@agent-native/core 0.13.1 → 0.14.1

package/dist/server/better-auth-instance.js

@@ -658,6 +658,19 @@ async function createBetterAuthInstance(config) {
                     },
                 }
                 : {}),
+            // When `COOKIE_DOMAIN` is set, share Better Auth's session cookie
+            // across every subdomain matching that domain. Pairs with the legacy
+            // framework cookie's matching `Domain=` attribute (auth.ts) so that
+            // signing into one first-party app (e.g. mail.agent-native.com)
+            // signs the user into all sibling apps without re-authenticating.
+            ...(process.env.COOKIE_DOMAIN
+                ? {
+                    crossSubDomainCookies: {
+                        enabled: true,
+                        domain: process.env.COOKIE_DOMAIN,
+                    },
+                }
+                : {}),
         },
         plugins: [
             // Organizations: many:many user:org, roles, invitations

package/dist/server/better-auth-instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"better-auth-instance.js","sourceRoot":"","sources":["../../src/server/better-auth-instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,UAAU,EACV,cAAc,EACd,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,OAAO,EACP,IAAI,IAAI,MAAM,EACd,SAAS,IAAI,WAAW,EACxB,OAAO,IAAI,SAAS,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,IAAI,IAAI,UAAU,EAClB,OAAO,IAAI,aAAa,GACzB,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,iBAAiB;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAE1E,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,+EAA+E;YAC7E,0EAA0E;YAC1E,0DAA0D;YAC1D,wBAAwB,MAAM,MAAM;YACpC,uEAAuE;YACvE,uEAAuE;YACvE,qFAAqF;YACrF,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,QAAQ;IACR,EAAE;IACF,yDAAyD;IACzD,+DAA+D;IAC/D,qEAAqE;IACrE,sEAAsE;IACtE,mDAAmD;IACnD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,QAAQ,CAAC,CAAC,mGAAmG;YAC9I,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC,sGAAsG;QAClJ,OAAO,CAAC,GAAG,CACT,0EAA0E;YACxE,iDAAiD;YACjD,4EAA4E,CAC/E,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CACV,oEAAoE;YAClE,gEAAgE;YAChE,wDAAwD;YACxD,oFAAoF,CACvF,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtD,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CACrB,8DAA8D,CAC/D,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAoB,EAAE,MAAc;IAChE,MAAM,MAAM,GACV,+DAA+D;QAC/D,oEAAoE;QACpE,2DAA2D,CAAC;IAC9D,MAAM,IAAI,GAAG,sBAAsB,MAAM,IAAI,CAAC;IAE9C,yEAAyE;IACzE,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5E,EAAE,CAAC,cAAc,CACf,YAAY,EACZ,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CACzD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACvD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,OAAO,CAAC;AAC3E,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AA2DD,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,IAAI,KAAqC,CAAC;AAC1C,IAAI,YAAqD,CAAC;AAC1D,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACxE,IAAI,aAAkB,CAAC;AAEvB,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,aAAa,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,oBAAoB,EAAE,MAAM,CAAC,wBAAwB,CAAC;KACvD,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;QACnC,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC;QACrC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;QAC3B,oBAAoB,EAAE,WAAW,CAAC,yBAAyB,EAAE;YAC3D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,qBAAqB,EAAE,WAAW,CAAC,0BAA0B,EAAE;YAC7D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACvC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE;QACxB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE;QAChC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;KAC7D,CAAC;CACH,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,aAAa,EAAE,aAAa,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aAChE,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;QACjB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,UAAU,CAAC,wBAAwB,CAAC;KAC3D,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,WAAW,EAAE,UAAU,CAAC,cAAc,CAAC;QACvC,YAAY,EAAE,UAAU,CAAC,eAAe,CAAC;QACzC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC;QAC/B,oBAAoB,EAAE,aAAa,CAAC,yBAAyB,EAAE;YAC7D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,qBAAqB,EAAE,aAAa,CAAC,0BAA0B,EAAE;YAC/D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC9C,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC3C,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC5B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,UAAU,EAAE,WAAW,CAAC,YAAY,EAAE;QACpC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACzD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;KACjE,CAAC;CACH,CAAC;AAEF,SAAS,mBAAmB;IAC1B,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,gCAAgC,CAAC,OAS/C;IACC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO;IACxD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO;IAE5B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iEAAiE;QACjE,kEAAkE;QAClE,oDAAoD;QACpD,OAAO;IACT,CAAC;IAED,kCAAkC;IAClC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAChC,GAAG,EAAE,uCAAuC;YAC5C,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACvB,CAAC,CAAC;QACH,KAAK,GAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAA4B,IAAI,SAAS,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,uEAAuE,EACvE,GAAG,CACJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,uEAAuE;IACvE,6BAA6B;IAC7B,IAAI,UAA8B,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC;IACzC,IAAI,GAAG,YAAY,IAAI,EAAE,CAAC;QACxB,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,UAAU,GAAG,GAAG,CAAC;IACnB,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAA4B;QACtC,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;KACrB,CAAC;IACF,IAAI,OAAO,CAAC,YAAY;QAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IACtE,IAAI,UAAU;QAAE,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC;IAChD,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAEvD,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,sBAAsB;IACnC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,UAAU,EAAE;QAC7B,CAAC,CAAC;YACE,sOAAsO;YACtO,iRAAiR;YACjR,sWAAsW;YACtW,mNAAmN;YACnN,4MAA4M;YAC5M,wNAAwN;YACxN,mSAAmS;YACnS,uKAAuK;SACxK;QACH,CAAC,CAAC;YACE,wNAAwN;YACxN,mQAAmQ;YACnQ,oVAAoV;YACpV,qMAAqM;YACrM,kMAAkM;YAClM,8MAA8M;YAC9M,qRAAqR;YACrR,6JAA6J;SAC9J,CAAC;IAEN,KAAK,MAAM,GAAG,IAAI,UAAU;QAAE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB;IAEzB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,YAAY,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAChD,KAAK,GAAG,MAAM,YAAY,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,KAAK,GAAG,SAAS,CAAC;IAClB,YAAY,GAAG,SAAS,CAAC;IACzB,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;QACD,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,KAAK,UAAU,wBAAwB,CACrC,MAAyB;IAEzB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,wBAAwB,CAAC;IAC9D,MAAM,sBAAsB,EAAE,CAAC;IAE/B,uCAAuC;IACvC,MAAM,eAAe,GAAyC;QAC5D,GAAG,MAAM,EAAE,eAAe;KAC3B,CAAC;IAEF,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,wCAAwC;QACxC,MAAM,WAAW,GAAG,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC1E,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAC9C,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC;oBACE,KAAK,EAAE,YAAY;oBACnB,UAAU,EAAE,SAAkB;oBAC9B,MAAM,EAAE,SAAkB;iBAC3B;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;SAC/C,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,wBAAwB,GAC5B,iBAAiB,EAAE,IAAI,CAAC,2BAA2B,EAAE,CAAC;IAExD,MAAM,IAAI,GAAG,UAAU,CAAC;QACtB,QAAQ;QACR,OAAO,EAAE,MAAM;QACf,QAAQ;QACR,MAAM;QACN,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,CAAC;YACpB,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,wBAAwB;YACxB,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC3C,qEAAqE;gBACrE,sEAAsE;gBACtE,MAAM,WAAW,GAAG,CAClB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,WAAW,mCAAmC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAC;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ;iBACT,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,oEAAoE;YACpE,oEAAoE;YACpE,wCAAwC;YACxC,YAAY,EAAE,wBAAwB;YACtC,qEAAqE;YACrE,sEAAsE;YACtE,6CAA6C;YAC7C,2BAA2B,EAAE,IAAI;YACjC,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC7C,qEAAqE;gBACrE,6EAA6E;gBAC7E,MAAM,cAAc,GAAG,CACrB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,SAAS,GAAG,cAAc;oBAC9B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,cAAc,IAAI,CAAC;oBACzD,CAAC,CAAC,GAAG,CAAC;gBACR,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC;oBACtD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS;iBACV,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,eAAe;QACf,OAAO,EAAE;YACP,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,mEAAmE;YACnE,2BAA2B;YAC3B,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;aACvC;SACF;QACD,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,IAIb,EAAE,EAAE;wBACH,gEAAgE;wBAChE,+DAA+D;wBAC/D,8DAA8D;wBAC9D,sDAAsD;wBACtD,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;wBAC1B,IAAI,CAAC,KAAK;4BAAE,OAAO;wBACnB,QAAQ,CAAC,KAAK,EAAE;4BACd,KAAK;4BACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS;4BAC5B,UAAU,EAAE,IAAI,CAAC,EAAE;yBACpB,CAAC,CAAC;wBACH,KAAK,CACH,QAAQ,EACR;4BACE,aAAa,EAAE,aAAa;4BAC5B,YAAY,EAAE,IAAI,CAAC,EAAE;yBACtB,EACD,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;wBACF,IAAI,CAAC;4BACH,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;wBAChD,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,+DAA+D;4BAC/D,OAAO,CAAC,KAAK,CACX,kDAAkD,EAClD,GAAG,CACJ,CAAC;wBACJ,CAAC;wBACD,IAAI,CAAC;4BACH,2DAA2D;4BAC3D,yDAAyD;4BACzD,wDAAwD;4BACxD,0DAA0D;4BAC1D,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;wBAC1C,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,OAAO,CAAC,KAAK,CACX,iDAAiD,EACjD,GAAG,CACJ,CAAC;wBACJ,CAAC;oBACH,CAAC;iBACF;aACF;YACD,OAAO,EAAE;gBACP,+DAA+D;gBAC/D,iEAAiE;gBACjE,kEAAkE;gBAClE,oDAAoD;gBACpD,EAAE;gBACF,+DAA+D;gBAC/D,+DAA+D;gBAC/D,+DAA+D;gBAC/D,gDAAgD;gBAChD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;gBACD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;aACF;SACF;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU;YACxC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,gBAAgB;YACzC,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,cAAc;aAC/B;SACF;QACD,QAAQ,EAAE;YACR,YAAY,EAAE,IAAI;YAClB,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,mCAAmC;YACnC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC/B,CAAC,CAAC;oBACE,uBAAuB,EAAE;wBACvB,QAAQ,EAAE,MAAe;wBACzB,MAAM,EAAE,IAAI;wBACZ,WAAW,EAAE,IAAI;qBAClB;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,OAAO,EAAE;YACP,wDAAwD;YACxD,YAAY,EAAE;YACd,kEAAkE;YAClE,GAAG,CAAC;gBACF,GAAG,EAAE;oBACH,MAAM,EAAE,MAAM;oBACd,cAAc,EAAE,KAAK;iBACtB;aACF,CAAC;YACF,+CAA+C;YAC/C,MAAM,EAAE;YACR,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC3B;KACF,CAAC,CAAC;IAEH,OAAO,IAAqC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAe;IAEf,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAE7D,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YAC1D,aAAa,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;YACpD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAChE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACxE,OAAO,cAAc,CAAC,EAAE,EAAE;gBACxB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,YAAY;aACrB,CAAC,CAAC;QACL,CAAC;QAED,gEAAgE;QAChE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE;YACxB,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC;YAClB,YAAY,EAAE,GAAG;YACjB,YAAY,EAAE,EAAE,GAAG,EAAE;YACrB,eAAe,EAAE,EAAE;YACnB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAClD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAEjD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,kCAAkC;QAClC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACxE,OAAO,cAAc,CAAC,EAAE,EAAE;QACxB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Internal Better Auth instance — lazily created, not exported to templates.\n *\n * Templates interact with auth via the existing `getSession()`, `autoMountAuth()`,\n * `createAuthPlugin()`, and `createGoogleAuthPlugin()` APIs. Better Auth is an\n * implementation detail behind those interfaces.\n */\n\nimport crypto from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { betterAuth, type BetterAuthOptions } from \"better-auth\";\nimport { organization } from \"better-auth/plugins/organization\";\nimport { jwt } from \"better-auth/plugins/jwt\";\nimport { bearer } from \"better-auth/plugins/bearer\";\nimport { sendEmail, isEmailConfigured } from \"./email.js\";\nimport {\n  renderResetPasswordEmail,\n  renderVerifySignupEmail,\n} from \"./email-templates.js\";\nimport { getAppProductionUrl } from \"./app-url.js\";\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport { acceptPendingInvitationsForEmail } from \"../org/accept-pending.js\";\nimport { autoJoinDomainMatchingOrgs } from \"../org/auto-join-domain.js\";\nimport { saveOAuthTokens } from \"../oauth-tokens/store.js\";\nimport { identify, track } from \"../tracking/index.js\";\nimport {\n  getDialect,\n  getDatabaseUrl,\n  getDatabaseAuthToken,\n} from \"../db/client.js\";\nimport {\n  pgTable,\n  text as pgText,\n  timestamp as pgTimestamp,\n  boolean as pgBoolean,\n} from \"drizzle-orm/pg-core\";\nimport {\n  sqliteTable,\n  text as sqliteText,\n  integer as sqliteInteger,\n} from \"drizzle-orm/sqlite-core\";\n\n// ---------------------------------------------------------------------------\n// Persistent auth secret\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve the Better Auth signing secret.\n *\n * Resolution order:\n *   1. `BETTER_AUTH_SECRET` env var — explicit, recommended for prod.\n *   2. `.env.local` in the template cwd — a per-workspace persistent secret\n *      that the framework writes once on first boot when no secret is set.\n *      Gitignored by convention (`.env*` in template .gitignore files), so\n *      it's safe to persist credentials here.\n *   3. Generate a new random 32-byte hex, write it to `.env.local`, and use\n *      it. Subsequent restarts re-read the same file — so session cookies\n *      signed by a previous boot remain valid across dev-server restarts.\n *\n * Why this matters: before this helper existed, missing `BETTER_AUTH_SECRET`\n * fell through to `GOOGLE_CLIENT_SECRET` / `ACCESS_TOKEN` / a hardcoded\n * string. If a template happened to have none of those, each dev-server\n * boot would re-fall back to the hardcoded value (still stable) — but\n * rotating Google credentials, toggling `ACCESS_TOKEN`, or churning the\n * fallback chain would invalidate every signed cookie and force everyone\n * to sign in again. Pinning the secret to `.env.local` on first boot\n * removes that footgun.\n */\nfunction resolveAuthSecret(): string {\n  if (process.env.BETTER_AUTH_SECRET) return process.env.BETTER_AUTH_SECRET;\n\n  // In production, never auto-generate or fall back. A regenerated/derived\n  // secret invalidates every signed session cookie on the next cold start\n  // (serverless filesystems aren't persistent), and the legacy hardcoded\n  // fallback is identical across every deploy that hits it — both are\n  // serious enough to fail the boot loudly so the deployer notices.\n  if (process.env.NODE_ENV === \"production\") {\n    const sample = crypto.randomBytes(32).toString(\"hex\");\n    throw new Error(\n      \"[agent-native] BETTER_AUTH_SECRET is not set. This is required in production \" +\n        \"so signed session cookies stay valid across deploys. Set it as a deploy \" +\n        \"environment variable (any 32-byte hex string), e.g.:\\n\\n\" +\n        `  BETTER_AUTH_SECRET=${sample}\\n\\n` +\n        \"Generate your own with `openssl rand -hex 32`. If you already have a \" +\n        \"running deploy on the legacy hardcoded fallback and need to preserve \" +\n        \"existing sessions, set BETTER_AUTH_SECRET=agent-native-local-dev-secret-k9x2m7q4w8 \" +\n        \"first, then rotate to a real value.\",\n    );\n  }\n\n  // Dev: persist a generated secret to .env.local so sessions survive\n  // dev-server restarts. Falls back to an in-memory random secret only if\n  // the filesystem isn't writable (rare in dev, e.g. read-only mounts) —\n  // sessions reset on every dev-process restart in that case, which is\n  // fine.\n  //\n  // SECURITY (audit 09 LOW-2): the previous fallback chain\n  // (`GOOGLE_CLIENT_SECRET || ACCESS_TOKEN || hardcoded`) reused\n  // cross-purpose secrets and a public hardcoded literal as the cookie\n  // HMAC. Dropped entirely — better to mint an ephemeral secret than to\n  // re-use a Google client secret or a known string.\n  try {\n    const envLocalPath = path.resolve(process.cwd(), \".env.local\");\n    const existing = readEnvLocalSecret(envLocalPath);\n    if (existing) {\n      process.env.BETTER_AUTH_SECRET = existing; // guard:allow-env-mutation — boot-time secret resolution from .env.local, runs once at module init\n      return existing;\n    }\n\n    const generated = crypto.randomBytes(32).toString(\"hex\");\n    appendEnvLocalSecret(envLocalPath, generated);\n    process.env.BETTER_AUTH_SECRET = generated; // guard:allow-env-mutation — boot-time secret generation, runs once at module init before any request\n    console.log(\n      \"[agent-native] Generated a persistent BETTER_AUTH_SECRET in .env.local. \" +\n        \"Sessions will now survive dev-server restarts. \" +\n        \"(Delete .env.local to rotate; set BETTER_AUTH_SECRET in .env to override.)\",\n    );\n    return generated;\n  } catch {\n    // Filesystem unwritable (read-only mount, sandboxed test env, etc.).\n    // Mint a per-process random secret so cookies stay unique per boot.\n    // Sessions reset when the dev process restarts — acceptable for dev.\n    const ephemeral = crypto.randomBytes(32).toString(\"hex\");\n    console.warn(\n      \"[agent-native] Could not persist BETTER_AUTH_SECRET to .env.local \" +\n        \"(filesystem unwritable). Using an ephemeral in-memory secret. \" +\n        \"Sessions will reset every time this process restarts. \" +\n        \"Set BETTER_AUTH_SECRET in your environment to keep sessions valid across restarts.\",\n    );\n    return ephemeral;\n  }\n}\n\nfunction readEnvLocalSecret(envLocalPath: string): string | undefined {\n  try {\n    const content = fs.readFileSync(envLocalPath, \"utf8\");\n    // Match `BETTER_AUTH_SECRET=...` on its own line. Tolerate optional\n    // quotes and leading `export `. Stop at the first newline or quote.\n    const m = content.match(\n      /^(?:export\\s+)?BETTER_AUTH_SECRET\\s*=\\s*\"?([^\"\\r\\n]+)\"?\\s*$/m,\n    );\n    return m?.[1]?.trim() || undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction appendEnvLocalSecret(envLocalPath: string, secret: string): void {\n  const header =\n    \"# Auto-generated by agent-native on first boot. Gitignored.\\n\" +\n    \"# Keeps signed session cookies valid across dev-server restarts.