npm - @agent-native/core - Versions diffs - 0.22.1 → 0.22.3 - Mend

@agent-native/core 0.22.1 → 0.22.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (31) hide show

package/dist/cli/mcp.d.ts.map +1 -1
package/dist/cli/mcp.js +18 -4
package/dist/cli/mcp.js.map +1 -1
package/dist/server/action-discovery.d.ts.map +1 -1
package/dist/server/action-discovery.js +5 -0
package/dist/server/action-discovery.js.map +1 -1
package/dist/server/auth.d.ts +3 -2
package/dist/server/auth.d.ts.map +1 -1
package/dist/server/auth.js +43 -45
package/dist/server/auth.js.map +1 -1
package/dist/server/better-auth-instance.d.ts.map +1 -1
package/dist/server/better-auth-instance.js +27 -16
package/dist/server/better-auth-instance.js.map +1 -1
package/dist/server/cookie-namespace.d.ts +14 -0
package/dist/server/cookie-namespace.d.ts.map +1 -0
package/dist/server/cookie-namespace.js +118 -0
package/dist/server/cookie-namespace.js.map +1 -0
package/dist/server/derived-secret.d.ts +3 -0
package/dist/server/derived-secret.d.ts.map +1 -0
package/dist/server/derived-secret.js +19 -0
package/dist/server/derived-secret.js.map +1 -0
package/dist/server/google-oauth.d.ts.map +1 -1
package/dist/server/google-oauth.js +8 -4
package/dist/server/google-oauth.js.map +1 -1
package/dist/server/short-lived-token.d.ts +3 -2
package/dist/server/short-lived-token.d.ts.map +1 -1
package/dist/server/short-lived-token.js +8 -4
package/dist/server/short-lived-token.js.map +1 -1
package/docs/content/authentication.md +21 -0
package/docs/content/security.md +3 -3
package/package.json +1 -1

package/dist/server/better-auth-instance.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"better-auth-instance.d.ts","sourceRoot":"","sources":["../../src/server/better-auth-instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAc,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;~~AA8JjE~~,wBAAgB,2BAA2B,IAAI,OAAO,CASrD;AAED,uDAAuD;AACvD,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAMD,4FAA4F;AAC5F,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC;YAClD,IAAI,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAC;YAClD,OAAO,EAAE;gBACP,EAAE,EAAE,MAAM,CAAC;gBACX,KAAK,EAAE,MAAM,CAAC;gBACd,SAAS,EAAE,IAAI,CAAC;aACjB,CAAC;SACH,GAAG,IAAI,CAAC,CAAC;QACV,WAAW,EAAE,CAAC,IAAI,EAAE;YAClB,IAAI,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC;gBAAC,QAAQ,EAAE,MAAM,CAAA;aAAE,CAAC;SAC3C,KAAK,OAAO,CAAC;YAAE,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,GAAG,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QACrD,WAAW,EAAE,CAAC,IAAI,EAAE;YAClB,IAAI,EAAE;gBACJ,KAAK,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAM,CAAC;gBACb,WAAW,CAAC,EAAE,MAAM,CAAC;aACtB,CAAC;SACH,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;KACvD,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,qCAAqC;IACrC,OAAO,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACvC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAwSD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAElE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,eAAe,EAAE,CACf,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,eAAe,EAAE,OAAO,CAAA;KAAE,KACnC,OAAO,CAAC;QACX,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACnD,QAAQ,EAAE,KAAK,CAAC;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC5D,GAAG,IAAI,CAAC,CAAC;IACV,WAAW,EAAE,CAAC,OAAO,EAAE;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KACnB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,UAAU,EAAE,CAAC,IAAI,EAAE;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/B;AAED;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAmBhD;AAED,wBAAwB;AACxB,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAWrD"}
1	+ {"version":3,"file":"better-auth-instance.d.ts","sourceRoot":"","sources":["../../src/server/better-auth-instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAc,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAwKjE,wBAAgB,2BAA2B,IAAI,OAAO,CASrD;AAED,uDAAuD;AACvD,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAMD,4FAA4F;AAC5F,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC;YAClD,IAAI,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAC;YAClD,OAAO,EAAE;gBACP,EAAE,EAAE,MAAM,CAAC;gBACX,KAAK,EAAE,MAAM,CAAC;gBACd,SAAS,EAAE,IAAI,CAAC;aACjB,CAAC;SACH,GAAG,IAAI,CAAC,CAAC;QACV,WAAW,EAAE,CAAC,IAAI,EAAE;YAClB,IAAI,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC;gBAAC,QAAQ,EAAE,MAAM,CAAA;aAAE,CAAC;SAC3C,KAAK,OAAO,CAAC;YAAE,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,GAAG,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QACrD,WAAW,EAAE,CAAC,IAAI,EAAE;YAClB,IAAI,EAAE;gBACJ,KAAK,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAM,CAAC;gBACb,WAAW,CAAC,EAAE,MAAM,CAAC;aACtB,CAAC;SACH,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;KACvD,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,qCAAqC;IACrC,OAAO,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACvC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAwSD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAElE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,eAAe,EAAE,CACf,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,eAAe,EAAE,OAAO,CAAA;KAAE,KACnC,OAAO,CAAC;QACX,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACnD,QAAQ,EAAE,KAAK,CAAC;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC5D,GAAG,IAAI,CAAC,CAAC;IACV,WAAW,EAAE,CAAC,OAAO,EAAE;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KACnB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,UAAU,EAAE,CAAC,IAAI,EAAE;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/B;AAED;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAmBhD;AAED,wBAAwB;AACxB,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAWrD"}

package/dist/server/better-auth-instance.js CHANGED Viewed

@@ -19,6 +19,8 @@ import { acceptPendingInvitationsForEmail } from "../org/accept-pending.js";
 import { autoJoinDomainMatchingOrgs } from "../org/auto-join-domain.js";
 import { saveOAuthTokens } from "../oauth-tokens/store.js";
 import { identify, track } from "../tracking/index.js";
+import { resolveAuthCookieNamespace } from "./cookie-namespace.js";
+import { getWorkspaceA2ADerivedSecret } from "./derived-secret.js";
 import { getDialect, getDatabaseUrl, getDatabaseAuthToken, pgPoolOptions, neonPoolMax, } from "../db/client.js";
 import { pgTable, text as pgText, timestamp as pgTimestamp, boolean as pgBoolean, } from "drizzle-orm/pg-core";
 import { sqliteTable, text as sqliteText, integer as sqliteInteger, } from "drizzle-orm/sqlite-core";
@@ -30,11 +32,14 @@ import { sqliteTable, text as sqliteText, integer as sqliteInteger, } from "driz
  *
  * Resolution order:
  *   1. `BETTER_AUTH_SECRET` env var — explicit, recommended for prod.
- *   2. `.env.local` in the template cwd — a per-workspace persistent secret
+ *   2. Hosted workspace deploys can derive a per-purpose secret from the
+ *      already-required `A2A_SECRET` root. This keeps fresh workspace branches
+ *      bootable without reusing the raw A2A key as a cookie-signing key.
+ *   3. `.env.local` in the template cwd — a per-workspace persistent secret
  *      that the framework writes once on first boot when no secret is set.
  *      Gitignored by convention (`.env*` in template .gitignore files), so
  *      it's safe to persist credentials here.
- *   3. Generate a new random 32-byte hex, write it to `.env.local`, and use
+ *   4. Generate a new random 32-byte hex, write it to `.env.local`, and use
  *      it. Subsequent restarts re-read the same file — so session cookies
  *      signed by a previous boot remain valid across dev-server restarts.
  *
@@ -50,11 +55,15 @@ import { sqliteTable, text as sqliteText, integer as sqliteInteger, } from "driz
 function resolveAuthSecret() {
     if (process.env.BETTER_AUTH_SECRET)
         return process.env.BETTER_AUTH_SECRET;
-    // In production, never auto-generate or fall back. A regenerated/derived
-    // secret invalidates every signed session cookie on the next cold start
-    // (serverless filesystems aren't persistent), and the legacy hardcoded
-    // fallback is identical across every deploy that hits it — both are
-    // serious enough to fail the boot loudly so the deployer notices.
+    const workspaceDerivedSecret = getWorkspaceA2ADerivedSecret("better-auth");
+    if (workspaceDerivedSecret)
+        return workspaceDerivedSecret;
+    // In production, beyond the workspace A2A-derived fallback above, never
+    // auto-generate or use legacy fallbacks. A generated secret invalidates every
+    // signed session cookie on the next cold start (serverless filesystems
+    // aren't persistent), and the legacy hardcoded fallback is identical across
+    // every deploy that hits it — both are serious enough to fail the boot loudly
+    // so the deployer notices.
     if (process.env.NODE_ENV === "production") {
         const sample = crypto.randomBytes(32).toString("hex");
         throw new Error("[agent-native] BETTER_AUTH_SECRET is not set. This is required in production " +
@@ -64,7 +73,9 @@ function resolveAuthSecret() {
             "Generate your own with `openssl rand -hex 32`. If you already have a " +
             "running deploy on the legacy hardcoded fallback and need to preserve " +
             "existing sessions, set BETTER_AUTH_SECRET=agent-native-local-dev-secret-k9x2m7q4w8 " +
-            "first, then rotate to a real value.");
+            "first, then rotate to a real value. Hosted workspace deploys may also " +
+            "set A2A_SECRET; agent-native derives a per-purpose Better Auth secret " +
+            "from that workspace root secret.");
     }
     // Dev: persist a generated secret to .env.local so sessions survive
     // dev-server restarts. Falls back to an in-memory random secret only if
@@ -526,6 +537,7 @@ async function createBetterAuthInstance(config) {
     const database = await buildDatabaseConfig(dialect);
     const secret = resolveAuthSecret();
     const appUrl = getAppProductionUrl();
+    const cookieNamespace = resolveAuthCookieNamespace();
     const requireEmailVerification = isEmailConfigured() && !shouldSkipEmailVerification();
     const auth = betterAuth({
         basePath,
@@ -668,7 +680,7 @@ async function createBetterAuthInstance(config) {
             },
         },
         advanced: {
-            cookiePrefix: "an",
+            cookiePrefix: cookieNamespace.betterAuthCookiePrefix,
             // Emit `SameSite=None; Secure` when the app is served over HTTPS so
             // session cookies are delivered inside third-party iframes (e.g. the
             // Builder.io editor). Plain-HTTP dev keeps the default (Lax) because
@@ -682,16 +694,15 @@ async function createBetterAuthInstance(config) {
                     },
                 }
                 : {}),
-            // When `COOKIE_DOMAIN` is set, share Better Auth's session cookie
-            // across every subdomain matching that domain. Pairs with the legacy
-            // framework cookie's matching `Domain=` attribute (auth.ts) so that
-            // signing into one first-party app (e.g. mail.agent-native.com)
-            // signs the user into all sibling apps without re-authenticating.
-            ...(process.env.COOKIE_DOMAIN
+            // When an effective shared cookie domain is set, share Better Auth's
+            // session cookie across that domain. First-party `*.agent-native.com`
+            // apps intentionally do not use this path because their auth DBs are
+            // separate; Dispatch identity federation handles cross-app sign-in.
