemptTrigger = __WebhookAttemptTrigger;\n export const WebhookAttemptTrigger = T.WebhookAttemptTrigger;\n export type WebhookEndpointDisabledReason = __WebhookEndpointDisabledReason;\n export const WebhookEndpointDisabledReason = T.WebhookEndpointDisabledReason;\n export type WebhookEndpointStatus = __WebhookEndpointStatus;\n export const WebhookEndpointStatus = T.WebhookEndpointStatus;\n export type WebhookEventStatus = __WebhookEventStatus;\n export const WebhookEventStatus = T.WebhookEventStatus;\n export type WebhookEventType = __WebhookEventType;\n export const WebhookEventType = T.WebhookEventType;\n export type AcceptedTenantInvite = __AcceptedTenantInvite;\n export type AccountContact = __AccountContact;\n export type AccountContactList = __AccountContactList;\n export type AddMember = __AddMember;\n export type AdminProvisionFactor = __AdminProvisionFactor;\n export type ApiKeyList = __ApiKeyList;\n export type ApiKeySummary = __ApiKeySummary;\n export type AppList = __AppList;\n export type AppMemberList = __AppMemberList;\n export type AppMemberSummary = __AppMemberSummary;\n export type AppMembership = __AppMembership;\n export type AppNotificationSettings = __AppNotificationSettings;\n export type AppPermissionCatalogEntry = __AppPermissionCatalogEntry;\n export type App = __App;\n export type AppSlugChangedEventData = __AppSlugChangedEventData;\n export type ApplyConflict = __ApplyConflict;\n export type ApplyCounts = __ApplyCounts;\n export type ApplyPlanItem = __ApplyPlanItem;\n export type AuditLogEntry = __AuditLogEntry;\n export type AuditLogList = __AuditLogList;\n export type AuditSink = __AuditSink;\n export type AuditSinkTestResult = __AuditSinkTestResult;\n export type AuditSinkWithSecret = __AuditSinkWithSecret;\n export type AuthConfig = __AuthConfig;\n export type AuthStatsInWindow = __AuthStatsInWindow;\n export type AuthStatsSeries = __AuthStatsSeries;\n export type AuthStatsTotals = __AuthStatsTotals;\n export type AuthWorkspaceStats = __AuthWorkspaceStats;\n export type AuthorizeBatch = __AuthorizeBatch;\n export type AuthorizeBatchResult = __AuthorizeBatchResult;\n export type Authorize = __Authorize;\n export type AvatarUrl = __AvatarUrl;\n export type BotProtection = __BotProtection;\n export type BulkAffectedUsers = __BulkAffectedUsers;\n export type CloneApp = __CloneApp;\n export type ConfirmEnrollment = __ConfirmEnrollment;\n export type ConsumerAddMember = __ConsumerAddMember;\n export type ConsumerAdminCreatedUser = __ConsumerAdminCreatedUser;\n export type ConsumerAdminEndUser = __ConsumerAdminEndUser;\n export type ConsumerAdminEndUserList = __ConsumerAdminEndUserList;\n export type ConsumerAdminPermission = __ConsumerAdminPermission;\n export type ConsumerAdminPermissionListEntry = __ConsumerAdminPermissionListEntry;\n export type ConsumerAdminRoleAssignment = __ConsumerAdminRoleAssignment;\n export type ConsumerCodeDispatch = __ConsumerCodeDispatch;\n export type ConsumerCodeIssue = __ConsumerCodeIssue;\n export type ConsumerMfaChallengeFactor = __ConsumerMfaChallengeFactor;\n export type ConsumerMfaChallenge = __ConsumerMfaChallenge;\n export type ConsumerMfaEnrollVerify = __ConsumerMfaEnrollVerify;\n export type ConsumerMfaEnrollmentRequired = __ConsumerMfaEnrollmentRequired;\n export type ConsumerMfaSendCode = __ConsumerMfaSendCode;\n export type ConsumerRoleList = __ConsumerRoleList;\n export type ConsumerRolePermissionEntry = __ConsumerRolePermissionEntry;\n export type ConsumerRole = __ConsumerRole;\n export type ConsumerRoleWithPermissions = __ConsumerRoleWithPermissions;\n export type ConsumerTenantList = __ConsumerTenantList;\n export type ConsumerTenantMembershipList = __ConsumerTenantMembershipList;\n export type ConsumerTenantMembership = __ConsumerTenantMembership;\n export type ConsumerTenant = __ConsumerTenant;\n export type ConsumerToken = __ConsumerToken;\n export type ConsumerVerify = __ConsumerVerify;\n export type ConsumerWebauthnOptions = __ConsumerWebauthnOptions;\n export type CreateApiKey = __CreateApiKey;\n export type CreateTenantInvite = __CreateTenantInvite;\n export type CustomDomainApplyResult = __CustomDomainApplyResult;\n export type CustomDomainCallbackUrls = __CustomDomainCallbackUrls;\n export type CustomDomain = __CustomDomain;\n export type CustomDomainList = __CustomDomainList;\n export type CustomDomainRecord = __CustomDomainRecord;\n export type DnsConflict = __DnsConflict;\n export type DnsProviderRef = __DnsProviderRef;\n export type EffectiveSender = __EffectiveSender;\n export type EmailEnrollmentData = __EmailEnrollmentData;\n export type EndUserActionCount = __EndUserActionCount;\n export type EndUserActivityEntry = __EndUserActivityEntry;\n export type EndUserDetailInsights = __EndUserDetailInsights;\n export type EndUserFactorEntry = __EndUserFactorEntry;\n export type EndUserInsights = __EndUserInsights;\n export type EndUserInviteList = __EndUserInviteList;\n export type EndUserInvite = __EndUserInvite;\n export type EndUserList = __EndUserList;\n export type EndUserRoleAssignment = __EndUserRoleAssignment;\n export type EndUserSessionEntry = __EndUserSessionEntry;\n export type EndUserSummary = __EndUserSummary;\n export type EnforcedPermissions = __EnforcedPermissions;\n export type Exchange = __Exchange;\n export type FactorList = __FactorList;\n export type GrantableScope = __GrantableScope;\n export type IdpMfaEnrollmentRequired = __IdpMfaEnrollmentRequired;\n export type IdpToken = __IdpToken;\n export type ImportJobError = __ImportJobError;\n export type ImportJob = __ImportJob;\n export type InsightsMfa = __InsightsMfa;\n export type InsightsPasswordReset = __InsightsPasswordReset;\n export type InsightsSessions = __InsightsSessions;\n export type InsightsSignin = __InsightsSignin;\n export type InsightsUsers = __InsightsUsers;\n export type InsightsVerification = __InsightsVerification;\n export type Introspect = __Introspect;\n export type IntrospectionCreator = __IntrospectionCreator;\n export type IssuedVerificationCode = __IssuedVerificationCode;\n export type Jwk = __Jwk;\n export type Jwks = __Jwks;\n export type ListWebhookEndpoints = __ListWebhookEndpoints;\n export type ListWebhookEventTypes = __ListWebhookEventTypes;\n export type ListWebhookEvents = __ListWebhookEvents;\n export type M2mClientCreate = __M2mClientCreate;\n export type M2mClientDetail = __M2mClientDetail;\n export type M2mClientList = __M2mClientList;\n export type M2mClientSummary = __M2mClientSummary;\n export type M2mRotateSecret = __M2mRotateSecret;\n export type M2mScopeEntry = __M2mScopeEntry;\n export type MeActivityEntry = __MeActivityEntry;\n export type MeActivity = __MeActivity;\n export type MeContact = __MeContact;\n export type MeContacts = __MeContacts;\n export type MePermissions = __MePermissions;\n export type MeProfile = __MeProfile;\n export type MeSession = __MeSession;\n export type MeSessions = __MeSessions;\n export type MeUpdatedAccount = __MeUpdatedAccount;\n export type MfaEnrollmentRequiredEventData = __MfaEnrollmentRequiredEventData;\n export type MfaFactorEventData = __MfaFactorEventData;\n export type MfaRecoveryCodeUsedEventData = __MfaRecoveryCodeUsedEventData;\n export type MfaStepUpLockedEventData = __MfaStepUpLockedEventData;\n export type MfaStepUpSucceededEventData = __MfaStepUpSucceededEventData;\n export type MyTenants = __MyTenants;\n export type NotificationTest = __NotificationTest;\n export type OAuthToken = __OAuthToken;\n export type OpenIdConfiguration = __OpenIdConfiguration;\n export type Pagination = __Pagination;\n export type Permission = __Permission;\n export type PlatformTenantApiKey = __PlatformTenantApiKey;\n export type PlatformTenantApiKeyList = __PlatformTenantApiKeyList;\n export type PlatformUserStats = __PlatformUserStats;\n export type ProviderCheck = __ProviderCheck;\n export type ProviderDetail = __ProviderDetail;\n export type ProviderListEntry = __ProviderListEntry;\n