@ai-development-environment/server 0.0.102 → 0.0.104

package/standalone/.next/server/chunks/_05hmt-3._.js

@@ -462,10 +462,10 @@ To resolve this, you can:
 	1. Use only one of the conflicting plugins
 	2. Configure the plugins to use different paths (if supported)
 	3. Ensure plugins use different HTTP methods for the same path
-`)}}(t={...t,secret:i,baseURL:u?t.baseURL:p?new URL(p).origin:"",basePath:t.basePath||"/api/auth",plugins:l.concat(c)},d);let A=t.advanced?.ipAddress?.trustedProxies;if(A&&A.length>0){let e=A.filter(e=>null===I(e));e.length>0&&d.warn(`Ignoring invalid \`advanced.ipAddress.trustedProxies\` entries: ${e.join(", ")}. Each entry must be an IP address or CIDR range.`)}let E=(0,ti.getCookies)(t),b=(0,eO.getAuthTables)(t),_=(await Promise.all(Object.entries(t.socialProviders||{}).map(async([e,t])=>{let r="function"==typeof t?await t():t;if(null==r||!1===r.enabled)return null;r.clientId||d.warn(`Social provider ${e} is missing clientId or clientSecret`);let i=o_[e](r);return i.disableImplicitSignUp=r.disableImplicitSignUp,i}))).filter(e=>null!==e),R=({model:e,size:r})=>{if("function"==typeof t.advanced?.generateId)return t.advanced.generateId({model:e,size:r});let i=t?.advanced?.database?.generateId;return"function"==typeof i?i({model:e,size:r}):"uuid"===i?crypto.randomUUID():"serial"!==i&&!1!==i&&(0,D.generateId)(r)},{publish:T}=await nP(t,{adapter:e.id,database:"function"==typeof t.database?"adapter":r(t.database)}),S=new Set(t.plugins.map(e=>e.id)),v=await tD(t),U=await tC(t),O={appName:t.appName||"Better Auth",baseURL:p||"",version:(0,nd.getBetterAuthVersion)(),socialProviders:_,options:t,oauthConfig:{storeStateStrategy:t.account?.storeStateStrategy||(s?"database":"cookie"),skipStateCookieCheck:!!t.account?.skipStateCookieCheck},tables:b,trustedOrigins:v,trustedProviders:U,isTrustedOrigin(e,t){return this.trustedOrigins.some(r=>e3(e,r,t))},sessionConfig:{updateAge:t.session?.updateAge!==void 0?t.session.updateAge:86400,expiresIn:t.session?.expiresIn||604800,freshAge:t.session?.freshAge===void 0?86400:t.session.freshAge,cookieRefreshCache:(n=t.session?.cookieCache?.refreshCache,a=t.session?.cookieCache?.maxAge||300,s&&n?(d.warn("[better-auth] `session.cookieCache.refreshCache` is enabled while `database` or `secondaryStorage` is configured. `refreshCache` is meant for stateless (DB-less) setups. Disabling `refreshCache` — remove it from your config to silence this warning."),!1):!1!==n&&void 0!==n&&(!0===n?{enabled:!0,updateAge:Math.floor(.2*a)}:{enabled:!0,updateAge:void 0!==n.updateAge?n.updateAge:Math.floor(.2*a)}))},secret:i,secretConfig:o,rateLimit:{...t.rateLimit,enabled:t.rateLimit?.enabled??f.isProduction,window:t.rateLimit?.window||10,max:t.rateLimit?.max||100,storage:t.rateLimit?.storage||(t.secondaryStorage?"secondary-storage":"memory")},authCookies:E,logger:d,generateId:R,session:null,secondaryStorage:t.secondaryStorage,password:{hash:t.emailAndPassword?.password?.hash||te,verify:t.emailAndPassword?.password?.verify||tr,config:{minPasswordLength:t.emailAndPassword?.minPasswordLength||8,maxPasswordLength:t.emailAndPassword?.maxPasswordLength||128},checkPassword:tj},setNewSession(e){this.newSession=e},newSession:null,adapter:e,internalAdapter:tb(e,{options:t,logger:d,hooks:t.databaseHooks?[{source:"user",hooks:t.databaseHooks}]:[],generateId:R}),createAuthCookie:(0,ti.createCookieGetter)(t),async runMigrations(){throw new k.BetterAuthError("runMigrations will be set by the specific init implementation")},publishTelemetry:T,skipCSRFCheck:!!t.advanced?.disableCSRFCheck,skipOriginCheck:t.advanced?.disableOriginCheck!==void 0?t.advanced.disableOriginCheck:!!(0,f.isTest)(),runInBackground:t.advanced?.backgroundTasks?.handler??(e=>{e.catch(()=>{})}),async runInBackgroundOrAwait(e){try{t.advanced?.backgroundTasks?.handler?e instanceof Promise&&t.advanced.backgroundTasks.handler(e.catch(e=>{d.error("Failed to run background task:",e)})):await e}catch(e){d.error("Failed to run background task:",e)}},getPlugin:e=>t.plugins.find(t=>t.id===e)??null,hasPlugin:e=>S.has(e)},x=tx(O);return(0,e4.isPromise)(x)&&await x,O}let nL=async e=>{let t=await eP(e),r=await nN(t,e,e=>(0,eL.getKyselyDatabaseType)(e)||"unknown");return r.runMigrations=async function(){if(!e.database||"updateMany"in e.database)throw new k.BetterAuthError("Database is not provided or it's an adapter. Migrations are only supported with a database instance.");let{runMigrations:t}=await eZ(e);await t()},r};e.s(["betterAuth",0,e=>((e,t)=>{let r=t(e),{api:i}=nc(r,e),o=e.plugins?.reduce((e,t)=>t.$ERROR_CODES?{...e,...t.$ERROR_CODES}:e,{}),n=async t=>{let i,o=await r,n=o.options.basePath||"/api/auth";if((0,eX.isDynamicBaseURLConfig)(e.baseURL))i=await tN(o,t,tP(o.options));else{i=Object.create(Object.getPrototypeOf(o),Object.getOwnPropertyDescriptors(o));let e=o.options;if(!o.options.baseURL){let r=(0,eX.getBaseURL)(void 0,n,t,void 0,o.options.advanced?.trustedProxyHeaders);if(!r)throw new k.BetterAuthError("Could not get base URL from request. Please provide a valid base URL.");i.baseURL=r,i.options={...o.options,baseURL:(0,eX.getOrigin)(r)||void 0},e=i.options}i.trustedOrigins=await tD(e,t),i.trustedProviders=await tC(e,t)}let{handler:a}=((e,t)=>{let{api:r,middlewares:i}=nc(e,t),o=new URL(e.baseURL).pathname;return(0,nl.createRouter)(r,{routerContext:e,openapi:{disabled:!0},basePath:o,routerMiddleware:[{path:"/**",middleware:tW},...i],allowedMediaTypes:["application/json"],skipTrailingSlashes:t.advanced?.skipTrailingSlashes??!1,async onRequest(t){let r=e.options.disabledPaths||[],i=tV(t.url,o);if(r.includes(i))return new Response("Not Found",{status:404});let n=t,a=await t2(n,e);if(a)return a;for(let t of e.options.plugins||[])if(t.onRequest){let r=await (0,tg.withSpan)(`onRequest ${t.id}`,{[th]:"onRequest",[tm]:`plugin:${t.id}`},()=>t.onRequest(n,e));if(r&&"response"in r)return r.response;r&&"request"in r&&(n=r.request)}return n},async onResponse(t,r){for(let r of e.options.plugins||[])if(r.onResponse){let i=await (0,tg.withSpan)(`onResponse ${r.id}`,{[th]:"onResponse",[tm]:`plugin:${r.id}`,[tp.ATTR_HTTP_RESPONSE_STATUS_CODE]:t.status},()=>r.onResponse(t,e));if(i)return i.response}return t},onError(r){if((0,t$.isAPIError)(r)&&"FOUND"===r.status)return;if(t.onAPIError?.throw)throw r;if(t.onAPIError?.onError)return void t.onAPIError.onError(r,e);let i=t.logger?.level,o="error"===i||"warn"===i||"debug"===i?ex.logger:void 0;if(t.logger?.disabled!==!0){if(r&&"object"==typeof r&&"message"in r&&"string"==typeof r.message&&(r.message.includes("no column")||r.message.includes("column")||r.message.includes("relation")||r.message.includes("table")||r.message.includes("does not exist")))return void e.logger?.error(r.message);(0,t$.isAPIError)(r)?("INTERNAL_SERVER_ERROR"===r.status&&e.logger.error(r.status,r),o?.error(r.message)):e.logger?.error(r&&"object"==typeof r&&"name"in r?r.name:"",r)}}})})(i,e);return(0,td.runWithAdapter)(i.adapter,()=>a(t))};return{handler:n,fetch:n,api:i,options:e,$context:r,$ERROR_CODES:{...o,...tq.BASE_ERROR_CODES}}})(e,nL)],204721)},749599,e=>{"use strict";let t;var r=e.i(46754),i=e.i(682868),o=e.i(272003),n=e.i(890659);let a=()=>t??=e.A(6878).catch(e=>{throw t=void 0,e});e.s(["nextCookies",0,()=>{let e=!1;return{id:"next-cookies",version:o.PACKAGE_VERSION,hooks:{before:[{matcher:e=>"/get-session"===e.path,handler:(0,n.createAuthMiddleware)(async t=>{let r;if(e||(!function(e,t){let r=e.options.plugins||[];if(0===r.length)return;let i=r.findIndex(e=>e.id===t);-1===i||r.slice(i+1).some(e=>e.hooks&&Array.isArray(e.hooks.after)&&e.hooks.after.length>0)&&e.logger.warn(`[better-auth] Cookie integration plugin "${t}" should be placed last in the plugins array. Plugins with \`hooks.after\` running after it may set cookies that are not forwarded to the framework cookie store. Move your cookie integration plugin to the end of the \`plugins\` array to avoid missing \`Set-Cookie\` headers.`)}(t.context,"next-cookies"),e=!0),"_flag"in t&&"router"===t._flag)return;try{let{headers:e}=await a();r=await e()}catch{return}let o="1"===r.get("RSC"),n=!!r.get("next-action");o&&!n&&await (0,i.setShouldSkipSessionRefresh)(!0)})}],after:[{matcher:e=>!0,handler:(0,n.createAuthMiddleware)(async e=>{let t=e.context.responseHeaders;if((!("_flag"in e)||"router"!==e._flag)&&t instanceof Headers){let e,i=t?.get("set-cookie");if(!i)return;let o=(0,r.parseSetCookieHeader)(i);try{let{cookies:t}=await a();e=await t()}catch(e){if(e instanceof Error&&(e.message.startsWith("`cookies` was called outside a request scope.")||e.message.includes("Cannot find module")))return;throw e}o.forEach((t,i)=>{if(i)try{e.set(i,t.value,(0,r.toCookieOptions)(t))}catch{}});return}})}]}}},"toNextJsHandler",0,function(e){let t=async t=>"handler"in e?e.handler(t):e(t);return{GET:t,POST:t,PATCH:t,PUT:t,DELETE:t}}],749599)},303361,e=>{"use strict";let t=new Set(["localhost","127.0.0.1","::1","[::1]"]);function r(e){let r,i=e.trim();if(!i)throw Error("APP_ORIGINS contains an empty entry.");if(/[\s/\\]/.test(i.replace(/^https?:\/\//,"")))throw Error(`APP_ORIGINS entry "${i}" must be a bare host or an origin, with no path.`);if(i.includes("@"))throw Error(`APP_ORIGINS entry "${i}" must not contain credentials.`);let o=/^(https?):\/\/(.+)$/.exec(i),n=o?"https"===o[1]?"https:":"http:":null,a=o?o[2]:i,s=/^(\[[^\]]+\]|[^:]+)(?::(\d+))?$/.exec(a);if(!s)throw Error(`APP_ORIGINS entry "${i}" is not a valid host.`);let l=s[1].toLowerCase(),c=s[2]??null;if(!l||"."===l)throw Error(`APP_ORIGINS entry "${i}" is not a valid host.`);let d=l.includes("*");return d&&function(e,t){let r=e.split(".");if(r.slice(1).some(e=>e.includes("*")))throw Error(`APP_ORIGINS entry "${t}" may only use a wildcard in its leftmost label.`);if("*"!==r[0])throw Error(`APP_ORIGINS entry "${t}" must use "*" as a whole label, for example "*.example.com".`);if(r.length<3)throw Error(`APP_ORIGINS entry "${t}" is too broad; a wildcard needs at least two literal labels after it.`)}(l,i),{hostname:l,host:c?`${l}:${c}`:l,port:c,protocol:n,wildcard:d,loopback:(r=l.toLowerCase().replace(/^\[|\]$/g,""),!!(t.has(r)||"::1"===r||r.endsWith(".localhost"))||/^127\./.test(r))}}function i(e,t){return e.protocol?e.protocol:e.loopback?"http:":t?"https:":"http:"}let o=!1;function n(e){let t=e.trim().toLowerCase();return!(!t||/[\s/\\@]/.test(t))&&/^(\[[^\]]+\]|[^:]+)(?::\d+)?$/.test(t)}function a(e,t){let r=e.trim().toLowerCase();if(!r)return!1;let i=/^(\[[^\]]+\]|[^:]+)(?::(\d+))?$/.exec(r);if(!i)return!1;let o=i[1],n=i[2]??null;return(!t.port||t.port===n)&&function(e,t){let r=e.trim().toLowerCase();if(!r)return!1;if(!t.wildcard)return t.hostname===r;let i=t.hostname.slice(1);return r.endsWith(i)&&r.length>i.length}(o,t)}function s(e,t){let r=t=>{let r=e.headers.get(t)?.split(",")[0]?.trim();return r&&!/[\s/\\@]/.test(r)?r:null},i=t?r("x-forwarded-host"):null,o=t?r("x-forwarded-proto"):null,a=i??r("host");if(a&&n(a)){let t="https"===o||"http"===o?o:new URL(e.url).protocol.replace(":","");return`${t}://${a.toLowerCase()}`}try{return new URL(e.url).origin}catch{return null}}e.s(["betterAuthBaseURL",0,function(e){if("inferred"!==e.mode)return"single"===e.mode?e.canonical:{allowedHosts:e.patterns.flatMap(e=>e.port?[e.host]:[e.host,`${e.host}:*`]),protocol:e.allHttps?"https":"auto",fallback:e.canonical}},"isSameOriginRequest",0,function(e,t){let r=e.headers.get("sec-fetch-site");if(r)return"same-origin"===r||"none"===r;let i=e.headers.get("origin");if(!i)return!0;let o=s(e,t);return!!o&&i.trim().toLowerCase()===o},"isTrustedOrigin",0,function(e,t){let r=t.trim();if(!r)return!1;let i=r;if(/^https?:\/\//i.test(r))try{i=new URL(r).host}catch{return!1}return"inferred"===e.mode?n(i):e.patterns.some(e=>a(i,e))},"originFromRequest",0,s,"resolveAppOrigins",0,function(e=process.env){let t,n="phase-production-build"===e.NEXT_PHASE,s="production"===e.NODE_ENV&&!n,l=e.APP_ORIGINS?.trim(),c=function(e){let t,r=e.PUBLIC_BASE_URL?.trim();if(!r)return null;try{t=new URL(r)}catch{throw Error("PUBLIC_BASE_URL must be an absolute http or https URL.")}if("http:"!==t.protocol&&"https:"!==t.protocol)throw Error("PUBLIC_BASE_URL must use http or https.");return t}(e),d=l?l.split(",").map(e=>e.trim()).filter(Boolean).map(r):[];if(s&&0===d.length&&!c)return o||(o=!0,console.warn("[origins] Neither APP_ORIGINS nor PUBLIC_BASE_URL is set. Each request's own Host header will be trusted, so absolute URLs this server generates — OAuth callbacks, iOS enrollment and install links, the GitHub webhook URL — follow whatever host the caller asked for. Set APP_ORIGINS to the hostname(s) this server is reached at to pin them.")),{patterns:[],canonical:null,mode:"inferred",allHttps:!1};let u=s?d:function(e){let t=new Map;for(let r of e){let e=t.get(r.host);e?"http:"===r.protocol&&t.set(r.host,{...e,protocol:"http:"}):t.set(r.host,r)}return[...t.values()]}([...(t=e.PORT?.trim()||"3000",["localhost","127.0.0.1","[::1]"].map(e=>r(`http://${e}:${t}`))),...d]);if(0===u.length&&c&&(u=[r(c.origin)]),s){let e=u.filter(e=>e.wildcard);if(e.length>0)throw Error(`APP_ORIGINS may not use wildcards in production (${e.map(e=>e.hostname).join(", ")}). A wildcard trusts every host under it for CSRF and for post-login redirects; list exact hosts instead.`)}c&&!u.some(e=>a(c.host,e))&&(u=[...u,r(c.origin)]);let p=u.find(e=>!e.wildcard);if(!p&&!c)throw Error("APP_ORIGINS must include at least one exact origin; a wildcard alone gives this server no address to put in the links it generates.");return{patterns:u,canonical:c?.origin??`${i(p,s)}//${p.host}`,mode:1!==u.length||u[0].wildcard?"multi":"single",allHttps:u.every(e=>e.loopback||"https:"===i(e,s))}}])},576257,169040,464661,354470,e=>{"use strict";var t=e.i(363004),r=e.i(931129),i=e.i(204721),o=e.i(749599),n=e.i(756023),a=e.i(272003),s=e.i(483319);let l=(0,s.createAccessControl)({user:["create","list","set-role","ban","impersonate","impersonate-admins","delete","set-password","set-email","get","update"],session:["list","revoke","delete"]}),c={admin:l.newRole({user:["create","list","set-role","ban","impersonate","delete","set-password","set-email","get","update"],session:["list","revoke","delete"]}),user:l.newRole({user:[],session:[]})};var d=e.i(672823);let u=(0,d.defineErrorCodes)({FAILED_TO_CREATE_USER:"Failed to create user",USER_ALREADY_EXISTS:"User already exists.",USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL:"User already exists. Use another email.",YOU_CANNOT_BAN_YOURSELF:"You cannot ban yourself",YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE:"You are not allowed to change users role",YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS:"You are not allowed to create users",YOU_ARE_NOT_ALLOWED_TO_LIST_USERS:"You are not allowed to list users",YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS:"You are not allowed to list users sessions",YOU_ARE_NOT_ALLOWED_TO_BAN_USERS:"You are not allowed to ban users",YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS:"You are not allowed to impersonate users",YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS:"You are not allowed to revoke users sessions",YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS:"You are not allowed to delete users",YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD:"You are not allowed to set users password",BANNED_USER:"You have been banned from this application",YOU_ARE_NOT_ALLOWED_TO_GET_USER:"You are not allowed to get user",NO_DATA_TO_UPDATE:"No data to update",YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS:"You are not allowed to update users",YOU_CANNOT_REMOVE_YOURSELF:"You cannot remove yourself",YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE:"You are not allowed to set a non-existent role value",YOU_CANNOT_IMPERSONATE_ADMINS:"You cannot impersonate admins",INVALID_ROLE_TYPE:"Invalid role type",YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL:"You are not allowed to update users email",PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER:"Password cannot be updated through update-user. Use the set-user-password endpoint instead"});var p=e.i(786198);let f=async e=>{let t=e.context.returned;return t?t instanceof Response?200!