@8wave/ai-elements 0.98.0-beta.4 → 0.98.0

package/dist-vue/api.js

@@ -1,2 +1,2 @@
-import { t as e } from "./_chunks/createChatbotApiClient-Bf5DbqVH.js";
+import { t as e } from "./_chunks/createChatbotApiClient-BOBdBxmf.js";
 export { e as createChatbotApiClient };

package/dist-vue/apps/web-component/src/components/EmbeddedChatWidget.ce.d.ts

@@ -6,6 +6,12 @@ type __VLS_Props = {
     externalToken?: string;
     /** Boolean or attribute string ("true"/"false") when set via HTML attribute. */
     awaitExternalToken?: boolean | string;
+    /**
+     * Host-session mode: the widget skips its own sign-in and uses
+     * the host platform's better-auth session from the cookie.
+     * Boolean or attribute string ("true"/"false").
+     */
+    useHostSession?: boolean | string;
     /** Comma-separated list of extra slot names to forward to PkChatbot (e.g. "tool-showArtifact,subagent"). */
     forwardedSlots?: string;
     customCss?: string;
@@ -40,6 +46,7 @@ declare const __VLS_base: DefineComponent<__VLS_Props, {
     systemTheme: "light" | "dark";
     externalToken: string;
     awaitExternalToken: boolean | string;
+    useHostSession: boolean | string;
     forwardedSlots: string;
     appinsightsConnectionString: string;
     cookieName: string;

package/dist-vue/apps/web-component/src/components/FloatingChatWidget.ce.d.ts

@@ -6,6 +6,12 @@ type __VLS_Props = {
     externalToken?: string;
     /** Boolean or attribute string ("true"/"false") when set via HTML attribute. */
     awaitExternalToken?: boolean | string;
+    /**
+     * Host-session mode: the widget skips its own sign-in and uses
+     * the host platform's better-auth session from the cookie.
+     * Boolean or attribute string ("true"/"false").
+     */
+    useHostSession?: boolean | string;
     floatingButtonPosition?: 'left' | 'right';
     customCss?: string;
     appinsightsConnectionString?: string;
@@ -34,6 +40,7 @@ declare const __VLS_export: DefineComponent<__VLS_Props, {
     systemTheme: "light" | "dark";
     externalToken: string;
     awaitExternalToken: boolean | string;
+    useHostSession: boolean | string;
     appinsightsConnectionString: string;
     cookieName: string;
 }, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;

package/dist-vue/apps/web-component/src/composables/useChatbotAuth.d.ts

@@ -78,6 +78,17 @@ export declare function useChatbotAuth(options?: {
     basePath?: string;
     externalToken?: MaybeRefOrGetter<string | undefined>;
     awaitExternalToken?: boolean;
+    /**
+     * Host-session mode: the widget never signs in on its own and sends
+     * no Authorization header; the session comes from the host
+     * platform's better-auth cookie (sent thanks to
+     * `credentials: 'include'`). The session belongs to the host, so
+     * account management is hidden and `signOut` is a no-op. Intended
+     * for the widget embedded in the platform itself (Backoffice
+     * copilot, spec platform-copilot-session-bridge.md); it only works
+     * where the host cookie context works, not on third-party embeds.
+     */
+    useHostSession?: MaybeRefOrGetter<boolean | undefined>;
     isActive?: MaybeRefOrGetter<boolean>;
     cookieName?: string;
     /** Called when a session is established or the user changes. */

package/dist-vue/apps/web-component/src/lib.d.ts

@@ -7,6 +7,7 @@ export declare const FloatingChatWidgetCe: VueElementConstructor<{
     baseUrl?: string;
     externalToken?: string;
     awaitExternalToken?: boolean | string;
+    useHostSession?: boolean | string;
     floatingButtonPosition?: "left" | "right";
     customCss?: string;
     appinsightsConnectionString?: string;
@@ -19,6 +20,7 @@ export declare const EmbeddedChatWidgetCe: VueElementConstructor<{
     baseUrl?: string;
     externalToken?: string;
     awaitExternalToken?: boolean | string;
+    useHostSession?: boolean | string;
     forwardedSlots?: string;
     customCss?: string;
     appinsightsConnectionString?: string;
@@ -38,6 +40,8 @@ export interface FloatingChatWidgetElement extends HTMLElement {
     baseUrl?: string;
     externalToken?: string;
     awaitExternalToken?: boolean;
+    /** Host-session mode: use the host platform's better-auth session from the cookie (no widget sign-in). */
+    useHostSession?: boolean;
     floatingButtonPosition?: 'left' | 'right';
     customCss?: string;
     appinsightsConnectionString?: string;
@@ -59,6 +63,8 @@ export interface EmbeddedChatWidgetElement extends HTMLElement {
     baseUrl?: string;
     externalToken?: string;
     awaitExternalToken?: boolean;
+    /** Host-session mode: use the host platform's better-auth session from the cookie (no widget sign-in). */
+    useHostSession?: boolean;
     forwardedSlots?: string;
     customCss?: string;
     appinsightsConnectionString?: string;

package/dist-vue/composables.js

@@ -1,5 +1,5 @@
-import { t as e } from "./_chunks/createChatbotApiClient-Bf5DbqVH.js";
-import { t } from "./_chunks/useChatbotStore-DeHwEN8W.js";
+import { t as e } from "./_chunks/createChatbotApiClient-BOBdBxmf.js";
+import { t } from "./_chunks/useChatbotStore-BJ-EDmND.js";
 import { t as n } from "./_chunks/src-8QXYVWIx.js";
 import { t as r } from "./_chunks/useLocalizedString-PfaKjIQY.js";
 import { d as i } from "./_chunks/utils-BMa8jwJS.js";
@@ -133,12 +133,12 @@ function j() {
 	};
 }
 function M(e = {}) {
-	let t = l(x(e.cookieName)), n = a({
+	let t = l(x(e.cookieName)), n = a(() => u(e.useHostSession) ?? !1), r = a({
 		get: () => t.value,
 		set: (n) => {
 			b(n, e.cookieName), t.value = n;
 		}
-	}), r = a(() => n.value ? { Authorization: `Bearer ${n.value}` } : void 0), i = f({
+	}), i = a(() => !n.value && r.value ? { Authorization: `Bearer ${r.value}` } : void 0), o = f({
 		baseURL: e.baseUrl ?? void 0,
 		basePath: e.basePath ?? "auth",
 		plugins: [
@@ -150,189 +150,204 @@ function M(e = {}) {
 		],
 		fetchOptions: {
 			onSuccess: (e) => {
+				if (n.value) return;
 				let t = e.response.headers.get("set-auth-token");
-				t && (n.value = t);
+				t && (r.value = t);
 			},
 			auth: {
 				type: "Bearer",
-				token: () => n.value
-			}
+				token: () => n.value ? "" : r.value
+			},
+			customFetchImpl: (e, t) => fetch(e, {
+				...t,
+				credentials: n.value ? "include" : t?.credentials
+			})
 		}
-	}), o = i.useSession(), s = l(!1), c = a(() => u(e.externalToken)), h = a(() => u(e.isActive) ?? !0), g = l(c.value), _ = a(() => !!c.value || !!e.awaitExternalToken || !!g.value), v = Promise.resolve();
-	function y(e) {
-		let t = v.then(e, e);
-		return v = t, t;
+	}), s = o.useSession(), c = l(!1), h = a(() => u(e.externalToken)), g = a(() => u(e.isActive) ?? !0), _ = l(h.value), v = a(() => !!h.value || !!e.awaitExternalToken || !!_.value || n.value), y = Promise.resolve();
+	function T(e) {
+		let t = y.then(e, e);
+		return y = t, t;
 	}
-	d(() => o.value.data?.user, (t, n) => {
+	d(() => s.value.data?.user, (t, n) => {
 		t && t.id !== n?.id && e.onSignedIn?.({
 			userId: t.id,
 			isAnonymous: !!t.isAnonymous
 		}), !t && n && e.onSignedOut?.();
 	});
-	async function T() {
-		let { data: t } = await i.signIn.anonymous();
-		t?.token && (n.value = t.token, t.user?.id && S(t.user.id, e.cookieName));
-	}
 	async function E() {
+		let { data: t } = await o.signIn.anonymous();
+		t?.token && (r.value = t.token, t.user?.id && S(t.user.id, e.cookieName));
+	}
+	async function D() {
 		let t = C(e.cookieName);
 		if (!t) return !1;
 		try {
-			let { data: e } = await i.signIn.anonymousReauth({ userId: t });
-			if (e?.token) return n.value = e.token, await o.value.refetch(), !0;
+			let { data: e } = await o.signIn.anonymousReauth({ userId: t });
+			if (e?.token) return r.value = e.token, await s.value.refetch(), !0;
 		} catch {}
 		return !1;
 	}
-	async function D() {
-		await E() || await T();
+	async function O() {
+		await D() || await E();
 	}
-	async function O(t) {
-		g.value === t && (e.onExternalAuthExpired?.(), !e.awaitExternalToken && await D());
+	async function M(t) {
+		_.value === t && (e.onExternalAuthExpired?.(), !e.awaitExternalToken && await O());
 	}
-	async function M(e) {
-		s.value = !0;
+	async function N(e) {
+		c.value = !0;
 		try {
-			let { data: t } = await i.signIn.externalToken({ token: e });
-			if (g.value !== e) return;
+			let { data: t } = await o.signIn.externalToken({ token: e });
+			if (_.value !== e) return;
 			if (t?.token) {
-				n.value = t.token, await o.value.refetch();
+				r.value = t.token, await s.value.refetch();
 				return;
 			}
-			await O(e);
+			await M(e);
 		} catch {
-			await O(e);
+			await M(e);
 		} finally {
-			s.value = !1;
+			c.value = !1;
 		}
 	}
-	let N, P, F = !1;
-	async function I(e) {
-		if (!(!e || N === e)) {
-			g.value = e, P = e, N = e;
+	let P, F, I = !1;
+	async function L(e) {
+		if (!(!e || P === e)) {
+			_.value = e, F = e, P = e;
 			try {
-				await y(async () => {
-					g.value === e && await M(e);
+				await T(async () => {
+					_.value === e && await N(e);
 				});
 			} finally {
-				N = void 0;
+				P = void 0;
 			}
 		}
 	}
-	async function L() {
-		s.value || await y(async () => {
-			if (!g.value) {
-				s.value = !0;
+	async function R() {
+		c.value || await T(async () => {
+			if (!(_.value || n.value)) {
+				c.value = !0;
 				try {
-					await D();
+					await O();
 				} finally {
-					s.value = !1;
+					c.value = !1;
 				}
 			}
 		});
 	}
-	d([h, o], ([t, n]) => {
+	d([g, s], ([t, r]) => {
 		if (!t) return;
-		if (!n.isPending && !n.isRefetching && !s.value && !n.data) {
-			if (g.value) {
-				I(g.value);
+		if (!r.isPending && !r.isRefetching && !c.value && !r.data) {
+			if (n.value) return;
+			if (_.value) {
+				L(_.value);
 				return;
 			}
 			if (e.awaitExternalToken) return;
-			L();
+			R();
 			return;
 		}
-		let r = n.data?.user;
-		if (n.data?.session?.hardExpiresAt && !F) {
-			if (F = !0, !g.value) {
-				W();
-				return;
+		let i = r.data?.user;
+		if (!n.value) {
+			if (r.data?.session?.hardExpiresAt && !I) {
+				if (I = !0, !_.value) {
+					G();
+					return;
+				}
+				if (F !== _.value) {
+					L(_.value);
+					return;
+				}
 			}
-			if (P !== g.value) {
-				I(g.value);
+			if (i?.isAnonymous && _.value && F !== _.value) {
+				L(_.value);
 				return;
 			}
+			i?.isAnonymous && i.id && !C(e.cookieName) && S(i.id, e.cookieName);
 		}
-		if (r?.isAnonymous && g.value && P !== g.value) {
-			I(g.value);
-			return;
-		}
-		r?.isAnonymous && r.id && !C(e.cookieName) && S(r.id, e.cookieName);
-	}, { immediate: !0 }), d(c, (e, t) => {
+	}, { immediate: !0 }), d(n, () => {
+		s.value.refetch();
+	}), d(h, (e, t) => {
 		if (e) {
-			g.value = e, h.value && I(e);
+			_.value = e, g.value && L(e);
 			return;
 		}
-		t && g.value === t && W();
+		t && _.value === t && G();
 	});
-	function R(t) {
+	function z(t) {
 		if (t.status === 401) {
-			if (g.value) {
-				I(g.value);
+			if (n.value) {
+				s.value.refetch();
+				return;
+			}
+			if (_.value) {
+				L(_.value);
 				return;
 			}
-			e.awaitExternalToken || L();
+			e.awaitExternalToken || R();
 		}
 	}
-	let z = a(() => o.value.data?.user?.id);
-	async function B(t, r, a) {
-		let o = await i.signIn.email({
+	let B = a(() => s.value.data?.user?.id);
+	async function V(t, n, i) {
+		let a = await o.signIn.email({
 			email: t,
-			password: r,
-			rememberMe: a
+			password: n,
+			rememberMe: i
 		});
-		return o.data?.token && (n.value = o.data.token, w(e.cookieName)), o;
+		return a.data?.token && (r.value = a.data.token, w(e.cookieName)), a;
 	}
-	function V(e) {
-		return i.signUp.email(e);
+	function H(e) {
+		return o.signUp.email(e);
 	}
-	function H(e, t) {
-		return i.requestPasswordReset({
+	function U(e, t) {
+		return o.requestPasswordReset({
 			email: e,
 			redirectTo: t
 		});
 	}
-	async function U(t, r) {
-		let a = e.baseUrl ?? void 0, s = `${a}/${e.basePath ?? "auth"}/widget-oauth-callback`, c = i.signIn.socialRedirect({
+	async function W(t, n) {
+		let i = e.baseUrl ?? void 0, a = `${i}/${e.basePath ?? "auth"}/widget-oauth-callback`, c = o.signIn.socialRedirect({
 			provider: t,
-			callbackURL: s
+			callbackURL: a
 		}), l = window.open(c, "eightwave-oauth", "width=600,height=700,menubar=no,toolbar=no");
 		return l ? new Promise((t) => {
-			let i = new URL(a).origin, s = setInterval(() => {
