npm - @alook/app - Versions diffs - 0.0.145 → 0.0.146 - Mend

@alook/app 0.0.145 → 0.0.146

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (68) hide show

package/bundled/web/.open-next/server-functions/default/src/web/.next/server/chunks/ssr/_1t_zwti._.js ADDED Viewed

@@ -0,0 +1,416 @@
+module.exports=[645998,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={RequestCookies:function(){return f.RequestCookies},ResponseCookies:function(){return f.ResponseCookies},stringifyCookie:function(){return f.stringifyCookie}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f=a.r(878713)},854502,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"ReflectAdapter",{enumerable:!0,get:function(){return d}});class d{static get(a,b,c){let d=Reflect.get(a,b,c);return"function"==typeof d?d.bind(a):d}static set(a,b,c,d){return Reflect.set(a,b,c,d)}static has(a,b){return Reflect.has(a,b)}static deleteProperty(a,b){return Reflect.deleteProperty(a,b)}}},401098,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={ActionDidNotRevalidate:function(){return f},ActionDidRevalidateDynamicOnly:function(){return h},ActionDidRevalidateStaticAndDynamic:function(){return g}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f=0,g=1,h=2},953229,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={MutableRequestCookiesAdapter:function(){return o},ReadonlyRequestCookiesError:function(){return j},RequestCookiesAdapter:function(){return k},appendMutableCookies:function(){return n},areCookiesMutableInCurrentPhase:function(){return q},createCookiesWithMutableAccessCheck:function(){return p},getModifiedCookieValues:function(){return m},responseCookiesToRequestCookies:function(){return s}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f=a.r(645998),g=a.r(854502),h=a.r(556704),i=a.r(401098);class j extends Error{constructor(){super("Cookies can only be modified in a Server Action or Route Handler. Read more: https://nextjs.org/docs/app/api-reference/functions/cookies#options")}static callable(){throw new j}}class k{static seal(a){return new Proxy(a,{get(a,b,c){switch(b){case"clear":case"delete":case"set":return j.callable;default:return g.ReflectAdapter.get(a,b,c)}}})}}let l=Symbol.for("next.mutated.cookies");function m(a){let b=a[l];return b&&Array.isArray(b)&&0!==b.length?b:[]}function n(a,b){let c=m(b);if(0===c.length)return!1;let d=new f.ResponseCookies(a),e=d.getAll();for(let a of c)d.set(a);for(let a of e)d.set(a);return!0}class o{static wrap(a,b){let c=new f.ResponseCookies(new Headers);for(let b of a.getAll())c.set(b);let d=[],e=new Set,j=()=>{let a=h.workAsyncStorage.getStore();if(a&&(a.pathWasRevalidated=i.ActionDidRevalidateStaticAndDynamic),d=c.getAll().filter(a=>e.has(a.name)),b){let a=[];for(let b of d){let c=new f.ResponseCookies(new Headers);c.set(b),a.push(c.toString())}b(a)}},k=new Proxy(c,{get(a,b,c){switch(b){case l:return d;case"delete":return function(...b){e.add("string"==typeof b[0]?b[0]:b[0].name);try{return a.delete(...b),k}finally{j()}};case"set":return function(...b){e.add("string"==typeof b[0]?b[0]:b[0].name);try{return a.set(...b),k}finally{j()}};default:return g.ReflectAdapter.get(a,b,c)}}});return k}}function p(a){let b=new Proxy(a.mutableCookies,{get(c,d,e){switch(d){case"delete":return function(...d){return r(a,"cookies().delete"),c.delete(...d),b};case"set":return function(...d){return r(a,"cookies().set"),c.set(...d),b};default:return g.ReflectAdapter.get(c,d,e)}}});return b}function q(a){return"action"===a.phase}function r(a,b){if(!q(a))throw new j}function s(a){let b=new f.RequestCookies(new Headers);for(let c of a.getAll())b.set(c);return b}},323701,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"createDedupedByCallsiteServerErrorLoggerDev",{enumerable:!0,get:function(){return i}});let d=function(a){if(a&&a.__esModule)return a;if(null===a||"object"!=typeof a&&"function"!=typeof a)return{default:a};var b=e(void 0);if(b&&b.has(a))return b.get(a);var c={__proto__:null},d=Object.defineProperty&&Object.getOwnPropertyDescriptor;for(var f in a)if("default"!==f&&Object.prototype.hasOwnProperty.call(a,f)){var g=d?Object.getOwnPropertyDescriptor(a,f):null;g&&(g.get||g.set)?Object.defineProperty(c,f,g):c[f]=a[f]}return c.default=a,b&&b.set(a,c),c}(a.r(498582));function e(a){if("function"!=typeof WeakMap)return null;var b=new WeakMap,c=new WeakMap;return(e=function(a){return a?c:b})(a)}let f={current:null},g="function"==typeof d.cache?d.cache:a=>a,h=console.warn;function i(a){return function(...b){h(a(...b))}}g(a=>{try{h(f.current)}finally{f.current=null}})},354630,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={isRequestAPICallableInsideAfter:function(){return j},throwForSearchParamsAccessInUseCache:function(){return i},throwWithStaticGenerationBailoutErrorWithDynamicError:function(){return h}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f=a.r(63287),g=a.r(324725);function h(a,b){throw Object.defineProperty(new f.StaticGenBailoutError(`Route ${a} with \`dynamic = "error"\` couldn't be rendered statically because it used ${b}. See more info here: https://nextjs.org/docs/app/building-your-application/rendering/static-and-dynamic#dynamic-rendering`),"__NEXT_ERROR_CODE",{value:"E543",enumerable:!1,configurable:!0})}function i(a,b){let c=Object.defineProperty(Error(`Route ${a.route} used \`searchParams\` inside "use cache". Accessing dynamic request data inside a cache scope is not supported. If you need some search params inside a cached function await \`searchParams\` outside of the cached function and pass only the required search params as arguments to the cached function. See more info here: https://nextjs.org/docs/messages/next-request-in-use-cache`),"__NEXT_ERROR_CODE",{value:"E842",enumerable:!1,configurable:!0});throw Error.captureStackTrace(c,b),a.invalidDynamicUsageError??=c,c}function j(){let a=g.afterTaskAsyncStorage.getStore();return(null==a?void 0:a.rootTaskSpawnPhase)==="action"}},671326,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"cookies",{enumerable:!0,get:function(){return n}});let d=a.r(953229),e=a.r(645998),f=a.r(556704),g=a.r(832319),h=a.r(538775),i=a.r(63287),j=a.r(816858),k=a.r(323701),l=a.r(354630),m=a.r(705785);function n(){let a="cookies",b=f.workAsyncStorage.getStore(),c=g.workUnitAsyncStorage.getStore();if(b){if(c&&"after"===c.phase&&!(0,l.isRequestAPICallableInsideAfter)())throw Object.defineProperty(Error(`Route ${b.route} used \`cookies()\` inside \`after()\`. This is not supported. If you need this data inside an \`after()\` callback, use \`cookies()\` outside of the callback. See more info here: https://nextjs.org/docs/canary/app/api-reference/functions/after`),"__NEXT_ERROR_CODE",{value:"E843",enumerable:!1,configurable:!0});if(b.forceStatic)return p(d.RequestCookiesAdapter.seal(new e.RequestCookies(new Headers({}))));if(b.dynamicShouldError)throw Object.defineProperty(new i.StaticGenBailoutError(`Route ${b.route} with \`dynamic = "error"\` couldn't be rendered statically because it used \`cookies()\`. See more info here: https://nextjs.org/docs/app/building-your-application/rendering/static-and-dynamic#dynamic-rendering`),"__NEXT_ERROR_CODE",{value:"E849",enumerable:!1,configurable:!0});if(c)switch(c.type){case"cache":let f=Object.defineProperty(Error(`Route ${b.route} used \`cookies()\` inside "use cache". Accessing Dynamic data sources inside a cache scope is not supported. If you need this data inside a cached function use \`cookies()\` outside of the cached function and pass the required dynamic data in as an argument. See more info here: https://nextjs.org/docs/messages/next-request-in-use-cache`),"__NEXT_ERROR_CODE",{value:"E831",enumerable:!1,configurable:!0});throw Error.captureStackTrace(f,n),b.invalidDynamicUsageError??=f,f;case"unstable-cache":throw Object.defineProperty(Error(`Route ${b.route} used \`cookies()\` inside a function cached with \`unstable_cache()\`. Accessing Dynamic data sources inside a cache scope is not supported. If you need this data inside a cached function use \`cookies()\` outside of the cached function and pass the required dynamic data in as an argument. See more info here: https://nextjs.org/docs/app/api-reference/functions/unstable_cache`),"__NEXT_ERROR_CODE",{value:"E846",enumerable:!1,configurable:!0});case"generate-static-params":throw Object.defineProperty(Error(`Route ${b.route} used \`cookies()\` inside \`generateStaticParams\`. This is not supported because \`generateStaticParams\` runs at build time without an HTTP request. Read more: https://nextjs.org/docs/messages/next-dynamic-api-wrong-context`),"__NEXT_ERROR_CODE",{value:"E1123",enumerable:!1,configurable:!0});case"prerender":var k=b,q=c;let r=o.get(q);if(r)return r;let s=(0,j.makeHangingPromise)(q.renderSignal,k.route,"`cookies()`");return o.set(q,s),s;case"prerender-client":case"validation-client":let t="`cookies`";throw Object.defineProperty(new m.InvariantError(`${t} must not be used within a Client Component. Next.js should be preventing ${t} from being included in Client Components statically, but did not in this case.`),"__NEXT_ERROR_CODE",{value:"E1037",enumerable:!1,configurable:!0});case"prerender-ppr":return(0,h.postponeWithTracking)(b.route,a,c.dynamicTracking);case"prerender-legacy":return(0,h.throwToInterruptStaticGeneration)(a,b,c);case"prerender-runtime":return(0,j.delayUntilRuntimeStage)(c,p(c.cookies));case"private-cache":return p(c.cookies);case"request":let u;if((0,h.trackDynamicDataInDynamicRender)(c),u=(0,d.areCookiesMutableInCurrentPhase)(c)?c.userspaceMutableCookies:c.cookies,!c.asyncApiPromises)return p(u);{let a=(0,g.isInEarlyRenderStage)(c);if(u===c.mutableCookies)return a?c.asyncApiPromises.earlyMutableCookies:c.asyncApiPromises.mutableCookies;return a?c.asyncApiPromises.earlyCookies:c.asyncApiPromises.cookies}}}(0,g.throwForMissingRequestStore)(a)}a.r(194724);let o=new WeakMap;function p(a){let b=o.get(a);if(b)return b;let c=Promise.resolve(a);return o.set(a,c),c}(0,k.createDedupedByCallsiteServerErrorLoggerDev)(function(a,b){let c=a?`Route "${a}" `:"This route ";return Object.defineProperty(Error(`${c}used ${b}. \`cookies()\` returns a Promise and must be unwrapped with \`await\` or \`React.use()\` before accessing its properties. Learn more: https://nextjs.org/docs/messages/sync-dynamic-apis`),"__NEXT_ERROR_CODE",{value:"E830",enumerable:!1,configurable:!0})})},310234,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={HeadersAdapter:function(){return h},ReadonlyHeadersError:function(){return g}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f=a.r(854502);class g extends Error{constructor(){super("Headers cannot be modified. Read more: https://nextjs.org/docs/app/api-reference/functions/headers")}static callable(){throw new g}}class h extends Headers{constructor(a){super(),this.headers=new Proxy(a,{get(b,c,d){if("symbol"==typeof c)return f.ReflectAdapter.get(b,c,d);let e=c.toLowerCase(),g=Object.keys(a).find(a=>a.toLowerCase()===e);if(void 0!==g)return f.ReflectAdapter.get(b,g,d)},set(b,c,d,e){if("symbol"==typeof c)return f.ReflectAdapter.set(b,c,d,e);let g=c.toLowerCase(),h=Object.keys(a).find(a=>a.toLowerCase()===g);return f.ReflectAdapter.set(b,h??c,d,e)},has(b,c){if("symbol"==typeof c)return f.ReflectAdapter.has(b,c);let d=c.toLowerCase(),e=Object.keys(a).find(a=>a.toLowerCase()===d);return void 0!==e&&f.ReflectAdapter.has(b,e)},deleteProperty(b,c){if("symbol"==typeof c)return f.ReflectAdapter.deleteProperty(b,c);let d=c.toLowerCase(),e=Object.keys(a).find(a=>a.toLowerCase()===d);return void 0===e||f.ReflectAdapter.deleteProperty(b,e)}})}static seal(a){return new Proxy(a,{get(a,b,c){switch(b){case"append":case"delete":case"set":return g.callable;default:return f.ReflectAdapter.get(a,b,c)}}})}merge(a){return Array.isArray(a)?a.join(", "):a}static from(a){return a instanceof Headers?a:new h(a)}append(a,b){let c=this.headers[a];"string"==typeof c?this.headers[a]=[c,b]:Array.isArray(c)?c.push(b):this.headers[a]=b}delete(a){delete this.headers[a]}get(a){let b=this.headers[a];return void 0!==b?this.merge(b):null}has(a){return void 0!==this.headers[a]}set(a,b){this.headers[a]=b}forEach(a,b){for(let[c,d]of this.entries())a.call(b,d,c,this)}*entries(){for(let a of Object.keys(this.headers)){let b=a.toLowerCase(),c=this.get(b);yield[b,c]}}*keys(){for(let a of Object.keys(this.headers)){let b=a.toLowerCase();yield b}}*values(){for(let a of Object.keys(this.headers)){let b=this.get(a);yield b}}[Symbol.iterator](){return this.entries()}}},567469,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"headers",{enumerable:!0,get:function(){return m}});let d=a.r(310234),e=a.r(556704),f=a.r(832319),g=a.r(538775),h=a.r(63287),i=a.r(816858),j=a.r(323701),k=a.r(354630),l=a.r(705785);function m(){let a="headers",b=e.workAsyncStorage.getStore(),c=f.workUnitAsyncStorage.getStore();if(b){if(c&&"after"===c.phase&&!(0,k.isRequestAPICallableInsideAfter)())throw Object.defineProperty(Error(`Route ${b.route} used \`headers()\` inside \`after()\`. This is not supported. If you need this data inside an \`after()\` callback, use \`headers()\` outside of the callback. See more info here: https://nextjs.org/docs/canary/app/api-reference/functions/after`),"__NEXT_ERROR_CODE",{value:"E839",enumerable:!1,configurable:!0});if(b.forceStatic)return o(d.HeadersAdapter.seal(new Headers({})));if(c)switch(c.type){case"cache":{let a=Object.defineProperty(Error(`Route ${b.route} used \`headers()\` inside "use cache". Accessing Dynamic data sources inside a cache scope is not supported. If you need this data inside a cached function use \`headers()\` outside of the cached function and pass the required dynamic data in as an argument. See more info here: https://nextjs.org/docs/messages/next-request-in-use-cache`),"__NEXT_ERROR_CODE",{value:"E833",enumerable:!1,configurable:!0});throw Error.captureStackTrace(a,m),b.invalidDynamicUsageError??=a,a}case"unstable-cache":throw Object.defineProperty(Error(`Route ${b.route} used \`headers()\` inside a function cached with \`unstable_cache()\`. Accessing Dynamic data sources inside a cache scope is not supported. If you need this data inside a cached function use \`headers()\` outside of the cached function and pass the required dynamic data in as an argument. See more info here: https://nextjs.org/docs/app/api-reference/functions/unstable_cache`),"__NEXT_ERROR_CODE",{value:"E838",enumerable:!1,configurable:!0});case"generate-static-params":throw Object.defineProperty(Error(`Route ${b.route} used \`headers()\` inside \`generateStaticParams\`. This is not supported because \`generateStaticParams\` runs at build time without an HTTP request. Read more: https://nextjs.org/docs/messages/next-dynamic-api-wrong-context`),"__NEXT_ERROR_CODE",{value:"E1134",enumerable:!1,configurable:!0})}if(b.dynamicShouldError)throw Object.defineProperty(new h.StaticGenBailoutError(`Route ${b.route} with \`dynamic = "error"\` couldn't be rendered statically because it used \`headers()\`. See more info here: https://nextjs.org/docs/app/building-your-application/rendering/static-and-dynamic#dynamic-rendering`),"__NEXT_ERROR_CODE",{value:"E828",enumerable:!1,configurable:!0});if(c)switch(c.type){case"prerender":var j=b,p=c;let e=n.get(p);if(e)return e;let q=(0,i.makeHangingPromise)(p.renderSignal,j.route,"`headers()`");return n.set(p,q),q;case"prerender-client":case"validation-client":let r="`headers`";throw Object.defineProperty(new l.InvariantError(`${r} must not be used within a client component. Next.js should be preventing ${r} from being included in client components statically, but did not in this case.