+            ...(cookieNamespace.betterAuthCookieDomain
                 ? {
                     crossSubDomainCookies: {
                         enabled: true,
-                        domain: process.env.COOKIE_DOMAIN,
+                        domain: cookieNamespace.betterAuthCookieDomain,
                     },
                 }
                 : {}),

package/dist/server/better-auth-instance.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"better-auth-instance.js","sourceRoot":"","sources":["../../src/server/better-auth-instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,WAAW,GACZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,OAAO,EACP,IAAI,IAAI,MAAM,EACd,SAAS,IAAI,WAAW,EACxB,OAAO,IAAI,SAAS,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,IAAI,IAAI,UAAU,EAClB,OAAO,IAAI,aAAa,GACzB,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,iBAAiB;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAE1E,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,+EAA+E;YAC7E,0EAA0E;YAC1E,0DAA0D;YAC1D,wBAAwB,MAAM,MAAM;YACpC,uEAAuE;YACvE,uEAAuE;YACvE,qFAAqF;YACrF,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,QAAQ;IACR,EAAE;IACF,yDAAyD;IACzD,+DAA+D;IAC/D,qEAAqE;IACrE,sEAAsE;IACtE,mDAAmD;IACnD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,QAAQ,CAAC,CAAC,mGAAmG;YAC9I,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC,sGAAsG;QAClJ,OAAO,CAAC,GAAG,CACT,0EAA0E;YACxE,iDAAiD;YACjD,4EAA4E,CAC/E,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CACV,oEAAoE;YAClE,gEAAgE;YAChE,wDAAwD;YACxD,oFAAoF,CACvF,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtD,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CACrB,8DAA8D,CAC/D,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAoB,EAAE,MAAc;IAChE,MAAM,MAAM,GACV,+DAA+D;QAC/D,oEAAoE;QACpE,2DAA2D,CAAC;IAC9D,MAAM,IAAI,GAAG,sBAAsB,MAAM,IAAI,CAAC;IAE9C,yEAAyE;IACzE,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5E,EAAE,CAAC,cAAc,CACf,YAAY,EACZ,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CACzD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACvD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,OAAO,CAAC;AAC3E,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAyDD,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,IAAI,KAAqC,CAAC;AAC1C,IAAI,YAAqD,CAAC;AAC1D,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACxE,IAAI,aAAkB,CAAC;AAEvB,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,aAAa,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,oBAAoB,EAAE,MAAM,CAAC,wBAAwB,CAAC;KACvD,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;QACnC,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC;QACrC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;QAC3B,oBAAoB,EAAE,WAAW,CAAC,yBAAyB,EAAE;YAC3D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,qBAAqB,EAAE,WAAW,CAAC,0BAA0B,EAAE;YAC7D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACvC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE;QACxB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE;QAChC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;KAC7D,CAAC;CACH,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,aAAa,EAAE,aAAa,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aAChE,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;QACjB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,UAAU,CAAC,wBAAwB,CAAC;KAC3D,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,WAAW,EAAE,UAAU,CAAC,cAAc,CAAC;QACvC,YAAY,EAAE,UAAU,CAAC,eAAe,CAAC;QACzC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC;QAC/B,oBAAoB,EAAE,aAAa,CAAC,yBAAyB,EAAE;YAC7D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,qBAAqB,EAAE,aAAa,CAAC,0BAA0B,EAAE;YAC/D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC9C,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC3C,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC5B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,UAAU,EAAE,WAAW,CAAC,YAAY,EAAE;QACpC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACzD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;KACjE,CAAC;CACH,CAAC;AAEF,SAAS,mBAAmB;IAC1B,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,gCAAgC,CAAC,OAS/C;IACC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO;IACxD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO;IAE5B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iEAAiE;QACjE,kEAAkE;QAClE,oDAAoD;QACpD,OAAO;IACT,CAAC;IAED,kCAAkC;IAClC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAChC,GAAG,EAAE,uCAAuC;YAC5C,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACvB,CAAC,CAAC;QACH,KAAK,GAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAA4B,IAAI,SAAS,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,uEAAuE,EACvE,GAAG,CACJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,uEAAuE;IACvE,6BAA6B;IAC7B,IAAI,UAA8B,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC;IACzC,IAAI,GAAG,YAAY,IAAI,EAAE,CAAC;QACxB,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,UAAU,GAAG,GAAG,CAAC;IACnB,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAA4B;QACtC,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;KACrB,CAAC;IACF,IAAI,OAAO,CAAC,YAAY;QAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IACtE,IAAI,UAAU;QAAE,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC;IAChD,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAEvD,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,sBAAsB;IACnC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,UAAU,EAAE;QAC7B,CAAC,CAAC;YACE,sOAAsO;YACtO,iRAAiR;YACjR,sWAAsW;YACtW,mNAAmN;YACnN,4MAA4M;YAC5M,wNAAwN;YACxN,mSAAmS;YACnS,uKAAuK;SACxK;QACH,CAAC,CAAC;YACE,wNAAwN;YACxN,mQAAmQ;YACnQ,oVAAoV;YACpV,qMAAqM;YACrM,kMAAkM;YAClM,8MAA8M;YAC9M,qRAAqR;YACrR,6JAA6J;SAC9J,CAAC;IAEN,KAAK,MAAM,GAAG,IAAI,UAAU;QAAE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB;IAEzB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,YAAY,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAChD,KAAK,GAAG,MAAM,YAAY,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AA6BD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAExC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;QAChC,MAAM,EAAE,GAAG,GAAG,EAAE,eAAe,CAAC;QAChC,IACE,EAAE;YACF,OAAO,EAAE,CAAC,eAAe,KAAK,UAAU;YACxC,OAAO,EAAE,CAAC,WAAW,KAAK,UAAU;YACpC,OAAO,EAAE,CAAC,UAAU,KAAK,UAAU,EACnC,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,KAAK,GAAG,SAAS,CAAC;IAClB,YAAY,GAAG,SAAS,CAAC;IACzB,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;QACD,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,KAAK,UAAU,wBAAwB,CACrC,MAAyB;IAEzB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,wBAAwB,CAAC;IAC9D,MAAM,sBAAsB,EAAE,CAAC;IAE/B,uCAAuC;IACvC,MAAM,eAAe,GAAyC;QAC5D,GAAG,MAAM,EAAE,eAAe;KAC3B,CAAC;IAEF,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,wCAAwC;QACxC,MAAM,WAAW,GAAG,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC1E,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAC9C,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC;oBACE,KAAK,EAAE,YAAY;oBACnB,UAAU,EAAE,SAAkB;oBAC9B,MAAM,EAAE,SAAkB;iBAC3B;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;SAC/C,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,wBAAwB,GAC5B,iBAAiB,EAAE,IAAI,CAAC,2BAA2B,EAAE,CAAC;IAExD,MAAM,IAAI,GAAG,UAAU,CAAC;QACtB,QAAQ;QACR,OAAO,EAAE,MAAM;QACf,QAAQ;QACR,MAAM;QACN,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,CAAC;YACpB,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,wBAAwB;YACxB,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC3C,qEAAqE;gBACrE,sEAAsE;gBACtE,MAAM,WAAW,GAAG,CAClB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,WAAW,mCAAmC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAC;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ;iBACT,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,oEAAoE;YACpE,oEAAoE;YACpE,wCAAwC;YACxC,YAAY,EAAE,wBAAwB;YACtC,qEAAqE;YACrE,sEAAsE;YACtE,6CAA6C;YAC7C,2BAA2B,EAAE,IAAI;YACjC,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC7C,qEAAqE;gBACrE,6EAA6E;gBAC7E,MAAM,cAAc,GAAG,CACrB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,SAAS,GAAG,cAAc;oBAC9B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,cAAc,IAAI,CAAC;oBACzD,CAAC,CAAC,GAAG,CAAC;gBACR,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC;oBACtD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS;iBACV,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,eAAe;QACf,OAAO,EAAE;YACP,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,mEAAmE;YACnE,2BAA2B;YAC3B,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;aACvC;SACF;QACD,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,IAIb,EAAE,EAAE;wBACH,gEAAgE;wBAChE,+DAA+D;wBAC/D,8DAA8D;wBAC9D,sDAAsD;wBACtD,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;wBAC1B,IAAI,CAAC,KAAK;4BAAE,OAAO;wBACnB,QAAQ,CAAC,KAAK,EAAE;4BACd,KAAK;4BACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS;4BAC5B,UAAU,EAAE,IAAI,CAAC,EAAE;yBACpB,CAAC,CAAC;wBACH,KAAK,CACH,QAAQ,EACR;4BACE,aAAa,EAAE,aAAa;4BAC5B,YAAY,EAAE,IAAI,CAAC,EAAE;yBACtB,EACD,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;wBACF,IAAI,CAAC;4BACH,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;wBAChD,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,+DAA+D;4BAC/D,OAAO,CAAC,KAAK,CACX,kDAAkD,EAClD,GAAG,CACJ,CAAC;wBACJ,CAAC;wBACD,IAAI,CAAC;4BACH,2DAA2D;4BAC3D,yDAAyD;4BACzD,wDAAwD;4BACxD,0DAA0D;4BAC1D,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;wBAC1C,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,OAAO,CAAC,KAAK,CACX,iDAAiD,EACjD,GAAG,CACJ,CAAC;wBACJ,CAAC;oBACH,CAAC;iBACF;aACF;YACD,OAAO,EAAE;gBACP,+DAA+D;gBAC/D,iEAAiE;gBACjE,kEAAkE;gBAClE,oDAAoD;gBACpD,EAAE;gBACF,+DAA+D;gBAC/D,+DAA+D;gBAC/D,+DAA+D;gBAC/D,gDAAgD;gBAChD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;gBACD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;aACF;SACF;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU;YACxC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,gBAAgB;YACzC,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,cAAc;aAC/B;SACF;QACD,QAAQ,EAAE;YACR,YAAY,EAAE,IAAI;YAClB,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,mCAAmC;YACnC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC/B,CAAC,CAAC;oBACE,uBAAuB,EAAE;wBACvB,QAAQ,EAAE,MAAe;wBACzB,MAAM,EAAE,IAAI;wBACZ,WAAW,EAAE,IAAI;qBAClB;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,kEAAkE;YAClE,qEAAqE;YACrE,oEAAoE;YACpE,gEAAgE;YAChE,kEAAkE;YAClE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa;gBAC3B,CAAC,CAAC;oBACE,qBAAqB,EAAE;wBACrB,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;qBAClC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,OAAO,EAAE;YACP,kEAAkE;YAClE,GAAG,CAAC;gBACF,GAAG,EAAE;oBACH,MAAM,EAAE,MAAM;oBACd,cAAc,EAAE,KAAK;iBACtB;aACF,CAAC;YACF,+CAA+C;YAC/C,MAAM,EAAE;YACR,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC3B;KACF,CAAC,CAAC;IAEH,OAAO,IAAqC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAe;IAEf,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAE7D,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YAC1D,qEAAqE;YACrE,mEAAmE;YACnE,8DAA8D;YAC9D,+DAA+D;YAC/D,aAAa,GAAG,IAAI,IAAI,CAAC;gBACvB,gBAAgB,EAAE,GAAG;gBACrB,GAAG,EAAE,WAAW,EAAE;aACnB,CAAC,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAChE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACxE,OAAO,cAAc,CAAC,EAAE,EAAE;gBACxB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,YAAY;aACrB,CAAC,CAAC;QACL,CAAC;QAED,iEAAiE;QACjE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,mDAAmD;QACnD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAClD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAEjD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,kCAAkC;QAClC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACxE,OAAO,cAAc,CAAC,EAAE,EAAE;QACxB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAC;AACL,CAAC","sourcesContent":["/*\n Internal Better Auth instance — lazily created, not exported to templates.\n \n Templates interact with auth via the existing `getSession()`, `autoMountAuth()`,\n * `createAuthPlugin()`, and `createGoogleAuthPlugin()` APIs. Better Auth is an\n * implementation detail behind those interfaces.\n /\n\nimport crypto from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { betterAuth, type BetterAuthOptions } from \"better-auth\";\nimport { jwt } from \"better-auth/plugins/jwt\";\nimport { bearer } from \"better-auth/plugins/bearer\";\nimport { sendEmail, isEmailConfigured } from \"./email.js\";\nimport {\n renderResetPasswordEmail,\n renderVerifySignupEmail,\n} from \"./email-templates.js\";\nimport { getAppProductionUrl } from \"./app-url.js\";\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport { acceptPendingInvitationsForEmail } from \"../org/accept-pending.js\";\nimport { autoJoinDomainMatchingOrgs } from \"../org/auto-join-domain.js\";\nimport { saveOAuthTokens } from \"../oauth-tokens/store.js\";\nimport { identify, track } from \"../tracking/index.js\";\nimport {\n getDialect,\n getDatabaseUrl,\n getDatabaseAuthToken,\n pgPoolOptions,\n neonPoolMax,\n} from \"../db/client.js\";\nimport {\n pgTable,\n text as pgText,\n timestamp as pgTimestamp,\n boolean as pgBoolean,\n} from \"drizzle-orm/pg-core\";\nimport {\n sqliteTable,\n text as sqliteText,\n integer as sqliteInteger,\n} from \"drizzle-orm/sqlite-core\";\n\n// ---------------------------------------------------------------------------\n// Persistent auth secret\n// ---------------------------------------------------------------------------\n\n/\n Resolve the Better Auth signing secret.\n \n Resolution order:\n * 1. `BETTER_AUTH_SECRET` env var — explicit, recommended for prod.\n * 2. `.env.local` in the template cwd — a per-workspace persistent secret\n * that the framework writes once on first boot when no secret is set.\n * Gitignored by convention (`.env` in template .gitignore files), so\n it's safe to persist credentials here.\n * 3. Generate a new random 32-byte hex, write it to `.env.local`, and use\n * it. Subsequent restarts re-read the same file — so session cookies\n * signed by a previous boot remain valid across dev-server restarts.\n \n Why this matters: before this helper existed, missing `BETTER_AUTH_SECRET`\n * fell through to `GOOGLE_CLIENT_SECRET` / `ACCESS_TOKEN` / a hardcoded\n * string. If a template happened to have none of those, each dev-server\n * boot would re-fall back to the hardcoded value (still stable) — but\n * rotating Google credentials, toggling `ACCESS_TOKEN`, or churning the\n * fallback chain would invalidate every signed cookie and force everyone\n * to sign in again. Pinning the secret to `.env.local` on first boot\n * removes that footgun.\n /\nfunction resolveAuthSecret(): string {\n if (process.env.BETTER_AUTH_SECRET) return process.env.BETTER_AUTH_SECRET;\n\n // In production, never auto-generate or fall back. A regenerated/derived\n // secret invalidates every signed session cookie on the next cold start\n // (serverless filesystems aren't persistent), and the legacy hardcoded\n // fallback is identical across every deploy that hits it — both are\n // serious enough to fail the boot loudly so the deployer notices.\n if (process.env.NODE_ENV === \"production\") {\n const sample = crypto.randomBytes(32).toString(\"hex\");\n throw new Error(\n \"[agent-native] BETTER_AUTH_SECRET is not set. This is required in production \" +\n \"so signed session cookies stay valid across deploys. Set it as a deploy \" +\n \"environment variable (any 32-byte hex string), e.g.:\\n\\n\" +\n ` BETTER_AUTH_SECRET=${sample}\\n\\n` +\n \"Generate your own with `openssl rand -hex 32`. If you already have a \" +\n \"running deploy on the legacy hardcoded fallback and need to preserve \" +\n \"existing sessions, set BETTER_AUTH_SECRET=agent-native-local-dev-secret-k9x2m7q4w8 \" +\n \"first, then rotate to a real value.\",\n );\n }\n\n // Dev: persist a generated secret to .env.local so sessions survive\n // dev-server restarts. Falls back to an in-memory random secret only if\n // the filesystem isn't writable (rare in dev, e.g. read-only mounts) —\n // sessions reset on every dev-process restart in that case, which is\n // fine.\n //\n // SECURITY (audit 09 LOW-2): the previous fallback chain\n // (`GOOGLE_CLIENT_SECRET \|\| ACCESS_TOKEN \|\| hardcoded`) reused\n // cross-purpose secrets and a public hardcoded literal as the cookie\n // HMAC. Dropped entirely — better to mint an ephemeral secret than to\n // re-use a Google client secret or a known string.