herald-auth-web 0.5.1

package/dist/index.global.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/generated/core/bodySerializer.gen.ts","../src/generated/core/serverSentEvents.gen.ts","../src/generated/core/pathSerializer.gen.ts","../src/generated/core/utils.gen.ts","../src/generated/core/auth.gen.ts","../src/generated/client/utils.gen.ts","../src/generated/client/client.gen.ts","../src/generated/client.gen.ts","../src/generated/sdk.gen.ts","../src/errors.ts","../src/transport.ts","../src/auth.ts","../src/session.ts","../src/storage.ts","../src/config.ts","../src/webauthn.ts"],"sourcesContent":["/**\n * herald-auth-web — Herald official browser JavaScript SDK.\n *\n * Framework-agnostic, zero runtime dependencies. See README for integration.\n */\n\n// Public client factory + config.\nexport { createHeraldClient } from './config'\nexport type { HeraldClient, HeraldClientConfig, SetTokensPayload, TokenBridge } from './config'\n\n// Errors.\nexport { HeraldError } from './errors'\nexport type { HeraldErrorKind, HeraldErrorInit } from './errors'\n\n// Storage adapters.\nexport { localStorageStorage, memoryStorage } from './storage'\nexport type { TokenStorage } from './storage'\n\n// WebAuthn assertion helper (integrators call this between passkey loginBegin\n// and loginFinish).\nexport { performPasskeyAssertion } from './webauthn'\nexport type { AssertionResultJSON, PublicKeyCredentialRequestOptionsJSON } from './webauthn'\n\n// Public types.\nexport type {\n  BrowserTokenResponse,\n  ConsentAgreement,\n  EmailOtpConflict,\n  EmailOtpSendResult,\n  EmailOtpSent,\n  HeraldCredentialClass,\n  HeraldSession,\n  LoginConsentRequired,\n  LoginOauthRedirect,\n  LoginRequiresSecondFactor,\n  LoginResult,\n  LoginSuccess,\n  PasskeyLoginBeginResult,\n  SecondFactor,\n  SessionEvent,\n  StatusResponse,\n} from './types'\n\n// Method payload types.\nexport type {\n  EmailOtpSendPayload,\n  EmailOtpVerifyPayload,\n  LoginPayload,\n  PasskeyLoginBeginPayload,\n  PasskeyLoginFinishPayload,\n  RegisterPayload,\n  RequestPasswordResetPayload,\n  TriggerVerifyEmailPayload,\n  VerifyTotpPayload,\n} from './auth'\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport type { ArrayStyle, ObjectStyle, SerializerOptions } from './pathSerializer.gen';\n\nexport type QuerySerializer = (query: Record<string, unknown>) => string;\n\nexport type BodySerializer = (body: any) => any;\n\ntype QuerySerializerOptionsObject = {\n  allowReserved?: boolean;\n  array?: Partial<SerializerOptions<ArrayStyle>>;\n  object?: Partial<SerializerOptions<ObjectStyle>>;\n};\n\nexport type QuerySerializerOptions = QuerySerializerOptionsObject & {\n  /**\n   * Per-parameter serialization overrides. When provided, these settings\n   * override the global array/object settings for specific parameter names.\n   */\n  parameters?: Record<string, QuerySerializerOptionsObject>;\n};\n\nconst serializeFormDataPair = (data: FormData, key: string, value: unknown): void => {\n  if (typeof value === 'string' || value instanceof Blob) {\n    data.append(key, value);\n  } else if (value instanceof Date) {\n    data.append(key, value.toISOString());\n  } else {\n    data.append(key, JSON.stringify(value));\n  }\n};\n\nconst serializeUrlSearchParamsPair = (data: URLSearchParams, key: string, value: unknown): void => {\n  if (typeof value === 'string') {\n    data.append(key, value);\n  } else {\n    data.append(key, JSON.stringify(value));\n  }\n};\n\nexport const formDataBodySerializer = {\n  bodySerializer: <T extends Record<string, any> | Array<Record<string, any>>>(\n    body: T,\n  ): FormData => {\n    const data = new FormData();\n\n    Object.entries(body).forEach(([key, value]) => {\n      if (value === undefined || value === null) {\n        return;\n      }\n      if (Array.isArray(value)) {\n        value.forEach((v) => serializeFormDataPair(data, key, v));\n      } else {\n        serializeFormDataPair(data, key, value);\n      }\n    });\n\n    return data;\n  },\n};\n\nexport const jsonBodySerializer = {\n  bodySerializer: <T>(body: T): string =>\n    JSON.stringify(body, (_key, value) => (typeof value === 'bigint' ? value.toString() : value)),\n};\n\nexport const urlSearchParamsBodySerializer = {\n  bodySerializer: <T extends Record<string, any> | Array<Record<string, any>>>(body: T): string => {\n    const data = new URLSearchParams();\n\n    Object.entries(body).forEach(([key, value]) => {\n      if (value === undefined || value === null) {\n        return;\n      }\n      if (Array.isArray(value)) {\n        value.forEach((v) => serializeUrlSearchParamsPair(data, key, v));\n      } else {\n        serializeUrlSearchParamsPair(data, key, value);\n      }\n    });\n\n    return data.toString();\n  },\n};\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport type { Config } from './types.gen';\n\nexport type ServerSentEventsOptions<TData = unknown> = Omit<RequestInit, 'method'> &\n  Pick<Config, 'method' | 'responseTransformer' | 'responseValidator'> & {\n    /**\n     * Fetch API implementation. You can use this option to provide a custom\n     * fetch instance.\n     *\n     * @default globalThis.fetch\n     */\n    fetch?: typeof fetch;\n    /**\n     * Implementing clients can call request interceptors inside this hook.\n     */\n    onRequest?: (url: string, init: RequestInit) => Promise<Request>;\n    /**\n     * Callback invoked when a network or parsing error occurs during streaming.\n     *\n     * This option applies only if the endpoint returns a stream of events.\n     *\n     * @param error The error that occurred.\n     */\n    onSseError?: (error: unknown) => void;\n    /**\n     * Callback invoked when an event is streamed from the server.\n     *\n     * This option applies only if the endpoint returns a stream of events.\n     *\n     * @param event Event streamed from the server.\n     * @returns Nothing (void).\n     */\n    onSseEvent?: (event: StreamEvent<TData>) => void;\n    serializedBody?: RequestInit['body'];\n    /**\n     * Default retry delay in milliseconds.\n     *\n     * This option applies only if the endpoint returns a stream of events.\n     *\n     * @default 3000\n     */\n    sseDefaultRetryDelay?: number;\n    /**\n     * Maximum number of retry attempts before giving up.\n     */\n    sseMaxRetryAttempts?: number;\n    /**\n     * Maximum retry delay in milliseconds.\n     *\n     * Applies only when exponential backoff is used.\n     *\n     * This option applies only if the endpoint returns a stream of events.\n     *\n     * @default 30000\n     */\n    sseMaxRetryDelay?: number;\n    /**\n     * Optional sleep function for retry backoff.\n     *\n     * Defaults to using `setTimeout`.\n     */\n    sseSleepFn?: (ms: number) => Promise<void>;\n    url: string;\n  };\n\nexport interface StreamEvent<TData = unknown> {\n  data: TData;\n  event?: string;\n  id?: string;\n  retry?: number;\n}\n\nexport type ServerSentEventsResult<TData = unknown, TReturn = void, TNext = unknown> = {\n  stream: AsyncGenerator<\n    TData extends Record<string, unknown> ? TData[keyof TData] : TData,\n    TReturn,\n    TNext\n  >;\n};\n\nexport const createSseClient = <TData = unknown>({\n  onRequest,\n  onSseError,\n  onSseEvent,\n  responseTransformer,\n  responseValidator,\n  sseDefaultRetryDelay,\n  sseMaxRetryAttempts,\n  sseMaxRetryDelay,\n  sseSleepFn,\n  url,\n  ...options\n}: ServerSentEventsOptions): ServerSentEventsResult<TData> => {\n  let lastEventId: string | undefined;\n\n  const sleep = sseSleepFn ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));\n\n  const createStream = async function* () {\n    let retryDelay: number = sseDefaultRetryDelay ?? 3000;\n    let attempt = 0;\n    const signal = options.signal ?? new AbortController().signal;\n\n    while (true) {\n      if (signal.aborted) break;\n\n      attempt++;\n\n      const headers =\n        options.headers instanceof Headers\n          ? options.headers\n          : new Headers(options.headers as Record<string, string> | undefined);\n\n      if (lastEventId !== undefined) {\n        headers.set('Last-Event-ID', lastEventId);\n      }\n\n      try {\n        const requestInit: RequestInit = {\n          redirect: 'follow',\n          ...options,\n          body: options.serializedBody,\n          headers,\n          signal,\n        };\n        let request = new Request(url, requestInit);\n        if (onRequest) {\n          request = await onRequest(url, requestInit);\n        }\n        // fetch must be assigned here, otherwise it would throw the error:\n        // TypeError: Failed to execute 'fetch' on 'Window': Illegal invocation\n        const _fetch = options.fetch ?? globalThis.fetch;\n        const response = await _fetch(request);\n\n        if (!response.ok) throw new Error(`SSE failed: ${response.status} ${response.statusText}`);\n\n        if (!response.body) throw new Error('No body in SSE response');\n\n        const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();\n\n        let buffer = '';\n\n        const abortHandler = () => {\n          try {\n            reader.cancel();\n          } catch {\n            // noop\n          }\n        };\n\n        signal.addEventListener('abort', abortHandler);\n\n        try {\n          while (true) {\n            const { done, value } = await reader.read();\n            if (done) break;\n            buffer += value;\n            // Normalize line endings: CRLF -> LF, then CR -> LF\n            buffer = buffer.replace(/\\r\\n/g, '\\n').replace(/\\r/g, '\\n');\n\n            const chunks = buffer.split('\\n\\n');\n            buffer = chunks.pop() ?? '';\n\n            for (const chunk of chunks) {\n              const lines = chunk.split('\\n');\n              const dataLines: Array<string> = [];\n              let eventName: string | undefined;\n\n              for (const line of lines) {\n                if (line.startsWith('data:')) {\n                  dataLines.push(line.replace(/^data:\\s*/, ''));\n                } else if (line.startsWith('event:')) {\n                  eventName = line.replace(/^event:\\s*/, '');\n                } else if (line.startsWith('id:')) {\n                  lastEventId = line.replace(/^id:\\s*/, '');\n                } else if (line.startsWith('retry:')) {\n                  const parsed = Number.parseInt(line.replace(/^retry:\\s*/, ''), 10);\n                  if (!Number.isNaN(parsed)) {\n                    retryDelay = parsed;\n                  }\n                }\n              }\n\n              let data: unknown;\n              let parsedJson = false;\n\n              if (dataLines.length) {\n                const rawData = dataLines.join('\\n');\n                try {\n                  data = JSON.parse(rawData);\n                  parsedJson = true;\n                } catch {\n                  data = rawData;\n                }\n              }\n\n              if (parsedJson) {\n                if (responseValidator) {\n                  await responseValidator(data);\n                }\n\n                if (responseTransformer) {\n                  data = await responseTransformer(data);\n                }\n              }\n\n              onSseEvent?.({\n                data,\n                event: eventName,\n                id: lastEventId,\n                retry: retryDelay,\n              });\n\n              if (dataLines.length) {\n                yield data as any;\n              }\n            }\n          }\n        } finally {\n          signal.removeEventListener('abort', abortHandler);\n          reader.releaseLock();\n        }\n\n        break; // exit loop on normal completion\n      } catch (error) {\n        // connection failed or aborted; retry after delay\n        onSseError?.(error);\n\n        if (sseMaxRetryAttempts !== undefined && attempt >= sseMaxRetryAttempts) {\n          break; // stop after firing error\n        }\n\n        // exponential backoff: double retry each attempt, cap at 30s\n        const backoff = Math.min(retryDelay * 2 ** (attempt - 1), sseMaxRetryDelay ?? 30000);\n        await sleep(backoff);\n      }\n    }\n  };\n\n  const stream = createStream();\n\n  return { stream };\n};\n","// This file is auto-generated by @hey-api/openapi-ts\n\ninterface SerializeOptions<T> extends SerializePrimitiveOptions, SerializerOptions<T> {}\n\ninterface SerializePrimitiveOptions {\n  allowReserved?: boolean;\n  name: string;\n}\n\nexport interface SerializerOptions<T> {\n  /**\n   * @default true\n   */\n  explode: boolean;\n  style: T;\n}\n\nexport type ArrayStyle = 'form' | 'spaceDelimited' | 'pipeDelimited';\nexport type ArraySeparatorStyle = ArrayStyle | MatrixStyle;\ntype MatrixStyle = 'label' | 'matrix' | 'simple';\nexport type ObjectStyle = 'form' | 'deepObject';\ntype ObjectSeparatorStyle = ObjectStyle | MatrixStyle;\n\ninterface SerializePrimitiveParam extends SerializePrimitiveOptions {\n  value: string;\n}\n\nexport const separatorArrayExplode = (style: ArraySeparatorStyle) => {\n  switch (style) {\n    case 'label':\n      return '.';\n    case 'matrix':\n      return ';';\n    case 'simple':\n      return ',';\n    default:\n      return '&';\n  }\n};\n\nexport const separatorArrayNoExplode = (style: ArraySeparatorStyle) => {\n  switch (style) {\n    case 'form':\n      return ',';\n    case 'pipeDelimited':\n      return '|';\n    case 'spaceDelimited':\n      return '%20';\n    default:\n      return ',';\n  }\n};\n\nexport const separatorObjectExplode = (style: ObjectSeparatorStyle) => {\n  switch (style) {\n    case 'label':\n      return '.';\n    case 'matrix':\n      return ';';\n    case 'simple':\n      return ',';\n    default:\n      return '&';\n  }\n};\n\nexport const serializeArrayParam = ({\n  allowReserved,\n  explode,\n  name,\n  style,\n  value,\n}: SerializeOptions<ArraySeparatorStyle> & {\n  value: unknown[];\n}) => {\n  if (!explode) {\n    const joinedValues = (\n      allowReserved ? value : value.map((v) => encodeURIComponent(v as string))\n    ).join(separatorArrayNoExplode(style));\n    switch (style) {\n      case 'label':\n        return `.${joinedValues}`;\n      case 'matrix':\n        return `;${name}=${joinedValues}`;\n      case 'simple':\n        return joinedValues;\n      default:\n        return `${name}=${joinedValues}`;\n    }\n  }\n\n  const separator = separatorArrayExplode(style);\n  const joinedValues = value\n    .map((v) => {\n      if (style === 'label' || style === 'simple') {\n        return allowReserved ? v : encodeURIComponent(v as string);\n      }\n\n      return serializePrimitiveParam({\n        allowReserved,\n        name,\n        value: v as string,\n      });\n    })\n    .join(separator);\n  return style === 'label' || style === 'matrix' ? separator + joinedValues : joinedValues;\n};\n\nexport const serializePrimitiveParam = ({\n  allowReserved,\n  name,\n  value,\n}: SerializePrimitiveParam) => {\n  if (value === undefined || value === null) {\n    return '';\n  }\n\n  if (typeof value === 'object') {\n    throw new Error(\n      'Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.',\n    );\n  }\n\n  return `${name}=${allowReserved ? value : encodeURIComponent(value)}`;\n};\n\nexport const serializeObjectParam = ({\n  allowReserved,\n  explode,\n  name,\n  style,\n  value,\n  valueOnly,\n}: SerializeOptions<ObjectSeparatorStyle> & {\n  value: Record<string, unknown> | Date;\n  valueOnly?: boolean;\n}) => {\n  if (value instanceof Date) {\n    return valueOnly ? value.toISOString() : `${name}=${value.toISOString()}`;\n  }\n\n  if (style !== 'deepObject' && !explode) {\n    let values: string[] = [];\n    Object.entries(value).forEach(([key, v]) => {\n      values = [...values, key, allowReserved ? (v as string) : encodeURIComponent(v as string)];\n    });\n    const joinedValues = values.join(',');\n    switch (style) {\n      case 'form':\n        return `${name}=${joinedValues}`;\n      case 'label':\n        return `.${joinedValues}`;\n      case 'matrix':\n        return `;${name}=${joinedValues}`;\n      default:\n        return joinedValues;\n    }\n  }\n\n  const separator = separatorObjectExplode(style);\n  const joinedValues = Object.entries(value)\n    .map(([key, v]) =>\n      serializePrimitiveParam({\n        allowReserved,\n        name: style === 'deepObject' ? `${name}[${key}]` : key,\n        value: v as string,\n      }),\n    )\n    .join(separator);\n  return style === 'label' || style === 'matrix' ? separator + joinedValues : joinedValues;\n};\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport type { BodySerializer, QuerySerializer } from './bodySerializer.gen';\nimport {\n  type ArraySeparatorStyle,\n  serializeArrayParam,\n  serializeObjectParam,\n  serializePrimitiveParam,\n} from './pathSerializer.gen';\n\nexport interface PathSerializer {\n  path: Record<string, unknown>;\n  url: string;\n}\n\nexport const PATH_PARAM_RE = /\\{[^{}]+\\}/g;\n\nexport const defaultPathSerializer = ({ path, url: _url }: PathSerializer) => {\n  let url = _url;\n  const matches = _url.match(PATH_PARAM_RE);\n  if (matches) {\n    for (const match of matches) {\n      let explode = false;\n      let name = match.substring(1, match.length - 1);\n      let style: ArraySeparatorStyle = 'simple';\n\n      if (name.endsWith('*')) {\n        explode = true;\n        name = name.substring(0, name.length - 1);\n      }\n\n      if (name.startsWith('.')) {\n        name = name.substring(1);\n        style = 'label';\n      } else if (name.startsWith(';')) {\n        name = name.substring(1);\n        style = 'matrix';\n      }\n\n      const value = path[name];\n\n      if (value === undefined || value === null) {\n        continue;\n      }\n\n      if (Array.isArray(value)) {\n        url = url.replace(match, serializeArrayParam({ explode, name, style, value }));\n        continue;\n      }\n\n      if (typeof value === 'object') {\n        url = url.replace(\n          match,\n          serializeObjectParam({\n            explode,\n            name,\n            style,\n            value: value as Record<string, unknown>,\n            valueOnly: true,\n          }),\n        );\n        continue;\n      }\n\n      if (style === 'matrix') {\n        url = url.replace(\n          match,\n          `;${serializePrimitiveParam({\n            name,\n            value: value as string,\n          })}`,\n        );\n        continue;\n      }\n\n      const replaceValue = encodeURIComponent(\n        style === 'label' ? `.${value as string}` : (value as string),\n      );\n      url = url.replace(match, replaceValue);\n    }\n  }\n  return url;\n};\n\nexport const getUrl = ({\n  baseUrl,\n  path,\n  query,\n  querySerializer,\n  url: _url,\n}: {\n  baseUrl?: string;\n  path?: Record<string, unknown>;\n  query?: Record<string, unknown>;\n  querySerializer: QuerySerializer;\n  url: string;\n}) => {\n  const pathUrl = _url.startsWith('/') ? _url : `/${_url}`;\n  let url = (baseUrl ?? '') + pathUrl;\n  if (path) {\n    url = defaultPathSerializer({ path, url });\n  }\n  let search = query ? querySerializer(query) : '';\n  if (search.startsWith('?')) {\n    search = search.substring(1);\n  }\n  if (search) {\n    url += `?${search}`;\n  }\n  return url;\n};\n\nexport function getValidRequestBody(options: {\n  body?: unknown;\n  bodySerializer?: BodySerializer | null;\n  serializedBody?: unknown;\n}) {\n  const hasBody = options.body !== undefined;\n  const isSerializedBody = hasBody && options.bodySerializer;\n\n  if (isSerializedBody) {\n    if ('serializedBody' in options) {\n      const hasSerializedBody =\n        options.serializedBody !== undefined && options.serializedBody !== '';\n\n      return hasSerializedBody ? options.serializedBody : null;\n    }\n\n    // not all clients implement a serializedBody property (i.e. client-axios)\n    return options.body !== '' ? options.body : null;\n  }\n\n  // plain/text body\n  if (hasBody) {\n    return options.body;\n  }\n\n  // no body was provided\n  return undefined;\n}\n","// This file is auto-generated by @hey-api/openapi-ts\n\nexport type AuthToken = string | undefined;\n\nexport interface Auth {\n  /**\n   * Which part of the request do we use to send the auth?\n   *\n   * @default 'header'\n   */\n  in?: 'header' | 'query' | 'cookie';\n  /**\n   * Header or query parameter name.\n   *\n   * @default 'Authorization'\n   */\n  name?: string;\n  scheme?: 'basic' | 'bearer';\n  type: 'apiKey' | 'http';\n}\n\nexport const getAuthToken = async (\n  auth: Auth,\n  callback: ((auth: Auth) => Promise<AuthToken> | AuthToken) | AuthToken,\n): Promise<string | undefined> => {\n  const token = typeof callback === 'function' ? await callback(auth) : callback;\n\n  if (!token) {\n    return;\n  }\n\n  if (auth.scheme === 'bearer') {\n    return `Bearer ${token}`;\n  }\n\n  if (auth.scheme === 'basic') {\n    return `Basic ${btoa(token)}`;\n  }\n\n  return token;\n};\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport { getAuthToken } from '../core/auth.gen';\nimport type { QuerySerializerOptions } from '../core/bodySerializer.gen';\nimport { jsonBodySerializer } from '../core/bodySerializer.gen';\nimport {\n  serializeArrayParam,\n  serializeObjectParam,\n  serializePrimitiveParam,\n} from '../core/pathSerializer.gen';\nimport { getUrl } from '../core/utils.gen';\nimport type { Client, ClientOptions, Config, RequestOptions } from './types.gen';\n\nexport const createQuerySerializer = <T = unknown>({\n  parameters = {},\n  ...args\n}: QuerySerializerOptions = {}) => {\n  const querySerializer = (queryParams: T) => {\n    const search: string[] = [];\n    if (queryParams && typeof queryParams === 'object') {\n      for (const name in queryParams) {\n        const value = queryParams[name];\n\n        if (value === undefined || value === null) {\n          continue;\n        }\n\n        const options = parameters[name] || args;\n\n        if (Array.isArray(value)) {\n          const serializedArray = serializeArrayParam({\n            allowReserved: options.allowReserved,\n            explode: true,\n            name,\n            style: 'form',\n            value,\n            ...options.array,\n          });\n          if (serializedArray) search.push(serializedArray);\n        } else if (typeof value === 'object') {\n          const serializedObject = serializeObjectParam({\n            allowReserved: options.allowReserved,\n            explode: true,\n            name,\n            style: 'deepObject',\n            value: value as Record<string, unknown>,\n            ...options.object,\n          });\n          if (serializedObject) search.push(serializedObject);\n        } else {\n          const serializedPrimitive = serializePrimitiveParam({\n            allowReserved: options.allowReserved,\n            name,\n            value: value as string,\n          });\n          if (serializedPrimitive) search.push(serializedPrimitive);\n        }\n      }\n    }\n    return search.join('&');\n  };\n  return querySerializer;\n};\n\n/**\n * Infers parseAs value from provided Content-Type header.\n */\nexport const getParseAs = (contentType: string | null): Exclude<Config['parseAs'], 'auto'> => {\n  if (!contentType) {\n    // If no Content-Type header is provided, the best we can do is return the raw response body,\n    // which is effectively the same as the 'stream' option.\n    return 'stream';\n  }\n\n  const cleanContent = contentType.split(';')[0]?.trim();\n\n  if (!cleanContent) {\n    return;\n  }\n\n  if (cleanContent.startsWith('application/json') || cleanContent.endsWith('+json')) {\n    return 'json';\n  }\n\n  if (cleanContent === 'multipart/form-data') {\n    return 'formData';\n  }\n\n  if (\n    ['application/', 'audio/', 'image/', 'video/'].some((type) => cleanContent.startsWith(type))\n  ) {\n    return 'blob';\n  }\n\n  if (cleanContent.startsWith('text/')) {\n    return 'text';\n  }\n\n  return;\n};\n\nconst checkForExistence = (\n  options: Pick<RequestOptions, 'auth' | 'query'> & {\n    headers: Headers;\n  },\n  name?: string,\n): boolean => {\n  if (!name) {\n    return false;\n  }\n  if (\n    options.headers.has(name) ||\n    options.query?.[name] ||\n    options.headers.get('Cookie')?.includes(`${name}=`)\n  ) {\n    return true;\n  }\n  return false;\n};\n\nexport const setAuthParams = async ({\n  security,\n  ...options\n}: Pick<Required<RequestOptions>, 'security'> &\n  Pick<RequestOptions, 'auth' | 'query'> & {\n    headers: Headers;\n  }) => {\n  for (const auth of security) {\n    if (checkForExistence(options, auth.name)) {\n      continue;\n    }\n\n    const token = await getAuthToken(auth, options.auth);\n\n    if (!token) {\n      continue;\n    }\n\n    const name = auth.name ?? 'Authorization';\n\n    switch (auth.in) {\n      case 'query':\n        if (!options.query) {\n          options.query = {};\n        }\n        options.query[name] = token;\n        break;\n      case 'cookie':\n        options.headers.append('Cookie', `${name}=${token}`);\n        break;\n      case 'header':\n      default:\n        options.headers.set(name, token);\n        break;\n    }\n  }\n};\n\nexport const buildUrl: Client['buildUrl'] = (options) =>\n  getUrl({\n    baseUrl: options.baseUrl as string,\n    path: options.path,\n    query: options.query,\n    querySerializer:\n      typeof options.querySerializer === 'function'\n        ? options.querySerializer\n        : createQuerySerializer(options.querySerializer),\n    url: options.url,\n  });\n\nexport const mergeConfigs = (a: Config, b: Config): Config => {\n  const config = { ...a, ...b };\n  if (config.baseUrl?.endsWith('/')) {\n    config.baseUrl = config.baseUrl.substring(0, config.baseUrl.length - 1);\n  }\n  config.headers = mergeHeaders(a.headers, b.headers);\n  return config;\n};\n\nconst headersEntries = (headers: Headers): Array<[string, string]> => {\n  const entries: Array<[string, string]> = [];\n  headers.forEach((value, key) => {\n    entries.push([key, value]);\n  });\n  return entries;\n};\n\nexport const mergeHeaders = (\n  ...headers: Array<Required<Config>['headers'] | undefined>\n): Headers => {\n  const mergedHeaders = new Headers();\n  for (const header of headers) {\n    if (!header) {\n      continue;\n    }\n\n    const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);\n\n    for (const [key, value] of iterator) {\n      if (value === null) {\n        mergedHeaders.delete(key);\n      } else if (Array.isArray(value)) {\n        for (const v of value) {\n          mergedHeaders.append(key, v as string);\n        }\n      } else if (value !== undefined) {\n        // assume object headers are meant to be JSON stringified, i.e. their\n        // content value in OpenAPI specification is 'application/json'\n        mergedHeaders.set(\n          key,\n          typeof value === 'object' ? JSON.stringify(value) : (value as string),\n        );\n      }\n    }\n  }\n  return mergedHeaders;\n};\n\ntype ErrInterceptor<Err, Res, Req, Options> = (\n  error: Err,\n  response: Res,\n  request: Req,\n  options: Options,\n) => Err | Promise<Err>;\n\ntype ReqInterceptor<Req, Options> = (request: Req, options: Options) => Req | Promise<Req>;\n\ntype ResInterceptor<Res, Req, Options> = (\n  response: Res,\n  request: Req,\n  options: Options,\n) => Res | Promise<Res>;\n\nclass Interceptors<Interceptor> {\n  fns: Array<Interceptor | null> = [];\n\n  clear(): void {\n    this.fns = [];\n  }\n\n  eject(id: number | Interceptor): void {\n    const index = this.getInterceptorIndex(id);\n    if (this.fns[index]) {\n      this.fns[index] = null;\n    }\n  }\n\n  exists(id: number | Interceptor): boolean {\n    const index = this.getInterceptorIndex(id);\n    return Boolean(this.fns[index]);\n  }\n\n  getInterceptorIndex(id: number | Interceptor): number {\n    if (typeof id === 'number') {\n      return this.fns[id] ? id : -1;\n    }\n    return this.fns.indexOf(id);\n  }\n\n  update(id: number | Interceptor, fn: Interceptor): number | Interceptor | false {\n    const index = this.getInterceptorIndex(id);\n    if (this.fns[index]) {\n      this.fns[index] = fn;\n      return id;\n    }\n    return false;\n  }\n\n  use(fn: Interceptor): number {\n    this.fns.push(fn);\n    return this.fns.length - 1;\n  }\n}\n\nexport interface Middleware<Req, Res, Err, Options> {\n  error: Interceptors<ErrInterceptor<Err, Res, Req, Options>>;\n  request: Interceptors<ReqInterceptor<Req, Options>>;\n  response: Interceptors<ResInterceptor<Res, Req, Options>>;\n}\n\nexport const createInterceptors = <Req, Res, Err, Options>(): Middleware<\n  Req,\n  Res,\n  Err,\n  Options\n> => ({\n  error: new Interceptors<ErrInterceptor<Err, Res, Req, Options>>(),\n  request: new Interceptors<ReqInterceptor<Req, Options>>(),\n  response: new Interceptors<ResInterceptor<Res, Req, Options>>(),\n});\n\nconst defaultQuerySerializer = createQuerySerializer({\n  allowReserved: false,\n  array: {\n    explode: true,\n    style: 'form',\n  },\n  object: {\n    explode: true,\n    style: 'deepObject',\n  },\n});\n\nconst defaultHeaders = {\n  'Content-Type': 'application/json',\n};\n\nexport const createConfig = <T extends ClientOptions = ClientOptions>(\n  override: Config<Omit<ClientOptions, keyof T> & T> = {},\n): Config<Omit<ClientOptions, keyof T> & T> => ({\n  ...jsonBodySerializer,\n  headers: defaultHeaders,\n  parseAs: 'auto',\n  querySerializer: defaultQuerySerializer,\n  ...override,\n});\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport { createSseClient } from '../core/serverSentEvents.gen';\nimport type { HttpMethod } from '../core/types.gen';\nimport { getValidRequestBody } from '../core/utils.gen';\nimport type { Client, Config, RequestOptions, ResolvedRequestOptions } from './types.gen';\nimport {\n  buildUrl,\n  createConfig,\n  createInterceptors,\n  getParseAs,\n  mergeConfigs,\n  mergeHeaders,\n  setAuthParams,\n} from './utils.gen';\n\ntype ReqInit = Omit<RequestInit, 'body' | 'headers'> & {\n  body?: any;\n  headers: ReturnType<typeof mergeHeaders>;\n};\n\nexport const createClient = (config: Config = {}): Client => {\n  let _config = mergeConfigs(createConfig(), config);\n\n  const getConfig = (): Config => ({ ..._config });\n\n  const setConfig = (config: Config): Config => {\n    _config = mergeConfigs(_config, config);\n    return getConfig();\n  };\n\n  const interceptors = createInterceptors<Request, Response, unknown, ResolvedRequestOptions>();\n\n  const beforeRequest = async (options: RequestOptions) => {\n    const opts = {\n      ..._config,\n      ...options,\n      fetch: options.fetch ?? _config.fetch ?? globalThis.fetch,\n      headers: mergeHeaders(_config.headers, options.headers),\n      serializedBody: undefined,\n    };\n\n    if (opts.security) {\n      await setAuthParams({\n        ...opts,\n        security: opts.security,\n      });\n    }\n\n    if (opts.requestValidator) {\n      await opts.requestValidator(opts);\n    }\n\n    if (opts.body !