`),"__NEXT_ERROR_CODE",{value:"E1017",enumerable:!1,configurable:!0});case"prerender-ppr":return(0,g.postponeWithTracking)(b.route,a,c.dynamicTracking);case"prerender-legacy":return(0,g.throwToInterruptStaticGeneration)(a,b,c);case"prerender-runtime":return(0,i.delayUntilRuntimeStage)(c,o(c.headers));case"private-cache":return o(c.headers);case"request":if((0,g.trackDynamicDataInDynamicRender)(c),c.asyncApiPromises)return(0,f.isInEarlyRenderStage)(c)?c.asyncApiPromises.earlyHeaders:c.asyncApiPromises.headers;return o(c.headers)}}(0,f.throwForMissingRequestStore)(a)}a.r(194724);let n=new WeakMap;function o(a){let b=n.get(a);if(b)return b;let c=Promise.resolve(a);return n.set(a,c),c}(0,j.createDedupedByCallsiteServerErrorLoggerDev)(function(a,b){let c=a?`Route "${a}" `:"This route ";return Object.defineProperty(Error(`${c}used ${b}. \`headers()\` returns a Promise and must be unwrapped with \`await\` or \`React.use()\` before accessing its properties. Learn more: https://nextjs.org/docs/messages/sync-dynamic-apis`),"__NEXT_ERROR_CODE",{value:"E836",enumerable:!1,configurable:!0})})},10061,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"draftMode",{enumerable:!0,get:function(){return l}});let d=a.r(832319),e=a.r(556704),f=a.r(538775),g=a.r(323701),h=a.r(63287),i=a.r(69118),j=a.r(705785),k=a.r(816858);function l(){let a="draftMode",b=e.workAsyncStorage.getStore(),c=d.workUnitAsyncStorage.getStore();switch((!b||!c)&&(0,d.throwForMissingRequestStore)(a),c.type){case"prerender-runtime":return(0,k.delayUntilRuntimeStage)(c,m(c.draftMode,b));case"request":return m(c.draftMode,b);case"cache":case"private-cache":case"unstable-cache":let f=(0,d.getDraftModeProviderForCacheScope)(b,c);if(f)return m(f,b);case"prerender":case"prerender-ppr":case"prerender-legacy":return m(null,b);case"prerender-client":case"validation-client":{let a="`draftMode`";throw Object.defineProperty(new j.InvariantError(`${a} must not be used within a Client Component. Next.js should be preventing ${a} from being included in Client Components statically, but did not in this case.`),"__NEXT_ERROR_CODE",{value:"E1046",enumerable:!1,configurable:!0})}case"generate-static-params":throw Object.defineProperty(Error(`Route ${b.route} used \`${a}()\` inside \`generateStaticParams\`. This is not supported because \`generateStaticParams\` runs at build time without an HTTP request. Read more: https://nextjs.org/docs/messages/next-dynamic-api-wrong-context`),"__NEXT_ERROR_CODE",{value:"E1132",enumerable:!1,configurable:!0});default:return c}}function m(a,b){let c=o.get(a??n);return c||Promise.resolve(new p(a))}a.r(854502);let n={},o=new WeakMap;class p{constructor(a){this._provider=a}get isEnabled(){return null!==this._provider&&this._provider.isEnabled}enable(){q("draftMode().enable()",this.enable),null!==this._provider&&this._provider.enable()}disable(){q("draftMode().disable()",this.disable),null!==this._provider&&this._provider.disable()}}function q(a,b){let c=e.workAsyncStorage.getStore(),g=d.workUnitAsyncStorage.getStore();if(c){if((null==g?void 0:g.phase)==="after")throw Object.defineProperty(Error(`Route ${c.route} used "${a}" inside \`after()\`. The enabled status of \`draftMode()\` can be read inside \`after()\` but you cannot enable or disable \`draftMode()\`. See more info here: https://nextjs.org/docs/app/api-reference/functions/after`),"__NEXT_ERROR_CODE",{value:"E845",enumerable:!1,configurable:!0});if(c.dynamicShouldError)throw Object.defineProperty(new h.StaticGenBailoutError(`Route ${c.route} with \`dynamic = "error"\` couldn't be rendered statically because it used \`${a}\`. See more info here: https://nextjs.org/docs/app/building-your-application/rendering/static-and-dynamic#dynamic-rendering`),"__NEXT_ERROR_CODE",{value:"E553",enumerable:!1,configurable:!0});if(g)switch(g.type){case"cache":case"private-cache":{let d=Object.defineProperty(Error(`Route ${c.route} used "${a}" inside "use cache". The enabled status of \`draftMode()\` can be read in caches but you must not enable or disable \`draftMode()\` inside a cache. See more info here: https://nextjs.org/docs/messages/next-request-in-use-cache`),"__NEXT_ERROR_CODE",{value:"E829",enumerable:!1,configurable:!0});throw Error.captureStackTrace(d,b),c.invalidDynamicUsageError??=d,d}case"unstable-cache":throw Object.defineProperty(Error(`Route ${c.route} used "${a}" inside a function cached with \`unstable_cache()\`. The enabled status of \`draftMode()\` can be read in caches but you must not enable or disable \`draftMode()\` inside a cache. See more info here: https://nextjs.org/docs/app/api-reference/functions/unstable_cache`),"__NEXT_ERROR_CODE",{value:"E844",enumerable:!1,configurable:!0});case"prerender":case"prerender-runtime":{let b=Object.defineProperty(Error(`Route ${c.route} used ${a} without first calling \`await connection()\`. See more info here: https://nextjs.org/docs/messages/next-prerender-sync-headers`),"__NEXT_ERROR_CODE",{value:"E126",enumerable:!1,configurable:!0});return(0,f.abortAndThrowOnSynchronousRequestDataAccess)(c.route,a,b,g)}case"prerender-client":case"validation-client":let d="`draftMode`";throw Object.defineProperty(new j.InvariantError(`${d} must not be used within a Client Component. Next.js should be preventing ${d} from being included in Client Components statically, but did not in this case.`),"__NEXT_ERROR_CODE",{value:"E1046",enumerable:!1,configurable:!0});case"prerender-ppr":return(0,f.postponeWithTracking)(c.route,a,g.dynamicTracking);case"prerender-legacy":g.revalidate=0;let e=Object.defineProperty(new i.DynamicServerError(`Route ${c.route} couldn't be rendered statically because it used \`${a}\`. See more info here: https://nextjs.org/docs/messages/dynamic-server-error`),"__NEXT_ERROR_CODE",{value:"E558",enumerable:!1,configurable:!0});throw c.dynamicUsageDescription=a,c.dynamicUsageStack=e.stack,e;case"request":(0,f.trackDynamicDataInDynamicRender)(g);break;case"generate-static-params":throw Object.defineProperty(Error(`Route ${c.route} used \`${a}\` inside \`generateStaticParams\`. This is not supported because \`generateStaticParams\` runs at build time without an HTTP request. Read more: https://nextjs.org/docs/messages/next-dynamic-api-wrong-context`),"__NEXT_ERROR_CODE",{value:"E1121",enumerable:!1,configurable:!0})}}}(0,g.createDedupedByCallsiteServerErrorLoggerDev)(function(a,b){let c=a?`Route "${a}" `:"This route ";return Object.defineProperty(Error(`${c}used ${b}. \`draftMode()\` returns a Promise and must be unwrapped with \`await\` or \`React.use()\` before accessing its properties. Learn more: https://nextjs.org/docs/messages/sync-dynamic-apis`),"__NEXT_ERROR_CODE",{value:"E835",enumerable:!1,configurable:!0})})},353675,(a,b,c)=>{b.exports.cookies=a.r(671326).cookies,b.exports.headers=a.r(567469).headers,b.exports.draftMode=a.r(10061).draftMode},307767,a=>a.a(async(b,c)=>{try{var d=a.i(224321),e=a.i(28675),f=b([d,e]);async function g(b,c){let f;if(b.database)f="function"==typeof b.database?b.database(b):await c(b);else{let c=(0,d.getAuthTables)(b),e=Object.keys(c).reduce((a,b)=>(a[b]=[],a),{}),{memoryAdapter:g}=await a.A(922608);f=g(e)(b)}return f.transaction||(e.logger.warn("Adapter does not correctly implement transaction function, patching it automatically. Please update your adapter implementation."),f.transaction=async a=>a(f)),f}[d,e]=f.then?(await f)():f,a.s(["getBaseAdapter",0,g]),c()}catch(a){c(a)}},!1),292608,a=>a.a(async(b,c)=>{try{var d=a.i(307767),e=a.i(815291),f=b([d,e]);async function g(b){return(0,d.getBaseAdapter)(b,async b=>{let{createKyselyAdapter:c}=await a.A(710756),{kysely:d,databaseType:f,transaction:g}=await c(b);if(!d)throw new e.BetterAuthError("Failed to initialize database adapter");let{kyselyAdapter:h}=await a.A(710756);return h(d,{type:f||"sqlite",debugLogs:!!b.database&&"debugLogs"in b.database&&b.database.debugLogs,transaction:g})(b)})}[d,e]=f.then?(await f)():f,a.s(["getAdapter",0,g]),c()}catch(a){c(a)}},!1),365659,a=>a.a(async(b,c)=>{try{var d=a.i(224321),e=b([d]);[d]=e.then?(await e)():e,a.s(["getSchema",0,function(a){let b=(0,d.getAuthTables)(a),c={};for(let a in b){let d=b[a],e=d.fields,f={};if(Object.entries(e).forEach(([a,c])=>{if(f[c.fieldName||a]=c,c.references){let d=b[c.references.model];d&&(f[c.fieldName||a].references={...c.references,model:d.modelName,field:c.references.field})}}),c[d.modelName]){c[d.modelName].fields={...c[d.modelName].fields,...f};continue}c[d.modelName]={fields:f,order:d.order||1/0}}return c}]),c()}catch(a){c(a)}},!1),350242,a=>a.a(async(b,c)=>{try{var d=a.i(365659),e=a.i(224321),f=a.i(28675),g=a.i(838087),h=a.i(992862),i=a.i(566815),j=b([d,e,f,g,h]);[d,e,f,g,h]=j.then?(await j)():j;let m={postgres:{string:["character varying","varchar","text","uuid"],number:["int4","integer","bigint","smallint","numeric","real","double precision"],boolean:["bool","boolean"],date:["timestamptz","timestamp","date"],json:["json","jsonb"]},mysql:{string:["varchar","text","uuid"],number:["integer","int","bigint","smallint","decimal","float","double"],boolean:["boolean","tinyint"],date:["timestamp","datetime","date"],json:["json"]},sqlite:{string:["TEXT"],number:["INTEGER","REAL"],boolean:["INTEGER","BOOLEAN"],date:["DATE","INTEGER"],json:["TEXT"]},mssql:{string:["varchar","nvarchar","uniqueidentifier"],number:["int","bigint","smallint","decimal","float","double"],boolean:["bit","smallint"],date:["datetime2","date","datetime"],json:["varchar","nvarchar"]}};async function k(a){try{let b=await i.sql`SHOW search_path`.execute(a),c=b.rows[0]?.search_path??b.rows[0]?.searchPath;if(c)return c.split(",").map(a=>a.trim()).map(a=>a.replace(/^["']|["']$/g,"")).filter(a=>!a.startsWith("$")&&!a.startsWith("\\$"))[0]||"public"}catch{}return"public"}async function l(a){let b=(0,d.getSchema)(a),c=(0,f.createLogger)(a.logger),{kysely:j,databaseType:l}=await (0,g.createKyselyAdapter)(a);l||(c.warn("Could not determine database type, defaulting to sqlite. Please provide a type in the database options to avoid this."),l="sqlite"),j||(c.error("Only kysely adapter is supported for migrations. You can use `generate` command to generate the schema, if you're using a different adapter."),process.exit(1));let n="public";if("postgres"===l){n=await k(j),c.debug(`PostgreSQL migration: Using schema '${n}' (from search_path)`);try{let a=await i.sql`
+				SELECT schema_name
+				FROM information_schema.schemata
+				WHERE schema_name = ${n}
+			`.execute(j);(a.rows[0]?.schema_name??a.rows[0]?.schemaName)||c.warn(`Schema '${n}' does not exist. Tables will be inspected from available schemas. Consider creating the schema first or checking your database configuration.`)}catch(a){c.debug(`Could not verify schema existence: ${a instanceof Error?a.message:String(a)}`)}}let o=await j.introspection.getTables(),p=o;if("postgres"===l)try{let a=await i.sql`
+				SELECT table_name
+				FROM information_schema.tables
+				WHERE table_schema = ${n}
+				AND table_type = 'BASE TABLE'
+			`.execute(j),b=new Set(a.rows.map(a=>a.table_name??a.tableName));p=o.filter(a=>a.schema===n&&b.has(a.name)),c.debug(`Found ${p.length} table(s) in schema '${n}': ${p.map(a=>a.name).join(", ")||"(none)"}`)}catch(a){c.warn(`Could not filter tables by schema. Using all discovered tables. Error: ${a instanceof Error?a.message:String(a)}`)}let q=[],r=[];for(let[a,d]of Object.entries(b)){let b=p.find(b=>b.name===a);if(!b){let b=q.findIndex(b=>b.table===a),c={table:a,fields:d.fields,order:d.order||1/0},e=q.findIndex(a=>(a.order||1/0)>c.order);-1===e?-1===b?q.push(c):q[b].fields={...q[b].fields,...d.fields}:q.splice(e,0,c);continue}let e={};for(let[f,g]of Object.entries(d.fields)){let d=b.columns.find(a=>a.name===f);if(!d){e[f]=g;continue}!function(a,b,c){if("string[]"===b||"number[]"===b)return a.toLowerCase().includes("json");let d=m[c];return(Array.isArray(b)?d.string.map(a=>a.toLowerCase()):d[b].map(a=>a.toLowerCase())).includes(a.toLowerCase().split("(")[0].trim())}(d.dataType,g.type,l)&&c.warn(`Field ${f} in table ${a} has a different type in the database. Expected ${g.type} but got ${d.dataType}.`)}Object.keys(e).length>0&&r.push({table:a,fields:e,order:d.order||1/0})}let s=[],t=a.advanced?.database?.generateId==="uuid",u=a.advanced?.database?.generateId==="serial";function v(a,b){let c=a.type,d=l||"sqlite",e={string:{sqlite:"text",postgres:"text",mysql:a.unique?"varchar(255)":a.references?"varchar(36)":a.sortable||a.index?"varchar(255)":"text",mssql:a.unique||a.sortable?"varchar(255)":a.references?"varchar(36)":"varchar(8000)"},boolean:{sqlite:"integer",postgres:"boolean",mysql:"boolean",mssql:"smallint"},number:{sqlite:a.bigint?"bigint":"integer",postgres:a.bigint?"bigint":"integer",mysql:a.bigint?"bigint":"integer",mssql:a.bigint?"bigint":"integer"},date:{sqlite:"date",postgres:"timestamptz",mysql:"timestamp(3)",mssql:i.sql`datetime2(3)`},json:{sqlite:"text",postgres:"jsonb",mysql:"json",mssql:"varchar(8000)"},id:{postgres:u?i.sql`integer GENERATED BY DEFAULT AS IDENTITY`:t?"uuid":"text",mysql:u?"integer":"varchar(36)",mssql:u?"integer":"varchar(36)",sqlite:u?"integer":"text"},foreignKeyId:{postgres:u?"integer":t?"uuid":"text",mysql:u?"integer":"varchar(36)",mssql:u?"integer":"varchar(36)",sqlite:u?"integer":"text"},"string[]":{sqlite:"text",postgres:"jsonb",mysql:"json",mssql:"varchar(8000)"},"number[]":{sqlite:"text",postgres:"jsonb",mysql:"json",mssql:"varchar(8000)"}};if("id"===b||a.references?.field==="id")return"id"===b?e.id[d]:e.foreignKeyId[d];if(Array.isArray(c))return"text";if(!(c in e))throw Error(`Unsupported field type '${String(c)}' for field '${b}'. Allowed types are: string, number, boolean, date, string[], number[]. If you need to store structured data, store it as a JSON string (type: "string") or split it into primitive fields. See https://better-auth.com/docs/advanced/schema#additional-fields`);return e[c][d]}let w=(0,h.initGetModelName)({schema:(0,e.getAuthTables)(a),usePlural:!1}),x=(0,h.initGetFieldName)({schema:(0,e.getAuthTables)(a),usePlural:!1});function y(a,b){try{return`${w(a)}.${x({model:a,field:b})}`}catch{return`${a}.${b}`}}let z=[];if(r.length)for(let a of r)for(let[b,c]of Object.entries(a.fields)){let d=v(c,b),e=j.schema.alterTable(a.table);if(c.index){let d=`${a.table}_${b}_${c.unique?"uidx":"idx"}`,e=j.schema.createIndex(d).on(a.table).columns([b]);z.push(c.unique?e.unique():e)}let f=e.addColumn(b,d,a=>(a=!1!==c.required?a.notNull():a,c.references&&(a=a.references(y(c.references.model,c.references.field)).onDelete(c.references.onDelete||"cascade")),c.unique&&(a=a.unique()),"date"===c.type&&"function"==typeof c.defaultValue&&("postgres"===l||"mysql"===l||"mssql"===l)&&(a="mysql"===l?a.defaultTo(i.sql`CURRENT_TIMESTAMP(3)`):a.defaultTo(i.sql`CURRENT_TIMESTAMP`)),a));s.push(f)}if(q.length)for(let a of q){let b=v({type:u?"number":"string"},"id"),c=j.schema.createTable(a.table).addColumn("id",b,a=>{if(u)return"postgres"===l?a.primaryKey().notNull():"sqlite"===l?a.primaryKey().notNull():"mssql"===l?a.identity().primaryKey().notNull():a.autoIncrement().primaryKey().notNull();return t&&"postgres"===l?a.primaryKey().defaultTo(i.sql`pg_catalog.gen_random_uuid()`).notNull():a.primaryKey().notNull()});for(let[b,d]of Object.entries(a.fields)){let e=v(d,b);if(c=c.addColumn(b,e,a=>(a=!1!