\\n\" +\n    \"# Delete this file (or this line) to rotate the secret.\\n\";\n  const line = `BETTER_AUTH_SECRET=${secret}\\n`;\n\n  // If the file already exists, just append; otherwise create with header.\n  if (fs.existsSync(envLocalPath)) {\n    const existing = fs.readFileSync(envLocalPath, \"utf8\");\n    const needsLeadingNewline = existing.length > 0 && !existing.endsWith(\"\\n\");\n    fs.appendFileSync(\n      envLocalPath,\n      (needsLeadingNewline ? \"\\n\" : \"\") + \"\\n\" + header + line,\n    );\n  } else {\n    fs.writeFileSync(envLocalPath, header + line, { mode: 0o600 });\n  }\n}\n\nexport function shouldSkipEmailVerification(): boolean {\n  const value = process.env.AUTH_SKIP_EMAIL_VERIFICATION;\n  if (value == null) {\n    return (\n      process.env.NODE_ENV === \"development\" || process.env.NODE_ENV === \"test\"\n    );\n  }\n  const normalized = value.trim().toLowerCase();\n  return normalized !== \"\" && normalized !== \"0\" && normalized !== \"false\";\n}\n\n/** Read-only accessor for the resolved auth secret. */\nexport function getAuthSecret(): string {\n  return resolveAuthSecret();\n}\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/** The shape we need from a Better Auth instance (internal — not exported to templates). */\nexport interface BetterAuthInstance {\n  handler: (request: Request) => Promise<Response>;\n  api: {\n    getSession: (opts: { headers: Headers }) => Promise<{\n      user: { id: string; email: string; name: string };\n      session: {\n        id: string;\n        token: string;\n        expiresAt: Date;\n        activeOrganizationId?: string;\n      };\n    } | null>;\n    signInEmail: (opts: {\n      body: { email: string; password: string };\n    }) => Promise<{ token?: string; user?: any } | null>;\n    signUpEmail: (opts: {\n      body: {\n        email: string;\n        password: string;\n        name: string;\n        callbackURL?: string;\n      };\n    }) => Promise<any>;\n    signOut: (opts: { headers: Headers }) => Promise<any>;\n    listOrganizations: (opts: { headers: Headers }) => Promise<any[] | null>;\n  };\n}\n\nexport interface BetterAuthConfig {\n  /** Base path for Better Auth routes. Default: \"/_agent-native/auth/ba\" */\n  basePath?: string;\n  /** Additional social providers beyond what env vars auto-detect */\n  socialProviders?: BetterAuthOptions[\"socialProviders\"];\n  /** Additional Better Auth plugins */\n  plugins?: BetterAuthOptions[\"plugins\"];\n  /**\n   * Additional Google OAuth scopes (Gmail, Calendar, etc.) to request\n   * up front during the primary \"Sign in with Google\" flow, beyond the\n   * default identity scopes (`openid`, `email`, `profile`).\n   *\n   * When set, the Google social provider also opts into:\n   * - `accessType: \"offline\"` — so a refresh token is issued\n   * - `prompt: \"consent\"` — so the refresh token is reissued every sign-in\n   *\n   * Tokens are mirrored into `oauth_tokens` via a databaseHooks.account\n   * hook so existing template code that reads from `oauth_tokens` (mail's\n   * Gmail client, calendar's events fetcher) works without any separate\n   * \"Connect Google\" page.\n   */\n  googleScopes?: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Lazy instance\n// ---------------------------------------------------------------------------\n\nlet _auth: BetterAuthInstance | undefined;\nlet _initPromise: Promise<BetterAuthInstance> | undefined;\n// Track the Neon serverless Pool we open for Better Auth so closeBetterAuth()\n// can release it. The Pool keeps WebSocket connections open; leaking them on\n// hot-reload or process restart exhausts Neon's connection slot budget.\nlet _neonAuthPool: any;\n\nconst pgAuthSchema = {\n  user: pgTable(\"user\", {\n    id: pgText(\"id\").primaryKey(),\n    name: pgText(\"name\").notNull(),\n    email: pgText(\"email\").notNull().unique(),\n    emailVerified: pgBoolean(\"email_verified\").notNull().default(false),\n    image: pgText(\"image\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  session: pgTable(\"session\", {\n    id: pgText(\"id\").primaryKey(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    token: pgText(\"token\").notNull().unique(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n    ipAddress: pgText(\"ip_address\"),\n    userAgent: pgText(\"user_agent\"),\n    userId: pgText(\"user_id\").notNull(),\n    activeOrganizationId: pgText(\"active_organization_id\"),\n  }),\n  account: pgTable(\"account\", {\n    id: pgText(\"id\").primaryKey(),\n    accountId: pgText(\"account_id\").notNull(),\n    providerId: pgText(\"provider_id\").notNull(),\n    userId: pgText(\"user_id\").notNull(),\n    accessToken: pgText(\"access_token\"),\n    refreshToken: pgText(\"refresh_token\"),\n    idToken: pgText(\"id_token\"),\n    accessTokenExpiresAt: pgTimestamp(\"access_token_expires_at\", {\n      withTimezone: true,\n    }),\n    refreshTokenExpiresAt: pgTimestamp(\"refresh_token_expires_at\", {\n      withTimezone: true,\n    }),\n    scope: pgText(\"scope\"),\n    password: pgText(\"password\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  verification: pgTable(\"verification\", {\n    id: pgText(\"id\").primaryKey(),\n    identifier: pgText(\"identifier\").notNull(),\n    value: pgText(\"value\").notNull(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  organization: pgTable(\"organization\", {\n    id: pgText(\"id\").primaryKey(),\n    name: pgText(\"name\").notNull(),\n    slug: pgText(\"slug\").notNull().unique(),\n    logo: pgText(\"logo\"),\n    metadata: pgText(\"metadata\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  member: pgTable(\"member\", {\n    id: pgText(\"id\").primaryKey(),\n    organizationId: pgText(\"organization_id\").notNull(),\n    userId: pgText(\"user_id\").notNull(),\n    role: pgText(\"role\").notNull().default(\"member\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  invitation: pgTable(\"invitation\", {\n    id: pgText(\"id\").primaryKey(),\n    organizationId: pgText(\"organization_id\").notNull(),\n    email: pgText(\"email\").notNull(),\n    role: pgText(\"role\"),\n    status: pgText(\"status\").notNull().default(\"pending\"),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    inviterId: pgText(\"inviter_id\").notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  jwks: pgTable(\"jwks\", {\n    id: pgText(\"id\").primaryKey(),\n    publicKey: pgText(\"public_key\").notNull(),\n    privateKey: pgText(\"private_key\").notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }),\n  }),\n};\n\nconst sqliteAuthSchema = {\n  user: sqliteTable(\"user\", {\n    id: sqliteText(\"id\").primaryKey(),\n    name: sqliteText(\"name\").notNull(),\n    email: sqliteText(\"email\").notNull().unique(),\n    emailVerified: sqliteInteger(\"email_verified\", { mode: \"boolean\" })\n      .notNull()\n      .default(false),\n    image: sqliteText(\"image\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  session: sqliteTable(\"session\", {\n    id: sqliteText(\"id\").primaryKey(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    token: sqliteText(\"token\").notNull().unique(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n    ipAddress: sqliteText(\"ip_address\"),\n    userAgent: sqliteText(\"user_agent\"),\n    userId: sqliteText(\"user_id\").notNull(),\n    activeOrganizationId: sqliteText(\"active_organization_id\"),\n  }),\n  account: sqliteTable(\"account\", {\n    id: sqliteText(\"id\").primaryKey(),\n    accountId: sqliteText(\"account_id\").notNull(),\n    providerId: sqliteText(\"provider_id\").notNull(),\n    userId: sqliteText(\"user_id\").notNull(),\n    accessToken: sqliteText(\"access_token\"),\n    refreshToken: sqliteText(\"refresh_token\"),\n    idToken: sqliteText(\"id_token\"),\n    accessTokenExpiresAt: sqliteInteger(\"access_token_expires_at\", {\n      mode: \"timestamp_ms\",\n    }),\n    refreshTokenExpiresAt: sqliteInteger(\"refresh_token_expires_at\", {\n      mode: \"timestamp_ms\",\n    }),\n    scope: sqliteText(\"scope\"),\n    password: sqliteText(\"password\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  verification: sqliteTable(\"verification\", {\n    id: sqliteText(\"id\").primaryKey(),\n    identifier: sqliteText(\"identifier\").notNull(),\n    value: sqliteText(\"value\").notNull(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  organization: sqliteTable(\"organization\", {\n    id: sqliteText(\"id\").primaryKey(),\n    name: sqliteText(\"name\").notNull(),\n    slug: sqliteText(\"slug\").notNull().unique(),\n    logo: sqliteText(\"logo\"),\n    metadata: sqliteText(\"metadata\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  member: sqliteTable(\"member\", {\n    id: sqliteText(\"id\").primaryKey(),\n    organizationId: sqliteText(\"organization_id\").notNull(),\n    userId: sqliteText(\"user_id\").notNull(),\n    role: sqliteText(\"role\").notNull().default(\"member\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  invitation: sqliteTable(\"invitation\", {\n    id: sqliteText(\"id\").primaryKey(),\n    organizationId: sqliteText(\"organization_id\").notNull(),\n    email: sqliteText(\"email\").notNull(),\n    role: sqliteText(\"role\"),\n    status: sqliteText(\"status\").notNull().default(\"pending\"),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    inviterId: sqliteText(\"inviter_id\").notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  jwks: sqliteTable(\"jwks\", {\n    id: sqliteText(\"id\").primaryKey(),\n    publicKey: sqliteText(\"public_key\").notNull(),\n    privateKey: sqliteText(\"private_key\").notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }),\n  }),\n};\n\nfunction getBetterAuthSchema() {\n  return isPostgres() ? pgAuthSchema : sqliteAuthSchema;\n}\n\n/**\n * Mirror a Better Auth `account` row for Google into the `oauth_tokens`\n * table that template code (mail's Gmail client, calendar's events fetcher)\n * reads from. Called from the `databaseHooks.account.create.after` and\n * `.update.after` hooks so tokens captured during the primary \"Sign in\n * with Google\" flow flow straight to the apps that need them — no\n * separate \"Connect Google\" page required.\n *\n * Resolves `account.userId` to the user's email by querying the `user`\n * table (Better Auth always quotes \"user\" because it's a reserved word\n * in Postgres; SQLite accepts the quotes too).\n *\n * The hook is fire-and-forget from the caller's perspective — every\n * failure is caught upstream so a flake in `oauth_tokens` never blocks\n * sign-in. We still no-op on missing fields here as a defense in depth.\n */\nasync function mirrorGoogleAccountToOAuthTokens(account: {\n  providerId?: string;\n  userId?: string;\n  accountId?: string;\n  accessToken?: string | null;\n  refreshToken?: string | null;\n  accessTokenExpiresAt?: Date | string | number | null;\n  scope?: string | null;\n  idToken?: string | null;\n}): Promise<void> {\n  if (!account || account.providerId !== \"google\") return;\n  if (!account.userId) return;\n\n  const accessToken = account.accessToken ?? undefined;\n  if (!accessToken) {\n    // Better Auth sometimes upserts an account row before tokens are\n    // attached (e.g. linking flows). Nothing to mirror yet — the next\n    // update hook will run once the access token lands.\n    return;\n  }\n\n  // Resolve user email from userId.\n  const db = getDbExec();\n  let email: string | undefined;\n  try {\n    const { rows } = await db.execute({\n      sql: 'SELECT email FROM \"user\" WHERE id = ?',\n      args: [account.userId],\n    });\n    email = (rows[0]?.email as string | undefined) ?? undefined;\n  } catch (err) {\n    console.error(\n      \"[auth] mirror Google tokens: failed to resolve user email from userId\",\n      err,\n    );\n    return;\n  }\n  if (!email) return;\n\n  // Normalise expiry to epoch ms (Google's \"expiry_date\" convention used\n  // throughout the templates).\n  let expiryDate: number | undefined;\n  const raw = account.accessTokenExpiresAt;\n  if (raw instanceof Date) {\n    expiryDate = raw.getTime();\n  } else if (typeof raw === \"number\") {\n    expiryDate = raw;\n  } else if (typeof raw === \"string\") {\n    const ms = Date.parse(raw);\n    expiryDate = Number.isFinite(ms) ? ms : undefined;\n  }\n\n  const tokens: Record<string, unknown> = {\n    access_token: accessToken,\n    token_type: \"Bearer\",\n  };\n  if (account.refreshToken) tokens.refresh_token = account.refreshToken;\n  if (expiryDate) tokens.expiry_date = expiryDate;\n  if (account.scope) tokens.scope = account.scope;\n  if (account.idToken) tokens.id_token = account.idToken;\n\n  await saveOAuthTokens(\"google\", email, tokens, email);\n}\n\nasync function ensureBetterAuthTables(): Promise<void> {\n  const db = getDbExec();\n  const statements = isPostgres()\n    ? [\n        `CREATE TABLE IF NOT EXISTS \"user\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified BOOLEAN NOT NULL DEFAULT FALSE, image TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"session\" (id TEXT PRIMARY KEY, expires_at TIMESTAMPTZ NOT NULL, token TEXT NOT NULL UNIQUE, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n        `CREATE TABLE IF NOT EXISTS \"account\" (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at TIMESTAMPTZ, refresh_token_expires_at TIMESTAMPTZ, scope TEXT, password TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"verification\" (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"organization\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"member\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"invitation\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at TIMESTAMPTZ NOT NULL, inviter_id TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"jwks\" (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, expires_at TIMESTAMPTZ)`,\n      ]\n    : [\n        `CREATE TABLE IF NOT EXISTS user (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified INTEGER NOT NULL DEFAULT 0, image TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS session (id TEXT PRIMARY KEY, expires_at INTEGER NOT NULL, token TEXT NOT NULL UNIQUE, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n        `CREATE TABLE IF NOT EXISTS account (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at INTEGER, refresh_token_expires_at INTEGER, scope TEXT, password TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS verification (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at INTEGER NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS organization (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS member (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS invitation (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at INTEGER NOT NULL, inviter_id TEXT NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS jwks (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at INTEGER NOT NULL, expires_at INTEGER)`,\n      ];\n\n  for (const sql of statements) await db.execute(sql);\n}\n\n/**\n * Get or create the Better Auth instance.\n * Lazily initialized on first call — the database must be reachable by then.\n */\nexport async function getBetterAuth(\n  config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n  if (_auth) return _auth;\n  if (_initPromise) return _initPromise;\n\n  _initPromise = createBetterAuthInstance(config);\n  _auth = await _initPromise;\n  return _auth;\n}\n\n/**\n * Synchronous getter — returns the instance if already initialized, else undefined.\n * Use this in hot paths where you know init has already happened.\n */\nexport function getBetterAuthSync(): BetterAuthInstance | undefined {\n  return _auth;\n}\n\n/** Reset for testing */\nexport async function resetBetterAuth(): Promise<void> {\n  _auth = undefined;\n  _initPromise = undefined;\n  if (_neonAuthPool) {\n    try {\n      await _neonAuthPool.end();\n    } catch {\n      // Pool may have already closed (process exiting, etc.) — don't block reset.\n    }\n    _neonAuthPool = undefined;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Instance creation\n// ---------------------------------------------------------------------------\n\nasync function createBetterAuthInstance(\n  config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n  const dialect = getDialect();\n  const basePath = config?.basePath ?? \"/_agent-native/auth/ba\";\n  await ensureBetterAuthTables();\n\n  // Build social providers from env vars\n  const socialProviders: BetterAuthOptions[\"socialProviders\"] = {\n    ...config?.socialProviders,\n  };\n\n  if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {\n    // When the template requests broader scopes (Gmail, Calendar, etc.)\n    // ask for them on the primary sign-in flow so a separate \"Connect\n    // Google\" round-trip isn't needed. `accessType: \"offline\"` plus\n    // `prompt: \"consent\"` ensures we always receive a refresh token back —\n    // Google only re-issues a refresh token on consent, so re-signing in\n    // (e.g. after switching machines) would otherwise leave us with an\n    // access token that can't be refreshed.\n    const extraScopes = config?.googleScopes ?? [];\n    const baseScopes = [\"openid\", \"email\", \"profile\"];\n    const mergedScopes = Array.from(new Set([...baseScopes, ...extraScopes]));\n    socialProviders.google = {\n      clientId: process.env.GOOGLE_CLIENT_ID,\n      clientSecret: process.env.GOOGLE_CLIENT_SECRET,\n      ...(extraScopes.length > 0\n        ? {\n            scope: mergedScopes,\n            accessType: \"offline\" as const,\n            prompt: \"consent\" as const,\n          }\n        : {}),\n    };\n  }\n\n  if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {\n    socialProviders.github = {\n      clientId: process.env.GITHUB_CLIENT_ID,\n      clientSecret: process.env.GITHUB_CLIENT_SECRET,\n    };\n  }\n\n  // Build database config\n  const database = await buildDatabaseConfig(dialect);\n\n  const secret = resolveAuthSecret();\n\n  const appUrl = getAppProductionUrl();\n  const requireEmailVerification =\n    isEmailConfigured() && !shouldSkipEmailVerification();\n\n  const auth = betterAuth({\n    basePath,\n    baseURL: appUrl,\n    database,\n    secret,\n    emailAndPassword: {\n      enabled: true,\n      minPasswordLength: 8,\n      // Only require email verification when an email provider is configured.\n      // Without a provider, verification emails can't be sent, so requiring\n      // verification would lock users out of signup entirely. Local dev/test\n      // skip verification by default so +qa accounts can be created quickly;\n      // hosted QA deployments can opt out with AUTH_SKIP_EMAIL_VERIFICATION=1.\n      requireEmailVerification,\n      sendResetPassword: async ({ user, token }) => {\n        // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n        // reset link must include that prefix so the page resolves correctly.