==t.status?null:await t.clone().json():(0,p.isAPIError)(t)?null:t:null};var h=e.i(542158),m=e.i(370728),g=e.i(112996);let w=e=>{if(e.userId&&e.options?.adminUserIds?.includes(e.userId))return!0;if(!e.permissions)return!1;let t=(e.role||e.options?.defaultRole||"user").split(","),r=e.options?.roles||c;for(let i of t)if(r[i]?.authorize(e.permissions)?.success)return!0;return!1};var y=e.i(676386),A=e.i(71616),E=e.i(910228),b=e.i(776757),I=e.i(890659),_=e.i(907855),R=e.i(754257);let T=(0,I.createAuthMiddleware)(async e=>{let t=await (0,g.getAuthoritativeSessionFromCtx)(e);if(!t)throw A.APIError.fromStatus("UNAUTHORIZED");return{session:t}});function S(e){return Array.isArray(e)?e.join(","):e}let k=_.object({userId:R.coerce.string().meta({description:"The user id"}),role:_.union([_.string().meta({description:"The role to set. `admin` or `user` by default"}),_.array(_.string().meta({description:"The roles to set. `admin` or `user` by default"}))]).meta({description:"The role to set, this can be a string or an array of strings. Eg: `admin` or `[admin, user]`"})}),v=_.object({id:_.string().meta({description:"The id of the User"})}),U=_.object({email:_.string().meta({description:"The email of the user"}),password:_.string().optional().meta({description:"The password of the user. If not provided, the user will be created without a credential account (useful for magic link or social login only users)."}),name:_.string().meta({description:"The name of the user"}),role:_.union([_.string().meta({description:"The role of the user"}),_.array(_.string().meta({description:"The roles of user"}))]).optional().meta({description:'A string or array of strings representing the roles to apply to the new user. Eg: "user"'}),data:_.record(_.string(),_.any()).optional().meta({description:"Extra fields for the user. Including custom additional fields."})}),O=_.object({userId:R.coerce.string().meta({description:"The user id"}),data:_.record(_.any(),_.any()).meta({description:"The user data to update"})}),x=_.object({searchValue:_.string().optional().meta({description:'The value to search for. Eg: "some name"'}),searchField:_.enum(["email","name"]).meta({description:'The field to search in, defaults to email. Can be `email` or `name`. Eg: "name"'}).optional(),searchOperator:_.enum(["contains","starts_with","ends_with"]).meta({description:'The operator to use for the search. Can be `contains`, `starts_with` or `ends_with`. Eg: "contains"'}).optional(),limit:_.string().meta({description:"The number of users to return"}).or(_.number()).optional(),offset:_.string().meta({description:"The offset to start from"}).or(_.number()).optional(),sortBy:_.string().meta({description:"The field to sort by"}).optional(),sortDirection:_.enum(["asc","desc"]).meta({description:"The direction to sort by"}).optional(),filterField:_.string().meta({description:"The field to filter by"}).optional(),filterValue:_.string().meta({description:"The value to filter by"}).or(_.number()).or(_.boolean()).or(_.array(_.string())).or(_.array(_.number())).optional(),filterOperator:_.enum(b.whereOperators).meta({description:"The operator to use for the filter"}).optional()}),D=_.object({userId:R.coerce.string().meta({description:"The user id"})}),P=_.object({userId:R.coerce.string().meta({description:"The user id"})}),N=_.object({userId:R.coerce.string().meta({description:"The user id"}),banReason:_.string().meta({description:"The reason for the ban"}).optional(),banExpiresIn:_.number().meta({description:"The number of seconds until the ban expires"}).optional()}),L=_.object({userId:R.coerce.string().meta({description:"The user id"})}),C=_.object({sessionToken:_.string().meta({description:"The session token"})}),q=_.object({userId:R.coerce.string().meta({description:"The user id"})}),B=_.object({userId:R.coerce.string().meta({description:"The user id"})}),j=_.object({newPassword:_.string().nonempty("newPassword cannot be empty").meta({description:"The new password"}),userId:R.coerce.string().nonempty("userId cannot be empty").meta({description:"The user id"})}),$=_.object({userId:R.coerce.string().optional().meta({description:'The user id. Eg: "user-id"'}),role:_.string().optional().meta({description:'The role to check permission for. Eg: "admin"'})}).and(_.xor([_.object({permission:_.record(_.string(),_.array(_.string()))}),_.object({permissions:_.record(_.string(),_.array(_.string()))})])),V={user:{fields:{role:{type:"string",required:!1,input:!1},banned:{type:"boolean",defaultValue:!1,required:!1,input:!1},banReason:{type:"string",required:!1,input:!1},banExpires:{type:"date",required:!1,input:!1}}},session:{fields:{impersonatedBy:{type:"string",required:!1,input:!1}}}};var M=e.i(46754);e.i(418069);var F=e.i(444336),H=e.i(35972);function K(e){try{return decodeURIComponent(e)}catch{return e}}let z=(0,d.defineErrorCodes)({INVALID_OAUTH_CONFIGURATION:"Invalid OAuth configuration",TOKEN_URL_NOT_FOUND:"Invalid OAuth configuration. Token URL not found."});var W=e.i(533078),Y=e.i(878175);e.i(339507);var G=e.i(945e3),Q=e.i(729522),J=e.i(661372),Z=e.i(374091),X=e.i(100762),ee=e.i(550064);async function et(e,t){let r=await (0,W.betterFetch)(e,{method:"GET",headers:t});if(r.error||!r.data)return null;if(r.data.issuer)try{new URL(r.data.issuer)}catch{return null}return r.data}async function er(e,t){if(e.idToken)try{let t=(0,Y.decodeJwt)(e.idToken);if(t?.sub&&t?.email)return{id:t.sub,emailVerified:t.email_verified,image:t.picture,...t}}catch{}if(!t)return null;let r=await (0,W.betterFetch)(t,{method:"GET",headers:{Authorization:`Bearer ${e.accessToken}`}});return r.error||!r.data?null:{...r.data,email:r.data.email,emailVerified:r.data.email_verified??!1,image:r.data.picture,name:r.data.name}}var ei=e.i(51144),eo=e.i(530501),en=e.i(282318);let ea=async e=>{let t=await (0,en.createHash)("SHA-256").digest(new TextEncoder().encode(e));return eo.base64Url.encode(new Uint8Array(t),{padding:!1})},es=_.object({token:_.string().meta({description:'The token to verify. Eg: "some-token"'})});var el=e.i(303361),ec=e.i(243783),ed=e.i(187126);function eu(e,t){return e[t]?.trim()||void 0}function ep(e,t){let r=eu(e,t);if(!r)throw Error(`${t} is required for AUTH_MODE.`);return r}function ef(e=process.env){let t=function(e){let t=eu(e,"AUTH_MODE")??"password";if("password"!==t&&"oidc"!==t&&"both"!==t)throw Error('AUTH_MODE must be "password", "oidc", or "both".');return t}(e),r=(0,el.resolveAppOrigins)(e);return{secret:(0,ed.getAppSecrets)(e).authSecret,origins:r,baseURL:r.canonical,trustProxyHeaders:function(e){let t=eu(e,"TRUST_PROXY_HEADERS")?.toLowerCase();if(!t||"false"===t||"0"===t)return!1;if("true"===t||"1"===t)return!0;throw Error("TRUST_PROXY_HEADERS must be true, false, 1, or 0.")}(e),mode:t,provider:function(e,t){if("password"===t)return null;let r=eu(e,"AUTH_OAUTH_DISCOVERY_URL"),i=eu(e,"AUTH_OAUTH_AUTHORIZATION_URL"),o=eu(e,"AUTH_OAUTH_TOKEN_URL"),n=eu(e,"AUTH_OAUTH_USER_INFO_URL"),a=eu(e,"AUTH_OAUTH_ISSUER"),s=!!(i||o||n),l=i&&o&&n;if(r&&s)throw Error("OIDC configuration must use either discovery or explicit endpoints, not both.");if(!r&&!l)throw Error("OIDC authentication requires AUTH_OAUTH_DISCOVERY_URL or all of AUTH_OAUTH_AUTHORIZATION_URL, AUTH_OAUTH_TOKEN_URL, and AUTH_OAUTH_USER_INFO_URL.");if(s&&!l)throw Error("Explicit OAuth configuration must include authorization, token, and user-info URLs.");if(l&&!a)throw Error("AUTH_OAUTH_ISSUER is required with explicit OAuth endpoints.");let c=ep(e,"AUTH_OAUTH_SCOPES").split(",").map(e=>e.trim()).filter(Boolean);if(0===c.length)throw Error("AUTH_OAUTH_SCOPES must contain at least one scope.");return{providerId:ep(e,"AUTH_OAUTH_PROVIDER_ID"),displayName:ep(e,"AUTH_OAUTH_PROVIDER_NAME"),clientId:ep(e,"AUTH_OAUTH_CLIENT_ID"),clientSecret:ep(e,"AUTH_OAUTH_CLIENT_SECRET"),scopes:c,requireIssuerValidation:function(e){let t=eu(e,"AUTH_OAUTH_REQUIRE_ISSUER_VALIDATION")?.toLowerCase();if(!t||"false"===t||"0"===t)return!1;if("true"===t||"1"===t)return!0;throw Error("AUTH_OAUTH_REQUIRE_ISSUER_VALIDATION must be true, false, 1, or 0.")}(e),discoveryUrl:r,issuer:a,authorizationUrl:i,tokenUrl:o,userInfoUrl:n}}(e,t)}}function eh(e){return"password"===e||"both"===e}function em(e){return"oidc"===e||"both"===e}e.s(["getAuthRuntimeConfig",0,ef,"oauthAuthenticationEnabled",0,em,"passwordAuthenticationEnabled",0,eh],169040);var eg=e.i(812057);let ew=RegExp(String.raw`((?:"?(?:authorization|password|accessToken|refreshToken|idToken|sessionToken|clientSecret|secret|privateKey)"?)\s*:\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^,\n}\]]+)`,"gi");function ey(e){return e.replace(ew,'$1"[REDACTED]"')}function eA(e,t,...r){let i=[`${new Date().toISOString()} ${e.toUpperCase()} [Better Auth]: ${t}`,...r.map(e=>"string"==typeof e?e:(0,eg.inspect)(e,{depth:6,breakLength:120}))].map(ey);"error"===e?console.error(...i):"warn"===e?console.warn(...i):console.log(...i)}var eE=e.i(666680);let eb="default";async function eI(){let e=await (0,ec.getPrismaClient)();return await e.authSettings.findUnique({where:{id:eb}})??await e.authSettings.upsert({where:{id:eb},create:{id:eb},update:{}})}async function e_(){let e=await (0,ec.getPrismaClient)(),[t,r]=await Promise.all([eI(),e.user.count()]);return t.bootstrapCompleted||0!==r?!t.bootstrapCompleted&&r>0?(await e.authSettings.update({where:{id:eb},data:{bootstrapCompleted:!0,registrationEnabled:!1,bootstrapClaimId:null,bootstrapClaimedAt:null}}),{enabled:!1,setupRequired:!1}):{enabled:t.registrationEnabled,setupRequired:!1}:{enabled:!0,setupRequired:!0}}async function eR(e){let t=await (0,ec.getPrismaClient)();if(0===await t.user.count())throw new A.APIError("BAD_REQUEST",{message:"Create the initial account before changing registration."});await t.authSettings.upsert({where:{id:eb},create:{id:eb,bootstrapCompleted:!0,registrationEnabled:e},update:{registrationEnabled:e}})}async function eT(e,t){if(e===t)throw new A.APIError("BAD_REQUEST",{message:"You cannot delete the account you are currently using."});let r=await (0,ec.getPrismaClient)();if(1!==await r.$executeRaw`
+`)}}(t={...t,secret:i,baseURL:u?t.baseURL:p?new URL(p).origin:"",basePath:t.basePath||"/api/auth",plugins:l.concat(c)},d);let A=t.advanced?.ipAddress?.trustedProxies;if(A&&A.length>0){let e=A.filter(e=>null===I(e));e.length>0&&d.warn(`Ignoring invalid \`advanced.ipAddress.trustedProxies\` entries: ${e.join(", ")}. Each entry must be an IP address or CIDR range.`)}let E=(0,ti.getCookies)(t),b=(0,eO.getAuthTables)(t),_=(await Promise.all(Object.entries(t.socialProviders||{}).map(async([e,t])=>{let r="function"==typeof t?await t():t;if(null==r||!1===r.enabled)return null;r.clientId||d.warn(`Social provider ${e} is missing clientId or clientSecret`);let i=o_[e](r);return i.disableImplicitSignUp=r.disableImplicitSignUp,i}))).filter(e=>null!==e),R=({model:e,size:r})=>{if("function"==typeof t.advanced?.generateId)return t.advanced.generateId({model:e,size:r});let i=t?.advanced?.database?.generateId;return"function"==typeof i?i({model:e,size:r}):"uuid"===i?crypto.randomUUID():"serial"!==i&&!1!==i&&(0,D.generateId)(r)},{publish:T}=await nP(t,{adapter:e.id,database:"function"==typeof t.database?"adapter":r(t.database)}),S=new Set(t.plugins.map(e=>e.id)),v=await tD(t),U=await tC(t),O={appName:t.appName||"Better Auth",baseURL:p||"",version:(0,nd.getBetterAuthVersion)(),socialProviders:_,options:t,oauthConfig:{storeStateStrategy:t.account?.storeStateStrategy||(s?"database":"cookie"),skipStateCookieCheck:!!t.account?.skipStateCookieCheck},tables:b,trustedOrigins:v,trustedProviders:U,isTrustedOrigin(e,t){return this.trustedOrigins.some(r=>e3(e,r,t))},sessionConfig:{updateAge:t.session?.updateAge!==void 0?t.session.updateAge:86400,expiresIn:t.session?.expiresIn||604800,freshAge:t.session?.freshAge===void 0?86400:t.session.freshAge,cookieRefreshCache:(n=t.session?.cookieCache?.refreshCache,a=t.session?.cookieCache?.maxAge||300,s&&n?(d.warn("[better-auth] `session.cookieCache.refreshCache` is enabled while `database` or `secondaryStorage` is configured. `refreshCache` is meant for stateless (DB-less) setups. Disabling `refreshCache` — remove it from your config to silence this warning."),!1):!1!==n&&void 0!==n&&(!0===n?{enabled:!0,updateAge:Math.floor(.2*a)}:{enabled:!0,updateAge:void 0!==n.updateAge?n.updateAge:Math.floor(.2*a)}))},secret:i,secretConfig:o,rateLimit:{...t.rateLimit,enabled:t.rateLimit?.enabled??f.isProduction,window:t.rateLimit?.window||10,max:t.rateLimit?.max||100,storage:t.rateLimit?.storage||(t.secondaryStorage?"secondary-storage":"memory")},authCookies:E,logger:d,generateId:R,session:null,secondaryStorage:t.secondaryStorage,password:{hash:t.emailAndPassword?.password?.hash||te,verify:t.emailAndPassword?.password?.verify||tr,config:{minPasswordLength:t.emailAndPassword?.minPasswordLength||8,maxPasswordLength:t.emailAndPassword?.maxPasswordLength||128},checkPassword:tj},setNewSession(e){this.newSession=e},newSession:null,adapter:e,internalAdapter:tb(e,{options:t,logger:d,hooks:t.databaseHooks?[{source:"user",hooks:t.databaseHooks}]:[],generateId:R}),createAuthCookie:(0,ti.createCookieGetter)(t),async runMigrations(){throw new k.BetterAuthError("runMigrations will be set by the specific init implementation")},publishTelemetry:T,skipCSRFCheck:!!t.advanced?.disableCSRFCheck,skipOriginCheck:t.advanced?.disableOriginCheck!==void 0?t.advanced.disableOriginCheck:!!(0,f.isTest)(),runInBackground:t.advanced?.backgroundTasks?.handler??(e=>{e.catch(()=>{})}),async runInBackgroundOrAwait(e){try{t.advanced?.backgroundTasks?.handler?e instanceof Promise&&t.advanced.backgroundTasks.handler(e.catch(e=>{d.error("Failed to run background task:",e)})):await e}catch(e){d.error("Failed to run background task:",e)}},getPlugin:e=>t.plugins.find(t=>t.id===e)??null,hasPlugin:e=>S.has(e)},x=tx(O);return(0,e4.isPromise)(x)&&await x,O}let nL=async e=>{let t=await eP(e),r=await nN(t,e,e=>(0,eL.getKyselyDatabaseType)(e)||"unknown");return r.runMigrations=async function(){if(!e.database||"updateMany"in e.database)throw new k.BetterAuthError("Database is not provided or it's an adapter. Migrations are only supported with a database instance.");let{runMigrations:t}=await eZ(e);await t()},r};e.s(["betterAuth",0,e=>((e,t)=>{let r=t(e),{api:i}=nc(r,e),o=e.plugins?.reduce((e,t)=>t.$ERROR_CODES?{...e,...t.