@shipdit/cli 0.0.2 → 0.1.0

package/dist/index.mjs

@@ -365,16 +365,20 @@ async function i$1(e) {
 const a$1 = (...t) => hc(...t);
 const o$1 = (...t) => hc(...t);
 const s$1 = (...t) => hc(...t);
-const c$2 = (...t) => hc(...t);
-const l$2 = (...t) => hc(...t);
-const u$1 = (...t) => hc(...t);
-const d$1 = (...t) => hc(...t);
+const c$1 = (...t) => hc(...t);
+const l$1 = (...t) => hc(...t);
+const u$2 = (...t) => hc(...t);
+const d$2 = (...t) => hc(...t);
 const f$1 = (...t) => hc(...t);
 const p$1 = (...t) => hc(...t);
-function m$1(e) {
+const m$1 = (...t) => hc(...t);
+const h$1 = (...t) => hc(...t);
+const g$1 = (...t) => hc(...t);
+const _$1 = (...t) => hc(...t);
+function v$1(e) {
 	return `${e.replace(/\/+$/, ``)}/api/v1/rpc`;
 }
-function h$1(e) {
+function y$1(e) {
 	return {
 		...e.fetch ? { fetch: e.fetch } : {},
 		init: { credentials: e.client === `dashboard` ? `include` : `same-origin` },
@@ -384,70 +388,100 @@ function h$1(e) {
 		}
 	};
 }
-async function g$1(e, t) {
+async function b$1(e, t) {
 	return i$1(await e({ json: t }));
 }
-function _$1(e) {
-	let t = m$1(e.baseUrl), n = h$1(e), r = a$1(t, n), i = o$1(t, n), _ = s$1(t, n), v = c$2(t, n), y = l$2(t, n), b = u$1(t, n), x = d$1(t, n), S = f$1(t, n), C = p$1(t, n);
+function x$1(e) {
+	let t = v$1(e.baseUrl), n = y$1(e), r = a$1(t, n), i = o$1(t, n), x = s$1(t, n), S = c$1(t, n), C = l$1(t, n), w = u$2(t, n), T = d$2(t, n), E = m$1(t, n), D = f$1(t, n), O = p$1(t, n), k = h$1(t, n), A = g$1(t, n), j = _$1(t, n);
 	return {
-		me: { get: (e = {}) => g$1(r.me.$post, e) },
+		me: {
+			get: (e = {}) => b$1(r.me.$post, e),
+			feedback: (e) => b$1(r.me.feedback.$post, e)
+		},
 		project: {
-			list: (e = {}) => g$1(i.project.list.$post, e),
-			create: (e) => g$1(i.project.create.$post, e),
-			update: (e) => g$1(i.project.update.$post, e),
-			archive: (e) => g$1(i.project.archive.$post, e)
+			list: (e = {}) => b$1(i.project.list.$post, e),
+			create: (e) => b$1(i.project.create.$post, e),
+			update: (e) => b$1(i.project.update.$post, e),
+			archive: (e) => b$1(i.project.archive.$post, e)
 		},
 		environment: {
-			list: (e) => g$1(_.environment.list.$post, e),
-			create: (e) => g$1(_.environment.create.$post, e),
-			update: (e) => g$1(_.environment.update.$post, e),
-			archive: (e) => g$1(_.environment.archive.$post, e)
+			list: (e) => b$1(x.environment.list.$post, e),
+			create: (e) => b$1(x.environment.create.$post, e),
+			update: (e) => b$1(x.environment.update.$post, e),
+			archive: (e) => b$1(x.environment.archive.$post, e)
 		},
 		flag: {
-			list: (e) => g$1(v.flag.list.$post, e),
-			get: (e) => g$1(v.flag.get.$post, e),
-			create: (e) => g$1(v.flag.create.$post, e),
-			update: (e) => g$1(v.flag.update.$post, e),
-			archive: (e) => g$1(v.flag.archive.$post, e),
-			updateEnvironment: (e) => g$1(v.flag.updateEnvironment.$post, e),
-			toggleEnvironment: (e) => g$1(v.flag.toggleEnvironment.$post, e),
-			pull: (e) => g$1(v.flag.pull.$post, e),
-			diff: (e) => g$1(v.flag.diff.$post, e),
-			push: (e) => g$1(v.flag.push.$post, e)
+			list: (e) => b$1(S.flag.list.$post, e),
+			get: (e) => b$1(S.flag.get.$post, e),
+			create: (e) => b$1(S.flag.create.$post, e),
+			update: (e) => b$1(S.flag.update.$post, e),
+			archive: (e) => b$1(S.flag.archive.$post, e),
+			updateEnvironment: (e) => b$1(S.flag.updateEnvironment.$post, e),
+			toggleEnvironment: (e) => b$1(S.flag.toggleEnvironment.$post, e),
+			listEnvironmentStates: (e) => b$1(S.flag.listEnvironmentStates.$post, e),
+			pull: (e) => b$1(S.flag.pull.$post, e),
+			diff: (e) => b$1(S.flag.diff.$post, e),
+			push: (e) => b$1(S.flag.push.$post, e)
 		},
 		apiKey: {
-			list: (e = {}) => g$1(y.apiKey.list.$post, e),
-			create: (e) => g$1(y.apiKey.create.$post, e),
-			revoke: (e) => g$1(y.apiKey.revoke.$post, e)
+			list: (e = {}) => b$1(C.apiKey.list.$post, e),
+			create: (e) => b$1(C.apiKey.create.$post, e),
+			revoke: (e) => b$1(C.apiKey.revoke.$post, e)
 		},
 		sdkKey: {
-			list: (e = {}) => g$1(b.sdkKey.list.$post, e),
-			create: (e) => g$1(b.sdkKey.create.$post, e),
-			revoke: (e) => g$1(b.sdkKey.revoke.$post, e)
+			list: (e = {}) => b$1(T.sdkKey.list.$post, e),
+			create: (e) => b$1(T.sdkKey.create.$post, e),
+			revoke: (e) => b$1(T.sdkKey.revoke.$post, e)
+		},
+		segment: {
+			list: (e) => b$1(E.segment.list.$post, e),
+			get: (e) => b$1(E.segment.get.$post, e),
+			create: (e) => b$1(E.segment.create.$post, e),
+			update: (e) => b$1(E.segment.update.$post, e),
+			archive: (e) => b$1(E.segment.archive.$post, e),
+			listEnvironmentStates: (e) => b$1(E.segment.listEnvironmentStates.$post, e),
+			updateEnvironment: (e) => b$1(E.segment.updateEnvironment.$post, e)
 		},
 		evaluatedEntity: {
-			list: (e) => g$1(x.evaluatedEntity.list.$post, e),
-			get: (e) => g$1(x.evaluatedEntity.get.$post, e),
-			delete: (e) => g$1(x.evaluatedEntity.delete.$post, e)
+			list: (e) => b$1(D.evaluatedEntity.list.$post, e),
+			get: (e) => b$1(D.evaluatedEntity.get.$post, e),
+			delete: (e) => b$1(D.evaluatedEntity.delete.$post, e)
+		},
+		evaluationFact: {
+			list: (e) => b$1(O.evaluationFact.list.$post, e),
+			byRule: (e) => b$1(O.evaluationFact.byRule.$post, e),
+			orgSummary: (e = {}) => b$1(O.evaluationFact.orgSummary.$post, e),
+			projectSummary: (e) => b$1(O.evaluationFact.projectSummary.$post, e),
+			simulate: (e) => b$1(O.evaluationFact.simulate.$post, e)
 		},
-		snapshot: { publish: (e) => g$1(S.snapshot.publish.$post, e) },
-		device: { authorize: (e) => g$1(C.device.authorize.$post, e) },
+		snapshot: { publish: (e) => b$1(k.snapshot.publish.$post, e) },
+		device: { authorize: (e) => b$1(A.device.authorize.$post, e) },
+		billing: {
+			get: (e = {}) => b$1(j.billing.get.$post, e),
+			attach: (e) => b$1(j.billing.attach.$post, e),
+			openPortal: (e) => b$1(j.billing.openPortal.$post, e)
+		},
+		audit: { list: (e = {}) => b$1(w.audit.list.$post, e) },
 		raw: {
 			me: r,
 			project: i,
-			environment: _,
-			flag: v,
-			apiKey: y,
-			sdkKey: b,
-			evaluatedEntity: x,
-			snapshot: S,
-			device: C
+			environment: x,
+			flag: S,
+			apiKey: C,
+			audit: w,
+			sdkKey: T,
+			segment: E,
+			evaluatedEntity: D,
+			evaluationFact: O,
+			snapshot: k,
+			device: A,
+			billing: j
 		}
 	};
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_39d811f210df3a5f20302036ab91db01/node_modules/@better-auth/core/dist/utils/error-codes.mjs
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_92516152aeaed9865e4d3971447ef996/node_modules/@better-auth/core/dist/utils/error-codes.mjs
 function defineErrorCodes(codes) {
 	return Object.fromEntries(Object.entries(codes).map(([key, value]) => [key, {
 		code: key,
@@ -570,7 +604,7 @@ var InternalAPIError = class extends Error {
 const APIError = makeErrorForHideStackFrame(InternalAPIError, Error);
 
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_39d811f210df3a5f20302036ab91db01/node_modules/@better-auth/core/dist/error/index.mjs
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_92516152aeaed9865e4d3971447ef996/node_modules/@better-auth/core/dist/error/index.mjs
 var BetterAuthError = class extends Error {
 	constructor(message, options) {
 		super(message, options);
@@ -581,7 +615,7 @@ var BetterAuthError = class extends Error {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/access/access.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/plugins/access/access.mjs
 function unknownResourceResponse(requestedResource) {
 	return {
 		success: false,
@@ -658,15 +692,30 @@ function createAccessControl(s) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/package.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/plugins/two-factor/error-code.mjs