== undefined && opts.bodySerializer) {\n      opts.serializedBody = opts.bodySerializer(opts.body);\n    }\n\n    // remove Content-Type header if body is empty to avoid sending invalid requests\n    if (opts.body === undefined || opts.serializedBody === '') {\n      opts.headers.delete('Content-Type');\n    }\n\n    const url = buildUrl(opts);\n\n    return { opts, url };\n  };\n\n  const request: Client['request'] = async (options) => {\n    // @ts-expect-error\n    const { opts, url } = await beforeRequest(options);\n    const requestInit: ReqInit = {\n      redirect: 'follow',\n      ...opts,\n      body: getValidRequestBody(opts),\n    };\n\n    let request = new Request(url, requestInit);\n\n    for (const fn of interceptors.request.fns) {\n      if (fn) {\n        request = await fn(request, opts);\n      }\n    }\n\n    // fetch must be assigned here, otherwise it would throw the error:\n    // TypeError: Failed to execute 'fetch' on 'Window': Illegal invocation\n    const _fetch = opts.fetch!;\n    let response: Response;\n\n    try {\n      response = await _fetch(request);\n    } catch (error) {\n      // Handle fetch exceptions (AbortError, network errors, etc.)\n      let finalError = error;\n\n      for (const fn of interceptors.error.fns) {\n        if (fn) {\n          finalError = (await fn(error, undefined as any, request, opts)) as unknown;\n        }\n      }\n\n      finalError = finalError || ({} as unknown);\n\n      if (opts.throwOnError) {\n        throw finalError;\n      }\n\n      // Return error response\n      return opts.responseStyle === 'data'\n        ? undefined\n        : {\n            error: finalError,\n            request,\n            response: undefined as any,\n          };\n    }\n\n    for (const fn of interceptors.response.fns) {\n      if (fn) {\n        response = await fn(response, request, opts);\n      }\n    }\n\n    const result = {\n      request,\n      response,\n    };\n\n    if (response.ok) {\n      const parseAs =\n        (opts.parseAs === 'auto'\n          ? getParseAs(response.headers.get('Content-Type'))\n          : opts.parseAs) ?? 'json';\n\n      if (response.status === 204 || response.headers.get('Content-Length') === '0') {\n        let emptyData: any;\n        switch (parseAs) {\n          case 'arrayBuffer':\n          case 'blob':\n          case 'text':\n            emptyData = await response[parseAs]();\n            break;\n          case 'formData':\n            emptyData = new FormData();\n            break;\n          case 'stream':\n            emptyData = response.body;\n            break;\n          case 'json':\n          default:\n            emptyData = {};\n            break;\n        }\n        return opts.responseStyle === 'data'\n          ? emptyData\n          : {\n              data: emptyData,\n              ...result,\n            };\n      }\n\n      let data: any;\n      switch (parseAs) {\n        case 'arrayBuffer':\n        case 'blob':\n        case 'formData':\n        case 'text':\n          data = await response[parseAs]();\n          break;\n        case 'json': {\n          // Some servers return 200 with no Content-Length and empty body.\n          // response.json() would throw; read as text and parse if non-empty.\n          const text = await response.text();\n          data = text ? JSON.parse(text) : {};\n          break;\n        }\n        case 'stream':\n          return opts.responseStyle === 'data'\n            ? response.body\n            : {\n                data: response.body,\n                ...result,\n              };\n      }\n\n      if (parseAs === 'json') {\n        if (opts.responseValidator) {\n          await opts.responseValidator(data);\n        }\n\n        if (opts.responseTransformer) {\n          data = await opts.responseTransformer(data);\n        }\n      }\n\n      return opts.responseStyle === 'data'\n        ? data\n        : {\n            data,\n            ...result,\n          };\n    }\n\n    const textError = await response.text();\n    let jsonError: unknown;\n\n    try {\n      jsonError = JSON.parse(textError);\n    } catch {\n      // noop\n    }\n\n    const error = jsonError ?? textError;\n    let finalError = error;\n\n    for (const fn of interceptors.error.fns) {\n      if (fn) {\n        finalError = (await fn(error, response, request, opts)) as string;\n      }\n    }\n\n    finalError = finalError || ({} as string);\n\n    if (opts.throwOnError) {\n      throw finalError;\n    }\n\n    // TODO: we probably want to return error and improve types\n    return opts.responseStyle === 'data'\n      ? undefined\n      : {\n          error: finalError,\n          ...result,\n        };\n  };\n\n  const makeMethodFn = (method: Uppercase<HttpMethod>) => (options: RequestOptions) =>\n    request({ ...options, method });\n\n  const makeSseFn = (method: Uppercase<HttpMethod>) => async (options: RequestOptions) => {\n    const { opts, url } = await beforeRequest(options);\n    return createSseClient({\n      ...opts,\n      body: opts.body as BodyInit | null | undefined,\n      headers: opts.headers as unknown as Record<string, string>,\n      method,\n      onRequest: async (url, init) => {\n        let request = new Request(url, init);\n        for (const fn of interceptors.request.fns) {\n          if (fn) {\n            request = await fn(request, opts);\n          }\n        }\n        return request;\n      },\n      serializedBody: getValidRequestBody(opts) as BodyInit | null | undefined,\n      url,\n    });\n  };\n\n  return {\n    buildUrl,\n    connect: makeMethodFn('CONNECT'),\n    delete: makeMethodFn('DELETE'),\n    get: makeMethodFn('GET'),\n    getConfig,\n    head: makeMethodFn('HEAD'),\n    interceptors,\n    options: makeMethodFn('OPTIONS'),\n    patch: makeMethodFn('PATCH'),\n    post: makeMethodFn('POST'),\n    put: makeMethodFn('PUT'),\n    request,\n    setConfig,\n    sse: {\n      connect: makeSseFn('CONNECT'),\n      delete: makeSseFn('DELETE'),\n      get: makeSseFn('GET'),\n      head: makeSseFn('HEAD'),\n      options: makeSseFn('OPTIONS'),\n      patch: makeSseFn('PATCH'),\n      post: makeSseFn('POST'),\n      put: makeSseFn('PUT'),\n      trace: makeSseFn('TRACE'),\n    },\n    trace: makeMethodFn('TRACE'),\n  } as Client;\n};\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport { type ClientOptions, type Config, createClient, createConfig } from './client';\nimport type { ClientOptions as ClientOptions2 } from './types.gen';\n\n/**\n * The `createClientConfig()` function will be called on client initialization\n * and the returned object will become the client's initial configuration.\n *\n * You may want to initialize your client this way instead of calling\n * `setConfig()`. This is useful for example if you're using Next.js\n * to ensure your client always has the correct values.\n */\nexport type CreateClientConfig<T extends ClientOptions = ClientOptions2> = (override?: Config<ClientOptions & T>) => Config<Required<ClientOptions> & T>;\n\nexport const client = createClient(createConfig<ClientOptions2>());\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport type { Client, Options as Options2, TDataShape } from './client';\nimport { client } from './client.gen';\nimport type { AdminDiscardDraftData, AdminDiscardDraftErrors, AdminDiscardDraftResponses, AdminGetApiKeyRolesData, AdminGetApiKeyRolesErrors, AdminGetApiKeyRolesResponses, AdminGetDraftData, AdminGetDraftErrors, AdminGetDraftResponses, AdminGetUserRolesData, AdminGetUserRolesErrors, AdminGetUserRolesResponses, AdminGetVersionData, AdminGetVersionErrors, AdminGetVersionResponses, AdminListAgreementsData, AdminListAgreementsErrors, AdminListAgreementsResponses, AdminPublishCustomData, AdminPublishCustomErrors, AdminPublishCustomResponses, AdminPublishFromDraftData, AdminPublishFromDraftErrors, AdminPublishFromDraftResponses, AdminRevertToDefaultData, AdminRevertToDefaultErrors, AdminRevertToDefaultResponses, AdminSaveDraftData, AdminSaveDraftErrors, AdminSaveDraftResponses, AdminUpdateApiKeyRolesData, AdminUpdateApiKeyRolesErrors, AdminUpdateApiKeyRolesResponses, AppleNativeLoginData, AppleNativeLoginErrors, AppleNativeLoginResponses, ApplyInvoiceData, ApplyInvoiceErrors, ApplyInvoiceResponses, AssignPermissionToRoleData, AssignPermissionToRoleErrors, AssignPermissionToRoleResponses, BatchUpdateEntitlementMappingsData, BatchUpdateEntitlementMappingsErrors, BatchUpdateEntitlementMappingsResponses, BatchUpsertRealmConfigsData, BatchUpsertRealmConfigsErrors, BatchUpsertRealmConfigsResponses, CancelPaymentAttemptData, CancelPaymentAttemptErrors, CancelPaymentAttemptResponses, CancelSubscriptionForClientAppData, CancelSubscriptionForClientAppErrors, CancelSubscriptionForClientAppResponses, ChangeEmailConfirmData, ChangeEmailConfirmErrors, ChangeEmailConfirmResponses, ChangeEmailRequestData, ChangeEmailRequestErrors, ChangeEmailRequestResponses, ChangeUserPasswordData, ChangeUserPasswordErrors, ChangeUserPasswordResponses, CheckPermission2Data, CheckPermission2Errors, CheckPermission2Responses, CheckPermissionData, CheckPermissionErrors, CheckPermissionResponses, ConsumePointsExtData, ConsumePointsExtErrors, ConsumePointsExtResponses, CreateApiKeyData, CreateApiKeyErrors, CreateApiKeyResponses, CreateClientApp2Data, CreateClientApp2Errors, CreateClientApp2Responses, CreateClientAppData, CreateClientAppErrors, CreateClientAppResponses, CreateCreditBucketHandlerData, CreateCreditBucketHandlerErrors, CreateCreditBucketHandlerResponses, CreateCreditNoteData, CreateCreditNoteErrors, CreateCreditNoteResponses, CreateEntitlementMappingData, CreateEntitlementMappingErrors, CreateEntitlementMappingResponses, CreateInvoiceData, CreateInvoiceErrors, CreateInvoiceResponses, CreateOauthConfigData, CreateOauthConfigErrors, CreateOauthConfigResponses, CreatePaymentAttemptData, CreatePaymentAttemptErrors, CreatePaymentAttemptResponses, CreatePermissionDefinitionData, CreatePermissionDefinitionErrors, CreatePermissionDefinitionResponses, CreateRealm2Data, CreateRealm2Errors, CreateRealm2Responses, CreateRealmData, CreateRealmErrors, CreateRealmResponses, CreateRoleData, CreateRoleErrors, CreateRoleResponses, CreateUser2Data, CreateUser2Errors, CreateUser2Responses, CreateUserData, CreateUserErrors, CreateUserPermissionData, CreateUserPermissionErrors, CreateUserPermissionResponses, CreateUserResponses, DeleteAccountData, DeleteAccountErrors, DeleteAccountResponses, DeleteApiKeyData, DeleteApiKeyErrors, DeleteApiKeyResponses, DeleteClientAppData, DeleteClientAppErrors, DeleteClientAppResponses, DeleteCreditBucketHandlerData, DeleteCreditBucketHandlerErrors, DeleteCreditBucketHandlerResponses, DeleteOauthConfigData, DeleteOauthConfigErrors, DeleteOauthConfigResponses, DeletePermissionData, DeletePermissionErrors, DeletePermissionResponses, DeleteRealmConfigData, DeleteRealmConfigErrors, DeleteRealmConfigResponses, DeleteRoleData, DeleteRoleErrors, DeleteRoleResponses, DeleteUserData, DeleteUserErrors, DeleteUserPermissionData, DeleteUserPermissionErrors, DeleteUserPermissionResponses, DeleteUserResponses, DeviceAuthorizeData, DeviceAuthorizeErrors, DeviceAuthorizeResponses, DeviceConfirmData, DeviceConfirmErrors, DeviceConfirmResponses, DeviceTokenData, DeviceTokenErrors, DeviceTokenResponses, DeviceVerifyData, DeviceVerifyErrors, DeviceVerifyResponses, DownloadInvoicePdfData, DownloadInvoicePdfErrors, DownloadInvoicePdfResponses, DownloadMyInvoicePdfData, DownloadMyInvoicePdfErrors, DownloadMyInvoicePdfResponses, EmailStatusData, EmailStatusErrors, EmailStatusResponses, EmailTestData, EmailTestErrors, EmailTestResponses, FulfillPaymentData, FulfillPaymentErrors, FulfillPaymentResponses, GetAgreementData, GetAgreementErrors, GetAgreementResponses, GetApiKeyData, GetApiKeyErrors, GetApiKeyResponses, GetAuditEventData, GetAuditEventErrors, GetAuditEventResponses, GetBalanceExtData, GetBalanceExtErrors, GetBalanceExtResponses, GetBucketOverviewHandlerData, GetBucketOverviewHandlerErrors, GetBucketOverviewHandlerResponses, GetClientApp2Data, GetClientApp2Errors, GetClientApp2Responses, GetClientAppData, GetClientAppErrors, GetClientAppResponses, GetConsentStatusData, GetConsentStatusErrors, GetConsentStatusResponses, GetCreditBucketHandlerData, GetCreditBucketHandlerErrors, GetCreditBucketHandlerResponses, GetCurrentUserPermissionsData, GetCurrentUserPermissionsErrors, GetCurrentUserPermissionsResponses, GetDashboardStatsData, GetDashboardStatsErrors, GetDashboardStatsResponses, GetEntitlementCurrenciesData, GetEntitlementCurrenciesErrors, GetEntitlementCurrenciesResponses, GetEntitlementMappingData, GetEntitlementMappingErrors, GetEntitlementMappingResponses, GetFeatureAvailabilityData, GetFeatureAvailabilityErrors, GetFeatureAvailabilityResponses, GetInvoiceApplyEligibilityData, GetInvoiceApplyEligibilityErrors, GetInvoiceApplyEligibilityResponses, GetInvoiceData, GetInvoiceErrors, GetInvoiceResponses, GetMyInvoiceScopedData, GetMyInvoiceScopedErrors, GetMyInvoiceScopedResponses, GetMySubscriptionHistoryData, GetMySubscriptionHistoryErrors, GetMySubscriptionHistoryResponses, GetOauthConfigData, GetOauthConfigErrors, GetOauthConfigResponses, GetOneTimeMappingsData, GetOneTimeMappingsErrors, GetOneTimeMappingsResponses, GetPaymentAttemptStatusData, GetPaymentAttemptStatusErrors, GetPaymentAttemptStatusResponses, GetPermissionData, GetPermissionErrors, GetPermissionResponses, GetProfileData, GetProfileErrors, GetProfileResponses, GetPublicConfigData, GetPublicConfigErrors, GetPublicConfigResponses, GetPurchaseHistoryData, GetPurchaseHistoryErrors, GetPurchaseHistoryResponses, GetRealm2Data, GetRealm2Errors, GetRealm2Responses, GetRealmConfigData, GetRealmConfigErrors, GetRealmConfigResponses, GetRealmData, GetRealmErrors, GetRealmResponses, GetRegistrationRulesData, GetRegistrationRulesErrors, GetRegistrationRulesResponses, GetRoleData, GetRoleErrors, GetRolePermissionsData, GetRolePermissionsErrors, GetRolePermissionsResponses, GetRoleResponses, GetSellerConfigData, GetSellerConfigErrors, GetSellerConfigResponses, GetSignupStatusData, GetSignupStatusErrors, GetSignupStatusResponses, GetSubscription2Data, GetSubscription2Errors, GetSubscription2Responses, GetSubscription3Data, GetSubscription3Errors, GetSubscription3Responses, GetSubscriptionData, GetSubscriptionErrors, GetSubscriptionForClientAppData, GetSubscriptionForClientAppErrors, GetSubscriptionForClientAppResponses, GetSubscriptionHistoryData, GetSubscriptionHistoryErrors, GetSubscriptionHistoryResponses, GetSubscriptionResponses, GetTransactionByExternalRefExtData, GetTransactionByExternalRefExtErrors, GetTransactionByExternalRefExtResponses, GetTransactionExtData, GetTransactionExtErrors, GetTransactionExtResponses, GetTurnstileStatusData, GetTurnstileStatusErrors, GetTurnstileStatusResponses, GetUser2Data, GetUser2Errors, GetUser2Responses, GetUserData, GetUserErrors, GetUserFeatureAvailabilityData, GetUserFeatureAvailabilityErrors, GetUserFeatureAvailabilityResponses, GetUserResponses, GetUserRolesData, GetUserRolesErrors, GetUserRolesResponses, GetWalletData, GetWalletErrors, GetWalletResponses, GoogleOneTapData, GoogleOneTapErrors, GoogleOneTapResponses, GrantPointsData, GrantPointsErrors, GrantPointsExtData, GrantPointsExtErrors, GrantPointsExtResponses, GrantPointsResponses, GrantQuotaEntitlementData, GrantQuotaEntitlementErrors, GrantQuotaEntitlementResponses, HandleAppleWebhookData, HandleAppleWebhookResponses, HandleBeginPasskeyRegistrationData, HandleBeginPasskeyRegistrationErrors, HandleBeginPasskeyRegistrationResponses, HandleBeginReauthData, HandleBeginReauthErrors, HandleBeginReauthResponses, HandleCustomDomainAuthorizeData, HandleCustomDomainAuthorizeErrors, HandleCustomDomainAuthorizeResponses, HandleDeletePasskeyCredentialData, HandleDeletePasskeyCredentialErrors, HandleDeletePasskeyCredentialResponses, HandleDisableTotpData, HandleDisableTotpErrors, HandleDisableTotpResponses, HandleDiscardWhiteLabelDraftData, HandleDiscardWhiteLabelDraftErrors, HandleDiscardWhiteLabelDraftResponses, HandleEnableTotpData, HandleEnableTotpErrors, HandleEnableTotpResponses, HandleFinishPasskeyRegistrationData, HandleFinishPasskeyRegistrationErrors, HandleFinishPasskeyRegistrationResponses, HandleGetCustomDomainConfigData, HandleGetCustomDomainConfigErrors, HandleGetCustomDomainConfigResponses, HandleGetRealmEmailOtpConfigData, HandleGetRealmEmailOtpConfigErrors, HandleGetRealmEmailOtpConfigResponses, HandleGetRealmPasskeyConfigData, HandleGetRealmPasskeyConfigErrors, HandleGetRealmPasskeyConfigResponses, HandleGetRealmTotpConfigData, HandleGetRealmTotpConfigErrors, HandleGetRealmTotpConfigResponses, HandleGetTotpStatusData, HandleGetTotpStatusErrors, HandleGetTotpStatusResponses, HandleGetWhiteLabelConfigData, HandleGetWhiteLabelConfigErrors, HandleGetWhiteLabelConfigResponses, HandleListPasskeyCredentialsData, HandleListPasskeyCredentialsErrors, HandleListPasskeyCredentialsResponses, HandlePasskey2FaOptionsData, HandlePasskey2FaOptionsErrors, HandlePasskey2FaOptionsResponses, HandlePasskey2FaVerifyData, HandlePasskey2FaVerifyErrors, HandlePasskey2FaVerifyResponses, HandlePasskeyOptionsData, HandlePasskeyOptionsErrors, HandlePasskeyOptionsResponses, HandlePasskeyVerifyData, HandlePasskeyVerifyErrors, HandlePasskeyVerifyResponses, HandlePublishWhiteLabelConfigData, HandlePublishWhiteLabelConfigErrors, HandlePublishWhiteLabelConfigResponses, HandleRegenerateTotpData, HandleRegenerateTotpErrors, HandleRegenerateTotpResponses, HandleRenamePasskeyCredentialData, HandleRenamePasskeyCredentialErrors, HandleRenamePasskeyCredentialResponses, HandleRestoreWhiteLabelConfigData, HandleRestoreWhiteLabelConfigErrors, HandleRestoreWhiteLabelConfigResponses, HandleSaveWhiteLabelDraftData, HandleSaveWhiteLabelDraftErrors, HandleSaveWhiteLabelDraftResponses, HandleUpdateCustomDomainConfigData, HandleUpdateCustomDomainConfigErrors, HandleUpdateCustomDomainConfigResponses, HandleUpdateRealmEmailOtpConfigData, HandleUpdateRealmEmailOtpConfigErrors, HandleUpdateRealmEmailOtpConfigResponses, HandleUpdateRealmPasskeyConfigData, HandleUpdateRealmPasskeyConfigErrors, HandleUpdateRealmPasskeyConfigResponses, HandleUpdateRealmTotpConfigData, HandleUpdateRealmTotpConfigErrors, HandleUpdateRealmTotpConfigResponses, HandleVerifyReauthData, HandleVerifyReauthErrors, HandleVerifyReauthResponses, HandleVerifyTotpData, HandleVerifyTotpErrors, HandleVerifyTotpResponses, HandleVerifyTotpSetupData, HandleVerifyTotpSetupErrors, HandleVerifyTotpSetupResponses, HealthCheckData, HealthCheckErrors, HealthCheckResponses, IssueInvoiceData, IssueInvoiceErrors, IssueInvoiceResponses, ListAgreementsData, ListAgreementsErrors, ListAgreementsResponses, ListApiKeysData, ListApiKeysErrors, ListApiKeysResponses, ListAttributionAnomaliesData, ListAttributionAnomaliesErrors, ListAttributionAnomaliesResponses, ListAuditEventsData, ListAuditEventsErrors, ListAuditEventsResponses, ListClientApps2Data, ListClientApps2Errors, ListClientApps2Responses, ListClientAppsData, ListClientAppsErrors, ListClientAppsResponses, ListCreditBucketsHandlerData, ListCreditBucketsHandlerErrors, ListCreditBucketsHandlerResponses, ListEntitlementMappingsData, ListEntitlementMappingsErrors, ListEntitlementMappingsResponses, ListInvoicesData, ListInvoicesErrors, ListInvoicesResponses, ListMyInvoicesData, ListMyInvoicesErrors, ListMyInvoicesResponses, ListMySubscriptionHistoryData, ListMySubscriptionHistoryErrors, ListMySubscriptionHistoryResponses, ListOauthConfigsData, ListOauthConfigsErrors, ListOauthConfigsResponses, ListOneTimeMappingsData, ListOneTimeMappingsErrors, ListOneTimeMappingsResponses, ListPaymentProvidersData, ListPaymentProvidersErrors, ListPaymentProvidersResponses, ListPermissionData, ListPermissionErrors, ListPermissionResponses, ListPermissionsData, ListPermissionsErrors, ListPermissionsResponses, ListPurchaseOptionsData, ListPurchaseOptionsErrors, ListPurchaseOptionsResponses, ListRealmConfigsByTypeData, ListRealmConfigsByTypeErrors, ListRealmConfigsByTypeResponses, ListRealmConfigsData, ListRealmConfigsErrors, ListRealmConfigsResponses, ListRealms2Data, ListRealms2Errors, ListRealms2Responses, ListRealmsData, ListRealmsErrors, ListRealmsPaginatedData, ListRealmsPaginatedErrors, ListRealmsPaginatedResponses, ListRealmsResponses, ListRolesData, ListRolesErrors, ListRolesResponses, ListSubscriptionHistoryData, ListSubscriptionHistoryErrors, ListSubscriptionHistoryResponses, ListSubscriptionsData, ListSubscriptionsErrors, ListSubscriptionsResponses, ListTransactionsData, ListTransactionsErrors, ListTransactionsResponses, ListUsers2Data, ListUsers2Errors, ListUsers2Responses, ListUsersData, ListUsersErrors, ListUserSessionsData, ListUserSessionsErrors, ListUserSessionsResponses, ListUsersResponses, ListUserTransactionsData, ListUserTransactionsErrors, ListUserTransactionsResponses, ListUserWalletsData, ListUserWalletsErrors, ListUserWalletsResponses, ListWalletsData, ListWalletsErrors, ListWalletsResponses, LoginData, LoginErrors, LoginResponses, LogoutData, LogoutErrors, LogoutResponses, MarkPaidData, MarkPaidErrors, MarkPaidResponses, OauthAuthorizeData, OauthAuthorizeErrors, OauthCallbackData, OauthCallbackErrors, OauthCallbackResponses, OauthLoginData, OauthLoginErrors, OauthLoginResponses, OauthTokenData, OauthTokenErrors, OauthTokenResponses, RecordConsentData, RecordConsentErrors, RecordConsentResponses, RefreshData, RefreshErrors, RefreshResponses, RegisterData, RegisterErrors, RegisterResponses, RemovePermissionFromRoleData, RemovePermissionFromRoleErrors, RemovePermissionFromRoleResponses, ResetPasswordConfirmData, ResetPasswordConfirmErrors, ResetPasswordRequestData, ResetPasswordRequestErrors, ResetPasswordRequestResponses, ResetUserPasswordData, ResetUserPasswordErrors, ResetUserPasswordResponses, ResolveCustomDomainData, ResolveCustomDomainErrors, ResolveCustomDomainResponses, ResolveDefaultPriceData, ResolveDefaultPriceErrors, ResolveDefaultPriceResponses, RevokeAllUserSessionsData, RevokeAllUserSessionsErrors, RevokeAllUserSessionsResponses, RevokeQuotaEntitlementData, RevokeQuotaEntitlementErrors, RevokeQuotaEntitlementResponses, RevokeUserSessionData, RevokeUserSessionErrors, RevokeUserSessionResponses, RotateApiKeyData, RotateApiKeyErrors, RotateApiKeyResponses, SendData, SendErrors, SendResponses, SignupData, SignupErrors, SignupResponses, Status2Data, Status2Errors, Status2Responses, Status3Data, Status3Errors, Status3Responses, StatusData, StatusErrors, StatusResponses, SubmitIapReceiptData, SubmitIapReceiptErrors, SubmitIapReceiptResponses, SwitchClientData, SwitchClientErrors, SwitchClientResponses, SyncProviderProductsData, SyncProviderProductsErrors, SyncProviderProductsResponses, UpdateApiKeyData, UpdateApiKeyErrors, UpdateApiKeyResponses, UpdateClientAppData, UpdateClientAppErrors, UpdateClientAppResponses, UpdateCreditBucketHandlerData, UpdateCreditBucketHandlerErrors, UpdateCreditBucketHandlerResponses, UpdateEntitlementMappingData, UpdateEntitlementMappingErrors, UpdateEntitlementMappingResponses, UpdateInvoiceData, UpdateInvoiceErrors, UpdateInvoiceResponses, UpdateOauthConfigData, UpdateOauthConfigErrors, UpdateOauthConfigResponses, UpdatePermissionData, UpdatePermissionErrors, UpdatePermissionResponses, UpdateProfileData, UpdateProfileErrors, UpdateProfileResponses, UpdateRealmData, UpdateRealmErrors, UpdateRealmResponses, UpdateRoleData, UpdateRoleErrors, UpdateRoleResponses, UpdateUserData, UpdateUserErrors, UpdateUserResponses, UpdateUserRolesData, UpdateUserRolesErrors, UpdateUserRolesResponses, UpsertRealmConfigData, UpsertRealmConfigErrors, UpsertRealmConfigResponses, UpsertRegistrationRulesData, UpsertRegistrationRulesErrors, UpsertRegistrationRulesResponses, UpsertSellerConfigData, UpsertSellerConfigErrors, UpsertSellerConfigResponses, VerifyData, VerifyEmailConfirmData, VerifyEmailConfirmErrors, VerifyEmailTriggerData, VerifyEmailTriggerErrors, VerifyEmailTriggerResponses, VerifyErrors, VerifyResponses, VoidInvoiceData, VoidInvoiceErrors, VoidInvoiceResponses, WechatCallbackData, WechatCallbackErrors, WechatLoginData, WechatLoginErrors, WechatLoginResponses, WechatMiniprogramLoginData, WechatMiniprogramLoginErrors, WechatMiniprogramLoginResponses, WechatWebhookHandlerData, WechatWebhookHandlerErrors, WechatWebhookHandlerResponses } from './types.gen';\n\nexport type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean> = Options2<TData, ThrowOnError> & {\n    /**\n     * You can provide a client instance returned by `createClient()` instead of\n     * individual options. This might be also useful if you want to implement a\n     * custom client.\n     */\n    client?: Client;\n    /**\n     * You can pass arbitrary values through the `meta` object. This can be\n     * used to access values that aren't defined as part of the SDK function.\n     */\n    meta?: Record<string, unknown>;\n};\n\n/**\n * List all API Keys for a realm\n *\n * Returns a paginated list of API keys. Hash and plaintext are never exposed.\n */\nexport const listApiKeys = <ThrowOnError extends boolean = false>(options: Options<ListApiKeysData, ThrowOnError>) => (options.client ?? client).get<ListApiKeysResponses, ListApiKeysErrors, ThrowOnError>({ url: '/api/api-keys/{realmId}', ...options });\n\n/**\n * Create a new API Key\n *\n * Generates a new API key for the specified realm. The plaintext key is returned\n * only in this response and cannot be retrieved later.\n */\nexport const createApiKey = <ThrowOnError extends boolean = false>(options: Options<CreateApiKeyData, ThrowOnError>) => (options.client ?? client).post<CreateApiKeyResponses, CreateApiKeyErrors, ThrowOnError>({\n    url: '/api/api-keys/{realmId}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Delete an API Key\n *\n * Permanently deletes an API key.\n */\nexport const deleteApiKey = <ThrowOnError extends boolean = false>(options: Options<DeleteApiKeyData, ThrowOnError>) => (options.client ?? client).delete<DeleteApiKeyResponses, DeleteApiKeyErrors, ThrowOnError>({ url: '/api/api-keys/{realmId}/{apiKeyId}', ...options });\n\n/**\n * Get a specific API Key by ID\n *\n * Retrieves details of an API key. Hash and plaintext are never exposed.\n */\nexport const getApiKey = <ThrowOnError extends boolean = false>(options: Options<GetApiKeyData, ThrowOnError>) => (options.client ?? client).get<GetApiKeyResponses, GetApiKeyErrors, ThrowOnError>({ url: '/api/api-keys/{realmId}/{apiKeyId}', ...options });\n\n/**\n * Update an API Key\n *\n * Partially updates an API key's name, enabled status, or expiration.\n */\nexport const updateApiKey = <ThrowOnError extends boolean = false>(options: Options<UpdateApiKeyData, ThrowOnError>) => (options.client ?? client).put<UpdateApiKeyResponses, UpdateApiKeyErrors, ThrowOnError>({\n    url: '/api/api-keys/{realmId}/{apiKeyId}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get API Key roles\n *\n * Returns the list of roles assigned to a specific API Key.\n */\nexport const adminGetApiKeyRoles = <ThrowOnError extends boolean = false>(options: Options<AdminGetApiKeyRolesData, ThrowOnError>) => (options.client ?? client).get<AdminGetApiKeyRolesResponses, AdminGetApiKeyRolesErrors, ThrowOnError>({ url: '/api/api-keys/{realmId}/{apiKeyId}/roles', ...options });\n\n/**\n * Update API Key roles\n *\n * Replaces all roles assigned to an API Key. Empty array clears all roles.\n * Builtin roles cannot be assigned to API Keys (returns 400).