+			let a = new URL(i).origin, o = setInterval(() => {
 				l?.closed && c();
 			}, 500);
 			function c() {
-				window.removeEventListener("message", u), clearInterval(s), t({ popupBlocked: !1 });
+				window.removeEventListener("message", u), clearInterval(o), t({ popupBlocked: !1 });
 			}
 			function u(t) {
-				t.origin === i && t.data?.type === "eightwave-oauth" && (l?.close(), t.data.token && (n.value = t.data.token, w(e.cookieName)), o.value.refetch().then(() => r?.()), c());
+				t.origin === a && t.data?.type === "eightwave-oauth" && (l?.close(), t.data.token && (r.value = t.data.token, w(e.cookieName)), s.value.refetch().then(() => n?.()), c());
 			}
 			window.addEventListener("message", u);
 		}) : { popupBlocked: !0 };
 	}
-	async function W() {
-		g.value = void 0;
-		let e = n.value;
+	async function G() {
+		if (n.value) return;
+		_.value = void 0;
+		let e = r.value;
 		try {
-			await i.signOut();
+			await o.signOut();
 		} finally {
-			n.value === e && (n.value = ""), await o.value.refetch();
+			r.value === e && (r.value = ""), await s.value.refetch();
 		}
 	}
 	return {
-		client: i,
-		session: o,
-		isAuthenticating: s,
-		isExternalAuth: _,
-		token: n,
-		headers: r,
-		onError: R,
-		userId: z,
-		signInWithEmail: B,
-		signUpWithEmail: V,
-		requestPasswordReset: H,
-		signInSocial: i.signIn.social,
-		signInWithSocialPopup: U,
-		signInWithExternalToken: I,
-		signOut: W
+		client: o,
+		session: s,
+		isAuthenticating: c,
+		isExternalAuth: v,
+		token: r,
+		headers: i,
+		onError: z,
+		userId: B,
+		signInWithEmail: V,
+		signUpWithEmail: H,
+		requestPasswordReset: U,
+		signInSocial: o.signIn.social,
+		signInWithSocialPopup: W,
+		signInWithExternalToken: L,
+		signOut: G
 	};
 }
 //#endregion

package/dist-vue/composables.js.map

@@ -1 +1 @@
-{"version":3,"file":"composables.js","names":[],"sources":["../src/utils/cookie.ts","../src/utils/index.ts","../src/composables/useChatbotAgent.ts","../../../packages/auth/src/social-redirect-client-plugin.ts","../src/composables/useChatbotAuth.ts","../src/composables/useFocusTrapBypass.ts"],"sourcesContent":["import { logger } from 'utils'\n\nconst DEFAULT_COOKIE_NAME = 'eight-wave-ai'\nconst DEFAULT_USER_ID_COOKIE_SUFFIX = '-uid'\nconst MAX_AGE_ONE_YEAR = 31536000\n\nfunction setCookie(name: string, value: string, maxAge: number) {\n    try {\n        // A past `expires` accompanies `max-age=0` on deletion: some cookie\n        // implementations (older browsers, happy-dom) only honor the former.\n        const expires =\n            maxAge > 0 ? '' : '; expires=Thu, 01 Jan 1970 00:00:00 GMT'\n        document.cookie = `${name}=${value}; path=/; max-age=${maxAge}${expires}; SameSite=Lax; Secure`\n    } catch (error) {\n        logger.warn(\n            '[cookie] setCookie blocked (cross-origin/tracking protection)',\n            error,\n        )\n    }\n}\n\nfunction getCookie(name: string): string {\n    try {\n        // Only split on the FIRST \"=\" — session tokens are signed with a\n        // base64 signature that can contain \"=\" padding, so splitting on every\n        // \"=\" would truncate the value and corrupt the token.\n        const prefix = `${name}=`\n        const row = document.cookie\n            .split('; ')\n            .find((entry) => entry.startsWith(prefix))\n        return row ? row.slice(prefix.length) : ''\n    } catch (error) {\n        logger.warn(\n            '[cookie] getCookie blocked (cross-origin/tracking protection)',\n            error,\n        )\n        return ''\n    }\n}\n\n// create first-party session cookie for authentication with 1 year expiry;\n// an empty token (sign-out) deletes the cookie instead of storing an empty value\nexport function setSessionCookie(\n    token: string,\n    cookieName: string = DEFAULT_COOKIE_NAME,\n) {\n    setCookie(cookieName, token, token ? MAX_AGE_ONE_YEAR : 0)\n}\n\n// retrieve first-party session cookie\nexport function getSessionCookie(cookieName: string = DEFAULT_COOKIE_NAME) {\n    return getCookie(cookieName)\n}\n\n// persist anonymous userId alongside session token to enable re-auth after session expiry\nexport function setAnonymousUserIdCookie(\n    userId: string,\n    cookieName: string = DEFAULT_COOKIE_NAME,\n) {\n    setCookie(\n        `${cookieName}${DEFAULT_USER_ID_COOKIE_SUFFIX}`,\n        userId,\n        MAX_AGE_ONE_YEAR,\n    )\n}\n\n// retrieve persisted anonymous userId\nexport function getAnonymousUserIdCookie(\n    cookieName: string = DEFAULT_COOKIE_NAME,\n) {\n    return getCookie(`${cookieName}${DEFAULT_USER_ID_COOKIE_SUFFIX}`)\n}\n\n// remove the persisted anonymous userId once the anonymous user links a real\n// account (the linked anonymous user is deleted server-side, so it's stale)\nexport function clearAnonymousUserIdCookie(\n    cookieName: string = DEFAULT_COOKIE_NAME,\n) {\n    setCookie(`${cookieName}${DEFAULT_USER_ID_COOKIE_SUFFIX}`, '', 0)\n}\n","export * from './cookie'\n\nexport const BACKEND_URL: string = import.meta.env.VITE_BACKEND_URL\nexport const FRONTEND_URL: string = import.meta.env.VITE_FRONTEND_URL\nexport const AUTH_BASE_PATH = 'auth'\n","import type { MaybeRefOrGetter } from 'vue'\nimport { computed, ref, toValue, watch } from 'vue'\nimport type { AgentBranding, AgentPublic, AuthMethods } from 'models'\nimport { createChatbotApiClient } from 'composables'\nimport { resolveContrastColor } from 'components/src/chat/utils'\nimport { BACKEND_URL } from '~/utils'\n\nexport function useChatbotAgent(options: {\n    baseUrl?: string\n    basePath?: string\n    organizationSlug?: MaybeRefOrGetter<string>\n    agentId?: MaybeRefOrGetter<string>\n    headers?: MaybeRefOrGetter<Record<string, string> | undefined>\n    /**\n     * Host-provided color scheme override, applied when the agent theme is\n     * `auto`. Mirrors the precedence used by the chatbot store: agent theme,\n     * then this override, then the OS `prefers-color-scheme`.\n     */\n    systemTheme?: MaybeRefOrGetter<'light' | 'dark' | undefined>\n}) {\n    const agent = ref<AgentPublic>()\n    const branding = ref<AgentBranding>()\n    const authMethods = ref<AuthMethods>()\n    const requiresAuth = ref(false)\n    const notFound = ref(false)\n    const isLoading = ref(false)\n\n    async function load() {\n        const orgSlug = toValue(options.organizationSlug)\n        const agentId = toValue(options.agentId)\n        if (!orgSlug || !agentId) {\n            return\n        }\n        const apiClient = createChatbotApiClient({\n            baseUrl: options.baseUrl ?? BACKEND_URL,\n            basePath: options.basePath,\n            headers: () => toValue(options.headers),\n        })\n        isLoading.value = true\n        try {\n            const result = await apiClient.getAgentAccess(orgSlug, agentId)\n            authMethods.value = result.authMethods\n            if (result.requiresAuth) {\n                requiresAuth.value = true\n                branding.value = result.branding ?? undefined\n                agent.value = undefined\n            } else {\n                requiresAuth.value = false\n                branding.value = undefined\n                agent.value = result.agent ?? undefined\n            }\n            notFound.value = false\n        } catch {\n            notFound.value = true\n            agent.value = undefined\n            branding.value = undefined\n            requiresAuth.value = false\n        } finally {\n            isLoading.value = false\n        }\n    }\n\n    // Reload when org/agent changes\n    watch(\n        [\n            () => toValue(options.organizationSlug),\n            () => toValue(options.agentId),\n        ],\n        () => {\n            load()\n        },\n        { immediate: true },\n    )\n\n    // Reload when headers change meaningfully (e.g. after login) and auth is required\n    watch(\n        () => toValue(options.headers),\n        () => {\n            if (requiresAuth.value) {\n                load()\n            }\n        },\n    )\n\n    // Branding-aware theming: fall back to branding when agent is not available\n    const source = computed(\n        () => agent.value?.interface ?? branding.value?.interface,\n    )\n\n    const contrastColor = computed(() =>\n        resolveContrastColor(source.value?.textColor, source.value?.mainColor),\n    )\n    const mainColor = computed(() => source.value?.mainColor)\n\n    const themeClass = computed(() => {\n        const theme = source.value?.theme\n        if (theme && theme !== 'auto') {\n            return ['theme', `theme--${theme}`]\n        }\n        const systemTheme = toValue(options.systemTheme)\n        if (systemTheme) {\n            return ['theme', `theme--${systemTheme}`]\n        }\n        return ['theme']\n    })\n\n    const themeStyle = computed(() =>\n        source.value\n            ? {\n                  '--chatbot-main-color': mainColor.value,\n                  '--chatbot-contrast-color': contrastColor.value,\n              }\n            : undefined,\n    )\n\n    return {\n        agent,\n        branding,\n        authMethods,\n        requiresAuth,\n        notFound,\n        isLoading,\n        reload: load,\n        contrastColor,\n        mainColor,\n        themeClass,\n        themeStyle,\n    }\n}\n","import type { BetterAuthClientPlugin } from 'better-auth/client'\nimport type { socialRedirect } from './social-redirect-plugin'\n\n/**\n * Client counterpart of the server `socialRedirect()` plugin.\n *\n * Exposes `authClient.signIn.socialRedirect(...)`, which builds the URL of the\n * backend `/sign-in/social-redirect` endpoint from the client's configured\n * `baseURL`/`basePath` and returns it as a string.\n *\n * It intentionally does NOT navigate: the caller decides how to use the URL —\n * the main app does a top-level `window.location` navigation, the embeddable\n * widget opens it in a popup. Building the URL here (instead of a cross-origin\n * `signIn.social` XHR) keeps the OAuth `state` cookie first-party on the backend\n * origin and avoids the `state_mismatch` failure.\n */\nexport function socialRedirectClient() {\n    return {\n        id: 'social-redirect',\n        $InferServerPlugin: {} as ReturnType<typeof socialRedirect>,\n        getActions: (_$fetch, _$store, options) => ({\n            signIn: {\n                socialRedirect: (opts: {\n                    provider: string\n                    callbackURL: string\n                    errorCallbackURL?: string\n                }): string => {\n                    const baseURL = options?.baseURL ?? ''\n                    const basePath = options?.basePath ?? 'auth'\n                    const params = new URLSearchParams({\n                        provider: opts.provider,\n                        callbackURL: opts.callbackURL,\n                    })\n                    if (opts.errorCallbackURL) {\n                        params.set('errorCallbackURL', opts.errorCallbackURL)\n                    }\n                    return `${baseURL}/${basePath}/sign-in/social-redirect?