+const TWO_FACTOR_ERROR_CODES = defineErrorCodes({
+	OTP_NOT_ENABLED: "OTP not enabled",
+	OTP_HAS_EXPIRED: "OTP has expired",
+	TOTP_NOT_ENABLED: "TOTP not enabled",
+	TWO_FACTOR_NOT_ENABLED: "Two factor isn't enabled",
+	BACKUP_CODES_NOT_ENABLED: "Backup codes aren't enabled",
+	INVALID_BACKUP_CODE: "Invalid backup code",
+	INVALID_CODE: "Invalid code",
+	TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE: "Too many attempts. Please request a new code.",
+	ACCOUNT_TEMPORARILY_LOCKED: "Too many failed verification attempts. Your account is temporarily locked. Please try again later.",
+	INVALID_TWO_FACTOR_COOKIE: "Invalid two factor cookie"
+});
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/package.mjs
 var version = "1.6.26";
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/version.mjs
-const PACKAGE_VERSION$1 = version;
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/version.mjs
+const PACKAGE_VERSION$2 = version;
 
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_39d811f210df3a5f20302036ab91db01/node_modules/@better-auth/core/dist/utils/url.mjs
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_92516152aeaed9865e4d3971447ef996/node_modules/@better-auth/core/dist/utils/url.mjs
 /**
 * Schemes that execute or embed code when navigated to or accepted as a
 * redirect target. These are never safe as an OAuth `redirect_uri` or as a
@@ -698,7 +747,45 @@ function isSafeUrlScheme(value) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/admin/access/statement.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/plugins/two-factor/client.mjs
+const twoFactorClient = (options) => {
+	return {
+		id: "two-factor",
+		version: PACKAGE_VERSION$2,
+		$InferServerPlugin: {},
+		atomListeners: [{
+			matcher: (path) => path.startsWith("/two-factor/"),
+			signal: "$sessionSignal"
+		}],
+		pathMethods: {
+			"/two-factor/disable": "POST",
+			"/two-factor/enable": "POST",
+			"/two-factor/send-otp": "POST",
+			"/two-factor/generate-backup-codes": "POST",
+			"/two-factor/get-totp-uri": "POST",
+			"/two-factor/verify-totp": "POST",
+			"/two-factor/verify-otp": "POST",
+			"/two-factor/verify-backup-code": "POST"
+		},
+		fetchPlugins: [{
+			id: "two-factor",
+			name: "two-factor",
+			hooks: { async onSuccess(context) {
+				if (context.data?.twoFactorRedirect) {
+					if (options?.onTwoFactorRedirect) {
+						await options.onTwoFactorRedirect({ twoFactorMethods: context.data.twoFactorMethods });
+						return;
+					}
+					if (options?.twoFactorPage && typeof window !== "undefined" && isSafeUrlScheme(options.twoFactorPage)) window.location.href = options.twoFactorPage;
+				}
+			} }
+		}],
+		$ERROR_CODES: TWO_FACTOR_ERROR_CODES
+	};
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/plugins/admin/access/statement.mjs
 const defaultStatements$1 = {
 	user: [
 		"create",
@@ -749,7 +836,7 @@ const defaultRoles$1 = {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/admin/error-codes.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/plugins/admin/error-codes.mjs
 const ADMIN_ERROR_CODES = defineErrorCodes({
 	FAILED_TO_CREATE_USER: "Failed to create user",
 	USER_ALREADY_EXISTS: "User already exists.",
@@ -777,7 +864,7 @@ const ADMIN_ERROR_CODES = defineErrorCodes({
 });
 
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_39d811f210df3a5f20302036ab91db01/node_modules/@better-auth/core/dist/env/env-impl.mjs
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_92516152aeaed9865e4d3971447ef996/node_modules/@better-auth/core/dist/env/env-impl.mjs
 const _envShim = Object.create(null);
 const _getEnv = (useShim) => globalThis.process?.env || globalThis.Deno?.env.toObject() || globalThis.__env__ || (useShim ? _envShim : globalThis);
 const env = new Proxy(_envShim, {
@@ -841,7 +928,7 @@ const ENV = Object.freeze({
 });
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/utils/url.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/utils/url.mjs
 const SLASH_CHAR_CODE = "/".charCodeAt(0);
 function trimTrailingSlashes(value) {
 	let end = value.length;
@@ -920,7 +1007,7 @@ function getOrigin(url) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/admin/has-permission.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/plugins/admin/has-permission.mjs
 const hasPermission = (input) => {
 	if (input.userId && input.options?.adminUserIds?.includes(input.userId)) return true;
 	if (!input.permissions) return false;
@@ -1449,7 +1536,7 @@ var betterFetch = async (url, options) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/parser.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/client/parser.mjs
 const PROTO_POLLUTION_PATTERNS = {
 	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
 	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
@@ -1519,7 +1606,7 @@ function parseJSON(value, options = { strict: true }) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/organization/access/statement.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/plugins/organization/access/statement.mjs
 const defaultStatements = {
 	organization: ["update", "delete"],
 	member: [
@@ -1595,7 +1682,7 @@ const defaultRoles = {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/organization/permission.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/plugins/organization/permission.mjs
 const hasPermissionFn = (input, acRoles) => {
 	if (!input.permissions) return false;
 	const roles = input.role.split(",");
@@ -1608,7 +1695,7 @@ const hasPermissionFn = (input, acRoles) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/organization/error-codes.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/plugins/organization/error-codes.mjs
 const ORGANIZATION_ERROR_CODES = defineErrorCodes({
 	YOU_ARE_NOT_ALLOWED_TO_CREATE_A_NEW_ORGANIZATION: "You are not allowed to create a new organization",
 	YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_ORGANIZATIONS: "You have reached the maximum number of organizations",
@@ -1677,9 +1764,11 @@ const t$1 = createAccessControl({
 	organization: [`update`, `delete`],
 	member: [
 		`create`,
+		`read`,
 		`update`,
 		`delete`
 	],
+	audit: [`read`],
 	project: [
 		`create`,
 		`read`,
@@ -1711,16 +1800,20 @@ const t$1 = createAccessControl({
 		`read`,
 		`revoke`
 	],
-	evaluated_entity: [`read`, `delete`]
+	evaluated_entity: [`read`, `delete`],
+	billing: [`read`, `manage`]
 });
 const n$1 = {
 	viewer: t$1.newRole({
+		member: [`read`],
 		project: [`read`],
 		environment: [`read`],
 		flag: [`read`],
-		evaluated_entity: [`read`]
+		evaluated_entity: [`read`],
+		billing: [`read`]
 	}),
 	editor: t$1.newRole({
+		member: [`read`],
 		project: [`read`, `update`],
 		environment: [`read`],
 		flag: [
@@ -1732,11 +1825,17 @@ const n$1 = {
 		flag_state: [`update`],
 		apiKey: [`read`],
 		sdk_key: [`read`],
-		evaluated_entity: [`read`]
+		evaluated_entity: [`read`],
+		billing: [`read`]
 	}),
 	admin: t$1.newRole({
 		organization: [`update`],
-		member: [`create`, `update`],
+		member: [
+			`create`,
+			`read`,
+			`update`
+		],
+		audit: [`read`],
 		project: [
 			`create`,
 			`read`,
@@ -1768,15 +1867,18 @@ const n$1 = {
 			`read`,
 			`revoke`
 		],
-		evaluated_entity: [`read`, `delete`]
+		evaluated_entity: [`read`, `delete`],
+		billing: [`read`, `manage`]
 	}),
 	owner: t$1.newRole({
 		organization: [`update`, `delete`],
 		member: [
 			`create`,
+			`read`,
 			`update`,
 			`delete`
 		],
+		audit: [`read`],
 		project: [
 			`create`,
 			`read`,
@@ -1808,12 +1910,13 @@ const n$1 = {
 			`read`,
 			`revoke`
 		],
-		evaluated_entity: [`read`, `delete`]