\n */\nexport const adminUpdateApiKeyRoles = <ThrowOnError extends boolean = false>(options: Options<AdminUpdateApiKeyRolesData, ThrowOnError>) => (options.client ?? client).put<AdminUpdateApiKeyRolesResponses, AdminUpdateApiKeyRolesErrors, ThrowOnError>({\n    url: '/api/api-keys/{realmId}/{apiKeyId}/roles',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Rotate an API Key\n *\n * Generates a new key for the API key, replacing the old hash.\n * The old key is immediately invalidated. Returns the new plaintext key (shown once).\n */\nexport const rotateApiKey = <ThrowOnError extends boolean = false>(options: Options<RotateApiKeyData, ThrowOnError>) => (options.client ?? client).post<RotateApiKeyResponses, RotateApiKeyErrors, ThrowOnError>({ url: '/api/api-keys/{realmId}/{apiKeyId}/rotate', ...options });\n\n/**\n * List audit events with optional filters and pagination\n */\nexport const listAuditEvents = <ThrowOnError extends boolean = false>(options: Options<ListAuditEventsData, ThrowOnError>) => (options.client ?? client).get<ListAuditEventsResponses, ListAuditEventsErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/audit/{realmId}',\n    ...options\n});\n\n/**\n * Get a single audit event by ID\n */\nexport const getAuditEvent = <ThrowOnError extends boolean = false>(options: Options<GetAuditEventData, ThrowOnError>) => (options.client ?? client).get<GetAuditEventResponses, GetAuditEventErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/audit/{realmId}/{eventId}',\n    ...options\n});\n\nexport const refresh = <ThrowOnError extends boolean = false>(options: Options<RefreshData, ThrowOnError>) => (options.client ?? client).post<RefreshResponses, RefreshErrors, ThrowOnError>({\n    url: '/api/auth/browser-token/refresh',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const switchClient = <ThrowOnError extends boolean = false>(options: Options<SwitchClientData, ThrowOnError>) => (options.client ?? client).post<SwitchClientResponses, SwitchClientErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/auth/browser-token/switch-client',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const logout = <ThrowOnError extends boolean = false>(options?: Options<LogoutData, ThrowOnError>) => (options?.client ?? client).post<LogoutResponses, LogoutErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/auth/logout',\n    ...options\n});\n\nexport const status = <ThrowOnError extends boolean = false>(options?: Options<StatusData, ThrowOnError>) => (options?.client ?? client).get<StatusResponses, StatusErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/auth/status',\n    ...options\n});\n\n/**\n * Confirm email change with verification code\n *\n * Completes the email change process using the verification code sent to the new email address.\n */\nexport const changeEmailConfirm = <ThrowOnError extends boolean = false>(options: Options<ChangeEmailConfirmData, ThrowOnError>) => (options.client ?? client).get<ChangeEmailConfirmResponses, ChangeEmailConfirmErrors, ThrowOnError>({ url: '/api/auth/{realmId}/change_email/confirm/{changeCode}', ...options });\n\n/**\n * Request to change the email address for the authenticated user\n *\n * Initiates an email change process by sending a verification code to the new email address.\n * The user must click the confirmation link in the email to complete the change.\n */\nexport const changeEmailRequest = <ThrowOnError extends boolean = false>(options: Options<ChangeEmailRequestData, ThrowOnError>) => (options.client ?? client).post<ChangeEmailRequestResponses, ChangeEmailRequestErrors, ThrowOnError>({\n    url: '/api/auth/{realmId}/change_email/request',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Public OTP-login enablement flag for a Realm.\n *\n * Reads the `email_otp` / `settings` config row. Returns `{ enabled: false }`\n * when the config is absent or malformed (opt-in per Realm).\n */\nexport const status2 = <ThrowOnError extends boolean = false>(options: Options<Status2Data, ThrowOnError>) => (options.client ?? client).get<Status2Responses, Status2Errors, ThrowOnError>({ url: '/api/auth/{realmId}/email-otp/status', ...options });\n\n/**\n * Authenticate user with email/username and password\n *\n * Supports both email and username login. Returns a session token or requires TOTP verification\n * if two-factor authentication is enabled for the user.\n */\nexport const login = <ThrowOnError extends boolean = false>(options: Options<LoginData, ThrowOnError>) => (options.client ?? client).post<LoginResponses, LoginErrors, ThrowOnError>({\n    url: '/api/auth/{realmId}/login',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Send an email OTP login code.\n *\n * Issues a one-time verification code for an existing active user, or — if the\n * Realm has OTP auto-register enabled — for an unregistered email after consent\n * is expressed. Partially enumeration-resistant: a 200 is returned for a known\n * but non-active user (no code sent). An explicit 409 is still returned for an\n * unregistered email when auto-register is off — the same registration-status\n * bit the register endpoint exposes by design (both paths sit behind Turnstile\n * and per-email/IP rate limits).\n */\nexport const send = <ThrowOnError extends boolean = false>(options: Options<SendData, ThrowOnError>) => (options.client ?? client).post<SendResponses, SendErrors, ThrowOnError>({\n    url: '/api/auth/{realmId}/login/email-otp/send',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Verify an email OTP login code and issue a session.\n *\n * On a matching code: consumes it (one-time), then either logs the existing\n * user in (login-as-consent gate) or auto-registers a new account\n * (create-without-password → activate → register-as-consent) and issues a\n * Bearer token family via `RedisBrowserTokenService`. Returns `BrowserTokenResponse`.\n */\nexport const verify = <ThrowOnError extends boolean = false>(options: Options<VerifyData, ThrowOnError>) => (options.client ?? client).post<VerifyResponses, VerifyErrors, ThrowOnError>({\n    url: '/api/auth/{realmId}/login/email-otp/verify',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const handlePasskey2FaOptions = <ThrowOnError extends boolean = false>(options: Options<HandlePasskey2FaOptionsData, ThrowOnError>) => (options.client ?? client).post<HandlePasskey2FaOptionsResponses, HandlePasskey2FaOptionsErrors, ThrowOnError>({\n    url: '/api/auth/{realmId}/login/passkey/2fa/options',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const handlePasskey2FaVerify = <ThrowOnError extends boolean = false>(options: Options<HandlePasskey2FaVerifyData, ThrowOnError>) => (options.client ?? client).post<HandlePasskey2FaVerifyResponses, HandlePasskey2FaVerifyErrors, ThrowOnError>({\n    url: '/api/auth/{realmId}/login/passkey/2fa/verify',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const handlePasskeyOptions = <ThrowOnError extends boolean = false>(options: Options<HandlePasskeyOptionsData, ThrowOnError>) => (options.client ?? client).post<HandlePasskeyOptionsResponses, HandlePasskeyOptionsErrors, ThrowOnError>({\n    url: '/api/auth/{realmId}/login/passkey/options',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const handlePasskeyVerify = <ThrowOnError extends boolean = false>(options: Options<HandlePasskeyVerifyData, ThrowOnError>) => (options.client ?? client).post<HandlePasskeyVerifyResponses, HandlePasskeyVerifyErrors, ThrowOnError>({\n    url: '/api/auth/{realmId}/login/passkey/verify',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Verify TOTP code for two-factor authentication\n *\n * Completes the login process for users with TOTP enabled. Accepts either a TOTP code\n * from an authenticator app or a backup code. Creates a permanent session on success.\n */\nexport const handleVerifyTotp = <ThrowOnError extends boolean = false>(options: Options<HandleVerifyTotpData, ThrowOnError>) => (options.client ?? client).post<HandleVerifyTotpResponses, HandleVerifyTotpErrors, ThrowOnError>({\n    url: '/api/auth/{realmId}/login/verify-totp',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Public passkey enablement flag for a Realm.\n *\n * Reads the `passkey` / `settings` config row and returns `{ enabled }`. The\n * login page uses this to decide whether to render the passkey entry before\n * any passkey endpoint is called, rather than discovering disablement via a\n * 404 from `POST /login/passkey/options`. Anonymous (no authentication).\n */\nexport const status3 = <ThrowOnError extends boolean = false>(options: Options<Status3Data, ThrowOnError>) => (options.client ?? client).get<Status3Responses, Status3Errors, ThrowOnError>({ url: '/api/auth/{realmId}/passkey/status', ...options });\n\n/**\n * Register new user account\n *\n * Creates a new user account with email and optional username. If email verification is required\n * for realm, account will be created in a pending state and a verification email will be sent.\n */\nexport const register = <ThrowOnError extends boolean = false>(options: Options<RegisterData, ThrowOnError>) => (options.client ?? client).post<RegisterResponses, RegisterErrors, ThrowOnError>({\n    url: '/api/auth/{realmId}/register',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Confirm password reset with verification code\n *\n * Completes password reset process using verification code sent to user's email.\n */\nexport const resetPasswordConfirm = <ThrowOnError extends boolean = false>(options: Options<ResetPasswordConfirmData, ThrowOnError>) => (options.client ?? client).post<unknown, ResetPasswordConfirmErrors, ThrowOnError>({\n    url: '/api/auth/{realmId}/reset_password/confirm/{resetCode}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Request password reset\n *\n * Initiates a password reset process by sending a verification code to user's email address.\n * Always returns success to prevent email enumeration.\n */\nexport const resetPasswordRequest = <ThrowOnError extends boolean = false>(options: Options<ResetPasswordRequestData, ThrowOnError>) => (options.client ?? client).post<ResetPasswordRequestResponses, ResetPasswordRequestErrors, ThrowOnError>({\n    url: '/api/auth/{realmId}/reset_password/request',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Provision a new realm from an unauthenticated visitor and issue an\n * immediate first-party admin-console session for the new realm admin.\n *\n * Only the admin realm hosts this entry; any other `realmId` is rejected.\n * Pre-flight defenses run before any realm is created: the platform toggle,\n * human verification bound to the admin realm's `admin-web-console` Client\n * App, and a same-IP 24h quota.\n */\nexport const signup = <ThrowOnError extends boolean = false>(options: Options<SignupData, ThrowOnError>) => (options.client ?? client).post<SignupResponses, SignupErrors, ThrowOnError>({\n    url: '/api/auth/{realmId}/signup',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Public visibility of the self-service entry. Fail-closed: a missing toggle\n * row resolves to `enabled: false`.\n */\nexport const getSignupStatus = <ThrowOnError extends boolean = false>(options: Options<GetSignupStatusData, ThrowOnError>) => (options.client ?? client).get<GetSignupStatusResponses, GetSignupStatusErrors, ThrowOnError>({ url: '/api/auth/{realmId}/signup/status', ...options });\n\n/**\n * Get Turnstile configuration status for a Client App\n *\n * Returns whether Turnstile verification is enabled for the specified Client\n * App and the site key to render the widget. Turnstile is fully delegated to\n * the Client App (D-PROTECT-01); the legacy realm_config source is no longer\n * read. A missing or disabled Client App is rejected with 401, matching the\n * other anonymous Client-App-bound endpoints. Pass `clientId` as a query\n * parameter.\n */\nexport const getTurnstileStatus = <ThrowOnError extends boolean = false>(options: Options<GetTurnstileStatusData, ThrowOnError>) => (options.client ?? client).get<GetTurnstileStatusResponses, GetTurnstileStatusErrors, ThrowOnError>({ url: '/api/auth/{realmId}/turnstile/status', ...options });\n\n/**\n * Confirm email verification with code\n *\n * Completes email verification process using verification code sent to user's email.\n * Activates user account upon successful verification.\n */\nexport const verifyEmailConfirm = <ThrowOnError extends boolean = false>(options: Options<VerifyEmailConfirmData, ThrowOnError>) => (options.client ?? client).get<unknown, VerifyEmailConfirmErrors, ThrowOnError>({ url: '/api/auth/{realmId}/verify_email/confirm/{emailVerificationCode}', ...options });\n\n/**\n * Trigger email verification\n *\n * Sends a verification email to specified email address with a confirmation link.\n * Used to initiate email verification for pending accounts.\n */\nexport const verifyEmailTrigger = <ThrowOnError extends boolean = false>(options: Options<VerifyEmailTriggerData, ThrowOnError>) => (options.client ?? client).post<VerifyEmailTriggerResponses, VerifyEmailTriggerErrors, ThrowOnError>({\n    url: '/api/auth/{realmId}/verify_email/trigger',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * List purchasable price-level options for a client app.\n *\n * Returns a FLAT list of enabled price-granularity mappings (recurring +\n * one_time) for the purchase page; the frontend groups by\n * `external_product_id` / billing period. Replaces the purchase page's\n * dependency on `list_one_time_mappings` (which only covered one_time).\n */\nexport const listPurchaseOptions = <ThrowOnError extends boolean = false>(options: Options<ListPurchaseOptionsData, ThrowOnError>) => (options.client ?? client).get<ListPurchaseOptionsResponses, ListPurchaseOptionsErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/client/{clientAppId}/purchase-options',\n    ...options\n});\n\n/**\n * Get subscription for a client app\n */\nexport const getSubscriptionForClientApp = <ThrowOnError extends boolean = false>(options: Options<GetSubscriptionForClientAppData, ThrowOnError>) => (options.client ?? client).get<GetSubscriptionForClientAppResponses, GetSubscriptionForClientAppErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/client/{clientAppId}/subscription',\n    ...options\n});\n\n/**\n * Cancel the caller's own subscription for a client app.\n *\n * Unlike the previous admin-only flip, this handler is a **user self-service**\n * endpoint mounted on the browser-token router. It calls the **payment provider\n * cancel API** (Stripe/Creem) and does **NOT** touch the local subscription\n * row — local status is updated exclusively by the subsequent provider webhook\n * (`customer.subscription.deleted` / `subscription.canceled`). If the provider\n * call fails the error is surfaced to the caller and the local state is left\n * untouched.\n *\n * Apple / Google in-app purchases cannot be canceled via a developer API\n * (only via the App Store / Play Store by the user); this endpoint rejects\n * them with 400.\n */\nexport const cancelSubscriptionForClientApp = <ThrowOnError extends boolean = false>(options: Options<CancelSubscriptionForClientAppData, ThrowOnError>) => (options.client ?? client).post<CancelSubscriptionForClientAppResponses, CancelSubscriptionForClientAppErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/client/{clientAppId}/subscription/cancel',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * List entitlement mappings for a realm\n */\nexport const listEntitlementMappings = <ThrowOnError extends boolean = false>(options: Options<ListEntitlementMappingsData, ThrowOnError>) => (options.client ?? client).get<ListEntitlementMappingsResponses, ListEntitlementMappingsErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/entitlement-mappings',\n    ...options\n});\n\n/**\n * Generic over provider (IAP, Stripe, Creem). Required permission:\n * `billing.manage`; distribution-rule fields additionally require `points.manage`\n * (mirrors the batch update permission model). A duplicate\n * `(realm, provider, product, price)` row violates\n * `uq_pem_realm_provider_product_price` and surfaces as HTTP 409.\n */\nexport const createEntitlementMapping = <ThrowOnError extends boolean = false>(options: Options<CreateEntitlementMappingData, ThrowOnError>) => (options.client ?? client).post<CreateEntitlementMappingResponses, CreateEntitlementMappingErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/entitlement-mappings',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Batch-save all price mappings for a product.\n *\n * Validation/permission order:\n * 1. `billing.manage` (realm boundary + business permission).\n * 2. If any update row carries a credit-strategy field → `points.manage`.\n * 3. Credit-strategy field validation.\n *\n * Then the repository performs a single-transaction upsert of all the\n * product's price rows: any row transitioning enabled true→false while protected by an active\n * subscription rolls back the WHOLE transaction (409 with\n * `{ activeSubscriptions }`). Cross-realm/product `mapping_id` tampering surfaces as 400.\n */\nexport const batchUpdateEntitlementMappings = <ThrowOnError extends boolean = false>(options: Options<BatchUpdateEntitlementMappingsData, ThrowOnError>) => (options.client ?? client).put<BatchUpdateEntitlementMappingsResponses, BatchUpdateEntitlementMappingsErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/entitlement-mappings/batch',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Sync provider products into entitlement mappings\n */\nexport const syncProviderProducts = <ThrowOnError extends boolean = false>(options: Options<SyncProviderProductsData, ThrowOnError>) => (options.client ?? client).post<SyncProviderProductsResponses, SyncProviderProductsErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/entitlement-mappings/sync',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get a single entitlement mapping\n */\nexport const getEntitlementMapping = <ThrowOnError extends boolean = false>(options: Options<GetEntitlementMappingData, ThrowOnError>) => (options.client ?? client).get<GetEntitlementMappingResponses, GetEntitlementMappingErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/entitlement-mappings/{mappingId}',\n    ...options\n});\n\n/**\n * Update an entitlement mapping\n */\nexport const updateEntitlementMapping = <ThrowOnError extends boolean = false>(options: Options<UpdateEntitlementMappingData, ThrowOnError>) => (options.client ?? client).patch<UpdateEntitlementMappingResponses, UpdateEntitlementMappingErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/entitlement-mappings/{mappingId}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Admin read-only attribution anomaly discovery.\n *\n * Returns two anomaly classes:\n * - `unattributed_invoices`: externally-synced invoices that lack both\n * `subscription_id` and `payment_attempt_id` (reuses `list_admin` with\n * `attribution=Missing`, capped at the first 100 rows).\n * - `payments_without_invoice`: succeeded renewal / one-time payment attempts\n * inside a 90-day window with no invoice linked via\n * `invoice.payment_attempt_id` (anti-join read; no writes).\n *\n * Permission reuses `require_billing_permission(..., \"view\")` — same model as\n * `GET /invoices`. Realm isolation is enforced both by the repository\n * (`realm_id` filter) and the shared middleware.\n */\nexport const listAttributionAnomalies = <ThrowOnError extends boolean = false>(options: Options<ListAttributionAnomaliesData, ThrowOnError>) => (options.client ?? client).get<ListAttributionAnomaliesResponses, ListAttributionAnomaliesErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/invoice-attribution/anomalies',\n    ...options\n});\n\nexport const getSellerConfig = <ThrowOnError extends boolean = false>(options: Options<GetSellerConfigData, ThrowOnError>) => (options.client ?? client).get<GetSellerConfigResponses, GetSellerConfigErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/invoice-seller-config',\n    ...options\n});\n\nexport const upsertSellerConfig = <ThrowOnError extends boolean = false>(options: Options<UpsertSellerConfigData, ThrowOnError>) => (options.client ?? client).put<UpsertSellerConfigResponses, UpsertSellerConfigErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/invoice-seller-config',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const listInvoices = <ThrowOnError extends boolean = false>(options: Options<ListInvoicesData, ThrowOnError>) => (options.client ?? client).get<ListInvoicesResponses, ListInvoicesErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/invoices',\n    ...options\n});\n\nexport const createInvoice = <ThrowOnError extends boolean = false>(options: Options<CreateInvoiceData, ThrowOnError>) => (options.client ?? client).post<CreateInvoiceResponses, CreateInvoiceErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/invoices',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const getInvoice = <ThrowOnError extends boolean = false>(options: Options<GetInvoiceData, ThrowOnError>) => (options.client ?? client).get<GetInvoiceResponses, GetInvoiceErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/invoices/{invoiceId}',\n    ...options\n});\n\nexport const updateInvoice = <ThrowOnError extends boolean = false>(options: Options<UpdateInvoiceData, ThrowOnError>) => (options.client ?? client).patch<UpdateInvoiceResponses, UpdateInvoiceErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/invoices/{invoiceId}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const createCreditNote = <ThrowOnError extends boolean = false>(options: Options<CreateCreditNoteData, ThrowOnError>) => (options.client ?? client).post<CreateCreditNoteResponses, CreateCreditNoteErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/invoices/{invoiceId}/credit-notes',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const issueInvoice = <ThrowOnError extends boolean = false>(options: Options<IssueInvoiceData, ThrowOnError>) => (options.client ?? client).post<IssueInvoiceResponses, IssueInvoiceErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/invoices/{invoiceId}/issue',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const markPaid = <ThrowOnError extends boolean = false>(options: Options<MarkPaidData, ThrowOnError>) => (options.client ?? client).post<MarkPaidResponses, MarkPaidErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/invoices/{invoiceId}/mark-paid',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const downloadInvoicePdf = <ThrowOnError extends boolean = false>(options: Options<DownloadInvoicePdfData, ThrowOnError>) => (options.client ?? client).get<DownloadInvoicePdfResponses, DownloadInvoicePdfErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/invoices/{invoiceId}/pdf',\n    ...options\n});\n\nexport const voidInvoice = <ThrowOnError extends boolean = false>(options: Options<VoidInvoiceData, ThrowOnError>) => (options.client ?? client).post<VoidInvoiceResponses, VoidInvoiceErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/invoices/{invoiceId}/void',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * List current user's subscription history with filtering and pagination\n */\nexport const listMySubscriptionHistory = <ThrowOnError extends boolean = false>(options: Options<ListMySubscriptionHistoryData, ThrowOnError>) => (options.client ?? client).get<ListMySubscriptionHistoryResponses, ListMySubscriptionHistoryErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/my/subscriptions/history',\n    ...options\n});\n\n/**\n * Get current user's subscription history for a specific subscription\n */\nexport const getMySubscriptionHistory = <ThrowOnError extends boolean = false>(options: Options<GetMySubscriptionHistoryData, ThrowOnError>) => (options.client ?? client).get<GetMySubscriptionHistoryResponses, GetMySubscriptionHistoryErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/my/subscriptions/{subscriptionId}/history',\n    ...options\n});\n\n/**\n * List enabled one-time entitlement mappings for a realm\n */\nexport const listOneTimeMappings = <ThrowOnError extends boolean = false>(options: Options<ListOneTimeMappingsData, ThrowOnError>) => (options.client ?? client).get<ListOneTimeMappingsResponses, ListOneTimeMappingsErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/one-time-mappings',\n    ...options\n});\n\nexport const submitIapReceipt = <ThrowOnError extends boolean = false>(options: Options<SubmitIapReceiptData, ThrowOnError>) => (options.client ?? client).post<SubmitIapReceiptResponses, SubmitIapReceiptErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/purchase/iap/receipt',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const createPaymentAttempt = <ThrowOnError extends boolean = false>(options: Options<CreatePaymentAttemptData, ThrowOnError>) => (options.client ?? client).post<CreatePaymentAttemptResponses, CreatePaymentAttemptErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/purchase/payment-attempts',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const getPaymentAttemptStatus = <ThrowOnError extends boolean = false>(options: Options<GetPaymentAttemptStatusData, ThrowOnError>) => (options.client ?? client).get<GetPaymentAttemptStatusResponses, GetPaymentAttemptStatusErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/purchase/payment-attempts/{attemptId}',\n    ...options\n});\n\nexport const cancelPaymentAttempt = <ThrowOnError extends boolean = false>(options: Options<CancelPaymentAttemptData, ThrowOnError>) => (options.client ?? client).post<CancelPaymentAttemptResponses, CancelPaymentAttemptErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/purchase/payment-attempts/{attemptId}/cancel',\n    ...options\n});\n\n/**\n * List subscriptions for a realm\n */\nexport const listSubscriptions = <ThrowOnError extends boolean = false>(options: Options<ListSubscriptionsData, ThrowOnError>) => (options.client ?? client).get<ListSubscriptionsResponses, ListSubscriptionsErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/subscriptions',\n    ...options\n});\n\n/**\n * List subscription history with filtering and pagination\n */\nexport const listSubscriptionHistory = <ThrowOnError extends boolean = false>(options: Options<ListSubscriptionHistoryData, ThrowOnError>) => (options.client ?? client).get<ListSubscriptionHistoryResponses, ListSubscriptionHistoryErrors, ThrowOnError>({ url: '/api/bill/{realmId}/subscriptions/history', ...options });\n\n/**\n * Get a specific subscription\n */\nexport const getSubscription = <ThrowOnError extends boolean = false>(options: Options<GetSubscriptionData, ThrowOnError>) => (options.client ?? client).get<GetSubscriptionResponses, GetSubscriptionErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/bill/{realmId}/subscriptions/{subscriptionId}',\n    ...options\n});\n\n/**\n * Get subscription history for a specific subscription\n */\nexport const getSubscriptionHistory = <ThrowOnError extends boolean = false>(options: Options<GetSubscriptionHistoryData, ThrowOnError>) => (options.client ?? client).get<GetSubscriptionHistoryResponses, GetSubscriptionHistoryErrors, ThrowOnError>({ url: '/api/bill/{realmId}/subscriptions/{subscriptionId}/history', ...options });\n\n/**\n * List client applications\n *\n * List all OAuth client applications configured for the specified realm with pagination. Requires `clients.view` permission.\n */\nexport const listClientApps = <ThrowOnError extends boolean = false>(options: Options<ListClientAppsData, ThrowOnError>) => (options.client ?? client).get<ListClientAppsResponses, ListClientAppsErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/client/{realmId}',\n    ...options\n});\n\n/**\n * Create a new client app\n *\n * Creates a new OAuth client application with the specified configuration.\n */\nexport const createClientApp = <ThrowOnError extends boolean = false>(options: Options<CreateClientAppData, ThrowOnError>) => (options.client ?? client).post<CreateClientAppResponses, CreateClientAppErrors, ThrowOnError>({\n    url: '/api/client/{realmId}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Delete a client app\n *\n * Deletes an OAuth client application and its associated roles.\n * The built-in admin console client cannot be deleted.\n */\nexport const deleteClientApp = <ThrowOnError extends boolean = false>(options: Options<DeleteClientAppData, ThrowOnError>) => (options.client ?? client).delete<DeleteClientAppResponses, DeleteClientAppErrors, ThrowOnError>({ url: '/api/client/{realmId}/{clientAppId}', ...options });\n\n/**\n * Get a specific client app by ID\n *\n * Retrieves the details of a specific OAuth client application.\n */\nexport const getClientApp = <ThrowOnError extends boolean = false>(options: Options<GetClientAppData, ThrowOnError>) => (options.client ?? client).get<GetClientAppResponses, GetClientAppErrors, ThrowOnError>({ url: '/api/client/{realmId}/{clientAppId}', ...options });\n\n/**\n * Update a client app configuration\n *\n * Updates the configuration of an existing OAuth client application.\n * Optionally regenerate the client secret.