@agent-native/core 0.53.0 → 0.54.0

package/dist/server/better-auth-instance.d.ts

@@ -6,6 +6,13 @@
  * implementation detail behind those interfaces.
  */
 import { type BetterAuthOptions } from "better-auth";
+/** @internal */
+export declare function resolveSignupTrackingIdentity(): {
+    app?: string;
+    template?: string;
+};
+/** @internal */
+export declare function resolveSignupTrackingProperties(): Record<string, string>;
 export declare function shouldSkipEmailVerification(): boolean;
 /** Read-only accessor for the resolved auth secret. */
 export declare function getAuthSecret(): string;

package/dist/server/better-auth-instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"better-auth-instance.d.ts","sourceRoot":"","sources":["../../src/server/better-auth-instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAc,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAyKjE,wBAAgB,2BAA2B,IAAI,OAAO,CASrD;AAED,uDAAuD;AACvD,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAMD,4FAA4F;AAC5F,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC;YAClD,IAAI,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAC;YAClD,OAAO,EAAE;gBACP,EAAE,EAAE,MAAM,CAAC;gBACX,KAAK,EAAE,MAAM,CAAC;gBACd,SAAS,EAAE,IAAI,CAAC;aACjB,CAAC;SACH,GAAG,IAAI,CAAC,CAAC;QACV,WAAW,EAAE,CAAC,IAAI,EAAE;YAClB,IAAI,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC;gBAAC,QAAQ,EAAE,MAAM,CAAA;aAAE,CAAC;SAC3C,KAAK,OAAO,CAAC;YAAE,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,GAAG,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QACrD,WAAW,EAAE,CAAC,IAAI,EAAE;YAClB,IAAI,EAAE;gBACJ,KAAK,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAM,CAAC;gBACb,WAAW,CAAC,EAAE,MAAM,CAAC;aACtB,CAAC;SACH,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;KACvD,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,qCAAqC;IACrC,OAAO,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACvC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAoSD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAElE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,eAAe,EAAE,CACf,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,eAAe,EAAE,OAAO,CAAA;KAAE,KACnC,OAAO,CAAC;QACX,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACnD,QAAQ,EAAE,KAAK,CAAC;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC5D,GAAG,IAAI,CAAC,CAAC;IACV,WAAW,EAAE,CAAC,OAAO,EAAE;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KACnB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,UAAU,EAAE,CAAC,IAAI,EAAE;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/B;AAED;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAmBhD;AAED,wBAAwB;AACxB,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAWrD"}
+{"version":3,"file":"better-auth-instance.d.ts","sourceRoot":"","sources":["../../src/server/better-auth-instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAc,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAgOjE,gBAAgB;AAChB,wBAAgB,6BAA6B,IAAI;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAiCA;AAED,gBAAgB;AAChB,wBAAgB,+BAA+B,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxE;AAED,wBAAgB,2BAA2B,IAAI,OAAO,CASrD;AAED,uDAAuD;AACvD,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAMD,4FAA4F;AAC5F,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC;YAClD,IAAI,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAC;YAClD,OAAO,EAAE;gBACP,EAAE,EAAE,MAAM,CAAC;gBACX,KAAK,EAAE,MAAM,CAAC;gBACd,SAAS,EAAE,IAAI,CAAC;aACjB,CAAC;SACH,GAAG,IAAI,CAAC,CAAC;QACV,WAAW,EAAE,CAAC,IAAI,EAAE;YAClB,IAAI,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC;gBAAC,QAAQ,EAAE,MAAM,CAAA;aAAE,CAAC;SAC3C,KAAK,OAAO,CAAC;YAAE,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,GAAG,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QACrD,WAAW,EAAE,CAAC,IAAI,EAAE;YAClB,IAAI,EAAE;gBACJ,KAAK,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAM,CAAC;gBACb,WAAW,CAAC,EAAE,MAAM,CAAC;aACtB,CAAC;SACH,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;KACvD,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,qCAAqC;IACrC,OAAO,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACvC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAoSD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAElE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,eAAe,EAAE,CACf,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,eAAe,EAAE,OAAO,CAAA;KAAE,KACnC,OAAO,CAAC;QACX,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACnD,QAAQ,EAAE,KAAK,CAAC;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC5D,GAAG,IAAI,CAAC,CAAC;IACV,WAAW,EAAE,CAAC,OAAO,EAAE;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KACnB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,UAAU,EAAE,CAAC,IAAI,EAAE;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/B;AAED;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAmBhD;AAED,wBAAwB;AACxB,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAWrD"}

package/dist/server/better-auth-instance.js

@@ -19,6 +19,7 @@ import { acceptPendingInvitationsForEmail } from "../org/accept-pending.js";
 import { autoJoinDomainMatchingOrgs } from "../org/auto-join-domain.js";
 import { saveOAuthTokens } from "../oauth-tokens/store.js";
 import { identify, track } from "../tracking/index.js";
+import { TEMPLATES } from "../cli/templates-meta.js";
 import { resolveAuthCookieNamespace } from "./cookie-namespace.js";
 import { getWorkspaceA2ADerivedSecret } from "./derived-secret.js";
 import { getDialect, getDatabaseUrl, getDatabaseAuthToken, pgPoolOptions, neonPoolMax, attachNeonPoolErrorLogger, } from "../db/client.js";
@@ -142,6 +143,94 @@ function appendEnvLocalSecret(envLocalPath, secret) {
         fs.writeFileSync(envLocalPath, header + line, { mode: 0o600 });
     }
 }
+function normalizeTrackingSlug(value) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return undefined;
+    const unscoped = trimmed.startsWith("@")
+        ? (trimmed.split("/").pop() ?? trimmed)
+        : trimmed;
+    const slug = unscoped
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    return slug || undefined;
+}
+function knownTemplateSlug(value) {
+    const slug = normalizeTrackingSlug(value);
+    if (!slug)
+        return undefined;
+    const withoutPrefix = slug.startsWith("agent-native-")
+        ? slug.slice("agent-native-".length)
+        : slug;
+    return TEMPLATES.some((template) => template.name === withoutPrefix)
+        ? withoutPrefix
+        : undefined;
+}
+function readPackageName() {
+    try {
+        const pkgPath = path.join(process.cwd(), "package.json");
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+        return pkg.name;
+    }
+    catch {
+        return undefined;
+    }
+}
+function appSlugFromUrl(value) {
+    if (!value?.trim())
+        return undefined;
+    try {
+        const raw = /^[a-z][a-z0-9+.-]*:\/\//i.test(value)
+            ? value
+            : `https://${value}`;
+        const hostname = new URL(raw).hostname.toLowerCase();
+        if (hostname.endsWith(".agent-native.com")) {
+            return normalizeTrackingSlug(hostname.slice(0, -".agent-native.com".length));
+        }
+        return normalizeTrackingSlug(hostname.split(".")[0]);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** @internal */
+export function resolveSignupTrackingIdentity() {
+    const explicitApp = normalizeTrackingSlug(process.env.AGENT_NATIVE_APP) ||
+        normalizeTrackingSlug(process.env.VITE_AGENT_NATIVE_APP);
+    const packageApp = normalizeTrackingSlug(process.env.npm_package_name) ||
+        normalizeTrackingSlug(readPackageName());
+    const urlApp = appSlugFromUrl(process.env.APP_URL) ||
+        appSlugFromUrl(process.env.BETTER_AUTH_URL) ||
+        appSlugFromUrl(process.env.URL) ||
+        appSlugFromUrl(process.env.DEPLOY_URL) ||
+        appSlugFromUrl(process.env.VERCEL_PROJECT_PRODUCTION_URL) ||
+        appSlugFromUrl(process.env.VERCEL_URL);
+    const app = explicitApp ||
+        urlApp ||
+        packageApp ||
+        normalizeTrackingSlug(process.env.APP_NAME);
+    const template = knownTemplateSlug(process.env.AGENT_NATIVE_TEMPLATE) ||
+        knownTemplateSlug(process.env.VITE_AGENT_NATIVE_TEMPLATE) ||
+        knownTemplateSlug(process.env.APP_TEMPLATE) ||
+        knownTemplateSlug(process.env.VITE_APP_TEMPLATE) ||
+        knownTemplateSlug(app) ||
+        knownTemplateSlug(packageApp) ||
+        knownTemplateSlug(urlApp);
+    return {
+        ...(app ? { app } : {}),
+        ...(template ? { template } : {}),
+    };
+}
+/** @internal */
+export function resolveSignupTrackingProperties() {
+    const identity = resolveSignupTrackingIdentity();
+    return {
+        ...identity,
+        ...(identity.app ? { agent_native_app: identity.app } : {}),
+        ...(identity.template ? { agent_native_template: identity.template } : {}),
+    };
+}
 export function shouldSkipEmailVerification() {
     const value = process.env.AUTH_SKIP_EMAIL_VERIFICATION;
     if (value == null) {
@@ -619,6 +708,7 @@ async function createBetterAuthInstance(config) {
                             authUserId: user.id,
                         });
                         track("signup", {
+                            ...resolveSignupTrackingProperties(),
                             auth_provider: "better-auth",
                             auth_user_id: user.id,
                         }, { userId: email });

