npm - @agent-native/core - Versions diffs - 0.12.25 → 0.12.29 - Mend

@agent-native/core 0.12.25 → 0.12.29

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (101) hide show

package/dist/agent/engine/builder-engine.d.ts +1 -1
package/dist/agent/engine/builder-engine.d.ts.map +1 -1
package/dist/agent/model-config.d.ts +3 -3
package/dist/agent/model-config.d.ts.map +1 -1
package/dist/agent/model-config.js +5 -4
package/dist/agent/model-config.js.map +1 -1
package/dist/agent/production-agent.d.ts.map +1 -1
package/dist/agent/production-agent.js +20 -2
package/dist/agent/production-agent.js.map +1 -1
package/dist/application-state/emitter.d.ts +3 -2
package/dist/application-state/emitter.d.ts.map +1 -1
package/dist/application-state/emitter.js +4 -2
package/dist/application-state/emitter.js.map +1 -1
package/dist/application-state/store.js +3 -3
package/dist/application-state/store.js.map +1 -1
package/dist/client/AgentPanel.d.ts.map +1 -1
package/dist/client/AgentPanel.js +0 -1
package/dist/client/AgentPanel.js.map +1 -1
package/dist/client/AgentTaskCard.d.ts.map +1 -1
package/dist/client/AgentTaskCard.js +16 -3
package/dist/client/AgentTaskCard.js.map +1 -1
package/dist/client/AssistantChat.d.ts.map +1 -1
package/dist/client/AssistantChat.js +67 -19
package/dist/client/AssistantChat.js.map +1 -1
package/dist/client/IframeEmbed.d.ts.map +1 -1
package/dist/client/IframeEmbed.js +2 -2
package/dist/client/IframeEmbed.js.map +1 -1
package/dist/client/MultiTabAssistantChat.js.map +1 -1
package/dist/client/agent-chat-adapter.d.ts.map +1 -1
package/dist/client/agent-chat-adapter.js +74 -14
package/dist/client/agent-chat-adapter.js.map +1 -1
package/dist/client/composer/ComposerPlusMenu.d.ts.map +1 -1
package/dist/client/composer/ComposerPlusMenu.js +1 -1
package/dist/client/composer/ComposerPlusMenu.js.map +1 -1
package/dist/client/composer/PromptComposer.d.ts.map +1 -1
package/dist/client/composer/PromptComposer.js +8 -7
package/dist/client/composer/PromptComposer.js.map +1 -1
package/dist/client/composer/attachment-accept.d.ts +7 -0
package/dist/client/composer/attachment-accept.d.ts.map +1 -0
package/dist/client/composer/attachment-accept.js +36 -0
package/dist/client/composer/attachment-accept.js.map +1 -0
package/dist/client/sse-event-processor.d.ts.map +1 -1
package/dist/client/sse-event-processor.js +8 -0
package/dist/client/sse-event-processor.js.map +1 -1
package/dist/client/use-chat-models.js.map +1 -1
package/dist/client/use-db-sync.d.ts +4 -0
package/dist/client/use-db-sync.d.ts.map +1 -1
package/dist/client/use-db-sync.js +38 -13
package/dist/client/use-db-sync.js.map +1 -1
package/dist/client/use-pausing-interval.d.ts.map +1 -1
package/dist/client/use-pausing-interval.js +5 -2
package/dist/client/use-pausing-interval.js.map +1 -1
package/dist/collab/client.d.ts +2 -0
package/dist/collab/client.d.ts.map +1 -1
package/dist/collab/client.js +37 -4
package/dist/collab/client.js.map +1 -1
package/dist/db/client.d.ts +3 -0
package/dist/db/client.d.ts.map +1 -1
package/dist/db/client.js +70 -34
package/dist/db/client.js.map +1 -1
package/dist/db/create-get-db.d.ts.map +1 -1
package/dist/db/create-get-db.js +30 -7
package/dist/db/create-get-db.js.map +1 -1
package/dist/deploy/build.js +64 -0
package/dist/deploy/build.js.map +1 -1
package/dist/scripts/db/exec.d.ts.map +1 -1
package/dist/scripts/db/exec.js +3 -6
package/dist/scripts/db/exec.js.map +1 -1
package/dist/scripts/db/patch.d.ts.map +1 -1
package/dist/scripts/db/patch.js +3 -6
package/dist/scripts/db/patch.js.map +1 -1
package/dist/scripts/db/query.d.ts.map +1 -1
package/dist/scripts/db/query.js +3 -6
package/dist/scripts/db/query.js.map +1 -1
package/dist/scripts/db/schema.d.ts.map +1 -1
package/dist/scripts/db/schema.js +3 -6
package/dist/scripts/db/schema.js.map +1 -1
package/dist/scripts/db/sqlite-client.d.ts +15 -0
package/dist/scripts/db/sqlite-client.d.ts.map +1 -0
package/dist/scripts/db/sqlite-client.js +51 -0
package/dist/scripts/db/sqlite-client.js.map +1 -0
package/dist/server/auth.d.ts.map +1 -1
package/dist/server/auth.js +83 -2
package/dist/server/auth.js.map +1 -1
package/dist/server/better-auth-instance.js +4 -3
package/dist/server/better-auth-instance.js.map +1 -1
package/dist/server/google-auth-plugin.d.ts.map +1 -1
package/dist/server/google-auth-plugin.js +50 -3
package/dist/server/google-auth-plugin.js.map +1 -1
package/dist/server/google-oauth.d.ts.map +1 -1
package/dist/server/google-oauth.js +10 -4
package/dist/server/google-oauth.js.map +1 -1
package/dist/server/onboarding-html.d.ts.map +1 -1
package/dist/server/onboarding-html.js +50 -3
package/dist/server/onboarding-html.js.map +1 -1
package/dist/server/poll.d.ts.map +1 -1
package/dist/server/poll.js +15 -0
package/dist/server/poll.js.map +1 -1
package/dist/templates/default/app/hooks/use-navigation-state.ts +0 -1
package/package.json +1 -1
package/src/templates/default/app/hooks/use-navigation-state.ts +0 -1

package/dist/server/better-auth-instance.js CHANGED Viewed

@@ -727,10 +727,11 @@ async function buildDatabaseConfig(dialect) {
             schema: sqliteAuthSchema,
         });
     }
-    // Remote libsql (Turso)
-    const { createClient } = await import("@libsql/client");
+    // Remote libsql (Turso). Use the web client to avoid serverless bundles
+    // depending on libsql's platform-specific native packages.
+    const { createClient } = await import("@libsql/client/web");
     const client = createClient({ url, authToken: getDatabaseAuthToken() });
-    const { drizzle } = await import("drizzle-orm/libsql");
+    const { drizzle } = await import("drizzle-orm/libsql/web");
     const db = drizzle(client, { schema: sqliteAuthSchema });
     const { drizzleAdapter } = await import("better-auth/adapters/drizzle");
     return drizzleAdapter(db, {

package/dist/server/better-auth-instance.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"better-auth-instance.js","sourceRoot":"","sources":["../../src/server/better-auth-instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,UAAU,EACV,cAAc,EACd,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,OAAO,EACP,IAAI,IAAI,MAAM,EACd,SAAS,IAAI,WAAW,EACxB,OAAO,IAAI,SAAS,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,IAAI,IAAI,UAAU,EAClB,OAAO,IAAI,aAAa,GACzB,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,iBAAiB;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAE1E,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,+EAA+E;YAC7E,0EAA0E;YAC1E,0DAA0D;YAC1D,wBAAwB,MAAM,MAAM;YACpC,uEAAuE;YACvE,uEAAuE;YACvE,qFAAqF;YACrF,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,QAAQ;IACR,EAAE;IACF,yDAAyD;IACzD,+DAA+D;IAC/D,qEAAqE;IACrE,sEAAsE;IACtE,mDAAmD;IACnD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,QAAQ,CAAC,CAAC,mGAAmG;YAC9I,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC,sGAAsG;QAClJ,OAAO,CAAC,GAAG,CACT,0EAA0E;YACxE,iDAAiD;YACjD,4EAA4E,CAC/E,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CACV,oEAAoE;YAClE,gEAAgE;YAChE,wDAAwD;YACxD,oFAAoF,CACvF,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtD,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CACrB,8DAA8D,CAC/D,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAoB,EAAE,MAAc;IAChE,MAAM,MAAM,GACV,+DAA+D;QAC/D,oEAAoE;QACpE,2DAA2D,CAAC;IAC9D,MAAM,IAAI,GAAG,sBAAsB,MAAM,IAAI,CAAC;IAE9C,yEAAyE;IACzE,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5E,EAAE,CAAC,cAAc,CACf,YAAY,EACZ,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CACzD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACvD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,OAAO,CAAC;AAC3E,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AA2DD,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,IAAI,KAAqC,CAAC;AAC1C,IAAI,YAAqD,CAAC;AAC1D,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACxE,IAAI,aAAkB,CAAC;AAEvB,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,aAAa,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,oBAAoB,EAAE,MAAM,CAAC,wBAAwB,CAAC;KACvD,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;QACnC,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC;QACrC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;QAC3B,oBAAoB,EAAE,WAAW,CAAC,yBAAyB,EAAE;YAC3D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,qBAAqB,EAAE,WAAW,CAAC,0BAA0B,EAAE;YAC7D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACvC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE;QACxB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE;QAChC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;KAC7D,CAAC;CACH,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,aAAa,EAAE,aAAa,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aAChE,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;QACjB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,UAAU,CAAC,wBAAwB,CAAC;KAC3D,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,WAAW,EAAE,UAAU,CAAC,cAAc,CAAC;QACvC,YAAY,EAAE,UAAU,CAAC,eAAe,CAAC;QACzC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC;QAC/B,oBAAoB,EAAE,aAAa,CAAC,yBAAyB,EAAE;YAC7D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,qBAAqB,EAAE,aAAa,CAAC,0BAA0B,EAAE;YAC/D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC9C,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC3C,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC5B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,UAAU,EAAE,WAAW,CAAC,YAAY,EAAE;QACpC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACzD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;KACjE,CAAC;CACH,CAAC;AAEF,SAAS,mBAAmB;IAC1B,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,gCAAgC,CAAC,OAS/C;IACC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO;IACxD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO;IAE5B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iEAAiE;QACjE,kEAAkE;QAClE,oDAAoD;QACpD,OAAO;IACT,CAAC;IAED,kCAAkC;IAClC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAChC,GAAG,EAAE,uCAAuC;YAC5C,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACvB,CAAC,CAAC;QACH,KAAK,GAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAA4B,IAAI,SAAS,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,uEAAuE,EACvE,GAAG,CACJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,uEAAuE;IACvE,6BAA6B;IAC7B,IAAI,UAA8B,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC;IACzC,IAAI,GAAG,YAAY,IAAI,EAAE,CAAC;QACxB,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,UAAU,GAAG,GAAG,CAAC;IACnB,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAA4B;QACtC,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;KACrB,CAAC;IACF,IAAI,OAAO,CAAC,YAAY;QAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IACtE,IAAI,UAAU;QAAE,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC;IAChD,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAEvD,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,sBAAsB;IACnC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,UAAU,EAAE;QAC7B,CAAC,CAAC;YACE,sOAAsO;YACtO,iRAAiR;YACjR,sWAAsW;YACtW,mNAAmN;YACnN,4MAA4M;YAC5M,wNAAwN;YACxN,mSAAmS;YACnS,uKAAuK;SACxK;QACH,CAAC,CAAC;YACE,wNAAwN;YACxN,mQAAmQ;YACnQ,oVAAoV;YACpV,qMAAqM;YACrM,kMAAkM;YAClM,8MAA8M;YAC9M,qRAAqR;YACrR,6JAA6J;SAC9J,CAAC;IAEN,KAAK,MAAM,GAAG,IAAI,UAAU;QAAE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB;IAEzB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,YAAY,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAChD,KAAK,GAAG,MAAM,YAAY,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,KAAK,GAAG,SAAS,CAAC;IAClB,YAAY,GAAG,SAAS,CAAC;IACzB,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;QACD,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,KAAK,UAAU,wBAAwB,CACrC,MAAyB;IAEzB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,wBAAwB,CAAC;IAC9D,MAAM,sBAAsB,EAAE,CAAC;IAE/B,uCAAuC;IACvC,MAAM,eAAe,GAAyC;QAC5D,GAAG,MAAM,EAAE,eAAe;KAC3B,CAAC;IAEF,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,wCAAwC;QACxC,MAAM,WAAW,GAAG,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC1E,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAC9C,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC;oBACE,KAAK,EAAE,YAAY;oBACnB,UAAU,EAAE,SAAkB;oBAC9B,MAAM,EAAE,SAAkB;iBAC3B;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;SAC/C,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,wBAAwB,GAC5B,iBAAiB,EAAE,IAAI,CAAC,2BAA2B,EAAE,CAAC;IAExD,MAAM,IAAI,GAAG,UAAU,CAAC;QACtB,QAAQ;QACR,OAAO,EAAE,MAAM;QACf,QAAQ;QACR,MAAM;QACN,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,CAAC;YACpB,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,wBAAwB;YACxB,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC3C,qEAAqE;gBACrE,sEAAsE;gBACtE,MAAM,WAAW,GAAG,CAClB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,WAAW,mCAAmC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAC;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ;iBACT,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,oEAAoE;YACpE,oEAAoE;YACpE,wCAAwC;YACxC,YAAY,EAAE,wBAAwB;YACtC,qEAAqE;YACrE,sEAAsE;YACtE,6CAA6C;YAC7C,2BAA2B,EAAE,IAAI;YACjC,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC7C,qEAAqE;gBACrE,6EAA6E;gBAC7E,MAAM,cAAc,GAAG,CACrB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,SAAS,GAAG,cAAc;oBAC9B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,cAAc,IAAI,CAAC;oBACzD,CAAC,CAAC,GAAG,CAAC;gBACR,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC;oBACtD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS;iBACV,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,eAAe;QACf,OAAO,EAAE;YACP,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,mEAAmE;YACnE,2BAA2B;YAC3B,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;aACvC;SACF;QACD,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,IAIb,EAAE,EAAE;wBACH,gEAAgE;wBAChE,+DAA+D;wBAC/D,8DAA8D;wBAC9D,sDAAsD;wBACtD,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;wBAC1B,IAAI,CAAC,KAAK;4BAAE,OAAO;wBACnB,QAAQ,CAAC,KAAK,EAAE;4BACd,KAAK;4BACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS;4BAC5B,UAAU,EAAE,IAAI,CAAC,EAAE;yBACpB,CAAC,CAAC;wBACH,KAAK,CACH,QAAQ,EACR;4BACE,aAAa,EAAE,aAAa;4BAC5B,YAAY,EAAE,IAAI,CAAC,EAAE;yBACtB,EACD,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;wBACF,IAAI,CAAC;4BACH,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;wBAChD,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,+DAA+D;4BAC/D,OAAO,CAAC,KAAK,CACX,kDAAkD,EAClD,GAAG,CACJ,CAAC;wBACJ,CAAC;wBACD,IAAI,CAAC;4BACH,2DAA2D;4BAC3D,yDAAyD;4BACzD,wDAAwD;4BACxD,0DAA0D;4BAC1D,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;wBAC1C,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,OAAO,CAAC,KAAK,CACX,iDAAiD,EACjD,GAAG,CACJ,CAAC;wBACJ,CAAC;oBACH,CAAC;iBACF;aACF;YACD,OAAO,EAAE;gBACP,+DAA+D;gBAC/D,iEAAiE;gBACjE,kEAAkE;gBAClE,oDAAoD;gBACpD,EAAE;gBACF,+DAA+D;gBAC/D,+DAA+D;gBAC/D,+DAA+D;gBAC/D,gDAAgD;gBAChD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;gBACD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;aACF;SACF;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU;YACxC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,gBAAgB;YACzC,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,cAAc;aAC/B;SACF;QACD,QAAQ,EAAE;YACR,YAAY,EAAE,IAAI;YAClB,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,mCAAmC;YACnC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC/B,CAAC,CAAC;oBACE,uBAAuB,EAAE;wBACvB,QAAQ,EAAE,MAAe;wBACzB,MAAM,EAAE,IAAI;wBACZ,WAAW,EAAE,IAAI;qBAClB;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,OAAO,EAAE;YACP,wDAAwD;YACxD,YAAY,EAAE;YACd,kEAAkE;YAClE,GAAG,CAAC;gBACF,GAAG,EAAE;oBACH,MAAM,EAAE,MAAM;oBACd,cAAc,EAAE,KAAK;iBACtB;aACF,CAAC;YACF,+CAA+C;YAC/C,MAAM,EAAE;YACR,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC3B;KACF,CAAC,CAAC;IAEH,OAAO,IAAqC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAe;IAEf,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAE7D,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YAC1D,aAAa,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;YACpD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAChE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACxE,OAAO,cAAc,CAAC,EAAE,EAAE;gBACxB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,YAAY;aACrB,CAAC,CAAC;QACL,CAAC;QAED,gEAAgE;QAChE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE;YACxB,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC;YAClB,YAAY,EAAE,GAAG;YACjB,YAAY,EAAE,EAAE,GAAG,EAAE;YACrB,eAAe,EAAE,EAAE;YACnB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAClD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAEjD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,kCAAkC;QAClC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,wBAAwB;IACxB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACxE,OAAO,cAAc,CAAC,EAAE,EAAE;QACxB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAC;AACL,CAAC","sourcesContent":["/*\n Internal Better Auth instance — lazily created, not exported to templates.