$ERROR_CODES}:e,{}),n=async t=>{let i,o=await r,n=o.options.basePath||"/api/auth";if((0,eX.isDynamicBaseURLConfig)(e.baseURL))i=await tN(o,t,tP(o.options));else{i=Object.create(Object.getPrototypeOf(o),Object.getOwnPropertyDescriptors(o));let e=o.options;if(!o.options.baseURL){let r=(0,eX.getBaseURL)(void 0,n,t,void 0,o.options.advanced?.trustedProxyHeaders);if(!r)throw new k.BetterAuthError("Could not get base URL from request. Please provide a valid base URL.");i.baseURL=r,i.options={...o.options,baseURL:(0,eX.getOrigin)(r)||void 0},e=i.options}i.trustedOrigins=await tD(e,t),i.trustedProviders=await tC(e,t)}let{handler:a}=((e,t)=>{let{api:r,middlewares:i}=nc(e,t),o=new URL(e.baseURL).pathname;return(0,nl.createRouter)(r,{routerContext:e,openapi:{disabled:!0},basePath:o,routerMiddleware:[{path:"/**",middleware:tW},...i],allowedMediaTypes:["application/json"],skipTrailingSlashes:t.advanced?.skipTrailingSlashes??!1,async onRequest(t){let r=e.options.disabledPaths||[],i=tV(t.url,o);if(r.includes(i))return new Response("Not Found",{status:404});let n=t,a=await t2(n,e);if(a)return a;for(let t of e.options.plugins||[])if(t.onRequest){let r=await (0,tg.withSpan)(`onRequest ${t.id}`,{[th]:"onRequest",[tm]:`plugin:${t.id}`},()=>t.onRequest(n,e));if(r&&"response"in r)return r.response;r&&"request"in r&&(n=r.request)}return n},async onResponse(t,r){for(let r of e.options.plugins||[])if(r.onResponse){let i=await (0,tg.withSpan)(`onResponse ${r.id}`,{[th]:"onResponse",[tm]:`plugin:${r.id}`,[tp.ATTR_HTTP_RESPONSE_STATUS_CODE]:t.status},()=>r.onResponse(t,e));if(i)return i.response}return t},onError(r){if((0,t$.isAPIError)(r)&&"FOUND"===r.status)return;if(t.onAPIError?.throw)throw r;if(t.onAPIError?.onError)return void t.onAPIError.onError(r,e);let i=t.logger?.level,o="error"===i||"warn"===i||"debug"===i?ex.logger:void 0;if(t.logger?.disabled!==!0){if(r&&"object"==typeof r&&"message"in r&&"string"==typeof r.message&&(r.message.includes("no column")||r.message.includes("column")||r.message.includes("relation")||r.message.includes("table")||r.message.includes("does not exist")))return void e.logger?.error(r.message);(0,t$.isAPIError)(r)?("INTERNAL_SERVER_ERROR"===r.status&&e.logger.error(r.status,r),o?.error(r.message)):e.logger?.error(r&&"object"==typeof r&&"name"in r?r.name:"",r)}}})})(i,e);return(0,td.runWithAdapter)(i.adapter,()=>a(t))};return{handler:n,fetch:n,api:i,options:e,$context:r,$ERROR_CODES:{...o,...tq.BASE_ERROR_CODES}}})(e,nL)],204721)},749599,e=>{"use strict";let t;var r=e.i(46754),i=e.i(682868),o=e.i(272003),n=e.i(890659);let a=()=>t??=e.A(6878).catch(e=>{throw t=void 0,e});e.s(["nextCookies",0,()=>{let e=!1;return{id:"next-cookies",version:o.PACKAGE_VERSION,hooks:{before:[{matcher:e=>"/get-session"===e.path,handler:(0,n.createAuthMiddleware)(async t=>{let r;if(e||(!function(e,t){let r=e.options.plugins||[];if(0===r.length)return;let i=r.findIndex(e=>e.id===t);-1===i||r.slice(i+1).some(e=>e.hooks&&Array.isArray(e.hooks.after)&&e.hooks.after.length>0)&&e.logger.warn(`[better-auth] Cookie integration plugin "${t}" should be placed last in the plugins array. Plugins with \`hooks.after\` running after it may set cookies that are not forwarded to the framework cookie store. Move your cookie integration plugin to the end of the \`plugins\` array to avoid missing \`Set-Cookie\` headers.`)}(t.context,"next-cookies"),e=!0),"_flag"in t&&"router"===t._flag)return;try{let{headers:e}=await a();r=await e()}catch{return}let o="1"===r.get("RSC"),n=!!r.get("next-action");o&&!n&&await (0,i.setShouldSkipSessionRefresh)(!0)})}],after:[{matcher:e=>!0,handler:(0,n.createAuthMiddleware)(async e=>{let t=e.context.responseHeaders;if((!("_flag"in e)||"router"!==e._flag)&&t instanceof Headers){let e,i=t?.get("set-cookie");if(!i)return;let o=(0,r.parseSetCookieHeader)(i);try{let{cookies:t}=await a();e=await t()}catch(e){if(e instanceof Error&&(e.message.startsWith("`cookies` was called outside a request scope.")||e.message.includes("Cannot find module")))return;throw e}o.forEach((t,i)=>{if(i)try{e.set(i,t.value,(0,r.toCookieOptions)(t))}catch{}});return}})}]}}},"toNextJsHandler",0,function(e){let t=async t=>"handler"in e?e.handler(t):e(t);return{GET:t,POST:t,PATCH:t,PUT:t,DELETE:t}}],749599)},303361,e=>{"use strict";let t=new Set(["localhost","127.0.0.1","::1","[::1]"]);function r(e){let r,i=e.trim();if(!i)throw Error("APP_ORIGINS contains an empty entry.");if(/[\s/\\]/.test(i.replace(/^https?:\/\//,"")))throw Error(`APP_ORIGINS entry "${i}" must be a bare host or an origin, with no path.`);if(i.includes("@"))throw Error(`APP_ORIGINS entry "${i}" must not contain credentials.`);let o=/^(https?):\/\/(.+)$/.exec(i),n=o?"https"===o[1]?"https:":"http:":null,a=o?o[2]:i,s=/^(\[[^\]]+\]|[^:]+)(?::(\d+))?$/.exec(a);if(!s)throw Error(`APP_ORIGINS entry "${i}" is not a valid host.`);let l=s[1].toLowerCase(),c=s[2]??null;if(!l||"."===l)throw Error(`APP_ORIGINS entry "${i}" is not a valid host.`);let d=l.includes("*");return d&&function(e,t){let r=e.split(".");if(r.slice(1).some(e=>e.includes("*")))throw Error(`APP_ORIGINS entry "${t}" may only use a wildcard in its leftmost label.`);if("*"!==r[0])throw Error(`APP_ORIGINS entry "${t}" must use "*" as a whole label, for example "*.example.com".`);if(r.length<3)throw Error(`APP_ORIGINS entry "${t}" is too broad; a wildcard needs at least two literal labels after it.`)}(l,i),{hostname:l,host:c?`${l}:${c}`:l,port:c,protocol:n,wildcard:d,loopback:(r=l.toLowerCase().replace(/^\[|\]$/g,""),!!(t.has(r)||"::1"===r||r.endsWith(".localhost"))||/^127\./.test(r))}}function i(e,t){return e.protocol?e.protocol:e.loopback?"http:":t?"https:":"http:"}let o=!1;function n(e){let t=e.trim().toLowerCase();return!(!t||/[\s/\\@]/.test(t))&&/^(\[[^\]]+\]|[^:]+)(?::\d+)?$/.test(t)}function a(e,t){let r=e.trim().toLowerCase();if(!r)return!1;let i=/^(\[[^\]]+\]|[^:]+)(?::(\d+))?$/.exec(r);if(!i)return!1;let o=i[1],n=i[2]??null;return(!t.port||t.port===n)&&function(e,t){let r=e.trim().toLowerCase();if(!r)return!1;if(!t.wildcard)return t.hostname===r;let i=t.hostname.slice(1);return r.endsWith(i)&&r.length>i.length}(o,t)}function s(e,t){let r=t=>{let r=e.headers.get(t)?.split(",")[0]?.trim();return r&&!/[\s/\\@]/.test(r)?r:null},i=t?r("x-forwarded-host"):null,o=t?r("x-forwarded-proto"):null,a=i??r("host");if(a&&n(a)){let t="https"===o||"http"===o?o:new URL(e.url).protocol.replace(":","");return`${t}://${a.toLowerCase()}`}try{return new URL(e.url).origin}catch{return null}}e.s(["betterAuthBaseURL",0,function(e){if("inferred"!==e.mode)return"single"===e.mode?e.canonical:{allowedHosts:e.patterns.flatMap(e=>e.port?[e.host]:[e.host,`${e.host}:*`]),protocol:e.allHttps?"https":"auto",fallback:e.canonical}},"isSameOriginRequest",0,function(e,t){let r=e.headers.get("sec-fetch-site");if(r)return"same-origin"===r||"none"===r;let i=e.headers.get("origin");if(!i)return!0;let o=s(e,t);return!!o&&i.trim().toLowerCase()===o},"isTrustedOrigin",0,function(e,t){let r=t.trim();if(!r)return!1;let i=r;if(/^https?:\/\//i.test(r))try{i=new URL(r).host}catch{return!1}return"inferred"===e.mode?n(i):e.patterns.some(e=>a(i,e))},"originFromRequest",0,s,"resolveAppOrigins",0,function(e=process.env){let t,n="phase-production-build"===e.NEXT_PHASE,s="production"===e.NODE_ENV&&!n,l=e.APP_ORIGINS?.trim(),c=function(e){let t,r=e.PUBLIC_BASE_URL?.trim();if(!r)return null;try{t=new URL(r)}catch{throw Error("PUBLIC_BASE_URL must be an absolute http or https URL.")}if("http:"!==t.protocol&&"https:"!==t.protocol)throw Error("PUBLIC_BASE_URL must use http or https.");return t}(e),d=l?l.split(",").map(e=>e.trim()).filter(Boolean).map(r):[];if(s&&0===d.length&&!c)return o||(o=!0,console.warn("[origins] Neither APP_ORIGINS nor PUBLIC_BASE_URL is set. Each request's own Host header will be trusted, so absolute URLs this server generates — OAuth callbacks, iOS enrollment and install links, the GitHub webhook URL — follow whatever host the caller asked for. Set APP_ORIGINS to the hostname(s) this server is reached at to pin them.")),{patterns:[],canonical:null,mode:"inferred",allHttps:!1};let u=s?d:function(e){let t=new Map;for(let r of e){let e=t.get(r.host);e?"http:"===r.protocol&&t.set(r.host,{...e,protocol:"http:"}):t.set(r.host,r)}return[...t.values()]}([...(t=e.PORT?.trim()||"3000",["localhost","127.0.0.1","[::1]"].map(e=>r(`http://${e}:${t}`))),...d]);if(0===u.length&&c&&(u=[r(c.origin)]),s){let e=u.filter(e=>e.wildcard);if(e.length>0)throw Error(`APP_ORIGINS may not use wildcards in production (${e.map(e=>e.hostname).join(", ")}). A wildcard trusts every host under it for CSRF and for post-login redirects; list exact hosts instead.`)}c&&!u.some(e=>a(c.host,e))&&(u=[...u,r(c.origin)]);let p=u.find(e=>!e.wildcard);if(!p&&!c)throw Error("APP_ORIGINS must include at least one exact origin; a wildcard alone gives this server no address to put in the links it generates.");return{patterns:u,canonical:c?.origin??`${i(p,s)}//${p.host}`,mode:1!==u.length||u[0].wildcard?"multi":"single",allHttps:u.every(e=>e.loopback||"https:"===i(e,s))}}])},576257,169040,464661,354470,e=>{"use strict";var t=e.i(363004),r=e.i(931129),i=e.i(204721),o=e.i(749599),n=e.i(756023),a=e.i(272003),s=e.i(483319);let l=(0,s.createAccessControl)({user:["create","list","set-role","ban","impersonate","impersonate-admins","delete","set-password","set-email","get","update"],session:["list","revoke","delete"]}),c={admin:l.newRole({user:["create","list","set-role","ban","impersonate","delete","set-password","set-email","get","update"],session:["list","revoke","delete"]}),user:l.newRole({user:[],session:[]})};var d=e.i(672823);let u=(0,d.defineErrorCodes)({FAILED_TO_CREATE_USER:"Failed to create user",USER_ALREADY_EXISTS:"User already exists.",USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL:"User already exists. Use another email.",YOU_CANNOT_BAN_YOURSELF:"You cannot ban yourself",YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE:"You are not allowed to change users role",YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS:"You are not allowed to create users",YOU_ARE_NOT_ALLOWED_TO_LIST_USERS:"You are not allowed to list users",YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS:"You are not allowed to list users sessions",YOU_ARE_NOT_ALLOWED_TO_BAN_USERS:"You are not allowed to ban users",YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS:"You are not allowed to impersonate users",YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS:"You are not allowed to revoke users sessions",YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS:"You are not allowed to delete users",YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD:"You are not allowed to set users password",BANNED_USER:"You have been banned from this application",YOU_ARE_NOT_ALLOWED_TO_GET_USER:"You are not allowed to get user",NO_DATA_TO_UPDATE:"No data to update",YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS:"You are not allowed to update users",YOU_CANNOT_REMOVE_YOURSELF:"You cannot remove yourself",YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE:"You are not allowed to set a non-existent role value",YOU_CANNOT_IMPERSONATE_ADMINS:"You cannot impersonate admins",INVALID_ROLE_TYPE:"Invalid role type",YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL:"You are not allowed to update users email",PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER:"Password cannot be updated through update-user. Use the set-user-password endpoint instead"});var p=e.i(786198);let f=async e=>{let t=e.context.returned;return t?t instanceof Response?200!==t.status?null:await t.clone().json():(0,p.isAPIError)(t)?null:t:null};var h=e.i(542158),m=e.i(370728),g=e.i(112996);let w=e=>{if(e.userId&&e.options?.adminUserIds?.includes(e.userId))return!0;if(!e.permissions)return!1;let t=(e.role||e.options?.defaultRole||"user").split(","),r=e.options?.roles||c;for(let i of t)if(r[i]?.authorize(e.permissions)?.success)return!0;return!1};var y=e.i(676386),A=e.i(71616),E=e.i(910228),b=e.i(776757),I=e.i(890659),_=e.i(907855),R=e.i(754257);let T=(0,I.createAuthMiddleware)(async e=>{let t=await (0,g.getAuthoritativeSessionFromCtx)(e);if(!t)throw A.APIError.fromStatus("UNAUTHORIZED");return{session:t}});function S(e){return Array.isArray(e)?e.join(","):e}let k=_.object({userId:R.coerce.string().meta({description:"The user id"}),role:_.union([_.string().meta({description:"The role to set. `admin` or `user` by default"}),_.array(_.string().meta({description:"The roles to set. `admin` or `user` by default"}))]).meta({description:"The role to set, this can be a string or an array of strings. Eg: `admin` or `[admin, user]`"})}),v=_.object({id:_.string().meta({description:"The id of the User"})}),U=_.object({email:_.string().meta({description:"The email of the user"}),password:_.string().optional().meta({description:"The password of the user. If not provided, the user will be created without a credential account (useful for magic link or social login only users)."}),name:_.string().meta({description:"The name of the user"}),role:_.union([_.string().meta({description:"The role of the user"}),_.array(_.string().meta({description:"The roles of user"}))]).optional().meta({description:'A string or array of strings representing the roles to apply to the new user. Eg: "user"'}),data:_.record(_.string(),_.any()).optional().meta({description:"Extra fields for the user. Including custom additional fields."})}),O=_.object({userId:R.coerce.string().meta({description:"The user id"}),data:_.record(_.any(),_.any()).meta({description:"The user data to update"})}),x=_.object({searchValue:_.string().optional().meta({description:'The value to search for. Eg: "some name"'}),searchField:_.enum(["email","name"]).meta({description:'The field to search in, defaults to email. Can be `email` or `name`. Eg: "name"'}).optional(),searchOperator:_.enum(["contains","starts_with","ends_with"]).meta({description:'The operator to use for the search. Can be `contains`, `starts_with` or `ends_with`. Eg: "contains"'}).optional(),limit:_.string().meta({description:"The number of users to return"}).or(_.number()).optional(),offset:_.string().meta({description:"The offset to start from"}).or(_.number()).optional(),sortBy:_.string().meta({description:"The field to sort by"}).optional(),sortDirection:_.enum(["asc","desc"]).meta({description:"The direction to sort by"}).optional(),filterField:_.string().meta({description:"The field to filter by"}).optional(),filterValue:_.string().meta({description:"The value to filter by"}).or(_.number()).or(_.boolean()).or(_.array(_.string())).or(_.array(_.number())).optional(),filterOperator:_.enum(b.whereOperators).meta({description:"The operator to use for the filter"}).optional()}),D=_.object({userId:R.coerce.string().meta({description:"The user id"})}),P=_.object({userId:R.coerce.string().meta({description:"The user id"})}),N=_.object({userId:R.coerce.string().meta({description:"The user id"}),banReason:_.string().meta({description:"The reason for the ban"}).optional(),banExpiresIn:_.number().meta({description:"The number of seconds until the ban expires"}).optional()}),L=_.object({userId:R.coerce.string().meta({description:"The user id"})}),C=_.object({sessionToken:_.string().meta({description:"The session token"})}),q=_.object({userId:R.coerce.string().meta({description:"The user id"})}),B=_.object({userId:R.coerce.string().meta({description:"The user id"})}),j=_.object({newPassword:_.string().nonempty("newPassword cannot be empty").meta({description:"The new password"}),userId:R.coerce.string().nonempty("userId cannot be empty").meta({description:"The user id"})}),$=_.object({userId:R.coerce.string().optional().meta({description:'The user id. Eg: "user-id"'}),role:_.string().optional().meta({description:'The role to check permission for. Eg: "admin"'})}).and(_.xor([_.object({permission:_.record(_.string(),_.array(_.string()))}),_.object({permissions:_.record(_.string(),_.array(_.string()))})])),V={user:{fields:{role:{type:"string",required:!1,input:!1},banned:{type:"boolean",defaultValue:!1,required:!1,input:!1},banReason:{type:"string",required:!1,input:!1},banExpires:{type:"date",required:!1,input:!1}}},session:{fields:{impersonatedBy:{type:"string",required:!1,input:!1}}}};var M=e.i(46754);e.i(418069);var F=e.i(444336),H=e.i(35972);function K(e){try{return decodeURIComponent(e)}catch{return e}}let z=(0,d.defineErrorCodes)({INVALID_OAUTH_CONFIGURATION:"Invalid OAuth configuration",TOKEN_URL_NOT_FOUND:"Invalid OAuth configuration. Token URL not found."