\n try {\n const envLocalPath = path.resolve(process.cwd(), \".env.local\");\n const existing = readEnvLocalSecret(envLocalPath);\n if (existing) {\n process.env.BETTER_AUTH_SECRET = existing; // guard:allow-env-mutation — boot-time secret resolution from .env.local, runs once at module init\n return existing;\n }\n\n const generated = crypto.randomBytes(32).toString(\"hex\");\n appendEnvLocalSecret(envLocalPath, generated);\n process.env.BETTER_AUTH_SECRET = generated; // guard:allow-env-mutation — boot-time secret generation, runs once at module init before any request\n console.log(\n \"[agent-native] Generated a persistent BETTER_AUTH_SECRET in .env.local. \" +\n \"Sessions will now survive dev-server restarts. \" +\n \"(Delete .env.local to rotate; set BETTER_AUTH_SECRET in .env to override.)\",\n );\n return generated;\n } catch {\n // Filesystem unwritable (read-only mount, sandboxed test env, etc.).\n // Mint a per-process random secret so cookies stay unique per boot.\n // Sessions reset when the dev process restarts — acceptable for dev.\n const ephemeral = crypto.randomBytes(32).toString(\"hex\");\n console.warn(\n \"[agent-native] Could not persist BETTER_AUTH_SECRET to .env.local \" +\n \"(filesystem unwritable). Using an ephemeral in-memory secret. \" +\n \"Sessions will reset every time this process restarts. \" +\n \"Set BETTER_AUTH_SECRET in your environment to keep sessions valid across restarts.\",\n );\n return ephemeral;\n }\n}\n\nfunction readEnvLocalSecret(envLocalPath: string): string \| undefined {\n try {\n const content = fs.readFileSync(envLocalPath, \"utf8\");\n // Match `BETTER_AUTH_SECRET=...` on its own line. Tolerate optional\n // quotes and leading `export `. Stop at the first newline or quote.\n const m = content.match(\n /^(?:export\\s+)?BETTER_AUTH_SECRET\\s=\\s\"?([^\"\\r\\n]+)\"?\\s$/m,\n );\n return m?.[1]?.trim() \|\| undefined;\n } catch {\n return undefined;\n }\n}\n\nfunction appendEnvLocalSecret(envLocalPath: string, secret: string): void {\n const header =\n \"# Auto-generated by agent-native on first boot. Gitignored.\\n\" +\n \"# Keeps signed session cookies valid across dev-server restarts.\\n\" +\n \"# Delete this file (or this line) to rotate the secret.\\n\";\n const line = `BETTER_AUTH_SECRET=${secret}\\n`;\n\n // If the file already exists, just append; otherwise create with header.\n if (fs.existsSync(envLocalPath)) {\n const existing = fs.readFileSync(envLocalPath, \"utf8\");\n const needsLeadingNewline = existing.length > 0 && !existing.endsWith(\"\\n\");\n fs.appendFileSync(\n envLocalPath,\n (needsLeadingNewline ? \"\\n\" : \"\") + \"\\n\" + header + line,\n );\n } else {\n fs.writeFileSync(envLocalPath, header + line, { mode: 0o600 });\n }\n}\n\nexport function shouldSkipEmailVerification(): boolean {\n const value = process.env.AUTH_SKIP_EMAIL_VERIFICATION;\n if (value == null) {\n return (\n process.env.NODE_ENV === \"development\" \|\| process.env.NODE_ENV === \"test\"\n );\n }\n const normalized = value.trim().toLowerCase();\n return normalized !== \"\" && normalized !== \"0\" && normalized !== \"false\";\n}\n\n/** Read-only accessor for the resolved auth secret. /\nexport function getAuthSecret(): string {\n return resolveAuthSecret();\n}\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/* The shape we need from a Better Auth instance (internal — not exported to templates). /\nexport interface BetterAuthInstance {\n handler: (request: Request) => Promise<Response>;\n api: {\n getSession: (opts: { headers: Headers }) => Promise<{\n user: { id: string; email: string; name: string };\n session: {\n id: string;\n token: string;\n expiresAt: Date;\n };\n } \| null>;\n signInEmail: (opts: {\n body: { email: string; password: string };\n }) => Promise<{ token?: string; user?: any } \| null>;\n signUpEmail: (opts: {\n body: {\n email: string;\n password: string;\n name: string;\n callbackURL?: string;\n };\n }) => Promise<any>;\n signOut: (opts: { headers: Headers }) => Promise<any>;\n };\n}\n\nexport interface BetterAuthConfig {\n /* Base path for Better Auth routes. Default: \"/_agent-native/auth/ba\" /\n basePath?: string;\n /* Additional social providers beyond what env vars auto-detect /\n socialProviders?: BetterAuthOptions[\"socialProviders\"];\n /* Additional Better Auth plugins /\n plugins?: BetterAuthOptions[\"plugins\"];\n /\n Additional Google OAuth scopes (Gmail, Calendar, etc.) to request\n * up front during the primary \"Sign in with Google\" flow, beyond the\n * default identity scopes (`openid`, `email`, `profile`).\n \n When set, the Google social provider also opts into:\n * - `accessType: \"offline\"` — so a refresh token is issued\n * - `prompt: \"consent\"` — so the refresh token is reissued every sign-in\n \n Tokens are mirrored into `oauth_tokens` via a databaseHooks.account\n * hook so existing template code that reads from `oauth_tokens` (mail's\n * Gmail client, calendar's events fetcher) works without any separate\n * \"Connect Google\" page.\n /\n googleScopes?: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Lazy instance\n// ---------------------------------------------------------------------------\n\nlet _auth: BetterAuthInstance \| undefined;\nlet _initPromise: Promise<BetterAuthInstance> \| undefined;\n// Track the Neon serverless Pool we open for Better Auth so closeBetterAuth()\n// can release it. The Pool keeps WebSocket connections open; leaking them on\n// hot-reload or process restart exhausts Neon's connection slot budget.\nlet _neonAuthPool: any;\n\nconst pgAuthSchema = {\n user: pgTable(\"user\", {\n id: pgText(\"id\").primaryKey(),\n name: pgText(\"name\").notNull(),\n email: pgText(\"email\").notNull().unique(),\n emailVerified: pgBoolean(\"email_verified\").notNull().default(false),\n image: pgText(\"image\"),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n session: pgTable(\"session\", {\n id: pgText(\"id\").primaryKey(),\n expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n token: pgText(\"token\").notNull().unique(),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n ipAddress: pgText(\"ip_address\"),\n userAgent: pgText(\"user_agent\"),\n userId: pgText(\"user_id\").notNull(),\n activeOrganizationId: pgText(\"active_organization_id\"),\n }),\n account: pgTable(\"account\", {\n id: pgText(\"id\").primaryKey(),\n accountId: pgText(\"account_id\").notNull(),\n providerId: pgText(\"provider_id\").notNull(),\n userId: pgText(\"user_id\").notNull(),\n accessToken: pgText(\"access_token\"),\n refreshToken: pgText(\"refresh_token\"),\n idToken: pgText(\"id_token\"),\n accessTokenExpiresAt: pgTimestamp(\"access_token_expires_at\", {\n withTimezone: true,\n }),\n refreshTokenExpiresAt: pgTimestamp(\"refresh_token_expires_at\", {\n withTimezone: true,\n }),\n scope: pgText(\"scope\"),\n password: pgText(\"password\"),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n verification: pgTable(\"verification\", {\n id: pgText(\"id\").primaryKey(),\n identifier: pgText(\"identifier\").notNull(),\n value: pgText(\"value\").notNull(),\n expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n organization: pgTable(\"organization\", {\n id: pgText(\"id\").primaryKey(),\n name: pgText(\"name\").notNull(),\n slug: pgText(\"slug\").notNull().unique(),\n logo: pgText(\"logo\"),\n metadata: pgText(\"metadata\"),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n member: pgTable(\"member\", {\n id: pgText(\"id\").primaryKey(),\n organizationId: pgText(\"organization_id\").notNull(),\n userId: pgText(\"user_id\").notNull(),\n role: pgText(\"role\").notNull().default(\"member\"),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n invitation: pgTable(\"invitation\", {\n id: pgText(\"id\").primaryKey(),\n organizationId: pgText(\"organization_id\").notNull(),\n email: pgText(\"email\").notNull(),\n role: pgText(\"role\"),\n status: pgText(\"status\").notNull().default(\"pending\"),\n expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n inviterId: pgText(\"inviter_id\").notNull(),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n jwks: pgTable(\"jwks\", {\n id: pgText(\"id\").primaryKey(),\n publicKey: pgText(\"public_key\").notNull(),\n privateKey: pgText(\"private_key\").notNull(),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }),\n }),\n};\n\nconst sqliteAuthSchema = {\n user: sqliteTable(\"user\", {\n id: sqliteText(\"id\").primaryKey(),\n name: sqliteText(\"name\").notNull(),\n email: sqliteText(\"email\").notNull().unique(),\n emailVerified: sqliteInteger(\"email_verified\", { mode: \"boolean\" })\n .notNull()\n .default(false),\n image: sqliteText(\"image\"),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n session: sqliteTable(\"session\", {\n id: sqliteText(\"id\").primaryKey(),\n expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n token: sqliteText(\"token\").notNull().unique(),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n ipAddress: sqliteText(\"ip_address\"),\n userAgent: sqliteText(\"user_agent\"),\n userId: sqliteText(\"user_id\").notNull(),\n activeOrganizationId: sqliteText(\"active_organization_id\"),\n }),\n account: sqliteTable(\"account\", {\n id: sqliteText(\"id\").primaryKey(),\n accountId: sqliteText(\"account_id\").notNull(),\n providerId: sqliteText(\"provider_id\").notNull(),\n userId: sqliteText(\"user_id\").notNull(),\n accessToken: sqliteText(\"access_token\"),\n refreshToken: sqliteText(\"refresh_token\"),\n idToken: sqliteText(\"id_token\"),\n accessTokenExpiresAt: sqliteInteger(\"access_token_expires_at\", {\n mode: \"timestamp_ms\",\n }),\n refreshTokenExpiresAt: sqliteInteger(\"refresh_token_expires_at\", {\n mode: \"timestamp_ms\",\n }),\n scope: sqliteText(\"scope\"),\n password: sqliteText(\"password\"),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n verification: sqliteTable(\"verification\", {\n id: sqliteText(\"id\").primaryKey(),\n identifier: sqliteText(\"identifier\").notNull(),\n value: sqliteText(\"value\").notNull(),\n expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n organization: sqliteTable(\"organization\", {\n id: sqliteText(\"id\").primaryKey(),\n name: sqliteText(\"name\").notNull(),\n slug: sqliteText(\"slug\").notNull().unique(),\n logo: sqliteText(\"logo\"),\n metadata: sqliteText(\"metadata\"),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n member: sqliteTable(\"member\", {\n id: sqliteText(\"id\").primaryKey(),\n organizationId: sqliteText(\"organization_id\").notNull(),\n userId: sqliteText(\"user_id\").notNull(),\n role: sqliteText(\"role\").notNull().default(\"member\"),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n invitation: sqliteTable(\"invitation\", {\n id: sqliteText(\"id\").primaryKey(),\n organizationId: sqliteText(\"organization_id\").notNull(),\n email: sqliteText(\"email\").notNull(),\n role: sqliteText(\"role\"),\n status: sqliteText(\"status\").notNull().default(\"pending\"),\n expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n inviterId: sqliteText(\"inviter_id\").notNull(),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n jwks: sqliteTable(\"jwks\", {\n id: sqliteText(\"id\").primaryKey(),\n publicKey: sqliteText(\"public_key\").notNull(),\n privateKey: sqliteText(\"private_key\").notNull(),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }),\n }),\n};\n\nfunction getBetterAuthSchema() {\n return isPostgres() ? pgAuthSchema : sqliteAuthSchema;\n}\n\n/\n Mirror a Better Auth `account` row for Google into the `oauth_tokens`\n * table that template code (mail's Gmail client, calendar's events fetcher)\n * reads from. Called from the `databaseHooks.account.create.after` and\n * `.update.after` hooks so tokens captured during the primary \"Sign in\n * with Google\" flow flow straight to the apps that need them — no\n * separate \"Connect Google\" page required.\n \n Resolves `account.userId` to the user's email by querying the `user`\n * table (Better Auth always quotes \"user\" because it's a reserved word\n * in Postgres; SQLite accepts the quotes too).\n \n The hook is fire-and-forget from the caller's perspective — every\n * failure is caught upstream so a flake in `oauth_tokens` never blocks\n * sign-in. We still no-op on missing fields here as a defense in depth.\n /\nasync function mirrorGoogleAccountToOAuthTokens(account: {\n providerId?: string;\n userId?: string;\n accountId?: string;\n accessToken?: string \| null;\n refreshToken?: string \| null;\n accessTokenExpiresAt?: Date \| string \| number \| null;\n scope?: string \| null;\n idToken?: string \| null;\n}): Promise<void> {\n if (!account \|\| account.providerId !== \"google\") return;\n if (!account.userId) return;\n\n const accessToken = account.accessToken ?? undefined;\n if (!accessToken) {\n // Better Auth sometimes upserts an account row before tokens are\n // attached (e.g. linking flows). Nothing to mirror yet — the next\n // update hook will run once the access token lands.\n return;\n }\n\n // Resolve user email from userId.\n const db = getDbExec();\n let email: string \| undefined;\n try {\n const { rows } = await db.execute({\n sql: 'SELECT email FROM \"user\" WHERE id = ?',\n args: [account.userId],\n });\n email = (rows[0]?.email as string \| undefined) ?? undefined;\n } catch (err) {\n console.error(\n \"[auth] mirror Google tokens: failed to resolve user email from userId\",\n err,\n );\n return;\n }\n if (!email) return;\n\n // Normalise expiry to epoch ms (Google's \"expiry_date\" convention used\n // throughout the templates).\n let expiryDate: number \| undefined;\n const raw = account.accessTokenExpiresAt;\n if (raw instanceof Date) {\n expiryDate = raw.getTime();\n } else if (typeof raw === \"number\") {\n expiryDate = raw;\n } else if (typeof raw === \"string\") {\n const ms = Date.parse(raw);\n expiryDate = Number.isFinite(ms) ? ms : undefined;\n }\n\n const tokens: Record<string, unknown> = {\n access_token: accessToken,\n token_type: \"Bearer\",\n };\n if (account.refreshToken) tokens.refresh_token = account.refreshToken;\n if (expiryDate) tokens.expiry_date = expiryDate;\n if (account.scope) tokens.scope = account.scope;\n if (account.idToken) tokens.id_token = account.idToken;\n\n await saveOAuthTokens(\"google\", email, tokens, email);\n}\n\nasync function ensureBetterAuthTables(): Promise<void> {\n const db = getDbExec();\n const statements = isPostgres()\n ? [\n `CREATE TABLE IF NOT EXISTS \"user\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified BOOLEAN NOT NULL DEFAULT FALSE, image TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"session\" (id TEXT PRIMARY KEY, expires_at TIMESTAMPTZ NOT NULL, token TEXT NOT NULL UNIQUE, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n `CREATE TABLE IF NOT EXISTS \"account\" (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at TIMESTAMPTZ, refresh_token_expires_at TIMESTAMPTZ, scope TEXT, password TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"verification\" (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"organization\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"member\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"invitation\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at TIMESTAMPTZ NOT NULL, inviter_id TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"jwks\" (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, expires_at TIMESTAMPTZ)`,\n ]\n : [\n `CREATE TABLE IF NOT EXISTS user (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified INTEGER NOT NULL DEFAULT 0, image TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS session (id TEXT PRIMARY KEY, expires_at INTEGER NOT NULL, token TEXT NOT NULL UNIQUE, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n `CREATE TABLE IF NOT EXISTS account (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at INTEGER, refresh_token_expires_at INTEGER, scope TEXT, password TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS verification (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at INTEGER NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS organization (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS member (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS invitation (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at INTEGER NOT NULL, inviter_id TEXT NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS jwks (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at INTEGER NOT NULL, expires_at INTEGER)`,\n ];\n\n for (const sql of statements) await db.execute(sql);\n}\n\n/\n Get or create the Better Auth instance.\n * Lazily initialized on first call — the database must be reachable by then.\n /\nexport async function getBetterAuth(\n config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n if (_auth) return _auth;\n if (_initPromise) return _initPromise;\n\n _initPromise = createBetterAuthInstance(config);\n _auth = await _initPromise;\n return _auth;\n}\n\n/\n Synchronous getter — returns the instance if already initialized, else undefined.\n * Use this in hot paths where you know init has already happened.