==d.required?a.notNull():a,d.references&&(a=a.references(y(d.references.model,d.references.field)).onDelete(d.references.onDelete||"cascade")),d.unique&&(a=a.unique()),"date"===d.type&&"function"==typeof d.defaultValue&&("postgres"===l||"mysql"===l||"mssql"===l)&&(a="mysql"===l?a.defaultTo(i.sql`CURRENT_TIMESTAMP(3)`):a.defaultTo(i.sql`CURRENT_TIMESTAMP`)),a)),d.index){let c=j.schema.createIndex(`${a.table}_${b}_${d.unique?"uidx":"idx"}`).on(a.table).columns([b]);z.push(d.unique?c.unique():c)}}s.push(c)}for(let a of z)s.push(a);async function A(){for(let a of s)await a.execute()}async function B(){return s.map(a=>a.compile().sql).join(";\n\n")+";"}return{toBeCreated:q,toBeAdded:r,runMigrations:A,compileMigrations:B}}a.s(["getMigrations",0,l]),c()}catch(a){c(a)}},!1),304777,a=>{"use strict";function b(a){return"-"===a||"^"===a||"$"===a||"+"===a||"."===a||"("===a||")"===a||"|"===a||"["===a||"]"===a||"{"===a||"}"===a||"*"===a||"?"===a||"\\"===a?`\\${a}`:a}function c(a,b){if("string"!=typeof b)throw TypeError(`Sample must be a string, but ${typeof b} given`);return a.test(b)}a.s(["wildcardMatch",0,function(a,d){if("string"!=typeof a&&!Array.isArray(a))throw TypeError(`The first argument must be a single pattern string or an array of patterns, but ${typeof a} given`);if(("string"==typeof d||"boolean"==typeof d)&&(d={separator:d}),2==arguments.length&&!(void 0===d||"object"==typeof d&&null!==d&&!Array.isArray(d)))throw TypeError(`The second argument must be an options object or a string/boolean separator, but ${typeof d} given`);if("\\"===(d=d||{}).separator)throw Error("\\ is not a valid separator because it is used for escaping. Try setting the separator to `true` instead");let e=function a(c,d=!0){if(Array.isArray(c))return`(?:${c.map(b=>`^${a(b,d)}$`).join("|")})`;let e="",f="",g=".";!0===d?(e="/",f="[/\\\\]",g="[^/\\\\]"):d&&((f=function(a){let c="";for(let d=0;d<a.length;d++)c+=b(a[d]);return c}(e=d)).length>1?(f=`(?:${f})`,g=`((?!${f}).)`):g=`[^${f}]`);let h=d?`${f}+?`:"",i=d?`${f}*?`:"",j=d?c.split(e):[c],k="";for(let a=0;a<j.length;a++){let c=j[a],e=j[a+1],f="";if(c||!(a>0)){if(d&&(f=a===j.length-1?i:"**"!==e?h:""),d&&"**"===c){f&&(k+=0===a?"":f,k+=`(?:${g}*?${f})*?`);continue}for(let a=0;a<c.length;a++){let d=c[a];"\\"===d?a<c.length-1&&(k+=b(c[a+1]),a++):"?"===d?k+=g:"*"===d?k+=`${g}*?`:k+=b(d)}k+=f}}return k}(a,d.separator),f=RegExp(`^${e}$`,d.flags),g=c.bind(null,f);return g.options=d,g.pattern=a,g.regexp=f,g}])},592474,a=>a.a(async(b,c)=>{try{var d=a.i(304777),e=a.i(28675),f=a.i(815291),g=b([e,f]);function h(a){let b=a.length;for(;b>0&&47===a.charCodeAt(b-1);)b--;return b===a.length?a:a.slice(0,b)}function i(a,b="/api/auth"){try{let b=new URL(a);if("http:"!==b.protocol&&"https:"!==b.protocol)throw new f.BetterAuthError(`Invalid base URL: ${a}. URL must include 'http://' or 'https://'`)}catch(b){if(b instanceof f.BetterAuthError)throw b;throw new f.BetterAuthError(`Invalid base URL: ${a}. Please provide a valid base URL.`,{cause:b})}if(function(a){try{return"/"!==(h(new URL(a).pathname)||"/")}catch{throw new f.BetterAuthError(`Invalid base URL: ${a}. Please provide a valid base URL.`)}}(a))return a;let c=h(a);return b&&"/"!==b?(b=b.startsWith("/")?b:`/${b}`,`${c}${b}`):c}function j(a,b){return!!a&&""!==a.trim()&&("proto"===b?"http"===a||"https"===a:"host"===b&&![/\.\./,/\0/,/[\s]/,/^[.]/,/[<>'"]/,/javascript:/i,/file:/i,/data:/i].some(b=>b.test(a))&&(/^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*(:[0-9]{1,5})?$/.test(a)||/^(\d{1,3}\.){3}\d{1,3}(:[0-9]{1,5})?$/.test(a)||/^\[[0-9a-fA-F:]+\](:[0-9]{1,5})?$/.test(a)||/^localhost(:[0-9]{1,5})?$/i.test(a)))}function k(a,b,c,d,g){if(a)return i(a,b);if(!1!==d){let a=e.env.BETTER_AUTH_URL||e.env.NEXT_PUBLIC_BETTER_AUTH_URL||e.env.PUBLIC_BETTER_AUTH_URL||e.env.NUXT_PUBLIC_BETTER_AUTH_URL||e.env.NUXT_PUBLIC_AUTH_URL||("/"!==e.env.BASE_URL?e.env.BASE_URL:void 0);if(a)return i(a,b)}let h=c?.headers.get("x-forwarded-host"),k=c?.headers.get("x-forwarded-proto");if(h&&k&&g&&j(k,"proto")&&j(h,"host"))try{return i(`${k}://${h}`,b)}catch(a){}if(c){let a=l(c.url);if(!a)throw new f.BetterAuthError("Could not get origin from request. Please provide a valid base URL.");return i(a,b)}}function l(a){try{let b=new URL(a);return"null"===b.origin?null:b.origin}catch{return null}}function m(a){return"object"==typeof a&&null!==a&&"allowedHosts"in a&&Array.isArray(a.allowedHosts)}function n(a){return a instanceof Request||"object"==typeof a&&null!==a&&"[object Request]"===Object.prototype.toString.call(a)&&"string"==typeof a.url&&"object"==typeof a.headers&&null!==a.headers&&"function"==typeof a.headers.get}function o(a,b){let c=n(a)?a.headers:a;if(b){let a=c.get("x-forwarded-host");if(a&&j(a,"host"))return a}let d=c.get("host");if(d&&j(d,"host"))return d;if(n(a))try{return new URL(a.url).host}catch{}return null}[e,f]=g.then?(await g)():g,a.s(["getBaseURL",0,k,"getHost",0,function(a){try{return new URL(a).host}catch{return null}},"getOrigin",0,l,"getProtocol",0,function(a){try{return new URL(a).protocol}catch{return null}},"isDynamicBaseURLConfig",0,m,"isRequestLike",0,n,"resolveBaseURL",0,function(a,b,c,e,g){if(m(a)){if(c){let e=o(c,g);if(!e){if(a.fallback)return i(a.fallback,b);throw new f.BetterAuthError("Could not determine host from request headers. Please provide a fallback URL in your baseURL config.")}if(a.allowedHosts.some(a=>((a,b)=>{if(!a||!b)return!1;let c=a.replace(/^https?:\/\//,"").split("/")[0].toLowerCase(),e=b.replace(/^https?:\/\//,"").split("/")[0].toLowerCase();return e.includes("*")||e.includes("?")?(0,d.wildcardMatch)(e)(c):c.toLowerCase()===e.toLowerCase()})(e,a)))return i(`${function(a,b,c){let d;if("http"===b||"https"===b)return b;let e=n(a)?a.headers:a;if(c){let a=e.get("x-forwarded-proto");if(a&&j(a,"proto"))return a}if(n(a))try{let b=new URL(a.url);if("http:"===b.protocol||"https:"===b.protocol)return b.protocol.slice(0,-1)}catch{}let f=o(a,c);return f&&(d=f.replace(/:\d+$/,"").replace(/^\[|\]$/g,"").toLowerCase(),"localhost"===d||d.endsWith(".localhost")||"::1"===d||d.startsWith("127."))?"http":"https"}(c,a.protocol,g)}://${e}`,b);if(a.fallback)return i(a.fallback,b);throw new f.BetterAuthError(`Host "${e}" is not in the allowed hosts list. Allowed hosts: ${a.allowedHosts.join(", ")}. Add this host to your allowedHosts config or provide a fallback URL.`)}return a.fallback?i(a.fallback,b):k(void 0,b,void 0,e,g)}let h=n(c)?c:void 0;return"string"==typeof a?k(a,b,h,e,g):k(void 0,b,h,e,g)}]),c()}catch(a){c(a)}},!1),129522,a=>a.a(async(b,c)=>{try{var d=a.i(304777),e=a.i(592474),f=b([e]);[e]=f.then?(await f)():f,a.s(["matchesOriginPattern",0,(a,b,c)=>{if(a.startsWith("/"))return!!c?.allowRelativePaths&&a.startsWith("/")&&/^\/(?!\/|\\|%2f|%5c)[\w\-.\+/@]*(?:\?[\w\-.\+/=&%@]*)?$/.test(a);if(b.includes("*")||b.includes("?")){if(b.includes("://"))return(0,d.wildcardMatch)(b)((0,e.getOrigin)(a)||a);let c=(0,e.getHost)(a);return!!c&&(0,d.wildcardMatch)(b)(c)}let f=(0,e.getProtocol)(a);return"http:"!==f&&"https:"!==f&&f?a.startsWith(b):b===(0,e.getOrigin)(a)}]),c()}catch(a){c(a)}},!1),769675,a=>{"use strict";a.s(["hasServerSessionStore",0,function(a){return!!a.database||!!a.secondaryStorage},"shouldBindAccountCookieToSessionUser",0,function(a){return!!a.database}])},649021,a=>{"use strict";a.s(["isPromise",0,function(a){return!!a&&("object"==typeof a||"function"==typeof a)&&"function"==typeof a.then}])},827764,a=>{"use strict";var b=a.i(666680);function c(a,c){return new Promise((d,e)=>{(0,b.scrypt)(a.normalize("NFKC"),c,64,{N:16384,r:16,p:1,maxmem:0x4000000},(a,b)=>{a?e(a):d(b)})})}async function d(a){let d=(0,b.randomBytes)(16).toString("hex"),e=await c(a,d);return`${d}:${e.toString("hex")}`}async function e(a,b){let[d,e]=a.split(":");if(!d||!e)throw Error("Invalid password hash");return(await c(b,d)).toString("hex")===e}let f=async({hash:a,password:b})=>e(a,b);a.s(["hashPassword",0,d,"verifyPassword",0,f],827764)},832133,a=>{"use strict";class b extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(a,b){super(a,b),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}}class c extends b{[Symbol.asyncIterator];static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(a="multiple matching keys found in the JSON Web Key Set",b){super(a,b)}}a.s(["JOSEAlgNotAllowed",0,class extends b{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"},"JOSENotSupported",0,class extends b{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"},"JWEDecryptionFailed",0,class extends b{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(a="decryption operation failed",b){super(a,b)}},"JWEInvalid",0,class extends b{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"},"JWKInvalid",0,class extends b{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"},"JWSInvalid",0,class extends b{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"},"JWSSignatureVerificationFailed",0,class extends b{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(a="signature verification failed",b){super(a,b)}},"JWTClaimValidationFailed",0,class extends b{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(a,b,c="unspecified",d="unspecified"){super(a,{cause:{claim:c,reason:d,payload:b}}),this.claim=c,this.reason=d,this.payload=b}},"JWTExpired",0,class extends b{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(a,b,c="unspecified",d="unspecified"){super(a,{cause:{claim:c,reason:d,payload:b}}),this.claim=c,this.reason=d,this.payload=b}},"JWTInvalid",0,class extends b{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"}])},736256,598317,916339,581355,153039,91589,299646,778274,495906,654685,179137,444490,29110,373526,10862,a=>{"use strict";let b,c=new TextEncoder,d=new TextDecoder;function e(...a){let b=new Uint8Array(a.reduce((a,{length:b})=>a+b,0)),c=0;for(let d of a)b.set(d,c),c+=d.length;return b}function f(a,b,c){if(b<0||b>=0x100000000)throw RangeError(`value must be >= 0 and <= ${0x100000000-1}. Received ${b}`);a.set([b>>>24,b>>>16,b>>>8,255&b],c)}function g(a){let b=new Uint8Array(a.length);for(let c=0;c<a.length;c++){let d=a.charCodeAt(c);if(d>127)throw TypeError("non-ASCII string encountered in encode()");b[c]=d}return b}function h(a){if(Uint8Array.fromBase64)return Uint8Array.fromBase64("string"==typeof a?a:d.decode(a),{alphabet:"base64url"});let b=a;b instanceof Uint8Array&&(b=d.decode(b)),b=b.replace(/-/g,"+").replace(/_/g,"/");try{var c=b;if(Uint8Array.fromBase64)return Uint8Array.fromBase64(c);let a=atob(c),d=new Uint8Array(a.length);for(let b=0;b<a.length;b++)d[b]=a.charCodeAt(b);return d}catch{throw TypeError("The input to be decoded is not correctly encoded.")}}a.s(["concat",0,e,"decoder",0,d,"encode",0,g,"encoder",0,c,"uint32be",0,function(a){let b=new Uint8Array(4);return f(b,a),b},"uint64be",0,function(a){let b=Math.floor(a/0x100000000),c=new Uint8Array(8);return f(c,b,0),f(c,a%0x100000000,4),c}],598317),a.s(["decode",0,h,"encode",0,function(a){let b=a;return("string"==typeof b&&(b=c.encode(b)),Uint8Array.prototype.toBase64)?b.toBase64({alphabet:"base64url",omitPadding:!0}):(function(a){if(Uint8Array.prototype.toBase64)return a.toBase64();let b=[];for(let c=0;c<a.length;c+=32768)b.push(String.fromCharCode.apply(null,a.subarray(c,c+32768)));return btoa(b.join(""))})(b).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}],736256);let i=Symbol();function j(a,b,c){try{return h(a)}catch{throw new c(`Failed to base64url decode the ${b}`)}}async function k(a,b){let c=`SHA-${a.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(c,b))}a.s(["assertNotSet",0,function(a,b){if(a)throw TypeError(`${b} can only be called once`)},"decodeBase64url",0,j,"digest",0,k,"unprotected",0,i],916339);let l=(a,b="algorithm.name")=>TypeError(`CryptoKey does not support this operation, its ${b} must be ${a}`);function m(a,b){if(parseInt(a.hash.name.slice(4),10)!==b)throw l(`SHA-${b}`,"algorithm.hash")}function n(a,b){if(b&&!a.usages.includes(b))throw TypeError(`CryptoKey does not support this operation, its usages must include ${b}.`)}function o(a,b,c){switch(b){case"HS256":case"HS384":case"HS512":if("HMAC"!==a.algorithm.name)throw l("HMAC");m(a.algorithm,parseInt(b.slice(2),10));break;case"RS256":case"RS384":case"RS512":if("RSASSA-PKCS1-v1_5"!==a.algorithm.name)throw l("RSASSA-PKCS1-v1_5");m(a.algorithm,parseInt(b.slice(2),10));break;case"PS256":case"PS384":case"PS512":if("RSA-PSS"!==a.algorithm.name)throw l("RSA-PSS");m(a.algorithm,parseInt(b.slice(2),10));break;case"Ed25519":case"EdDSA":if("Ed25519"!==a.algorithm.name)throw l("Ed25519");break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":let d;if(d=a.algorithm,d.name!==b)throw l(b);break;case"ES256":case"ES384":case"ES512":{if("ECDSA"!==a.algorithm.name)throw l("ECDSA");let c=function(a){switch(a){case"ES256":return"P-256";case"ES384":return"P-384";case"ES512":return"P-521";default:throw Error("unreachable")}}(b);if(a.algorithm.namedCurve!==c)throw l(c,"algorithm.namedCurve");break}default:throw TypeError("CryptoKey does not support this operation")}n(a,c)}function p(a,b,...c){if((c=c.filter(Boolean)).length>2){let b=c.pop();a+=`one of type ${c.join(", ")}, or ${b}.`}else 2===c.length?a+=`one of type ${c[0]} or ${c[1]}.`:a+=`of type ${c[0]}.`;return null==b?a+=` Received ${b}`:"function"==typeof b&&b.name?a+=` Received function ${b.name}`:"object"==typeof b&&null!=b&&b.constructor?.name&&(a+=` Received an instance of ${b.constructor.name}`),a}a.s(["checkEncCryptoKey",0,function(a,b,c){switch(b){case"A128GCM":case"A192GCM":case"A256GCM":{if("AES-GCM"!==a.algorithm.name)throw l("AES-GCM");let c=parseInt(b.slice(1,4),10);if(a.algorithm.length!==c)throw l(c,"algorithm.length");break}case"A128KW":case"A192KW":case"A256KW":{if("AES-KW"!==a.algorithm.name)throw l("AES-KW");let c=parseInt(b.slice(1,4),10);if(a.algorithm.length!==c)throw l(c,"algorithm.length");break}case"ECDH":switch(a.algorithm.name){case"ECDH":case"X25519":break;default:throw l("ECDH or X25519")}break;case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":if("PBKDF2"!==a.algorithm.name)throw l("PBKDF2");break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":if("RSA-OAEP"!==a.algorithm.name)throw l("RSA-OAEP");m(a.algorithm,parseInt(b.slice(9),10)||1);break;default:throw TypeError("CryptoKey does not support this operation")}n(a,c)},"checkSigCryptoKey",0,o],581355);let q=(a,...b)=>p("Key must be ",a,...b),r=(a,b,...c)=>p(`Key for the ${a} algorithm must be `,b,...c);a.s(["invalidKeyInput",0,q,"withAlg",0,r],153039);let s=a=>{if(a?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return a instanceof CryptoKey}catch{return!1}},t=a=>a?.[Symbol.toStringTag]==="KeyObject",u=a=>s(a)||t(a);a.s(["assertCryptoKey",0,function(a){if(!s(a))throw Error("CryptoKey instance expected")},"isCryptoKey",0,s,"isKeyLike",0,u,"isKeyObject",0,t],91589);var v=a.i(832133);function w(a,b){if(a.startsWith("RS")||a.startsWith("PS")){let{modulusLength:c}=b.algorithm;if("number"!