});var W=e.i(533078),Y=e.i(878175);e.i(339507);var G=e.i(945e3),Q=e.i(729522),J=e.i(661372),Z=e.i(374091),X=e.i(100762),ee=e.i(550064);async function et(e,t){let r=await (0,W.betterFetch)(e,{method:"GET",headers:t});if(r.error||!r.data)return null;if(r.data.issuer)try{new URL(r.data.issuer)}catch{return null}return r.data}async function er(e,t){if(e.idToken)try{let t=(0,Y.decodeJwt)(e.idToken);if(t?.sub&&t?.email)return{id:t.sub,emailVerified:t.email_verified,image:t.picture,...t}}catch{}if(!t)return null;let r=await (0,W.betterFetch)(t,{method:"GET",headers:{Authorization:`Bearer ${e.accessToken}`}});return r.error||!r.data?null:{...r.data,email:r.data.email,emailVerified:r.data.email_verified??!1,image:r.data.picture,name:r.data.name}}var ei=e.i(51144),eo=e.i(530501),en=e.i(282318);let ea=async e=>{let t=await (0,en.createHash)("SHA-256").digest(new TextEncoder().encode(e));return eo.base64Url.encode(new Uint8Array(t),{padding:!1})},es=_.object({token:_.string().meta({description:'The token to verify. Eg: "some-token"'})});var el=e.i(303361),ec=e.i(243783),ed=e.i(187126);function eu(e,t){return e[t]?.trim()||void 0}function ep(e,t){let r=eu(e,t);if(!r)throw Error(`${t} is required for AUTH_MODE.`);return r}function ef(e=process.env){let t=function(e){let t=eu(e,"AUTH_MODE")??"password";if("password"!==t&&"oidc"!==t&&"both"!==t)throw Error('AUTH_MODE must be "password", "oidc", or "both".');return t}(e),r=(0,el.resolveAppOrigins)(e);return{secret:(0,ed.getAppSecrets)(e).authSecret,origins:r,baseURL:r.canonical,trustProxyHeaders:function(e){let t=eu(e,"TRUST_PROXY_HEADERS")?.toLowerCase();if(!t||"false"===t||"0"===t)return!1;if("true"===t||"1"===t)return!0;throw Error("TRUST_PROXY_HEADERS must be true, false, 1, or 0.")}(e),mode:t,provider:function(e,t){if("password"===t)return null;let r=eu(e,"AUTH_OAUTH_DISCOVERY_URL"),i=eu(e,"AUTH_OAUTH_AUTHORIZATION_URL"),o=eu(e,"AUTH_OAUTH_TOKEN_URL"),n=eu(e,"AUTH_OAUTH_USER_INFO_URL"),a=eu(e,"AUTH_OAUTH_ISSUER"),s=!!(i||o||n),l=i&&o&&n;if(r&&s)throw Error("OIDC configuration must use either discovery or explicit endpoints, not both.");if(!r&&!l)throw Error("OIDC authentication requires AUTH_OAUTH_DISCOVERY_URL or all of AUTH_OAUTH_AUTHORIZATION_URL, AUTH_OAUTH_TOKEN_URL, and AUTH_OAUTH_USER_INFO_URL.");if(s&&!l)throw Error("Explicit OAuth configuration must include authorization, token, and user-info URLs.");if(l&&!a)throw Error("AUTH_OAUTH_ISSUER is required with explicit OAuth endpoints.");let c=ep(e,"AUTH_OAUTH_SCOPES").split(",").map(e=>e.trim()).filter(Boolean);if(0===c.length)throw Error("AUTH_OAUTH_SCOPES must contain at least one scope.");return{providerId:ep(e,"AUTH_OAUTH_PROVIDER_ID"),displayName:ep(e,"AUTH_OAUTH_PROVIDER_NAME"),clientId:ep(e,"AUTH_OAUTH_CLIENT_ID"),clientSecret:ep(e,"AUTH_OAUTH_CLIENT_SECRET"),scopes:c,requireIssuerValidation:function(e){let t=eu(e,"AUTH_OAUTH_REQUIRE_ISSUER_VALIDATION")?.toLowerCase();if(!t||"false"===t||"0"===t)return!1;if("true"===t||"1"===t)return!0;throw Error("AUTH_OAUTH_REQUIRE_ISSUER_VALIDATION must be true, false, 1, or 0.")}(e),discoveryUrl:r,issuer:a,authorizationUrl:i,tokenUrl:o,userInfoUrl:n}}(e,t)}}function eh(e){return"password"===e||"both"===e}function em(e){return"oidc"===e||"both"===e}e.s(["getAuthRuntimeConfig",0,ef,"oauthAuthenticationEnabled",0,em,"passwordAuthenticationEnabled",0,eh],169040);var eg=e.i(812057);let ew=RegExp(String.raw`((?:"?(?:authorization|password|accessToken|refreshToken|idToken|sessionToken|clientSecret|secret|privateKey)"?)\s*:\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^,\n}\]]+)`,"gi");function ey(e){return e.replace(ew,'$1"[REDACTED]"')}function eA(e,t,...r){let i=[`${new Date().toISOString()} ${e.toUpperCase()} [Better Auth]: ${t}`,...r.map(e=>"string"==typeof e?e:(0,eg.inspect)(e,{depth:6,breakLength:120}))].map(ey);"error"===e?console.error(...i):"warn"===e?console.warn(...i):console.log(...i)}function eE(e){return"string"==typeof e&&e.length>0?e:void 0}async function eb(e,t){try{return await fetch(e,{headers:{Accept:"application/vnd.github+json",Authorization:`Bearer ${t}`,"User-Agent":"AI-Development-Environment"}})}catch{return null}}async function eI(e,t){let r,i=await eb(e,t);if(!i?.ok)return null;let o=await i.json(),n=eE(o.email),a=await eb(((r=new URL(e)).pathname=`${r.pathname.replace(/\/$/,"")}/emails`,r.toString()),t),s=a?.ok?await a.json():[],l=Array.isArray(s)?s:[],c=l.find(e=>!0===e.primary)??l[0],d=n??eE(c?.email),u=l.find(e=>eE(e.email)===d);return{...o,email:d,emailVerified:u?.verified===!0,image:eE(o.avatar_url),name:eE(o.name)??eE(o.login)??""}}var e_=e.i(666680);let eR="default";async function eT(){let e=await (0,ec.getPrismaClient)();return await e.authSettings.findUnique({where:{id:eR}})??await e.authSettings.upsert({where:{id:eR},create:{id:eR},update:{}})}async function eS(){let e=await (0,ec.getPrismaClient)(),[t,r]=await Promise.all([eT(),e.user.count()]);return t.bootstrapCompleted||0!==r?!t.bootstrapCompleted&&r>0?(await e.authSettings.update({where:{id:eR},data:{bootstrapCompleted:!0,registrationEnabled:!1,bootstrapClaimId:null,bootstrapClaimedAt:null}}),{enabled:!1,setupRequired:!1}):{enabled:t.registrationEnabled,setupRequired:!1}:{enabled:!0,setupRequired:!0}}async function ek(e){let t=await (0,ec.getPrismaClient)();if(0===await t.user.count())throw new A.APIError("BAD_REQUEST",{message:"Create the initial account before changing registration."});await t.authSettings.upsert({where:{id:eR},create:{id:eR,bootstrapCompleted:!0,registrationEnabled:e},update:{registrationEnabled:e}})}async function ev(e,t){if(e===t)throw new A.APIError("BAD_REQUEST",{message:"You cannot delete the account you are currently using."});let r=await (0,ec.getPrismaClient)();if(1!==await r.$executeRaw`
     DELETE FROM "user"
     WHERE "id" = ${e}
       AND (SELECT COUNT(*) FROM "user") > 1
-  `){if(!await r.user.findUnique({where:{id:e},select:{id:!0}}))throw new A.APIError("NOT_FOUND",{message:"User not found."});throw new A.APIError("BAD_REQUEST",{message:"The final account cannot be deleted."})}}async function eS({allowWhenRegistrationClosed:e=!1}={}){let t=await (0,ec.getPrismaClient)(),r=await eI();if(r.bootstrapCompleted){if(!r.registrationEnabled&&!e)throw new A.APIError("FORBIDDEN",{message:"Account registration is disabled."});return}if(await t.user.count()>0){if(await t.authSettings.update({where:{id:eb},data:{bootstrapCompleted:!0,registrationEnabled:!1,bootstrapClaimId:null,bootstrapClaimedAt:null}}),e)return;throw new A.APIError("FORBIDDEN",{message:"Account registration is disabled."})}let i=new Date(Date.now()-18e4),o=(0,eE.randomUUID)();if(1!==(await t.authSettings.updateMany({where:{id:eb,bootstrapCompleted:!1,OR:[{bootstrapClaimedAt:null},{bootstrapClaimedAt:{lt:i}}]},data:{bootstrapClaimId:o,bootstrapClaimedAt:new Date}})).count)throw new A.APIError("CONFLICT",{message:"The initial account is already being created. Try again shortly."})}async function ek(){let e=await (0,ec.getPrismaClient)();await e.authSettings.updateMany({where:{id:eb,bootstrapCompleted:!1},data:{bootstrapCompleted:!0,registrationEnabled:!1,bootstrapClaimId:null,bootstrapClaimedAt:null}})}let ev={user:{create:{before:async(e,t)=>(await eS({allowWhenRegistrationClosed:t?.path?.includes("/admin/create-user")??!1}),{data:{...e,role:"user",banned:!1,banReason:null,banExpires:null}}),after:async()=>{await ek()}},update:{before:async e=>({data:{...e,role:"user",banned:!1,banReason:null,banExpires:null}})},delete:{before:async()=>{throw new A.APIError("BAD_REQUEST",{message:"Accounts must be deleted through the management API."})}}}};e.s(["authDatabaseHooks",0,ev,"deleteManagedUser",0,eT,"getRegistrationStatus",0,e_,"setRegistrationEnabled",0,eR],464661);let eU={user:["create","list","set-password","set-email","get","update"],session:["list","revoke","delete"]},eO=(0,s.createAccessControl)(eU),ex=eO.newRole(eU),eD=null;function eP(){return eD||(eD=(0,ec.getPrismaClient)().then(e=>(function(e,s=ef()){let l=em(s.mode)&&s.provider?(e=>{let t=new Set,r=new Set;for(let i of e.config){let e=i.providerId;t.has(e)&&r.add(e),t.add(e)}return r.size>0&&console.warn(`Duplicate provider IDs found: ${Array.from(r).join(", ")}`),{id:"generic-oauth",version:a.PACKAGE_VERSION,init:async t=>{let r=[];for(let i of e.config){let e,o,n=i.authorizationUrl,a=i.tokenUrl,s=i.userInfoUrl,l=i.endSessionEndpoint,c=!1;if(i.discoveryUrl){let r=await et(i.discoveryUrl,i.discoveryHeaders).catch(e=>(t.logger.error(`Discovery fetch failed for "${i.providerId}": ${e}`),null));if(r){if(!r.issuer&&!i.accountIssuer)throw Error(`Provider "${i.providerId}": discovery did not return an issuer. Configure accountIssuer explicitly to establish a stable account namespace.`);n??=r.authorization_endpoint,a??=r.token_endpoint,s??=r.userinfo_endpoint,l??=r.end_session_endpoint,e=r.issuer;let t=r.id_token_signing_alg_values_supported;if(c=Array.isArray(t)&&t.length>0,r.jwks_uri&&r.issuer){let e;try{e=new URL(r.jwks_uri,i.discoveryUrl)}catch{throw Error(`Provider "${i.providerId}": invalid jwks_uri "${r.jwks_uri}" in discovery document.`)}o={jwks:(0,ee.createRemoteJWKSet)(e),issuer:r.issuer,audience:i.clientId,algorithms:c?t:void 0}}}else if(i.accountIssuer)n&&a||t.logger.error(`Provider "${i.providerId}": discovery returned no data and no explicit endpoints configured. OAuth sign-in will fail for this provider.`);else throw Error(`Provider "${i.providerId}": discovery returned no valid data. Provider initialization stopped to keep its account issuer stable.`)}if(i.requireIdTokenVerification&&!o)throw Error(`Provider "${i.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri.`);let d=i.tokenEndpointAuth;if(i.clientSecret&&(d?.method==="private_key_jwt"||d?.method==="none"))throw Error(`Provider "${i.providerId}": tokenEndpointAuth.method "${d?.method}" cannot be combined with clientSecret`);if(!i.clientSecret&&(d?.method==="client_secret_basic"||d?.method==="client_secret_post"))throw Error(`Provider "${i.providerId}": tokenEndpointAuth.method "${d?.method}" requires clientSecret`);if(!i.clientSecret&&!d&&"basic"===i.authentication)throw Error(`Provider "${i.providerId}": authentication "basic" requires clientSecret`);let u=i.accountSubject,p=i.accountIssuer,f={id:i.providerId,name:i.name??i.providerId,issuer:e,accountSubject:({tokens:e,profile:t})=>u?u({tokens:e,profile:t}):c?t.sub??"":t.id??"",accountIssuer:"function"==typeof p?({tokens:e,profile:t})=>p({tokens:e,profile:t}):p??e,idToken:o,requiresIdTokenNonce:void 0!==o&&!0!==i.disableIdTokenNonceBinding,allowIdpInitiated:i.allowIdpInitiated,async createEndSessionURL(e){let r;if(i.disableProviderLogout||!l)return null;try{r=new URL(l)}catch{return null}e.idToken&&r.searchParams.set("id_token_hint",e.idToken);let o=e.postLogoutRedirectURI??i.postLogoutRedirectURI,n=o?new URL(o,t.baseURL).toString():void 0;return n?(r.searchParams.set("post_logout_redirect_uri",n),r.searchParams.set("client_id",i.clientId),e.state&&r.searchParams.set("state",e.state)):e.idToken||r.searchParams.set("client_id",i.clientId),r},createAuthorizationURL(e){if(!n)throw A.APIError.from("BAD_REQUEST",z.INVALID_OAUTH_CONFIGURATION);return(0,Q.createAuthorizationURL)({id:i.providerId,options:{clientId:i.clientId,clientSecret:i.clientSecret,redirectURI:i.redirectURI},authorizationEndpoint:n,state:e.state,codeVerifier:i.pkce??!0?e.codeVerifier:void 0,scopes:(()=>{let t=[...e.scopes??[],...i.scopes??[]];return c&&!t.includes("openid")&&t.unshift("openid"),t})(),redirectURI:e.redirectURI,prompt:i.prompt,accessType:i.accessType,responseType:i.responseType,responseMode:i.responseMode,nonce:e.idTokenNonce,additionalParams:{...i.authorizationUrlParams??{},...e.additionalParams??{}},loginHint:e.loginHint})},async validateAuthorizationCode(e){if(i.getToken)return(0,G.applyDefaultAccessTokenExpiry)(await i.getToken(e),i.accessTokenExpiresIn);if(!a)throw A.APIError.from("BAD_REQUEST",z.TOKEN_URL_NOT_FOUND);return(0,G.applyDefaultAccessTokenExpiry)(await (0,Z.validateAuthorizationCode)({headers:i.authorizationHeaders,code:e.code,codeVerifier:i.pkce??!0?e.codeVerifier:void 0,redirectURI:e.redirectURI,options:{clientId:i.clientId,clientSecret:i.clientSecret,redirectURI:i.redirectURI},tokenEndpoint:a,authentication:i.authentication,tokenEndpointAuth:d,additionalParams:i.tokenUrlParams}),i.accessTokenExpiresIn)},async getUserInfo(e){let{expectedIdTokenNonce:r,...o}=e;if(o.idToken&&f.idToken&&!await (0,X.verifyProviderIdToken)(f,o.idToken,r))return t.logger.error(`Provider "${i.providerId}": id_token failed verification against the discovery JWKS or expected nonce`),null;let n=i.getUserInfo?await i.getUserInfo(o):await er(o,s);if(!n)return null;let a=i.mapProfileToUser?await i.mapProfileToUser(n):{},l={email:n.email,emailVerified:n.emailVerified,image:n.image,name:n.name,...a};return{user:{...l,image:l.image??void 0},data:n}},async refreshAccessToken(e,t){if(!a)throw A.APIError.from("BAD_REQUEST",z.TOKEN_URL_NOT_FOUND);let r="function"==typeof i.refreshTokenParams?await i.refreshTokenParams(t):i.refreshTokenParams;return(0,G.applyDefaultAccessTokenExpiry)(await (0,J.refreshAccessToken)({refreshToken:e,options:{clientId:i.clientId,clientSecret:i.clientSecret},authentication:i.authentication,tokenEndpointAuth:d,tokenEndpoint:a,extraParams:r}),i.accessTokenExpiresIn)},disableImplicitSignUp:i.disableImplicitSignUp,disableSignUp:i.disableSignUp,options:{disableSignUp:i.disableSignUp,overrideUserInfoOnSignIn:i.overrideUserInfo,requireEmailVerification:i.requireEmailVerification}};r.push(f)}let i=new Set(t.socialProviders.map(e=>e.id));for(let e of r)i.has(e.id)&&t.logger.warn(`Generic OAuth provider "${e.id}" shadows a built-in social provider with the same ID`);return{context:{socialProviders:r.concat(t.socialProviders)}}},options:e,$ERROR_CODES:z}})({config:[{providerId:s.provider.providerId,clientId:s.provider.clientId,clientSecret:s.provider.clientSecret,scopes:s.provider.scopes,discoveryUrl:s.provider.discoveryUrl,accountIssuer:`local:oauth:${s.provider.providerId}`,authorizationUrl:s.provider.authorizationUrl,tokenUrl:s.provider.tokenUrl,userInfoUrl:s.provider.userInfoUrl,pkce:!0,requireIdTokenVerification:s.provider.requireIssuerValidation,disableImplicitSignUp:!1}]}):null;return(0,i.betterAuth)({appName:"AI Development Environment",baseURL:(0,el.betterAuthBaseURL)(s.origins),trustedOrigins:e=>{if(!e)return[];let t=(0,el.originFromRequest)(e,s.trustProxyHeaders);return t&&(0,el.isTrustedOrigin)(s.origins,t)?