export type PublicFactor = __PublicFactor;\n export type RecoveryCodes = __RecoveryCodes;\n export type ReplayWebhookEvent = __ReplayWebhookEvent;\n export type RequireMfaReenrollment = __RequireMfaReenrollment;\n export type RoleList = __RoleList;\n export type RolePermissionEntry = __RolePermissionEntry;\n export type Role = __Role;\n export type RoleWithPermissions = __RoleWithPermissions;\n export type RotateApiKey = __RotateApiKey;\n export type SetupRow = __SetupRow;\n export type SetupRowFix = __SetupRowFix;\n export type SetupRowTest = __SetupRowTest;\n export type SetupStatus = __SetupStatus;\n export type SignInTest = __SignInTest;\n export type SignInTestEmailDelivery = __SignInTestEmailDelivery;\n export type SignInTestEmailNotice = __SignInTestEmailNotice;\n export type SignInTestError = __SignInTestError;\n export type SignInTestIdentity = __SignInTestIdentity;\n export type StartEnrollment = __StartEnrollment;\n export type StatsSeriesPoint = __StatsSeriesPoint;\n export type StepUp = __StepUp;\n export type StepUpSendCode = __StepUpSendCode;\n export type TenantApiKeyCreator = __TenantApiKeyCreator;\n export type TenantApiKey = __TenantApiKey;\n export type TenantApiKeyIntrospection = __TenantApiKeyIntrospection;\n export type TenantApiKeyList = __TenantApiKeyList;\n export type TenantApiKeyStatus = __TenantApiKeyStatus;\n export type TenantApiKeyWithSecret = __TenantApiKeyWithSecret;\n export type TenantApiKeysConfig = __TenantApiKeysConfig;\n export type TenantEventData = __TenantEventData;\n export type TenantInviteAcceptedEventData = __TenantInviteAcceptedEventData;\n export type TenantInviteCreatedEventData = __TenantInviteCreatedEventData;\n export type TenantInviteList = __TenantInviteList;\n export type TenantInvite = __TenantInvite;\n export type TenantInviteRevokedEventData = __TenantInviteRevokedEventData;\n export type TenantList = __TenantList;\n export type TenantMemberAddedEventData = __TenantMemberAddedEventData;\n export type TenantMemberRemovedEventData = __TenantMemberRemovedEventData;\n export type TenantMemberRoleChangedEventData = __TenantMemberRoleChangedEventData;\n export type TenantMembershipForMe = __TenantMembershipForMe;\n export type TenantMembershipList = __TenantMembershipList;\n export type TenantMembership = __TenantMembership;\n export type Tenant = __Tenant;\n export type TotpEnrollmentData = __TotpEnrollmentData;\n export type UnverifiedAccountExpiryRun = __UnverifiedAccountExpiryRun;\n export type UnverifiedAccountExpiryStatus = __UnverifiedAccountExpiryStatus;\n export type UserContactVerifiedEventData = __UserContactVerifiedEventData;\n export type UserDeletedEventData = __UserDeletedEventData;\n export type UserEmailVerifiedEventData = __UserEmailVerifiedEventData;\n export type UserEventData = __UserEventData;\n export type UserPasswordResetRequestedEventData = __UserPasswordResetRequestedEventData;\n export type UserRoleChangedEventData = __UserRoleChangedEventData;\n export type UserSigninEventData = __UserSigninEventData;\n export type UserSignupEventData = __UserSignupEventData;\n export type VerifyPrincipal = __VerifyPrincipal;\n export type Verify = __Verify;\n export type WebauthnConfig = __WebauthnConfig;\n export type WebauthnEnrollmentData = __WebauthnEnrollmentData;\n export type WebauthnOptions = __WebauthnOptions;\n export type WebhookDeliveryAttempt = __WebhookDeliveryAttempt;\n export type WebhookEndpoint = __WebhookEndpoint;\n export type WebhookEndpointWithSecret = __WebhookEndpointWithSecret;\n export type WebhookEventDelivery = __WebhookEventDelivery;\n export type WebhookEventDetail = __WebhookEventDetail;\n export type WebhookEvent = __WebhookEvent;\n export type WebhookEventTypeInfo = __WebhookEventTypeInfo;\n export type WebhookPagination = __WebhookPagination;\n export type AppListParams = __AppListParams;\n export type AppCreateParams = __AppCreateParams;\n export type AppUpdateParams = __AppUpdateParams;\n export type