\n        const appBasePath = (\n          process.env.VITE_APP_BASE_PATH ||\n          process.env.APP_BASE_PATH ||\n          \"\"\n        ).replace(/\\/$/, \"\");\n        const resetUrl = `${appUrl}${appBasePath}/_agent-native/auth/reset?token=${encodeURIComponent(token)}`;\n        const { subject, html, text } = renderResetPasswordEmail({\n          email: user.email,\n          resetUrl,\n        });\n        await sendEmail({ to: user.email, subject, html, text });\n      },\n    },\n    emailVerification: {\n      // Fire verification email right after signup, before the user has a\n      // session — pairs with requireEmailVerification above. Only enabled\n      // when an email provider is configured.\n      sendOnSignUp: requireEmailVerification,\n      // Auto-create a session once the user clicks the link. Without this,\n      // verified users would have to go back and sign in manually, which is\n      // a confusing dead-end on the verify screen.\n      autoSignInAfterVerification: true,\n      sendVerificationEmail: async ({ user, url }) => {\n        // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n        // verification link must include that prefix so the page resolves correctly.\n        const verifyBasePath = (\n          process.env.VITE_APP_BASE_PATH ||\n          process.env.APP_BASE_PATH ||\n          \"\"\n        ).replace(/\\/$/, \"\");\n        const verifyUrl = verifyBasePath\n          ? url.replace(/(\\/\\/[^/]+)(\\/)/, `$1${verifyBasePath}$2`)\n          : url;\n        const { subject, html, text } = renderVerifySignupEmail({\n          email: user.email,\n          verifyUrl,\n        });\n        await sendEmail({ to: user.email, subject, html, text });\n      },\n    },\n    socialProviders,\n    account: {\n      // Merge accounts when a user signs in with a social provider using an\n      // email that already has a local email/password account (or vice versa).\n      // Only providers listed in `trustedProviders` auto-link — these are the\n      // ones that verify emails at the identity layer. Never add a provider\n      // here that lets users claim an unverified email; that would be an\n      // account-takeover vector.\n      accountLinking: {\n        enabled: true,\n        trustedProviders: [\"google\", \"github\"],\n      },\n    },\n    databaseHooks: {\n      user: {\n        create: {\n          after: async (user: {\n            id?: string;\n            email?: string;\n            name?: string | null;\n          }) => {\n            // When a newly-created user's email has pending org invitations\n            // (common when someone is invited *before* they've signed up),\n            // auto-accept them so the user lands in the org on their very\n            // first page load instead of a blank-slate workspace.\n            const email = user?.email;\n            if (!email) return;\n            identify(email, {\n              email,\n              name: user.name ?? undefined,\n              authUserId: user.id,\n            });\n            track(\n              \"signup\",\n              {\n                auth_provider: \"better-auth\",\n                auth_user_id: user.id,\n              },\n              { userId: email },\n            );\n            try {\n              await acceptPendingInvitationsForEmail(email);\n            } catch (err) {\n              // Never block signup on invite bookkeeping — log and continue.\n              console.error(\n                \"[auth] failed to auto-accept pending invitations\",\n                err,\n              );\n            }\n            try {\n              // Auto-join orgs whose `allowed_domain` matches this email\n              // domain. Lets a fresh `@builder.io` (or any org-domain)\n              // signup land inside the company org on first page load\n              // without going through the picker. No-ops when no match.\n              await autoJoinDomainMatchingOrgs(email);\n            } catch (err) {\n              console.error(\n                \"[auth] failed to auto-join domain-matching orgs\",\n                err,\n              );\n            }\n          },\n        },\n      },\n      account: {\n        // Mirror Google account tokens into `oauth_tokens` so existing\n        // template code (mail's Gmail client, calendar's events fetcher)\n        // can pick up Gmail/Calendar credentials from the primary sign-in\n        // flow — no separate \"Set up Google\" page required.\n        //\n        // Better Auth fires `create` for first-time social sign-in and\n        // `update` whenever a session re-issues tokens (e.g., the user\n        // re-signs in to refresh the token). Both branches do the same\n        // mirroring work; failures never block sign-in.\n        create: {\n          after: async (account: any) => {\n            await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n              console.error(\n                \"[auth] failed to mirror Google account tokens to oauth_tokens (create)\",\n                err,\n              );\n            });\n          },\n        },\n        update: {\n          after: async (account: any) => {\n            await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n              console.error(\n                \"[auth] failed to mirror Google account tokens to oauth_tokens (update)\",\n                err,\n              );\n            });\n          },\n        },\n      },\n    },\n    session: {\n      expiresIn: 60 * 60 * 24 * 30, // 30 days\n      updateAge: 60 * 60 * 24, // refresh daily\n      cookieCache: {\n        enabled: true,\n        maxAge: 5 * 60, // 5 min cache\n      },\n    },\n    advanced: {\n      cookiePrefix: \"an\",\n      // Emit `SameSite=None; Secure` when the app is served over HTTPS so\n      // session cookies are delivered inside third-party iframes (e.g. the\n      // Builder.io editor). Plain-HTTP dev keeps the default (Lax) because\n      // `SameSite=None` requires Secure.\n      ...(appUrl.startsWith(\"https://\")\n        ? {\n            defaultCookieAttributes: {\n              sameSite: \"none\" as const,\n              secure: true,\n              partitioned: true,\n            },\n          }\n        : {}),\n    },\n    plugins: [\n      // Organizations: many:many user:org, roles, invitations\n      organization(),\n      // JWT: issue tokens for A2A calls, JWKS endpoint for verification\n      jwt({\n        jwt: {\n          issuer: appUrl,\n          expirationTime: \"15m\",\n        },\n      }),\n      // Bearer: accept Bearer tokens on API requests\n      bearer(),\n      ...(config?.plugins ?? []),\n    ],\n  });\n\n  return auth as unknown as BetterAuthInstance;\n}\n\nasync function buildDatabaseConfig(\n  dialect: string,\n): Promise<BetterAuthOptions[\"database\"]> {\n  if (dialect === \"postgres\") {\n    const url = getDatabaseUrl();\n    const { isNeonUrl } = await import(\"../db/create-get-db.js\");\n\n    // Neon via @neondatabase/serverless (WebSockets over HTTPS). postgres-js\n    // opens a raw TCP connection on port 5432 which frequently times out on\n    // Netlify Functions / Vercel / CF Workers when Neon's pooler is cold.\n    if (isNeonUrl(url)) {\n      const { Pool } = await import(\"@neondatabase/serverless\");\n      _neonAuthPool = new Pool({ connectionString: url });\n      const { drizzle } = await import(\"drizzle-orm/neon-serverless\");\n      const db = drizzle(_neonAuthPool, { schema: pgAuthSchema });\n      const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n      return drizzleAdapter(db, {\n        provider: \"pg\",\n        schema: pgAuthSchema,\n      });\n    }\n\n    // Non-Neon Postgres (Supabase, self-hosted, etc.) → postgres-js\n    const { default: postgres } = await import(\"postgres\");\n    const sql = postgres(url, {\n      onnotice: () => {},\n      idle_timeout: 240,\n      max_lifetime: 60 * 30,\n      connect_timeout: 10,\n      ...(url.includes(\"supabase\") ? { prepare: false } : {}),\n    });\n    const { drizzle } = await import(\"drizzle-orm/postgres-js\");\n    const db = drizzle(sql, { schema: pgAuthSchema });\n    const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n    return drizzleAdapter(db, {\n      provider: \"pg\",\n      schema: pgAuthSchema,\n    });\n  }\n\n  // SQLite / libsql\n  const url = getDatabaseUrl(\"file:./data/app.db\");\n\n  if (url.startsWith(\"file:\") || !url.includes(\"://\")) {\n    // Local SQLite via better-sqlite3\n    const { default: Database } = await import(\"better-sqlite3\");\n    const filePath = url.replace(/^file:/, \"\");\n    const sqlite = new Database(filePath);\n    sqlite.pragma(\"journal_mode = WAL\");\n    const { drizzle } = await import(\"drizzle-orm/better-sqlite3\");\n    const db = drizzle(sqlite, { schema: sqliteAuthSchema });\n    const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n    return drizzleAdapter(db, {\n      provider: \"sqlite\",\n      schema: sqliteAuthSchema,\n    });\n  }\n\n  // Remote libsql (Turso). Use the web client to avoid serverless bundles\n  // depending on libsql's platform-specific native packages.\n  const { createClient } = await import(\"@libsql/client/web\");\n  const client = createClient({ url, authToken: getDatabaseAuthToken() });\n  const { drizzle } = await import(\"drizzle-orm/libsql/web\");\n  const db = drizzle(client, { schema: sqliteAuthSchema });\n  const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n  return drizzleAdapter(db, {\n    provider: \"sqlite\",\n    schema: sqliteAuthSchema,\n  });\n}\n"]}
+{"version":3,"file":"better-auth-instance.js","sourceRoot":"","sources":["../../src/server/better-auth-instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,UAAU,EACV,cAAc,EACd,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,OAAO,EACP,IAAI,IAAI,MAAM,EACd,SAAS,IAAI,WAAW,EACxB,OAAO,IAAI,SAAS,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,IAAI,IAAI,UAAU,EAClB,OAAO,IAAI,aAAa,GACzB,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,iBAAiB;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAE1E,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,+EAA+E;YAC7E,0EAA0E;YAC1E,0DAA0D;YAC1D,wBAAwB,MAAM,MAAM;YACpC,uEAAuE;YACvE,uEAAuE;YACvE,qFAAqF;YACrF,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,QAAQ;IACR,EAAE;IACF,yDAAyD;IACzD,+DAA+D;IAC/D,qEAAqE;IACrE,sEAAsE;IACtE,mDAAmD;IACnD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,QAAQ,CAAC,CAAC,mGAAmG;YAC9I,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC,sGAAsG;QAClJ,OAAO,CAAC,GAAG,CACT,0EAA0E;YACxE,iDAAiD;YACjD,4EAA4E,CAC/E,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CACV,oEAAoE;YAClE,gEAAgE;YAChE,wDAAwD;YACxD,oFAAoF,CACvF,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtD,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CACrB,8DAA8D,CAC/D,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAoB,EAAE,MAAc;IAChE,MAAM,MAAM,GACV,+DAA+D;QAC/D,oEAAoE;QACpE,2DAA2D,CAAC;IAC9D,MAAM,IAAI,GAAG,sBAAsB,MAAM,IAAI,CAAC;IAE9C,yEAAyE;IACzE,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5E,EAAE,CAAC,cAAc,CACf,YAAY,EACZ,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CACzD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACvD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,OAAO,CAAC;AAC3E,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AA2DD,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,IAAI,KAAqC,CAAC;AAC1C,IAAI,YAAqD,CAAC;AAC1D,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACxE,IAAI,aAAkB,CAAC;AAEvB,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,aAAa,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,oBAAoB,EAAE,MAAM,CAAC,wBAAwB,CAAC;KACvD,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;QACnC,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC;QACrC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;QAC3B,oBAAoB,EAAE,WAAW,CAAC,yBAAyB,EAAE;YAC3D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,qBAAqB,EAAE,WAAW,CAAC,0BAA0B,EAAE;YAC7D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACvC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE;QACxB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE;QAChC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;KAC7D,CAAC;CACH,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,aAAa,EAAE,aAAa,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aAChE,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;QACjB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,UAAU,CAAC,wBAAwB,CAAC;KAC3D,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,WAAW,EAAE,UAAU,CAAC,cAAc,CAAC;QACvC,YAAY,EAAE,UAAU,CAAC,eAAe,CAAC;QACzC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC;QAC/B,oBAAoB,EAAE,aAAa,CAAC,yBAAyB,EAAE;YAC7D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,qBAAqB,EAAE,aAAa,CAAC,0BAA0B,EAAE;YAC/D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC9C,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC3C,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC5B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,UAAU,EAAE,WAAW,CAAC,YAAY,EAAE;QACpC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACzD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;KACjE,CAAC;CACH,CAAC;AAEF,SAAS,mBAAmB;IAC1B,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,gCAAgC,CAAC,OAS/C;IACC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO;IACxD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO;IAE5B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iEAAiE;QACjE,kEAAkE;QAClE,oDAAoD;QACpD,OAAO;IACT,CAAC;IAED,kCAAkC;IAClC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAChC,GAAG,EAAE,uCAAuC;YAC5C,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACvB,CAAC,CAAC;QACH,KAAK,GAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAA4B,IAAI,SAAS,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,uEAAuE,EACvE,GAAG,CACJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,uEAAuE;IACvE,6BAA6B;IAC7B,IAAI,UAA8B,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC;IACzC,IAAI,GAAG,YAAY,IAAI,EAAE,CAAC;QACxB,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,UAAU,GAAG,GAAG,CAAC;IACnB,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAA4B;QACtC,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;KACrB,CAAC;IACF,IAAI,OAAO,CAAC,YAAY;QAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IACtE,IAAI,UAAU;QAAE,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC;IAChD,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAEvD,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,sBAAsB;IACnC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,UAAU,EAAE;QAC7B,CAAC,CAAC;YACE,sOAAsO;YACtO,iRAAiR;YACjR,sWAAsW;YACtW,mNAAmN;YACnN,4MAA4M;YAC5M,wNAAwN;YACxN,mSAAmS;YACnS,uKAAuK;SACxK;QACH,CAAC,CAAC;YACE,wNAAwN;YACxN,mQAAmQ;YACnQ,oVAAoV;YACpV,qMAAqM;YACrM,kMAAkM;YAClM,8MAA8M;YAC9M,qRAAqR;YACrR,6JAA6J;SAC9J,CAAC;IAEN,KAAK,MAAM,GAAG,IAAI,UAAU;QAAE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB;IAEzB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,YAAY,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAChD,KAAK,GAAG,MAAM,YAAY,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,KAAK,GAAG,SAAS,CAAC;IAClB,YAAY,GAAG,SAAS,CAAC;IACzB,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;QACD,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,KAAK,UAAU,wBAAwB,CACrC,MAAyB;IAEzB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,wBAAwB,CAAC;IAC9D,MAAM,sBAAsB,EAAE,CAAC;IAE/B,uCAAuC;IACvC,MAAM,eAAe,GAAyC;QAC5D,GAAG,MAAM,EAAE,eAAe;KAC3B,CAAC;IAEF,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,wCAAwC;QACxC,MAAM,WAAW,GAAG,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC1E,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAC9C,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC;oBACE,KAAK,EAAE,YAAY;oBACnB,UAAU,EAAE,SAAkB;oBAC9B,MAAM,EAAE,SAAkB;iBAC3B;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;SAC/C,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,wBAAwB,GAC5B,iBAAiB,EAAE,IAAI,CAAC,2BAA2B,EAAE,CAAC;IAExD,MAAM,IAAI,GAAG,UAAU,CAAC;QACtB,QAAQ;QACR,OAAO,EAAE,MAAM;QACf,QAAQ;QACR,MAAM;QACN,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,CAAC;YACpB,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,wBAAwB;YACxB,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC3C,qEAAqE;gBACrE,sEAAsE;gBACtE,MAAM,WAAW,GAAG,CAClB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,WAAW,mCAAmC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAC;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ;iBACT,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,oEAAoE;YACpE,oEAAoE;YACpE,wCAAwC;YACxC,YAAY,EAAE,wBAAwB;YACtC,qEAAqE;YACrE,sEAAsE;YACtE,6CAA6C;YAC7C,2BAA2B,EAAE,IAAI;YACjC,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC7C,qEAAqE;gBACrE,6EAA6E;gBAC7E,MAAM,cAAc,GAAG,CACrB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,SAAS,GAAG,cAAc;oBAC9B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,cAAc,IAAI,CAAC;oBACzD,CAAC,CAAC,GAAG,CAAC;gBACR,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC;oBACtD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS;iBACV,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,eAAe;QACf,OAAO,EAAE;YACP,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,mEAAmE;YACnE,2BAA2B;YAC3B,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;aACvC;SACF;QACD,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,IAIb,EAAE,EAAE;wBACH,gEAAgE;wBAChE,+DAA+D;wBAC/D,8DAA8D;wBAC9D,sDAAsD;wBACtD,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;wBAC1B,IAAI,CAAC,KAAK;4BAAE,OAAO;wBACnB,QAAQ,CAAC,KAAK,EAAE;4BACd,KAAK;4BACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS;4BAC5B,UAAU,EAAE,IAAI,CAAC,EAAE;yBACpB,CAAC,CAAC;wBACH,KAAK,CACH,QAAQ,EACR;4BACE,aAAa,EAAE,aAAa;4BAC5B,YAAY,EAAE,IAAI,CAAC,EAAE;yBACtB,EACD,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;wBACF,IAAI,CAAC;4BACH,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;wBAChD,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,+DAA+D;4BAC/D,OAAO,CAAC,KAAK,CACX,kDAAkD,EAClD,GAAG,CACJ,CAAC;wBACJ,CAAC;wBACD,IAAI,CAAC;4BACH,2DAA2D;4BAC3D,yDAAyD;4BACzD,wDAAwD;4BACxD,0DAA0D;4BAC1D,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;wBAC1C,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,OAAO,CAAC,KAAK,CACX,iDAAiD,EACjD,GAAG,CACJ,CAAC;wBACJ,CAAC;oBACH,CAAC;iBACF;aACF;YACD,OAAO,EAAE;gBACP,+DAA+D;gBAC/D,iEAAiE;gBACjE,kEAAkE;gBAClE,oDAAoD;gBACpD,EAAE;gBACF,+DAA+D;gBAC/D,+DAA+D;gBAC/D,+DAA+D;gBAC/D,gDAAgD;gBAChD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;gBACD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;aACF;SACF;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU;YACxC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,gBAAgB;YACzC,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,cAAc;aAC/B;SACF;QACD,QAAQ,EAAE;YACR,YAAY,EAAE,IAAI;YAClB,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,mCAAmC;YACnC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC/B,CAAC,CAAC;oBACE,uBAAuB,EAAE;wBACvB,QAAQ,EAAE,MAAe;wBACzB,MAAM,EAAE,IAAI;wBACZ,WAAW,EAAE,IAAI;qBAClB;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,kEAAkE;YAClE,qEAAqE;YACrE,oEAAoE;YACpE,gEAAgE;YAChE,kEAAkE;YAClE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa;gBAC3B,CAAC,CAAC;oBACE,qBAAqB,EAAE;wBACrB,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;qBAClC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,OAAO,EAAE;YACP,wDAAwD;YACxD,YAAY,EAAE;YACd,kEAAkE;YAClE,GAAG,CAAC;gBACF,GAAG,EAAE;oBACH,MAAM,EAAE,MAAM;oBACd,cAAc,EAAE,KAAK;iBACtB;aACF,CAAC;YACF,+CAA+C;YAC/C,MAAM,EAAE;YACR,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC3B;KACF,CAAC,CAAC;IAEH,OAAO,IAAqC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAe;IAEf,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAE7D,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YAC1D,aAAa,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;YACpD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAChE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACxE,OAAO,cAAc,CAAC,EAAE,EAAE;gBACxB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,YAAY;aACrB,CAAC,CAAC;QACL,CAAC;QAED,gEAAgE;QAChE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE;YACxB,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC;YAClB,YAAY,EAAE,GAAG;YACjB,YAAY,EAAE,EAAE,GAAG,EAAE;YACrB,eAAe,EAAE,EAAE;YACnB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAClD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAEjD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,kCAAkC;QAClC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACxE,OAAO,cAAc,CAAC,EAAE,EAAE;QACxB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Internal Better Auth instance — lazily created, not exported to templates.