[t]:[]},secret:s.secret,logger:{log:eA},advanced:{trustedProxyHeaders:s.trustProxyHeaders},database:(0,r.prismaAdapter)(e,{provider:"sqlite"}),emailAndPassword:{enabled:eh(s.mode),requireEmailVerification:!1},account:{accountLinking:{enabled:!0,disableImplicitLinking:!0,allowDifferentEmails:!1}},databaseHooks:ev,plugins:[function(){let e=(e=>{let t={...e||{},defaultRole:e?.defaultRole??"user",adminRoles:e?.adminRoles??["admin"],bannedUserMessage:e?.bannedUserMessage??"You have been banned from this application. Please contact support if you believe this is an error."};if(e?.adminRoles){let t=(Array.isArray(e.adminRoles)?e.adminRoles:[...e.adminRoles.split(",")]).filter(t=>!Object.keys(e?.roles||c).map(e=>e.toLowerCase()).includes(t.toLowerCase()));if(t.length>0)throw new A.BetterAuthError(`Invalid admin roles: ${t.join(", ")}. Admin roles must be defined in the 'roles' configuration.`)}return{id:"admin",version:a.PACKAGE_VERSION,init:()=>({options:{databaseHooks:{user:{create:{before:async t=>({data:{role:e?.defaultRole??"user",...t}})}},session:{create:{async before(e,r){if(!r)return;let i=await r.context.internalAdapter.findUserById(e.userId);if(i?.banned){if(i.banExpires&&new Date(i.banExpires).getTime()<Date.now())return void await r.context.internalAdapter.updateUser(e.userId,{banned:!1,banReason:null,banExpires:null});throw A.APIError.from("FORBIDDEN",{message:t.bannedUserMessage,code:"BANNED_USER"})}}}}}}}),hooks:{after:[{matcher:e=>"/list-sessions"===e.path,handler:(0,I.createAuthMiddleware)(async e=>{let t=await f(e);if(!t)return;let r=t.filter(e=>!e.impersonatedBy);return e.json(r)})}]},endpoints:{setRole:(0,I.createAuthEndpoint)("/admin/set-role",{method:"POST",body:k,requireHeaders:!0,use:[T],metadata:{openapi:{operationId:"setUserRole",summary:"Set the role of a user",description:"Set the role of a user",responses:{200:{description:"User role updated",content:{"application/json":{schema:{type:"object",properties:{user:{$ref:"#/components/schemas/User"}}}}}}}},$Infer:{body:{}}}},async e=>{if(!w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["set-role"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE);let r=t.roles;if(r){for(let t of Array.isArray(e.body.role)?e.body.role:[e.body.role])if(!r[t])throw A.APIError.from("BAD_REQUEST",u.YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE)}if(!await e.context.internalAdapter.findUserById(e.body.userId))throw A.APIError.from("NOT_FOUND",E.BASE_ERROR_CODES.USER_NOT_FOUND);let i=await e.context.internalAdapter.updateUser(e.body.userId,{role:S(e.body.role)});return e.json({user:(0,n.parseUserOutput)(e.context.options,i)})}),getUser:(0,I.createAuthEndpoint)("/admin/get-user",{method:"GET",query:v,use:[T],metadata:{openapi:{operationId:"getUser",summary:"Get an existing user",description:"Get an existing user",responses:{200:{description:"User",content:{"application/json":{schema:{type:"object",properties:{user:{$ref:"#/components/schemas/User"}}}}}}}}}},async e=>{let{id:r}=e.query;if(!w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["get"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_GET_USER);let i=await e.context.internalAdapter.findUserById(r);if(!i)throw A.APIError.from("NOT_FOUND",E.BASE_ERROR_CODES.USER_NOT_FOUND);return(0,n.parseUserOutput)(e.context.options,i)}),createUser:(0,I.createAuthEndpoint)("/admin/create-user",{method:"POST",body:U,metadata:{openapi:{operationId:"createUser",summary:"Create a new user",description:"Create a new user",responses:{200:{description:"User created",content:{"application/json":{schema:{type:"object",properties:{user:{$ref:"#/components/schemas/User"}}}}}}}},$Infer:{body:{}}}},async e=>{let r=await (0,g.getAuthoritativeSessionFromCtx)(e);if(!r&&(e.request||e.headers))throw e.error("UNAUTHORIZED");if(r&&!w({userId:r.user.id,role:r.user.role,options:t,permissions:{user:["create"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS);let{role:i,...o}=e.body.data??{},a=e.body.role??i;if(void 0!==a){if(r&&!w({userId:r.user.id,role:r.user.role,options:t,permissions:{user:["set-role"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE);for(let e of Array.isArray(a)?a:[a]){if("string"!=typeof e)throw A.APIError.from("BAD_REQUEST",u.INVALID_ROLE_TYPE);if(t.roles&&!t.roles[e])throw A.APIError.from("BAD_REQUEST",u.YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE)}}if(r&&["banned","banReason","banExpires"].some(e=>Object.prototype.hasOwnProperty.call(o,e))&&!w({userId:r.user.id,role:r.user.role,options:t,permissions:{user:["ban"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_BAN_USERS);let s=e.body.email.toLowerCase();if(!_.email().safeParse(s).success)throw A.APIError.from("BAD_REQUEST",E.BASE_ERROR_CODES.INVALID_EMAIL);if(await e.context.internalAdapter.findUserByEmail(s))throw A.APIError.from("BAD_REQUEST",u.USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL);let l=await e.context.internalAdapter.createUser({...o,email:s,name:e.body.name,role:void 0!==a?S(a):t?.defaultRole??"user"},{method:"admin"});if(!l)throw A.APIError.from("INTERNAL_SERVER_ERROR",u.FAILED_TO_CREATE_USER);if(e.body.password){let t=await e.context.password.hash(e.body.password);await e.context.internalAdapter.linkAccount({providerId:"credential",issuer:(0,y.createLocalAccountIssuer)("credential"),accountId:l.id,password:t,userId:l.id})}return e.json({user:(0,n.parseUserOutput)(e.context.options,l)})}),adminUpdateUser:(0,I.createAuthEndpoint)("/admin/update-user",{method:"POST",body:O,use:[T],metadata:{openapi:{operationId:"adminUpdateUser",summary:"Update a user",description:"Update a user's details",responses:{200:{description:"User updated",content:{"application/json":{schema:{type:"object",properties:{user:{$ref:"#/components/schemas/User"}}}}}}}}}},async e=>{if(!w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["update"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS);if(0===Object.keys(e.body.data).length)throw A.APIError.from("BAD_REQUEST",u.NO_DATA_TO_UPDATE);let r=e.body.data,i=e=>Object.prototype.hasOwnProperty.call(r,e);if(i("password"))throw A.APIError.from("BAD_REQUEST",u.PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER);if(Object.prototype.hasOwnProperty.call(e.body.data,"role")){if(!w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["set-role"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE);let r=e.body.data.role,i=Array.isArray(r)?r:[r];for(let e of i){if("string"!=typeof e)throw A.APIError.from("BAD_REQUEST",u.INVALID_ROLE_TYPE);if(t.roles&&!t.roles[e])throw A.APIError.from("BAD_REQUEST",u.YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE)}e.body.data.role=S(i)}if(["banned","banReason","banExpires"].some(i)){if(!w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["ban"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_BAN_USERS);if(!0===r.banned&&e.body.userId===e.context.session.user.id)throw A.APIError.from("BAD_REQUEST",u.YOU_CANNOT_BAN_YOURSELF)}if(i("email")||i("emailVerified")){if(!w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["set-email"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL);if(i("email")){let t=String(r.email).toLowerCase();if(!_.email().safeParse(t).success)throw A.APIError.from("BAD_REQUEST",E.BASE_ERROR_CODES.INVALID_EMAIL);let i=await e.context.internalAdapter.findUserByEmail(t);if(i&&i.user.id!==e.body.userId)throw A.APIError.from("BAD_REQUEST",u.USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL);r.email=t}}if(!await e.context.internalAdapter.findUserById(e.body.userId))throw A.APIError.from("NOT_FOUND",E.BASE_ERROR_CODES.USER_NOT_FOUND);let o=await e.context.internalAdapter.updateUser(e.body.userId,e.body.data);return!0===r.banned&&await e.context.internalAdapter.deleteUserSessions(e.body.userId),e.json((0,n.parseUserOutput)(e.context.options,o))}),listUsers:(0,I.createAuthEndpoint)("/admin/list-users",{method:"GET",use:[T],query:x,metadata:{openapi:{operationId:"listUsers",summary:"List users",description:"List users",responses:{200:{description:"List of users",content:{"application/json":{schema:{type:"object",properties:{users:{type:"array",items:{$ref:"#/components/schemas/User"}},total:{type:"number"},limit:{type:"number"},offset:{type:"number"}},required:["users","total"]}}}}}}}},async e=>{let r=e.context.session;if(!w({userId:e.context.session.user.id,role:r.user.role,options:t,permissions:{user:["list"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_LIST_USERS);let i=[];e.query?.searchValue&&i.push({field:e.query.searchField||"email",operator:e.query.searchOperator||"contains",value:e.query.searchValue}),e.query?.filterValue!==void 0&&i.push({field:e.query.filterField||"email",operator:e.query.filterOperator||"eq",value:e.query.filterValue});try{let t=await e.context.internalAdapter.listUsers(Number(e.query?.limit)||void 0,Number(e.query?.offset)||void 0,e.query?.sortBy?{field:e.query.sortBy,direction:e.query.sortDirection||"asc"}:void 0,i.length?i:void 0),r=await e.context.internalAdapter.countTotalUsers(i.length?i:void 0);return e.json({users:t.map(t=>(0,n.parseUserOutput)(e.context.options,t)),total:r,limit:Number(e.query?.limit)||void 0,offset:Number(e.query?.offset)||void 0})}catch{return e.json({users:[],total:0})}}),listUserSessions:(0,I.createAuthEndpoint)("/admin/list-user-sessions",{method:"POST",use:[T],body:D,metadata:{openapi:{operationId:"adminListUserSessions",summary:"List user sessions",description:"List user sessions",responses:{200:{description:"List of user sessions",content:{"application/json":{schema:{type:"object",properties:{sessions:{type:"array",items:{$ref:"#/components/schemas/Session"}}}}}}}}}}},async e=>{let r=e.context.session;if(!w({userId:e.context.session.user.id,role:r.user.role,options:t,permissions:{session:["list"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS);let i=await e.context.internalAdapter.listSessions(e.body.userId);return e.json({sessions:i.map(t=>(0,n.parseSessionOutput)(e.context.options,t))})}),unbanUser:(0,I.createAuthEndpoint)("/admin/unban-user",{method:"POST",body:P,use:[T],metadata:{openapi:{operationId:"unbanUser",summary:"Unban a user",description:"Unban a user",responses:{200:{description:"User unbanned",content:{"application/json":{schema:{type:"object",properties:{user:{$ref:"#/components/schemas/User"}}}}}}}}}},async e=>{let r=e.context.session;if(!w({userId:e.context.session.user.id,role:r.user.role,options:t,permissions:{user:["ban"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_BAN_USERS);if(!await e.context.internalAdapter.findUserById(e.body.userId))throw A.APIError.from("NOT_FOUND",E.BASE_ERROR_CODES.USER_NOT_FOUND);let i=await e.context.internalAdapter.updateUser(e.body.userId,{banned:!1,banExpires:null,banReason:null,updatedAt:new Date});return e.json({user:(0,n.parseUserOutput)(e.context.options,i)})}),banUser:(0,I.createAuthEndpoint)("/admin/ban-user",{method:"POST",body:N,use:[T],metadata:{openapi:{operationId:"banUser",summary:"Ban a user",description:"Ban a user",responses:{200:{description:"User banned",content:{"application/json":{schema:{type:"object",properties:{user:{$ref:"#/components/schemas/User"}}}}}}}}}},async e=>{let r=e.context.session;if(!w({userId:e.context.session.user.id,role:r.user.role,options:t,permissions:{user:["ban"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_BAN_USERS);if(!await e.context.internalAdapter.findUserById(e.body.userId))throw A.APIError.from("NOT_FOUND",E.BASE_ERROR_CODES.USER_NOT_FOUND);if(e.body.userId===e.context.session.user.id)throw A.APIError.from("BAD_REQUEST",u.YOU_CANNOT_BAN_YOURSELF);let i=await e.context.internalAdapter.updateUser(e.body.userId,{banned:!0,banReason:e.body.banReason||t?.defaultBanReason||"No reason",banExpires:e.body.banExpiresIn?(0,h.getDate)(e.body.banExpiresIn,"sec"):t?.defaultBanExpiresIn?(0,h.getDate)(t.defaultBanExpiresIn,"sec"):null,updatedAt:new Date});return await e.context.internalAdapter.deleteUserSessions(e.body.userId),e.json({user:(0,n.parseUserOutput)(e.context.options,i)})}),impersonateUser:(0,I.createAuthEndpoint)("/admin/impersonate-user",{method:"POST",body:L,use:[T],metadata:{openapi:{operationId:"impersonateUser",summary:"Impersonate a user",description:"Impersonate a user",responses:{200:{description:"Impersonation session created",content:{"application/json":{schema:{type:"object",properties:{session:{$ref:"#/components/schemas/Session"},user:{$ref:"#/components/schemas/User"}}}}}}}}}},async e=>{if(!w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["impersonate"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS);let r=await e.context.internalAdapter.findUserById(e.body.userId);if(!r)throw A.APIError.from("NOT_FOUND",E.BASE_ERROR_CODES.USER_NOT_FOUND);let i=(Array.isArray(t.adminRoles)?t.adminRoles:t.adminRoles?.split(",")||[]).map(e=>e.trim());if(((r.role||t.defaultRole||"user").split(",").some(e=>i.includes(e))||t.adminUserIds?.includes(r.id))&&!(!0===t.allowImpersonatingAdmins||w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["impersonate-admins"]}})))throw A.APIError.from("FORBIDDEN",u.YOU_CANNOT_IMPERSONATE_ADMINS);let o=await e.context.internalAdapter.createSession(r.id,!0,{impersonatedBy:e.context.session.user.id,expiresAt:t?.impersonationSessionDuration?(0,h.getDate)(t.impersonationSessionDuration,"sec"):(0,h.getDate)(3600,"sec")},!0);if(!o)throw A.APIError.from("INTERNAL_SERVER_ERROR",u.FAILED_TO_CREATE_USER);let a=e.context.authCookies;(0,m.deleteSessionCookie)(e);let s=await e.getSignedCookie(e.context.authCookies.dontRememberToken.name,e.context.secret),l=e.context.createAuthCookie("admin_session");return await e.setSignedCookie(l.name,`${e.context.session.session.token}:${s||""}`,e.context.secret,a.sessionToken.attributes),await (0,m.setSessionCookie)(e,{session:o,user:r},!0),e.json({session:o,user:(0,n.parseUserOutput)(e.context.options,r)})}),stopImpersonating:(0,I.createAuthEndpoint)("/admin/stop-impersonating",{method:"POST",requireHeaders:!0},async e=>{let t=await (0,g.getSessionFromCtx)(e);if(!t)throw A.APIError.fromStatus("UNAUTHORIZED");if(!t.session.impersonatedBy)throw A.APIError.fromStatus("BAD_REQUEST",{message:"You are not impersonating anyone"});let r=await e.context.internalAdapter.findUserById(t.session.impersonatedBy);if(!r)throw A.APIError.fromStatus("INTERNAL_SERVER_ERROR",{message:"Failed to find user"});let i=e.context.createAuthCookie("admin_session"),o=await e.getSignedCookie(i.name,e.context.secret);if(!o)throw A.APIError.fromStatus("INTERNAL_SERVER_ERROR",{message:"Failed to find admin session"});let[a,s]=o?.split(":"),l=await e.context.internalAdapter.findSession(a);if(!l||l.session.userId!