ApiKeyListParams = __ApiKeyListParams;\n export type ApiKeyCreateParams = __ApiKeyCreateParams;\n export type ApiKeyRotateParams = __ApiKeyRotateParams;\n export type AuditLogListParams = __AuditLogListParams;\n export type AuditLogExportParams = __AuditLogExportParams;\n export type AuditSinkReplaceParams = __AuditSinkReplaceParams;\n export type AuditSinkUpdateParams = __AuditSinkUpdateParams;\n export type AuthConfigUpdateParams = __AuthConfigUpdateParams;\n export type AuthConfigProviderListResponse = __AuthConfigProviderListResponse;\n export type AuthConfigProviderReplaceParams = __AuthConfigProviderReplaceParams;\n export type AuthConfigProviderUpdateParams = __AuthConfigProviderUpdateParams;\n export type CloneParams = __CloneParams;\n export type CredentialListParams = __CredentialListParams;\n export type CredentialCreateParams = __CredentialCreateParams;\n export type CredentialUpdateParams = __CredentialUpdateParams;\n export type CredentialUpdateScopesParams = __CredentialUpdateScopesParams;\n export type CredentialUpdateScopesResponse = __CredentialUpdateScopesResponse;\n export type CustomDomainCreateParams = __CustomDomainCreateParams;\n export type CustomDomainApplyParams = __CustomDomainApplyParams;\n export type CustomDomainExportParams = __CustomDomainExportParams;\n export type EndUserListParams = __EndUserListParams;\n export type EndUserBulkDeleteParams = __EndUserBulkDeleteParams;\n export type EndUserBulkRevokeSessionsParams = __EndUserBulkRevokeSessionsParams;\n export type EndUserBulkUpdateRoleParams = __EndUserBulkUpdateRoleParams;\n export type EndUserBulkUpdateStatusParams = __EndUserBulkUpdateStatusParams;\n export type EndUserExportParams = __EndUserExportParams;\n export type EndUserInviteListParams = __EndUserInviteListParams;\n export type EndUserInviteCreateParams = __EndUserInviteCreateParams;\n export type EndUserUpdateParams = __EndUserUpdateParams;\n export type EndUserContactCreateParams = __EndUserContactCreateParams;\n export type EndUserUpdateRoleParams = __EndUserUpdateRoleParams;\n export type EndUserUpdateStatusParams = __EndUserUpdateStatusParams;\n export type MemberListParams = __MemberListParams;\n export type NotificationSettingUpdateParams = __NotificationSettingUpdateParams;\n export type AppScopedPermissionListResponse = __AppScopedPermissionListResponse;\n export type AppScopedPermissionCreateParams = __AppScopedPermissionCreateParams;\n export type AppScopedRoleListParams = __AppScopedRoleListParams;\n export type AppScopedRoleCreateParams = __AppScopedRoleCreateParams;\n export type RoleAssignParams = __RoleAssignParams;\n export type RolePermissionListResponse = __RolePermissionListResponse;\n export type AppScopedRoleUpdateParams = __AppScopedRoleUpdateParams;\n export type AppScopedRoleUpdatePermissionsParams = __AppScopedRoleUpdatePermissionsParams;\n export type AppScopedRoleUpdatePermissionsResponse = __AppScopedRoleUpdatePermissionsResponse;\n export type SignInTestCreateParams = __SignInTestCreateParams;\n export type UpdateStatusParams = __UpdateStatusParams;\n export type AppScopedTenantApiKeyListParams = __AppScopedTenantApiKeyListParams;\n export type AppScopedTenantApiKeyConfigUpdateParams = __AppScopedTenantApiKeyConfigUpdateParams;\n export type AppScopedTenantListParams = __AppScopedTenantListParams;\n export type AppScopedTenantCreateParams = __AppScopedTenantCreateParams;\n export type AppScopedTenantUpdateParams = __AppScopedTenantUpdateParams;\n export type AppScopedTenantInviteListParams = __AppScopedTenantInviteListParams;\n export type AppScopedTenantInviteCreateParams = __AppScopedTenantInviteCreateParams;\n export type AppScopedTenantMemberListParams = __AppScopedTenantMemberListParams;\n export type AppScopedTenantMemberCreateParams = __AppScopedTenantMemberCreateParams;\n export type AppScopedTenantMemberUpdateParams = __AppScopedTenantMemberUpdateParams;\n export type UnverifiedAccountExpiryRunParams = __UnverifiedAccountExpiryRunParams;\n