\n */\nexport const updateClientApp = <ThrowOnError extends boolean = false>(options: Options<UpdateClientAppData, ThrowOnError>) => (options.client ?? client).put<UpdateClientAppResponses, UpdateClientAppErrors, ThrowOnError>({\n    url: '/api/client/{realmId}/{clientAppId}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get all configs for a given realm\n */\nexport const listRealmConfigs = <ThrowOnError extends boolean = false>(options: Options<ListRealmConfigsData, ThrowOnError>) => (options.client ?? client).get<ListRealmConfigsResponses, ListRealmConfigsErrors, ThrowOnError>({ url: '/api/configs/{realmId}', ...options });\n\n/**\n * Create or update a config (upsert)\n */\nexport const upsertRealmConfig = <ThrowOnError extends boolean = false>(options: Options<UpsertRealmConfigData, ThrowOnError>) => (options.client ?? client).put<UpsertRealmConfigResponses, UpsertRealmConfigErrors, ThrowOnError>({\n    url: '/api/configs/{realmId}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Batch create or update configs\n */\nexport const batchUpsertRealmConfigs = <ThrowOnError extends boolean = false>(options: Options<BatchUpsertRealmConfigsData, ThrowOnError>) => (options.client ?? client).post<BatchUpsertRealmConfigsResponses, BatchUpsertRealmConfigsErrors, ThrowOnError>({\n    url: '/api/configs/{realmId}/batch',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get email configuration status for a realm\n */\nexport const emailStatus = <ThrowOnError extends boolean = false>(options: Options<EmailStatusData, ThrowOnError>) => (options.client ?? client).get<EmailStatusResponses, EmailStatusErrors, ThrowOnError>({ url: '/api/configs/{realmId}/email/status', ...options });\n\n/**\n * Send a test email for a realm\n */\nexport const emailTest = <ThrowOnError extends boolean = false>(options: Options<EmailTestData, ThrowOnError>) => (options.client ?? client).post<EmailTestResponses, EmailTestErrors, ThrowOnError>({\n    url: '/api/configs/{realmId}/email/test',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get all configs of a given type\n */\nexport const listRealmConfigsByType = <ThrowOnError extends boolean = false>(options: Options<ListRealmConfigsByTypeData, ThrowOnError>) => (options.client ?? client).get<ListRealmConfigsByTypeResponses, ListRealmConfigsByTypeErrors, ThrowOnError>({ url: '/api/configs/{realmId}/{configType}', ...options });\n\n/**\n * Delete a config\n */\nexport const deleteRealmConfig = <ThrowOnError extends boolean = false>(options: Options<DeleteRealmConfigData, ThrowOnError>) => (options.client ?? client).delete<DeleteRealmConfigResponses, DeleteRealmConfigErrors, ThrowOnError>({ url: '/api/configs/{realmId}/{configType}/{configKey}', ...options });\n\n/**\n * Get a single config\n */\nexport const getRealmConfig = <ThrowOnError extends boolean = false>(options: Options<GetRealmConfigData, ThrowOnError>) => (options.client ?? client).get<GetRealmConfigResponses, GetRealmConfigErrors, ThrowOnError>({ url: '/api/configs/{realmId}/{configType}/{configKey}', ...options });\n\n/**\n * Get dashboard statistics for a realm\n */\nexport const getDashboardStats = <ThrowOnError extends boolean = false>(options: Options<GetDashboardStatsData, ThrowOnError>) => (options.client ?? client).get<GetDashboardStatsResponses, GetDashboardStatsErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/dashboard/{realmId}/stats',\n    ...options\n});\n\nexport const deviceAuthorize = <ThrowOnError extends boolean = false>(options: Options<DeviceAuthorizeData, ThrowOnError>) => (options.client ?? client).post<DeviceAuthorizeResponses, DeviceAuthorizeErrors, ThrowOnError>({\n    url: '/api/device/{realmId}/authorize',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const deviceConfirm = <ThrowOnError extends boolean = false>(options: Options<DeviceConfirmData, ThrowOnError>) => (options.client ?? client).post<DeviceConfirmResponses, DeviceConfirmErrors, ThrowOnError>({\n    url: '/api/device/{realmId}/confirm',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const deviceToken = <ThrowOnError extends boolean = false>(options: Options<DeviceTokenData, ThrowOnError>) => (options.client ?? client).post<DeviceTokenResponses, DeviceTokenErrors, ThrowOnError>({\n    url: '/api/device/{realmId}/token',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const deviceVerify = <ThrowOnError extends boolean = false>(options: Options<DeviceVerifyData, ThrowOnError>) => (options.client ?? client).post<DeviceVerifyResponses, DeviceVerifyErrors, ThrowOnError>({\n    url: '/api/device/{realmId}/verify',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get subscription for a client app\n *\n * Returns subscription details for the specified client app.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Realm Isolation\n * The API key must belong to the same realm as the client app.\n * Cross-realm requests will return 403 Forbidden.\n *\n * # Example\n * ```bash\n * curl -X GET \\\n * https://api.example.com/api/ext/bill/realm123/client/client-app-123/subscription \\\n * -H \"X-API-Key: your-api-key\"\n * ```\n */\nexport const getSubscription2 = <ThrowOnError extends boolean = false>(options: Options<GetSubscription2Data, ThrowOnError>) => (options.client ?? client).get<GetSubscription2Responses, GetSubscription2Errors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/bill/{realmId}/client/{clientAppId}/subscription',\n    ...options\n});\n\n/**\n * Check user permissions\n *\n * This endpoint allows third-party applications to check if a user\n * has specific permissions using their browser access token.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Example\n * ```json\n * {\n * \"accessToken\": \"user-access-token\",\n * \"rules\": [\n * {\"resource\": \"article\", \"action\": \"read\"},\n * {\"resource\": \"article\", \"action\": \"write\"}\n * ]\n * }\n * ```\n */\nexport const checkPermission = <ThrowOnError extends boolean = false>(options: Options<CheckPermissionData, ThrowOnError>) => (options.client ?? client).post<CheckPermissionResponses, CheckPermissionErrors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/permission/check',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get user points balance\n *\n * Returns the current points balance for a user in the specified realm.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Realm Isolation\n * The API key must belong to the same realm as the requested realm.\n * Cross-realm requests will return 403 Forbidden.\n *\n * # Example\n * ```bash\n * curl -X GET \\\n * https://api.example.com/api/ext/points/realm123/balance?userId=user-123 \\\n * -H \"X-API-Key: your-api-key\"\n * ```\n */\nexport const getBalanceExt = <ThrowOnError extends boolean = false>(options: Options<GetBalanceExtData, ThrowOnError>) => (options.client ?? client).get<GetBalanceExtResponses, GetBalanceExtErrors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/points/{realmId}/balance',\n    ...options\n});\n\n/**\n * Consume points from user account\n *\n * Consumes points from a user's account for paid operations.\n * Returns transaction details including the new balance.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Realm Isolation\n * The API key must belong to the same realm as the requested realm.\n * Cross-realm requests will return 403 Forbidden.\n *\n * # Example\n * ```bash\n * curl -X POST \\\n * https://api.example.com/api/ext/points/realm123/consume \\\n * -H \"X-API-Key: your-api-key\" \\\n * -H \"Content-Type: application/json\" \\\n * -d '{\n * \"userId\": \"user-123\",\n * \"clientAppId\": \"app-abc\",\n * \"amount\": 100,\n * \"description\": \"AI API call\"\n * }'\n * ```\n */\nexport const consumePointsExt = <ThrowOnError extends boolean = false>(options: Options<ConsumePointsExtData, ThrowOnError>) => (options.client ?? client).post<ConsumePointsExtResponses, ConsumePointsExtErrors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/points/{realmId}/consume',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Grant points to a user account (SDK)\n *\n * Grants points to a user's account from a third-party application.\n * Returns transaction details including the new balance.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Realm Isolation\n * The API key must belong to the same realm as the requested realm.\n * Cross-realm requests will return 403 Forbidden.\n *\n * # Example\n * ```bash\n * curl -X POST \\\n * https://api.example.com/api/ext/points/realm123/grant \\\n * -H \"X-API-Key: your-api-key\" \\\n * -H \"Content-Type: application/json\" \\\n * -d '{\n * \"userId\": \"user-123\",\n * \"amount\": 100,\n * \"reason\": \"Promotional grant\"\n * }'\n * ```\n */\nexport const grantPointsExt = <ThrowOnError extends boolean = false>(options: Options<GrantPointsExtData, ThrowOnError>) => (options.client ?? client).post<GrantPointsExtResponses, GrantPointsExtErrors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/points/{realmId}/grant',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get transaction by external reference ID\n *\n * Returns details of a specific points transaction by `externalRefId`.\n */\nexport const getTransactionByExternalRefExt = <ThrowOnError extends boolean = false>(options: Options<GetTransactionByExternalRefExtData, ThrowOnError>) => (options.client ?? client).get<GetTransactionByExternalRefExtResponses, GetTransactionByExternalRefExtErrors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/points/{realmId}/transactions/by-external-ref/{externalRefId}',\n    ...options\n});\n\n/**\n * Get transaction by ID\n *\n * Returns details of a specific points transaction.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Realm Isolation\n * The API key must belong to the same realm as the requested realm.\n * Cross-realm requests will return 403 Forbidden.\n *\n * # Example\n * ```bash\n * curl -X GET \\\n * https://api.example.com/api/ext/points/realm123/transactions/uuid \\\n * -H \"X-API-Key: your-api-key\"\n * ```\n */\nexport const getTransactionExt = <ThrowOnError extends boolean = false>(options: Options<GetTransactionExtData, ThrowOnError>) => (options.client ?? client).get<GetTransactionExtResponses, GetTransactionExtErrors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/points/{realmId}/transactions/{transactionId}',\n    ...options\n});\n\n/**\n * List realms\n *\n * Returns the realms visible to the caller. Principals in the `admin` realm\n * see all realms (platform-level enumeration); every other principal sees\n * only its own realm. Realm-level detail endpoints remain strictly\n * own-realm — this list is the only platform-wide view.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Authorization\n * The caller must have `realm:view` permission in their own realm.\n */\nexport const listRealms = <ThrowOnError extends boolean = false>(options?: Options<ListRealmsData, ThrowOnError>) => (options?.client ?? client).get<ListRealmsResponses, ListRealmsErrors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/realms',\n    ...options\n});\n\n/**\n * Create a new realm\n *\n * Creates a new realm in the system. Only principals with `realm:manage` permission\n * in the admin realm may invoke this endpoint.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Authorization\n * The caller must have `realm:manage` permission in the `admin` realm.\n */\nexport const createRealm = <ThrowOnError extends boolean = false>(options: Options<CreateRealmData, ThrowOnError>) => (options.client ?? client).post<CreateRealmResponses, CreateRealmErrors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/realms',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get a single realm by ID\n *\n * Returns detailed information for the specified realm.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Authorization\n * The caller must have `realm:view` permission in the target realm.\n * Every principal may only view its own realm (no super-admin).\n */\nexport const getRealm = <ThrowOnError extends boolean = false>(options: Options<GetRealmData, ThrowOnError>) => (options.client ?? client).get<GetRealmResponses, GetRealmErrors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/realms/{realmId}',\n    ...options\n});\n\n/**\n * List client apps in a realm\n *\n * Returns all client apps in the specified realm.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Authorization\n * The caller must have `clients:view` permission in the target realm.\n */\nexport const listClientApps2 = <ThrowOnError extends boolean = false>(options: Options<ListClientApps2Data, ThrowOnError>) => (options.client ?? client).get<ListClientApps2Responses, ListClientApps2Errors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/realms/{realmId}/client-apps',\n    ...options\n});\n\n/**\n * Create a new client app in a realm\n *\n * Creates a client app in the specified realm. Only principals with `clients:manage` permission\n * in the target realm may invoke this endpoint.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Authorization\n * The caller must have `clients:manage` permission in the target realm.\n */\nexport const createClientApp2 = <ThrowOnError extends boolean = false>(options: Options<CreateClientApp2Data, ThrowOnError>) => (options.client ?? client).post<CreateClientApp2Responses, CreateClientApp2Errors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/realms/{realmId}/client-apps',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get a single client app by ID within a realm\n *\n * Returns detailed information for the specified client app.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Authorization\n * The caller must have `clients:view` permission in the target realm.\n */\nexport const getClientApp2 = <ThrowOnError extends boolean = false>(options: Options<GetClientApp2Data, ThrowOnError>) => (options.client ?? client).get<GetClientApp2Responses, GetClientApp2Errors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/realms/{realmId}/client-apps/{clientAppId}',\n    ...options\n});\n\n/**\n * List users in a realm\n *\n * Returns a paginated list of users in the specified realm.\n * Default page_size is 20, maximum is 100.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Authorization\n * The caller must have `users:view` permission in the target realm.\n */\nexport const listUsers = <ThrowOnError extends boolean = false>(options: Options<ListUsersData, ThrowOnError>) => (options.client ?? client).get<ListUsersResponses, ListUsersErrors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/realms/{realmId}/users',\n    ...options\n});\n\n/**\n * Create a new user in a realm\n *\n * Creates a user in the specified realm. Only principals with `users:create` permission\n * in the target realm may invoke this endpoint.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Authorization\n * The caller must have `users:create` permission in the target realm.\n */\nexport const createUser = <ThrowOnError extends boolean = false>(options: Options<CreateUserData, ThrowOnError>) => (options.client ?? client).post<CreateUserResponses, CreateUserErrors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/realms/{realmId}/users',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get a single user by ID within a realm\n *\n * Returns detailed information for the specified user.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Authorization\n * The caller must have `users:view` permission in the target realm.\n */\nexport const getUser = <ThrowOnError extends boolean = false>(options: Options<GetUserData, ThrowOnError>) => (options.client ?? client).get<GetUserResponses, GetUserErrors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/realms/{realmId}/users/{userId}',\n    ...options\n});\n\n/**\n * Get subscription status for a client app\n *\n * Returns subscription information for the specified client app.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Realm Isolation\n * The API key must belong to the same realm as the client app.\n * Cross-realm requests will return 403 Forbidden.\n *\n * # Example\n * ```bash\n * curl -X GET \\\n * https://api.example.com/api/ext/subscription/client-app-123 \\\n * -H \"X-API-Key: your-api-key\"\n * ```\n */\nexport const getSubscription3 = <ThrowOnError extends boolean = false>(options: Options<GetSubscription3Data, ThrowOnError>) => (options.client ?? client).get<GetSubscription3Responses, GetSubscription3Errors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/subscription/{clientAppId}',\n    ...options\n});\n\n/**\n * Get the currency set supported by a purchasable entitlement\n *\n * Returns the deduplicated currencies covered by the entitlement's enabled\n * Stripe mapping rows (subscription-type and one-time-type rows both count).\n * Creem/IAP rows are excluded: their pricing is provider/store-side and\n * carries no per-currency price rows.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Realm Isolation\n * The API key must belong to the same realm as the requested realm.\n */\nexport const getEntitlementCurrencies = <ThrowOnError extends boolean = false>(options: Options<GetEntitlementCurrenciesData, ThrowOnError>) => (options.client ?? client).get<GetEntitlementCurrenciesResponses, GetEntitlementCurrenciesErrors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/{realmId}/entitlements/{entitlementKey}/currencies',\n    ...options\n});\n\n/**\n * Resolve an entitlement's default price row by currency\n *\n * Filters the entitlement's enabled Stripe mapping rows by the requested\n * currency (plus optional billing type/period filters) and returns the unique\n * match. Fail-loud by design: 404 when no row matches the currency (no\n * secondary-currency fallback), 409 when multiple rows remain and the caller\n * must narrow by billing type/period.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Realm Isolation\n * The API key must belong to the same realm as the requested realm.\n */\nexport const resolveDefaultPrice = <ThrowOnError extends boolean = false>(options: Options<ResolveDefaultPriceData, ThrowOnError>) => (options.client ?? client).get<ResolveDefaultPriceResponses, ResolveDefaultPriceErrors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/{realmId}/entitlements/{entitlementKey}/default-price',\n    ...options\n});\n\n/**\n * Get purchasable one-time entitlement mappings\n *\n * Returns enabled one-time entitlement mappings that have provider product info configured.\n * Used by frontend/SDK to display purchasable products.\n *\n * # Authentication\n * Requires valid API Key via X-API-Key header\n *\n * # Realm Isolation\n * The API key must belong to the same realm as the requested realm.\n * Cross-realm requests will return 403 Forbidden.\n */\nexport const getOneTimeMappings = <ThrowOnError extends boolean = false>(options: Options<GetOneTimeMappingsData, ThrowOnError>) => (options.client ?? client).get<GetOneTimeMappingsResponses, GetOneTimeMappingsErrors, ThrowOnError>({\n    security: [{ name: 'X-API-Key', type: 'apiKey' }],\n    url: '/api/ext/{realmId}/one-time-mappings',\n    ...options\n});\n\nexport const fulfillPayment = <ThrowOnError extends boolean = false>(options: Options<FulfillPaymentData, ThrowOnError>) => (options.client ?? client).post<FulfillPaymentResponses, FulfillPaymentErrors, ThrowOnError>({\n    url: '/api/internal/bill/purchase/payment-attempts/{attemptId}/fulfill',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Caddy On-Demand TLS ask authorization endpoint.\n *\n * Returns `200 {\"authorized\": true}` when `host` matches a published+enabled\n * `custom_domain_mapping` row; `404` on a miss (Caddy declines TLS issuance); `401` when the\n * `X-Herald-Ask-Key` header is missing or mismatches the configured shared\n * secret. Never exposes realm information — this is a certificate-abuse gate.\n */\nexport const handleCustomDomainAuthorize = <ThrowOnError extends boolean = false>(options: Options<HandleCustomDomainAuthorizeData, ThrowOnError>) => (options.client ?? client).get<HandleCustomDomainAuthorizeResponses, HandleCustomDomainAuthorizeErrors, ThrowOnError>({ url: '/api/internal/custom-domain/authorize', ...options });\n\n/**\n * Grant (or idempotently re-grant) a quota entitlement.\n *\n * `idempotency_key` is derived as `internal:{source_id}` so a replayed grant\n * converges on the same row (matching the `UNIQUE(realm_id, user_id, bucket_id,\n * credit_type, idempotency_key)` constraint).\n */\nexport const grantQuotaEntitlement = <ThrowOnError extends boolean = false>(options: Options<GrantQuotaEntitlementData, ThrowOnError>) => (options.client ?? client).post<GrantQuotaEntitlementResponses, GrantQuotaEntitlementErrors, ThrowOnError>({\n    url: '/api/internal/points/{realmId}/quota-entitlement/grant',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Revoke the active quota entitlement identified by `source_id`. Idempotent:\n * a no-match returns `{ revoked: true }` (the post-condition \"no active\n * entitlement\" holds).\n */\nexport const revokeQuotaEntitlement = <ThrowOnError extends boolean = false>(options: Options<RevokeQuotaEntitlementData, ThrowOnError>) => (options.client ?? client).post<RevokeQuotaEntitlementResponses, RevokeQuotaEntitlementErrors, ThrowOnError>({\n    url: '/api/internal/points/{realmId}/quota-entitlement/revoke',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * List both agreement types with their source, current effective version, and\n * version history for the realm.\n *\n * Admin — requires first-party Bearer + `settings.view` + `has_access_to_realm`.\n * `source` is derived per-type from `has_custom` (Custom when a realm custom\n * version exists, otherwise Default).\n */\nexport const adminListAgreements = <ThrowOnError extends boolean = false>(options: Options<AdminListAgreementsData, ThrowOnError>) => (options.client ?? client).get<AdminListAgreementsResponses, AdminListAgreementsErrors, ThrowOnError>({ url: '/api/legal/admin/{realmId}/agreements', ...options });\n\n/**\n * Get a single published version's full body by id (admin history view).\n *\n * Admin — requires first-party Bearer + `settings.view` + `has_access_to_realm`\n * (same gate as `admin_list_agreements`, since this is a read of the same\n * history the list already exposes). Returns 404 when the id does not resolve.\n * The `realmId` path segment scopes the permission check; the version itself is\n * looked up by primary key (history rows already surfaced by the list endpoint\n * are guaranteed to belong to the realm or be the platform default).\n */\nexport const adminGetVersion = <ThrowOnError extends boolean = false>(options: Options<AdminGetVersionData, ThrowOnError>) => (options.client ?? client).get<AdminGetVersionResponses, AdminGetVersionErrors, ThrowOnError>({ url: '/api/legal/admin/{realmId}/agreements/versions/{versionId}', ...options });\n\n/**\n * Publish a new per-realm custom agreement version.\n *\n * Admin — requires first-party Bearer + `settings.manage` + `has_access_to_realm`.\n * Unknown `agreementType` → 400; non-object/empty `content` → 400 (also\n * enforced in the service). On success the service records an\n * `agreement.published` audit event and returns the new version.\n */\nexport const adminPublishCustom = <ThrowOnError extends boolean = false>(options: Options<AdminPublishCustomData, ThrowOnError>) => (options.client ?? client).put<AdminPublishCustomResponses, AdminPublishCustomErrors, ThrowOnError>({\n    url: '/api/legal/admin/{realmId}/agreements/{agreementType}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Revert a realm's agreement to the platform default.\n *\n * Admin — requires first-party Bearer + `settings.manage` + `has_access_to_realm`.\n * Implemented as **snapshot semantics** in the service: the current default\n * body is copied into a brand-new custom version (new `version_id`, monotonic\n * `version_no`), so existing user consent no longer matches and reconsent is\n * triggered. No prior rows are deleted. The handler is a thin pass-through.\n */\nexport const adminRevertToDefault = <ThrowOnError extends boolean = false>(options: Options<AdminRevertToDefaultData, ThrowOnError>) => (options.client ?? client).delete<AdminRevertToDefaultResponses, AdminRevertToDefaultErrors, ThrowOnError>({ url: '/api/legal/admin/{realmId}/agreements/{agreementType}/custom', ...options });\n\n/**\n * Discard the staged draft.\n *\n * Admin — requires first-party Bearer + `settings.manage` + `has_access_to_realm`.\n * Idempotent: discarding a missing draft returns 204. The published version\n * table is untouched.\n */\nexport const adminDiscardDraft = <ThrowOnError extends boolean = false>(options: Options<AdminDiscardDraftData, ThrowOnError>) => (options.client ?? client).delete<AdminDiscardDraftResponses, AdminDiscardDraftErrors, ThrowOnError>({ url: '/api/legal/admin/{realmId}/agreements/{agreementType}/draft', ...options });\n\n/**\n * Get the staged draft for an agreement type.\n *\n * Admin — requires first-party Bearer + `settings.manage` + `has_access_to_realm`.\n * Returns 404 when no draft exists for the type (the admin form treats this as\n * \"start a new draft\").\n */\nexport const adminGetDraft = <ThrowOnError extends boolean = false>(options: Options<AdminGetDraftData, ThrowOnError>) => (options.client ?? client).get<AdminGetDraftResponses, AdminGetDraftErrors, ThrowOnError>({ url: '/api/legal/admin/{realmId}/agreements/{agreementType}/draft', ...options });\n\n/**\n * Save (upsert) a draft for an agreement type.\n *\n * Admin — requires first-party Bearer + `settings.manage` + `has_access_to_realm`.\n * A repeat save overwrites the prior draft. Does NOT publish — the agreement\n * stays unchanged for end users until POST `/publish`.\n */\nexport const adminSaveDraft = <ThrowOnError extends boolean = false>(options: Options<AdminSaveDraftData, ThrowOnError>) => (options.client ?? client).put<AdminSaveDraftResponses, AdminSaveDraftErrors, ThrowOnError>({\n    url: '/api/legal/admin/{realmId}/agreements/{agreementType}/draft',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Publish the staged draft as a new effective version.\n *\n * Admin — requires first-party Bearer + `settings.manage` + `has_access_to_realm`.\n * Reads the draft, creates a new immutable `legal_agreement_version` row\n * (advancing `version_no`, recording an `agreement.published` audit event),\n * and clears the draft. Returns 404 when no draft exists for the type. This is\n * the only path the admin UI uses to publish — there is no \"publish without a\n * draft\" entry in the UI (the legacy `PUT /agreements/{type}` handler remains\n * for backward compatibility).\n */\nexport const adminPublishFromDraft = <ThrowOnError extends boolean = false>(options: Options<AdminPublishFromDraftData, ThrowOnError>) => (options.client ?? client).post<AdminPublishFromDraftResponses, AdminPublishFromDraftErrors, ThrowOnError>({\n    url: '/api/legal/admin/{realmId}/agreements/{agreementType}/publish',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * List the current effective agreements for a realm (Terms + Privacy).\n *\n * Public — no Bearer identity. Each agreement type resolves to its current\n * effective version (realm custom if present, otherwise platform default);\n * missing types are skipped. Returns 404 when no type resolves, which signals\n * a seed-missing deployment anomaly (the platform default templates should\n * always be present).\n */\nexport const listAgreements = <ThrowOnError extends boolean = false>(options: Options<ListAgreementsData, ThrowOnError>) => (options.client ?? client).get<ListAgreementsResponses, ListAgreementsErrors, ThrowOnError>({ url: '/api/legal/{realmId}/agreements', ...options });\n\n/**\n * Get the full localized detail of a single agreement type for a realm.\n *\n * Public — no Bearer identity. Unknown `agreementType` → 400; no effective\n * version deployed → 404.\n */\nexport const getAgreement = <ThrowOnError extends boolean = false>(options: Options<GetAgreementData, ThrowOnError>) => (options.client ?? client).get<GetAgreementResponses, GetAgreementErrors, ThrowOnError>({ url: '/api/legal/{realmId}/agreements/{agreementType}', ...options });\n\n/**\n * Record the user's explicit consent to one or more agreement versions.\n *\n * Self-service — requires Bearer identity. Each `version_id` must equal the\n * current effective version for its type (enforced in the service layer,\n * BE-D04); a stale version surfaces as 409 so the client re-reads the\n * effective version. Returns 204 on success. The upsert is idempotent on a\n * repeat of the same version.\n */\nexport const recordConsent = <ThrowOnError extends boolean = false>(options: Options<RecordConsentData, ThrowOnError>) => (options.client ?? client).post<RecordConsentResponses, RecordConsentErrors, ThrowOnError>({\n    url: '/api/legal/{realmId}/consent',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Reconsent gate verdict for the calling user across both agreement types.\n *\n * Self-service — requires Bearer identity. Cross-realm access is rejected\n * with 403 (each user may only inspect their own realm's consent state).\n */\nexport const getConsentStatus = <ThrowOnError extends boolean = false>(options: Options<GetConsentStatusData, ThrowOnError>) => (options.client ?? client).get<GetConsentStatusResponses, GetConsentStatusErrors, ThrowOnError>({ url: '/api/legal/{realmId}/consent/status', ...options });\n\n/**\n * Apple native login.