==r.id)throw A.APIError.fromStatus("INTERNAL_SERVER_ERROR",{message:"Failed to find admin session"});return await e.context.internalAdapter.deleteSession(t.session.token),await (0,m.setSessionCookie)(e,l,!!s),(0,m.expireCookie)(e,i),e.json({session:(0,n.parseSessionOutput)(e.context.options,l.session),user:(0,n.parseUserOutput)(e.context.options,l.user)})}),revokeUserSession:(0,I.createAuthEndpoint)("/admin/revoke-user-session",{method:"POST",body:C,use:[T],metadata:{openapi:{operationId:"revokeUserSession",summary:"Revoke a user session",description:"Revoke a user session",responses:{200:{description:"Session revoked",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean"}}}}}}}}}},async e=>{let r=e.context.session;if(!w({userId:e.context.session.user.id,role:r.user.role,options:t,permissions:{session:["revoke"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS);return await e.context.internalAdapter.deleteSession(e.body.sessionToken),e.json({success:!0})}),revokeUserSessions:(0,I.createAuthEndpoint)("/admin/revoke-user-sessions",{method:"POST",body:q,use:[T],metadata:{openapi:{operationId:"revokeUserSessions",summary:"Revoke all user sessions",description:"Revoke all user sessions",responses:{200:{description:"Sessions revoked",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean"}}}}}}}}}},async e=>{let r=e.context.session;if(!w({userId:e.context.session.user.id,role:r.user.role,options:t,permissions:{session:["revoke"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS);return await e.context.internalAdapter.deleteUserSessions(e.body.userId),e.json({success:!0})}),removeUser:(0,I.createAuthEndpoint)("/admin/remove-user",{method:"POST",body:B,use:[T],metadata:{openapi:{operationId:"removeUser",summary:"Remove a user",description:"Delete a user and all their sessions and accounts. Cannot be undone.",responses:{200:{description:"User removed",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean"}}}}}}}}}},async e=>{let r=e.context.session;if(!w({userId:e.context.session.user.id,role:r.user.role,options:t,permissions:{user:["delete"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS);if(e.body.userId===e.context.session.user.id)throw A.APIError.from("BAD_REQUEST",u.YOU_CANNOT_REMOVE_YOURSELF);if(!await e.context.internalAdapter.findUserById(e.body.userId))throw A.APIError.from("NOT_FOUND",E.BASE_ERROR_CODES.USER_NOT_FOUND);return await e.context.internalAdapter.deleteUserSessions(e.body.userId),await e.context.internalAdapter.deleteUser(e.body.userId),e.json({success:!0})}),setUserPassword:(0,I.createAuthEndpoint)("/admin/set-user-password",{method:"POST",body:j,use:[T],metadata:{openapi:{operationId:"setUserPassword",summary:"Set a user's password",description:"Set a user's password",responses:{200:{description:"Password set",content:{"application/json":{schema:{type:"object",properties:{status:{type:"boolean"}}}}}}}}}},async e=>{if(!w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["set-password"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD);let{newPassword:r,userId:i}=e.body,o=e.context.password.config.minPasswordLength;if(r.length<o)throw e.context.logger.warn("Password is too short"),A.APIError.from("BAD_REQUEST",E.BASE_ERROR_CODES.PASSWORD_TOO_SHORT);let n=e.context.password.config.maxPasswordLength;if(r.length>n)throw e.context.logger.warn("Password is too long"),A.APIError.from("BAD_REQUEST",E.BASE_ERROR_CODES.PASSWORD_TOO_LONG);let a=await e.context.internalAdapter.findUserById(i);if(!a)throw A.APIError.from("NOT_FOUND",E.BASE_ERROR_CODES.USER_NOT_FOUND);let s=await e.context.password.hash(r);return await e.context.internalAdapter.findCredentialAccount(i)?await e.context.internalAdapter.updatePassword(i,s):await e.context.internalAdapter.createAccount({userId:i,providerId:"credential",issuer:(0,y.createLocalAccountIssuer)("credential"),accountId:a.id,password:s}),e.json({status:!0})}),userHasPermission:(0,I.createAuthEndpoint)("/admin/has-permission",{method:"POST",body:$,metadata:{openapi:{description:"Check if the user has permission",requestBody:{content:{"application/json":{schema:{type:"object",properties:{permissions:{type:"object",description:"The permission to check"}},required:["permissions"]}}}},responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{error:{type:"string"},success:{type:"boolean"}},required:["success"]}}}}}},$Infer:{body:{}}}},async e=>{if(!e.body?.permissions)throw new A.APIError("BAD_REQUEST",{message:"invalid permission check. no permission(s) were passed."});let r=await (0,g.getAuthoritativeSessionFromCtx)(e);if(!r&&(e.request||e.headers))throw new A.APIError("UNAUTHORIZED");if(!r&&!e.body.userId&&!e.body.role)throw new A.APIError("BAD_REQUEST",{message:"user id or role is required"});let i=r?.user||(e.body.role?{id:e.body.userId||"",role:e.body.role}:null)||(e.body.userId?await e.context.internalAdapter.findUserById(e.body.userId):null);if(!i)throw new A.APIError("BAD_REQUEST",{message:"user not found"});let o=w({userId:i.id,role:i.role,options:t,permissions:e.body.permissions});return e.json({error:null,success:o})})},$ERROR_CODES:u,schema:(0,n.mergeSchema)(V,t.schema),options:e}})({ac:eO,roles:{user:ex},defaultRole:"user",adminRoles:["user"]}),{setRole:t,banUser:r,unbanUser:i,impersonateUser:o,stopImpersonating:s,removeUser:l,...d}=e.endpoints;return{...e,endpoints:d}}(),(0,t.apiKey)({schema:{apikey:{modelName:"ApiKey"}},defaultPrefix:"aide_",requireName:!0,startingCharactersConfig:{shouldStore:!0,charactersLength:12},keyExpiration:{defaultExpiresIn:null,disableCustomExpiresTime:!1,minExpiresIn:1,maxExpiresIn:3650},rateLimit:{enabled:!1},enableSessionForAPIKeys:!1}),{id:"bearer",version:a.PACKAGE_VERSION,hooks:{before:[{matcher:e=>!!(e.request?.headers.get("authorization")||e.headers?.get("authorization")),handler:(0,I.createAuthMiddleware)(async e=>{let t,r=e.request?.headers.get("authorization")||e.headers?.get("Authorization");if(!r||"bearer "!==r.slice(0,7).toLowerCase())return;let i=r.slice(7).trim();if(!i)return;t=i.includes(".")?i.includes("%")?K(i):i:K((await (0,F.serializeSignedCookie)("",i,e.context.secret)).replace("=",""));try{if(!await (0,H.createHMAC)("SHA-256","base64urlnopad").verify(e.context.secret,t.split(".")[0],t.split(".")[1]))return}catch{return}let o=e.request?.headers||e.headers,n=new Headers({...Object.fromEntries(o?.entries())});return(0,M.setRequestCookie)(n,e.context.authCookies.sessionToken.name,t),{context:{headers:n}}})}],after:[{matcher:e=>!0,handler:(0,I.createAuthMiddleware)(async e=>{let t=e.context.responseHeaders?.get("set-cookie");if(!t)return;let r=(0,M.parseSetCookieHeader)(t),i=e.context.authCookies.sessionToken.name,o=r.get(i);if(!o||!o.value||0===o["max-age"])return;let n=o.value,a=new Set((e.context.responseHeaders?.get("access-control-expose-headers")||"").split(",").map(e=>e.trim()).filter(Boolean));a.add("set-auth-token"),e.setHeader("set-auth-token",n),e.setHeader("Access-Control-Expose-Headers",Array.from(a).join(", "))})}]},options:void 0},(e=>{let t={storeToken:"plain",...e};async function r(e,r){return"hashed"===t.storeToken?await ea(r):"object"==typeof t.storeToken&&"type"in t.storeToken&&"custom-hasher"===t.storeToken.type?await t.storeToken.hash(r):r}async function i(e,i){let o=t?.generateToken?await t.generateToken(i,e):(0,ei.generateRandomString)(32),n=new Date(Date.now()+(t?.expiresIn??3)*6e4),a=await r(e,o);return await e.context.internalAdapter.createVerificationValue({value:i.session.token,identifier:`one-time-token:${a}`,expiresAt:n}),o}return{id:"one-time-token",version:a.PACKAGE_VERSION,endpoints:{generateOneTimeToken:(0,I.createAuthEndpoint)("/one-time-token/generate",{method:"GET",use:[g.sessionMiddleware]},async e=>{if(t?.disableClientRequest&&e.request)throw e.error("BAD_REQUEST",{message:"Client requests are disabled"});let r=e.context.session,o=await i(e,r);return e.json({token:o})}),verifyOneTimeToken:(0,I.createAuthEndpoint)("/one-time-token/verify",{method:"POST",body:es},async e=>{let{token:i}=e.body,o=await r(e,i),n=await e.context.internalAdapter.consumeVerificationValue(`one-time-token:${o}`);if(!n)throw e.error("BAD_REQUEST",{message:"Invalid token"});let a=await e.context.internalAdapter.findSession(n.value);if(!a)throw e.error("BAD_REQUEST",{message:"Session not found"});if(t?.disableSetSessionCookie||await (0,m.setSessionCookie)(e,a),a.session.expiresAt<new Date)throw e.error("BAD_REQUEST",{message:"Session expired"});return e.json(a)})},hooks:{after:[{matcher:()=>!0,handler:(0,I.createAuthMiddleware)(async e=>{if(e.context.newSession){if(!t?.setOttHeaderOnNewSession)return;let r=new Set((e.context.responseHeaders?.get("access-control-expose-headers")||"").split(",").map(e=>e.trim()).filter(Boolean));r.add("set-ott");let o=await i(e,e.context.newSession);e.setHeader("set-ott",o),e.setHeader("Access-Control-Expose-Headers",Array.from(r).join(", "))}})}]},options:e}})({disableClientRequest:!0,expiresIn:1,storeToken:"hashed"}),...l?[l]:[],(0,o.nextCookies)()]})})(e))),eD}e.s(["getAuth",0,eP],576257);class eN extends Error{status;constructor(e,t=401){super(e),this.status=t,this.name="PrincipalResolutionError"}}function eL(e){return/(?:^|;\s*)(?:__Secure-)?better-auth\.session_token=/.test(e.get("cookie")??"")}async function eC(e,t){let r=e.get("x-api-key")?.trim()||null,i=function(e){let t=e.get("authorization");if(!t)return null;if(!t.startsWith("Bearer "))throw new eN("Authorization must use the Bearer scheme.");let r=t.slice(7).trim();if(!r)throw new eN("The bearer credential is empty.");return r}(e),o=eL(e);if(Number(!!r)+Number(!!i)+Number(o)>1)throw new eN("Provide exactly one application credential.",400);if(r){let e=await eP(),t=await e.api.verifyApiKey({body:{key:r}});if(!t.valid||!t.key)throw new eN("The API key is invalid or inactive.");return{kind:"apiKey",apiKeyId:t.key.id,userId:t.key.referenceId,name:t.key.name??null}}if(i?.startsWith("agent_")){if(!t)throw new eN("Agent credentials are not accepted by this endpoint.");let e=await t.authenticate(i);if(!e)throw new eN("The agent credential is invalid.");return{kind:"agent",agentId:e}}if(i||o){let t=await eP(),r=await t.api.getSession({headers:e});if(!r?.session||!r.user)throw new eN("The session is invalid or expired.");return{kind:"user",userId:r.user.id,email:r.user.email,sessionId:r.session.id}}return{kind:"anonymous"}}async function eq(e){let t=await eC(e);if("user"!==t.kind)throw new eN("A user session is required.");return t}e.s(["PrincipalResolutionError",0,eN,"principalErrorResponse",0,function(e){return Response.json({error:{code:"AUTHENTICATION_REQUIRED",message:e.message}},{status:e.status,headers:{"www-authenticate":"Bearer"}})},"requireUserPrincipal",0,eq,"resolveRequestPrincipal",0,eC,"usesAmbientCredential",0,function(e){return eL(e)&&!e.get("x-api-key")?.trim()&&!e.get("authorization")?.trim()}],354470)},406315,e=>{"use strict";var t=e.i(303361),r=e.i(169040),i=e.i(354470);function o(e){return!(0,i.usesAmbientCredential)(e.headers)||(0,t.isSameOriginRequest)(e,(0,r.getAuthRuntimeConfig)().trustProxyHeaders)?null:Response.json({error:{code:"CROSS_ORIGIN_REQUEST",message:"A session-authenticated request must come from this site. Use an API key for cross-origin access."}},{status:403})}async function n(e){let t=o(e);if(t)return t;try{return await (0,i.requireUserPrincipal)(e.headers),null}catch(e){if(e instanceof i.PrincipalResolutionError)return(0,i.principalErrorResponse)(e);throw e}}e.s(["crossOriginError",0,o,"requireUserRequest",0,n])},406478,e=>{"use strict";e.i(576257),e.i(169040),e.i(406315),e.i(354470),e.i(464661),e.s([])}];
+  `){if(!await r.user.findUnique({where:{id:e},select:{id:!0}}))throw new A.APIError("NOT_FOUND",{message:"User not found."});throw new A.APIError("BAD_REQUEST",{message:"The final account cannot be deleted."})}}async function eU({allowWhenRegistrationClosed:e=!1}={}){let t=await (0,ec.getPrismaClient)(),r=await eT();if(r.bootstrapCompleted){if(!r.registrationEnabled&&!e)throw new A.APIError("FORBIDDEN",{message:"Account registration is disabled."});return}if(await t.user.count()>0){if(await t.authSettings.update({where:{id:eR},data:{bootstrapCompleted:!0,registrationEnabled:!1,bootstrapClaimId:null,bootstrapClaimedAt:null}}),e)return;throw new A.APIError("FORBIDDEN",{message:"Account registration is disabled."})}let i=new Date(Date.now()-18e4),o=(0,e_.randomUUID)();if(1!==(await t.authSettings.updateMany({where:{id:eR,bootstrapCompleted:!1,OR:[{bootstrapClaimedAt:null},{bootstrapClaimedAt:{lt:i}}]},data:{bootstrapClaimId:o,bootstrapClaimedAt:new Date}})).count)throw new A.APIError("CONFLICT",{message:"The initial account is already being created. Try again shortly."})}async function eO(){let e=await (0,ec.getPrismaClient)();await e.authSettings.updateMany({where:{id:eR,bootstrapCompleted:!1},data:{bootstrapCompleted:!0,registrationEnabled:!1,bootstrapClaimId:null,bootstrapClaimedAt:null}})}let ex={user:{create:{before:async(e,t)=>(await eU({allowWhenRegistrationClosed:t?.path?.includes("/admin/create-user")??!1}),{data:{...e,role:"user",banned:!1,banReason:null,banExpires:null}}),after:async()=>{await eO()}},update:{before:async e=>({data:{...e,role:"user",banned:!1,banReason:null,banExpires:null}})},delete:{before:async()=>{throw new A.APIError("BAD_REQUEST",{message:"Accounts must be deleted through the management API."})}}}};e.s(["authDatabaseHooks",0,ex,"deleteManagedUser",0,ev,"getRegistrationStatus",0,eS,"setRegistrationEnabled",0,ek],464661);let eD={user:["create","list","set-password","set-email","get","update"],session:["list","revoke","delete"]},eP=(0,s.createAccessControl)(eD),eN=eP.newRole(eD),eL=null;function eC(){return eL||(eL=(0,ec.getPrismaClient)().then(e=>(function(e,s=ef()){let l=s.provider,d=l?.providerId.toLowerCase()==="github"?l.userInfoUrl:void 0,p=em(s.mode)&&l?(e=>{let t=new Set,r=new Set;for(let i of e.config){let e=i.providerId;t.has(e)&&r.add(e),t.add(e)}return r.size>0&&console.warn(`Duplicate provider IDs found: ${Array.from(r).join(", ")}`),{id:"generic-oauth",version:a.PACKAGE_VERSION,init:async t=>{let r=[];for(let i of e.config){let e,o,n=i.authorizationUrl,a=i.tokenUrl,s=i.userInfoUrl,l=i.endSessionEndpoint,c=!1;if(i.discoveryUrl){let r=await et(i.discoveryUrl,i.discoveryHeaders).catch(e=>(t.logger.error(`Discovery fetch failed for "${i.providerId}": ${e}`),null));if(r){if(!r.issuer&&!i.accountIssuer)throw Error(`Provider "${i.providerId}": discovery did not return an issuer. Configure accountIssuer explicitly to establish a stable account namespace.`);n??=r.authorization_endpoint,a??=r.token_endpoint,s??=r.userinfo_endpoint,l??=r.end_session_endpoint,e=r.issuer;let t=r.id_token_signing_alg_values_supported;if(c=Array.isArray(t)&&t.length>0,r.jwks_uri&&r.issuer){let e;try{e=new URL(r.jwks_uri,i.discoveryUrl)}catch{throw Error(`Provider "${i.providerId}": invalid jwks_uri "${r.jwks_uri}" in discovery document.`)}o={jwks:(0,ee.createRemoteJWKSet)(e),issuer:r.issuer,audience:i.clientId,algorithms:c?t:void 0}}}else if(i.accountIssuer)n&&a||t.logger.error(`Provider "${i.providerId}": discovery returned no data and no explicit endpoints configured. OAuth sign-in will fail for this provider.`);else throw Error(`Provider "${i.providerId}": discovery returned no valid data. Provider initialization stopped to keep its account issuer stable.`)}if(i.requireIdTokenVerification&&!o)throw Error(`Provider "${i.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri.`);let d=i.tokenEndpointAuth;if(i.clientSecret&&(d?.method==="private_key_jwt"||d?.method==="none"))throw Error(`Provider "${i.providerId}": tokenEndpointAuth.method "${d?.method}" cannot be combined with clientSecret`);if(!i.clientSecret&&(d?.method==="client_secret_basic"||d?.method==="client_secret_post"))throw Error(`Provider "${i.providerId}": tokenEndpointAuth.method "${d?.method}" requires clientSecret`);if(!i.clientSecret&&!d&&"basic"===i.authentication)throw Error(`Provider "${i.providerId}": authentication "basic" requires clientSecret`);let u=i.accountSubject,p=i.accountIssuer,f={id:i.providerId,name:i.name??i.providerId,issuer:e,accountSubject:({tokens:e,profile:t})=>u?u({tokens:e,profile:t}):c?t.sub??"":t.id??"",accountIssuer:"function"==typeof p?