package/dist/server/better-auth-instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"better-auth-instance.js","sourceRoot":"","sources":["../../src/server/better-auth-instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,WAAW,EACX,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,OAAO,EACP,IAAI,IAAI,MAAM,EACd,SAAS,IAAI,WAAW,EACxB,OAAO,IAAI,SAAS,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,IAAI,IAAI,UAAU,EAClB,OAAO,IAAI,aAAa,GACzB,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,iBAAiB;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC1E,MAAM,sBAAsB,GAAG,4BAA4B,CAAC,aAAa,CAAC,CAAC;IAC3E,IAAI,sBAAsB;QAAE,OAAO,sBAAsB,CAAC;IAE1D,wEAAwE;IACxE,8EAA8E;IAC9E,uEAAuE;IACvE,4EAA4E;IAC5E,8EAA8E;IAC9E,2BAA2B;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,+EAA+E;YAC7E,0EAA0E;YAC1E,0DAA0D;YAC1D,wBAAwB,MAAM,MAAM;YACpC,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,+CAA+C;YAC/C,wEAAwE;YACxE,kCAAkC,CACrC,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,QAAQ;IACR,EAAE;IACF,yDAAyD;IACzD,+DAA+D;IAC/D,qEAAqE;IACrE,sEAAsE;IACtE,mDAAmD;IACnD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,QAAQ,CAAC,CAAC,mGAAmG;YAC9I,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC,sGAAsG;QAClJ,OAAO,CAAC,GAAG,CACT,0EAA0E;YACxE,iDAAiD;YACjD,4EAA4E,CAC/E,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CACV,oEAAoE;YAClE,gEAAgE;YAChE,wDAAwD;YACxD,oFAAoF,CACvF,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtD,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CACrB,8DAA8D,CAC/D,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAoB,EAAE,MAAc;IAChE,MAAM,MAAM,GACV,+DAA+D;QAC/D,oEAAoE;QACpE,2DAA2D,CAAC;IAC9D,MAAM,IAAI,GAAG,sBAAsB,MAAM,IAAI,CAAC;IAE9C,yEAAyE;IACzE,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5E,EAAE,CAAC,cAAc,CACf,YAAY,EACZ,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CACzD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACvD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,OAAO,CAAC;AAC3E,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAyDD,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,IAAI,KAAqC,CAAC;AAC1C,IAAI,YAAqD,CAAC;AAC1D,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACxE,IAAI,aAAkB,CAAC;AAEvB,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,aAAa,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,oBAAoB,EAAE,MAAM,CAAC,wBAAwB,CAAC;KACvD,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;QACnC,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC;QACrC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;QAC3B,oBAAoB,EAAE,WAAW,CAAC,yBAAyB,EAAE;YAC3D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,qBAAqB,EAAE,WAAW,CAAC,0BAA0B,EAAE;YAC7D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACvC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE;QACxB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE;QAChC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;KAC7D,CAAC;CACH,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,aAAa,EAAE,aAAa,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aAChE,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;QACjB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,UAAU,CAAC,wBAAwB,CAAC;KAC3D,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,WAAW,EAAE,UAAU,CAAC,cAAc,CAAC;QACvC,YAAY,EAAE,UAAU,CAAC,eAAe,CAAC;QACzC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC;QAC/B,oBAAoB,EAAE,aAAa,CAAC,yBAAyB,EAAE;YAC7D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,qBAAqB,EAAE,aAAa,CAAC,0BAA0B,EAAE;YAC/D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC9C,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC3C,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC5B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,UAAU,EAAE,WAAW,CAAC,YAAY,EAAE;QACpC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACzD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;KACjE,CAAC;CACH,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,gCAAgC,CAAC,OAS/C;IACC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO;IACxD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO;IAE5B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iEAAiE;QACjE,kEAAkE;QAClE,oDAAoD;QACpD,OAAO;IACT,CAAC;IAED,kCAAkC;IAClC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAChC,GAAG,EAAE,uCAAuC;YAC5C,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACvB,CAAC,CAAC;QACH,KAAK,GAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAA4B,IAAI,SAAS,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,uEAAuE,EACvE,GAAG,CACJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,uEAAuE;IACvE,6BAA6B;IAC7B,IAAI,UAA8B,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC;IACzC,IAAI,GAAG,YAAY,IAAI,EAAE,CAAC;QACxB,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,UAAU,GAAG,GAAG,CAAC;IACnB,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAA4B;QACtC,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;KACrB,CAAC;IACF,IAAI,OAAO,CAAC,YAAY;QAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IACtE,IAAI,UAAU;QAAE,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC;IAChD,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAEvD,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,sBAAsB;IACnC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,UAAU,EAAE;QAC7B,CAAC,CAAC;YACE,sOAAsO;YACtO,iRAAiR;YACjR,sWAAsW;YACtW,mNAAmN;YACnN,4MAA4M;YAC5M,wNAAwN;YACxN,mSAAmS;YACnS,uKAAuK;SACxK;QACH,CAAC,CAAC;YACE,wNAAwN;YACxN,mQAAmQ;YACnQ,oVAAoV;YACpV,qMAAqM;YACrM,kMAAkM;YAClM,8MAA8M;YAC9M,qRAAqR;YACrR,6JAA6J;SAC9J,CAAC;IAEN,KAAK,MAAM,GAAG,IAAI,UAAU;QAAE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB;IAEzB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,YAAY,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAChD,KAAK,GAAG,MAAM,YAAY,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AA6BD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAExC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;QAChC,MAAM,EAAE,GAAG,GAAG,EAAE,eAAe,CAAC;QAChC,IACE,EAAE;YACF,OAAO,EAAE,CAAC,eAAe,KAAK,UAAU;YACxC,OAAO,EAAE,CAAC,WAAW,KAAK,UAAU;YACpC,OAAO,EAAE,CAAC,UAAU,KAAK,UAAU,EACnC,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,KAAK,GAAG,SAAS,CAAC;IAClB,YAAY,GAAG,SAAS,CAAC;IACzB,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;QACD,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,KAAK,UAAU,wBAAwB,CACrC,MAAyB;IAEzB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,wBAAwB,CAAC;IAC9D,MAAM,sBAAsB,EAAE,CAAC;IAE/B,uCAAuC;IACvC,MAAM,eAAe,GAAyC;QAC5D,GAAG,MAAM,EAAE,eAAe;KAC3B,CAAC;IAEF,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,wCAAwC;QACxC,MAAM,WAAW,GAAG,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC1E,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAC9C,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC;oBACE,KAAK,EAAE,YAAY;oBACnB,UAAU,EAAE,SAAkB;oBAC9B,MAAM,EAAE,SAAkB;iBAC3B;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;SAC/C,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,eAAe,GAAG,0BAA0B,EAAE,CAAC;IACrD,MAAM,wBAAwB,GAC5B,iBAAiB,EAAE,IAAI,CAAC,2BAA2B,EAAE,CAAC;IAExD,MAAM,IAAI,GAAG,UAAU,CAAC;QACtB,QAAQ;QACR,OAAO,EAAE,MAAM;QACf,QAAQ;QACR,MAAM;QACN,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,CAAC;YACpB,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,wBAAwB;YACxB,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC3C,qEAAqE;gBACrE,sEAAsE;gBACtE,MAAM,WAAW,GAAG,CAClB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,WAAW,mCAAmC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAC;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ;iBACT,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,oEAAoE;YACpE,oEAAoE;YACpE,wCAAwC;YACxC,YAAY,EAAE,wBAAwB;YACtC,qEAAqE;YACrE,sEAAsE;YACtE,6CAA6C;YAC7C,2BAA2B,EAAE,IAAI;YACjC,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC7C,qEAAqE;gBACrE,6EAA6E;gBAC7E,MAAM,cAAc,GAAG,CACrB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,SAAS,GAAG,cAAc;oBAC9B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,cAAc,IAAI,CAAC;oBACzD,CAAC,CAAC,GAAG,CAAC;gBACR,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC;oBACtD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS;iBACV,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,eAAe;QACf,OAAO,EAAE;YACP,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,mEAAmE;YACnE,2BAA2B;YAC3B,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;aACvC;SACF;QACD,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,IAIb,EAAE,EAAE;wBACH,gEAAgE;wBAChE,+DAA+D;wBAC/D,8DAA8D;wBAC9D,sDAAsD;wBACtD,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;wBAC1B,IAAI,CAAC,KAAK;4BAAE,OAAO;wBACnB,QAAQ,CAAC,KAAK,EAAE;4BACd,KAAK;4BACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS;4BAC5B,UAAU,EAAE,IAAI,CAAC,EAAE;yBACpB,CAAC,CAAC;wBACH,KAAK,CACH,QAAQ,EACR;4BACE,aAAa,EAAE,aAAa;4BAC5B,YAAY,EAAE,IAAI,CAAC,EAAE;yBACtB,EACD,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;wBACF,IAAI,CAAC;4BACH,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;wBAChD,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,+DAA+D;4BAC/D,OAAO,CAAC,KAAK,CACX,kDAAkD,EAClD,GAAG,CACJ,CAAC;wBACJ,CAAC;wBACD,IAAI,CAAC;4BACH,2DAA2D;4BAC3D,yDAAyD;4BACzD,wDAAwD;4BACxD,0DAA0D;4BAC1D,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;wBAC1C,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,OAAO,CAAC,KAAK,CACX,iDAAiD,EACjD,GAAG,CACJ,CAAC;wBACJ,CAAC;oBACH,CAAC;iBACF;aACF;YACD,OAAO,EAAE;gBACP,+DAA+D;gBAC/D,iEAAiE;gBACjE,kEAAkE;gBAClE,oDAAoD;gBACpD,EAAE;gBACF,+DAA+D;gBAC/D,+DAA+D;gBAC/D,+DAA+D;gBAC/D,gDAAgD;gBAChD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;gBACD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;aACF;SACF;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU;YACxC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,gBAAgB;YACzC,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,cAAc;aAC/B;SACF;QACD,QAAQ,EAAE;YACR,YAAY,EAAE,eAAe,CAAC,sBAAsB;YACpD,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,mCAAmC;YACnC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC/B,CAAC,CAAC;oBACE,uBAAuB,EAAE;wBACvB,QAAQ,EAAE,MAAe;wBACzB,MAAM,EAAE,IAAI;wBACZ,WAAW,EAAE,IAAI;qBAClB;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,oEAAoE;YACpE,GAAG,CAAC,eAAe,CAAC,sBAAsB;gBACxC,CAAC,CAAC;oBACE,qBAAqB,EAAE;wBACrB,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,eAAe,CAAC,sBAAsB;qBAC/C;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,OAAO,EAAE;YACP,kEAAkE;YAClE,GAAG,CAAC;gBACF,GAAG,EAAE;oBACH,MAAM,EAAE,MAAM;oBACd,cAAc,EAAE,KAAK;iBACtB;aACF,CAAC;YACF,+CAA+C;YAC/C,MAAM,EAAE;YACR,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC3B;KACF,CAAC,CAAC;IAEH,OAAO,IAAqC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAe;IAEf,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAE7D,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YAC1D,qEAAqE;YACrE,mEAAmE;YACnE,8DAA8D;YAC9D,+DAA+D;YAC/D,aAAa,GAAG,IAAI,IAAI,CAAC;gBACvB,gBAAgB,EAAE,GAAG;gBACrB,GAAG,EAAE,WAAW,EAAE;aACnB,CAAC,CAAC;YACH,yBAAyB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACzD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAChE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACxE,OAAO,cAAc,CAAC,EAAE,EAAE;gBACxB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,YAAY;aACrB,CAAC,CAAC;QACL,CAAC;QAED,iEAAiE;QACjE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,mDAAmD;QACnD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAClD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAEjD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,kCAAkC;QAClC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACxE,OAAO,cAAc,CAAC,EAAE,EAAE;QACxB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Internal Better Auth instance — lazily created, not exported to templates.\n *\n * Templates interact with auth via the existing `getSession()`, `autoMountAuth()`,\n * `createAuthPlugin()`, and `createGoogleAuthPlugin()` APIs. Better Auth is an\n * implementation detail behind those interfaces.\n */\n\nimport crypto from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { betterAuth, type BetterAuthOptions } from \"better-auth\";\nimport { jwt } from \"better-auth/plugins/jwt\";\nimport { bearer } from \"better-auth/plugins/bearer\";\nimport { sendEmail, isEmailConfigured } from \"./email.js\";\nimport {\n  renderResetPasswordEmail,\n  renderVerifySignupEmail,\n} from \"./email-templates.js\";\nimport { getAppProductionUrl } from \"./app-url.js\";\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport { acceptPendingInvitationsForEmail } from \"../org/accept-pending.js\";\nimport { autoJoinDomainMatchingOrgs } from \"../org/auto-join-domain.js\";\nimport { saveOAuthTokens } from \"../oauth-tokens/store.js\";\nimport { identify, track } from \"../tracking/index.js\";\nimport { resolveAuthCookieNamespace } from \"./cookie-namespace.js\";\nimport { getWorkspaceA2ADerivedSecret } from \"./derived-secret.js\";\nimport {\n  getDialect,\n  getDatabaseUrl,\n  getDatabaseAuthToken,\n  pgPoolOptions,\n  neonPoolMax,\n  attachNeonPoolErrorLogger,\n} from \"../db/client.js\";\nimport {\n  pgTable,\n  text as pgText,\n  timestamp as pgTimestamp,\n  boolean as pgBoolean,\n} from \"drizzle-orm/pg-core\";\nimport {\n  sqliteTable,\n  text as sqliteText,\n  integer as sqliteInteger,\n} from \"drizzle-orm/sqlite-core\";\n\n// ---------------------------------------------------------------------------\n// Persistent auth secret\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve the Better Auth signing secret.\n *\n * Resolution order:\n *   1. `BETTER_AUTH_SECRET` env var — explicit, recommended for prod.\n *   2. Hosted workspace deploys can derive a per-purpose secret from the\n *      already-required `A2A_SECRET` root. This keeps fresh workspace branches\n *      bootable without reusing the raw A2A key as a cookie-signing key.\n *   3. `.env.local` in the template cwd — a per-workspace persistent secret\n *      that the framework writes once on first boot when no secret is set.\n *      Gitignored by convention (`.env*` in template .gitignore files), so\n *      it's safe to persist credentials here.\n *   4. Generate a new random 32-byte hex, write it to `.env.local`, and use\n *      it. Subsequent restarts re-read the same file — so session cookies\n *      signed by a previous boot remain valid across dev-server restarts.\n *\n * Why this matters: before this helper existed, missing `BETTER_AUTH_SECRET`\n * fell through to `GOOGLE_CLIENT_SECRET` / `ACCESS_TOKEN` / a hardcoded\n * string. If a template happened to have none of those, each dev-server\n * boot would re-fall back to the hardcoded value (still stable) — but\n * rotating Google credentials, toggling `ACCESS_TOKEN`, or churning the\n * fallback chain would invalidate every signed cookie and force everyone\n * to sign in again. Pinning the secret to `.env.local` on first boot\n * removes that footgun.\n */\nfunction resolveAuthSecret(): string {\n  if (process.env.BETTER_AUTH_SECRET) return process.env.BETTER_AUTH_SECRET;\n  const workspaceDerivedSecret = getWorkspaceA2ADerivedSecret(\"better-auth\");\n  if (workspaceDerivedSecret) return workspaceDerivedSecret;\n\n  // In production, beyond the workspace A2A-derived fallback above, never\n  // auto-generate or use legacy fallbacks. A generated secret invalidates every\n  // signed session cookie on the next cold start (serverless filesystems\n  // aren't persistent), and the legacy hardcoded fallback is identical across\n  // every deploy that hits it — both are serious enough to fail the boot loudly\n  // so the deployer notices.\n  if (process.env.NODE_ENV === \"production\") {\n    const sample = crypto.randomBytes(32).toString(\"hex\");\n    throw new Error(\n      \"[agent-native] BETTER_AUTH_SECRET is not set. This is required in production \" +\n        \"so signed session cookies stay valid across deploys. Set it as a deploy \" +\n        \"environment variable (any 32-byte hex string), e.g.:\\n\\n\" +\n        `  BETTER_AUTH_SECRET=${sample}\\n\\n` +\n        \"Generate your own with `openssl rand -hex 32`. If you already have a \" +\n        \"running deploy and need to preserve existing sessions, set it to your \" +\n        \"previously-deployed BETTER_AUTH_SECRET value first, then rotate to a \" +\n        \"fresh one. Hosted workspace deploys may also \" +\n        \"set A2A_SECRET; agent-native derives a per-purpose Better Auth secret \" +\n        \"from that workspace root secret.\",\n    );\n  }\n\n  // Dev: persist a generated secret to .env.local so sessions survive\n  // dev-server restarts. Falls back to an in-memory random secret only if\n  // the filesystem isn't writable (rare in dev, e.g. read-only mounts) —\n  // sessions reset on every dev-process restart in that case, which is\n  // fine.\n  //\n  // SECURITY (audit 09 LOW-2): the previous fallback chain\n  // (`GOOGLE_CLIENT_SECRET || ACCESS_TOKEN || hardcoded`) reused\n  // cross-purpose secrets and a public hardcoded literal as the cookie\n  // HMAC. Dropped entirely — better to mint an ephemeral secret than to\n  // re-use a Google client secret or a known string.\n  try {\n    const envLocalPath = path.resolve(process.cwd(), \".env.local\");\n    const existing = readEnvLocalSecret(envLocalPath);\n    if (existing) {\n      process.env.BETTER_AUTH_SECRET = existing; // guard:allow-env-mutation — boot-time secret resolution from .env.local, runs once at module init\n      return existing;\n    }\n\n    const generated = crypto.randomBytes(32).toString(\"hex\");\n    appendEnvLocalSecret(envLocalPath, generated);\n    process.env.BETTER_AUTH_SECRET = generated; // guard:allow-env-mutation — boot-time secret generation, runs once at module init before any request\n    console.log(\n      \"[agent-native] Generated a persistent BETTER_AUTH_SECRET in .env.local. \" +\n        \"Sessions will now survive dev-server restarts. \" +\n        \"(Delete .env.local to rotate; set BETTER_AUTH_SECRET in .env to override.)\",\n    );\n    return generated;\n  } catch {\n    // Filesystem unwritable (read-only mount, sandboxed test env, etc.).\n    // Mint a per-process random secret so cookies stay unique per boot.\n    // Sessions reset when the dev process restarts — acceptable for dev.