\n *\n * Templates interact with auth via the existing `getSession()`, `autoMountAuth()`,\n * `createAuthPlugin()`, and `createGoogleAuthPlugin()` APIs. Better Auth is an\n * implementation detail behind those interfaces.\n */\n\nimport crypto from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { betterAuth, type BetterAuthOptions } from \"better-auth\";\nimport { organization } from \"better-auth/plugins/organization\";\nimport { jwt } from \"better-auth/plugins/jwt\";\nimport { bearer } from \"better-auth/plugins/bearer\";\nimport { sendEmail, isEmailConfigured } from \"./email.js\";\nimport {\n  renderResetPasswordEmail,\n  renderVerifySignupEmail,\n} from \"./email-templates.js\";\nimport { getAppProductionUrl } from \"./app-url.js\";\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport { acceptPendingInvitationsForEmail } from \"../org/accept-pending.js\";\nimport { autoJoinDomainMatchingOrgs } from \"../org/auto-join-domain.js\";\nimport { saveOAuthTokens } from \"../oauth-tokens/store.js\";\nimport { identify, track } from \"../tracking/index.js\";\nimport {\n  getDialect,\n  getDatabaseUrl,\n  getDatabaseAuthToken,\n} from \"../db/client.js\";\nimport {\n  pgTable,\n  text as pgText,\n  timestamp as pgTimestamp,\n  boolean as pgBoolean,\n} from \"drizzle-orm/pg-core\";\nimport {\n  sqliteTable,\n  text as sqliteText,\n  integer as sqliteInteger,\n} from \"drizzle-orm/sqlite-core\";\n\n// ---------------------------------------------------------------------------\n// Persistent auth secret\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve the Better Auth signing secret.\n *\n * Resolution order:\n *   1. `BETTER_AUTH_SECRET` env var — explicit, recommended for prod.\n *   2. `.env.local` in the template cwd — a per-workspace persistent secret\n *      that the framework writes once on first boot when no secret is set.\n *      Gitignored by convention (`.env*` in template .gitignore files), so\n *      it's safe to persist credentials here.\n *   3. Generate a new random 32-byte hex, write it to `.env.local`, and use\n *      it. Subsequent restarts re-read the same file — so session cookies\n *      signed by a previous boot remain valid across dev-server restarts.\n *\n * Why this matters: before this helper existed, missing `BETTER_AUTH_SECRET`\n * fell through to `GOOGLE_CLIENT_SECRET` / `ACCESS_TOKEN` / a hardcoded\n * string. If a template happened to have none of those, each dev-server\n * boot would re-fall back to the hardcoded value (still stable) — but\n * rotating Google credentials, toggling `ACCESS_TOKEN`, or churning the\n * fallback chain would invalidate every signed cookie and force everyone\n * to sign in again. Pinning the secret to `.env.local` on first boot\n * removes that footgun.\n */\nfunction resolveAuthSecret(): string {\n  if (process.env.BETTER_AUTH_SECRET) return process.env.BETTER_AUTH_SECRET;\n\n  // In production, never auto-generate or fall back. A regenerated/derived\n  // secret invalidates every signed session cookie on the next cold start\n  // (serverless filesystems aren't persistent), and the legacy hardcoded\n  // fallback is identical across every deploy that hits it — both are\n  // serious enough to fail the boot loudly so the deployer notices.\n  if (process.env.NODE_ENV === \"production\") {\n    const sample = crypto.randomBytes(32).toString(\"hex\");\n    throw new Error(\n      \"[agent-native] BETTER_AUTH_SECRET is not set. This is required in production \" +\n        \"so signed session cookies stay valid across deploys. Set it as a deploy \" +\n        \"environment variable (any 32-byte hex string), e.g.:\\n\\n\" +\n        `  BETTER_AUTH_SECRET=${sample}\\n\\n` +\n        \"Generate your own with `openssl rand -hex 32`. If you already have a \" +\n        \"running deploy on the legacy hardcoded fallback and need to preserve \" +\n        \"existing sessions, set BETTER_AUTH_SECRET=agent-native-local-dev-secret-k9x2m7q4w8 \" +\n        \"first, then rotate to a real value.\",\n    );\n  }\n\n  // Dev: persist a generated secret to .env.local so sessions survive\n  // dev-server restarts. Falls back to an in-memory random secret only if\n  // the filesystem isn't writable (rare in dev, e.g. read-only mounts) —\n  // sessions reset on every dev-process restart in that case, which is\n  // fine.\n  //\n  // SECURITY (audit 09 LOW-2): the previous fallback chain\n  // (`GOOGLE_CLIENT_SECRET || ACCESS_TOKEN || hardcoded`) reused\n  // cross-purpose secrets and a public hardcoded literal as the cookie\n  // HMAC. Dropped entirely — better to mint an ephemeral secret than to\n  // re-use a Google client secret or a known string.\n  try {\n    const envLocalPath = path.resolve(process.cwd(), \".env.local\");\n    const existing = readEnvLocalSecret(envLocalPath);\n    if (existing) {\n      process.env.BETTER_AUTH_SECRET = existing; // guard:allow-env-mutation — boot-time secret resolution from .env.local, runs once at module init\n      return existing;\n    }\n\n    const generated = crypto.randomBytes(32).toString(\"hex\");\n    appendEnvLocalSecret(envLocalPath, generated);\n    process.env.BETTER_AUTH_SECRET = generated; // guard:allow-env-mutation — boot-time secret generation, runs once at module init before any request\n    console.log(\n      \"[agent-native] Generated a persistent BETTER_AUTH_SECRET in .env.local. \" +\n        \"Sessions will now survive dev-server restarts. \" +\n        \"(Delete .env.local to rotate; set BETTER_AUTH_SECRET in .env to override.)\",\n    );\n    return generated;\n  } catch {\n    // Filesystem unwritable (read-only mount, sandboxed test env, etc.).\n    // Mint a per-process random secret so cookies stay unique per boot.\n    // Sessions reset when the dev process restarts — acceptable for dev.\n    const ephemeral = crypto.randomBytes(32).toString(\"hex\");\n    console.warn(\n      \"[agent-native] Could not persist BETTER_AUTH_SECRET to .env.local \" +\n        \"(filesystem unwritable). Using an ephemeral in-memory secret. \" +\n        \"Sessions will reset every time this process restarts. \" +\n        \"Set BETTER_AUTH_SECRET in your environment to keep sessions valid across restarts.\",\n    );\n    return ephemeral;\n  }\n}\n\nfunction readEnvLocalSecret(envLocalPath: string): string | undefined {\n  try {\n    const content = fs.readFileSync(envLocalPath, \"utf8\");\n    // Match `BETTER_AUTH_SECRET=...` on its own line. Tolerate optional\n    // quotes and leading `export `. Stop at the first newline or quote.\n    const m = content.match(\n      /^(?:export\\s+)?BETTER_AUTH_SECRET\\s*=\\s*\"?([^\"\\r\\n]+)\"?\\s*$/m,\n    );\n    return m?.[1]?.trim() || undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction appendEnvLocalSecret(envLocalPath: string, secret: string): void {\n  const header =\n    \"# Auto-generated by agent-native on first boot. Gitignored.\\n\" +\n    \"# Keeps signed session cookies valid across dev-server restarts.\\n\" +\n    \"# Delete this file (or this line) to rotate the secret.\\n\";\n  const line = `BETTER_AUTH_SECRET=${secret}\\n`;\n\n  // If the file already exists, just append; otherwise create with header.\n  if (fs.existsSync(envLocalPath)) {\n    const existing = fs.readFileSync(envLocalPath, \"utf8\");\n    const needsLeadingNewline = existing.length > 0 && !existing.endsWith(\"\\n\");\n    fs.appendFileSync(\n      envLocalPath,\n      (needsLeadingNewline ? \"\\n\" : \"\") + \"\\n\" + header + line,\n    );\n  } else {\n    fs.writeFileSync(envLocalPath, header + line, { mode: 0o600 });\n  }\n}\n\nexport function shouldSkipEmailVerification(): boolean {\n  const value = process.env.AUTH_SKIP_EMAIL_VERIFICATION;\n  if (value == null) {\n    return (\n      process.env.NODE_ENV === \"development\" || process.env.NODE_ENV === \"test\"\n    );\n  }\n  const normalized = value.trim().toLowerCase();\n  return normalized !== \"\" && normalized !== \"0\" && normalized !== \"false\";\n}\n\n/** Read-only accessor for the resolved auth secret. */\nexport function getAuthSecret(): string {\n  return resolveAuthSecret();\n}\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/** The shape we need from a Better Auth instance (internal — not exported to templates). */\nexport interface BetterAuthInstance {\n  handler: (request: Request) => Promise<Response>;\n  api: {\n    getSession: (opts: { headers: Headers }) => Promise<{\n      user: { id: string; email: string; name: string };\n      session: {\n        id: string;\n        token: string;\n        expiresAt: Date;\n        activeOrganizationId?: string;\n      };\n    } | null>;\n    signInEmail: (opts: {\n      body: { email: string; password: string };\n    }) => Promise<{ token?: string; user?: any } | null>;\n    signUpEmail: (opts: {\n      body: {\n        email: string;\n        password: string;\n        name: string;\n        callbackURL?: string;\n      };\n    }) => Promise<any>;\n    signOut: (opts: { headers: Headers }) => Promise<any>;\n    listOrganizations: (opts: { headers: Headers }) => Promise<any[] | null>;\n  };\n}\n\nexport interface BetterAuthConfig {\n  /** Base path for Better Auth routes. Default: \"/_agent-native/auth/ba\" */\n  basePath?: string;\n  /** Additional social providers beyond what env vars auto-detect */\n  socialProviders?: BetterAuthOptions[\"socialProviders\"];\n  /** Additional Better Auth plugins */\n  plugins?: BetterAuthOptions[\"plugins\"];\n  /**\n   * Additional Google OAuth scopes (Gmail, Calendar, etc.) to request\n   * up front during the primary \"Sign in with Google\" flow, beyond the\n   * default identity scopes (`openid`, `email`, `profile`).\n   *\n   * When set, the Google social provider also opts into:\n   * - `accessType: \"offline\"` — so a refresh token is issued\n   * - `prompt: \"consent\"` — so the refresh token is reissued every sign-in\n   *\n   * Tokens are mirrored into `oauth_tokens` via a databaseHooks.account\n   * hook so existing template code that reads from `oauth_tokens` (mail's\n   * Gmail client, calendar's events fetcher) works without any separate\n   * \"Connect Google\" page.\n   */\n  googleScopes?: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Lazy instance\n// ---------------------------------------------------------------------------\n\nlet _auth: BetterAuthInstance | undefined;\nlet _initPromise: Promise<BetterAuthInstance> | undefined;\n// Track the Neon serverless Pool we open for Better Auth so closeBetterAuth()\n// can release it. The Pool keeps WebSocket connections open; leaking them on\n// hot-reload or process restart exhausts Neon's connection slot budget.\nlet _neonAuthPool: any;\n\nconst pgAuthSchema = {\n  user: pgTable(\"user\", {\n    id: pgText(\"id\").primaryKey(),\n    name: pgText(\"name\").notNull(),\n    email: pgText(\"email\").notNull().unique(),\n    emailVerified: pgBoolean(\"email_verified\").notNull().default(false),\n    image: pgText(\"image\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  session: pgTable(\"session\", {\n    id: pgText(\"id\").primaryKey(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    token: pgText(\"token\").notNull().unique(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n    ipAddress: pgText(\"ip_address\"),\n    userAgent: pgText(\"user_agent\"),\n    userId: pgText(\"user_id\").notNull(),\n    activeOrganizationId: pgText(\"active_organization_id\"),\n  }),\n  account: pgTable(\"account\", {\n    id: pgText(\"id\").primaryKey(),\n    accountId: pgText(\"account_id\").notNull(),\n    providerId: pgText(\"provider_id\").notNull(),\n    userId: pgText(\"user_id\").notNull(),\n    accessToken: pgText(\"access_token\"),\n    refreshToken: pgText(\"refresh_token\"),\n    idToken: pgText(\"id_token\"),\n    accessTokenExpiresAt: pgTimestamp(\"access_token_expires_at\", {\n      withTimezone: true,\n    }),\n    refreshTokenExpiresAt: pgTimestamp(\"refresh_token_expires_at\", {\n      withTimezone: true,\n    }),\n    scope: pgText(\"scope\"),\n    password: pgText(\"password\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  verification: pgTable(\"verification\", {\n    id: pgText(\"id\").primaryKey(),\n    identifier: pgText(\"identifier\").notNull(),\n    value: pgText(\"value\").notNull(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  organization: pgTable(\"organization\", {\n    id: pgText(\"id\").primaryKey(),\n    name: pgText(\"name\").notNull(),\n    slug: pgText(\"slug\").notNull().unique(),\n    logo: pgText(\"logo\"),\n    metadata: pgText(\"metadata\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  member: pgTable(\"member\", {\n    id: pgText(\"id\").primaryKey(),\n    organizationId: pgText(\"organization_id\").notNull(),\n    userId: pgText(\"user_id\").notNull(),\n    role: pgText(\"role\").notNull().default(\"member\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  invitation: pgTable(\"invitation\", {\n    id: pgText(\"id\").primaryKey(),\n    organizationId: pgText(\"organization_id\").notNull(),\n    email: pgText(\"email\").notNull(),\n    role: pgText(\"role\"),\n    status: pgText(\"status\").notNull().default(\"pending\"),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    inviterId: pgText(\"inviter_id\").notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  jwks: pgTable(\"jwks\", {\n    id: pgText(\"id\").primaryKey(),\n    publicKey: pgText(\"public_key\").notNull(),\n    privateKey: pgText(\"private_key\").notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }),\n  }),\n};\n\nconst sqliteAuthSchema = {\n  user: sqliteTable(\"user\", {\n    id: sqliteText(\"id\").primaryKey(),\n    name: sqliteText(\"name\").notNull(),\n    email: sqliteText(\"email\").notNull().unique(),\n    emailVerified: sqliteInteger(\"email_verified\", { mode: \"boolean\" })\n      .notNull()\n      .default(false),\n    image: sqliteText(\"image\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  session: sqliteTable(\"session\", {\n    id: sqliteText(\"id\").primaryKey(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    token: sqliteText(\"token\").notNull().unique(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n    ipAddress: sqliteText(\"ip_address\"),\n    userAgent: sqliteText(\"user_agent\"),\n    userId: sqliteText(\"user_id\").notNull(),\n    activeOrganizationId: sqliteText(\"active_organization_id\"),\n  }),\n  account: sqliteTable(\"account\", {\n    id: sqliteText(\"id\").primaryKey(),\n    accountId: sqliteText(\"account_id\").notNull(),\n    providerId: sqliteText(\"provider_id\").notNull(),\n    userId: sqliteText(\"user_id\").notNull(),\n    accessToken: sqliteText(\"access_token\"),\n    refreshToken: sqliteText(\"refresh_token\"),\n    idToken: sqliteText(\"id_token\"),\n    accessTokenExpiresAt: sqliteInteger(\"access_token_expires_at\", {\n      mode: \"timestamp_ms\",\n    }),\n    refreshTokenExpiresAt: sqliteInteger(\"refresh_token_expires_at\", {\n      mode: \"timestamp_ms\",\n    }),\n    scope: sqliteText(\"scope\"),\n    password: sqliteText(\"password\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  verification: sqliteTable(\"verification\", {\n    id: sqliteText(\"id\").primaryKey(),\n    identifier: sqliteText(\"identifier\").notNull(),\n    value: sqliteText(\"value\").notNull(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  organization: sqliteTable(\"organization\", {\n    id: sqliteText(\"id\").primaryKey(),\n    name: sqliteText(\"name\").notNull(),\n    slug: sqliteText(\"slug\").notNull().unique(),\n    logo: sqliteText(\"logo\"),\n    metadata: sqliteText(\"metadata\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  member: sqliteTable(\"member\", {\n    id: sqliteText(\"id\").primaryKey(),\n    organizationId: sqliteText(\"organization_id\").notNull(),\n    userId: sqliteText(\"user_id\").notNull(),\n    role: sqliteText(\"role\").notNull().default(\"member\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  invitation: sqliteTable(\"invitation\", {\n    id: sqliteText(\"id\").primaryKey(),\n    organizationId: sqliteText(\"organization_id\").notNull(),\n    email: sqliteText(\"email\").notNull(),\n    role: sqliteText(\"role\"),\n    status: sqliteText(\"status\").notNull().default(\"pending\"),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    inviterId: sqliteText(\"inviter_id\").notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  jwks: sqliteTable(\"jwks\", {\n    id: sqliteText(\"id\").primaryKey(),\n    publicKey: sqliteText(\"public_key\").notNull(),\n    privateKey: sqliteText(\"private_key\").notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }),\n  }),\n};\n\nfunction getBetterAuthSchema() {\n  return isPostgres() ? pgAuthSchema : sqliteAuthSchema;\n}\n\n/**\n * Mirror a Better Auth `account` row for Google into the `oauth_tokens`\n * table that template code (mail's Gmail client, calendar's events fetcher)\n * reads from. Called from the `databaseHooks.account.create.after` and\n * `.update.after` hooks so tokens captured during the primary \"Sign in\n * with Google\" flow flow straight to the apps that need them — no\n * separate \"Connect Google\" page required.