=typeof c||c<2048)throw TypeError(`${a} requires key modulusLength to be 2048 bits or larger`)}}function x(a,b){let c=`SHA-${a.slice(-3)}`;switch(a){case"HS256":case"HS384":case"HS512":return{hash:c,name:"HMAC"};case"PS256":case"PS384":case"PS512":return{hash:c,name:"RSA-PSS",saltLength:parseInt(a.slice(-3),10)>>3};case"RS256":case"RS384":case"RS512":return{hash:c,name:"RSASSA-PKCS1-v1_5"};case"ES256":case"ES384":case"ES512":return{hash:c,name:"ECDSA",namedCurve:b.namedCurve};case"Ed25519":case"EdDSA":return{name:"Ed25519"};case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return{name:a};default:throw new v.JOSENotSupported(`alg ${a} is not supported either by JOSE or your javascript runtime`)}}async function y(a,b,c){if(b instanceof Uint8Array){if(!a.startsWith("HS"))throw TypeError(q(b,"CryptoKey","KeyObject","JSON Web Key"));return crypto.subtle.importKey("raw",b,{hash:`SHA-${a.slice(-3)}`,name:"HMAC"},!1,[c])}return o(b,a,c),b}async function z(a,b,c){let d=await y(a,b,"sign");return w(a,d),new Uint8Array(await crypto.subtle.sign(x(a,d.algorithm),d,c))}async function A(a,b,c,d){let e=await y(a,b,"verify");w(a,e);let f=x(a,e.algorithm);try{return await crypto.subtle.verify(f,e,c,d)}catch{return!1}}function B(a){if("object"!=typeof a||null===a||"[object Object]"!==Object.prototype.toString.call(a))return!1;if(null===Object.getPrototypeOf(a))return!0;let b=a;for(;null!==Object.getPrototypeOf(b);)b=Object.getPrototypeOf(b);return Object.getPrototypeOf(a)===b}function C(...a){let b,c=a.filter(Boolean);if(0===c.length||1===c.length)return!0;for(let a of c){let c=Object.keys(a);if(!b||0===b.size){b=new Set(c);continue}for(let a of c){if(b.has(a))return!1;b.add(a)}}return!0}a.s(["checkKeyLength",0,w,"sign",0,z,"verify",0,A],299646);let D=a=>B(a)&&"string"==typeof a.kty,E=a=>"oct"!==a.kty&&("AKP"===a.kty&&"string"==typeof a.priv||"string"==typeof a.d),F=a=>"oct"!==a.kty&&void 0===a.d&&void 0===a.priv,G=a=>"oct"===a.kty&&"string"==typeof a.k;a.s(["isDisjoint",0,C,"isJWK",0,D,"isObject",0,B,"isPrivateJWK",0,E,"isPublicJWK",0,F,"isSecretJWK",0,G],778274);let H='Invalid or unsupported JWK "alg" (Algorithm) Parameter value';async function I(a){if(!a.alg)throw TypeError('"alg" argument is required when "jwk.alg" is not present');let{algorithm:b,keyUsages:c}=function(a){let b,c;switch(a.kty){case"AKP":switch(a.alg){case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":b={name:a.alg},c=a.priv?["sign"]:["verify"];break;default:throw new v.JOSENotSupported(H)}break;case"RSA":switch(a.alg){case"PS256":case"PS384":case"PS512":b={name:"RSA-PSS",hash:`SHA-${a.alg.slice(-3)}`},c=a.d?["sign"]:["verify"];break;case"RS256":case"RS384":case"RS512":b={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${a.alg.slice(-3)}`},c=a.d?["sign"]:["verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":b={name:"RSA-OAEP",hash:`SHA-${parseInt(a.alg.slice(-3),10)||1}`},c=a.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new v.JOSENotSupported(H)}break;case"EC":switch(a.alg){case"ES256":case"ES384":case"ES512":b={name:"ECDSA",namedCurve:({ES256:"P-256",ES384:"P-384",ES512:"P-521"})[a.alg]},c=a.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":b={name:"ECDH",namedCurve:a.crv},c=a.d?["deriveBits"]:[];break;default:throw new v.JOSENotSupported(H)}break;case"OKP":switch(a.alg){case"Ed25519":case"EdDSA":b={name:"Ed25519"},c=a.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":b={name:a.crv},c=a.d?["deriveBits"]:[];break;default:throw new v.JOSENotSupported(H)}break;default:throw new v.JOSENotSupported('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return{algorithm:b,keyUsages:c}}(a),d={...a};return"AKP"!==d.kty&&delete d.alg,delete d.use,crypto.subtle.importKey("jwk",d,b,a.ext??(!a.d&&!a.priv),a.key_ops??c)}a.s(["jwkToKey",0,I],495906);let J="given KeyObject instance cannot be used for this algorithm",K=async(a,c,d,e=!1)=>{let f=(b||=new WeakMap).get(a);if(f?.[d])return f[d];let g=await I({...c,alg:d});return e&&Object.freeze(a),f?f[d]=g:b.set(a,{[d]:g}),g};async function L(a,c){if(a instanceof Uint8Array||s(a))return a;if(t(a)){if("secret"===a.type)return a.export();if("toCryptoKey"in a&&"function"==typeof a.toCryptoKey)try{return((a,c)=>{let d,e=(b||=new WeakMap).get(a);if(e?.[c])return e[c];let f="public"===a.type,g=!!f;if("x25519"===a.asymmetricKeyType){switch(c){case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":break;default:throw TypeError(J)}d=a.toCryptoKey(a.asymmetricKeyType,g,f?[]:["deriveBits"])}if("ed25519"===a.asymmetricKeyType){if("EdDSA"!==c&&"Ed25519"!==c)throw TypeError(J);d=a.toCryptoKey(a.asymmetricKeyType,g,[f?"verify":"sign"])}switch(a.asymmetricKeyType){case"ml-dsa-44":case"ml-dsa-65":case"ml-dsa-87":if(c!==a.asymmetricKeyType.toUpperCase())throw TypeError(J);d=a.toCryptoKey(a.asymmetricKeyType,g,[f?"verify":"sign"])}if("rsa"===a.asymmetricKeyType){let b;switch(c){case"RSA-OAEP":b="SHA-1";break;case"RS256":case"PS256":case"RSA-OAEP-256":b="SHA-256";break;case"RS384":case"PS384":case"RSA-OAEP-384":b="SHA-384";break;case"RS512":case"PS512":case"RSA-OAEP-512":b="SHA-512";break;default:throw TypeError(J)}if(c.startsWith("RSA-OAEP"))return a.toCryptoKey({name:"RSA-OAEP",hash:b},g,f?["encrypt"]:["decrypt"]);d=a.toCryptoKey({name:c.startsWith("PS")?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:b},g,[f?"verify":"sign"])}if("ec"===a.asymmetricKeyType){let b=new Map([["prime256v1","P-256"],["secp384r1","P-384"],["secp521r1","P-521"]]).get(a.asymmetricKeyDetails?.namedCurve);if(!b)throw TypeError(J);let e={ES256:"P-256",ES384:"P-384",ES512:"P-521"};e[c]&&b===e[c]&&(d=a.toCryptoKey({name:"ECDSA",namedCurve:b},g,[f?"verify":"sign"])),c.startsWith("ECDH-ES")&&(d=a.toCryptoKey({name:"ECDH",namedCurve:b},g,f?[]:["deriveBits"]))}if(!d)throw TypeError(J);return e?e[c]=d:b.set(a,{[c]:d}),d})(a,c)}catch(a){if(a instanceof TypeError)throw a}let d=a.export({format:"jwk"});return K(a,d,c)}if(D(a))return a.k?h(a.k):K(a,a,c,!0);throw Error("unreachable")}function M(a,b,c,d,e){let f;if(void 0!==e.crit&&d?.crit===void 0)throw new a('"crit" (Critical) Header Parameter MUST be integrity protected');if(!d||void 0===d.crit)return new Set;if(!Array.isArray(d.crit)||0===d.crit.length||d.crit.some(a=>"string"!=typeof a||0===a.length))throw new a('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');for(let g of(f=void 0!==c?new Map([...Object.entries(c),...b.entries()]):b,d.crit)){if(!f.has(g))throw new v.JOSENotSupported(`Extension Header Parameter "${g}" is not recognized`);if(void 0===e[g])throw new a(`Extension Header Parameter "${g}" is missing`);if(f.get(g)&&void 0===d[g])throw new a(`Extension Header Parameter "${g}" MUST be integrity protected`)}return new Set(d.crit)}a.s(["normalizeKey",0,L],654685),a.s(["validateCrit",0,M],179137);let N=a=>a?.[Symbol.toStringTag],O=(a,b,c)=>{if(void 0!==b.use){let a;switch(c){case"sign":case"verify":a="sig";break;case"encrypt":case"decrypt":a="enc"}if(b.use!==a)throw TypeError(`Invalid key for this operation, its "use" must be "${a}" when present`)}if(void 0!==b.alg&&b.alg!==a)throw TypeError(`Invalid key for this operation, its "alg" must be "${a}" when present`);if(Array.isArray(b.key_ops)){let d;switch(!0){case"sign"===c||"verify"===c:case"dir"===a:case a.includes("CBC-HS"):d=c;break;case a.startsWith("PBES2"):d="deriveBits";break;case/^A\d{3}(?:GCM)?(?:KW)?$/.test(a):d=!a.includes("GCM")&&a.endsWith("KW")?"encrypt"===c?"wrapKey":"unwrapKey":c;break;case"encrypt"===c&&a.startsWith("RSA"):d="wrapKey";break;case"decrypt"===c:d=a.startsWith("RSA")?"unwrapKey":"deriveBits"}if(d&&b.key_ops?.includes?.(d)===!1)throw TypeError(`Invalid key for this operation, its "key_ops" must include "${d}" when present`)}return!0};function P(a,b,c){switch(a.substring(0,2)){case"A1":case"A2":case"di":case"HS":case"PB":((a,b,c)=>{if(!(b instanceof Uint8Array)){if(D(b)){if(G(b)&&O(a,b,c))return;throw TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present')}if(!u(b))throw TypeError(r(a,b,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"));if("secret"!==b.type)throw TypeError(`${N(b)} instances for symmetric algorithms must be of type "secret"`)}})(a,b,c);break;default:((a,b,c)=>{if(D(b))switch(c){case"decrypt":case"sign":if(E(b)&&O(a,b,c))return;throw TypeError("JSON Web Key for this operation must be a private JWK");case"encrypt":case"verify":if(F(b)&&O(a,b,c))return;throw TypeError("JSON Web Key for this operation must be a public JWK")}if(!u(b))throw TypeError(r(a,b,"CryptoKey","KeyObject","JSON Web Key"));if("secret"===b.type)throw TypeError(`${N(b)} instances for asymmetric algorithms must not be of type "secret"`);if("public"===b.type)switch(c){case"sign":throw TypeError(`${N(b)} instances for asymmetric algorithm signing must be of type "private"`);case"decrypt":throw TypeError(`${N(b)} instances for asymmetric algorithm decryption must be of type "private"`)}if("private"===b.type)switch(c){case"verify":throw TypeError(`${N(b)} instances for asymmetric algorithm verifying must be of type "public"`);case"encrypt":throw TypeError(`${N(b)} instances for asymmetric algorithm encryption must be of type "public"`)}})(a,b,c)}}a.s(["checkKeyType",0,P],444490);let Q=a=>Math.floor(a.getTime()/1e3),R=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;function S(a){let b,c=R.exec(a);if(!c||c[4]&&c[1])throw TypeError("Invalid time period format");let d=parseFloat(c[2]);switch(c[3].toLowerCase()){case"sec":case"secs":case"second":case"seconds":case"s":b=Math.round(d);break;case"minute":case"minutes":case"min":case"mins":case"m":b=Math.round(60*d);break;case"hour":case"hours":case"hr":case"hrs":case"h":b=Math.round(3600*d);break;case"day":case"days":case"d":b=Math.round(86400*d);break;case"week":case"weeks":case"w":b=Math.round(604800*d);break;default:b=Math.round(0x1e187e0*d)}return"-"===c[1]||"ago"===c[4]?-b:b}function T(a,b){if(!Number.isFinite(b))throw TypeError(`Invalid ${a} input`);return b}let U=a=>a.includes("/")?a.toLowerCase():`application/${a.toLowerCase()}`;function V(a,b,c={}){var e,f;let g,h;try{g=JSON.parse(d.decode(b))}catch{}if(!B(g))throw new v.JWTInvalid("JWT Claims Set must be a top-level JSON object");let{typ:i}=c;if(i&&("string"!=typeof a.typ||U(a.typ)!==U(i)))throw new v.JWTClaimValidationFailed('unexpected "typ" JWT header value',g,"typ","check_failed");let{requiredClaims:j=[],issuer:k,subject:l,audience:m,maxTokenAge:n}=c,o=[...j];for(let a of(void 0!==n&&o.push("iat"),void 0!==m&&o.push("aud"),void 0!==l&&o.push("sub"),void 0!==k&&o.push("iss"),new Set(o.reverse())))if(!(a in g))throw new v.JWTClaimValidationFailed(`missing required "${a}" claim`,g,a,"missing");if(k&&!(Array.isArray(k)?k:[k]).includes(g.iss))throw new v.JWTClaimValidationFailed('unexpected "iss" claim value',g,"iss","check_failed");if(l&&g.sub!==l)throw new v.JWTClaimValidationFailed('unexpected "sub" claim value',g,"sub","check_failed");if(m&&(e=g.aud,f="string"==typeof m?[m]:m,"string"==typeof e?!f.includes(e):!(Array.isArray(e)&&f.some(Set.prototype.has.bind(new Set(e))))))throw new v.JWTClaimValidationFailed('unexpected "aud" claim value',g,"aud","check_failed");switch(typeof c.clockTolerance){case"string":h=S(c.clockTolerance);break;case"number":h=c.clockTolerance;break;case"undefined":h=0;break;default:throw TypeError("Invalid clockTolerance option type")}let{currentDate:p}=c,q=Q(p||new Date);if((void 0!==g.iat||n)&&"number"!=typeof g.iat)throw new v.JWTClaimValidationFailed('"iat" claim must be a number',g,"iat","invalid");if(void 0!==g.nbf){if("number"!=typeof g.nbf)throw new v.JWTClaimValidationFailed('"nbf" claim must be a number',g,"nbf","invalid");if(g.nbf>q+h)throw new v.JWTClaimValidationFailed('"nbf" claim timestamp check failed',g,"nbf","check_failed")}if(void 0!==g.exp){if("number"!=typeof g.exp)throw new v.JWTClaimValidationFailed('"exp" claim must be a number',g,"exp","invalid");if(g.exp<=q-h)throw new v.JWTExpired('"exp" claim timestamp check failed',g,"exp","check_failed")}if(n){let a=q-g.iat;if(a-h>("number"==typeof n?n:S(n)))throw new v.JWTExpired('"iat" claim timestamp check failed (too far in the past)',g,"iat","check_failed");if(a<0-h)throw new v.JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)',g,"iat","check_failed")}return g}function W(a,b){if(void 0!==b&&(!Array.isArray(b)||b.some(a=>"string"!=typeof a)))throw TypeError(`"${a}" option must be an array of strings`);if(b)return new Set(b)}async function X(a,b,f){if(!B(a))throw new v.JWSInvalid("Flattened JWS must be an object");if(void 0===a.protected&&void 0===a.header)throw new v.JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');if(void 0!==a.protected&&"string"!=typeof a.protected)throw new v.JWSInvalid("JWS Protected Header incorrect type");if(void 0===a.payload)throw new v.JWSInvalid("JWS Payload missing");if("string"!=typeof a.signature)throw new v.JWSInvalid("JWS Signature missing or incorrect type");if(void 0!==a.header&&!B(a.header))throw new v.JWSInvalid("JWS Unprotected Header incorrect type");let i={};if(a.protected)try{let b=h(a.protected);i=JSON.parse(d.decode(b))}catch{throw new v.JWSInvalid("JWS Protected Header is invalid")}if(!C(i,a.header))throw new v.JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let k={...i,...a.header},l=M(v.JWSInvalid,new Map([["b64",!0]]),f?.crit,i,k),m=!0;if(l.has("b64")&&"boolean"!=typeof(m=i.b64))throw new v.JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:n}=k;if("string"!=typeof n||!n)throw new v.JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');let o=f&&W("algorithms",f.algorithms);if(o&&!o.has(n))throw new v.JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');if(m){if("string"!=typeof a.payload)throw new v.JWSInvalid("JWS Payload must be a string")}else if("string"!=typeof a.payload&&!(a.payload instanceof Uint8Array))throw new v.JWSInvalid("JWS Payload must be a string or an Uint8Array instance");let p=!1;"function"==typeof b&&(b=await b(i,a),p=!0),P(n,b,"verify");let q=e(void 0!==a.protected?g(a.protected):new Uint8Array,g("."),"string"==typeof a.payload?m?g(a.payload):c.encode(a.payload):a.payload),r=j(a.signature,"signature",v.JWSInvalid),s=await L(b,n);if(!await A(n,s,r,q))throw new v.JWSSignatureVerificationFailed;let t={payload:m?j(a.payload,"payload",v.JWSInvalid):"string"==typeof a.payload?c.encode(a.payload):a.payload};return(void 0!==a.protected&&(t.protectedHeader=i),void 0!==a.header&&(t.unprotectedHeader=a.header),p)?{...t,key:s}:t}async function Y(a,b,c){if(a instanceof Uint8Array&&(a=d.decode(a)),"string"!=typeof a)throw new v.JWSInvalid("Compact JWS must be a string or Uint8Array");let{0:e,1:f,2:g,length:h}=a.split(".");if(3!==h)throw new v.JWSInvalid("Invalid Compact JWS");let i=await X({payload:f,protected:e,signature:g},b,c),j={payload:i.payload,protectedHeader:i.protectedHeader};return"function"==typeof b?{...j,key:i.key}:j}async function Z(a,b,c){let d=await Y(a,b,c);if(d.protectedHeader.crit?.includes("b64")&&!1===d.protectedHeader.b64)throw new v.JWTInvalid("JWTs MUST NOT use unencoded payload");let e={payload:V(d.protectedHeader,d.payload,c),protectedHeader:d.protectedHeader};return"function"==typeof b?{...e,key:d.key}:e}a.s(["JWTClaimsBuilder",0,class{#a;constructor(a){if(!B(a))throw TypeError("JWT Claims Set MUST be an object");this.#a=structuredClone(a)}data(){return c.encode(JSON.stringify(this.#a))}get iss(){return this.#a.iss}set iss(a){this.#a.iss=a}get sub(){return this.#a.sub}set sub(a){this.#a.sub=a}get aud(){return this.#a.aud}set aud(a){this.#a.aud=a}set jti(a){this.#a.jti=a}set nbf(a){"number"==typeof a?this.#a.nbf=T("setNotBefore",a):a instanceof Date?this.#a.nbf=T("setNotBefore",Q(a)):this.