\n /\nexport function getBetterAuthSync(): BetterAuthInstance \| undefined {\n return _auth;\n}\n\n/\n The subset of Better Auth's internal adapter we use for federated-SSO\n * JIT account linking. Better Auth owns these writes (id + timestamp +\n * schema handling), so callers never hand-roll SQL against `user`/`account`.\n * Read-only lookups + strictly-additive `linkAccount`/`createUser` only — no\n * update/delete of existing identity rows.\n /\nexport interface BetterAuthInternalAdapter {\n findUserByEmail: (\n email: string,\n options?: { includeAccounts: boolean },\n ) => Promise<{\n user: { id: string; email: string; name?: string };\n accounts: Array<{ providerId: string; accountId: string }>;\n } \| null>;\n linkAccount: (account: {\n userId: string;\n providerId: string;\n accountId: string;\n }) => Promise<unknown>;\n createUser: (user: {\n email: string;\n name: string;\n emailVerified?: boolean;\n }) => Promise<{ id: string }>;\n}\n\n/\n Resolve Better Auth's internal adapter via the live instance's\n * `$context`. The framework's narrowed `BetterAuthInstance` interface omits\n * `$context`, but the underlying object created by `betterAuth(...)` always\n * exposes it (see Better Auth's `Auth` type) — so this is a safe, typed\n * accessor for the federated-SSO client. Returns `undefined` if the context\n * shape is unexpected (older/newer Better Auth) so callers can fall back.\n /\nexport async function getBetterAuthInternalAdapter(\n config?: BetterAuthConfig,\n): Promise<BetterAuthInternalAdapter \| undefined> {\n const auth = (await getBetterAuth(config)) as unknown as {\n $context?: Promise<{ internalAdapter?: BetterAuthInternalAdapter }>;\n };\n try {\n const ctx = await auth.$context;\n const ia = ctx?.internalAdapter;\n if (\n ia &&\n typeof ia.findUserByEmail === \"function\" &&\n typeof ia.linkAccount === \"function\" &&\n typeof ia.createUser === \"function\"\n ) {\n return ia;\n }\n } catch {\n // Context resolution failed — caller falls back to the signup path.\n }\n return undefined;\n}\n\n/* Reset for testing /\nexport async function resetBetterAuth(): Promise<void> {\n _auth = undefined;\n _initPromise = undefined;\n if (_neonAuthPool) {\n try {\n await _neonAuthPool.end();\n } catch {\n // Pool may have already closed (process exiting, etc.) — don't block reset.\n }\n _neonAuthPool = undefined;\n }\n}\n\n// ---------------------------------------------------------------------------\n// Instance creation\n// ---------------------------------------------------------------------------\n\nasync function createBetterAuthInstance(\n config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n const dialect = getDialect();\n const basePath = config?.basePath ?? \"/_agent-native/auth/ba\";\n await ensureBetterAuthTables();\n\n // Build social providers from env vars\n const socialProviders: BetterAuthOptions[\"socialProviders\"] = {\n ...config?.socialProviders,\n };\n\n if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {\n // When the template requests broader scopes (Gmail, Calendar, etc.)\n // ask for them on the primary sign-in flow so a separate \"Connect\n // Google\" round-trip isn't needed. `accessType: \"offline\"` plus\n // `prompt: \"consent\"` ensures we always receive a refresh token back —\n // Google only re-issues a refresh token on consent, so re-signing in\n // (e.g. after switching machines) would otherwise leave us with an\n // access token that can't be refreshed.\n const extraScopes = config?.googleScopes ?? [];\n const baseScopes = [\"openid\", \"email\", \"profile\"];\n const mergedScopes = Array.from(new Set([...baseScopes, ...extraScopes]));\n socialProviders.google = {\n clientId: process.env.GOOGLE_CLIENT_ID,\n clientSecret: process.env.GOOGLE_CLIENT_SECRET,\n ...(extraScopes.length > 0\n ? {\n scope: mergedScopes,\n accessType: \"offline\" as const,\n prompt: \"consent\" as const,\n }\n : {}),\n };\n }\n\n if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {\n socialProviders.github = {\n clientId: process.env.GITHUB_CLIENT_ID,\n clientSecret: process.env.GITHUB_CLIENT_SECRET,\n };\n }\n\n // Build database config\n const database = await buildDatabaseConfig(dialect);\n\n const secret = resolveAuthSecret();\n\n const appUrl = getAppProductionUrl();\n const requireEmailVerification =\n isEmailConfigured() && !shouldSkipEmailVerification();\n\n const auth = betterAuth({\n basePath,\n baseURL: appUrl,\n database,\n secret,\n emailAndPassword: {\n enabled: true,\n minPasswordLength: 8,\n // Only require email verification when an email provider is configured.\n // Without a provider, verification emails can't be sent, so requiring\n // verification would lock users out of signup entirely. Local dev/test\n // skip verification by default so +qa accounts can be created quickly;\n // hosted QA deployments can opt out with AUTH_SKIP_EMAIL_VERIFICATION=1.\n requireEmailVerification,\n sendResetPassword: async ({ user, token }) => {\n // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n // reset link must include that prefix so the page resolves correctly.\n const appBasePath = (\n process.env.VITE_APP_BASE_PATH \|\|\n process.env.APP_BASE_PATH \|\|\n \"\"\n ).replace(/\\/$/, \"\");\n const resetUrl = `${appUrl}${appBasePath}/_agent-native/auth/reset?token=${encodeURIComponent(token)}`;\n const { subject, html, text } = renderResetPasswordEmail({\n email: user.email,\n resetUrl,\n });\n await sendEmail({ to: user.email, subject, html, text });\n },\n },\n emailVerification: {\n // Fire verification email right after signup, before the user has a\n // session — pairs with requireEmailVerification above. Only enabled\n // when an email provider is configured.\n sendOnSignUp: requireEmailVerification,\n // Auto-create a session once the user clicks the link. Without this,\n // verified users would have to go back and sign in manually, which is\n // a confusing dead-end on the verify screen.\n autoSignInAfterVerification: true,\n sendVerificationEmail: async ({ user, url }) => {\n // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n // verification link must include that prefix so the page resolves correctly.\n const verifyBasePath = (\n process.env.VITE_APP_BASE_PATH \|\|\n process.env.APP_BASE_PATH \|\|\n \"\"\n ).replace(/\\/$/, \"\");\n const verifyUrl = verifyBasePath\n ? url.replace(/(\\/\\/[^/]+)(\\/)/, `$1${verifyBasePath}$2`)\n : url;\n const { subject, html, text } = renderVerifySignupEmail({\n email: user.email,\n verifyUrl,\n });\n await sendEmail({ to: user.email, subject, html, text });\n },\n },\n socialProviders,\n account: {\n // Merge accounts when a user signs in with a social provider using an\n // email that already has a local email/password account (or vice versa).\n // Only providers listed in `trustedProviders` auto-link — these are the\n // ones that verify emails at the identity layer. Never add a provider\n // here that lets users claim an unverified email; that would be an\n // account-takeover vector.\n accountLinking: {\n enabled: true,\n trustedProviders: [\"google\", \"github\"],\n },\n },\n databaseHooks: {\n user: {\n create: {\n after: async (user: {\n id?: string;\n email?: string;\n name?: string \| null;\n }) => {\n // When a newly-created user's email has pending org invitations\n // (common when someone is invited before* they've signed up),\n // auto-accept them so the user lands in the org on their very\n // first page load instead of a blank-slate workspace.\n const email = user?.email;\n if (!email) return;\n identify(email, {\n email,\n name: user.name ?? undefined,\n authUserId: user.id,\n });\n track(\n \"signup\",\n {\n auth_provider: \"better-auth\",\n auth_user_id: user.id,\n },\n { userId: email },\n );\n try {\n await acceptPendingInvitationsForEmail(email);\n } catch (err) {\n // Never block signup on invite bookkeeping — log and continue.\n console.error(\n \"[auth] failed to auto-accept pending invitations\",\n err,\n );\n }\n try {\n // Auto-join orgs whose `allowed_domain` matches this email\n // domain. Lets a fresh `@builder.io` (or any org-domain)\n // signup land inside the company org on first page load\n // without going through the picker. No-ops when no match.\n await autoJoinDomainMatchingOrgs(email);\n } catch (err) {\n console.error(\n \"[auth] failed to auto-join domain-matching orgs\",\n err,\n );\n }\n },\n },\n },\n account: {\n // Mirror Google account tokens into `oauth_tokens` so existing\n // template code (mail's Gmail client, calendar's events fetcher)\n // can pick up Gmail/Calendar credentials from the primary sign-in\n // flow — no separate \"Set up Google\" page required.\n //\n // Better Auth fires `create` for first-time social sign-in and\n // `update` whenever a session re-issues tokens (e.g., the user\n // re-signs in to refresh the token). Both branches do the same\n // mirroring work; failures never block sign-in.\n create: {\n after: async (account: any) => {\n await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n console.error(\n \"[auth] failed to mirror Google account tokens to oauth_tokens (create)\",\n err,\n );\n });\n },\n },\n update: {\n after: async (account: any) => {\n await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n console.error(\n \"[auth] failed to mirror Google account tokens to oauth_tokens (update)\",\n err,\n );\n });\n },\n },\n },\n },\n session: {\n expiresIn: 60 * 60 * 24 * 30, // 30 days\n updateAge: 60 * 60 * 24, // refresh daily\n cookieCache: {\n enabled: true,\n maxAge: 5 * 60, // 5 min cache\n },\n },\n advanced: {\n cookiePrefix: \"an\",\n // Emit `SameSite=None; Secure` when the app is served over HTTPS so\n // session cookies are delivered inside third-party iframes (e.g. the\n // Builder.io editor). Plain-HTTP dev keeps the default (Lax) because\n // `SameSite=None` requires Secure.\n ...(appUrl.startsWith(\"https://\")\n ? {\n defaultCookieAttributes: {\n sameSite: \"none\" as const,\n secure: true,\n partitioned: true,\n },\n }\n : {}),\n // When `COOKIE_DOMAIN` is set, share Better Auth's session cookie\n // across every subdomain matching that domain. Pairs with the legacy\n // framework cookie's matching `Domain=` attribute (auth.ts) so that\n // signing into one first-party app (e.g. mail.agent-native.com)\n // signs the user into all sibling apps without re-authenticating.\n ...(process.env.COOKIE_DOMAIN\n ? {\n crossSubDomainCookies: {\n enabled: true,\n domain: process.env.COOKIE_DOMAIN,\n },\n }\n : {}),\n },\n plugins: [\n // JWT: issue tokens for A2A calls, JWKS endpoint for verification\n jwt({\n jwt: {\n issuer: appUrl,\n expirationTime: \"15m\",\n },\n }),\n // Bearer: accept Bearer tokens on API requests\n bearer(),\n ...(config?.plugins ?? []),\n ],\n });\n\n return auth as unknown as BetterAuthInstance;\n}\n\nasync function buildDatabaseConfig(\n dialect: string,\n): Promise<BetterAuthOptions[\"database\"]> {\n if (dialect === \"postgres\") {\n const url = getDatabaseUrl();\n const { isNeonUrl } = await import(\"../db/create-get-db.js\");\n\n // Neon via @neondatabase/serverless (WebSockets over HTTPS). postgres-js\n // opens a raw TCP connection on port 5432 which frequently times out on\n // Netlify Functions / Vercel / CF Workers when Neon's pooler is cold.\n if (isNeonUrl(url)) {\n const { Pool } = await import(\"@neondatabase/serverless\");\n // Cap the auth pool the same way as the app pool. Better Auth runs a\n // session lookup on essentially every authenticated request, so an\n // un-capped pool here is a primary contributor to \"Max client\n // connections reached\" across concurrent serverless instances.\n _neonAuthPool = new Pool({\n connectionString: url,\n max: neonPoolMax(),\n });\n const { drizzle } = await import(\"drizzle-orm/neon-serverless\");\n const db = drizzle(_neonAuthPool, { schema: pgAuthSchema });\n const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n return drizzleAdapter(db, {\n provider: \"pg\",\n schema: pgAuthSchema,\n });\n }\n\n // Non-Neon Postgres (Supabase, self-hosted, etc.) → postgres-js.\n // pgPoolOptions caps this pool to a small size on serverless. Better Auth\n // runs a session lookup on essentially every authenticated request, so an\n // un-capped pool here is a primary contributor to \"Max client connections\n // reached\" across concurrent serverless instances.\n const { default: postgres } = await import(\"postgres\");\n const sql = postgres(url, pgPoolOptions(url));\n const { drizzle } = await import(\"drizzle-orm/postgres-js\");\n const db = drizzle(sql, { schema: pgAuthSchema });\n const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n return drizzleAdapter(db, {\n provider: \"pg\",\n schema: pgAuthSchema,\n });\n }\n\n // SQLite / libsql\n const url = getDatabaseUrl(\"file:./data/app.db\");\n\n if (url.startsWith(\"file:\") \|\| !url.includes(\"://\")) {\n // Local SQLite via better-sqlite3\n const { default: Database } = await import(\"better-sqlite3\");\n const filePath = url.replace(/^file:/, \"\");\n const sqlite = new Database(filePath);\n sqlite.pragma(\"journal_mode = WAL\");\n const { drizzle } = await import(\"drizzle-orm/better-sqlite3\");\n const db = drizzle(sqlite, { schema: sqliteAuthSchema });\n const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n return drizzleAdapter(db, {\n provider: \"sqlite\",\n schema: sqliteAuthSchema,\n });\n }\n\n // Remote libsql (Turso). Use the web client to avoid serverless bundles\n // depending on libsql's platform-specific native packages.\n const { createClient } = await import(\"@libsql/client/web\");\n const client = createClient({ url, authToken: getDatabaseAuthToken() });\n const { drizzle } = await import(\"drizzle-orm/libsql/web\");\n const db = drizzle(client, { schema: sqliteAuthSchema });\n const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n return drizzleAdapter(db, {\n provider: \"sqlite\",\n schema: sqliteAuthSchema,\n });\n}\n"]}
1	+ {"version":3,"file":"better-auth-instance.js","sourceRoot":"","sources":["../../src/server/better-auth-instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,WAAW,GACZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,OAAO,EACP,IAAI,IAAI,MAAM,EACd,SAAS,IAAI,WAAW,EACxB,OAAO,IAAI,SAAS,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,IAAI,IAAI,UAAU,EAClB,OAAO,IAAI,aAAa,GACzB,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,iBAAiB;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC1E,MAAM,sBAAsB,GAAG,4BAA4B,CAAC,aAAa,CAAC,CAAC;IAC3E,IAAI,sBAAsB;QAAE,OAAO,sBAAsB,CAAC;IAE1D,wEAAwE;IACxE,8EAA8E;IAC9E,uEAAuE;IACvE,4EAA4E;IAC5E,8EAA8E;IAC9E,2BAA2B;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,+EAA+E;YAC7E,0EAA0E;YAC1E,0DAA0D;YAC1D,wBAAwB,MAAM,MAAM;YACpC,uEAAuE;YACvE,uEAAuE;YACvE,qFAAqF;YACrF,wEAAwE;YACxE,wEAAwE;YACxE,kCAAkC,CACrC,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,QAAQ;IACR,EAAE;IACF,yDAAyD;IACzD,+DAA+D;IAC/D,qEAAqE;IACrE,sEAAsE;IACtE,mDAAmD;IACnD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,QAAQ,CAAC,CAAC,mGAAmG;YAC9I,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC,sGAAsG;QAClJ,OAAO,CAAC,GAAG,CACT,0EAA0E;YACxE,iDAAiD;YACjD,4EAA4E,CAC/E,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CACV,oEAAoE;YAClE,gEAAgE;YAChE,wDAAwD;YACxD,oFAAoF,CACvF,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtD,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CACrB,8DAA8D,CAC/D,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAoB,EAAE,MAAc;IAChE,MAAM,MAAM,GACV,+DAA+D;QAC/D,oEAAoE;QACpE,2DAA2D,CAAC;IAC9D,MAAM,IAAI,GAAG,sBAAsB,MAAM,IAAI,CAAC;IAE9C,yEAAyE;IACzE,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5E,EAAE,CAAC,cAAc,CACf,YAAY,EACZ,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CACzD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACvD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,OAAO,CAAC;AAC3E,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAyDD,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,IAAI,KAAqC,CAAC;AAC1C,IAAI,YAAqD,CAAC;AAC1D,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACxE,IAAI,aAAkB,CAAC;AAEvB,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,aAAa,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,oBAAoB,EAAE,MAAM,CAAC,wBAAwB,CAAC;KACvD,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;QACnC,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC;QACrC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;QAC3B,oBAAoB,EAAE,WAAW,CAAC,yBAAyB,EAAE;YAC3D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,qBAAqB,EAAE,WAAW,CAAC,0BAA0B,EAAE;YAC7D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACvC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE;QACxB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE;QAChC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;KAC7D,CAAC;CACH,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,aAAa,EAAE,aAAa,