\n    const ephemeral = crypto.randomBytes(32).toString(\"hex\");\n    console.warn(\n      \"[agent-native] Could not persist BETTER_AUTH_SECRET to .env.local \" +\n        \"(filesystem unwritable). Using an ephemeral in-memory secret. \" +\n        \"Sessions will reset every time this process restarts. \" +\n        \"Set BETTER_AUTH_SECRET in your environment to keep sessions valid across restarts.\",\n    );\n    return ephemeral;\n  }\n}\n\nfunction readEnvLocalSecret(envLocalPath: string): string | undefined {\n  try {\n    const content = fs.readFileSync(envLocalPath, \"utf8\");\n    // Match `BETTER_AUTH_SECRET=...` on its own line. Tolerate optional\n    // quotes and leading `export `. Stop at the first newline or quote.\n    const m = content.match(\n      /^(?:export\\s+)?BETTER_AUTH_SECRET\\s*=\\s*\"?([^\"\\r\\n]+)\"?\\s*$/m,\n    );\n    return m?.[1]?.trim() || undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction appendEnvLocalSecret(envLocalPath: string, secret: string): void {\n  const header =\n    \"# Auto-generated by agent-native on first boot. Gitignored.\\n\" +\n    \"# Keeps signed session cookies valid across dev-server restarts.\\n\" +\n    \"# Delete this file (or this line) to rotate the secret.\\n\";\n  const line = `BETTER_AUTH_SECRET=${secret}\\n`;\n\n  // If the file already exists, just append; otherwise create with header.\n  if (fs.existsSync(envLocalPath)) {\n    const existing = fs.readFileSync(envLocalPath, \"utf8\");\n    const needsLeadingNewline = existing.length > 0 && !existing.endsWith(\"\\n\");\n    fs.appendFileSync(\n      envLocalPath,\n      (needsLeadingNewline ? \"\\n\" : \"\") + \"\\n\" + header + line,\n    );\n  } else {\n    fs.writeFileSync(envLocalPath, header + line, { mode: 0o600 });\n  }\n}\n\nexport function shouldSkipEmailVerification(): boolean {\n  const value = process.env.AUTH_SKIP_EMAIL_VERIFICATION;\n  if (value == null) {\n    return (\n      process.env.NODE_ENV === \"development\" || process.env.NODE_ENV === \"test\"\n    );\n  }\n  const normalized = value.trim().toLowerCase();\n  return normalized !== \"\" && normalized !== \"0\" && normalized !== \"false\";\n}\n\n/** Read-only accessor for the resolved auth secret. */\nexport function getAuthSecret(): string {\n  return resolveAuthSecret();\n}\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/** The shape we need from a Better Auth instance (internal — not exported to templates). */\nexport interface BetterAuthInstance {\n  handler: (request: Request) => Promise<Response>;\n  api: {\n    getSession: (opts: { headers: Headers }) => Promise<{\n      user: { id: string; email: string; name: string };\n      session: {\n        id: string;\n        token: string;\n        expiresAt: Date;\n      };\n    } | null>;\n    signInEmail: (opts: {\n      body: { email: string; password: string };\n    }) => Promise<{ token?: string; user?: any } | null>;\n    signUpEmail: (opts: {\n      body: {\n        email: string;\n        password: string;\n        name: string;\n        callbackURL?: string;\n      };\n    }) => Promise<any>;\n    signOut: (opts: { headers: Headers }) => Promise<any>;\n  };\n}\n\nexport interface BetterAuthConfig {\n  /** Base path for Better Auth routes. Default: \"/_agent-native/auth/ba\" */\n  basePath?: string;\n  /** Additional social providers beyond what env vars auto-detect */\n  socialProviders?: BetterAuthOptions[\"socialProviders\"];\n  /** Additional Better Auth plugins */\n  plugins?: BetterAuthOptions[\"plugins\"];\n  /**\n   * Additional Google OAuth scopes (Gmail, Calendar, etc.) to request\n   * up front during the primary \"Sign in with Google\" flow, beyond the\n   * default identity scopes (`openid`, `email`, `profile`).\n   *\n   * When set, the Google social provider also opts into:\n   * - `accessType: \"offline\"` — so a refresh token is issued\n   * - `prompt: \"consent\"` — so the refresh token is reissued every sign-in\n   *\n   * Tokens are mirrored into `oauth_tokens` via a databaseHooks.account\n   * hook so existing template code that reads from `oauth_tokens` (mail's\n   * Gmail client, calendar's events fetcher) works without any separate\n   * \"Connect Google\" page.\n   */\n  googleScopes?: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Lazy instance\n// ---------------------------------------------------------------------------\n\nlet _auth: BetterAuthInstance | undefined;\nlet _initPromise: Promise<BetterAuthInstance> | undefined;\n// Track the Neon serverless Pool we open for Better Auth so closeBetterAuth()\n// can release it. The Pool keeps WebSocket connections open; leaking them on\n// hot-reload or process restart exhausts Neon's connection slot budget.\nlet _neonAuthPool: any;\n\nconst pgAuthSchema = {\n  user: pgTable(\"user\", {\n    id: pgText(\"id\").primaryKey(),\n    name: pgText(\"name\").notNull(),\n    email: pgText(\"email\").notNull().unique(),\n    emailVerified: pgBoolean(\"email_verified\").notNull().default(false),\n    image: pgText(\"image\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  session: pgTable(\"session\", {\n    id: pgText(\"id\").primaryKey(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    token: pgText(\"token\").notNull().unique(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n    ipAddress: pgText(\"ip_address\"),\n    userAgent: pgText(\"user_agent\"),\n    userId: pgText(\"user_id\").notNull(),\n    activeOrganizationId: pgText(\"active_organization_id\"),\n  }),\n  account: pgTable(\"account\", {\n    id: pgText(\"id\").primaryKey(),\n    accountId: pgText(\"account_id\").notNull(),\n    providerId: pgText(\"provider_id\").notNull(),\n    userId: pgText(\"user_id\").notNull(),\n    accessToken: pgText(\"access_token\"),\n    refreshToken: pgText(\"refresh_token\"),\n    idToken: pgText(\"id_token\"),\n    accessTokenExpiresAt: pgTimestamp(\"access_token_expires_at\", {\n      withTimezone: true,\n    }),\n    refreshTokenExpiresAt: pgTimestamp(\"refresh_token_expires_at\", {\n      withTimezone: true,\n    }),\n    scope: pgText(\"scope\"),\n    password: pgText(\"password\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  verification: pgTable(\"verification\", {\n    id: pgText(\"id\").primaryKey(),\n    identifier: pgText(\"identifier\").notNull(),\n    value: pgText(\"value\").notNull(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  organization: pgTable(\"organization\", {\n    id: pgText(\"id\").primaryKey(),\n    name: pgText(\"name\").notNull(),\n    slug: pgText(\"slug\").notNull().unique(),\n    logo: pgText(\"logo\"),\n    metadata: pgText(\"metadata\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  member: pgTable(\"member\", {\n    id: pgText(\"id\").primaryKey(),\n    organizationId: pgText(\"organization_id\").notNull(),\n    userId: pgText(\"user_id\").notNull(),\n    role: pgText(\"role\").notNull().default(\"member\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  invitation: pgTable(\"invitation\", {\n    id: pgText(\"id\").primaryKey(),\n    organizationId: pgText(\"organization_id\").notNull(),\n    email: pgText(\"email\").notNull(),\n    role: pgText(\"role\"),\n    status: pgText(\"status\").notNull().default(\"pending\"),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    inviterId: pgText(\"inviter_id\").notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  jwks: pgTable(\"jwks\", {\n    id: pgText(\"id\").primaryKey(),\n    publicKey: pgText(\"public_key\").notNull(),\n    privateKey: pgText(\"private_key\").notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }),\n  }),\n};\n\nconst sqliteAuthSchema = {\n  user: sqliteTable(\"user\", {\n    id: sqliteText(\"id\").primaryKey(),\n    name: sqliteText(\"name\").notNull(),\n    email: sqliteText(\"email\").notNull().unique(),\n    emailVerified: sqliteInteger(\"email_verified\", { mode: \"boolean\" })\n      .notNull()\n      .default(false),\n    image: sqliteText(\"image\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  session: sqliteTable(\"session\", {\n    id: sqliteText(\"id\").primaryKey(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    token: sqliteText(\"token\").notNull().unique(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n    ipAddress: sqliteText(\"ip_address\"),\n    userAgent: sqliteText(\"user_agent\"),\n    userId: sqliteText(\"user_id\").notNull(),\n    activeOrganizationId: sqliteText(\"active_organization_id\"),\n  }),\n  account: sqliteTable(\"account\", {\n    id: sqliteText(\"id\").primaryKey(),\n    accountId: sqliteText(\"account_id\").notNull(),\n    providerId: sqliteText(\"provider_id\").notNull(),\n    userId: sqliteText(\"user_id\").notNull(),\n    accessToken: sqliteText(\"access_token\"),\n    refreshToken: sqliteText(\"refresh_token\"),\n    idToken: sqliteText(\"id_token\"),\n    accessTokenExpiresAt: sqliteInteger(\"access_token_expires_at\", {\n      mode: \"timestamp_ms\",\n    }),\n    refreshTokenExpiresAt: sqliteInteger(\"refresh_token_expires_at\", {\n      mode: \"timestamp_ms\",\n    }),\n    scope: sqliteText(\"scope\"),\n    password: sqliteText(\"password\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  verification: sqliteTable(\"verification\", {\n    id: sqliteText(\"id\").primaryKey(),\n    identifier: sqliteText(\"identifier\").notNull(),\n    value: sqliteText(\"value\").notNull(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  organization: sqliteTable(\"organization\", {\n    id: sqliteText(\"id\").primaryKey(),\n    name: sqliteText(\"name\").notNull(),\n    slug: sqliteText(\"slug\").notNull().unique(),\n    logo: sqliteText(\"logo\"),\n    metadata: sqliteText(\"metadata\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  member: sqliteTable(\"member\", {\n    id: sqliteText(\"id\").primaryKey(),\n    organizationId: sqliteText(\"organization_id\").notNull(),\n    userId: sqliteText(\"user_id\").notNull(),\n    role: sqliteText(\"role\").notNull().default(\"member\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  invitation: sqliteTable(\"invitation\", {\n    id: sqliteText(\"id\").primaryKey(),\n    organizationId: sqliteText(\"organization_id\").notNull(),\n    email: sqliteText(\"email\").notNull(),\n    role: sqliteText(\"role\"),\n    status: sqliteText(\"status\").notNull().default(\"pending\"),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    inviterId: sqliteText(\"inviter_id\").notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  jwks: sqliteTable(\"jwks\", {\n    id: sqliteText(\"id\").primaryKey(),\n    publicKey: sqliteText(\"public_key\").notNull(),\n    privateKey: sqliteText(\"private_key\").notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }),\n  }),\n};\n\n/**\n * Mirror a Better Auth `account` row for Google into the `oauth_tokens`\n * table that template code (mail's Gmail client, calendar's events fetcher)\n * reads from. Called from the `databaseHooks.account.create.after` and\n * `.update.after` hooks so tokens captured during the primary \"Sign in\n * with Google\" flow flow straight to the apps that need them — no\n * separate \"Connect Google\" page required.\n *\n * Resolves `account.userId` to the user's email by querying the `user`\n * table (Better Auth always quotes \"user\" because it's a reserved word\n * in Postgres; SQLite accepts the quotes too).\n *\n * The hook is fire-and-forget from the caller's perspective — every\n * failure is caught upstream so a flake in `oauth_tokens` never blocks\n * sign-in. We still no-op on missing fields here as a defense in depth.\n */\nasync function mirrorGoogleAccountToOAuthTokens(account: {\n  providerId?: string;\n  userId?: string;\n  accountId?: string;\n  accessToken?: string | null;\n  refreshToken?: string | null;\n  accessTokenExpiresAt?: Date | string | number | null;\n  scope?: string | null;\n  idToken?: string | null;\n}): Promise<void> {\n  if (!account || account.providerId !== \"google\") return;\n  if (!account.userId) return;\n\n  const accessToken = account.accessToken ?? undefined;\n  if (!accessToken) {\n    // Better Auth sometimes upserts an account row before tokens are\n    // attached (e.g. linking flows). Nothing to mirror yet — the next\n    // update hook will run once the access token lands.\n    return;\n  }\n\n  // Resolve user email from userId.\n  const db = getDbExec();\n  let email: string | undefined;\n  try {\n    const { rows } = await db.execute({\n      sql: 'SELECT email FROM \"user\" WHERE id = ?',\n      args: [account.userId],\n    });\n    email = (rows[0]?.email as string | undefined) ?? undefined;\n  } catch (err) {\n    console.error(\n      \"[auth] mirror Google tokens: failed to resolve user email from userId\",\n      err,\n    );\n    return;\n  }\n  if (!email) return;\n\n  // Normalise expiry to epoch ms (Google's \"expiry_date\" convention used\n  // throughout the templates).\n  let expiryDate: number | undefined;\n  const raw = account.accessTokenExpiresAt;\n  if (raw instanceof Date) {\n    expiryDate = raw.getTime();\n  } else if (typeof raw === \"number\") {\n    expiryDate = raw;\n  } else if (typeof raw === \"string\") {\n    const ms = Date.parse(raw);\n    expiryDate = Number.isFinite(ms) ? ms : undefined;\n  }\n\n  const tokens: Record<string, unknown> = {\n    access_token: accessToken,\n    token_type: \"Bearer\",\n  };\n  if (account.refreshToken) tokens.refresh_token = account.refreshToken;\n  if (expiryDate) tokens.expiry_date = expiryDate;\n  if (account.scope) tokens.scope = account.scope;\n  if (account.idToken) tokens.id_token = account.idToken;\n\n  await saveOAuthTokens(\"google\", email, tokens, email);\n}\n\nasync function ensureBetterAuthTables(): Promise<void> {\n  const db = getDbExec();\n  const statements = isPostgres()\n    ? [\n        `CREATE TABLE IF NOT EXISTS \"user\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified BOOLEAN NOT NULL DEFAULT FALSE, image TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"session\" (id TEXT PRIMARY KEY, expires_at TIMESTAMPTZ NOT NULL, token TEXT NOT NULL UNIQUE, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n        `CREATE TABLE IF NOT EXISTS \"account\" (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at TIMESTAMPTZ, refresh_token_expires_at TIMESTAMPTZ, scope TEXT, password TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"verification\" (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"organization\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"member\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"invitation\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at TIMESTAMPTZ NOT NULL, inviter_id TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"jwks\" (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, expires_at TIMESTAMPTZ)`,\n      ]\n    : [\n        `CREATE TABLE IF NOT EXISTS user (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified INTEGER NOT NULL DEFAULT 0, image TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS session (id TEXT PRIMARY KEY, expires_at INTEGER NOT NULL, token TEXT NOT NULL UNIQUE, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n        `CREATE TABLE IF NOT EXISTS account (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at INTEGER, refresh_token_expires_at INTEGER, scope TEXT, password TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS verification (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at INTEGER NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS organization (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS member (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS invitation (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at INTEGER NOT NULL, inviter_id TEXT NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS jwks (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at INTEGER NOT NULL, expires_at INTEGER)`,\n      ];\n\n  for (const sql of statements) await db.execute(sql);\n}\n\n/**\n * Get or create the Better Auth instance.\n * Lazily initialized on first call — the database must be reachable by then.\n */\nexport async function getBetterAuth(\n  config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n  if (_auth) return _auth;\n  if (_initPromise) return _initPromise;\n\n  _initPromise = createBetterAuthInstance(config);\n  _auth = await _initPromise;\n  return _auth;\n}\n\n/**\n * Synchronous getter — returns the instance if already initialized, else undefined.\n * Use this in hot paths where you know init has already happened.\n */\nexport function getBetterAuthSync(): BetterAuthInstance | undefined {\n  return _auth;\n}\n\n/**\n * The subset of Better Auth's internal adapter we use for federated-SSO\n * JIT account linking. Better Auth owns these writes (id + timestamp +\n * schema handling), so callers never hand-roll SQL against `user`/`account`.\n * Read-only lookups + strictly-additive `linkAccount`/`createUser` only — no\n * update/delete of existing identity rows.\n */\nexport interface BetterAuthInternalAdapter {\n  findUserByEmail: (\n    email: string,\n    options?: { includeAccounts: boolean },\n  ) => Promise<{\n    user: { id: string; email: string; name?: string };\n    accounts: Array<{ providerId: string; accountId: string }>;\n  } | null>;\n  linkAccount: (account: {\n    userId: string;\n    providerId: string;\n    accountId: string;\n  }) => Promise<unknown>;\n  createUser: (user: {\n    email: string;\n    name: string;\n    emailVerified?: boolean;\n  }) => Promise<{ id: string }>;\n}\n\n/**\n * Resolve Better Auth's internal adapter via the live instance's\n * `$context`. The framework's narrowed `BetterAuthInstance` interface omits\n * `$context`, but the underlying object created by `betterAuth(...)` always\n * exposes it (see Better Auth's `Auth` type) — so this is a safe, typed\n * accessor for the federated-SSO client. Returns `undefined` if the context\n * shape is unexpected (older/newer Better Auth) so callers can fall back.\n */\nexport async function getBetterAuthInternalAdapter(\n  config?: BetterAuthConfig,\n): Promise<BetterAuthInternalAdapter | undefined> {\n  const auth = (await getBetterAuth(config)) as unknown as {\n    $context?: Promise<{ internalAdapter?: BetterAuthInternalAdapter }>;\n  };\n  try {\n    const ctx = await auth.