+		evaluated_entity: [`read`, `delete`],
+		billing: [`read`, `manage`]
 	})
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/broadcast-channel.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/client/broadcast-channel.mjs
 const kBroadcastChannel = Symbol.for("better-auth:broadcast-channel");
 const now$1 = () => Math.floor(Date.now() / 1e3);
 var WindowBroadcastChannel = class {
@@ -2030,7 +2133,7 @@ let onMount = ($store, initialize) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/equality.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/client/equality.mjs
 function isPlainObject(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const prototype = Object.getPrototypeOf(value);
@@ -2071,7 +2174,7 @@ function withEquality(store, isEqual) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/focus-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/client/focus-manager.mjs
 const kFocusManager = Symbol.for("better-auth:focus-manager");
 var WindowFocusManager = class {
 	listeners = /* @__PURE__ */ new Set();
@@ -2101,7 +2204,7 @@ function getGlobalFocusManager() {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/online-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/client/online-manager.mjs
 const kOnlineManager = Symbol.for("better-auth:online-manager");
 var WindowOnlineManager = class {
 	listeners = /* @__PURE__ */ new Set();
@@ -2134,7 +2237,7 @@ function getGlobalOnlineManager() {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/query.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/client/query.mjs
 const isServer$1 = () => typeof window === "undefined";
 function isAuthQueryStateEqual(a, b) {
 	return isJsonEqual(a.data, b.data) && a.error === b.error && a.isPending === b.isPending && a.isRefetching === b.isRefetching && a.refetch === b.refetch;
@@ -2256,7 +2359,7 @@ const useAuthQuery = (initializedAtom, path, $fetch, options) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/session-refresh.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/client/session-refresh.mjs
 const now = () => Math.floor(Date.now() / 1e3);
 /**
 * Rate limit: don't refetch on focus if a session request was made within this many seconds
@@ -2384,7 +2487,7 @@ function createSessionRefreshManager(opts) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/fetch-plugins.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/client/fetch-plugins.mjs
 const redirectPlugin = {
 	id: "redirect",
 	name: "Redirect",
@@ -2400,7 +2503,7 @@ const redirectPlugin = {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/session-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/client/session-atom.mjs
 const isServer = () => typeof window === "undefined";
 /**
 * Normalize $fetch response: `throw: true` returns data directly,
@@ -2551,7 +2654,7 @@ function getSessionAtom($fetch, options) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/config.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/client/config.mjs
 const resolvePublicAuthUrl = (basePath) => {
 	if (typeof process === "undefined") return void 0;
 	const path = basePath ?? "/api/auth";
@@ -2650,13 +2753,13 @@ const getClientConfig = (options, loadEnv) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/utils/is-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/utils/is-atom.mjs
 function isAtom(value) {
 	return typeof value === "object" && value !== null && "get" in value && typeof value.get === "function" && "lc" in value && typeof value.lc === "number";
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_39d811f210df3a5f20302036ab91db01/node_modules/@better-auth/core/dist/utils/string.mjs
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_92516152aeaed9865e4d3971447ef996/node_modules/@better-auth/core/dist/utils/string.mjs
 function capitalizeFirstLetter(str) {
 	return str.charAt(0).toUpperCase() + str.slice(1);
 }
@@ -2670,7 +2773,7 @@ function toKebabCase(input) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/proxy.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/client/proxy.mjs
 function getMethod(path, knownPathMethods, args) {
 	const method = knownPathMethods[path];
 	const { fetchOptions, query: _query, ...body } = args || {};
@@ -2746,7 +2849,7 @@ function createDynamicPathProxy(routes, client, knownPathMethods, atoms, atomLis
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/vanilla.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/client/vanilla.mjs
 function createAuthClient(options) {
 	const { pluginPathMethods, pluginsActions, pluginsAtoms, $fetch, atomListeners, $store } = getClientConfig(options);
 	const resolvedHooks = {};
@@ -2760,17 +2863,17 @@ function createAuthClient(options) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/additional-fields/client.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/plugins/additional-fields/client.mjs
 const inferAdditionalFields = (schema) => {
 	return {
 		id: "additional-fields-client",
-		version: PACKAGE_VERSION$1,
+		version: PACKAGE_VERSION$2,
 		$InferServerPlugin: {}
 	};
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/admin/client.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/plugins/admin/client.mjs
 const adminClient = (options) => {
 	const roles = {
 		admin: adminAc$1,
@@ -2779,7 +2882,7 @@ const adminClient = (options) => {
 	};
 	return {
 		id: "admin-client",
-		version: PACKAGE_VERSION$1,
+		version: PACKAGE_VERSION$2,
 		$InferServerPlugin: {},
 		getActions: () => ({ admin: { checkRolePermission: (data) => {
 			return hasPermission({
@@ -2805,11 +2908,11 @@ const adminClient = (options) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/device-authorization/client.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/plugins/device-authorization/client.mjs
 const deviceAuthorizationClient = () => {
 	return {
 		id: "device-authorization",
-		version: PACKAGE_VERSION$1,
+		version: PACKAGE_VERSION$2,
 		$InferServerPlugin: {},
 		pathMethods: {
 			"/device/code": "POST",
@@ -2822,7 +2925,7 @@ const deviceAuthorizationClient = () => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/organization/client.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_20fb48331ea10f84b14a69b42b690fe2/node_modules/better-auth/dist/plugins/organization/client.mjs
 /**
 * Using the same `hasPermissionFn` function, but without the need for a `ctx` parameter or the `organizationId` parameter.
 */
@@ -2842,7 +2945,7 @@ const organizationClient = (options) => {
 	};
 	return {
 		id: "organization",
-		version: PACKAGE_VERSION$1,
+		version: PACKAGE_VERSION$2,
 		$InferServerPlugin: {},
 		getActions: ($fetch, _$store, co) => ({
 			$Infer: {
@@ -2920,7 +3023,7 @@ const organizationClient = (options) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+api-key@1.6.26_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-f_7fcf2d2039ede21128af994b19d00ab6/node_modules/@better-auth/api-key/dist/version-vgVyvied.mjs
+//#region ../../node_modules/.pnpm/@better-auth+api-key@1.6.26_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-f_26c063546df2762d5214ad7424a4d563/node_modules/@better-auth/api-key/dist/version-vgVyvied.mjs
 const API_KEY_ERROR_CODES = defineErrorCodes({
 	INVALID_METADATA_TYPE: "metadata must be an object or undefined",
 	REFILL_AMOUNT_AND_INTERVAL_REQUIRED: "refillAmount is required when refillInterval is provided",
@@ -2954,14 +3057,14 @@ const API_KEY_ERROR_CODES = defineErrorCodes({
 	NO_DEFAULT_API_KEY_CONFIGURATION_FOUND: "No default api-key configuration found.",
 	ORGANIZATION_PLUGIN_REQUIRED: "Organization plugin is required for organization-owned API keys. Please install and configure the organization plugin."