#a.nbf=Q(new Date)+S(a)}set exp(a){"number"==typeof a?this.#a.exp=T("setExpirationTime",a):a instanceof Date?this.#a.exp=T("setExpirationTime",Q(a)):this.#a.exp=Q(new Date)+S(a)}set iat(a){void 0===a?this.#a.iat=Q(new Date):a instanceof Date?this.#a.iat=T("setIssuedAt",Q(a)):"string"==typeof a?this.#a.iat=T("setIssuedAt",Q(new Date)+S(a)):this.#a.iat=T("setIssuedAt",a)}},"validateClaimsSet",0,V],29110),a.s(["validateAlgorithms",0,W],373526),a.s(["jwtVerify",0,Z],10862)},405463,a=>{"use strict";let b;function c(a,b=""){if("number"!=typeof a){let c=b&&`"${b}" `;throw TypeError(`${c}expected number, got ${typeof a}`)}if(!Number.isSafeInteger(a)||a<0){let c=b&&`"${b}" `;throw RangeError(`${c}expected integer >= 0, got ${a}`)}}function d(a,b,c=""){let e=a instanceof Uint8Array||ArrayBuffer.isView(a)&&"Uint8Array"===a.constructor.name&&"BYTES_PER_ELEMENT"in a&&1===a.BYTES_PER_ELEMENT,f=a?.length,g=void 0!==b;if(!e||g&&f!==b){let d=(c&&`"${c}" `)+"expected Uint8Array"+(g?` of length ${b}`:"")+", got "+(e?`length=${f}`:`type=${typeof a}`);if(!e)throw TypeError(d);throw RangeError(d)}return a}function e(a){if("function"!=typeof a||"function"!=typeof a.create)throw TypeError("Hash must wrapped by utils.createHasher");if(c(a.outputLen),c(a.blockLen),a.outputLen<1)throw Error('"outputLen" must be >= 1');if(a.blockLen<1)throw Error('"blockLen" must be >= 1')}function f(a,b=!0){if(a.destroyed)throw Error("Hash instance has been destroyed");if(b&&a.finished)throw Error("Hash#digest() has already been called")}function g(a,b){d(a,void 0,"digestInto() output");let c=b.outputLen;if(a.length<c)throw RangeError('"digestInto() output" expected to be of length >='+c)}function h(...a){for(let b=0;b<a.length;b++)a[b].fill(0)}function i(a){return new DataView(a.buffer,a.byteOffset,a.byteLength)}function j(a,b){return a<<32-b|a>>>b}class k{oHash;iHash;blockLen;outputLen;canXOF=!1;finished=!1;destroyed=!1;constructor(a,b){if(e(a),d(b,void 0,"key"),this.iHash=a.create(),"function"!=typeof this.iHash.update)throw Error("Expected instance of class which extends utils.Hash");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;const c=this.blockLen,f=new Uint8Array(c);f.set(b.length>c?a.create().update(b).digest():b);for(let a=0;a<f.length;a++)f[a]^=54;this.iHash.update(f),this.oHash=a.create();for(let a=0;a<f.length;a++)f[a]^=106;this.oHash.update(f),h(f)}update(a){return f(this),this.iHash.update(a),this}digestInto(a){f(this),g(a,this),this.finished=!0;let b=a.subarray(0,this.outputLen);this.iHash.digestInto(b),this.oHash.update(b),this.oHash.digestInto(b),this.destroy()}digest(){let a=new Uint8Array(this.oHash.outputLen);return this.digestInto(a),a}_cloneInto(a){a||=Object.create(Object.getPrototypeOf(this),{});let{oHash:b,iHash:c,finished:d,destroyed:e,blockLen:f,outputLen:g}=this;return a.finished=d,a.destroyed=e,a.blockLen=f,a.outputLen=g,a.oHash=b._cloneInto(a.oHash),a.iHash=c._cloneInto(a.iHash),a}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}}let l=((b=(a,b,c)=>new k(a,b).update(c).digest()).create=(a,b)=>new k(a,b),b),m=Uint8Array.of(0),n=Uint8Array.of();class o{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(a,b,c,d){this.blockLen=a,this.outputLen=b,this.padOffset=c,this.isLE=d,this.buffer=new Uint8Array(a),this.view=i(this.buffer)}update(a){f(this),d(a);let{view:b,buffer:c,blockLen:e}=this,g=a.length;for(let d=0;d<g;){let f=Math.min(e-this.pos,g-d);if(f===e){let b=i(a);for(;e<=g-d;d+=e)this.process(b,d);continue}c.set(a.subarray(d,d+f),this.pos),this.pos+=f,d+=f,this.pos===e&&(this.process(b,0),this.pos=0)}return this.length+=a.length,this.roundClean(),this}digestInto(a){f(this),g(a,this),this.finished=!0;let{buffer:b,view:c,blockLen:d,isLE:e}=this,{pos:j}=this;b[j++]=128,h(this.buffer.subarray(j)),this.padOffset>d-j&&(this.process(c,0),j=0);for(let a=j;a<d;a++)b[a]=0;c.setBigUint64(d-8,BigInt(8*this.length),e),this.process(c,0);let k=i(a),l=this.outputLen;if(l%4)throw Error("_sha2: outputLen must be aligned to 32bit");let m=l/4,n=this.get();if(m>n.length)throw Error("_sha2: outputLen bigger than state");for(let a=0;a<m;a++)k.setUint32(4*a,n[a],e)}digest(){let{buffer:a,outputLen:b}=this;this.digestInto(a);let c=a.slice(0,b);return this.destroy(),c}_cloneInto(a){(a||=new this.constructor).set(...this.get());let{blockLen:b,buffer:c,length:d,finished:e,destroyed:f,pos:g}=this;return a.destroyed=f,a.finished=e,a.length=d,a.pos=g,d%b&&a.buffer.set(c),a}clone(){return this._cloneInto()}}let p=Uint32Array.from([0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19]),q=Uint32Array.from([0xc1059ed8,0x367cd507,0x3070dd17,0xf70e5939,0xffc00b31,0x68581511,0x64f98fa7,0xbefa4fa4]),r=Uint32Array.from([0xcbbb9d5d,0xc1059ed8,0x629a292a,0x367cd507,0x9159015a,0x3070dd17,0x152fecd8,0xf70e5939,0x67332667,0xffc00b31,0x8eb44a87,0x68581511,0xdb0c2e0d,0x64f98fa7,0x47b5481d,0xbefa4fa4]),s=Uint32Array.from([0x6a09e667,0xf3bcc908,0xbb67ae85,0x84caa73b,0x3c6ef372,0xfe94f82b,0xa54ff53a,0x5f1d36f1,0x510e527f,0xade682d1,0x9b05688c,0x2b3e6c1f,0x1f83d9ab,0xfb41bd6b,0x5be0cd19,0x137e2179]),t=BigInt(0x100000000-1),u=BigInt(32),v=Uint32Array.from([0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,0xe49b69c1,0xefbe4786,0xfc19dc6,0x240ca1cc,0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,0xc6e00bf3,0xd5a79147,0x6ca6351,0x14292967,0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,0xd192e819,0xd6990624,0xf40e3585,0x106aa070,0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2]),w=new Uint32Array(64);class x extends o{constructor(a){super(64,a,8,!1)}get(){let{A:a,B:b,C:c,D:d,E:e,F:f,G:g,H:h}=this;return[a,b,c,d,e,f,g,h]}set(a,b,c,d,e,f,g,h){this.A=0|a,this.B=0|b,this.C=0|c,this.D=0|d,this.E=0|e,this.F=0|f,this.G=0|g,this.H=0|h}process(a,b){for(let c=0;c<16;c++,b+=4)w[c]=a.getUint32(b,!1);for(let a=16;a<64;a++){let b=w[a-15],c=w[a-2],d=j(b,7)^j(b,18)^b>>>3,e=j(c,17)^j(c,19)^c>>>10;w[a]=e+w[a-7]+d+w[a-16]|0}let{A:c,B:d,C:e,D:f,E:g,F:h,G:i,H:k}=this;for(let a=0;a<64;a++){var l,m,n,o;let b=k+(j(g,6)^j(g,11)^j(g,25))+((l=g)&h^~l&i)+v[a]+w[a]|0,p=(j(c,2)^j(c,13)^j(c,22))+((m=c)&(n=d)^m&(o=e)^n&o)|0;k=i,i=h,h=g,g=f+b|0,f=e,e=d,d=c,c=b+p|0}c=c+this.A|0,d=d+this.B|0,e=e+this.C|0,f=f+this.D|0,g=g+this.E|0,h=h+this.F|0,i=i+this.G|0,k=k+this.H|0,this.set(c,d,e,f,g,h,i,k)}roundClean(){h(w)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),h(this.buffer)}}class y extends x{A=0|p[0];B=0|p[1];C=0|p[2];D=0|p[3];E=0|p[4];F=0|p[5];G=0|p[6];H=0|p[7];constructor(){super(32)}}let z=function(a,b=!1){let c=a.length,d=new Uint32Array(c),e=new Uint32Array(c);for(let f=0;f<c;f++){let{h:c,l:g}=function(a,b=!1){return b?{h:Number(a&t),l:Number(a>>u&t)}:{h:0|Number(a>>u&t),l:0|Number(a&t)}}(a[f],b);[d[f],e[f]]=[c,g]}return[d,e]}(["0x428a2f98d728ae22","0x7137449123ef65cd","0xb5c0fbcfec4d3b2f","0xe9b5dba58189dbbc","0x3956c25bf348b538","0x59f111f1b605d019","0x923f82a4af194f9b","0xab1c5ed5da6d8118","0xd807aa98a3030242","0x12835b0145706fbe","0x243185be4ee4b28c","0x550c7dc3d5ffb4e2","0x72be5d74f27b896f","0x80deb1fe3b1696b1","0x9bdc06a725c71235","0xc19bf174cf692694","0xe49b69c19ef14ad2","0xefbe4786384f25e3","0x0fc19dc68b8cd5b5","0x240ca1cc77ac9c65","0x2de92c6f592b0275","0x4a7484aa6ea6e483","0x5cb0a9dcbd41fbd4","0x76f988da831153b5","0x983e5152ee66dfab","0xa831c66d2db43210","0xb00327c898fb213f","0xbf597fc7beef0ee4","0xc6e00bf33da88fc2","0xd5a79147930aa725","0x06ca6351e003826f","0x142929670a0e6e70","0x27b70a8546d22ffc","0x2e1b21385c26c926","0x4d2c6dfc5ac42aed","0x53380d139d95b3df","0x650a73548baf63de","0x766a0abb3c77b2a8","0x81c2c92e47edaee6","0x92722c851482353b","0xa2bfe8a14cf10364","0xa81a664bbc423001","0xc24b8b70d0f89791","0xc76c51a30654be30","0xd192e819d6ef5218","0xd69906245565a910","0xf40e35855771202a","0x106aa07032bbd1b8","0x19a4c116b8d2d0c8","0x1e376c085141ab53","0x2748774cdf8eeb99","0x34b0bcb5e19b48a8","0x391c0cb3c5c95a63","0x4ed8aa4ae3418acb","0x5b9cca4f7763e373","0x682e6ff3d6b2b8a3","0x748f82ee5defb2fc","0x78a5636f43172f60","0x84c87814a1f0ab72","0x8cc702081a6439ec","0x90befffa23631e28","0xa4506cebde82bde9","0xbef9a3f7b2c67915","0xc67178f2e372532b","0xca273eceea26619c","0xd186b8c721c0c207","0xeada7dd6cde0eb1e","0xf57d4f7fee6ed178","0x06f067aa72176fba","0x0a637dc5a2c898a6","0x113f9804bef90dae","0x1b710b35131c471b","0x28db77f523047d84","0x32caab7b40c72493","0x3c9ebe0a15c9bebc","0x431d67c49c100d4c","0x4cc5d4becb3e42b6","0x597f299cfc657e2a","0x5fcb6fab3ad6faec","0x6c44198c4a475817"].map(a=>BigInt(a))),A=z[0],B=z[1],C=new Uint32Array(80),D=new Uint32Array(80),E=function(a,b={}){let c=(b,c)=>a(c).update(b).digest(),d=a(void 0);return c.outputLen=d.outputLen,c.blockLen=d.blockLen,c.canXOF=d.canXOF,c.create=b=>a(b),Object.assign(c,b),Object.freeze(c)}(()=>new y,{oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,1])});var F=a.i(736256),G=a.i(916339),H=a.i(598317),I=a.i(581355),J=a.i(153039),K=a.i(832133),L=a.i(91589);function M(a){switch(a){case"A128GCM":return 128;case"A192GCM":return 192;case"A256GCM":case"A128CBC-HS256":return 256;case"A192CBC-HS384":return 384;case"A256CBC-HS512":return 512;default:throw new K.JOSENotSupported(`Unsupported JWE Algorithm: ${a}`)}}let N=a=>crypto.getRandomValues(new Uint8Array(M(a)>>3));function O(a,b){let c=a.byteLength<<3;if(c!==b)throw new K.JWEInvalid(`Invalid Content Encryption Key length. Expected ${b} bits, got ${c} bits`)}function P(a){switch(a){case"A128GCM":case"A128GCMKW":case"A192GCM":case"A192GCMKW":case"A256GCM":case"A256GCMKW":return 96;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return 128;default:throw new K.JOSENotSupported(`Unsupported JWE Algorithm: ${a}`)}}function Q(a,b){if(b.length<<3!==P(a))throw new K.JWEInvalid("Invalid Initialization Vector length")}async function R(a,b,c){if(!(b instanceof Uint8Array))throw TypeError((0,J.invalidKeyInput)(b,"Uint8Array"));let d=parseInt(a.slice(1,4),10);return{encKey:await crypto.subtle.importKey("raw",b.subarray(d>>3),"AES-CBC",!1,[c]),macKey:await crypto.subtle.importKey("raw",b.subarray(0,d>>3),{hash:`SHA-${d<<1}`,name:"HMAC"},!1,["sign"]),keySize:d}}async function S(a,b,c){return new Uint8Array((await crypto.subtle.sign("HMAC",a,b)).slice(0,c>>3))}async function T(a,b,c,d,e){let{encKey:f,macKey:g,keySize:h}=await R(a,c,"encrypt"),i=new Uint8Array(await crypto.subtle.encrypt({iv:d,name:"AES-CBC"},f,b)),j=(0,H.concat)(e,d,i,(0,H.uint64be)(e.length<<3));return{ciphertext:i,tag:await S(g,j,h),iv:d}}async function U(a,b){if(!(a instanceof Uint8Array))throw TypeError("First argument must be a buffer");if(!(b instanceof Uint8Array))throw TypeError("Second argument must be a buffer");let c={name:"HMAC",hash:"SHA-256"},d=await crypto.subtle.generateKey(c,!1,["sign"]),e=new Uint8Array(await crypto.subtle.sign(c,d,a)),f=new Uint8Array(await crypto.subtle.sign(c,d,b)),g=0,h=-1;for(;++h<32;)g|=e[h]^f[h];return 0===g}async function V(a,b,c,d,e,f){let g,h,{encKey:i,macKey:j,keySize:k}=await R(a,b,"decrypt"),l=(0,H.concat)(f,d,c,(0,H.uint64be)(f.length<<3)),m=await S(j,l,k);try{g=await U(e,m)}catch{}if(!g)throw new K.JWEDecryptionFailed;try{h=new Uint8Array(await crypto.subtle.decrypt({iv:d,name:"AES-CBC"},i,c))}catch{}if(!h)throw new K.JWEDecryptionFailed;return h}async function W(a,b,c,d,e){let f;c instanceof Uint8Array?f=await crypto.subtle.importKey("raw",c,"AES-GCM",!1,["encrypt"]):((0,I.checkEncCryptoKey)(c,a,"encrypt"),f=c);let g=new Uint8Array(await crypto.subtle.encrypt({additionalData:e,iv:d,name:"AES-GCM",tagLength:128},f,b)),h=g.slice(-16);return{ciphertext:g.slice(0,-16),tag:h,iv:d}}async function X(a,b,c,d,e,f){let g;b instanceof Uint8Array?g=await crypto.subtle.importKey("raw",b,"AES-GCM",!1,["decrypt"]):((0,I.checkEncCryptoKey)(b,a,"decrypt"),g=b);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:f,iv:d,name:"AES-GCM",tagLength:128},g,(0,H.concat)(c,e)))}catch{throw new K.JWEDecryptionFailed}}let Y="Unsupported JWE Content Encryption Algorithm";async function Z(a,b,c,d,e){if(!(0,L.isCryptoKey)(c)&&!(c instanceof Uint8Array))throw TypeError((0,J.invalidKeyInput)(c,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(d)Q(a,d);else d=crypto.getRandomValues(new Uint8Array(P(a)>>3));switch(a){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return c instanceof Uint8Array&&O(c,parseInt(a.slice(-3),10)),T(a,b,c,d,e);case"A128GCM":case"A192GCM":case"A256GCM":return c instanceof Uint8Array&&O(c,parseInt(a.slice(1,4),10)),W(a,b,c,d,e);default:throw new K.JOSENotSupported(Y)}}async function $(a,b,c,d,e,f){if(!(0,L.isCryptoKey)(b)&&!(b instanceof Uint8Array))throw TypeError((0,J.invalidKeyInput)(b,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(!d)throw new K.JWEInvalid("JWE Initialization Vector missing");if(!e)throw new K.JWEInvalid("JWE Authentication Tag missing");switch(Q(a,d),a){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return b instanceof Uint8Array&&O(b,parseInt(a.slice(-3),10)),V(a,b,c,d,e,f);case"A128GCM":case"A192GCM":case"A256GCM":return b instanceof Uint8Array&&O(b,parseInt(a.slice(1,4),10)),X(a,b,c,d,e,f);default:throw new K.JOSENotSupported(Y)}}function _(a,b){if(a.algorithm.length!==parseInt(b.slice(1,4),10))throw TypeError(`Invalid key size for alg: ${b}`)}function aa(a,b,c){return a instanceof Uint8Array?crypto.subtle.importKey("raw",a,"AES-KW",!0,[c]):((0,I.checkEncCryptoKey)(a,b,c),a)}async function ab(a,b,c){let d=await aa(b,a,"wrapKey");_(d,a);let e=await crypto.subtle.importKey("raw",c,{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",e,d,"AES-KW"))}async function ac(a,b,c){let d=await aa(b,a,"unwrapKey");_(d,a);let e=await crypto.subtle.unwrapKey("raw",c,d,"AES-KW",{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",e))}function ad(a){return(0,H.concat)((0,H.uint32be)(a.length),a)}async function ae(a,b,c){let d=b>>3,e=Math.ceil(d/32),f=new Uint8Array(32*e);for(let b=1;b<=e;b++){let d=new Uint8Array(4+a.length+c.length);d.set((0,H.uint32be)(b),0),d.set(a,4),d.set(c,4+a.length);let e=await (0,G.digest)("sha256",d);f.set(e,(b-1)*32)}return f.slice(0,d)}async function af(a,b,c,d,e=new Uint8Array,f=new Uint8Array){var g;(0,I.checkEncCryptoKey)(a,"ECDH"),(0,I.checkEncCryptoKey)(b,"ECDH","deriveBits");let h=ad((0,H.encode)(c)),i=ad(e),j=ad(f),k=(0,H.uint32be)(d),l=new Uint8Array,m=(0,H.concat)(h,i,j,k,l);return ae(new Uint8Array(await crypto.subtle.deriveBits({name:a.algorithm.name,public:a},b,"X25519"===(g=a).algorithm.name?256:Math.ceil(parseInt(g.algorithm.namedCurve.slice(-3),10)/8)<<3)),d,m)}function ag(a){switch(a.algorithm.namedCurve){case"P-256":case"P-384":case"P-521":return!0;default:return"X25519"===a.algorithm.name}}async function ah(a,b,c,d){if(!(a instanceof Uint8Array)||a.length<8)throw new K.JWEInvalid("PBES2 Salt Input must be 8 or more octets");if(!Number.isSafeInteger(c)||1!==Math.sign(c))throw new K.JWEInvalid("PBES2 Count Input must be a positive integer");let e=(0,H.concat)((0,H.encode)(b),Uint8Array.of(0),a),f=parseInt(b.slice(13,16),10),g={hash:`SHA-${b.slice(8,11)}`,iterations:c,name:"PBKDF2",salt:e},h=await (d instanceof Uint8Array?crypto.subtle.importKey("raw",d,"PBKDF2",!1,["deriveBits"]):((0,I.checkEncCryptoKey)(d,b,"deriveBits"),d));return new Uint8Array(await crypto.subtle.deriveBits(g,h,f))}async function ai(a,b,c,d=2048,e=crypto.getRandomValues(new Uint8Array(16))){let f=await ah(e,a,d,b);return{encryptedKey:await ab(a.slice(-6),f,c),p2c:d,p2s:(0,F.encode)(e)}}async function aj(a,b,c,d,e){let f=await ah(e,a,d,b);return ac(a.slice(-6),f,c)}var ak=a.i(299646);let al=a=>{switch(a){case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":return"RSA-OAEP";default:throw new K.JOSENotSupported(`alg ${a} is not supported either by JOSE or your javascript runtime`)}};async function am(a,b,c){return(0,I.checkEncCryptoKey)(b,a,"encrypt"),(0,ak.checkKeyLength)(a,b),new Uint8Array(await crypto.subtle.encrypt(al(a),b,c))}async function an(a,b,c){return(0,I.checkEncCryptoKey)(b,a,"decrypt"),(0,ak.checkKeyLength)(a,b),new Uint8Array(await crypto.subtle.decrypt(al(a),b,c))}var ao=a.i(654685),ap=a.i(495906),aq=a.i(778274);async function ar(a,b,c){let d;if(!