$context;\n    const ia = ctx?.internalAdapter;\n    if (\n      ia &&\n      typeof ia.findUserByEmail === \"function\" &&\n      typeof ia.linkAccount === \"function\" &&\n      typeof ia.createUser === \"function\"\n    ) {\n      return ia;\n    }\n  } catch {\n    // Context resolution failed — caller falls back to the signup path.\n  }\n  return undefined;\n}\n\n/** Reset for testing */\nexport async function resetBetterAuth(): Promise<void> {\n  _auth = undefined;\n  _initPromise = undefined;\n  if (_neonAuthPool) {\n    try {\n      await _neonAuthPool.end();\n    } catch {\n      // Pool may have already closed (process exiting, etc.) — don't block reset.\n    }\n    _neonAuthPool = undefined;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Instance creation\n// ---------------------------------------------------------------------------\n\nasync function createBetterAuthInstance(\n  config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n  const dialect = getDialect();\n  const basePath = config?.basePath ?? \"/_agent-native/auth/ba\";\n  await ensureBetterAuthTables();\n\n  // Build social providers from env vars\n  const socialProviders: BetterAuthOptions[\"socialProviders\"] = {\n    ...config?.socialProviders,\n  };\n\n  if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {\n    // When the template requests broader scopes (Gmail, Calendar, etc.)\n    // ask for them on the primary sign-in flow so a separate \"Connect\n    // Google\" round-trip isn't needed. `accessType: \"offline\"` plus\n    // `prompt: \"consent\"` ensures we always receive a refresh token back —\n    // Google only re-issues a refresh token on consent, so re-signing in\n    // (e.g. after switching machines) would otherwise leave us with an\n    // access token that can't be refreshed.\n    const extraScopes = config?.googleScopes ?? [];\n    const baseScopes = [\"openid\", \"email\", \"profile\"];\n    const mergedScopes = Array.from(new Set([...baseScopes, ...extraScopes]));\n    socialProviders.google = {\n      clientId: process.env.GOOGLE_CLIENT_ID,\n      clientSecret: process.env.GOOGLE_CLIENT_SECRET,\n      ...(extraScopes.length > 0\n        ? {\n            scope: mergedScopes,\n            accessType: \"offline\" as const,\n            prompt: \"consent\" as const,\n          }\n        : {}),\n    };\n  }\n\n  if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {\n    socialProviders.github = {\n      clientId: process.env.GITHUB_CLIENT_ID,\n      clientSecret: process.env.GITHUB_CLIENT_SECRET,\n    };\n  }\n\n  // Build database config\n  const database = await buildDatabaseConfig(dialect);\n\n  const secret = resolveAuthSecret();\n\n  const appUrl = getAppProductionUrl();\n  const cookieNamespace = resolveAuthCookieNamespace();\n  const requireEmailVerification =\n    isEmailConfigured() && !shouldSkipEmailVerification();\n\n  const auth = betterAuth({\n    basePath,\n    baseURL: appUrl,\n    database,\n    secret,\n    emailAndPassword: {\n      enabled: true,\n      minPasswordLength: 8,\n      // Only require email verification when an email provider is configured.\n      // Without a provider, verification emails can't be sent, so requiring\n      // verification would lock users out of signup entirely. Local dev/test\n      // skip verification by default so +qa accounts can be created quickly;\n      // hosted QA deployments can opt out with AUTH_SKIP_EMAIL_VERIFICATION=1.\n      requireEmailVerification,\n      sendResetPassword: async ({ user, token }) => {\n        // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n        // reset link must include that prefix so the page resolves correctly.\n        const appBasePath = (\n          process.env.VITE_APP_BASE_PATH ||\n          process.env.APP_BASE_PATH ||\n          \"\"\n        ).replace(/\\/$/, \"\");\n        const resetUrl = `${appUrl}${appBasePath}/_agent-native/auth/reset?token=${encodeURIComponent(token)}`;\n        const { subject, html, text } = renderResetPasswordEmail({\n          email: user.email,\n          resetUrl,\n        });\n        await sendEmail({ to: user.email, subject, html, text });\n      },\n    },\n    emailVerification: {\n      // Fire verification email right after signup, before the user has a\n      // session — pairs with requireEmailVerification above. Only enabled\n      // when an email provider is configured.\n      sendOnSignUp: requireEmailVerification,\n      // Auto-create a session once the user clicks the link. Without this,\n      // verified users would have to go back and sign in manually, which is\n      // a confusing dead-end on the verify screen.\n      autoSignInAfterVerification: true,\n      sendVerificationEmail: async ({ user, url }) => {\n        // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n        // verification link must include that prefix so the page resolves correctly.\n        const verifyBasePath = (\n          process.env.VITE_APP_BASE_PATH ||\n          process.env.APP_BASE_PATH ||\n          \"\"\n        ).replace(/\\/$/, \"\");\n        const verifyUrl = verifyBasePath\n          ? url.replace(/(\\/\\/[^/]+)(\\/)/, `$1${verifyBasePath}$2`)\n          : url;\n        const { subject, html, text } = renderVerifySignupEmail({\n          email: user.email,\n          verifyUrl,\n        });\n        await sendEmail({ to: user.email, subject, html, text });\n      },\n    },\n    socialProviders,\n    account: {\n      // Merge accounts when a user signs in with a social provider using an\n      // email that already has a local email/password account (or vice versa).\n      // Only providers listed in `trustedProviders` auto-link — these are the\n      // ones that verify emails at the identity layer. Never add a provider\n      // here that lets users claim an unverified email; that would be an\n      // account-takeover vector.\n      accountLinking: {\n        enabled: true,\n        trustedProviders: [\"google\", \"github\"],\n      },\n    },\n    databaseHooks: {\n      user: {\n        create: {\n          after: async (user: {\n            id?: string;\n            email?: string;\n            name?: string | null;\n          }) => {\n            // When a newly-created user's email has pending org invitations\n            // (common when someone is invited *before* they've signed up),\n            // auto-accept them so the user lands in the org on their very\n            // first page load instead of a blank-slate workspace.\n            const email = user?.email;\n            if (!email) return;\n            identify(email, {\n              email,\n              name: user.name ?? undefined,\n              authUserId: user.id,\n            });\n            track(\n              \"signup\",\n              {\n                auth_provider: \"better-auth\",\n                auth_user_id: user.id,\n              },\n              { userId: email },\n            );\n            try {\n              await acceptPendingInvitationsForEmail(email);\n            } catch (err) {\n              // Never block signup on invite bookkeeping — log and continue.\n              console.error(\n                \"[auth] failed to auto-accept pending invitations\",\n                err,\n              );\n            }\n            try {\n              // Auto-join orgs whose `allowed_domain` matches this email\n              // domain. Lets a fresh `@builder.io` (or any org-domain)\n              // signup land inside the company org on first page load\n              // without going through the picker. No-ops when no match.\n              await autoJoinDomainMatchingOrgs(email);\n            } catch (err) {\n              console.error(\n                \"[auth] failed to auto-join domain-matching orgs\",\n                err,\n              );\n            }\n          },\n        },\n      },\n      account: {\n        // Mirror Google account tokens into `oauth_tokens` so existing\n        // template code (mail's Gmail client, calendar's events fetcher)\n        // can pick up Gmail/Calendar credentials from the primary sign-in\n        // flow — no separate \"Set up Google\" page required.\n        //\n        // Better Auth fires `create` for first-time social sign-in and\n        // `update` whenever a session re-issues tokens (e.g., the user\n        // re-signs in to refresh the token). Both branches do the same\n        // mirroring work; failures never block sign-in.\n        create: {\n          after: async (account: any) => {\n            await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n              console.error(\n                \"[auth] failed to mirror Google account tokens to oauth_tokens (create)\",\n                err,\n              );\n            });\n          },\n        },\n        update: {\n          after: async (account: any) => {\n            await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n              console.error(\n                \"[auth] failed to mirror Google account tokens to oauth_tokens (update)\",\n                err,\n              );\n            });\n          },\n        },\n      },\n    },\n    session: {\n      expiresIn: 60 * 60 * 24 * 30, // 30 days\n      updateAge: 60 * 60 * 24, // refresh daily\n      cookieCache: {\n        enabled: true,\n        maxAge: 5 * 60, // 5 min cache\n      },\n    },\n    advanced: {\n      cookiePrefix: cookieNamespace.betterAuthCookiePrefix,\n      // Emit `SameSite=None; Secure` when the app is served over HTTPS so\n      // session cookies are delivered inside third-party iframes (e.g. the\n      // Builder.io editor). Plain-HTTP dev keeps the default (Lax) because\n      // `SameSite=None` requires Secure.\n      ...(appUrl.startsWith(\"https://\")\n        ? {\n            defaultCookieAttributes: {\n              sameSite: \"none\" as const,\n              secure: true,\n              partitioned: true,\n            },\n          }\n        : {}),\n      // When an effective shared cookie domain is set, share Better Auth's\n      // session cookie across that domain. First-party `*.agent-native.com`\n      // apps intentionally do not use this path because their auth DBs are\n      // separate; Dispatch identity federation handles cross-app sign-in.\n      ...(cookieNamespace.betterAuthCookieDomain\n        ? {\n            crossSubDomainCookies: {\n              enabled: true,\n              domain: cookieNamespace.betterAuthCookieDomain,\n            },\n          }\n        : {}),\n    },\n    plugins: [\n      // JWT: issue tokens for A2A calls, JWKS endpoint for verification\n      jwt({\n        jwt: {\n          issuer: appUrl,\n          expirationTime: \"15m\",\n        },\n      }),\n      // Bearer: accept Bearer tokens on API requests\n      bearer(),\n      ...(config?.plugins ?? []),\n    ],\n  });\n\n  return auth as unknown as BetterAuthInstance;\n}\n\nasync function buildDatabaseConfig(\n  dialect: string,\n): Promise<BetterAuthOptions[\"database\"]> {\n  if (dialect === \"postgres\") {\n    const url = getDatabaseUrl();\n    const { isNeonUrl } = await import(\"../db/create-get-db.js\");\n\n    // Neon via @neondatabase/serverless (WebSockets over HTTPS). postgres-js\n    // opens a raw TCP connection on port 5432 which frequently times out on\n    // Netlify Functions / Vercel / CF Workers when Neon's pooler is cold.\n    if (isNeonUrl(url)) {\n      const { Pool } = await import(\"@neondatabase/serverless\");\n      // Cap the auth pool the same way as the app pool. Better Auth runs a\n      // session lookup on essentially every authenticated request, so an\n      // un-capped pool here is a primary contributor to \"Max client\n      // connections reached\" across concurrent serverless instances.\n      _neonAuthPool = new Pool({\n        connectionString: url,\n        max: neonPoolMax(),\n      });\n      attachNeonPoolErrorLogger(_neonAuthPool, \"db/neon-auth\");\n      const { drizzle } = await import(\"drizzle-orm/neon-serverless\");\n      const db = drizzle(_neonAuthPool, { schema: pgAuthSchema });\n      const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n      return drizzleAdapter(db, {\n        provider: \"pg\",\n        schema: pgAuthSchema,\n      });\n    }\n\n    // Non-Neon Postgres (Supabase, self-hosted, etc.) → postgres-js.\n    // pgPoolOptions caps this pool to a small size on serverless. Better Auth\n    // runs a session lookup on essentially every authenticated request, so an\n    // un-capped pool here is a primary contributor to \"Max client connections\n    // reached\" across concurrent serverless instances.\n    const { default: postgres } = await import(\"postgres\");\n    const sql = postgres(url, pgPoolOptions(url));\n    const { drizzle } = await import(\"drizzle-orm/postgres-js\");\n    const db = drizzle(sql, { schema: pgAuthSchema });\n    const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n    return drizzleAdapter(db, {\n      provider: \"pg\",\n      schema: pgAuthSchema,\n    });\n  }\n\n  // SQLite / libsql\n  const url = getDatabaseUrl(\"file:./data/app.db\");\n\n  if (url.startsWith(\"file:\") || !url.includes(\"://\")) {\n    // Local SQLite via better-sqlite3\n    const { default: Database } = await import(\"better-sqlite3\");\n    const filePath = url.replace(/^file:/, \"\");\n    const sqlite = new Database(filePath);\n    sqlite.pragma(\"journal_mode = WAL\");\n    const { drizzle } = await import(\"drizzle-orm/better-sqlite3\");\n    const db = drizzle(sqlite, { schema: sqliteAuthSchema });\n    const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n    return drizzleAdapter(db, {\n      provider: \"sqlite\",\n      schema: sqliteAuthSchema,\n    });\n  }\n\n  // Remote libsql (Turso). Use the web client to avoid serverless bundles\n  // depending on libsql's platform-specific native packages.\n  const { createClient } = await import(\"@libsql/client/web\");\n  const client = createClient({ url, authToken: getDatabaseAuthToken() });\n  const { drizzle } = await import(\"drizzle-orm/libsql/web\");\n  const db = drizzle(client, { schema: sqliteAuthSchema });\n  const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n  return drizzleAdapter(db, {\n    provider: \"sqlite\",\n    schema: sqliteAuthSchema,\n  });\n}\n"]}
+{"version":3,"file":"better-auth-instance.js","sourceRoot":"","sources":["../../src/server/better-auth-instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,WAAW,EACX,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,OAAO,EACP,IAAI,IAAI,MAAM,EACd,SAAS,IAAI,WAAW,EACxB,OAAO,IAAI,SAAS,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,IAAI,IAAI,UAAU,EAClB,OAAO,IAAI,aAAa,GACzB,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,iBAAiB;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC1E,MAAM,sBAAsB,GAAG,4BAA4B,CAAC,aAAa,CAAC,CAAC;IAC3E,IAAI,sBAAsB;QAAE,OAAO,sBAAsB,CAAC;IAE1D,wEAAwE;IACxE,8EAA8E;IAC9E,uEAAuE;IACvE,4EAA4E;IAC5E,8EAA8E;IAC9E,2BAA2B;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,+EAA+E;YAC7E,0EAA0E;YAC1E,0DAA0D;YAC1D,wBAAwB,MAAM,MAAM;YACpC,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,+CAA+C;YAC/C,wEAAwE;YACxE,kCAAkC,CACrC,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,QAAQ;IACR,EAAE;IACF,yDAAyD;IACzD,+DAA+D;IAC/D,qEAAqE;IACrE,sEAAsE;IACtE,mDAAmD;IACnD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,QAAQ,CAAC,CAAC,mGAAmG;YAC9I,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC,sGAAsG;QAClJ,OAAO,CAAC,GAAG,CACT,0EAA0E;YACxE,iDAAiD;YACjD,4EAA4E,CAC/E,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CACV,oEAAoE;YAClE,gEAAgE;YAChE,wDAAwD;YACxD,oFAAoF,CACvF,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtD,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CACrB,8DAA8D,CAC/D,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAoB,EAAE,MAAc;IAChE,MAAM,MAAM,GACV,+DAA+D;QAC/D,oEAAoE;QACpE,2DAA2D,CAAC;IAC9D,MAAM,IAAI,GAAG,sBAAsB,MAAM,IAAI,CAAC;IAE9C,yEAAyE;IACzE,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5E,EAAE,CAAC,cAAc,CACf,YAAY,EACZ,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CACzD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAyB;IACtD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACtC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC;QACvC,CAAC,CAAC,OAAO,CAAC;IACZ,MAAM,IAAI,GAAG,QAAQ;SAClB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,IAAI,IAAI,SAAS,CAAC;AAC3B,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QACpD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC;QACpC,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa,CAAC;QAClE,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAEtD,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;YAChD,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC3C,OAAO,qBAAqB,CAC1B,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAC/C,CAAC;QACJ,CAAC;QACD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,6BAA6B;IAI3C,MAAM,WAAW,GACf,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACnD,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC3D,MAAM,UAAU,GACd,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACnD,qBAAqB,CAAC,eAAe,EAAE,CAAC,CAAC;IAC3C,MAAM,MAAM,GACV,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACnC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3C,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QAC/B,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACtC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;QACzD,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,GAAG,GACP,WAAW;QACX,MAAM;QACN,UAAU;QACV,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE9C,MAAM,QAAQ,GACZ,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACpD,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACzD,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC3C,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAChD,iBAAiB,CAAC,GAAG,CAAC;QACtB,iBAAiB,CAAC,UAAU,CAAC;QAC7B,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE5B,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,+BAA+B;IAC7C,MAAM,QAAQ,GAAG,6BAA6B,EAAE,CAAC;IACjD,OAAO;QACL,GAAG,QAAQ;QACX,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACvD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,OAAO,CAAC;AAC3E,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAyDD,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,IAAI,KAAqC,CAAC;AAC1C,IAAI,YAAqD,CAAC;AAC1D,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACxE,IAAI,aAAkB,CAAC;AAEvB,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,aAAa,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,oBAAoB,EAAE,MAAM,CAAC,wBAAwB,CAAC;KACvD,CAAC;IACF,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;QACnC,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC;QACrC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;QAC3B,oBAAoB,EAAE,WAAW,CAAC,yBAAyB,EAAE;YAC3D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,qBAAqB,EAAE,WAAW,CAAC,0BAA0B,EAAE;YAC7D,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE;QACpC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QACvC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAC5B,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE;QACxB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACnC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE;QAChC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACnD,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAChC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;KACvE,CAAC;IACF,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC3C,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;KAC7D,CAAC;CACH,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,aAAa,EAAE,aAAa,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aAChE,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;QACjB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,UAAU,CAAC,wBAAwB,CAAC;KAC3D,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE;QAC9B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,WAAW,EAAE,UAAU,CAAC,cAAc,CAAC;QACvC,YAAY,EAAE,UAAU,CAAC,eAAe,CAAC;QACzC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC;QAC/B,oBAAoB,EAAE,aAAa,CAAC,yBAAyB,EAAE;YAC7D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,qBAAqB,EAAE,aAAa,CAAC,0BAA0B,EAAE;YAC/D,IAAI,EAAE,cAAc;SACrB,CAAC;QACF,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1B,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC9C,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,YAAY,EAAE,WAAW,CAAC,cAAc,EAAE;QACxC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAClC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC3C,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC5B,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,UAAU,EAAE,WAAW,CAAC,YAAY,EAAE;QACpC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,cAAc,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;QACvD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QACpC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACzD,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;KAC3E,CAAC;IACF,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE;QACxB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QACjC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QAC/C,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1E,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;KACjE,CAAC;CACH,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,gCAAgC,CAAC,OAS/C;IACC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO;IACxD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO;IAE5B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iEAAiE;QACjE,kEAAkE;QAClE,oDAAoD;QACpD,OAAO;IACT,CAAC;IAED,kCAAkC;IAClC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAChC,GAAG,EAAE,uCAAuC;YAC5C,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACvB,CAAC,CAAC;QACH,KAAK,GAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAA4B,IAAI,SAAS,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,uEAAuE,EACvE,GAAG,CACJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,uEAAuE;IACvE,6BAA6B;IAC7B,IAAI,UAA8B,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC;IACzC,IAAI,GAAG,YAAY,IAAI,EAAE,CAAC;QACxB,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,UAAU,GAAG,GAAG,CAAC;IACnB,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAA4B;QACtC,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;KACrB,CAAC;IACF,IAAI,OAAO,CAAC,YAAY;QAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IACtE,IAAI,UAAU;QAAE,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC;IAChD,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAEvD,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,sBAAsB;IACnC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,UAAU,EAAE;QAC7B,CAAC,CAAC;YACE,sOAAsO;YACtO,iRAAiR;YACjR,sWAAsW;YACtW,mNAAmN;YACnN,4MAA4M;YAC5M,wNAAwN;YACxN,mSAAmS;YACnS,uKAAuK;SACxK;QACH,CAAC,CAAC;YACE,wNAAwN;YACxN,mQAAmQ;YACnQ,oVAAoV;YACpV,qMAAqM;YACrM,kMAAkM;YAClM,8MAA8M;YAC9M,qRAAqR;YACrR,6JAA6J;SAC9J,CAAC;IAEN,KAAK,MAAM,GAAG,IAAI,UAAU;QAAE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB;IAEzB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,YAAY,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAChD,KAAK,GAAG,MAAM,YAAY,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AA6BD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAExC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;QAChC,MAAM,EAAE,GAAG,GAAG,EAAE,eAAe,CAAC;QAChC,IACE,EAAE;YACF,OAAO,EAAE,CAAC,eAAe,KAAK,UAAU;YACxC,OAAO,EAAE,CAAC,WAAW,KAAK,UAAU;YACpC,OAAO,EAAE,CAAC,UAAU,KAAK,UAAU,EACnC,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,KAAK,GAAG,SAAS,CAAC;IAClB,YAAY,GAAG,SAAS,CAAC;IACzB,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;QACD,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,KAAK,UAAU,wBAAwB,CACrC,MAAyB;IAEzB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,wBAAwB,CAAC;IAC9D,MAAM,sBAAsB,EAAE,CAAC;IAE/B,uCAAuC;IACvC,MAAM,eAAe,GAAyC;QAC5D,GAAG,MAAM,EAAE,eAAe;KAC3B,CAAC;IAEF,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,wCAAwC;QACxC,MAAM,WAAW,GAAG,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC1E,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAC9C,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC;oBACE,KAAK,EAAE,YAAY;oBACnB,UAAU,EAAE,SAAkB;oBAC9B,MAAM,EAAE,SAAkB;iBAC3B;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACrE,eAAe,CAAC,MAAM,GAAG;YACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;SAC/C,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,eAAe,GAAG,0BAA0B,EAAE,CAAC;IACrD,MAAM,wBAAwB,GAC5B,iBAAiB,EAAE,IAAI,CAAC,2BAA2B,EAAE,CAAC;IAExD,MAAM,IAAI,GAAG,UAAU,CAAC;QACtB,QAAQ;QACR,OAAO,EAAE,MAAM;QACf,QAAQ;QACR,MAAM;QACN,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,CAAC;YACpB,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,wBAAwB;YACxB,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC3C,qEAAqE;gBACrE,sEAAsE;gBACtE,MAAM,WAAW,GAAG,CAClB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,WAAW,mCAAmC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAC;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ;iBACT,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,oEAAoE;YACpE,oEAAoE;YACpE,wCAAwC;YACxC,YAAY,EAAE,wBAAwB;YACtC,qEAAqE;YACrE,sEAAsE;YACtE,6CAA6C;YAC7C,2BAA2B,EAAE,IAAI;YACjC,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC7C,qEAAqE;gBACrE,6EAA6E;gBAC7E,MAAM,cAAc,GAAG,CACrB,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,OAAO,CAAC,GAAG,CAAC,aAAa;oBACzB,EAAE,CACH,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,SAAS,GAAG,cAAc;oBAC9B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,cAAc,IAAI,CAAC;oBACzD,CAAC,CAAC,GAAG,CAAC;gBACR,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC;oBACtD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS;iBACV,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QACD,eAAe;QACf,OAAO,EAAE;YACP,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,mEAAmE;YACnE,2BAA2B;YAC3B,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;aACvC;SACF;QACD,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,IAIb,EAAE,EAAE;wBACH,gEAAgE;wBAChE,+DAA+D;wBAC/D,8DAA8D;wBAC9D,sDAAsD;wBACtD,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;wBAC1B,IAAI,CAAC,KAAK;4BAAE,OAAO;wBACnB,QAAQ,CAAC,KAAK,EAAE;4BACd,KAAK;4BACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS;4BAC5B,UAAU,EAAE,IAAI,CAAC,EAAE;yBACpB,CAAC,CAAC;wBACH,KAAK,CACH,QAAQ,EACR;4BACE,GAAG,+BAA+B,EAAE;4BACpC,aAAa,EAAE,aAAa;4BAC5B,YAAY,EAAE,IAAI,CAAC,EAAE;yBACtB,EACD,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;wBACF,IAAI,CAAC;4BACH,MAAM,gCAAgC,CAAC,KAAK,CAAC,CAAC;wBAChD,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,+DAA+D;4BAC/D,OAAO,CAAC,KAAK,CACX,kDAAkD,EAClD,GAAG,CACJ,CAAC;wBACJ,CAAC;wBACD,IAAI,CAAC;4BACH,2DAA2D;4BAC3D,yDAAyD;4BACzD,wDAAwD;4BACxD,0DAA0D;4BAC1D,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;wBAC1C,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,OAAO,CAAC,KAAK,CACX,iDAAiD,EACjD,GAAG,CACJ,CAAC;wBACJ,CAAC;oBACH,CAAC;iBACF;aACF;YACD,OAAO,EAAE;gBACP,+DAA+D;gBAC/D,iEAAiE;gBACjE,kEAAkE;gBAClE,oDAAoD;gBACpD,EAAE;gBACF,+DAA+D;gBAC/D,+DAA+D;gBAC/D,+DAA+D;gBAC/D,gDAAgD;gBAChD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;gBACD,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;wBAC5B,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC5D,OAAO,CAAC,KAAK,CACX,wEAAwE,EACxE,GAAG,CACJ,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF;aACF;SACF;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU;YACxC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,gBAAgB;YACzC,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,cAAc;aAC/B;SACF;QACD,QAAQ,EAAE;YACR,YAAY,EAAE,eAAe,CAAC,sBAAsB;YACpD,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,mCAAmC;YACnC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC/B,CAAC,CAAC;oBACE,uBAAuB,EAAE;wBACvB,QAAQ,EAAE,MAAe;wBACzB,MAAM,EAAE,IAAI;wBACZ,WAAW,EAAE,IAAI;qBAClB;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,oEAAoE;YACpE,GAAG,CAAC,eAAe,CAAC,sBAAsB;gBACxC,CAAC,CAAC;oBACE,qBAAqB,EAAE;wBACrB,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,eAAe,CAAC,sBAAsB;qBAC/C;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,OAAO,EAAE;YACP,kEAAkE;YAClE,GAAG,CAAC;gBACF,GAAG,EAAE;oBACH,MAAM,EAAE,MAAM;oBACd,cAAc,EAAE,KAAK;iBACtB;aACF,CAAC;YACF,+CAA+C;YAC/C,MAAM,EAAE;YACR,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC3B;KACF,CAAC,CAAC;IAEH,OAAO,IAAqC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAe;IAEf,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAE7D,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YAC1D,qEAAqE;YACrE,mEAAmE;YACnE,8DAA8D;YAC9D,+DAA+D;YAC/D,aAAa,GAAG,IAAI,IAAI,CAAC;gBACvB,gBAAgB,EAAE,GAAG;gBACrB,GAAG,EAAE,WAAW,EAAE;aACnB,CAAC,CAAC;YACH,yBAAyB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACzD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAChE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACxE,OAAO,cAAc,CAAC,EAAE,EAAE;gBACxB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,YAAY;aACrB,CAAC,CAAC;QACL,CAAC;QAED,iEAAiE;QACjE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,mDAAmD;QACnD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAClD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAEjD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,kCAAkC;QAClC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACzD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACxE,OAAO,cAAc,CAAC,EAAE,EAAE;QACxB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Internal Better Auth instance — lazily created, not exported to templates.\n *\n * Templates interact with auth via the existing `getSession()`, `autoMountAuth()`,\n * `createAuthPlugin()`, and `createGoogleAuthPlugin()` APIs. Better Auth is an\n * implementation detail behind those interfaces.\n */\n\nimport crypto from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { betterAuth, type BetterAuthOptions } from \"better-auth\";\nimport { jwt } from \"better-auth/plugins/jwt\";\nimport { bearer } from \"better-auth/plugins/bearer\";\nimport { sendEmail, isEmailConfigured } from \"./email.js\";\nimport {\n  renderResetPasswordEmail,\n  renderVerifySignupEmail,\n} from \"./email-templates.js\";\nimport { getAppProductionUrl } from \"./app-url.js\";\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport { acceptPendingInvitationsForEmail } from \"../org/accept-pending.js\";\nimport { autoJoinDomainMatchingOrgs } from \"../org/auto-join-domain.js\";\nimport { saveOAuthTokens } from \"../oauth-tokens/store.js\";\nimport { identify, track } from \"../tracking/index.js\";\nimport { TEMPLATES } from \"../cli/templates-meta.js\";\nimport { resolveAuthCookieNamespace } from \"./cookie-namespace.js\";\nimport { getWorkspaceA2ADerivedSecret } from \"./derived-secret.js\";\nimport {\n  getDialect,\n  getDatabaseUrl,\n  getDatabaseAuthToken,\n  pgPoolOptions,\n  neonPoolMax,\n  attachNeonPoolErrorLogger,\n} from \"../db/client.js\";\nimport {\n  pgTable,\n  text as pgText,\n  timestamp as pgTimestamp,\n  boolean as pgBoolean,\n} from \"drizzle-orm/pg-core\";\nimport {\n  sqliteTable,\n  text as sqliteText,\n  integer as sqliteInteger,\n} from \"drizzle-orm/sqlite-core\";\n\n// ---------------------------------------------------------------------------\n// Persistent auth secret\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve the Better Auth signing secret.\n *\n * Resolution order:\n *   1. `BETTER_AUTH_SECRET` env var — explicit, recommended for prod.\n *   2. Hosted workspace deploys can derive a per-purpose secret from the\n *      already-required `A2A_SECRET` root. This keeps fresh workspace branches\n *      bootable without reusing the raw A2A key as a cookie-signing key.\n *   3. `.env.local` in the template cwd — a per-workspace persistent secret\n *      that the framework writes once on first boot when no secret is set.\n *      Gitignored by convention (`.env*` in template .gitignore files), so\n *      it's safe to persist credentials here.\n *   4. Generate a new random 32-byte hex, write it to `.env.local`, and use\n *      it. Subsequent restarts re-read the same file — so session cookies\n *      signed by a previous boot remain valid across dev-server restarts.\n *\n * Why this matters: before this helper existed, missing `BETTER_AUTH_SECRET`\n * fell through to `GOOGLE_CLIENT_SECRET` / `ACCESS_TOKEN` / a hardcoded\n * string. If a template happened to have none of those, each dev-server\n * boot would re-fall back to the hardcoded value (still stable) — but\n * rotating Google credentials, toggling `ACCESS_TOKEN`, or churning the\n * fallback chain would invalidate every signed cookie and force everyone\n * to sign in again. Pinning the secret to `.env.local` on first boot\n * removes that footgun.\n */\nfunction resolveAuthSecret(): string {\n  if (process.env.BETTER_AUTH_SECRET) return process.env.BETTER_AUTH_SECRET;\n  const workspaceDerivedSecret = getWorkspaceA2ADerivedSecret(\"better-auth\");\n  if (workspaceDerivedSecret) return workspaceDerivedSecret;\n\n  // In production, beyond the workspace A2A-derived fallback above, never\n  // auto-generate or use legacy fallbacks. A generated secret invalidates every\n  // signed session cookie on the next cold start (serverless filesystems\n  // aren't persistent), and the legacy hardcoded fallback is identical across\n  // every deploy that hits it — both are serious enough to fail the boot loudly\n  // so the deployer notices.\n  if (process.env.NODE_ENV === \"production\") {\n    const sample = crypto.randomBytes(32).toString(\"hex\");\n    throw new Error(\n      \"[agent-native] BETTER_AUTH_SECRET is not set. This is required in production \" +\n        \"so signed session cookies stay valid across deploys. Set it as a deploy \" +\n        \"environment variable (any 32-byte hex string), e.g.:\\n\\n\" +\n        `  BETTER_AUTH_SECRET=${sample}\\n\\n` +\n        \"Generate your own with `openssl rand -hex 32`. If you already have a \" +\n        \"running deploy and need to preserve existing sessions, set it to your \" +\n        \"previously-deployed BETTER_AUTH_SECRET value first, then rotate to a \" +\n        \"fresh one. Hosted workspace deploys may also \" +\n        \"set A2A_SECRET; agent-native derives a per-purpose Better Auth secret \" +\n        \"from that workspace root secret.\",\n    );\n  }\n\n  // Dev: persist a generated secret to .env.local so sessions survive\n  // dev-server restarts. Falls back to an in-memory random secret only if\n  // the filesystem isn't writable (rare in dev, e.g. read-only mounts) —\n  // sessions reset on every dev-process restart in that case, which is\n  // fine.\n  //\n  // SECURITY (audit 09 LOW-2): the previous fallback chain\n  // (`GOOGLE_CLIENT_SECRET || ACCESS_TOKEN || hardcoded`) reused\n  // cross-purpose secrets and a public hardcoded literal as the cookie\n  // HMAC. Dropped entirely — better to mint an ephemeral secret than to\n  // re-use a Google client secret or a known string.\n  try {\n    const envLocalPath = path.resolve(process.cwd(), \".env.local\");\n    const existing = readEnvLocalSecret(envLocalPath);\n    if (existing) {\n      process.env.BETTER_AUTH_SECRET = existing; // guard:allow-env-mutation — boot-time secret resolution from .env.local, runs once at module init\n      return existing;\n    }\n\n    const generated = crypto.randomBytes(32).toString(\"hex\");\n    appendEnvLocalSecret(envLocalPath, generated);\n    process.env.BETTER_AUTH_SECRET = generated; // guard:allow-env-mutation — boot-time secret generation, runs once at module init before any request\n    console.log(\n      \"[agent-native] Generated a persistent BETTER_AUTH_SECRET in .env.local. \" +\n        \"Sessions will now survive dev-server restarts. \" +\n        \"(Delete .env.local to rotate; set BETTER_AUTH_SECRET in .env to override.)\",\n    );\n    return generated;\n  } catch {\n    // Filesystem unwritable (read-only mount, sandboxed test env, etc.).\n    // Mint a per-process random secret so cookies stay unique per boot.\n    // Sessions reset when the dev process restarts — acceptable for dev.\n    const ephemeral = crypto.randomBytes(32).toString(\"hex\");\n    console.warn(\n      \"[agent-native] Could not persist BETTER_AUTH_SECRET to .env.local \" +\n        \"(filesystem unwritable). Using an ephemeral in-memory secret. \" +\n        \"Sessions will reset every time this process restarts. \" +\n        \"Set BETTER_AUTH_SECRET in your environment to keep sessions valid across restarts.