@agent-native/core 0.114.0 → 0.114.2

package/dist/server/better-auth-instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"better-auth-instance.js","sourceRoot":"","sources":["../../src/server/better-auth-instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,EACL,OAAO,EACP,IAAI,IAAI,MAAM,EACd,SAAS,IAAI,WAAW,EACxB,OAAO,IAAI,SAAS,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,IAAI,IAAI,UAAU,EAClB,OAAO,IAAI,aAAa,GACzB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,iCAAiC,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAE/E,KAAK,UAAU,mBAAmB;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,aAAa,EAAE;YACf,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAa;IACxD,MAAM,OAAO,GAAG,MAAM,4BAA4B,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5E,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,OAAO;SAC3B,eAAe,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;SAClD,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,YAAY,EACZ,UAAU,EACV,KAAK,EACL,IAAI,EACJ,WAAW,GAcZ;IACC,QAAQ,CAAC,KAAK,EAAE;QACd,KAAK;QACL,IAAI,EAAE,IAAI,IAAI,SAAS;QACvB,UAAU;KACX,CAAC,CAAC;IACH,MAAM,gBAAgB,GAA2B,EAAE,CAAC;IACpD,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,gBAAgB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,CACH,QAAQ,EACR;QACE,GAAG,+BAA+B,EAAE;QACpC,aAAa,EAAE,YAAY;QAC3B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,gBAAgB;KACpB,EACD,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;IACF,MAAM,mBAAmB,EAAE,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,IAAI,qBAAyC,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,iBAAiB;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC1E,MAAM,sBAAsB,GAAG,4BAA4B,CAAC,aAAa,CAAC,CAAC;IAC3E,IAAI,sBAAsB;QAAE,OAAO,sBAAsB,CAAC;IAE1D,wEAAwE;IACxE,8EAA8E;IAC9E,uEAAuE;IACvE,4EAA4E;IAC5E,8EAA8E;IAC9E,2BAA2B;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,+EAA+E;YAC7E,0EAA0E;YAC1E,0DAA0D;YAC1D,wBAAwB,MAAM,MAAM;YACpC,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,+CAA+C;YAC/C,wEAAwE;YACxE,kCAAkC,CACrC,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,+DAA+D;IAC/D,qEAAqE;IACrE,sEAAsE;IACtE,mDAAmD;IACnD,MAAM,QAAQ,GAAG,kBAAkB,CACjC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAC1C,CAAC;IACF,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,qBAAqB,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CACV,0EAA0E;YACxE,oEAAoE;YACpE,uEAAuE;YACvE,iCAAiC,CACpC,CAAC;IACJ,CAAC;IACD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtD,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CACrB,8DAA8D,CAC/D,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAyB;IACtD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACtC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC;QACvC,CAAC,CAAC,OAAO,CAAC;IACZ,MAAM,IAAI,GAAG,QAAQ;SAClB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,IAAI,IAAI,SAAS,CAAC;AAC3B,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QACpD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC;QACpC,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa,CAAC;QAClE,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAEtD,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;YAChD,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC3C,OAAO,qBAAqB,CAC1B,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAC/C,CAAC;QACJ,CAAC;QACD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,6BAA6B;IAI3C,MAAM,WAAW,GACf,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACnD,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC3D,MAAM,UAAU,GACd,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACnD,qBAAqB,CAAC,eAAe,EAAE,CAAC,CAAC;IAC3C,MAAM,MAAM,GACV,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACnC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3C,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QAC/B,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACtC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;QACzD,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,GAAG,GACP,WAAW;QACX,MAAM;QACN,UAAU;QACV,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE9C,MAAM,QAAQ,GACZ,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACpD,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACzD,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC3C,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAChD,iBAAiB,CAAC,GAAG,CAAC;QACtB,iBAAiB,CAAC,UAAU,CAAC;QAC7B,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE5B,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,+BAA+B;IAC7C,MAAM,QAAQ,GAAG,6BAA6B,EAAE,CAAC;IACjD,OAAO;QACL,GAAG,QAAQ;QACX,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACvD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,OAAO,CAAC;AAC3E,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AA0DD,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,IAAI,KAAqC,CAAC;AAC1C,IAAI,YAAqD,CAAC;AAC1D,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACxE,IAAI,aAAkB,CAAC;AAEvB,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,aAAa,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,oBAAoB,EAAE,MAAM,CAAC,wBAAwB,CAAC;KACvD,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;QACnC,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC;QACrC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;QAC3B,oBAAoB,EAAE,WAAW,CAAC,yBAAyB,EAAE;YAC3D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,qBAAqB,EAAE,WAAW,CAAC,0BAA0B,EAAE;YAC7D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACvC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE;QACxB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE;QAChC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;KAC7D,CAAC;CACH,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,aAAa,EAAE,aAAa,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aAChE,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;QACjB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,UAAU,CAAC,wBAAwB,CAAC;KAC3D,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,WAAW,EAAE,UAAU,CAAC,cAAc,CAAC;QACvC,YAAY,EAAE,UAAU,CAAC,eAAe,CAAC;QACzC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC;QAC/B,oBAAoB,EAAE,aAAa,CAAC,yBAAyB,EAAE;YAC7D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,qBAAqB,EAAE,aAAa,CAAC,0BAA0B,EAAE;YAC/D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC9C,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC3C,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC5B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,UAAU,EAAE,WAAW,CAAC,YAAY,EAAE;QACpC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACzD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;KACjE,CAAC;CACH,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,gCAAgC,CAAC,OAS/C;IACC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO;IACxD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO;IAE5B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iEAAiE;QACjE,kEAAkE;QAClE,oDAAoD;QACpD,OAAO;IACT,CAAC;IAED,kCAAkC;IAClC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAChC,GAAG,EAAE,uCAAuC;YAC5C,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACvB,CAAC,CAAC;QACH,KAAK,GAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAA4B,IAAI,SAAS,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,uEAAuE,EACvE,GAAG,CACJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,uEAAuE;IACvE,6BAA6B;IAC7B,IAAI,UAA8B,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC;IACzC,IAAI,GAAG,YAAY,IAAI,EAAE,CAAC;QACxB,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,UAAU,GAAG,GAAG,CAAC;IACnB,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAA4B;QACtC,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;KACrB,CAAC;IACF,IAAI,OAAO,CAAC,YAAY;QAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IACtE,IAAI,UAAU;QAAE,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC;IAChD,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAEvD,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,sBAAsB;IACnC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAEvB,yEAAyE;IACzE,uEAAuE;IACvE,+EAA+E;IAC/E,2EAA2E;IAC3E,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,GAA6C;YACzD;gBACE,MAAM;gBACN,sOAAsO;aACvO;YACD;gBACE,SAAS;gBACT,iRAAiR;aAClR;YACD;gBACE,SAAS;gBACT,sWAAsW;aACvW;YACD;gBACE,cAAc;gBACd,mNAAmN;aACpN;YACD;gBACE,cAAc;gBACd,4MAA4M;aAC7M;YACD;gBACE,QAAQ;gBACR,wNAAwN;aACzN;YACD;gBACE,YAAY;gBACZ,mSAAmS;aACpS;YACD;gBACE,MAAM;gBACN,uKAAuK;aACxK;SACF,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ;YAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,MAAM,gBAAgB,GAAG;QACvB,wNAAwN;QACxN,mQAAmQ;QACnQ,oVAAoV;QACpV,qMAAqM;QACrM,kMAAkM;QAClM,8MAA8M;QAC9M,qRAAqR;QACrR,6JAA6J;KAC9J,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,gBAAgB;QAAE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB;IAEzB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,YAAY,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAChD,KAAK,GAAG,MAAM,YAAY,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AA6BD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAExC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;QAChC,MAAM,EAAE,GAAG,GAAG,EAAE,eAAe,CAAC;QAChC,IACE,EAAE;YACF,OAAO,EAAE,CAAC,eAAe,KAAK,UAAU;YACxC,OAAO,EAAE,CAAC,WAAW,KAAK,UAAU;YACpC,OAAO,EAAE,CAAC,UAAU,KAAK,UAAU,EACnC,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,KAAK,GAAG,SAAS,CAAC;IAClB,YAAY,GAAG,SAAS,CAAC;IACzB,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;QACD,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;IACD,MAAM,kBAAkB,EAAE,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,KAAK,UAAU,wBAAwB,CACrC,MAAyB;IAEzB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,wBAAwB,CAAC;IAC9D,MAAM,sBAAsB,EAAE,CAAC;IAE/B,uCAAuC;IACvC,MAAM,eAAe,GAAyC;QAC5D,GAAG,MAAM,EAAE,eAAe;KAC3B,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;IAC/C,MAAM,iBAAiB,GACrB,WAAW,CAAC,MAAM,GAAG,CAAC;QACpB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAChE,CAAC,CAAC;gBACE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;gBACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;aAC/C;YACH,CAAC,CAAC,IAAI;QACR,CAAC,CAAC,8BAA8B,EAAE,CAAC;IACvC,IAAI,iBAAiB,EAAE,CAAC;QACtB,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,wCAAwC;QACxC,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC1E,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;YACpC,YAAY,EAAE,iBAAiB,CAAC,YAAY;YAC5C,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC;oBACE,KAAK,EAAE,YAAY;oBACnB,UAAU,EAAE,SAAkB;oBAC9B,MAAM,EAAE,SAAkB;iBAC3B;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;SAC/C,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,eAAe,GAAG,0BAA0B,EAAE,CAAC;IACrD,MAAM,wBAAwB,GAC5B,CAAC,MAAM,iBAAiB,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC;IAEhE,MAAM,+BAA+B,GACnC,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAE1C,MAAM,IAAI,GAAG,UAAU,CAAC;QACtB,QAAQ;QACR,OAAO,EAAE,MAAM;QACf,QAAQ;QACR,MAAM;QACN,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,CAAC;YACpB,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,wBAAwB;YACxB,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC3C,qEAAqE;gBACrE,sEAAsE;gBACtE,MAAM,WAAW,GAAG,CAClB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,WAAW,mCAAmC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAC;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ;iBACT,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,oEAAoE;YACpE,oEAAoE;YACpE,wCAAwC;YACxC,YAAY,EAAE,wBAAwB;YACtC,qEAAqE;YACrE,sEAAsE;YACtE,6CAA6C;YAC7C,2BAA2B,EAAE,IAAI;YACjC,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC7C,qEAAqE;gBACrE,6EAA6E;gBAC7E,MAAM,cAAc,GAAG,CACrB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,SAAS,GAAG,cAAc;oBAC9B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,cAAc,IAAI,CAAC;oBACzD,CAAC,CAAC,GAAG,CAAC;gBACR,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC;oBACtD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS;iBACV,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,eAAe;QACf,OAAO,EAAE;YACP,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,mEAAmE;YACnE,2BAA2B;YAC3B,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;aACvC;SACF;QACD,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EACV,IAIC;oBACD,kEAAkE;oBAClE,6DAA6D;oBAC7D,8DAA8D;oBAC9D,iDAAiD;oBACjD,OAGQ,EACR,EAAE;wBACF,gEAAgE;wBAChE,+DAA+D;wBAC/D,8DAA8D;wBAC9D,sDAAsD;wBACtD,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;wBAC1B,IAAI,CAAC,KAAK;4BAAE,OAAO;wBACnB,6DAA6D;wBAC7D,8DAA8D;wBAC9D,+CAA+C;wBAC/C,IAAI,WAA+C,CAAC;wBACpD,IAAI,CAAC;4BACH,MAAM,YAAY,GAChB,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC;gCAC/B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC;gCACxC,IAAI,CAAC;4BACP,WAAW,GAAG,iCAAiC,CAAC,YAAY,CAAC,CAAC;wBAChE,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;4BACjE,WAAW,GAAG,SAAS,CAAC;wBAC1B,CAAC;wBACD,MAAM,gBAAgB,CAAC;4BACrB,YAAY,EAAE,aAAa;4BAC3B,UAAU,EAAE,IAAI,CAAC,EAAE;4BACnB,KAAK;4BACL,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,WAAW;yBACZ,CAAC,CAAC;wBACH,IAAI,CAAC;4BACH,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;wBAChD,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,+DAA+D;4BAC/D,OAAO,CAAC,KAAK,CACX,kDAAkD,EAClD,GAAG,CACJ,CAAC;wBACJ,CAAC;wBACD,IAAI,CAAC;4BACH,2DAA2D;4BAC3D,yDAAyD;4BACzD,wDAAwD;4BACxD,0DAA0D;4BAC1D,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;wBAC1C,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,OAAO,CAAC,KAAK,CACX,iDAAiD,EACjD,GAAG,CACJ,CAAC;wBACJ,CAAC;oBACH,CAAC;iBACF;aACF;YACD,OAAO,EAAE;gBACP,+DAA+D;gBAC/D,iEAAiE;gBACjE,kEAAkE;gBAClE,oDAAoD;gBACpD,EAAE;gBACF,+DAA+D;gBAC/D,+DAA+D;gBAC/D,+DAA+D;gBAC/D,gDAAgD;gBAChD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,IAAI,CAAC,+BAA+B;4BAAE,OAAO;wBAC7C,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;gBACD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,IAAI,CAAC,+BAA+B;4BAAE,OAAO;wBAC7C,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;aACF;SACF;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU;YACxC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,gBAAgB;YACzC,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,cAAc;aAC/B;SACF;QACD,QAAQ,EAAE;YACR,YAAY,EAAE,eAAe,CAAC,sBAAsB;YACpD,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,mCAAmC;YACnC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC/B,CAAC,CAAC;oBACE,uBAAuB,EAAE;wBACvB,QAAQ,EAAE,MAAe;wBACzB,MAAM,EAAE,IAAI;wBACZ,WAAW,EAAE,IAAI;qBAClB;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,oEAAoE;YACpE,GAAG,CAAC,eAAe,CAAC,sBAAsB;gBACxC,CAAC,CAAC;oBACE,qBAAqB,EAAE;wBACrB,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,eAAe,CAAC,sBAAsB;qBAC/C;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,OAAO,EAAE;YACP,kEAAkE;YAClE,GAAG,CAAC;gBACF,GAAG,EAAE;oBACH,MAAM,EAAE,MAAM;oBACd,cAAc,EAAE,KAAK;iBACtB;aACF,CAAC;YACF,+CAA+C;YAC/C,MAAM,EAAE;YACR,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC3B;KACF,CAAC,CAAC;IAEH,OAAO,IAAqC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAe;IAEf,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,EACJ,sBAAsB,EACtB,8BAA8B,EAC9B,SAAS,GACV,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAE3C,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACxE,OAAO,cAAc,CAAC,EAAE,EAAE;gBACxB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,YAAY;aACrB,CAAC,CAAC;QACL,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YAC1D,qEAAqE;YACrE,mEAAmE;YACnE,8DAA8D;YAC9D,+DAA+D;YAC/D,aAAa,GAAG,IAAI,IAAI,CAAC;gBACvB,gBAAgB,EAAE,GAAG;gBACrB,GAAG,EAAE,WAAW,EAAE;aACnB,CAAC,CAAC;YACH,yBAAyB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACzD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAChE,MAAM,EAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE;gBACxD,MAAM,EAAE,YAAY;aACrB,CAAC,CAAC;YACH,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACxE,OAAO,cAAc,CAAC,EAAE,EAAE;gBACxB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,YAAY;aACrB,CAAC,CAAC;QACL,CAAC;QAED,iEAAiE;QACjE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,mDAAmD;QACnD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,EAAE;YACtD,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAEjD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,kCAAkC;QAClC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACxE,OAAO,cAAc,CAAC,EAAE,EAAE;QACxB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Internal Better Auth instance — lazily created, not exported to templates.\n *\n * Templates interact with auth via the existing `getSession()`, `autoMountAuth()`,\n * `createAuthPlugin()`, and `createGoogleAuthPlugin()` APIs. Better Auth is an\n * implementation detail behind those interfaces.\n */\n\nimport crypto from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nimport { betterAuth, type BetterAuthOptions } from \"better-auth\";\nimport { bearer } from \"better-auth/plugins/bearer\";\nimport { jwt } from \"better-auth/plugins/jwt\";\nimport {\n  pgTable,\n  text as pgText,\n  timestamp as pgTimestamp,\n  boolean as pgBoolean,\n} from \"drizzle-orm/pg-core\";\nimport {\n  sqliteTable,\n  text as sqliteText,\n  integer as sqliteInteger,\n} from \"drizzle-orm/sqlite-core\";\n\nimport { TEMPLATES } from \"../cli/templates-meta.js\";\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport {\n  getDialect,\n  getDatabaseUrl,\n  getDatabaseAuthToken,\n  closePgliteClients,\n  getPgliteClient,\n  isPgliteUrl,\n  loadPgliteDrizzle,\n  pgPoolOptions,\n  neonPoolMax,\n  attachNeonPoolErrorLogger,\n} from \"../db/client.js\";\nimport { ensureTableExists } from \"../db/ddl-guard.js\";\nimport { saveOAuthTokens } from \"../oauth-tokens/store.js\";\nimport { acceptPendingInvitationsForEmail } from \"../org/accept-pending.js\";\nimport { autoJoinDomainMatchingOrgs } from \"../org/auto-join-domain.js\";\nimport { flushTracking, identify, track } from \"../tracking/index.js\";\nimport { getAppProductionUrl } from \"./app-url.js\";\nimport { signupAttributionFromCookieHeader } from \"./attribution.js\";\nimport { resolveAuthCookieNamespace } from \"./cookie-namespace.js\";\nimport { getWorkspaceA2ADerivedSecret } from \"./derived-secret.js\";\nimport {\n  renderResetPasswordEmail,\n  renderVerifySignupEmail,\n} from \"./email-templates.js\";\nimport { sendEmail, isEmailConfigured } from \"./email.js\";\nimport { resolveGoogleSignInCredentials } from \"./google-oauth-credentials.js\";\n\nasync function flushSignupTracking(): Promise<void> {\n  try {\n    await Promise.race([\n      flushTracking(),\n      new Promise<void>((resolve) => setTimeout(resolve, 1500)),\n    ]);\n  } catch {\n    // Signup should never fail because analytics delivery did.