@w6w/sdk 0.5.0 → 0.9.8

package/dist/src/console/auth.d.ts

@@ -43,9 +43,27 @@
  * handlers, not assumed) — every method here returns `res.body` directly and
  * never calls this package's `unwrap()` helper.
  *
+ * **T1.1.4's seven `/me/*` methods added here (profile, contact
+ * change-and-confirm, promote, remove, password).** Registered BELOW the auth
+ * guard (`packages/server/packages/api/data/me.ts`'s own doc comment) — every
+ * one of the seven is AUTHENTICATED, the default `requireAuth`, unlike
+ * `login`/`signup`/`checkAccountSlug` above. `removeContact` and
+ * `promoteContact` are not in this task's pinned method list but are added
+ * per HITL-7 ("if T1.1.4 ships routes for adding / removing / promoting a
+ * secondary contact, they get methods here too") — both routes exist on the
+ * merged branch (`data/me.ts:135-154`).
+ *
+ * **`UserProfile.hasPassword` is a RENAME of the wire's `passwordSet`, not an
+ * invented field.** `GET /me/profile` answers `passwordSet` (`data/me.ts:9`,
+ * `packages/bll/signup.ts:555`, derived server-side from
+ * `password_hash !== null` — the hash itself never appears). HITL-10 needs
+ * this fact under a name Studio's "Set a password"/"Change password" fork
+ * reads directly; `toUserProfile()` below performs the rename from the exact
+ * value the wire sent, never a default and never computed from anything else.
+ *
  * @module
  */
-import type { HttpResponse, RequestOptions } from "../http.ts";
+import { type HttpResponse, type RequestOptions } from "../http.ts";
 /**
  * The slice of `W6WClient` this namespace needs: the transport, and nothing
  * else. Structural rather than a concrete client type, so the namespace stays
@@ -66,6 +84,11 @@ export interface LoginResponse {
     user: User;
     expiresIn: number;
 }
+/** `POST /auth/refresh` → 200 (`id/auth.ts`'s `refreshHandler`). */
+export interface RefreshResponse {
+    token: string;
+    expiresIn: number;
+}
 /** The signed-up user, as `POST /auth/signup` returns it (`data/signup.ts:147-152`). */
 export interface SignupUser {
     id: string;
@@ -110,6 +133,17 @@ export interface SlugAvailabilityResponse {
     available: boolean;
     suggestions: string[];
 }
+/** The body `createAccount` sends. An options object, matching `signup`'s
+ * `SignupInput` shape two methods below — `name`/`slug` are **not** sent, the
+ * server mints the slug from `companyName`. */
+export interface CreateAccountInput {
+    /** The company/workspace name. Optional — the server mints the account slug from it when present. */
+    companyName?: string;
+    /** The caller's role in the company, from the signup form's dropdown. Optional. */
+    role?: string;
+    /** What the caller intends to use w6w for, from the signup form's dropdown. Optional. */
+    usage?: string;
+}
 /** `POST /accounts` → 201 (`id/signup.ts:69-73`). The token re-issues the session
  * with the new account's claim on it. */
 export interface CreateAccountResponse {
@@ -149,15 +183,118 @@ export interface ConsoleMe {
      * accidentally granted.
      */
     tenantAdmin: boolean;
+    /**
+     * Server-decided: may this caller manage its account's team (invite, change
+     * a role, remove a member)? Studio-internal; not on the published `Me`.
+     *
+     * **Required, not optional, on purpose.** A client forced to branch on
+     * `undefined` is a client that will branch wrong; an older server that omits
+     * the key yields `undefined` at runtime, which is falsy, so every
+     * `if (me.canManageMembers)` fails CLOSED — the capability is denied, never
+     * accidentally granted.
+     */
+    canManageMembers: boolean;
     /** Component versions, as the published `Me` documents them. Optional and open. */
     versions?: Record<string, string>;
 }
+/**
+ * One of the caller's own contact addresses (email or phone), as `GET /me/profile`
+ * lists it (`packages/bll/signup.ts`'s `ProfileContact`, `data/me.ts:9-12`).