\n *\n * Resolves `account.userId` to the user's email by querying the `user`\n * table (Better Auth always quotes \"user\" because it's a reserved word\n * in Postgres; SQLite accepts the quotes too).\n *\n * The hook is fire-and-forget from the caller's perspective — every\n * failure is caught upstream so a flake in `oauth_tokens` never blocks\n * sign-in. We still no-op on missing fields here as a defense in depth.\n */\nasync function mirrorGoogleAccountToOAuthTokens(account: {\n  providerId?: string;\n  userId?: string;\n  accountId?: string;\n  accessToken?: string | null;\n  refreshToken?: string | null;\n  accessTokenExpiresAt?: Date | string | number | null;\n  scope?: string | null;\n  idToken?: string | null;\n}): Promise<void> {\n  if (!account || account.providerId !== \"google\") return;\n  if (!account.userId) return;\n\n  const accessToken = account.accessToken ?? undefined;\n  if (!accessToken) {\n    // Better Auth sometimes upserts an account row before tokens are\n    // attached (e.g. linking flows). Nothing to mirror yet — the next\n    // update hook will run once the access token lands.\n    return;\n  }\n\n  // Resolve user email from userId.\n  const db = getDbExec();\n  let email: string | undefined;\n  try {\n    const { rows } = await db.execute({\n      sql: 'SELECT email FROM \"user\" WHERE id = ?',\n      args: [account.userId],\n    });\n    email = (rows[0]?.email as string | undefined) ?? undefined;\n  } catch (err) {\n    console.error(\n      \"[auth] mirror Google tokens: failed to resolve user email from userId\",\n      err,\n    );\n    return;\n  }\n  if (!email) return;\n\n  // Normalise expiry to epoch ms (Google's \"expiry_date\" convention used\n  // throughout the templates).\n  let expiryDate: number | undefined;\n  const raw = account.accessTokenExpiresAt;\n  if (raw instanceof Date) {\n    expiryDate = raw.getTime();\n  } else if (typeof raw === \"number\") {\n    expiryDate = raw;\n  } else if (typeof raw === \"string\") {\n    const ms = Date.parse(raw);\n    expiryDate = Number.isFinite(ms) ? ms : undefined;\n  }\n\n  const tokens: Record<string, unknown> = {\n    access_token: accessToken,\n    token_type: \"Bearer\",\n  };\n  if (account.refreshToken) tokens.refresh_token = account.refreshToken;\n  if (expiryDate) tokens.expiry_date = expiryDate;\n  if (account.scope) tokens.scope = account.scope;\n  if (account.idToken) tokens.id_token = account.idToken;\n\n  await saveOAuthTokens(\"google\", email, tokens, email);\n}\n\nasync function ensureBetterAuthTables(): Promise<void> {\n  const db = getDbExec();\n  const statements = isPostgres()\n    ? [\n        `CREATE TABLE IF NOT EXISTS \"user\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified BOOLEAN NOT NULL DEFAULT FALSE, image TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"session\" (id TEXT PRIMARY KEY, expires_at TIMESTAMPTZ NOT NULL, token TEXT NOT NULL UNIQUE, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n        `CREATE TABLE IF NOT EXISTS \"account\" (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at TIMESTAMPTZ, refresh_token_expires_at TIMESTAMPTZ, scope TEXT, password TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"verification\" (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"organization\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"member\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"invitation\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at TIMESTAMPTZ NOT NULL, inviter_id TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"jwks\" (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, expires_at TIMESTAMPTZ)`,\n      ]\n    : [\n        `CREATE TABLE IF NOT EXISTS user (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified INTEGER NOT NULL DEFAULT 0, image TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS session (id TEXT PRIMARY KEY, expires_at INTEGER NOT NULL, token TEXT NOT NULL UNIQUE, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n        `CREATE TABLE IF NOT EXISTS account (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at INTEGER, refresh_token_expires_at INTEGER, scope TEXT, password TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS verification (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at INTEGER NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS organization (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS member (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS invitation (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at INTEGER NOT NULL, inviter_id TEXT NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS jwks (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at INTEGER NOT NULL, expires_at INTEGER)`,\n      ];\n\n  for (const sql of statements) await db.execute(sql);\n}\n\n/**\n * Get or create the Better Auth instance.\n * Lazily initialized on first call — the database must be reachable by then.\n */\nexport async function getBetterAuth(\n  config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n  if (_auth) return _auth;\n  if (_initPromise) return _initPromise;\n\n  _initPromise = createBetterAuthInstance(config);\n  _auth = await _initPromise;\n  return _auth;\n}\n\n/**\n * Synchronous getter — returns the instance if already initialized, else undefined.\n * Use this in hot paths where you know init has already happened.\n */\nexport function getBetterAuthSync(): BetterAuthInstance | undefined {\n  return _auth;\n}\n\n/** Reset for testing */\nexport async function resetBetterAuth(): Promise<void> {\n  _auth = undefined;\n  _initPromise = undefined;\n  if (_neonAuthPool) {\n    try {\n      await _neonAuthPool.end();\n    } catch {\n      // Pool may have already closed (process exiting, etc.) — don't block reset.\n    }\n    _neonAuthPool = undefined;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Instance creation\n// ---------------------------------------------------------------------------\n\nasync function createBetterAuthInstance(\n  config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n  const dialect = getDialect();\n  const basePath = config?.basePath ?? \"/_agent-native/auth/ba\";\n  await ensureBetterAuthTables();\n\n  // Build social providers from env vars\n  const socialProviders: BetterAuthOptions[\"socialProviders\"] = {\n    ...config?.socialProviders,\n  };\n\n  if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {\n    // When the template requests broader scopes (Gmail, Calendar, etc.)\n    // ask for them on the primary sign-in flow so a separate \"Connect\n    // Google\" round-trip isn't needed. `accessType: \"offline\"` plus\n    // `prompt: \"consent\"` ensures we always receive a refresh token back —\n    // Google only re-issues a refresh token on consent, so re-signing in\n    // (e.g. after switching machines) would otherwise leave us with an\n    // access token that can't be refreshed.\n    const extraScopes = config?.googleScopes ?? [];\n    const baseScopes = [\"openid\", \"email\", \"profile\"];\n    const mergedScopes = Array.from(new Set([...baseScopes, ...extraScopes]));\n    socialProviders.google = {\n      clientId: process.env.GOOGLE_CLIENT_ID,\n      clientSecret: process.env.GOOGLE_CLIENT_SECRET,\n      ...(extraScopes.length > 0\n        ? {\n            scope: mergedScopes,\n            accessType: \"offline\" as const,\n            prompt: \"consent\" as const,\n          }\n        : {}),\n    };\n  }\n\n  if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {\n    socialProviders.github = {\n      clientId: process.env.GITHUB_CLIENT_ID,\n      clientSecret: process.env.GITHUB_CLIENT_SECRET,\n    };\n  }\n\n  // Build database config\n  const database = await buildDatabaseConfig(dialect);\n\n  const secret = resolveAuthSecret();\n\n  const appUrl = getAppProductionUrl();\n  const requireEmailVerification =\n    isEmailConfigured() && !shouldSkipEmailVerification();\n\n  const auth = betterAuth({\n    basePath,\n    baseURL: appUrl,\n    database,\n    secret,\n    emailAndPassword: {\n      enabled: true,\n      minPasswordLength: 8,\n      // Only require email verification when an email provider is configured.\n      // Without a provider, verification emails can't be sent, so requiring\n      // verification would lock users out of signup entirely. Local dev/test\n      // skip verification by default so +qa accounts can be created quickly;\n      // hosted QA deployments can opt out with AUTH_SKIP_EMAIL_VERIFICATION=1.\n      requireEmailVerification,\n      sendResetPassword: async ({ user, token }) => {\n        // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n        // reset link must include that prefix so the page resolves correctly.\n        const appBasePath = (\n          process.env.VITE_APP_BASE_PATH ||\n          process.env.APP_BASE_PATH ||\n          \"\"\n        ).replace(/\\/$/, \"\");\n        const resetUrl = `${appUrl}${appBasePath}/_agent-native/auth/reset?token=${encodeURIComponent(token)}`;\n        const { subject, html, text } = renderResetPasswordEmail({\n          email: user.email,\n          resetUrl,\n        });\n        await sendEmail({ to: user.email, subject, html, text });\n      },\n    },\n    emailVerification: {\n      // Fire verification email right after signup, before the user has a\n      // session — pairs with requireEmailVerification above. Only enabled\n      // when an email provider is configured.\n      sendOnSignUp: requireEmailVerification,\n      // Auto-create a session once the user clicks the link. Without this,\n      // verified users would have to go back and sign in manually, which is\n      // a confusing dead-end on the verify screen.\n      autoSignInAfterVerification: true,\n      sendVerificationEmail: async ({ user, url }) => {\n        // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n        // verification link must include that prefix so the page resolves correctly.\n        const verifyBasePath = (\n          process.env.VITE_APP_BASE_PATH ||\n          process.env.APP_BASE_PATH ||\n          \"\"\n        ).replace(/\\/$/, \"\");\n        const verifyUrl = verifyBasePath\n          ? url.replace(/(\\/\\/[^/]+)(\\/)/, `$1${verifyBasePath}$2`)\n          : url;\n        const { subject, html, text } = renderVerifySignupEmail({\n          email: user.email,\n          verifyUrl,\n        });\n        await sendEmail({ to: user.email, subject, html, text });\n      },\n    },\n    socialProviders,\n    account: {\n      // Merge accounts when a user signs in with a social provider using an\n      // email that already has a local email/password account (or vice versa).\n      // Only providers listed in `trustedProviders` auto-link — these are the\n      // ones that verify emails at the identity layer. Never add a provider\n      // here that lets users claim an unverified email; that would be an\n      // account-takeover vector.\n      accountLinking: {\n        enabled: true,\n        trustedProviders: [\"google\", \"github\"],\n      },\n    },\n    databaseHooks: {\n      user: {\n        create: {\n          after: async (user: {\n            id?: string;\n            email?: string;\n            name?: string | null;\n          }) => {\n            // When a newly-created user's email has pending org invitations\n            // (common when someone is invited *before* they've signed up),\n            // auto-accept them so the user lands in the org on their very\n            // first page load instead of a blank-slate workspace.\n            const email = user?.email;\n            if (!email) return;\n            identify(email, {\n              email,\n              name: user.name ?? undefined,\n              authUserId: user.id,\n            });\n            track(\n              \"signup\",\n              {\n                auth_provider: \"better-auth\",\n                auth_user_id: user.id,\n              },\n              { userId: email },\n            );\n            try {\n              await acceptPendingInvitationsForEmail(email);\n            } catch (err) {\n              // Never block signup on invite bookkeeping — log and continue.\n              console.error(\n                \"[auth] failed to auto-accept pending invitations\",\n                err,\n              );\n            }\n            try {\n              // Auto-join orgs whose `allowed_domain` matches this email\n              // domain. Lets a fresh `@builder.io` (or any org-domain)\n              // signup land inside the company org on first page load\n              // without going through the picker. No-ops when no match.\n              await autoJoinDomainMatchingOrgs(email);\n            } catch (err) {\n              console.error(\n                \"[auth] failed to auto-join domain-matching orgs\",\n                err,\n              );\n            }\n          },\n        },\n      },\n      account: {\n        // Mirror Google account tokens into `oauth_tokens` so existing\n        // template code (mail's Gmail client, calendar's events fetcher)\n        // can pick up Gmail/Calendar credentials from the primary sign-in\n        // flow — no separate \"Set up Google\" page required.\n        //\n        // Better Auth fires `create` for first-time social sign-in and\n        // `update` whenever a session re-issues tokens (e.g., the user\n        // re-signs in to refresh the token). Both branches do the same\n        // mirroring work; failures never block sign-in.\n        create: {\n          after: async (account: any) => {\n            await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n              console.error(\n                \"[auth] failed to mirror Google account tokens to oauth_tokens (create)\",\n                err,\n              );\n            });\n          },\n        },\n        update: {\n          after: async (account: any) => {\n            await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n              console.error(\n                \"[auth] failed to mirror Google account tokens to oauth_tokens (update)\",\n                err,\n              );\n            });\n          },\n        },\n      },\n    },\n    session: {\n      expiresIn: 60 * 60 * 24 * 30, // 30 days\n      updateAge: 60 * 60 * 24, // refresh daily\n      cookieCache: {\n        enabled: true,\n        maxAge: 5 * 60, // 5 min cache\n      },\n    },\n    advanced: {\n      cookiePrefix: \"an\",\n      // Emit `SameSite=None; Secure` when the app is served over HTTPS so\n      // session cookies are delivered inside third-party iframes (e.g. the\n      // Builder.io editor). Plain-HTTP dev keeps the default (Lax) because\n      // `SameSite=None` requires Secure.\n      ...(appUrl.startsWith(\"https://\")\n        ? {\n            defaultCookieAttributes: {\n              sameSite: \"none\" as const,\n              secure: true,\n              partitioned: true,\n            },\n          }\n        : {}),\n      // When `COOKIE_DOMAIN` is set, share Better Auth's session cookie\n      // across every subdomain matching that domain. Pairs with the legacy\n      // framework cookie's matching `Domain=` attribute (auth.ts) so that\n      // signing into one first-party app (e.g. mail.agent-native.com)\n      // signs the user into all sibling apps without re-authenticating.\n      ...(process.env.COOKIE_DOMAIN\n        ? {\n            crossSubDomainCookies: {\n              enabled: true,\n              domain: process.env.COOKIE_DOMAIN,\n            },\n          }\n        : {}),\n    },\n    plugins: [\n      // Organizations: many:many user:org, roles, invitations\n      organization(),\n      // JWT: issue tokens for A2A calls, JWKS endpoint for verification\n      jwt({\n        jwt: {\n          issuer: appUrl,\n          expirationTime: \"15m\",\n        },\n      }),\n      // Bearer: accept Bearer tokens on API requests\n      bearer(),\n      ...(config?.plugins ?? []),\n    ],\n  });\n\n  return auth as unknown as BetterAuthInstance;\n}\n\nasync function buildDatabaseConfig(\n  dialect: string,\n): Promise<BetterAuthOptions[\"database\"]> {\n  if (dialect === \"postgres\") {\n    const url = getDatabaseUrl();\n    const { isNeonUrl } = await import(\"../db/create-get-db.js\");\n\n    // Neon via @neondatabase/serverless (WebSockets over HTTPS). postgres-js\n    // opens a raw TCP connection on port 5432 which frequently times out on\n    // Netlify Functions / Vercel / CF Workers when Neon's pooler is cold.\n    if (isNeonUrl(url)) {\n      const { Pool } = await import(\"@neondatabase/serverless\");\n      _neonAuthPool = new Pool({ connectionString: url });\n      const { drizzle } = await import(\"drizzle-orm/neon-serverless\");\n      const db = drizzle(_neonAuthPool, { schema: pgAuthSchema });\n      const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n      return drizzleAdapter(db, {\n        provider: \"pg\",\n        schema: pgAuthSchema,\n      });\n    }\n\n    // Non-Neon Postgres (Supabase, self-hosted, etc.) → postgres-js\n    const { default: postgres } = await import(\"postgres\");\n    const sql = postgres(url, {\n      onnotice: () => {},\n      idle_timeout: 240,\n      max_lifetime: 60 * 30,\n      connect_timeout: 10,\n      ...(url.includes(\"supabase\") ? { prepare: false } : {}),\n    });\n    const { drizzle } = await import(\"drizzle-orm/postgres-js\");\n    const db = drizzle(sql, { schema: pgAuthSchema });\n    const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n    return drizzleAdapter(db, {\n      provider: \"pg\",\n      schema: pgAuthSchema,\n    });\n  }\n\n  // SQLite / libsql\n  const url = getDatabaseUrl(\"file:./data/app.db\");\n\n  if (url.startsWith(\"file:\") || !url.includes(\"://\")) {\n    // Local SQLite via better-sqlite3\n    const { default: Database } = await import(\"better-sqlite3\");\n    const filePath = url.replace(/^file:/, \"\");\n    const sqlite = new Database(filePath);\n    sqlite.pragma(\"journal_mode = WAL\");\n    const { drizzle } = await import(\"drizzle-orm/better-sqlite3\");\n    const db = drizzle(sqlite, { schema: sqliteAuthSchema });\n    const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n    return drizzleAdapter(db, {\n      provider: \"sqlite\",\n      schema: sqliteAuthSchema,\n    });\n  }\n\n  // Remote libsql (Turso). Use the web client to avoid serverless bundles\n  // depending on libsql's platform-specific native packages.\n  const { createClient } = await import(\"@libsql/client/web\");\n  const client = createClient({ url, authToken: getDatabaseAuthToken() });\n  const { drizzle } = await import(\"drizzle-orm/libsql/web\");\n  const db = drizzle(client, { schema: sqliteAuthSchema });\n  const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n  return drizzleAdapter(db, {\n    provider: \"sqlite\",\n    schema: sqliteAuthSchema,\n  });\n}\n"]}