\n  }\n}\n\nexport async function hasBetterAuthUserEmail(email: string): Promise<boolean> {\n  const adapter = await getBetterAuthInternalAdapter().catch(() => undefined);\n  if (!adapter) return false;\n  const existing = await adapter\n    .findUserByEmail(email, { includeAccounts: false })\n    .catch(() => null);\n  return !!existing?.user?.email;\n}\n\nexport async function trackSignupEvent({\n  authProvider,\n  authUserId,\n  email,\n  name,\n  attribution,\n}: {\n  authProvider: string;\n  authUserId?: string;\n  email: string;\n  name?: string | null;\n  /**\n   * First-touch referral attribution derived from the visitor's `an_ft`\n   * cookie (see `server/attribution.ts`). Snake_case keys such as\n   * `referral_source`, `referrer_user`, and the UTM passthrough are merged\n   * into the `signup` event so we can measure where new users came from.\n   * `undefined` values are dropped; a missing object is a clean no-op.\n   */\n  attribution?: Record<string, string | undefined>;\n}): Promise<void> {\n  identify(email, {\n    email,\n    name: name ?? undefined,\n    authUserId,\n  });\n  const cleanAttribution: Record<string, string> = {};\n  if (attribution) {\n    for (const [key, value] of Object.entries(attribution)) {\n      if (typeof value === \"string\" && value.length > 0) {\n        cleanAttribution[key] = value;\n      }\n    }\n  }\n  track(\n    \"signup\",\n    {\n      ...resolveSignupTrackingProperties(),\n      auth_provider: authProvider,\n      ...(authUserId ? { auth_user_id: authUserId } : {}),\n      ...cleanAttribution,\n    },\n    { userId: email },\n  );\n  await flushSignupTracking();\n}\n\n// ---------------------------------------------------------------------------\n// Persistent auth secret\n// ---------------------------------------------------------------------------\n\nlet inMemoryDevAuthSecret: string | undefined;\n\n/**\n * Resolve the Better Auth signing secret.\n *\n * Resolution order:\n *   1. `BETTER_AUTH_SECRET` env var — explicit, recommended for prod.\n *   2. Hosted workspace deploys can derive a per-purpose secret from the\n *      already-required `A2A_SECRET` root. This keeps fresh workspace branches\n *      bootable without reusing the raw A2A key as a cookie-signing key.\n *   3. Existing `.env.local` values in the template cwd — read-only\n *      compatibility for projects that already configured this secret.\n *   4. Generate a per-process in-memory random 32-byte hex in development.\n *\n * Why this matters: before this helper existed, missing `BETTER_AUTH_SECRET`\n * fell through to `GOOGLE_CLIENT_SECRET` / `ACCESS_TOKEN` / a hardcoded\n * string. If a template happened to have none of those, each dev-server\n * boot would re-fall back to the hardcoded value (still stable) — but\n * rotating Google credentials, toggling `ACCESS_TOKEN`, or churning the\n * fallback chain would invalidate every signed cookie and force everyone\n * to sign in again. We still read explicit env configuration, but never\n * auto-write a generated secret into env files.\n */\nfunction resolveAuthSecret(): string {\n  if (process.env.BETTER_AUTH_SECRET) return process.env.BETTER_AUTH_SECRET;\n  const workspaceDerivedSecret = getWorkspaceA2ADerivedSecret(\"better-auth\");\n  if (workspaceDerivedSecret) return workspaceDerivedSecret;\n\n  // In production, beyond the workspace A2A-derived fallback above, never\n  // auto-generate or use legacy fallbacks. A generated secret invalidates every\n  // signed session cookie on the next cold start (serverless filesystems\n  // aren't persistent), and the legacy hardcoded fallback is identical across\n  // every deploy that hits it — both are serious enough to fail the boot loudly\n  // so the deployer notices.\n  if (process.env.NODE_ENV === \"production\") {\n    const sample = crypto.randomBytes(32).toString(\"hex\");\n    throw new Error(\n      \"[agent-native] BETTER_AUTH_SECRET is not set. This is required in production \" +\n        \"so signed session cookies stay valid across deploys. Set it as a deploy \" +\n        \"environment variable (any 32-byte hex string), e.g.:\\n\\n\" +\n        `  BETTER_AUTH_SECRET=${sample}\\n\\n` +\n        \"Generate your own with `openssl rand -hex 32`. If you already have a \" +\n        \"running deploy and need to preserve existing sessions, set it to your \" +\n        \"previously-deployed BETTER_AUTH_SECRET value first, then rotate to a \" +\n        \"fresh one. Hosted workspace deploys may also \" +\n        \"set A2A_SECRET; agent-native derives a per-purpose Better Auth secret \" +\n        \"from that workspace root secret.\",\n    );\n  }\n\n  // SECURITY (audit 09 LOW-2): the previous fallback chain\n  // (`GOOGLE_CLIENT_SECRET || ACCESS_TOKEN || hardcoded`) reused\n  // cross-purpose secrets and a public hardcoded literal as the cookie\n  // HMAC. Dropped entirely — better to mint an ephemeral secret than to\n  // re-use a Google client secret or a known string.\n  const existing = readEnvLocalSecret(\n    path.resolve(process.cwd(), \".env.local\"),\n  );\n  if (existing) return existing;\n\n  if (!inMemoryDevAuthSecret) {\n    inMemoryDevAuthSecret = crypto.randomBytes(32).toString(\"hex\");\n    console.warn(\n      \"[agent-native] BETTER_AUTH_SECRET is not configured. Using an ephemeral \" +\n        \"in-memory development secret. Sessions will reset every time this \" +\n        \"process restarts. Set BETTER_AUTH_SECRET in your environment to keep \" +\n        \"sessions valid across restarts.\",\n    );\n  }\n  return inMemoryDevAuthSecret;\n}\n\nfunction readEnvLocalSecret(envLocalPath: string): string | undefined {\n  try {\n    const content = fs.readFileSync(envLocalPath, \"utf8\");\n    // Match `BETTER_AUTH_SECRET=...` on its own line. Tolerate optional\n    // quotes and leading `export `. Stop at the first newline or quote.\n    const m = content.match(\n      /^(?:export\\s+)?BETTER_AUTH_SECRET\\s*=\\s*\"?([^\"\\r\\n]+)\"?\\s*$/m,\n    );\n    return m?.[1]?.trim() || undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction normalizeTrackingSlug(value: string | undefined): string | undefined {\n  const trimmed = value?.trim();\n  if (!trimmed) return undefined;\n  const unscoped = trimmed.startsWith(\"@\")\n    ? (trimmed.split(\"/\").pop() ?? trimmed)\n    : trimmed;\n  const slug = unscoped\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return slug || undefined;\n}\n\nfunction knownTemplateSlug(value: string | undefined): string | undefined {\n  const slug = normalizeTrackingSlug(value);\n  if (!slug) return undefined;\n  const withoutPrefix = slug.startsWith(\"agent-native-\")\n    ? slug.slice(\"agent-native-\".length)\n    : slug;\n  return TEMPLATES.some((template) => template.name === withoutPrefix)\n    ? withoutPrefix\n    : undefined;\n}\n\nfunction readPackageName(): string | undefined {\n  try {\n    const pkgPath = path.join(process.cwd(), \"package.json\");\n    const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf8\")) as {\n      name?: string;\n    };\n    return pkg.name;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction appSlugFromUrl(value: string | undefined): string | undefined {\n  if (!value?.trim()) return undefined;\n  try {\n    const raw = /^[a-z][a-z0-9+.-]*:\\/\\//i.test(value)\n      ? value\n      : `https://${value}`;\n    const hostname = new URL(raw).hostname.toLowerCase();\n    if (hostname.endsWith(\".agent-native.com\")) {\n      return normalizeTrackingSlug(\n        hostname.slice(0, -\".agent-native.com\".length),\n      );\n    }\n    return normalizeTrackingSlug(hostname.split(\".\")[0]);\n  } catch {\n    return undefined;\n  }\n}\n\n/** @internal */\nexport function resolveSignupTrackingIdentity(): {\n  app?: string;\n  template?: string;\n} {\n  const explicitApp =\n    normalizeTrackingSlug(process.env.AGENT_NATIVE_APP) ||\n    normalizeTrackingSlug(process.env.VITE_AGENT_NATIVE_APP);\n  const packageApp =\n    normalizeTrackingSlug(process.env.npm_package_name) ||\n    normalizeTrackingSlug(readPackageName());\n  const urlApp =\n    appSlugFromUrl(process.env.APP_URL) ||\n    appSlugFromUrl(process.env.BETTER_AUTH_URL) ||\n    appSlugFromUrl(process.env.URL) ||\n    appSlugFromUrl(process.env.DEPLOY_URL) ||\n    appSlugFromUrl(process.env.VERCEL_PROJECT_PRODUCTION_URL) ||\n    appSlugFromUrl(process.env.VERCEL_URL);\n  const app =\n    explicitApp ||\n    urlApp ||\n    packageApp ||\n    normalizeTrackingSlug(process.env.APP_NAME);\n\n  const template =\n    knownTemplateSlug(process.env.AGENT_NATIVE_TEMPLATE) ||\n    knownTemplateSlug(process.env.VITE_AGENT_NATIVE_TEMPLATE) ||\n    knownTemplateSlug(process.env.APP_TEMPLATE) ||\n    knownTemplateSlug(process.env.VITE_APP_TEMPLATE) ||\n    knownTemplateSlug(app) ||\n    knownTemplateSlug(packageApp) ||\n    knownTemplateSlug(urlApp);\n\n  return {\n    ...(app ? { app } : {}),\n    ...(template ? { template } : {}),\n  };\n}\n\n/** @internal */\nexport function resolveSignupTrackingProperties(): Record<string, string> {\n  const identity = resolveSignupTrackingIdentity();\n  return {\n    ...identity,\n    ...(identity.app ? { agent_native_app: identity.app } : {}),\n    ...(identity.template ? { agent_native_template: identity.template } : {}),\n  };\n}\n\nexport function shouldSkipEmailVerification(): boolean {\n  const value = process.env.AUTH_SKIP_EMAIL_VERIFICATION;\n  if (value == null) {\n    return (\n      process.env.NODE_ENV === \"development\" || process.env.NODE_ENV === \"test\"\n    );\n  }\n  const normalized = value.trim().toLowerCase();\n  return normalized !== \"\" && normalized !== \"0\" && normalized !== \"false\";\n}\n\n/** Read-only accessor for the resolved auth secret. */\nexport function getAuthSecret(): string {\n  return resolveAuthSecret();\n}\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/** The shape we need from a Better Auth instance (internal — not exported to templates). */\nexport interface BetterAuthInstance {\n  handler: (request: Request) => Promise<Response>;\n  api: {\n    getSession: (opts: { headers: Headers }) => Promise<{\n      user: { id: string; email: string; name: string };\n      session: {\n        id: string;\n        token: string;\n        expiresAt: Date;\n      };\n    } | null>;\n    signInEmail: (opts: {\n      body: { email: string; password: string };\n    }) => Promise<{ token?: string; user?: any } | null>;\n    signUpEmail: (opts: {\n      body: {\n        email: string;\n        password: string;\n        name: string;\n        callbackURL?: string;\n      };\n      headers?: Headers;\n    }) => Promise<any>;\n    signOut: (opts: { headers: Headers }) => Promise<any>;\n  };\n}\n\nexport interface BetterAuthConfig {\n  /** Base path for Better Auth routes. Default: \"/_agent-native/auth/ba\" */\n  basePath?: string;\n  /** Additional social providers beyond what env vars auto-detect */\n  socialProviders?: BetterAuthOptions[\"socialProviders\"];\n  /** Additional Better Auth plugins */\n  plugins?: BetterAuthOptions[\"plugins\"];\n  /**\n   * Additional Google OAuth scopes (Gmail, Calendar, etc.) to request\n   * up front during the primary \"Sign in with Google\" flow, beyond the\n   * default identity scopes (`openid`, `email`, `profile`).\n   *\n   * When set, the Google social provider also opts into:\n   * - `accessType: \"offline\"` — so a refresh token is issued\n   * - `prompt: \"consent\"` — so the refresh token is reissued every sign-in\n   *\n   * Tokens are mirrored into `oauth_tokens` via a databaseHooks.account\n   * hook so existing template code that reads from `oauth_tokens` (mail's\n   * Gmail client, calendar's events fetcher) works without any separate\n   * \"Connect Google\" page.\n   */\n  googleScopes?: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Lazy instance\n// ---------------------------------------------------------------------------\n\nlet _auth: BetterAuthInstance | undefined;\nlet _initPromise: Promise<BetterAuthInstance> | undefined;\n// Track the Neon serverless Pool we open for Better Auth so closeBetterAuth()\n// can release it. The Pool keeps WebSocket connections open; leaking them on\n// hot-reload or process restart exhausts Neon's connection slot budget.\nlet _neonAuthPool: any;\n\nconst pgAuthSchema = {\n  user: pgTable(\"user\", {\n    id: pgText(\"id\").primaryKey(),\n    name: pgText(\"name\").notNull(),\n    email: pgText(\"email\").notNull().unique(),\n    emailVerified: pgBoolean(\"email_verified\").notNull().default(false),\n    image: pgText(\"image\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  session: pgTable(\"session\", {\n    id: pgText(\"id\").primaryKey(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    token: pgText(\"token\").notNull().unique(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n    ipAddress: pgText(\"ip_address\"),\n    userAgent: pgText(\"user_agent\"),\n    userId: pgText(\"user_id\").notNull(),\n    activeOrganizationId: pgText(\"active_organization_id\"),\n  }),\n  account: pgTable(\"account\", {\n    id: pgText(\"id\").primaryKey(),\n    accountId: pgText(\"account_id\").notNull(),\n    providerId: pgText(\"provider_id\").notNull(),\n    userId: pgText(\"user_id\").notNull(),\n    accessToken: pgText(\"access_token\"),\n    refreshToken: pgText(\"refresh_token\"),\n    idToken: pgText(\"id_token\"),\n    accessTokenExpiresAt: pgTimestamp(\"access_token_expires_at\", {\n      withTimezone: true,\n    }),\n    refreshTokenExpiresAt: pgTimestamp(\"refresh_token_expires_at\", {\n      withTimezone: true,\n    }),\n    scope: pgText(\"scope\"),\n    password: pgText(\"password\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  verification: pgTable(\"verification\", {\n    id: pgText(\"id\").primaryKey(),\n    identifier: pgText(\"identifier\").notNull(),\n    value: pgText(\"value\").notNull(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  organization: pgTable(\"organization\", {\n    id: pgText(\"id\").primaryKey(),\n    name: pgText(\"name\").notNull(),\n    slug: pgText(\"slug\").notNull().unique(),\n    logo: pgText(\"logo\"),\n    metadata: pgText(\"metadata\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  member: pgTable(\"member\", {\n    id: pgText(\"id\").primaryKey(),\n    organizationId: pgText(\"organization_id\").notNull(),\n    userId: pgText(\"user_id\").notNull(),\n    role: pgText(\"role\").notNull().default(\"member\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  invitation: pgTable(\"invitation\", {\n    id: pgText(\"id\").primaryKey(),\n    organizationId: pgText(\"organization_id\").notNull(),\n    email: pgText(\"email\").notNull(),\n    role: pgText(\"role\"),\n    status: pgText(\"status\").notNull().default(\"pending\"),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    inviterId: pgText(\"inviter_id\").notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  jwks: pgTable(\"jwks\", {\n    id: pgText(\"id\").primaryKey(),\n    publicKey: pgText(\"public_key\").notNull(),\n    privateKey: pgText(\"private_key\").notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }),\n  }),\n};\n\nconst sqliteAuthSchema = {\n  user: sqliteTable(\"user\", {\n    id: sqliteText(\"id\").primaryKey(),\n    name: sqliteText(\"name\").notNull(),\n    email: sqliteText(\"email\").notNull().unique(),\n    emailVerified: sqliteInteger(\"email_verified\", { mode: \"boolean\" })\n      .notNull()\n      .default(false),\n    image: sqliteText(\"image\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  session: sqliteTable(\"session\", {\n    id: sqliteText(\"id\").primaryKey(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    token: sqliteText(\"token\").notNull().unique(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n    ipAddress: sqliteText(\"ip_address\"),\n    userAgent: sqliteText(\"user_agent\"),\n    userId: sqliteText(\"user_id\").notNull(),\n    activeOrganizationId: sqliteText(\"active_organization_id\"),\n  }),\n  account: sqliteTable(\"account\", {\n    id: sqliteText(\"id\").primaryKey(),\n    accountId: sqliteText(\"account_id\").notNull(),\n    providerId: sqliteText(\"provider_id\").notNull(),\n    userId: sqliteText(\"user_id\").notNull(),\n    accessToken: sqliteText(\"access_token\"),\n    refreshToken: sqliteText(\"refresh_token\"),\n    idToken: sqliteText(\"id_token\"),\n    accessTokenExpiresAt: sqliteInteger(\"access_token_expires_at\", {\n      mode: \"timestamp_ms\",\n    }),\n    refreshTokenExpiresAt: sqliteInteger(\"refresh_token_expires_at\", {\n      mode: \"timestamp_ms\",\n    }),\n    scope: sqliteText(\"scope\"),\n    password: sqliteText(\"password\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  verification: sqliteTable(\"verification\", {\n    id: sqliteText(\"id\").primaryKey(),\n    identifier: sqliteText(\"identifier\").notNull(),\n    value: sqliteText(\"value\").notNull(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  organization: sqliteTable(\"organization\", {\n    id: sqliteText(\"id\").primaryKey(),\n    name: sqliteText(\"name\").notNull(),\n    slug: sqliteText(\"slug\").notNull().unique(),\n    logo: sqliteText(\"logo\"),\n    metadata: sqliteText(\"metadata\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  member: sqliteTable(\"member\", {\n    id: sqliteText(\"id\").primaryKey(),\n    organizationId: sqliteText(\"organization_id\").notNull(),\n    userId: sqliteText(\"user_id\").notNull(),\n    role: sqliteText(\"role\").notNull().default(\"member\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  invitation: sqliteTable(\"invitation\", {\n    id: sqliteText(\"id\").primaryKey(),\n    organizationId: sqliteText(\"organization_id\").notNull(),\n    email: sqliteText(\"email\").notNull(),\n    role: sqliteText(\"role\"),\n    status: sqliteText(\"status\").notNull().default(\"pending\"),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    inviterId: sqliteText(\"inviter_id\").notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  jwks: sqliteTable(\"jwks\", {\n    id: sqliteText(\"id\").primaryKey(),\n    publicKey: sqliteText(\"public_key\").notNull(),\n    privateKey: sqliteText(\"private_key\").notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }),\n  }),\n};\n\n/**\n * Mirror a Better Auth `account` row for Google into the `oauth_tokens`\n * table that template code (mail's Gmail client, calendar's events fetcher)\n * reads from. Called from the `databaseHooks.account.create.after` and\n * `.update.after` hooks so tokens captured during the primary \"Sign in\n * with Google\" flow flow straight to the apps that need them — no\n * separate \"Connect Google\" page required.