 });
-const PACKAGE_VERSION = "1.6.26";
+const PACKAGE_VERSION$1 = "1.6.26";
 
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+api-key@1.6.26_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-f_7fcf2d2039ede21128af994b19d00ab6/node_modules/@better-auth/api-key/dist/client.mjs
+//#region ../../node_modules/.pnpm/@better-auth+api-key@1.6.26_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-f_26c063546df2762d5214ad7424a4d563/node_modules/@better-auth/api-key/dist/client.mjs
 const apiKeyClient = () => {
 	return {
 		id: "api-key",
-		version: PACKAGE_VERSION,
+		version: PACKAGE_VERSION$1,
 		$InferServerPlugin: {},
 		pathMethods: {
 			"/api-key/create": "POST",
@@ -2972,13 +3075,704 @@ const apiKeyClient = () => {
 	};
 };
 
+//#endregion
+//#region ../../node_modules/.pnpm/@better-auth+passkey@1.6.26_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-f_b9d6999fc8dc623532f797abb6d4608d/node_modules/@better-auth/passkey/dist/version-BE4wdr64.mjs
+const PASSKEY_ERROR_CODES = defineErrorCodes({
+	CHALLENGE_NOT_FOUND: "Challenge not found",
+	YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY: "You are not allowed to register this passkey",
+	FAILED_TO_VERIFY_REGISTRATION: "Failed to verify registration",
+	PASSKEY_NOT_FOUND: "Passkey not found",
+	AUTHENTICATION_FAILED: "Authentication failed",
+	UNABLE_TO_CREATE_SESSION: "Unable to create session",
+	FAILED_TO_UPDATE_PASSKEY: "Failed to update passkey",
+	PREVIOUSLY_REGISTERED: "Previously registered",
+	REGISTRATION_CANCELLED: "Registration cancelled",
+	AUTH_CANCELLED: "Auth cancelled",
+	UNKNOWN_ERROR: "Unknown error",
+	SESSION_REQUIRED: "Passkey registration requires an authenticated session",
+	RESOLVE_USER_REQUIRED: "Passkey registration requires either an authenticated session or a resolveUser callback when requireSession is false",
+	RESOLVED_USER_INVALID: "Resolved user is invalid"
+});
+const PACKAGE_VERSION = "1.6.26";
+
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/bufferToBase64URLString.js
+/**
+* Convert the given array buffer into a Base64URL-encoded string. Ideal for converting various
+* credential response ArrayBuffers to string for sending back to the server as JSON.
+*
+* Helper method to compliment `base64URLStringToBuffer`
+*/
+function bufferToBase64URLString(buffer) {
+	const bytes = new Uint8Array(buffer);
+	let str = "";
+	for (const charCode of bytes) str += String.fromCharCode(charCode);
+	return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/base64URLStringToBuffer.js
+/**
+* Convert from a Base64URL-encoded string to an Array Buffer. Best used when converting a
+* credential ID from a JSON string to an ArrayBuffer, like in allowCredentials or
+* excludeCredentials
+*
+* Helper method to compliment `bufferToBase64URLString`
+*/
+function base64URLStringToBuffer(base64URLString) {
+	const base64 = base64URLString.replace(/-/g, "+").replace(/_/g, "/");
+	/**
+	* Pad with '=' until it's a multiple of four
+	* (4 - (85 % 4 = 1) = 3) % 4 = 3 padding
+	* (4 - (86 % 4 = 2) = 2) % 4 = 2 padding
+	* (4 - (87 % 4 = 3) = 1) % 4 = 1 padding
+	* (4 - (88 % 4 = 0) = 4) % 4 = 0 padding
+	*/
+	const padLength = (4 - base64.length % 4) % 4;
+	const padded = base64.padEnd(base64.length + padLength, "=");
+	const binary = atob(padded);
+	const buffer = new ArrayBuffer(binary.length);
+	const bytes = new Uint8Array(buffer);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return buffer;
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/browserSupportsWebAuthn.js
+/**
+* Determine if the browser is capable of Webauthn
+*/
+function browserSupportsWebAuthn() {
+	return _browserSupportsWebAuthnInternals.stubThis(globalThis?.PublicKeyCredential !== void 0 && typeof globalThis.PublicKeyCredential === "function");
+}
+/**
+* Make it possible to stub the return value during testing
+* @ignore Don't include this in docs output
+*/
+const _browserSupportsWebAuthnInternals = { stubThis: (value) => value };
+
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/toPublicKeyCredentialDescriptor.js
+function toPublicKeyCredentialDescriptor(descriptor) {
+	const { id } = descriptor;
+	return {
+		...descriptor,
+		id: base64URLStringToBuffer(id),
+		/**
+		* `descriptor.transports` is an array of our `AuthenticatorTransportFuture` that includes newer
+		* transports that TypeScript's DOM lib is ignorant of. Convince TS that our list of transports
+		* are fine to pass to WebAuthn since browsers will recognize the new value.
+		*/
+		transports: descriptor.transports
+	};
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/isValidDomain.js
+/**
+* A simple test to determine if a hostname is a properly-formatted domain name
+*
+* A "valid domain" is defined here: https://url.spec.whatwg.org/#valid-domain
+*
+* Regex was originally sourced from here, then remixed to add punycode support:
+* https://www.oreilly.com/library/view/regular-expressions-cookbook/9781449327453/ch08s15.html
+*/
+function isValidDomain(hostname) {
+	return hostname === "localhost" || /^((xn--[a-z0-9-]+|[a-z0-9]+(-[a-z0-9]+)*)\.)+([a-z]{2,}|xn--[a-z0-9-]+)$/i.test(hostname);
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/webAuthnError.js
+/**
+* A custom Error used to return a more nuanced error detailing _why_ one of the eight documented
+* errors in the spec was raised after calling `navigator.credentials.create()` or
+* `navigator.credentials.get()`:
+*
+* - `AbortError`
+* - `ConstraintError`
+* - `InvalidStateError`
+* - `NotAllowedError`
+* - `NotSupportedError`
+* - `SecurityError`
+* - `TypeError`
+* - `UnknownError`
+*
+* Error messages were determined through investigation of the spec to determine under which
+* scenarios a given error would be raised.
+*/
+var WebAuthnError = class extends Error {
+	constructor({ message, code, cause, name }) {
+		super(message, { cause });
+		Object.defineProperty(this, "code", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: void 0
+		});
+		this.name = name ?? cause.name;
+		this.code = code;
+	}
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/identifyRegistrationError.js
+/**
+* Attempt to intuit _why_ an error was raised after calling `navigator.credentials.create()`
+*/
+function identifyRegistrationError({ error, options }) {
+	const { publicKey } = options;
+	if (!publicKey) throw Error("options was missing required publicKey property");
+	if (error.name === "AbortError") {
+		if (options.signal instanceof AbortSignal) return new WebAuthnError({
+			message: "Registration ceremony was sent an abort signal",
+			code: "ERROR_CEREMONY_ABORTED",
+			cause: error
+		});
+	} else if (error.name === "ConstraintError") {
+		if (publicKey.authenticatorSelection?.requireResidentKey === true) return new WebAuthnError({
+			message: "Discoverable credentials were required but no available authenticator supported it",
+			code: "ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT",
+			cause: error
+		});
+		else if (options.mediation === "conditional" && publicKey.authenticatorSelection?.userVerification === "required") return new WebAuthnError({
+			message: "User verification was required during automatic registration but it could not be performed",
+			code: "ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE",
+			cause: error
+		});
+		else if (publicKey.authenticatorSelection?.userVerification === "required") return new WebAuthnError({
+			message: "User verification was required but no available authenticator supported it",
+			code: "ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT",
+			cause: error
+		});
+	} else if (error.name === "InvalidStateError") return new WebAuthnError({
+		message: "The authenticator was previously registered",
+		code: "ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED",
+		cause: error
+	});
+	else if (error.name === "NotAllowedError")
+ /**
+	* Pass the error directly through. Platforms are overloading this error beyond what the spec
+	* defines and we don't want to overwrite potentially useful error messages.