\",\n    );\n    return ephemeral;\n  }\n}\n\nfunction readEnvLocalSecret(envLocalPath: string): string | undefined {\n  try {\n    const content = fs.readFileSync(envLocalPath, \"utf8\");\n    // Match `BETTER_AUTH_SECRET=...` on its own line. Tolerate optional\n    // quotes and leading `export `. Stop at the first newline or quote.\n    const m = content.match(\n      /^(?:export\\s+)?BETTER_AUTH_SECRET\\s*=\\s*\"?([^\"\\r\\n]+)\"?\\s*$/m,\n    );\n    return m?.[1]?.trim() || undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction appendEnvLocalSecret(envLocalPath: string, secret: string): void {\n  const header =\n    \"# Auto-generated by agent-native on first boot. Gitignored.\\n\" +\n    \"# Keeps signed session cookies valid across dev-server restarts.\\n\" +\n    \"# Delete this file (or this line) to rotate the secret.\\n\";\n  const line = `BETTER_AUTH_SECRET=${secret}\\n`;\n\n  // If the file already exists, just append; otherwise create with header.\n  if (fs.existsSync(envLocalPath)) {\n    const existing = fs.readFileSync(envLocalPath, \"utf8\");\n    const needsLeadingNewline = existing.length > 0 && !existing.endsWith(\"\\n\");\n    fs.appendFileSync(\n      envLocalPath,\n      (needsLeadingNewline ? \"\\n\" : \"\") + \"\\n\" + header + line,\n    );\n  } else {\n    fs.writeFileSync(envLocalPath, header + line, { mode: 0o600 });\n  }\n}\n\nfunction normalizeTrackingSlug(value: string | undefined): string | undefined {\n  const trimmed = value?.trim();\n  if (!trimmed) return undefined;\n  const unscoped = trimmed.startsWith(\"@\")\n    ? (trimmed.split(\"/\").pop() ?? trimmed)\n    : trimmed;\n  const slug = unscoped\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return slug || undefined;\n}\n\nfunction knownTemplateSlug(value: string | undefined): string | undefined {\n  const slug = normalizeTrackingSlug(value);\n  if (!slug) return undefined;\n  const withoutPrefix = slug.startsWith(\"agent-native-\")\n    ? slug.slice(\"agent-native-\".length)\n    : slug;\n  return TEMPLATES.some((template) => template.name === withoutPrefix)\n    ? withoutPrefix\n    : undefined;\n}\n\nfunction readPackageName(): string | undefined {\n  try {\n    const pkgPath = path.join(process.cwd(), \"package.json\");\n    const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf8\")) as {\n      name?: string;\n    };\n    return pkg.name;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction appSlugFromUrl(value: string | undefined): string | undefined {\n  if (!value?.trim()) return undefined;\n  try {\n    const raw = /^[a-z][a-z0-9+.-]*:\\/\\//i.test(value)\n      ? value\n      : `https://${value}`;\n    const hostname = new URL(raw).hostname.toLowerCase();\n    if (hostname.endsWith(\".agent-native.com\")) {\n      return normalizeTrackingSlug(\n        hostname.slice(0, -\".agent-native.com\".length),\n      );\n    }\n    return normalizeTrackingSlug(hostname.split(\".\")[0]);\n  } catch {\n    return undefined;\n  }\n}\n\n/** @internal */\nexport function resolveSignupTrackingIdentity(): {\n  app?: string;\n  template?: string;\n} {\n  const explicitApp =\n    normalizeTrackingSlug(process.env.AGENT_NATIVE_APP) ||\n    normalizeTrackingSlug(process.env.VITE_AGENT_NATIVE_APP);\n  const packageApp =\n    normalizeTrackingSlug(process.env.npm_package_name) ||\n    normalizeTrackingSlug(readPackageName());\n  const urlApp =\n    appSlugFromUrl(process.env.APP_URL) ||\n    appSlugFromUrl(process.env.BETTER_AUTH_URL) ||\n    appSlugFromUrl(process.env.URL) ||\n    appSlugFromUrl(process.env.DEPLOY_URL) ||\n    appSlugFromUrl(process.env.VERCEL_PROJECT_PRODUCTION_URL) ||\n    appSlugFromUrl(process.env.VERCEL_URL);\n  const app =\n    explicitApp ||\n    urlApp ||\n    packageApp ||\n    normalizeTrackingSlug(process.env.APP_NAME);\n\n  const template =\n    knownTemplateSlug(process.env.AGENT_NATIVE_TEMPLATE) ||\n    knownTemplateSlug(process.env.VITE_AGENT_NATIVE_TEMPLATE) ||\n    knownTemplateSlug(process.env.APP_TEMPLATE) ||\n    knownTemplateSlug(process.env.VITE_APP_TEMPLATE) ||\n    knownTemplateSlug(app) ||\n    knownTemplateSlug(packageApp) ||\n    knownTemplateSlug(urlApp);\n\n  return {\n    ...(app ? { app } : {}),\n    ...(template ? { template } : {}),\n  };\n}\n\n/** @internal */\nexport function resolveSignupTrackingProperties(): Record<string, string> {\n  const identity = resolveSignupTrackingIdentity();\n  return {\n    ...identity,\n    ...(identity.app ? { agent_native_app: identity.app } : {}),\n    ...(identity.template ? { agent_native_template: identity.template } : {}),\n  };\n}\n\nexport function shouldSkipEmailVerification(): boolean {\n  const value = process.env.AUTH_SKIP_EMAIL_VERIFICATION;\n  if (value == null) {\n    return (\n      process.env.NODE_ENV === \"development\" || process.env.NODE_ENV === \"test\"\n    );\n  }\n  const normalized = value.trim().toLowerCase();\n  return normalized !== \"\" && normalized !== \"0\" && normalized !== \"false\";\n}\n\n/** Read-only accessor for the resolved auth secret. */\nexport function getAuthSecret(): string {\n  return resolveAuthSecret();\n}\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/** The shape we need from a Better Auth instance (internal — not exported to templates). */\nexport interface BetterAuthInstance {\n  handler: (request: Request) => Promise<Response>;\n  api: {\n    getSession: (opts: { headers: Headers }) => Promise<{\n      user: { id: string; email: string; name: string };\n      session: {\n        id: string;\n        token: string;\n        expiresAt: Date;\n      };\n    } | null>;\n    signInEmail: (opts: {\n      body: { email: string; password: string };\n    }) => Promise<{ token?: string; user?: any } | null>;\n    signUpEmail: (opts: {\n      body: {\n        email: string;\n        password: string;\n        name: string;\n        callbackURL?: string;\n      };\n    }) => Promise<any>;\n    signOut: (opts: { headers: Headers }) => Promise<any>;\n  };\n}\n\nexport interface BetterAuthConfig {\n  /** Base path for Better Auth routes. Default: \"/_agent-native/auth/ba\" */\n  basePath?: string;\n  /** Additional social providers beyond what env vars auto-detect */\n  socialProviders?: BetterAuthOptions[\"socialProviders\"];\n  /** Additional Better Auth plugins */\n  plugins?: BetterAuthOptions[\"plugins\"];\n  /**\n   * Additional Google OAuth scopes (Gmail, Calendar, etc.) to request\n   * up front during the primary \"Sign in with Google\" flow, beyond the\n   * default identity scopes (`openid`, `email`, `profile`).\n   *\n   * When set, the Google social provider also opts into:\n   * - `accessType: \"offline\"` — so a refresh token is issued\n   * - `prompt: \"consent\"` — so the refresh token is reissued every sign-in\n   *\n   * Tokens are mirrored into `oauth_tokens` via a databaseHooks.account\n   * hook so existing template code that reads from `oauth_tokens` (mail's\n   * Gmail client, calendar's events fetcher) works without any separate\n   * \"Connect Google\" page.\n   */\n  googleScopes?: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Lazy instance\n// ---------------------------------------------------------------------------\n\nlet _auth: BetterAuthInstance | undefined;\nlet _initPromise: Promise<BetterAuthInstance> | undefined;\n// Track the Neon serverless Pool we open for Better Auth so closeBetterAuth()\n// can release it. The Pool keeps WebSocket connections open; leaking them on\n// hot-reload or process restart exhausts Neon's connection slot budget.\nlet _neonAuthPool: any;\n\nconst pgAuthSchema = {\n  user: pgTable(\"user\", {\n    id: pgText(\"id\").primaryKey(),\n    name: pgText(\"name\").notNull(),\n    email: pgText(\"email\").notNull().unique(),\n    emailVerified: pgBoolean(\"email_verified\").notNull().default(false),\n    image: pgText(\"image\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  session: pgTable(\"session\", {\n    id: pgText(\"id\").primaryKey(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    token: pgText(\"token\").notNull().unique(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n    ipAddress: pgText(\"ip_address\"),\n    userAgent: pgText(\"user_agent\"),\n    userId: pgText(\"user_id\").notNull(),\n    activeOrganizationId: pgText(\"active_organization_id\"),\n  }),\n  account: pgTable(\"account\", {\n    id: pgText(\"id\").primaryKey(),\n    accountId: pgText(\"account_id\").notNull(),\n    providerId: pgText(\"provider_id\").notNull(),\n    userId: pgText(\"user_id\").notNull(),\n    accessToken: pgText(\"access_token\"),\n    refreshToken: pgText(\"refresh_token\"),\n    idToken: pgText(\"id_token\"),\n    accessTokenExpiresAt: pgTimestamp(\"access_token_expires_at\", {\n      withTimezone: true,\n    }),\n    refreshTokenExpiresAt: pgTimestamp(\"refresh_token_expires_at\", {\n      withTimezone: true,\n    }),\n    scope: pgText(\"scope\"),\n    password: pgText(\"password\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  verification: pgTable(\"verification\", {\n    id: pgText(\"id\").primaryKey(),\n    identifier: pgText(\"identifier\").notNull(),\n    value: pgText(\"value\").notNull(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  organization: pgTable(\"organization\", {\n    id: pgText(\"id\").primaryKey(),\n    name: pgText(\"name\").notNull(),\n    slug: pgText(\"slug\").notNull().unique(),\n    logo: pgText(\"logo\"),\n    metadata: pgText(\"metadata\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  member: pgTable(\"member\", {\n    id: pgText(\"id\").primaryKey(),\n    organizationId: pgText(\"organization_id\").notNull(),\n    userId: pgText(\"user_id\").notNull(),\n    role: pgText(\"role\").notNull().default(\"member\"),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  invitation: pgTable(\"invitation\", {\n    id: pgText(\"id\").primaryKey(),\n    organizationId: pgText(\"organization_id\").notNull(),\n    email: pgText(\"email\").notNull(),\n    role: pgText(\"role\"),\n    status: pgText(\"status\").notNull().default(\"pending\"),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }).notNull(),\n    inviterId: pgText(\"inviter_id\").notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    updatedAt: pgTimestamp(\"updated_at\", { withTimezone: true }).notNull(),\n  }),\n  jwks: pgTable(\"jwks\", {\n    id: pgText(\"id\").primaryKey(),\n    publicKey: pgText(\"public_key\").notNull(),\n    privateKey: pgText(\"private_key\").notNull(),\n    createdAt: pgTimestamp(\"created_at\", { withTimezone: true }).notNull(),\n    expiresAt: pgTimestamp(\"expires_at\", { withTimezone: true }),\n  }),\n};\n\nconst sqliteAuthSchema = {\n  user: sqliteTable(\"user\", {\n    id: sqliteText(\"id\").primaryKey(),\n    name: sqliteText(\"name\").notNull(),\n    email: sqliteText(\"email\").notNull().unique(),\n    emailVerified: sqliteInteger(\"email_verified\", { mode: \"boolean\" })\n      .notNull()\n      .default(false),\n    image: sqliteText(\"image\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  session: sqliteTable(\"session\", {\n    id: sqliteText(\"id\").primaryKey(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    token: sqliteText(\"token\").notNull().unique(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n    ipAddress: sqliteText(\"ip_address\"),\n    userAgent: sqliteText(\"user_agent\"),\n    userId: sqliteText(\"user_id\").notNull(),\n    activeOrganizationId: sqliteText(\"active_organization_id\"),\n  }),\n  account: sqliteTable(\"account\", {\n    id: sqliteText(\"id\").primaryKey(),\n    accountId: sqliteText(\"account_id\").notNull(),\n    providerId: sqliteText(\"provider_id\").notNull(),\n    userId: sqliteText(\"user_id\").notNull(),\n    accessToken: sqliteText(\"access_token\"),\n    refreshToken: sqliteText(\"refresh_token\"),\n    idToken: sqliteText(\"id_token\"),\n    accessTokenExpiresAt: sqliteInteger(\"access_token_expires_at\", {\n      mode: \"timestamp_ms\",\n    }),\n    refreshTokenExpiresAt: sqliteInteger(\"refresh_token_expires_at\", {\n      mode: \"timestamp_ms\",\n    }),\n    scope: sqliteText(\"scope\"),\n    password: sqliteText(\"password\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  verification: sqliteTable(\"verification\", {\n    id: sqliteText(\"id\").primaryKey(),\n    identifier: sqliteText(\"identifier\").notNull(),\n    value: sqliteText(\"value\").notNull(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  organization: sqliteTable(\"organization\", {\n    id: sqliteText(\"id\").primaryKey(),\n    name: sqliteText(\"name\").notNull(),\n    slug: sqliteText(\"slug\").notNull().unique(),\n    logo: sqliteText(\"logo\"),\n    metadata: sqliteText(\"metadata\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  member: sqliteTable(\"member\", {\n    id: sqliteText(\"id\").primaryKey(),\n    organizationId: sqliteText(\"organization_id\").notNull(),\n    userId: sqliteText(\"user_id\").notNull(),\n    role: sqliteText(\"role\").notNull().default(\"member\"),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  invitation: sqliteTable(\"invitation\", {\n    id: sqliteText(\"id\").primaryKey(),\n    organizationId: sqliteText(\"organization_id\").notNull(),\n    email: sqliteText(\"email\").notNull(),\n    role: sqliteText(\"role\"),\n    status: sqliteText(\"status\").notNull().default(\"pending\"),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }).notNull(),\n    inviterId: sqliteText(\"inviter_id\").notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    updatedAt: sqliteInteger(\"updated_at\", { mode: \"timestamp_ms\" }).notNull(),\n  }),\n  jwks: sqliteTable(\"jwks\", {\n    id: sqliteText(\"id\").primaryKey(),\n    publicKey: sqliteText(\"public_key\").notNull(),\n    privateKey: sqliteText(\"private_key\").notNull(),\n    createdAt: sqliteInteger(\"created_at\", { mode: \"timestamp_ms\" }).notNull(),\n    expiresAt: sqliteInteger(\"expires_at\", { mode: \"timestamp_ms\" }),\n  }),\n};\n\n/**\n * Mirror a Better Auth `account` row for Google into the `oauth_tokens`\n * table that template code (mail's Gmail client, calendar's events fetcher)\n * reads from. Called from the `databaseHooks.account.create.after` and\n * `.update.after` hooks so tokens captured during the primary \"Sign in\n * with Google\" flow flow straight to the apps that need them — no\n * separate \"Connect Google\" page required.\n *\n * Resolves `account.userId` to the user's email by querying the `user`\n * table (Better Auth always quotes \"user\" because it's a reserved word\n * in Postgres; SQLite accepts the quotes too).\n *\n * The hook is fire-and-forget from the caller's perspective — every\n * failure is caught upstream so a flake in `oauth_tokens` never blocks\n * sign-in. We still no-op on missing fields here as a defense in depth.\n */\nasync function mirrorGoogleAccountToOAuthTokens(account: {\n  providerId?: string;\n  userId?: string;\n  accountId?: string;\n  accessToken?: string | null;\n  refreshToken?: string | null;\n  accessTokenExpiresAt?: Date | string | number | null;\n  scope?: string | null;\n  idToken?: string | null;\n}): Promise<void> {\n  if (!account || account.providerId !== \"google\") return;\n  if (!account.userId) return;\n\n  const accessToken = account.accessToken ?? undefined;\n  if (!accessToken) {\n    // Better Auth sometimes upserts an account row before tokens are\n    // attached (e.g. linking flows). Nothing to mirror yet — the next\n    // update hook will run once the access token lands.\n    return;\n  }\n\n  // Resolve user email from userId.\n  const db = getDbExec();\n  let email: string | undefined;\n  try {\n    const { rows } = await db.execute({\n      sql: 'SELECT email FROM \"user\" WHERE id = ?',\n      args: [account.userId],\n    });\n    email = (rows[0]?.email as string | undefined) ?? undefined;\n  } catch (err) {\n    console.error(\n      \"[auth] mirror Google tokens: failed to resolve user email from userId\",\n      err,\n    );\n    return;\n  }\n  if (!email) return;\n\n  // Normalise expiry to epoch ms (Google's \"expiry_date\" convention used\n  // throughout the templates).\n  let expiryDate: number | undefined;\n  const raw = account.accessTokenExpiresAt;\n  if (raw instanceof Date) {\n    expiryDate = raw.getTime();\n  } else if (typeof raw === \"number\") {\n    expiryDate = raw;\n  } else if (typeof raw === \"string\") {\n    const ms = Date.parse(raw);\n    expiryDate = Number.isFinite(ms) ? ms : undefined;\n  }\n\n  const tokens: Record<string, unknown> = {\n    access_token: accessToken,\n    token_type: \"Bearer\",\n  };\n  if (account.refreshToken) tokens.refresh_token = account.refreshToken;\n  if (expiryDate) tokens.expiry_date = expiryDate;\n  if (account.scope) tokens.scope = account.scope;\n  if (account.idToken) tokens.id_token = account.idToken;\n\n  await saveOAuthTokens(\"google\", email, tokens, email);\n}\n\nasync function ensureBetterAuthTables(): Promise<void> {\n  const db = getDbExec();\n  const statements = isPostgres()\n    ? [\n        `CREATE TABLE IF NOT EXISTS \"user\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified BOOLEAN NOT NULL DEFAULT FALSE, image TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"session\" (id TEXT PRIMARY KEY, expires_at TIMESTAMPTZ NOT NULL, token TEXT NOT NULL UNIQUE, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n        `CREATE TABLE IF NOT EXISTS \"account\" (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at TIMESTAMPTZ, refresh_token_expires_at TIMESTAMPTZ, scope TEXT, password TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"verification\" (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"organization\" (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"member\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"invitation\" (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at TIMESTAMPTZ NOT NULL, inviter_id TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS \"jwks\" (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL, expires_at TIMESTAMPTZ)`,\n      ]\n    : [\n        `CREATE TABLE IF NOT EXISTS user (id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified INTEGER NOT NULL DEFAULT 0, image TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS session (id TEXT PRIMARY KEY, expires_at INTEGER NOT NULL, token TEXT NOT NULL UNIQUE, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, ip_address TEXT, user_agent TEXT, user_id TEXT NOT NULL, active_organization_id TEXT)`,\n        `CREATE TABLE IF NOT EXISTS account (id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at INTEGER, refresh_token_expires_at INTEGER, scope TEXT, password TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS verification (id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at INTEGER NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS organization (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, logo TEXT, metadata TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS member (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, user_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS invitation (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, email TEXT NOT NULL, role TEXT, status TEXT NOT NULL DEFAULT 'pending', expires_at INTEGER NOT NULL, inviter_id TEXT NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,\n        `CREATE TABLE IF NOT EXISTS jwks (id TEXT PRIMARY KEY, public_key TEXT NOT NULL, private_key TEXT NOT NULL, created_at INTEGER NOT NULL, expires_at INTEGER)`,\n      ];\n\n  for (const sql of statements) await db.execute(sql);\n}\n\n/**\n * Get or create the Better Auth instance.