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aAChE,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;QACjB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,UAAU,CAAC,wBAAwB,CAAC;KAC3D,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,WAAW,EAAE,UAAU,CAAC,cAAc,CAAC;QACvC,YAAY,EAAE,UAAU,CAAC,eAAe,CAAC;QACzC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC;QAC/B,oBAAoB,EAAE,aAAa,CAAC,yBAAyB,EAAE;YAC7D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,qBAAqB,EAAE,aAAa,CAAC,0BAA0B,EAAE;YAC/D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC9C,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC3C,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC5B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,UAAU,EAAE,WAAW,CAAC,YAAY,EAAE;QACpC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACzD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;KACjE,CAAC;CACH,CAAC;AAEF,SAAS,mBAAmB;IAC1B,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,gCAAgC,CAAC,OAS/C;IACC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO;IACxD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO;IAE5B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iEAAiE;QACjE,kEAAkE;QAClE,oDAAoD;QACpD,OAAO;IACT,CAAC;IAED,kCAAkC;IAClC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAChC,GAAG,EAAE,uCAAuC;YAC5C,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACvB,CAAC,CAAC;QACH,KAAK,GAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAA4B,IAAI,SAAS,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,uEAAuE,EACvE,GAAG,CACJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,uEAAuE;IACvE,6BAA6B;IAC7B,IAAI,UAA8B,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC;IACzC,IAAI,GAAG,YAAY,IAAI,EAAE,CAAC;QACxB,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,UAAU,GAAG,GAAG,CAAC;IACnB,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAA4B;QACtC,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;KACrB,CAAC;IACF,IAAI,OAAO,CAAC,YAAY;QAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IACtE,IAAI,UAAU;QAAE,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC;IAChD,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAEvD,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,sBAAsB;IACnC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,UAAU,EAAE;QAC7B,CAAC,CAAC;YACE,sOAAsO;YACtO,iRAAiR;YACjR,sWAAsW;YACtW,mNAAmN;YACnN,4MAA4M;YAC5M,wNAAwN;YACxN,mSAAmS;YACnS,uKAAuK;SACxK;QACH,CAAC,CAAC;YACE,wNAAwN;YACxN,mQAAmQ;YACnQ,oVAAoV;YACpV,qMAAqM;YACrM,kMAAkM;YAClM,8MAA8M;YAC9M,qRAAqR;YACrR,6JAA6J;SAC9J,CAAC;IAEN,KAAK,MAAM,GAAG,IAAI,UAAU;QAAE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB;IAEzB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,YAAY,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAChD,KAAK,GAAG,MAAM,YAAY,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AA6BD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAExC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;QAChC,MAAM,EAAE,GAAG,GAAG,EAAE,eAAe,CAAC;QAChC,IACE,EAAE;YACF,OAAO,EAAE,CAAC,eAAe,KAAK,UAAU;YACxC,OAAO,EAAE,CAAC,WAAW,KAAK,UAAU;YACpC,OAAO,EAAE,CAAC,UAAU,KAAK,UAAU,EACnC,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,KAAK,GAAG,SAAS,CAAC;IAClB,YAAY,GAAG,SAAS,CAAC;IACzB,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;QACD,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,KAAK,UAAU,wBAAwB,CACrC,MAAyB;IAEzB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,wBAAwB,CAAC;IAC9D,MAAM,sBAAsB,EAAE,CAAC;IAE/B,uCAAuC;IACvC,MAAM,eAAe,GAAyC;QAC5D,GAAG,MAAM,EAAE,eAAe;KAC3B,CAAC;IAEF,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,wCAAwC;QACxC,MAAM,WAAW,GAAG,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC1E,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAC9C,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC;oBACE,KAAK,EAAE,YAAY;oBACnB,UAAU,EAAE,SAAkB;oBAC9B,MAAM,EAAE,SAAkB;iBAC3B;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;SAC/C,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,eAAe,GAAG,0BAA0B,EAAE,CAAC;IACrD,MAAM,wBAAwB,GAC5B,iBAAiB,EAAE,IAAI,CAAC,2BAA2B,EAAE,CAAC;IAExD,MAAM,IAAI,GAAG,UAAU,CAAC;QACtB,QAAQ;QACR,OAAO,EAAE,MAAM;QACf,QAAQ;QACR,MAAM;QACN,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,CAAC;YACpB,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,wBAAwB;YACxB,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC3C,qEAAqE;gBACrE,sEAAsE;gBACtE,MAAM,WAAW,GAAG,CAClB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,WAAW,mCAAmC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAC;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ;iBACT,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,oEAAoE;YACpE,oEAAoE;YACpE,wCAAwC;YACxC,YAAY,EAAE,wBAAwB;YACtC,qEAAqE;YACrE,sEAAsE;YACtE,6CAA6C;YAC7C,2BAA2B,EAAE,IAAI;YACjC,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC7C,qEAAqE;gBACrE,6EAA6E;gBAC7E,MAAM,cAAc,GAAG,CACrB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,SAAS,GAAG,cAAc;oBAC9B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,cAAc,IAAI,CAAC;oBACzD,CAAC,CAAC,GAAG,CAAC;gBACR,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC;oBACtD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS;iBACV,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,eAAe;QACf,OAAO,EAAE;YACP,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,mEAAmE;YACnE,2BAA2B;YAC3B,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;aACvC;SACF;QACD,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,IAIb,EAAE,EAAE;wBACH,gEAAgE;wBAChE,+DAA+D;wBAC/D,8DAA8D;wBAC9D,sDAAsD;wBACtD,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;wBAC1B,IAAI,CAAC,KAAK;4BAAE,OAAO;wBACnB,QAAQ,CAAC,KAAK,EAAE;4BACd,KAAK;4BACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS;4BAC5B,UAAU,EAAE,IAAI,CAAC,EAAE;yBACpB,CAAC,CAAC;wBACH,KAAK,CACH,QAAQ,EACR;4BACE,aAAa,EAAE,aAAa;4BAC5B,YAAY,EAAE,IAAI,CAAC,EAAE;yBACtB,EACD,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;wBACF,IAAI,CAAC;4BACH,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;wBAChD,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,+DAA+D;4BAC/D,OAAO,CAAC,KAAK,CACX,kDAAkD,EAClD,GAAG,CACJ,CAAC;wBACJ,CAAC;wBACD,IAAI,CAAC;4BACH,2DAA2D;4BAC3D,yDAAyD;4BACzD,wDAAwD;4BACxD,0DAA0D;4BAC1D,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;wBAC1C,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,OAAO,CAAC,KAAK,CACX,iDAAiD,EACjD,GAAG,CACJ,CAAC;wBACJ,CAAC;oBACH,CAAC;iBACF;aACF;YACD,OAAO,EAAE;gBACP,+DAA+D;gBAC/D,iEAAiE;gBACjE,kEAAkE;gBAClE,oDAAoD;gBACpD,EAAE;gBACF,+DAA+D;gBAC/D,+DAA+D;gBAC/D,+DAA+D;gBAC/D,gDAAgD;gBAChD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;gBACD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;aACF;SACF;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU;YACxC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,gBAAgB;YACzC,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,cAAc;aAC/B;SACF;QACD,QAAQ,EAAE;YACR,YAAY,EAAE,eAAe,CAAC,sBAAsB;YACpD,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,mCAAmC;YACnC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC/B,CAAC,CAAC;oBACE,uBAAuB,EAAE;wBACvB,QAAQ,EAAE,MAAe;wBACzB,MAAM,EAAE,IAAI;wBACZ,WAAW,EAAE,IAAI;qBAClB;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,oEAAoE;YACpE,GAAG,CAAC,eAAe,CAAC,sBAAsB;gBACxC,CAAC,CAAC;oBACE,qBAAqB,EAAE;wBACrB,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,eAAe,CAAC,sBAAsB;qBAC/C;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,OAAO,EAAE;YACP,kEAAkE;YAClE,GAAG,CAAC;gBACF,GAAG,EAAE;oBACH,MAAM,EAAE,MAAM;oBACd,cAAc,EAAE,KAAK;iBACtB;aACF,CAAC;YACF,+CAA+C;YAC/C,MAAM,EAAE;YACR,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC3B;KACF,CAAC,CAAC;IAEH,OAAO,IAAqC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAe;IAEf,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAE7D,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YAC1D,qEAAqE;YACrE,mEAAmE;YACnE,8DAA8D;YAC9D,+DAA+D;YAC/D,aAAa,GAAG,IAAI,IAAI,CAAC;gBACvB,gBAAgB,EAAE,GAAG;gBACrB,GAAG,EAAE,WAAW,EAAE;aACnB,CAAC,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAChE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACxE,OAAO,cAAc,CAAC,EAAE,EAAE;gBACxB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,YAAY;aACrB,CAAC,CAAC;QACL,CAAC;QAED,iEAAiE;QACjE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,mDAAmD;QACnD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAClD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAEjD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,kCAAkC;QAClC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACxE,OAAO,cAAc,CAAC,EAAE,EAAE;QACxB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAC;AACL,CAAC","sourcesContent":["/*\n Internal Better Auth instance — lazily created, not exported to templates.\n \n Templates interact with auth via the existing `getSession()`, `autoMountAuth()`,\n * `createAuthPlugin()`, and `createGoogleAuthPlugin()` APIs. Better Auth is an\n * implementation detail behind those interfaces.\n /\n\nimport crypto from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { betterAuth, type BetterAuthOptions } from \"better-auth\";\nimport { jwt } from \"better-auth/plugins/jwt\";\nimport { bearer } from \"better-auth/plugins/bearer\";\nimport { sendEmail, isEmailConfigured } from \"./email.js\";\nimport {\n renderResetPasswordEmail,\n renderVerifySignupEmail,\n} from \"./email-templates.js\";\nimport { getAppProductionUrl } from \"./app-url.js\";\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport { acceptPendingInvitationsForEmail } from \"../org/accept-pending.js\";\nimport { autoJoinDomainMatchingOrgs } from \"../org/auto-join-domain.js\";\nimport { saveOAuthTokens } from \"../oauth-tokens/store.js\";\nimport { identify, track } from \"../tracking/index.js\";\nimport { resolveAuthCookieNamespace } from \"./cookie-namespace.js\";\nimport { getWorkspaceA2ADerivedSecret } from \"./derived-secret.js\";\nimport {\n getDialect,\n getDatabaseUrl,\n getDatabaseAuthToken,\n pgPoolOptions,\n neonPoolMax,\n} from \"../db/client.js\";\nimport {\n pgTable,\n text as pgText,\n timestamp as pgTimestamp,\n boolean as pgBoolean,\n} from \"drizzle-orm/pg-core\";\nimport {\n sqliteTable,\n text as sqliteText,\n integer as sqliteInteger,\n} from \"drizzle-orm/sqlite-core\";\n\n// ---------------------------------------------------------------------------\n// Persistent auth secret\n// ---------------------------------------------------------------------------\n\n/\n Resolve the Better Auth signing secret.\n \n Resolution order:\n * 1. `BETTER_AUTH_SECRET` env var — explicit, recommended for prod.\n * 2. Hosted workspace deploys can derive a per-purpose secret from the\n * already-required `A2A_SECRET` root. This keeps fresh workspace branches\n * bootable without reusing the raw A2A key as a cookie-signing key.\n * 3. `.env.local` in the template cwd — a per-workspace persistent secret\n * that the framework writes once on first boot when no secret is set.\n * Gitignored by convention (`.env` in template .gitignore files), so\n it's safe to persist credentials here.\n * 4. Generate a new random 32-byte hex, write it to `.env.local`, and use\n * it. Subsequent restarts re-read the same file — so session cookies\n * signed by a previous boot remain valid across dev-server restarts.\n \n Why this matters: before this helper existed, missing `BETTER_AUTH_SECRET`\n * fell through to `GOOGLE_CLIENT_SECRET` / `ACCESS_TOKEN` / a hardcoded\n * string. If a template happened to have none of those, each dev-server\n * boot would re-fall back to the hardcoded value (still stable) — but\n * rotating Google credentials, toggling `ACCESS_TOKEN`, or churning the\n * fallback chain would invalidate every signed cookie and force everyone\n * to sign in again. Pinning the secret to `.env.local` on first boot\n * removes that footgun.\n /\nfunction resolveAuthSecret(): string {\n if (process.env.BETTER_AUTH_SECRET) return process.env.BETTER_AUTH_SECRET;\n const workspaceDerivedSecret = getWorkspaceA2ADerivedSecret(\"better-auth\");\n if (workspaceDerivedSecret) return workspaceDerivedSecret;\n\n // In production, beyond the workspace A2A-derived fallback above, never\n // auto-generate or use legacy fallbacks. A generated secret invalidates every\n // signed session cookie on the next cold start (serverless filesystems\n // aren't persistent), and the legacy hardcoded fallback is identical across\n // every deploy that hits it — both are serious enough to fail the boot loudly\n // so the deployer notices.\n if (process.env.NODE_ENV === \"production\") {\n const sample = crypto.randomBytes(32).toString(\"hex\");\n throw new Error(\n \"[agent-native] BETTER_AUTH_SECRET is not set. This is required in production \" +\n \"so signed session cookies stay valid across deploys. Set it as a deploy \" +\n \"environment variable (any 32-byte hex string), e.g.:\\n\\n\" +\n ` BETTER_AUTH_SECRET=${sample}\\n\\n` +\n \"Generate your own with `openssl rand -hex 32`. If you already have a \" +\n \"running deploy on the legacy hardcoded fallback and need to preserve \" +\n \"existing sessions, set BETTER_AUTH_SECRET=agent-native-local-dev-secret-k9x2m7q4w8 \" +\n \"first, then rotate to a real value. Hosted workspace deploys may also \" +\n \"set A2A_SECRET; agent-native derives a per-purpose Better Auth secret \" +\n \"from that workspace root secret.\",\n );\n }\n\n // Dev: persist a generated secret to .env.local so sessions survive\n // dev-server restarts. Falls back to an in-memory random secret only if\n // the filesystem isn't writable (rare in dev, e.g. read-only mounts) —\n // sessions reset on every dev-process restart in that case, which is\n // fine.\n //\n // SECURITY (audit 09 LOW-2): the previous fallback chain\n // (`GOOGLE_CLIENT_SECRET \|\| ACCESS_TOKEN \|\| hardcoded`) reused\n // cross-purpose secrets and a public hardcoded literal as the cookie\n // HMAC. Dropped entirely — better to mint an ephemeral secret than to\n // re-use a Google client secret or a known string.\n try {\n const envLocalPath = path.resolve(process.cwd(), \".env.local\");\n const existing = readEnvLocalSecret(envLocalPath);\n if (existing) {\n process.env.BETTER_AUTH_SECRET = existing; // guard:allow-env-mutation — boot-time secret resolution from .env.local, runs once at module init\n return existing;\n }\n\n const generated = crypto.randomBytes(32).toString(\"hex\");\n appendEnvLocalSecret(envLocalPath, generated);\n process.env.BETTER_AUTH_SECRET = generated; // guard:allow-env-mutation — boot-time secret generation, runs once at module init before any request\n console.log(\n \"[agent-native] Generated a persistent BETTER_AUTH_SECRET in .env.local. \" +\n \"Sessions will now survive dev-server restarts. \" +\n \"(Delete .env.local to rotate; set BETTER_AUTH_SECRET in .env to override.)\",\n );\n return generated;\n } catch {\n // Filesystem unwritable (read-only mount, sandboxed test env, etc.).\n // Mint a per-process random secret so cookies stay unique per boot.\n // Sessions reset when the dev process restarts — acceptable for dev.\n const ephemeral = crypto.randomBytes(32).toString(\"hex\");\n console.warn(\n \"[agent-native] Could not persist BETTER_AUTH_SECRET to .env.local \" +\n \"(filesystem unwritable). Using an ephemeral in-memory secret. \" +\n \"Sessions will reset every time this process restarts. \" +\n \"Set BETTER_AUTH_SECRET in your environment to keep sessions valid across restarts.\",\n );\n return ephemeral;\n }\n}\n\nfunction readEnvLocalSecret(envLocalPath: string): string \| undefined {\n try {\n const content = fs.readFileSync(envLocalPath, \"utf8\");\n // Match `BETTER_AUTH_SECRET=...` on its own line. Tolerate optional\n // quotes and leading `export `. Stop at the first newline or quote.\n const m = content.match(\n /^(?:export\\s+)?BETTER_AUTH_SECRET\\s=\\s\"?([^\"\\r\\n]+)\"?\\s$/m,\n );\n return m?.[1]?.trim() \|\| undefined;\n } catch {\n return undefined;\n }\n}\n\nfunction appendEnvLocalSecret(envLocalPath: string, secret: string): void {\n const header =\n \"# Auto-generated by agent-native on first boot. Gitignored.\\n\" +\n \"# Keeps signed session cookies valid across dev-server restarts.\\n\" +\n \"# Delete this file (or this line) to rotate the secret.\\n\";\n const line = `BETTER_AUTH_SECRET=${secret}\\n`;\n\n // If the file already exists, just append; otherwise create with header.\n if (fs.existsSync(envLocalPath)) {\n const existing = fs.readFileSync(envLocalPath, \"utf8\");\n const needsLeadingNewline = existing.length > 0 && !existing.endsWith(\"\\n\");\n fs.appendFileSync(\n envLocalPath,\n (needsLeadingNewline ? \"\\n\" : \"\") + \"\\n\" + header + line,\n );\n } else {\n fs.writeFileSync(envLocalPath, header + line, { mode: 0o600 });\n }\n}\n\nexport function shouldSkipEmailVerification(): boolean {\n const value = process.env.AUTH_SKIP_EMAIL_VERIFICATION;\n if (value == null) {\n return (\n process.env.NODE_ENV === \"development\" \|\| process.env.NODE_ENV === \"test\"\n );\n }\n const normalized = value.trim().toLowerCase();\n return normalized !