+ */
+export interface ProfileContact {
+    id: string;
+    kind: "email" | "phone";
+    value: string;
+    /** ISO-8601 timestamp, or `null` while unverified. */
+    verifiedAt: string | null;
+}
+/** One of the caller's registered login methods (`data/me.ts:9-12`). */
+export interface ProfileLoginMethod {
+    id: string;
+    /** e.g. `"password"`, `"passkey"`. */
+    kind: string;
+    label: string;
+    /** ISO-8601 timestamp. */
+    createdAt: string;
+    /** ISO-8601 timestamp, or `null` if never used. */
+    lastUsedAt: string | null;
+}
+/** A pending, unconfirmed contact-change request (`data/me.ts:9-12`). */
+export interface ProfilePendingChange {
+    id: string;
+    method: "email" | "phone";
+    value: string;
+    /** ISO-8601 timestamp; the pending row is unusable past this point. */
+    expiresAt: string;
+    /** ISO-8601 timestamp. */
+    createdAt: string;
+}
+/**
+ * The `users` row and its dependent state, as `GET`/`PATCH /me/profile`,
+ * `POST /me/contacts/confirm` and `POST /me/contacts/:id/primary` all return
+ * it (`data/me.ts:6-19`). Every method on this namespace that returns a
+ * profile returns THIS shape, mapped from the wire's `passwordSet` — see this
+ * module's header for why {@linkcode UserProfile.hasPassword} is a rename,
+ * not an invented field.
+ */
+export interface UserProfile {
+    userId: string;
+    tenant: string;
+    displayName: string;
+    email: string | null;
+    emailVerified: boolean;
+    /**
+     * Whether the caller already has a local password. Read straight off the
+     * wire's `passwordSet` (`packages/bll/signup.ts:555`) — never defaulted,
+     * never computed client-side. Drives HITL-10's "Set a password" (`false`)
+     * vs "Change password" (`true`) fork.
+     */
+    hasPassword: boolean;
+    contacts: ProfileContact[];
+    loginMethods: ProfileLoginMethod[];
+    pending: ProfilePendingChange[];
+}
+/** The body `updateProfile` sends (`PATCH /me/profile`, `data/me.ts:53-71`). */
+export interface UpdateProfileInput {
+    displayName: string;
+}
+/**
+ * The body `requestContactChange` sends (`POST /me/contacts/change`,
+ * `data/me.ts:73-98`). Parks a pending change; does not confirm it.
+ */
+export interface RequestContactChangeInput {
+    method: "email" | "phone";
+    value: string;
+}
+/**
+ * The body `confirmContactChange` sends (`POST /me/contacts/confirm`,
+ * `data/me.ts:100-133`). Consumes the code sent to `requestContactChange`'s
+ * `value`.
+ */
+export interface ConfirmContactChangeInput {
+    method: "email" | "phone";
+    code: string;
+    /** Promote the newly-confirmed contact to primary in the same call (D3). */
+    promote?: boolean;
+}
+/**
+ * The body `setPassword` sends (`POST /me/password`, `data/me.ts:156-184`).
+ * One method for HITL-10's set-and-change: `currentPassword` is a field, not
+ * a second method, because the merged route is the single `POST /me/password`
+ * — not two routes.
+ */
+export interface SetPasswordInput {
+    newPassword: string;
+    /** Required by the server when the caller already has a password (`hasPassword: true`); omit
+     * for the first-time "set a password" case. */
+    currentPassword?: string;
+}
 /**
  * The `console.auth` namespace on a `W6WClient`.
  *
  * @example
  * ```ts
- * const { token } = await client.console.auth.login("user", "pass");
+ * const { token } = await client.console.auth.login("user@example.com", "pass");
  * const me = await client.console.auth.getMe();
  * if (me.tenantAdmin) { // tenant-admin surface
  * }
@@ -175,12 +312,29 @@ export declare class AuthApi {
      * PUBLIC — sends no bearer, even on a client that already holds one
      * (`requireAuth: false`).
      *
-     * @param username - The account username.
+     * @param identifier - The login identifier, normally the account's email. The
+     *   platform operator credential (`AUTH_USERNAME`) is NOT email-shaped and is a
+     *   legitimate value here — never validate this as an email (DECISIONS.md HITL-1).
+     *   It is sent as the `email` key: the server resolves `body.email ?? body.username`.
      * @param password - The account password.
      * @returns The token, the caller's identity, and the token's lifetime.
      * @throws {ApiError} On any non-2xx, e.g. `401` for invalid credentials.
      */
-    login(username: string, password: string): Promise<LoginResponse>;
+    login(identifier: string, password: string): Promise<LoginResponse>;
+    /**
+     * Mint a fresh token for the CURRENT session — same identity (subject,
+     * tenant, role, account, any admin claim), just a renewed lifetime. The
+     * sliding-session mechanism: a client that keeps calling this while a
+     * user is active never sees the original token's `exp` arrive.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies (a caller with no
+     * token has no session to extend).