\n \n Templates interact with auth via the existing `getSession()`, `autoMountAuth()`,\n * `createAuthPlugin()`, and `createGoogleAuthPlugin()` APIs. Better Auth is an\n * implementation detail behind those interfaces.\n /\n\nimport crypto from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { betterAuth, type BetterAuthOptions } from \"better-auth\";\nimport { organization } from \"better-auth/plugins/organization\";\nimport { jwt } from \"better-auth/plugins/jwt\";\nimport { bearer } from \"better-auth/plugins/bearer\";\nimport { sendEmail, isEmailConfigured } from \"./email.js\";\nimport {\n renderResetPasswordEmail,\n renderVerifySignupEmail,\n} from \"./email-templates.js\";\nimport { getAppProductionUrl } from \"./app-url.js\";\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport { acceptPendingInvitationsForEmail } from \"../org/accept-pending.js\";\nimport { autoJoinDomainMatchingOrgs } from \"../org/auto-join-domain.js\";\nimport { saveOAuthTokens } from \"../oauth-tokens/store.js\";\nimport { identify, track } from \"../tracking/index.js\";\nimport {\n getDialect,\n getDatabaseUrl,\n getDatabaseAuthToken,\n} from \"../db/client.js\";\nimport {\n pgTable,\n text as pgText,\n timestamp as pgTimestamp,\n boolean as pgBoolean,\n} from \"drizzle-orm/pg-core\";\nimport {\n sqliteTable,\n text as sqliteText,\n integer as sqliteInteger,\n} from \"drizzle-orm/sqlite-core\";\n\n// ---------------------------------------------------------------------------\n// Persistent auth secret\n// ---------------------------------------------------------------------------\n\n/\n Resolve the Better Auth signing secret.\n \n Resolution order:\n * 1. `BETTER_AUTH_SECRET` env var — explicit, recommended for prod.\n * 2. `.env.local` in the template cwd — a per-workspace persistent secret\n * that the framework writes once on first boot when no secret is set.\n * Gitignored by convention (`.env` in template .gitignore files), so\n it's safe to persist credentials here.\n * 3. Generate a new random 32-byte hex, write it to `.env.local`, and use\n * it. Subsequent restarts re-read the same file — so session cookies\n * signed by a previous boot remain valid across dev-server restarts.\n \n Why this matters: before this helper existed, missing `BETTER_AUTH_SECRET`\n * fell through to `GOOGLE_CLIENT_SECRET` / `ACCESS_TOKEN` / a hardcoded\n * string. If a template happened to have none of those, each dev-server\n * boot would re-fall back to the hardcoded value (still stable) — but\n * rotating Google credentials, toggling `ACCESS_TOKEN`, or churning the\n * fallback chain would invalidate every signed cookie and force everyone\n * to sign in again. Pinning the secret to `.env.local` on first boot\n * removes that footgun.\n /\nfunction resolveAuthSecret(): string {\n if (process.env.BETTER_AUTH_SECRET) return process.env.BETTER_AUTH_SECRET;\n\n // In production, never auto-generate or fall back. A regenerated/derived\n // secret invalidates every signed session cookie on the next cold start\n // (serverless filesystems aren't persistent), and the legacy hardcoded\n // fallback is identical across every deploy that hits it — both are\n // serious enough to fail the boot loudly so the deployer notices.\n if (process.env.NODE_ENV === \"production\") {\n const sample = crypto.randomBytes(32).toString(\"hex\");\n throw new Error(\n \"[agent-native] BETTER_AUTH_SECRET is not set. This is required in production \" +\n \"so signed session cookies stay valid across deploys. Set it as a deploy \" +\n \"environment variable (any 32-byte hex string), e.g.:\\n\\n\" +\n ` BETTER_AUTH_SECRET=${sample}\\n\\n` +\n \"Generate your own with `openssl rand -hex 32`. If you already have a \" +\n \"running deploy on the legacy hardcoded fallback and need to preserve \" +\n \"existing sessions, set BETTER_AUTH_SECRET=agent-native-local-dev-secret-k9x2m7q4w8 \" +\n \"first, then rotate to a real value.\",\n );\n }\n\n // Dev: persist a generated secret to .env.local so sessions survive\n // dev-server restarts. Falls back to an in-memory random secret only if\n // the filesystem isn't writable (rare in dev, e.g. read-only mounts) —\n // sessions reset on every dev-process restart in that case, which is\n // fine.\n //\n // SECURITY (audit 09 LOW-2): the previous fallback chain\n // (`GOOGLE_CLIENT_SECRET \|\| ACCESS_TOKEN \|\| hardcoded`) reused\n // cross-purpose secrets and a public hardcoded literal as the cookie\n // HMAC. Dropped entirely — better to mint an ephemeral secret than to\n // re-use a Google client secret or a known string.\n try {\n const envLocalPath = path.resolve(process.cwd(), \".env.local\");\n const existing = readEnvLocalSecret(envLocalPath);\n if (existing) {\n process.env.BETTER_AUTH_SECRET = existing; // guard:allow-env-mutation — boot-time secret resolution from .env.local, runs once at module init\n return existing;\n }\n\n const generated = crypto.randomBytes(32).toString(\"hex\");\n appendEnvLocalSecret(envLocalPath, generated);\n process.env.BETTER_AUTH_SECRET = generated; // guard:allow-env-mutation — boot-time secret generation, runs once at module init before any request\n console.log(\n \"[agent-native] Generated a persistent BETTER_AUTH_SECRET in .env.local. \" +\n \"Sessions will now survive dev-server restarts. \" +\n \"(Delete .env.local to rotate; set BETTER_AUTH_SECRET in .env to override.)\",\n );\n return generated;\n } catch {\n // Filesystem unwritable (read-only mount, sandboxed test env, etc.).\n // Mint a per-process random secret so cookies stay unique per boot.\n // Sessions reset when the dev process restarts — acceptable for dev.\n const ephemeral = crypto.randomBytes(32).toString(\"hex\");\n console.warn(\n \"[agent-native] Could not persist BETTER_AUTH_SECRET to .env.local \" +\n \"(filesystem unwritable). Using an ephemeral in-memory secret. \" +\n \"Sessions will reset every time this process restarts. \" +\n \"Set BETTER_AUTH_SECRET in your environment to keep sessions valid across restarts.\",\n );\n return ephemeral;\n }\n}\n\nfunction readEnvLocalSecret(envLocalPath: string): string \| undefined {\n try {\n const content = fs.readFileSync(envLocalPath, \"utf8\");\n // Match `BETTER_AUTH_SECRET=...` on its own line. Tolerate optional\n // quotes and leading `export `. Stop at the first newline or quote.\n const m = content.match(\n /^(?:export\\s+)?BETTER_AUTH_SECRET\\s=\\s\"?([^\"\\r\\n]+)\"?\\s$/m,\n );\n return m?.[1]?.trim() \|\| undefined;\n } catch {\n return undefined;\n }\n}\n\nfunction appendEnvLocalSecret(envLocalPath: string, secret: string): void {\n const header =\n \"# Auto-generated by agent-native on first boot. Gitignored.\\n\" +\n \"# Keeps signed session cookies valid across dev-server restarts.\\n\" +\n \"# Delete this file (or this line) to rotate the secret.\\n\";\n const line = `BETTER_AUTH_SECRET=${secret}\\n`;\n\n // If the file already exists, just append; otherwise create with header.\n if (fs.existsSync(envLocalPath)) {\n const existing = fs.readFileSync(envLocalPath, \"utf8\");\n const needsLeadingNewline = existing.length > 0 && !existing.endsWith(\"\\n\");\n fs.appendFileSync(\n envLocalPath,\n (needsLeadingNewline ? \"\\n\" : \"\") + \"\\n\" + header + line,\n );\n } else {\n fs.writeFileSync(envLocalPath, header + line, { mode: 0o600 });\n }\n}\n\nexport function shouldSkipEmailVerification(): boolean {\n const value = process.env.AUTH_SKIP_EMAIL_VERIFICATION;\n if (value == null) {\n return (\n process.env.NODE_ENV === \"development\" \|\| process.env.NODE_ENV === \"test\"\n );\n }\n const normalized = value.trim().toLowerCase();\n return normalized !== \"\" && normalized !== \"0\" && normalized !== \"false\";\n}\n\n/** Read-only accessor for the resolved auth secret. /\nexport function getAuthSecret(): string {\n return resolveAuthSecret();\n}\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/* The shape we need from a Better Auth instance (internal — not exported to templates). /\nexport interface BetterAuthInstance {\n handler: (request: Request) => Promise<Response>;\n api: {\n getSession: (opts: { headers: Headers }) => Promise<{\n user: { id: string; email: string; name: string };\n session: {\n id: string;\n token: string;\n expiresAt: Date;\n activeOrganizationId?: string;\n };\n } \| null>;\n signInEmail: (opts: {\n body: { email: string; password: string };\n }) => Promise<{ token?: string; user?: any } \| null>;\n signUpEmail: (opts: {\n body: {\n email: string;\n password: string;\n name: string;\n callbackURL?: string;\n };\n }) => Promise<any>;\n signOut: (opts: { headers: Headers }) => Promise<any>;\n listOrganizations: (opts: { headers: Headers }) => Promise<any[] \| null>;\n };\n}\n\nexport interface BetterAuthConfig {\n /* Base path for Better Auth routes. Default: \"/_agent-native/auth/ba\" /\n basePath?: string;\n /* Additional social providers beyond what env vars auto-detect /\n socialProviders?: BetterAuthOptions[\"socialProviders\"];\n /* Additional Better Auth plugins /\n plugins?: BetterAuthOptions[\"plugins\"];\n /\n Additional Google OAuth scopes (Gmail, Calendar, etc.) to request\n * up front during the primary \"Sign in with Google\" flow, beyond the\n * default identity scopes (`openid`, `email`, `profile`).\n \n When set, the Google social provider also opts into:\n * - `accessType: \"offline\"` — so a refresh token is issued\n * - `prompt: \"consent\"` — so the refresh token is reissued every sign-in\n \n Tokens are mirrored into `oauth_tokens` via a databaseHooks.account\n * hook so existing template code that reads from `oauth_tokens` (mail's\n * Gmail client, calendar's events fetcher) works without any separate\n * \"Connect Google\" page.\n /\n googleScopes?: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Lazy instance\n// ---------------------------------------------------------------------------\n\nlet _auth: BetterAuthInstance \| undefined;\nlet _initPromise: Promise<BetterAuthInstance> \| undefined;\n// Track the Neon serverless Pool we open for Better Auth so closeBetterAuth()\n// can release it. The Pool keeps WebSocket connections open; leaking them on\n// hot-reload or process restart exhausts Neon's connection slot budget.\nlet _neonAuthPool: any;\n\nconst pgAuthSchema = {\n user: pgTable(\"user\", {\n id: pgText(\"id\").primaryKey(),\n name: pgText(\"name\").notNull(),\n email: pgText(\"email\").notNull().unique(),\n emailVerified: pgBoolean(\"email_verified\").notNull().default(false),\n image: pgText(\"image\"),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n session: pgTable(\"session\", {\n id: pgText(\"id\").primaryKey(),\n expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n token: pgText(\"token\").notNull().unique(),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n ipAddress: pgText(\"ip_address\"),\n userAgent: pgText(\"user_agent\"),\n userId: pgText(\"user_id\").notNull(),\n activeOrganizationId: pgText(\"active_organization_id\"),\n }),\n account: pgTable(\"account\", {\n id: pgText(\"id\").primaryKey(),\n accountId: pgText(\"account_id\").notNull(),\n providerId: pgText(\"provider_id\").notNull(),\n userId: pgText(\"user_id\").notNull(),\n accessToken: pgText(\"access_token\"),\n refreshToken: pgText(\"refresh_token\"),\n idToken: pgText(\"id_token\"),\n accessTokenExpiresAt: pgTimestamp(\"access_token_expires_at\", {\n withTimezone: true,\n }),\n refreshTokenExpiresAt: pgTimestamp(\"refresh_token_expires_at\", {\n withTimezone: true,\n }),\n scope: pgText(\"scope\"),\n password: pgText(\"password\"),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n verification: pgTable(\"verification\", {\n id: pgText(\"id\").primaryKey(),\n identifier: pgText(\"identifier\").notNull(),\n value: pgText(\"value\").notNull(),\n expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n organization: pgTable(\"organization\", {\n id: pgText(\"id\").primaryKey(),\n name: pgText(\"name\").notNull(),\n slug: pgText(\"slug\").notNull().unique(),\n logo: pgText(\"logo\"),\n metadata: pgText(\"metadata\"),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n member: pgTable(\"member\", {\n id: pgText(\"id\").primaryKey(),\n organizationId: pgText(\"organization_id\").notNull(),\n userId: pgText(\"user_id\").notNull(),\n role: pgText(\"role\").notNull().default(\"member\"),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n invitation: pgTable(\"invitation\", {\n id: pgText(\"id\").primaryKey(),\n organizationId: pgText(\"organization_id\").notNull(),\n email: pgText(\"email\").notNull(),\n role: pgText(\"role\"),\n status: pgText(\"status\").notNull().default(\"pending\"),\n expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n inviterId: pgText(\"inviter_id\").notNull(),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n jwks: pgTable(\"jwks\", {\n id: pgText(\"id\").primaryKey(),\n publicKey: pgText(\"public_key\").notNull(),\n privateKey: pgText(\"private_key\").notNull(),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }),\n }),\n};\n\nconst sqliteAuthSchema = {\n user: sqliteTable(\"user\", {\n id: sqliteText(\"id\").primaryKey(),\n name: sqliteText(\"name\").notNull(),\n email: sqliteText(\"email\").notNull().unique(),\n emailVerified: sqliteInteger(\"email_verified\", { mode: \"boolean\" })\n .notNull()\n .default(false),\n image: sqliteText(\"image\"),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n session: sqliteTable(\"session\", {\n id: sqliteText(\"id\").primaryKey(),\n expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n token: sqliteText(\"token\").notNull().unique(),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n ipAddress: sqliteText(\"ip_address\"),\n userAgent: sqliteText(\"user_agent\"),\n userId: sqliteText(\"user_id\").notNull(),\n activeOrganizationId: sqliteText(\"active_organization_id\"),\n }),\n account: sqliteTable(\"account\", {\n id: sqliteText(\"id\").primaryKey(),\n accountId: sqliteText(\"account_id\").notNull(),\n providerId: sqliteText(\"provider_id\").notNull(),\n userId: sqliteText(\"user_id\").notNull(),\n accessToken: sqliteText(\"access_token\"),\n refreshToken: sqliteText(\"refresh_token\"),\n idToken: sqliteText(\"id_token\"),\n accessTokenExpiresAt: sqliteInteger(\"access_token_expires_at\", {\n mode: \"timestamp_ms\",\n }),\n refreshTokenExpiresAt: sqliteInteger(\"refresh_token_expires_at\", {\n mode: \"timestamp_ms\",\n }),\n scope: sqliteText(\"scope\"),\n password: sqliteText(\"password\"),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n verification: sqliteTable(\"verification\", {\n id: sqliteText(\"id\").primaryKey(),\n identifier: sqliteText(\"identifier\").notNull(),\n value: sqliteText(\"value\").notNull(),\n expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n organization: sqliteTable(\"organization\", {\n id: sqliteText(\"id\").primaryKey(),\n name: sqliteText(\"name\").notNull(),\n slug: sqliteText(\"slug\").notNull().unique(),\n logo: sqliteText(\"logo\"),\n metadata: sqliteText(\"metadata\"),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n member: sqliteTable(\"member\", {\n id: sqliteText(\"id\").primaryKey(),\n organizationId: sqliteText(\"organization_id\").notNull(),\n userId: sqliteText(\"user_id\").notNull(),\n role: sqliteText(\"role\").notNull().default(\"member\"),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n invitation: sqliteTable(\"invitation\", {\n id: sqliteText(\"id\").primaryKey(),\n organizationId: sqliteText(\"organization_id\").notNull(),\n email: sqliteText(\"email\").notNull(),\n role: sqliteText(\"role\"),\n status: sqliteText(\"status\").notNull().default(\"pending\"),\n expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n inviterId: sqliteText(\"inviter_id\").notNull(),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n jwks: sqliteTable(\"jwks\", {\n id: sqliteText(\"id\").primaryKey(),\n publicKey: sqliteText(\"public_key\").notNull(),\n privateKey: sqliteText(\"private_key\").notNull(),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }),\n }),\n};\n\nfunction getBetterAuthSchema() {\n return isPostgres() ? pgAuthSchema : sqliteAuthSchema;\n}\n\n/\n Mirror a Better Auth `account` row for Google into the `oauth_tokens`\n * table that template code (mail's Gmail client, calendar's events fetcher)\n * reads from. Called from the `databaseHooks.account.create.after` and\n * `.update.after` hooks so tokens captured during the primary \"Sign in\n * with Google\" flow flow straight to the apps that need them — no\n * separate \"Connect Google\" page required.\n \n Resolves `account.userId` to the user's email by querying the `user`\n * table (Better Auth always quotes \"user\" because it's a reserved word\n * in Postgres; SQLite accepts the quotes too).\n \n The hook is fire-and-forget from the caller's perspective — every\n * failure is caught upstream so a flake in `oauth_tokens` never blocks\n * sign-in. We still no-op on missing fields here as a defense in depth.\n /\nasync function mirrorGoogleAccountToOAuthTokens(account: {\n providerId?: string;\n userId?: string;\n accountId?: string;\n accessToken?: string \| null;\n refreshToken?: string \| null;\n accessTokenExpiresAt?: Date \| string \| number \| null;\n scope?: string \| null;\n idToken?: string \| null;\n}): Promise<void> {\n if (!account \|\| account.providerId !== \"google\") return;\n if (!account.userId) return;\n\n const accessToken = account.accessToken ?? undefined;\n if (!accessToken) {\n // Better Auth sometimes upserts an account row before tokens are\n // attached (e.g. linking flows). Nothing to mirror yet — the next\n // update hook will run once the access token lands.\n return;\n }\n\n // Resolve user email from userId.\n const db = getDbExec();\n let email: string \| undefined;\n try {\n const { rows } = await db.execute({\n sql: 'SELECT email FROM \"user\" WHERE id = ?',\n args: [account.userId],\n });\n email = (rows[0]?.email as string \| undefined) ?? undefined;\n } catch (err) {\n console.error(\n \"[auth] mirror Google tokens: failed to resolve user email from userId\",\n err,\n );\n return;\n }\n if (!email) return;\n\n // Normalise expiry to epoch ms (Google's \"expiry_date\" convention used\n // throughout the templates).\n let expiryDate: number \| undefined;\n const raw = account.accessTokenExpiresAt;\n if (raw instanceof Date) {\n expiryDate = raw.getTime();\n } else if (typeof raw === \"number\") {\n expiryDate = raw;\n } else if (typeof raw === \"string\") {\n const ms = Date.parse(raw);\n expiryDate = Number.isFinite(ms) ? ms : undefined;\n }\n\n const tokens: Record<string, unknown> = {\n access_token: accessToken,\n token_type: \"Bearer\",\n };\n if (account.refreshToken) tokens.refresh_token = account.refreshToken;\n if (expiryDate) tokens.expiry_date = expiryDate;\n if (account.scope) tokens.scope = account.scope;\n if (account.idToken) tokens.id_token = account.idToken;\n\n await saveOAuthTokens(\"google\", email, tokens, email);\n}\n\nasync function ensureBetterAuthTables(): Promise<void> {\n const db = getDbExec();\n const statements = isPostgres()\n ? [\n `CREATE TABLE IF NOT EXISTS \"user\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified BOOLEAN NOT NULL DEFAULT FALSE, image TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"session\" (id TEXT PRIMARY KEY, expires_at TIMESTAMPTZ NOT NULL, token TEXT NOT NULL UNIQUE, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n `CREATE TABLE IF NOT EXISTS \"account\" (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at TIMESTAMPTZ, refresh_token_expires_at TIMESTAMPTZ, scope TEXT, password TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"verification\" (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"organization\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"member\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"invitation\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at TIMESTAMPTZ NOT NULL, inviter_id TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"jwks\" (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, expires_at TIMESTAMPTZ)`,\n ]\n : [\n `CREATE TABLE IF NOT EXISTS user (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified INTEGER NOT NULL DEFAULT 0, image TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS session (id TEXT PRIMARY KEY, expires_at INTEGER NOT NULL, token TEXT NOT NULL UNIQUE, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n `CREATE TABLE IF NOT EXISTS account (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at INTEGER, refresh_token_expires_at INTEGER, scope TEXT, password TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS verification (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at INTEGER NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS organization (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS member (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS invitation (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at INTEGER NOT NULL, inviter_id TEXT NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS jwks (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at INTEGER NOT NULL, expires_at INTEGER)`,\n ];\n\n for (const sql of statements) await db.execute(sql);\n}\n\n/\n Get or create the Better Auth instance.\n * Lazily initialized on first call — the database must be reachable by then.\n /\nexport async function getBetterAuth(\n config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n if (_auth) return _auth;\n if (_initPromise) return _initPromise;\n\n _initPromise = createBetterAuthInstance(config);\n _auth = await _initPromise;\n return _auth;\n}\n\n/\n Synchronous getter — returns the instance if already initialized, else undefined.\n * Use this in hot paths where you know init has already happened.\n /\nexport function getBetterAuthSync(): BetterAuthInstance \| undefined {\n return _auth;\n}\n\n/* Reset for testing /\nexport async function resetBetterAuth(): Promise<void> {\n _auth = undefined;\n _initPromise = undefined;\n if (_neonAuthPool) {\n try {\n await _neonAuthPool.end();\n } catch {\n // Pool may have already closed (process exiting, etc.) — don't block reset.\n }\n _neonAuthPool = undefined;\n }\n}\n\n// ---------------------------------------------------------------------------\n// Instance creation\n// ---------------------------------------------------------------------------\n\nasync function createBetterAuthInstance(\n config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n const dialect = getDialect();\n const basePath = config?.basePath ?? \"/_agent-native/auth/ba\";\n await ensureBetterAuthTables();\n\n // Build social providers from env vars\n const socialProviders: BetterAuthOptions[\"socialProviders\"] = {\n ...config?.socialProviders,\n };\n\n if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {\n // When the template requests broader scopes (Gmail, Calendar, etc.)\n // ask for them on the primary sign-in flow so a separate \"Connect\n // Google\" round-trip isn't needed. `accessType: \"offline\"` plus\n // `prompt: \"consent\"` ensures we always receive a refresh token back —\n // Google only re-issues a refresh token on consent, so re-signing in\n // (e.g. after switching machines) would otherwise leave us with an\n // access token that can't be refreshed.\n const extraScopes = config?.googleScopes ?? [];\n const baseScopes = [\"openid\", \"email\", \"profile\"];\n const mergedScopes = Array.from(new Set([...baseScopes, ...extraScopes]));\n socialProviders.google = {\n clientId: process.env.GOOGLE_CLIENT_ID,\n clientSecret: process.env.GOOGLE_CLIENT_SECRET,\n ...(extraScopes.length > 0\n ? {\n scope: mergedScopes,\n accessType: \"offline\" as const,\n prompt: \"consent\" as const,\n }\n : {}),\n };\n }\n\n if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {\n socialProviders.github = {\n clientId: process.env.GITHUB_CLIENT_ID,\n clientSecret: process.env.GITHUB_CLIENT_SECRET,\n };\n }\n\n // Build database config\n const database = await buildDatabaseConfig(dialect);\n\n const secret = resolveAuthSecret();\n\n const appUrl = getAppProductionUrl();\n const requireEmailVerification =\n isEmailConfigured() && !shouldSkipEmailVerification();\n\n const auth = betterAuth({\n basePath,\n baseURL: appUrl,\n database,\n secret,\n emailAndPassword: {\n enabled: true,\n minPasswordLength: 8,\n // Only require email verification when an email provider is configured.\n // Without a provider, verification emails can't be sent, so requiring\n // verification would lock users out of signup entirely. Local dev/test\n // skip verification by default so +qa accounts can be created quickly;\n // hosted QA deployments can opt out with AUTH_SKIP_EMAIL_VERIFICATION=1.\n requireEmailVerification,\n sendResetPassword: async ({ user, token }) => {\n // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n // reset link must include that prefix so the page resolves correctly.\n const appBasePath = (\n process.env.VITE_APP_BASE_PATH \|\|\n process.env.APP_BASE_PATH \|\|\n \"\"\n ).replace(/\\/$/, \"\");\n const resetUrl = `${appUrl}${appBasePath}/_agent-native/auth/reset?token=${encodeURIComponent(token)}`;\n const { subject, html, text } = renderResetPasswordEmail({\n email: user.email,\n resetUrl,\n });\n await sendEmail({ to: user.email, subject, html, text });\n },\n },\n emailVerification: {\n // Fire verification email right after signup, before the user has a\n // session — pairs with requireEmailVerification above. Only enabled\n // when an email provider is configured.\n sendOnSignUp: requireEmailVerification,\n // Auto-create a session once the user clicks the link. Without this,\n // verified users would have to go back and sign in manually, which is\n // a confusing dead-end on the verify screen.\n autoSignInAfterVerification: true,\n sendVerificationEmail: async ({ user, url }) => {\n // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n // verification link must include that prefix so the page resolves correctly.\n const verifyBasePath = (\n process.env.VITE_APP_BASE_PATH \|\|\n process.env.APP_BASE_PATH \|\|\n \"\"\n ).replace(/\\/$/, \"\");\n const verifyUrl = verifyBasePath\n ? url.replace(/(\\/\\/[^/]+)(\\/)/, `$1${verifyBasePath}$2`)\n : url;\n const { subject, html, text } = renderVerifySignupEmail({\n email: user.email,\n verifyUrl,\n });\n await sendEmail({ to: user.email, subject, html, text });\n },\n },\n socialProviders,\n account: {\n // Merge accounts when a user signs in with a social provider using an\n // email that already has a local email/password account (or vice versa).\n // Only providers listed in `trustedProviders` auto-link — these are the\n // ones that verify emails at the identity layer. Never add a provider\n // here that lets users claim an unverified email; that would be an\n // account-takeover vector.\n accountLinking: {\n enabled: true,\n trustedProviders: [\"google\", \"github\"],\n },\n },\n databaseHooks: {\n user: {\n create: {\n after: async (user: {\n id?: string;\n email?: string;\n name?: string \| null;\n }) => {\n // When a newly-created user's email has pending org invitations\n // (common when someone is invited before* they've signed up),\n // auto-accept them so the user lands in the org on their very\n // first page load instead of a blank-slate workspace.\n const email = user?.email;\n if (!email) return;\n identify(email, {\n email,\n name: user.name ?? undefined,\n authUserId: user.id,\n });\n track(\n \"signup\",\n {\n auth_provider: \"better-auth\",\n auth_user_id: user.id,\n },\n { userId: email },\n );\n try {\n await acceptPendingInvitationsForEmail(email);\n } catch (err) {\n // Never block signup on invite bookkeeping — log and continue.\n console.error(\n \"[auth] failed to auto-accept pending invitations\",\n err,\n );\n }\n try {\n // Auto-join orgs whose `allowed_domain` matches this email\n // domain. Lets a fresh `@builder.io` (or any org-domain)\n // signup land inside the company org on first page load\n // without going through the picker. No-ops when no match.\n await autoJoinDomainMatchingOrgs(email);\n } catch (err) {\n console.error(\n \"[auth] failed to auto-join domain-matching orgs\",\n err,\n );\n }\n },\n },\n },\n account: {\n // Mirror Google account tokens into `oauth_tokens` so existing\n // template code (mail's Gmail client, calendar's events fetcher)\n // can pick up Gmail/Calendar credentials from the primary sign-in\n // flow — no separate \"Set up Google\" page required.\n //\n // Better Auth fires `create` for first-time social sign-in and\n // `update` whenever a session re-issues tokens (e.g., the user\n // re-signs in to refresh the token). Both branches do the same\n // mirroring work; failures never block sign-in.