== \"\" && normalized !== \"0\" && normalized !== \"false\";\n}\n\n/** Read-only accessor for the resolved auth secret. /\nexport function getAuthSecret(): string {\n return resolveAuthSecret();\n}\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/* The shape we need from a Better Auth instance (internal — not exported to templates). /\nexport interface BetterAuthInstance {\n handler: (request: Request) => Promise<Response>;\n api: {\n getSession: (opts: { headers: Headers }) => Promise<{\n user: { id: string; email: string; name: string };\n session: {\n id: string;\n token: string;\n expiresAt: Date;\n };\n } \| null>;\n signInEmail: (opts: {\n body: { email: string; password: string };\n }) => Promise<{ token?: string; user?: any } \| null>;\n signUpEmail: (opts: {\n body: {\n email: string;\n password: string;\n name: string;\n callbackURL?: string;\n };\n }) => Promise<any>;\n signOut: (opts: { headers: Headers }) => Promise<any>;\n };\n}\n\nexport interface BetterAuthConfig {\n /* Base path for Better Auth routes. Default: \"/_agent-native/auth/ba\" /\n basePath?: string;\n /* Additional social providers beyond what env vars auto-detect /\n socialProviders?: BetterAuthOptions[\"socialProviders\"];\n /* Additional Better Auth plugins /\n plugins?: BetterAuthOptions[\"plugins\"];\n /\n Additional Google OAuth scopes (Gmail, Calendar, etc.) to request\n * up front during the primary \"Sign in with Google\" flow, beyond the\n * default identity scopes (`openid`, `email`, `profile`).\n \n When set, the Google social provider also opts into:\n * - `accessType: \"offline\"` — so a refresh token is issued\n * - `prompt: \"consent\"` — so the refresh token is reissued every sign-in\n \n Tokens are mirrored into `oauth_tokens` via a databaseHooks.account\n * hook so existing template code that reads from `oauth_tokens` (mail's\n * Gmail client, calendar's events fetcher) works without any separate\n * \"Connect Google\" page.\n /\n googleScopes?: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Lazy instance\n// ---------------------------------------------------------------------------\n\nlet _auth: BetterAuthInstance \| undefined;\nlet _initPromise: Promise<BetterAuthInstance> \| undefined;\n// Track the Neon serverless Pool we open for Better Auth so closeBetterAuth()\n// can release it. The Pool keeps WebSocket connections open; leaking them on\n// hot-reload or process restart exhausts Neon's connection slot budget.\nlet _neonAuthPool: any;\n\nconst pgAuthSchema = {\n user: pgTable(\"user\", {\n id: pgText(\"id\").primaryKey(),\n name: pgText(\"name\").notNull(),\n email: pgText(\"email\").notNull().unique(),\n emailVerified: pgBoolean(\"email_verified\").notNull().default(false),\n image: pgText(\"image\"),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n session: pgTable(\"session\", {\n id: pgText(\"id\").primaryKey(),\n expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n token: pgText(\"token\").notNull().unique(),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n ipAddress: pgText(\"ip_address\"),\n userAgent: pgText(\"user_agent\"),\n userId: pgText(\"user_id\").notNull(),\n activeOrganizationId: pgText(\"active_organization_id\"),\n }),\n account: pgTable(\"account\", {\n id: pgText(\"id\").primaryKey(),\n accountId: pgText(\"account_id\").notNull(),\n providerId: pgText(\"provider_id\").notNull(),\n userId: pgText(\"user_id\").notNull(),\n accessToken: pgText(\"access_token\"),\n refreshToken: pgText(\"refresh_token\"),\n idToken: pgText(\"id_token\"),\n accessTokenExpiresAt: pgTimestamp(\"access_token_expires_at\", {\n withTimezone: true,\n }),\n refreshTokenExpiresAt: pgTimestamp(\"refresh_token_expires_at\", {\n withTimezone: true,\n }),\n scope: pgText(\"scope\"),\n password: pgText(\"password\"),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n verification: pgTable(\"verification\", {\n id: pgText(\"id\").primaryKey(),\n identifier: pgText(\"identifier\").notNull(),\n value: pgText(\"value\").notNull(),\n expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n organization: pgTable(\"organization\", {\n id: pgText(\"id\").primaryKey(),\n name: pgText(\"name\").notNull(),\n slug: pgText(\"slug\").notNull().unique(),\n logo: pgText(\"logo\"),\n metadata: pgText(\"metadata\"),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n member: pgTable(\"member\", {\n id: pgText(\"id\").primaryKey(),\n organizationId: pgText(\"organization_id\").notNull(),\n userId: pgText(\"user_id\").notNull(),\n role: pgText(\"role\").notNull().default(\"member\"),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n invitation: pgTable(\"invitation\", {\n id: pgText(\"id\").primaryKey(),\n organizationId: pgText(\"organization_id\").notNull(),\n email: pgText(\"email\").notNull(),\n role: pgText(\"role\"),\n status: pgText(\"status\").notNull().default(\"pending\"),\n expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n inviterId: pgText(\"inviter_id\").notNull(),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n }),\n jwks: pgTable(\"jwks\", {\n id: pgText(\"id\").primaryKey(),\n publicKey: pgText(\"public_key\").notNull(),\n privateKey: pgText(\"private_key\").notNull(),\n createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }),\n }),\n};\n\nconst sqliteAuthSchema = {\n user: sqliteTable(\"user\", {\n id: sqliteText(\"id\").primaryKey(),\n name: sqliteText(\"name\").notNull(),\n email: sqliteText(\"email\").notNull().unique(),\n emailVerified: sqliteInteger(\"email_verified\", { mode: \"boolean\" })\n .notNull()\n .default(false),\n image: sqliteText(\"image\"),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n session: sqliteTable(\"session\", {\n id: sqliteText(\"id\").primaryKey(),\n expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n token: sqliteText(\"token\").notNull().unique(),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n ipAddress: sqliteText(\"ip_address\"),\n userAgent: sqliteText(\"user_agent\"),\n userId: sqliteText(\"user_id\").notNull(),\n activeOrganizationId: sqliteText(\"active_organization_id\"),\n }),\n account: sqliteTable(\"account\", {\n id: sqliteText(\"id\").primaryKey(),\n accountId: sqliteText(\"account_id\").notNull(),\n providerId: sqliteText(\"provider_id\").notNull(),\n userId: sqliteText(\"user_id\").notNull(),\n accessToken: sqliteText(\"access_token\"),\n refreshToken: sqliteText(\"refresh_token\"),\n idToken: sqliteText(\"id_token\"),\n accessTokenExpiresAt: sqliteInteger(\"access_token_expires_at\", {\n mode: \"timestamp_ms\",\n }),\n refreshTokenExpiresAt: sqliteInteger(\"refresh_token_expires_at\", {\n mode: \"timestamp_ms\",\n }),\n scope: sqliteText(\"scope\"),\n password: sqliteText(\"password\"),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n verification: sqliteTable(\"verification\", {\n id: sqliteText(\"id\").primaryKey(),\n identifier: sqliteText(\"identifier\").notNull(),\n value: sqliteText(\"value\").notNull(),\n expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n organization: sqliteTable(\"organization\", {\n id: sqliteText(\"id\").primaryKey(),\n name: sqliteText(\"name\").notNull(),\n slug: sqliteText(\"slug\").notNull().unique(),\n logo: sqliteText(\"logo\"),\n metadata: sqliteText(\"metadata\"),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n member: sqliteTable(\"member\", {\n id: sqliteText(\"id\").primaryKey(),\n organizationId: sqliteText(\"organization_id\").notNull(),\n userId: sqliteText(\"user_id\").notNull(),\n role: sqliteText(\"role\").notNull().default(\"member\"),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n invitation: sqliteTable(\"invitation\", {\n id: sqliteText(\"id\").primaryKey(),\n organizationId: sqliteText(\"organization_id\").notNull(),\n email: sqliteText(\"email\").notNull(),\n role: sqliteText(\"role\"),\n status: sqliteText(\"status\").notNull().default(\"pending\"),\n expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n inviterId: sqliteText(\"inviter_id\").notNull(),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n }),\n jwks: sqliteTable(\"jwks\", {\n id: sqliteText(\"id\").primaryKey(),\n publicKey: sqliteText(\"public_key\").notNull(),\n privateKey: sqliteText(\"private_key\").notNull(),\n createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }),\n }),\n};\n\nfunction getBetterAuthSchema() {\n return isPostgres() ? pgAuthSchema : sqliteAuthSchema;\n}\n\n/\n Mirror a Better Auth `account` row for Google into the `oauth_tokens`\n * table that template code (mail's Gmail client, calendar's events fetcher)\n * reads from. Called from the `databaseHooks.account.create.after` and\n * `.update.after` hooks so tokens captured during the primary \"Sign in\n * with Google\" flow flow straight to the apps that need them — no\n * separate \"Connect Google\" page required.\n \n Resolves `account.userId` to the user's email by querying the `user`\n * table (Better Auth always quotes \"user\" because it's a reserved word\n * in Postgres; SQLite accepts the quotes too).\n \n The hook is fire-and-forget from the caller's perspective — every\n * failure is caught upstream so a flake in `oauth_tokens` never blocks\n * sign-in. We still no-op on missing fields here as a defense in depth.\n /\nasync function mirrorGoogleAccountToOAuthTokens(account: {\n providerId?: string;\n userId?: string;\n accountId?: string;\n accessToken?: string \| null;\n refreshToken?: string \| null;\n accessTokenExpiresAt?: Date \| string \| number \| null;\n scope?: string \| null;\n idToken?: string \| null;\n}): Promise<void> {\n if (!account \|\| account.providerId !== \"google\") return;\n if (!account.userId) return;\n\n const accessToken = account.accessToken ?? undefined;\n if (!accessToken) {\n // Better Auth sometimes upserts an account row before tokens are\n // attached (e.g. linking flows). Nothing to mirror yet — the next\n // update hook will run once the access token lands.\n return;\n }\n\n // Resolve user email from userId.\n const db = getDbExec();\n let email: string \| undefined;\n try {\n const { rows } = await db.execute({\n sql: 'SELECT email FROM \"user\" WHERE id = ?',\n args: [account.userId],\n });\n email = (rows[0]?.email as string \| undefined) ?? undefined;\n } catch (err) {\n console.error(\n \"[auth] mirror Google tokens: failed to resolve user email from userId\",\n err,\n );\n return;\n }\n if (!email) return;\n\n // Normalise expiry to epoch ms (Google's \"expiry_date\" convention used\n // throughout the templates).\n let expiryDate: number \| undefined;\n const raw = account.accessTokenExpiresAt;\n if (raw instanceof Date) {\n expiryDate = raw.getTime();\n } else if (typeof raw === \"number\") {\n expiryDate = raw;\n } else if (typeof raw === \"string\") {\n const ms = Date.parse(raw);\n expiryDate = Number.isFinite(ms) ? ms : undefined;\n }\n\n const tokens: Record<string, unknown> = {\n access_token: accessToken,\n token_type: \"Bearer\",\n };\n if (account.refreshToken) tokens.refresh_token = account.refreshToken;\n if (expiryDate) tokens.expiry_date = expiryDate;\n if (account.scope) tokens.scope = account.scope;\n if (account.idToken) tokens.id_token = account.idToken;\n\n await saveOAuthTokens(\"google\", email, tokens, email);\n}\n\nasync function ensureBetterAuthTables(): Promise<void> {\n const db = getDbExec();\n const statements = isPostgres()\n ? [\n `CREATE TABLE IF NOT EXISTS \"user\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified BOOLEAN NOT NULL DEFAULT FALSE, image TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"session\" (id TEXT PRIMARY KEY, expires_at TIMESTAMPTZ NOT NULL, token TEXT NOT NULL UNIQUE, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n `CREATE TABLE IF NOT EXISTS \"account\" (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at TIMESTAMPTZ, refresh_token_expires_at TIMESTAMPTZ, scope TEXT, password TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"verification\" (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"organization\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"member\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"invitation\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at TIMESTAMPTZ NOT NULL, inviter_id TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS \"jwks\" (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, expires_at TIMESTAMPTZ)`,\n ]\n : [\n `CREATE TABLE IF NOT EXISTS user (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified INTEGER NOT NULL DEFAULT 0, image TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS session (id TEXT PRIMARY KEY, expires_at INTEGER NOT NULL, token TEXT NOT NULL UNIQUE, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n `CREATE TABLE IF NOT EXISTS account (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at INTEGER, refresh_token_expires_at INTEGER, scope TEXT, password TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS verification (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at INTEGER NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS organization (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS member (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS invitation (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at INTEGER NOT NULL, inviter_id TEXT NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS jwks (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at INTEGER NOT NULL, expires_at INTEGER)`,\n ];\n\n for (const sql of statements) await db.execute(sql);\n}\n\n/\n Get or create the Better Auth instance.\n * Lazily initialized on first call — the database must be reachable by then.\n /\nexport async function getBetterAuth(\n config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n if (_auth) return _auth;\n if (_initPromise) return _initPromise;\n\n _initPromise = createBetterAuthInstance(config);\n _auth = await _initPromise;\n return _auth;\n}\n\n/\n Synchronous getter — returns the instance if already initialized, else undefined.\n * Use this in hot paths where you know init has already happened.\n /\nexport function getBetterAuthSync(): BetterAuthInstance \| undefined {\n return _auth;\n}\n\n/\n The subset of Better Auth's internal adapter we use for federated-SSO\n * JIT account linking. Better Auth owns these writes (id + timestamp +\n * schema handling), so callers never hand-roll SQL against `user`/`account`.\n * Read-only lookups + strictly-additive `linkAccount`/`createUser` only — no\n * update/delete of existing identity rows.\n /\nexport interface BetterAuthInternalAdapter {\n findUserByEmail: (\n email: string,\n options?: { includeAccounts: boolean },\n ) => Promise<{\n user: { id: string; email: string; name?: string };\n accounts: Array<{ providerId: string; accountId: string }>;\n } \| null>;\n linkAccount: (account: {\n userId: string;\n providerId: string;\n accountId: string;\n }) => Promise<unknown>;\n createUser: (user: {\n email: string;\n name: string;\n emailVerified?: boolean;\n }) => Promise<{ id: string }>;\n}\n\n/\n Resolve Better Auth's internal adapter via the live instance's\n * `$context`. The framework's narrowed `BetterAuthInstance` interface omits\n * `$context`, but the underlying object created by `betterAuth(...)` always\n * exposes it (see Better Auth's `Auth` type) — so this is a safe, typed\n * accessor for the federated-SSO client. Returns `undefined` if the context\n * shape is unexpected (older/newer Better Auth) so callers can fall back.\n /\nexport async function getBetterAuthInternalAdapter(\n config?: BetterAuthConfig,\n): Promise<BetterAuthInternalAdapter \| undefined> {\n const auth = (await getBetterAuth(config)) as unknown as {\n $context?: Promise<{ internalAdapter?: BetterAuthInternalAdapter }>;\n };\n try {\n const ctx = await auth.$context;\n const ia = ctx?.internalAdapter;\n if (\n ia &&\n typeof ia.findUserByEmail === \"function\" &&\n typeof ia.linkAccount === \"function\" &&\n typeof ia.createUser === \"function\"\n ) {\n return ia;\n }\n } catch {\n // Context resolution failed — caller falls back to the signup path.\n }\n return undefined;\n}\n\n/* Reset for testing /\nexport async function resetBetterAuth(): Promise<void> {\n _auth = undefined;\n _initPromise = undefined;\n if (_neonAuthPool) {\n try {\n await _neonAuthPool.end();\n } catch {\n // Pool may have already closed (process exiting, etc.) — don't block reset.