package/dist/server/google-auth-mode.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Google sign-in flow selection.
+ *
+ * - `'popup'`: open Google in a popup window; the parent polls the
+ *   `desktop-exchange` endpoint to retrieve the session token. Better UX —
+ *   the user stays on the current page.
+ * - `'redirect'`: full-page redirect to Google. Simpler, more reliable on
+ *   mobile / inside in-app browsers / inside Electron.
+ * - `'auto'` (default): popup in normal browsers; redirect in Electron;
+ *   popup in the Builder.io browser iframe (a redirect there hits Google's
+ *   `X-Frame-Options: DENY`).
+ */
+export type GoogleAuthMode = "auto" | "popup" | "redirect";
+/**
+ * Resolve the effective sign-in flow.
+ *
+ * Priority: explicit option > `GOOGLE_AUTH_MODE` env var > `'auto'`.
+ */
+export declare function resolveGoogleAuthMode(option?: GoogleAuthMode): GoogleAuthMode;
+//# sourceMappingURL=google-auth-mode.d.ts.map

package/dist/server/google-auth-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-auth-mode.d.ts","sourceRoot":"","sources":["../../src/server/google-auth-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;AAa3D;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,CAG7E"}

package/dist/server/google-auth-mode.js

@@ -0,0 +1,20 @@
+const VALID = new Set([
+    "auto",
+    "popup",
+    "redirect",
+]);
+function fromEnv() {
+    const raw = (process.env.GOOGLE_AUTH_MODE || "").trim().toLowerCase();
+    return VALID.has(raw) ? raw : undefined;
+}
+/**
+ * Resolve the effective sign-in flow.
+ *
+ * Priority: explicit option > `GOOGLE_AUTH_MODE` env var > `'auto'`.
+ */
+export function resolveGoogleAuthMode(option) {
+    if (option && VALID.has(option))
+        return option;
+    return fromEnv() ?? "auto";
+}
+//# sourceMappingURL=google-auth-mode.js.map

package/dist/server/google-auth-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-auth-mode.js","sourceRoot":"","sources":["../../src/server/google-auth-mode.ts"],"names":[],"mappings":"AAcA,MAAM,KAAK,GAAgC,IAAI,GAAG,CAAC;IACjD,MAAM;IACN,OAAO;IACP,UAAU;CACX,CAAC,CAAC;AAEH,SAAS,OAAO;IACd,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtE,OAAO,KAAK,CAAC,GAAG,CAAC,GAAqB,CAAC,CAAC,CAAC,CAAE,GAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IAC3D,IAAI,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC/C,OAAO,OAAO,EAAE,IAAI,MAAM,CAAC;AAC7B,CAAC","sourcesContent":["/**\n * Google sign-in flow selection.\n *\n * - `'popup'`: open Google in a popup window; the parent polls the\n *   `desktop-exchange` endpoint to retrieve the session token. Better UX —\n *   the user stays on the current page.\n * - `'redirect'`: full-page redirect to Google. Simpler, more reliable on\n *   mobile / inside in-app browsers / inside Electron.\n * - `'auto'` (default): popup in normal browsers; redirect in Electron;\n *   popup in the Builder.io browser iframe (a redirect there hits Google's\n *   `X-Frame-Options: DENY`).\n */\nexport type GoogleAuthMode = \"auto\" | \"popup\" | \"redirect\";\n\nconst VALID: ReadonlySet<GoogleAuthMode> = new Set([\n  \"auto\",\n  \"popup\",\n  \"redirect\",\n]);\n\nfunction fromEnv(): GoogleAuthMode | undefined {\n  const raw = (process.env.GOOGLE_AUTH_MODE || \"\").trim().toLowerCase();\n  return VALID.has(raw as GoogleAuthMode) ? (raw as GoogleAuthMode) : undefined;\n}\n\n/**\n * Resolve the effective sign-in flow.\n *\n * Priority: explicit option > `GOOGLE_AUTH_MODE` env var > `'auto'`.\n */\nexport function resolveGoogleAuthMode(option?: GoogleAuthMode): GoogleAuthMode {\n  if (option && VALID.has(option)) return option;\n  return fromEnv() ?? \"auto\";\n}\n"]}

package/dist/server/google-auth-plugin.d.ts

@@ -1,7 +1,14 @@
+import { type GoogleAuthMode } from "./google-auth-mode.js";
 type NitroPluginDef = (nitroApp: any) => void | Promise<void>;
 export interface GoogleAuthPluginOptions {
     /** Additional paths accessible without authentication */
     publicPaths?: string[];
+    /**
+     * Google sign-in flow: `'popup'`, `'redirect'`, or `'auto'` (default).
+     * Falls back to `GOOGLE_AUTH_MODE` env var, then `'auto'`. The Builder.io
+     * browser iframe always uses popup regardless (Google blocks framing).
+     */
+    googleAuthMode?: GoogleAuthMode;
 }
 /**
  * Create an auth plugin that uses Google OAuth for authentication.