\n create: {\n after: async (account: any) => {\n await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n console.error(\n \"[auth] failed to mirror Google account tokens to oauth_tokens (create)\",\n err,\n );\n });\n },\n },\n update: {\n after: async (account: any) => {\n await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n console.error(\n \"[auth] failed to mirror Google account tokens to oauth_tokens (update)\",\n err,\n );\n });\n },\n },\n },\n },\n session: {\n expiresIn: 60 * 60 * 24 * 30, // 30 days\n updateAge: 60 * 60 * 24, // refresh daily\n cookieCache: {\n enabled: true,\n maxAge: 5 * 60, // 5 min cache\n },\n },\n advanced: {\n cookiePrefix: \"an\",\n // Emit `SameSite=None; Secure` when the app is served over HTTPS so\n // session cookies are delivered inside third-party iframes (e.g. the\n // Builder.io editor). Plain-HTTP dev keeps the default (Lax) because\n // `SameSite=None` requires Secure.\n ...(appUrl.startsWith(\"https://\")\n ? {\n defaultCookieAttributes: {\n sameSite: \"none\" as const,\n secure: true,\n partitioned: true,\n },\n }\n : {}),\n },\n plugins: [\n // Organizations: many:many user:org, roles, invitations\n organization(),\n // JWT: issue tokens for A2A calls, JWKS endpoint for verification\n jwt({\n jwt: {\n issuer: appUrl,\n expirationTime: \"15m\",\n },\n }),\n // Bearer: accept Bearer tokens on API requests\n bearer(),\n ...(config?.plugins ?? []),\n ],\n });\n\n return auth as unknown as BetterAuthInstance;\n}\n\nasync function buildDatabaseConfig(\n dialect: string,\n): Promise<BetterAuthOptions[\"database\"]> {\n if (dialect === \"postgres\") {\n const url = getDatabaseUrl();\n const { isNeonUrl } = await import(\"../db/create-get-db.js\");\n\n // Neon via @neondatabase/serverless (WebSockets over HTTPS). postgres-js\n // opens a raw TCP connection on port 5432 which frequently times out on\n // Netlify Functions / Vercel / CF Workers when Neon's pooler is cold.\n if (isNeonUrl(url)) {\n const { Pool } = await import(\"@neondatabase/serverless\");\n _neonAuthPool = new Pool({ connectionString: url });\n const { drizzle } = await import(\"drizzle-orm/neon-serverless\");\n const db = drizzle(_neonAuthPool, { schema: pgAuthSchema });\n const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n return drizzleAdapter(db, {\n provider: \"pg\",\n schema: pgAuthSchema,\n });\n }\n\n // Non-Neon Postgres (Supabase, self-hosted, etc.) → postgres-js\n const { default: postgres } = await import(\"postgres\");\n const sql = postgres(url, {\n onnotice: () => {},\n idle_timeout: 240,\n max_lifetime: 60 * 30,\n connect_timeout: 10,\n ...(url.includes(\"supabase\") ? { prepare: false } : {}),\n });\n const { drizzle } = await import(\"drizzle-orm/postgres-js\");\n const db = drizzle(sql, { schema: pgAuthSchema });\n const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n return drizzleAdapter(db, {\n provider: \"pg\",\n schema: pgAuthSchema,\n });\n }\n\n // SQLite / libsql\n const url = getDatabaseUrl(\"file:./data/app.db\");\n\n if (url.startsWith(\"file:\") \|\| !url.includes(\"://\")) {\n // Local SQLite via better-sqlite3\n const { default: Database } = await import(\"better-sqlite3\");\n const filePath = url.replace(/^file:/, \"\");\n const sqlite = new Database(filePath);\n sqlite.pragma(\"journal_mode = WAL\");\n const { drizzle } = await import(\"drizzle-orm/better-sqlite3\");\n const db = drizzle(sqlite, { schema: sqliteAuthSchema });\n const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n return drizzleAdapter(db, {\n provider: \"sqlite\",\n schema: sqliteAuthSchema,\n });\n }\n\n // Remote libsql (Turso)\n const { createClient } = await import(\"@libsql/client\");\n const client = createClient({ url, authToken: getDatabaseAuthToken() });\n const { drizzle } = await import(\"drizzle-orm/libsql\");\n const db = drizzle(client, { schema: sqliteAuthSchema });\n const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n return drizzleAdapter(db, {\n provider: \"sqlite\",\n schema: sqliteAuthSchema,\n });\n}\n"]}
1	+ {"version":3,"file":"better-auth-instance.js","sourceRoot":"","sources":["../../src/server/better-auth-instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,UAAU,EACV,cAAc,EACd,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,OAAO,EACP,IAAI,IAAI,MAAM,EACd,SAAS,IAAI,WAAW,EACxB,OAAO,IAAI,SAAS,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,IAAI,IAAI,UAAU,EAClB,OAAO,IAAI,aAAa,GACzB,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,iBAAiB;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAE1E,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,+EAA+E;YAC7E,0EAA0E;YAC1E,0DAA0D;YAC1D,wBAAwB,MAAM,MAAM;YACpC,uEAAuE;YACvE,uEAAuE;YACvE,qFAAqF;YACrF,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,QAAQ;IACR,EAAE;IACF,yDAAyD;IACzD,+DAA+D;IAC/D,qEAAqE;IACrE,sEAAsE;IACtE,mDAAmD;IACnD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,QAAQ,CAAC,CAAC,mGAAmG;YAC9I,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC,sGAAsG;QAClJ,OAAO,CAAC,GAAG,CACT,0EAA0E;YACxE,iDAAiD;YACjD,4EAA4E,CAC/E,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CACV,oEAAoE;YAClE,gEAAgE;YAChE,wDAAwD;YACxD,oFAAoF,CACvF,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtD,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CACrB,8DAA8D,CAC/D,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAoB,EAAE,MAAc;IAChE,MAAM,MAAM,GACV,+DAA+D;QAC/D,oEAAoE;QACpE,2DAA2D,CAAC;IAC9D,MAAM,IAAI,GAAG,sBAAsB,MAAM,IAAI,CAAC;IAE9C,yEAAyE;IACzE,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5E,EAAE,CAAC,cAAc,CACf,YAAY,EACZ,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CACzD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACvD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,OAAO,CAAC;AAC3E,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AA2DD,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,IAAI,KAAqC,CAAC;AAC1C,IAAI,YAAqD,CAAC;AAC1D,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACxE,IAAI,aAAkB,CAAC;AAEvB,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,aAAa,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,oBAAoB,EAAE,MAAM,CAAC,wBAAwB,CAAC;KACvD,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;QACnC,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC;QACrC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;QAC3B,oBAAoB,EAAE,WAAW,CAAC,yBAAyB,EAAE;YAC3D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,qBAAqB,EAAE,WAAW,CAAC,0BAA0B,EAAE;YAC7D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACvC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE;QACxB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE;QAChC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;KAC7D,CAAC;CACH,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,aAAa,EAAE,aAAa,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aAChE,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;QACjB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,UAAU,CAAC,wBAAwB,CAAC;KAC3D,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,WAAW,EAAE,UAAU,CAAC,cAAc,CAAC;QACvC,YAAY,EAAE,UAAU,CAAC,eAAe,CAAC;QACzC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC;QAC/B,oBAAoB,EAAE,aAAa,CAAC,yBAAyB,EAAE;YAC7D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,qBAAqB,EAAE,aAAa,CAAC,0BAA0B,EAAE;YAC/D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC9C,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC3C,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC5B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,UAAU,EAAE,WAAW,CAAC,YAAY,EAAE;QACpC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACzD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;KACjE,CAAC;CACH,CAAC;AAEF,SAAS,mBAAmB;IAC1B,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,gCAAgC,CAAC,OAS/C;IACC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO;IACxD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO;IAE5B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iEAAiE;QACjE,kEAAkE;QAClE,oDAAoD;QACpD,OAAO;IACT,CAAC;IAED,kCAAkC;IAClC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAChC,GAAG,EAAE,uCAAuC;YAC5C,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACvB,CAAC,CAAC;QACH,KAAK,GAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAA4B,IAAI,SAAS,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,uEAAuE,EACvE,GAAG,CACJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,uEAAuE;IACvE,6BAA6B;IAC7B,IAAI,UAA8B,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC;IACzC,IAAI,GAAG,YAAY,IAAI,EAAE,CAAC;QACxB,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,UAAU,GAAG,GAAG,CAAC;IACnB,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAA4B;QACtC,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;KACrB,CAAC;IACF,IAAI,OAAO,CAAC,YAAY;QAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IACtE,IAAI,UAAU;QAAE,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC;IAChD,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAEvD,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,sBAAsB;IACnC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,UAAU,EAAE;QAC7B,CAAC,CAAC;YACE,sOAAsO;YACtO,iRAAiR;YACjR,sWAAsW;YACtW,mNAAmN;YACnN,4MAA4M;YAC5M,wNAAwN;YACxN,mSAAmS;YACnS,uKAAuK;SACxK;QACH,CAAC,CAAC;YACE,wNAAwN;YACxN,mQAAmQ;YACnQ,oVAAoV;YACpV,qMAAqM;YACrM,kMAAkM;YAClM,8MAA8M;YAC9M,qRAAqR;YACrR,6JAA6J;SAC9J,CAAC;IAEN,KAAK,MAAM,GAAG,IAAI,UAAU;QAAE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB;IAEzB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,YAAY,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAChD,KAAK,GAAG,MAAM,YAAY,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,KAAK,GAAG,SAAS,CAAC;IAClB,YAAY,GAAG,SAAS,CAAC;IACzB,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;QACD,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,KAAK,UAAU,wBAAwB,CACrC,MAAyB;IAEzB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,wBAAwB,CAAC;IAC9D,MAAM,sBAAsB,EAAE,CAAC;IAE/B,uCAAuC;IACvC,MAAM,eAAe,GAAyC;QAC5D,GAAG,MAAM,EAAE,eAAe;KAC3B,CAAC;IAEF,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,wCAAwC;QACxC,MAAM,WAAW,GAAG,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC1E,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAC9C,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC;oBACE,KAAK,EAAE,YAAY;oBACnB,UAAU,EAAE,SAAkB;oBAC9B,MAAM,EAAE,SAAkB;iBAC3B;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;SAC/C,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,wBAAwB,GAC5B,iBAAiB,EAAE,IAAI,CAAC,2BAA2B,EAAE,CAAC;IAExD,MAAM,IAAI,GAAG,UAAU,CAAC;QACtB,QAAQ;QACR,OAAO,EAAE,MAAM;QACf,QAAQ;QACR,MAAM;QACN,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,CAAC;YACpB,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,wBAAwB;YACxB,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC3C,qEAAqE;gBACrE,sEAAsE;gBACtE,MAAM,WAAW,GAAG,CAClB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,WAAW,mCAAmC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAC;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ;iBACT,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,oEAAoE;YACpE,oEAAoE;YACpE,wCAAwC;YACxC,YAAY,EAAE,wBAAwB;YACtC,qEAAqE;YACrE,sEAAsE;YACtE,6CAA6C;YAC7C,2BAA2B,EAAE,IAAI;YACjC,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC7C,qEAAqE;gBACrE,6EAA6E;gBAC7E,MAAM,cAAc,GAAG,CACrB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,SAAS,GAAG,cAAc;oBAC9B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,cAAc,IAAI,CAAC;oBACzD,CAAC,CAAC,GAAG,CAAC;gBACR,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC;oBACtD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS;iBACV,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,eAAe;QACf,OAAO,EAAE;YACP,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,mEAAmE;YACnE,2BAA2B;YAC3B,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;aACvC;SACF;QACD,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,IAIb,EAAE,EAAE;wBACH,gEAAgE;wBAChE,+DAA+D;wBAC/D,8DAA8D;wBAC9D,sDAAsD;wBACtD,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;wBAC1B,IAAI,CAAC,KAAK;4BAAE,OAAO;wBACnB,QAAQ,CAAC,KAAK,EAAE;4BACd,KAAK;4BACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS;4BAC5B,UAAU,EAAE,IAAI,CAAC,EAAE;yBACpB,CAAC,CAAC;wBACH,KAAK,CACH,QAAQ,EACR;4BACE,aAAa,EAAE,aAAa;4BAC5B,YAAY,EAAE,IAAI,CAAC,EAAE;yBACtB,EACD,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;wBACF,IAAI,CAAC;4BACH,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;wBAChD,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,+DAA+D;4BAC/D,OAAO,CAAC,KAAK,CACX,kDAAkD,EAClD,GAAG,CACJ,CAAC;wBACJ,CAAC;wBACD,IAAI,CAAC;4BACH,2DAA2D;4BAC3D,yDAAyD;4BACzD,wDAAwD;4BACxD,0DAA0D;4BAC1D,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;wBAC1C,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,OAAO,CAAC,KAAK,CACX,iDAAiD,EACjD,GAAG,CACJ,CAAC;wBACJ,CAAC;oBACH,CAAC;iBACF;aACF;YACD,OAAO,EAAE;gBACP,+DAA+D;gBAC/D,iEAAiE;gBACjE,kEAAkE;gBAClE,oDAAoD;gBACpD,EAAE;gBACF,+DAA+D;gBAC/D,+DAA+D;gBAC/D,+DAA+D;gBAC/D,gDAAgD;gBAChD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;gBACD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;aACF;SACF;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU;YACxC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,gBAAgB;YACzC,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,cAAc;aAC/B;SACF;QACD,QAAQ,EAAE;YACR,YAAY,EAAE,IAAI;YAClB,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,mCAAmC;YACnC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC/B,CAAC,CAAC;oBACE,uBAAuB,EAAE;wBACvB,QAAQ,EAAE,MAAe;wBACzB,MAAM,EAAE,IAAI;wBACZ,WAAW,EAAE,IAAI;qBAClB;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,OAAO,EAAE;YACP,wDAAwD;YACxD,YAAY,EAAE;YACd,kEAAkE;YAClE,GAAG,CAAC;gBACF,GAAG,EAAE;oBACH,MAAM,EAAE,MAAM;oBACd,cAAc,EAAE,KAAK;iBACtB;aACF,CAAC;YACF,+CAA+C;YAC/C,MAAM,EAAE;YACR,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC3B;KACF,CAAC,CAAC;IAEH,OAAO,IAAqC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAe;IAEf,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAE7D,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YAC1D,aAAa,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;YACpD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAChE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACxE,OAAO,cAAc,CAAC,EAAE,EAAE;gBACxB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,YAAY;aACrB,CAAC,CAAC;QACL,CAAC;QAED,gEAAgE;QAChE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE;YACxB,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC;YAClB,YAAY,EAAE,GAAG;YACjB,YAAY,EAAE,EAAE,GAAG,EAAE;YACrB,eAAe,EAAE,EAAE;YACnB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAClD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAEjD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,kCAAkC;QAClC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACxE,OAAO,cAAc,CAAC,EAAE,EAAE;QACxB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAC;AACL,CAAC","sourcesContent":["/*\n Internal Better Auth instance — lazily created, not exported to templates.\n \n Templates interact with auth via the existing `getSession()`, `autoMountAuth()`,\n * `createAuthPlugin()`, and `createGoogleAuthPlugin()` APIs. Better Auth is an\n * implementation detail behind those interfaces.