({tokens:e,profile:t})=>p({tokens:e,profile:t}):p??e,idToken:o,requiresIdTokenNonce:void 0!==o&&!0!==i.disableIdTokenNonceBinding,allowIdpInitiated:i.allowIdpInitiated,async createEndSessionURL(e){let r;if(i.disableProviderLogout||!l)return null;try{r=new URL(l)}catch{return null}e.idToken&&r.searchParams.set("id_token_hint",e.idToken);let o=e.postLogoutRedirectURI??i.postLogoutRedirectURI,n=o?new URL(o,t.baseURL).toString():void 0;return n?(r.searchParams.set("post_logout_redirect_uri",n),r.searchParams.set("client_id",i.clientId),e.state&&r.searchParams.set("state",e.state)):e.idToken||r.searchParams.set("client_id",i.clientId),r},createAuthorizationURL(e){if(!n)throw A.APIError.from("BAD_REQUEST",z.INVALID_OAUTH_CONFIGURATION);return(0,Q.createAuthorizationURL)({id:i.providerId,options:{clientId:i.clientId,clientSecret:i.clientSecret,redirectURI:i.redirectURI},authorizationEndpoint:n,state:e.state,codeVerifier:i.pkce??!0?e.codeVerifier:void 0,scopes:(()=>{let t=[...e.scopes??[],...i.scopes??[]];return c&&!t.includes("openid")&&t.unshift("openid"),t})(),redirectURI:e.redirectURI,prompt:i.prompt,accessType:i.accessType,responseType:i.responseType,responseMode:i.responseMode,nonce:e.idTokenNonce,additionalParams:{...i.authorizationUrlParams??{},...e.additionalParams??{}},loginHint:e.loginHint})},async validateAuthorizationCode(e){if(i.getToken)return(0,G.applyDefaultAccessTokenExpiry)(await i.getToken(e),i.accessTokenExpiresIn);if(!a)throw A.APIError.from("BAD_REQUEST",z.TOKEN_URL_NOT_FOUND);return(0,G.applyDefaultAccessTokenExpiry)(await (0,Z.validateAuthorizationCode)({headers:i.authorizationHeaders,code:e.code,codeVerifier:i.pkce??!0?e.codeVerifier:void 0,redirectURI:e.redirectURI,options:{clientId:i.clientId,clientSecret:i.clientSecret,redirectURI:i.redirectURI},tokenEndpoint:a,authentication:i.authentication,tokenEndpointAuth:d,additionalParams:i.tokenUrlParams}),i.accessTokenExpiresIn)},async getUserInfo(e){let{expectedIdTokenNonce:r,...o}=e;if(o.idToken&&f.idToken&&!await (0,X.verifyProviderIdToken)(f,o.idToken,r))return t.logger.error(`Provider "${i.providerId}": id_token failed verification against the discovery JWKS or expected nonce`),null;let n=i.getUserInfo?await i.getUserInfo(o):await er(o,s);if(!n)return null;let a=i.mapProfileToUser?await i.mapProfileToUser(n):{},l={email:n.email,emailVerified:n.emailVerified,image:n.image,name:n.name,...a};return{user:{...l,image:l.image??void 0},data:n}},async refreshAccessToken(e,t){if(!a)throw A.APIError.from("BAD_REQUEST",z.TOKEN_URL_NOT_FOUND);let r="function"==typeof i.refreshTokenParams?await i.refreshTokenParams(t):i.refreshTokenParams;return(0,G.applyDefaultAccessTokenExpiry)(await (0,J.refreshAccessToken)({refreshToken:e,options:{clientId:i.clientId,clientSecret:i.clientSecret},authentication:i.authentication,tokenEndpointAuth:d,tokenEndpoint:a,extraParams:r}),i.accessTokenExpiresIn)},disableImplicitSignUp:i.disableImplicitSignUp,disableSignUp:i.disableSignUp,options:{disableSignUp:i.disableSignUp,overrideUserInfoOnSignIn:i.overrideUserInfo,requireEmailVerification:i.requireEmailVerification}};r.push(f)}let i=new Set(t.socialProviders.map(e=>e.id));for(let e of r)i.has(e.id)&&t.logger.warn(`Generic OAuth provider "${e.id}" shadows a built-in social provider with the same ID`);return{context:{socialProviders:r.concat(t.socialProviders)}}},options:e,$ERROR_CODES:z}})({config:[{providerId:l.providerId,clientId:l.clientId,clientSecret:l.clientSecret,scopes:l.scopes,discoveryUrl:l.discoveryUrl,accountIssuer:`local:oauth:${l.providerId}`,authorizationUrl:l.authorizationUrl,tokenUrl:l.tokenUrl,userInfoUrl:l.userInfoUrl,getUserInfo:d?async e=>e.accessToken?eI(d,e.accessToken):null:void 0,pkce:!0,requireIdTokenVerification:l.requireIssuerValidation,disableImplicitSignUp:!1}]}):null;return(0,i.betterAuth)({appName:"AI Development Environment",baseURL:(0,el.betterAuthBaseURL)(s.origins),trustedOrigins:e=>{if(!e)return[];let t=(0,el.originFromRequest)(e,s.trustProxyHeaders);return t&&(0,el.isTrustedOrigin)(s.origins,t)?[t]:[]},secret:s.secret,logger:{log:eA},advanced:{trustedProxyHeaders:s.trustProxyHeaders},database:(0,r.prismaAdapter)(e,{provider:"sqlite"}),emailAndPassword:{enabled:eh(s.mode),requireEmailVerification:!1},account:{accountLinking:{enabled:!0,disableImplicitLinking:!0,allowDifferentEmails:!1}},databaseHooks:ex,plugins:[function(){let e=(e=>{let t={...e||{},defaultRole:e?.defaultRole??"user",adminRoles:e?.adminRoles??["admin"],bannedUserMessage:e?.bannedUserMessage??"You have been banned from this application. Please contact support if you believe this is an error."};if(e?.adminRoles){let t=(Array.isArray(e.adminRoles)?e.adminRoles:[...e.adminRoles.split(",")]).filter(t=>!Object.keys(e?.roles||c).map(e=>e.toLowerCase()).includes(t.toLowerCase()));if(t.length>0)throw new A.BetterAuthError(`Invalid admin roles: ${t.join(", ")}. Admin roles must be defined in the 'roles' configuration.`)}return{id:"admin",version:a.PACKAGE_VERSION,init:()=>({options:{databaseHooks:{user:{create:{before:async t=>({data:{role:e?.defaultRole??"user",...t}})}},session:{create:{async before(e,r){if(!r)return;let i=await r.context.internalAdapter.findUserById(e.userId);if(i?.banned){if(i.banExpires&&new Date(i.banExpires).getTime()<Date.now())return void await r.context.internalAdapter.updateUser(e.userId,{banned:!1,banReason:null,banExpires:null});throw A.APIError.from("FORBIDDEN",{message:t.bannedUserMessage,code:"BANNED_USER"})}}}}}}}),hooks:{after:[{matcher:e=>"/list-sessions"===e.path,handler:(0,I.createAuthMiddleware)(async e=>{let t=await f(e);if(!t)return;let r=t.filter(e=>!e.impersonatedBy);return e.json(r)})}]},endpoints:{setRole:(0,I.createAuthEndpoint)("/admin/set-role",{method:"POST",body:k,requireHeaders:!0,use:[T],metadata:{openapi:{operationId:"setUserRole",summary:"Set the role of a user",description:"Set the role of a user",responses:{200:{description:"User role updated",content:{"application/json":{schema:{type:"object",properties:{user:{$ref:"#/components/schemas/User"}}}}}}}},$Infer:{body:{}}}},async e=>{if(!w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["set-role"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE);let r=t.roles;if(r){for(let t of Array.isArray(e.body.role)?e.body.role:[e.body.role])if(!r[t])throw A.APIError.from("BAD_REQUEST",u.YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE)}if(!await e.context.internalAdapter.findUserById(e.body.userId))throw A.APIError.from("NOT_FOUND",E.BASE_ERROR_CODES.USER_NOT_FOUND);let i=await e.context.internalAdapter.updateUser(e.body.userId,{role:S(e.body.role)});return e.json({user:(0,n.parseUserOutput)(e.context.options,i)})}),getUser:(0,I.createAuthEndpoint)("/admin/get-user",{method:"GET",query:v,use:[T],metadata:{openapi:{operationId:"getUser",summary:"Get an existing user",description:"Get an existing user",responses:{200:{description:"User",content:{"application/json":{schema:{type:"object",properties:{user:{$ref:"#/components/schemas/User"}}}}}}}}}},async e=>{let{id:r}=e.query;if(!w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["get"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_GET_USER);let i=await e.context.internalAdapter.findUserById(r);if(!i)throw A.APIError.from("NOT_FOUND",E.BASE_ERROR_CODES.USER_NOT_FOUND);return(0,n.parseUserOutput)(e.context.options,i)}),createUser:(0,I.createAuthEndpoint)("/admin/create-user",{method:"POST",body:U,metadata:{openapi:{operationId:"createUser",summary:"Create a new user",description:"Create a new user",responses:{200:{description:"User created",content:{"application/json":{schema:{type:"object",properties:{user:{$ref:"#/components/schemas/User"}}}}}}}},$Infer:{body:{}}}},async e=>{let r=await (0,g.getAuthoritativeSessionFromCtx)(e);if(!r&&(e.request||e.headers))throw e.error("UNAUTHORIZED");if(r&&!w({userId:r.user.id,role:r.user.role,options:t,permissions:{user:["create"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS);let{role:i,...o}=e.body.data??{},a=e.body.role??i;if(void 0!==a){if(r&&!w({userId:r.user.id,role:r.user.role,options:t,permissions:{user:["set-role"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE);for(let e of Array.isArray(a)?a:[a]){if("string"!=typeof e)throw A.APIError.from("BAD_REQUEST",u.INVALID_ROLE_TYPE);if(t.roles&&!t.roles[e])throw A.APIError.from("BAD_REQUEST",u.YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE)}}if(r&&["banned","banReason","banExpires"].some(e=>Object.prototype.hasOwnProperty.call(o,e))&&!w({userId:r.user.id,role:r.user.role,options:t,permissions:{user:["ban"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_BAN_USERS);let s=e.body.email.toLowerCase();if(!_.email().safeParse(s).success)throw A.APIError.from("BAD_REQUEST",E.BASE_ERROR_CODES.INVALID_EMAIL);if(await e.context.internalAdapter.findUserByEmail(s))throw A.APIError.from("BAD_REQUEST",u.USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL);let l=await e.context.internalAdapter.createUser({...o,email:s,name:e.body.name,role:void 0!==a?S(a):t?.defaultRole??"user"},{method:"admin"});if(!l)throw A.APIError.from("INTERNAL_SERVER_ERROR",u.FAILED_TO_CREATE_USER);if(e.body.password){let t=await e.context.password.hash(e.body.password);await e.context.internalAdapter.linkAccount({providerId:"credential",issuer:(0,y.createLocalAccountIssuer)("credential"),accountId:l.id,password:t,userId:l.id})}return e.json({user:(0,n.parseUserOutput)(e.context.options,l)})}),adminUpdateUser:(0,I.createAuthEndpoint)("/admin/update-user",{method:"POST",body:O,use:[T],metadata:{openapi:{operationId:"adminUpdateUser",summary:"Update a user",description:"Update a user's details",responses:{200:{description:"User updated",content:{"application/json":{schema:{type:"object",properties:{user:{$ref:"#/components/schemas/User"}}}}}}}}}},async e=>{if(!w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["update"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS);if(0===Object.keys(e.body.data).length)throw A.APIError.from("BAD_REQUEST",u.NO_DATA_TO_UPDATE);let r=e.body.data,i=e=>Object.prototype.hasOwnProperty.call(r,e);if(i("password"))throw A.APIError.from("BAD_REQUEST",u.PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER);if(Object.prototype.hasOwnProperty.call(e.body.data,"role")){if(!w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["set-role"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE);let r=e.body.data.role,i=Array.isArray(r)?r:[r];for(let e of i){if("string"!=typeof e)throw A.APIError.from("BAD_REQUEST",u.INVALID_ROLE_TYPE);if(t.roles&&!t.roles[e])throw A.APIError.from("BAD_REQUEST",u.YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE)}e.body.data.role=S(i)}if(["banned","banReason","banExpires"].some(i)){if(!w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["ban"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_BAN_USERS);if(!0===r.banned&&e.body.userId===e.context.session.user.id)throw A.APIError.from("BAD_REQUEST",u.YOU_CANNOT_BAN_YOURSELF)}if(i("email")||i("emailVerified")){if(!w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["set-email"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL);if(i("email")){let t=String(r.email).toLowerCase();if(!_.email().safeParse(t).success)throw A.APIError.from("BAD_REQUEST",E.BASE_ERROR_CODES.INVALID_EMAIL);let i=await e.context.internalAdapter.findUserByEmail(t);if(i&&i.user.id!==e.body.userId)throw A.APIError.from("BAD_REQUEST",u.USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL);r.email=t}}if(!await e.context.internalAdapter.findUserById(e.body.userId))throw A.APIError.from("NOT_FOUND",E.BASE_ERROR_CODES.USER_NOT_FOUND);let o=await e.context.internalAdapter.updateUser(e.body.userId,e.body.data);return!0===r.banned&&await e.context.internalAdapter.deleteUserSessions(e.body.userId),e.json((0,n.parseUserOutput)(e.context.options,o))}),listUsers:(0,I.createAuthEndpoint)("/admin/list-users",{method:"GET",use:[T],query:x,metadata:{openapi:{operationId:"listUsers",summary:"List users",description:"List users",responses:{200:{description:"List of users",content:{"application/json":{schema:{type:"object",properties:{users:{type:"array",items:{$ref:"#/components/schemas/User"}},total:{type:"number"},limit:{type:"number"},offset:{type:"number"}},required:["users","total"]}}}}}}}},async e=>{let r=e.context.session;if(!w({userId:e.context.session.user.id,role:r.user.role,options:t,permissions:{user:["list"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_LIST_USERS);let i=[];e.query?.searchValue&&i.push({field:e.query.searchField||"email",operator:e.query.searchOperator||"contains",value:e.query.searchValue}),e.query?.filterValue!==void 0&&i.push({field:e.query.filterField||"email",operator:e.query.filterOperator||"eq",value:e.query.filterValue});try{let t=await e.context.internalAdapter.listUsers(Number(e.query?.limit)||void 0,Number(e.query?.offset)||void 0,e.query?.sortBy?{field:e.query.sortBy,direction:e.query.sortDirection||"asc"}:void 0,i.length?i:void 0),r=await e.context.internalAdapter.countTotalUsers(i.length?i:void 0);return e.json({users:t.map(t=>(0,n.parseUserOutput)(e.context.options,t)),total:r,limit:Number(e.query?.limit)||void 0,offset:Number(e.query?.offset)||void 0})}catch{return e.json({users:[],total:0})}}),listUserSessions:(0,I.createAuthEndpoint)("/admin/list-user-sessions",{method:"POST",use:[T],body:D,metadata:{openapi:{operationId:"adminListUserSessions",summary:"List user sessions",description:"List user sessions",responses:{200:{description:"List of user sessions",content:{"application/json":{schema:{type:"object",properties:{sessions:{type:"array",items:{$ref:"#/components/schemas/Session"}}}}}}}}}}},async e=>{let r=e.context.session;if(!w({userId:e.context.session.user.id,role:r.user.role,options:t,permissions:{session:["list"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS);let i=await e.context.internalAdapter.listSessions(e.body.userId);return e.json({sessions:i.map(t=>(0,n.parseSessionOutput)(e.context.options,t))})}),unbanUser:(0,I.createAuthEndpoint)("/admin/unban-user",{method:"POST",body:P,use:[T],metadata:{openapi:{operationId:"unbanUser",summary:"Unban a user",description:"Unban a user",responses:{200:{description:"User unbanned",content:{"application/json":{schema:{type:"object",properties:{user:{$ref:"#/components/schemas/User"}}}}}}}}}},async e=>{let r=e.context.session;if(!w({userId:e.context.session.user.id,role:r.user.role,options:t,permissions:{user:["ban"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_BAN_USERS);if(!await e.context.internalAdapter.findUserById(e.body.userId))throw A.APIError.from("NOT_FOUND",E.BASE_ERROR_CODES.USER_NOT_FOUND);let i=await e.context.internalAdapter.updateUser(e.body.userId,{banned:!1,banExpires:null,banReason:null,updatedAt:new Date});return e.json({user:(0,n.parseUserOutput)(e.context.options,i)})}),banUser:(0,I.createAuthEndpoint)("/admin/ban-user",{method:"POST",body:N,use:[T],metadata:{openapi:{operationId:"banUser",summary:"Ban a user",description:"Ban a user",responses:{200:{description:"User banned",content:{"application/json":{schema:{type:"object",properties:{user:{$ref:"#/components/schemas/User"}}}}}}}}}},async e=>{let r=e.context.session;if(!w({userId:e.context.session.user.id,role:r.user.role,options:t,permissions:{user:["ban"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_BAN_USERS);if(!await e.context.internalAdapter.findUserById(e.body.userId))throw A.APIError.from("NOT_FOUND",E.BASE_ERROR_CODES.USER_NOT_FOUND);if(e.body.userId===e.context.session.user.id)throw A.APIError.from("BAD_REQUEST",u.YOU_CANNOT_BAN_YOURSELF);let i=await e.context.internalAdapter.updateUser(e.body.userId,{banned:!0,banReason:e.body.banReason||t?.defaultBanReason||"No reason",banExpires:e.body.banExpiresIn?