+	*/
+	return new WebAuthnError({
+		message: error.message,
+		code: "ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",
+		cause: error
+	});
+	else if (error.name === "NotSupportedError") {
+		if (publicKey.pubKeyCredParams.filter((param) => param.type === "public-key").length === 0) return new WebAuthnError({
+			message: "No entry in pubKeyCredParams was of type \"public-key\"",
+			code: "ERROR_MALFORMED_PUBKEYCREDPARAMS",
+			cause: error
+		});
+		return new WebAuthnError({
+			message: "No available authenticator supported any of the specified pubKeyCredParams algorithms",
+			code: "ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG",
+			cause: error
+		});
+	} else if (error.name === "SecurityError") {
+		const effectiveDomain = globalThis.location.hostname;
+		if (!isValidDomain(effectiveDomain)) return new WebAuthnError({
+			message: `${globalThis.location.hostname} is an invalid domain`,
+			code: "ERROR_INVALID_DOMAIN",
+			cause: error
+		});
+		else if (publicKey.rp.id !== effectiveDomain) return new WebAuthnError({
+			message: `The RP ID "${publicKey.rp.id}" is invalid for this domain`,
+			code: "ERROR_INVALID_RP_ID",
+			cause: error
+		});
+	} else if (error.name === "TypeError") {
+		if (publicKey.user.id.byteLength < 1 || publicKey.user.id.byteLength > 64) return new WebAuthnError({
+			message: "User ID was not between 1 and 64 characters",
+			code: "ERROR_INVALID_USER_ID_LENGTH",
+			cause: error
+		});
+	} else if (error.name === "UnknownError") return new WebAuthnError({
+		message: "The authenticator was unable to process the specified options, or could not create a new credential",
+		code: "ERROR_AUTHENTICATOR_GENERAL_ERROR",
+		cause: error
+	});
+	return error;
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/webAuthnAbortService.js
+var BaseWebAuthnAbortService = class {
+	constructor() {
+		Object.defineProperty(this, "controller", {
+			enumerable: true,
+			configurable: true,
+			writable: true,
+			value: void 0
+		});
+	}
+	createNewAbortSignal() {
+		if (this.controller) {
+			const abortError = /* @__PURE__ */ new Error("Cancelling existing WebAuthn API call for new one");
+			abortError.name = "AbortError";
+			this.controller.abort(abortError);
+		}
+		const newController = new AbortController();
+		this.controller = newController;
+		return newController.signal;
+	}
+	cancelCeremony() {
+		if (this.controller) {
+			const abortError = /* @__PURE__ */ new Error("Manually cancelling existing WebAuthn API call");
+			abortError.name = "AbortError";
+			this.controller.abort(abortError);
+			this.controller = void 0;
+		}
+	}
+};
+/**
+* A service singleton to help ensure that only a single WebAuthn ceremony is active at a time.
+*
+* Users of **@simplewebauthn/browser** shouldn't typically need to use this, but it can help e.g.
+* developers building projects that use client-side routing to better control the behavior of
+* their UX in response to router navigation events.
+*/
+const WebAuthnAbortService = new BaseWebAuthnAbortService();
+
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/toAuthenticatorAttachment.js
+const attachments = ["cross-platform", "platform"];
+/**
+* If possible coerce a `string` value into a known `AuthenticatorAttachment`
+*/
+function toAuthenticatorAttachment(attachment) {
+	if (!attachment) return;
+	if (attachments.indexOf(attachment) < 0) return;
+	return attachment;
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/methods/startRegistration.js
+/**
+* Begin authenticator "registration" via WebAuthn attestation
+*
+* @param optionsJSON Output from **@simplewebauthn/server**'s `generateRegistrationOptions()`
+* @param useAutoRegister (Optional) Try to silently create a passkey with the password manager that the user just signed in with. Defaults to `false`.
+*/
+async function startRegistration(options) {
+	if (!options.optionsJSON && options.challenge) {
+		console.warn("startRegistration() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information.");
+		options = { optionsJSON: options };
+	}
+	const { optionsJSON, useAutoRegister = false } = options;
+	if (!browserSupportsWebAuthn()) throw new Error("WebAuthn is not supported in this browser");
+	const publicKey = {
+		...optionsJSON,
+		challenge: base64URLStringToBuffer(optionsJSON.challenge),
+		user: {
+			...optionsJSON.user,
+			id: base64URLStringToBuffer(optionsJSON.user.id)
+		},
+		excludeCredentials: optionsJSON.excludeCredentials?.map(toPublicKeyCredentialDescriptor)
+	};
+	const createOptions = {};
+	/**
+	* Try to use conditional create to register a passkey for the user with the password manager
+	* the user just used to authenticate with. The user won't be shown any prominent UI by the
+	* browser.
+	*/
+	if (useAutoRegister) createOptions.mediation = "conditional";
+	createOptions.publicKey = publicKey;
+	createOptions.signal = WebAuthnAbortService.createNewAbortSignal();
+	let credential;
+	try {
+		credential = await navigator.credentials.create(createOptions);
+	} catch (err) {
+		throw identifyRegistrationError({
+			error: err,
+			options: createOptions
+		});
+	}
+	if (!credential) throw new Error("Registration was not completed");
+	const { id, rawId, response, type } = credential;
+	let transports = void 0;
+	if (typeof response.getTransports === "function") transports = response.getTransports();
+	let responsePublicKeyAlgorithm = void 0;
+	if (typeof response.getPublicKeyAlgorithm === "function") try {
+		responsePublicKeyAlgorithm = response.getPublicKeyAlgorithm();
+	} catch (error) {
+		warnOnBrokenImplementation("getPublicKeyAlgorithm()", error);
+	}
+	let responsePublicKey = void 0;
+	if (typeof response.getPublicKey === "function") try {
+		const _publicKey = response.getPublicKey();
+		if (_publicKey !== null) responsePublicKey = bufferToBase64URLString(_publicKey);
+	} catch (error) {
+		warnOnBrokenImplementation("getPublicKey()", error);
+	}
+	let responseAuthenticatorData;
+	if (typeof response.getAuthenticatorData === "function") try {
+		responseAuthenticatorData = bufferToBase64URLString(response.getAuthenticatorData());
+	} catch (error) {
+		warnOnBrokenImplementation("getAuthenticatorData()", error);
+	}
+	return {
+		id,
+		rawId: bufferToBase64URLString(rawId),
+		response: {
+			attestationObject: bufferToBase64URLString(response.attestationObject),
+			clientDataJSON: bufferToBase64URLString(response.clientDataJSON),
+			transports,
+			publicKeyAlgorithm: responsePublicKeyAlgorithm,
+			publicKey: responsePublicKey,
+			authenticatorData: responseAuthenticatorData
+		},
+		type,
+		clientExtensionResults: credential.getClientExtensionResults(),
+		authenticatorAttachment: toAuthenticatorAttachment(credential.authenticatorAttachment)
+	};
+}
+/**
+* Visibly warn when we detect an issue related to a passkey provider intercepting WebAuthn API
+* calls
+*/
+function warnOnBrokenImplementation(methodName, cause) {
+	console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${methodName}. You should report this error to them.\n`, cause);
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/browserSupportsWebAuthnAutofill.js
+/**
+* Determine if the browser supports conditional UI, so that WebAuthn credentials can
+* be shown to the user in the browser's typical password autofill popup.
+*/
+function browserSupportsWebAuthnAutofill() {
+	if (!browserSupportsWebAuthn()) return _browserSupportsWebAuthnAutofillInternals.stubThis(new Promise((resolve) => resolve(false)));
+	/**
+	* I don't like the `as unknown` here but there's a `declare var PublicKeyCredential` in
+	* TS' DOM lib that's making it difficult for me to just go `as PublicKeyCredentialFuture` as I
+	* want. I think I'm fine with this for now since it's _supposed_ to be temporary, until TS types
+	* have a chance to catch up.
+	*/
+	const globalPublicKeyCredential = globalThis.PublicKeyCredential;
+	if (globalPublicKeyCredential?.isConditionalMediationAvailable === void 0) return _browserSupportsWebAuthnAutofillInternals.stubThis(new Promise((resolve) => resolve(false)));
+	return _browserSupportsWebAuthnAutofillInternals.stubThis(globalPublicKeyCredential.isConditionalMediationAvailable());
+}
+const _browserSupportsWebAuthnAutofillInternals = { stubThis: (value) => value };
+
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/helpers/identifyAuthenticationError.js
+/**
+* Attempt to intuit _why_ an error was raised after calling `navigator.credentials.get()`
+*/
+function identifyAuthenticationError({ error, options }) {
+	const { publicKey } = options;
+	if (!publicKey) throw Error("options was missing required publicKey property");
+	if (error.name === "AbortError") {
+		if (options.signal instanceof AbortSignal) return new WebAuthnError({
+			message: "Authentication ceremony was sent an abort signal",
+			code: "ERROR_CEREMONY_ABORTED",
+			cause: error
+		});
+	} else if (error.name === "NotAllowedError")
+ /**
+	* Pass the error directly through. Platforms are overloading this error beyond what the spec
+	* defines and we don't want to overwrite potentially useful error messages.