\n /\n\nimport crypto from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { betterAuth, type BetterAuthOptions } from \"better-auth\";\nimport { organization } from \"better-auth/plugins/organization\";\nimport { jwt } from \"better-auth/plugins/jwt\";\nimport { bearer } from \"better-auth/plugins/bearer\";\nimport { sendEmail, isEmailConfigured } from \"./email.js\";\nimport {\n renderResetPasswordEmail,\n renderVerifySignupEmail,\n} from \"./email-templates.js\";\nimport { getAppProductionUrl } from \"./app-url.js\";\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport { acceptPendingInvitationsForEmail } from \"../org/accept-pending.js\";\nimport { autoJoinDomainMatchingOrgs } from \"../org/auto-join-domain.js\";\nimport { saveOAuthTokens } from \"../oauth-tokens/store.js\";\nimport { identify, track } from \"../tracking/index.js\";\nimport {\n getDialect,\n getDatabaseUrl,\n getDatabaseAuthToken,\n} from \"../db/client.js\";\nimport {\n pgTable,\n text as pgText,\n timestamp as pgTimestamp,\n boolean as pgBoolean,\n} from \"drizzle-orm/pg-core\";\nimport {\n sqliteTable,\n text as sqliteText,\n integer as sqliteInteger,\n} from \"drizzle-orm/sqlite-core\";\n\n// ---------------------------------------------------------------------------\n// Persistent auth secret\n// ---------------------------------------------------------------------------\n\n/\n Resolve the Better Auth signing secret.\n \n Resolution order:\n * 1. `BETTER_AUTH_SECRET` env var — explicit, recommended for prod.\n * 2. `.env.local` in the template cwd — a per-workspace persistent secret\n * that the framework writes once on first boot when no secret is set.\n * Gitignored by convention (`.env` in template .gitignore files), so\n it's safe to persist credentials here.\n * 3. Generate a new random 32-byte hex, write it to `.env.local`, and use\n * it. Subsequent restarts re-read the same file — so session cookies\n * signed by a previous boot remain valid across dev-server restarts.\n \n Why this matters: before this helper existed, missing `BETTER_AUTH_SECRET`\n * fell through to `GOOGLE_CLIENT_SECRET` / `ACCESS_TOKEN` / a hardcoded\n * string. If a template happened to have none of those, each dev-server\n * boot would re-fall back to the hardcoded value (still stable) — but\n * rotating Google credentials, toggling `ACCESS_TOKEN`, or churning the\n * fallback chain would invalidate every signed cookie and force everyone\n * to sign in again. Pinning the secret to `.env.local` on first boot\n * removes that footgun.\n /\nfunction resolveAuthSecret(): string {\n if (process.env.BETTER_AUTH_SECRET) return process.env.BETTER_AUTH_SECRET;\n\n // In production, never auto-generate or fall back. A regenerated/derived\n // secret invalidates every signed session cookie on the next cold start\n // (serverless filesystems aren't persistent), and the legacy hardcoded\n // fallback is identical across every deploy that hits it — both are\n // serious enough to fail the boot loudly so the deployer notices.\n if (process.env.NODE_ENV === \"production\") {\n const sample = crypto.randomBytes(32).toString(\"hex\");\n throw new Error(\n \"[agent-native] BETTER_AUTH_SECRET is not set. This is required in production \" +\n \"so signed session cookies stay valid across deploys. Set it as a deploy \" +\n \"environment variable (any 32-byte hex string), e.g.:\\n\\n\" +\n ` BETTER_AUTH_SECRET=${sample}\\n\\n` +\n \"Generate your own with `openssl rand -hex 32`. If you already have a \" +\n \"running deploy on the legacy hardcoded fallback and need to preserve \" +\n \"existing sessions, set BETTER_AUTH_SECRET=agent-native-local-dev-secret-k9x2m7q4w8 \" +\n \"first, then rotate to a real value.\",\n );\n }\n\n // Dev: persist a generated secret to .env.local so sessions survive\n // dev-server restarts. Falls back to an in-memory random secret only if\n // the filesystem isn't writable (rare in dev, e.g. read-only mounts) —\n // sessions reset on every dev-process restart in that case, which is\n // fine.\n //\n // SECURITY (audit 09 LOW-2): the previous fallback chain\n // (`GOOGLE_CLIENT_SECRET \|\| ACCESS_TOKEN \|\| hardcoded`) reused\n // cross-purpose secrets and a public hardcoded literal as the cookie\n // HMAC. Dropped entirely — better to mint an ephemeral secret than to\n // re-use a Google client secret or a known string.\n try {\n const envLocalPath = path.resolve(process.cwd(), \".env.local\");\n const existing = readEnvLocalSecret(envLocalPath);\n if (existing) {\n process.env.BETTER_AUTH_SECRET = existing; // guard:allow-env-mutation — boot-time secret resolution from .env.local, runs once at module init\n return existing;\n }\n\n const generated = crypto.randomBytes(32).toString(\"hex\");\n appendEnvLocalSecret(envLocalPath, generated);\n process.env.BETTER_AUTH_SECRET = generated; // guard:allow-env-mutation — boot-time secret generation, runs once at module init before any request\n console.log(\n \"[agent-native] Generated a persistent BETTER_AUTH_SECRET in .env.local. \" +\n \"Sessions will now survive dev-server restarts. \" +\n \"(Delete .env.local to rotate; set BETTER_AUTH_SECRET in .env to override.)\",\n );\n return generated;\n } catch {\n // Filesystem unwritable (read-only mount, sandboxed test env, etc.).\n // Mint a per-process random secret so cookies stay unique per boot.\n // Sessions reset when the dev process restarts — acceptable for dev.\n const ephemeral = crypto.randomBytes(32).toString(\"hex\");\n console.warn(\n \"[agent-native] Could not persist BETTER_AUTH_SECRET to .env.local \" +\n \"(filesystem unwritable). Using an ephemeral in-memory secret. \" +\n \"Sessions will reset every time this process restarts. \" +\n \"Set BETTER_AUTH_SECRET in your environment to keep sessions valid across restarts.\",\n );\n return ephemeral;\n }\n}\n\nfunction readEnvLocalSecret(envLocalPath: string): string \| undefined {\n try {\n const content = fs.readFileSync(envLocalPath, \"utf8\");\n // Match `BETTER_AUTH_SECRET=...` on its own line. Tolerate optional\n // quotes and leading `export `. Stop at the first newline or quote.\n const m = content.match(\n /^(?:export\\s+)?BETTER_AUTH_SECRET\\s=\\s\"?([^\"\\r\\n]+)\"?\\s$/m,\n );\n return m?.[1]?.trim() \|\| undefined;\n } catch {\n return undefined;\n }\n}\n\nfunction appendEnvLocalSecret(envLocalPath: string, secret: string): void {\n const header =\n \"# Auto-generated by agent-native on first boot. Gitignored.\\n\" +\n \"# Keeps signed session cookies valid across dev-server restarts.\\n\" +\n \"# Delete this file (or this line) to rotate the secret.\\n\";\n const line = `BETTER_AUTH_SECRET=${secret}\\n`;\n\n // If the file already exists, just append; otherwise create with header.\n if (fs.existsSync(envLocalPath)) {\n const existing = fs.readFileSync(envLocalPath, \"utf8\");\n const needsLeadingNewline = existing.length > 0 && !existing.endsWith(\"\\n\");\n fs.appendFileSync(\n envLocalPath,\n (needsLeadingNewline ? \"\\n\" : \"\") + \"\\n\" + header + line,\n );\n } else {\n fs.writeFileSync(envLocalPath, header + line, { mode: 0o600 });\n }\n}\n\nexport function shouldSkipEmailVerification(): boolean {\n const value = process.env.AUTH_SKIP_EMAIL_VERIFICATION;\n if (value == null) {\n return (\n process.env.NODE_ENV === \"development\" \|\| process.env.NODE_ENV === \"test\"\n );\n }\n const normalized = value.trim().toLowerCase();\n return normalized !== \"\" && normalized !== \"0\" && normalized !== \"false\";\n}\n\n/** Read-only accessor for the resolved auth secret. /\nexport function getAuthSecret(): string {\n return resolveAuthSecret();\n}\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/* The shape we need from a Better Auth instance (internal — not exported to templates). /\nexport interface BetterAuthInstance {\n handler: (request: Request) => Promise<Response>;\n api: {\n getSession: (opts: { headers: Headers }) => Promise<{\n user: { id: string; email: string; name: string };\n session: {\n id: string;\n token: string;\n expiresAt: Date;\n activeOrganizationId?: string;\n };\n } \| null>;\n signInEmail: (opts: {\n body: { email: string; password: string };\n }) => Promise<{ token?: string; user?: any } \| null>;\n signUpEmail: (opts: {\n body: {\n email: string;\n password: string;\n name: string;\n callbackURL?: string;\n };\n }) => Promise<any>;\n signOut: (opts: { headers: Headers }) => Promise<any>;\n listOrganizations: (opts: { headers: Headers }) => Promise<any[] \| null>;\n };\n}\n\nexport interface BetterAuthConfig {\n /* Base path for Better Auth routes. Default: \"/_agent-native/auth/ba\" /\n basePath?: string;\n /* Additional social providers beyond what env vars auto-detect /\n socialProviders?: BetterAuthOptions[\"socialProviders\"];\n /* Additional Better Auth plugins /\n plugins?: BetterAuthOptions[\"plugins\"];\n /\n Additional Google OAuth scopes (Gmail, Calendar, etc.) to request\n * up front during the primary \"Sign in with Google\" flow, beyond the\n * default identity scopes (`openid`, `email`, `profile`).\n \n When set, the Google social provider also opts into:\n * - `accessType: \"offline\"` — so a refresh token is issued\n * - `prompt: \"consent\"` — so the refresh token is reissued every sign-in\n \n Tokens are mirrored into `oauth_tokens` via a databaseHooks.account\n * hook so existing template code that reads from `oauth_tokens` (mail's\n * Gmail client, calendar's events fetcher) works without any separate\n * \"Connect Google\" page.\n /\n googleScopes?: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Lazy instance\n// ---------------------------------------------------------------------------\n\nlet _auth: BetterAuthInstance \| undefined;\nlet _initPromise: Promise<BetterAuthInstance> \| undefined;\n// Track the Neon serverless Pool we open for Better Auth so closeBetterAuth()\n// can release it. The Pool keeps WebSocket connections open; leaking them on\n// hot-reload or process restart exhausts Neon's connection slot budget.\nlet _neonAuthPool: any;\n\nconst pgAuthSchema = {\n user: pgTable(\"user\", {\n id: pgText(\"id\").primaryKey(),\n name: pgText(\"name\").notNull(),\n email: pgText(\"email\").notNull().unique(),\n emailVerified: pgBoolean(\"email_verified\").notNull().default(false),\n image: pgText(\"image\"),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n session: pgTable(\"session\", {\n id: pgText(\"id\").primaryKey(),\n expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n token: pgText(\"token\").notNull().unique(),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n ipAddress: pgText(\"ip_address\"),\n userAgent: pgText(\"user_agent\"),\n userId: pgText(\"user_id\").notNull(),\n activeOrganizationId: pgText(\"active_organization_id\"),\n }),\n account: pgTable(\"account\", {\n id: pgText(\"id\").primaryKey(),\n accountId: pgText(\"account_id\").notNull(),\n providerId: pgText(\"provider_id\").notNull(),\n userId: pgText(\"user_id\").notNull(),\n accessToken: pgText(\"access_token\"),\n refreshToken: pgText(\"refresh_token\"),\n idToken: pgText(\"id_token\"),\n accessTokenExpiresAt: pgTimestamp(\"access_token_expires_at\", {\n withTimezone: true,\n }),\n refreshTokenExpiresAt: pgTimestamp(\"refresh_token_expires_at\", {\n withTimezone: true,\n }),\n scope: pgText(\"scope\"),\n password: pgText(\"password\"),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n verification: pgTable(\"verification\", {\n id: pgText(\"id\").primaryKey(),\n identifier: pgText(\"identifier\").notNull(),\n value: pgText(\"value\").notNull(),\n expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n organization: pgTable(\"organization\", {\n id: pgText(\"id\").primaryKey(),\n name: pgText(\"name\").notNull(),\n slug: pgText(\"slug\").notNull().unique(),\n logo: pgText(\"logo\"),\n metadata: pgText(\"metadata\"),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n member: pgTable(\"member\", {\n id: pgText(\"id\").primaryKey(),\n organizationId: pgText(\"organization_id\").notNull(),\n userId: pgText(\"user_id\").notNull(),\n role: pgText(\"role\").notNull().default(\"member\"),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n invitation: pgTable(\"invitation\", {\n id: pgText(\"id\").primaryKey(),\n organizationId: pgText(\"organization_id\").notNull(),\n email: pgText(\"email\").notNull(),\n role: pgText(\"role\"),\n status: pgText(\"status\").notNull().default(\"pending\"),\n expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n inviterId: pgText(\"inviter_id\").notNull(),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n jwks: pgTable(\"jwks\", {\n id: pgText(\"id\").primaryKey(),\n publicKey: pgText(\"public_key\").notNull(),\n privateKey: pgText(\"private_key\").notNull(),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }),\n }),\n};\n\nconst sqliteAuthSchema = {\n user: sqliteTable(\"user\", {\n id: sqliteText(\"id\").primaryKey(),\n name: sqliteText(\"name\").notNull(),\n email: sqliteText(\"email\").notNull().unique(),\n emailVerified: sqliteInteger(\"email_verified\", { mode: \"boolean\" })\n .notNull()\n .default(false),\n image: sqliteText(\"image\"),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n session: sqliteTable(\"session\", {\n id: sqliteText(\"id\").primaryKey(),\n expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n token: sqliteText(\"token\").notNull().unique(),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n ipAddress: sqliteText(\"ip_address\"),\n userAgent: sqliteText(\"user_agent\"),\n userId: sqliteText(\"user_id\").notNull(),\n activeOrganizationId: sqliteText(\"active_organization_id\"),\n }),\n account: sqliteTable(\"account\", {\n id: sqliteText(\"id\").primaryKey(),\n accountId: sqliteText(\"account_id\").notNull(),\n providerId: sqliteText(\"provider_id\").notNull(),\n userId: sqliteText(\"user_id\").notNull(),\n accessToken: sqliteText(\"access_token\"),\n refreshToken: sqliteText(\"refresh_token\"),\n idToken: sqliteText(\"id_token\"),\n accessTokenExpiresAt: sqliteInteger(\"access_token_expires_at\", {\n mode: \"timestamp_ms\",\n }),\n refreshTokenExpiresAt: sqliteInteger(\"refresh_token_expires_at\", {\n mode: \"timestamp_ms\",\n }),\n scope: sqliteText(\"scope\"),\n password: sqliteText(\"password\"),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n verification: sqliteTable(\"verification\", {\n id: sqliteText(\"id\").primaryKey(),\n identifier: sqliteText(\"identifier\").notNull(),\n value: sqliteText(\"value\").notNull(),\n expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n organization: sqliteTable(\"organization\", {\n id: sqliteText(\"id\").primaryKey(),\n name: sqliteText(\"name\").notNull(),\n slug: sqliteText(\"slug\").notNull().unique(),\n logo: sqliteText(\"logo\"),\n metadata: sqliteText(\"metadata\"),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n member: sqliteTable(\"member\", {\n id: sqliteText(\"id\").primaryKey(),\n organizationId: sqliteText(\"organization_id\").notNull(),\n userId: sqliteText(\"user_id\").notNull(),\n role: sqliteText(\"role\").notNull().default(\"member\"),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n invitation: sqliteTable(\"invitation\", {\n id: sqliteText(\"id\").primaryKey(),\n organizationId: sqliteText(\"organization_id\").notNull(),\n email: sqliteText(\"email\").notNull(),\n role: sqliteText(\"role\"),\n status: sqliteText(\"status\").notNull().default(\"pending\"),\n expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n inviterId: sqliteText(\"inviter_id\").notNull(),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n jwks: sqliteTable(\"jwks\", {\n id: sqliteText(\"id\").primaryKey(),\n publicKey: sqliteText(\"public_key\").notNull(),\n privateKey: sqliteText(\"private_key\").notNull(),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }),\n }),\n};\n\nfunction getBetterAuthSchema() {\n return isPostgres() ? pgAuthSchema : sqliteAuthSchema;\n}\n\n/\n Mirror a Better Auth `account` row for Google into the `oauth_tokens`\n * table that template code (mail's Gmail client, calendar's events fetcher)\n * reads from. Called from the `databaseHooks.account.create.after` and\n * `.update.after` hooks so tokens captured during the primary \"Sign in\n * with Google\" flow flow straight to the apps that need them — no\n * separate \"Connect Google\" page required.