(0,aq.isObject)(a))throw TypeError("JWK must be an object");switch(b??=a.alg,d??=c?.extractable??a.ext,a.kty){case"oct":if("string"!=typeof a.k||!a.k)throw TypeError('missing "k" (Key Value) Parameter value');return(0,F.decode)(a.k);case"RSA":if("oth"in a&&void 0!==a.oth)throw new K.JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');return(0,ap.jwkToKey)({...a,alg:b,ext:d});case"AKP":if("string"!=typeof a.alg||!a.alg)throw TypeError('missing "alg" (Algorithm) Parameter value');if(void 0!==b&&b!==a.alg)throw TypeError("JWK alg and alg option value mismatch");return(0,ap.jwkToKey)({...a,ext:d});case"EC":case"OKP":return(0,ap.jwkToKey)({...a,alg:b,ext:d});default:throw new K.JOSENotSupported('Unsupported "kty" (Key Type) Parameter value')}}async function as(a){if((0,L.isKeyObject)(a))if("secret"!==a.type)return a.export({format:"jwk"});else a=a.export();if(a instanceof Uint8Array)return{kty:"oct",k:(0,F.encode)(a)};if(!(0,L.isCryptoKey)(a))throw TypeError((0,J.invalidKeyInput)(a,"CryptoKey","KeyObject","Uint8Array"));if(!a.extractable)throw TypeError("non-extractable CryptoKey cannot be exported as a JWK");let{ext:b,key_ops:c,alg:d,use:e,...f}=await crypto.subtle.exportKey("jwk",a);return"AKP"===f.kty&&(f.alg=d),f}async function at(a){return as(a)}async function au(a,b,c,d){let e=a.slice(0,7),f=await Z(e,c,b,d,new Uint8Array);return{encryptedKey:f.ciphertext,iv:(0,F.encode)(f.iv),tag:(0,F.encode)(f.tag)}}async function av(a,b,c,d,e){return $(a.slice(0,7),b,c,d,e,new Uint8Array)}let aw='Invalid or unsupported "alg" (JWE Algorithm) header value';function ax(a){if(void 0===a)throw new K.JWEInvalid("JWE Encrypted Key missing")}async function ay(a,b,c,d,e){switch(a){case"dir":if(void 0!==c)throw new K.JWEInvalid("Encountered unexpected JWE Encrypted Key");return b;case"ECDH-ES":if(void 0!==c)throw new K.JWEInvalid("Encountered unexpected JWE Encrypted Key");case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{let e,f;if(!(0,aq.isObject)(d.epk))throw new K.JWEInvalid('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');if((0,L.assertCryptoKey)(b),!ag(b))throw new K.JOSENotSupported("ECDH with the provided key is not allowed or not supported by your javascript runtime");let g=await ar(d.epk,a);if((0,L.assertCryptoKey)(g),void 0!==d.apu){if("string"!=typeof d.apu)throw new K.JWEInvalid('JOSE Header "apu" (Agreement PartyUInfo) invalid');e=(0,G.decodeBase64url)(d.apu,"apu",K.JWEInvalid)}if(void 0!==d.apv){if("string"!=typeof d.apv)throw new K.JWEInvalid('JOSE Header "apv" (Agreement PartyVInfo) invalid');f=(0,G.decodeBase64url)(d.apv,"apv",K.JWEInvalid)}let h=await af(g,b,"ECDH-ES"===a?d.enc:a,"ECDH-ES"===a?M(d.enc):parseInt(a.slice(-5,-2),10),e,f);if("ECDH-ES"===a)return h;return ax(c),ac(a.slice(-6),h,c)}case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":return ax(c),(0,L.assertCryptoKey)(b),an(a,b,c);case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{let f;if(ax(c),"number"!=typeof d.p2c)throw new K.JWEInvalid('JOSE Header "p2c" (PBES2 Count) missing or invalid');let g=e?.maxPBES2Count||1e4;if(d.p2c>g)throw new K.JWEInvalid('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if("string"!=typeof d.p2s)throw new K.JWEInvalid('JOSE Header "p2s" (PBES2 Salt) missing or invalid');return f=(0,G.decodeBase64url)(d.p2s,"p2s",K.JWEInvalid),aj(a,b,c,d.p2c,f)}case"A128KW":case"A192KW":case"A256KW":return ax(c),ac(a,b,c);case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":if(ax(c),"string"!=typeof d.iv)throw new K.JWEInvalid('JOSE Header "iv" (Initialization Vector) missing or invalid');if("string"!=typeof d.tag)throw new K.JWEInvalid('JOSE Header "tag" (Authentication Tag) missing or invalid');return av(a,b,c,(0,G.decodeBase64url)(d.iv,"iv",K.JWEInvalid),(0,G.decodeBase64url)(d.tag,"tag",K.JWEInvalid));default:throw new K.JOSENotSupported(aw)}}async function az(a,b,c,d,e={}){let f,g,h;switch(a){case"dir":h=c;break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{let i;if((0,L.assertCryptoKey)(c),!ag(c))throw new K.JOSENotSupported("ECDH with the provided key is not allowed or not supported by your javascript runtime");let{apu:j,apv:k}=e;i=e.epk?await (0,ao.normalizeKey)(e.epk,a):(await crypto.subtle.generateKey(c.algorithm,!0,["deriveBits"])).privateKey;let{x:l,y:m,crv:n,kty:o}=await at(i),p=await af(c,i,"ECDH-ES"===a?b:a,"ECDH-ES"===a?M(b):parseInt(a.slice(-5,-2),10),j,k);if(g={epk:{x:l,crv:n,kty:o}},"EC"===o&&(g.epk.y=m),j&&(g.apu=(0,F.encode)(j)),k&&(g.apv=(0,F.encode)(k)),"ECDH-ES"===a){h=p;break}h=d||N(b);let q=a.slice(-6);f=await ab(q,p,h);break}case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":h=d||N(b),(0,L.assertCryptoKey)(c),f=await am(a,c,h);break;case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{h=d||N(b);let{p2c:i,p2s:j}=e;({encryptedKey:f,...g}=await ai(a,c,h,i,j));break}case"A128KW":case"A192KW":case"A256KW":h=d||N(b),f=await ab(a,c,h);break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{h=d||N(b);let{iv:i}=e;({encryptedKey:f,...g}=await au(a,c,h,i));break}default:throw new K.JOSENotSupported(aw)}return{cek:h,encryptedKey:f,parameters:g}}var aA=a.i(179137),aB=a.i(444490);function aC(a){if(void 0===globalThis[a])throw new K.JOSENotSupported(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${a} API.`)}async function aD(a){aC("CompressionStream");let b=new CompressionStream("deflate-raw"),c=b.writable.getWriter();c.write(a).catch(()=>{}),c.close().catch(()=>{});let d=[],e=b.readable.getReader();for(;;){let{value:a,done:b}=await e.read();if(b)break;d.push(a)}return(0,H.concat)(...d)}async function aE(a,b){aC("DecompressionStream");let c=new DecompressionStream("deflate-raw"),d=c.writable.getWriter();d.write(a).catch(()=>{}),d.close().catch(()=>{});let e=[],f=0,g=c.readable.getReader();for(;;){let{value:a,done:c}=await g.read();if(c)break;if(e.push(a),f+=a.byteLength,b!==1/0&&f>b)throw new K.JWEInvalid("Decompressed plaintext exceeded the configured limit")}return(0,H.concat)(...e)}class aF{#b;#c;#d;#e;#f;#g;#h;#i;constructor(a){if(!(a instanceof Uint8Array))throw TypeError("plaintext must be an instance of Uint8Array");this.#b=a}setKeyManagementParameters(a){return(0,G.assertNotSet)(this.#i,"setKeyManagementParameters"),this.#i=a,this}setProtectedHeader(a){return(0,G.assertNotSet)(this.#c,"setProtectedHeader"),this.#c=a,this}setSharedUnprotectedHeader(a){return(0,G.assertNotSet)(this.#d,"setSharedUnprotectedHeader"),this.#d=a,this}setUnprotectedHeader(a){return(0,G.assertNotSet)(this.#e,"setUnprotectedHeader"),this.#e=a,this}setAdditionalAuthenticatedData(a){return this.#f=a,this}setContentEncryptionKey(a){return(0,G.assertNotSet)(this.#g,"setContentEncryptionKey"),this.#g=a,this}setInitializationVector(a){return(0,G.assertNotSet)(this.#h,"setInitializationVector"),this.#h=a,this}async encrypt(a,b){let c,d,e,f,g,h;if(!this.#c&&!this.#e&&!this.#d)throw new K.JWEInvalid("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");if(!(0,aq.isDisjoint)(this.#c,this.#e,this.#d))throw new K.JWEInvalid("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let i={...this.#c,...this.#e,...this.#d};if((0,aA.validateCrit)(K.JWEInvalid,new Map,b?.crit,this.#c,i),void 0!==i.zip&&"DEF"!==i.zip)throw new K.JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(void 0!==i.zip&&!this.#c?.zip)throw new K.JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');let{alg:j,enc:k}=i;if("string"!=typeof j||!j)throw new K.JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid');if("string"!=typeof k||!k)throw new K.JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');if(this.#g&&("dir"===j||"ECDH-ES"===j))throw TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${j}`);(0,aB.checkKeyType)("dir"===j?k:j,a,"encrypt");{let e,f=await (0,ao.normalizeKey)(a,j);({cek:d,encryptedKey:c,parameters:e}=await az(j,k,f,this.#g,this.#i)),e&&(b&&G.unprotected in b?this.#e?this.#e={...this.#e,...e}:this.setUnprotectedHeader(e):this.#c?this.#c={...this.#c,...e}:this.setProtectedHeader(e))}if(this.#c?(f=(0,F.encode)(JSON.stringify(this.#c)),g=(0,H.encode)(f)):(f="",g=new Uint8Array),this.#f){h=(0,F.encode)(this.#f);let a=(0,H.encode)(h);e=(0,H.concat)(g,(0,H.encode)("."),a)}else e=g;let l=this.#b;"DEF"===i.zip&&(l=await aD(l).catch(a=>{throw new K.JWEInvalid("Failed to compress plaintext",{cause:a})}));let{ciphertext:m,tag:n,iv:o}=await Z(k,l,d,this.#h,e),p={ciphertext:(0,F.encode)(m)};return o&&(p.iv=(0,F.encode)(o)),n&&(p.tag=(0,F.encode)(n)),c&&(p.encrypted_key=(0,F.encode)(c)),h&&(p.aad=h),this.#c&&(p.protected=f),this.#d&&(p.unprotected=this.#d),this.#e&&(p.header=this.#e),p}}class aG{#j;constructor(a){this.#j=new aF(a)}setContentEncryptionKey(a){return this.#j.setContentEncryptionKey(a),this}setInitializationVector(a){return this.#j.setInitializationVector(a),this}setProtectedHeader(a){return this.#j.setProtectedHeader(a),this}setKeyManagementParameters(a){return this.#j.setKeyManagementParameters(a),this}async encrypt(a,b){let c=await this.#j.encrypt(a,b);return[c.protected,c.encrypted_key,c.iv,c.ciphertext,c.tag].join(".")}}var aH=a.i(29110);class aI{#g;#h;#i;#c;#k;#l;#m;#n;constructor(a={}){this.#n=new aH.JWTClaimsBuilder(a)}setIssuer(a){return this.#n.iss=a,this}setSubject(a){return this.#n.sub=a,this}setAudience(a){return this.#n.aud=a,this}setJti(a){return this.#n.jti=a,this}setNotBefore(a){return this.#n.nbf=a,this}setExpirationTime(a){return this.#n.exp=a,this}setIssuedAt(a){return this.#n.iat=a,this}setProtectedHeader(a){return(0,G.assertNotSet)(this.#c,"setProtectedHeader"),this.#c=a,this}setKeyManagementParameters(a){return(0,G.assertNotSet)(this.#i,"setKeyManagementParameters"),this.#i=a,this}setContentEncryptionKey(a){return(0,G.assertNotSet)(this.#g,"setContentEncryptionKey"),this.#g=a,this}setInitializationVector(a){return(0,G.assertNotSet)(this.#h,"setInitializationVector"),this.#h=a,this}replicateIssuerAsHeader(){return this.#k=!0,this}replicateSubjectAsHeader(){return this.#l=!0,this}replicateAudienceAsHeader(){return this.#m=!0,this}async encrypt(a,b){let c=new aG(this.#n.data());return this.#c&&(this.#k||this.#l||this.#m)&&(this.#c={...this.#c,iss:this.#k?this.#n.iss:void 0,sub:this.#l?this.#n.sub:void 0,aud:this.#m?this.#n.aud:void 0}),c.setProtectedHeader(this.#c),this.#h&&c.setInitializationVector(this.#h),this.#g&&c.setContentEncryptionKey(this.#g),this.#i&&c.setKeyManagementParameters(this.#i),c.encrypt(a,b)}}class aJ{#a;#c;#e;constructor(a){if(!(a instanceof Uint8Array))throw TypeError("payload must be an instance of Uint8Array");this.#a=a}setProtectedHeader(a){return(0,G.assertNotSet)(this.#c,"setProtectedHeader"),this.#c=a,this}setUnprotectedHeader(a){return(0,G.assertNotSet)(this.#e,"setUnprotectedHeader"),this.#e=a,this}async sign(a,b){let c,d,e,f;if(!this.#c&&!this.#e)throw new K.JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!(0,aq.isDisjoint)(this.#c,this.#e))throw new K.JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let g={...this.#c,...this.#e},h=(0,aA.validateCrit)(K.JWSInvalid,new Map([["b64",!0]]),b?.crit,this.#c,g),i=!0;if(h.has("b64")&&"boolean"!=typeof(i=this.#c.b64))throw new K.JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:j}=g;if("string"!=typeof j||!j)throw new K.JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');(0,aB.checkKeyType)(j,a,"sign"),i?(c=(0,F.encode)(this.#a),d=(0,H.encode)(c)):(d=this.#a,c=""),this.#c?(e=(0,F.encode)(JSON.stringify(this.#c)),f=(0,H.encode)(e)):(e="",f=new Uint8Array);let k=(0,H.concat)(f,(0,H.encode)("."),d),l=await (0,ao.normalizeKey)(a,j),m=await (0,ak.sign)(j,l,k),n={signature:(0,F.encode)(m),payload:c};return this.#e&&(n.header=this.#e),this.#c&&(n.protected=e),n}}class aK{#j;constructor(a){this.#j=new aJ(a)}setProtectedHeader(a){return this.#j.setProtectedHeader(a),this}async sign(a,b){let c=await this.#j.sign(a,b);if(void 0===c.payload)throw TypeError("use the flattened module for creating JWS with b64: false");return`${c.protected}.${c.payload}.${c.signature}`}}class aL{#c;#n;constructor(a={}){this.#n=new aH.JWTClaimsBuilder(a)}setIssuer(a){return this.#n.iss=a,this}setSubject(a){return this.#n.sub=a,this}setAudience(a){return this.#n.aud=a,this}setJti(a){return this.#n.jti=a,this}setNotBefore(a){return this.#n.nbf=a,this}setExpirationTime(a){return this.#n.exp=a,this}setIssuedAt(a){return this.#n.iat=a,this}setProtectedHeader(a){return this.#c=a,this}async sign(a,b){let c=new aK(this.#n.data());if(c.setProtectedHeader(this.#c),Array.isArray(this.#c?.crit)&&this.#c.crit.includes("b64")&&!1===this.#c.b64)throw new K.JWTInvalid("JWTs MUST NOT use unencoded payload");return c.sign(a,b)}}let aM=(a,b)=>{if("string"!=typeof a||!a)throw new K.JWKInvalid(`${b} missing or invalid`)};async function aN(a,b){let c,d;if((0,aq.isJWK)(a))c=a;else if((0,L.isKeyLike)(a))c=await at(a);else throw TypeError((0,J.invalidKeyInput)(a,"CryptoKey","KeyObject","JSON Web Key"));if("sha256"!==(b??="sha256")&&"sha384"!==b&&"sha512"!==b)throw TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');switch(c.kty){case"AKP":aM(c.alg,'"alg" (Algorithm) Parameter'),aM(c.pub,'"pub" (Public key) Parameter'),d={alg:c.alg,kty:c.kty,pub:c.pub};break;case"EC":aM(c.crv,'"crv" (Curve) Parameter'),aM(c.x,'"x" (X Coordinate) Parameter'),aM(c.y,'"y" (Y Coordinate) Parameter'),d={crv:c.crv,kty:c.kty,x:c.x,y:c.y};break;case"OKP":aM(c.crv,'"crv" (Subtype of Key Pair) Parameter'),aM(c.x,'"x" (Public Key) Parameter'),d={crv:c.crv,kty:c.kty,x:c.x};break;case"RSA":aM(c.e,'"e" (Exponent) Parameter'),aM(c.n,'"n" (Modulus) Parameter'),d={e:c.e,kty:c.kty,n:c.n};break;case"oct":aM(c.k,'"k" (Key Value) Parameter'),d={k:c.k,kty:c.kty};break;default:throw new K.JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported')}let e=(0,H.encode)(JSON.stringify(d));return(0,F.encode)(await (0,G.digest)(b,e))}var aO=a.i(373526);async function aP(a,b,c){let d,e,f,g,h,i;if(!(0,aq.isObject)(a))throw new K.JWEInvalid("Flattened JWE must be an object");if(void 0===a.protected&&void 0===a.header&&void 0===a.unprotected)throw new K.JWEInvalid("JOSE Header missing");if(void 0!==a.iv&&"string"!=typeof a.iv)throw new K.JWEInvalid("JWE Initialization Vector incorrect type");if("string"!=typeof a.ciphertext)throw new K.JWEInvalid("JWE Ciphertext missing or incorrect type");if(void 0!==a.tag&&"string"!=typeof a.tag)throw new K.JWEInvalid("JWE Authentication Tag incorrect type");if(void 0!==a.protected&&"string"!=typeof a.protected)throw new K.JWEInvalid("JWE Protected Header incorrect type");if(void 0!==a.encrypted_key&&"string"!=typeof a.encrypted_key)throw new K.JWEInvalid("JWE Encrypted Key incorrect type");if(void 0!==a.aad&&"string"!=typeof a.aad)throw new K.JWEInvalid("JWE AAD incorrect type");if(void 0!==a.header&&!(0,aq.isObject)(a.header))throw new K.JWEInvalid("JWE Shared Unprotected Header incorrect type");if(void 0!