+     *
+     * @returns The new token and its lifetime in seconds.
+     * @throws {ApiError} `401` if the CURRENT token is already invalid/expired
+     *   — refreshing cannot resurrect a session that has already lapsed.
+     */
+    refresh(): Promise<RefreshResponse>;
     /**
      * Self-serve signup: creates the user and mints a `role: "user"` session.
      *
@@ -213,12 +367,11 @@ export declare class AuthApi {
      * adopting it downgrades an operator; this method never writes the session
      * itself, the caller decides.
      *
-     * @param name - The account's display name.
-     * @param slug - The account's slug.
+     * @param input - The optional company name, role and use-case from the signup form.
      * @returns The created account, a re-issued token carrying its claim, and the token's lifetime.
      * @throws {ApiError} On any non-2xx, e.g. `409` when the slug is taken.
      */
-    createAccount(name: string, slug: string): Promise<CreateAccountResponse>;
+    createAccount(input: CreateAccountInput): Promise<CreateAccountResponse>;
     /**
      * Read the caller's identity **and its tenant-admin capability**.
      *
@@ -237,5 +390,90 @@ export declare class AuthApi {
      * @throws {ApiError} On any non-2xx, e.g. `401` when the bearer is missing or expired.
      */
     getMe(): Promise<ConsoleMe>;
+    /**
+     * Read the caller's own profile — the real `users` row, including
+     * {@linkcode UserProfile.hasPassword}. Distinct from `getMe()`, which reads
+     * session claims: this reads the actual database row (`data/me.ts:43-51`).
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @returns The caller's profile.
+     * @throws {ApiError} `404 no_user_profile` when there is no `users` row for this principal.
+     */
+    getProfile(): Promise<UserProfile>;
+    /**
+     * Patch the caller's display name.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The new display name.
+     * @returns The updated profile (`data/me.ts:53-71`).
+     * @throws {ApiError} `400 invalid_body`/`invalid_display_name`.
+     */
+    updateProfile(input: UpdateProfileInput): Promise<UserProfile>;
+    /**
+     * Park a pending email/phone change and send its confirmation code. Does
+     * NOT confirm the change — see {@linkcode confirmContactChange}.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The contact method and the new value.
+     * @returns Nothing: the server answers `202` with `{ok: true}`, which carries no information a
+     *   caller can use (`data/me.ts:73-98`).
+     * @throws {ApiError} `400 invalid_body`/`invalid_email`, `409 email_taken`.
+     */
+    requestContactChange(input: RequestContactChangeInput): Promise<void>;
+    /**
+     * Consume the code from {@linkcode requestContactChange} and confirm the
+     * pending change. Optionally promotes the newly-confirmed contact to
+     * primary in the same call (D3).
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The contact method, the code, and an optional promote flag.
+     * @returns The updated profile (`data/me.ts:100-133`).
+     * @throws {ApiError} `400 invalid_body`/`invalid_code`, `404 contact_not_found`.
+     */
+    confirmContactChange(input: ConfirmContactChangeInput): Promise<UserProfile>;
+    /**
+     * Remove one of the caller's own (non-primary) contacts. Added per HITL-7
+     * — `DELETE /me/contacts/:id` exists on the merged branch (`data/me.ts:135-144`).
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param id - The contact id.
+     * @returns Nothing: the server answers `{ok: true}`, which carries no information a caller can
+     *   use, mirroring `console.projects.delete`/`console.schedules.delete` in this same package.
+     * @throws {ApiError} `404 contact_not_found`.
+     */
+    removeContact(id: string): Promise<void>;
+    /**
+     * Promote one of the caller's own secondary contacts to primary. Added per
+     * HITL-7 — `POST /me/contacts/:id/primary` exists on the merged branch
+     * (`data/me.ts:146-154`).
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param id - The contact id.
+     * @returns The updated profile.
+     * @throws {ApiError} `404 contact_not_found`, `403 contact_not_verified`.
+     */
+    promoteContact(id: string): Promise<UserProfile>;
+    /**
+     * Set or change the caller's password (HITL-10) — one method, since the
+     * merged route is the single `POST /me/password`, not two. Omit
+     * `currentPassword` for the first-time "set a password" case
+     * (`hasPassword: false`); the server requires it once a password already
+     * exists.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The new password, plus the current one when required.