\n *\n * Resolves `account.userId` to the user's email by querying the `user`\n * table (Better Auth always quotes \"user\" because it's a reserved word\n * in Postgres; SQLite accepts the quotes too).\n *\n * The hook is fire-and-forget from the caller's perspective — every\n * failure is caught upstream so a flake in `oauth_tokens` never blocks\n * sign-in. We still no-op on missing fields here as a defense in depth.\n */\nasync function mirrorGoogleAccountToOAuthTokens(account: {\n  providerId?: string;\n  userId?: string;\n  accountId?: string;\n  accessToken?: string | null;\n  refreshToken?: string | null;\n  accessTokenExpiresAt?: Date | string | number | null;\n  scope?: string | null;\n  idToken?: string | null;\n}): Promise<void> {\n  if (!account || account.providerId !== \"google\") return;\n  if (!account.userId) return;\n\n  const accessToken = account.accessToken ?? undefined;\n  if (!accessToken) {\n    // Better Auth sometimes upserts an account row before tokens are\n    // attached (e.g. linking flows). Nothing to mirror yet — the next\n    // update hook will run once the access token lands.\n    return;\n  }\n\n  // Resolve user email from userId.\n  const db = getDbExec();\n  let email: string | undefined;\n  try {\n    const { rows } = await db.execute({\n      sql: 'SELECT email FROM \"user\" WHERE id = ?',\n      args: [account.userId],\n    });\n    email = (rows[0]?.email as string | undefined) ?? undefined;\n  } catch (err) {\n    console.error(\n      \"[auth] mirror Google tokens: failed to resolve user email from userId\",\n      err,\n    );\n    return;\n  }\n  if (!email) return;\n\n  // Normalise expiry to epoch ms (Google's \"expiry_date\" convention used\n  // throughout the templates).\n  let expiryDate: number | undefined;\n  const raw = account.accessTokenExpiresAt;\n  if (raw instanceof Date) {\n    expiryDate = raw.getTime();\n  } else if (typeof raw === \"number\") {\n    expiryDate = raw;\n  } else if (typeof raw === \"string\") {\n    const ms = Date.parse(raw);\n    expiryDate = Number.isFinite(ms) ? ms : undefined;\n  }\n\n  const tokens: Record<string, unknown> = {\n    access_token: accessToken,\n    token_type: \"Bearer\",\n  };\n  if (account.refreshToken) tokens.refresh_token = account.refreshToken;\n  if (expiryDate) tokens.expiry_date = expiryDate;\n  if (account.scope) tokens.scope = account.scope;\n  if (account.idToken) tokens.id_token = account.idToken;\n\n  await saveOAuthTokens(\"google\", email, tokens, email);\n}\n\nasync function ensureBetterAuthTables(): Promise<void> {\n  const db = getDbExec();\n\n  // PG guard: probe information_schema first (no lock) for each table; run\n  // DDL only when missing, bounded by a transaction-scoped lock_timeout.\n  // Probe names are UNQUOTED (what information_schema.tables.table_name stores);\n  // createSql keeps the QUOTED \"user\"/\"session\"/… form required by Postgres.\n  if (isPostgres()) {\n    const pgTables: Array<[name: string, createSql: string]> = [\n      [\n        \"user\",\n        `CREATE TABLE IF NOT EXISTS \"user\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified BOOLEAN NOT NULL DEFAULT FALSE, image TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n      ],\n      [\n        \"session\",\n        `CREATE TABLE IF NOT EXISTS \"session\" (id TEXT PRIMARY KEY, expires_at TIMESTAMPTZ NOT NULL, token TEXT NOT NULL UNIQUE, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n      ],\n      [\n        \"account\",\n        `CREATE TABLE IF NOT EXISTS \"account\" (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at TIMESTAMPTZ, refresh_token_expires_at TIMESTAMPTZ, scope TEXT, password TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n      ],\n      [\n        \"verification\",\n        `CREATE TABLE IF NOT EXISTS \"verification\" (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n      ],\n      [\n        \"organization\",\n        `CREATE TABLE IF NOT EXISTS \"organization\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n      ],\n      [\n        \"member\",\n        `CREATE TABLE IF NOT EXISTS \"member\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n      ],\n      [\n        \"invitation\",\n        `CREATE TABLE IF NOT EXISTS \"invitation\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at TIMESTAMPTZ NOT NULL, inviter_id TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n      ],\n      [\n        \"jwks\",\n        `CREATE TABLE IF NOT EXISTS \"jwks\" (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, expires_at TIMESTAMPTZ)`,\n      ],\n    ];\n    for (const [name, sql] of pgTables) await ensureTableExists(name, sql);\n    return;\n  }\n\n  // SQLite (local dev): no lock problem — keep the original behaviour.\n  const sqliteStatements = [\n    `CREATE TABLE IF NOT EXISTS user (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified INTEGER NOT NULL DEFAULT 0, image TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n    `CREATE TABLE IF NOT EXISTS session (id TEXT PRIMARY KEY, expires_at INTEGER NOT NULL, token TEXT NOT NULL UNIQUE, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n    `CREATE TABLE IF NOT EXISTS account (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at INTEGER, refresh_token_expires_at INTEGER, scope TEXT, password TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n    `CREATE TABLE IF NOT EXISTS verification (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at INTEGER NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n    `CREATE TABLE IF NOT EXISTS organization (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n    `CREATE TABLE IF NOT EXISTS member (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n    `CREATE TABLE IF NOT EXISTS invitation (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at INTEGER NOT NULL, inviter_id TEXT NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n    `CREATE TABLE IF NOT EXISTS jwks (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at INTEGER NOT NULL, expires_at INTEGER)`,\n  ];\n  for (const sql of sqliteStatements) await db.execute(sql);\n}\n\n/**\n * Get or create the Better Auth instance.\n * Lazily initialized on first call — the database must be reachable by then.\n */\nexport async function getBetterAuth(\n  config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n  if (_auth) return _auth;\n  if (_initPromise) return _initPromise;\n\n  _initPromise = createBetterAuthInstance(config);\n  _auth = await _initPromise;\n  return _auth;\n}\n\n/**\n * Synchronous getter — returns the instance if already initialized, else undefined.\n * Use this in hot paths where you know init has already happened.\n */\nexport function getBetterAuthSync(): BetterAuthInstance | undefined {\n  return _auth;\n}\n\n/**\n * The subset of Better Auth's internal adapter we use for federated-SSO\n * JIT account linking. Better Auth owns these writes (id + timestamp +\n * schema handling), so callers never hand-roll SQL against `user`/`account`.\n * Read-only lookups + strictly-additive `linkAccount`/`createUser` only — no\n * update/delete of existing identity rows.\n */\nexport interface BetterAuthInternalAdapter {\n  findUserByEmail: (\n    email: string,\n    options?: { includeAccounts: boolean },\n  ) => Promise<{\n    user: { id: string; email: string; name?: string };\n    accounts: Array<{ providerId: string; accountId: string }>;\n  } | null>;\n  linkAccount: (account: {\n    userId: string;\n    providerId: string;\n    accountId: string;\n  }) => Promise<unknown>;\n  createUser: (user: {\n    email: string;\n    name: string;\n    emailVerified?: boolean;\n  }) => Promise<{ id: string }>;\n}\n\n/**\n * Resolve Better Auth's internal adapter via the live instance's\n * `$context`. The framework's narrowed `BetterAuthInstance` interface omits\n * `$context`, but the underlying object created by `betterAuth(...)` always\n * exposes it (see Better Auth's `Auth` type) — so this is a safe, typed\n * accessor for the federated-SSO client. Returns `undefined` if the context\n * shape is unexpected (older/newer Better Auth) so callers can fall back.\n */\nexport async function getBetterAuthInternalAdapter(\n  config?: BetterAuthConfig,\n): Promise<BetterAuthInternalAdapter | undefined> {\n  const auth = (await getBetterAuth(config)) as unknown as {\n    $context?: Promise<{ internalAdapter?: BetterAuthInternalAdapter }>;\n  };\n  try {\n    const ctx = await auth.$context;\n    const ia = ctx?.internalAdapter;\n    if (\n      ia &&\n      typeof ia.findUserByEmail === \"function\" &&\n      typeof ia.linkAccount === \"function\" &&\n      typeof ia.createUser === \"function\"\n    ) {\n      return ia;\n    }\n  } catch {\n    // Context resolution failed — caller falls back to the signup path.\n  }\n  return undefined;\n}\n\n/** Reset for testing */\nexport async function resetBetterAuth(): Promise<void> {\n  _auth = undefined;\n  _initPromise = undefined;\n  if (_neonAuthPool) {\n    try {\n      await _neonAuthPool.end();\n    } catch {\n      // Pool may have already closed (process exiting, etc.) — don't block reset.\n    }\n    _neonAuthPool = undefined;\n  }\n  await closePgliteClients();\n}\n\n// ---------------------------------------------------------------------------\n// Instance creation\n// ---------------------------------------------------------------------------\n\nasync function createBetterAuthInstance(\n  config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n  const dialect = getDialect();\n  const basePath = config?.basePath ?? \"/_agent-native/auth/ba\";\n  await ensureBetterAuthTables();\n\n  // Build social providers from env vars\n  const socialProviders: BetterAuthOptions[\"socialProviders\"] = {\n    ...config?.socialProviders,\n  };\n\n  const extraScopes = config?.googleScopes ?? [];\n  const googleCredentials =\n    extraScopes.length > 0\n      ? process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET\n        ? {\n            clientId: process.env.GOOGLE_CLIENT_ID,\n            clientSecret: process.env.GOOGLE_CLIENT_SECRET,\n          }\n        : null\n      : resolveGoogleSignInCredentials();\n  if (googleCredentials) {\n    // When the template requests broader scopes (Gmail, Calendar, etc.)\n    // ask for them on the primary sign-in flow so a separate \"Connect\n    // Google\" round-trip isn't needed. `accessType: \"offline\"` plus\n    // `prompt: \"consent\"` ensures we always receive a refresh token back —\n    // Google only re-issues a refresh token on consent, so re-signing in\n    // (e.g. after switching machines) would otherwise leave us with an\n    // access token that can't be refreshed.\n    const baseScopes = [\"openid\", \"email\", \"profile\"];\n    const mergedScopes = Array.from(new Set([...baseScopes, ...extraScopes]));\n    socialProviders.google = {\n      clientId: googleCredentials.clientId,\n      clientSecret: googleCredentials.clientSecret,\n      ...(extraScopes.length > 0\n        ? {\n            scope: mergedScopes,\n            accessType: \"offline\" as const,\n            prompt: \"consent\" as const,\n          }\n        : {}),\n    };\n  }\n\n  if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {\n    socialProviders.github = {\n      clientId: process.env.GITHUB_CLIENT_ID,\n      clientSecret: process.env.GITHUB_CLIENT_SECRET,\n    };\n  }\n\n  // Build database config\n  const database = await buildDatabaseConfig(dialect);\n\n  const secret = resolveAuthSecret();\n\n  const appUrl = getAppProductionUrl();\n  const cookieNamespace = resolveAuthCookieNamespace();\n  const requireEmailVerification =\n    (await isEmailConfigured()) && !shouldSkipEmailVerification();\n\n  const shouldMirrorGoogleAccountTokens =\n    (config?.googleScopes?.length ?? 0) > 0;\n\n  const auth = betterAuth({\n    basePath,\n    baseURL: appUrl,\n    database,\n    secret,\n    emailAndPassword: {\n      enabled: true,\n      minPasswordLength: 8,\n      // Only require email verification when an email provider is configured.\n      // Without a provider, verification emails can't be sent, so requiring\n      // verification would lock users out of signup entirely. Local dev/test\n      // skip verification by default so +qa accounts can be created quickly;\n      // hosted QA deployments can opt out with AUTH_SKIP_EMAIL_VERIFICATION=1.\n      requireEmailVerification,\n      sendResetPassword: async ({ user, token }) => {\n        // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n        // reset link must include that prefix so the page resolves correctly.\n        const appBasePath = (\n          process.env.VITE_APP_BASE_PATH ||\n          process.env.APP_BASE_PATH ||\n          \"\"\n        ).replace(/\\/$/, \"\");\n        const resetUrl = `${appUrl}${appBasePath}/_agent-native/auth/reset?token=${encodeURIComponent(token)}`;\n        const { subject, html, text } = renderResetPasswordEmail({\n          email: user.email,\n          resetUrl,\n        });\n        await sendEmail({ to: user.email, subject, html, text });\n      },\n    },\n    emailVerification: {\n      // Fire verification email right after signup, before the user has a\n      // session — pairs with requireEmailVerification above. Only enabled\n      // when an email provider is configured.\n      sendOnSignUp: requireEmailVerification,\n      // Auto-create a session once the user clicks the link. Without this,\n      // verified users would have to go back and sign in manually, which is\n      // a confusing dead-end on the verify screen.\n      autoSignInAfterVerification: true,\n      sendVerificationEmail: async ({ user, url }) => {\n        // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n        // verification link must include that prefix so the page resolves correctly.\n        const verifyBasePath = (\n          process.env.VITE_APP_BASE_PATH ||\n          process.env.APP_BASE_PATH ||\n          \"\"\n        ).replace(/\\/$/, \"\");\n        const verifyUrl = verifyBasePath\n          ? url.replace(/(\\/\\/[^/]+)(\\/)/, `$1${verifyBasePath}$2`)\n          : url;\n        const { subject, html, text } = renderVerifySignupEmail({\n          email: user.email,\n          verifyUrl,\n        });\n        await sendEmail({ to: user.email, subject, html, text });\n      },\n    },\n    socialProviders,\n    account: {\n      // Merge accounts when a user signs in with a social provider using an\n      // email that already has a local email/password account (or vice versa).\n      // Only providers listed in `trustedProviders` auto-link — these are the\n      // ones that verify emails at the identity layer. Never add a provider\n      // here that lets users claim an unverified email; that would be an\n      // account-takeover vector.\n      accountLinking: {\n        enabled: true,\n        trustedProviders: [\"google\", \"github\"],\n      },\n    },\n    databaseHooks: {\n      user: {\n        create: {\n          after: async (\n            user: {\n              id?: string;\n              email?: string;\n              name?: string | null;\n            },\n            // Better Auth (1.6.x) passes the endpoint context as the 2nd arg.\n            // It carries the originating request's headers (and on OAuth\n            // signups the callback request's headers), which is where the\n            // browser's `an_ft` first-touch cookie rides in.\n            context?: {\n              headers?: Headers | null;\n              request?: { headers?: Headers | null } | null;\n            } | null,\n          ) => {\n            // When a newly-created user's email has pending org invitations\n            // (common when someone is invited *before* they've signed up),\n            // auto-accept them so the user lands in the org on their very\n            // first page load instead of a blank-slate workspace.\n            const email = user?.email;\n            if (!email) return;\n            // Derive first-touch referral attribution from the request's\n            // cookie header. Never let attribution parsing throw or block\n            // signup — on any error fall back to `direct`.\n            let attribution: Record<string, string> | undefined;\n            try {\n              const cookieHeader =\n                context?.headers?.get(\"cookie\") ??\n                context?.request?.headers?.get(\"cookie\") ??\n                null;\n              attribution = signupAttributionFromCookieHeader(cookieHeader);\n            } catch (err) {\n              console.error(\"[auth] failed to derive signup attribution\", err);\n              attribution = undefined;\n            }\n            await trackSignupEvent({\n              authProvider: \"better-auth\",\n              authUserId: user.id,\n              email,\n              name: user.name,\n              attribution,\n            });\n            try {\n              await acceptPendingInvitationsForEmail(email);\n            } catch (err) {\n              // Never block signup on invite bookkeeping — log and continue.\n              console.error(\n                \"[auth] failed to auto-accept pending invitations\",\n                err,\n              );\n            }\n            try {\n              // Auto-join orgs whose `allowed_domain` matches this email\n              // domain. Lets a fresh `@builder.io` (or any org-domain)\n              // signup land inside the company org on first page load\n              // without going through the picker. No-ops when no match.