\n * Lazily initialized on first call — the database must be reachable by then.\n */\nexport async function getBetterAuth(\n  config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n  if (_auth) return _auth;\n  if (_initPromise) return _initPromise;\n\n  _initPromise = createBetterAuthInstance(config);\n  _auth = await _initPromise;\n  return _auth;\n}\n\n/**\n * Synchronous getter — returns the instance if already initialized, else undefined.\n * Use this in hot paths where you know init has already happened.\n */\nexport function getBetterAuthSync(): BetterAuthInstance | undefined {\n  return _auth;\n}\n\n/**\n * The subset of Better Auth's internal adapter we use for federated-SSO\n * JIT account linking. Better Auth owns these writes (id + timestamp +\n * schema handling), so callers never hand-roll SQL against `user`/`account`.\n * Read-only lookups + strictly-additive `linkAccount`/`createUser` only — no\n * update/delete of existing identity rows.\n */\nexport interface BetterAuthInternalAdapter {\n  findUserByEmail: (\n    email: string,\n    options?: { includeAccounts: boolean },\n  ) => Promise<{\n    user: { id: string; email: string; name?: string };\n    accounts: Array<{ providerId: string; accountId: string }>;\n  } | null>;\n  linkAccount: (account: {\n    userId: string;\n    providerId: string;\n    accountId: string;\n  }) => Promise<unknown>;\n  createUser: (user: {\n    email: string;\n    name: string;\n    emailVerified?: boolean;\n  }) => Promise<{ id: string }>;\n}\n\n/**\n * Resolve Better Auth's internal adapter via the live instance's\n * `$context`. The framework's narrowed `BetterAuthInstance` interface omits\n * `$context`, but the underlying object created by `betterAuth(...)` always\n * exposes it (see Better Auth's `Auth` type) — so this is a safe, typed\n * accessor for the federated-SSO client. Returns `undefined` if the context\n * shape is unexpected (older/newer Better Auth) so callers can fall back.\n */\nexport async function getBetterAuthInternalAdapter(\n  config?: BetterAuthConfig,\n): Promise<BetterAuthInternalAdapter | undefined> {\n  const auth = (await getBetterAuth(config)) as unknown as {\n    $context?: Promise<{ internalAdapter?: BetterAuthInternalAdapter }>;\n  };\n  try {\n    const ctx = await auth.$context;\n    const ia = ctx?.internalAdapter;\n    if (\n      ia &&\n      typeof ia.findUserByEmail === \"function\" &&\n      typeof ia.linkAccount === \"function\" &&\n      typeof ia.createUser === \"function\"\n    ) {\n      return ia;\n    }\n  } catch {\n    // Context resolution failed — caller falls back to the signup path.\n  }\n  return undefined;\n}\n\n/** Reset for testing */\nexport async function resetBetterAuth(): Promise<void> {\n  _auth = undefined;\n  _initPromise = undefined;\n  if (_neonAuthPool) {\n    try {\n      await _neonAuthPool.end();\n    } catch {\n      // Pool may have already closed (process exiting, etc.) — don't block reset.\n    }\n    _neonAuthPool = undefined;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Instance creation\n// ---------------------------------------------------------------------------\n\nasync function createBetterAuthInstance(\n  config?: BetterAuthConfig,\n): Promise<BetterAuthInstance> {\n  const dialect = getDialect();\n  const basePath = config?.basePath ?? \"/_agent-native/auth/ba\";\n  await ensureBetterAuthTables();\n\n  // Build social providers from env vars\n  const socialProviders: BetterAuthOptions[\"socialProviders\"] = {\n    ...config?.socialProviders,\n  };\n\n  if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {\n    // When the template requests broader scopes (Gmail, Calendar, etc.)\n    // ask for them on the primary sign-in flow so a separate \"Connect\n    // Google\" round-trip isn't needed. `accessType: \"offline\"` plus\n    // `prompt: \"consent\"` ensures we always receive a refresh token back —\n    // Google only re-issues a refresh token on consent, so re-signing in\n    // (e.g. after switching machines) would otherwise leave us with an\n    // access token that can't be refreshed.\n    const extraScopes = config?.googleScopes ?? [];\n    const baseScopes = [\"openid\", \"email\", \"profile\"];\n    const mergedScopes = Array.from(new Set([...baseScopes, ...extraScopes]));\n    socialProviders.google = {\n      clientId: process.env.GOOGLE_CLIENT_ID,\n      clientSecret: process.env.GOOGLE_CLIENT_SECRET,\n      ...(extraScopes.length > 0\n        ? {\n            scope: mergedScopes,\n            accessType: \"offline\" as const,\n            prompt: \"consent\" as const,\n          }\n        : {}),\n    };\n  }\n\n  if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {\n    socialProviders.github = {\n      clientId: process.env.GITHUB_CLIENT_ID,\n      clientSecret: process.env.GITHUB_CLIENT_SECRET,\n    };\n  }\n\n  // Build database config\n  const database = await buildDatabaseConfig(dialect);\n\n  const secret = resolveAuthSecret();\n\n  const appUrl = getAppProductionUrl();\n  const cookieNamespace = resolveAuthCookieNamespace();\n  const requireEmailVerification =\n    isEmailConfigured() && !shouldSkipEmailVerification();\n\n  const auth = betterAuth({\n    basePath,\n    baseURL: appUrl,\n    database,\n    secret,\n    emailAndPassword: {\n      enabled: true,\n      minPasswordLength: 8,\n      // Only require email verification when an email provider is configured.\n      // Without a provider, verification emails can't be sent, so requiring\n      // verification would lock users out of signup entirely. Local dev/test\n      // skip verification by default so +qa accounts can be created quickly;\n      // hosted QA deployments can opt out with AUTH_SKIP_EMAIL_VERIFICATION=1.\n      requireEmailVerification,\n      sendResetPassword: async ({ user, token }) => {\n        // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n        // reset link must include that prefix so the page resolves correctly.\n        const appBasePath = (\n          process.env.VITE_APP_BASE_PATH ||\n          process.env.APP_BASE_PATH ||\n          \"\"\n        ).replace(/\\/$/, \"\");\n        const resetUrl = `${appUrl}${appBasePath}/_agent-native/auth/reset?token=${encodeURIComponent(token)}`;\n        const { subject, html, text } = renderResetPasswordEmail({\n          email: user.email,\n          resetUrl,\n        });\n        await sendEmail({ to: user.email, subject, html, text });\n      },\n    },\n    emailVerification: {\n      // Fire verification email right after signup, before the user has a\n      // session — pairs with requireEmailVerification above. Only enabled\n      // when an email provider is configured.\n      sendOnSignUp: requireEmailVerification,\n      // Auto-create a session once the user clicks the link. Without this,\n      // verified users would have to go back and sign in manually, which is\n      // a confusing dead-end on the verify screen.\n      autoSignInAfterVerification: true,\n      sendVerificationEmail: async ({ user, url }) => {\n        // APP_BASE_PATH lets this app mount under a prefix (e.g. /mail). The\n        // verification link must include that prefix so the page resolves correctly.\n        const verifyBasePath = (\n          process.env.VITE_APP_BASE_PATH ||\n          process.env.APP_BASE_PATH ||\n          \"\"\n        ).replace(/\\/$/, \"\");\n        const verifyUrl = verifyBasePath\n          ? url.replace(/(\\/\\/[^/]+)(\\/)/, `$1${verifyBasePath}$2`)\n          : url;\n        const { subject, html, text } = renderVerifySignupEmail({\n          email: user.email,\n          verifyUrl,\n        });\n        await sendEmail({ to: user.email, subject, html, text });\n      },\n    },\n    socialProviders,\n    account: {\n      // Merge accounts when a user signs in with a social provider using an\n      // email that already has a local email/password account (or vice versa).\n      // Only providers listed in `trustedProviders` auto-link — these are the\n      // ones that verify emails at the identity layer. Never add a provider\n      // here that lets users claim an unverified email; that would be an\n      // account-takeover vector.\n      accountLinking: {\n        enabled: true,\n        trustedProviders: [\"google\", \"github\"],\n      },\n    },\n    databaseHooks: {\n      user: {\n        create: {\n          after: async (user: {\n            id?: string;\n            email?: string;\n            name?: string | null;\n          }) => {\n            // When a newly-created user's email has pending org invitations\n            // (common when someone is invited *before* they've signed up),\n            // auto-accept them so the user lands in the org on their very\n            // first page load instead of a blank-slate workspace.\n            const email = user?.email;\n            if (!email) return;\n            identify(email, {\n              email,\n              name: user.name ?? undefined,\n              authUserId: user.id,\n            });\n            track(\n              \"signup\",\n              {\n                ...resolveSignupTrackingProperties(),\n                auth_provider: \"better-auth\",\n                auth_user_id: user.id,\n              },\n              { userId: email },\n            );\n            try {\n              await acceptPendingInvitationsForEmail(email);\n            } catch (err) {\n              // Never block signup on invite bookkeeping — log and continue.\n              console.error(\n                \"[auth] failed to auto-accept pending invitations\",\n                err,\n              );\n            }\n            try {\n              // Auto-join orgs whose `allowed_domain` matches this email\n              // domain. Lets a fresh `@builder.io` (or any org-domain)\n              // signup land inside the company org on first page load\n              // without going through the picker. No-ops when no match.\n              await autoJoinDomainMatchingOrgs(email);\n            } catch (err) {\n              console.error(\n                \"[auth] failed to auto-join domain-matching orgs\",\n                err,\n              );\n            }\n          },\n        },\n      },\n      account: {\n        // Mirror Google account tokens into `oauth_tokens` so existing\n        // template code (mail's Gmail client, calendar's events fetcher)\n        // can pick up Gmail/Calendar credentials from the primary sign-in\n        // flow — no separate \"Set up Google\" page required.\n        //\n        // Better Auth fires `create` for first-time social sign-in and\n        // `update` whenever a session re-issues tokens (e.g., the user\n        // re-signs in to refresh the token). Both branches do the same\n        // mirroring work; failures never block sign-in.\n        create: {\n          after: async (account: any) => {\n            await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n              console.error(\n                \"[auth] failed to mirror Google account tokens to oauth_tokens (create)\",\n                err,\n              );\n            });\n          },\n        },\n        update: {\n          after: async (account: any) => {\n            await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {\n              console.error(\n                \"[auth] failed to mirror Google account tokens to oauth_tokens (update)\",\n                err,\n              );\n            });\n          },\n        },\n      },\n    },\n    session: {\n      expiresIn: 60 * 60 * 24 * 30, // 30 days\n      updateAge: 60 * 60 * 24, // refresh daily\n      cookieCache: {\n        enabled: true,\n        maxAge: 5 * 60, // 5 min cache\n      },\n    },\n    advanced: {\n      cookiePrefix: cookieNamespace.betterAuthCookiePrefix,\n      // Emit `SameSite=None; Secure` when the app is served over HTTPS so\n      // session cookies are delivered inside third-party iframes (e.g. the\n      // Builder.io editor). Plain-HTTP dev keeps the default (Lax) because\n      // `SameSite=None` requires Secure.\n      ...(appUrl.startsWith(\"https://\")\n        ? {\n            defaultCookieAttributes: {\n              sameSite: \"none\" as const,\n              secure: true,\n              partitioned: true,\n            },\n          }\n        : {}),\n      // When an effective shared cookie domain is set, share Better Auth's\n      // session cookie across that domain. First-party `*.agent-native.com`\n      // apps intentionally do not use this path because their auth DBs are\n      // separate; Dispatch identity federation handles cross-app sign-in.\n      ...(cookieNamespace.betterAuthCookieDomain\n        ? {\n            crossSubDomainCookies: {\n              enabled: true,\n              domain: cookieNamespace.betterAuthCookieDomain,\n            },\n          }\n        : {}),\n    },\n    plugins: [\n      // JWT: issue tokens for A2A calls, JWKS endpoint for verification\n      jwt({\n        jwt: {\n          issuer: appUrl,\n          expirationTime: \"15m\",\n        },\n      }),\n      // Bearer: accept Bearer tokens on API requests\n      bearer(),\n      ...(config?.plugins ?? []),\n    ],\n  });\n\n  return auth as unknown as BetterAuthInstance;\n}\n\nasync function buildDatabaseConfig(\n  dialect: string,\n): Promise<BetterAuthOptions[\"database\"]> {\n  if (dialect === \"postgres\") {\n    const url = getDatabaseUrl();\n    const { isNeonUrl } = await import(\"../db/create-get-db.js\");\n\n    // Neon via @neondatabase/serverless (WebSockets over HTTPS). postgres-js\n    // opens a raw TCP connection on port 5432 which frequently times out on\n    // Netlify Functions / Vercel / CF Workers when Neon's pooler is cold.\n    if (isNeonUrl(url)) {\n      const { Pool } = await import(\"@neondatabase/serverless\");\n      // Cap the auth pool the same way as the app pool. Better Auth runs a\n      // session lookup on essentially every authenticated request, so an\n      // un-capped pool here is a primary contributor to \"Max client\n      // connections reached\" across concurrent serverless instances.\n      _neonAuthPool = new Pool({\n        connectionString: url,\n        max: neonPoolMax(),\n      });\n      attachNeonPoolErrorLogger(_neonAuthPool, \"db/neon-auth\");\n      const { drizzle } = await import(\"drizzle-orm/neon-serverless\");\n      const db = drizzle(_neonAuthPool, { schema: pgAuthSchema });\n      const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n      return drizzleAdapter(db, {\n        provider: \"pg\",\n        schema: pgAuthSchema,\n      });\n    }\n\n    // Non-Neon Postgres (Supabase, self-hosted, etc.) → postgres-js.\n    // pgPoolOptions caps this pool to a small size on serverless. Better Auth\n    // runs a session lookup on essentially every authenticated request, so an\n    // un-capped pool here is a primary contributor to \"Max client connections\n    // reached\" across concurrent serverless instances.\n    const { default: postgres } = await import(\"postgres\");\n    const sql = postgres(url, pgPoolOptions(url));\n    const { drizzle } = await import(\"drizzle-orm/postgres-js\");\n    const db = drizzle(sql, { schema: pgAuthSchema });\n    const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n    return drizzleAdapter(db, {\n      provider: \"pg\",\n      schema: pgAuthSchema,\n    });\n  }\n\n  // SQLite / libsql\n  const url = getDatabaseUrl(\"file:./data/app.db\");\n\n  if (url.startsWith(\"file:\") || !url.includes(\"://\")) {\n    // Local SQLite via better-sqlite3\n    const { default: Database } = await import(\"better-sqlite3\");\n    const filePath = url.replace(/^file:/, \"\");\n    const sqlite = new Database(filePath);\n    sqlite.pragma(\"journal_mode = WAL\");\n    const { drizzle } = await import(\"drizzle-orm/better-sqlite3\");\n    const db = drizzle(sqlite, { schema: sqliteAuthSchema });\n    const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n    return drizzleAdapter(db, {\n      provider: \"sqlite\",\n      schema: sqliteAuthSchema,\n    });\n  }\n\n  // Remote libsql (Turso). Use the web client to avoid serverless bundles\n  // depending on libsql's platform-specific native packages.\n  const { createClient } = await import(\"@libsql/client/web\");\n  const client = createClient({ url, authToken: getDatabaseAuthToken() });\n  const { drizzle } = await import(\"drizzle-orm/libsql/web\");\n  const db = drizzle(client, { schema: sqliteAuthSchema });\n  const { drizzleAdapter } = await import(\"better-auth/adapters/drizzle\");\n  return drizzleAdapter(db, {\n    provider: \"sqlite\",\n    schema: sqliteAuthSchema,\n  });\n}\n"]}