export type WebauthnConfigUpdateParams = __WebauthnConfigUpdateParams;\n export type WebhookEndpointCreateParams = __WebhookEndpointCreateParams;\n export type WebhookEndpointUpdateParams = __WebhookEndpointUpdateParams;\n export type WebhookEndpointRotateSecretParams = __WebhookEndpointRotateSecretParams;\n export type WebhookEndpointTestParams = __WebhookEndpointTestParams;\n export type WebhookEventListParams = __WebhookEventListParams;\n export type WebhookEventReplayParams = __WebhookEventReplayParams;\n export type StatsMeParams = __StatsMeParams;\n export type StatsRetrieveParams = __StatsRetrieveParams;\n export type ConsumerScopedPermissionListResponse = __ConsumerScopedPermissionListResponse;\n export type ConsumerScopedPermissionCreateParams = __ConsumerScopedPermissionCreateParams;\n export type ConsumerScopedRoleListParams = __ConsumerScopedRoleListParams;\n export type ConsumerScopedRoleCreateParams = __ConsumerScopedRoleCreateParams;\n export type ConsumerScopedRoleUpdateParams = __ConsumerScopedRoleUpdateParams;\n export type ConsumerScopedRoleUpdatePermissionsParams = __ConsumerScopedRoleUpdatePermissionsParams;\n export type ConsumerScopedRoleUpdatePermissionsResponse = __ConsumerScopedRoleUpdatePermissionsResponse;\n export type UserListParams = __UserListParams;\n export type UserCreateParams = __UserCreateParams;\n export type UserUpdateParams = __UserUpdateParams;\n export type UserUpdateRoleParams = __UserUpdateRoleParams;\n export type UserUpdateStatusParams = __UserUpdateStatusParams;\n export type AcceptInviteParams = __AcceptInviteParams;\n export type AcceptInviteResponse = __AcceptInviteResponse;\n export type AcceptTenantInviteParams = __AcceptTenantInviteParams;\n export type LogoutParams = __LogoutParams;\n export type MfaEnrollParams = __MfaEnrollParams;\n export type MfaVerifyEnrollmentParams = __MfaVerifyEnrollmentParams;\n export type MfaRecoverParams = __MfaRecoverParams;\n export type MfaSendCodeParams = __MfaSendCodeParams;\n export type MfaVerifyParams = __MfaVerifyParams;\n export type MfaWebauthnOptionsParams = __MfaWebauthnOptionsParams;\n export type ExchangeProviderCodeParams = __ExchangeProviderCodeParams;\n export type SigninWithProviderParams = __SigninWithProviderParams;\n export type SigninWithProviderResponse = __SigninWithProviderResponse;\n export type PasskeyOptionsParams = __PasskeyOptionsParams;\n export type PasskeyVerifyParams = __PasskeyVerifyParams;\n export type RefreshParams = __RefreshParams;\n export type RequestPasswordResetParams = __RequestPasswordResetParams;\n export type RequestVerificationParams = __RequestVerificationParams;\n export type ResetPasswordParams = __ResetPasswordParams;\n export type SendPasswordResetEmailParams = __SendPasswordResetEmailParams;\n export type SendVerificationEmailParams = __SendVerificationEmailParams;\n export type SigninParams = __SigninParams;\n export type SigninResponse = __SigninResponse;\n export type SignupParams = __SignupParams;\n export type SignupResponse = __SignupResponse;\n export type SwitchTenantParams = __SwitchTenantParams;\n export type VerifyEmailParams = __VerifyEmailParams;\n export type VerifyAuthorizeParams = __VerifyAuthorizeParams;\n export type VerifyAuthorizeBatchParams = __VerifyAuthorizeBatchParams;\n export type MeUpdateParams = __MeUpdateParams;\n export type MeUploadAvatarParams = __MeUploadAvatarParams;\n export type MeChangePasswordParams = __MeChangePasswordParams;\n export type MeContactCreateParams = __MeContactCreateParams;\n export type MeMfaFactorCreateParams = __MeMfaFactorCreateParams;\n export type MeMfaFactorVerifyParams = __MeMfaFactorVerifyParams;\n export type MeMfaStepUpVerifyParams = __MeMfaStepUpVerifyParams;\n export type MeMfaStepUpSendCodeParams = __MeMfaStepUpSendCodeParams;\n export type MeTenantInviteAcceptParams = __MeTenantInviteAcceptParams;\n export type OauthIntrospectParams = __OauthIntrospectParams;\n export type OauthTokenParams = __OauthTokenParams;\n export type ConsumerScopedTenantApiKeyListParams = __ConsumerScopedTenantApiKeyListParams;\n export type TenantApiKeyCreateParams = __TenantApiKeyCreateParams;\n export type ConsumerScopedTenantApiKeyConfigUpdateParams = __ConsumerScopedTenantApiKeyConfigUpdateParams;\n export type TenantApiKeyIntrospectParams = __TenantApiKeyIntrospectParams;\n export type TenantApiKeyRotateParams = __TenantApiKeyRotateParams;\n export type ConsumerScopedTenantListParams = __ConsumerScopedTenantListParams;\n export type ConsumerScopedTenantCreateParams = __ConsumerScopedTenantCreateParams;\n export type ConsumerScopedTenantUpdateParams = __ConsumerScopedTenantUpdateParams;\n export type ConsumerScopedTenantInviteListParams = __ConsumerScopedTenantInviteListParams;\n export type ConsumerScopedTenantInviteCreateParams = __ConsumerScopedTenantInviteCreateParams;\n export type ConsumerScopedTenantMemberListParams = __ConsumerScopedTenantMemberListParams;\n export type ConsumerScopedTenantMemberCreateParams = __ConsumerScopedTenantMemberCreateParams;\n export type ConsumerScopedTenantMemberUpdateParams = __ConsumerScopedTenantMemberUpdateParams;\n export type UserFactorCreateParams = __UserFactorCreateParams;\n export type VerifyTokenParams = __VerifyTokenParams;\n export type ErrorCode = __ErrorCode;\n export type AppSlugChangedEvent = __AppSlugChangedEvent;\n export type TenantCreatedEvent = __TenantCreatedEvent;\n export type TenantDeletedEvent = __TenantDeletedEvent;\n export type TenantInviteAcceptedEvent = __TenantInviteAcceptedEvent;\n export type TenantInviteCreatedEvent = __TenantInviteCreatedEvent;\n export type TenantInviteRevokedEvent = __TenantInviteRevokedEvent;\n export type TenantMemberAddedEvent = __TenantMemberAddedEvent;\n export type TenantMemberRemovedEvent = __TenantMemberRemovedEvent;\n export type TenantMemberRoleChangedEvent = __TenantMemberRoleChangedEvent;\n export type TenantUpdatedEvent = __TenantUpdatedEvent;\n export type UserContactVerifiedEvent = __UserContactVerifiedEvent;\n export type UserDeactivatedEvent = __UserDeactivatedEvent;\n export type UserDeletedEvent = __UserDeletedEvent;\n export type UserEmailVerifiedEvent = __UserEmailVerifiedEvent;\n export type UserMfaEnrollmentRequiredEvent = __UserMfaEnrollmentRequiredEvent;\n export type UserMfaFactorDisabledEvent = __UserMfaFactorDisabledEvent;\n export type UserMfaFactorEnrolledEvent = __UserMfaFactorEnrolledEvent;\n export type UserMfaRecoveryCodeUsedEvent = __UserMfaRecoveryCodeUsedEvent;\n export type UserMfaReenrollmentRequiredEvent = __UserMfaReenrollmentRequiredEvent;\n export type UserMfaStepUpLockedEvent = __UserMfaStepUpLockedEvent;\n export type UserMfaStepUpSucceededEvent = __UserMfaStepUpSucceededEvent;\n export type UserPasswordResetCompletedEvent = __UserPasswordResetCompletedEvent;\n export type UserPasswordResetRequestedEvent = __UserPasswordResetRequestedEvent;\n export type UserReinstatedEvent = __UserReinstatedEvent;\n export type UserRoleChangedEvent = __UserRoleChangedEvent;\n export type UserSigninEvent = __UserSigninEvent;\n export type UserSignupEvent = __UserSignupEvent;\n export type UserSuspendedEvent = __UserSuspendedEvent;\n export type UnknownWebhookEvent = __UnknownWebhookEvent;\n export type UnwrapWebhookEvent = __UnwrapWebhookEvent;\n export type WebhookSignParams = __WebhookSignParams;\n export type WebhookUnwrapParams = __WebhookUnwrapParams;\n}\n","// Generated by scripts/gen-sdk.mjs from Specs/auth.json. Do not edit.