==a.unprotected&&!(0,aq.isObject)(a.unprotected))throw new K.JWEInvalid("JWE Per-Recipient Unprotected Header incorrect type");if(a.protected)try{let b=(0,F.decode)(a.protected);d=JSON.parse(H.decoder.decode(b))}catch{throw new K.JWEInvalid("JWE Protected Header is invalid")}if(!(0,aq.isDisjoint)(d,a.header,a.unprotected))throw new K.JWEInvalid("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");let j={...d,...a.header,...a.unprotected};if((0,aA.validateCrit)(K.JWEInvalid,new Map,c?.crit,d,j),void 0!==j.zip&&"DEF"!==j.zip)throw new K.JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(void 0!==j.zip&&!d?.zip)throw new K.JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');let{alg:k,enc:l}=j;if("string"!=typeof k||!k)throw new K.JWEInvalid("missing JWE Algorithm (alg) in JWE Header");if("string"!=typeof l||!l)throw new K.JWEInvalid("missing JWE Encryption Algorithm (enc) in JWE Header");let m=c&&(0,aO.validateAlgorithms)("keyManagementAlgorithms",c.keyManagementAlgorithms),n=c&&(0,aO.validateAlgorithms)("contentEncryptionAlgorithms",c.contentEncryptionAlgorithms);if(m&&!m.has(k)||!m&&k.startsWith("PBES2"))throw new K.JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');if(n&&!n.has(l))throw new K.JOSEAlgNotAllowed('"enc" (Encryption Algorithm) Header Parameter value not allowed');void 0!==a.encrypted_key&&(e=(0,G.decodeBase64url)(a.encrypted_key,"encrypted_key",K.JWEInvalid));let o=!1;"function"==typeof b&&(b=await b(d,a),o=!0),(0,aB.checkKeyType)("dir"===k?l:k,b,"decrypt");let p=await (0,ao.normalizeKey)(b,k);try{f=await ay(k,p,e,j,c)}catch(a){if(a instanceof TypeError||a instanceof K.JWEInvalid||a instanceof K.JOSENotSupported)throw a;f=N(l)}void 0!==a.iv&&(g=(0,G.decodeBase64url)(a.iv,"iv",K.JWEInvalid)),void 0!==a.tag&&(h=(0,G.decodeBase64url)(a.tag,"tag",K.JWEInvalid));let q=void 0!==a.protected?(0,H.encode)(a.protected):new Uint8Array;i=void 0!==a.aad?(0,H.concat)(q,(0,H.encode)("."),(0,H.encode)(a.aad)):q;let r=(0,G.decodeBase64url)(a.ciphertext,"ciphertext",K.JWEInvalid),s=await $(l,f,r,g,h,i),t={plaintext:s};if("DEF"===j.zip){let a=c?.maxDecompressedLength??25e4;if(0===a)throw new K.JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');if(a!==1/0&&(!Number.isSafeInteger(a)||a<1))throw TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");t.plaintext=await aE(s,a).catch(a=>{if(a instanceof K.JWEInvalid)throw a;throw new K.JWEInvalid("Failed to decompress plaintext",{cause:a})})}return(void 0!==a.protected&&(t.protectedHeader=d),void 0!==a.aad&&(t.additionalAuthenticatedData=(0,G.decodeBase64url)(a.aad,"aad",K.JWEInvalid)),void 0!==a.unprotected&&(t.sharedUnprotectedHeader=a.unprotected),void 0!==a.header&&(t.unprotectedHeader=a.header),o)?{...t,key:p}:t}async function aQ(a,b,c){if(a instanceof Uint8Array&&(a=H.decoder.decode(a)),"string"!=typeof a)throw new K.JWEInvalid("Compact JWE must be a string or Uint8Array");let{0:d,1:e,2:f,3:g,4:h,length:i}=a.split(".");if(5!==i)throw new K.JWEInvalid("Invalid Compact JWE");let j=await aP({ciphertext:g,iv:f||void 0,protected:d,tag:h||void 0,encrypted_key:e||void 0},b,c),k={plaintext:j.plaintext,protectedHeader:j.protectedHeader};return"function"==typeof b?{...k,key:j.key}:k}async function aR(a,b,c){let d=await aQ(a,b,c),e=(0,aH.validateClaimsSet)(d.protectedHeader,d.plaintext,c),{protectedHeader:f}=d;if(void 0!==f.iss&&f.iss!==e.iss)throw new K.JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch',e,"iss","mismatch");if(void 0!==f.sub&&f.sub!==e.sub)throw new K.JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch',e,"sub","mismatch");if(void 0!==f.aud&&JSON.stringify(f.aud)!==JSON.stringify(e.aud))throw new K.JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch',e,"aud","mismatch");let g={payload:e,protectedHeader:f};return"function"==typeof b?{...g,key:d.key}:g}var aS=a.i(10862);async function aT(a,b,c=3600){return await new aL(a).setProtectedHeader({alg:"HS256"}).setIssuedAt().setExpirationTime(Math.floor(Date.now()/1e3)+c).sign(new TextEncoder().encode(b))}async function aU(a,b){try{return(await (0,aS.jwtVerify)(a,new TextEncoder().encode(b))).payload}catch{return null}}let aV=new Uint8Array([66,101,116,116,101,114,65,117,116,104,46,106,115,32,71,101,110,101,114,97,116,101,100,32,69,110,99,114,121,112,116,105,111,110,32,75,101,121]),aW="A256CBC-HS512";function aX(a,b){var f,g,i;return f=new TextEncoder().encode(a),g=new TextEncoder().encode(b),function(a,b,f,g=32){e(a),c(g,"length"),d(b,void 0,"prk");let i=a.outputLen;if(b.length<i)throw Error('"prk" must be at least HashLen octets');if(g>255*i)throw Error("Length must be <= 255*HashLen");let j=Math.ceil(g/i);void 0===f?f=n:d(f,void 0,"info");let k=new Uint8Array(j*i),o=l.create(a,b),p=o._cloneInto(),q=new Uint8Array(o.outputLen);for(let a=0;a<j;a++)m[0]=a+1,p.update(0===a?n:q).update(f).update(m).digestInto(q),k.set(q,i*a),o._cloneInto(p);return o.destroy(),p.destroy(),h(q,m),k.slice(0,g)}(E,(i=g,e(E),void 0===i&&(i=new Uint8Array(E.outputLen)),l(E,i,f)),aV,64)}function aY(a){if("string"==typeof a)return[{version:0,value:a}];let b=[];for(let[c,d]of a.keys)b.push({version:c,value:d});return a.legacySecret&&!b.some(b=>b.value===a.legacySecret)&&b.push({version:-1,value:a.legacySecret}),b}async function aZ(a,b,c,d=3600){let e=aX(function(a){if("string"==typeof a)return a;let b=a.keys.get(a.currentVersion);if(!b)throw Error(`Secret version ${a.currentVersion} not found in keys`);return b}(b),c),f=await aN({kty:"oct",k:F.encode(e)},"sha256");return await new aI(a).setProtectedHeader({alg:"dir",enc:aW,kid:f}).setIssuedAt().setExpirationTime((Date.now()/1e3|0)+d).setJti(crypto.randomUUID()).encrypt(e)}let a$={clockTolerance:15,keyManagementAlgorithms:["dir"],contentEncryptionAlgorithms:[aW,"A256GCM"]};async function a_(a,b,c){if(!a)return null;let d=!1;try{d=void 0!==function(a){let b;if("string"==typeof a){let c=a.split(".");(3===c.length||5===c.length)&&([b]=c)}else if("object"==typeof a&&a)if("protected"in a)b=a.protected;else throw TypeError("Token does not contain a Protected Header");try{if("string"!=typeof b||!b)throw Error();let a=JSON.parse(H.decoder.decode((0,F.decode)(b)));if(!(0,aq.isObject)(a))throw Error();return a}catch{throw TypeError("Invalid Token or Protected Header formatting")}}(a).kid}catch{return null}try{let d=aY(b),{payload:e}=await aR(a,async a=>{let b=a.kid;if(void 0!==b){for(let a of d){let d=aX(a.value,c);if(b===await aN({kty:"oct",k:F.encode(d)},"sha256"))return d}throw Error("no matching decryption secret")}return d.length,aX(d[0].value,c)},a$);return e}catch{if(d)return null;let e=aY(b);if(e.length<=1)return null;for(let b=1;b<e.length;b++)try{let d=e[b],{payload:f}=await aR(a,aX(d.value,c),a$);return f}catch{continue}return null}}a.s(["signJWT",0,aT,"symmetricDecodeJWT",0,a_,"symmetricEncodeJWT",0,aZ,"verifyJWT",0,aU],405463)},704551,a=>a.a(async(b,c)=>{try{var d=a.i(224321),e=a.i(815291),f=a.i(940689),g=b([d,e,f]);[d,e,f]=g.then?(await g)():g;let j=new WeakMap;function h(a,b,c){let e=`${b}:${c}`;j.has(a)||j.set(a,new Map);let f=j.get(a);if(f.has(e))return f.get(e);let g="output"===c?(0,d.getAuthTables)(a)[b]?.fields??{}:{},h="user"===b||"session"===b||"account"===b?a[b]?.additionalFields:void 0,i={...g,...h??{}};for(let c of a.plugins||[])c.schema&&c.schema[b]&&(i={...i,...c.schema[b].fields});return f.set(e,i),i}function i(a,b){let c=b.action||"create",d=b.fields,f=Object.create(null);for(let b in d){if(b in a){if(!1===d[b].input){if(void 0!==d[b].defaultValue&&"update"!==c){f[b]=d[b].defaultValue;continue}if(a[b])throw e.APIError.from("BAD_REQUEST",{...e.BASE_ERROR_CODES.FIELD_NOT_ALLOWED,message:`${b} is not allowed to be set`});continue}if(d[b].validator?.input&&void 0!==a[b]){let c=d[b].validator.input["~standard"].validate(a[b]);if(c instanceof Promise)throw e.APIError.from("INTERNAL_SERVER_ERROR",e.BASE_ERROR_CODES.ASYNC_VALIDATION_NOT_SUPPORTED);if("issues"in c&&c.issues)throw e.APIError.from("BAD_REQUEST",{...e.BASE_ERROR_CODES.VALIDATION_ERROR,message:c.issues[0]?.message||"Validation Error"});f[b]=c.value;continue}if(d[b].transform?.input&&void 0!==a[b]){f[b]=d[b].transform?.input(a[b]);continue}f[b]=a[b];continue}if(void 0!==d[b].defaultValue&&"create"===c){if("function"==typeof d[b].defaultValue){f[b]=d[b].defaultValue();continue}f[b]=d[b].defaultValue;continue}if(d[b].required&&"create"===c)throw e.APIError.from("BAD_REQUEST",{...e.BASE_ERROR_CODES.MISSING_FIELD,message:`${b} is required`})}return f}a.s(["buildSyntheticUserOutput",0,function(a,b){let c=h(a,"user","output"),d={};for(let a in c){let e=c[a];!1!==e.returned&&(a in b&&void 0!==b[a]?d[a]=b[a]:void 0!==e.defaultValue?d[a]="function"==typeof e.defaultValue?e.defaultValue():e.defaultValue:e.required||(d[a]=null))}return"id"in b&&(d.id=b.id),d},"getSessionDefaultFields",0,function(a){let b=h(a,"session","input"),c={};for(let a in b)void 0!==b[a].defaultValue&&(c[a]="function"==typeof b[a].defaultValue?b[a].defaultValue():b[a].defaultValue);return c},"mergeSchema",0,function(a,b){if(!b)return a;for(let c in b){let d=b[c]?.modelName;for(let e in d&&(a[c].modelName=d),a[c].fields){let d=b[c]?.fields?.[e];d&&(a[c].fields[e].fieldName=d)}}return a},"parseAccountOutput",0,function(a,b){let{accessToken:c,refreshToken:d,idToken:e,accessTokenExpiresAt:g,refreshTokenExpiresAt:i,password:j,...k}=(0,f.filterOutputFields)(b,h(a,"account","output"));return k},"parseSessionInput",0,function(a,b,c){return i(b,{fields:h(a,"session","input"),action:c})},"parseSessionOutput",0,function(a,b){return(0,f.filterOutputFields)(b,h(a,"session","output"))},"parseUserInput",0,function(a,b={},c){return i(b,{fields:h(a,"user","input"),action:c})},"parseUserOutput",0,function(a,b){return(0,f.filterOutputFields)(b,h(a,"user","output"))}]),c()}catch(a){c(a)}},!1),186673,a=>{"use strict";a.s(["getDate",0,(a,b="ms")=>new Date(Date.now()+("sec"===b?1e3*a:a))])},584085,a=>{"use strict";let b=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|months?|mo|years?|yrs?|y)(?: (ago|from now))?$/i;function c(a){let c,d=b.exec(a);if(!d||d[4]&&d[1])throw TypeError(`Invalid time string format: "${a}". Use formats like "7d", "30m", "1 hour", etc.`);let e=parseFloat(d[2]),f=d[3].toLowerCase();switch(f){case"years":case"year":case"yrs":case"yr":case"y":c=315576e5*e;break;case"months":case"month":case"mo":c=2592e6*e;break;case"weeks":case"week":case"w":c=6048e5*e;break;case"days":case"day":case"d":c=864e5*e;break;case"hours":case"hour":case"hrs":case"hr":case"h":c=36e5*e;break;case"minutes":case"minute":case"mins":case"min":case"m":c=6e4*e;break;case"seconds":case"second":case"secs":case"sec":case"s":c=1e3*e;break;default:throw TypeError(`Unknown time unit: "${f}"`)}return"-"===d[1]||"ago"===d[4]?-c:c}a.s(["ms",0,function(a){return c(a)},"sec",0,function(a){return Math.round(c(a)/1e3)}])},583048,a=>{"use strict";function b(a){if(-1===a.indexOf("%"))return a;try{return decodeURIComponent(a)}catch{return a}}function c(a){if(!a)return[];let b=[],c=0,d=0;for(;d<a.length;){if(","===a[d]){let e=d+1;for(;e<a.length&&" "===a[e];)e++;for(;e<a.length&&"="!==a[e]&&";"!==a[e]&&","!==a[e];)e++;if(e<a.length&&"="===a[e]){let e=a.slice(c,d).trim();for(e&&b.push(e),c=d+1;c<a.length&&" "===a[c];)c++;d=c;continue}}d++}let e=a.slice(c).trim();return e&&b.push(e),b}function d(a){let d=new Map;return c(a).forEach(a=>{let[c,...e]=a.split(";").map(a=>a.trim()),[f,...h]=(c||"").split("="),i=g(h.join("="));if(!f)return;let j={value:b(i)};e.forEach(a=>{let[b,...c]=a.split("="),d=c.join("="),e=b.trim().toLowerCase();switch(e){case"max-age":j["max-age"]=d?parseInt(d.trim(),10):void 0;break;case"expires":j.expires=d?new Date(d.trim()):void 0;break;case"domain":j.domain=d?d.trim():void 0;break;case"path":j.path=d?d.trim():void 0;break;case"secure":j.secure=!0;break;case"httponly":j.httponly=!0;break;case"samesite":j.samesite=d?d.trim().toLowerCase():void 0;break;case"partitioned":j.partitioned=!0;break;default:j[e]=!d||d.trim()}}),d.set(f,j)}),d}let e=/^[\x21\x23-\x27\x2A\x2B\x2D\x2E\x30-\x39\x41-\x5A\x5E\x5F\x60\x61-\x7A\x7C\x7E]+$/,f=/^[\x20\x21\x23-\x3A\x3C-\x5B\x5D-\x7E]*$/;function g(a){return!(a.length<2)&&a.startsWith('"')&&a.endsWith('"')?a.slice(1,-1):a}function h(a){let b=0,c=a.length;for(;b<c;){let c=a.charCodeAt(b);if(32!==c&&9!==c)break;b++}for(;c>b;){let b=a.charCodeAt(c-1);if(32!==b&&9!==b)break;c--}return 0===b&&c===a.length?a:a.slice(b,c)}function i(a){let c=new Map;if(a.length<2)return c;for(let d of a.split(";")){let a=d.indexOf("=");if(-1===a)continue;let i=h(d.slice(0,a)),j=g(h(d.slice(a+1)));e.test(i)&&f.test(j)&&c.set(i,b(j))}return c}function j(a,b){let c=i(a.get("cookie")||"");for(let a of b)for(let[b,f]of d(a))e.test(b)&&c.set(b,f.value);a.set("cookie",Array.from(c,([a,b])=>`${a}=${encodeURIComponent(b)}`).join("; "))}a.s(["HOST_COOKIE_PREFIX",0,"__Host-","SECURE_COOKIE_PREFIX",0,"__Secure-","applySetCookies",0,j,"cookieNameRegex",0,e,"parseCookies",0,i,"parseSetCookieHeader",0,d,"setCookieToHeader",0,function(a){return b=>{let c=b.response.headers.get("set-cookie");c&&j(a,[c])}},"setRequestCookie",0,function(a,b,c){let d=i(a.get("cookie")||"");e.test(b)&&d.set(b,c),a.set("cookie",Array.from(d,([a,b])=>`${a}=${encodeURIComponent(b)}`).join("; "))},"splitSetCookieHeader",0,c,"stripSecureCookiePrefix",0,function(a){return a.startsWith("__Secure-")?a.slice(9):a.startsWith("__Host-")?a.slice(7):a},"toCookieOptions",0,function(a){return{maxAge:a["max-age"],expires:a.expires,domain:a.domain,path:a.path,secure:a.secure,httpOnly:a.httponly,sameSite:a.samesite,partitioned:a.partitioned}}])},142060,a=>{"use strict";var b=a.i(461713);a.s(["coerce",0,b])},646762,a=>a.a(async(b,c)=>{try{var d=a.i(405463),e=a.i(583048),f=a.i(140257),g=a.i(512418),h=a.i(142060),i=b([f]);[f]=i.then?(await i)():i;function j(a){let b=a.split("."),c=b[b.length-1],d=parseInt(c||"0",10);return isNaN(d)?0:d}function k(a,b){let c={};for(let d in a)c[d]={name:d,value:"",attributes:{...b,maxAge:0}};return c}let o=a=>(b,c,d)=>{let f=function(a,b){let c={};for(let[d,f]of(0,e.parseCookies)(b.headers?.get("cookie")||""))d.startsWith(a)&&(c[d]=f);return c}(b,d),g=d.context.logger;return{getValue:()=>Object.keys(f).sort((a,b)=>j(a)-j(b)).map(a=>f[a]).join(""),hasChunks:()=>Object.keys(f).length>0,chunk(d,e){let h=k(f,c);for(let a in f)delete f[a];for(let i of function(a,b,c,d){let e=Math.ceil(b.value.length/3896);if(1===e)return c[b.name]=b.value,[b];let f=[];for(let a=0;a<e;a++){let d=`${b.name}.${a}`,e=3896*a,g=b.value.substring(e,e+3896);f.push({...b,name:d,value:g}),c[d]=g}return d.debug(`CHUNKING_${a.toUpperCase()}_COOKIE`,{message:`${a} cookie exceeds allowed 4096 bytes.`,emptyCookieSize:200,valueSize:b.value.length,chunkCount:e,chunks:f.map(a=>a.value.length+200)}),f}(a,{name:b,value:d,attributes:{...c,...e}},f,g))h[i.name]=i;return Object.values(h)},clean(){let a=k(f,c);for(let a in f)delete f[a];return Object.values(a)},setCookies(a){for(let b of a)d.setCookie(b.name,b.value,b.attributes)}}},p=o("Session"),q=o("Account");function l(a,b){let c=a.getCookie(b);if(c)return c;let d=[],f=a.headers?.get("cookie");if(!f)return null;for(let[a,c]of(0,e.parseCookies)(f))if(a.startsWith(b+".")){let b=a.split(".").at(-1),e=parseInt(b||"0",10);isNaN(e)||d.push({index:e,value:c})}return d.length>0?