package/dist/server/google-auth-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-auth-plugin.d.ts","sourceRoot":"","sources":["../../src/server/google-auth-plugin.ts"],"names":[],"mappings":"AAGA,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAqQD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,CAAC,EAAE,uBAAuB,GAChC,cAAc,CAUhB"}
+{"version":3,"file":"google-auth-plugin.d.ts","sourceRoot":"","sources":["../../src/server/google-auth-plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAE/B,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAoRD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,CAAC,EAAE,uBAAuB,GAChC,cAAc,CAYhB"}

package/dist/server/google-auth-plugin.js

@@ -1,6 +1,7 @@
 import { createAuthPlugin } from "./auth-plugin.js";
 import { getPublicOAuthOrigin } from "./oauth-public-origin.js";
-function getGoogleLoginHtml() {
+import { resolveGoogleAuthMode, } from "./google-auth-mode.js";
+function getGoogleLoginHtml(googleAuthMode) {
     const publicOAuthOrigin = getPublicOAuthOrigin();
     return `<!DOCTYPE html>
 <html lang="en">
@@ -82,6 +83,7 @@ function getGoogleLoginHtml() {
     return __anBasePath() + path;
   }
   var __AN_PUBLIC_OAUTH_ORIGIN = ${JSON.stringify(publicOAuthOrigin)};
+  var __AN_GOOGLE_AUTH_MODE = ${JSON.stringify(googleAuthMode)};
   function __anConfiguredOAuthOrigin() {
     if (!__AN_PUBLIC_OAUTH_ORIGIN) return '';
     try {
@@ -115,6 +117,20 @@ function getGoogleLoginHtml() {
       return false;
     }
   }
+  function __anIsElectron() {
+    try {
+      return (navigator.userAgent || '').indexOf('Electron') !== -1;
+    } catch(e) {
+      return false;
+    }
+  }
+  function __anResolveAuthFlow() {
+    if (__anIsBuilderPreview() && !__anIsBuilderDesktop()) return 'popup';
+    var mode = __AN_GOOGLE_AUTH_MODE || 'auto';
+    if (mode === 'popup') return 'popup';
+    if (mode === 'redirect') return 'redirect';
+    return __anIsElectron() ? 'redirect' : 'popup';
+  }
   var __anOAuthPollTimer = null;
   var __anOAuthPollCount = 0;
   function __anNewOAuthFlowId() {
@@ -185,7 +201,7 @@ function getGoogleLoginHtml() {
     __anOAuthPollTimer = setInterval(check, 1000);
     setTimeout(check, 500);
   }
-  function __anStartBuilderOAuth(ret, btn, err) {
+  function __anStartPopupOAuth(ret, btn, err) {
     var flowId = __anNewOAuthFlowId();
     var params = new URLSearchParams();
     if (ret) params.set('return', ret);
@@ -226,8 +242,8 @@ function getGoogleLoginHtml() {
     var ret = window.location.pathname + window.location.search;
     btn.disabled = true;
     err.classList.remove('show');
-    if (__anIsBuilderPreview() && !__anIsBuilderDesktop()) {
-      __anStartBuilderOAuth(ret, btn, err);
+    if (__anResolveAuthFlow() === 'popup') {
+      __anStartPopupOAuth(ret, btn, err);
       return;
     }
     if (__anIsBuilderPreview()) {
@@ -284,7 +300,7 @@ export function createGoogleAuthPlugin(options) {
             "/_agent-native/auth/ba",
             ...(options?.publicPaths ?? []),
         ],
-        loginHtml: getGoogleLoginHtml(),
+        loginHtml: getGoogleLoginHtml(resolveGoogleAuthMode(options?.googleAuthMode)),
     });
 }
 //# sourceMappingURL=google-auth-plugin.js.map

package/dist/server/google-auth-plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"google-auth-plugin.js","sourceRoot":"","sources":["../../src/server/google-auth-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAShE,SAAS,kBAAkB;IACzB,MAAM,iBAAiB,GAAG,oBAAoB,EAAE,CAAC;IACjD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCA+E0B,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA+K5D,CAAC;AACT,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAiC;IAEjC,OAAO,gBAAgB,CAAC;QACtB,WAAW,EAAE;YACX,gCAAgC;YAChC,gCAAgC;YAChC,wBAAwB;YACxB,GAAG,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;SAChC;QACD,SAAS,EAAE,kBAAkB,EAAE;KAChC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { createAuthPlugin } from \"./auth-plugin.js\";\nimport { getPublicOAuthOrigin } from \"./oauth-public-origin.js\";\n\ntype NitroPluginDef = (nitroApp: any) => void | Promise<void>;\n\nexport interface GoogleAuthPluginOptions {\n  /** Additional paths accessible without authentication */\n  publicPaths?: string[];\n}\n\nfunction getGoogleLoginHtml(): string {\n  const publicOAuthOrigin = getPublicOAuthOrigin();\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"UTF-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no\">\n<title>Sign in</title>\n<style>\n  *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }\n  body {\n    font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n    background: #0a0a0a;\n    color: #e5e5e5;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    min-height: 100vh;\n  }\n  .card {\n    width: 100%;\n    max-width: 360px;\n    padding: 2rem;\n    background: #141414;\n    border: 1px solid rgba(255,255,255,0.08);\n    border-radius: 12px;\n    text-align: center;\n  }\n  h1 { font-size: 1.125rem; font-weight: 600; margin-bottom: 0.5rem; color: #fff; }\n  .subtitle { font-size: 0.8125rem; color: #888; margin-bottom: 1.5rem; }\n  button {\n    width: 100%;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    gap: 0.625rem;\n    padding: 0.625rem;\n    background: #fff;\n    color: #000;\n    border: none;\n    border-radius: 8px;\n    font-size: 0.9375rem;\n    font-weight: 500;\n    cursor: pointer;\n  }\n  button:hover { opacity: 0.85; }\n  button:disabled { opacity: 0.5; cursor: wait; }\n  .error { margin-top: 0.75rem; font-size: 0.8125rem; color: #f87171; display: none; }\n  .error.show { display: block; }\n  .debug {\n    display: none;\n    margin-top: 0.625rem;\n    font-size: 0.6875rem;\n    line-height: 1.45;\n    color: #777;\n    word-break: break-word;\n  }\n  .debug.show { display: block; }\n  svg { width: 18px; height: 18px; }\n</style>\n</head>\n<body>\n<div class=\"card\">\n  <h1>Sign in</h1>\n  <p class=\"subtitle\">Continue with your Google account</p>\n  <button id=\"btn\" onclick=\"signIn()\">\n    <svg viewBox=\"0 0 24 24\"><path fill=\"#4285F4\" d=\"M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92a5.06 5.06 0 0 1-2.2 3.32v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.1z\"/><path fill=\"#34A853\" d=\"M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z\"/><path fill=\"#FBBC05\" d=\"M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z\"/><path fill=\"#EA4335\" d=\"M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z\"/></svg>\n    Sign in with Google\n  </button>\n  <p class=\"error\" id=\"err\"></p>\n  <p class=\"debug\" id=\"debug\"></p>\n</div>\n<script>\n  function __anBasePath() {\n    var marker = '/_agent-native';\n    var idx = window.location.pathname.indexOf(marker);\n    return idx > 0 ? window.location.pathname.slice(0, idx) : '';\n  }\n  function __anPath(path) {\n    return __anBasePath() + path;\n  }\n  var __AN_PUBLIC_OAUTH_ORIGIN = ${JSON.stringify(publicOAuthOrigin)};\n  function __anConfiguredOAuthOrigin() {\n    if (!__AN_PUBLIC_OAUTH_ORIGIN) return '';\n    try {\n      var origin = new URL(__AN_PUBLIC_OAUTH_ORIGIN).origin;\n      return origin && origin !== window.location.origin ? origin : '';\n    } catch(e) {\n      return '';\n    }\n  }\n  function __anAuthPath(path) {\n    var origin = __anIsBuilderPreview() ? __anConfiguredOAuthOrigin() : '';\n    return origin ? origin + path : __anPath(path);\n  }\n  function __anIsBuilderPreview() {\n    try {\n      var params = new URLSearchParams(window.location.search);\n      if (params.has('builder.preview') || params.has('builder.frameEditing') || params.has('__builder_editing__')) return true;\n    } catch(e) {}\n    try {\n      var ref = document.referrer || '';\n      return ref.indexOf('builder.io') !== -1 || ref.indexOf('builder.my') !== -1 || ref.indexOf('builderio.xyz') !== -1;\n    } catch(e) {\n      return false;\n    }\n  }\n  function __anIsBuilderDesktop() {\n    try {\n      var ua = navigator.userAgent || '';\n      return ua.indexOf('Electron') !== -1 && ua.indexOf('AgentNativeDesktop') === -1;\n    } catch(e) {\n      return false;\n    }\n  }\n  var __anOAuthPollTimer = null;\n  var __anOAuthPollCount = 0;\n  function __anNewOAuthFlowId() {\n    try {\n      if (window.crypto && typeof window.crypto.randomUUID === 'function') {\n        return window.crypto.randomUUID();\n      }\n    } catch(e) {}\n    return 'builder-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2);\n  }\n  function __anFlowDebugId(flowId) {\n    return flowId ? String(flowId).slice(-10) : '';\n  }\n  function __anSetOAuthDebug(message, flowId) {\n    var text = message + (flowId ? ' (flow ' + __anFlowDebugId(flowId) + ')' : '');\n    try {\n      console.info('[agent-native][google-oauth]', { message: message, flow: __anFlowDebugId(flowId) || undefined });\n    } catch(e) {}\n    var debug = document.getElementById('debug');\n    if (debug) {\n      debug.textContent = text;\n      debug.classList.add('show');\n    }\n  }\n  function __anShowOAuthError(err, btn, message) {\n    if (__anOAuthPollTimer) {\n      clearInterval(__anOAuthPollTimer);\n      __anOAuthPollTimer = null;\n    }\n    err.textContent = message;\n    err.classList.add('show');\n    btn.disabled = false;\n  }\n  function __anWaitForOAuthExchange(flowId, ret, btn, err) {\n    var started = Date.now();\n    var timeoutMs = 5 * 60 * 1000;\n    __anOAuthPollCount = 0;\n    async function check() {\n      __anOAuthPollCount++;\n      try {\n        var res = await fetch(__anPath('/_agent-native/auth/desktop-exchange') + '?flow_id=' + encodeURIComponent(flowId), { credentials: 'include' });\n        var data = await res.json().catch(function() { return {}; });\n        if (data && (data.email || data.token)) {\n          if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);\n          __anOAuthPollTimer = null;\n          __anSetOAuthDebug('OAuth exchange redeemed; returning to the app', flowId);\n          window.location.href = ret || '/';\n          return;\n        }\n        if (data && data.error) {\n          __anSetOAuthDebug('OAuth exchange returned an error: ' + (data.message || data.error), flowId);\n          __anShowOAuthError(err, btn, data.message || data.error);\n          return;\n        }\n        if (data && data.pending && (__anOAuthPollCount === 1 || __anOAuthPollCount % 5 === 0)) {\n          __anSetOAuthDebug('Waiting for the Google callback; polling attempt ' + __anOAuthPollCount, flowId);\n        }\n      } catch(e) {\n        if (__anOAuthPollCount === 1 || __anOAuthPollCount % 5 === 0) {\n          __anSetOAuthDebug('Could not reach the OAuth exchange endpoint: ' + (e && e.message ? e.message : 'network error'), flowId);\n        }\n      }\n      if (Date.now() - started > timeoutMs) {\n        __anShowOAuthError(err, btn, 'Google sign-in did not finish. Flow ' + __anFlowDebugId(flowId) + ' never redeemed; check server logs for [agent-native][google-oauth].');\n      }\n    }\n    if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);\n    __anOAuthPollTimer = setInterval(check, 1000);\n    setTimeout(check, 500);\n  }\n  function __anStartBuilderOAuth(ret, btn, err) {\n    var flowId = __anNewOAuthFlowId();\n    var params = new URLSearchParams();\n    if (ret) params.set('return', ret);\n    params.set('desktop', '1');\n    params.set('flow_id', flowId);\n    params.set('redirect', '1');\n    var url = __anPath('/_agent-native/google/auth-url') + '?' + params.toString();\n    try { sessionStorage.setItem('__an_signin', '1'); } catch(e) {}\n    __anSetOAuthDebug('Opening Google sign-in popup', flowId);\n    try {\n      var popup = window.open('', '_blank', 'width=640,height=760');\n      if (!popup) {\n        __anShowOAuthError(err, btn, 'Google popup was blocked. Allow popups for this site and try again (flow ' + __anFlowDebugId(flowId) + ').');\n        return;\n      }\n      try { popup.opener = null; } catch(e) {}\n      try {\n        popup.location.href = url;\n      } catch(e) {\n        try { popup.close(); } catch(closeErr) {}\n        __anShowOAuthError(err, btn, 'Could not navigate Google popup for flow ' + __anFlowDebugId(flowId) + ': ' + (e && e.message ? e.message : 'unknown error'));\n        return;\n      }\n      __anSetOAuthDebug('Google popup opened; waiting for callback', flowId);\n    } catch(e) {\n      __anShowOAuthError(err, btn, 'Could not open Google popup for flow ' + __anFlowDebugId(flowId) + ': ' + (e && e.message ? e.message : 'unknown error'));\n      return;\n    }\n    __anWaitForOAuthExchange(flowId, ret, btn, err);\n  }\n  function __anOpenOAuthUrl(url) {\n    try { sessionStorage.setItem('__an_signin', '1'); } catch(e) {}\n    window.location.href = url;\n  }\n  async function signIn() {\n    var btn = document.getElementById('btn');\n    var err = document.getElementById('err');\n    var ret = window.location.pathname + window.location.search;\n    btn.disabled = true;\n    err.classList.remove('show');\n    if (__anIsBuilderPreview() && !__anIsBuilderDesktop()) {\n      __anStartBuilderOAuth(ret, btn, err);\n      return;\n    }\n    if (__anIsBuilderPreview()) {\n      var params = new URLSearchParams();\n      if (ret) params.set('return', ret);\n      params.set('redirect', '1');\n      __anSetOAuthDebug('Opening Google sign-in redirect');\n      __anOpenOAuthUrl(__anAuthPath('/_agent-native/google/auth-url') + '?' + params.toString());\n      return;\n    }\n    try {\n      var res = await fetch(__anPath('/_agent-native/google/auth-url') + '?return=' + encodeURIComponent(ret));\n      var data = await res.json();\n      if (data.url) {\n        __anOpenOAuthUrl(data.url);\n      } else {\n        err.textContent = data.message || 'Google OAuth is not configured. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.';\n        err.classList.add('show');\n        btn.disabled = false;\n      }\n    } catch (e) {\n      err.textContent = 'Failed to connect. Please try again.';\n      err.classList.add('show');\n      btn.disabled = false;\n    }\n  }\n</script>\n</body>\n</html>`;\n}\n\n/**\n * Create an auth plugin that uses Google OAuth for authentication.\n *\n * When a user visits the app unauthenticated, they see a \"Sign in with Google\"\n * page. The Google OAuth callback (handled by the template) creates a session\n * tied to the user's Google email. `getSession()` then returns `{ email }` for\n * all subsequent requests.\n *\n * Better Auth handles Google OAuth internally when GOOGLE_CLIENT_ID and\n * GOOGLE_CLIENT_SECRET are set. The template's callback route at\n * /_agent-native/google/callback handles mobile deep linking.\n *\n * Usage in a template's `server/plugins/auth.ts`:\n * ```ts\n * import { createGoogleAuthPlugin } from \"@agent-native/core/server\";\n * export default createGoogleAuthPlugin();\n * ```\n */\nexport function createGoogleAuthPlugin(\n  options?: GoogleAuthPluginOptions,\n): NitroPluginDef {\n  return createAuthPlugin({\n    publicPaths: [\n      \"/_agent-native/google/callback\",\n      \"/_agent-native/google/auth-url\",\n      \"/_agent-native/auth/ba\",\n      ...(options?.publicPaths ?? []),\n    ],\n    loginHtml: getGoogleLoginHtml(),\n  });\n}\n"]}
+{"version":3,"file":"google-auth-plugin.js","sourceRoot":"","sources":["../../src/server/google-auth-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EACL,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC;AAe/B,SAAS,kBAAkB,CAAC,cAA8B;IACxD,MAAM,iBAAiB,GAAG,oBAAoB,EAAE,CAAC;IACjD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCA+E0B,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;gCACpC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA6LtD,CAAC;AACT,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAiC;IAEjC,OAAO,gBAAgB,CAAC;QACtB,WAAW,EAAE;YACX,gCAAgC;YAChC,gCAAgC;YAChC,wBAAwB;YACxB,GAAG,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;SAChC;QACD,SAAS,EAAE,kBAAkB,CAC3B,qBAAqB,CAAC,OAAO,EAAE,cAAc,CAAC,CAC/C;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { createAuthPlugin } from \"./auth-plugin.js\";\nimport { getPublicOAuthOrigin } from \"./oauth-public-origin.js\";\nimport {\n  resolveGoogleAuthMode,\n  type GoogleAuthMode,\n} from \"./google-auth-mode.js\";\n\ntype NitroPluginDef = (nitroApp: any) => void | Promise<void>;\n\nexport interface GoogleAuthPluginOptions {\n  /** Additional paths accessible without authentication */\n  publicPaths?: string[];\n  /**\n   * Google sign-in flow: `'popup'`, `'redirect'`, or `'auto'` (default).\n   * Falls back to `GOOGLE_AUTH_MODE` env var, then `'auto'`. The Builder.io\n   * browser iframe always uses popup regardless (Google blocks framing).\n   */\n  googleAuthMode?: GoogleAuthMode;\n}\n\nfunction getGoogleLoginHtml(googleAuthMode: GoogleAuthMode): string {\n  const publicOAuthOrigin = getPublicOAuthOrigin();\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"UTF-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no\">\n<title>Sign in</title>\n<style>\n  *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }\n  body {\n    font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n    background: #0a0a0a;\n    color: #e5e5e5;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    min-height: 100vh;\n  }\n  .card {\n    width: 100%;\n    max-width: 360px;\n    padding: 2rem;\n    background: #141414;\n    border: 1px solid rgba(255,255,255,0.08);\n    border-radius: 12px;\n    text-align: center;\n  }\n  h1 { font-size: 1.125rem; font-weight: 600; margin-bottom: 0.5rem; color: #fff; }\n  .subtitle { font-size: 0.8125rem; color: #888; margin-bottom: 1.5rem; }\n  button {\n    width: 100%;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    gap: 0.625rem;\n    padding: 0.625rem;\n    background: #fff;\n    color: #000;\n    border: none;\n    border-radius: 8px;\n    font-size: 0.9375rem;\n    font-weight: 500;\n    cursor: pointer;\n  }\n  button:hover { opacity: 0.85; }\n  button:disabled { opacity: 0.5; cursor: wait; }\n  .error { margin-top: 0.75rem; font-size: 0.8125rem; color: #f87171; display: none; }\n  .error.show { display: block; }\n  .debug {\n    display: none;\n    margin-top: 0.625rem;\n    font-size: 0.6875rem;\n    line-height: 1.45;\n    color: #777;\n    word-break: break-word;\n  }\n  .debug.show { display: block; }\n  svg { width: 18px; height: 18px; }\n</style>\n</head>\n<body>\n<div class=\"card\">\n  <h1>Sign in</h1>\n  <p class=\"subtitle\">Continue with your Google account</p>\n  <button id=\"btn\" onclick=\"signIn()\">\n    <svg viewBox=\"0 0 24 24\"><path fill=\"#4285F4\" d=\"M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92a5.06 5.06 0 0 1-2.2 3.32v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.1z\"/><path fill=\"#34A853\" d=\"M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z\"/><path fill=\"#FBBC05\" d=\"M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z\"/><path fill=\"#EA4335\" d=\"M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z\"/></svg>\n    Sign in with Google\n  </button>\n  <p class=\"error\" id=\"err\"></p>\n  <p class=\"debug\" id=\"debug\"></p>\n</div>\n<script>\n  function __anBasePath() {\n    var marker = '/_agent-native';\n    var idx = window.location.pathname.indexOf(marker);\n    return idx > 0 ? window.location.pathname.slice(0, idx) : '';\n  }\n  function __anPath(path) {\n    return __anBasePath() + path;\n  }\n  var __AN_PUBLIC_OAUTH_ORIGIN = ${JSON.stringify(publicOAuthOrigin)};\n  var __AN_GOOGLE_AUTH_MODE = ${JSON.stringify(googleAuthMode)};\n  function __anConfiguredOAuthOrigin() {\n    if (!__AN_PUBLIC_OAUTH_ORIGIN) return '';\n    try {\n      var origin = new URL(__AN_PUBLIC_OAUTH_ORIGIN).origin;\n      return origin && origin !== window.location.origin ? origin : '';\n    } catch(e) {\n      return '';\n    }\n  }\n  function __anAuthPath(path) {\n    var origin = __anIsBuilderPreview() ? __anConfiguredOAuthOrigin() : '';\n    return origin ? origin + path : __anPath(path);\n  }\n  function __anIsBuilderPreview() {\n    try {\n      var params = new URLSearchParams(window.location.search);\n      if (params.has('builder.preview') || params.has('builder.frameEditing') || params.has('__builder_editing__')) return true;\n    } catch(e) {}\n    try {\n      var ref = document.referrer || '';\n      return ref.indexOf('builder.io') !== -1 || ref.indexOf('builder.my') !== -1 || ref.indexOf('builderio.xyz') !== -1;\n    } catch(e) {\n      return false;\n    }\n  }\n  function __anIsBuilderDesktop() {\n    try {\n      var ua = navigator.userAgent || '';\n      return ua.indexOf('Electron') !== -1 && ua.indexOf('AgentNativeDesktop') === -1;\n    } catch(e) {\n      return false;\n    }\n  }\n  function __anIsElectron() {\n    try {\n      return (navigator.userAgent || '').indexOf('Electron') !== -1;\n    } catch(e) {\n      return false;\n    }\n  }\n  function __anResolveAuthFlow() {\n    if (__anIsBuilderPreview() && !__anIsBuilderDesktop()) return 'popup';\n    var mode = __AN_GOOGLE_AUTH_MODE || 'auto';\n    if (mode === 'popup') return 'popup';\n    if (mode === 'redirect') return 'redirect';\n    return __anIsElectron() ? 'redirect' : 'popup';\n  }\n  var __anOAuthPollTimer = null;\n  var __anOAuthPollCount = 0;\n  function __anNewOAuthFlowId() {\n    try {\n      if (window.crypto && typeof window.crypto.randomUUID === 'function') {\n        return window.crypto.randomUUID();\n      }\n    } catch(e) {}\n    return 'builder-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2);\n  }\n  function __anFlowDebugId(flowId) {\n    return flowId ? String(flowId).slice(-10) : '';\n  }\n  function __anSetOAuthDebug(message, flowId) {\n    var text = message + (flowId ? ' (flow ' + __anFlowDebugId(flowId) + ')' : '');\n    try {\n      console.info('[agent-native][google-oauth]', { message: message, flow: __anFlowDebugId(flowId) || undefined });\n    } catch(e) {}\n    var debug = document.getElementById('debug');\n    if (debug) {\n      debug.textContent = text;\n      debug.classList.add('show');\n    }\n  }\n  function __anShowOAuthError(err, btn, message) {\n    if (__anOAuthPollTimer) {\n      clearInterval(__anOAuthPollTimer);\n      __anOAuthPollTimer = null;\n    }\n    err.textContent = message;\n    err.classList.add('show');\n    btn.disabled = false;\n  }\n  function __anWaitForOAuthExchange(flowId, ret, btn, err) {\n    var started = Date.now();\n    var timeoutMs = 5 * 60 * 1000;\n    __anOAuthPollCount = 0;\n    async function check() {\n      __anOAuthPollCount++;\n      try {\n        var res = await fetch(__anPath('/_agent-native/auth/desktop-exchange') + '?flow_id=' + encodeURIComponent(flowId), { credentials: 'include' });\n        var data = await res.json().catch(function() { return {}; });\n        if (data && (data.email || data.token)) {\n          if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);\n          __anOAuthPollTimer = null;\n          __anSetOAuthDebug('OAuth exchange redeemed; returning to the app', flowId);\n          window.location.href = ret || '/';\n          return;\n        }\n        if (data && data.error) {\n          __anSetOAuthDebug('OAuth exchange returned an error: ' + (data.message || data.error), flowId);\n          __anShowOAuthError(err, btn, data.message || data.error);\n          return;\n        }\n        if (data && data.pending && (__anOAuthPollCount === 1 || __anOAuthPollCount % 5 === 0)) {\n          __anSetOAuthDebug('Waiting for the Google callback; polling attempt ' + __anOAuthPollCount, flowId);\n        }\n      } catch(e) {\n        if (__anOAuthPollCount === 1 || __anOAuthPollCount % 5 === 0) {\n          __anSetOAuthDebug('Could not reach the OAuth exchange endpoint: ' + (e && e.message ? e.message : 'network error'), flowId);\n        }\n      }\n      if (Date.now() - started > timeoutMs) {\n        __anShowOAuthError(err, btn, 'Google sign-in did not finish. Flow ' + __anFlowDebugId(flowId) + ' never redeemed; check server logs for [agent-native][google-oauth].');\n      }\n    }\n    if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);\n    __anOAuthPollTimer = setInterval(check, 1000);\n    setTimeout(check, 500);\n  }\n  function __anStartPopupOAuth(ret, btn, err) {\n    var flowId = __anNewOAuthFlowId();\n    var params = new URLSearchParams();\n    if (ret) params.set('return', ret);\n    params.set('desktop', '1');\n    params.set('flow_id', flowId);\n    params.set('redirect', '1');\n    var url = __anPath('/_agent-native/google/auth-url') + '?' + params.toString();\n    try { sessionStorage.setItem('__an_signin', '1'); } catch(e) {}\n    __anSetOAuthDebug('Opening Google sign-in popup', flowId);\n    try {\n      var popup = window.open('', '_blank', 'width=640,height=760');\n      if (!popup) {\n        __anShowOAuthError(err, btn, 'Google popup was blocked. Allow popups for this site and try again (flow ' + __anFlowDebugId(flowId) + ').');\n        return;\n      }\n      try { popup.opener = null; } catch(e) {}\n      try {\n        popup.location.href = url;\n      } catch(e) {\n        try { popup.close(); } catch(closeErr) {}\n        __anShowOAuthError(err, btn, 'Could not navigate Google popup for flow ' + __anFlowDebugId(flowId) + ': ' + (e && e.message ? e.message : 'unknown error'));\n        return;\n      }\n      __anSetOAuthDebug('Google popup opened; waiting for callback', flowId);\n    } catch(e) {\n      __anShowOAuthError(err, btn, 'Could not open Google popup for flow ' + __anFlowDebugId(flowId) + ': ' + (e && e.message ? e.message : 'unknown error'));\n      return;\n    }\n    __anWaitForOAuthExchange(flowId, ret, btn, err);\n  }\n  function __anOpenOAuthUrl(url) {\n    try { sessionStorage.setItem('__an_signin', '1'); } catch(e) {}\n    window.location.href = url;\n  }\n  async function signIn() {\n    var btn = document.getElementById('btn');\n    var err = document.getElementById('err');\n    var ret = window.location.pathname + window.location.search;\n    btn.disabled = true;\n    err.classList.remove('show');\n    if (__anResolveAuthFlow() === 'popup') {\n      __anStartPopupOAuth(ret, btn, err);\n      return;\n    }\n    if (__anIsBuilderPreview()) {\n      var params = new URLSearchParams();\n      if (ret) params.set('return', ret);\n      params.set('redirect', '1');\n      __anSetOAuthDebug('Opening Google sign-in redirect');\n      __anOpenOAuthUrl(__anAuthPath('/_agent-native/google/auth-url') + '?' + params.toString());\n      return;\n    }\n    try {\n      var res = await fetch(__anPath('/_agent-native/google/auth-url') + '?return=' + encodeURIComponent(ret));\n      var data = await res.json();\n      if (data.url) {\n        __anOpenOAuthUrl(data.url);\n      } else {\n        err.textContent = data.message || 'Google OAuth is not configured. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.';\n        err.classList.add('show');\n        btn.disabled = false;\n      }\n    } catch (e) {\n      err.textContent = 'Failed to connect. Please try again.';\n      err.classList.add('show');\n      btn.disabled = false;\n    }\n  }\n</script>\n</body>\n</html>`;\n}\n\n/**\n * Create an auth plugin that uses Google OAuth for authentication.\n *\n * When a user visits the app unauthenticated, they see a \"Sign in with Google\"\n * page. The Google OAuth callback (handled by the template) creates a session\n * tied to the user's Google email. `getSession()` then returns `{ email }` for\n * all subsequent requests.\n *\n * Better Auth handles Google OAuth internally when GOOGLE_CLIENT_ID and\n * GOOGLE_CLIENT_SECRET are set. The template's callback route at\n * /_agent-native/google/callback handles mobile deep linking.\n *\n * Usage in a template's `server/plugins/auth.ts`:\n * ```ts\n * import { createGoogleAuthPlugin } from \"@agent-native/core/server\";\n * export default createGoogleAuthPlugin();\n * ```\n */\nexport function createGoogleAuthPlugin(\n  options?: GoogleAuthPluginOptions,\n): NitroPluginDef {\n  return createAuthPlugin({\n    publicPaths: [\n      \"/_agent-native/google/callback\",\n      \"/_agent-native/google/auth-url\",\n      \"/_agent-native/auth/ba\",\n      ...(options?.publicPaths ?? []),\n    ],\n    loginHtml: getGoogleLoginHtml(\n      resolveGoogleAuthMode(options?.googleAuthMode),\n    ),\n  });\n}\n"]}