+	*/
+	return new WebAuthnError({
+		message: error.message,
+		code: "ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",
+		cause: error
+	});
+	else if (error.name === "SecurityError") {
+		const effectiveDomain = globalThis.location.hostname;
+		if (!isValidDomain(effectiveDomain)) return new WebAuthnError({
+			message: `${globalThis.location.hostname} is an invalid domain`,
+			code: "ERROR_INVALID_DOMAIN",
+			cause: error
+		});
+		else if (publicKey.rpId !== effectiveDomain) return new WebAuthnError({
+			message: `The RP ID "${publicKey.rpId}" is invalid for this domain`,
+			code: "ERROR_INVALID_RP_ID",
+			cause: error
+		});
+	} else if (error.name === "UnknownError") return new WebAuthnError({
+		message: "The authenticator was unable to process the specified options, or could not create a new assertion signature",
+		code: "ERROR_AUTHENTICATOR_GENERAL_ERROR",
+		cause: error
+	});
+	return error;
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@simplewebauthn+browser@13.3.0/node_modules/@simplewebauthn/browser/esm/methods/startAuthentication.js
+/**
+* Begin authenticator "login" via WebAuthn assertion
+*
+* @param optionsJSON Output from **@simplewebauthn/server**'s `generateAuthenticationOptions()`
+* @param useBrowserAutofill (Optional) Initialize conditional UI to enable logging in via browser autofill prompts. Defaults to `false`.
+* @param verifyBrowserAutofillInput (Optional) Ensure a suitable `<input>` element is present when `useBrowserAutofill` is `true`. Defaults to `true`.
+*/
+async function startAuthentication(options) {
+	if (!options.optionsJSON && options.challenge) {
+		console.warn("startAuthentication() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information.");
+		options = { optionsJSON: options };
+	}
+	const { optionsJSON, useBrowserAutofill = false, verifyBrowserAutofillInput = true } = options;
+	if (!browserSupportsWebAuthn()) throw new Error("WebAuthn is not supported in this browser");
+	let allowCredentials;
+	if (optionsJSON.allowCredentials?.length !== 0) allowCredentials = optionsJSON.allowCredentials?.map(toPublicKeyCredentialDescriptor);
+	const publicKey = {
+		...optionsJSON,
+		challenge: base64URLStringToBuffer(optionsJSON.challenge),
+		allowCredentials
+	};
+	const getOptions = {};
+	/**
+	* Set up the page to prompt the user to select a credential for authentication via the browser's
+	* input autofill mechanism.
+	*/
+	if (useBrowserAutofill) {
+		if (!await browserSupportsWebAuthnAutofill()) throw Error("Browser does not support WebAuthn autofill");
+		if (document.querySelectorAll("input[autocomplete$='webauthn']").length < 1 && verifyBrowserAutofillInput) throw Error("No <input> with \"webauthn\" as the only or last value in its `autocomplete` attribute was detected");
+		getOptions.mediation = "conditional";
+		publicKey.allowCredentials = [];
+	}
+	getOptions.publicKey = publicKey;
+	getOptions.signal = WebAuthnAbortService.createNewAbortSignal();
+	let credential;
+	try {
+		credential = await navigator.credentials.get(getOptions);
+	} catch (err) {
+		throw identifyAuthenticationError({
+			error: err,
+			options: getOptions
+		});
+	}
+	if (!credential) throw new Error("Authentication was not completed");
+	const { id, rawId, response, type } = credential;
+	let userHandle = void 0;
+	if (response.userHandle) userHandle = bufferToBase64URLString(response.userHandle);
+	return {
+		id,
+		rawId: bufferToBase64URLString(rawId),
+		response: {
+			authenticatorData: bufferToBase64URLString(response.authenticatorData),
+			clientDataJSON: bufferToBase64URLString(response.clientDataJSON),
+			signature: bufferToBase64URLString(response.signature),
+			userHandle
+		},
+		type,
+		clientExtensionResults: credential.getClientExtensionResults(),
+		authenticatorAttachment: toAuthenticatorAttachment(credential.authenticatorAttachment)
+	};
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@better-auth+passkey@1.6.26_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-f_b9d6999fc8dc623532f797abb6d4608d/node_modules/@better-auth/passkey/dist/client.mjs
+const getPasskeyActions = ($fetch, { $listPasskeys, $store }) => {
+	const signInPasskey = async (opts, options) => {
+		const response = await $fetch("/passkey/generate-authenticate-options", {
+			method: "GET",
+			throw: false
+		});
+		if (!response.data) return response;
+		const mergedExtensions = response.data.extensions || opts?.extensions ? {
+			...response.data.extensions || {},
+			...opts?.extensions || {}
+		} : void 0;
+		let res;
+		try {
+			res = await startAuthentication({
+				optionsJSON: {
+					...response.data,
+					extensions: mergedExtensions
+				},
+				useBrowserAutofill: opts?.autoFill
+			});
+		} catch (err) {
+			return {
+				data: null,
+				error: {
+					code: err instanceof WebAuthnError ? err.code : "AUTH_CANCELLED",
+					message: PASSKEY_ERROR_CODES.AUTH_CANCELLED.message,
+					status: 400,
+					statusText: "BAD_REQUEST"
+				}
+			};
+		}
+		try {
+			const { clientExtensionResults, ...responseBody } = res;
+			const verified = await $fetch("/passkey/verify-authentication", {
+				body: { response: responseBody },
+				...opts?.fetchOptions,
+				...options,
+				method: "POST",
+				throw: false
+			});
+			$listPasskeys.set(Math.random());
+			$store.notify("$sessionSignal");
+			if (opts?.returnWebAuthnResponse) return {
+				...verified,
+				webauthn: {
+					response: res,
+					clientExtensionResults
+				}
+			};
+			return verified;
+		} catch (err) {
+			console.error(`[Better Auth] Error verifying passkey`, err);
+			return {
+				data: null,
+				error: {
+					code: "AUTH_CANCELLED",
+					message: PASSKEY_ERROR_CODES.AUTH_CANCELLED.message,
+					status: 400,
+					statusText: "BAD_REQUEST"
+				}
+			};
+		}
+	};
+	const registerPasskey = async (opts, fetchOpts) => {
+		const options = await $fetch("/passkey/generate-register-options", {
+			method: "GET",
+			query: {
+				...opts?.authenticatorAttachment && { authenticatorAttachment: opts.authenticatorAttachment },
+				...opts?.name && { name: opts.name },
+				...opts?.context && { context: opts.context }
+			},
+			throw: false
+		});
+		if (!options.data) return options;
+		try {
+			const mergedExtensions = options.data.extensions || opts?.extensions ? {
+				...options.data.extensions || {},
+				...opts?.extensions || {}
+			} : void 0;
+			const res = await startRegistration({
+				optionsJSON: {
+					...options.data,
+					extensions: mergedExtensions
+				},
+				useAutoRegister: opts?.useAutoRegister
+			});
+			const { clientExtensionResults, ...responseBody } = res;
+			const verified = await $fetch("/passkey/verify-registration", {
+				...opts?.fetchOptions,
+				...fetchOpts,
+				body: {
+					response: responseBody,
+					name: opts?.name
+				},
+				method: "POST",
+				throw: false
+			});
+			if (!verified.data) return verified;
+			$listPasskeys.set(Math.random());
+			if (opts?.returnWebAuthnResponse) return {
+				...verified,
+				webauthn: {
+					response: res,
+					clientExtensionResults
+				}
+			};
+			return verified;
+		} catch (e) {
+			if (e instanceof WebAuthnError) {
+				if (e.code === "ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED") return {
+					data: null,
+					error: {
+						code: e.code,
+						message: PASSKEY_ERROR_CODES.PREVIOUSLY_REGISTERED.message,
+						status: 400,
+						statusText: "BAD_REQUEST"
+					}
+				};
+				if (e.code === "ERROR_CEREMONY_ABORTED") return {
+					data: null,
+					error: {