\n *\n * Verifies an Apple `identityToken` (from `ASAuthorizationAppleIDProvider`)\n * server-side and, depending on `downstreamState`, issues either a direct\n * browser session (Bearer token family bound to `clientId`) or a downstream\n * authorization code for the Code+PKCE flow. Requires the realm to have an\n * enabled Apple provider.\n */\nexport const appleNativeLogin = <ThrowOnError extends boolean = false>(options: Options<AppleNativeLoginData, ThrowOnError>) => (options.client ?? client).post<AppleNativeLoginResponses, AppleNativeLoginErrors, ThrowOnError>({\n    url: '/api/oauth/{realmId}/apple/native-login',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * OAuth authorize endpoint (Authorization Code + PKCE)\n *\n * Initiates the Authorization Code + PKCE flow:\n * 1. Validates client_id exists and is enabled\n * 2. Validates redirect_uri is in whitelist (exact match only)\n * 3. Validates PKCE code_challenge_method (must be S256 if provided)\n * 4. Stores state token with PKCE parameters in Redis (5 minutes TTL)\n * 5. Redirects to login page with OAuth parameters\n *\n * # Arguments\n * * `realm_id` - Realm identifier\n * * `params` - OAuth query parameters (client_id, redirect_uri, state, response_type, code_challenge, code_challenge_method)\n *\n * # Returns\n * * 302 redirect to login page with OAuth parameters\n *\n * # Errors\n * * 400 - Invalid parameters (missing client_id, redirect_uri, state, or code_challenge)\n * * 400 - Invalid response_type (must be \"code\")\n * * 400 - Unsupported code_challenge_method (must be \"S256\")\n * * 404 - Client not found or disabled\n * * 400 - Redirect URI not in whitelist\n */\nexport const oauthAuthorize = <ThrowOnError extends boolean = false>(options: Options<OauthAuthorizeData, ThrowOnError>) => (options.client ?? client).get<unknown, OauthAuthorizeErrors, ThrowOnError>({ url: '/api/oauth/{realmId}/authorize', ...options });\n\n/**\n * List all OAuth provider configurations for a realm\n */\nexport const listOauthConfigs = <ThrowOnError extends boolean = false>(options: Options<ListOauthConfigsData, ThrowOnError>) => (options.client ?? client).get<ListOauthConfigsResponses, ListOauthConfigsErrors, ThrowOnError>({ url: '/api/oauth/{realmId}/configs', ...options });\n\n/**\n * Create OAuth provider configuration\n */\nexport const createOauthConfig = <ThrowOnError extends boolean = false>(options: Options<CreateOauthConfigData, ThrowOnError>) => (options.client ?? client).post<CreateOauthConfigResponses, CreateOauthConfigErrors, ThrowOnError>({\n    url: '/api/oauth/{realmId}/configs',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Delete OAuth provider configuration\n */\nexport const deleteOauthConfig = <ThrowOnError extends boolean = false>(options: Options<DeleteOauthConfigData, ThrowOnError>) => (options.client ?? client).delete<DeleteOauthConfigResponses, DeleteOauthConfigErrors, ThrowOnError>({ url: '/api/oauth/{realmId}/configs/{providerType}', ...options });\n\n/**\n * Get OAuth provider configuration by provider type\n */\nexport const getOauthConfig = <ThrowOnError extends boolean = false>(options: Options<GetOauthConfigData, ThrowOnError>) => (options.client ?? client).get<GetOauthConfigResponses, GetOauthConfigErrors, ThrowOnError>({ url: '/api/oauth/{realmId}/configs/{providerType}', ...options });\n\n/**\n * Update OAuth provider configuration\n */\nexport const updateOauthConfig = <ThrowOnError extends boolean = false>(options: Options<UpdateOauthConfigData, ThrowOnError>) => (options.client ?? client).put<UpdateOauthConfigResponses, UpdateOauthConfigErrors, ThrowOnError>({\n    url: '/api/oauth/{realmId}/configs/{providerType}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Google One Tap login.\n *\n * Verifies a Google One Tap (GIS) ID Token server-side and, depending on\n * `downstreamState`, issues either a direct browser session (Bearer token\n * family bound to `clientId`) or a downstream authorization code for the\n * Code+PKCE flow. Requires the realm to have an enabled Google provider.\n */\nexport const googleOneTap = <ThrowOnError extends boolean = false>(options: Options<GoogleOneTapData, ThrowOnError>) => (options.client ?? client).post<GoogleOneTapResponses, GoogleOneTapErrors, ThrowOnError>({\n    url: '/api/oauth/{realmId}/google/one-tap',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const oauthToken = <ThrowOnError extends boolean = false>(options: Options<OauthTokenData, ThrowOnError>) => (options.client ?? client).post<OauthTokenResponses, OauthTokenErrors, ThrowOnError>({\n    url: '/api/oauth/{realmId}/token',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * WeChat Mini Program login (code2session)\n */\nexport const wechatMiniprogramLogin = <ThrowOnError extends boolean = false>(options: Options<WechatMiniprogramLoginData, ThrowOnError>) => (options.client ?? client).post<WechatMiniprogramLoginResponses, WechatMiniprogramLoginErrors, ThrowOnError>({\n    url: '/api/oauth/{realmId}/wechat-miniprogram/login',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Handle WeChat OAuth callback\n */\nexport const wechatCallback = <ThrowOnError extends boolean = false>(options: Options<WechatCallbackData, ThrowOnError>) => (options.client ?? client).get<unknown, WechatCallbackErrors, ThrowOnError>({ url: '/api/oauth/{realmId}/wechat/callback', ...options });\n\n/**\n * Generate WeChat authorization URL (QRconnect)\n */\nexport const wechatLogin = <ThrowOnError extends boolean = false>(options: Options<WechatLoginData, ThrowOnError>) => (options.client ?? client).get<WechatLoginResponses, WechatLoginErrors, ThrowOnError>({ url: '/api/oauth/{realmId}/wechat/login', ...options });\n\n/**\n * Handle OAuth callback from provider for a realm\n */\nexport const oauthCallback = <ThrowOnError extends boolean = false>(options: Options<OauthCallbackData, ThrowOnError>) => (options.client ?? client).get<OauthCallbackResponses, OauthCallbackErrors, ThrowOnError>({ url: '/api/oauth/{realmId}/{provider}/callback', ...options });\n\n/**\n * Initiate OAuth login flow for a realm\n */\nexport const oauthLogin = <ThrowOnError extends boolean = false>(options: Options<OauthLoginData, ThrowOnError>) => (options.client ?? client).get<OauthLoginResponses, OauthLoginErrors, ThrowOnError>({ url: '/api/oauth/{realmId}/{provider}/login', ...options });\n\n/**\n * Permission check\n *\n * Spec: POST /api/permission/check\n */\nexport const checkPermission2 = <ThrowOnError extends boolean = false>(options: Options<CheckPermission2Data, ThrowOnError>) => (options.client ?? client).post<CheckPermission2Responses, CheckPermission2Errors, ThrowOnError>({\n    url: '/api/permission/check',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * List permissions in the realm\n *\n * List all permission definitions in the realm. Requires `permissions.view` permission.\n */\nexport const listPermissions = <ThrowOnError extends boolean = false>(options: Options<ListPermissionsData, ThrowOnError>) => (options.client ?? client).get<ListPermissionsResponses, ListPermissionsErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/permission/{realmId}/define',\n    ...options\n});\n\n/**\n * Create a new permission\n *\n * Create a new permission definition. Permission name must be in format 'resource.action' (e.g., 'users.manage'). Requires `permissions.manage` permission.\n */\nexport const createPermissionDefinition = <ThrowOnError extends boolean = false>(options: Options<CreatePermissionDefinitionData, ThrowOnError>) => (options.client ?? client).post<CreatePermissionDefinitionResponses, CreatePermissionDefinitionErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/permission/{realmId}/define',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Delete a permission\n *\n * Delete a permission definition. Built-in permissions cannot be deleted. Requires `permissions.manage` permission.\n */\nexport const deletePermission = <ThrowOnError extends boolean = false>(options: Options<DeletePermissionData, ThrowOnError>) => (options.client ?? client).delete<DeletePermissionResponses, DeletePermissionErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/permission/{realmId}/define/{permissionDefinitionId}',\n    ...options\n});\n\n/**\n * Get permission by ID\n */\nexport const getPermission = <ThrowOnError extends boolean = false>(options: Options<GetPermissionData, ThrowOnError>) => (options.client ?? client).get<GetPermissionResponses, GetPermissionErrors, ThrowOnError>({ url: '/api/permission/{realmId}/define/{permissionDefinitionId}', ...options });\n\n/**\n * Update a permission\n *\n * Update permission definition. Built-in permissions cannot be modified. Requires `permissions.manage` permission.\n */\nexport const updatePermission = <ThrowOnError extends boolean = false>(options: Options<UpdatePermissionData, ThrowOnError>) => (options.client ?? client).put<UpdatePermissionResponses, UpdatePermissionErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/permission/{realmId}/define/{permissionDefinitionId}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Create a permission or role assignment\n *\n * Creates either a policy permission (resource/action) or a role assignment (user/role).\n * Requires appropriate permissions based on the operation type.\n */\nexport const createUserPermission = <ThrowOnError extends boolean = false>(options: Options<CreateUserPermissionData, ThrowOnError>) => (options.client ?? client).post<CreateUserPermissionResponses, CreateUserPermissionErrors, ThrowOnError>({\n    url: '/api/permission/{realmId}/permissions',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Delete a permission\n *\n * Corresponds to spec: post /api/permission/:id\n */\nexport const deleteUserPermission = <ThrowOnError extends boolean = false>(options: Options<DeleteUserPermissionData, ThrowOnError>) => (options.client ?? client).post<DeleteUserPermissionResponses, DeleteUserPermissionErrors, ThrowOnError>({\n    url: '/api/permission/{realmId}/permissions/delete',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Permission list (paginated by client ID)\n */\nexport const listPermission = <ThrowOnError extends boolean = false>(options: Options<ListPermissionData, ThrowOnError>) => (options.client ?? client).get<ListPermissionResponses, ListPermissionErrors, ThrowOnError>({ url: '/api/permission/{realmId}/permissions/{clientId}', ...options });\n\n/**\n * Grant points to a user (admin)\n */\nexport const grantPoints = <ThrowOnError extends boolean = false>(options: Options<GrantPointsData, ThrowOnError>) => (options.client ?? client).post<GrantPointsResponses, GrantPointsErrors, ThrowOnError>({\n    url: '/api/points/{realmId}/grant',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get the Realm's registration distribution rules.\n */\nexport const getRegistrationRules = <ThrowOnError extends boolean = false>(options: Options<GetRegistrationRulesData, ThrowOnError>) => (options.client ?? client).get<GetRegistrationRulesResponses, GetRegistrationRulesErrors, ThrowOnError>({ url: '/api/points/{realmId}/registration-rules', ...options });\n\n/**\n * Atomically upsert the Realm's registration distribution rule set.\n */\nexport const upsertRegistrationRules = <ThrowOnError extends boolean = false>(options: Options<UpsertRegistrationRulesData, ThrowOnError>) => (options.client ?? client).put<UpsertRegistrationRulesResponses, UpsertRegistrationRulesErrors, ThrowOnError>({\n    url: '/api/points/{realmId}/registration-rules',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * List points transactions with filters\n */\nexport const listTransactions = <ThrowOnError extends boolean = false>(options: Options<ListTransactionsData, ThrowOnError>) => (options.client ?? client).get<ListTransactionsResponses, ListTransactionsErrors, ThrowOnError>({ url: '/api/points/{realmId}/transactions', ...options });\n\n/**\n * List points wallets. Regular users see their own wallets; managers see all wallets in the realm.\n */\nexport const listWallets = <ThrowOnError extends boolean = false>(options: Options<ListWalletsData, ThrowOnError>) => (options.client ?? client).get<ListWalletsResponses, ListWalletsErrors, ThrowOnError>({ url: '/api/points/{realmId}/wallets', ...options });\n\n/**\n * Get points wallet for a specific user\n */\nexport const getWallet = <ThrowOnError extends boolean = false>(options: Options<GetWalletData, ThrowOnError>) => (options.client ?? client).get<GetWalletResponses, GetWalletErrors, ThrowOnError>({ url: '/api/points/{realmId}/wallets/{userId}', ...options });\n\n/**\n * Resolve the current request host to a published custom-domain realm.\n *\n * Used by the SPA on custom domains before it knows the realm id. This endpoint\n * is intentionally separate from the internal Caddy ask endpoint: the ask\n * endpoint stays shared-secret protected and never leaks realm identity, while\n * this public endpoint is only for hosts already serving the app.\n */\nexport const resolveCustomDomain = <ThrowOnError extends boolean = false>(options?: Options<ResolveCustomDomainData, ThrowOnError>) => (options?.client ?? client).get<ResolveCustomDomainResponses, ResolveCustomDomainErrors, ThrowOnError>({ url: '/api/public-config/custom-domain/resolve', ...options });\n\n/**\n * Get public configuration for a realm\n *\n * Returns publicly accessible configuration for the specified realm, including:\n * - Registration settings (whether registration is allowed and if email verification is required)\n * - List of enabled OAuth providers\n * - Published white-label settings\n *\n * This endpoint does not require authentication.\n */\nexport const getPublicConfig = <ThrowOnError extends boolean = false>(options: Options<GetPublicConfigData, ThrowOnError>) => (options.client ?? client).get<GetPublicConfigResponses, GetPublicConfigErrors, ThrowOnError>({ url: '/api/public-config/{realmId}', ...options });\n\n/**\n * List all realms (non-paginated, deprecated - use list_realms_paginated)\n */\nexport const listRealms2 = <ThrowOnError extends boolean = false>(options?: Options<ListRealms2Data, ThrowOnError>) => (options?.client ?? client).get<ListRealms2Responses, ListRealms2Errors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms',\n    ...options\n});\n\n/**\n * Create a new realm\n */\nexport const createRealm2 = <ThrowOnError extends boolean = false>(options: Options<CreateRealm2Data, ThrowOnError>) => (options.client ?? client).post<CreateRealm2Responses, CreateRealm2Errors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * List realms with pagination\n */\nexport const listRealmsPaginated = <ThrowOnError extends boolean = false>(options?: Options<ListRealmsPaginatedData, ThrowOnError>) => (options?.client ?? client).get<ListRealmsPaginatedResponses, ListRealmsPaginatedErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/paginated',\n    ...options\n});\n\n/**\n * Get realm by ID\n */\nexport const getRealm2 = <ThrowOnError extends boolean = false>(options: Options<GetRealm2Data, ThrowOnError>) => (options.client ?? client).get<GetRealm2Responses, GetRealm2Errors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}',\n    ...options\n});\n\n/**\n * Update realm\n */\nexport const updateRealm = <ThrowOnError extends boolean = false>(options: Options<UpdateRealmData, ThrowOnError>) => (options.client ?? client).put<UpdateRealmResponses, UpdateRealmErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * List all Credit Buckets for a realm.\n */\nexport const listCreditBucketsHandler = <ThrowOnError extends boolean = false>(options: Options<ListCreditBucketsHandlerData, ThrowOnError>) => (options.client ?? client).get<ListCreditBucketsHandlerResponses, ListCreditBucketsHandlerErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/billing/credit-buckets',\n    ...options\n});\n\n/**\n * Create a Credit Bucket.\n */\nexport const createCreditBucketHandler = <ThrowOnError extends boolean = false>(options: Options<CreateCreditBucketHandlerData, ThrowOnError>) => (options.client ?? client).post<CreateCreditBucketHandlerResponses, CreateCreditBucketHandlerErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/billing/credit-buckets',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get the bucket overview matrix.\n *\n * Returns `{ rows: OverviewRow[], grandTotal: ByCreditType }` — `grandTotal`\n * is a SEPARATE top-level field, not appended to rows.\n */\nexport const getBucketOverviewHandler = <ThrowOnError extends boolean = false>(options: Options<GetBucketOverviewHandlerData, ThrowOnError>) => (options.client ?? client).get<GetBucketOverviewHandlerResponses, GetBucketOverviewHandlerErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/billing/credit-buckets/overview',\n    ...options\n});\n\n/**\n * Delete a Credit Bucket (DELETE).\n *\n * 204 on success; 409 `bucket_in_use` with `{ code, activeSubscriptions,\n * holdersWithBalance }` when in-flight subscriptions or residual balances exist.\n */\nexport const deleteCreditBucketHandler = <ThrowOnError extends boolean = false>(options: Options<DeleteCreditBucketHandlerData, ThrowOnError>) => (options.client ?? client).delete<DeleteCreditBucketHandlerResponses, DeleteCreditBucketHandlerErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/billing/credit-buckets/{bucketId}',\n    ...options\n});\n\n/**\n * Get a single Credit Bucket with coverage set and attached mappings.\n */\nexport const getCreditBucketHandler = <ThrowOnError extends boolean = false>(options: Options<GetCreditBucketHandlerData, ThrowOnError>) => (options.client ?? client).get<GetCreditBucketHandlerResponses, GetCreditBucketHandlerErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/billing/credit-buckets/{bucketId}',\n    ...options\n});\n\n/**\n * Update a Credit Bucket (PUT). Coverage set is fully replaced.\n */\nexport const updateCreditBucketHandler = <ThrowOnError extends boolean = false>(options: Options<UpdateCreditBucketHandlerData, ThrowOnError>) => (options.client ?? client).put<UpdateCreditBucketHandlerResponses, UpdateCreditBucketHandlerErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/billing/credit-buckets/{bucketId}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get custom-domain management state.\n */\nexport const handleGetCustomDomainConfig = <ThrowOnError extends boolean = false>(options: Options<HandleGetCustomDomainConfigData, ThrowOnError>) => (options.client ?? client).get<HandleGetCustomDomainConfigResponses, HandleGetCustomDomainConfigErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/config/custom-domain',\n    ...options\n});\n\n/**\n * Update custom-domain configuration (writes the host→realm mapping).\n */\nexport const handleUpdateCustomDomainConfig = <ThrowOnError extends boolean = false>(options: Options<HandleUpdateCustomDomainConfigData, ThrowOnError>) => (options.client ?? client).put<HandleUpdateCustomDomainConfigResponses, HandleUpdateCustomDomainConfigErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/config/custom-domain',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get realm Email OTP configuration\n *\n * Retrieves the Email OTP configuration (login enabled + auto-register) for a\n * realm. Requires 'settings.view' permission. Defaults to\n * `{ enabled: false, auto_register: false }` when no config exists.\n */\nexport const handleGetRealmEmailOtpConfig = <ThrowOnError extends boolean = false>(options: Options<HandleGetRealmEmailOtpConfigData, ThrowOnError>) => (options.client ?? client).get<HandleGetRealmEmailOtpConfigResponses, HandleGetRealmEmailOtpConfigErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/config/email-otp',\n    ...options\n});\n\n/**\n * Update realm Email OTP configuration\n *\n * Enables/disables Email OTP login for a realm and separately controls whether\n * unregistered emails are auto-registered on successful verification. Requires\n * 'settings.manage' permission. Stored as `ConfigType::EmailOtp` /\n * `config_key=\"settings\"` JSON.\n */\nexport const handleUpdateRealmEmailOtpConfig = <ThrowOnError extends boolean = false>(options: Options<HandleUpdateRealmEmailOtpConfigData, ThrowOnError>) => (options.client ?? client).put<HandleUpdateRealmEmailOtpConfigResponses, HandleUpdateRealmEmailOtpConfigErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/config/email-otp',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get realm Passkey configuration\n *\n * Retrieves the Passkey configuration for a realm. Requires 'settings.view' permission.\n */\nexport const handleGetRealmPasskeyConfig = <ThrowOnError extends boolean = false>(options: Options<HandleGetRealmPasskeyConfigData, ThrowOnError>) => (options.client ?? client).get<HandleGetRealmPasskeyConfigResponses, HandleGetRealmPasskeyConfigErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/config/passkey',\n    ...options\n});\n\n/**\n * Update realm Passkey configuration\n *\n * Updates the Passkey configuration for a realm, including whether Passkey authentication is enabled.\n * Requires 'settings.manage' permission.\n */\nexport const handleUpdateRealmPasskeyConfig = <ThrowOnError extends boolean = false>(options: Options<HandleUpdateRealmPasskeyConfigData, ThrowOnError>) => (options.client ?? client).put<HandleUpdateRealmPasskeyConfigResponses, HandleUpdateRealmPasskeyConfigErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/config/passkey',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get realm TOTP configuration and statistics\n *\n * Retrieves the TOTP configuration for a realm along with statistics about TOTP adoption\n * including total users, enabled users, disabled users, and enablement rate. Requires 'settings.view' permission.\n */\nexport const handleGetRealmTotpConfig = <ThrowOnError extends boolean = false>(options: Options<HandleGetRealmTotpConfigData, ThrowOnError>) => (options.client ?? client).get<HandleGetRealmTotpConfigResponses, HandleGetRealmTotpConfigErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/config/totp',\n    ...options\n});\n\n/**\n * Update realm TOTP configuration\n *\n * Updates the TOTP (Time-based One-Time Password) configuration for a realm, including whether TOTP is enabled\n * and whether it is force-required for all users. Requires 'settings.manage' permission.\n */\nexport const handleUpdateRealmTotpConfig = <ThrowOnError extends boolean = false>(options: Options<HandleUpdateRealmTotpConfigData, ThrowOnError>) => (options.client ?? client).put<HandleUpdateRealmTotpConfigResponses, HandleUpdateRealmTotpConfigErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/config/totp',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get white-label management state.\n */\nexport const handleGetWhiteLabelConfig = <ThrowOnError extends boolean = false>(options: Options<HandleGetWhiteLabelConfigData, ThrowOnError>) => (options.client ?? client).get<HandleGetWhiteLabelConfigResponses, HandleGetWhiteLabelConfigErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/config/white-label',\n    ...options\n});\n\n/**\n * Discard white-label draft.\n */\nexport const handleDiscardWhiteLabelDraft = <ThrowOnError extends boolean = false>(options: Options<HandleDiscardWhiteLabelDraftData, ThrowOnError>) => (options.client ?? client).delete<HandleDiscardWhiteLabelDraftResponses, HandleDiscardWhiteLabelDraftErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/config/white-label/draft',\n    ...options\n});\n\n/**\n * Save white-label draft without publishing.\n */\nexport const handleSaveWhiteLabelDraft = <ThrowOnError extends boolean = false>(options: Options<HandleSaveWhiteLabelDraftData, ThrowOnError>) => (options.client ?? client).put<HandleSaveWhiteLabelDraftResponses, HandleSaveWhiteLabelDraftErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/config/white-label/draft',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Publish request body or the existing white-label draft.\n */\nexport const handlePublishWhiteLabelConfig = <ThrowOnError extends boolean = false>(options: Options<HandlePublishWhiteLabelConfigData, ThrowOnError>) => (options.client ?? client).post<HandlePublishWhiteLabelConfigResponses, HandlePublishWhiteLabelConfigErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/config/white-label/publish',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Restore previous white-label settings.\n */\nexport const handleRestoreWhiteLabelConfig = <ThrowOnError extends boolean = false>(options: Options<HandleRestoreWhiteLabelConfigData, ThrowOnError>) => (options.client ?? client).post<HandleRestoreWhiteLabelConfigResponses, HandleRestoreWhiteLabelConfigErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/realms/{realmId}/config/white-label/restore',\n    ...options\n});\n\nexport const getFeatureAvailability = <ThrowOnError extends boolean = false>(options: Options<GetFeatureAvailabilityData, ThrowOnError>) => (options.client ?? client).get<GetFeatureAvailabilityResponses, GetFeatureAvailabilityErrors, ThrowOnError>({ url: '/api/realms/{realmId}/feature-availability', ...options });\n\n/**\n * List roles in the realm\n *\n * List all role definitions for the admin-web-console client. Requires `roles.view` permission.\n */\nexport const listRoles = <ThrowOnError extends boolean = false>(options: Options<ListRolesData, ThrowOnError>) => (options.client ?? client).get<ListRolesResponses, ListRolesErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/roles/{realmId}/define',\n    ...options\n});\n\n/**\n * Create a new role\n *\n * Create a new role definition. Requires `roles.manage` permission.\n */\nexport const createRole = <ThrowOnError extends boolean = false>(options: Options<CreateRoleData, ThrowOnError>) => (options.client ?? client).post<CreateRoleResponses, CreateRoleErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/roles/{realmId}/define',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Delete a role\n *\n * Delete a role definition. Built-in roles cannot be deleted. Requires `roles.manage` permission.\n */\nexport const deleteRole = <ThrowOnError extends boolean = false>(options: Options<DeleteRoleData, ThrowOnError>) => (options.client ?? client).delete<DeleteRoleResponses, DeleteRoleErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/roles/{realmId}/define/{roleId}',\n    ...options\n});\n\n/**\n * Get role by ID\n */\nexport const getRole = <ThrowOnError extends boolean = false>(options: Options<GetRoleData, ThrowOnError>) => (options.client ?? client).get<GetRoleResponses, GetRoleErrors, ThrowOnError>({ url: '/api/roles/{realmId}/define/{roleId}', ...options });\n\n/**\n * Update a role\n *\n * Update role definition name and description. Requires `roles.manage` permission.\n */\nexport const updateRole = <ThrowOnError extends boolean = false>(options: Options<UpdateRoleData, ThrowOnError>) => (options.client ?? client).put<UpdateRoleResponses, UpdateRoleErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/roles/{realmId}/define/{roleId}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get permissions for a role\n */\nexport const getRolePermissions = <ThrowOnError extends boolean = false>(options: Options<GetRolePermissionsData, ThrowOnError>) => (options.client ?? client).get<GetRolePermissionsResponses, GetRolePermissionsErrors, ThrowOnError>({ url: '/api/roles/{realmId}/define/{roleId}/permissions', ...options });\n\n/**\n * Assign permission to role\n */\nexport const assignPermissionToRole = <ThrowOnError extends boolean = false>(options: Options<AssignPermissionToRoleData, ThrowOnError>) => (options.client ?? client).post<AssignPermissionToRoleResponses, AssignPermissionToRoleErrors, ThrowOnError>({\n    url: '/api/roles/{realmId}/define/{roleId}/permissions',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Remove permission from role\n */\nexport const removePermissionFromRole = <ThrowOnError extends boolean = false>(options: Options<RemovePermissionFromRoleData, ThrowOnError>) => (options.client ?? client).delete<RemovePermissionFromRoleResponses, RemovePermissionFromRoleErrors, ThrowOnError>({ url: '/api/roles/{realmId}/define/{roleId}/permissions/{permissionId}', ...options });\n\nexport const handleAppleWebhook = <ThrowOnError extends boolean = false>(options: Options<HandleAppleWebhookData, ThrowOnError>) => (options.client ?? client).post<HandleAppleWebhookResponses, unknown, ThrowOnError>({ url: '/api/third/pay/{realmId}/apple/webhooks', ...options });\n\nexport const listPaymentProviders = <ThrowOnError extends boolean = false>(options: Options<ListPaymentProvidersData, ThrowOnError>) => (options.client ?? client).get<ListPaymentProvidersResponses, ListPaymentProvidersErrors, ThrowOnError>({ url: '/api/third/pay/{realmId}/providers', ...options });\n\nexport const wechatWebhookHandler = <ThrowOnError extends boolean = false>(options: Options<WechatWebhookHandlerData, ThrowOnError>) => (options.client ?? client).post<WechatWebhookHandlerResponses, WechatWebhookHandlerErrors, ThrowOnError>({ url: '/api/third/pay/{realmId}/wechat/webhooks', ...options });\n\n/**\n * Self-service account deletion (soft-delete).\n *\n * Requires an authenticated browser token. Anonymizes PII,\n * marks the account `Deleted`, clears TOTP, cancels in-effect subscriptions,\n * revokes all sessions (incl. the caller's), and records a `user.delete`\n * audit event. One-time purchases are NOT refunded. Returns 204 on success —\n * the caller's token is invalidated by the session wipe.