\n              await autoJoinDomainMatchingOrgs(email);\n            } catch (err) {\n              console.error(\n                \"[auth] failed to auto-join domain-matching orgs\",\n                err,\n              );\n            }\n          },\n        },\n      },\n      account: {\n        // Mirror Google account tokens into `oauth_tokens` so existing\n        // template code (mail's Gmail client, calendar's events fetcher)\n        // can pick up Gmail/Calendar credentials from the primary sign-in\n        // flow — no separate \"Set up Google\" page required.\n        //\n        // Better Auth fires `create` for first-time social sign-in and\n        // `update` whenever a session re-issues tokens (e.g., the user\n        // re-signs in to refresh the token). Both branches do the same\n        // mirroring work; failures never block sign-in.\n        create: {\n          after: async (account: any) => {\n            if (!shouldMirrorGoogleAccountTokens) return;\n            await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n              console.error(\n                \"[auth] failed to mirror Google account tokens to oauth_tokens (create)\",\n                err,\n              );\n            });\n          },\n        },\n        update: {\n          after: async (account: any) => {\n            if (!shouldMirrorGoogleAccountTokens) return;\n            await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n              console.error(\n                \"[auth] failed to mirror Google account tokens to oauth_tokens (update)\",\n                err,\n              );\n            });\n          },\n        },\n      },\n    },\n    session: {\n      expiresIn: 60 * 60 * 24 * 30, // 30 days\n      updateAge: 60 * 60 * 24, // refresh daily\n      cookieCache: {\n        enabled: true,\n        maxAge: 5 * 60, // 5 min cache\n      },\n    },\n    advanced: {\n      cookiePrefix: cookieNamespace.betterAuthCookiePrefix,\n      // Emit `SameSite=None; Secure` when the app is served over HTTPS so\n      // session cookies are delivered inside third-party iframes (e.g. the\n      // Builder.io editor). Plain-HTTP dev keeps the default (Lax) because\n      // `SameSite=None` requires Secure.\n      ...(appUrl.startsWith(\"https://\")\n        ? {\n            defaultCookieAttributes: {\n              sameSite: \"none\" as const,\n              secure: true,\n              partitioned: true,\n            },\n          }\n        : {}),\n      // When an effective shared cookie domain is set, share Better Auth's\n      // session cookie across that domain. First-party `*.agent-native.com`\n      // apps intentionally do not use this path because their auth DBs are\n      // separate; Dispatch identity federation handles cross-app sign-in.\n      ...(cookieNamespace.betterAuthCookieDomain\n        ? {\n            crossSubDomainCookies: {\n              enabled: true,\n              domain: cookieNamespace.betterAuthCookieDomain,\n            },\n          }\n        : {}),\n    },\n    plugins: [\n      // JWT: issue tokens for A2A calls, JWKS endpoint for verification\n      jwt({\n        jwt: {\n          issuer: appUrl,\n          expirationTime: \"15m\",\n        },\n      }),\n      // Bearer: accept Bearer tokens on API requests\n      bearer(),\n      ...(config?.plugins ?? []),\n    ],\n  });\n\n  return auth as unknown as BetterAuthInstance;\n}\n\nasync function buildDatabaseConfig(\n  dialect: string,\n): Promise<BetterAuthOptions[\"database\"]> {\n  if (dialect === \"postgres\") {\n    const url = getDatabaseUrl();\n    const {\n      buildResilientNeonPool,\n      buildResilientPostgresJsClient,\n      isNeonUrl,\n    } = await import(\"../db/create-get-db.js\");\n\n    if (isPgliteUrl(url)) {\n      const { drizzle } = await loadPgliteDrizzle();\n      const client = await getPgliteClient(url);\n      const db = drizzle({ client, schema: pgAuthSchema });\n      const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n      return drizzleAdapter(db, {\n        provider: \"pg\",\n        schema: pgAuthSchema,\n      });\n    }\n\n    // Neon via @neondatabase/serverless (WebSockets over HTTPS). postgres-js\n    // opens a raw TCP connection on port 5432 which frequently times out on\n    // Netlify Functions / Vercel / CF Workers when Neon's pooler is cold.\n    if (isNeonUrl(url)) {\n      const { Pool } = await import(\"@neondatabase/serverless\");\n      // Cap the auth pool the same way as the app pool. Better Auth runs a\n      // session lookup on essentially every authenticated request, so an\n      // un-capped pool here is a primary contributor to \"Max client\n      // connections reached\" across concurrent serverless instances.\n      _neonAuthPool = new Pool({\n        connectionString: url,\n        max: neonPoolMax(),\n      });\n      attachNeonPoolErrorLogger(_neonAuthPool, \"db/neon-auth\");\n      const { drizzle } = await import(\"drizzle-orm/neon-serverless\");\n      const db = drizzle(buildResilientNeonPool(_neonAuthPool), {\n        schema: pgAuthSchema,\n      });\n      const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n      return drizzleAdapter(db, {\n        provider: \"pg\",\n        schema: pgAuthSchema,\n      });\n    }\n\n    // Non-Neon Postgres (Supabase, self-hosted, etc.) → postgres-js.\n    // pgPoolOptions caps this pool to a small size on serverless. Better Auth\n    // runs a session lookup on essentially every authenticated request, so an\n    // un-capped pool here is a primary contributor to \"Max client connections\n    // reached\" across concurrent serverless instances.\n    const { default: postgres } = await import(\"postgres\");\n    const sql = postgres(url, pgPoolOptions(url));\n    const { drizzle } = await import(\"drizzle-orm/postgres-js\");\n    const db = drizzle(buildResilientPostgresJsClient(sql), {\n      schema: pgAuthSchema,\n    });\n    const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n    return drizzleAdapter(db, {\n      provider: \"pg\",\n      schema: pgAuthSchema,\n    });\n  }\n\n  // SQLite / libsql\n  const url = getDatabaseUrl(\"file:./data/app.db\");\n\n  if (url.startsWith(\"file:\") || !url.includes(\"://\")) {\n    // Local SQLite via better-sqlite3\n    const { default: Database } = await import(\"better-sqlite3\");\n    const filePath = url.replace(/^file:/, \"\");\n    const sqlite = new Database(filePath);\n    sqlite.pragma(\"journal_mode = WAL\");\n    const { drizzle } = await import(\"drizzle-orm/better-sqlite3\");\n    const db = drizzle(sqlite, { schema: sqliteAuthSchema });\n    const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n    return drizzleAdapter(db, {\n      provider: \"sqlite\",\n      schema: sqliteAuthSchema,\n    });\n  }\n\n  // Remote libsql (Turso). Use the web client to avoid serverless bundles\n  // depending on libsql's platform-specific native packages.\n  const { createClient } = await import(\"@libsql/client/web\");\n  const client = createClient({ url, authToken: getDatabaseAuthToken() });\n  const { drizzle } = await import(\"drizzle-orm/libsql/web\");\n  const db = drizzle(client, { schema: sqliteAuthSchema });\n  const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n  return drizzleAdapter(db, {\n    provider: \"sqlite\",\n    schema: sqliteAuthSchema,\n  });\n}\n"]}
+{"version":3,"file":"better-auth-instance.js","sourceRoot":"","sources":["../../src/server/better-auth-instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,EACL,OAAO,EACP,IAAI,IAAI,MAAM,EACd,SAAS,IAAI,WAAW,EACxB,OAAO,IAAI,SAAS,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,IAAI,IAAI,UAAU,EAClB,OAAO,IAAI,aAAa,GACzB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,iCAAiC,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAE/E,KAAK,UAAU,mBAAmB;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,aAAa,EAAE;YACf,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAa;IACxD,MAAM,OAAO,GAAG,MAAM,4BAA4B,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5E,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,OAAO;SAC3B,eAAe,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;SAClD,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,YAAY,EACZ,UAAU,EACV,KAAK,EACL,IAAI,EACJ,WAAW,GAcZ;IACC,QAAQ,CAAC,KAAK,EAAE;QACd,KAAK;QACL,IAAI,EAAE,IAAI,IAAI,SAAS;QACvB,UAAU;KACX,CAAC,CAAC;IACH,MAAM,gBAAgB,GAA2B,EAAE,CAAC;IACpD,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,gBAAgB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,CACH,QAAQ,EACR;QACE,GAAG,+BAA+B,EAAE;QACpC,aAAa,EAAE,YAAY;QAC3B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,gBAAgB;KACpB,EACD,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;IACF,MAAM,mBAAmB,EAAE,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,IAAI,qBAAyC,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,iBAAiB;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC1E,MAAM,sBAAsB,GAAG,4BAA4B,CAAC,aAAa,CAAC,CAAC;IAC3E,IAAI,sBAAsB;QAAE,OAAO,sBAAsB,CAAC;IAE1D,wEAAwE;IACxE,8EAA8E;IAC9E,uEAAuE;IACvE,4EAA4E;IAC5E,8EAA8E;IAC9E,2BAA2B;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,+EAA+E;YAC7E,0EAA0E;YAC1E,0DAA0D;YAC1D,wBAAwB,MAAM,MAAM;YACpC,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,+CAA+C;YAC/C,wEAAwE;YACxE,kCAAkC,CACrC,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,+DAA+D;IAC/D,qEAAqE;IACrE,sEAAsE;IACtE,mDAAmD;IACnD,MAAM,QAAQ,GAAG,kBAAkB,CACjC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAC1C,CAAC;IACF,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,qBAAqB,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CACV,0EAA0E;YACxE,oEAAoE;YACpE,uEAAuE;YACvE,iCAAiC,CACpC,CAAC;IACJ,CAAC;IACD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtD,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CACrB,8DAA8D,CAC/D,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAyB;IACtD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACtC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC;QACvC,CAAC,CAAC,OAAO,CAAC;IACZ,MAAM,IAAI,GAAG,QAAQ;SAClB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,IAAI,IAAI,SAAS,CAAC;AAC3B,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QACpD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC;QACpC,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa,CAAC;QAClE,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAEtD,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;YAChD,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC3C,OAAO,qBAAqB,CAC1B,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAC/C,CAAC;QACJ,CAAC;QACD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,6BAA6B;IAI3C,MAAM,WAAW,GACf,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACnD,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC3D,MAAM,UAAU,GACd,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACnD,qBAAqB,CAAC,eAAe,EAAE,CAAC,CAAC;IAC3C,MAAM,MAAM,GACV,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACnC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3C,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QAC/B,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACtC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;QACzD,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,GAAG,GACP,WAAW;QACX,MAAM;QACN,UAAU;QACV,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE9C,MAAM,QAAQ,GACZ,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACpD,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACzD,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC3C,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAChD,iBAAiB,CAAC,GAAG,CAAC;QACtB,iBAAiB,CAAC,UAAU,CAAC;QAC7B,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE5B,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,+BAA+B;IAC7C,MAAM,QAAQ,GAAG,6BAA6B,EAAE,CAAC;IACjD,OAAO;QACL,GAAG,QAAQ;QACX,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACvD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,MAAM,aAAa,GACjB,OAAO,CAAC,GAAG,CAAC,iCAAiC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACvE,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa;YACtC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;YAC/B,aAAa,KAAK,gBAAgB,CACnC,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,OAAO,CAAC;AAC3E,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AA0DD,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,IAAI,KAAqC,CAAC;AAC1C,IAAI,YAAqD,CAAC;AAC1D,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACxE,IAAI,aAAkB,CAAC;AAEvB,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,aAAa,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,oBAAoB,EAAE,MAAM,CAAC,wBAAwB,CAAC;KACvD,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;QACnC,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC;QACrC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;QAC3B,oBAAoB,EAAE,WAAW,CAAC,yBAAyB,EAAE;YAC3D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,qBAAqB,EAAE,WAAW,CAAC,0BAA0B,EAAE;YAC7D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACvC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE;QACxB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE;QAChC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;KAC7D,CAAC;CACH,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,aAAa,EAAE,aAAa,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aAChE,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;QACjB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,UAAU,CAAC,wBAAwB,CAAC;KAC3D,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,WAAW,EAAE,UAAU,CAAC,cAAc,CAAC;QACvC,YAAY,EAAE,UAAU,CAAC,eAAe,CAAC;QACzC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC;QAC/B,oBAAoB,EAAE,aAAa,CAAC,yBAAyB,EAAE;YAC7D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,qBAAqB,EAAE,aAAa,CAAC,0BAA0B,EAAE;YAC/D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC9C,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC3C,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC5B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,UAAU,EAAE,WAAW,CAAC,YAAY,EAAE;QACpC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACzD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;KACjE,CAAC;CACH,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,gCAAgC,CAAC,OAS/C;IACC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO;IACxD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO;IAE5B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iEAAiE;QACjE,kEAAkE;QAClE,oDAAoD;QACpD,OAAO;IACT,CAAC;IAED,kCAAkC;IAClC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAChC,GAAG,EAAE,uCAAuC;YAC5C,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACvB,CAAC,CAAC;QACH,KAAK,GAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAA4B,IAAI,SAAS,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,uEAAuE,EACvE,GAAG,CACJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,uEAAuE;IACvE,6BAA6B;IAC7B,IAAI,UAA8B,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC;IACzC,IAAI,GAAG,YAAY,IAAI,EAAE,CAAC;QACxB,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,UAAU,GAAG,GAAG,CAAC;IACnB,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAA4B;QACtC,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;KACrB,CAAC;IACF,IAAI,OAAO,CAAC,YAAY;QAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IACtE,IAAI,UAAU;QAAE,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC;IAChD,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAEvD,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,sBAAsB;IACnC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAEvB,yEAAyE;IACzE,uEAAuE;IACvE,+EAA+E;IAC/E,2EAA2E;IAC3E,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,GAA6C;YACzD;gBACE,MAAM;gBACN,sOAAsO;aACvO;YACD;gBACE,SAAS;gBACT,iRAAiR;aAClR;YACD;gBACE,SAAS;gBACT,sWAAsW;aACvW;YACD;gBACE,cAAc;gBACd,mNAAmN;aACpN;YACD;gBACE,cAAc;gBACd,4MAA4M;aAC7M;YACD;gBACE,QAAQ;gBACR,wNAAwN;aACzN;YACD;gBACE,YAAY;gBACZ,mSAAmS;aACpS;YACD;gBACE,MAAM;gBACN,uKAAuK;aACxK;SACF,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ;YAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,MAAM,gBAAgB,GAAG;QACvB,wNAAwN;QACxN,mQAAmQ;QACnQ,oVAAoV;QACpV,qMAAqM;QACrM,kMAAkM;QAClM,8MAA8M;QAC9M,qRAAqR;QACrR,6JAA6J;KAC9J,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,gBAAgB;QAAE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB;IAEzB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,YAAY,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAChD,KAAK,GAAG,MAAM,YAAY,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AA6BD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAExC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;QAChC,MAAM,EAAE,GAAG,GAAG,EAAE,eAAe,CAAC;QAChC,IACE,EAAE;YACF,OAAO,EAAE,CAAC,eAAe,KAAK,UAAU;YACxC,OAAO,EAAE,CAAC,WAAW,KAAK,UAAU;YACpC,OAAO,EAAE,CAAC,UAAU,KAAK,UAAU,EACnC,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,KAAK,GAAG,SAAS,CAAC;IAClB,YAAY,GAAG,SAAS,CAAC;IACzB,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;QACD,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;IACD,MAAM,kBAAkB,EAAE,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,KAAK,UAAU,wBAAwB,CACrC,MAAyB;IAEzB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,wBAAwB,CAAC;IAC9D,MAAM,sBAAsB,EAAE,CAAC;IAE/B,uCAAuC;IACvC,MAAM,eAAe,GAAyC;QAC5D,GAAG,MAAM,EAAE,eAAe;KAC3B,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;IAC/C,MAAM,iBAAiB,GACrB,WAAW,CAAC,MAAM,GAAG,CAAC;QACpB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAChE,CAAC,CAAC;gBACE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;gBACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;aAC/C;YACH,CAAC,CAAC,IAAI;QACR,CAAC,CAAC,8BAA8B,EAAE,CAAC;IACvC,IAAI,iBAAiB,EAAE,CAAC;QACtB,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,wCAAwC;QACxC,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC1E,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;YACpC,YAAY,EAAE,iBAAiB,CAAC,YAAY;YAC5C,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC;oBACE,KAAK,EAAE,YAAY;oBACnB,UAAU,EAAE,SAAkB;oBAC9B,MAAM,EAAE,SAAkB;iBAC3B;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;SAC/C,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,eAAe,GAAG,0BAA0B,EAAE,CAAC;IACrD,MAAM,wBAAwB,GAC5B,CAAC,MAAM,iBAAiB,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC;IAEhE,MAAM,+BAA+B,GACnC,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAE1C,MAAM,IAAI,GAAG,UAAU,CAAC;QACtB,QAAQ;QACR,OAAO,EAAE,MAAM;QACf,QAAQ;QACR,MAAM;QACN,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,CAAC;YACpB,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