+     * @returns Nothing: the server answers `{ok: true}`, which carries no information a caller can
+     *   use (`data/me.ts:156-184`).
+     * @throws {ApiError} `400 invalid_body`/`invalid_password`/`current_password_required`,
+     *   `403 invalid_current_password`.
+     */
+    setPassword(input: SetPasswordInput): Promise<void>;
 }
 //# sourceMappingURL=auth.d.ts.map

package/dist/src/console/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/console/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED,qFAAqF;AACrF,MAAM,WAAW,IAAI;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;4FAC4F;AAC5F,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;CAC7B;AAED,4EAA4E;AAC5E,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;yCACyC;AACzC,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,SAAS;IACxB,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,qGAAqG;IACrG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,OAAO;;IAGlB;;OAEG;gBACS,IAAI,EAAE,QAAQ;IAI1B;;;;;;;;;;OAUG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAUvE;;;;;;;;;OASG;IACG,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;IAUzD;;;;;;;;;;;OAWG;IACG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAUvE;;;;;;;;;;;;OAYG;IACG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAS/E;;;;;;;;;;;;;;;;OAgBG;IACG,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC;CAOlC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/console/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAQ,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED,qFAAqF;AACrF,MAAM,WAAW,IAAI;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;4FAC4F;AAC5F,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;CAC7B;AAED,4EAA4E;AAC5E,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;+CAE+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yFAAyF;IACzF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;yCACyC;AACzC,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,SAAS;IACxB,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,qGAAqG;IACrG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;;OASG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,OAAO,EAAE,oBAAoB,EAAE,CAAC;CACjC;AA0BD,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB;mDAC+C;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,OAAO;;IAGlB;;OAEG;gBACS,IAAI,EAAE,QAAQ;IAI1B;;;;;;;;;;;;;OAaG;IACG,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAUzE;;;;;;;;;;;;OAYG;IACG,OAAO,IAAI,OAAO,CAAC,eAAe,CAAC;IAQzC;;;;;;;;;OASG;IACG,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;IAUzD;;;;;;;;;;;OAWG;IACG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAUvE;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAS9E;;;;;;;;;;;;;;;;OAgBG;IACG,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC;IAQjC;;;;;;;;;OASG;IACG,UAAU,IAAI,OAAO,CAAC,WAAW,CAAC;IAKxC;;;;;;;;OAQG;IACG,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC;IASpE;;;;;;;;;;OAUG;IACG,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3E;;;;;;;;;;OAUG;IACG,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,WAAW,CAAC;IASlF;;;;;;;;;;OAUG;IACG,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C;;;;;;;;;;OAUG;IACG,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAStD;;;;;;;;;;;;;;OAcG;IACG,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;CAO1D"}

package/dist/src/console/auth.js

@@ -43,14 +43,38 @@
  * handlers, not assumed) — every method here returns `res.body` directly and
  * never calls this package's `unwrap()` helper.
  *
+ * **T1.1.4's seven `/me/*` methods added here (profile, contact
+ * change-and-confirm, promote, remove, password).** Registered BELOW the auth
+ * guard (`packages/server/packages/api/data/me.ts`'s own doc comment) — every
+ * one of the seven is AUTHENTICATED, the default `requireAuth`, unlike
+ * `login`/`signup`/`checkAccountSlug` above. `removeContact` and
+ * `promoteContact` are not in this task's pinned method list but are added
+ * per HITL-7 ("if T1.1.4 ships routes for adding / removing / promoting a
+ * secondary contact, they get methods here too") — both routes exist on the
+ * merged branch (`data/me.ts:135-154`).
+ *
+ * **`UserProfile.hasPassword` is a RENAME of the wire's `passwordSet`, not an
+ * invented field.** `GET /me/profile` answers `passwordSet` (`data/me.ts:9`,
+ * `packages/bll/signup.ts:555`, derived server-side from
+ * `password_hash !== null` — the hash itself never appears). HITL-10 needs
+ * this fact under a name Studio's "Set a password"/"Change password" fork
+ * reads directly; `toUserProfile()` below performs the rename from the exact
+ * value the wire sent, never a default and never computed from anything else.
+ *
  * @module
  */
+import { path } from "../http.js";
+/** `passwordSet` → `hasPassword`. The one hop between the wire and {@linkcode UserProfile}. */
+function toUserProfile(wire) {
+    const { passwordSet, ...rest } = wire;
+    return { ...rest, hasPassword: passwordSet };
+}
 /**
  * The `console.auth` namespace on a `W6WClient`.