\n */\nexport const deleteAccount = <ThrowOnError extends boolean = false>(options: Options<DeleteAccountData, ThrowOnError>) => (options.client ?? client).delete<DeleteAccountResponses, DeleteAccountErrors, ThrowOnError>({\n    url: '/api/user',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const listMyInvoices = <ThrowOnError extends boolean = false>(options?: Options<ListMyInvoicesData, ThrowOnError>) => (options?.client ?? client).get<ListMyInvoicesResponses, ListMyInvoicesErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/bill/invoices',\n    ...options\n});\n\nexport const applyInvoice = <ThrowOnError extends boolean = false>(options: Options<ApplyInvoiceData, ThrowOnError>) => (options.client ?? client).post<ApplyInvoiceResponses, ApplyInvoiceErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/bill/invoices',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Per-resource invoice apply-eligibility (read-only, context-level).\n *\n * Decision order: ownership → provider → policy → seller config →\n * external-invoice-exists, then delegates the verdict to the pure\n * `determine_invoice_apply_route`. The endpoint resolves facts; the pure\n * function owns the rules (single home — avoids divergence from the write\n * path `validate_invoice_creation_policy` / `apply_invoice`).\n */\nexport const getInvoiceApplyEligibility = <ThrowOnError extends boolean = false>(options: Options<GetInvoiceApplyEligibilityData, ThrowOnError>) => (options.client ?? client).get<GetInvoiceApplyEligibilityResponses, GetInvoiceApplyEligibilityErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/bill/invoices/apply-eligibility',\n    ...options\n});\n\nexport const getMyInvoiceScoped = <ThrowOnError extends boolean = false>(options: Options<GetMyInvoiceScopedData, ThrowOnError>) => (options.client ?? client).get<GetMyInvoiceScopedResponses, GetMyInvoiceScopedErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/bill/invoices/{invoiceId}',\n    ...options\n});\n\nexport const downloadMyInvoicePdf = <ThrowOnError extends boolean = false>(options: Options<DownloadMyInvoicePdfData, ThrowOnError>) => (options.client ?? client).get<DownloadMyInvoicePdfResponses, DownloadMyInvoicePdfErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/bill/invoices/{invoiceId}/pdf',\n    ...options\n});\n\nexport const getPurchaseHistory = <ThrowOnError extends boolean = false>(options?: Options<GetPurchaseHistoryData, ThrowOnError>) => (options?.client ?? client).get<GetPurchaseHistoryResponses, GetPurchaseHistoryErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/bill/purchase/history',\n    ...options\n});\n\n/**\n * Change password for current user\n */\nexport const changeUserPassword = <ThrowOnError extends boolean = false>(options: Options<ChangeUserPasswordData, ThrowOnError>) => (options.client ?? client).post<ChangeUserPasswordResponses, ChangeUserPasswordErrors, ThrowOnError>({\n    url: '/api/user/change-password',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const getUserFeatureAvailability = <ThrowOnError extends boolean = false>(options?: Options<GetUserFeatureAvailabilityData, ThrowOnError>) => (options?.client ?? client).get<GetUserFeatureAvailabilityResponses, GetUserFeatureAvailabilityErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/feature-availability',\n    ...options\n});\n\nexport const handleListPasskeyCredentials = <ThrowOnError extends boolean = false>(options?: Options<HandleListPasskeyCredentialsData, ThrowOnError>) => (options?.client ?? client).get<HandleListPasskeyCredentialsResponses, HandleListPasskeyCredentialsErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/passkey/credentials',\n    ...options\n});\n\nexport const handleDeletePasskeyCredential = <ThrowOnError extends boolean = false>(options: Options<HandleDeletePasskeyCredentialData, ThrowOnError>) => (options.client ?? client).delete<HandleDeletePasskeyCredentialResponses, HandleDeletePasskeyCredentialErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/passkey/credentials/{credentialId}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const handleRenamePasskeyCredential = <ThrowOnError extends boolean = false>(options: Options<HandleRenamePasskeyCredentialData, ThrowOnError>) => (options.client ?? client).patch<HandleRenamePasskeyCredentialResponses, HandleRenamePasskeyCredentialErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/passkey/credentials/{credentialId}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const handleBeginPasskeyRegistration = <ThrowOnError extends boolean = false>(options: Options<HandleBeginPasskeyRegistrationData, ThrowOnError>) => (options.client ?? client).post<HandleBeginPasskeyRegistrationResponses, HandleBeginPasskeyRegistrationErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/passkey/registration/begin',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const handleFinishPasskeyRegistration = <ThrowOnError extends boolean = false>(options: Options<HandleFinishPasskeyRegistrationData, ThrowOnError>) => (options.client ?? client).post<HandleFinishPasskeyRegistrationResponses, HandleFinishPasskeyRegistrationErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/passkey/registration/finish',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get the current user's permission list\n *\n * Returns the list of all permission names the current user has, used for\n * frontend menu permission control.\n *\n * **has_all field**:\n * Legacy response field kept for compatibility. The user endpoint no longer\n * expands the full set of realm permission definitions and always returns false.\n */\nexport const getCurrentUserPermissions = <ThrowOnError extends boolean = false>(options?: Options<GetCurrentUserPermissionsData, ThrowOnError>) => (options?.client ?? client).get<GetCurrentUserPermissionsResponses, GetCurrentUserPermissionsErrors, ThrowOnError>({ url: '/api/user/permissions', ...options });\n\n/**\n * Get current user profile\n */\nexport const getProfile = <ThrowOnError extends boolean = false>(options?: Options<GetProfileData, ThrowOnError>) => (options?.client ?? client).get<GetProfileResponses, GetProfileErrors, ThrowOnError>({ url: '/api/user/profile', ...options });\n\n/**\n * Update current user profile\n */\nexport const updateProfile = <ThrowOnError extends boolean = false>(options: Options<UpdateProfileData, ThrowOnError>) => (options.client ?? client).put<UpdateProfileResponses, UpdateProfileErrors, ThrowOnError>({\n    url: '/api/user/profile',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const handleBeginReauth = <ThrowOnError extends boolean = false>(options: Options<HandleBeginReauthData, ThrowOnError>) => (options.client ?? client).post<HandleBeginReauthResponses, HandleBeginReauthErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/reauth',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const handleVerifyReauth = <ThrowOnError extends boolean = false>(options: Options<HandleVerifyReauthData, ThrowOnError>) => (options.client ?? client).post<HandleVerifyReauthResponses, HandleVerifyReauthErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/reauth/verify',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get the current user's roles and permissions\n *\n * Returns all roles (role names) and permissions (permission names) of the\n * currently logged-in user. Returns the roles and permissions the user\n * actually holds, without expanding the full set of realm permission definitions.\n */\nexport const getUserRoles = <ThrowOnError extends boolean = false>(options?: Options<GetUserRolesData, ThrowOnError>) => (options?.client ?? client).get<GetUserRolesResponses, GetUserRolesErrors, ThrowOnError>({ url: '/api/user/roles', ...options });\n\n/**\n * Disable TOTP two-factor authentication for the current user\n *\n * Disables TOTP and removes the configuration. Requires password verification.\n * Cannot be disabled if the realm has force-enabled TOTP.\n */\nexport const handleDisableTotp = <ThrowOnError extends boolean = false>(options: Options<HandleDisableTotpData, ThrowOnError>) => (options.client ?? client).delete<HandleDisableTotpResponses, HandleDisableTotpErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/totp',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Enable TOTP two-factor authentication for the current user\n *\n * Initiates TOTP setup by generating a secret key, QR code URL, and backup codes.\n * The user must verify the TOTP code to complete the setup. Requires password verification.\n */\nexport const handleEnableTotp = <ThrowOnError extends boolean = false>(options: Options<HandleEnableTotpData, ThrowOnError>) => (options.client ?? client).post<HandleEnableTotpResponses, HandleEnableTotpErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/totp',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Regenerate TOTP secret and backup codes\n *\n * Generates a new TOTP secret and backup codes, invalidating the old ones.\n * The user must verify the new TOTP code to complete the regeneration. Requires password verification.\n */\nexport const handleRegenerateTotp = <ThrowOnError extends boolean = false>(options: Options<HandleRegenerateTotpData, ThrowOnError>) => (options.client ?? client).post<HandleRegenerateTotpResponses, HandleRegenerateTotpErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/totp/regenerate',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Get TOTP configuration status for the current user\n *\n * Returns the TOTP status including whether it is enabled, when it was enabled,\n * and backup code usage statistics.\n */\nexport const handleGetTotpStatus = <ThrowOnError extends boolean = false>(options?: Options<HandleGetTotpStatusData, ThrowOnError>) => (options?.client ?? client).get<HandleGetTotpStatusResponses, HandleGetTotpStatusErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/totp/status',\n    ...options\n});\n\n/**\n * Verify TOTP setup and enable two-factor authentication\n *\n * Completes the TOTP setup process by verifying the TOTP code generated from the secret.\n * On successful verification, TOTP is enabled for the user account.\n */\nexport const handleVerifyTotpSetup = <ThrowOnError extends boolean = false>(options: Options<HandleVerifyTotpSetupData, ThrowOnError>) => (options.client ?? client).post<HandleVerifyTotpSetupResponses, HandleVerifyTotpSetupErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/totp/verify',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\nexport const listUserTransactions = <ThrowOnError extends boolean = false>(options?: Options<ListUserTransactionsData, ThrowOnError>) => (options?.client ?? client).get<ListUserTransactionsResponses, ListUserTransactionsErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/transactions',\n    ...options\n});\n\nexport const listUserWallets = <ThrowOnError extends boolean = false>(options?: Options<ListUserWalletsData, ThrowOnError>) => (options?.client ?? client).get<ListUserWalletsResponses, ListUserWalletsErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/user/wallets',\n    ...options\n});\n\n/**\n * List users in the realm\n *\n * List users with pagination. Requires `users.view` permission.\n */\nexport const listUsers2 = <ThrowOnError extends boolean = false>(options: Options<ListUsers2Data, ThrowOnError>) => (options.client ?? client).get<ListUsers2Responses, ListUsers2Errors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/users/{realmId}',\n    ...options\n});\n\n/**\n * Create a new user\n *\n * Create a new user with email, password, and optional roles. Requires `users.manage` permission. Realm-admins can only assign the 'user' role unless they also have `roles.manage` permission.\n */\nexport const createUser2 = <ThrowOnError extends boolean = false>(options: Options<CreateUser2Data, ThrowOnError>) => (options.client ?? client).post<CreateUser2Responses, CreateUser2Errors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/users/{realmId}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Delete a user\n *\n * Delete a user from the realm. Requires `users.manage` permission.\n */\nexport const deleteUser = <ThrowOnError extends boolean = false>(options: Options<DeleteUserData, ThrowOnError>) => (options.client ?? client).delete<DeleteUserResponses, DeleteUserErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/users/{realmId}/{userId}',\n    ...options\n});\n\n/**\n * Get user by ID\n *\n * Get detailed information about a specific user. Requires `users.view` permission.\n */\nexport const getUser2 = <ThrowOnError extends boolean = false>(options: Options<GetUser2Data, ThrowOnError>) => (options.client ?? client).get<GetUser2Responses, GetUser2Errors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/users/{realmId}/{userId}',\n    ...options\n});\n\n/**\n * Update a user\n *\n * Update user status or nickname. Email is read-only after creation. Requires `users.manage` permission.\n */\nexport const updateUser = <ThrowOnError extends boolean = false>(options: Options<UpdateUserData, ThrowOnError>) => (options.client ?? client).put<UpdateUserResponses, UpdateUserErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/users/{realmId}/{userId}',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Reset user password (generate 16-character random password)\n */\nexport const resetUserPassword = <ThrowOnError extends boolean = false>(options: Options<ResetUserPasswordData, ThrowOnError>) => (options.client ?? client).post<ResetUserPasswordResponses, ResetUserPasswordErrors, ThrowOnError>({ url: '/api/users/{realmId}/{userId}/reset-password', ...options });\n\n/**\n * Get user roles\n *\n * Returns the list of roles assigned to a specific user.\n */\nexport const adminGetUserRoles = <ThrowOnError extends boolean = false>(options: Options<AdminGetUserRolesData, ThrowOnError>) => (options.client ?? client).get<AdminGetUserRolesResponses, AdminGetUserRolesErrors, ThrowOnError>({ url: '/api/users/{realmId}/{userId}/roles', ...options });\n\n/**\n * Update user roles\n *\n * Updates the roles assigned to a user. Replaces all existing roles with the new list.\n *\n * **Security constraints**:\n * - Realm-admin can only assign \"user\" role, not \"realm-admin\"\n */\nexport const updateUserRoles = <ThrowOnError extends boolean = false>(options: Options<UpdateUserRolesData, ThrowOnError>) => (options.client ?? client).put<UpdateUserRolesResponses, UpdateUserRolesErrors, ThrowOnError>({\n    url: '/api/users/{realmId}/{userId}/roles',\n    ...options,\n    headers: {\n        'Content-Type': 'application/json',\n        ...options.headers\n    }\n});\n\n/**\n * Revoke all sessions for a user\n *\n * Revoke every active browser-token session for a user. Requires `users.manage` permission.\n */\nexport const revokeAllUserSessions = <ThrowOnError extends boolean = false>(options: Options<RevokeAllUserSessionsData, ThrowOnError>) => (options.client ?? client).delete<RevokeAllUserSessionsResponses, RevokeAllUserSessionsErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/users/{realmId}/{userId}/sessions',\n    ...options\n});\n\n/**\n * List a user's active sessions\n *\n * List active browser-token sessions for a specific user. Requires `users.manage` permission.\n */\nexport const listUserSessions = <ThrowOnError extends boolean = false>(options: Options<ListUserSessionsData, ThrowOnError>) => (options.client ?? client).get<ListUserSessionsResponses, ListUserSessionsErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/users/{realmId}/{userId}/sessions',\n    ...options\n});\n\n/**\n * Revoke a single user session\n *\n * Revoke a single browser-token session family for a user. Requires `users.manage` permission.\n */\nexport const revokeUserSession = <ThrowOnError extends boolean = false>(options: Options<RevokeUserSessionData, ThrowOnError>) => (options.client ?? client).delete<RevokeUserSessionResponses, RevokeUserSessionErrors, ThrowOnError>({\n    security: [{ scheme: 'bearer', type: 'http' }],\n    url: '/api/users/{realmId}/{userId}/sessions/{familyId}',\n    ...options\n});\n\n/**\n * Health check endpoint for monitoring and orchestration\n *\n * Used by:\n * - Kubernetes liveness probes (is the service running?)\n * - Kubernetes readiness probes (can the service handle traffic?)\n * - Monitoring systems (Prometheus, Datadog, etc.)\n * - Load balancers (health checks)\n *\n * # Health Criteria\n *\n * The service is considered **healthy** when:\n * - PostgreSQL database is reachable (`SELECT 1` succeeds)\n * - Redis cache is reachable (PING succeeds)\n *\n * # Response Codes\n *\n * - **200 OK**: Service is healthy\n * - **503 Service Unavailable**: Service is unhealthy\n */\nexport const healthCheck = <ThrowOnError extends boolean = false>(options?: Options<HealthCheckData, ThrowOnError>) => (options?.client ?? client).get<HealthCheckResponses, HealthCheckErrors, ThrowOnError>({ url: '/health', ...options });\n","/**\n * Typed, programmatically-discriminable error union (US-JS-008).\n *\n * Every public SDK method rejects with a `HeraldError`. Branch on the stable\n * `kind` field instead of parsing messages.\n */\n\nexport type HeraldErrorKind =\n  /** Non-browser/SSR use without an injected `TokenStorage` adapter. */\n  | 'ssr-no-storage'\n  /** Cross-origin blocked because the page origin is not on the Client App allow-list. */\n  | 'origin-not-allowed'\n  /** Network failure or undifferentiated fetch error. */\n  | 'network'\n  /** 401 — credentials invalid (non-refresh context). */\n  | 'unauthorized'\n  /** 403. */\n  | 'forbidden'\n  /** 404. */\n  | 'not-found'\n  /** Login returned a second-factor challenge where a direct token was expected. */\n  | 'requires-second-factor'\n  /** Login returned a consent-required gate where a direct token was expected. */\n  | 'consent-required'\n  /** Refresh failed / token family revoked / Client App disabled. */\n  | 'session-expired'\n  /** 429. */\n  | 'rate-limited'\n  /** 400 field validation. */\n  | 'validation'\n  /** Any other backend error (carries `code`/`requestId`/`details`). */\n  | 'api'\n\nexport interface HeraldErrorInit {\n  kind: HeraldErrorKind\n  message?: string\n  status?: number\n  /** Backend `ApiError.code` (snake_case slug) when available. */\n  code?: string\n  /** Backend `ApiError.requestId` when available. */\n  requestId?: string\n  /** Backend `ApiError.details` when available. */\n  details?: unknown\n}\n\nexport class HeraldError extends Error {\n  readonly kind: HeraldErrorKind\n  readonly status?: number\n  readonly code?: string\n  readonly requestId?: string\n  readonly details?: unknown\n\n  constructor(init: HeraldErrorInit) {\n    super(init.message ?? init.kind)\n    this.name = 'HeraldError'\n    this.kind = init.kind\n    this.status = init.status\n    this.code = init.code\n    this.requestId = init.requestId\n    this.details = init.details\n  }\n}\n\n/** Backend `ApiError` JSON body shape (`backend/api-base/.../api_error.rs`). */\ninterface ApiErrorBody {\n  status?: number\n  code?: string\n  message?: string\n  error?: string\n  details?: unknown\n  requestId?: string | null\n}\n\nfunction kindForStatus(status: number): HeraldErrorKind {\n  switch (status) {\n    case 400:\n      return 'validation'\n    case 401:\n      return 'unauthorized'\n    case 403:\n      return 'forbidden'\n    case 404:\n      return 'not-found'\n    case 429:\n      return 'rate-limited'\n    default:\n      return 'api'\n  }\n}\n\n/**\n * Map a generated-client op result error to a `HeraldError`.\n *\n * - `response === undefined` ⇒ the underlying `fetch` threw. The browser cannot\n *   reliably distinguish a CORS rejection (origin not pre-registered on the\n *   Client App) from a generic network failure, so we report `network` and hint\n *   at origin pre-registration.\n * - otherwise map by HTTP status, preserving backend `code`/`requestId`/`details`.\n */\nexport function toHeraldError(error: unknown, response: Response | undefined): HeraldError {\n  if (!response) {\n    return new HeraldError({\n      kind: 'network',\n      message:\n        'Network request failed. For cross-origin integrations, ensure the page origin is pre-registered on the Client App (allowed_origins).',\n      details: error,\n    })\n  }\n  const body = (error ?? {}) as ApiErrorBody\n  return new HeraldError({\n    kind: kindForStatus(response.status),\n    status: response.status,\n    message: body.message ?? body.error ?? `HTTP ${response.status}`,\n    code: body.code,\n    requestId: body.requestId ?? undefined,\n    details: body.details,\n  })\n}\n","/**\n * Transport layer (DEC-js-sdk-007): wraps a generated fetch client\n * instance with the Bearer access/refresh token model.\n *\n *   - request interceptor: inject `Authorization: Bearer {accessToken}` from\n *     the in-memory holder (skips the refresh endpoint);\n *   - response interceptor: on a single 401, run a single-flight refresh, swap\n *     the rotated tokens, and replay the original request exactly once\n *     (loop-guarded with `X-Herald-Refresh-Retried`).\n *\n * Each `createHeraldClient` gets its own generated client instance, so multiple\n * clients (and tests) are fully isolated. This is a direct port of the Herald\n * own-frontend wiring (`frontend/src/lib/api-client.ts`), store coupling removed.\n */\n\nimport { createClient } from './generated/client/client.gen'\nimport type { Client, ResolvedRequestOptions } from './generated/client/types.gen'\nimport { refresh } from './generated/sdk.gen'\nimport type { BrowserTokenResponse } from './generated/types.gen'\nimport { toHeraldError } from './errors'\nimport type { AccessTokenHolder, SessionStore } from './session'\nimport type { TokenStorage } from './storage'\n\n/** Marker header so the response interceptor only retries each request once. */\nconst RETRY_HEADER = 'X-Herald-Refresh-Retried'\n/** Path of the refresh endpoint — never Bearer-injected, never auto-refreshed. */\nconst REFRESH_PATH = '/api/auth/browser-token/refresh'\n\nexport interface TransportDeps {\n  baseUrl: string\n  accessTokenHolder: AccessTokenHolder\n  storage: TokenStorage\n  session: SessionStore\n}\n\nexport interface Transport {\n  /** The per-instance generated client; pass to generated ops as `{ client }`. */\n  readonly client: Client\n  /**\n   * Single-flight refresh core shared by the 401 interceptor and the public\n   * `auth.refresh()` bridge: resolves the rotated token set, or `null` when no\n   * refresh token is stored or the refresh failed (both emit\n   * `session-expired`).\n   */\n  readonly refreshTokens: () => Promise<BrowserTokenResponse | null>\n}\n\n/** In-flight refresh promise keyed on the client instance (single-flight). */\ntype RefreshSlot = { __heraldRefresh?: Promise<BrowserTokenResponse | null> | null }\n\n/**\n * Run the refresh exactly once for a batch of concurrent callers sharing this\n * client instance.\n *\n * - No stored refresh token ⇒ resolves `null` WITHOUT an HTTP call, after\n *   emitting `session-expired`: the caller was never (or no longer) in a\n *   restorable session, so the 401 just propagates.\n * - Refresh attempt fails (reuse / expired / family revoked) ⇒ clears the\n *   session and emits `session-expired`, then resolves `null`.\n * - Success ⇒ stores the rotated access + refresh tokens, resolves the set.\n */\nfunction refreshTokens(client: Client, deps: TransportDeps): Promise<BrowserTokenResponse | null> {\n  const rt = deps.storage.getRefreshToken()\n  if (!rt) {\n    // No stored refresh token → the session cannot be restored. Signal expiry\n    // and let the 401 propagate.\n    deps.session.emit({ type: 'session-expired', reason: 'refresh-failed' })\n    return Promise.resolve(null)\n  }\n\n  const inFlight = (client as unknown as RefreshSlot).__heraldRefresh\n  if (inFlight) return inFlight\n\n  const promise = (async () => {\n    try {\n      const { data, error } = await refresh({ client, body: { refreshToken: rt } })\n      if (error || !data) {\n        // 401 reuse-detected / expired / family revoked → clean re-login required.\n        deps.session.emit({ type: 'session-expired', reason: 'family-revoked' })\n        return null\n      }\n      deps.accessTokenHolder.set(data.accessToken)\n      deps.storage.setRefreshToken(data.refreshToken)\n      return data\n    } catch {\n      deps.session.emit({ type: 'session-expired', reason: 'refresh-failed' })\n      return null\n    } finally {\n      ;(client as unknown as RefreshSlot).__heraldRefresh = null\n    }\n  })()\n\n  ;(client as unknown as RefreshSlot).__heraldRefresh = promise\n  return promise\n}\n\n/**\n * Replay the original request after a successful refresh. The generated client\n * rebuilds a fresh `Request` from the options, so we re-issue through the\n * instance client's `request` (which re-applies the now-updated Authorization).\n * We cannot return `result.response` directly: the outer pipeline would read its\n * body a second time, so we reconstruct a fresh `Response` from the parsed payload.\n */\nasync function replayRequest(client: Client, options: Record<string, unknown>): Promise<Response> {\n  const result = (await client.request(options as never)) as {\n    response?: Response\n    data?: unknown\n    error?: unknown\n  }\n  if (!result.response) {\n    return new Response(null, { status: 401 })\n  }\n  const headers = new Headers(result.response.headers)\n  const payload = result.data !== undefined ? result.data : result.error\n  const body = payload !== undefined && payload !== null ? JSON.stringify(payload) : null\n  return new Response(body, { status: result.response.status, headers })\n}\n\n/**\n * Create a per-instance generated client configured with `baseUrl` and the\n * Bearer + silent-refresh interceptors.\n */\nexport function createTransport(deps: TransportDeps): Transport {\n  const client = createClient({ baseUrl: deps.baseUrl })\n\n  // --- Request interceptor: inject Authorization: Bearer ---\n  client.interceptors.request.use((request: Request, options: ResolvedRequestOptions) => {\n    // The refresh endpoint authenticates with the refresh token in the body.\n    if (options.url === REFRESH_PATH) {\n      return request\n    }\n    const accessToken = deps.accessTokenHolder.get()\n    if (!accessToken) {\n      return request\n    }\n    const headers = new Headers(request.headers)\n    if (!headers.has('Authorization')) {\n      headers.set('Authorization', `Bearer ${accessToken}`)\n    }\n    return new Request(request, { headers })\n  })\n\n  // --- Response interceptor: single 401 → refresh → retry once ---\n  client.interceptors.response.use(\n    async (response: Response, request: Request, options: ResolvedRequestOptions) => {\n      if (response.status !== 401) {\n        return response\n      }\n      // Never auto-refresh the refresh endpoint, and never retry a request twice.\n      if (options.url === REFRESH_PATH) {\n        return response\n      }\n      if (request.headers.get(RETRY_HEADER)) {\n        return response\n      }\n\n      const refreshed = (await refreshTokens(client, deps)) !== null\n      if (!refreshed) {\n        // No token to refresh with, or refresh failed → let the 401 propagate.\n        return response\n      }\n\n      // Mark the replay so a subsequent 401 is not refreshed again (loop guard).\n      const replayOptions: Record<string, unknown> = { ...options }\n      const headers = new Headers(\n        (replayOptions.headers as Headers | Record<string, string> | undefined) ?? undefined,\n      )\n      headers.set(RETRY_HEADER, '1')\n      replayOptions.headers = headers\n      return replayRequest(client, replayOptions)\n    },\n  )\n\n  return { client, refreshTokens: () => refreshTokens(client, deps) }\n}\n\n/**\n * Resolve a generated op result envelope to its `data`, or throw a `HeraldError`.\n * The generated client never throws with default options — network and HTTP\n * errors arrive as `{ error, response }` with `data === undefined`.\n */\nexport async function resolveOp<T>(\n  promise: Promise<{ data?: T; error?: unknown; response?: Response }>,\n): Promise<T> {\n  const { data, error, response } = await promise\n  if (data === undefined) {\n    throw toHeraldError(error, response)\n  }\n  return data\n}\n","/**\n * Authentication orchestration (DEC-js-sdk-008 / DEC-js-sdk-010).\n *\n * Each method calls a generated op through the per-instance transport client\n * (auto Bearer + silent refresh), maps the result to SDK public types, and\n * updates the session/token state. Login-family methods normalize the\n * multi-branch 200 into the `LoginResult` discriminated union.