,wBAAwB;YACxB,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC3C,qEAAqE;gBACrE,sEAAsE;gBACtE,MAAM,WAAW,GAAG,CAClB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,WAAW,mCAAmC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAC;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ;iBACT,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,oEAAoE;YACpE,oEAAoE;YACpE,wCAAwC;YACxC,YAAY,EAAE,wBAAwB;YACtC,qEAAqE;YACrE,sEAAsE;YACtE,6CAA6C;YAC7C,2BAA2B,EAAE,IAAI;YACjC,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC7C,qEAAqE;gBACrE,6EAA6E;gBAC7E,MAAM,cAAc,GAAG,CACrB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,SAAS,GAAG,cAAc;oBAC9B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,cAAc,IAAI,CAAC;oBACzD,CAAC,CAAC,GAAG,CAAC;gBACR,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC;oBACtD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS;iBACV,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,eAAe;QACf,OAAO,EAAE;YACP,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,mEAAmE;YACnE,2BAA2B;YAC3B,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;aACvC;SACF;QACD,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EACV,IAIC;oBACD,kEAAkE;oBAClE,6DAA6D;oBAC7D,8DAA8D;oBAC9D,iDAAiD;oBACjD,OAGQ,EACR,EAAE;wBACF,gEAAgE;wBAChE,+DAA+D;wBAC/D,8DAA8D;wBAC9D,sDAAsD;wBACtD,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;wBAC1B,IAAI,CAAC,KAAK;4BAAE,OAAO;wBACnB,6DAA6D;wBAC7D,8DAA8D;wBAC9D,+CAA+C;wBAC/C,IAAI,WAA+C,CAAC;wBACpD,IAAI,CAAC;4BACH,MAAM,YAAY,GAChB,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC;gCAC/B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC;gCACxC,IAAI,CAAC;4BACP,WAAW,GAAG,iCAAiC,CAAC,YAAY,CAAC,CAAC;wBAChE,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;4BACjE,WAAW,GAAG,SAAS,CAAC;wBAC1B,CAAC;wBACD,MAAM,gBAAgB,CAAC;4BACrB,YAAY,EAAE,aAAa;4BAC3B,UAAU,EAAE,IAAI,CAAC,EAAE;4BACnB,KAAK;4BACL,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,WAAW;yBACZ,CAAC,CAAC;wBACH,IAAI,CAAC;4BACH,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;wBAChD,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,+DAA+D;4BAC/D,OAAO,CAAC,KAAK,CACX,kDAAkD,EAClD,GAAG,CACJ,CAAC;wBACJ,CAAC;wBACD,IAAI,CAAC;4BACH,2DAA2D;4BAC3D,yDAAyD;4BACzD,wDAAwD;4BACxD,0DAA0D;4BAC1D,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;wBAC1C,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,OAAO,CAAC,KAAK,CACX,iDAAiD,EACjD,GAAG,CACJ,CAAC;wBACJ,CAAC;oBACH,CAAC;iBACF;aACF;YACD,OAAO,EAAE;gBACP,+DAA+D;gBAC/D,iEAAiE;gBACjE,kEAAkE;gBAClE,oDAAoD;gBACpD,EAAE;gBACF,+DAA+D;gBAC/D,+DAA+D;gBAC/D,+DAA+D;gBAC/D,gDAAgD;gBAChD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,IAAI,CAAC,+BAA+B;4BAAE,OAAO;wBAC7C,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;gBACD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,IAAI,CAAC,+BAA+B;4BAAE,OAAO;wBAC7C,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;aACF;SACF;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU;YACxC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,gBAAgB;YACzC,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,cAAc;aAC/B;SACF;QACD,QAAQ,EAAE;YACR,YAAY,EAAE,eAAe,CAAC,sBAAsB;YACpD,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,mCAAmC;YACnC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC/B,CAAC,CAAC;oBACE,uBAAuB,EAAE;wBACvB,QAAQ,EAAE,MAAe;wBACzB,MAAM,EAAE,IAAI;wBACZ,WAAW,EAAE,IAAI;qBAClB;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,oEAAoE;YACpE,GAAG,CAAC,eAAe,CAAC,sBAAsB;gBACxC,CAAC,CAAC;oBACE,qBAAqB,EAAE;wBACrB,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,eAAe,CAAC,sBAAsB;qBAC/C;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,OAAO,EAAE;YACP,kEAAkE;YAClE,GAAG,CAAC;gBACF,GAAG,EAAE;oBACH,MAAM,EAAE,MAAM;oBACd,cAAc,EAAE,KAAK;iBACtB;aACF,CAAC;YACF,+CAA+C;YAC/C,MAAM,EAAE;YACR,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC3B;KACF,CAAC,CAAC;IAEH,OAAO,IAAqC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAe;IAEf,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,EACJ,sBAAsB,EACtB,8BAA8B,EAC9B,SAAS,GACV,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAE3C,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACxE,OAAO,cAAc,CAAC,EAAE,EAAE;gBACxB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,YAAY;aACrB,CAAC,CAAC;QACL,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YAC1D,qEAAqE;YACrE,mEAAmE;YACnE,8DAA8D;YAC9D,+DAA+D;YAC/D,aAAa,GAAG,IAAI,IAAI,CAAC;gBACvB,gBAAgB,EAAE,GAAG;gBACrB,GAAG,EAAE,WAAW,EAAE;aACnB,CAAC,CAAC;YACH,yBAAyB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACzD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAChE,MAAM,EAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE;gBACxD,MAAM,EAAE,YAAY;aACrB,CAAC,CAAC;YACH,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACxE,OAAO,cAAc,CAAC,EAAE,EAAE;gBACxB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,YAAY;aACrB,CAAC,CAAC;QACL,CAAC;QAED,iEAAiE;QACjE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,mDAAmD;QACnD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,EAAE;YACtD,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAEjD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,kCAAkC;QAClC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACxE,OAAO,cAAc,CAAC,EAAE,EAAE;QACxB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Internal Better Auth instance — lazily created, not exported to templates.\n *\n * Templates interact with auth via the existing `getSession()`, `autoMountAuth()`,\n * `createAuthPlugin()`, and `createGoogleAuthPlugin()` APIs. Better Auth is an\n * implementation detail behind those interfaces.\n */\n\nimport crypto from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nimport { betterAuth, type BetterAuthOptions } from \"better-auth\";\nimport { bearer } from \"better-auth/plugins/bearer\";\nimport { jwt } from \"better-auth/plugins/jwt\";\nimport {\n  pgTable,\n  text as pgText,\n  timestamp as pgTimestamp,\n  boolean as pgBoolean,\n} from \"drizzle-orm/pg-core\";\nimport {\n  sqliteTable,\n  text as sqliteText,\n  integer as sqliteInteger,\n} from \"drizzle-orm/sqlite-core\";\n\nimport { TEMPLATES } from \"../cli/templates-meta.js\";\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport {\n  getDialect,\n  getDatabaseUrl,\n  getDatabaseAuthToken,\n  closePgliteClients,\n  getPgliteClient,\n  isPgliteUrl,\n  loadPgliteDrizzle,\n  pgPoolOptions,\n  neonPoolMax,\n  attachNeonPoolErrorLogger,\n} from \"../db/client.js\";\nimport { ensureTableExists } from \"../db/ddl-guard.js\";\nimport { saveOAuthTokens } from \"../oauth-tokens/store.js\";\nimport { acceptPendingInvitationsForEmail } from \"../org/accept-pending.js\";\nimport { autoJoinDomainMatchingOrgs } from \"../org/auto-join-domain.js\";\nimport { flushTracking, identify, track } from \"../tracking/index.js\";\nimport { getAppProductionUrl } from \"./app-url.js\";\nimport { signupAttributionFromCookieHeader } from \"./attribution.js\";\nimport { resolveAuthCookieNamespace } from \"./cookie-namespace.js\";\nimport { getWorkspaceA2ADerivedSecret } from \"./derived-secret.js\";\nimport {\n  renderResetPasswordEmail,\n  renderVerifySignupEmail,\n} from \"./email-templates.js\";\nimport { sendEmail, isEmailConfigured } from \"./email.js\";\nimport { resolveGoogleSignInCredentials } from \"./google-oauth-credentials.js\";\n\nasync function flushSignupTracking(): Promise<void> {\n  try {\n    await Promise.race([\n      flushTracking(),\n      new Promise<void>((resolve) => setTimeout(resolve, 1500)),\n    ]);\n  } catch {\n    // Signup should never fail because analytics delivery did.\n  }\n}\n\nexport async function hasBetterAuthUserEmail(email: string): Promise<boolean> {\n  const adapter = await getBetterAuthInternalAdapter().catch(() => undefined);\n  if (!adapter) return false;\n  const existing = await adapter\n    .findUserByEmail(email, { includeAccounts: false })\n    .catch(() => null);\n  return !!existing?.user?.email;\n}\n\nexport async function trackSignupEvent({\n  authProvider,\n  authUserId,\n  email,\n  name,\n  attribution,\n}: {\n  authProvider: string;\n  authUserId?: string;\n  email: string;\n  name?: string | null;\n  /**\n   * First-touch referral attribution derived from the visitor's `an_ft`\n   * cookie (see `server/attribution.ts`). Snake_case keys such as\n   * `referral_source`, `referrer_user`, and the UTM passthrough are merged\n   * into the `signup` event so we can measure where new users came from.\n   * `undefined` values are dropped; a missing object is a clean no-op.\n   */\n  attribution?: Record<string, string | undefined>;\n}): Promise<void> {\n  identify(email, {\n    email,\n    name: name ?? undefined,\n    authUserId,\n  });\n  const cleanAttribution: Record<string, string> = {};\n  if (attribution) {\n    for (const [key, value] of Object.entries(attribution)) {\n      if (typeof value === \"string\" && value.length > 0) {\n        cleanAttribution[key] = value;\n      }\n    }\n  }\n  track(\n    \"signup\",\n    {\n      ...resolveSignupTrackingProperties(),\n      auth_provider: authProvider,\n      ...(authUserId ? { auth_user_id: authUserId } : {}),\n      ...cleanAttribution,\n    },\n    { userId: email },\n  );\n  await flushSignupTracking();\n}\n\n// ---------------------------------------------------------------------------\n// Persistent auth secret\n// ---------------------------------------------------------------------------\n\nlet inMemoryDevAuthSecret: string | undefined;\n\n/**\n * Resolve the Better Auth signing secret.\n *\n * Resolution order:\n *   1. `BETTER_AUTH_SECRET` env var — explicit, recommended for prod.\n *   2. Hosted workspace deploys can derive a per-purpose secret from the\n *      already-required `A2A_SECRET` root. This keeps fresh workspace branches\n *      bootable without reusing the raw A2A key as a cookie-signing key.\n *   3. Existing `.env.local` values in the template cwd — read-only\n *      compatibility for projects that already configured this secret.\n *   4. Generate a per-process in-memory random 32-byte hex in development.\n *\n * Why this matters: before this helper existed, missing `BETTER_AUTH_SECRET`\n * fell through to `GOOGLE_CLIENT_SECRET` / `ACCESS_TOKEN` / a hardcoded\n * string. If a template happened to have none of those, each dev-server\n * boot would re-fall back to the hardcoded value (still stable) — but\n * rotating Google credentials, toggling `ACCESS_TOKEN`, or churning the\n * fallback chain would invalidate every signed cookie and force everyone\n * to sign in again. We still read explicit env configuration, but never\n * auto-write a generated secret into env files.\n */\nfunction resolveAuthSecret(): string {\n  if (process.env.BETTER_AUTH_SECRET) return process.env.BETTER_AUTH_SECRET;\n  const workspaceDerivedSecret = getWorkspaceA2ADerivedSecret(\"better-auth\");\n  if (workspaceDerivedSecret) return workspaceDerivedSecret;\n\n  // In production, beyond the workspace A2A-derived fallback above, never\n  // auto-generate or use legacy fallbacks. A generated secret invalidates every\n  // signed session cookie on the next cold start (serverless filesystems\n  // aren't persistent), and the legacy hardcoded fallback is identical across\n  // every deploy that hits it — both are serious enough to fail the boot loudly\n  // so the deployer notices.\n  if (process.env.NODE_ENV === \"production\") {\n    const sample = crypto.randomBytes(32).toString(\"hex\");\n    throw new Error(\n      \"[agent-native] BETTER_AUTH_SECRET is not set. This is required in production \" +\n        \"so signed session cookies stay valid across deploys. Set it as a deploy \" +\n        \"environment variable (any 32-byte hex string), e.g.:\\n\\n\" +\n        `  BETTER_AUTH_SECRET=${sample}\\n\\n` +\n        \"Generate your own with `openssl rand -hex 32`. If you already have a \" +\n        \"running deploy and need to preserve existing sessions, set it to your \" +\n        \"previously-deployed BETTER_AUTH_SECRET value first, then rotate to a \" +\n        \"fresh one. Hosted workspace deploys may also \" +\n        \"set A2A_SECRET; agent-native derives a per-purpose Better Auth secret \" +\n        \"from that workspace root secret.\",\n    );\n  }\n\n  // SECURITY (audit 09 LOW-2): the previous fallback chain\n  // (`GOOGLE_CLIENT_SECRET || ACCESS_TOKEN || hardcoded`) reused\n  // cross-purpose secrets and a public hardcoded literal as the cookie\n  // HMAC. Dropped entirely — better to mint an ephemeral secret than to\n  // re-use a Google client secret or a known string.\n  const existing = readEnvLocalSecret(\n    path.resolve(process.cwd(), \".env.local\"),\n  );\n  if (existing) return existing;\n\n  if (!inMemoryDevAuthSecret) {\n    inMemoryDevAuthSecret = crypto.randomBytes(32).toString(\"hex\");\n    console.warn(\n      \"[agent-native] BETTER_AUTH_SECRET is not configured. Using an ephemeral \" +\n        \"in-memory development secret. Sessions will reset every time this \" +\n        \"process restarts. Set BETTER_AUTH_SECRET in your environment to keep \" +\n        \"sessions valid across restarts.\",\n    );\n  }\n  return inMemoryDevAuthSecret;\n}\n\nfunction readEnvLocalSecret(envLocalPath: string): string | undefined {\n  try {\n    const content = fs.readFileSync(envLocalPath, \"utf8\");\n    // Match `BETTER_AUTH_SECRET=...` on its own line. Tolerate optional\n    // quotes and leading `export `. Stop at the first newline or quote.\n    const m = content.match(\n      /^(?:export\\s+)?BETTER_AUTH_SECRET\\s*=\\s*\"?([^\"\\r\\n]+)\"?\\s*$/m,\n    );\n    return m?.[1]?.trim() || undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction normalizeTrackingSlug(value: string | undefined): string | undefined {\n  const trimmed = value?.trim();\n  if (!trimmed) return undefined;\n  const unscoped = trimmed.startsWith(\"@\")\n    ? (trimmed.split(\"/\").pop() ?? trimmed)\n    : trimmed;\n  const slug = unscoped\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return slug || undefined;\n}\n\nfunction knownTemplateSlug(value: string | undefined): string | undefined {\n  const slug = normalizeTrackingSlug(value);\n  if (!slug) return undefined;\n  const withoutPrefix = slug.startsWith(\"agent-native-\")\n    ? slug.slice(\"agent-native-\".length)\n    : slug;\n  return TEMPLATES.some((template) => template.name === withoutPrefix)\n    ? withoutPrefix\n    : undefined;\n}\n\nfunction readPackageName(): string | undefined {\n  try {\n    const pkgPath = path.join(process.cwd(), \"package.json\");\n    const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf8\")) as {\n      name?: string;\n    };\n    return pkg.name;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction appSlugFromUrl(value: string | undefined): string | undefined {\n  if (!value?.trim()) return undefined;\n  try {\n    const raw = /^[a-z][a-z0-9+.-]*:\\/\\//i.test(value)\n      ? value\n      : `https://${value}`;\n    const hostname = new URL(raw).hostname.toLowerCase();\n    if (hostname.endsWith(\".agent-native.com\")) {\n      return normalizeTrackingSlug(\n        hostname.slice(0, -\".agent-native.com\".length),\n      );\n    }\n    return normalizeTrackingSlug(hostname.split(\".\")[0]);\n  } catch {\n    return undefined;\n  }\n}\n\n/** @internal */\nexport function resolveSignupTrackingIdentity(): {\n  app?: string;\n  template?: string;\n} {\n  const explicitApp =\n    normalizeTrackingSlug(process.env.AGENT_NATIVE_APP) ||\n    normalizeTrackingSlug(process.env.VITE_AGENT_NATIVE_APP);\n  const packageApp =\n    normalizeTrackingSlug(process.env.npm_package_name) ||\n    normalizeTrackingSlug(readPackageName());\n  const urlApp =\n    appSlugFromUrl(process.env.APP_URL) ||\n    appSlugFromUrl(process.env.BETTER_AUTH_URL) ||\n    appSlugFromUrl(process.env.URL) ||\n    appSlugFromUrl(process.env.DEPLOY_URL) ||\n    appSlugFromUrl(process.env.VERCEL_PROJECT_PRODUCTION_URL) ||\n    appSlugFromUrl(process.env.VERCEL_URL);\n  const app =\n    explicitApp ||\n    urlApp ||\n    packageApp ||\n    normalizeTrackingSlug(process.env.APP_NAME);\n\n  const template =\n    knownTemplateSlug(process.env.AGENT_NATIVE_TEMPLATE) ||\n    knownTemplateSlug(process.env.VITE_AGENT_NATIVE_TEMPLATE) ||\n    knownTemplateSlug(process.env.APP_TEMPLATE) ||\n    knownTemplateSlug(process.env.VITE_APP_TEMPLATE) ||\n    knownTemplateSlug(app) ||\n    knownTemplateSlug(packageApp) ||\n    knownTemplateSlug(urlApp);\n\n  return {\n    ...(app ? { app } : {}),\n    ...(template ? { template } : {}),\n  };\n}\n\n/** @internal */\nexport function resolveSignupTrackingProperties(): Record<string, string> {\n  const identity = resolveSignupTrackingIdentity();\n  return {\n    ...identity,\n    ...(identity.app ? { agent_native_app: identity.app } : {}),\n    ...(identity.template ? { agent_native_template: identity.template } : {}),\n  };\n}\n\nexport function shouldSkipEmailVerification(): boolean {\n  const value = process.env.AUTH_SKIP_EMAIL_VERIFICATION;\n  if (value == null) {\n    const deployContext =\n      process.env.AGENT_NATIVE_BUILD_DEPLOY_CONTEXT || process.env.CONTEXT;\n    return (\n      process.env.NODE_ENV === \"development\" ||\n      process.env.NODE_ENV === \"test\" ||\n      deployContext === \"deploy-preview\"\n    );\n  }\n  const normalized = value.trim().toLowerCase();\n  return normalized !== \"\" && normalized !== \"0\" && normalized !== \"false\";\n}\n\n/** Read-only accessor for the resolved auth secret. */\nexport function getAuthSecret(): string {\n  return resolveAuthSecret();\n}\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/** The shape we need from a Better Auth instance (internal — not exported to templates). */\nexport interface BetterAuthInstance {\n  handler: (request: Request) => Promise<Response>;\n  api: {\n    getSession: (opts: { headers: Headers }) => Promise<{\n      user: { id: string; email: string; name: string };\n      session: {\n        id: string;\n        token: string;\n        expiresAt: Date;\n      };\n    } | null>;\n    signInEmail: (opts: {\n      body: { email: string; password: string };\n    }) => Promise<{ token?: string; user?: any } | null>;\n    signUpEmail: (opts: {\n      body: {\n        email: string;\n        password: string;\n        name: string;\n        callbackURL?: string;\n      };\n      headers?: Headers;\n    }) => Promise<any>;\n    signOut: (opts: { headers: Headers }) => Promise<any>;\n  };\n}\n\nexport interface BetterAuthConfig {\n  /** Base path for Better Auth routes. Default: \"/_agent-native/auth/ba\" */\n  basePath?: string;\n  /** Additional social providers beyond what env vars auto-detect */\n  socialProviders?: BetterAuthOptions[\"socialProviders\"];\n  /** Additional Better Auth plugins */\n  plugins?: BetterAuthOptions[\"plugins\"];\n  /**\n   * Additional Google OAuth scopes (Gmail, Calendar, etc.) to request\n   * up front during the primary \"Sign in with Google\" flow, beyond the\n   * default identity scopes (`openid`, `email`, `profile`).