${params}`\n                },\n            },\n        }),\n    } satisfies BetterAuthClientPlugin\n}\n","import type { MaybeRefOrGetter } from 'vue'\nimport type { BetterAuthClientPlugin } from 'better-auth/client'\nimport type { auth } from 'auth'\nimport { socialRedirectClient } from 'auth/src/social-redirect-client-plugin'\nimport { computed, ref, watch, toValue } from 'vue'\nimport { createAuthClient } from 'better-auth/vue'\nimport {\n    inferAdditionalFields,\n    anonymousClient,\n} from 'better-auth/client/plugins'\nimport {\n    getSessionCookie,\n    setSessionCookie,\n    getAnonymousUserIdCookie,\n    setAnonymousUserIdCookie,\n    clearAnonymousUserIdCookie,\n    BACKEND_URL,\n    AUTH_BASE_PATH,\n} from '~/utils'\n\nfunction anonymousReauthClient() {\n    return {\n        id: 'anonymous-reauth' as const,\n        getActions: ($fetch) => ({\n            signIn: {\n                anonymousReauth: async (data: { userId: string }) => {\n                    return $fetch<{\n                        token: string\n                        user: Record<string, unknown>\n                    }>('/sign-in/anonymous-reauth', {\n                        method: 'POST',\n                        body: data,\n                    })\n                },\n            },\n        }),\n        pathMethods: {\n            '/sign-in/anonymous-reauth': 'POST' as const,\n        },\n    } satisfies BetterAuthClientPlugin\n}\n\nfunction externalAuthClient() {\n    return {\n        id: 'external-auth' as const,\n        getActions: ($fetch) => ({\n            signIn: {\n                externalToken: async (data: { token: string }) => {\n                    return $fetch<{\n                        token: string\n                        user: Record<string, unknown>\n                    }>('/sign-in/external-token', {\n                        method: 'POST',\n                        body: data,\n                    })\n                },\n            },\n        }),\n        pathMethods: {\n            '/sign-in/external-token': 'POST' as const,\n        },\n        atomListeners: [\n            {\n                matcher: (path: string) => path === '/sign-in/external-token',\n                signal: '$sessionSignal' as const,\n            },\n        ],\n    } satisfies BetterAuthClientPlugin\n}\n\ntype AuthClientOptions = {\n    baseURL?: string\n    basePath?: string\n    plugins: [\n        ReturnType<typeof inferAdditionalFields<typeof auth>>,\n        ReturnType<typeof anonymousClient>,\n        ReturnType<typeof anonymousReauthClient>,\n        ReturnType<typeof externalAuthClient>,\n        ReturnType<typeof socialRedirectClient>,\n    ]\n}\n\nexport type AuthClient = ReturnType<typeof createAuthClient<AuthClientOptions>>\n\nexport function useChatbotAuth(\n    options: {\n        baseUrl?: string\n        basePath?: string\n        externalToken?: MaybeRefOrGetter<string | undefined>\n        awaitExternalToken?: boolean\n        isActive?: MaybeRefOrGetter<boolean>\n        cookieName?: string\n        /** Called when a session is established or the user changes. */\n        onSignedIn?: (detail: { userId: string; isAnonymous: boolean }) => void\n        /** Called when the session ends without an immediate replacement. */\n        onSignedOut?: () => void\n        /**\n         * Called when an external token sign-in fails (expired token, invalid\n         * signature or disabled config): the host should provide a fresh token.\n         */\n        onExternalAuthExpired?: () => void\n    } = {},\n) {\n    const _token = ref(getSessionCookie(options.cookieName))\n\n    const token = computed({\n        get: () => _token.value,\n        set: (token: string) => {\n            setSessionCookie(token, options.cookieName)\n            _token.value = token\n        },\n    })\n\n    const headers = computed(() =>\n        token.value ? { Authorization: `Bearer ${token.value}` } : undefined,\n    )\n\n    const client = createAuthClient({\n        baseURL: options.baseUrl ?? BACKEND_URL,\n        basePath: options.basePath ?? AUTH_BASE_PATH,\n        plugins: [\n            inferAdditionalFields<typeof auth>(),\n            anonymousClient(),\n            anonymousReauthClient(),\n            externalAuthClient(),\n            socialRedirectClient(),\n        ],\n        fetchOptions: {\n            onSuccess: (ctx) => {\n                const newTokenFromHeader =\n                    ctx.response.headers.get('set-auth-token')\n                if (newTokenFromHeader) {\n                    token.value = newTokenFromHeader\n                }\n            },\n            auth: {\n                type: 'Bearer',\n                token: () => token.value,\n            },\n        },\n    }) as AuthClient\n\n    const session = client.useSession()\n    const isAuthenticating = ref(false)\n    const externalToken = computed(() => toValue(options.externalToken))\n    const isActive = computed(() => toValue(options.isActive) ?? true)\n\n    /**\n     * External token currently authorized for automatic (re-)authentication.\n     * Follows the `externalToken` option and imperative sign-in calls; cleared\n     * by `signOut`, so the watchers never re-login with a token the host has\n     * withdrawn.\n     */\n    const activeExternalToken = ref(externalToken.value)\n\n    // External token mode: the host application owns the auth lifecycle,\n    // so the widget must not offer account management (sign-out, profile).\n    const isExternalAuth = computed(\n        () =>\n            !!externalToken.value ||\n            !!options.awaitExternalToken ||\n            !!activeExternalToken.value,\n    )\n\n    /**\n     * Serializes sign-in operations: a request arriving while another is in\n     * flight runs right after it instead of being dropped. Each task re-checks\n     * state when it starts, so superseded requests no-op.\n     */\n    let authChain: Promise<void> = Promise.resolve()\n    function runExclusiveAuth(task: () => Promise<void>): Promise<void> {\n        const run = authChain.then(task, task)\n        authChain = run\n        return run\n    }\n\n    // Notify the host on session transitions, whatever flow caused them\n    // (anonymous, external token, email, social).\n    watch(\n        () => session.value.data?.user,\n        (user, previousUser) => {\n            if (user && user.id !== previousUser?.id) {\n                options.onSignedIn?.({\n                    userId: user.id,\n                    isAnonymous: !!user.isAnonymous,\n                })\n            }\n            if (!user && previousUser) {\n                options.onSignedOut?.()\n            }\n        },\n    )\n\n    async function signInAnonymously(): Promise<void> {\n        const { data } = await client.signIn.anonymous()\n        if (data?.token) {\n            token.value = data.token\n            if (data.user?.id) {\n                setAnonymousUserIdCookie(\n                    data.user.id as string,\n                    options.cookieName,\n                )\n            }\n        }\n    }\n\n    /**\n     * Attempts to create a new session for an existing anonymous user.\n     * Returns true if re-auth succeeded, false otherwise.\n     */\n    async function tryAnonymousReauth(): Promise<boolean> {\n        const storedUserId = getAnonymousUserIdCookie(options.cookieName)\n        if (!storedUserId) {\n            return false\n        }\n        try {\n            const { data } = await client.signIn.anonymousReauth({\n                userId: storedUserId,\n            })\n            if (data?.token) {\n                token.value = data.token\n                await session.value.refetch()\n                return true\n            }\n        } catch {\n            // user record may have been deleted — fall back to creating a new one\n        }\n        return false\n    }\n\n    /** Re-authenticates the stored anonymous user, or creates a fresh one. */\n    async function reauthOrSignInAnonymously(): Promise<void> {\n        const reauthed = await tryAnonymousReauth()\n        if (!reauthed) {\n            await signInAnonymously()\n        }\n    }\n\n    /**\n     * The external token was rejected (expired, invalid or config disabled):\n     * notify the host so it can provide a fresh one, then apply the fallback\n     * (keep waiting in `awaitExternalToken` mode, anonymous otherwise).\n     */\n    async function handleExternalTokenFailure(\n        failedExternalToken: string,\n    ): Promise<void> {\n        if (activeExternalToken.value !== failedExternalToken) {\n            // Withdrawn (sign-out) or replaced while the request was in flight\n            return\n        }\n        options.onExternalAuthExpired?.()\n        if (options.awaitExternalToken) {\n            return\n        }\n        await reauthOrSignInAnonymously()\n    }\n\n    /** Raw token exchange; must run inside `runExclusiveAuth`. */\n    async function exchangeExternalToken(\n        newExternalToken: string,\n    ): Promise<void> {\n        isAuthenticating.value = true\n        try {\n            const { data } = await client.signIn.externalToken({\n                token: newExternalToken,\n            })\n            if (activeExternalToken.value !== newExternalToken) {\n                // Withdrawn (sign-out) or replaced while the request was in flight\n                return\n            }\n            if (data?.token) {\n                token.value = data.token\n                await session.value.refetch()\n                return\n            }\n            await handleExternalTokenFailure(newExternalToken)\n        } catch {\n            await handleExternalTokenFailure(newExternalToken)\n        } finally {\n            isAuthenticating.value = false\n        }\n    }\n\n    /** External token currently queued or in flight, to drop duplicate requests. */\n    let pendingExternalToken: string | undefined\n\n    /**\n     * Last external token an exchange was attempted with, whatever the\n     * trigger. The session watcher consults it so a token that was already\n     * tried is never auto-retried: a rejected token must not loop between\n     * exchange and fallback. Deliberate retries (prop change, imperative\n     * `signIn`, 401 handler) bypass it.\n     */\n    let attemptedExternalToken: string | undefined\n\n    /** The cookie-restored external session was reconciled with the host state. */\n    let externalSessionReconciled = false\n\n    async function signInWithExternalToken(\n        newExternalToken: string,\n    ): Promise<void> {\n        if (!newExternalToken || pendingExternalToken === newExternalToken) {\n            return\n        }\n        activeExternalToken.value = newExternalToken\n        attemptedExternalToken = newExternalToken\n        pendingExternalToken = newExternalToken\n        try {\n            await runExclusiveAuth(async () => {\n                if (activeExternalToken.value !== newExternalToken) {\n                    // Superseded while waiting for the previous operation\n                    return\n                }\n                await exchangeExternalToken(newExternalToken)\n            })\n        } finally {\n            pendingExternalToken = undefined\n        }\n    }\n\n    async function signInAnonymouslyWithFallback(): Promise<void> {\n        if (isAuthenticating.value) {\n            // The `[isActive, session]` watcher retries on the next session change\n            return\n        }\n        await runExclusiveAuth(async () => {\n            if (activeExternalToken.value) {\n                // An external sign-in was requested in the meantime\n                return\n            }\n            isAuthenticating.value = true\n            try {\n                await reauthOrSignInAnonymously()\n            } finally {\n                isAuthenticating.value = false\n            }\n        })\n    }\n\n    watch(\n        [isActive, session],\n        ([newIsActive, newSession]) => {\n            if (!newIsActive) {\n                return\n            }\n            if (\n                !newSession.isPending &&\n                !newSession.isRefetching &&\n                !isAuthenticating.value &&\n                !newSession.data\n            ) {\n                if (activeExternalToken.value) {\n                    signInWithExternalToken(activeExternalToken.value)\n                    return\n                }\n                if (options.awaitExternalToken) {\n                    return\n                }\n                signInAnonymouslyWithFallback()\n                return\n            }\n\n            const user = newSession.data?.user\n\n            // A session created by an external token exchange (the only kind\n            // with `hardExpiresAt`) may have been restored from the cookie\n            // after a page navigation, where prop changes cannot be observed:\n            // reconcile it once with the auth state the host declares now.\n            if (\n                newSession.data?.session?.hardExpiresAt &&\n                !externalSessionReconciled\n            ) {\n                externalSessionReconciled = true\n                if (!activeExternalToken.value) {\n                    // The host no longer provides a token (it logged out\n                    // before this page load): drop the stale session. The\n                    // usual fallback rules apply (keep waiting in\n                    // `awaitExternalToken` mode, anonymous otherwise).\n                    signOut()\n                    return\n                }\n                if (attemptedExternalToken !