\n }\n _neonAuthPool = undefined;\n }\n}\n\n// ---------------------------------------------------------------------------\n// Instance creation\n// ---------------------------------------------------------------------------\n\nasync function createBetterAuthInstance(\n config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n const dialect = getDialect();\n const basePath = config?.basePath ?? \"/_agent-native/auth/ba\";\n await ensureBetterAuthTables();\n\n // Build social providers from env vars\n const socialProviders: BetterAuthOptions[\"socialProviders\"] = {\n ...config?.socialProviders,\n };\n\n if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {\n // When the template requests broader scopes (Gmail, Calendar, etc.)\n // ask for them on the primary sign-in flow so a separate \"Connect\n // Google\" round-trip isn't needed. `accessType: \"offline\"` plus\n // `prompt: \"consent\"` ensures we always receive a refresh token back —\n // Google only re-issues a refresh token on consent, so re-signing in\n // (e.g. after switching machines) would otherwise leave us with an\n // access token that can't be refreshed.\n const extraScopes = config?.googleScopes ?? [];\n const baseScopes = [\"openid\", \"email\", \"profile\"];\n const mergedScopes = Array.from(new Set([...baseScopes, ...extraScopes]));\n socialProviders.google = {\n clientId: process.env.GOOGLE_CLIENT_ID,\n clientSecret: process.env.GOOGLE_CLIENT_SECRET,\n ...(extraScopes.length > 0\n ? {\n scope: mergedScopes,\n accessType: \"offline\" as const,\n prompt: \"consent\" as const,\n }\n : {}),\n };\n }\n\n if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {\n socialProviders.github = {\n clientId: process.env.GITHUB_CLIENT_ID,\n clientSecret: process.env.GITHUB_CLIENT_SECRET,\n };\n }\n\n // Build database config\n const database = await buildDatabaseConfig(dialect);\n\n const secret = resolveAuthSecret();\n\n const appUrl = getAppProductionUrl();\n const cookieNamespace = resolveAuthCookieNamespace();\n const requireEmailVerification =\n isEmailConfigured() && !shouldSkipEmailVerification();\n\n const auth = betterAuth({\n basePath,\n baseURL: appUrl,\n database,\n secret,\n emailAndPassword: {\n enabled: true,\n minPasswordLength: 8,\n // Only require email verification when an email provider is configured.\n // Without a provider, verification emails can't be sent, so requiring\n // verification would lock users out of signup entirely. Local dev/test\n // skip verification by default so +qa accounts can be created quickly;\n // hosted QA deployments can opt out with AUTH_SKIP_EMAIL_VERIFICATION=1.\n requireEmailVerification,\n sendResetPassword: async ({ user, token }) => {\n // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n // reset link must include that prefix so the page resolves correctly.\n const appBasePath = (\n process.env.VITE_APP_BASE_PATH \|\|\n process.env.APP_BASE_PATH \|\|\n \"\"\n ).replace(/\\/$/, \"\");\n const resetUrl = `${appUrl}${appBasePath}/_agent-native/auth/reset?token=${encodeURIComponent(token)}`;\n const { subject, html, text } = renderResetPasswordEmail({\n email: user.email,\n resetUrl,\n });\n await sendEmail({ to: user.email, subject, html, text });\n },\n },\n emailVerification: {\n // Fire verification email right after signup, before the user has a\n // session — pairs with requireEmailVerification above. Only enabled\n // when an email provider is configured.\n sendOnSignUp: requireEmailVerification,\n // Auto-create a session once the user clicks the link. Without this,\n // verified users would have to go back and sign in manually, which is\n // a confusing dead-end on the verify screen.\n autoSignInAfterVerification: true,\n sendVerificationEmail: async ({ user, url }) => {\n // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n // verification link must include that prefix so the page resolves correctly.\n const verifyBasePath = (\n process.env.VITE_APP_BASE_PATH \|\|\n process.env.APP_BASE_PATH \|\|\n \"\"\n ).replace(/\\/$/, \"\");\n const verifyUrl = verifyBasePath\n ? url.replace(/(\\/\\/[^/]+)(\\/)/, `$1${verifyBasePath}$2`)\n : url;\n const { subject, html, text } = renderVerifySignupEmail({\n email: user.email,\n verifyUrl,\n });\n await sendEmail({ to: user.email, subject, html, text });\n },\n },\n socialProviders,\n account: {\n // Merge accounts when a user signs in with a social provider using an\n // email that already has a local email/password account (or vice versa).\n // Only providers listed in `trustedProviders` auto-link — these are the\n // ones that verify emails at the identity layer. Never add a provider\n // here that lets users claim an unverified email; that would be an\n // account-takeover vector.\n accountLinking: {\n enabled: true,\n trustedProviders: [\"google\", \"github\"],\n },\n },\n databaseHooks: {\n user: {\n create: {\n after: async (user: {\n id?: string;\n email?: string;\n name?: string \| null;\n }) => {\n // When a newly-created user's email has pending org invitations\n // (common when someone is invited before* they've signed up),\n // auto-accept them so the user lands in the org on their very\n // first page load instead of a blank-slate workspace.\n const email = user?.email;\n if (!email) return;\n identify(email, {\n email,\n name: user.name ?? undefined,\n authUserId: user.id,\n });\n track(\n \"signup\",\n {\n auth_provider: \"better-auth\",\n auth_user_id: user.id,\n },\n { userId: email },\n );\n try {\n await acceptPendingInvitationsForEmail(email);\n } catch (err) {\n // Never block signup on invite bookkeeping — log and continue.\n console.error(\n \"[auth] failed to auto-accept pending invitations\",\n err,\n );\n }\n try {\n // Auto-join orgs whose `allowed_domain` matches this email\n // domain. Lets a fresh `@builder.io` (or any org-domain)\n // signup land inside the company org on first page load\n // without going through the picker. No-ops when no match.\n await autoJoinDomainMatchingOrgs(email);\n } catch (err) {\n console.error(\n \"[auth] failed to auto-join domain-matching orgs\",\n err,\n );\n }\n },\n },\n },\n account: {\n // Mirror Google account tokens into `oauth_tokens` so existing\n // template code (mail's Gmail client, calendar's events fetcher)\n // can pick up Gmail/Calendar credentials from the primary sign-in\n // flow — no separate \"Set up Google\" page required.\n //\n // Better Auth fires `create` for first-time social sign-in and\n // `update` whenever a session re-issues tokens (e.g., the user\n // re-signs in to refresh the token). Both branches do the same\n // mirroring work; failures never block sign-in.\n create: {\n after: async (account: any) => {\n await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n console.error(\n \"[auth] failed to mirror Google account tokens to oauth_tokens (create)\",\n err,\n );\n });\n },\n },\n update: {\n after: async (account: any) => {\n await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n console.error(\n \"[auth] failed to mirror Google account tokens to oauth_tokens (update)\",\n err,\n );\n });\n },\n },\n },\n },\n session: {\n expiresIn: 60 * 60 * 24 * 30, // 30 days\n updateAge: 60 * 60 * 24, // refresh daily\n cookieCache: {\n enabled: true,\n maxAge: 5 * 60, // 5 min cache\n },\n },\n advanced: {\n cookiePrefix: cookieNamespace.betterAuthCookiePrefix,\n // Emit `SameSite=None; Secure` when the app is served over HTTPS so\n // session cookies are delivered inside third-party iframes (e.g. the\n // Builder.io editor). Plain-HTTP dev keeps the default (Lax) because\n // `SameSite=None` requires Secure.\n ...(appUrl.startsWith(\"https://\")\n ? {\n defaultCookieAttributes: {\n sameSite: \"none\" as const,\n secure: true,\n partitioned: true,\n },\n }\n : {}),\n // When an effective shared cookie domain is set, share Better Auth's\n // session cookie across that domain. First-party `*.agent-native.com`\n // apps intentionally do not use this path because their auth DBs are\n // separate; Dispatch identity federation handles cross-app sign-in.\n ...(cookieNamespace.betterAuthCookieDomain\n ? {\n crossSubDomainCookies: {\n enabled: true,\n domain: cookieNamespace.betterAuthCookieDomain,\n },\n }\n : {}),\n },\n plugins: [\n // JWT: issue tokens for A2A calls, JWKS endpoint for verification\n jwt({\n jwt: {\n issuer: appUrl,\n expirationTime: \"15m\",\n },\n }),\n // Bearer: accept Bearer tokens on API requests\n bearer(),\n ...(config?.plugins ?? []),\n ],\n });\n\n return auth as unknown as BetterAuthInstance;\n}\n\nasync function buildDatabaseConfig(\n dialect: string,\n): Promise<BetterAuthOptions[\"database\"]> {\n if (dialect === \"postgres\") {\n const url = getDatabaseUrl();\n const { isNeonUrl } = await import(\"../db/create-get-db.js\");\n\n // Neon via @neondatabase/serverless (WebSockets over HTTPS). postgres-js\n // opens a raw TCP connection on port 5432 which frequently times out on\n // Netlify Functions / Vercel / CF Workers when Neon's pooler is cold.\n if (isNeonUrl(url)) {\n const { Pool } = await import(\"@neondatabase/serverless\");\n // Cap the auth pool the same way as the app pool. Better Auth runs a\n // session lookup on essentially every authenticated request, so an\n // un-capped pool here is a primary contributor to \"Max client\n // connections reached\" across concurrent serverless instances.\n _neonAuthPool = new Pool({\n connectionString: url,\n max: neonPoolMax(),\n });\n const { drizzle } = await import(\"drizzle-orm/neon-serverless\");\n const db = drizzle(_neonAuthPool, { schema: pgAuthSchema });\n const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n return drizzleAdapter(db, {\n provider: \"pg\",\n schema: pgAuthSchema,\n });\n }\n\n // Non-Neon Postgres (Supabase, self-hosted, etc.) → postgres-js.\n // pgPoolOptions caps this pool to a small size on serverless. Better Auth\n // runs a session lookup on essentially every authenticated request, so an\n // un-capped pool here is a primary contributor to \"Max client connections\n // reached\" across concurrent serverless instances.\n const { default: postgres } = await import(\"postgres\");\n const sql = postgres(url, pgPoolOptions(url));\n const { drizzle } = await import(\"drizzle-orm/postgres-js\");\n const db = drizzle(sql, { schema: pgAuthSchema });\n const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n return drizzleAdapter(db, {\n provider: \"pg\",\n schema: pgAuthSchema,\n });\n }\n\n // SQLite / libsql\n const url = getDatabaseUrl(\"file:./data/app.db\");\n\n if (url.startsWith(\"file:\") \|\| !url.includes(\"://\")) {\n // Local SQLite via better-sqlite3\n const { default: Database } = await import(\"better-sqlite3\");\n const filePath = url.replace(/^file:/, \"\");\n const sqlite = new Database(filePath);\n sqlite.pragma(\"journal_mode = WAL\");\n const { drizzle } = await import(\"drizzle-orm/better-sqlite3\");\n const db = drizzle(sqlite, { schema: sqliteAuthSchema });\n const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n return drizzleAdapter(db, {\n provider: \"sqlite\",\n schema: sqliteAuthSchema,\n });\n }\n\n // Remote libsql (Turso). Use the web client to avoid serverless bundles\n // depending on libsql's platform-specific native packages.\n const { createClient } = await import(\"@libsql/client/web\");\n const client = createClient({ url, authToken: getDatabaseAuthToken() });\n const { drizzle } = await import(\"drizzle-orm/libsql/web\");\n const db = drizzle(client, { schema: sqliteAuthSchema });\n const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n return drizzleAdapter(db, {\n provider: \"sqlite\",\n schema: sqliteAuthSchema,\n });\n}\n"]}

package/dist/server/cookie-namespace.d.ts ADDED Viewed

@@ -0,0 +1,14 @@
+export interface AuthCookieNamespace {
+    appSlug: string;
+    configuredCookieDomain?: string;
+    frameworkCookieDomain?: string;
+    frameworkCookieName: string;
+    frameworkCookieNamesToClear: string[];
+    frameworkCookieDomainsToClear: string[];
+    betterAuthCookiePrefix: string;
+    betterAuthCookieDomain?: string;
+    isWorkspaceMode: boolean;
+    isFirstPartyCookieDomain: boolean;
+}
+export declare function resolveAuthCookieNamespace(env?: Record<string, string | undefined>, cwd?: string): AuthCookieNamespace;
+//# sourceMappingURL=cookie-namespace.d.ts.map

package/dist/server/cookie-namespace.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"cookie-namespace.d.ts","sourceRoot":"","sources":["../../src/server/cookie-namespace.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,6BAA6B,EAAE,MAAM,EAAE,CAAC;IACxC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,eAAe,EAAE,OAAO,CAAC;IACzB,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAED,wBAAgB,0BAA0B,CACxC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,GAAG,SAAgB,GAClB,mBAAmB,CA4ErB"}

package/dist/server/cookie-namespace.js ADDED Viewed

@@ -0,0 +1,118 @@
+import fs from "node:fs";
+import path from "node:path";
+const FIRST_PARTY_COOKIE_DOMAIN = "agent-native.com";
+export function resolveAuthCookieNamespace(env = process.env, cwd = process.cwd()) {
+    const isWorkspaceMode = env.AGENT_NATIVE_WORKSPACE === "1" ||
+        env.VITE_AGENT_NATIVE_WORKSPACE === "1";
+    const configuredCookieDomain = normalizeCookieDomain(env.COOKIE_DOMAIN);
+    const isFirstPartyCookieDomain = normalizeDomainForCompare(configuredCookieDomain) ===
+        FIRST_PARTY_COOKIE_DOMAIN;
+    const shareFirstPartyCookieDomain = isTruthy(env.AGENT_NATIVE_SHARE_COOKIE_DOMAIN);
+    const firstPartyIsolatedRealm = isFirstPartyCookieDomain &&
+        !shareFirstPartyCookieDomain &&
+        !isWorkspaceMode;
+    const frameworkCookieDomain = configuredCookieDomain && !isWorkspaceMode
+        ? firstPartyIsolatedRealm
+            ? undefined
+            : configuredCookieDomain
+        : undefined;
+    const localIsolatedRealm = env.NODE_ENV !== "production" && !isWorkspaceMode && !frameworkCookieDomain;
+    const explicitAppSlug = slugifyAppName(env.APP_NAME || "");
+    const localAppSlug = localIsolatedRealm
+        ? slugifyAppName(env.npm_package_name || readPackageJsonName(cwd))
+        : "";
+    const firstPartyUrlAppSlug = firstPartyIsolatedRealm
+        ? readFirstPartyAppSlugFromUrl(env)
+        : "";
+    const appSlug = explicitAppSlug || firstPartyUrlAppSlug || localAppSlug;
+    if (firstPartyIsolatedRealm && !appSlug) {
+        throw new Error("[agent-native] COOKIE_DOMAIN=.agent-native.com requires an app identifier " +
+            "so first-party auth cookies stay isolated. Set APP_NAME, APP_URL, URL, " +
+            "DEPLOY_PRIME_URL, or DEPLOY_URL; only set AGENT_NATIVE_SHARE_COOKIE_DOMAIN=1 " +
+            "when every subdomain intentionally shares one auth database.");
+    }
+    const frameworkCookieName = frameworkCookieDomain
+        ? "an_session"
+        : isWorkspaceMode
+            ? "an_session_workspace"
+            : appSlug
+                ? `an_session_${appSlug}`
+                : "an_session";
+    const isolatedBetterAuthPrefix = !!appSlug && (localIsolatedRealm || firstPartyIsolatedRealm);
+    const frameworkCookieNamesToClear = new Set([
+        frameworkCookieName,
+        "an_session",
+    ]);
+    if (appSlug)
+        frameworkCookieNamesToClear.add(`an_session_${appSlug}`);
+    if (isWorkspaceMode)
+        frameworkCookieNamesToClear.add("an_session_workspace");
+    const frameworkCookieDomainsToClear = configuredCookieDomain
+        ? [configuredCookieDomain]
+        : [];
+    return {
+        appSlug,
+        configuredCookieDomain,
+        frameworkCookieDomain,
+        frameworkCookieName,
+        frameworkCookieNamesToClear: [...frameworkCookieNamesToClear],
+        frameworkCookieDomainsToClear,
+        betterAuthCookiePrefix: isolatedBetterAuthPrefix ? `an_${appSlug}` : "an",
+        betterAuthCookieDomain: frameworkCookieDomain,
+        isWorkspaceMode,
+        isFirstPartyCookieDomain,
+    };
+}
+function readPackageJsonName(cwd) {
+    try {
+        const raw = fs.readFileSync(path.join(cwd, "package.json"), "utf8");
+        const parsed = JSON.parse(raw);
+        return typeof parsed.name === "string" ? parsed.name : "";
+    }
+    catch {
+        return "";
+    }
+}
+function readFirstPartyAppSlugFromUrl(env) {
+    for (const key of [
+        "APP_URL",
+        "BETTER_AUTH_URL",
+        "VITE_BETTER_AUTH_URL",
+        "URL",
+        "DEPLOY_PRIME_URL",
+        "DEPLOY_URL",
+    ]) {
+        const raw = env[key];
+        if (!raw)
+            continue;
+        try {
+            const hostname = new URL(raw).hostname.toLowerCase();
+            if (hostname.endsWith(`.${FIRST_PARTY_COOKIE_DOMAIN}`) &&
+                hostname !== `www.${FIRST_PARTY_COOKIE_DOMAIN}`) {
+                return slugifyAppName(hostname.slice(0, -`.${FIRST_PARTY_COOKIE_DOMAIN}`.length));
+            }
+        }
+        catch {
+            // Ignore malformed platform URLs.