(0,h.getDate)(e.body.banExpiresIn,"sec"):t?.defaultBanExpiresIn?(0,h.getDate)(t.defaultBanExpiresIn,"sec"):null,updatedAt:new Date});return await e.context.internalAdapter.deleteUserSessions(e.body.userId),e.json({user:(0,n.parseUserOutput)(e.context.options,i)})}),impersonateUser:(0,I.createAuthEndpoint)("/admin/impersonate-user",{method:"POST",body:L,use:[T],metadata:{openapi:{operationId:"impersonateUser",summary:"Impersonate a user",description:"Impersonate a user",responses:{200:{description:"Impersonation session created",content:{"application/json":{schema:{type:"object",properties:{session:{$ref:"#/components/schemas/Session"},user:{$ref:"#/components/schemas/User"}}}}}}}}}},async e=>{if(!w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["impersonate"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS);let r=await e.context.internalAdapter.findUserById(e.body.userId);if(!r)throw A.APIError.from("NOT_FOUND",E.BASE_ERROR_CODES.USER_NOT_FOUND);let i=(Array.isArray(t.adminRoles)?t.adminRoles:t.adminRoles?.split(",")||[]).map(e=>e.trim());if(((r.role||t.defaultRole||"user").split(",").some(e=>i.includes(e))||t.adminUserIds?.includes(r.id))&&!(!0===t.allowImpersonatingAdmins||w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["impersonate-admins"]}})))throw A.APIError.from("FORBIDDEN",u.YOU_CANNOT_IMPERSONATE_ADMINS);let o=await e.context.internalAdapter.createSession(r.id,!0,{impersonatedBy:e.context.session.user.id,expiresAt:t?.impersonationSessionDuration?(0,h.getDate)(t.impersonationSessionDuration,"sec"):(0,h.getDate)(3600,"sec")},!0);if(!o)throw A.APIError.from("INTERNAL_SERVER_ERROR",u.FAILED_TO_CREATE_USER);let a=e.context.authCookies;(0,m.deleteSessionCookie)(e);let s=await e.getSignedCookie(e.context.authCookies.dontRememberToken.name,e.context.secret),l=e.context.createAuthCookie("admin_session");return await e.setSignedCookie(l.name,`${e.context.session.session.token}:${s||""}`,e.context.secret,a.sessionToken.attributes),await (0,m.setSessionCookie)(e,{session:o,user:r},!0),e.json({session:o,user:(0,n.parseUserOutput)(e.context.options,r)})}),stopImpersonating:(0,I.createAuthEndpoint)("/admin/stop-impersonating",{method:"POST",requireHeaders:!0},async e=>{let t=await (0,g.getSessionFromCtx)(e);if(!t)throw A.APIError.fromStatus("UNAUTHORIZED");if(!t.session.impersonatedBy)throw A.APIError.fromStatus("BAD_REQUEST",{message:"You are not impersonating anyone"});let r=await e.context.internalAdapter.findUserById(t.session.impersonatedBy);if(!r)throw A.APIError.fromStatus("INTERNAL_SERVER_ERROR",{message:"Failed to find user"});let i=e.context.createAuthCookie("admin_session"),o=await e.getSignedCookie(i.name,e.context.secret);if(!o)throw A.APIError.fromStatus("INTERNAL_SERVER_ERROR",{message:"Failed to find admin session"});let[a,s]=o?.split(":"),l=await e.context.internalAdapter.findSession(a);if(!l||l.session.userId!==r.id)throw A.APIError.fromStatus("INTERNAL_SERVER_ERROR",{message:"Failed to find admin session"});return await e.context.internalAdapter.deleteSession(t.session.token),await (0,m.setSessionCookie)(e,l,!!s),(0,m.expireCookie)(e,i),e.json({session:(0,n.parseSessionOutput)(e.context.options,l.session),user:(0,n.parseUserOutput)(e.context.options,l.user)})}),revokeUserSession:(0,I.createAuthEndpoint)("/admin/revoke-user-session",{method:"POST",body:C,use:[T],metadata:{openapi:{operationId:"revokeUserSession",summary:"Revoke a user session",description:"Revoke a user session",responses:{200:{description:"Session revoked",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean"}}}}}}}}}},async e=>{let r=e.context.session;if(!w({userId:e.context.session.user.id,role:r.user.role,options:t,permissions:{session:["revoke"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS);return await e.context.internalAdapter.deleteSession(e.body.sessionToken),e.json({success:!0})}),revokeUserSessions:(0,I.createAuthEndpoint)("/admin/revoke-user-sessions",{method:"POST",body:q,use:[T],metadata:{openapi:{operationId:"revokeUserSessions",summary:"Revoke all user sessions",description:"Revoke all user sessions",responses:{200:{description:"Sessions revoked",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean"}}}}}}}}}},async e=>{let r=e.context.session;if(!w({userId:e.context.session.user.id,role:r.user.role,options:t,permissions:{session:["revoke"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS);return await e.context.internalAdapter.deleteUserSessions(e.body.userId),e.json({success:!0})}),removeUser:(0,I.createAuthEndpoint)("/admin/remove-user",{method:"POST",body:B,use:[T],metadata:{openapi:{operationId:"removeUser",summary:"Remove a user",description:"Delete a user and all their sessions and accounts. Cannot be undone.",responses:{200:{description:"User removed",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean"}}}}}}}}}},async e=>{let r=e.context.session;if(!w({userId:e.context.session.user.id,role:r.user.role,options:t,permissions:{user:["delete"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS);if(e.body.userId===e.context.session.user.id)throw A.APIError.from("BAD_REQUEST",u.YOU_CANNOT_REMOVE_YOURSELF);if(!await e.context.internalAdapter.findUserById(e.body.userId))throw A.APIError.from("NOT_FOUND",E.BASE_ERROR_CODES.USER_NOT_FOUND);return await e.context.internalAdapter.deleteUserSessions(e.body.userId),await e.context.internalAdapter.deleteUser(e.body.userId),e.json({success:!0})}),setUserPassword:(0,I.createAuthEndpoint)("/admin/set-user-password",{method:"POST",body:j,use:[T],metadata:{openapi:{operationId:"setUserPassword",summary:"Set a user's password",description:"Set a user's password",responses:{200:{description:"Password set",content:{"application/json":{schema:{type:"object",properties:{status:{type:"boolean"}}}}}}}}}},async e=>{if(!w({userId:e.context.session.user.id,role:e.context.session.user.role,options:t,permissions:{user:["set-password"]}}))throw A.APIError.from("FORBIDDEN",u.YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD);let{newPassword:r,userId:i}=e.body,o=e.context.password.config.minPasswordLength;if(r.length<o)throw e.context.logger.warn("Password is too short"),A.APIError.from("BAD_REQUEST",E.BASE_ERROR_CODES.PASSWORD_TOO_SHORT);let n=e.context.password.config.maxPasswordLength;if(r.length>n)throw e.context.logger.warn("Password is too long"),A.APIError.from("BAD_REQUEST",E.BASE_ERROR_CODES.PASSWORD_TOO_LONG);let a=await e.context.internalAdapter.findUserById(i);if(!a)throw A.APIError.from("NOT_FOUND",E.BASE_ERROR_CODES.USER_NOT_FOUND);let s=await e.context.password.hash(r);return await e.context.internalAdapter.findCredentialAccount(i)?await e.context.internalAdapter.updatePassword(i,s):await e.context.internalAdapter.createAccount({userId:i,providerId:"credential",issuer:(0,y.createLocalAccountIssuer)("credential"),accountId:a.id,password:s}),e.json({status:!0})}),userHasPermission:(0,I.createAuthEndpoint)("/admin/has-permission",{method:"POST",body:$,metadata:{openapi:{description:"Check if the user has permission",requestBody:{content:{"application/json":{schema:{type:"object",properties:{permissions:{type:"object",description:"The permission to check"}},required:["permissions"]}}}},responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{error:{type:"string"},success:{type:"boolean"}},required:["success"]}}}}}},$Infer:{body:{}}}},async e=>{if(!e.body?.permissions)throw new A.APIError("BAD_REQUEST",{message:"invalid permission check. no permission(s) were passed."});let r=await (0,g.getAuthoritativeSessionFromCtx)(e);if(!r&&(e.request||e.headers))throw new A.APIError("UNAUTHORIZED");if(!r&&!e.body.userId&&!e.body.role)throw new A.APIError("BAD_REQUEST",{message:"user id or role is required"});let i=r?.user||(e.body.role?{id:e.body.userId||"",role:e.body.role}:null)||(e.body.userId?await e.context.internalAdapter.findUserById(e.body.userId):null);if(!i)throw new A.APIError("BAD_REQUEST",{message:"user not found"});let o=w({userId:i.id,role:i.role,options:t,permissions:e.body.permissions});return e.json({error:null,success:o})})},$ERROR_CODES:u,schema:(0,n.mergeSchema)(V,t.schema),options:e}})({ac:eP,roles:{user:eN},defaultRole:"user",adminRoles:["user"]}),{setRole:t,banUser:r,unbanUser:i,impersonateUser:o,stopImpersonating:s,removeUser:l,...d}=e.endpoints;return{...e,endpoints:d}}(),(0,t.apiKey)({schema:{apikey:{modelName:"ApiKey"}},defaultPrefix:"aide_",requireName:!0,startingCharactersConfig:{shouldStore:!0,charactersLength:12},keyExpiration:{defaultExpiresIn:null,disableCustomExpiresTime:!1,minExpiresIn:1,maxExpiresIn:3650},rateLimit:{enabled:!1},enableSessionForAPIKeys:!1}),{id:"bearer",version:a.PACKAGE_VERSION,hooks:{before:[{matcher:e=>!!(e.request?.headers.get("authorization")||e.headers?.get("authorization")),handler:(0,I.createAuthMiddleware)(async e=>{let t,r=e.request?.headers.get("authorization")||e.headers?.get("Authorization");if(!r||"bearer "!==r.slice(0,7).toLowerCase())return;let i=r.slice(7).trim();if(!i)return;t=i.includes(".")?i.includes("%")?K(i):i:K((await (0,F.serializeSignedCookie)("",i,e.context.secret)).replace("=",""));try{if(!await (0,H.createHMAC)("SHA-256","base64urlnopad").verify(e.context.secret,t.split(".")[0],t.split(".")[1]))return}catch{return}let o=e.request?.headers||e.headers,n=new Headers({...Object.fromEntries(o?.entries())});return(0,M.setRequestCookie)(n,e.context.authCookies.sessionToken.name,t),{context:{headers:n}}})}],after:[{matcher:e=>!0,handler:(0,I.createAuthMiddleware)(async e=>{let t=e.context.responseHeaders?.get("set-cookie");if(!t)return;let r=(0,M.parseSetCookieHeader)(t),i=e.context.authCookies.sessionToken.name,o=r.get(i);if(!o||!o.value||0===o["max-age"])return;let n=o.value,a=new Set((e.context.responseHeaders?.get("access-control-expose-headers")||"").split(",").map(e=>e.trim()).filter(Boolean));a.add("set-auth-token"),e.setHeader("set-auth-token",n),e.setHeader("Access-Control-Expose-Headers",Array.from(a).join(", "))})}]},options:void 0},(e=>{let t={storeToken:"plain",...e};async function r(e,r){return"hashed"===t.storeToken?await ea(r):"object"==typeof t.storeToken&&"type"in t.storeToken&&"custom-hasher"===t.storeToken.type?await t.storeToken.hash(r):r}async function i(e,i){let o=t?.generateToken?await t.generateToken(i,e):(0,ei.generateRandomString)(32),n=new Date(Date.now()+(t?.expiresIn??3)*6e4),a=await r(e,o);return await e.context.internalAdapter.createVerificationValue({value:i.session.token,identifier:`one-time-token:${a}`,expiresAt:n}),o}return{id:"one-time-token",version:a.PACKAGE_VERSION,endpoints:{generateOneTimeToken:(0,I.createAuthEndpoint)("/one-time-token/generate",{method:"GET",use:[g.sessionMiddleware]},async e=>{if(t?.disableClientRequest&&e.request)throw e.error("BAD_REQUEST",{message:"Client requests are disabled"});let r=e.context.session,o=await i(e,r);return e.json({token:o})}),verifyOneTimeToken:(0,I.createAuthEndpoint)("/one-time-token/verify",{method:"POST",body:es},async e=>{let{token:i}=e.body,o=await r(e,i),n=await e.context.internalAdapter.consumeVerificationValue(`one-time-token:${o}`);if(!n)throw e.error("BAD_REQUEST",{message:"Invalid token"});let a=await e.context.internalAdapter.findSession(n.value);if(!a)throw e.error("BAD_REQUEST",{message:"Session not found"});if(t?.disableSetSessionCookie||await (0,m.setSessionCookie)(e,a),a.session.expiresAt<new Date)throw e.error("BAD_REQUEST",{message:"Session expired"});return e.json(a)})},hooks:{after:[{matcher:()=>!0,handler:(0,I.createAuthMiddleware)(async e=>{if(e.context.newSession){if(!t?.setOttHeaderOnNewSession)return;let r=new Set((e.context.responseHeaders?.get("access-control-expose-headers")||"").split(",").map(e=>e.trim()).filter(Boolean));r.add("set-ott");let o=await i(e,e.context.newSession);e.setHeader("set-ott",o),e.setHeader("Access-Control-Expose-Headers",Array.from(r).join(", "))}})}]},options:e}})({disableClientRequest:!0,expiresIn:1,storeToken:"hashed"}),...p?[p]:[],(0,o.nextCookies)()]})})(e))),eL}e.s(["getAuth",0,eC],576257);class eq extends Error{status;constructor(e,t=401){super(e),this.status=t,this.name="PrincipalResolutionError"}}function eB(e){return/(?:^|;\s*)(?:__Secure-)?better-auth\.session_token=/.test(e.get("cookie")??"")}async function ej(e,t){let r=e.get("x-api-key")?.trim()||null,i=function(e){let t=e.get("authorization");if(!t)return null;if(!t.startsWith("Bearer "))throw new eq("Authorization must use the Bearer scheme.");let r=t.slice(7).trim();if(!r)throw new eq("The bearer credential is empty.");return r}(e),o=eB(e);if(Number(!!r)+Number(!!i)+Number(o)>1)throw new eq("Provide exactly one application credential.",400);if(r){let e=await eC(),t=await e.api.verifyApiKey({body:{key:r}});if(!t.valid||!t.key)throw new eq("The API key is invalid or inactive.");return{kind:"apiKey",apiKeyId:t.key.id,userId:t.key.referenceId,name:t.key.name??null}}if(i?.startsWith("agent_")){if(!t)throw new eq("Agent credentials are not accepted by this endpoint.");let e=await t.authenticate(i);if(!e)throw new eq("The agent credential is invalid.");return{kind:"agent",agentId:e}}if(i||o){let t=await eC(),r=await t.api.getSession({headers:e});if(!r?.session||!r.user)throw new eq("The session is invalid or expired.");return{kind:"user",userId:r.user.id,email:r.user.email,sessionId:r.session.id}}return{kind:"anonymous"}}async function e$(e){let t=await ej(e);if("user"!==t.kind)throw new eq("A user session is required.");return t}e.s(["PrincipalResolutionError",0,eq,"principalErrorResponse",0,function(e){return Response.json({error:{code:"AUTHENTICATION_REQUIRED",message:e.message}},{status:e.status,headers:{"www-authenticate":"Bearer"}})},"requireUserPrincipal",0,e$,"resolveRequestPrincipal",0,ej,"usesAmbientCredential",0,function(e){return eB(e)&&!e.get("x-api-key")?.trim()&&!e.get("authorization")?.trim()}],354470)},406315,e=>{"use strict";var t=e.i(303361),r=e.i(169040),i=e.i(354470);function o(e){return!(0,i.usesAmbientCredential)(e.headers)||(0,t.isSameOriginRequest)(e,(0,r.getAuthRuntimeConfig)().trustProxyHeaders)?null:Response.json({error:{code:"CROSS_ORIGIN_REQUEST",message:"A session-authenticated request must come from this site. Use an API key for cross-origin access."}},{status:403})}async function n(e){let t=o(e);if(t)return t;try{return await (0,i.requireUserPrincipal)(e.headers),null}catch(e){if(e instanceof i.PrincipalResolutionError)return(0,i.principalErrorResponse)(e);throw e}}e.s(["crossOriginError",0,o,"requireUserRequest",0,n])},406478,e=>{"use strict";e.i(576257),e.i(169040),e.i(406315),e.i(354470),e.i(464661),e.s([])}];
 
 //# sourceMappingURL=_05hmt-3._.js.map