package/dist/server/index.d.ts

@@ -14,6 +14,7 @@ export { captureError, captureServerError, registerErrorCaptureProvider, type Ca
 export { createSentryPlugin, defaultSentryPlugin } from "./sentry-plugin.js";
 export { createOrgPlugin, defaultOrgPlugin } from "../org/plugin.js";
 export { createGoogleAuthPlugin, type GoogleAuthPluginOptions, } from "./google-auth-plugin.js";
+export type { GoogleAuthMode } from "./google-auth-mode.js";
 export { createAgentChatPlugin, defaultAgentChatPlugin, type AgentChatPluginOptions, } from "./agent-chat-plugin.js";
 export { createThread, getThread, listThreads, updateThreadData, deleteThread, type ChatThread, type ChatThreadSummary, } from "../chat-threads/store.js";
 export { createResourcesPlugin, defaultResourcesPlugin, } from "./resources-plugin.js";

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACpE,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,UAAU,EACV,aAAa,EACb,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,KAAK,2BAA2B,EAChC,KAAK,WAAW,EAChB,KAAK,WAAW,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EACL,4BAA4B,EAC5B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,kCAAkC,EACvC,KAAK,iCAAiC,EACtC,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,4BAA4B,EAC5B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAI7E,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EACL,sBAAsB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,YAAY,EACZ,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,SAAS,EACT,OAAO,EACP,eAAe,EACf,SAAS,EACT,UAAU,EACV,eAAe,EACf,KAAK,SAAS,EACd,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,QAAQ,EACR,cAAc,EACd,KAAK,SAAS,GACf,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,6BAA6B,EAC7B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,cAAc,EACnB,KAAK,iBAAiB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,UAAU,EACV,yBAAyB,EACzB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,UAAU,EACV,QAAQ,EACR,SAAS,EACT,cAAc,EACd,SAAS,EACT,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,gCAAgC,EAChC,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,eAAe,EACf,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,aAAa,EAClB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,WAAW,EACX,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,QAAQ,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,YAAY,IAAI,2BAA2B,GACjD,MAAM,wBAAwB,CAAC;AAUhC,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AACrE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,cAAc,CAErE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACpE,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,UAAU,EACV,aAAa,EACb,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,KAAK,2BAA2B,EAChC,KAAK,WAAW,EAChB,KAAK,WAAW,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EACL,4BAA4B,EAC5B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,kCAAkC,EACvC,KAAK,iCAAiC,EACtC,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,4BAA4B,EAC5B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAI7E,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EACL,sBAAsB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,YAAY,EACZ,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,SAAS,EACT,OAAO,EACP,eAAe,EACf,SAAS,EACT,UAAU,EACV,eAAe,EACf,KAAK,SAAS,EACd,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,QAAQ,EACR,cAAc,EACd,KAAK,SAAS,GACf,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,6BAA6B,EAC7B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,cAAc,EACnB,KAAK,iBAAiB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,UAAU,EACV,yBAAyB,EACzB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,UAAU,EACV,QAAQ,EACR,SAAS,EACT,cAAc,EACd,SAAS,EACT,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,gCAAgC,EAChC,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,eAAe,EACf,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,aAAa,EAClB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,WAAW,EACX,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,QAAQ,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,YAAY,IAAI,2BAA2B,GACjD,MAAM,wBAAwB,CAAC;AAUhC,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AACrE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,cAAc,CAErE"}