\n */\n\nimport {\n  handlePasskey2FaOptions,\n  handlePasskey2FaVerify,\n  handlePasskeyOptions,\n  handlePasskeyVerify,\n  handleVerifyTotp,\n  login,\n  logout,\n  register,\n  resetPasswordRequest,\n  send,\n  status,\n  verify,\n  verifyEmailTrigger,\n} from './generated/sdk.gen'\nimport type { Client } from './generated/client/types.gen'\nimport type { BrowserTokenResponse, StatusResponse } from './generated/types.gen'\nimport { HeraldError, toHeraldError } from './errors'\nimport { resolveOp } from './transport'\nimport type { AccessTokenHolder, SessionStore } from './session'\nimport type { TokenStorage } from './storage'\nimport type {\n  ConsentAgreement,\n  EmailOtpSendResult,\n  HeraldSession,\n  LoginResult,\n  PasskeyLoginBeginResult,\n  SecondFactor,\n} from './types'\nimport type { AssertionResultJSON } from './webauthn'\n\n// --- public payloads ---\n\nexport interface RegisterPayload {\n  email: string\n  password: string\n  username?: string\n  turnstileToken?: string\n}\n\nexport interface TriggerVerifyEmailPayload {\n  email: string\n  turnstileToken?: string\n}\n\nexport interface RequestPasswordResetPayload {\n  email: string\n  turnstileToken?: string\n}\n\nexport interface LoginPayload {\n  username?: string\n  email?: string\n  password: string\n  turnstileToken?: string\n  /** Agreements to satisfy a prior `consent-required` gate. */\n  agreements?: ConsentAgreement[]\n  /**\n   * Optional OAuth context for host apps that drive an authorization-code flow\n   * themselves (e.g. Herald's own frontend with PKCE). When present the backend\n   * answers with `redirectTo`, surfaced as `{ kind: 'oauth-redirect' }`; the SDK\n   * does NOT perform the token exchange (DEC-js-sdk-008 — that stays with the\n   * caller).\n   */\n  oauthClientId?: string\n  redirectUri?: string\n  state?: string\n}\n\nexport interface VerifyTotpPayload {\n  tempToken: string\n  code?: string\n  backupCode?: string\n  agreements?: ConsentAgreement[]\n}\n\nexport interface PasskeyLoginBeginPayload {\n  /** Present for 2FA (after a `requires-second-factor` login); absent for 1FA. */\n  tempToken?: string\n  turnstileToken?: string\n  /**\n   * Optional OAuth context for host apps driving an authorization-code flow\n   * (first-party passkey logins from an OAuth-linked login page). Passkey\n   * verify then answers with `redirectTo` (kind: 'oauth-redirect'); the SDK\n   * does NOT perform the exchange (DEC-js-sdk-008).\n   */\n  oauth?: {\n    clientId: string\n    redirectUri: string\n    state: string\n  }\n}\n\nexport interface PasskeyLoginFinishPayload {\n  authToken: string\n  assertion: AssertionResultJSON\n  /** Present when finishing a 2FA passkey login. */\n  tempToken?: string\n  agreements?: ConsentAgreement[]\n}\n\nexport interface EmailOtpSendPayload {\n  email: string\n  turnstileToken?: string\n  /** Agreements to satisfy a prior `consent_required` conflict on re-send. */\n  agreements?: ConsentAgreement[]\n}\n\nexport interface EmailOtpVerifyPayload {\n  email: string\n  code: string\n  agreements?: ConsentAgreement[]\n}\n\n// --- internal helpers ---\n\nexport interface AuthDeps {\n  realmId: string\n  clientId: string\n  /** Per-instance transport client; routes every op through its interceptors. */\n  client: Client\n  accessTokenHolder: AccessTokenHolder\n  storage: TokenStorage\n  session: SessionStore\n  /** Shared single-flight refresh core (from the transport). */\n  refreshTokens: () => Promise<BrowserTokenResponse | null>\n}\n\nfunction applyTokens(tokens: BrowserTokenResponse, deps: AuthDeps): void {\n  deps.accessTokenHolder.set(tokens.accessToken)\n  deps.storage.setRefreshToken(tokens.refreshToken)\n}\n\nfunction sessionFromLoginSuccess(deps: AuthDeps): HeraldSession {\n  return {\n    authenticated: true,\n    realmId: deps.realmId,\n    userId: null,\n    clientAppId: null,\n    clientId: deps.clientId,\n    credentialClass: 'custom_user_ui',\n    permissions: [],\n    scopes: [],\n  }\n}\n\nfunction sessionFromStatus(s: StatusResponse, deps: AuthDeps): HeraldSession {\n  return {\n    authenticated: s.authenticated,\n    realmId: s.realmId ?? deps.realmId,\n    userId: s.userId ?? null,\n    clientAppId: s.clientAppId ?? null,\n    clientId: s.clientId ?? deps.clientId,\n    credentialClass: s.credentialClass ?? null,\n    permissions: s.permissions ?? [],\n    scopes: s.scopes ?? [],\n  }\n}\n\nfunction normalizeAgreements(raw: unknown): ConsentAgreement[] {\n  if (!Array.isArray(raw)) return []\n  return raw.map((a) => {\n    const o = (a ?? {}) as Record<string, unknown>\n    return {\n      agreementType: String(o['agreementType'] ?? o['agreement_type'] ?? ''),\n      versionId: String(o['versionId'] ?? o['version_id'] ?? ''),\n      // Display passthrough for host apps that render the consent list.\n      ...(a && typeof a === 'object' ? { raw: o } : {}),\n    }\n  })\n}\n\nfunction filterSecondFactors(arr: unknown): SecondFactor[] {\n  return (arr as unknown[]).filter((f): f is SecondFactor => f === 'totp' || f === 'passkey')\n}\n\n/**\n * Discriminate a multi-branch login 200 body (DEC-js-sdk-010) into a\n * `LoginResult`. Success also stores the token set + emits `authenticated`.\n */\nfunction toLoginResult(body: unknown, deps: AuthDeps): LoginResult {\n  const b = (body ?? null) as Record<string, unknown> | null\n\n  if (b && typeof b['accessToken'] === 'string') {\n    applyTokens(b as unknown as BrowserTokenResponse, deps)\n    const session = sessionFromLoginSuccess(deps)\n    deps.session.emit({ type: 'authenticated', session })\n    return { kind: 'success', session }\n  }\n  if (b && b['consentRequired'] === true) {\n    return { kind: 'consent-required', agreements: normalizeAgreements(b['agreements']) }\n  }\n  if (b && Array.isArray(b['secondFactors']) && (b['secondFactors'] as unknown[]).length > 0) {\n    return {\n      kind: 'requires-second-factor',\n      tempToken: String(b['tempToken'] ?? ''),\n      expiresInSeconds: Number(b['expiresInSeconds'] ?? 0),\n      secondFactors: filterSecondFactors(b['secondFactors']),\n      userId: String(b['userId'] ?? ''),\n      realmId: String(b['realmId'] ?? deps.realmId),\n    }\n  }\n  if (b && typeof b['redirectTo'] === 'string') {\n    return { kind: 'oauth-redirect', redirectTo: b['redirectTo'] }\n  }\n  throw new HeraldError({ kind: 'api', message: 'Unrecognized login response shape.' })\n}\n\n// --- factory ---\n\nexport function createAuth(deps: AuthDeps) {\n  const { realmId, client } = deps\n\n  return {\n    async register(payload: RegisterPayload) {\n      const data = await resolveOp(\n        register({\n          client,\n          path: { realmId },\n          body: {\n            clientId: deps.clientId,\n            email: payload.email,\n            password: payload.password,\n            ...(payload.username ? { username: payload.username } : {}),\n            ...(payload.turnstileToken ? { turnstileToken: payload.turnstileToken } : {}),\n          },\n        }),\n      )\n      return { message: data.message, verificationRequired: data.verificationRequired }\n    },\n\n    async triggerVerifyEmail(payload: TriggerVerifyEmailPayload) {\n      const data = await resolveOp(\n        verifyEmailTrigger({\n          client,\n          path: { realmId },\n          body: {\n            clientId: deps.clientId,\n            email: payload.email,\n            ...(payload.turnstileToken ? { turnstileToken: payload.turnstileToken } : {}),\n          },\n        }),\n      )\n      return { message: data.message }\n    },\n\n    async requestPasswordReset(payload: RequestPasswordResetPayload) {\n      const data = await resolveOp(\n        resetPasswordRequest({\n          client,\n          path: { realmId },\n          body: {\n            clientId: deps.clientId,\n            email: payload.email,\n            ...(payload.turnstileToken ? { turnstileToken: payload.turnstileToken } : {}),\n          },\n        }),\n      )\n      return { message: data.message }\n    },\n\n    async login(payload: LoginPayload): Promise<LoginResult> {\n      const body = await resolveOp<unknown>(\n        login({\n          client,\n          path: { realmId },\n          body: {\n            clientId: deps.clientId,\n            password: payload.password,\n            ...(payload.username ? { username: payload.username } : {}),\n            ...(payload.email ? { email: payload.email } : {}),\n            ...(payload.turnstileToken ? { turnstileToken: payload.turnstileToken } : {}),\n            ...(payload.agreements ? { agreements: payload.agreements } : {}),\n            ...(payload.oauthClientId ? { oauthClientId: payload.oauthClientId } : {}),\n            ...(payload.redirectUri ? { redirectUri: payload.redirectUri } : {}),\n            ...(payload.state ? { state: payload.state } : {}),\n          },\n        }),\n      )\n      return toLoginResult(body, deps)\n    },\n\n    async verifyTotp(payload: VerifyTotpPayload): Promise<LoginResult> {\n      const body = await resolveOp<unknown>(\n        handleVerifyTotp({\n          client,\n          path: { realmId },\n          body: {\n            tempToken: payload.tempToken,\n            ...(payload.code ? { code: payload.code } : {}),\n            ...(payload.backupCode ? { backupCode: payload.backupCode } : {}),\n            ...(payload.agreements ? { agreements: payload.agreements } : {}),\n          },\n        }),\n      )\n      return toLoginResult(body, deps)\n    },\n\n    passkey: {\n      async loginBegin(payload: PasskeyLoginBeginPayload): Promise<PasskeyLoginBeginResult> {\n        const data =\n          payload.tempToken !== undefined\n            ? await resolveOp(\n                handlePasskey2FaOptions({\n                  client,\n                  path: { realmId },\n                  body: { tempToken: payload.tempToken },\n                }),\n              )\n            : await resolveOp(\n                handlePasskeyOptions({\n                  client,\n                  path: { realmId },\n                  body: {\n                    clientId: deps.clientId,\n                    ...(payload.turnstileToken ? { turnstileToken: payload.turnstileToken } : {}),\n                    ...(payload.oauth ? { oauth: payload.oauth } : {}),\n                  },\n                }),\n              )\n        return { authToken: data.authToken, options: data.options }\n      },\n\n      async loginFinish(payload: PasskeyLoginFinishPayload): Promise<LoginResult> {\n        const body = await resolveOp<unknown>(\n          payload.tempToken !== undefined\n            ? handlePasskey2FaVerify({\n                client,\n                path: { realmId },\n                body: {\n                  tempToken: payload.tempToken,\n                  authToken: payload.authToken,\n                  assertion: payload.assertion,\n                  ...(payload.agreements ? { agreements: payload.agreements } : {}),\n                },\n              })\n            : handlePasskeyVerify({\n                client,\n                path: { realmId },\n                body: {\n                  authToken: payload.authToken,\n                  assertion: payload.assertion,\n                  ...(payload.agreements ? { agreements: payload.agreements } : {}),\n                },\n              }),\n        )\n        return toLoginResult(body, deps)\n      },\n    },\n\n    loginWithEmailOtp: {\n      /**\n       * Send a passwordless login code. The two 409 control-flow outcomes\n       * (DEC-js-sdk-014) — `consent_required` (auto-register consent gate) and\n       * `email_not_registered` (auto-register off) — resolve as\n       * `{ kind: 'conflict' }` instead of throwing, mirroring the multi-branch\n       * normalization `login()` applies to its 200 bodies. All other HTTP\n       * failures throw `HeraldError`.\n       */\n      async send(payload: EmailOtpSendPayload): Promise<EmailOtpSendResult> {\n        const { data, error, response } = await send({\n          client,\n          path: { realmId },\n          body: {\n            clientId: deps.clientId,\n            email: payload.email,\n            ...(payload.turnstileToken ? { turnstileToken: payload.turnstileToken } : {}),\n            ...(payload.agreements ? { agreements: payload.agreements } : {}),\n          },\n        })\n        if (data) {\n          return { kind: 'sent', message: data.message, expiresInSeconds: data.expiresInSeconds }\n        }\n        const body = (error ?? {}) as Record<string, unknown>\n        const code = body['code']\n        if (\n          response?.status === 409 &&\n          (code === 'consent_required' || code === 'email_not_registered')\n        ) {\n          return {\n            kind: 'conflict',\n            code: String(code),\n            message: String(body['message'] ?? ''),\n            consentRequired: body['consentRequired'] === true,\n            agreements: normalizeAgreements(body['agreements']),\n          }\n        }\n        throw toHeraldError(error, response)\n      },\n\n      async verify(payload: EmailOtpVerifyPayload): Promise<LoginResult> {\n        const body = await resolveOp<unknown>(\n          verify({\n            client,\n            path: { realmId },\n            body: {\n              clientId: deps.clientId,\n              email: payload.email,\n              code: payload.code,\n              ...(payload.agreements ? { agreements: payload.agreements } : {}),\n            },\n          }),\n        )\n        return toLoginResult(body, deps)\n      },\n    },\n\n    async getStatus(): Promise<StatusResponse> {\n      const data = await resolveOp(status({ client }))\n      deps.session.emit({ type: 'authenticated', session: sessionFromStatus(data, deps) })\n      return data\n    },\n\n    /**\n     * Explicitly refresh the Bearer token family (startup restore, proactive\n     * refresh). Single-flight: concurrent calls share one HTTP request with the\n     * 401 auto-refresh interceptor. On success both the in-memory access token\n     * and the stored refresh token are rotated.\n     *\n     * @throws {HeraldError} `kind: 'session-expired'` when no refresh token is\n     *   stored or the refresh failed (reuse / expiry / family revocation); a\n     *   `session-expired` event is emitted either way.\n     */\n    async refresh(): Promise<BrowserTokenResponse> {\n      const tokens = await deps.refreshTokens()\n      if (!tokens) {\n        throw new HeraldError({\n          kind: 'session-expired',\n          message: 'Session refresh failed; sign in again.',\n        })\n      }\n      return tokens\n    },\n\n    async logout() {\n      const data = await resolveOp(logout({ client }))\n      deps.accessTokenHolder.clear()\n      deps.storage.setRefreshToken(null)\n      deps.session.emit({ type: 'logged-out' })\n      return { message: data?.message ?? 'Logged out' }\n    },\n  }\n}\n","/**\n * In-memory access-token holder + session state + events.\n *\n * Mirrors the Herald own-frontend pattern (`frontend/src/stores/auth-store.ts`\n * `accessTokenHolder` + persist), with all framework (Zustand/React) coupling\n * removed.\n */\n\nimport type { HeraldSession, SessionEvent } from './types'\n\n/**\n * Non-persisted, module-instance holder for the access token. A page reload\n * clears it; the transport restores it via a silent refresh on the next 401.\n */\nexport interface AccessTokenHolder {\n  get(): string | null\n  set(token: string | null): void\n  clear(): void\n}\n\nexport function createAccessTokenHolder(): AccessTokenHolder {\n  let token: string | null = null\n  return {\n    get: () => token,\n    set: (t) => {\n      token = t\n    },\n    clear: () => {\n      token = null\n    },\n  }\n}\n\nexport const UNAUTHENTICATED_SESSION: HeraldSession = {\n  authenticated: false,\n  realmId: null,\n  userId: null,\n  clientAppId: null,\n  clientId: null,\n  credentialClass: null,\n  permissions: [],\n  scopes: [],\n}\n\nexport type SessionListener = (event: SessionEvent) => void\n\nexport interface SessionStore {\n  getSession(): HeraldSession\n  setSession(session: HeraldSession | null): void\n  subscribe(listener: SessionListener): () => void\n  emit(event: SessionEvent): void\n}\n\n/**\n * Create a session store. `onChange` is the optional callback supplied via\n * `createHeraldClient({ onSessionChange })`; per-instance listeners can also be\n * added with `subscribe`.\n */\nexport function createSessionStore(onChange?: (event: SessionEvent) => void): SessionStore {\n  let session: HeraldSession = { ...UNAUTHENTICATED_SESSION }\n  const listeners = new Set<SessionListener>()\n\n  return {\n    getSession: () => session,\n    setSession: (s) => {\n      session = s ?? { ...UNAUTHENTICATED_SESSION }\n    },\n    subscribe: (fn) => {\n      listeners.add(fn)\n      return () => {\n        listeners.delete(fn)\n      }\n    },\n    emit: (event) => {\n      if (event.type === 'authenticated') {\n        session = event.session\n      } else if (event.type === 'session-expired' || event.type === 'logged-out') {\n        session = { ...UNAUTHENTICATED_SESSION }\n      }\n      for (const fn of listeners) {\n        fn(event)\n      }\n      onChange?.(event)\n    },\n  }\n}\n","/**\n * Pluggable refresh-token storage (DEC-js-sdk-006).\n *\n * The access token NEVER passes through `TokenStorage` — it lives only in the\n * in-memory holder (`session.ts`). The default implementation persists the\n * (rotating, reuse-detected) refresh token to `localStorage`, matching the\n * Herald own-frontend risk posture. Non-browser / SSR integrators must inject\n * an adapter or use `memoryStorage()`.\n */\n\nimport { HeraldError } from './errors'\n\nexport interface TokenStorage {\n  getRefreshToken(): string | null\n  setRefreshToken(token: string | null): void\n}\n\n/** In-memory storage: nothing survives a page reload. */\nexport function memoryStorage(): TokenStorage {\n  let token: string | null = null\n  return {\n    getRefreshToken: () => token,\n    setRefreshToken: (t) => {\n      token = t\n    },\n  }\n}\n\n/**\n * `localStorage`-backed storage (browser default). Throws `HeraldError\n * { kind: 'ssr-no-storage' }` when `localStorage` is unavailable so SSR/Node\n * misuse fails fast instead of silently no-op'ing.\n */\nexport function localStorageStorage(key: string): TokenStorage {\n  if (typeof localStorage === 'undefined' || localStorage === null) {\n    throw new HeraldError({\n      kind: 'ssr-no-storage',\n      message:\n        'localStorage is unavailable in this environment. Inject a TokenStorage adapter via `storage`, or use memoryStorage().',\n    })\n  }\n  return {\n    getRefreshToken: () => localStorage.getItem(key),\n    setRefreshToken: (t) => {\n      if (t === null) {\n        localStorage.removeItem(key)\n      } else {\n        localStorage.setItem(key, t)\n      }\n    },\n  }\n}\n","/**\n * Client factory (US-JS-001).\n *\n * `createHeraldClient` wires the in-memory access-token holder, the pluggable\n * refresh-token storage, the session store, the transport interceptors, and the\n * auth-orchestration methods into a single client object.\n */\n\nimport { createAuth } from './auth'\nimport { HeraldError } from './errors'\nimport { createAccessTokenHolder, createSessionStore } from './session'\nimport { createTransport } from './transport'\nimport { localStorageStorage } from './storage'\nimport type { TokenStorage } from './storage'\nimport type { HeraldSession, SessionEvent } from './types'\n\nexport interface HeraldClientConfig {\n  /** Herald API origin (e.g. `https://auth.example.com`). */\n  baseUrl: string\n  /** Realm the integration belongs to. */\n  realmId: string\n  /** Client App identifier; injected into request bodies. */\n  clientId: string\n  /** Refresh-token storage. Defaults to `localStorage`; inject in SSR. */\n  storage?: TokenStorage\n  /** `localStorage` key for the refresh token (default `herald.refreshToken`). */\n  storageKey?: string\n  /** Session lifecycle callback (`authenticated` / `session-expired` / `logged-out`). */\n  onSessionChange?: (event: SessionEvent) => void\n}\n\nexport type HeraldClient = ReturnType<typeof createAuth> & {\n  /** The resolved refresh-token storage. */\n  readonly storage: TokenStorage\n  /** Current session snapshot + per-instance event subscription. */\n  readonly session: {\n    getSession(): HeraldSession\n    subscribe(listener: (event: SessionEvent) => void): () => void\n  }\n  /** First-party token bridge: inspect / inject the token family from the host app. */\n  readonly tokens: TokenBridge\n}\n\n/** Token set obtained outside the SDK (PKCE exchange, switch-client, direct-issue responses). */\nexport interface SetTokensPayload {\n  accessToken: string\n  refreshToken: string\n  /**\n   * When provided, rebinds the client's request-body `clientId` (e.g. after a\n   * first-party PKCE exchange or a switch-client performed by the host app).\n   */\n  clientId?: string\n}\n\nexport interface TokenBridge {\n  /** Current in-memory access token (null after a reload, until refreshed). */\n  getAccessToken(): string | null\n  /**\n   * Inject a token set obtained outside the SDK. Pure state update — no session\n   * event is emitted; call `getStatus()` afterwards to hydrate the session.\n   */\n  setTokens(tokens: SetTokensPayload): void\n  /** Clear the access + refresh tokens without calling the server or emitting events. */\n  clear(): void\n  /**\n   * Rebind the request-body `clientId` without touching tokens. First-party\n   * hosts pick between built-in products (e.g. console vs account center) per\n   * flow, before any tokens exist.\n   */\n  bindClientId(clientId: string): void\n}\n\n/**\n * Create a Herald browser client. Each client owns its own generated HTTP\n * client instance, so multiple clients are fully isolated.\n *\n * @throws {HeraldError} `kind: 'ssr-no-storage'` when no `storage` is injected\n *   and `localStorage` is unavailable (SSR / Node).\n */\nexport function createHeraldClient(config: HeraldClientConfig): HeraldClient {\n  const hasLocalStorage = typeof localStorage !== 'undefined' && localStorage !== null\n\n  let storage = config.storage\n  if (!storage) {\n    if (!hasLocalStorage) {\n      throw new HeraldError({\n        kind: 'ssr-no-storage',\n        message:\n          'No TokenStorage adapter was provided and localStorage is unavailable (SSR/Node). Inject a `storage` adapter or use memoryStorage().',\n      })\n    }\n    storage = localStorageStorage(config.storageKey ?? 'herald.refreshToken')\n  }\n\n  const accessTokenHolder = createAccessTokenHolder()\n  const session = createSessionStore(config.onSessionChange)\n\n  const transport = createTransport({\n    baseUrl: config.baseUrl,\n    accessTokenHolder,\n    storage,\n    session,\n  })\n\n  // Mutable on purpose: `tokens.setTokens({ clientId })` rebinds the client's\n  // request-body clientId after a host-app switch-client / PKCE exchange.\n  const authDeps = {\n    realmId: config.realmId,\n    clientId: config.clientId,\n    client: transport.client,\n    accessTokenHolder,\n    storage,\n    session,\n    refreshTokens: transport.refreshTokens,\n  }\n\n  const auth = createAuth(authDeps)\n\n  return {\n    ...auth,\n    storage,\n    session: {\n      getSession: () => session.getSession(),\n      subscribe: (listener) => session.subscribe(listener),\n    },\n    tokens: {\n      getAccessToken: () => accessTokenHolder.get(),\n      setTokens: (tokens) => {\n        accessTokenHolder.set(tokens.accessToken)\n        storage.setRefreshToken(tokens.refreshToken)\n        if (tokens.clientId !== undefined) {\n          authDeps.clientId = tokens.clientId\n        }\n      },\n      clear: () => {\n        accessTokenHolder.clear()\n        storage.setRefreshToken(null)\n      },\n      bindClientId: (clientId) => {\n        authDeps.clientId = clientId\n      },\n    },\n  }\n}\n","/**\n * WebAuthn passkey LOGIN assertion helper.\n *\n * Only `navigator.credentials.get` (assertion) — no registration/create. The\n * SDK never manages authenticators (DEC-js-sdk-001). The integrator passes the\n * server-provided options to `performPasskeyAssertion` and submits the returned\n * assertion to `passkey.loginFinish`.\n *\n * base64url encode/decode is implemented on native `ArrayBuffer` ↔ `string`\n * (no dependency).\n */\n\n/** Server-provided WebAuthn request options, JSON-encoded (base64url fields). */\nexport interface PublicKeyCredentialRequestOptionsJSON {\n  challenge: string\n  rpId?: string\n  timeout?: number\n  userVerification?: UserVerificationRequirement\n  allowCredentials?: Array<{\n    type: 'public-key'\n    id: string\n    transports?: AuthenticatorTransport[]\n  }>\n}\n\n/** Assertion result ready to submit to the passkey verify endpoint. */\nexport interface AssertionResultJSON {\n  id: string\n  rawId: string\n  type: 'public-key'\n  response: {\n    authenticatorData: string\n    clientDataJSON: string\n    signature: string\n    userHandle?: string | null\n  }\n  clientExtensionResults?: Record<string, unknown>\n}\n\n// --- base64url codec (exported for unit testing) ---\n\n/** Decode an unpadded base64url string to an `ArrayBuffer`. */\nexport function base64urlToBuffer(input: string): ArrayBuffer {\n  const b64 = input.replace(/-/g, '+').replace(/_/g, '/')\n  // Re-pad to a multiple of 4.\n  const padded = b64 + '==='.slice((b64.length + 3) % 4)\n  const binary = atob(padded)\n  const bytes = new Uint8Array(binary.length)\n  for (let i = 0; i < binary.length; i += 1) {\n    bytes[i] = binary.charCodeAt(i)\n  }\n  return bytes.buffer\n}\n\n/** Encode an `ArrayBuffer` / `Uint8Array` as an unpadded base64url string. */\nexport function bufferToBase64url(buffer: ArrayBuffer | Uint8Array): string {\n  const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer)\n  let binary = ''\n  for (let i = 0; i < bytes.length; i += 1) {\n    binary += String.fromCharCode(bytes[i] ?? 0)\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/[=]/g, '')\n}\n\n/**\n * Perform a WebAuthn assertion for passkey login.\n *\n * @throws when WebAuthn is unavailable or the user cancels.\n */\nexport async function performPasskeyAssertion(\n  options: PublicKeyCredentialRequestOptionsJSON,\n): Promise<AssertionResultJSON> {\n  if (typeof navigator === 'undefined' || !navigator.credentials?.get) {\n    throw new Error('WebAuthn (navigator.credentials.get) is not available in this environment.')\n  }\n\n  const publicKey: PublicKeyCredentialRequestOptions = {\n    challenge: base64urlToBuffer(options.challenge),\n    ...(options.rpId ? { rpId: options.rpId } : {}),\n    ...(options.timeout !== undefined ? { timeout: options.timeout } : {}),\n    ...(options.userVerification ? { userVerification: options.userVerification } : {}),\n    ...(options.allowCredentials\n      ? {\n          allowCredentials: options.allowCredentials.map((c) => ({\n            type: 'public-key' as const,\n            id: base64urlToBuffer(c.id),\n            ...(c.transports ? { transports: c.transports } : {}),\n          })),\n        }\n      : {}),\n  }\n\n  const credential = (await navigator.credentials.get({ publicKey })) as PublicKeyCredential | null\n  if (!credential) {\n    throw new Error('Passkey assertion returned no credential.')\n  }\n\n  const response = credential.response as AuthenticatorAssertionResponse\n  const result: AssertionResultJSON = {\n    id: credential.id,\n    rawId: bufferToBase64url(credential.rawId),\n    type: 'public-key',\n    response: {\n      authenticatorData: bufferToBase64url(response.authenticatorData),\n      clientDataJSON: bufferToBase64url(response.clientDataJSON),\n      signature: bufferToBase64url(response.signature),\n      ...(response.userHandle ? { userHandle: bufferToBase64url(response.userHandle) } : {}),\n    },\n  }\n\n  // `getClientExtensionResults` is synchronous per the WebAuthn spec. The\n  // result is serialized opaquely to the backend (the verify body holds the\n  // assertion as `unknown`), so cast to the JSON record shape here.