  *
  * @example
  * ```ts
- * const { token } = await client.console.auth.login("user", "pass");
+ * const { token } = await client.console.auth.login("user@example.com", "pass");
  * const me = await client.console.auth.getMe();
  * if (me.tenantAdmin) { // tenant-admin surface
  * }
@@ -70,20 +94,43 @@ export class AuthApi {
      * PUBLIC — sends no bearer, even on a client that already holds one
      * (`requireAuth: false`).
      *
-     * @param username - The account username.
+     * @param identifier - The login identifier, normally the account's email. The
+     *   platform operator credential (`AUTH_USERNAME`) is NOT email-shaped and is a
+     *   legitimate value here — never validate this as an email (DECISIONS.md HITL-1).
+     *   It is sent as the `email` key: the server resolves `body.email ?? body.username`.
      * @param password - The account password.
      * @returns The token, the caller's identity, and the token's lifetime.
      * @throws {ApiError} On any non-2xx, e.g. `401` for invalid credentials.
      */
-    async login(username, password) {
+    async login(identifier, password) {
         const res = await this.#host.request({
             method: "POST",
             path: "/auth/login",
-            body: { username, password },
+            body: { email: identifier, password },
             requireAuth: false,
         });
         return res.body;
     }
+    /**
+     * Mint a fresh token for the CURRENT session — same identity (subject,
+     * tenant, role, account, any admin claim), just a renewed lifetime. The
+     * sliding-session mechanism: a client that keeps calling this while a
+     * user is active never sees the original token's `exp` arrive.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies (a caller with no
+     * token has no session to extend).
+     *
+     * @returns The new token and its lifetime in seconds.
+     * @throws {ApiError} `401` if the CURRENT token is already invalid/expired
+     *   — refreshing cannot resurrect a session that has already lapsed.
+     */
+    async refresh() {
+        const res = await this.#host.request({
+            method: "POST",
+            path: "/auth/refresh",
+        });
+        return res.body;
+    }
     /**
      * Self-serve signup: creates the user and mints a `role: "user"` session.
      *
@@ -132,16 +179,15 @@ export class AuthApi {
      * adopting it downgrades an operator; this method never writes the session
      * itself, the caller decides.
      *
-     * @param name - The account's display name.
-     * @param slug - The account's slug.
+     * @param input - The optional company name, role and use-case from the signup form.
      * @returns The created account, a re-issued token carrying its claim, and the token's lifetime.
      * @throws {ApiError} On any non-2xx, e.g. `409` when the slug is taken.
      */
-    async createAccount(name, slug) {
+    async createAccount(input) {
         const res = await this.#host.request({
             method: "POST",
             path: "/accounts",
-            body: { name, slug },
+            body: input,
         });
         return res.body;
     }
@@ -169,5 +215,128 @@ export class AuthApi {
         });
         return res.body;
     }
+    /**
+     * Read the caller's own profile — the real `users` row, including
+     * {@linkcode UserProfile.hasPassword}. Distinct from `getMe()`, which reads
+     * session claims: this reads the actual database row (`data/me.ts:43-51`).
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @returns The caller's profile.
+     * @throws {ApiError} `404 no_user_profile` when there is no `users` row for this principal.
+     */
+    async getProfile() {
+        const res = await this.#host.request({ method: "GET", path: "/me/profile" });
+        return toUserProfile(res.body);
+    }
+    /**
+     * Patch the caller's display name.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The new display name.
+     * @returns The updated profile (`data/me.ts:53-71`).
+     * @throws {ApiError} `400 invalid_body`/`invalid_display_name`.
+     */
+    async updateProfile(input) {
+        const res = await this.#host.request({
+            method: "PATCH",
+            path: "/me/profile",
+            body: input,
+        });
+        return toUserProfile(res.body);
+    }
+    /**
+     * Park a pending email/phone change and send its confirmation code. Does
+     * NOT confirm the change — see {@linkcode confirmContactChange}.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The contact method and the new value.
+     * @returns Nothing: the server answers `202` with `{ok: true}`, which carries no information a
+     *   caller can use (`data/me.ts:73-98`).
+     * @throws {ApiError} `400 invalid_body`/`invalid_email`, `409 email_taken`.