\n   *\n   * When set, the Google social provider also opts into:\n   * - `accessType: \"offline\"` — so a refresh token is issued\n   * - `prompt: \"consent\"` — so the refresh token is reissued every sign-in\n   *\n   * Tokens are mirrored into `oauth_tokens` via a databaseHooks.account\n   * hook so existing template code that reads from `oauth_tokens` (mail's\n   * Gmail client, calendar's events fetcher) works without any separate\n   * \"Connect Google\" page.\n   */\n  googleScopes?: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Lazy instance\n// ---------------------------------------------------------------------------\n\nlet _auth: BetterAuthInstance | undefined;\nlet _initPromise: Promise<BetterAuthInstance> | undefined;\n// Track the Neon serverless Pool we open for Better Auth so closeBetterAuth()\n// can release it. The Pool keeps WebSocket connections open; leaking them on\n// hot-reload or process restart exhausts Neon's connection slot budget.\nlet _neonAuthPool: any;\n\nconst pgAuthSchema = {\n  user: pgTable(\"user\", {\n    id: pgText(\"id\").primaryKey(),\n    name: pgText(\"name\").notNull(),\n    email: pgText(\"email\").notNull().unique(),\n    emailVerified: pgBoolean(\"email_verified\").notNull().default(false),\n    image: pgText(\"image\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  session: pgTable(\"session\", {\n    id: pgText(\"id\").primaryKey(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    token: pgText(\"token\").notNull().unique(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n    ipAddress: pgText(\"ip_address\"),\n    userAgent: pgText(\"user_agent\"),\n    userId: pgText(\"user_id\").notNull(),\n    activeOrganizationId: pgText(\"active_organization_id\"),\n  }),\n  account: pgTable(\"account\", {\n    id: pgText(\"id\").primaryKey(),\n    accountId: pgText(\"account_id\").notNull(),\n    providerId: pgText(\"provider_id\").notNull(),\n    userId: pgText(\"user_id\").notNull(),\n    accessToken: pgText(\"access_token\"),\n    refreshToken: pgText(\"refresh_token\"),\n    idToken: pgText(\"id_token\"),\n    accessTokenExpiresAt: pgTimestamp(\"access_token_expires_at\", {\n      withTimezone: true,\n    }),\n    refreshTokenExpiresAt: pgTimestamp(\"refresh_token_expires_at\", {\n      withTimezone: true,\n    }),\n    scope: pgText(\"scope\"),\n    password: pgText(\"password\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  verification: pgTable(\"verification\", {\n    id: pgText(\"id\").primaryKey(),\n    identifier: pgText(\"identifier\").notNull(),\n    value: pgText(\"value\").notNull(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  organization: pgTable(\"organization\", {\n    id: pgText(\"id\").primaryKey(),\n    name: pgText(\"name\").notNull(),\n    slug: pgText(\"slug\").notNull().unique(),\n    logo: pgText(\"logo\"),\n    metadata: pgText(\"metadata\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  member: pgTable(\"member\", {\n    id: pgText(\"id\").primaryKey(),\n    organizationId: pgText(\"organization_id\").notNull(),\n    userId: pgText(\"user_id\").notNull(),\n    role: pgText(\"role\").notNull().default(\"member\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  invitation: pgTable(\"invitation\", {\n    id: pgText(\"id\").primaryKey(),\n    organizationId: pgText(\"organization_id\").notNull(),\n    email: pgText(\"email\").notNull(),\n    role: pgText(\"role\"),\n    status: pgText(\"status\").notNull().default(\"pending\"),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    inviterId: pgText(\"inviter_id\").notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  jwks: pgTable(\"jwks\", {\n    id: pgText(\"id\").primaryKey(),\n    publicKey: pgText(\"public_key\").notNull(),\n    privateKey: pgText(\"private_key\").notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }),\n  }),\n};\n\nconst sqliteAuthSchema = {\n  user: sqliteTable(\"user\", {\n    id: sqliteText(\"id\").primaryKey(),\n    name: sqliteText(\"name\").notNull(),\n    email: sqliteText(\"email\").notNull().unique(),\n    emailVerified: sqliteInteger(\"email_verified\", { mode: \"boolean\" })\n      .notNull()\n      .default(false),\n    image: sqliteText(\"image\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  session: sqliteTable(\"session\", {\n    id: sqliteText(\"id\").primaryKey(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    token: sqliteText(\"token\").notNull().unique(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n    ipAddress: sqliteText(\"ip_address\"),\n    userAgent: sqliteText(\"user_agent\"),\n    userId: sqliteText(\"user_id\").notNull(),\n    activeOrganizationId: sqliteText(\"active_organization_id\"),\n  }),\n  account: sqliteTable(\"account\", {\n    id: sqliteText(\"id\").primaryKey(),\n    accountId: sqliteText(\"account_id\").notNull(),\n    providerId: sqliteText(\"provider_id\").notNull(),\n    userId: sqliteText(\"user_id\").notNull(),\n    accessToken: sqliteText(\"access_token\"),\n    refreshToken: sqliteText(\"refresh_token\"),\n    idToken: sqliteText(\"id_token\"),\n    accessTokenExpiresAt: sqliteInteger(\"access_token_expires_at\", {\n      mode: \"timestamp_ms\",\n    }),\n    refreshTokenExpiresAt: sqliteInteger(\"refresh_token_expires_at\", {\n      mode: \"timestamp_ms\",\n    }),\n    scope: sqliteText(\"scope\"),\n    password: sqliteText(\"password\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  verification: sqliteTable(\"verification\", {\n    id: sqliteText(\"id\").primaryKey(),\n    identifier: sqliteText(\"identifier\").notNull(),\n    value: sqliteText(\"value\").notNull(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  organization: sqliteTable(\"organization\", {\n    id: sqliteText(\"id\").primaryKey(),\n    name: sqliteText(\"name\").notNull(),\n    slug: sqliteText(\"slug\").notNull().unique(),\n    logo: sqliteText(\"logo\"),\n    metadata: sqliteText(\"metadata\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  member: sqliteTable(\"member\", {\n    id: sqliteText(\"id\").primaryKey(),\n    organizationId: sqliteText(\"organization_id\").notNull(),\n    userId: sqliteText(\"user_id\").notNull(),\n    role: sqliteText(\"role\").notNull().default(\"member\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  invitation: sqliteTable(\"invitation\", {\n    id: sqliteText(\"id\").primaryKey(),\n    organizationId: sqliteText(\"organization_id\").notNull(),\n    email: sqliteText(\"email\").notNull(),\n    role: sqliteText(\"role\"),\n    status: sqliteText(\"status\").notNull().default(\"pending\"),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    inviterId: sqliteText(\"inviter_id\").notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  jwks: sqliteTable(\"jwks\", {\n    id: sqliteText(\"id\").primaryKey(),\n    publicKey: sqliteText(\"public_key\").notNull(),\n    privateKey: sqliteText(\"private_key\").notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }),\n  }),\n};\n\n/**\n * Mirror a Better Auth `account` row for Google into the `oauth_tokens`\n * table that template code (mail's Gmail client, calendar's events fetcher)\n * reads from. Called from the `databaseHooks.account.create.after` and\n * `.update.after` hooks so tokens captured during the primary \"Sign in\n * with Google\" flow flow straight to the apps that need them — no\n * separate \"Connect Google\" page required.\n *\n * Resolves `account.userId` to the user's email by querying the `user`\n * table (Better Auth always quotes \"user\" because it's a reserved word\n * in Postgres; SQLite accepts the quotes too).\n *\n * The hook is fire-and-forget from the caller's perspective — every\n * failure is caught upstream so a flake in `oauth_tokens` never blocks\n * sign-in. We still no-op on missing fields here as a defense in depth.\n */\nasync function mirrorGoogleAccountToOAuthTokens(account: {\n  providerId?: string;\n  userId?: string;\n  accountId?: string;\n  accessToken?: string | null;\n  refreshToken?: string | null;\n  accessTokenExpiresAt?: Date | string | number | null;\n  scope?: string | null;\n  idToken?: string | null;\n}): Promise<void> {\n  if (!account || account.providerId !== \"google\") return;\n  if (!account.userId) return;\n\n  const accessToken = account.accessToken ?? undefined;\n  if (!accessToken) {\n    // Better Auth sometimes upserts an account row before tokens are\n    // attached (e.g. linking flows). Nothing to mirror yet — the next\n    // update hook will run once the access token lands.\n    return;\n  }\n\n  // Resolve user email from userId.\n  const db = getDbExec();\n  let email: string | undefined;\n  try {\n    const { rows } = await db.execute({\n      sql: 'SELECT email FROM \"user\" WHERE id = ?',\n      args: [account.userId],\n    });\n    email = (rows[0]?.email as string | undefined) ?? undefined;\n  } catch (err) {\n    console.error(\n      \"[auth] mirror Google tokens: failed to resolve user email from userId\",\n      err,\n    );\n    return;\n  }\n  if (!email) return;\n\n  // Normalise expiry to epoch ms (Google's \"expiry_date\" convention used\n  // throughout the templates).\n  let expiryDate: number | undefined;\n  const raw = account.accessTokenExpiresAt;\n  if (raw instanceof Date) {\n    expiryDate = raw.getTime();\n  } else if (typeof raw === \"number\") {\n    expiryDate = raw;\n  } else if (typeof raw === \"string\") {\n    const ms = Date.parse(raw);\n    expiryDate = Number.isFinite(ms) ? ms : undefined;\n  }\n\n  const tokens: Record<string, unknown> = {\n    access_token: accessToken,\n    token_type: \"Bearer\",\n  };\n  if (account.refreshToken) tokens.refresh_token = account.refreshToken;\n  if (expiryDate) tokens.expiry_date = expiryDate;\n  if (account.scope) tokens.scope = account.scope;\n  if (account.idToken) tokens.id_token = account.idToken;\n\n  await saveOAuthTokens(\"google\", email, tokens, email);\n}\n\nasync function ensureBetterAuthTables(): Promise<void> {\n  const db = getDbExec();\n\n  // PG guard: probe information_schema first (no lock) for each table; run\n  // DDL only when missing, bounded by a transaction-scoped lock_timeout.\n  // Probe names are UNQUOTED (what information_schema.tables.table_name stores);\n  // createSql keeps the QUOTED \"user\"/\"session\"/… form required by Postgres.\n  if (isPostgres()) {\n    const pgTables: Array<[name: string, createSql: string]> = [\n      [\n        \"user\",\n        `CREATE TABLE IF NOT EXISTS \"user\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified BOOLEAN NOT NULL DEFAULT FALSE, image TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n      ],\n      [\n        \"session\",\n        `CREATE TABLE IF NOT EXISTS \"session\" (id TEXT PRIMARY KEY, expires_at TIMESTAMPTZ NOT NULL, token TEXT NOT NULL UNIQUE, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n      ],\n      [\n        \"account\",\n        `CREATE TABLE IF NOT EXISTS \"account\" (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at TIMESTAMPTZ, refresh_token_expires_at TIMESTAMPTZ, scope TEXT, password TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n      ],\n      [\n        \"verification\",\n        `CREATE TABLE IF NOT EXISTS \"verification\" (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n      ],\n      [\n        \"organization\",\n        `CREATE TABLE IF NOT EXISTS \"organization\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n      ],\n      [\n        \"member\",\n        `CREATE TABLE IF NOT EXISTS \"member\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n      ],\n      [\n        \"invitation\",\n        `CREATE TABLE IF NOT EXISTS \"invitation\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at TIMESTAMPTZ NOT NULL, inviter_id TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n      ],\n      [\n        \"jwks\",\n        `CREATE TABLE IF NOT EXISTS \"jwks\" (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, expires_at TIMESTAMPTZ)`,\n      ],\n    ];\n    for (const [name, sql] of pgTables) await ensureTableExists(name, sql);\n    return;\n  }\n\n  // SQLite (local dev): no lock problem — keep the original behaviour.\n  const sqliteStatements = [\n    `CREATE TABLE IF NOT EXISTS user (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified INTEGER NOT NULL DEFAULT 0, image TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n    `CREATE TABLE IF NOT EXISTS session (id TEXT PRIMARY KEY, expires_at INTEGER NOT NULL, token TEXT NOT NULL UNIQUE, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n    `CREATE TABLE IF NOT EXISTS account (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at INTEGER, refresh_token_expires_at INTEGER, scope TEXT, password TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n    `CREATE TABLE IF NOT EXISTS verification (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at INTEGER NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n    `CREATE TABLE IF NOT EXISTS organization (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n    `CREATE TABLE IF NOT EXISTS member (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n    `CREATE TABLE IF NOT EXISTS invitation (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at INTEGER NOT NULL, inviter_id TEXT NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n    `CREATE TABLE IF NOT EXISTS jwks (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at INTEGER NOT NULL, expires_at INTEGER)`,\n  ];\n  for (const sql of sqliteStatements) await db.execute(sql);\n}\n\n/**\n * Get or create the Better Auth instance.\n * Lazily initialized on first call — the database must be reachable by then.\n */\nexport async function getBetterAuth(\n  config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n  if (_auth) return _auth;\n  if (_initPromise) return _initPromise;\n\n  _initPromise = createBetterAuthInstance(config);\n  _auth = await _initPromise;\n  return _auth;\n}\n\n/**\n * Synchronous getter — returns the instance if already initialized, else undefined.\n * Use this in hot paths where you know init has already happened.\n */\nexport function getBetterAuthSync(): BetterAuthInstance | undefined {\n  return _auth;\n}\n\n/**\n * The subset of Better Auth's internal adapter we use for federated-SSO\n * JIT account linking. Better Auth owns these writes (id + timestamp +\n * schema handling), so callers never hand-roll SQL against `user`/`account`.\n * Read-only lookups + strictly-additive `linkAccount`/`createUser` only — no\n * update/delete of existing identity rows.\n */\nexport interface BetterAuthInternalAdapter {\n  findUserByEmail: (\n    email: string,\n    options?: { includeAccounts: boolean },\n  ) => Promise<{\n    user: { id: string; email: string; name?: string };\n    accounts: Array<{ providerId: string; accountId: string }>;\n  } | null>;\n  linkAccount: (account: {\n    userId: string;\n    providerId: string;\n    accountId: string;\n  }) => Promise<unknown>;\n  createUser: (user: {\n    email: string;\n    name: string;\n    emailVerified?: boolean;\n  }) => Promise<{ id: string }>;\n}\n\n/**\n * Resolve Better Auth's internal adapter via the live instance's\n * `$context`. The framework's narrowed `BetterAuthInstance` interface omits\n * `$context`, but the underlying object created by `betterAuth(...)` always\n * exposes it (see Better Auth's `Auth` type) — so this is a safe, typed\n * accessor for the federated-SSO client. Returns `undefined` if the context\n * shape is unexpected (older/newer Better Auth) so callers can fall back.\n */\nexport async function getBetterAuthInternalAdapter(\n  config?: BetterAuthConfig,\n): Promise<BetterAuthInternalAdapter | undefined> {\n  const auth = (await getBetterAuth(config)) as unknown as {\n    $context?: Promise<{ internalAdapter?: BetterAuthInternalAdapter }>;\n  };\n  try {\n    const ctx = await auth.$context;\n    const ia = ctx?.internalAdapter;\n    if (\n      ia &&\n      typeof ia.findUserByEmail === \"function\" &&\n      typeof ia.linkAccount === \"function\" &&\n      typeof ia.createUser === \"function\"\n    ) {\n      return ia;\n    }\n  } catch {\n    // Context resolution failed — caller falls back to the signup path.\n  }\n  return undefined;\n}\n\n/** Reset for testing */\nexport async function resetBetterAuth(): Promise<void> {\n  _auth = undefined;\n  _initPromise = undefined;\n  if (_neonAuthPool) {\n    try {\n      await _neonAuthPool.end();\n    } catch {\n      // Pool may have already closed (process exiting, etc.) — don't block reset.\n    }\n    _neonAuthPool = undefined;\n  }\n  await closePgliteClients();\n}\n\n// ---------------------------------------------------------------------------\n// Instance creation\n// ---------------------------------------------------------------------------\n\nasync function createBetterAuthInstance(\n  config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n  const dialect = getDialect();\n  const basePath = config?.basePath ?? \"/_agent-native/auth/ba\";\n  await ensureBetterAuthTables();\n\n  // Build social providers from env vars\n  const socialProviders: BetterAuthOptions[\"socialProviders\"] = {\n    ...config?.socialProviders,\n  };\n\n  const extraScopes = config?.googleScopes ?? [];\n  const googleCredentials =\n    extraScopes.length > 0\n      ? process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET\n        ? {\n            clientId: process.env.GOOGLE_CLIENT_ID,\n            clientSecret: process.env.GOOGLE_CLIENT_SECRET,\n          }\n        : null\n      : resolveGoogleSignInCredentials();\n  if (googleCredentials) {\n    // When the template requests broader scopes (Gmail, Calendar, etc.)