== activeExternalToken.value) {\n                    // Re-exchange the current token, so a token minted for a\n                    // different user replaces the restored session and an\n                    // expired one raises `external-auth-expired` right away.\n                    signInWithExternalToken(activeExternalToken.value)\n                    return\n                }\n            }\n\n            // Upgrade an anonymous session restored from the cookie when an\n            // external token is available (e.g. the user logged into the host\n            // app between page loads). Attempted once per token.\n            if (\n                user?.isAnonymous &&\n                activeExternalToken.value &&\n                attemptedExternalToken !== activeExternalToken.value\n            ) {\n                signInWithExternalToken(activeExternalToken.value)\n                return\n            }\n\n            // Backfill userId cookie for existing anonymous sessions\n            if (\n                user?.isAnonymous &&\n                user.id &&\n                !getAnonymousUserIdCookie(options.cookieName)\n            ) {\n                setAnonymousUserIdCookie(user.id as string, options.cookieName)\n            }\n        },\n        { immediate: true },\n    )\n\n    watch(externalToken, (newToken, previousToken) => {\n        if (newToken) {\n            // Track the intent even when inactive: the `[isActive, session]`\n            // watcher signs in with it once the widget becomes active.\n            activeExternalToken.value = newToken\n            if (isActive.value) {\n                signInWithExternalToken(newToken)\n            }\n            return\n        }\n        // The host withdrew the token (logged out): sign out without\n        // re-authenticating; the fallback rules apply (keep waiting in\n        // `awaitExternalToken` mode, anonymous otherwise).\n        if (previousToken && activeExternalToken.value === previousToken) {\n            signOut()\n        }\n    })\n\n    function onError(error: { type: string; title: string; status: number }) {\n        if (error.status !== 401) {\n            return\n        }\n        if (activeExternalToken.value) {\n            signInWithExternalToken(activeExternalToken.value)\n            return\n        }\n        if (options.awaitExternalToken) {\n            return\n        }\n        signInAnonymouslyWithFallback()\n    }\n\n    const userId = computed(() => session.value.data?.user?.id)\n\n    // Auth methods for widget login screen\n    async function signInWithEmail(\n        email: string,\n        password: string,\n        rememberMe?: boolean,\n    ) {\n        const result = await client.signIn.email({\n            email,\n            password,\n            rememberMe,\n        })\n        // Capture the session token from the response body. Relying solely on\n        // the `set-auth-token` header is unreliable here, so we mirror the\n        // anonymous/social flows and store the token explicitly.\n        if (result.data?.token) {\n            token.value = result.data.token\n            // Signing in from an anonymous session links (and deletes) the\n            // anonymous user server-side, so its stored userId can no longer\n            // be re-authenticated — drop it so a later sign-out falls straight\n            // back to a fresh anonymous session.\n            clearAnonymousUserIdCookie(options.cookieName)\n        }\n        return result\n    }\n\n    function signUpWithEmail(params: {\n        email: string\n        password: string\n        name: string\n    }) {\n        return client.signUp.email(params)\n    }\n\n    function requestPasswordReset(email: string, redirectTo: string) {\n        return client.requestPasswordReset({ email, redirectTo })\n    }\n\n    /**\n     * Opens a popup for social OAuth sign-in.\n     *\n     * The popup performs a top-level navigation to the backend `social-redirect`\n     * endpoint, so the OAuth `state` cookie is set first-party on the backend\n     * origin and survives the round-trip (a cross-origin XHR `signIn.social`\n     * would set it as a third-party cookie that browsers drop, causing\n     * `state_mismatch`). After the flow completes, the backend callback page\n     * posts back the session Bearer token, which we store before refetching.\n     */\n    async function signInWithSocialPopup(\n        provider: 'google' | 'microsoft',\n        onAuthSuccess?: () => void,\n    ): Promise<{ popupBlocked: boolean }> {\n        const baseUrl = options.baseUrl ?? BACKEND_URL\n        const basePath = options.basePath ?? AUTH_BASE_PATH\n        const callbackURL = `${baseUrl}/${basePath}/widget-oauth-callback`\n        const redirectUrl = client.signIn.socialRedirect({\n            provider,\n            callbackURL,\n        })\n\n        const popup = window.open(\n            redirectUrl,\n            'eightwave-oauth',\n            'width=600,height=700,menubar=no,toolbar=no',\n        )\n\n        if (!popup) {\n            return { popupBlocked: true }\n        }\n\n        return new Promise((resolve) => {\n            const allowedOrigin = new URL(baseUrl).origin\n            // Resolve too if the user closes the popup without completing OAuth.\n            const closedPollId = setInterval(() => {\n                if (popup?.closed) {\n                    finish()\n                }\n            }, 500)\n\n            function finish() {\n                window.removeEventListener('message', onOAuthMessage)\n                clearInterval(closedPollId)\n                resolve({ popupBlocked: false })\n            }\n\n            function onOAuthMessage(event: MessageEvent) {\n                const isTrustedOAuthMessage =\n                    event.origin === allowedOrigin &&\n                    event.data?.type === 'eightwave-oauth'\n                if (!isTrustedOAuthMessage) {\n                    return\n                }\n                popup?.close()\n                if (event.data.token) {\n                    token.value = event.data.token\n                    // Same as the email flow: the anonymous user was linked\n                    // and deleted server-side, its stored userId is stale.\n                    clearAnonymousUserIdCookie(options.cookieName)\n                }\n                session.value.refetch().then(() => onAuthSuccess?.())\n                finish()\n            }\n\n            window.addEventListener('message', onOAuthMessage)\n        })\n    }\n\n    /**\n     * Signs the current user out and clears the locally stored session token.\n     * Withdraws the active external token first, so the watchers never\n     * re-authenticate with it: in external mode the host signs the widget back\n     * in (prop change or `signInWithExternalToken`), while in the other modes\n     * the `[isActive, session]` watcher re-establishes an anonymous session\n     * (re-using the stored anonymous userId cookie when present).\n     */\n    async function signOut(): Promise<void> {\n        activeExternalToken.value = undefined\n        const revokedToken = token.value\n        try {\n            await client.signOut()\n        } finally {\n            // A concurrent exchange may have stored a fresh session token\n            // while the revoke request was in flight (e.g. a host `signIn`\n            // racing the mount-time reconcile): only clear our own token,\n            // never the newer one.\n            if (token.value === revokedToken) {\n                token.value = ''\n            }\n            await session.value.refetch()\n        }\n    }\n\n    return {\n        client,\n        session,\n        isAuthenticating,\n        isExternalAuth,\n        token,\n        headers,\n        onError,\n        userId,\n        signInWithEmail,\n        signUpWithEmail,\n        requestPasswordReset,\n        signInSocial: client.signIn.social,\n        signInWithSocialPopup,\n        signInWithExternalToken,\n        signOut,\n    }\n}\n","import { getCurrentInstance, onBeforeUnmount, onMounted } from 'vue'\n\n/**\n * Prevents external focus-trapping libraries (e.g. Bootstrap 5 modals) from\n * stealing focus away from elements inside this custom element's shadow root.\n *\n * Bootstrap modals attach a `focusin` listener on `document` that pulls focus\n * back whenever it leaves the modal subtree. Because our custom element lives\n * outside the modal in the DOM, every focus event that escapes the shadow root\n * is treated as a \"focus escape\" and gets redirected back into the modal.\n *\n * Fix: intercept `focusin` at the shadow root boundary in the **bubble phase**\n * and stop its propagation. The event still reaches every internal element\n * normally (capture → target → bubble up through the shadow tree), but is\n * stopped at the shadow root before it can re-target and continue to `document`.\n *\n * Must be called inside a `.ce.vue` root component's `<script setup>`.\n */\nexport function useFocusTrapBypass() {\n    let shadowRoot: ShadowRoot | null = null\n\n    const stopFocusPropagation = (event: Event) => {\n        event.stopPropagation()\n    }\n\n    onMounted(() => {\n        const instance = getCurrentInstance()\n        const rootNode = instance?.proxy?.$el?.getRootNode()\n\n        if (!(rootNode instanceof ShadowRoot)) {\n            return\n        }\n\n        shadowRoot = rootNode\n        shadowRoot.addEventListener('focusin', stopFocusPropagation)\n    })\n\n    onBeforeUnmount(() => {\n        if (!shadowRoot) {\n            return\n        }\n\n        shadowRoot.removeEventListener('focusin', stopFocusPropagation)\n        shadowRoot = null\n    })\n}\n"],"mappings":";;;;;;;;;AAEA,IAAM,IAAsB,iBACtB,IAAgC,QAChC,IAAmB;AAEzB,SAAS,EAAU,GAAc,GAAe,GAAgB;CAC5D,IAAI;EAKA,SAAS,SAAS,GAAG,EAAK,GAAG,EAAM,oBAAoB,IADnD,IAAS,IAAI,KAAK,0CACkD;CAC5E,SAAS,GAAO;EACZ,EAAO,KACH,iEACA,CACJ;CACJ;AACJ;AAEA,SAAS,EAAU,GAAsB;CACrC,IAAI;EAIA,IAAM,IAAS,GAAG,EAAK,IACjB,IAAM,SAAS,OAChB,MAAM,IAAI,CAAC,CACX,MAAM,MAAU,EAAM,WAAW,CAAM,CAAC;EAC7C,OAAO,IAAM,EAAI,MAAM,EAAO,MAAM,IAAI;CAC5C,SAAS,GAAO;EAKZ,OAJA,EAAO,KACH,iEACA,CACJ,GACO;CACX;AACJ;AAIA,SAAgB,EACZ,GACA,IAAqB,GACvB;CACE,EAAU,GAAY,GAAO,IAAQ,IAAmB,CAAC;AAC7D;AAGA,SAAgB,EAAiB,IAAqB,GAAqB;CACvE,OAAO,EAAU,CAAU;AAC/B;AAGA,SAAgB,EACZ,GACA,IAAqB,GACvB;CACE,EACI,GAAG,IAAa,KAChB,GACA,CACJ;AACJ;AAGA,SAAgB,EACZ,IAAqB,GACvB;CACE,OAAO,EAAU,GAAG,IAAa,GAA+B;AACpE;AAIA,SAAgB,EACZ,IAAqB,GACvB;CACE,EAAU,GAAG,IAAa,KAAiC,IAAI,CAAC;AACpE;;;AC7EA,IAAa,IAAA,KAAA,GACA,IAAA,KAAA,GACA,IAAiB;;;ACG9B,SAAgB,EAAgB,GAY7B;CACC,IAAM,IAAQ,EAAiB,GACzB,IAAW,EAAmB,GAC9B,IAAc,EAAiB,GAC/B,IAAe,EAAI,EAAK,GACxB,IAAW,EAAI,EAAK,GACpB,IAAY,EAAI,EAAK;CAE3B,eAAe,IAAO;EAClB,IAAM,IAAU,EAAQ,EAAQ,gBAAgB,GAC1C,IAAU,EAAQ,EAAQ,OAAO;EACvC,IAAI,CAAC,KAAW,CAAC,GACb;EAEJ,IAAM,IAAY,EAAuB;GACrC,SAAS,EAAQ,WAAA,KAAA;GACjB,UAAU,EAAQ;GAClB,eAAe,EAAQ,EAAQ,OAAO;EAC1C,CAAC;EACD,EAAU,QAAQ;EAClB,IAAI;GACA,IAAM,IAAS,MAAM,EAAU,eAAe,GAAS,CAAO;GAW9D,AAVA,EAAY,QAAQ,EAAO,aACvB,EAAO,gBACP,EAAa,QAAQ,IACrB,EAAS,QAAQ,EAAO,YAAY,KAAA,GACpC,EAAM,QAAQ,KAAA,MAEd,EAAa,QAAQ,IACrB,EAAS,QAAQ,KAAA,GACjB,EAAM,QAAQ,EAAO,SAAS,KAAA,IAElC,EAAS,QAAQ;EACrB,QAAQ;GAIJ,AAHA,EAAS,QAAQ,IACjB,EAAM,QAAQ,KAAA,GACd,EAAS,QAAQ,KAAA,GACjB,EAAa,QAAQ;EACzB,UAAU;GACN,EAAU,QAAQ;EACtB;CACJ;CAeA,AAZA,EACI,OACU,EAAQ,EAAQ,gBAAgB,SAChC,EAAQ,EAAQ,OAAO,CACjC,SACM;EACF,EAAK;CACT,GACA,EAAE,WAAW,GAAK,CACtB,GAGA,QACU,EAAQ,EAAQ,OAAO,SACvB;EACF,AAAI,EAAa,SACb,EAAK;CAEb,CACJ;CAGA,IAAM,IAAS,QACL,EAAM,OAAO,aAAa,EAAS,OAAO,SACpD,GAEM,IAAgB,QAClB,EAAqB,EAAO,OAAO,WAAW,EAAO,OAAO,SAAS,CACzE,GACM,IAAY,QAAe,EAAO,OAAO,SAAS;CAuBxD,OAAO;EACH;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA,YA/Be,QAAe;GAC9B,IAAM,IAAQ,EAAO,OAAO;GAC5B,IAAI,KAAS,MAAU,QACnB,OAAO,CAAC,SAAS,UAAU,GAAO;GAEtC,IAAM,IAAc,EAAQ,EAAQ,WAAW;GAI/C,OAHI,IACO,CAAC,SAAS,UAAU,GAAa,IAErC,CAAC,OAAO;EACnB,CAqBI;EACA,YApBe,QACf,EAAO,QACD;GACI,wBAAwB,EAAU;GAClC,4BAA4B,EAAc;EAC9C,IACA,KAAA,CAcN;CACJ;AACJ;;;AChHA,SAAgB,IAAuB;CACnC,OAAO;EACH,IAAI;EACJ,oBAAoB,CAAC;EACrB,aAAa,GAAS,GAAS,OAAa,EACxC,QAAQ,EACJ,iBAAiB,MAIH;GACV,IAAM,IAAU,GAAS,WAAW,IAC9B,IAAW,GAAS,YAAY,QAChC,IAAS,IAAI,gBAAgB;IAC/B,UAAU,EAAK;IACf,aAAa,EAAK;GACtB,CAAC;GAID,OAHI,EAAK,oBACL,EAAO,IAAI,oBAAoB,EAAK,gBAAgB,GAEjD,GAAG,EAAQ,GAAG,EAAS,2BAA2B;EAC7D,EACJ,EACJ;CACJ;AACJ;;;ACrBA,SAAS,IAAwB;CAC7B,OAAO;EACH,IAAI;EACJ,aAAa,OAAY,EACrB,QAAQ,EACJ,iBAAiB,OAAO,MACb,EAGJ,6BAA6B;GAC5B,QAAQ;GACR,MAAM;EACV,CAAC,EAET,EACJ;EACA,aAAa,EACT,6BAA6B,OACjC;CACJ;AACJ;AAEA,SAAS,IAAqB;CAC1B,OAAO;EACH,IAAI;EACJ,aAAa,OAAY,EACrB,QAAQ,EACJ,eAAe,OAAO,MACX,EAGJ,2BAA2B;GAC1B,QAAQ;GACR,MAAM;EACV,CAAC,EAET,EACJ;EACA,aAAa,EACT,2BAA2B,OAC/B;EACA,eAAe,CACX;GACI,UAAU,MAAiB,MAAS;GACpC,QAAQ;EACZ,CACJ;CACJ;AACJ;AAgBA,SAAgB,EACZ,IAgBI,CAAC,GACP;CACE,IAAM,IAAS,EAAI,EAAiB,EAAQ,UAAU,CAAC,GAEjD,IAAQ,EAAS;EACnB,WAAW,EAAO;EAClB,MAAM,MAAkB;GAEpB,AADA,EAAiB,GAAO,EAAQ,UAAU,GAC1C,EAAO,QAAQ;EACnB;CACJ,CAAC,GAEK,IAAU,QACZ,EAAM,QAAQ,EAAE,eAAe,UAAU,EAAM,QAAQ,IAAI,KAAA,CAC/D,GAEM,IAAS,EAAiB;EAC5B,SAAS,EAAQ,WAAA,KAAA;EACjB,UAAU,EAAQ,YAAA;EAClB,SAAS;GACL,EAAmC;GACnC,EAAgB;GAChB,EAAsB;GACtB,EAAmB;GACnB,EAAqB;EACzB;EACA,cAAc;GACV,YAAY,MAAQ;IAChB,IAAM,IACF,EAAI,SAAS,QAAQ,IAAI,gBAAgB;IAC7C,AAAI,MACA,EAAM,QAAQ;GAEtB;GACA,MAAM;IACF,MAAM;IACN,aAAa,EAAM;GACvB;EACJ;CACJ,CAAC,GAEK,IAAU,EAAO,WAAW,GAC5B,IAAmB,EAAI,EAAK,GAC5B,IAAgB,QAAe,EAAQ,EAAQ,aAAa,CAAC,GAC7D,IAAW,QAAe,EAAQ,EAAQ,QAAQ,KAAK,EAAI,GAQ3D,IAAsB,EAAI,EAAc,KAAK,GAI7C,IAAiB,QAEf,CAAC,CAAC,EAAc,SAChB,CAAC,CAAC,EAAQ,sBACV,CAAC,CAAC,EAAoB,KAC9B,GAOI,IAA2B,QAAQ,QAAQ;CAC/C,SAAS,EAAiB,GAA0C;EAChE,IAAM,IAAM,EAAU,KAAK,GAAM,CAAI;EAErC,OADA,IAAY,GACL;CACX;CAIA,QACU,EAAQ,MAAM,MAAM,OACzB,GAAM,MAAiB;EAOpB,AANI,KAAQ,EAAK,OAAO,GAAc,MAClC,EAAQ,aAAa;GACjB,QAAQ,EAAK;GACb,aAAa,CAAC,CAAC,EAAK;EACxB,CAAC,GAED,CAAC,KAAQ,KACT,EAAQ,cAAc;CAE9B,CACJ;CAEA,eAAe,IAAmC;EAC9C,IAAM,EAAE,YAAS,MAAM,EAAO,OAAO,UAAU;EAC/C,AAAI,GAAM,UACN,EAAM,QAAQ,EAAK,OACf,EAAK,MAAM,MACX,EACI,EAAK,KAAK,IACV,EAAQ,UACZ;CAGZ;CAMA,eAAe,IAAuC;EAClD,IAAM,IAAe,EAAyB,EAAQ,UAAU;EAChE,IAAI,CAAC,GACD,OAAO;EAEX,IAAI;GACA,IAAM,EAAE,YAAS,MAAM,EAAO,OAAO,gBAAgB,EACjD,QAAQ,EACZ,CAAC;GACD,IAAI,GAAM,OAGN,OAFA,EAAM,QAAQ,EAAK,OACnB,MAAM,EAAQ,MAAM,QAAQ,GACrB;EAEf,QAAQ,CAER;EACA,OAAO;CACX;CAGA,eAAe,IAA2C;EAEtD,AAAK,MADkB,EAAmB,KAEtC,MAAM,EAAkB;CAEhC;CAOA,eAAe,EACX,GACa;EACT,EAAoB,UAAU,MAIlC,EAAQ,wBAAwB,GAC5B,GAAQ,sBAGZ,MAAM,EAA0B;CACpC;CAGA,eAAe,EACX,GACa;EACb,EAAiB,QAAQ;EACzB,IAAI;GACA,IAAM,EAAE,YAAS,MAAM,EAAO,OAAO,cAAc,EAC/C,OAAO,EACX,CAAC;GACD,IAAI,EAAoB,UAAU,GAE9B;GAEJ,IAAI,GAAM,OAAO;IAEb,AADA,EAAM,QAAQ,EAAK,OACnB,MAAM,EAAQ,MAAM,QAAQ;IAC5B;GACJ;GACA,MAAM,EAA2B,CAAgB;EACrD,QAAQ;GACJ,MAAM,EAA2B,CAAgB;EACrD,UAAU;GACN,EAAiB,QAAQ;EAC7B;CACJ;CAGA,IAAI,GASA,GAGA,IAA4B;CAEhC,eAAe,EACX,GACa;EACT,OAAC,KAAoB,MAAyB,IAKlD;GAFA,EAAoB,QAAQ,GAC5B,IAAyB,GACzB,IAAuB;GACvB,IAAI;IACA,MAAM,EAAiB,YAAY;KAC3B,EAAoB,UAAU,KAIlC,MAAM,EAAsB,CAAgB;IAChD,CAAC;GACL,UAAU;IACN,IAAuB,KAAA;GAC3B;EAXuB;CAY3B;CAEA,eAAe,IAA+C;EACtD,EAAiB,SAIrB,MAAM,EAAiB,YAAY;GAC3B,OAAoB,OAIxB;MAAiB,QAAQ;IACzB,IAAI;KACA,MAAM,EAA0B;IACpC,UAAU;KACN,EAAiB,QAAQ;IAC7B;GALyB;EAM7B,CAAC;CACL;CA6EA,AA3EA,EACI,CAAC,GAAU,CAAO,IACjB,CAAC,GAAa,OAAgB;EAC3B,IAAI,CAAC,GACD;EAEJ,IACI,CAAC,EAAW,aACZ,CAAC,EAAW,gBACZ,CAAC,EAAiB,SAClB,CAAC,EAAW,MACd;GACE,IAAI,EAAoB,OAAO;IAC3B,EAAwB,EAAoB,KAAK;IACjD;GACJ;GACA,IAAI,EAAQ,oBACR;GAEJ,EAA8B;GAC9B;EACJ;EAEA,IAAM,IAAO,EAAW,MAAM;EAM9B,IACI,EAAW,MAAM,SAAS,iBAC1B,CAAC,GACH;GAEE,IADA,IAA4B,IACxB,CAAC,EAAoB,OAAO;IAK5B,EAAQ;IACR;GACJ;GACA,IAAI,MAA2B,EAAoB,OAAO;IAItD,EAAwB,EAAoB,KAAK;IACjD;GACJ;EACJ;EAKA,IACI,GAAM,eACN,EAAoB,SACpB,MAA2B,EAAoB,OACjD;GACE,EAAwB,EAAoB,KAAK;GACjD;EACJ;EAGA,AACI,GAAM,eACN,EAAK,MACL,CAAC,EAAyB,EAAQ,UAAU,KAE5C,EAAyB,EAAK,IAAc,EAAQ,UAAU;CAEtE,GACA,EAAE,WAAW,GAAK,CACtB,GAEA,EAAM,IAAgB,GAAU,MAAkB;EAC9C,IAAI,GAAU;GAIV,AADA,EAAoB,QAAQ,GACxB,EAAS,SACT,EAAwB,CAAQ;GAEpC;EACJ;EAIA,AAAI,KAAiB,EAAoB,UAAU,KAC/C,EAAQ;CAEhB,CAAC;CAED,SAAS,EAAQ,GAAwD;EACjE,MAAM,WAAW,KAGrB;OAAI,EAAoB,OAAO;IAC3B,EAAwB,EAAoB,KAAK;IACjD;GACJ;GACI,EAAQ,sBAGZ,EAA8B;EAJ9B;CAKJ;CAEA,IAAM,IAAS,QAAe,EAAQ,MAAM,MAAM,MAAM,EAAE;CAG1D,eAAe,EACX,GACA,GACA,GACF;EACE,IAAM,IAAS,MAAM,EAAO,OAAO,MAAM;GACrC;GACA;GACA;EACJ,CAAC;EAYD,OARI,EAAO,MAAM,UACb,EAAM,QAAQ,EAAO,KAAK,OAK1B,EAA2B,EAAQ,UAAU,IAE1C;CACX;CAEA,SAAS,EAAgB,GAItB;EACC,OAAO,EAAO,OAAO,MAAM,CAAM;CACrC;CAEA,SAAS,EAAqB,GAAe,GAAoB;EAC7D,OAAO,EAAO,qBAAqB;GAAE;GAAO;EAAW,CAAC;CAC5D;CAYA,eAAe,EACX,GACA,GACkC;EAClC,IAAM,IAAU,EAAQ,WAAA,KAAA,GAElB,IAAc,GAAG,EAAQ,GADd,EAAQ,YAAA,OACkB,yBACrC,IAAc,EAAO,OAAO,eAAe;GAC7C;GACA;EACJ,CAAC,GAEK,IAAQ,OAAO,KACjB,GACA,mBACA,4CACJ;EAMA,OAJK,IAIE,IAAI,SAAS,MAAY;GAC5B,IAAM,IAAgB,IAAI,IAAI,CAAO,CAAC,CAAC,QAEjC,IAAe,kBAAkB;IACnC,AAAI,GAAO,UACP,EAAO;GAEf,GAAG,GAAG;GAEN,SAAS,IAAS;IAGd,AAFA,OAAO,oBAAoB,WAAW,CAAc,GACpD,cAAc,CAAY,GAC1B,EAAQ,EAAE,cAAc,GAAM,CAAC;GACnC;GAEA,SAAS,EAAe,GAAqB;IAErC,EAAM,WAAW,KACjB,EAAM,MAAM,SAAS,sBAIzB,GAAO,MAAM,GACT,EAAM,KAAK,UACX,EAAM,QAAQ,EAAM,KAAK,OAGzB,EAA2B,EAAQ,UAAU,IAEjD,EAAQ,MAAM,QAAQ,CAAC,CAAC,WAAW,IAAgB,CAAC,GACpD,EAAO;GACX;GAEA,OAAO,iBAAiB,WAAW,CAAc;EACrD,CAAC,IArCU,EAAE,cAAc,GAAK;CAsCpC;CAUA,eAAe,IAAyB;EACpC,EAAoB,QAAQ,KAAA;EAC5B,IAAM,IAAe,EAAM;EAC3B,IAAI;GACA,MAAM,EAAO,QAAQ;EACzB,UAAU;GAQN,AAHI,EAAM,UAAU,MAChB,EAAM,QAAQ,KAElB,MAAM,EAAQ,MAAM,QAAQ;EAChC;CACJ;CAEA,OAAO;EACH;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,cAAc,EAAO,OAAO;EAC5B;EACA;EACA;CACJ;AACJ;;;AClkBA,SAAgB,IAAqB;CACjC,IAAI,IAAgC,MAE9B,KAAwB,MAAiB;EAC3C,EAAM,gBAAgB;CAC1B;CAcA,AAZA,QAAgB;EAEZ,IAAM,IADW,EACA,CAAA,EAAU,OAAO,KAAK,YAAY;EAE7C,aAAoB,eAI1B,IAAa,GACb,EAAW,iBAAiB,WAAW,CAAoB;CAC/D,CAAC,GAED,QAAsB;EACb,AAKL,OADA,EAAW,oBAAoB,WAAW,CAAoB,GACjD;CACjB,CAAC;AACL"}
+{"version":3,"file":"composables.js","names":[],"sources":["../src/utils/cookie.ts","../src/utils/index.ts","../src/composables/useChatbotAgent.ts","../../../packages/auth/src/social-redirect-client-plugin.ts","../src/composables/useChatbotAuth.ts","../src/composables/useFocusTrapBypass.ts"],"sourcesContent":["import { logger } from 'utils'\n\nconst DEFAULT_COOKIE_NAME = 'eight-wave-ai'\nconst DEFAULT_USER_ID_COOKIE_SUFFIX = '-uid'\nconst MAX_AGE_ONE_YEAR = 31536000\n\nfunction setCookie(name: string, value: string, maxAge: number) {\n    try {\n        // A past `expires` accompanies `max-age=0` on deletion: some cookie\n        // implementations (older browsers, happy-dom) only honor the former.\n        const expires =\n            maxAge > 0 ? '' : '; expires=Thu, 01 Jan 1970 00:00:00 GMT'\n        document.cookie = `${name}=${value}; path=/; max-age=${maxAge}${expires}; SameSite=Lax; Secure`\n    } catch (error) {\n        logger.warn(\n            '[cookie] setCookie blocked (cross-origin/tracking protection)',\n            error,\n        )\n    }\n}\n\nfunction getCookie(name: string): string {\n    try {\n        // Only split on the FIRST \"=\" — session tokens are signed with a\n        // base64 signature that can contain \"=\" padding, so splitting on every\n        // \"=\" would truncate the value and corrupt the token.\n        const prefix = `${name}=`\n        const row = document.cookie\n            .split('; ')\n            .find((entry) => entry.startsWith(prefix))\n        return row ? row.slice(prefix.length) : ''\n    } catch (error) {\n        logger.warn(\n            '[cookie] getCookie blocked (cross-origin/tracking protection)',\n            error,\n        )\n        return ''\n    }\n}\n\n// create first-party session cookie for authentication with 1 year expiry;\n// an empty token (sign-out) deletes the cookie instead of storing an empty value\nexport function setSessionCookie(\n    token: string,\n    cookieName: string = DEFAULT_COOKIE_NAME,\n) {\n    setCookie(cookieName, token, token ? MAX_AGE_ONE_YEAR : 0)\n}\n\n// retrieve first-party session cookie\nexport function getSessionCookie(cookieName: string = DEFAULT_COOKIE_NAME) {\n    return getCookie(cookieName)\n}\n\n// persist anonymous userId alongside session token to enable re-auth after session expiry\nexport function setAnonymousUserIdCookie(\n    userId: string,\n    cookieName: string = DEFAULT_COOKIE_NAME,\n) {\n    setCookie(\n        `${cookieName}${DEFAULT_USER_ID_COOKIE_SUFFIX}`,\n        userId,\n        MAX_AGE_ONE_YEAR,\n    )\n}\n\n// retrieve persisted anonymous userId\nexport function getAnonymousUserIdCookie(\n    cookieName: string = DEFAULT_COOKIE_NAME,\n) {\n    return getCookie(`${cookieName}${DEFAULT_USER_ID_COOKIE_SUFFIX}`)\n}\n\n// remove the persisted anonymous userId once the anonymous user links a real\n// account (the linked anonymous user is deleted server-side, so it's stale)\nexport function clearAnonymousUserIdCookie(\n    cookieName: string = DEFAULT_COOKIE_NAME,\n) {\n    setCookie(`${cookieName}${DEFAULT_USER_ID_COOKIE_SUFFIX}`, '', 0)\n}\n","export * from './cookie'\n\nexport const BACKEND_URL: string = import.meta.env.VITE_BACKEND_URL\nexport const FRONTEND_URL: string = import.meta.env.VITE_FRONTEND_URL\nexport const AUTH_BASE_PATH = 'auth'\n","import type { MaybeRefOrGetter } from 'vue'\nimport { computed, ref, toValue, watch } from 'vue'\nimport type { AgentBranding, AgentPublic, AuthMethods } from 'models'\nimport { createChatbotApiClient } from 'composables'\nimport { resolveContrastColor } from 'components/src/chat/utils'\nimport { BACKEND_URL } from '~/utils'\n\nexport function useChatbotAgent(options: {\n    baseUrl?: string\n    basePath?: string\n    organizationSlug?: MaybeRefOrGetter<string>\n    agentId?: MaybeRefOrGetter<string>\n    headers?: MaybeRefOrGetter<Record<string, string> | undefined>\n    /**\n     * Host-provided color scheme override, applied when the agent theme is\n     * `auto`. Mirrors the precedence used by the chatbot store: agent theme,\n     * then this override, then the OS `prefers-color-scheme`.\n     */\n    systemTheme?: MaybeRefOrGetter<'light' | 'dark' | undefined>\n}) {\n    const agent = ref<AgentPublic>()\n    const branding = ref<AgentBranding>()\n    const authMethods = ref<AuthMethods>()\n    const requiresAuth = ref(false)\n    const notFound = ref(false)\n    const isLoading = ref(false)\n\n    async function load() {\n        const orgSlug = toValue(options.organizationSlug)\n        const agentId = toValue(options.agentId)\n        if (!orgSlug || !agentId) {\n            return\n        }\n        const apiClient = createChatbotApiClient({\n            baseUrl: options.baseUrl ?? BACKEND_URL,\n            basePath: options.basePath,\n            headers: () => toValue(options.headers),\n        })\n        isLoading.value = true\n        try {\n            const result = await apiClient.getAgentAccess(orgSlug, agentId)\n            authMethods.value = result.authMethods\n            if (result.requiresAuth) {\n                requiresAuth.value = true\n                branding.value = result.branding ?? undefined\n                agent.value = undefined\n            } else {\n                requiresAuth.value = false\n                branding.value = undefined\n                agent.value = result.agent ?? undefined\n            }\n            notFound.value = false\n        } catch {\n            notFound.value = true\n            agent.value = undefined\n            branding.value = undefined\n            requiresAuth.value = false\n        } finally {\n            isLoading.value = false\n        }\n    }\n\n    // Reload when org/agent changes\n    watch(\n        [\n            () => toValue(options.organizationSlug),\n            () => toValue(options.agentId),\n        ],\n        () => {\n            load()\n        },\n        { immediate: true },\n    )\n\n    // Reload when headers change meaningfully (e.g. after login) and auth is required\n    watch(\n        () => toValue(options.headers),\n        () => {\n            if (requiresAuth.value) {\n                load()\n            }\n        },\n    )\n\n    // Branding-aware theming: fall back to branding when agent is not available\n    const source = computed(\n        () => agent.value?.interface ?? branding.value?.interface,\n    )\n\n    const contrastColor = computed(() =>\n        resolveContrastColor(source.value?.textColor, source.value?.mainColor),\n    )\n    const mainColor = computed(() => source.value?.mainColor)\n\n    const themeClass = computed(() => {\n        const theme = source.value?.theme\n        if (theme && theme !== 'auto') {\n            return ['theme', `theme--${theme}`]\n        }\n        const systemTheme = toValue(options.systemTheme)\n        if (systemTheme) {\n            return ['theme', `theme--${systemTheme}`]\n        }\n        return ['theme']\n    })\n\n    const themeStyle = computed(() =>\n        source.value\n            ? {\n                  '--chatbot-main-color': mainColor.value,\n                  '--chatbot-contrast-color': contrastColor.value,\n              }\n            : undefined,\n    )\n\n    return {\n        agent,\n        branding,\n        authMethods,\n        requiresAuth,\n        notFound,\n        isLoading,\n        reload: load,\n        contrastColor,\n        mainColor,\n        themeClass,\n        themeStyle,\n    }\n}\n","import type { BetterAuthClientPlugin } from 'better-auth/client'\nimport type { socialRedirect } from './social-redirect-plugin'\n\n/**\n * Client counterpart of the server `socialRedirect()` plugin.