\n \n Resolves `account.userId` to the user's email by querying the `user`\n * table (Better Auth always quotes \"user\" because it's a reserved word\n * in Postgres; SQLite accepts the quotes too).\n \n The hook is fire-and-forget from the caller's perspective — every\n * failure is caught upstream so a flake in `oauth_tokens` never blocks\n * sign-in. We still no-op on missing fields here as a defense in depth.\n /\nasync function mirrorGoogleAccountToOAuthTokens(account: {\n providerId?: string;\n userId?: string;\n accountId?: string;\n accessToken?: string \| null;\n refreshToken?: string \| null;\n accessTokenExpiresAt?: Date \| string \| number \| null;\n scope?: string \| null;\n idToken?: string \| null;\n}): Promise<void> {\n if (!account \|\| account.providerId !== \"google\") return;\n if (!account.userId) return;\n\n const accessToken = account.accessToken ?? undefined;\n if (!accessToken) {\n // Better Auth sometimes upserts an account row before tokens are\n // attached (e.g. linking flows). Nothing to mirror yet — the next\n // update hook will run once the access token lands.\n return;\n }\n\n // Resolve user email from userId.\n const db = getDbExec();\n let email: string \| undefined;\n try {\n const { rows } = await db.execute({\n sql: 'SELECT email FROM \"user\" WHERE id = ?',\n args: [account.userId],\n });\n email = (rows[0]?.email as string \| undefined) ?? undefined;\n } catch (err) {\n console.error(\n \"[auth] mirror Google tokens: failed to resolve user email from userId\",\n err,\n );\n return;\n }\n if (!email) return;\n\n // Normalise expiry to epoch ms (Google's \"expiry_date\" convention used\n // throughout the templates).\n let expiryDate: number \| undefined;\n const raw = account.accessTokenExpiresAt;\n if (raw instanceof Date) {\n expiryDate = raw.getTime();\n } else if (typeof raw === \"number\") {\n expiryDate = raw;\n } else if (typeof raw === \"string\") {\n const ms = Date.parse(raw);\n expiryDate = Number.isFinite(ms) ? ms : undefined;\n }\n\n const tokens: Record<string, unknown> = {\n access_token: accessToken,\n token_type: \"Bearer\",\n };\n if (account.refreshToken) tokens.refresh_token = account.refreshToken;\n if (expiryDate) tokens.expiry_date = expiryDate;\n if (account.scope) tokens.scope = account.scope;\n if (account.idToken) tokens.id_token = account.idToken;\n\n await saveOAuthTokens(\"google\", email, tokens, email);\n}\n\nasync function ensureBetterAuthTables(): Promise<void> {\n const db = getDbExec();\n const statements = isPostgres()\n ? [\n `CREATE TABLE IF NOT EXISTS \"user\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified BOOLEAN NOT NULL DEFAULT FALSE, image TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"session\" (id TEXT PRIMARY KEY, expires_at TIMESTAMPTZ NOT NULL, token TEXT NOT NULL UNIQUE, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n `CREATE TABLE IF NOT EXISTS \"account\" (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at TIMESTAMPTZ, refresh_token_expires_at TIMESTAMPTZ, scope TEXT, password TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"verification\" (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"organization\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"member\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"invitation\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at TIMESTAMPTZ NOT NULL, inviter_id TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"jwks\" (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, expires_at TIMESTAMPTZ)`,\n ]\n : [\n `CREATE TABLE IF NOT EXISTS user (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified INTEGER NOT NULL DEFAULT 0, image TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS session (id TEXT PRIMARY KEY, expires_at INTEGER NOT NULL, token TEXT NOT NULL UNIQUE, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n `CREATE TABLE IF NOT EXISTS account (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at INTEGER, refresh_token_expires_at INTEGER, scope TEXT, password TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS verification (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at INTEGER NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS organization (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS member (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS invitation (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at INTEGER NOT NULL, inviter_id TEXT NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS jwks (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at INTEGER NOT NULL, expires_at INTEGER)`,\n ];\n\n for (const sql of statements) await db.execute(sql);\n}\n\n/\n Get or create the Better Auth instance.\n * Lazily initialized on first call — the database must be reachable by then.\n /\nexport async function getBetterAuth(\n config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n if (_auth) return _auth;\n if (_initPromise) return _initPromise;\n\n _initPromise = createBetterAuthInstance(config);\n _auth = await _initPromise;\n return _auth;\n}\n\n/\n Synchronous getter — returns the instance if already initialized, else undefined.\n * Use this in hot paths where you know init has already happened.\n /\nexport function getBetterAuthSync(): BetterAuthInstance \| undefined {\n return _auth;\n}\n\n/* Reset for testing /\nexport async function resetBetterAuth(): Promise<void> {\n _auth = undefined;\n _initPromise = undefined;\n if (_neonAuthPool) {\n try {\n await _neonAuthPool.end();\n } catch {\n // Pool may have already closed (process exiting, etc.) — don't block reset.\n }\n _neonAuthPool = undefined;\n }\n}\n\n// ---------------------------------------------------------------------------\n// Instance creation\n// ---------------------------------------------------------------------------\n\nasync function createBetterAuthInstance(\n config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n const dialect = getDialect();\n const basePath = config?.basePath ?? \"/_agent-native/auth/ba\";\n await ensureBetterAuthTables();\n\n // Build social providers from env vars\n const socialProviders: BetterAuthOptions[\"socialProviders\"] = {\n ...config?.socialProviders,\n };\n\n if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {\n // When the template requests broader scopes (Gmail, Calendar, etc.)\n // ask for them on the primary sign-in flow so a separate \"Connect\n // Google\" round-trip isn't needed. `accessType: \"offline\"` plus\n // `prompt: \"consent\"` ensures we always receive a refresh token back —\n // Google only re-issues a refresh token on consent, so re-signing in\n // (e.g. after switching machines) would otherwise leave us with an\n // access token that can't be refreshed.\n const extraScopes = config?.googleScopes ?? [];\n const baseScopes = [\"openid\", \"email\", \"profile\"];\n const mergedScopes = Array.from(new Set([...baseScopes, ...extraScopes]));\n socialProviders.google = {\n clientId: process.env.GOOGLE_CLIENT_ID,\n clientSecret: process.env.GOOGLE_CLIENT_SECRET,\n ...(extraScopes.length > 0\n ? {\n scope: mergedScopes,\n accessType: \"offline\" as const,\n prompt: \"consent\" as const,\n }\n : {}),\n };\n }\n\n if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {\n socialProviders.github = {\n clientId: process.env.GITHUB_CLIENT_ID,\n clientSecret: process.env.GITHUB_CLIENT_SECRET,\n };\n }\n\n // Build database config\n const database = await buildDatabaseConfig(dialect);\n\n const secret = resolveAuthSecret();\n\n const appUrl = getAppProductionUrl();\n const requireEmailVerification =\n isEmailConfigured() && !shouldSkipEmailVerification();\n\n const auth = betterAuth({\n basePath,\n baseURL: appUrl,\n database,\n secret,\n emailAndPassword: {\n enabled: true,\n minPasswordLength: 8,\n // Only require email verification when an email provider is configured.\n // Without a provider, verification emails can't be sent, so requiring\n // verification would lock users out of signup entirely. Local dev/test\n // skip verification by default so +qa accounts can be created quickly;\n // hosted QA deployments can opt out with AUTH_SKIP_EMAIL_VERIFICATION=1.\n requireEmailVerification,\n sendResetPassword: async ({ user, token }) => {\n // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n // reset link must include that prefix so the page resolves correctly.\n const appBasePath = (\n process.env.VITE_APP_BASE_PATH \|\|\n process.env.APP_BASE_PATH \|\|\n \"\"\n ).replace(/\\/$/, \"\");\n const resetUrl = `${appUrl}${appBasePath}/_agent-native/auth/reset?token=${encodeURIComponent(token)}`;\n const { subject, html, text } = renderResetPasswordEmail({\n email: user.email,\n resetUrl,\n });\n await sendEmail({ to: user.email, subject, html, text });\n },\n },\n emailVerification: {\n // Fire verification email right after signup, before the user has a\n // session — pairs with requireEmailVerification above. Only enabled\n // when an email provider is configured.\n sendOnSignUp: requireEmailVerification,\n // Auto-create a session once the user clicks the link. Without this,\n // verified users would have to go back and sign in manually, which is\n // a confusing dead-end on the verify screen.\n autoSignInAfterVerification: true,\n sendVerificationEmail: async ({ user, url }) => {\n // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n // verification link must include that prefix so the page resolves correctly.\n const verifyBasePath = (\n process.env.VITE_APP_BASE_PATH \|\|\n process.env.APP_BASE_PATH \|\|\n \"\"\n ).replace(/\\/$/, \"\");\n const verifyUrl = verifyBasePath\n ? url.replace(/(\\/\\/[^/]+)(\\/)/, `$1${verifyBasePath}$2`)\n : url;\n const { subject, html, text } = renderVerifySignupEmail({\n email: user.email,\n verifyUrl,\n });\n await sendEmail({ to: user.email, subject, html, text });\n },\n },\n socialProviders,\n account: {\n // Merge accounts when a user signs in with a social provider using an\n // email that already has a local email/password account (or vice versa).\n // Only providers listed in `trustedProviders` auto-link — these are the\n // ones that verify emails at the identity layer. Never add a provider\n // here that lets users claim an unverified email; that would be an\n // account-takeover vector.\n accountLinking: {\n enabled: true,\n trustedProviders: [\"google\", \"github\"],\n },\n },\n databaseHooks: {\n user: {\n create: {\n after: async (user: {\n id?: string;\n email?: string;\n name?: string \| null;\n }) => {\n // When a newly-created user's email has pending org invitations\n // (common when someone is invited before* they've signed up),\n // auto-accept them so the user lands in the org on their very\n // first page load instead of a blank-slate workspace.\n const email = user?.email;\n if (!email) return;\n identify(email, {\n email,\n name: user.name ?? undefined,\n authUserId: user.id,\n });\n track(\n \"signup\",\n {\n auth_provider: \"better-auth\",\n auth_user_id: user.id,\n },\n { userId: email },\n );\n try {\n await acceptPendingInvitationsForEmail(email);\n } catch (err) {\n // Never block signup on invite bookkeeping — log and continue.\n console.error(\n \"[auth] failed to auto-accept pending invitations\",\n err,\n );\n }\n try {\n // Auto-join orgs whose `allowed_domain` matches this email\n // domain. Lets a fresh `@builder.io` (or any org-domain)\n // signup land inside the company org on first page load\n // without going through the picker. No-ops when no match.\n await autoJoinDomainMatchingOrgs(email);\n } catch (err) {\n console.error(\n \"[auth] failed to auto-join domain-matching orgs\",\n err,\n );\n }\n },\n },\n },\n account: {\n // Mirror Google account tokens into `oauth_tokens` so existing\n // template code (mail's Gmail client, calendar's events fetcher)\n // can pick up Gmail/Calendar credentials from the primary sign-in\n // flow — no separate \"Set up Google\" page required.\n //\n // Better Auth fires `create` for first-time social sign-in and\n // `update` whenever a session re-issues tokens (e.g., the user\n // re-signs in to refresh the token). Both branches do the same\n // mirroring work; failures never block sign-in.\n create: {\n after: async (account: any) => {\n await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n console.error(\n \"[auth] failed to mirror Google account tokens to oauth_tokens (create)\",\n err,\n );\n });\n },\n },\n update: {\n after: async (account: any) => {\n await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n console.error(\n \"[auth] failed to mirror Google account tokens to oauth_tokens (update)\",\n err,\n );\n });\n },\n },\n },\n },\n session: {\n expiresIn: 60 * 60 * 24 * 30, // 30 days\n updateAge: 60 * 60 * 24, // refresh daily\n cookieCache: {\n enabled: true,\n maxAge: 5 * 60, // 5 min cache\n },\n },\n advanced: {\n cookiePrefix: \"an\",\n // Emit `SameSite=None; Secure` when the app is served over HTTPS so\n // session cookies are delivered inside third-party iframes (e.g. the\n // Builder.io editor). Plain-HTTP dev keeps the default (Lax) because\n // `SameSite=None` requires Secure.\n ...(appUrl.startsWith(\"https://\")\n ? {\n defaultCookieAttributes: {\n sameSite: \"none\" as const,\n secure: true,\n partitioned: true,\n },\n }\n : {}),\n },\n plugins: [\n // Organizations: many:many user:org, roles, invitations\n organization(),\n // JWT: issue tokens for A2A calls, JWKS endpoint for verification\n jwt({\n jwt: {\n issuer: appUrl,\n expirationTime: \"15m\",\n },\n }),\n // Bearer: accept Bearer tokens on API requests\n bearer(),\n ...(config?.plugins ?? []),\n ],\n });\n\n return auth as unknown as BetterAuthInstance;\n}\n\nasync function buildDatabaseConfig(\n dialect: string,\n): Promise<BetterAuthOptions[\"database\"]> {\n if (dialect === \"postgres\") {\n const url = getDatabaseUrl();\n const { isNeonUrl } = await import(\"../db/create-get-db.js\");\n\n // Neon via @neondatabase/serverless (WebSockets over HTTPS). postgres-js\n // opens a raw TCP connection on port 5432 which frequently times out on\n // Netlify Functions / Vercel / CF Workers when Neon's pooler is cold.\n if (isNeonUrl(url)) {\n const { Pool } = await import(\"@neondatabase/serverless\");\n _neonAuthPool = new Pool({ connectionString: url });\n const { drizzle } = await import(\"drizzle-orm/neon-serverless\");\n const db = drizzle(_neonAuthPool, { schema: pgAuthSchema });\n const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n return drizzleAdapter(db, {\n provider: \"pg\",\n schema: pgAuthSchema,\n });\n }\n\n // Non-Neon Postgres (Supabase, self-hosted, etc.) → postgres-js\n const { default: postgres } = await import(\"postgres\");\n const sql = postgres(url, {\n onnotice: () => {},\n idle_timeout: 240,\n max_lifetime: 60 * 30,\n connect_timeout: 10,\n ...(url.includes(\"supabase\") ? { prepare: false } : {}),\n });\n const { drizzle } = await import(\"drizzle-orm/postgres-js\");\n const db = drizzle(sql, { schema: pgAuthSchema });\n const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n return drizzleAdapter(db, {\n provider: \"pg\",\n schema: pgAuthSchema,\n });\n }\n\n // SQLite / libsql\n const url = getDatabaseUrl(\"file:./data/app.db\");\n\n if (url.startsWith(\"file:\") \|\| !url.includes(\"://\")) {\n // Local SQLite via better-sqlite3\n const { default: Database } = await import(\"better-sqlite3\");\n const filePath = url.replace(/^file:/, \"\");\n const sqlite = new Database(filePath);\n sqlite.pragma(\"journal_mode = WAL\");\n const { drizzle } = await import(\"drizzle-orm/better-sqlite3\");\n const db = drizzle(sqlite, { schema: sqliteAuthSchema });\n const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n return drizzleAdapter(db, {\n provider: \"sqlite\",\n schema: sqliteAuthSchema,\n });\n }\n\n // Remote libsql (Turso). Use the web client to avoid serverless bundles\n // depending on libsql's platform-specific native packages.\n const { createClient } = await import(\"@libsql/client/web\");\n const client = createClient({ url, authToken: getDatabaseAuthToken() });\n const { drizzle } = await import(\"drizzle-orm/libsql/web\");\n const db = drizzle(client, { schema: sqliteAuthSchema });\n const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n return drizzleAdapter(db, {\n provider: \"sqlite\",\n schema: sqliteAuthSchema,\n });\n}\n"]}