+     */
+    async requestContactChange(input) {
+        await this.#host.request({
+            method: "POST",
+            path: "/me/contacts/change",
+            body: input,
+        });
+    }
+    /**
+     * Consume the code from {@linkcode requestContactChange} and confirm the
+     * pending change. Optionally promotes the newly-confirmed contact to
+     * primary in the same call (D3).
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The contact method, the code, and an optional promote flag.
+     * @returns The updated profile (`data/me.ts:100-133`).
+     * @throws {ApiError} `400 invalid_body`/`invalid_code`, `404 contact_not_found`.
+     */
+    async confirmContactChange(input) {
+        const res = await this.#host.request({
+            method: "POST",
+            path: "/me/contacts/confirm",
+            body: input,
+        });
+        return toUserProfile(res.body);
+    }
+    /**
+     * Remove one of the caller's own (non-primary) contacts. Added per HITL-7
+     * — `DELETE /me/contacts/:id` exists on the merged branch (`data/me.ts:135-144`).
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param id - The contact id.
+     * @returns Nothing: the server answers `{ok: true}`, which carries no information a caller can
+     *   use, mirroring `console.projects.delete`/`console.schedules.delete` in this same package.
+     * @throws {ApiError} `404 contact_not_found`.
+     */
+    async removeContact(id) {
+        await this.#host.request({ method: "DELETE", path: path `/me/contacts/${id}` });
+    }
+    /**
+     * Promote one of the caller's own secondary contacts to primary. Added per
+     * HITL-7 — `POST /me/contacts/:id/primary` exists on the merged branch
+     * (`data/me.ts:146-154`).
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param id - The contact id.
+     * @returns The updated profile.
+     * @throws {ApiError} `404 contact_not_found`, `403 contact_not_verified`.
+     */
+    async promoteContact(id) {
+        const res = await this.#host.request({
+            method: "POST",
+            path: path `/me/contacts/${id}/primary`,
+            body: {},
+        });
+        return toUserProfile(res.body);
+    }
+    /**
+     * Set or change the caller's password (HITL-10) — one method, since the
+     * merged route is the single `POST /me/password`, not two. Omit
+     * `currentPassword` for the first-time "set a password" case
+     * (`hasPassword: false`); the server requires it once a password already
+     * exists.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The new password, plus the current one when required.
+     * @returns Nothing: the server answers `{ok: true}`, which carries no information a caller can
+     *   use (`data/me.ts:156-184`).
+     * @throws {ApiError} `400 invalid_body`/`invalid_password`/`current_password_required`,
+     *   `403 invalid_current_password`.
+     */
+    async setPassword(input) {
+        await this.#host.request({
+            method: "POST",
+            path: "/me/password",
+            body: input,
+        });
+    }
 }
 //# sourceMappingURL=auth.js.map

package/dist/src/console/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/console/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAwHH;;;;;;;;;;GAUG;AACH,MAAM,OAAO,OAAO;IACT,KAAK,CAAW;IAEzB;;OAEG;IACH,YAAY,IAAc;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,QAAgB;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB;YAClD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;YAC5B,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,CAAC,KAAkB;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiB;YACnD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,KAAK;YACX,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAA2B;YAC7D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,6BAA6B;YACnC,KAAK,EAAE,EAAE,IAAI,EAAE;YACf,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,IAAY;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwB;YAC1D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY;YAC9C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/console/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH,OAAO,EAAqB,IAAI,EAAuB,MAAM,YAAY,CAAC;AAkO1E,+FAA+F;AAC/F,SAAS,aAAa,CAAC,IAAiB;IACtC,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACtC,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AAC/C,CAAC;AAyCD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,OAAO;IACT,KAAK,CAAW;IAEzB;;OAEG;IACH,YAAY,IAAc;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,QAAgB;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB;YAClD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE;YACrC,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB;YACpD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,CAAC,KAAkB;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiB;YACnD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,KAAK;YACX,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAA2B;YAC7D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,6BAA6B;YACnC,KAAK,EAAE,EAAE,IAAI,EAAE;YACf,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwB;YAC1D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY;YAC9C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAC1F,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc;YAChD,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,oBAAoB,CAAC,KAAgC;QACzD,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAChC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,oBAAoB,CAAC,KAAgC;QACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc;YAChD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,aAAa,CAAC,EAAU;QAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAA,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc;YAChD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,gBAAgB,EAAE,UAAU;YACtC,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QACH,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,WAAW,CAAC,KAAuB;QACvC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAChC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;CACF"}