\n *\n * Exposes `authClient.signIn.socialRedirect(...)`, which builds the URL of the\n * backend `/sign-in/social-redirect` endpoint from the client's configured\n * `baseURL`/`basePath` and returns it as a string.\n *\n * It intentionally does NOT navigate: the caller decides how to use the URL —\n * the main app does a top-level `window.location` navigation, the embeddable\n * widget opens it in a popup. Building the URL here (instead of a cross-origin\n * `signIn.social` XHR) keeps the OAuth `state` cookie first-party on the backend\n * origin and avoids the `state_mismatch` failure.\n */\nexport function socialRedirectClient() {\n    return {\n        id: 'social-redirect',\n        $InferServerPlugin: {} as ReturnType<typeof socialRedirect>,\n        getActions: (_$fetch, _$store, options) => ({\n            signIn: {\n                socialRedirect: (opts: {\n                    provider: string\n                    callbackURL: string\n                    errorCallbackURL?: string\n                }): string => {\n                    const baseURL = options?.baseURL ?? ''\n                    const basePath = options?.basePath ?? 'auth'\n                    const params = new URLSearchParams({\n                        provider: opts.provider,\n                        callbackURL: opts.callbackURL,\n                    })\n                    if (opts.errorCallbackURL) {\n                        params.set('errorCallbackURL', opts.errorCallbackURL)\n                    }\n                    return `${baseURL}/${basePath}/sign-in/social-redirect?${params}`\n                },\n            },\n        }),\n    } satisfies BetterAuthClientPlugin\n}\n","import type { MaybeRefOrGetter } from 'vue'\nimport type { BetterAuthClientPlugin } from 'better-auth/client'\nimport type { auth } from 'auth'\nimport { socialRedirectClient } from 'auth/src/social-redirect-client-plugin'\nimport { computed, ref, watch, toValue } from 'vue'\nimport { createAuthClient } from 'better-auth/vue'\nimport {\n    inferAdditionalFields,\n    anonymousClient,\n} from 'better-auth/client/plugins'\nimport {\n    getSessionCookie,\n    setSessionCookie,\n    getAnonymousUserIdCookie,\n    setAnonymousUserIdCookie,\n    clearAnonymousUserIdCookie,\n    BACKEND_URL,\n    AUTH_BASE_PATH,\n} from '~/utils'\n\nfunction anonymousReauthClient() {\n    return {\n        id: 'anonymous-reauth' as const,\n        getActions: ($fetch) => ({\n            signIn: {\n                anonymousReauth: async (data: { userId: string }) => {\n                    return $fetch<{\n                        token: string\n                        user: Record<string, unknown>\n                    }>('/sign-in/anonymous-reauth', {\n                        method: 'POST',\n                        body: data,\n                    })\n                },\n            },\n        }),\n        pathMethods: {\n            '/sign-in/anonymous-reauth': 'POST' as const,\n        },\n    } satisfies BetterAuthClientPlugin\n}\n\nfunction externalAuthClient() {\n    return {\n        id: 'external-auth' as const,\n        getActions: ($fetch) => ({\n            signIn: {\n                externalToken: async (data: { token: string }) => {\n                    return $fetch<{\n                        token: string\n                        user: Record<string, unknown>\n                    }>('/sign-in/external-token', {\n                        method: 'POST',\n                        body: data,\n                    })\n                },\n            },\n        }),\n        pathMethods: {\n            '/sign-in/external-token': 'POST' as const,\n        },\n        atomListeners: [\n            {\n                matcher: (path: string) => path === '/sign-in/external-token',\n                signal: '$sessionSignal' as const,\n            },\n        ],\n    } satisfies BetterAuthClientPlugin\n}\n\ntype AuthClientOptions = {\n    baseURL?: string\n    basePath?: string\n    plugins: [\n        ReturnType<typeof inferAdditionalFields<typeof auth>>,\n        ReturnType<typeof anonymousClient>,\n        ReturnType<typeof anonymousReauthClient>,\n        ReturnType<typeof externalAuthClient>,\n        ReturnType<typeof socialRedirectClient>,\n    ]\n}\n\nexport type AuthClient = ReturnType<typeof createAuthClient<AuthClientOptions>>\n\nexport function useChatbotAuth(\n    options: {\n        baseUrl?: string\n        basePath?: string\n        externalToken?: MaybeRefOrGetter<string | undefined>\n        awaitExternalToken?: boolean\n        /**\n         * Host-session mode: the widget never signs in on its own and sends\n         * no Authorization header; the session comes from the host\n         * platform's better-auth cookie (sent thanks to\n         * `credentials: 'include'`). The session belongs to the host, so\n         * account management is hidden and `signOut` is a no-op. Intended\n         * for the widget embedded in the platform itself (Backoffice\n         * copilot, spec platform-copilot-session-bridge.md); it only works\n         * where the host cookie context works, not on third-party embeds.\n         */\n        useHostSession?: MaybeRefOrGetter<boolean | undefined>\n        isActive?: MaybeRefOrGetter<boolean>\n        cookieName?: string\n        /** Called when a session is established or the user changes. */\n        onSignedIn?: (detail: { userId: string; isAnonymous: boolean }) => void\n        /** Called when the session ends without an immediate replacement. */\n        onSignedOut?: () => void\n        /**\n         * Called when an external token sign-in fails (expired token, invalid\n         * signature or disabled config): the host should provide a fresh token.\n         */\n        onExternalAuthExpired?: () => void\n    } = {},\n) {\n    const _token = ref(getSessionCookie(options.cookieName))\n    const useHostSession = computed(\n        () => toValue(options.useHostSession) ?? false,\n    )\n\n    const token = computed({\n        get: () => _token.value,\n        set: (token: string) => {\n            setSessionCookie(token, options.cookieName)\n            _token.value = token\n        },\n    })\n\n    const headers = computed(() =>\n        !useHostSession.value && token.value\n            ? { Authorization: `Bearer ${token.value}` }\n            : undefined,\n    )\n\n    const client = createAuthClient({\n        baseURL: options.baseUrl ?? BACKEND_URL,\n        basePath: options.basePath ?? AUTH_BASE_PATH,\n        plugins: [\n            inferAdditionalFields<typeof auth>(),\n            anonymousClient(),\n            anonymousReauthClient(),\n            externalAuthClient(),\n            socialRedirectClient(),\n        ],\n        fetchOptions: {\n            onSuccess: (ctx) => {\n                if (useHostSession.value) {\n                    // The host session token must never be persisted as the\n                    // widget's own Bearer: it would keep impersonating the\n                    // host after the mode is turned off.\n                    return\n                }\n                const newTokenFromHeader =\n                    ctx.response.headers.get('set-auth-token')\n                if (newTokenFromHeader) {\n                    token.value = newTokenFromHeader\n                }\n            },\n            auth: {\n                type: 'Bearer',\n                // Host-session mode relies on the cookie alone: the widget's\n                // stored Bearer (e.g. a previous anonymous session) would\n                // shadow it.\n                token: () => (useHostSession.value ? '' : token.value),\n            },\n            // Only host-session mode may exchange cookies: with credentials\n            // on, an anonymous sign-in's Set-Cookie would REPLACE the user's\n            // platform session cookie on the backend origin.\n            customFetchImpl: (input, init) =>\n                fetch(input, {\n                    ...init,\n                    credentials: useHostSession.value\n                        ? 'include'\n                        : init?.credentials,\n                }),\n        },\n    }) as AuthClient\n\n    const session = client.useSession()\n    const isAuthenticating = ref(false)\n    const externalToken = computed(() => toValue(options.externalToken))\n    const isActive = computed(() => toValue(options.isActive) ?? true)\n\n    /**\n     * External token currently authorized for automatic (re-)authentication.\n     * Follows the `externalToken` option and imperative sign-in calls; cleared\n     * by `signOut`, so the watchers never re-login with a token the host has\n     * withdrawn.\n     */\n    const activeExternalToken = ref(externalToken.value)\n\n    // External token / host-session mode: the host application owns the auth\n    // lifecycle, so the widget must not offer account management (sign-out,\n    // profile).\n    const isExternalAuth = computed(\n        () =>\n            !!externalToken.value ||\n            !!options.awaitExternalToken ||\n            !!activeExternalToken.value ||\n            useHostSession.value,\n    )\n\n    /**\n     * Serializes sign-in operations: a request arriving while another is in\n     * flight runs right after it instead of being dropped. Each task re-checks\n     * state when it starts, so superseded requests no-op.\n     */\n    let authChain: Promise<void> = Promise.resolve()\n    function runExclusiveAuth(task: () => Promise<void>): Promise<void> {\n        const run = authChain.then(task, task)\n        authChain = run\n        return run\n    }\n\n    // Notify the host on session transitions, whatever flow caused them\n    // (anonymous, external token, email, social).\n    watch(\n        () => session.value.data?.user,\n        (user, previousUser) => {\n            if (user && user.id !== previousUser?.id) {\n                options.onSignedIn?.({\n                    userId: user.id,\n                    isAnonymous: !!user.isAnonymous,\n                })\n            }\n            if (!user && previousUser) {\n                options.onSignedOut?.()\n            }\n        },\n    )\n\n    async function signInAnonymously(): Promise<void> {\n        const { data } = await client.signIn.anonymous()\n        if (data?.token) {\n            token.value = data.token\n            if (data.user?.id) {\n                setAnonymousUserIdCookie(\n                    data.user.id as string,\n                    options.cookieName,\n                )\n            }\n        }\n    }\n\n    /**\n     * Attempts to create a new session for an existing anonymous user.\n     * Returns true if re-auth succeeded, false otherwise.\n     */\n    async function tryAnonymousReauth(): Promise<boolean> {\n        const storedUserId = getAnonymousUserIdCookie(options.cookieName)\n        if (!storedUserId) {\n            return false\n        }\n        try {\n            const { data } = await client.signIn.anonymousReauth({\n                userId: storedUserId,\n            })\n            if (data?.token) {\n                token.value = data.token\n                await session.value.refetch()\n                return true\n            }\n        } catch {\n            // user record may have been deleted — fall back to creating a new one\n        }\n        return false\n    }\n\n    /** Re-authenticates the stored anonymous user, or creates a fresh one. */\n    async function reauthOrSignInAnonymously(): Promise<void> {\n        const reauthed = await tryAnonymousReauth()\n        if (!reauthed) {\n            await signInAnonymously()\n        }\n    }\n\n    /**\n     * The external token was rejected (expired, invalid or config disabled):\n     * notify the host so it can provide a fresh one, then apply the fallback\n     * (keep waiting in `awaitExternalToken` mode, anonymous otherwise).