\n  if (typeof credential.getClientExtensionResults === 'function') {\n    result.clientExtensionResults =\n      credential.getClientExtensionResults() as unknown as Record<string, unknown>\n  }\n\n  return result\n}\n"],"mappings":"ocAAA,IAAAA,GAAA,GAAAC,GAAAD,GAAA,iBAAAE,EAAA,uBAAAC,GAAA,wBAAAC,EAAA,kBAAAC,GAAA,4BAAAC,KC6DO,IAAMC,EAAqB,CAChC,eAAoBC,GAClB,KAAK,UAAUA,EAAM,CAACC,EAAMC,IAAW,OAAOA,GAAU,SAAWA,EAAM,SAAS,EAAIA,CAAM,CAChG,ECiBO,IAAMC,EAAkB,CAAkB,CAC/C,UAAAC,EACA,WAAAC,EACA,WAAAC,EACA,oBAAAC,EACA,kBAAAC,EACA,qBAAAC,EACA,oBAAAC,EACA,iBAAAC,EACA,WAAAC,EACA,IAAAC,EACA,GAAGC,CACL,IAA8D,CAC5D,IAAIC,EAEEC,EAAQJ,IAAgBK,GAAe,IAAI,QAASC,GAAY,WAAWA,EAASD,CAAE,CAAC,GAiJ7F,MAAO,CAAE,OA/IY,iBAAmB,CACtC,IAAIE,EAAqBV,GAAwB,IAC7CW,EAAU,EACRC,EAASP,EAAQ,QAAU,IAAI,gBAAgB,EAAE,OAEvD,KACM,CAAAO,EAAO,SADA,CAGXD,IAEA,IAAME,EACJR,EAAQ,mBAAmB,QACvBA,EAAQ,QACR,IAAI,QAAQA,EAAQ,OAA6C,EAEnEC,IAAgB,QAClBO,EAAQ,IAAI,gBAAiBP,CAAW,EAG1C,GAAI,CACF,IAAMQ,EAA2B,CAC/B,SAAU,SACV,GAAGT,EACH,KAAMA,EAAQ,eACd,QAAAQ,EACA,OAAAD,CACF,EACIG,EAAU,IAAI,QAAQX,EAAKU,CAAW,EACtCnB,IACFoB,EAAU,MAAMpB,EAAUS,EAAKU,CAAW,GAK5C,IAAME,EAAW,MADFX,EAAQ,OAAS,WAAW,OACbU,CAAO,EAErC,GAAI,CAACC,EAAS,GAAI,MAAM,IAAI,MAAM,eAAeA,EAAS,MAAM,IAAIA,EAAS,UAAU,EAAE,EAEzF,GAAI,CAACA,EAAS,KAAM,MAAM,IAAI,MAAM,yBAAyB,EAE7D,IAAMC,EAASD,EAAS,KAAK,YAAY,IAAI,iBAAmB,EAAE,UAAU,EAExEE,EAAS,GAEPC,EAAe,IAAM,CACzB,GAAI,CACFF,EAAO,OAAO,CAChB,MAAQ,CAER,CACF,EAEAL,EAAO,iBAAiB,QAASO,CAAY,EAE7C,GAAI,CACF,OAAa,CACX,GAAM,CAAE,KAAAC,GAAM,MAAAC,EAAM,EAAI,MAAMJ,EAAO,KAAK,EAC1C,GAAIG,GAAM,MACVF,GAAUG,GAEVH,EAASA,EAAO,QAAQ,QAAS;AAAA,CAAI,EAAE,QAAQ,MAAO;AAAA,CAAI,EAE1D,IAAMI,EAASJ,EAAO,MAAM;AAAA;AAAA,CAAM,EAClCA,EAASI,EAAO,IAAI,GAAK,GAEzB,QAAWC,MAASD,EAAQ,CAC1B,IAAME,GAAQD,GAAM,MAAM;AAAA,CAAI,EACxBE,EAA2B,CAAC,EAC9BC,EAEJ,QAAWC,KAAQH,GACjB,GAAIG,EAAK,WAAW,OAAO,EACzBF,EAAU,KAAKE,EAAK,QAAQ,YAAa,EAAE,CAAC,UACnCA,EAAK,WAAW,QAAQ,EACjCD,EAAYC,EAAK,QAAQ,aAAc,EAAE,UAChCA,EAAK,WAAW,KAAK,EAC9BrB,EAAcqB,EAAK,QAAQ,UAAW,EAAE,UAC/BA,EAAK,WAAW,QAAQ,EAAG,CACpC,IAAMC,EAAS,OAAO,SAASD,EAAK,QAAQ,aAAc,EAAE,EAAG,EAAE,EAC5D,OAAO,MAAMC,CAAM,IACtBlB,EAAakB,EAEjB,CAGF,IAAIC,EACAC,EAAa,GAEjB,GAAIL,EAAU,OAAQ,CACpB,IAAMM,EAAUN,EAAU,KAAK;AAAA,CAAI,EACnC,GAAI,CACFI,EAAO,KAAK,MAAME,CAAO,EACzBD,EAAa,EACf,MAAQ,CACND,EAAOE,CACT,CACF,CAEID,IACE/B,GACF,MAAMA,EAAkB8B,CAAI,EAG1B/B,IACF+B,EAAO,MAAM/B,EAAoB+B,CAAI,IAIzChC,IAAa,CACX,KAAAgC,EACA,MAAOH,EACP,GAAIpB,EACJ,MAAOI,CACT,CAAC,EAEGe,EAAU,SACZ,MAAMI,EAEV,CACF,CACF,QAAE,CACAjB,EAAO,oBAAoB,QAASO,CAAY,EAChDF,EAAO,YAAY,CACrB,CAEA,KACF,OAASe,EAAO,CAId,GAFApC,IAAaoC,CAAK,EAEd/B,IAAwB,QAAaU,GAAWV,EAClD,MAIF,IAAMgC,EAAU,KAAK,IAAIvB,EAAa,IAAMC,EAAU,GAAIT,GAAoB,GAAK,EACnF,MAAMK,EAAM0B,CAAO,CACrB,CACF,CACF,EAE4B,CAEZ,CAClB,ECvNO,IAAMC,GAAyBC,GAA+B,CACnE,OAAQA,EAAO,CACb,IAAK,QACH,MAAO,IACT,IAAK,SACH,MAAO,IACT,IAAK,SACH,MAAO,IACT,QACE,MAAO,GACX,CACF,EAEaC,GAA2BD,GAA+B,CACrE,OAAQA,EAAO,CACb,IAAK,OACH,MAAO,IACT,IAAK,gBACH,MAAO,IACT,IAAK,iBACH,MAAO,MACT,QACE,MAAO,GACX,CACF,EAEaE,GAA0BF,GAAgC,CACrE,OAAQA,EAAO,CACb,IAAK,QACH,MAAO,IACT,IAAK,SACH,MAAO,IACT,IAAK,SACH,MAAO,IACT,QACE,MAAO,GACX,CACF,EAEaG,EAAsB,CAAC,CAClC,cAAAC,EACA,QAAAC,EACA,KAAAC,EACA,MAAAN,EACA,MAAAO,CACF,IAEM,CACJ,GAAI,CAACF,EAAS,CACZ,IAAMG,GACJJ,EAAgBG,EAAQA,EAAM,IAAKE,GAAM,mBAAmBA,CAAW,CAAC,GACxE,KAAKR,GAAwBD,CAAK,CAAC,EACrC,OAAQA,EAAO,CACb,IAAK,QACH,MAAO,IAAIQ,CAAY,GACzB,IAAK,SACH,MAAO,IAAIF,CAAI,IAAIE,CAAY,GACjC,IAAK,SACH,OAAOA,EACT,QACE,MAAO,GAAGF,CAAI,IAAIE,CAAY,EAClC,CACF,CAEA,IAAME,EAAYX,GAAsBC,CAAK,EACvCQ,EAAeD,EAClB,IAAKE,GACAT,IAAU,SAAWA,IAAU,SAC1BI,EAAgBK,EAAI,mBAAmBA,CAAW,EAGpDE,EAAwB,CAC7B,cAAAP,EACA,KAAAE,EACA,MAAOG,CACT,CAAC,CACF,EACA,KAAKC,CAAS,EACjB,OAAOV,IAAU,SAAWA,IAAU,SAAWU,EAAYF,EAAeA,CAC9E,EAEaG,EAA0B,CAAC,CACtC,cAAAP,EACA,KAAAE,EACA,MAAAC,CACF,IAA+B,CAC7B,GAA2BA,GAAU,KACnC,MAAO,GAGT,GAAI,OAAOA,GAAU,SACnB,MAAM,IAAI,MACR,2GACF,EAGF,MAAO,GAAGD,CAAI,IAAIF,EAAgBG,EAAQ,mBAAmBA,CAAK,CAAC,EACrE,EAEaK,EAAuB,CAAC,CACnC,cAAAR,EACA,QAAAC,EACA,KAAAC,EACA,MAAAN,EACA,MAAAO,EACA,UAAAM,CACF,IAGM,CACJ,GAAIN,aAAiB,KACnB,OAAOM,EAAYN,EAAM,YAAY,EAAI,GAAGD,CAAI,IAAIC,EAAM,YAAY,CAAC,GAGzE,GAAIP,IAAU,cAAgB,CAACK,EAAS,CACtC,IAAIS,EAAmB,CAAC,EACxB,OAAO,QAAQP,CAAK,EAAE,QAAQ,CAAC,CAACQ,EAAKN,CAAC,IAAM,CAC1CK,EAAS,CAAC,GAAGA,EAAQC,EAAKX,EAAiBK,EAAe,mBAAmBA,CAAW,CAAC,CAC3F,CAAC,EACD,IAAMD,EAAeM,EAAO,KAAK,GAAG,EACpC,OAAQd,EAAO,CACb,IAAK,OACH,MAAO,GAAGM,CAAI,IAAIE,CAAY,GAChC,IAAK,QACH,MAAO,IAAIA,CAAY,GACzB,IAAK,SACH,MAAO,IAAIF,CAAI,IAAIE,CAAY,GACjC,QACE,OAAOA,CACX,CACF,CAEA,IAAME,EAAYR,GAAuBF,CAAK,EACxCQ,EAAe,OAAO,QAAQD,CAAK,EACtC,IAAI,CAAC,CAACQ,EAAKN,CAAC,IACXE,EAAwB,CACtB,cAAAP,EACA,KAAMJ,IAAU,aAAe,GAAGM,CAAI,IAAIS,CAAG,IAAMA,EACnD,MAAON,CACT,CAAC,CACH,EACC,KAAKC,CAAS,EACjB,OAAOV,IAAU,SAAWA,IAAU,SAAWU,EAAYF,EAAeA,CAC9E,EC3JO,IAAMQ,GAAgB,cAEhBC,GAAwB,CAAC,CAAE,KAAAC,EAAM,IAAKC,CAAK,IAAsB,CAC5E,IAAIC,EAAMD,EACJE,EAAUF,EAAK,MAAMH,EAAa,EACxC,GAAIK,EACF,QAAWC,KAASD,EAAS,CAC3B,IAAIE,EAAU,GACVC,EAAOF,EAAM,UAAU,EAAGA,EAAM,OAAS,CAAC,EAC1CG,EAA6B,SAE7BD,EAAK,SAAS,GAAG,IACnBD,EAAU,GACVC,EAAOA,EAAK,UAAU,EAAGA,EAAK,OAAS,CAAC,GAGtCA,EAAK,WAAW,GAAG,GACrBA,EAAOA,EAAK,UAAU,CAAC,EACvBC,EAAQ,SACCD,EAAK,WAAW,GAAG,IAC5BA,EAAOA,EAAK,UAAU,CAAC,EACvBC,EAAQ,UAGV,IAAMC,EAAQR,EAAKM,CAAI,EAEvB,GAA2BE,GAAU,KACnC,SAGF,GAAI,MAAM,QAAQA,CAAK,EAAG,CACxBN,EAAMA,EAAI,QAAQE,EAAOK,EAAoB,CAAE,QAAAJ,EAAS,KAAAC,EAAM,MAAAC,EAAO,MAAAC,CAAM,CAAC,CAAC,EAC7E,QACF,CAEA,GAAI,OAAOA,GAAU,SAAU,CAC7BN,EAAMA,EAAI,QACRE,EACAM,EAAqB,CACnB,QAAAL,EACA,KAAAC,EACA,MAAAC,EACA,MAAOC,EACP,UAAW,EACb,CAAC,CACH,EACA,QACF,CAEA,GAAID,IAAU,SAAU,CACtBL,EAAMA,EAAI,QACRE,EACA,IAAIO,EAAwB,CAC1B,KAAAL,EACA,MAAOE,CACT,CAAC,CAAC,EACJ,EACA,QACF,CAEA,IAAMI,EAAe,mBACnBL,IAAU,QAAU,IAAIC,CAAe,GAAMA,CAC/C,EACAN,EAAMA,EAAI,QAAQE,EAAOQ,CAAY,CACvC,CAEF,OAAOV,CACT,EAEaW,GAAS,CAAC,CACrB,QAAAC,EACA,KAAAd,EACA,MAAAe,EACA,gBAAAC,EACA,IAAKf,CACP,IAMM,CACJ,IAAMgB,EAAUhB,EAAK,WAAW,GAAG,EAAIA,EAAO,IAAIA,CAAI,GAClDC,GAAOY,GAAW,IAAMG,EACxBjB,IACFE,EAAMH,GAAsB,CAAE,KAAAC,EAAM,IAAAE,CAAI,CAAC,GAE3C,IAAIgB,EAASH,EAAQC,EAAgBD,CAAK,EAAI,GAC9C,OAAIG,EAAO,WAAW,GAAG,IACvBA,EAASA,EAAO,UAAU,CAAC,GAEzBA,IACFhB,GAAO,IAAIgB,CAAM,IAEZhB,CACT,EAEO,SAASiB,EAAoBC,EAIjC,CACD,IAAMC,EAAUD,EAAQ,OAAS,OAGjC,GAFyBC,GAAWD,EAAQ,eAG1C,MAAI,mBAAoBA,EAEpBA,EAAQ,iBAAmB,QAAaA,EAAQ,iBAAmB,GAE1CA,EAAQ,eAAiB,KAI/CA,EAAQ,OAAS,GAAKA,EAAQ,KAAO,KAI9C,GAAIC,EACF,OAAOD,EAAQ,IAKnB,CCtHO,IAAME,GAAe,MAC1BC,EACAC,IACgC,CAChC,IAAMC,EAAQ,OAAOD,GAAa,WAAa,MAAMA,EAASD,CAAI,EAAIC,EAEtE,GAAKC,EAIL,OAAIF,EAAK,SAAW,SACX,UAAUE,CAAK,GAGpBF,EAAK,SAAW,QACX,SAAS,KAAKE,CAAK,CAAC,GAGtBA,CACT,EC3BO,IAAMC,GAAwB,CAAc,CACjD,WAAAC,EAAa,CAAC,EACd,GAAGC,CACL,EAA4B,CAAC,IACFC,GAAmB,CAC1C,IAAMC,EAAmB,CAAC,EAC1B,GAAID,GAAe,OAAOA,GAAgB,SACxC,QAAWE,KAAQF,EAAa,CAC9B,IAAMG,EAAQH,EAAYE,CAAI,EAE9B,GAA2BC,GAAU,KACnC,SAGF,IAAMC,EAAUN,EAAWI,CAAI,GAAKH,EAEpC,GAAI,MAAM,QAAQI,CAAK,EAAG,CACxB,IAAME,EAAkBC,EAAoB,CAC1C,cAAeF,EAAQ,cACvB,QAAS,GACT,KAAAF,EACA,MAAO,OACP,MAAAC,EACA,GAAGC,EAAQ,KACb,CAAC,EACGC,GAAiBJ,EAAO,KAAKI,CAAe,CAClD,SAAW,OAAOF,GAAU,SAAU,CACpC,IAAMI,EAAmBC,EAAqB,CAC5C,cAAeJ,EAAQ,cACvB,QAAS,GACT,KAAAF,EACA,MAAO,aACP,MAAOC,EACP,GAAGC,EAAQ,MACb,CAAC,EACGG,GAAkBN,EAAO,KAAKM,CAAgB,CACpD,KAAO,CACL,IAAME,EAAsBC,EAAwB,CAClD,cAAeN,EAAQ,cACvB,KAAAF,EACA,MAAOC,CACT,CAAC,EACGM,GAAqBR,EAAO,KAAKQ,CAAmB,CAC1D,CACF,CAEF,OAAOR,EAAO,KAAK,GAAG,CACxB,EAOWU,GAAcC,GAAmE,CAC5F,GAAI,CAACA,EAGH,MAAO,SAGT,IAAMC,EAAeD,EAAY,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,EAErD,GAAKC,EAIL,IAAIA,EAAa,WAAW,kBAAkB,GAAKA,EAAa,SAAS,OAAO,EAC9E,MAAO,OAGT,GAAIA,IAAiB,sBACnB,MAAO,WAGT,GACE,CAAC,eAAgB,SAAU,SAAU,QAAQ,EAAE,KAAMC,GAASD,EAAa,WAAWC,CAAI,CAAC,EAE3F,MAAO,OAGT,GAAID,EAAa,WAAW,OAAO,EACjC,MAAO,OAIX,EAEME,GAAoB,CACxBX,EAGAF,IAEKA,EAIH,GAAAE,EAAQ,QAAQ,IAAIF,CAAI,GACxBE,EAAQ,QAAQF,CAAI,GACpBE,EAAQ,QAAQ,IAAI,QAAQ,GAAG,SAAS,GAAGF,CAAI,GAAG,GAL3C,GAYEc,GAAgB,MAAO,CAClC,SAAAC,EACA,GAAGb,CACL,IAGQ,CACN,QAAWc,KAAQD,EAAU,CAC3B,GAAIF,GAAkBX,EAASc,EAAK,IAAI,EACtC,SAGF,IAAMC,EAAQ,MAAMC,GAAaF,EAAMd,EAAQ,IAAI,EAEnD,GAAI,CAACe,EACH,SAGF,IAAMjB,EAAOgB,EAAK,MAAQ,gBAE1B,OAAQA,EAAK,GAAI,CACf,IAAK,QACEd,EAAQ,QACXA,EAAQ,MAAQ,CAAC,GAEnBA,EAAQ,MAAMF,CAAI,EAAIiB,EACtB,MACF,IAAK,SACHf,EAAQ,QAAQ,OAAO,SAAU,GAAGF,CAAI,IAAIiB,CAAK,EAAE,EACnD,MAEF,QACEf,EAAQ,QAAQ,IAAIF,EAAMiB,CAAK,EAC/B,KACJ,CACF,CACF,EAEaE,EAAgCjB,GAC3CkB,GAAO,CACL,QAASlB,EAAQ,QACjB,KAAMA,EAAQ,KACd,MAAOA,EAAQ,MACf,gBACE,OAAOA,EAAQ,iBAAoB,WAC/BA,EAAQ,gBACRP,GAAsBO,EAAQ,eAAe,EACnD,IAAKA,EAAQ,GACf,CAAC,EAEUmB,EAAe,CAACC,EAAWC,IAAsB,CAC5D,IAAMC,EAAS,CAAE,GAAGF,EAAG,GAAGC,CAAE,EAC5B,OAAIC,EAAO,SAAS,SAAS,GAAG,IAC9BA,EAAO,QAAUA,EAAO,QAAQ,UAAU,EAAGA,EAAO,QAAQ,OAAS,CAAC,GAExEA,EAAO,QAAUC,EAAaH,EAAE,QAASC,EAAE,OAAO,EAC3CC,CACT,EAEME,GAAkBC,GAA8C,CACpE,IAAMC,EAAmC,CAAC,EAC1C,OAAAD,EAAQ,QAAQ,CAAC1B,EAAO4B,IAAQ,CAC9BD,EAAQ,KAAK,CAACC,EAAK5B,CAAK,CAAC,CAC3B,CAAC,EACM2B,CACT,EAEaH,EAAe,IACvBE,IACS,CACZ,IAAMG,EAAgB,IAAI,QAC1B,QAAWC,KAAUJ,EAAS,CAC5B,GAAI,CAACI,EACH,SAGF,IAAMC,EAAWD,aAAkB,QAAUL,GAAeK,CAAM,EAAI,OAAO,QAAQA,CAAM,EAE3F,OAAW,CAACF,EAAK5B,CAAK,IAAK+B,EACzB,GAAI/B,IAAU,KACZ6B,EAAc,OAAOD,CAAG,UACf,MAAM,QAAQ5B,CAAK,EAC5B,QAAWgC,KAAKhC,EACd6B,EAAc,OAAOD,EAAKI,CAAW,OAE9BhC,IAAU,QAGnB6B,EAAc,IACZD,EACA,OAAO5B,GAAU,SAAW,KAAK,UAAUA,CAAK,EAAKA,CACvD,CAGN,CACA,OAAO6B,CACT,EAiBMI,EAAN,KAAgC,CAAhC,cACE,SAAiC,CAAC,EAElC,OAAc,CACZ,KAAK,IAAM,CAAC,CACd,CAEA,MAAMC,EAAgC,CACpC,IAAMC,EAAQ,KAAK,oBAAoBD,CAAE,EACrC,KAAK,IAAIC,CAAK,IAChB,KAAK,IAAIA,CAAK,EAAI,KAEtB,CAEA,OAAOD,EAAmC,CACxC,IAAMC,EAAQ,KAAK,oBAAoBD,CAAE,EACzC,MAAO,EAAQ,KAAK,IAAIC,CAAK,CAC/B,CAEA,oBAAoBD,EAAkC,CACpD,OAAI,OAAOA,GAAO,SACT,KAAK,IAAIA,CAAE,EAAIA,EAAK,GAEtB,KAAK,IAAI,QAAQA,CAAE,CAC5B,CAEA,OAAOA,EAA0BE,EAA+C,CAC9E,IAAMD,EAAQ,KAAK,oBAAoBD,CAAE,EACzC,OAAI,KAAK,IAAIC,CAAK,GAChB,KAAK,IAAIA,CAAK,EAAIC,EACXF,GAEF,EACT,CAEA,IAAIE,EAAyB,CAC3B,YAAK,IAAI,KAAKA,CAAE,EACT,KAAK,IAAI,OAAS,CAC3B,CACF,EAQaC,GAAqB,KAK5B,CACJ,MAAO,IAAIJ,EACX,QAAS,IAAIA,EACb,SAAU,IAAIA,CAChB,GAEMK,GAAyB5C,GAAsB,CACnD,cAAe,GACf,MAAO,CACL,QAAS,GACT,MAAO,MACT,EACA,OAAQ,CACN,QAAS,GACT,MAAO,YACT,CACF,CAAC,EAEK6C,GAAiB,CACrB,eAAgB,kBAClB,EAEaC,EAAe,CAC1BC,EAAqD,CAAC,KACR,CAC9C,GAAGC,EACH,QAASH,GACT,QAAS,OACT,gBAAiBD,GACjB,GAAGG,CACL,GCtSO,IAAME,EAAe,CAACC,EAAiB,CAAC,IAAc,CAC3D,IAAIC,EAAUC,EAAaC,EAAa,EAAGH,CAAM,EAE3CI,EAAY,KAAe,CAAE,GAAGH,CAAQ,GAExCI,EAAaL,IACjBC,EAAUC,EAAaD,EAASD,CAAM,EAC/BI,EAAU,GAGbE,EAAeC,GAAuE,EAEtFC,EAAgB,MAAOC,GAA4B,CACvD,IAAMC,EAAO,CACX,GAAGT,EACH,GAAGQ,EACH,MAAOA,EAAQ,OAASR,EAAQ,OAAS,WAAW,MACpD,QAASU,EAAaV,EAAQ,QAASQ,EAAQ,OAAO,EACtD,eAAgB,MAClB,EAEIC,EAAK,UACP,MAAME,GAAc,CAClB,GAAGF,EACH,SAAUA,EAAK,QACjB,CAAC,EAGCA,EAAK,kBACP,MAAMA,EAAK,iBAAiBA,CAAI,EAG9BA,EAAK,OAAS,QAAaA,EAAK,iBAClCA,EAAK,eAAiBA,EAAK,eAAeA,EAAK,IAAI,IAIjDA,EAAK,OAAS,QAAaA,EAAK,iBAAmB,KACrDA,EAAK,QAAQ,OAAO,cAAc,EAGpC,IAAMG,EAAMC,EAASJ,CAAI,EAEzB,MAAO,CAAE,KAAAA,EAAM,IAAAG,CAAI,CACrB,EAEME,EAA6B,MAAON,GAAY,CAEpD,GAAM,CAAE,KAAAC,EAAM,IAAAG,CAAI,EAAI,MAAML,EAAcC,CAAO,EAC3CO,EAAuB,CAC3B,SAAU,SACV,GAAGN,EACH,KAAMO,EAAoBP,CAAI,CAChC,EAEIK,EAAU,IAAI,QAAQF,EAAKG,CAAW,EAE1C,QAAWE,KAAMZ,EAAa,QAAQ,IAChCY,IACFH,EAAU,MAAMG,EAAGH,EAASL,CAAI,GAMpC,IAAMS,EAAST,EAAK,MAChBU,EAEJ,GAAI,CACFA,EAAW,MAAMD,EAAOJ,CAAO,CACjC,OAASM,EAAO,CAEd,IAAIC,EAAaD,EAEjB,QAAWH,KAAMZ,EAAa,MAAM,IAC9BY,IACFI,EAAc,MAAMJ,EAAGG,EAAO,OAAkBN,EAASL,CAAI,GAMjE,GAFAY,EAAaA,GAAe,CAAC,EAEzBZ,EAAK,aACP,MAAMY,EAIR,OAAOZ,EAAK,gBAAkB,OAC1B,OACA,CACE,MAAOY,EACP,QAAAP,EACA,SAAU,MACZ,CACN,CAEA,QAAWG,KAAMZ,EAAa,SAAS,IACjCY,IACFE,EAAW,MAAMF,EAAGE,EAAUL,EAASL,CAAI,GAI/C,IAAMa,EAAS,CACb,QAAAR,EACA,SAAAK,CACF,EAEA,GAAIA,EAAS,GAAI,CACf,IAAMI,GACHd,EAAK,UAAY,OACde,GAAWL,EAAS,QAAQ,IAAI,cAAc,CAAC,EAC/CV,EAAK,UAAY,OAEvB,GAAIU,EAAS,SAAW,KAAOA,EAAS,QAAQ,IAAI,gBAAgB,IAAM,IAAK,CAC7E,IAAIM,EACJ,OAAQF,EAAS,CACf,IAAK,cACL,IAAK,OACL,IAAK,OACHE,EAAY,MAAMN,EAASI,CAAO,EAAE,EACpC,MACF,IAAK,WACHE,EAAY,IAAI,SAChB,MACF,IAAK,SACHA,EAAYN,EAAS,KACrB,MAEF,QACEM,EAAY,CAAC,EACb,KACJ,CACA,OAAOhB,EAAK,gBAAkB,OAC1BgB,EACA,CACE,KAAMA,EACN,GAAGH,CACL,CACN,CAEA,IAAII,EACJ,OAAQH,EAAS,CACf,IAAK,cACL,IAAK,OACL,IAAK,WACL,IAAK,OACHG,EAAO,MAAMP,EAASI,CAAO,EAAE,EAC/B,MACF,IAAK,OAAQ,CAGX,IAAMI,EAAO,MAAMR,EAAS,KAAK,EACjCO,EAAOC,EAAO,KAAK,MAAMA,CAAI,EAAI,CAAC,EAClC,KACF,CACA,IAAK,SACH,OAAOlB,EAAK,gBAAkB,OAC1BU,EAAS,KACT,CACE,KAAMA,EAAS,KACf,GAAGG,CACL,CACR,CAEA,OAAIC,IAAY,SACVd,EAAK,mBACP,MAAMA,EAAK,kBAAkBiB,CAAI,EAG/BjB,EAAK,sBACPiB,EAAO,MAAMjB,EAAK,oBAAoBiB,CAAI,IAIvCjB,EAAK,gBAAkB,OAC1BiB,EACA,CACE,KAAAA,EACA,GAAGJ,CACL,CACN,CAEA,IAAMM,EAAY,MAAMT,EAAS,KAAK,EAClCU,EAEJ,GAAI,CACFA,EAAY,KAAK,MAAMD,CAAS,CAClC,MAAQ,CAER,CAEA,IAAMR,EAAQS,GAAaD,EACvBP,EAAaD,EAEjB,QAAWH,KAAMZ,EAAa,MAAM,IAC9BY,IACFI,EAAc,MAAMJ,EAAGG,EAAOD,EAAUL,EAASL,CAAI,GAMzD,GAFAY,EAAaA,GAAe,CAAC,EAEzBZ,EAAK,aACP,MAAMY,EAIR,OAAOZ,EAAK,gBAAkB,OAC1B,OACA,CACE,MAAOY,EACP,GAAGC,CACL,CACN,EAEMQ,EAAgBC,GAAmCvB,GACvDM,EAAQ,CAAE,GAAGN,EAAS,OAAAuB,CAAO,CAAC,EAE1BC,EAAaD,GAAkC,MAAOvB,GAA4B,CACtF,GAAM,CAAE,KAAAC,EAAM,IAAAG,CAAI,EAAI,MAAML,EAAcC,CAAO,EACjD,OAAOyB,EAAgB,CACrB,GAAGxB,EACH,KAAMA,EAAK,KACX,QAASA,EAAK,QACd,OAAAsB,EACA,UAAW,MAAOnB,EAAKsB,IAAS,CAC9B,IAAIpB,EAAU,IAAI,QAAQF,EAAKsB,CAAI,EACnC,QAAWjB,KAAMZ,EAAa,QAAQ,IAChCY,IACFH,EAAU,MAAMG,EAAGH,EAASL,CAAI,GAGpC,OAAOK,CACT,EACA,eAAgBE,EAAoBP,CAAI,EACxC,IAAAG,CACF,CAAC,CACH,EAEA,MAAO,CACL,SAAAC,EACA,QAASiB,EAAa,SAAS,EAC/B,OAAQA,EAAa,QAAQ,EAC7B,IAAKA,EAAa,KAAK,EACvB,UAAA3B,EACA,KAAM2B,EAAa,MAAM,EACzB,aAAAzB,EACA,QAASyB,EAAa,SAAS,EAC/B,MAAOA,EAAa,OAAO,EAC3B,KAAMA,EAAa,MAAM,EACzB,IAAKA,EAAa,KAAK,EACvB,QAAAhB,EACA,UAAAV,EACA,IAAK,CACH,QAAS4B,EAAU,SAAS,EAC5B,OAAQA,EAAU,QAAQ,EAC1B,IAAKA,EAAU,KAAK,EACpB,KAAMA,EAAU,MAAM,EACtB,QAASA,EAAU,SAAS,EAC5B,MAAOA,EAAU,OAAO,EACxB,KAAMA,EAAU,MAAM,EACtB,IAAKA,EAAU,KAAK,EACpB,MAAOA,EAAU,OAAO,CAC1B,EACA,MAAOF,EAAa,OAAO,CAC7B,CACF,EChRO,IAAMK,EAASC,EAAaC,EAA6B,CAAC,ECuG1D,IAAMC,GAAiDC,IAAiDA,EAAQ,QAAUC,GAAQ,KAAoD,CACzL,IAAK,kCACL,GAAGD,EACH,QAAS,CACL,eAAgB,mBAChB,GAAGA,EAAQ,OACf,CACJ,CAAC,EAYM,IAAME,GAAgDC,IAAiDA,GAAS,QAAUC,GAAQ,KAAkD,CACvL,SAAU,CAAC,CAAE,OAAQ,SAAU,KAAM,MAAO,CAAC,EAC7C,IAAK,mBACL,GAAGD,CACP,CAAC,EAEYE,GAAgDF,IAAiDA,GAAS,QAAUC,GAAQ,IAAiD,CACtL,SAAU,CAAC,CAAE,OAAQ,SAAU,KAAM,MAAO,CAAC,EAC7C,IAAK,mBACL,GAAGD,CACP,CAAC,EAsCM,IAAMG,GAA+CC,IAA+CA,EAAQ,QAAUC,GAAQ,KAAgD,CACjL,IAAK,4BACL,GAAGD,EACH,QAAS,CACL,eAAgB,mBAChB,GAAGA,EAAQ,OACf,CACJ,CAAC,EAaYE,GAA8CF,IAA8CA,EAAQ,QAAUC,GAAQ,KAA8C,CAC7K,IAAK,2CACL,GAAGD,EACH,QAAS,CACL,eAAgB,mBAChB,GAAGA,EAAQ,OACf,CACJ,CAAC,EAUYG,GAAgDH,IAAgDA,EAAQ,QAAUC,GAAQ,KAAkD,CACrL,IAAK,6CACL,GAAGD,EACH,QAAS,CACL,eAAgB,mBAChB,GAAGA,EAAQ,OACf,CACJ,CAAC,EAEYI,GAAiEJ,IAAiEA,EAAQ,QAAUC,GAAQ,KAAoF,CACzP,IAAK,gDACL,GAAGD,EACH,QAAS,CACL,eAAgB,mBAChB,GAAGA,EAAQ,OACf,CACJ,CAAC,EAEYK,GAAgEL,IAAgEA,EAAQ,QAAUC,GAAQ,KAAkF,CACrP,IAAK,+CACL,GAAGD,EACH,QAAS,CACL,eAAgB,mBAChB,GAAGA,EAAQ,OACf,CACJ,CAAC,EAEYM,GAA8DN,IAA8DA,EAAQ,QAAUC,GAAQ,KAA8E,CAC7O,IAAK,4CACL,GAAGD,EACH,QAAS,CACL,eAAgB,mBAChB,GAAGA,EAAQ,OACf,CACJ,CAAC,EAEYO,GAA6DP,IAA6DA,EAAQ,QAAUC,GAAQ,KAA4E,CACzO,IAAK,2CACL,GAAGD,EACH,QAAS,CACL,eAAgB,mBAChB,GAAGA,EAAQ,OACf,CACJ,CAAC,EAQYQ,GAA0DR,IAA0DA,EAAQ,QAAUC,GAAQ,KAAsE,CAC7N,IAAK,wCACL,GAAGD,EACH,QAAS,CACL,eAAgB,mBAChB,GAAGA,EAAQ,OACf,CACJ,CAAC,EAkBM,IAAMS,GAAkDC,IAAkDA,EAAQ,QAAUC,GAAQ,KAAsD,CAC7L,IAAK,+BACL,GAAGD,EACH,QAAS,CACL,eAAgB,mBAChB,GAAGA,EAAQ,OACf,CACJ,CAAC,EAsBM,IAAME,GAA8DC,IAA8DA,EAAQ,QAAUC,GAAQ,KAA8E,CAC7O,IAAK,6CACL,GAAGD,EACH,QAAS,CACL,eAAgB,mBAChB,GAAGA,EAAQ,OACf,CACJ,CAAC,EAoDM,IAAME,GAA4DC,IAA4DA,EAAQ,QAAUC,GAAQ,KAA0E,CACrO,IAAK,2CACL,GAAGD,EACH,QAAS,CACL,eAAgB,mBAChB,GAAGA,EAAQ,OACf,CACJ,CAAC,EC5VM,IAAME,EAAN,cAA0B,KAAM,CAOrC,YAAYC,EAAuB,CACjC,MAAMA,EAAK,SAAWA,EAAK,IAAI,EAC/B,KAAK,KAAO,cACZ,KAAK,KAAOA,EAAK,KACjB,KAAK,OAASA,EAAK,OACnB,KAAK,KAAOA,EAAK,KACjB,KAAK,UAAYA,EAAK,UACtB,KAAK,QAAUA,EAAK,OACtB,CACF,EAYA,SAASC,GAAcC,EAAiC,CACtD,OAAQA,EAAQ,CACd,IAAK,KACH,MAAO,aACT,IAAK,KACH,MAAO,eACT,IAAK,KACH,MAAO,YACT,IAAK,KACH,MAAO,YACT,IAAK,KACH,MAAO,eACT,QACE,MAAO,KACX,CACF,CAWO,SAASC,EAAcC,EAAgBC,EAA6C,CACzF,GAAI,CAACA,EACH,OAAO,IAAIN,EAAY,CACrB,KAAM,UACN,QACE,uIACF,QAASK,CACX,CAAC,EAEH,IAAME,EAAQF,GAAS,CAAC,EACxB,OAAO,IAAIL,EAAY,CACrB,KAAME,GAAcI,EAAS,MAAM,EACnC,OAAQA,EAAS,OACjB,QAASC,EAAK,SAAWA,EAAK,OAAS,QAAQD,EAAS,MAAM,GAC9D,KAAMC,EAAK,KACX,UAAWA,EAAK,WAAa,OAC7B,QAASA,EAAK,OAChB,CAAC,CACH,CC7FA,IAAMC,GAAe,2BAEfC,GAAe,kCAmCrB,SAASC,GAAcC,EAAgBC,EAA2D,CAChG,IAAMC,EAAKD,EAAK,QAAQ,gBAAgB,EACxC,GAAI,CAACC,EAGH,OAAAD,EAAK,QAAQ,KAAK,CAAE,KAAM,kBAAmB,OAAQ,gBAAiB,CAAC,EAChE,QAAQ,QAAQ,IAAI,EAG7B,IAAME,EAAYH,EAAkC,gBACpD,GAAIG,EAAU,OAAOA,EAErB,IAAMC,GAAW,SAAY,CAC3B,GAAI,CACF,GAAM,CAAE,KAAAC,EAAM,MAAAC,CAAM,EAAI,MAAMC,GAAQ,CAAE,OAAAP,EAAQ,KAAM,CAAE,aAAcE,CAAG,CAAE,CAAC,EAC5E,OAAII,GAAS,CAACD,GAEZJ,EAAK,QAAQ,KAAK,CAAE,KAAM,kBAAmB,OAAQ,gBAAiB,CAAC,EAChE,OAETA,EAAK,kBAAkB,IAAII,EAAK,WAAW,EAC3CJ,EAAK,QAAQ,gBAAgBI,EAAK,YAAY,EACvCA,EACT,MAAQ,CACN,OAAAJ,EAAK,QAAQ,KAAK,CAAE,KAAM,kBAAmB,OAAQ,gBAAiB,CAAC,EAChE,IACT,QAAE,CACED,EAAkC,gBAAkB,IACxD,CACF,GAAG,EAEF,OAACA,EAAkC,gBAAkBI,EAC/CA,CACT,CASA,eAAeI,GAAcR,EAAgBS,EAAqD,CAChG,IAAMC,EAAU,MAAMV,EAAO,QAAQS,CAAgB,EAKrD,GAAI,CAACC,EAAO,SACV,OAAO,IAAI,SAAS,KAAM,CAAE,OAAQ,GAAI,CAAC,EAE3C,IAAMC,EAAU,IAAI,QAAQD,EAAO,SAAS,OAAO,EAC7CE,EAAUF,EAAO,OAAS,OAAYA,EAAO,KAAOA,EAAO,MAC3DG,EAAgCD,GAAY,KAAO,KAAK,UAAUA,CAAO,EAAI,KACnF,OAAO,IAAI,SAASC,EAAM,CAAE,OAAQH,EAAO,SAAS,OAAQ,QAAAC,CAAQ,CAAC,CACvE,CAMO,SAASG,GAAgBb,EAAgC,CAC9D,IAAMD,EAASe,EAAa,CAAE,QAASd,EAAK,OAAQ,CAAC,EAGrD,OAAAD,EAAO,aAAa,QAAQ,IAAI,CAACgB,EAAkBP,IAAoC,CAErF,GAAIA,EAAQ,MAAQX,GAClB,OAAOkB,EAET,IAAMC,EAAchB,EAAK,kBAAkB,IAAI,EAC/C,GAAI,CAACgB,EACH,OAAOD,EAET,IAAML,EAAU,IAAI,QAAQK,EAAQ,OAAO,EAC3C,OAAKL,EAAQ,IAAI,eAAe,GAC9BA,EAAQ,IAAI,gBAAiB,UAAUM,CAAW,EAAE,EAE/C,IAAI,QAAQD,EAAS,CAAE,QAAAL,CAAQ,CAAC,CACzC,CAAC,EAGDX,EAAO,aAAa,SAAS,IAC3B,MAAOkB,EAAoBF,EAAkBP,IAAoC,CAa/E,GAZIS,EAAS,SAAW,KAIpBT,EAAQ,MAAQX,IAGhBkB,EAAQ,QAAQ,IAAInB,EAAY,GAKhC,EADe,MAAME,GAAcC,EAAQC,CAAI,IAAO,MAGxD,OAAOiB,EAIT,IAAMC,EAAyC,CAAE,GAAGV,CAAQ,EACtDE,EAAU,IAAI,QACjBQ,EAAc,SAA4D,MAC7E,EACA,OAAAR,EAAQ,IAAId,GAAc,GAAG,EAC7BsB,EAAc,QAAUR,EACjBH,GAAcR,EAAQmB,CAAa,CAC5C,CACF,EAEO,CAAE,OAAAnB,EAAQ,cAAe,IAAMD,GAAcC,EAAQC,CAAI,CAAE,CACpE,CAOA,eAAsBmB,EACpBhB,EACY,CACZ,GAAM,CAAE,KAAAC,EAAM,MAAAC,EAAO,SAAAY,CAAS,EAAI,MAAMd,EACxC,GAAIC,IAAS,OACX,MAAMgB,EAAcf,EAAOY,CAAQ,EAErC,OAAOb,CACT,CCpDA,SAASiB,GAAYC,EAA8BC,EAAsB,CACvEA,EAAK,kBAAkB,IAAID,EAAO,WAAW,EAC7CC,EAAK,QAAQ,gBAAgBD,EAAO,YAAY,CAClD,CAEA,SAASE,GAAwBD,EAA+B,CAC9D,MAAO,CACL,cAAe,GACf,QAASA,EAAK,QACd,OAAQ,KACR,YAAa,KACb,SAAUA,EAAK,SACf,gBAAiB,iBACjB,YAAa,CAAC,EACd,OAAQ,CAAC,CACX,CACF,CAEA,SAASE,GAAkBC,EAAmBH,EAA+B,CAC3E,MAAO,CACL,cAAeG,EAAE,cACjB,QAASA,EAAE,SAAWH,EAAK,QAC3B,OAAQG,EAAE,QAAU,KACpB,YAAaA,EAAE,aAAe,KAC9B,SAAUA,EAAE,UAAYH,EAAK,SAC7B,gBAAiBG,EAAE,iBAAmB,KACtC,YAAaA,EAAE,aAAe,CAAC,EAC/B,OAAQA,EAAE,QAAU,CAAC,CACvB,CACF,CAEA,SAASC,GAAoBC,EAAkC,CAC7D,OAAK,MAAM,QAAQA,CAAG,EACfA,EAAI,IAAKC,GAAM,CACpB,IAAMC,EAAKD,GAAK,CAAC,EACjB,MAAO,CACL,cAAe,OAAOC,EAAE,eAAoBA,EAAE,gBAAqB,EAAE,EACrE,UAAW,OAAOA,EAAE,WAAgBA,EAAE,YAAiB,EAAE,EAEzD,GAAID,GAAK,OAAOA,GAAM,SAAW,CAAE,IAAKC,CAAE,EAAI,CAAC,CACjD,CACF,CAAC,EAT+B,CAAC,CAUnC,CAEA,SAASC,GAAoBC,EAA8B,CACzD,OAAQA,EAAkB,OAAQC,GAAyBA,IAAM,QAAUA,IAAM,SAAS,CAC5F,CAMA,SAASC,EAAcC,EAAeZ,EAA6B,CACjE,IAAMa,EAAKD,GAAQ,KAEnB,GAAIC,GAAK,OAAOA,EAAE,aAAmB,SAAU,CAC7Cf,GAAYe,EAAsCb,CAAI,EACtD,IAAMc,EAAUb,GAAwBD,CAAI,EAC5C,OAAAA,EAAK,QAAQ,KAAK,CAAE,KAAM,gBAAiB,QAAAc,CAAQ,CAAC,EAC7C,CAAE,KAAM,UAAW,QAAAA,CAAQ,CACpC,CACA,GAAID,GAAKA,EAAE,kBAAuB,GAChC,MAAO,CAAE,KAAM,mBAAoB,WAAYT,GAAoBS,EAAE,UAAa,CAAE,EAEtF,GAAIA,GAAK,MAAM,QAAQA,EAAE,aAAgB,GAAMA,EAAE,cAA+B,OAAS,EACvF,MAAO,CACL,KAAM,yBACN,UAAW,OAAOA,EAAE,WAAgB,EAAE,EACtC,iBAAkB,OAAOA,EAAE,kBAAuB,CAAC,EACnD,cAAeL,GAAoBK,EAAE,aAAgB,EACrD,OAAQ,OAAOA,EAAE,QAAa,EAAE,EAChC,QAAS,OAAOA,EAAE,SAAcb,EAAK,OAAO,CAC9C,EAEF,GAAIa,GAAK,OAAOA,EAAE,YAAkB,SAClC,MAAO,CAAE,KAAM,iBAAkB,WAAYA,EAAE,UAAc,EAE/D,MAAM,IAAIE,EAAY,CAAE,KAAM,MAAO,QAAS,oCAAqC,CAAC,CACtF,CAIO,SAASC,GAAWhB,EAAgB,CACzC,GAAM,CAAE,QAAAiB,EAAS,OAAAC,CAAO,EAAIlB,EAE5B,MAAO,CACL,MAAM,SAASmB,EAA0B,CACvC,IAAMC,EAAO,MAAMC,EACjBC,GAAS,CACP,OAAAJ,EACA,KAAM,CAAE,QAAAD,CAAQ,EAChB,KAAM,CACJ,SAAUjB,EAAK,SACf,MAAOmB,EAAQ,MACf,SAAUA,EAAQ,SAClB,GAAIA,EAAQ,SAAW,CAAE,SAAUA,EAAQ,QAAS,EAAI,CAAC,EACzD,GAAIA,EAAQ,eAAiB,CAAE,eAAgBA,EAAQ,cAAe,EAAI,CAAC,CAC7E,CACF,CAAC,CACH,EACA,MAAO,CAAE,QAASC,EAAK,QAAS,qBAAsBA,EAAK,oBAAqB,CAClF,EAEA,MAAM,mBAAmBD,EAAoC,CAY3D,MAAO,CAAE,SAXI,MAAME,EACjBE,GAAmB,CACjB,OAAAL,EACA,KAAM,CAAE,QAAAD,CAAQ,EAChB,KAAM,CACJ,SAAUjB,EAAK,SACf,MAAOmB,EAAQ,MACf,GAAIA,EAAQ,eAAiB,CAAE,eAAgBA,EAAQ,cAAe,EAAI,CAAC,CAC7E,CACF,CAAC,CACH,GACuB,OAAQ,CACjC,EAEA,MAAM,qBAAqBA,EAAsC,CAY/D,MAAO,CAAE,SAXI,MAAME,EACjBG,GAAqB,CACnB,OAAAN,EACA,KAAM,CAAE,QAAAD,CAAQ,EAChB,KAAM,CACJ,SAAUjB,EAAK,SACf,MAAOmB,EAAQ,MACf,GAAIA,EAAQ,eAAiB,CAAE,eAAgBA,EAAQ,cAAe,EAAI,CAAC,CAC7E,CACF,CAAC,CACH,GACuB,OAAQ,CACjC,EAEA,MAAM,MAAMA,EAA6C,CACvD,IAAMP,EAAO,MAAMS,EACjBI,GAAM,CACJ,OAAAP,EACA,KAAM,CAAE,QAAAD,CAAQ,EAChB,KAAM,CACJ,SAAUjB,EAAK,SACf,SAAUmB,EAAQ,SAClB,GAAIA,EAAQ,SAAW,CAAE,SAAUA,EAAQ,QAAS,EAAI,CAAC,EACzD,GAAIA,EAAQ,MAAQ,CAAE,MAAOA,EAAQ,KAAM,EAAI,CAAC,EAChD,GAAIA,EAAQ,eAAiB,CAAE,eAAgBA,EAAQ,cAAe,EAAI,CAAC,EAC3E,GAAIA,EAAQ,WAAa,CAAE,WAAYA,EAAQ,UAAW,EAAI,CAAC,EAC/D,GAAIA,EAAQ,cAAgB,CAAE,cAAeA,EAAQ,aAAc,EAAI,CAAC,EACxE,GAAIA,EAAQ,YAAc,CAAE,YAAaA,EAAQ,WAAY,EAAI,CAAC,EAClE,GAAIA,EAAQ,MAAQ,CAAE,MAAOA,EAAQ,KAAM,EAAI,CAAC,CAClD,CACF,CAAC,CACH,EACA,OAAOR,EAAcC,EAAMZ,CAAI,CACjC,EAEA,MAAM,WAAWmB,EAAkD,CACjE,IAAMP,EAAO,MAAMS,EACjBK,GAAiB,CACf,OAAAR,EACA,KAAM,CAAE,QAAAD,CAAQ,EAChB,KAAM,CACJ,UAAWE,EAAQ,UACnB,GAAIA,EAAQ,KAAO,CAAE,KAAMA,EAAQ,IAAK,EAAI,CAAC,EAC7C,GAAIA,EAAQ,WAAa,CAAE,WAAYA,EAAQ,UAAW,EAAI,CAAC,EAC/D,GAAIA,EAAQ,WAAa,CAAE,WAAYA,EAAQ,UAAW,EAAI,CAAC,CACjE,CACF,CAAC,CACH,EACA,OAAOR,EAAcC,EAAMZ,CAAI,CACjC,EAEA,QAAS,CACP,MAAM,WAAWmB,EAAqE,CACpF,IAAMC,EACJD,EAAQ,YAAc,OAClB,MAAME,EACJM,GAAwB,CACtB,OAAAT,EACA,KAAM,CAAE,QAAAD,CAAQ,EAChB,KAAM,CAAE,UAAWE,EAAQ,SAAU,CACvC,CAAC,CACH,EACA,MAAME,EACJO,GAAqB,CACnB,OAAAV,EACA,KAAM,CAAE,QAAAD,CAAQ,EAChB,KAAM,CACJ,SAAUjB,EAAK,SACf,GAAImB,EAAQ,eAAiB,CAAE,eAAgBA,EAAQ,cAAe,EAAI,CAAC,EAC3E,GAAIA,EAAQ,MAAQ,CAAE,MAAOA,EAAQ,KAAM,EAAI,CAAC,CAClD,CACF,CAAC,CACH,EACN,MAAO,CAAE,UAAWC,EAAK,UAAW,QAASA,EAAK,OAAQ,CAC5D,EAEA,MAAM,YAAYD,EAA0D,CAC1E,IAAMP,EAAO,MAAMS,EACjBF,EAAQ,YAAc,OAClBU,GAAuB,CACrB,OAAAX,EACA,KAAM,CAAE,QAAAD,CAAQ,EAChB,KAAM,CACJ,UAAWE,EAAQ,UACnB,UAAWA,EAAQ,UACnB,UAAWA,EAAQ,UACnB,GAAIA,EAAQ,WAAa,CAAE,WAAYA,EAAQ,UAAW,EAAI,CAAC,CACjE,CACF,CAAC,EACDW,GAAoB,CAClB,OAAAZ,EACA,KAAM,CAAE,QAAAD,CAAQ,EAChB,KAAM,CACJ,UAAWE,EAAQ,UACnB,UAAWA,EAAQ,UACnB,GAAIA,EAAQ,WAAa,CAAE,WAAYA,EAAQ,UAAW,EAAI,CAAC,CACjE,CACF,CAAC,CACP,EACA,OAAOR,EAAcC,EAAMZ,CAAI,CACjC,CACF,EAEA,kBAAmB,CASjB,MAAM,KAAKmB,EAA2D,CACpE,GAAM,CAAE,KAAAC,EAAM,MAAAW,EAAO,SAAAC,CAAS,EAAI,MAAMC,GAAK,CAC3C,OAAAf,EACA,KAAM,CAAE,QAAAD,CAAQ,EAChB,KAAM,CACJ,SAAUjB,EAAK,SACf,MAAOmB,EAAQ,MACf,GAAIA,EAAQ,eAAiB,CAAE,eAAgBA,EAAQ,cAAe,EAAI,CAAC,EAC3E,GAAIA,EAAQ,WAAa,CAAE,WAAYA,EAAQ,UAAW,EAAI,CAAC,CACjE,CACF,CAAC,EACD,GAAIC,EACF,MAAO,CAAE,KAAM,OAAQ,QAASA,EAAK,QAAS,iBAAkBA,EAAK,gBAAiB,EAExF,IAAMR,EAAQmB,GAAS,CAAC,EAClBG,EAAOtB,EAAK,KAClB,GACEoB,GAAU,SAAW,MACpBE,IAAS,oBAAsBA,IAAS,wBAEzC,MAAO,CACL,KAAM,WACN,KAAM,OAAOA,CAAI,EACjB,QAAS,OAAOtB,EAAK,SAAc,EAAE,EACrC,gBAAiBA,EAAK,kBAAuB,GAC7C,WAAYR,GAAoBQ,EAAK,UAAa,CACpD,EAEF,MAAMuB,EAAcJ,EAAOC,CAAQ,CACrC,EAEA,MAAM,OAAOb,EAAsD,CACjE,IAAMP,EAAO,MAAMS,EACjBe,GAAO,CACL,OAAAlB,EACA,KAAM,CAAE,QAAAD,CAAQ,EAChB,KAAM,CACJ,SAAUjB,EAAK,SACf,MAAOmB,EAAQ,MACf,KAAMA,EAAQ,KACd,GAAIA,EAAQ,WAAa,CAAE,WAAYA,EAAQ,UAAW,EAAI,CAAC,CACjE,CACF,CAAC,CACH,EACA,OAAOR,EAAcC,EAAMZ,CAAI,CACjC,CACF,EAEA,MAAM,WAAqC,CACzC,IAAMoB,EAAO,MAAMC,EAAUgB,GAAO,CAAE,OAAAnB,CAAO,CAAC,CAAC,EAC/C,OAAAlB,EAAK,QAAQ,KAAK,CAAE,KAAM,gBAAiB,QAASE,GAAkBkB,EAAMpB,CAAI,CAAE,CAAC,EAC5EoB,CACT,EAYA,MAAM,SAAyC,CAC7C,IAAMrB,EAAS,MAAMC,EAAK,cAAc,EACxC,GAAI,CAACD,EACH,MAAM,IAAIgB,EAAY,CACpB,KAAM,kBACN,QAAS,wCACX,CAAC,EAEH,OAAOhB,CACT,EAEA,MAAM,QAAS,CACb,IAAMqB,EAAO,MAAMC,EAAUiB,GAAO,CAAE,OAAApB,CAAO,CAAC,CAAC,EAC/C,OAAAlB,EAAK,kBAAkB,MAAM,EAC7BA,EAAK,QAAQ,gBAAgB,IAAI,EACjCA,EAAK,QAAQ,KAAK,CAAE,KAAM,YAAa,CAAC,EACjC,CAAE,QAASoB,GAAM,SAAW,YAAa,CAClD,CACF,CACF,CC/aO,SAASmB,IAA6C,CAC3D,IAAIC,EAAuB,KAC3B,MAAO,CACL,IAAK,IAAMA,EACX,IAAMC,GAAM,CACVD,EAAQC,CACV,EACA,MAAO,IAAM,CACXD,EAAQ,IACV,CACF,CACF,CAEO,IAAME,EAAyC,CACpD,cAAe,GACf,QAAS,KACT,OAAQ,KACR,YAAa,KACb,SAAU,KACV,gBAAiB,KACjB,YAAa,CAAC,EACd,OAAQ,CAAC,CACX,EAgBO,SAASC,GAAmBC,EAAwD,CACzF,IAAIC,EAAyB,CAAE,GAAGH,CAAwB,EACpDI,EAAY,IAAI,IAEtB,MAAO,CACL,WAAY,IAAMD,EAClB,WAAa,GAAM,CACjBA,EAAU,GAAK,CAAE,GAAGH,CAAwB,CAC9C,EACA,UAAYK,IACVD,EAAU,IAAIC,CAAE,EACT,IAAM,CACXD,EAAU,OAAOC,CAAE,CACrB,GAEF,KAAOC,GAAU,CACXA,EAAM,OAAS,gBACjBH,EAAUG,EAAM,SACPA,EAAM,OAAS,mBAAqBA,EAAM,OAAS,gBAC5DH,EAAU,CAAE,GAAGH,CAAwB,GAEzC,QAAWK,KAAMD,EACfC,EAAGC,CAAK,EAEVJ,IAAWI,CAAK,CAClB,CACF,CACF,CCnEO,SAASC,IAA8B,CAC5C,IAAIC,EAAuB,KAC3B,MAAO,CACL,gBAAiB,IAAMA,EACvB,gBAAkBC,GAAM,CACtBD,EAAQC,CACV,CACF,CACF,CAOO,SAASC,EAAoBC,EAA2B,CAC7D,GAAI,OAAO,aAAiB,KAAe,eAAiB,KAC1D,MAAM,IAAIC,EAAY,CACpB,KAAM,iBACN,QACE,uHACJ,CAAC,EAEH,MAAO,CACL,gBAAiB,IAAM,aAAa,QAAQD,CAAG,EAC/C,gBAAkBF,GAAM,CAClBA,IAAM,KACR,aAAa,WAAWE,CAAG,EAE3B,aAAa,QAAQA,EAAKF,CAAC,CAE/B,CACF,CACF,CC4BO,SAASI,GAAmBC,EAA0C,CAC3E,IAAMC,EAAkB,OAAO,aAAiB,KAAe,eAAiB,KAE5EC,EAAUF,EAAO,QACrB,GAAI,CAACE,EAAS,CACZ,GAAI,CAACD,EACH,MAAM,IAAIE,EAAY,CACpB,KAAM,iBACN,QACE,qIACJ,CAAC,EAEHD,EAAUE,EAAoBJ,EAAO,YAAc,qBAAqB,CAC1E,CAEA,IAAMK,EAAoBC,GAAwB,EAC5CC,EAAUC,GAAmBR,EAAO,eAAe,EAEnDS,EAAYC,GAAgB,CAChC,QAASV,EAAO,QAChB,kBAAAK,EACA,QAAAH,EACA,QAAAK,CACF,CAAC,EAIKI,EAAW,CACf,QAASX,EAAO,QAChB,SAAUA,EAAO,SACjB,OAAQS,EAAU,OAClB,kBAAAJ,EACA,QAAAH,EACA,QAAAK,EACA,cAAeE,EAAU,aAC3B,EAIA,MAAO,CACL,GAHWG,GAAWD,CAAQ,EAI9B,QAAAT,EACA,QAAS,CACP,WAAY,IAAMK,EAAQ,WAAW,EACrC,UAAYM,GAAaN,EAAQ,UAAUM,CAAQ,CACrD,EACA,OAAQ,CACN,eAAgB,IAAMR,EAAkB,IAAI,EAC5C,UAAYS,GAAW,CACrBT,EAAkB,IAAIS,EAAO,WAAW,EACxCZ,EAAQ,gBAAgBY,EAAO,YAAY,EACvCA,EAAO,WAAa,SACtBH,EAAS,SAAWG,EAAO,SAE/B,EACA,MAAO,IAAM,CACXT,EAAkB,MAAM,EACxBH,EAAQ,gBAAgB,IAAI,CAC9B,EACA,aAAea,GAAa,CAC1BJ,EAAS,SAAWI,CACtB,CACF,CACF,CACF,CCrGO,SAASC,GAAkBC,EAA4B,CAC5D,IAAMC,EAAMD,EAAM,QAAQ,KAAM,GAAG,EAAE,QAAQ,KAAM,GAAG,EAEhDE,EAASD,EAAM,MAAM,OAAOA,EAAI,OAAS,GAAK,CAAC,EAC/CE,EAAS,KAAKD,CAAM,EACpBE,EAAQ,IAAI,WAAWD,EAAO,MAAM,EAC1C,QAASE,EAAI,EAAGA,EAAIF,EAAO,OAAQE,GAAK,EACtCD,EAAMC,CAAC,EAAIF,EAAO,WAAWE,CAAC,EAEhC,OAAOD,EAAM,MACf,CAGO,SAASE,EAAkBC,EAA0C,CAC1E,IAAMH,EAAQG,aAAkB,WAAaA,EAAS,IAAI,WAAWA,CAAM,EACvEJ,EAAS,GACb,QAASE,EAAI,EAAGA,EAAID,EAAM,OAAQC,GAAK,EACrCF,GAAU,OAAO,aAAaC,EAAMC,CAAC,GAAK,CAAC,EAE7C,OAAO,KAAKF,CAAM,EAAE,QAAQ,MAAO,GAAG,EAAE,QAAQ,MAAO,GAAG,EAAE,QAAQ,OAAQ,EAAE,CAChF,CAOA,eAAsBK,GACpBC,EAC8B,CAC9B,GAAI,OAAO,UAAc,KAAe,CAAC,UAAU,aAAa,IAC9D,MAAM,IAAI,MAAM,4EAA4E,EAG9F,IAAMC,EAA+C,CACnD,UAAWX,GAAkBU,EAAQ,SAAS,EAC9C,GAAIA,EAAQ,KAAO,CAAE,KAAMA,EAAQ,IAAK,EAAI,CAAC,EAC7C,GAAIA,EAAQ,UAAY,OAAY,CAAE,QAASA,EAAQ,OAAQ,EAAI,CAAC,EACpE,GAAIA,EAAQ,iBAAmB,CAAE,iBAAkBA,EAAQ,gBAAiB,EAAI,CAAC,EACjF,GAAIA,EAAQ,iBACR,CACE,iBAAkBA,EAAQ,iBAAiB,IAAKE,IAAO,CACrD,KAAM,aACN,GAAIZ,GAAkBY,EAAE,EAAE,EAC1B,GAAIA,EAAE,WAAa,CAAE,WAAYA,EAAE,UAAW,EAAI,CAAC,CACrD,EAAE,CACJ,EACA,CAAC,CACP,EAEMC,EAAc,MAAM,UAAU,YAAY,IAAI,CAAE,UAAAF,CAAU,CAAC,EACjE,GAAI,CAACE,EACH,MAAM,IAAI,MAAM,2CAA2C,EAG7D,IAAMC,EAAWD,EAAW,SACtBE,EAA8B,CAClC,GAAIF,EAAW,GACf,MAAON,EAAkBM,EAAW,KAAK,EACzC,KAAM,aACN,SAAU,CACR,kBAAmBN,EAAkBO,EAAS,iBAAiB,EAC/D,eAAgBP,EAAkBO,EAAS,cAAc,EACzD,UAAWP,EAAkBO,EAAS,SAAS,EAC/C,GAAIA,EAAS,WAAa,CAAE,WAAYP,EAAkBO,EAAS,UAAU,CAAE,EAAI,CAAC,CACtF,CACF,EAKA,OAAI,OAAOD,EAAW,2BAA8B,aAClDE,EAAO,uBACLF,EAAW,0BAA0B,GAGlCE,CACT","names":["index_exports","__export","HeraldError","createHeraldClient","localStorageStorage","memoryStorage","performPasskeyAssertion","jsonBodySerializer","body","_key","value","createSseClient","onRequest","onSseError","onSseEvent","responseTransformer","responseValidator","sseDefaultRetryDelay","sseMaxRetryAttempts","sseMaxRetryDelay","sseSleepFn","url","options","lastEventId","sleep","ms","resolve","retryDelay","attempt","signal","headers","requestInit","request","response","reader","buffer","abortHandler","done","value","chunks","chunk","lines","dataLines","eventName","line","parsed","data","parsedJson","rawData","error","backoff","separatorArrayExplode","style","separatorArrayNoExplode","separatorObjectExplode","serializeArrayParam","allowReserved","explode","name","value","joinedValues","v","separator","serializePrimitiveParam","serializeObjectParam","valueOnly","values","key","PATH_PARAM_RE","defaultPathSerializer","path","_url","url","matches","match","explode","name","style","value","serializeArrayParam","serializeObjectParam","serializePrimitiveParam","replaceValue","getUrl","baseUrl","query","querySerializer","pathUrl","search","getValidRequestBody","options","hasBody","getAuthToken","auth","callback","token","createQuerySerializer","parameters","args","queryParams","search","name","value","options","serializedArray","serializeArrayParam","serializedObject","serializeObjectParam","serializedPrimitive","serializePrimitiveParam","getParseAs","contentType","cleanContent","type","checkForExistence","setAuthParams","security","auth","token","getAuthToken","buildUrl","getUrl","mergeConfigs","a","b","config","mergeHeaders","headersEntries","headers","entries","key","mergedHeaders","header","iterator","v","Interceptors","id","index","fn","createInterceptors","defaultQuerySerializer","defaultHeaders","createConfig","override","jsonBodySerializer","createClient","config","_config","mergeConfigs","createConfig","getConfig","setConfig","interceptors","createInterceptors","beforeRequest","options","opts","mergeHeaders","setAuthParams","url","buildUrl","request","requestInit","getValidRequestBody","fn","_fetch","response","error","finalError","result","parseAs","getParseAs","emptyData","data","text","textError","jsonError","makeMethodFn","method","makeSseFn","createSseClient","init","client","createClient","createConfig","refresh","options","client","logout","options","client","status","login","options","client","send","verify","handlePasskey2FaOptions","handlePasskey2FaVerify","handlePasskeyOptions","handlePasskeyVerify","handleVerifyTotp","register","options","client","resetPasswordRequest","options","client","verifyEmailTrigger","options","client","HeraldError","init","kindForStatus","status","toHeraldError","error","response","body","RETRY_HEADER","REFRESH_PATH","refreshTokens","client","deps","rt","inFlight","promise","data","error","refresh","replayRequest","options","result","headers","payload","body","createTransport","createClient","request","accessToken","response","replayOptions","resolveOp","toHeraldError","applyTokens","tokens","deps","sessionFromLoginSuccess","sessionFromStatus","s","normalizeAgreements","raw","a","o","filterSecondFactors","arr","f","toLoginResult","body","b","session","HeraldError","createAuth","realmId","client","payload","data","resolveOp","register","verifyEmailTrigger","resetPasswordRequest","login","handleVerifyTotp","handlePasskey2FaOptions","handlePasskeyOptions","handlePasskey2FaVerify","handlePasskeyVerify","error","response","send","code","toHeraldError","verify","status","logout","createAccessTokenHolder","token","t","UNAUTHENTICATED_SESSION","createSessionStore","onChange","session","listeners","fn","event","memoryStorage","token","t","localStorageStorage","key","HeraldError","createHeraldClient","config","hasLocalStorage","storage","HeraldError","localStorageStorage","accessTokenHolder","createAccessTokenHolder","session","createSessionStore","transport","createTransport","authDeps","createAuth","listener","tokens","clientId","base64urlToBuffer","input","b64","padded","binary","bytes","i","bufferToBase64url","buffer","performPasskeyAssertion","options","publicKey","c","credential","response","result"]}