+						code: e.code,
+						message: PASSKEY_ERROR_CODES.REGISTRATION_CANCELLED.message,
+						status: 400,
+						statusText: "BAD_REQUEST"
+					}
+				};
+				return {
+					data: null,
+					error: {
+						code: e.code,
+						message: e.message,
+						status: 400,
+						statusText: "BAD_REQUEST"
+					}
+				};
+			}
+			return {
+				data: null,
+				error: {
+					code: "UNKNOWN_ERROR",
+					message: e instanceof Error ? e.message : PASSKEY_ERROR_CODES.UNKNOWN_ERROR.message,
+					status: 500,
+					statusText: "INTERNAL_SERVER_ERROR"
+				}
+			};
+		}
+	};
+	return {
+		signIn: { 
+		/**
+		* Sign in with a registered passkey
+		*/
+passkey: signInPasskey },
+		passkey: { 
+		/**
+		* Add a passkey to the user account
+		*/
+addPasskey: registerPasskey },
+		/**
+		* Inferred Internal Types
+		*/
+		$Infer: {}
+	};
+};
+const passkeyClient = () => {
+	const $listPasskeys = /* @__PURE__ */ atom();
+	return {
+		id: "passkey",
+		version: PACKAGE_VERSION,
+		$InferServerPlugin: {},
+		getActions: ($fetch, $store) => getPasskeyActions($fetch, {
+			$listPasskeys,
+			$store
+		}),
+		getAtoms($fetch) {
+			return {
+				listPasskeys: useAuthQuery($listPasskeys, "/passkey/list-user-passkeys", $fetch, { method: "GET" }),
+				$listPasskeys
+			};
+		},
+		pathMethods: {
+			"/passkey/register": "POST",
+			"/passkey/authenticate": "POST"
+		},
+		atomListeners: [{
+			matcher(path) {
+				return path === "/passkey/verify-registration" || path === "/passkey/delete-passkey" || path === "/passkey/update-passkey" || path === "/sign-out";
+			},
+			signal: "$listPasskeys"
+		}, {
+			matcher: (path) => path === "/passkey/verify-authentication",
+			signal: "$sessionSignal"
+		}],
+		$ERROR_CODES: PASSKEY_ERROR_CODES
+	};
+};
+
 //#endregion
 //#region ../auth/dist/client.mjs
-function c$1() {
+function u$1(n) {
 	return [
 		apiKeyClient(),
 		adminClient(),
 		deviceAuthorizationClient(),
+		twoFactorClient({ twoFactorPage: n?.twoFactorPage ?? `/auth/two-factor` }),
+		passkeyClient(),
 		organizationClient({
 			ac: t$1,
 			roles: n$1
@@ -2986,10 +3780,11 @@ function c$1() {
 		inferAdditionalFields()
 	];
 }
-const l$1 = (e) => createAuthClient({
+const d$1 = (e) => createAuthClient({
 	baseURL: e.baseURL,
 	basePath: e.basePath,
-	plugins: c$1()
+	fetchOptions: e.fetchOptions,
+	plugins: u$1(e)
 });
 
 //#endregion
@@ -3015,7 +3810,7 @@ function exitCodeForError(error) {
 //#region src/lib/client.ts
 const AUTH_BASE_PATH = "/api/v1/auth";
 function createCliAuthClient(apiUrl) {
-	return l$1({
+	return d$1({
 		baseURL: apiUrl,
 		basePath: AUTH_BASE_PATH
 	});
@@ -3079,7 +3874,7 @@ async function createCliApiClient(runtime) {
 		sessionToken,
 		orgSlug: runtime.org
 	});
-	const client = _$1({
+	const client = x$1({
 		baseUrl: runtime.apiUrl,
 		client: "cli",
 		getHeaders: () => {
@@ -3286,7 +4081,12 @@ function a(e) {
 	return i.has(e);
 }
 const o = z.string().min(1).refine((e) => e.trim().length > 0, { message: `flag key must not be empty or whitespace-only` }).refine((e) => !a(e), { message: `flag key "__proto__" is reserved` });
-const s = z.discriminatedUnion(`kind`, [
+const s = z.union([
+	z.string(),
+	z.number(),
+	z.boolean()
+]);
+const c = z.discriminatedUnion(`kind`, [
 	z.object({
 		kind: z.literal(`boolean`),
 		value: z.boolean()
@@ -3305,45 +4105,93 @@ const s = z.discriminatedUnion(`kind`, [
 	}),
 	z.object({ kind: z.literal(`disabled`) })
 ]);
-const c = z.union([
-	z.object({
-		kind: z.literal(`attribute`),
-		attribute: z.string().min(1),
-		operator: z.enum([
-			`eq`,
-			`neq`,
-			`contains`
-		]),
-		value: z.union([
-			z.string(),
-			z.number(),
-			z.boolean()
-		])
-	}),
-	z.object({
-		kind: z.literal(`attribute`),
-		attribute: z.string().min(1),
-		operator: z.literal(`in`),
-		value: z.array(z.string())
-	}),
+const l = z.object({
+	kind: z.literal(`weighted`),
+	variations: z.array(z.object({
+		weight: z.number().positive(),
+		serve: c
+	})).min(1),
+	seed: z.string().min(1).optional(),
+	attribute: z.string().min(1).optional()
+});
+const u = z.union([c, l]);
+const d = z.object({
+	kind: z.literal(`attribute`),
+	attribute: z.string().min(1),
+	operator: z.enum([`exists`, `not_exists`])
+});
+const f = z.object({
+	kind: z.literal(`attribute`),
+	attribute: z.string().min(1),
+	operator: z.enum([
+		`eq`,
+		`neq`,
+		`contains`,
+		`startsWith`,
+		`endsWith`,
+		`gt`,
+		`gte`,
+		`lt`,
+		`lte`
+	]),
+	value: s
+});
+const p = z.object({
+	kind: z.literal(`attribute`),
+	attribute: z.string().min(1),
+	operator: z.enum([`in`, `not_in`]),
+	value: z.array(s).min(1)
+});
+const m = z.object({
+	kind: z.literal(`percentage`),
+	rollout: z.number().min(0).max(100),
+	seed: z.string().min(1).optional(),
+	attribute: z.string().min(1).optional()
+});
+const h = z.object({ kind: z.literal(`always`) });
+const g = z.object({
+	kind: z.literal(`segment`),
+	segmentId: z.string().min(1),
+	operator: z.enum([`in`, `not_in`]).optional()
+});
+const _ = z.lazy(() => z.union([
+	h,
+	m,
+	g,
+	d,
+	f,
+	p,
 	z.object({
-		kind: z.literal(`percentage`),
-		rollout: z.number().min(0).max(100),
-		seed: z.string().min(1).optional()
+		kind: z.literal(`group`),
+		op: z.enum([`and`, `or`]),
+		conditions: z.array(_).min(1)
 	})
-]);
-const l = z.object({
+]));
+function v(e, t = 0) {
+	return e.kind !== `group` || !Array.isArray(e.conditions) ? t : Math.max(t + 1, ...e.conditions.map((e) => v(e, t + 1)));
+}
+function y(e, t) {
+	for (let n of e) v(n) > 8 && t.addIssue({
+		code: `custom`,
+		message: `condition groups cannot nest more than 8 levels`
+	});
+}
+const b = z.object({
 	id: z.string().min(1),
 	description: z.string().optional(),
-	conditions: z.array(c),
-	serve: s
-});
-const u = z.object({ projectId: z.string().min(1) });
-const d = z.object({
+	conditions: z.array(_),
+	serve: u
+}).superRefine((e, t) => y(e.conditions, t));
+const x = z.object({
+	id: z.string().min(1),
+	conditions: z.array(_).min(1)
+}).superRefine((e, t) => y(e.conditions, t));
+const S = z.object({ projectId: z.string().min(1) });
+const C = z.object({
 	projectId: z.string().min(1),
 	key: z.string().min(1)
 });
-const f = z.object({
+const w = z.object({
 	projectId: z.string().min(1),
 	key: o,
 	name: z.string().min(1),
@@ -3358,7 +4206,7 @@ const f = z.object({
 		message: `variant flag requires a non-empty variants array`
 	});
 });
-const p = z.object({
+const T = z.object({
 	flagId: z.string().min(1),
 	key: o.optional(),
 	name: z.string().min(1).optional(),
@@ -3367,25 +4215,26 @@ const p = z.object({
 	variants: z.array(z.string()).nullable().optional(),
 	tags: z.array(z.string()).optional()
 });
-const m = z.object({ flagId: z.string().min(1) });
-const h = z.object({
+const E = z.object({ flagId: z.string().min(1) });
+const D = z.object({
 	flagId: z.string().min(1),
 	environmentId: z.string().min(1),
 	enabled: z.boolean().optional(),
-	rules: z.array(l).optional(),
-	fallthrough: s.optional()
+	rules: z.array(b).optional(),
+	fallthrough: u.optional()
 });
-const g = z.object({
+const O = z.object({
 	flagId: z.string().min(1),
 	environmentId: z.string().min(1),
 	enabled: z.boolean()
 });
-const _ = z.enum([`active`, `deprecated`]);
-function v(e) {
+const k = z.object({ flagId: z.string().min(1) });
+const A = z.enum([`active`, `deprecated`]);
+function j(e) {
 	let t = Object.getPrototypeOf(e);
 	return t === Object.prototype || t === null;
 }
-function y(e, t) {
+function M(e, t) {
 	if (e === null) return !0;
 	switch (typeof e) {
 		case `boolean`:
@@ -3393,13 +4242,13 @@ function y(e, t) {
 		case `number`: return Number.isFinite(e);
 		case `object`: {
 			let n = t ?? /* @__PURE__ */ new WeakSet();
-			return !n.has(e) && (n.add(e), Array.isArray(e) ? e.every((e) => y(e, n)) : !v(e) || Object.getOwnPropertySymbols(e).length > 0 ? !1 : Object.keys(e).every((t) => y(e[t], n)));
+			return !n.has(e) && (n.add(e), Array.isArray(e) ? e.every((e) => M(e, n)) : !j(e) || Object.getOwnPropertySymbols(e).length > 0 ? !1 : Object.keys(e).every((t) => M(e[t], n)));
 		}
 		default: return !1;
 	}
 }
-const b = z.custom(y, { message: `default must be JSON-serializable` });
-function x(e, t) {
+const N = z.custom(M, { message: `default must be JSON-serializable` });
+function P(e, t) {
 	switch (e.type) {
 		case `boolean`:
 			typeof e.default != `boolean` && t.addIssue({
@@ -3428,43 +4277,43 @@ function x(e, t) {
 			});
 			break;
 		}
-		case `json`: b.safeParse(e.default).success || t.addIssue({
+		case `json`: N.safeParse(e.default).success || t.addIssue({
 			code: `custom`,
 			path: [`default`],
 			message: `json flag default must be JSON-serializable`
 		});
 	}
 }
-const S = z.object({
+const F = z.object({
 	key: o,
 	type: t,
 	default: z.unknown(),
 	description: z.string().optional(),
 	tags: z.array(z.string()).default([]),
-	lifecycle: _.default(`active`),
+	lifecycle: A.default(`active`),
 	variants: z.array(z.string()).optional(),
 	disabled: z.boolean().optional()
 });
-const C = S.superRefine(x);
-const w = S.extend({
+const I = F.superRefine(P);
+const L = F.extend({
 	version: z.number().int().positive(),
 	environmentVersion: z.number().int().positive().optional(),
 	managedBy: n
-}).superRefine(x);
-const T = z.object({
+}).superRefine(P);
+const R = z.object({
 	version: z.number().int().positive(),
 	environmentVersion: z.number().int().positive().optional()
 });
-const E = z.object({
+const z$1 = z.object({
 	projectId: z.string().min(1),
 	environmentId: z.string().min(1)
 });
-const D = z.object({
+const B = z.object({
 	projectId: z.string(),
 	environmentId: z.string(),
-	flags: z.array(w)
+	flags: z.array(L)
 });
-function O(e, t) {
+function V(e, t) {
 	let n = /* @__PURE__ */ new Set();
 	for (let [r, i] of e.entries()) n.has(i.key) && t.addIssue({
 		code: `custom`,
@@ -3476,12 +4325,12 @@ function O(e, t) {
 		message: `duplicate flag key "${i.key}"`
 	}), n.add(i.key);
 }
-const k = z.object({
+const H = z.object({
 	projectId: z.string().min(1),
 	environmentId: z.string().min(1),
-	flags: z.array(C)
-}).superRefine((e, t) => O(e.flags, t));
-const A = z.object({
+	flags: z.array(I)
+}).superRefine((e, t) => V(e.flags, t));
+const U = z.object({
 	key: z.string(),
 	op: z.enum([
 		`add`,
@@ -3489,39 +4338,39 @@ const A = z.object({
 		`remove`,
 		`unlinked`
 	]),
-	before: w.optional(),
-	after: C.optional(),
+	before: L.optional(),
+	after: I.optional(),
 	message: z.string().optional()
 });
-const j = z.object({
+const W = z.object({
 	projectId: z.string(),
 	environmentId: z.string(),
-	changes: z.array(A),
-	remoteOnly: z.array(w).default([])
+	changes: z.array(U),
+	remoteOnly: z.array(L).default([])
 });
-const M = z.object({
+const G = z.object({
 	projectId: z.string().min(1),
 	environmentId: z.string().min(1),
-	flags: z.array(C),
+	flags: z.array(I),
 	apply: z.boolean().default(!1),
 	prune: z.boolean().default(!1),
 	force: z.boolean().default(!1),
 	adopt: z.boolean().default(!1),
-	expectedVersions: z.record(z.string(), T).optional()
-}).superRefine((e, t) => O(e.flags, t));
-const N = z.object({
+	expectedVersions: z.record(z.string(), R).optional()
+}).superRefine((e, t) => V(e.flags, t));
+const K = z.object({
 	projectId: z.string(),
 	environmentId: z.string(),
 	applied: z.boolean(),
-	changes: z.array(A),
-	remoteOnly: z.array(w).default([]),
+	changes: z.array(U),
+	remoteOnly: z.array(L).default([]),
 	forced: z.boolean().default(!1),
 	adopted: z.boolean().default(!1)
 });
 
 //#endregion
 //#region src/lib/local-config.ts
-const localFlagsArraySchema = z.array(C).superRefine((flags, ctx) => {
+const localFlagsArraySchema = z.array(I).superRefine((flags, ctx) => {
 	const seen = /* @__PURE__ */ new Set();
 	for (const [index, flag] of flags.entries()) {
 		if (seen.has(flag.key)) ctx.addIssue({
@@ -3675,10 +4524,7 @@ const DEFINITION_ONLY_FIELDS = [
 ];
 function planHasDefinitionChanges(plan) {
 	if (plan.creates.length > 0 || plan.archives.length > 0) return true;
-	for (const update of plan.updates) {
-		if (update.before.managedBy && update.before.managedBy !== "code") return true;
-		for (const field of DEFINITION_ONLY_FIELDS) if (update.fields[field]) return true;
-	}
+	for (const update of plan.updates) for (const field of DEFINITION_ONLY_FIELDS) if (update.fields[field]) return true;
 	return false;
 }
 function buildSyncPlan(changes) {
@@ -3761,7 +4607,7 @@ function formatSyncPlan(plan) {
 	}
 	if (planHasDefinitionChanges(plan)) {
 		lines.push("");
-		lines.push("Note: definition changes (type, variants, tags, lifecycle, description) and ownership adoption apply to all environments.");
+		lines.push("Note: definition changes (type, variants, tags, lifecycle, description) apply to all environments.");
 	}
 	return lines.join("\n").trimEnd();
 }
@@ -3966,7 +4812,7 @@ function warnRemoteOnly(keys, json) {
 	for (const key of keys) console.error(`  - ${key}`);
 }
 function registerPushCommand(program) {
-	program.command("push").description("Plan and apply local flag definitions to the server").option("--prune", "Archive remote flags missing from local config", false).option("--force", "Override stale-version conflicts (audited); does not adopt ownership", false).option("--adopt", "Link local flags to remote non-code flags by key", false).action(async (opts, command) => {
+	program.command("push").description("Plan and apply local flag definitions to the server").option("--prune", "Archive remote flags missing from local config", false).option("--force", "Override stale-version conflicts (audited)", false).option("--adopt", "Deprecated no-op. managedBy is last-touch attribution, not a lock.", false).action(async (opts, command) => {
 		const runtime = getRuntime(command);
 		const client = await createCliApiClient(runtime);
 		const { projectId, environmentId } = await resolveIds(client, runtime);
@@ -3987,11 +4833,7 @@ function registerPushCommand(program) {
 		const remoteOnly = planned.remoteOnly ?? [];
 		warnRemoteOnly(remoteOnly.map((flag) => flag.key), runtime.json);
 		if (!runtime.json) console.log(planIsEmpty(plan) ? "Nothing to push." : formatSyncPlan(plan));
-		if (plan.unlinked.length > 0 && !adopt) throw new CliError("unlinked", `${plan.unlinked.length} unlinked flag(s). Pass --adopt to link ownership to code.`, {
-			exitCode: 4,
-			details: { keys: plan.unlinked.map((item) => item.key) }
-		});
-		if (!(planHasDrift(plan) || adopt && plan.updates.length > 0)) {
+		if (!planHasDrift(plan)) {
 			if (runtime.json) console.log(JSON.stringify({
 				plan,
 				remoteOnly
@@ -4017,12 +4859,10 @@ function registerPushCommand(program) {
 			plan: appliedPlan,
 			remoteOnly,
 			forced: applied.forced === true,
-			adopted: applied.adopted === true,
 			types
 		}, [
 			`Applied ${applied.changes.length} change(s).`,
 			applied.forced ? "Forced through version conflicts (audited)." : null,
-			applied.adopted ? "Adopted remote ownership to code." : null,
 			`Wrote types for ${types.flagCount} flag(s) to ${types.written}`
 		].filter(Boolean).join("\n"));
 	});