\n     */\n    async function handleExternalTokenFailure(\n        failedExternalToken: string,\n    ): Promise<void> {\n        if (activeExternalToken.value !== failedExternalToken) {\n            // Withdrawn (sign-out) or replaced while the request was in flight\n            return\n        }\n        options.onExternalAuthExpired?.()\n        if (options.awaitExternalToken) {\n            return\n        }\n        await reauthOrSignInAnonymously()\n    }\n\n    /** Raw token exchange; must run inside `runExclusiveAuth`. */\n    async function exchangeExternalToken(\n        newExternalToken: string,\n    ): Promise<void> {\n        isAuthenticating.value = true\n        try {\n            const { data } = await client.signIn.externalToken({\n                token: newExternalToken,\n            })\n            if (activeExternalToken.value !== newExternalToken) {\n                // Withdrawn (sign-out) or replaced while the request was in flight\n                return\n            }\n            if (data?.token) {\n                token.value = data.token\n                await session.value.refetch()\n                return\n            }\n            await handleExternalTokenFailure(newExternalToken)\n        } catch {\n            await handleExternalTokenFailure(newExternalToken)\n        } finally {\n            isAuthenticating.value = false\n        }\n    }\n\n    /** External token currently queued or in flight, to drop duplicate requests. */\n    let pendingExternalToken: string | undefined\n\n    /**\n     * Last external token an exchange was attempted with, whatever the\n     * trigger. The session watcher consults it so a token that was already\n     * tried is never auto-retried: a rejected token must not loop between\n     * exchange and fallback. Deliberate retries (prop change, imperative\n     * `signIn`, 401 handler) bypass it.\n     */\n    let attemptedExternalToken: string | undefined\n\n    /** The cookie-restored external session was reconciled with the host state. */\n    let externalSessionReconciled = false\n\n    async function signInWithExternalToken(\n        newExternalToken: string,\n    ): Promise<void> {\n        if (!newExternalToken || pendingExternalToken === newExternalToken) {\n            return\n        }\n        activeExternalToken.value = newExternalToken\n        attemptedExternalToken = newExternalToken\n        pendingExternalToken = newExternalToken\n        try {\n            await runExclusiveAuth(async () => {\n                if (activeExternalToken.value !== newExternalToken) {\n                    // Superseded while waiting for the previous operation\n                    return\n                }\n                await exchangeExternalToken(newExternalToken)\n            })\n        } finally {\n            pendingExternalToken = undefined\n        }\n    }\n\n    async function signInAnonymouslyWithFallback(): Promise<void> {\n        if (isAuthenticating.value) {\n            // The `[isActive, session]` watcher retries on the next session change\n            return\n        }\n        await runExclusiveAuth(async () => {\n            if (activeExternalToken.value || useHostSession.value) {\n                // A host-owned sign-in was requested in the meantime\n                return\n            }\n            isAuthenticating.value = true\n            try {\n                await reauthOrSignInAnonymously()\n            } finally {\n                isAuthenticating.value = false\n            }\n        })\n    }\n\n    watch(\n        [isActive, session],\n        ([newIsActive, newSession]) => {\n            if (!newIsActive) {\n                return\n            }\n            if (\n                !newSession.isPending &&\n                !newSession.isRefetching &&\n                !isAuthenticating.value &&\n                !newSession.data\n            ) {\n                if (useHostSession.value) {\n                    // Host-session mode: the session comes from the host\n                    // cookie, the widget never signs in on its own. No\n                    // session means the host is not (or no longer) logged in.\n                    return\n                }\n                if (activeExternalToken.value) {\n                    signInWithExternalToken(activeExternalToken.value)\n                    return\n                }\n                if (options.awaitExternalToken) {\n                    return\n                }\n                signInAnonymouslyWithFallback()\n                return\n            }\n\n            const user = newSession.data?.user\n\n            if (useHostSession.value) {\n                // Host-session mode: the session is read from (and owned by)\n                // the host cookie, none of the widget-session housekeeping\n                // below applies.\n                return\n            }\n\n            // A session created by an external token exchange (the only kind\n            // with `hardExpiresAt`) may have been restored from the cookie\n            // after a page navigation, where prop changes cannot be observed:\n            // reconcile it once with the auth state the host declares now.\n            if (\n                newSession.data?.session?.hardExpiresAt &&\n                !externalSessionReconciled\n            ) {\n                externalSessionReconciled = true\n                if (!activeExternalToken.value) {\n                    // The host no longer provides a token (it logged out\n                    // before this page load): drop the stale session. The\n                    // usual fallback rules apply (keep waiting in\n                    // `awaitExternalToken` mode, anonymous otherwise).\n                    signOut()\n                    return\n                }\n                if (attemptedExternalToken !== activeExternalToken.value) {\n                    // Re-exchange the current token, so a token minted for a\n                    // different user replaces the restored session and an\n                    // expired one raises `external-auth-expired` right away.\n                    signInWithExternalToken(activeExternalToken.value)\n                    return\n                }\n            }\n\n            // Upgrade an anonymous session restored from the cookie when an\n            // external token is available (e.g. the user logged into the host\n            // app between page loads). Attempted once per token.\n            if (\n                user?.isAnonymous &&\n                activeExternalToken.value &&\n                attemptedExternalToken !== activeExternalToken.value\n            ) {\n                signInWithExternalToken(activeExternalToken.value)\n                return\n            }\n\n            // Backfill userId cookie for existing anonymous sessions\n            if (\n                user?.isAnonymous &&\n                user.id &&\n                !getAnonymousUserIdCookie(options.cookieName)\n            ) {\n                setAnonymousUserIdCookie(user.id as string, options.cookieName)\n            }\n        },\n        { immediate: true },\n    )\n\n    // Host-session mode toggle: on entry re-read the session from the host\n    // cookie (the widget Bearer is already suppressed by the mode); on exit\n    // re-read without the cookie, so the `[isActive, session]` watcher\n    // re-establishes the widget's own flow (anonymous or external token).\n    watch(useHostSession, () => {\n        session.value.refetch()\n    })\n\n    watch(externalToken, (newToken, previousToken) => {\n        if (newToken) {\n            // Track the intent even when inactive: the `[isActive, session]`\n            // watcher signs in with it once the widget becomes active.\n            activeExternalToken.value = newToken\n            if (isActive.value) {\n                signInWithExternalToken(newToken)\n            }\n            return\n        }\n        // The host withdrew the token (logged out): sign out without\n        // re-authenticating; the fallback rules apply (keep waiting in\n        // `awaitExternalToken` mode, anonymous otherwise).\n        if (previousToken && activeExternalToken.value === previousToken) {\n            signOut()\n        }\n    })\n\n    function onError(error: { type: string; title: string; status: number }) {\n        if (error.status !== 401) {\n            return\n        }\n        if (useHostSession.value) {\n            // The widget cannot recover a host session on its own (a 401\n            // here means the host session expired): re-read it so the UI\n            // reflects the signed-out state.\n            session.value.refetch()\n            return\n        }\n        if (activeExternalToken.value) {\n            signInWithExternalToken(activeExternalToken.value)\n            return\n        }\n        if (options.awaitExternalToken) {\n            return\n        }\n        signInAnonymouslyWithFallback()\n    }\n\n    const userId = computed(() => session.value.data?.user?.id)\n\n    // Auth methods for widget login screen\n    async function signInWithEmail(\n        email: string,\n        password: string,\n        rememberMe?: boolean,\n    ) {\n        const result = await client.signIn.email({\n            email,\n            password,\n            rememberMe,\n        })\n        // Capture the session token from the response body. Relying solely on\n        // the `set-auth-token` header is unreliable here, so we mirror the\n        // anonymous/social flows and store the token explicitly.\n        if (result.data?.token) {\n            token.value = result.data.token\n            // Signing in from an anonymous session links (and deletes) the\n            // anonymous user server-side, so its stored userId can no longer\n            // be re-authenticated — drop it so a later sign-out falls straight\n            // back to a fresh anonymous session.\n            clearAnonymousUserIdCookie(options.cookieName)\n        }\n        return result\n    }\n\n    function signUpWithEmail(params: {\n        email: string\n        password: string\n        name: string\n    }) {\n        return client.signUp.email(params)\n    }\n\n    function requestPasswordReset(email: string, redirectTo: string) {\n        return client.requestPasswordReset({ email, redirectTo })\n    }\n\n    /**\n     * Opens a popup for social OAuth sign-in.\n     *\n     * The popup performs a top-level navigation to the backend `social-redirect`\n     * endpoint, so the OAuth `state` cookie is set first-party on the backend\n     * origin and survives the round-trip (a cross-origin XHR `signIn.social`\n     * would set it as a third-party cookie that browsers drop, causing\n     * `state_mismatch`). After the flow completes, the backend callback page\n     * posts back the session Bearer token, which we store before refetching.\n     */\n    async function signInWithSocialPopup(\n        provider: 'google' | 'microsoft',\n        onAuthSuccess?: () => void,\n    ): Promise<{ popupBlocked: boolean }> {\n        const baseUrl = options.baseUrl ?? BACKEND_URL\n        const basePath = options.basePath ?? AUTH_BASE_PATH\n        const callbackURL = `${baseUrl}/${basePath}/widget-oauth-callback`\n        const redirectUrl = client.signIn.socialRedirect({\n            provider,\n            callbackURL,\n        })\n\n        const popup = window.open(\n            redirectUrl,\n            'eightwave-oauth',\n            'width=600,height=700,menubar=no,toolbar=no',\n        )\n\n        if (!popup) {\n            return { popupBlocked: true }\n        }\n\n        return new Promise((resolve) => {\n            const allowedOrigin = new URL(baseUrl).origin\n            // Resolve too if the user closes the popup without completing OAuth.\n            const closedPollId = setInterval(() => {\n                if (popup?.closed) {\n                    finish()\n                }\n            }, 500)\n\n            function finish() {\n                window.removeEventListener('message', onOAuthMessage)\n                clearInterval(closedPollId)\n                resolve({ popupBlocked: false })\n            }\n\n            function onOAuthMessage(event: MessageEvent) {\n                const isTrustedOAuthMessage =\n                    event.origin === allowedOrigin &&\n                    event.data?.type === 'eightwave-oauth'\n                if (!isTrustedOAuthMessage) {\n                    return\n                }\n                popup?.close()\n                if (event.data.token) {\n                    token.value = event.data.token\n                    // Same as the email flow: the anonymous user was linked\n                    // and deleted server-side, its stored userId is stale.