\n    // ask for them on the primary sign-in flow so a separate \"Connect\n    // Google\" round-trip isn't needed. `accessType: \"offline\"` plus\n    // `prompt: \"consent\"` ensures we always receive a refresh token back —\n    // Google only re-issues a refresh token on consent, so re-signing in\n    // (e.g. after switching machines) would otherwise leave us with an\n    // access token that can't be refreshed.\n    const baseScopes = [\"openid\", \"email\", \"profile\"];\n    const mergedScopes = Array.from(new Set([...baseScopes, ...extraScopes]));\n    socialProviders.google = {\n      clientId: googleCredentials.clientId,\n      clientSecret: googleCredentials.clientSecret,\n      ...(extraScopes.length > 0\n        ? {\n            scope: mergedScopes,\n            accessType: \"offline\" as const,\n            prompt: \"consent\" as const,\n          }\n        : {}),\n    };\n  }\n\n  if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {\n    socialProviders.github = {\n      clientId: process.env.GITHUB_CLIENT_ID,\n      clientSecret: process.env.GITHUB_CLIENT_SECRET,\n    };\n  }\n\n  // Build database config\n  const database = await buildDatabaseConfig(dialect);\n\n  const secret = resolveAuthSecret();\n\n  const appUrl = getAppProductionUrl();\n  const cookieNamespace = resolveAuthCookieNamespace();\n  const requireEmailVerification =\n    (await isEmailConfigured()) && !shouldSkipEmailVerification();\n\n  const shouldMirrorGoogleAccountTokens =\n    (config?.googleScopes?.length ?? 0) > 0;\n\n  const auth = betterAuth({\n    basePath,\n    baseURL: appUrl,\n    database,\n    secret,\n    emailAndPassword: {\n      enabled: true,\n      minPasswordLength: 8,\n      // Only require email verification when an email provider is configured.\n      // Without a provider, verification emails can't be sent, so requiring\n      // verification would lock users out of signup entirely. Local dev/test\n      // skip verification by default so +qa accounts can be created quickly;\n      // hosted QA deployments can opt out with AUTH_SKIP_EMAIL_VERIFICATION=1.\n      requireEmailVerification,\n      sendResetPassword: async ({ user, token }) => {\n        // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n        // reset link must include that prefix so the page resolves correctly.\n        const appBasePath = (\n          process.env.VITE_APP_BASE_PATH ||\n          process.env.APP_BASE_PATH ||\n          \"\"\n        ).replace(/\\/$/, \"\");\n        const resetUrl = `${appUrl}${appBasePath}/_agent-native/auth/reset?token=${encodeURIComponent(token)}`;\n        const { subject, html, text } = renderResetPasswordEmail({\n          email: user.email,\n          resetUrl,\n        });\n        await sendEmail({ to: user.email, subject, html, text });\n      },\n    },\n    emailVerification: {\n      // Fire verification email right after signup, before the user has a\n      // session — pairs with requireEmailVerification above. Only enabled\n      // when an email provider is configured.\n      sendOnSignUp: requireEmailVerification,\n      // Auto-create a session once the user clicks the link. Without this,\n      // verified users would have to go back and sign in manually, which is\n      // a confusing dead-end on the verify screen.\n      autoSignInAfterVerification: true,\n      sendVerificationEmail: async ({ user, url }) => {\n        // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n        // verification link must include that prefix so the page resolves correctly.\n        const verifyBasePath = (\n          process.env.VITE_APP_BASE_PATH ||\n          process.env.APP_BASE_PATH ||\n          \"\"\n        ).replace(/\\/$/, \"\");\n        const verifyUrl = verifyBasePath\n          ? url.replace(/(\\/\\/[^/]+)(\\/)/, `$1${verifyBasePath}$2`)\n          : url;\n        const { subject, html, text } = renderVerifySignupEmail({\n          email: user.email,\n          verifyUrl,\n        });\n        await sendEmail({ to: user.email, subject, html, text });\n      },\n    },\n    socialProviders,\n    account: {\n      // Merge accounts when a user signs in with a social provider using an\n      // email that already has a local email/password account (or vice versa).\n      // Only providers listed in `trustedProviders` auto-link — these are the\n      // ones that verify emails at the identity layer. Never add a provider\n      // here that lets users claim an unverified email; that would be an\n      // account-takeover vector.\n      accountLinking: {\n        enabled: true,\n        trustedProviders: [\"google\", \"github\"],\n      },\n    },\n    databaseHooks: {\n      user: {\n        create: {\n          after: async (\n            user: {\n              id?: string;\n              email?: string;\n              name?: string | null;\n            },\n            // Better Auth (1.6.x) passes the endpoint context as the 2nd arg.\n            // It carries the originating request's headers (and on OAuth\n            // signups the callback request's headers), which is where the\n            // browser's `an_ft` first-touch cookie rides in.\n            context?: {\n              headers?: Headers | null;\n              request?: { headers?: Headers | null } | null;\n            } | null,\n          ) => {\n            // When a newly-created user's email has pending org invitations\n            // (common when someone is invited *before* they've signed up),\n            // auto-accept them so the user lands in the org on their very\n            // first page load instead of a blank-slate workspace.\n            const email = user?.email;\n            if (!email) return;\n            // Derive first-touch referral attribution from the request's\n            // cookie header. Never let attribution parsing throw or block\n            // signup — on any error fall back to `direct`.\n            let attribution: Record<string, string> | undefined;\n            try {\n              const cookieHeader =\n                context?.headers?.get(\"cookie\") ??\n                context?.request?.headers?.get(\"cookie\") ??\n                null;\n              attribution = signupAttributionFromCookieHeader(cookieHeader);\n            } catch (err) {\n              console.error(\"[auth] failed to derive signup attribution\", err);\n              attribution = undefined;\n            }\n            await trackSignupEvent({\n              authProvider: \"better-auth\",\n              authUserId: user.id,\n              email,\n              name: user.name,\n              attribution,\n            });\n            try {\n              await acceptPendingInvitationsForEmail(email);\n            } catch (err) {\n              // Never block signup on invite bookkeeping — log and continue.\n              console.error(\n                \"[auth] failed to auto-accept pending invitations\",\n                err,\n              );\n            }\n            try {\n              // Auto-join orgs whose `allowed_domain` matches this email\n              // domain. Lets a fresh `@builder.io` (or any org-domain)\n              // signup land inside the company org on first page load\n              // without going through the picker. No-ops when no match.\n              await autoJoinDomainMatchingOrgs(email);\n            } catch (err) {\n              console.error(\n                \"[auth] failed to auto-join domain-matching orgs\",\n                err,\n              );\n            }\n          },\n        },\n      },\n      account: {\n        // Mirror Google account tokens into `oauth_tokens` so existing\n        // template code (mail's Gmail client, calendar's events fetcher)\n        // can pick up Gmail/Calendar credentials from the primary sign-in\n        // flow — no separate \"Set up Google\" page required.\n        //\n        // Better Auth fires `create` for first-time social sign-in and\n        // `update` whenever a session re-issues tokens (e.g., the user\n        // re-signs in to refresh the token). Both branches do the same\n        // mirroring work; failures never block sign-in.\n        create: {\n          after: async (account: any) => {\n            if (!shouldMirrorGoogleAccountTokens) return;\n            await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n              console.error(\n                \"[auth] failed to mirror Google account tokens to oauth_tokens (create)\",\n                err,\n              );\n            });\n          },\n        },\n        update: {\n          after: async (account: any) => {\n            if (!shouldMirrorGoogleAccountTokens) return;\n            await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n              console.error(\n                \"[auth] failed to mirror Google account tokens to oauth_tokens (update)\",\n                err,\n              );\n            });\n          },\n        },\n      },\n    },\n    session: {\n      expiresIn: 60 * 60 * 24 * 30, // 30 days\n      updateAge: 60 * 60 * 24, // refresh daily\n      cookieCache: {\n        enabled: true,\n        maxAge: 5 * 60, // 5 min cache\n      },\n    },\n    advanced: {\n      cookiePrefix: cookieNamespace.betterAuthCookiePrefix,\n      // Emit `SameSite=None; Secure` when the app is served over HTTPS so\n      // session cookies are delivered inside third-party iframes (e.g. the\n      // Builder.io editor). Plain-HTTP dev keeps the default (Lax) because\n      // `SameSite=None` requires Secure.\n      ...(appUrl.startsWith(\"https://\")\n        ? {\n            defaultCookieAttributes: {\n              sameSite: \"none\" as const,\n              secure: true,\n              partitioned: true,\n            },\n          }\n        : {}),\n      // When an effective shared cookie domain is set, share Better Auth's\n      // session cookie across that domain. First-party `*.agent-native.com`\n      // apps intentionally do not use this path because their auth DBs are\n      // separate; Dispatch identity federation handles cross-app sign-in.\n      ...(cookieNamespace.betterAuthCookieDomain\n        ? {\n            crossSubDomainCookies: {\n              enabled: true,\n              domain: cookieNamespace.betterAuthCookieDomain,\n            },\n          }\n        : {}),\n    },\n    plugins: [\n      // JWT: issue tokens for A2A calls, JWKS endpoint for verification\n      jwt({\n        jwt: {\n          issuer: appUrl,\n          expirationTime: \"15m\",\n        },\n      }),\n      // Bearer: accept Bearer tokens on API requests\n      bearer(),\n      ...(config?.plugins ?? []),\n    ],\n  });\n\n  return auth as unknown as BetterAuthInstance;\n}\n\nasync function buildDatabaseConfig(\n  dialect: string,\n): Promise<BetterAuthOptions[\"database\"]> {\n  if (dialect === \"postgres\") {\n    const url = getDatabaseUrl();\n    const {\n      buildResilientNeonPool,\n      buildResilientPostgresJsClient,\n      isNeonUrl,\n    } = await import(\"../db/create-get-db.js\");\n\n    if (isPgliteUrl(url)) {\n      const { drizzle } = await loadPgliteDrizzle();\n      const client = await getPgliteClient(url);\n      const db = drizzle({ client, schema: pgAuthSchema });\n      const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n      return drizzleAdapter(db, {\n        provider: \"pg\",\n        schema: pgAuthSchema,\n      });\n    }\n\n    // Neon via @neondatabase/serverless (WebSockets over HTTPS). postgres-js\n    // opens a raw TCP connection on port 5432 which frequently times out on\n    // Netlify Functions / Vercel / CF Workers when Neon's pooler is cold.\n    if (isNeonUrl(url)) {\n      const { Pool } = await import(\"@neondatabase/serverless\");\n      // Cap the auth pool the same way as the app pool. Better Auth runs a\n      // session lookup on essentially every authenticated request, so an\n      // un-capped pool here is a primary contributor to \"Max client\n      // connections reached\" across concurrent serverless instances.\n      _neonAuthPool = new Pool({\n        connectionString: url,\n        max: neonPoolMax(),\n      });\n      attachNeonPoolErrorLogger(_neonAuthPool, \"db/neon-auth\");\n      const { drizzle } = await import(\"drizzle-orm/neon-serverless\");\n      const db = drizzle(buildResilientNeonPool(_neonAuthPool), {\n        schema: pgAuthSchema,\n      });\n      const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n      return drizzleAdapter(db, {\n        provider: \"pg\",\n        schema: pgAuthSchema,\n      });\n    }\n\n    // Non-Neon Postgres (Supabase, self-hosted, etc.) → postgres-js.\n    // pgPoolOptions caps this pool to a small size on serverless. Better Auth\n    // runs a session lookup on essentially every authenticated request, so an\n    // un-capped pool here is a primary contributor to \"Max client connections\n    // reached\" across concurrent serverless instances.\n    const { default: postgres } = await import(\"postgres\");\n    const sql = postgres(url, pgPoolOptions(url));\n    const { drizzle } = await import(\"drizzle-orm/postgres-js\");\n    const db = drizzle(buildResilientPostgresJsClient(sql), {\n      schema: pgAuthSchema,\n    });\n    const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n    return drizzleAdapter(db, {\n      provider: \"pg\",\n      schema: pgAuthSchema,\n    });\n  }\n\n  // SQLite / libsql\n  const url = getDatabaseUrl(\"file:./data/app.db\");\n\n  if (url.startsWith(\"file:\") || !url.includes(\"://\")) {\n    // Local SQLite via better-sqlite3\n    const { default: Database } = await import(\"better-sqlite3\");\n    const filePath = url.replace(/^file:/, \"\");\n    const sqlite = new Database(filePath);\n    sqlite.pragma(\"journal_mode = WAL\");\n    const { drizzle } = await import(\"drizzle-orm/better-sqlite3\");\n    const db = drizzle(sqlite, { schema: sqliteAuthSchema });\n    const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n    return drizzleAdapter(db, {\n      provider: \"sqlite\",\n      schema: sqliteAuthSchema,\n    });\n  }\n\n  // Remote libsql (Turso). Use the web client to avoid serverless bundles\n  // depending on libsql's platform-specific native packages.\n  const { createClient } = await import(\"@libsql/client/web\");\n  const client = createClient({ url, authToken: getDatabaseAuthToken() });\n  const { drizzle } = await import(\"drizzle-orm/libsql/web\");\n  const db = drizzle(client, { schema: sqliteAuthSchema });\n  const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n  return drizzleAdapter(db, {\n    provider: \"sqlite\",\n    schema: sqliteAuthSchema,\n  });\n}\n"]}

package/dist/server/transcribe-voice.d.ts

@@ -20,7 +20,7 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    text: string;
     error?: undefined;
+    text: string;
 }>>;
 //# sourceMappingURL=transcribe-voice.d.ts.map

package/dist/shared/mcp-embed-headers.d.ts

@@ -1,4 +1,4 @@
-export declare const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
+export declare const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
 export declare const EMBED_TRANSPLANT_HEADER = "x-agent-native-embed-transplant";
 export declare function isLocalMcpEmbedOrigin(origin: string | null | undefined): boolean;
 export declare function isClaudeMcpContentOrigin(origin: string | null | undefined): boolean;

package/dist/shared/mcp-embed-headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-embed-headers.d.ts","sourceRoot":"","sources":["../../src/shared/mcp-embed-headers.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,4BAA4B,yLAC+I,CAAC;AACzL,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAYzE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAWT;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAUT;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAWT;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAOT;AAED,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAgBT;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAiBT;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAUT;AAED,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAQT;AAED,eAAO,MAAM,8BAA8B;aACzC,6BAA6B,EAAE,GAAG;aAClC,8BAA8B,EAAE,cAAc;CACtC,CAAC;AAoBX,wBAAgB,6BAA6B,CAC3C,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,OAAO,8BAA8B,CAAA;CAAE,CAAC,CAapE"}
+{"version":3,"file":"mcp-embed-headers.d.ts","sourceRoot":"","sources":["../../src/shared/mcp-embed-headers.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,4BAA4B,qPAC2M,CAAC;AACrP,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAYzE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAWT;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAUT;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAWT;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAOT;AAED,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAgBT;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAiBT;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAUT;AAED,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAQT;AAED,eAAO,MAAM,8BAA8B;aACzC,6BAA6B,EAAE,GAAG;aAClC,8BAA8B,EAAE,cAAc;CACtC,CAAC;AAoBX,wBAAgB,6BAA6B,CAC3C,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,OAAO,8BAA8B,CAAA;CAAE,CAAC,CAapE"}

package/dist/shared/mcp-embed-headers.js

@@ -1,4 +1,4 @@
-export const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
+export const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
 export const EMBED_TRANSPLANT_HEADER = "x-agent-native-embed-transplant";
 const CLAUDE_MCP_CONTENT_HOST_RE = /^[a-f0-9]{32}\.claudemcpcontent\.com$/i;
 const CHATGPT_MCP_SANDBOX_HOST_RE = /^(?:[^.]+\.)?web-sandbox\.oaiusercontent\.com$/i;