package/dist/server/google-auth-plugin.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"google-auth-plugin.d.ts","sourceRoot":"","sources":["../../src/server/google-auth-plugin.ts"],"names":[],"mappings":"AAEA,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;~~AA6KD~~;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,CAAC,EAAE,uBAAuB,GAChC,cAAc,CAUhB"}
1	+ {"version":3,"file":"google-auth-plugin.d.ts","sourceRoot":"","sources":["../../src/server/google-auth-plugin.ts"],"names":[],"mappings":"AAEA,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AA4ND;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,CAAC,EAAE,uBAAuB,GAChC,cAAc,CAUhB"}

package/dist/server/google-auth-plugin.js CHANGED Viewed

@@ -46,6 +46,15 @@ const GOOGLE_LOGIN_HTML = `<!DOCTYPE html>
   button:disabled { opacity: 0.5; cursor: wait; }
   .error { margin-top: 0.75rem; font-size: 0.8125rem; color: #f87171; display: none; }
   .error.show { display: block; }
+  .debug {
+    display: none;
+    margin-top: 0.625rem;
+    font-size: 0.6875rem;
+    line-height: 1.45;
+    color: #777;
+    word-break: break-word;
+  }
+  .debug.show { display: block; }
   svg { width: 18px; height: 18px; }
 </style>
 </head>
@@ -58,6 +67,7 @@ const GOOGLE_LOGIN_HTML = `<!DOCTYPE html>
     Sign in with Google
   </button>
   <p class="error" id="err"></p>
+  <p class="debug" id="debug"></p>
 </div>
 <script>
   function __anBasePath() {
@@ -81,6 +91,7 @@ const GOOGLE_LOGIN_HTML = `<!DOCTYPE html>
     }
   }
   var __anOAuthPollTimer = null;
+  var __anOAuthPollCount = 0;
   function __anNewOAuthFlowId() {
     try {
       if (window.crypto && typeof window.crypto.randomUUID === 'function') {
@@ -89,6 +100,20 @@ const GOOGLE_LOGIN_HTML = `<!DOCTYPE html>
     } catch(e) {}
     return 'builder-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2);
   }
+  function __anFlowDebugId(flowId) {
+    return flowId ? String(flowId).slice(-10) : '';
+  }
+  function __anSetOAuthDebug(message, flowId) {
+    var text = message + (flowId ? ' (flow ' + __anFlowDebugId(flowId) + ')' : '');
+    try {
+      console.info('[agent-native][google-oauth]', { message: message, flow: __anFlowDebugId(flowId) || undefined });
+    } catch(e) {}
+    var debug = document.getElementById('debug');
+    if (debug) {
+      debug.textContent = text;
+      debug.classList.add('show');
+    }
+  }
   function __anShowOAuthError(err, btn, message) {
     if (__anOAuthPollTimer) {
       clearInterval(__anOAuthPollTimer);
@@ -101,23 +126,34 @@ const GOOGLE_LOGIN_HTML = `<!DOCTYPE html>
   function __anWaitForOAuthExchange(flowId, ret, btn, err) {
     var started = Date.now();
     var timeoutMs = 5 * 60 * 1000;
+    __anOAuthPollCount = 0;
     async function check() {
+      __anOAuthPollCount++;
       try {
         var res = await fetch(__anPath('/_agent-native/auth/desktop-exchange') + '?flow_id=' + encodeURIComponent(flowId), { credentials: 'include' });
         var data = await res.json().catch(function() { return {}; });
         if (data && (data.email || data.token)) {
           if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);
           __anOAuthPollTimer = null;
+          __anSetOAuthDebug('OAuth exchange redeemed; returning to the app', flowId);
           window.location.href = ret || '/';
           return;
         }
         if (data && data.error) {
+          __anSetOAuthDebug('OAuth exchange returned an error: ' + (data.message || data.error), flowId);
           __anShowOAuthError(err, btn, data.message || data.error);
           return;
         }
-      } catch(e) {}
+        if (data && data.pending && (__anOAuthPollCount === 1 || __anOAuthPollCount % 5 === 0)) {
+          __anSetOAuthDebug('Waiting for the Google callback; polling attempt ' + __anOAuthPollCount, flowId);
+        }
+      } catch(e) {
+        if (__anOAuthPollCount === 1 || __anOAuthPollCount % 5 === 0) {
+          __anSetOAuthDebug('Could not reach the OAuth exchange endpoint: ' + (e && e.message ? e.message : 'network error'), flowId);
+        }
+      }
       if (Date.now() - started > timeoutMs) {
-        __anShowOAuthError(err, btn, 'Google sign-in did not finish. Allow popups and try again.');
+        __anShowOAuthError(err, btn, 'Google sign-in did not finish. Flow ' + __anFlowDebugId(flowId) + ' never redeemed; check server logs for [agent-native][google-oauth].');
       }
     }
     if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);
@@ -133,7 +169,18 @@ const GOOGLE_LOGIN_HTML = `<!DOCTYPE html>
     params.set('redirect', '1');
     var url = __anPath('/_agent-native/google/auth-url') + '?' + params.toString();
     try { sessionStorage.setItem('__an_signin', '1'); } catch(e) {}
-    try { window.open(url, '_blank', 'noopener,noreferrer,width=640,height=760'); } catch(e) {}
+    __anSetOAuthDebug('Opening Google sign-in popup', flowId);
+    try {
+      var popup = window.open(url, '_blank', 'noopener,noreferrer,width=640,height=760');
+      if (!popup) {
+        __anShowOAuthError(err, btn, 'Google popup was blocked. Allow popups for this site and try again (flow ' + __anFlowDebugId(flowId) + ').');
+        return;
+      }
+      __anSetOAuthDebug('Google popup opened; waiting for callback', flowId);
+    } catch(e) {
+      __anShowOAuthError(err, btn, 'Could not open Google popup for flow ' + __anFlowDebugId(flowId) + ': ' + (e && e.message ? e.message : 'unknown error'));
+      return;
+    }
     __anWaitForOAuthExchange(flowId, ret, btn, err);
   }
   function __anOpenOAuthUrl(url) {

package/dist/server/google-auth-plugin.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"google-auth-plugin.js","sourceRoot":"","sources":["../../src/server/google-auth-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AASpD,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAyKlB,CAAC;AAET;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAiC;IAEjC,OAAO,gBAAgB,CAAC;QACtB,WAAW,EAAE;YACX,gCAAgC;YAChC,gCAAgC;YAChC,wBAAwB;YACxB,GAAG,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;SAChC;QACD,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { createAuthPlugin } from \"./auth-plugin.js\";\n\ntype NitroPluginDef = (nitroApp: any) => void \| Promise<void>;\n\nexport interface GoogleAuthPluginOptions {\n /** Additional paths accessible without authentication /\n publicPaths?: string[];\n}\n\nconst GOOGLE_LOGIN_HTML = `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"UTF-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no\">\n<title>Sign in</title>\n<style>\n , ::before, ::after { box-sizing: border-box; margin: 0; padding: 0; }\n body {\n font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n background: #0a0a0a;\n color: #e5e5e5;\n display: flex;\n align-items: center;\n justify-content: center;\n min-height: 100vh;\n }\n .card {\n width: 100%;\n max-width: 360px;\n padding: 2rem;\n background: #141414;\n border: 1px solid rgba(255,255,255,0.08);\n border-radius: 12px;\n text-align: center;\n }\n h1 { font-size: 1.125rem; font-weight: 600; margin-bottom: 0.5rem; color: #fff; }\n .subtitle { font-size: 0.8125rem; color: #888; margin-bottom: 1.5rem; }\n button {\n width: 100%;\n display: flex;\n align-items: center;\n justify-content: center;\n gap: 0.625rem;\n padding: 0.625rem;\n background: #fff;\n color: #000;\n border: none;\n border-radius: 8px;\n font-size: 0.9375rem;\n font-weight: 500;\n cursor: pointer;\n }\n button:hover { opacity: 0.85; }\n button:disabled { opacity: 0.5; cursor: wait; }\n .error { margin-top: 0.75rem; font-size: 0.8125rem; color: #f87171; display: none; }\n .error.show { display: block; }\n svg { width: 18px; height: 18px; }\n</style>\n</head>\n<body>\n<div class=\"card\">\n <h1>Sign in</h1>\n <p class=\"subtitle\">Continue with your Google account</p>\n <button id=\"btn\" onclick=\"signIn()\">\n <svg viewBox=\"0 0 24 24\"><path fill=\"#4285F4\" d=\"M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92a5.06 5.06 0 0 1-2.2 3.32v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.1z\"/><path fill=\"#34A853\" d=\"M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z\"/><path fill=\"#FBBC05\" d=\"M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z\"/><path fill=\"#EA4335\" d=\"M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z\"/></svg>\n Sign in with Google\n </button>\n <p class=\"error\" id=\"err\"></p>\n</div>\n<script>\n function __anBasePath() {\n var marker = '/_agent-native';\n var idx = window.location.pathname.indexOf(marker);\n return idx > 0 ? window.location.pathname.slice(0, idx) : '';\n }\n function __anPath(path) {\n return __anBasePath() + path;\n }\n function __anIsBuilderPreview() {\n try {\n var params = new URLSearchParams(window.location.search);\n if (params.has('builder.preview') \|\| params.has('builder.frameEditing') \|\| params.has('__builder_editing__')) return true;\n } catch(e) {}\n try {\n var ref = document.referrer \|\| '';\n return ref.indexOf('builder.io') !== -1 \|\| ref.indexOf('builder.my') !== -1 \|\| ref.indexOf('builderio.xyz') !== -1;\n } catch(e) {\n return false;\n }\n }\n var __anOAuthPollTimer = null;\n function __anNewOAuthFlowId() {\n try {\n if (window.crypto && typeof window.crypto.randomUUID === 'function') {\n return window.crypto.randomUUID();\n }\n } catch(e) {}\n return 'builder-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2);\n }\n function __anShowOAuthError(err, btn, message) {\n if (__anOAuthPollTimer) {\n clearInterval(__anOAuthPollTimer);\n __anOAuthPollTimer = null;\n }\n err.textContent = message;\n err.classList.add('show');\n btn.disabled = false;\n }\n function __anWaitForOAuthExchange(flowId, ret, btn, err) {\n var started = Date.now();\n var timeoutMs = 5 * 60 * 1000;\n async function check() {\n try {\n var res = await fetch(__anPath('/_agent-native/auth/desktop-exchange') + '?flow_id=' + encodeURIComponent(flowId), { credentials: 'include' });\n var data = await res.json().catch(function() { return {}; });\n if (data && (data.email \|\| data.token)) {\n if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);\n __anOAuthPollTimer = null;\n window.location.href = ret \|\| '/';\n return;\n }\n if (data && data.error) {\n __anShowOAuthError(err, btn, data.message \|\| data.error);\n return;\n }\n } catch(e) {}\n if (Date.now() - started > timeoutMs) {\n __anShowOAuthError(err, btn, 'Google sign-in did not finish. Allow popups and try again.');\n }\n }\n if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);\n __anOAuthPollTimer = setInterval(check, 1000);\n setTimeout(check, 500);\n }\n function __anStartBuilderOAuth(ret, btn, err) {\n var flowId = __anNewOAuthFlowId();\n var params = new URLSearchParams();\n if (ret) params.set('return', ret);\n params.set('desktop', '1');\n params.set('flow_id', flowId);\n params.set('redirect', '1');\n var url = __anPath('/_agent-native/google/auth-url') + '?' + params.toString();\n try { sessionStorage.setItem('__an_signin', '1'); } catch(e) {}\n try { window.open(url, '_blank', 'noopener,noreferrer,width=640,height=760'); } catch(e) {}\n __anWaitForOAuthExchange(flowId, ret, btn, err);\n }\n function __anOpenOAuthUrl(url) {\n try { sessionStorage.setItem('__an_signin', '1'); } catch(e) {}\n window.location.href = url;\n }\n async function signIn() {\n var btn = document.getElementById('btn');\n var err = document.getElementById('err');\n var ret = window.location.pathname + window.location.search;\n btn.disabled = true;\n err.classList.remove('show');\n if (__anIsBuilderPreview()) {\n __anStartBuilderOAuth(ret, btn, err);\n return;\n }\n try {\n var res = await fetch(__anPath('/_agent-native/google/auth-url') + '?return=' + encodeURIComponent(ret));\n var data = await res.json();\n if (data.url) {\n __anOpenOAuthUrl(data.url);\n } else {\n err.textContent = data.message \|\| 'Google OAuth is not configured. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.';\n err.classList.add('show');\n btn.disabled = false;\n }\n } catch (e) {\n err.textContent = 'Failed to connect. Please try again.';\n err.classList.add('show');\n btn.disabled = false;\n }\n }\n</script>\n</body>\n</html>`;\n\n/*\n Create an auth plugin that uses Google OAuth for authentication.\n \n When a user visits the app unauthenticated, they see a \"Sign in with Google\"\n * page. The Google OAuth callback (handled by the template) creates a session\n * tied to the user's Google email. `getSession()` then returns `{ email }` for\n * all subsequent requests.\n \n Better Auth handles Google OAuth internally when GOOGLE_CLIENT_ID and\n * GOOGLE_CLIENT_SECRET are set. The template's callback route at\n * /_agent-native/google/callback handles mobile deep linking.\n \n Usage in a template's `server/plugins/auth.ts`:\n * ```ts\n * import { createGoogleAuthPlugin } from \"@agent-native/core/server\";\n * export default createGoogleAuthPlugin();\n * ```\n */\nexport function createGoogleAuthPlugin(\n options?: GoogleAuthPluginOptions,\n): NitroPluginDef {\n return createAuthPlugin({\n publicPaths: [\n \"/_agent-native/google/callback\",\n \"/_agent-native/google/auth-url\",\n \"/_agent-native/auth/ba\",\n ...(options?.publicPaths ?? []),\n ],\n loginHtml: GOOGLE_LOGIN_HTML,\n });\n}\n"]}