\n                    clearAnonymousUserIdCookie(options.cookieName)\n                }\n                session.value.refetch().then(() => onAuthSuccess?.())\n                finish()\n            }\n\n            window.addEventListener('message', onOAuthMessage)\n        })\n    }\n\n    /**\n     * Signs the current user out and clears the locally stored session token.\n     * Withdraws the active external token first, so the watchers never\n     * re-authenticate with it: in external mode the host signs the widget back\n     * in (prop change or `signInWithExternalToken`), while in the other modes\n     * the `[isActive, session]` watcher re-establishes an anonymous session\n     * (re-using the stored anonymous userId cookie when present).\n     */\n    async function signOut(): Promise<void> {\n        if (useHostSession.value) {\n            // The session belongs to the host application (cookie): revoking\n            // it from the widget would log the user out of the host too.\n            // Leaving host-session mode is the host's move (prop change).\n            return\n        }\n        activeExternalToken.value = undefined\n        const revokedToken = token.value\n        try {\n            await client.signOut()\n        } finally {\n            // A concurrent exchange may have stored a fresh session token\n            // while the revoke request was in flight (e.g. a host `signIn`\n            // racing the mount-time reconcile): only clear our own token,\n            // never the newer one.\n            if (token.value === revokedToken) {\n                token.value = ''\n            }\n            await session.value.refetch()\n        }\n    }\n\n    return {\n        client,\n        session,\n        isAuthenticating,\n        isExternalAuth,\n        token,\n        headers,\n        onError,\n        userId,\n        signInWithEmail,\n        signUpWithEmail,\n        requestPasswordReset,\n        signInSocial: client.signIn.social,\n        signInWithSocialPopup,\n        signInWithExternalToken,\n        signOut,\n    }\n}\n","import { getCurrentInstance, onBeforeUnmount, onMounted } from 'vue'\n\n/**\n * Prevents external focus-trapping libraries (e.g. Bootstrap 5 modals) from\n * stealing focus away from elements inside this custom element's shadow root.\n *\n * Bootstrap modals attach a `focusin` listener on `document` that pulls focus\n * back whenever it leaves the modal subtree. Because our custom element lives\n * outside the modal in the DOM, every focus event that escapes the shadow root\n * is treated as a \"focus escape\" and gets redirected back into the modal.\n *\n * Fix: intercept `focusin` at the shadow root boundary in the **bubble phase**\n * and stop its propagation. The event still reaches every internal element\n * normally (capture → target → bubble up through the shadow tree), but is\n * stopped at the shadow root before it can re-target and continue to `document`.\n *\n * Must be called inside a `.ce.vue` root component's `<script setup>`.\n */\nexport function useFocusTrapBypass() {\n    let shadowRoot: ShadowRoot | null = null\n\n    const stopFocusPropagation = (event: Event) => {\n        event.stopPropagation()\n    }\n\n    onMounted(() => {\n        const instance = getCurrentInstance()\n        const rootNode = instance?.proxy?.$el?.getRootNode()\n\n        if (!(rootNode instanceof ShadowRoot)) {\n            return\n        }\n\n        shadowRoot = rootNode\n        shadowRoot.addEventListener('focusin', stopFocusPropagation)\n    })\n\n    onBeforeUnmount(() => {\n        if (!shadowRoot) {\n            return\n        }\n\n        shadowRoot.removeEventListener('focusin', stopFocusPropagation)\n        shadowRoot = null\n    })\n}\n"],"mappings":";;;;;;;;;AAEA,IAAM,IAAsB,iBACtB,IAAgC,QAChC,IAAmB;AAEzB,SAAS,EAAU,GAAc,GAAe,GAAgB;CAC5D,IAAI;EAKA,SAAS,SAAS,GAAG,EAAK,GAAG,EAAM,oBAAoB,IADnD,IAAS,IAAI,KAAK,0CACkD;CAC5E,SAAS,GAAO;EACZ,EAAO,KACH,iEACA,CACJ;CACJ;AACJ;AAEA,SAAS,EAAU,GAAsB;CACrC,IAAI;EAIA,IAAM,IAAS,GAAG,EAAK,IACjB,IAAM,SAAS,OAChB,MAAM,IAAI,CAAC,CACX,MAAM,MAAU,EAAM,WAAW,CAAM,CAAC;EAC7C,OAAO,IAAM,EAAI,MAAM,EAAO,MAAM,IAAI;CAC5C,SAAS,GAAO;EAKZ,OAJA,EAAO,KACH,iEACA,CACJ,GACO;CACX;AACJ;AAIA,SAAgB,EACZ,GACA,IAAqB,GACvB;CACE,EAAU,GAAY,GAAO,IAAQ,IAAmB,CAAC;AAC7D;AAGA,SAAgB,EAAiB,IAAqB,GAAqB;CACvE,OAAO,EAAU,CAAU;AAC/B;AAGA,SAAgB,EACZ,GACA,IAAqB,GACvB;CACE,EACI,GAAG,IAAa,KAChB,GACA,CACJ;AACJ;AAGA,SAAgB,EACZ,IAAqB,GACvB;CACE,OAAO,EAAU,GAAG,IAAa,GAA+B;AACpE;AAIA,SAAgB,EACZ,IAAqB,GACvB;CACE,EAAU,GAAG,IAAa,KAAiC,IAAI,CAAC;AACpE;;;AC7EA,IAAa,IAAA,KAAA,GACA,IAAA,KAAA,GACA,IAAiB;;;ACG9B,SAAgB,EAAgB,GAY7B;CACC,IAAM,IAAQ,EAAiB,GACzB,IAAW,EAAmB,GAC9B,IAAc,EAAiB,GAC/B,IAAe,EAAI,EAAK,GACxB,IAAW,EAAI,EAAK,GACpB,IAAY,EAAI,EAAK;CAE3B,eAAe,IAAO;EAClB,IAAM,IAAU,EAAQ,EAAQ,gBAAgB,GAC1C,IAAU,EAAQ,EAAQ,OAAO;EACvC,IAAI,CAAC,KAAW,CAAC,GACb;EAEJ,IAAM,IAAY,EAAuB;GACrC,SAAS,EAAQ,WAAA,KAAA;GACjB,UAAU,EAAQ;GAClB,eAAe,EAAQ,EAAQ,OAAO;EAC1C,CAAC;EACD,EAAU,QAAQ;EAClB,IAAI;GACA,IAAM,IAAS,MAAM,EAAU,eAAe,GAAS,CAAO;GAW9D,AAVA,EAAY,QAAQ,EAAO,aACvB,EAAO,gBACP,EAAa,QAAQ,IACrB,EAAS,QAAQ,EAAO,YAAY,KAAA,GACpC,EAAM,QAAQ,KAAA,MAEd,EAAa,QAAQ,IACrB,EAAS,QAAQ,KAAA,GACjB,EAAM,QAAQ,EAAO,SAAS,KAAA,IAElC,EAAS,QAAQ;EACrB,QAAQ;GAIJ,AAHA,EAAS,QAAQ,IACjB,EAAM,QAAQ,KAAA,GACd,EAAS,QAAQ,KAAA,GACjB,EAAa,QAAQ;EACzB,UAAU;GACN,EAAU,QAAQ;EACtB;CACJ;CAeA,AAZA,EACI,OACU,EAAQ,EAAQ,gBAAgB,SAChC,EAAQ,EAAQ,OAAO,CACjC,SACM;EACF,EAAK;CACT,GACA,EAAE,WAAW,GAAK,CACtB,GAGA,QACU,EAAQ,EAAQ,OAAO,SACvB;EACF,AAAI,EAAa,SACb,EAAK;CAEb,CACJ;CAGA,IAAM,IAAS,QACL,EAAM,OAAO,aAAa,EAAS,OAAO,SACpD,GAEM,IAAgB,QAClB,EAAqB,EAAO,OAAO,WAAW,EAAO,OAAO,SAAS,CACzE,GACM,IAAY,QAAe,EAAO,OAAO,SAAS;CAuBxD,OAAO;EACH;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA,YA/Be,QAAe;GAC9B,IAAM,IAAQ,EAAO,OAAO;GAC5B,IAAI,KAAS,MAAU,QACnB,OAAO,CAAC,SAAS,UAAU,GAAO;GAEtC,IAAM,IAAc,EAAQ,EAAQ,WAAW;GAI/C,OAHI,IACO,CAAC,SAAS,UAAU,GAAa,IAErC,CAAC,OAAO;EACnB,CAqBI;EACA,YApBe,QACf,EAAO,QACD;GACI,wBAAwB,EAAU;GAClC,4BAA4B,EAAc;EAC9C,IACA,KAAA,CAcN;CACJ;AACJ;;;AChHA,SAAgB,IAAuB;CACnC,OAAO;EACH,IAAI;EACJ,oBAAoB,CAAC;EACrB,aAAa,GAAS,GAAS,OAAa,EACxC,QAAQ,EACJ,iBAAiB,MAIH;GACV,IAAM,IAAU,GAAS,WAAW,IAC9B,IAAW,GAAS,YAAY,QAChC,IAAS,IAAI,gBAAgB;IAC/B,UAAU,EAAK;IACf,aAAa,EAAK;GACtB,CAAC;GAID,OAHI,EAAK,oBACL,EAAO,IAAI,oBAAoB,EAAK,gBAAgB,GAEjD,GAAG,EAAQ,GAAG,EAAS,2BAA2B;EAC7D,EACJ,EACJ;CACJ;AACJ;;;ACrBA,SAAS,IAAwB;CAC7B,OAAO;EACH,IAAI;EACJ,aAAa,OAAY,EACrB,QAAQ,EACJ,iBAAiB,OAAO,MACb,EAGJ,6BAA6B;GAC5B,QAAQ;GACR,MAAM;EACV,CAAC,EAET,EACJ;EACA,aAAa,EACT,6BAA6B,OACjC;CACJ;AACJ;AAEA,SAAS,IAAqB;CAC1B,OAAO;EACH,IAAI;EACJ,aAAa,OAAY,EACrB,QAAQ,EACJ,eAAe,OAAO,MACX,EAGJ,2BAA2B;GAC1B,QAAQ;GACR,MAAM;EACV,CAAC,EAET,EACJ;EACA,aAAa,EACT,2BAA2B,OAC/B;EACA,eAAe,CACX;GACI,UAAU,MAAiB,MAAS;GACpC,QAAQ;EACZ,CACJ;CACJ;AACJ;AAgBA,SAAgB,EACZ,IA2BI,CAAC,GACP;CACE,IAAM,IAAS,EAAI,EAAiB,EAAQ,UAAU,CAAC,GACjD,IAAiB,QACb,EAAQ,EAAQ,cAAc,KAAK,EAC7C,GAEM,IAAQ,EAAS;EACnB,WAAW,EAAO;EAClB,MAAM,MAAkB;GAEpB,AADA,EAAiB,GAAO,EAAQ,UAAU,GAC1C,EAAO,QAAQ;EACnB;CACJ,CAAC,GAEK,IAAU,QACZ,CAAC,EAAe,SAAS,EAAM,QACzB,EAAE,eAAe,UAAU,EAAM,QAAQ,IACzC,KAAA,CACV,GAEM,IAAS,EAAiB;EAC5B,SAAS,EAAQ,WAAA,KAAA;EACjB,UAAU,EAAQ,YAAA;EAClB,SAAS;GACL,EAAmC;GACnC,EAAgB;GAChB,EAAsB;GACtB,EAAmB;GACnB,EAAqB;EACzB;EACA,cAAc;GACV,YAAY,MAAQ;IAChB,IAAI,EAAe,OAIf;IAEJ,IAAM,IACF,EAAI,SAAS,QAAQ,IAAI,gBAAgB;IAC7C,AAAI,MACA,EAAM,QAAQ;GAEtB;GACA,MAAM;IACF,MAAM;IAIN,aAAc,EAAe,QAAQ,KAAK,EAAM;GACpD;GAIA,kBAAkB,GAAO,MACrB,MAAM,GAAO;IACT,GAAG;IACH,aAAa,EAAe,QACtB,YACA,GAAM;GAChB,CAAC;EACT;CACJ,CAAC,GAEK,IAAU,EAAO,WAAW,GAC5B,IAAmB,EAAI,EAAK,GAC5B,IAAgB,QAAe,EAAQ,EAAQ,aAAa,CAAC,GAC7D,IAAW,QAAe,EAAQ,EAAQ,QAAQ,KAAK,EAAI,GAQ3D,IAAsB,EAAI,EAAc,KAAK,GAK7C,IAAiB,QAEf,CAAC,CAAC,EAAc,SAChB,CAAC,CAAC,EAAQ,sBACV,CAAC,CAAC,EAAoB,SACtB,EAAe,KACvB,GAOI,IAA2B,QAAQ,QAAQ;CAC/C,SAAS,EAAiB,GAA0C;EAChE,IAAM,IAAM,EAAU,KAAK,GAAM,CAAI;EAErC,OADA,IAAY,GACL;CACX;CAIA,QACU,EAAQ,MAAM,MAAM,OACzB,GAAM,MAAiB;EAOpB,AANI,KAAQ,EAAK,OAAO,GAAc,MAClC,EAAQ,aAAa;GACjB,QAAQ,EAAK;GACb,aAAa,CAAC,CAAC,EAAK;EACxB,CAAC,GAED,CAAC,KAAQ,KACT,EAAQ,cAAc;CAE9B,CACJ;CAEA,eAAe,IAAmC;EAC9C,IAAM,EAAE,YAAS,MAAM,EAAO,OAAO,UAAU;EAC/C,AAAI,GAAM,UACN,EAAM,QAAQ,EAAK,OACf,EAAK,MAAM,MACX,EACI,EAAK,KAAK,IACV,EAAQ,UACZ;CAGZ;CAMA,eAAe,IAAuC;EAClD,IAAM,IAAe,EAAyB,EAAQ,UAAU;EAChE,IAAI,CAAC,GACD,OAAO;EAEX,IAAI;GACA,IAAM,EAAE,YAAS,MAAM,EAAO,OAAO,gBAAgB,EACjD,QAAQ,EACZ,CAAC;GACD,IAAI,GAAM,OAGN,OAFA,EAAM,QAAQ,EAAK,OACnB,MAAM,EAAQ,MAAM,QAAQ,GACrB;EAEf,QAAQ,CAER;EACA,OAAO;CACX;CAGA,eAAe,IAA2C;EAEtD,AAAK,MADkB,EAAmB,KAEtC,MAAM,EAAkB;CAEhC;CAOA,eAAe,EACX,GACa;EACT,EAAoB,UAAU,MAIlC,EAAQ,wBAAwB,GAC5B,GAAQ,sBAGZ,MAAM,EAA0B;CACpC;CAGA,eAAe,EACX,GACa;EACb,EAAiB,QAAQ;EACzB,IAAI;GACA,IAAM,EAAE,YAAS,MAAM,EAAO,OAAO,cAAc,EAC/C,OAAO,EACX,CAAC;GACD,IAAI,EAAoB,UAAU,GAE9B;GAEJ,IAAI,GAAM,OAAO;IAEb,AADA,EAAM,QAAQ,EAAK,OACnB,MAAM,EAAQ,MAAM,QAAQ;IAC5B;GACJ;GACA,MAAM,EAA2B,CAAgB;EACrD,QAAQ;GACJ,MAAM,EAA2B,CAAgB;EACrD,UAAU;GACN,EAAiB,QAAQ;EAC7B;CACJ;CAGA,IAAI,GASA,GAGA,IAA4B;CAEhC,eAAe,EACX,GACa;EACT,OAAC,KAAoB,MAAyB,IAKlD;GAFA,EAAoB,QAAQ,GAC5B,IAAyB,GACzB,IAAuB;GACvB,IAAI;IACA,MAAM,EAAiB,YAAY;KAC3B,EAAoB,UAAU,KAIlC,MAAM,EAAsB,CAAgB;IAChD,CAAC;GACL,UAAU;IACN,IAAuB,KAAA;GAC3B;EAXuB;CAY3B;CAEA,eAAe,IAA+C;EACtD,EAAiB,SAIrB,MAAM,EAAiB,YAAY;GAC3B,QAAoB,SAAS,EAAe,QAIhD;MAAiB,QAAQ;IACzB,IAAI;KACA,MAAM,EAA0B;IACpC,UAAU;KACN,EAAiB,QAAQ;IAC7B;GALyB;EAM7B,CAAC;CACL;CAkGA,AAhGA,EACI,CAAC,GAAU,CAAO,IACjB,CAAC,GAAa,OAAgB;EAC3B,IAAI,CAAC,GACD;EAEJ,IACI,CAAC,EAAW,aACZ,CAAC,EAAW,gBACZ,CAAC,EAAiB,SAClB,CAAC,EAAW,MACd;GACE,IAAI,EAAe,OAIf;GAEJ,IAAI,EAAoB,OAAO;IAC3B,EAAwB,EAAoB,KAAK;IACjD;GACJ;GACA,IAAI,EAAQ,oBACR;GAEJ,EAA8B;GAC9B;EACJ;EAEA,IAAM,IAAO,EAAW,MAAM;EAE1B,OAAe,OAWnB;OACI,EAAW,MAAM,SAAS,iBAC1B,CAAC,GACH;IAEE,IADA,IAA4B,IACxB,CAAC,EAAoB,OAAO;KAK5B,EAAQ;KACR;IACJ;IACA,IAAI,MAA2B,EAAoB,OAAO;KAItD,EAAwB,EAAoB,KAAK;KACjD;IACJ;GACJ;GAKA,IACI,GAAM,eACN,EAAoB,SACpB,MAA2B,EAAoB,OACjD;IACE,EAAwB,EAAoB,KAAK;IACjD;GACJ;GAGA,AACI,GAAM,eACN,EAAK,MACL,CAAC,EAAyB,EAAQ,UAAU,KAE5C,EAAyB,EAAK,IAAc,EAAQ,UAAU;EApBlE;CAsBJ,GACA,EAAE,WAAW,GAAK,CACtB,GAMA,EAAM,SAAsB;EACxB,EAAQ,MAAM,QAAQ;CAC1B,CAAC,GAED,EAAM,IAAgB,GAAU,MAAkB;EAC9C,IAAI,GAAU;GAIV,AADA,EAAoB,QAAQ,GACxB,EAAS,SACT,EAAwB,CAAQ;GAEpC;EACJ;EAIA,AAAI,KAAiB,EAAoB,UAAU,KAC/C,EAAQ;CAEhB,CAAC;CAED,SAAS,EAAQ,GAAwD;EACjE,MAAM,WAAW,KAGrB;OAAI,EAAe,OAAO;IAItB,EAAQ,MAAM,QAAQ;IACtB;GACJ;GACA,IAAI,EAAoB,OAAO;IAC3B,EAAwB,EAAoB,KAAK;IACjD;GACJ;GACI,EAAQ,sBAGZ,EAA8B;EAR9B;CASJ;CAEA,IAAM,IAAS,QAAe,EAAQ,MAAM,MAAM,MAAM,EAAE;CAG1D,eAAe,EACX,GACA,GACA,GACF;EACE,IAAM,IAAS,MAAM,EAAO,OAAO,MAAM;GACrC;GACA;GACA;EACJ,CAAC;EAYD,OARI,EAAO,MAAM,UACb,EAAM,QAAQ,EAAO,KAAK,OAK1B,EAA2B,EAAQ,UAAU,IAE1C;CACX;CAEA,SAAS,EAAgB,GAItB;EACC,OAAO,EAAO,OAAO,MAAM,CAAM;CACrC;CAEA,SAAS,EAAqB,GAAe,GAAoB;EAC7D,OAAO,EAAO,qBAAqB;GAAE;GAAO;EAAW,CAAC;CAC5D;CAYA,eAAe,EACX,GACA,GACkC;EAClC,IAAM,IAAU,EAAQ,WAAA,KAAA,GAElB,IAAc,GAAG,EAAQ,GADd,EAAQ,YAAA,OACkB,yBACrC,IAAc,EAAO,OAAO,eAAe;GAC7C;GACA;EACJ,CAAC,GAEK,IAAQ,OAAO,KACjB,GACA,mBACA,4CACJ;EAMA,OAJK,IAIE,IAAI,SAAS,MAAY;GAC5B,IAAM,IAAgB,IAAI,IAAI,CAAO,CAAC,CAAC,QAEjC,IAAe,kBAAkB;IACnC,AAAI,GAAO,UACP,EAAO;GAEf,GAAG,GAAG;GAEN,SAAS,IAAS;IAGd,AAFA,OAAO,oBAAoB,WAAW,CAAc,GACpD,cAAc,CAAY,GAC1B,EAAQ,EAAE,cAAc,GAAM,CAAC;GACnC;GAEA,SAAS,EAAe,GAAqB;IAErC,EAAM,WAAW,KACjB,EAAM,MAAM,SAAS,sBAIzB,GAAO,MAAM,GACT,EAAM,KAAK,UACX,EAAM,QAAQ,EAAM,KAAK,OAGzB,EAA2B,EAAQ,UAAU,IAEjD,EAAQ,MAAM,QAAQ,CAAC,CAAC,WAAW,IAAgB,CAAC,GACpD,EAAO;GACX;GAEA,OAAO,iBAAiB,WAAW,CAAc;EACrD,CAAC,IArCU,EAAE,cAAc,GAAK;CAsCpC;CAUA,eAAe,IAAyB;EACpC,IAAI,EAAe,OAIf;EAEJ,EAAoB,QAAQ,KAAA;EAC5B,IAAM,IAAe,EAAM;EAC3B,IAAI;GACA,MAAM,EAAO,QAAQ;EACzB,UAAU;GAQN,AAHI,EAAM,UAAU,MAChB,EAAM,QAAQ,KAElB,MAAM,EAAQ,MAAM,QAAQ;EAChC;CACJ;CAEA,OAAO;EACH;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,cAAc,EAAO,OAAO;EAC5B;EACA;EACA;CACJ;AACJ;;;ACzoBA,SAAgB,IAAqB;CACjC,IAAI,IAAgC,MAE9B,KAAwB,MAAiB;EAC3C,EAAM,gBAAgB;CAC1B;CAcA,AAZA,QAAgB;EAEZ,IAAM,IADW,EACA,CAAA,EAAU,OAAO,KAAK,YAAY;EAE7C,aAAoB,eAI1B,IAAa,GACb,EAAW,iBAAiB,WAAW,CAAoB;CAC/D,CAAC,GAED,QAAsB;EACb,AAKL,OADA,EAAW,oBAAoB,WAAW,CAAoB,GACjD;CACjB,CAAC;AACL"}