+        }
+    }
+    return "";
+}
+function normalizeCookieDomain(value) {
+    const trimmed = value?.trim();
+    return trimmed || undefined;
+}
+function normalizeDomainForCompare(value) {
+    return (value || "").trim().toLowerCase().replace(/^\./, "");
+}
+function slugifyAppName(value) {
+    return value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "_")
+        .replace(/^_+|_+$/g, "");
+}
+function isTruthy(value) {
+    const normalized = value?.trim().toLowerCase();
+    return !!normalized && !["0", "false", "no", "off"].includes(normalized);
+}
+//# sourceMappingURL=cookie-namespace.js.map

package/dist/server/cookie-namespace.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"cookie-namespace.js","sourceRoot":"","sources":["../../src/server/cookie-namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,yBAAyB,GAAG,kBAAkB,CAAC;AAerD,MAAM,UAAU,0BAA0B,CACxC,MAA0C,OAAO,CAAC,GAAG,EACrD,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAEnB,MAAM,eAAe,GACnB,GAAG,CAAC,sBAAsB,KAAK,GAAG;QAClC,GAAG,CAAC,2BAA2B,KAAK,GAAG,CAAC;IAC1C,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACxE,MAAM,wBAAwB,GAC5B,yBAAyB,CAAC,sBAAsB,CAAC;QACjD,yBAAyB,CAAC;IAC5B,MAAM,2BAA2B,GAAG,QAAQ,CAC1C,GAAG,CAAC,gCAAgC,CACrC,CAAC;IACF,MAAM,uBAAuB,GAC3B,wBAAwB;QACxB,CAAC,2BAA2B;QAC5B,CAAC,eAAe,CAAC;IACnB,MAAM,qBAAqB,GACzB,sBAAsB,IAAI,CAAC,eAAe;QACxC,CAAC,CAAC,uBAAuB;YACvB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,sBAAsB;QAC1B,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,kBAAkB,GACtB,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,eAAe,IAAI,CAAC,qBAAqB,CAAC;IAE9E,MAAM,eAAe,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,kBAAkB;QACrC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,gBAAgB,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAClE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,oBAAoB,GAAG,uBAAuB;QAClD,CAAC,CAAC,4BAA4B,CAAC,GAAG,CAAC;QACnC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GAAG,eAAe,IAAI,oBAAoB,IAAI,YAAY,CAAC;IAExE,IAAI,uBAAuB,IAAI,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,yEAAyE;YACzE,+EAA+E;YAC/E,8DAA8D,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,mBAAmB,GAAG,qBAAqB;QAC/C,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,eAAe;YACf,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,OAAO;gBACP,CAAC,CAAC,cAAc,OAAO,EAAE;gBACzB,CAAC,CAAC,YAAY,CAAC;IAErB,MAAM,wBAAwB,GAC5B,CAAC,CAAC,OAAO,IAAI,CAAC,kBAAkB,IAAI,uBAAuB,CAAC,CAAC;IAE/D,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAS;QAClD,mBAAmB;QACnB,YAAY;KACb,CAAC,CAAC;IACH,IAAI,OAAO;QAAE,2BAA2B,CAAC,GAAG,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;IACtE,IAAI,eAAe;QAAE,2BAA2B,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAE7E,MAAM,6BAA6B,GAAG,sBAAsB;QAC1D,CAAC,CAAC,CAAC,sBAAsB,CAAC;QAC1B,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,OAAO;QACP,sBAAsB;QACtB,qBAAqB;QACrB,mBAAmB;QACnB,2BAA2B,EAAE,CAAC,GAAG,2BAA2B,CAAC;QAC7D,6BAA6B;QAC7B,sBAAsB,EAAE,wBAAwB,CAAC,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QACzE,sBAAsB,EAAE,qBAAqB;QAC7C,eAAe;QACf,wBAAwB;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;QACrD,OAAO,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,GAAuC;IAEvC,KAAK,MAAM,GAAG,IAAI;QAChB,SAAS;QACT,iBAAiB;QACjB,sBAAsB;QACtB,KAAK;QACL,kBAAkB;QAClB,YAAY;KACb,EAAE,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YACrD,IACE,QAAQ,CAAC,QAAQ,CAAC,IAAI,yBAAyB,EAAE,CAAC;gBAClD,QAAQ,KAAK,OAAO,yBAAyB,EAAE,EAC/C,CAAC;gBACD,OAAO,cAAc,CACnB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,yBAAyB,EAAE,CAAC,MAAM,CAAC,CAC3D,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAyB;IACtD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAyB;IAC1D,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,OAAO,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC3E,CAAC","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\n\nconst FIRST_PARTY_COOKIE_DOMAIN = \"agent-native.com\";\n\nexport interface AuthCookieNamespace {\n appSlug: string;\n configuredCookieDomain?: string;\n frameworkCookieDomain?: string;\n frameworkCookieName: string;\n frameworkCookieNamesToClear: string[];\n frameworkCookieDomainsToClear: string[];\n betterAuthCookiePrefix: string;\n betterAuthCookieDomain?: string;\n isWorkspaceMode: boolean;\n isFirstPartyCookieDomain: boolean;\n}\n\nexport function resolveAuthCookieNamespace(\n env: Record<string, string | undefined> = process.env,\n cwd = process.cwd(),\n): AuthCookieNamespace {\n const isWorkspaceMode =\n env.AGENT_NATIVE_WORKSPACE === \"1\" ||\n env.VITE_AGENT_NATIVE_WORKSPACE === \"1\";\n const configuredCookieDomain = normalizeCookieDomain(env.COOKIE_DOMAIN);\n const isFirstPartyCookieDomain =\n normalizeDomainForCompare(configuredCookieDomain) ===\n FIRST_PARTY_COOKIE_DOMAIN;\n const shareFirstPartyCookieDomain = isTruthy(\n env.AGENT_NATIVE_SHARE_COOKIE_DOMAIN,\n );\n const firstPartyIsolatedRealm =\n isFirstPartyCookieDomain &&\n !shareFirstPartyCookieDomain &&\n !isWorkspaceMode;\n const frameworkCookieDomain =\n configuredCookieDomain && !isWorkspaceMode\n ? firstPartyIsolatedRealm\n ? undefined\n : configuredCookieDomain\n : undefined;\n const localIsolatedRealm =\n env.NODE_ENV !== \"production\" && !isWorkspaceMode && !frameworkCookieDomain;\n\n const explicitAppSlug = slugifyAppName(env.APP_NAME || \"\");\n const localAppSlug = localIsolatedRealm\n ? slugifyAppName(env.npm_package_name || readPackageJsonName(cwd))\n : \"\";\n const firstPartyUrlAppSlug = firstPartyIsolatedRealm\n ? readFirstPartyAppSlugFromUrl(env)\n : \"\";\n const appSlug = explicitAppSlug || firstPartyUrlAppSlug || localAppSlug;\n\n if (firstPartyIsolatedRealm && !appSlug) {\n throw new Error(\n \"[agent-native] COOKIE_DOMAIN=.agent-native.com requires an app identifier \" +\n \"so first-party auth cookies stay isolated. Set APP_NAME, APP_URL, URL, \" +\n \"DEPLOY_PRIME_URL, or DEPLOY_URL; only set AGENT_NATIVE_SHARE_COOKIE_DOMAIN=1 \" +\n \"when every subdomain intentionally shares one auth database.\",\n );\n }\n\n const frameworkCookieName = frameworkCookieDomain\n ? \"an_session\"\n : isWorkspaceMode\n ? \"an_session_workspace\"\n : appSlug\n ? `an_session_${appSlug}`\n : \"an_session\";\n\n const isolatedBetterAuthPrefix =\n !!appSlug && (localIsolatedRealm || firstPartyIsolatedRealm);\n\n const frameworkCookieNamesToClear = new Set<string>([\n frameworkCookieName,\n \"an_session\",\n ]);\n if (appSlug) frameworkCookieNamesToClear.add(`an_session_${appSlug}`);\n if (isWorkspaceMode) frameworkCookieNamesToClear.add(\"an_session_workspace\");\n\n const frameworkCookieDomainsToClear = configuredCookieDomain\n ? [configuredCookieDomain]\n : [];\n\n return {\n appSlug,\n configuredCookieDomain,\n frameworkCookieDomain,\n frameworkCookieName,\n frameworkCookieNamesToClear: [...frameworkCookieNamesToClear],\n frameworkCookieDomainsToClear,\n betterAuthCookiePrefix: isolatedBetterAuthPrefix ? `an_${appSlug}` : \"an\",\n betterAuthCookieDomain: frameworkCookieDomain,\n isWorkspaceMode,\n isFirstPartyCookieDomain,\n };\n}\n\nfunction readPackageJsonName(cwd: string): string {\n try {\n const raw = fs.readFileSync(path.join(cwd, \"package.json\"), \"utf8\");\n const parsed = JSON.parse(raw) as { name?: unknown };\n return typeof parsed.name === \"string\" ? parsed.name : \"\";\n } catch {\n return \"\";\n }\n}\n\nfunction readFirstPartyAppSlugFromUrl(\n env: Record<string, string | undefined>,\n): string {\n for (const key of [\n \"APP_URL\",\n \"BETTER_AUTH_URL\",\n \"VITE_BETTER_AUTH_URL\",\n \"URL\",\n \"DEPLOY_PRIME_URL\",\n \"DEPLOY_URL\",\n ]) {\n const raw = env[key];\n if (!raw) continue;\n try {\n const hostname = new URL(raw).hostname.toLowerCase();\n if (\n hostname.endsWith(`.${FIRST_PARTY_COOKIE_DOMAIN}`) &&\n hostname !== `www.${FIRST_PARTY_COOKIE_DOMAIN}`\n ) {\n return slugifyAppName(\n hostname.slice(0, -`.${FIRST_PARTY_COOKIE_DOMAIN}`.length),\n );\n }\n } catch {\n // Ignore malformed platform URLs.\n }\n }\n return \"\";\n}\n\nfunction normalizeCookieDomain(value: string | undefined): string | undefined {\n const trimmed = value?.trim();\n return trimmed || undefined;\n}\n\nfunction normalizeDomainForCompare(value: string | undefined): string {\n return (value || \"\").trim().toLowerCase().replace(/^\\./, \"\");\n}\n\nfunction slugifyAppName(value: string): string {\n return value\n .toLowerCase()\n .replace(/[^a-z0-9]+/g, \"_\")\n .replace(/^_+|_+$/g, \"\");\n}\n\nfunction isTruthy(value: string | undefined): boolean {\n const normalized = value?.trim().toLowerCase();\n return !!normalized && ![\"0\", \"false\", \"no\", \"off\"].includes(normalized);\n}\n"]}

package/dist/server/derived-secret.d.ts ADDED Viewed

@@ -0,0 +1,3 @@
+export declare function deriveServerSecret(rootSecret: string, purpose: string): string;
+export declare function getWorkspaceA2ADerivedSecret(purpose: "better-auth" | "oauth-state" | "short-lived-token"): string | undefined;
+//# sourceMappingURL=derived-secret.d.ts.map