package/dist/shared/mcp-embed-headers.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-embed-headers.js","sourceRoot":"","sources":["../../src/shared/mcp-embed-headers.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GACvC,sLAAsL,CAAC;AACzL,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AAEzE,MAAM,0BAA0B,GAAG,wCAAwC,CAAC;AAC5E,MAAM,2BAA2B,GAC/B,iDAAiD,CAAC;AACpD,MAAM,wCAAwC,GAAG,mBAAmB,CAAC;AACrE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,yBAAyB;IACzB,qBAAqB;IACrB,mBAAmB;CACpB,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CACnC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,OAAO;YACxB,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC3E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC/C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,wBAAwB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,IAAI;YACT,QAAQ,CAAC,QAAQ,CAAC,wCAAwC,CAAC;YAC3D,QAAQ,CAAC,MAAM,GAAG,wCAAwC,CAAC,MAAM,CAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,QAAQ,KAAK,YAAY;gBACxB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAChC,QAAQ,KAAK,YAAY;gBACzB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CACpC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAiC;IAEjC,OAAO,CACL,MAAM,KAAK,MAAM;QACjB,qBAAqB,CAAC,MAAM,CAAC;QAC7B,wBAAwB,CAAC,MAAM,CAAC;QAChC,yBAAyB,CAAC,MAAM,CAAC;QACjC,sBAAsB,CAAC,MAAM,CAAC;QAC9B,gCAAgC,CAAC,MAAM,CAAC;QACxC,sBAAsB,CAAC,MAAM,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAiC;IAEjC,OAAO,CACL,MAAM,KAAK,MAAM;QACjB,CAAC,wBAAwB,CAAC,MAAM,CAAC;QACjC,CAAC,yBAAyB,CAAC,MAAM,CAAC;QAClC,CAAC,sBAAsB,CAAC,MAAM,CAAC;QAC/B,CAAC,gCAAgC,CAAC,MAAM,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,cAAc;CACtC,CAAC;AAEX,MAAM,qBAAqB,GAAG;IAC5B,YAAY;IACZ,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,qBAAqB;IACrB,qBAAqB;CACtB,CAAC;AAEF,SAAS,iBAAiB,CAAC,QAA4B;IACrD,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAGP,EAAE,CAAC;IACP,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC7D,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,CAAC,GAAG,IAAI,GAAG,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["export const MCP_EMBED_CORS_ALLOW_HEADERS =\n  \"Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant\";\nexport const EMBED_TRANSPLANT_HEADER = \"x-agent-native-embed-transplant\";\n\nconst CLAUDE_MCP_CONTENT_HOST_RE = /^[a-f0-9]{32}\\.claudemcpcontent\\.com$/i;\nconst CHATGPT_MCP_SANDBOX_HOST_RE =\n  /^(?:[^.]+\\.)?web-sandbox\\.oaiusercontent\\.com$/i;\nconst AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX = \".agent-native.com\";\nconst MCP_PRODUCT_HOST_ORIGINS = new Set([\n  \"https://chat.openai.com\",\n  \"https://chatgpt.com\",\n  \"https://claude.ai\",\n]);\n\nexport function isLocalMcpEmbedOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    return (\n      url.protocol === \"http:\" &&\n      [\"localhost\", \"127.0.0.1\", \"::1\", \"[::1]\"].includes(url.hostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isClaudeMcpContentOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    return (\n      url.protocol === \"https:\" && CLAUDE_MCP_CONTENT_HOST_RE.test(url.hostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isChatGptMcpSandboxOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    return (\n      url.protocol === \"https:\" &&\n      CHATGPT_MCP_SANDBOX_HOST_RE.test(url.hostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isMcpProductHostOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    return MCP_PRODUCT_HOST_ORIGINS.has(new URL(origin).origin);\n  } catch {\n    return false;\n  }\n}\n\nexport function isAgentNativeFirstPartyAppOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    const hostname = url.hostname.toLowerCase();\n    return (\n      url.protocol === \"https:\" &&\n      !url.username &&\n      !url.password &&\n      !url.port &&\n      hostname.endsWith(AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX) &&\n      hostname.length > AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX.length\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isBuilderIoEmbedOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    const hostname = url.hostname.toLowerCase();\n    return (\n      url.protocol === \"https:\" &&\n      !url.username &&\n      !url.password &&\n      (hostname === \"builder.io\" ||\n        hostname.endsWith(\".builder.io\") ||\n        hostname === \"builder.my\" ||\n        hostname.endsWith(\".builder.my\"))\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isMcpEmbedCorsOrigin(\n  origin: string | null | undefined,\n): boolean {\n  return (\n    origin === \"null\" ||\n    isLocalMcpEmbedOrigin(origin) ||\n    isClaudeMcpContentOrigin(origin) ||\n    isChatGptMcpSandboxOrigin(origin) ||\n    isMcpProductHostOrigin(origin) ||\n    isAgentNativeFirstPartyAppOrigin(origin) ||\n    isBuilderIoEmbedOrigin(origin)\n  );\n}\n\nexport function shouldAllowMcpEmbedCredentials(\n  origin: string | null | undefined,\n): boolean {\n  return (\n    origin !== \"null\" &&\n    !isClaudeMcpContentOrigin(origin) &&\n    !isChatGptMcpSandboxOrigin(origin) &&\n    !isMcpProductHostOrigin(origin) &&\n    !isAgentNativeFirstPartyAppOrigin(origin)\n  );\n}\n\nexport const MCP_EMBED_STATIC_ASSET_HEADERS = {\n  \"Access-Control-Allow-Origin\": \"*\",\n  \"Cross-Origin-Resource-Policy\": \"cross-origin\",\n} as const;\n\nconst STATIC_ASSET_PATTERNS = [\n  \"/assets/**\",\n  \"/favicon.ico\",\n  \"/favicon.svg\",\n  \"/manifest.json\",\n  \"/icon-*.svg\",\n  \"/agent-native-*.svg\",\n  \"/library-presets/**\",\n];\n\nfunction normalizeBasePath(basePath: string | undefined): string {\n  const base = (basePath ?? \"\").trim();\n  if (!base || base === \"/\") return \"\";\n  return base.startsWith(\"/\")\n    ? base.replace(/\\/+$/g, \"\")\n    : `/${base.replace(/\\/+$/g, \"\")}`;\n}\n\nexport function mcpEmbedStaticAssetRouteRules(\n  basePath?: string,\n): Record<string, { headers: typeof MCP_EMBED_STATIC_ASSET_HEADERS }> {\n  const base = normalizeBasePath(basePath);\n  const rules: Record<\n    string,\n    { headers: typeof MCP_EMBED_STATIC_ASSET_HEADERS }\n  > = {};\n  for (const pattern of STATIC_ASSET_PATTERNS) {\n    rules[pattern] = { headers: MCP_EMBED_STATIC_ASSET_HEADERS };\n    if (base) {\n      rules[`${base}${pattern}`] = { headers: MCP_EMBED_STATIC_ASSET_HEADERS };\n    }\n  }\n  return rules;\n}\n"]}
+{"version":3,"file":"mcp-embed-headers.js","sourceRoot":"","sources":["../../src/shared/mcp-embed-headers.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GACvC,kPAAkP,CAAC;AACrP,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AAEzE,MAAM,0BAA0B,GAAG,wCAAwC,CAAC;AAC5E,MAAM,2BAA2B,GAC/B,iDAAiD,CAAC;AACpD,MAAM,wCAAwC,GAAG,mBAAmB,CAAC;AACrE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,yBAAyB;IACzB,qBAAqB;IACrB,mBAAmB;CACpB,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CACnC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,OAAO;YACxB,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC3E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC/C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,wBAAwB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,IAAI;YACT,QAAQ,CAAC,QAAQ,CAAC,wCAAwC,CAAC;YAC3D,QAAQ,CAAC,MAAM,GAAG,wCAAwC,CAAC,MAAM,CAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,QAAQ,KAAK,YAAY;gBACxB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAChC,QAAQ,KAAK,YAAY;gBACzB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CACpC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAiC;IAEjC,OAAO,CACL,MAAM,KAAK,MAAM;QACjB,qBAAqB,CAAC,MAAM,CAAC;QAC7B,wBAAwB,CAAC,MAAM,CAAC;QAChC,yBAAyB,CAAC,MAAM,CAAC;QACjC,sBAAsB,CAAC,MAAM,CAAC;QAC9B,gCAAgC,CAAC,MAAM,CAAC;QACxC,sBAAsB,CAAC,MAAM,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAiC;IAEjC,OAAO,CACL,MAAM,KAAK,MAAM;QACjB,CAAC,wBAAwB,CAAC,MAAM,CAAC;QACjC,CAAC,yBAAyB,CAAC,MAAM,CAAC;QAClC,CAAC,sBAAsB,CAAC,MAAM,CAAC;QAC/B,CAAC,gCAAgC,CAAC,MAAM,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,cAAc;CACtC,CAAC;AAEX,MAAM,qBAAqB,GAAG;IAC5B,YAAY;IACZ,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,qBAAqB;IACrB,qBAAqB;CACtB,CAAC;AAEF,SAAS,iBAAiB,CAAC,QAA4B;IACrD,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAGP,EAAE,CAAC;IACP,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC7D,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,CAAC,GAAG,IAAI,GAAG,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["export const MCP_EMBED_CORS_ALLOW_HEADERS =\n  \"Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant\";\nexport const EMBED_TRANSPLANT_HEADER = \"x-agent-native-embed-transplant\";\n\nconst CLAUDE_MCP_CONTENT_HOST_RE = /^[a-f0-9]{32}\\.claudemcpcontent\\.com$/i;\nconst CHATGPT_MCP_SANDBOX_HOST_RE =\n  /^(?:[^.]+\\.)?web-sandbox\\.oaiusercontent\\.com$/i;\nconst AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX = \".agent-native.com\";\nconst MCP_PRODUCT_HOST_ORIGINS = new Set([\n  \"https://chat.openai.com\",\n  \"https://chatgpt.com\",\n  \"https://claude.ai\",\n]);\n\nexport function isLocalMcpEmbedOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    return (\n      url.protocol === \"http:\" &&\n      [\"localhost\", \"127.0.0.1\", \"::1\", \"[::1]\"].includes(url.hostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isClaudeMcpContentOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    return (\n      url.protocol === \"https:\" && CLAUDE_MCP_CONTENT_HOST_RE.test(url.hostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isChatGptMcpSandboxOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    return (\n      url.protocol === \"https:\" &&\n      CHATGPT_MCP_SANDBOX_HOST_RE.test(url.hostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isMcpProductHostOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    return MCP_PRODUCT_HOST_ORIGINS.has(new URL(origin).origin);\n  } catch {\n    return false;\n  }\n}\n\nexport function isAgentNativeFirstPartyAppOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    const hostname = url.hostname.toLowerCase();\n    return (\n      url.protocol === \"https:\" &&\n      !url.username &&\n      !url.password &&\n      !url.port &&\n      hostname.endsWith(AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX) &&\n      hostname.length > AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX.length\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isBuilderIoEmbedOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    const hostname = url.hostname.toLowerCase();\n    return (\n      url.protocol === \"https:\" &&\n      !url.username &&\n      !url.password &&\n      (hostname === \"builder.io\" ||\n        hostname.endsWith(\".builder.io\") ||\n        hostname === \"builder.my\" ||\n        hostname.endsWith(\".builder.my\"))\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isMcpEmbedCorsOrigin(\n  origin: string | null | undefined,\n): boolean {\n  return (\n    origin === \"null\" ||\n    isLocalMcpEmbedOrigin(origin) ||\n    isClaudeMcpContentOrigin(origin) ||\n    isChatGptMcpSandboxOrigin(origin) ||\n    isMcpProductHostOrigin(origin) ||\n    isAgentNativeFirstPartyAppOrigin(origin) ||\n    isBuilderIoEmbedOrigin(origin)\n  );\n}\n\nexport function shouldAllowMcpEmbedCredentials(\n  origin: string | null | undefined,\n): boolean {\n  return (\n    origin !== \"null\" &&\n    !isClaudeMcpContentOrigin(origin) &&\n    !isChatGptMcpSandboxOrigin(origin) &&\n    !isMcpProductHostOrigin(origin) &&\n    !isAgentNativeFirstPartyAppOrigin(origin)\n  );\n}\n\nexport const MCP_EMBED_STATIC_ASSET_HEADERS = {\n  \"Access-Control-Allow-Origin\": \"*\",\n  \"Cross-Origin-Resource-Policy\": \"cross-origin\",\n} as const;\n\nconst STATIC_ASSET_PATTERNS = [\n  \"/assets/**\",\n  \"/favicon.ico\",\n  \"/favicon.svg\",\n  \"/manifest.json\",\n  \"/icon-*.svg\",\n  \"/agent-native-*.svg\",\n  \"/library-presets/**\",\n];\n\nfunction normalizeBasePath(basePath: string | undefined): string {\n  const base = (basePath ?? \"\").trim();\n  if (!base || base === \"/\") return \"\";\n  return base.startsWith(\"/\")\n    ? base.replace(/\\/+$/g, \"\")\n    : `/${base.replace(/\\/+$/g, \"\")}`;\n}\n\nexport function mcpEmbedStaticAssetRouteRules(\n  basePath?: string,\n): Record<string, { headers: typeof MCP_EMBED_STATIC_ASSET_HEADERS }> {\n  const base = normalizeBasePath(basePath);\n  const rules: Record<\n    string,\n    { headers: typeof MCP_EMBED_STATIC_ASSET_HEADERS }\n  > = {};\n  for (const pattern of STATIC_ASSET_PATTERNS) {\n    rules[pattern] = { headers: MCP_EMBED_STATIC_ASSET_HEADERS };\n    if (base) {\n      rules[`${base}${pattern}`] = { headers: MCP_EMBED_STATIC_ASSET_HEADERS };\n    }\n  }\n  return rules;\n}\n"]}

package/dist/templates/chat/.agents/skills/agent-native-toolkit/SKILL.md

@@ -0,0 +1,133 @@
+---
+name: agent-native-toolkit
+description: >-
+  Inventory and ownership rules for shared Agent Native workspace UI. Use
+  before building app chrome, settings, navigation, sharing, collaboration,
+  setup, history, comments, chat rails, agent UX, or repeated workspace behavior.
+scope: dev
+metadata:
+  internal: true
+---
+
+# Agent-Native Toolkit
+
+Use this skill when deciding whether app chrome, settings, collaboration,
+sharing, navigation, organization, setup, history, comments, or agent UX should
+be built app-locally or moved into reusable framework/toolkit pieces.
+
+## Core Rule
+
+Apps own domain models, domain actions, and product-specific workflows. The
+framework and `@agent-native/toolkit` own repeated workspace behavior users
+expect to work the same everywhere.
+
+Move behavior into shared toolkit primitives when it is:
+
+- workspace-wide, such as settings, nav, search, org membership, or setup
+- agent-visible, such as context, actions, run progress, or proof-of-done
+- governed, such as secrets, permissions, sharing, audit, or billing
+- repeated by two or more apps
+- not tied to one domain model
+
+Keep behavior app-local when the abstraction would hide important domain
+language or make a simple app-specific workflow harder to understand.
+
+## Discover Before Building
+
+Before creating an app-local version of repeated workspace or agent UI:
+
+1. Check the reusable kits below and the installed package documentation.
+2. Search installed public components and source with `docs-search` and
+   `source-search`.
+3. Run `agent-native eject --list` to see the version-matched units published
+   by the packages installed in this app.
+4. Read `customizing-agent-native` and configure, compose, or eject the
+   smallest unit instead of recreating shared behavior from memory.
+
+Use public package exports at runtime. Published source and ejection manifests
+are discovery and ownership-transfer mechanisms, not private runtime APIs.
+
+## Settings Direction
+
+Durable settings belong in the Settings app or a registered settings route. The
+agent sidebar should not become a second settings app. It can show contextual
+quick controls and deep links such as:
+
+- `/settings/ai`
+- `/settings/connections`
+- `/settings/secrets`
+- `/settings/usage`
+- `/settings/apps/:appId`
+
+When adding a new API key, OAuth grant, provider connection, model selector, app
+preference, notification preference, or usage/billing surface, register it as a
+settings tab or app settings panel first. Only add sidebar UI when it is needed
+in the moment of agent use.
+
+## Reusable Kits
+
+- **Settings kit**: a searchable settings page with account, workspace, AI
+  models, LLM keys, connections, secrets, usage, notifications, changelog, and
+  app-specific panels. Search is on by default; register a `SettingsSearchEntry`
+  per control so users find settings by name across tabs.
+- **Collaboration kit**: Yjs docs, presence, agent presence, live cursors,
+  remote selections, recent edit highlights, real-time sync indicators, and
+  undo/redo grouping.
+- **Sharing kit**: private/workspace/org/public-link access, invites, roles,
+  expirations, agent-readable links, and resource registration.
+- **Navigation and command kit**: app shell, side nav, breadcrumbs, app switcher,
+  command palette entries, recent resources, pinned resources, and global search.
+- **Organization kit**: folders, tags, favorites, archive, trash, ownership,
+  membership, and common resource metadata.
+- **Setup and connections kit**: declarative setup requirements, model readiness,
+  missing-secret states, OAuth grants, and provider connection health.
+- **Agent UX kit**: sidebar, composer, staged context, mentions, voice, human
+  approval, generative UI, progress, and screen-state exposure.
+- **Chat history kit**: presentational chat lists and recent-chat rails belong
+  in Toolkit; Core keeps thread persistence, agent execution, transport, and
+  page-to-sidebar handoff. Apps inject routing, labels, and domain actions.
+- **Agent page kit**: the full-page `/agent` surface (`AgentTabsPage` from
+  `@agent-native/core/client`) with Context, Files, Connections, Jobs, and
+  Access tabs plus a Personal/Organization scope toggle. The canonical home
+  for context transparency, MCP servers, A2A remote agents, recurring
+  jobs/automations, and external-client connect flows. See the `agent-page`
+  skill.
+- **History and recovery kit**: audit log, activity feed, version history,
+  checkpoints, undo, redo, restore, and proof-of-done.
+- **Comments and review kit**: anchored comments, pins, mentions, review
+  requests, resolved threads, agent follow-up tasks, and notifications.
+- **Workflow and observability kit**: notifications, approvals, scheduled work,
+  background runs, recurring jobs, traces, evals, feedback, and run timelines.
+
+## Implementation Checklist
+
+When adding or refactoring one of these areas:
+
+1. Search existing framework and template code for duplicated UI or actions.
+2. Decide the shared contract: data shape, action API, React component/hook, and
+   app adapter points.
+3. Keep shared data provider-agnostic and scoped by auth/sharing rules.
+4. Expose the same capability to the UI and agent through actions or documented
+   client helpers.
+5. Register app-specific labels, routes, resource adapters, and settings panels
+   instead of hardcoding app names in core UI.
+6. Update docs and relevant skills so future apps discover the shared path.
+7. Keep the component easy to adopt piecemeal: expose props/slots first and
+   ship readable source plus a complete ejection unit so apps can take ownership
+   of the smallest feature when needed. See `customizing-agent-native` for the
+   configure → compose → eject → propose seam ladder.
+
+## Related Skills
+
+Read these alongside this skill when the work touches the specific area:
+
+- `sharing`
+- `real-time-collab`
+- `real-time-sync`
+- `client-side-routing`
+- `context-awareness`
+- `onboarding`
+- `secrets`
+- `audit-log`
+- `observability`
+- `frontend-design`