package/dist/server/deep-link.d.ts

@@ -2,6 +2,8 @@
 export declare const OPEN_ROUTE_SUBPATH = "/open";
 /** Custom URL scheme the desktop app registers (`agentnative://open?...`). */
 export declare const DESKTOP_OPEN_URL = "agentnative://open";
+/** VS Code extension URI used by builderio.agent-native to open a webview. */
+export declare const VSCODE_OPEN_URL = "vscode://builderio.agent-native/open";
 export interface DeepLinkInput {
     /** App id (informational + multi-app/desktop routing), e.g. "mail". */
     app?: string;
@@ -32,4 +34,9 @@ export declare function toAbsoluteOpenUrl(urlOrPath: string, origin: string | un
  * web URL; preserves the query string.
  */
 export declare function toDesktopOpenUrl(urlOrPath: string): string;
+/**
+ * Wrap an Agent Native web URL in the VS Code extension URI so external agents
+ * can hand users a link that opens the app inside a VS Code webview.
+ */
+export declare function toVsCodeOpenUrl(urlOrPath: string): string;
 //# sourceMappingURL=deep-link.d.ts.map

package/dist/server/deep-link.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-link.d.ts","sourceRoot":"","sources":["../../src/server/deep-link.ts"],"names":[],"mappings":"AAwBA,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,UAAU,CAAC;AAE1C,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAErD,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb;yEACqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACtE;uDACmD;IACnD,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAcD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAI1D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,MAAM,CAMR;AAgBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAI1D"}
+{"version":3,"file":"deep-link.d.ts","sourceRoot":"","sources":["../../src/server/deep-link.ts"],"names":[],"mappings":"AAwBA,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,UAAU,CAAC;AAE1C,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAErD,8EAA8E;AAC9E,eAAO,MAAM,eAAe,yCAAyC,CAAC;AAEtE,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb;yEACqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACtE;uDACmD;IACnD,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAcD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAI1D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,MAAM,CAMR;AAgBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAI1D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAIzD"}

package/dist/server/deep-link.js

@@ -5,8 +5,8 @@
  * Every artifact-producing / list action that wants an external agent (MCP /
  * A2A) to surface an "Open in <app> →" link returns
  * `{ url: buildDeepLink(...), label }` from its `link` builder. The MCP layer
- * turns the relative path into an absolute web URL (and an `agentnative://`
- * desktop URL) using the request origin.
+ * turns the relative path into an absolute web URL, an `agentnative://`
+ * desktop URL, and a VS Code extension URL using the request origin.
  *
  * The `/_agent-native/open` route (see `open-route.ts`) consumes these: it
  * resolves the *browser session's* identity, writes the existing one-shot
@@ -22,6 +22,8 @@ import { getConfiguredAppBasePath, normalizeAppBasePath, } from "./app-base-path
 export const OPEN_ROUTE_SUBPATH = "/open";
 /** Custom URL scheme the desktop app registers (`agentnative://open?...`). */
 export const DESKTOP_OPEN_URL = "agentnative://open";
+/** VS Code extension URI used by builderio.agent-native to open a webview. */
+export const VSCODE_OPEN_URL = "vscode://builderio.agent-native/open";
 function buildQuery(input) {
     const sp = new URLSearchParams();
     if (input.app)
@@ -80,4 +82,13 @@ export function toDesktopOpenUrl(urlOrPath) {
     const query = qIdx >= 0 ? urlOrPath.slice(qIdx + 1) : "";
     return query ? `${DESKTOP_OPEN_URL}?${query}` : DESKTOP_OPEN_URL;
 }
+/**
+ * Wrap an Agent Native web URL in the VS Code extension URI so external agents
+ * can hand users a link that opens the app inside a VS Code webview.
+ */
+export function toVsCodeOpenUrl(urlOrPath) {
+    const sp = new URLSearchParams();
+    sp.set("url", urlOrPath);
+    return `${VSCODE_OPEN_URL}?${sp.toString()}`;
+}
 //# sourceMappingURL=deep-link.js.map

package/dist/server/deep-link.js.map

@@ -1 +1 @@
-{"version":3,"file":"deep-link.js","sourceRoot":"","sources":["../../src/server/deep-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAerD,SAAS,UAAU,CAAC,KAAoB;IACtC,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,GAAG;QAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,EAAE;QAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE;YAAE,SAAS;QACxD,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAoB;IAChD,OAAO,8BAA8B,CACnC,iBAAiB,kBAAkB,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAC3D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,MAA0B;IAE1B,IAAI,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACjE,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;IAC5E,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC1D,IACE,kBAAkB,KAAK,QAAQ;QAC/B,kBAAkB,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAC7C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,QAAQ,GAAG,WAAW,EAAE,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,gBAAgB,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACnE,CAAC","sourcesContent":["/**\n * Deep-link helpers — the single source of truth for the\n * `/_agent-native/open` URL format.\n *\n * Every artifact-producing / list action that wants an external agent (MCP /\n * A2A) to surface an \"Open in <app> →\" link returns\n * `{ url: buildDeepLink(...), label }` from its `link` builder. The MCP layer\n * turns the relative path into an absolute web URL (and an `agentnative://`\n * desktop URL) using the request origin.\n *\n * The `/_agent-native/open` route (see `open-route.ts`) consumes these: it\n * resolves the *browser session's* identity, writes the existing one-shot\n * `navigate` application-state command, and 302-redirects to the rendered SPA\n * view so any browser / inline webview lands on the right screen with the\n * record focused. We never invent a new navigation mechanism — this just\n * bridges external surfaces to the `navigate`/`application_state` contract the\n * UI already drains every 2s.\n */\nimport { withCollapsedAgentSidebarParam } from \"../shared/agent-sidebar-url.js\";\nimport {\n  getConfiguredAppBasePath,\n  normalizeAppBasePath,\n} from \"./app-base-path.js\";\n\n/** Path of the framework deep-link route, relative to the route prefix. */\nexport const OPEN_ROUTE_SUBPATH = \"/open\";\n\n/** Custom URL scheme the desktop app registers (`agentnative://open?...`). */\nexport const DESKTOP_OPEN_URL = \"agentnative://open\";\n\nexport interface DeepLinkInput {\n  /** App id (informational + multi-app/desktop routing), e.g. \"mail\". */\n  app?: string;\n  /** Target view — maps to the `navigate` command `view`. */\n  view: string;\n  /** Record-focus + filter params, e.g. `{ threadId }`, `{ eventId, date }`,\n   *  `{ dashboardId }`. `undefined`/`null`/`\"\"` values are dropped. */\n  params?: Record<string, string | number | boolean | null | undefined>;\n  /** Explicit client-side path override (must be a same-origin, leading-slash\n   *  relative path — enforced by the open route). */\n  to?: string;\n}\n\nfunction buildQuery(input: DeepLinkInput): string {\n  const sp = new URLSearchParams();\n  if (input.app) sp.set(\"app\", input.app);\n  sp.set(\"view\", input.view);\n  if (input.to) sp.set(\"to\", input.to);\n  for (const [k, v] of Object.entries(input.params ?? {})) {\n    if (v === undefined || v === null || v === \"\") continue;\n    sp.set(k, String(v));\n  }\n  return sp.toString();\n}\n\n/**\n * Build the app-relative deep-link path:\n * `/_agent-native/open?app=mail&view=inbox&threadId=abc`.\n * Per-app `link` builders call this; never hand-format the URL.\n */\nexport function buildDeepLink(input: DeepLinkInput): string {\n  return withCollapsedAgentSidebarParam(\n    `/_agent-native${OPEN_ROUTE_SUBPATH}?${buildQuery(input)}`,\n  );\n}\n\n/**\n * Resolve a (possibly relative) deep link to an absolute web URL using the\n * inbound request origin. Absolute URLs pass through unchanged.\n */\nexport function toAbsoluteOpenUrl(\n  urlOrPath: string,\n  origin: string | undefined,\n): string {\n  if (/^[a-z][a-z0-9+.-]*:\\/\\//i.test(urlOrPath)) return urlOrPath;\n  const basePath = getConfiguredAppBasePath();\n  const path = withBasePath(urlOrPath, basePath);\n  if (!origin) return path;\n  return `${origin.replace(/\\/+$/, \"\")}${path.startsWith(\"/\") ? \"\" : \"/\"}${path}`;\n}\n\nfunction withBasePath(urlOrPath: string, basePath: string): string {\n  if (!basePath) return urlOrPath;\n  const leadingPath = urlOrPath.startsWith(\"/\") ? urlOrPath : `/${urlOrPath}`;\n  const [pathname] = leadingPath.split(/[?#]/, 1);\n  const normalizedPathname = normalizeAppBasePath(pathname);\n  if (\n    normalizedPathname === basePath ||\n    normalizedPathname.startsWith(`${basePath}/`)\n  ) {\n    return urlOrPath;\n  }\n  return `${basePath}${leadingPath}`;\n}\n\n/**\n * Rewrite a deep link to the desktop `agentnative://open?...` scheme so the\n * desktop app's existing `handleDeepLink` opens it inside the app webview.\n * Accepts either an app-relative `/_agent-native/open?...` path or an absolute\n * web URL; preserves the query string.\n */\nexport function toDesktopOpenUrl(urlOrPath: string): string {\n  const qIdx = urlOrPath.indexOf(\"?\");\n  const query = qIdx >= 0 ? urlOrPath.slice(qIdx + 1) : \"\";\n  return query ? `${DESKTOP_OPEN_URL}?${query}` : DESKTOP_OPEN_URL;\n}\n"]}
+{"version":3,"file":"deep-link.js","sourceRoot":"","sources":["../../src/server/deep-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAetE,SAAS,UAAU,CAAC,KAAoB;IACtC,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,GAAG;QAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,EAAE;QAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE;YAAE,SAAS;QACxD,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAoB;IAChD,OAAO,8BAA8B,CACnC,iBAAiB,kBAAkB,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAC3D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,MAA0B;IAE1B,IAAI,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACjE,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;IAC5E,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC1D,IACE,kBAAkB,KAAK,QAAQ;QAC/B,kBAAkB,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAC7C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,QAAQ,GAAG,WAAW,EAAE,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,gBAAgB,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACzB,OAAO,GAAG,eAAe,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC/C,CAAC","sourcesContent":["/**\n * Deep-link helpers — the single source of truth for the\n * `/_agent-native/open` URL format.\n *\n * Every artifact-producing / list action that wants an external agent (MCP /\n * A2A) to surface an \"Open in <app> →\" link returns\n * `{ url: buildDeepLink(...), label }` from its `link` builder. The MCP layer\n * turns the relative path into an absolute web URL, an `agentnative://`\n * desktop URL, and a VS Code extension URL using the request origin.\n *\n * The `/_agent-native/open` route (see `open-route.ts`) consumes these: it\n * resolves the *browser session's* identity, writes the existing one-shot\n * `navigate` application-state command, and 302-redirects to the rendered SPA\n * view so any browser / inline webview lands on the right screen with the\n * record focused. We never invent a new navigation mechanism — this just\n * bridges external surfaces to the `navigate`/`application_state` contract the\n * UI already drains every 2s.\n */\nimport { withCollapsedAgentSidebarParam } from \"../shared/agent-sidebar-url.js\";\nimport {\n  getConfiguredAppBasePath,\n  normalizeAppBasePath,\n} from \"./app-base-path.js\";\n\n/** Path of the framework deep-link route, relative to the route prefix. */\nexport const OPEN_ROUTE_SUBPATH = \"/open\";\n\n/** Custom URL scheme the desktop app registers (`agentnative://open?...`). */\nexport const DESKTOP_OPEN_URL = \"agentnative://open\";\n\n/** VS Code extension URI used by builderio.agent-native to open a webview. */\nexport const VSCODE_OPEN_URL = \"vscode://builderio.agent-native/open\";\n\nexport interface DeepLinkInput {\n  /** App id (informational + multi-app/desktop routing), e.g. \"mail\". */\n  app?: string;\n  /** Target view — maps to the `navigate` command `view`. */\n  view: string;\n  /** Record-focus + filter params, e.g. `{ threadId }`, `{ eventId, date }`,\n   *  `{ dashboardId }`. `undefined`/`null`/`\"\"` values are dropped. */\n  params?: Record<string, string | number | boolean | null | undefined>;\n  /** Explicit client-side path override (must be a same-origin, leading-slash\n   *  relative path — enforced by the open route). */\n  to?: string;\n}\n\nfunction buildQuery(input: DeepLinkInput): string {\n  const sp = new URLSearchParams();\n  if (input.app) sp.set(\"app\", input.app);\n  sp.set(\"view\", input.view);\n  if (input.to) sp.set(\"to\", input.to);\n  for (const [k, v] of Object.entries(input.params ?? {})) {\n    if (v === undefined || v === null || v === \"\") continue;\n    sp.set(k, String(v));\n  }\n  return sp.toString();\n}\n\n/**\n * Build the app-relative deep-link path:\n * `/_agent-native/open?app=mail&view=inbox&threadId=abc`.\n * Per-app `link` builders call this; never hand-format the URL.\n */\nexport function buildDeepLink(input: DeepLinkInput): string {\n  return withCollapsedAgentSidebarParam(\n    `/_agent-native${OPEN_ROUTE_SUBPATH}?${buildQuery(input)}`,\n  );\n}\n\n/**\n * Resolve a (possibly relative) deep link to an absolute web URL using the\n * inbound request origin. Absolute URLs pass through unchanged.\n */\nexport function toAbsoluteOpenUrl(\n  urlOrPath: string,\n  origin: string | undefined,\n): string {\n  if (/^[a-z][a-z0-9+.-]*:\\/\\//i.test(urlOrPath)) return urlOrPath;\n  const basePath = getConfiguredAppBasePath();\n  const path = withBasePath(urlOrPath, basePath);\n  if (!origin) return path;\n  return `${origin.replace(/\\/+$/, \"\")}${path.startsWith(\"/\") ? \"\" : \"/\"}${path}`;\n}\n\nfunction withBasePath(urlOrPath: string, basePath: string): string {\n  if (!basePath) return urlOrPath;\n  const leadingPath = urlOrPath.startsWith(\"/\") ? urlOrPath : `/${urlOrPath}`;\n  const [pathname] = leadingPath.split(/[?#]/, 1);\n  const normalizedPathname = normalizeAppBasePath(pathname);\n  if (\n    normalizedPathname === basePath ||\n    normalizedPathname.startsWith(`${basePath}/`)\n  ) {\n    return urlOrPath;\n  }\n  return `${basePath}${leadingPath}`;\n}\n\n/**\n * Rewrite a deep link to the desktop `agentnative://open?...` scheme so the\n * desktop app's existing `handleDeepLink` opens it inside the app webview.\n * Accepts either an app-relative `/_agent-native/open?...` path or an absolute\n * web URL; preserves the query string.\n */\nexport function toDesktopOpenUrl(urlOrPath: string): string {\n  const qIdx = urlOrPath.indexOf(\"?\");\n  const query = qIdx >= 0 ? urlOrPath.slice(qIdx + 1) : \"\";\n  return query ? `${DESKTOP_OPEN_URL}?${query}` : DESKTOP_OPEN_URL;\n}\n\n/**\n * Wrap an Agent Native web URL in the VS Code extension URI so external agents\n * can hand users a link that opens the app inside a VS Code webview.\n */\nexport function toVsCodeOpenUrl(urlOrPath: string): string {\n  const sp = new URLSearchParams();\n  sp.set(\"url\", urlOrPath);\n  return `${VSCODE_OPEN_URL}?${sp.toString()}`;\n}\n"]}

package/dist/server/index.d.ts

@@ -1,6 +1,6 @@
 export { createServer, upsertEnvFile, type CreateServerOptions, type EnvKeyConfig, } from "./create-server.js";
 export { readBody, readBodyWithSizeLimit, streamFile, DEFAULT_CHAT_MAX_BODY_BYTES, DEFAULT_UPLOAD_MAX_FILE_BYTES, MAX_CHAT_ATTACHMENTS_PER_MESSAGE, isAllowedUploadMimeType, } from "./h3-helpers.js";
-export { buildDeepLink, toAbsoluteOpenUrl, toDesktopOpenUrl, OPEN_ROUTE_SUBPATH, DESKTOP_OPEN_URL, type DeepLinkInput, } from "./deep-link.js";
+export { buildDeepLink, toAbsoluteOpenUrl, toDesktopOpenUrl, toVsCodeOpenUrl, OPEN_ROUTE_SUBPATH, DESKTOP_OPEN_URL, VSCODE_OPEN_URL, type DeepLinkInput, } from "./deep-link.js";
 export { createOpenRouteHandler, type OpenRouteOptions } from "./open-route.js";
 export { createEmbedStartRouteHandler, buildEmbedStartPath, type EmbedStartRouteOptions, } from "./embed-route.js";
 export { createEmbedSessionTicket, consumeEmbedSessionTicket, normalizeEmbedTargetPath, requestHasEmbedAuthMarker, resolveEmbedSessionFromRequest, setEmbedSessionCookie, signEmbedSessionToken, verifyEmbedSessionToken, type ConsumedEmbedSessionTicket, type ConsumeEmbedSessionTicketOptions, type EmbedSessionTicket, type EmbedSessionTicketInput, type EmbedSessionTokenClaims, type ResolvedEmbedSession, type VerifyEmbedSessionTokenResult, } from "./embed-session.js";