\n\nexport { APIConnectionError, APIError, APITimeoutError, APIUserAbortError, AuthenticationError, BadRequestError, ConfigurationError, ConflictError, IdempotencyKeyReuseError, InternalServerError, NotFoundError, PermissionDeniedError, ProductCraftError, RateLimitError, UnprocessableEntityError, WebhookVerificationError } from \"@productcraft/core\";\n\n/** Error codes this API documents. Open: codes added later still type-check. See https://productcraft.co/docs/errors. */\nexport type AuthErrorCode = \"BAD_REQUEST\" | \"VALIDATION_ERROR\" | \"UNAUTHORIZED\" | \"PAYMENT_REQUIRED\" | \"FORBIDDEN\" | \"NOT_FOUND\" | \"METHOD_NOT_ALLOWED\" | \"NOT_ACCEPTABLE\" | \"REQUEST_TIMEOUT\" | \"CONFLICT\" | \"GONE\" | \"PRECONDITION_FAILED\" | \"PAYLOAD_TOO_LARGE\" | \"UNSUPPORTED_MEDIA_TYPE\" | \"UNPROCESSABLE_ENTITY\" | \"PRECONDITION_REQUIRED\" | \"RATE_LIMITED\" | \"INTERNAL_SERVER_ERROR\" | \"NOT_IMPLEMENTED\" | \"BAD_GATEWAY\" | \"SERVICE_UNAVAILABLE\" | \"GATEWAY_TIMEOUT\" | \"SERVICE_NOT_ENABLED\" | \"INVALID_CREDENTIALS\" | \"SESSION_REVOKED\" | \"MCP_NOT_PERMITTED\" | \"MCP_WORKSPACE_MISMATCH\" | \"PAK_NOT_PERMITTED\" | \"ACTIONS_NOT_GRANTABLE\" | \"IDEMPOTENCY_KEY_REUSE\" | \"IDEMPOTENCY_KEY_REQUIRED\" | \"IDEMPOTENCY_IN_PROGRESS\" | \"WEBHOOK_ENDPOINT_LIMIT\" | \"WEBHOOK_ENDPOINT_NOT_FOUND\" | \"WEBHOOK_ENDPOINT_NOT_SUBSCRIBED\" | \"WEBHOOK_EVENT_NOT_FOUND\" | \"WEBHOOK_EVENT_TYPE_UNKNOWN\" | \"ACCOUNT_EXISTS\" | \"ACCOUNT_NOT_FOUND\" | \"ACCOUNT_SUSPENDED\" | \"APEX_NOT_SUPPORTED\" | \"APP_ARCHIVED\" | \"APP_HAS_NO_WORKSPACE\" | \"APP_NOT_FOUND\" | \"APP_SUSPENDED\" | \"AUTH_SETTINGS_IN_METADATA\" | \"AVATAR_INVALID_TYPE\" | \"AVATAR_MAGIC_MISMATCH\" | \"AVATAR_NOT_FOUND\" | \"AVATAR_TOO_LARGE\" | \"BOT_PROTECTION_FAILED\" | \"BOT_PROTECTION_REQUIRED\" | \"BOT_PROTECTION_UNAVAILABLE\" | \"CUSTOM_DOMAIN_EXISTS\" | \"CUSTOM_DOMAIN_NOT_ACTIVE\" | \"CUSTOM_DOMAIN_NOT_FOUND\" | \"CUSTOM_DOMAIN_OAUTH_ONLY\" | \"DNS_CONFLICTS\" | \"ENVOI_APP_NOT_BOUND_TO_WORKSPACE\" | \"ENVOI_NOT_ENABLED\" | \"ENVOI_NOT_WIRED\" | \"ENVOI_SENDER_NOT_CONFIGURED\" | \"ENVOI_TEMPLATE_NOT_CONFIGURED\" | \"FEATURE_NOT_ENABLED\" | \"HOSTNAME_RESERVED\" | \"HOSTNAME_TAKEN\" | \"INSUFFICIENT_PERMISSIONS\" | \"INVALID_FORMAT\" | \"INVALID_HOSTNAME\" | \"INVALID_IDENTIFIER\" | \"INVALID_PROVIDER\" | \"INVALID_ZONE\" | \"MAIL_UNREACHABLE\" | \"PAK_WORKSPACE_MISMATCH\" | \"PASSWORD_BREACHED\" | \"PASSWORD_TOO_COMMON\" | \"PROVIDER_ERROR\" | \"PROVIDER_PERMISSION_DENIED\" | \"PROVIDER_TOKEN_REJECTED\" | \"PROVIDER_UNAVAILABLE\" | \"PROVIDER_ZONE_NOT_FOUND\" | \"ROLE_IN_USE\" | \"SENDER_ADDRESS_REQUIRED\" | \"SESSION_EXPIRED\" | \"SIGN_IN_TEST_INVALID\" | \"SLUG_TAKEN\" | \"SLUG_UUID_SHAPED\" | \"TENANT_API_KEYS_APP_PROXY_ONLY\" | \"TENANT_API_KEYS_FORBIDDEN\" | \"TENANT_API_KEYS_NOT_ENABLED\" | \"TENANT_API_KEYS_NO_SCOPES\" | \"TENANT_API_KEYS_SCOPE_INVALID\" | \"TENANT_API_KEYS_SUSPENDED\" | \"TENANT_API_KEYS_SUSPENDED_NOT_WRITABLE\" | \"TENANT_API_KEYS_UNKNOWN_ROLE\" | \"TENANT_API_KEY_EXPIRY_INVALID\" | \"TENANT_API_KEY_LIMIT\" | \"TENANT_API_KEY_NOT_ACTIVE\" | \"TENANT_API_KEY_NOT_FOUND\" | \"TENANT_API_KEY_SCOPE_ABOVE_CEILING\" | \"TENANT_API_KEY_SCOPE_NOT_GRANTABLE\" | \"TENANT_CONTEXT_REQUIRED\" | \"TENANT_MEMBERSHIP_REQUIRED\" | \"TENANT_NOT_ACTIVE\" | \"TOKEN_EXPIRED\" | \"TOKEN_INVALID\" | \"TOKEN_REVOKED\" | \"USERNAME_TAKEN\" | \"account_exists_with_different_provider\" | \"idempotency_secret_not_replayable\" | \"link_required\" | \"step_up_required\" | (string & {});\nexport const AuthErrorCode = { values: [\"BAD_REQUEST\", \"VALIDATION_ERROR\", \"UNAUTHORIZED\", \"PAYMENT_REQUIRED\", \"FORBIDDEN\", \"NOT_FOUND\", \"METHOD_NOT_ALLOWED\", \"NOT_ACCEPTABLE\", \"REQUEST_TIMEOUT\", \"CONFLICT\", \"GONE\", \"PRECONDITION_FAILED\", \"PAYLOAD_TOO_LARGE\", \"UNSUPPORTED_MEDIA_TYPE\", \"UNPROCESSABLE_ENTITY\", \"PRECONDITION_REQUIRED\", \"RATE_LIMITED\", \"INTERNAL_SERVER_ERROR\", \"NOT_IMPLEMENTED\", \"BAD_GATEWAY\", \"SERVICE_UNAVAILABLE\", \"GATEWAY_TIMEOUT\", \"SERVICE_NOT_ENABLED\", \"INVALID_CREDENTIALS\", \"SESSION_REVOKED\", \"MCP_NOT_PERMITTED\", \"MCP_WORKSPACE_MISMATCH\", \"PAK_NOT_PERMITTED\", \"ACTIONS_NOT_GRANTABLE\", \"IDEMPOTENCY_KEY_REUSE\", \"IDEMPOTENCY_KEY_REQUIRED\", \"IDEMPOTENCY_IN_PROGRESS\", \"WEBHOOK_ENDPOINT_LIMIT\", \"WEBHOOK_ENDPOINT_NOT_FOUND\", \"WEBHOOK_ENDPOINT_NOT_SUBSCRIBED\", \"WEBHOOK_EVENT_NOT_FOUND\", \"WEBHOOK_EVENT_TYPE_UNKNOWN\", \"ACCOUNT_EXISTS\", \"ACCOUNT_NOT_FOUND\", \"ACCOUNT_SUSPENDED\", \"APEX_NOT_SUPPORTED\", \"APP_ARCHIVED\", \"APP_HAS_NO_WORKSPACE\", \"APP_NOT_FOUND\", \"APP_SUSPENDED\", \"AUTH_SETTINGS_IN_METADATA\", \"AVATAR_INVALID_TYPE\", \"AVATAR_MAGIC_MISMATCH\", \"AVATAR_NOT_FOUND\", \"AVATAR_TOO_LARGE\", \"BOT_PROTECTION_FAILED\", \"BOT_PROTECTION_REQUIRED\", \"BOT_PROTECTION_UNAVAILABLE\", \"CUSTOM_DOMAIN_EXISTS\", \"CUSTOM_DOMAIN_NOT_ACTIVE\", \"CUSTOM_DOMAIN_NOT_FOUND\", \"CUSTOM_DOMAIN_OAUTH_ONLY\", \"DNS_CONFLICTS\", \"ENVOI_APP_NOT_BOUND_TO_WORKSPACE\", \"ENVOI_NOT_ENABLED\", \"ENVOI_NOT_WIRED\", \"ENVOI_SENDER_NOT_CONFIGURED\", \"ENVOI_TEMPLATE_NOT_CONFIGURED\", \"FEATURE_NOT_ENABLED\", \"HOSTNAME_RESERVED\", \"HOSTNAME_TAKEN\", \"INSUFFICIENT_PERMISSIONS\", \"INVALID_FORMAT\", \"INVALID_HOSTNAME\", \"INVALID_IDENTIFIER\", \"INVALID_PROVIDER\", \"INVALID_ZONE\", \"MAIL_UNREACHABLE\", \"PAK_WORKSPACE_MISMATCH\", \"PASSWORD_BREACHED\", \"PASSWORD_TOO_COMMON\", \"PROVIDER_ERROR\", \"PROVIDER_PERMISSION_DENIED\", \"PROVIDER_TOKEN_REJECTED\", \"PROVIDER_UNAVAILABLE\", \"PROVIDER_ZONE_NOT_FOUND\", \"ROLE_IN_USE\", \"SENDER_ADDRESS_REQUIRED\", \"SESSION_EXPIRED\", \"SIGN_IN_TEST_INVALID\", \"SLUG_TAKEN\", \"SLUG_UUID_SHAPED\", \"TENANT_API_KEYS_APP_PROXY_ONLY\", \"TENANT_API_KEYS_FORBIDDEN\", \"TENANT_API_KEYS_NOT_ENABLED\", \"TENANT_API_KEYS_NO_SCOPES\", \"TENANT_API_KEYS_SCOPE_INVALID\", \"TENANT_API_KEYS_SUSPENDED\", \"TENANT_API_KEYS_SUSPENDED_NOT_WRITABLE\", \"TENANT_API_KEYS_UNKNOWN_ROLE\", \"TENANT_API_KEY_EXPIRY_INVALID\", \"TENANT_API_KEY_LIMIT\", \"TENANT_API_KEY_NOT_ACTIVE\", \"TENANT_API_KEY_NOT_FOUND\", \"TENANT_API_KEY_SCOPE_ABOVE_CEILING\", \"TENANT_API_KEY_SCOPE_NOT_GRANTABLE\", \"TENANT_CONTEXT_REQUIRED\", \"TENANT_MEMBERSHIP_REQUIRED\", \"TENANT_NOT_ACTIVE\", \"TOKEN_EXPIRED\", \"TOKEN_INVALID\", \"TOKEN_REVOKED\", \"USERNAME_TAKEN\", \"account_exists_with_different_provider\", \"idempotency_secret_not_replayable\", \"link_required\", \"step_up_required\"] as const };\n","/**\n * @productcraft/auth: `auth.admin.app(id)` (admin) and `auth.consumer(slug)` (end users).\n * HTTP methods, types, errors and mocks are generated (scripts/gen-sdk.mjs); hand-written:\n * jwt/, passkeys.ts, consumer.ts and base.ts.\n */\nimport { APIError } from \"@productcraft/core\";\n\nexport { Auth, Auth as default } from \"./_generated/client.js\";\nexport * from \"./_generated/errors.js\";\nexport type { paths, components } from \"./_generated/paths.js\";\nexport type { AuthOptions, AuthOptions as AuthConfig } from \"./base.js\";\nexport { ConsumerScope, AUTH_LEGACY_ISSUER, type ConsumerScopeOptions } from \"./consumer.js\";\n/** 0.x name of the `auth.admin.app(id)` scope class. */\nexport { AuthApp as AppScope } from \"./_generated/resources.js\";\nexport type { PCAuth, PCClientConfig } from \"@productcraft/core\";\n\n/** @deprecated 0.x name: every API error is an `APIError` (`instanceof AuthHttpError` still works). Removed in 2.0. */\nexport const AuthHttpError = APIError;\n/** @deprecated 0.x name for `APIError`. Removed in 2.0. */\nexport type AuthHttpError = APIError;\n\n/** 0.x type names (`ConsumerSigninDto`, …), each a deprecated alias. */\nexport type * from \"./_generated/compat.js\";\n\nexport {\n JwksCache,\n type AuthClaims,\n type VerifyOptions,\n verifyAuthToken,\n isRefreshToken,\n JwtVerifyError,\n JwtInvalidError,\n JwtExpiredError,\n JwtNotYetValidError,\n JwtIssuerMismatchError,\n JwtAudienceMismatchError,\n JwksKeyNotFoundError,\n JwksFetchError,\n JwtRefreshTokenError,\n} from \"./jwt/index.js\";\n\nexport {\n toB64u,\n fromB64u,\n decodeOptions,\n encodeCredential,\n isPasskeySupported,\n createPasskeyCredential,\n getPasskeyCredential,\n PasskeyError,\n type PasskeyPublicKeyOptions,\n type PasskeyDecodedOptions,\n type PasskeyCredentialLike,\n type EncodedPasskeyCredential,\n type PasskeyCredentialsContainer,\n type PasskeyMediation,\n type PasskeyErrorCode,\n type PasskeyBrowserOptions,\n} from \"./passkeys.js\";\n"]}