1	+ {"version":3,"file":"google-auth-plugin.js","sourceRoot":"","sources":["../../src/server/google-auth-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AASpD,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAwNlB,CAAC;AAET;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAiC;IAEjC,OAAO,gBAAgB,CAAC;QACtB,WAAW,EAAE;YACX,gCAAgC;YAChC,gCAAgC;YAChC,wBAAwB;YACxB,GAAG,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;SAChC;QACD,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { createAuthPlugin } from \"./auth-plugin.js\";\n\ntype NitroPluginDef = (nitroApp: any) => void \| Promise<void>;\n\nexport interface GoogleAuthPluginOptions {\n /** Additional paths accessible without authentication /\n publicPaths?: string[];\n}\n\nconst GOOGLE_LOGIN_HTML = `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"UTF-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no\">\n<title>Sign in</title>\n<style>\n , ::before, ::after { box-sizing: border-box; margin: 0; padding: 0; }\n body {\n font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n background: #0a0a0a;\n color: #e5e5e5;\n display: flex;\n align-items: center;\n justify-content: center;\n min-height: 100vh;\n }\n .card {\n width: 100%;\n max-width: 360px;\n padding: 2rem;\n background: #141414;\n border: 1px solid rgba(255,255,255,0.08);\n border-radius: 12px;\n text-align: center;\n }\n h1 { font-size: 1.125rem; font-weight: 600; margin-bottom: 0.5rem; color: #fff; }\n .subtitle { font-size: 0.8125rem; color: #888; margin-bottom: 1.5rem; }\n button {\n width: 100%;\n display: flex;\n align-items: center;\n justify-content: center;\n gap: 0.625rem;\n padding: 0.625rem;\n background: #fff;\n color: #000;\n border: none;\n border-radius: 8px;\n font-size: 0.9375rem;\n font-weight: 500;\n cursor: pointer;\n }\n button:hover { opacity: 0.85; }\n button:disabled { opacity: 0.5; cursor: wait; }\n .error { margin-top: 0.75rem; font-size: 0.8125rem; color: #f87171; display: none; }\n .error.show { display: block; }\n .debug {\n display: none;\n margin-top: 0.625rem;\n font-size: 0.6875rem;\n line-height: 1.45;\n color: #777;\n word-break: break-word;\n }\n .debug.show { display: block; }\n svg { width: 18px; height: 18px; }\n</style>\n</head>\n<body>\n<div class=\"card\">\n <h1>Sign in</h1>\n <p class=\"subtitle\">Continue with your Google account</p>\n <button id=\"btn\" onclick=\"signIn()\">\n <svg viewBox=\"0 0 24 24\"><path fill=\"#4285F4\" d=\"M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92a5.06 5.06 0 0 1-2.2 3.32v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.1z\"/><path fill=\"#34A853\" d=\"M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z\"/><path fill=\"#FBBC05\" d=\"M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z\"/><path fill=\"#EA4335\" d=\"M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z\"/></svg>\n Sign in with Google\n </button>\n <p class=\"error\" id=\"err\"></p>\n <p class=\"debug\" id=\"debug\"></p>\n</div>\n<script>\n function __anBasePath() {\n var marker = '/_agent-native';\n var idx = window.location.pathname.indexOf(marker);\n return idx > 0 ? window.location.pathname.slice(0, idx) : '';\n }\n function __anPath(path) {\n return __anBasePath() + path;\n }\n function __anIsBuilderPreview() {\n try {\n var params = new URLSearchParams(window.location.search);\n if (params.has('builder.preview') \|\| params.has('builder.frameEditing') \|\| params.has('__builder_editing__')) return true;\n } catch(e) {}\n try {\n var ref = document.referrer \|\| '';\n return ref.indexOf('builder.io') !== -1 \|\| ref.indexOf('builder.my') !== -1 \|\| ref.indexOf('builderio.xyz') !== -1;\n } catch(e) {\n return false;\n }\n }\n var __anOAuthPollTimer = null;\n var __anOAuthPollCount = 0;\n function __anNewOAuthFlowId() {\n try {\n if (window.crypto && typeof window.crypto.randomUUID === 'function') {\n return window.crypto.randomUUID();\n }\n } catch(e) {}\n return 'builder-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2);\n }\n function __anFlowDebugId(flowId) {\n return flowId ? String(flowId).slice(-10) : '';\n }\n function __anSetOAuthDebug(message, flowId) {\n var text = message + (flowId ? ' (flow ' + __anFlowDebugId(flowId) + ')' : '');\n try {\n console.info('[agent-native][google-oauth]', { message: message, flow: __anFlowDebugId(flowId) \|\| undefined });\n } catch(e) {}\n var debug = document.getElementById('debug');\n if (debug) {\n debug.textContent = text;\n debug.classList.add('show');\n }\n }\n function __anShowOAuthError(err, btn, message) {\n if (__anOAuthPollTimer) {\n clearInterval(__anOAuthPollTimer);\n __anOAuthPollTimer = null;\n }\n err.textContent = message;\n err.classList.add('show');\n btn.disabled = false;\n }\n function __anWaitForOAuthExchange(flowId, ret, btn, err) {\n var started = Date.now();\n var timeoutMs = 5 * 60 * 1000;\n __anOAuthPollCount = 0;\n async function check() {\n __anOAuthPollCount++;\n try {\n var res = await fetch(__anPath('/_agent-native/auth/desktop-exchange') + '?flow_id=' + encodeURIComponent(flowId), { credentials: 'include' });\n var data = await res.json().catch(function() { return {}; });\n if (data && (data.email \|\| data.token)) {\n if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);\n __anOAuthPollTimer = null;\n __anSetOAuthDebug('OAuth exchange redeemed; returning to the app', flowId);\n window.location.href = ret \|\| '/';\n return;\n }\n if (data && data.error) {\n __anSetOAuthDebug('OAuth exchange returned an error: ' + (data.message \|\| data.error), flowId);\n __anShowOAuthError(err, btn, data.message \|\| data.error);\n return;\n }\n if (data && data.pending && (__anOAuthPollCount === 1 \|\| __anOAuthPollCount % 5 === 0)) {\n __anSetOAuthDebug('Waiting for the Google callback; polling attempt ' + __anOAuthPollCount, flowId);\n }\n } catch(e) {\n if (__anOAuthPollCount === 1 \|\| __anOAuthPollCount % 5 === 0) {\n __anSetOAuthDebug('Could not reach the OAuth exchange endpoint: ' + (e && e.message ? e.message : 'network error'), flowId);\n }\n }\n if (Date.now() - started > timeoutMs) {\n __anShowOAuthError(err, btn, 'Google sign-in did not finish. Flow ' + __anFlowDebugId(flowId) + ' never redeemed; check server logs for [agent-native][google-oauth].');\n }\n }\n if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);\n __anOAuthPollTimer = setInterval(check, 1000);\n setTimeout(check, 500);\n }\n function __anStartBuilderOAuth(ret, btn, err) {\n var flowId = __anNewOAuthFlowId();\n var params = new URLSearchParams();\n if (ret) params.set('return', ret);\n params.set('desktop', '1');\n params.set('flow_id', flowId);\n params.set('redirect', '1');\n var url = __anPath('/_agent-native/google/auth-url') + '?' + params.toString();\n try { sessionStorage.setItem('__an_signin', '1'); } catch(e) {}\n __anSetOAuthDebug('Opening Google sign-in popup', flowId);\n try {\n var popup = window.open(url, '_blank', 'noopener,noreferrer,width=640,height=760');\n if (!popup) {\n __anShowOAuthError(err, btn, 'Google popup was blocked. Allow popups for this site and try again (flow ' + __anFlowDebugId(flowId) + ').');\n return;\n }\n __anSetOAuthDebug('Google popup opened; waiting for callback', flowId);\n } catch(e) {\n __anShowOAuthError(err, btn, 'Could not open Google popup for flow ' + __anFlowDebugId(flowId) + ': ' + (e && e.message ? e.message : 'unknown error'));\n return;\n }\n __anWaitForOAuthExchange(flowId, ret, btn, err);\n }\n function __anOpenOAuthUrl(url) {\n try { sessionStorage.setItem('__an_signin', '1'); } catch(e) {}\n window.location.href = url;\n }\n async function signIn() {\n var btn = document.getElementById('btn');\n var err = document.getElementById('err');\n var ret = window.location.pathname + window.location.search;\n btn.disabled = true;\n err.classList.remove('show');\n if (__anIsBuilderPreview()) {\n __anStartBuilderOAuth(ret, btn, err);\n return;\n }\n try {\n var res = await fetch(__anPath('/_agent-native/google/auth-url') + '?return=' + encodeURIComponent(ret));\n var data = await res.json();\n if (data.url) {\n __anOpenOAuthUrl(data.url);\n } else {\n err.textContent = data.message \|\| 'Google OAuth is not configured. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.';\n err.classList.add('show');\n btn.disabled = false;\n }\n } catch (e) {\n err.textContent = 'Failed to connect. Please try again.';\n err.classList.add('show');\n btn.disabled = false;\n }\n }\n</script>\n</body>\n</html>`;\n\n/*\n Create an auth plugin that uses Google OAuth for authentication.\n \n When a user visits the app unauthenticated, they see a \"Sign in with Google\"\n * page. The Google OAuth callback (handled by the template) creates a session\n * tied to the user's Google email. `getSession()` then returns `{ email }` for\n * all subsequent requests.\n \n Better Auth handles Google OAuth internally when GOOGLE_CLIENT_ID and\n * GOOGLE_CLIENT_SECRET are set. The template's callback route at\n * /_agent-native/google/callback handles mobile deep linking.\n \n Usage in a template's `server/plugins/auth.ts`:\n * ```ts\n * import { createGoogleAuthPlugin } from \"@agent-native/core/server\";\n * export default createGoogleAuthPlugin();\n * ```\n */\nexport function createGoogleAuthPlugin(\n options?: GoogleAuthPluginOptions,\n): NitroPluginDef {\n return createAuthPlugin({\n publicPaths: [\n \"/_agent-native/google/callback\",\n \"/_agent-native/google/auth-url\",\n \"/_agent-native/auth/ba\",\n ...(options?.publicPaths ?? []),\n ],\n loginHtml: GOOGLE_LOGIN_HTML,\n });\n}\n"]}

package/dist/server/google-oauth.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"google-oauth.d.ts","sourceRoot":"","sources":["../../src/server/google-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;~~AA6CZ~~;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD;AAED,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhD;AAsBD;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAsBhD;AASD,uEAAuE;AACvE,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAED,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAM,GAAG,MAAM,CAG5D;AAgED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,OAAO,GACb,OAAO,CAqCT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,WAAW,SAAmC,GAC7C,MAAM,GAAG,IAAI,CAMf;AAID,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA6CD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAAC;AACxE,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,EACjB,UAAU,CAAC,EAAE,OAAO,EACpB,GAAG,CAAC,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC;AA0CV;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAqCnB;AAID,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,EACd,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAQ3B;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,oBAAoB,EAAE,OAAO,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GACA,OAAO,CAAC,kBAAkB,CAAC,CA2B7B;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,~~CA0FpE~~;AAED;;;kEAGkE;AAClE,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAMxD;AAED,wBAAgB,wBAAwB,CACtC,OAAO,SAA4B,GAClC,QAAQ,CAKV"}
1	+ {"version":3,"file":"google-oauth.d.ts","sourceRoot":"","sources":["../../src/server/google-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAwDZ;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD;AAED,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhD;AAsBD;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAsBhD;AASD,uEAAuE;AACvE,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAED,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAM,GAAG,MAAM,CAG5D;AAgED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,OAAO,GACb,OAAO,CAqCT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,WAAW,SAAmC,GAC7C,MAAM,GAAG,IAAI,CAMf;AAID,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA6CD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAAC;AACxE,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,EACjB,UAAU,CAAC,EAAE,OAAO,EACpB,GAAG,CAAC,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC;AA0CV;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAqCnB;AAID,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,EACd,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAQ3B;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,oBAAoB,EAAE,OAAO,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GACA,OAAO,CAAC,kBAAkB,CAAC,CA2B7B;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,CA4FpE;AAED;;;kEAGkE;AAClE,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAMxD;AAED,wBAAgB,wBAAwB,CACtC,OAAO,SAA4B,GAClC,QAAQ,CAKV"}

package/dist/server/google-oauth.js CHANGED Viewed

@@ -25,8 +25,14 @@ function htmlResponse(html, status = 200) {
  *  check icon above the message, with a little breathing room between the
  *  headline and secondary line. Used by every template that goes through the
  *  shared Google OAuth flow. */
-function oauthSuccessCloseTabHtml(headline, footnote) {
-    return `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connected</title></head><body style="background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column"><svg width="44" height="44" viewBox="0 0 24 24" fill="none" stroke="#22c55e" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="margin-bottom:14px" aria-hidden="true"><circle cx="12" cy="12" r="10"/><path d="M9 12l2 2l4 -4"/></svg><p style="font-size:16px;margin:0 0 12px 0">${headline}</p><p style="font-size:13px;color:#888;margin:0">${footnote}</p><script>setTimeout(function(){try{window.close()}catch(e){}},250)</script></body></html>`;
+function oauthDebugFlowId(flowId) {
+    return flowId ? flowId.slice(-10) : undefined;
+}
+function oauthSuccessCloseTabHtml(headline, footnote, debugFlowId) {
+    const debug = debugFlowId
+        ? `<p style="font-size:11px;color:#555;margin:12px 0 0 0">Debug flow: ${escapeHtml(debugFlowId)}</p>`
+        : "";
+    return `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connected</title></head><body style="background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column"><svg width="44" height="44" viewBox="0 0 24 24" fill="none" stroke="#22c55e" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="margin-bottom:14px" aria-hidden="true"><circle cx="12" cy="12" r="10"/><path d="M9 12l2 2l4 -4"/></svg><p style="font-size:16px;margin:0 0 12px 0">${headline}</p><p style="font-size:13px;color:#888;margin:0">${footnote}</p>${debug}<script>console.info("[agent-native][google-oauth] success page loaded",{flow:${JSON.stringify(debugFlowId || null)}});setTimeout(function(){try{window.close()}catch(e){}},250)</script></body></html>`;
 }
 /**
  * HTML escape — minimal but covers the cases that matter when interpolating
@@ -447,7 +453,7 @@ export function oauthCallbackResponse(event, email, opts) {
         const safeEmail = email ? escapeHtml(email) : "";
         const safeAppName = escapeHtml(resolveOAuthAppName(opts.appName));
         const msg = safeEmail ? `Connected ${safeEmail}!` : "Connected!";
-        return htmlResponse(oauthSuccessCloseTabHtml(msg, `You can close this tab and return to ${safeAppName}.`));
+        return htmlResponse(oauthSuccessCloseTabHtml(msg, `You can close this tab and return to ${safeAppName}.`, oauthDebugFlowId(opts.flowId)));
     }
     // Electron desktop exchange flow: mail/calendar still pass a flow id so the
     // renderer can poll as a fallback, but the main handoff should use the
@@ -461,7 +467,7 @@ export function oauthCallbackResponse(event, email, opts) {
         const safeEmail = email ? escapeHtml(email) : "";
         const safeAppName = escapeHtml(resolveOAuthAppName(opts.appName));
         const msg = safeEmail ? `Signed in as ${safeEmail}!` : "Signed in!";
-        return htmlResponse(oauthSuccessCloseTabHtml(msg, `You can close this tab and return to ${safeAppName}.`));
+        return htmlResponse(oauthSuccessCloseTabHtml(msg, `You can close this tab and return to ${safeAppName}.`, oauthDebugFlowId(opts.flowId)));
     }
     // Desktop login: deep link back to Electron app — only when the callback
     // request actually carries the AgentNativeDesktop UA marker. Without this