(d.sort((a,b)=>a.index-b.index),d.map(a=>a.value).join("")):null}async function m(a,b){let c=a.context.authCookies.accountData,e={maxAge:300,...c.attributes},f=await (0,d.symmetricEncodeJWT)(b,a.context.secretConfig,"better-auth-account",e.maxAge);if(f.length>4096){let b=q(c.name,e,a),d=b.chunk(f,e);b.setCookies(d)}else{let b=q(c.name,e,a);if(b.hasChunks()){let a=b.clean();b.setCookies(a)}a.setCookie(c.name,f,e)}}async function n(a){let b=l(a,a.context.authCookies.accountData.name);if(b){let c=(0,f.safeJSONParse)(await (0,d.symmetricDecodeJWT)(b,a.context.secretConfig,"better-auth-account"));if(c)return c}return null}let r=g.optional(g.object({disableCookieCache:h.coerce.boolean().meta({description:"Disable cookie cache and fetch session from database"}).optional(),disableRefresh:h.coerce.boolean().meta({description:"Disable session refresh. Useful for checking session status, without updating the session"}).optional()}));a.s(["createAccountStore",0,q,"createSessionStore",0,p,"getAccountCookie",0,n,"getChunkedCookie",0,l,"getSessionQuerySchema",0,r,"setAccountCookie",0,m]),c()}catch(a){c(a)}},!1),711159,a=>{"use strict";function b(a){return a?"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}function c(a,b,c){let d="",e=0,f=0;for(let c of a)for(e=e<<8|c,f+=8;f>=6;)f-=6,d+=b[e>>f&63];if(f>0&&(d+=b[e<<6-f&63]),c){let a=(4-d.length%4)%4;d+="=".repeat(a)}return d}function d(a,b){let c=new Map;for(let a=0;a<b.length;a++)c.set(b[a],a);let d=[],e=0,f=0;for(let b of a){if("="===b)break;let a=c.get(b);if(void 0===a)throw Error(`Invalid Base64 character: ${b}`);e=e<<6|a,(f+=6)>=8&&(f-=8,d.push(e>>f&255))}return Uint8Array.from(d)}a.s(["base64",0,{encode(a,d={}){let e=b(!1);return c("string"==typeof a?new TextEncoder().encode(a):new Uint8Array(a),e,d.padding??!0)},decode(a){"string"!=typeof a&&(a=new TextDecoder().decode(a));let c=b(a.includes("-")||a.includes("_"));return d(a,c)}},"base64Url",0,{encode(a,d={}){let e=b(!0);return c("string"==typeof a?new TextEncoder().encode(a):new Uint8Array(a),e,d.padding??!0)},decode(a){let c=b(a.includes("-")||a.includes("_"));return d(a,c)}}])},198465,a=>{"use strict";let b=new Map,c={decode:(a,c="utf-8")=>(b.has(c)||b.set(c,new TextDecoder(c)),b.get(c).decode(a)),encode:new TextEncoder().encode};a.s(["binary",0,c])},956980,a=>{"use strict";a.s(["getWebcryptoSubtle",0,function(){let a="u">typeof globalThis&&globalThis.crypto;if(a&&"object"==typeof a.subtle&&null!=a.subtle)return a.subtle;throw Error("crypto.subtle must be defined")}])},958228,a=>{"use strict";var b=a.i(711159),c=a.i(956980);a.s(["createHMAC",0,(a="SHA-256",d="none")=>{let e={importKey:async(b,d)=>(0,c.getWebcryptoSubtle)().importKey("raw","string"==typeof b?new TextEncoder().encode(b):b,{name:"HMAC",hash:{name:a}},!1,[d]),sign:async(a,f)=>{"string"==typeof a&&(a=await e.importKey(a,"sign"));let g=await (0,c.getWebcryptoSubtle)().sign("HMAC",a,"string"==typeof f?new TextEncoder().encode(f):f);return"hex"===d?(a=>{if("string"==typeof a&&(a=new TextEncoder().encode(a)),0===a.byteLength)return"";let b=new Uint8Array(a),c="";for(let a of b)c+=a.toString(16).padStart(2,"0");return c})(g):"base64"===d||"base64url"===d||"base64urlnopad"===d?b.base64Url.encode(g,{padding:"base64urlnopad"!==d}):g},verify:async(a,f,g)=>("string"==typeof a&&(a=await e.importKey(a,"verify")),"hex"===d&&(g=(a=>{if(!a)return"";if("string"==typeof a){if(a.length%2!=0||!RegExp("^[0123456789abcdef]+$").test(a))throw Error("Invalid hexadecimal string");let b=new Uint8Array(a.length/2);for(let c=0;c<a.length;c+=2)b[c/2]=parseInt(a.slice(c,c+2),16);return new TextDecoder().decode(b)}return new TextDecoder().decode(a)})(g)),("base64"===d||"base64url"===d||"base64urlnopad"===d)&&(g=await b.base64.decode(g)),(0,c.getWebcryptoSubtle)().verify("HMAC",a,"string"==typeof g?new TextEncoder().encode(g):g,"string"==typeof f?new TextEncoder().encode(f):f))};return e}],958228)},46585,a=>a.a(async(b,c)=>{try{var d=a.i(592474),e=a.i(769675),f=a.i(405463),g=a.i(704551),h=a.i(186673),i=a.i(649021),j=a.i(584085),k=a.i(583048),l=a.i(646762),m=a.i(28675),n=a.i(815291),o=a.i(140257),p=a.i(940689),q=a.i(711159);a.i(198465);var r=a.i(958228),s=b([d,g,l,m,n,o,p]);function t(a){let b="string"==typeof a.baseURL?a.baseURL:void 0,c="object"==typeof a.baseURL&&null!==a.baseURL?a.baseURL.protocol:void 0,e=(a.advanced?.useSecureCookies!==void 0?a.advanced?.useSecureCookies:"https"===c||"http"!==c&&(b?b.startsWith("https://"):m.isProduction))?k.SECURE_COOKIE_PREFIX:"",f=!!a.advanced?.crossSubDomainCookies?.enabled,g=f?a.advanced?.crossSubDomainCookies?.domain||(b?new URL(b).hostname:void 0):void 0;if(f&&!g&&!(0,d.isDynamicBaseURLConfig)(a.baseURL))throw new n.BetterAuthError("baseURL is required when crossSubdomainCookies are enabled.");return function(b,c={}){let d=a.advanced?.cookiePrefix||"better-auth",h=a.advanced?.cookies?.[b]?.name||`${d}.${b}`,i=a.advanced?.cookies?.[b]?.attributes??{};return{name:`${e}${h}`,attributes:{secure:!!e,sameSite:"lax",path:"/",httpOnly:!0,...f?{domain:g}:{},...a.advanced?.defaultCookieAttributes,...c,...i}}}}async function u(a,b,c){let d;if(!a.context.options.session?.cookieCache?.enabled)return;let j=(0,p.filterOutputFields)(b.session,a.context.options.session?.additionalFields),m=(0,g.parseUserOutput)(a.context.options,b.user),n=a.context.options.session?.cookieCache?.version,o="1";if(n){if("string"==typeof n)o=n;else if("function"==typeof n){let a=n(b.session,b.user);o=(0,i.isPromise)(a)?await a:a}}let s={session:j,user:m,updatedAt:Date.now(),version:o},t={...a.context.authCookies.sessionData.attributes,maxAge:c?void 0:a.context.authCookies.sessionData.attributes.maxAge},u=(0,h.getDate)(t.maxAge||60,"sec").getTime(),v=a.context.options.session?.cookieCache?.strategy||"compact";if((d="jwe"===v?await (0,f.symmetricEncodeJWT)(s,a.context.secretConfig,"better-auth-session",t.maxAge||300):"jwt"===v?await (0,f.signJWT)(s,a.context.secret,t.maxAge||300):q.base64Url.encode(JSON.stringify({session:s,expiresAt:u,signature:await (0,r.createHMAC)("SHA-256","base64urlnopad").sign(a.context.secret,JSON.stringify({...s,expiresAt:u}))}),{padding:!1})).length>4093){let b=(0,l.createSessionStore)(a.context.authCookies.sessionData.name,t,a),c=b.chunk(d,t);b.setCookies(c)}else{let b=(0,l.createSessionStore)(a.context.authCookies.sessionData.name,t,a);if(b.hasChunks()){let a=b.clean();b.setCookies(a)}a.setCookie(a.context.authCookies.sessionData.name,d,t)}if(a.context.options.account?.storeAccountCookie&&!function(a,b){let c=new Set;a.responseHeaders&&c.add(a.responseHeaders),a.context?.responseHeaders&&c.add(a.context.responseHeaders);let d=`${b}=`,e=`${b}.`;for(let a of c)if(("function"==typeof a.getSetCookie?a.getSetCookie():(0,k.splitSetCookieHeader)(a.get("set-cookie")||"")).some(a=>a.startsWith(d)||a.startsWith(e)))return!0;return!1}(a,a.context.authCookies.accountData.name)){let c=await (0,l.getAccountCookie)(a);if(c)if((0,e.shouldBindAccountCookieToSessionUser)(a.context.options)&&c.userId!==b.user.id){w(a,a.context.authCookies.accountData);let b=(0,l.createAccountStore)(a.context.authCookies.accountData.name,a.context.authCookies.accountData.attributes,a);b.setCookies(b.clean())}else await (0,l.setAccountCookie)(a,c)}}async function v(a,b,c,d){let e=await a.getSignedCookie(a.context.authCookies.dontRememberToken.name,a.context.secret);c=void 0!==c?c:!!e;let f=a.context.authCookies.sessionToken.attributes,g=c?void 0:a.context.sessionConfig.expiresIn;await a.setSignedCookie(a.context.authCookies.sessionToken.name,b.session.token,a.context.secret,{...f,maxAge:g,...d}),c&&await a.setSignedCookie(a.context.authCookies.dontRememberToken.name,"true",a.context.secret,a.context.authCookies.dontRememberToken.attributes),await u(a,b,c),a.context.setNewSession(b)}function w(a,b){!function(a,b){let c=new Set;a.responseHeaders&&c.add(a.responseHeaders),a.context?.responseHeaders&&c.add(a.context.responseHeaders);let d=`${b}=`,e=`${b}.`;for(let a of c){let b="function"==typeof a.getSetCookie?a.getSetCookie():(0,k.splitSetCookieHeader)(a.get("set-cookie")||"");if(!b.length)continue;let c=b.filter(a=>!a.startsWith(d)&&!a.startsWith(e));if(c.length!==b.length)for(let b of(a.delete("set-cookie"),c))a.append("set-cookie",b)}}(a,b.name),a.setCookie(b.name,"",{...b.attributes,maxAge:0})}[d,g,l,m,n,o,p]=s.then?(await s)():s,a.s(["createCookieGetter",0,t,"deleteSessionCookie",0,function(a,b){if(w(a,a.context.authCookies.sessionToken),w(a,a.context.authCookies.sessionData),a.context.options.account?.storeAccountCookie){w(a,a.context.authCookies.accountData);let b=(0,l.createAccountStore)(a.context.authCookies.accountData.name,a.context.authCookies.accountData.attributes,a),c=b.clean();b.setCookies(c)}"cookie"===a.context.oauthConfig.storeStateStrategy&&w(a,a.context.createAuthCookie("oauth_state"));let c=(0,l.createSessionStore)(a.context.authCookies.sessionData.name,a.context.authCookies.sessionData.attributes,a),d=c.clean();c.setCookies(d),b||w(a,a.context.authCookies.dontRememberToken)},"expireCookie",0,w,"getCookies",0,function(a){let b=t(a),c=b("session_token",{maxAge:a.session?.expiresIn||(0,j.sec)("7d")}),d=b("session_data",{maxAge:a.session?.cookieCache?.maxAge||300}),e=b("account_data",{maxAge:a.session?.cookieCache?.maxAge||300}),f=b("dont_remember");return{sessionToken:{name:c.name,attributes:c.attributes},sessionData:{name:d.name,attributes:d.attributes},dontRememberToken:{name:f.name,attributes:f.attributes},accountData:{name:e.name,attributes:e.attributes}}},"setCookieCache",0,u,"setSessionCookie",0,v]),c()}catch(a){c(a)}},!1),531093,a=>a.a(async(b,c)=>{try{var d=a.i(28675),e=a.i(862e3),f=b([d,e]);[d,e]=f.then?(await f)():f,a.s(["getIp",0,function(a,b){if(b.advanced?.ipAddress?.disableIpTracking)return null;let c="headers"in a?a.headers:a;for(let a of b.advanced?.ipAddress?.ipAddressHeaders||["x-forwarded-for"]){let d="get"in c?c.get(a):c[a];if("string"==typeof d){let a=d.split(",")[0].trim();if((0,e.isValidIP)(a))return(0,e.normalizeIP)(a,{ipv6Subnet:b.advanced?.ipAddress?.ipv6Subnet})}}return(0,d.isTest)()||(0,d.isDevelopment)()?"127.0.0.1":null}]),c()}catch(a){c(a)}},!1),531429,a=>{"use strict";var b=a.i(711159),c=a.i(956980);a.s(["createHash",0,function(a,d){return{digest:async e=>{let f=new TextEncoder,g="string"==typeof e?f.encode(e):e,h=await (0,c.getWebcryptoSubtle)().digest(a,g);return"hex"===d?Array.from(new Uint8Array(h)).map(a=>a.toString(16).padStart(2,"0")).join(""):"base64"===d||"base64url"===d||"base64urlnopad"===d?d.includes("url")?b.base64Url.encode(h,{padding:"base64urlnopad"!==d}):b.base64.encode(h):h}}}])},81391,a=>{"use strict";var b=a.i(711159),c=a.i(531429);let d=async a=>{let d=await (0,c.createHash)("SHA-256").digest(new TextEncoder().encode(a));return b.base64Url.encode(new Uint8Array(d),{padding:!1})};async function e(a,b){return b&&"plain"!==b?"hashed"===b?d(a):"object"==typeof b&&"hash"in b?b.hash(a):a:a}a.s(["getStorageOption",0,function(a,b){if(b){if("object"==typeof b&&"default"in b){if(b.overrides){for(let[c,d]of Object.entries(b.overrides))if(a.startsWith(c))return d}return b.default}return b}},"processIdentifier",0,e])},563980,a=>a.a(async(b,c)=>{try{var d=a.i(782645),e=a.i(596657),f=b([d,e]);[d,e]=f.then?(await f)():f,a.s(["getWithHooks",0,function(a,b){let c=b.hooks;async function f(b,f,g,h){let i=await (0,d.getCurrentAuthContext)().catch(()=>null),j=b;for(let{source:a,hooks:d}of c){let c=d[g]?.update?.before;if(c){let d=await (0,e.withSpan)(`db update.before ${g}`,{[e.ATTR_HOOK_TYPE]:"update.before",[e.ATTR_DB_COLLECTION_NAME]:g,[e.ATTR_CONTEXT]:a},()=>c(b,i));if(!1===d)return null;"object"==typeof d&&"data"in d&&(j={...j,...d.data})}}let k=h?await h.fn(j):null,l=!h||h.executeMainFn?await (await (0,d.getCurrentAdapter)(a)).update({model:g,update:j,where:f}):k;for(let{source:a,hooks:b}of c){let c=b[g]?.update?.after;c&&await (0,d.queueAfterTransactionHook)(async()=>{await (0,e.withSpan)(`db update.after ${g}`,{[e.ATTR_HOOK_TYPE]:"update.after",[e.ATTR_DB_COLLECTION_NAME]:g,[e.ATTR_CONTEXT]:a},()=>c(l,i))})}return l}async function g(b,f,g,h){let i=await (0,d.getCurrentAuthContext)().catch(()=>null),j=b;for(let{source:a,hooks:d}of c){let c=d[g]?.update?.before;if(c){let d=await (0,e.withSpan)(`db updateMany.before ${g}`,{[e.ATTR_HOOK_TYPE]:"updateMany.before",[e.ATTR_DB_COLLECTION_NAME]:g,[e.ATTR_CONTEXT]:a},()=>c(b,i));if(!1===d)return null;"object"==typeof d&&"data"in d&&(j={...j,...d.data})}}let k=h?await h.fn(j):null,l=!h||h.executeMainFn?await (await (0,d.getCurrentAdapter)(a)).updateMany({model:g,update:j,where:f}):k;for(let{source:a,hooks:b}of c){let c=b[g]?.update?.after;c&&await (0,d.queueAfterTransactionHook)(async()=>{await (0,e.withSpan)(`db updateMany.after ${g}`,{[e.ATTR_HOOK_TYPE]:"updateMany.after",[e.ATTR_DB_COLLECTION_NAME]:g,[e.ATTR_CONTEXT]:a},()=>c(l,i))})}return l}async function h(b,f,g){let h=await (0,d.getCurrentAuthContext)().catch(()=>null),i=null;try{i=(await (await (0,d.getCurrentAdapter)(a)).findMany({model:f,where:b,limit:1}))[0]||null}catch{}if(i)for(let{source:a,hooks:b}of c){let c=b[f]?.delete?.before;if(c&&await (0,e.withSpan)(`db delete.before ${f}`,{[e.ATTR_HOOK_TYPE]:"delete.before",[e.ATTR_DB_COLLECTION_NAME]:f,[e.ATTR_CONTEXT]:a},()=>c(i,h))===!1)return null}let j=g?await g.fn(b):null,k=(!g||g.executeMainFn)&&i?await (await (0,d.getCurrentAdapter)(a)).delete({model:f,where:b}):j;if(i)for(let{source:a,hooks:b}of c){let c=b[f]?.delete?.after;c&&await (0,d.queueAfterTransactionHook)(async()=>{await (0,e.withSpan)(`db delete.after ${f}`,{[e.ATTR_HOOK_TYPE]:"delete.after",[e.ATTR_DB_COLLECTION_NAME]:f,[e.ATTR_CONTEXT]:a},()=>c(i,h))})}return k}async function i(b,f,g){let h=await (0,d.getCurrentAuthContext)().catch(()=>null),i=[];try{i=await (await (0,d.getCurrentAdapter)(a)).findMany({model:f,where:b})}catch{}for(let a of i)for(let{source:b,hooks:d}of c){let c=d[f]?.delete?.before;if(c&&await (0,e.withSpan)(`db delete.before ${f}`,{[e.ATTR_HOOK_TYPE]:"delete.before",[e.ATTR_DB_COLLECTION_NAME]:f,[e.ATTR_CONTEXT]:b},()=>c(a,h))===!1)return null}let j=g?await g.fn(b):null,k=!g||g.executeMainFn?await (await (0,d.getCurrentAdapter)(a)).deleteMany({model:f,where:b}):j;for(let a of i)for(let{source:b,hooks:g}of c){let c=g[f]?.delete?.after;c&&await (0,d.queueAfterTransactionHook)(async()=>{await (0,e.withSpan)(`db delete.after ${f}`,{[e.ATTR_HOOK_TYPE]:"delete.after",[e.ATTR_DB_COLLECTION_NAME]:f,[e.ATTR_CONTEXT]:b},()=>c(a,h))})}return k}async function j(b,f,g,h){let i=await (0,d.getCurrentAuthContext)().catch(()=>null),j=c.flatMap(({source:a,hooks:c})=>{let d=c[b]?.delete?.before;return d?[{source:a,fn:d}]:[]}),k=h??null;if(j.length){if(!k)try{k=(await (await (0,d.getCurrentAdapter)(a)).findMany({model:b,where:f,limit:1}))[0]||null}catch{}if(k){for(let{source:a,fn:c}of j)if(await (0,e.withSpan)(`db delete.before ${b}`,{[e.ATTR_HOOK_TYPE]:"delete.before",[e.ATTR_DB_COLLECTION_NAME]:b,[e.ATTR_CONTEXT]:a},()=>c(k,i))===!1)return null}}let l=await g();if(!l)return null;for(let{source:a,hooks:f}of c){let c=f[b]?.delete?.after;c&&await (0,d.queueAfterTransactionHook)(async()=>{await (0,e.withSpan)(`db delete.after ${b}`,{[e.ATTR_HOOK_TYPE]:"delete.after",[e.ATTR_DB_COLLECTION_NAME]:b,[e.ATTR_CONTEXT]:a},()=>c(l,i))})}return l}return{createWithHooks:async function(b,f,g){let h=await (0,d.getCurrentAuthContext)().catch(()=>null),i=b;for(let{source:a,hooks:b}of c){let c=b[f]?.create?.before;if(c){let b=await (0,e.withSpan)(`db create.before ${f}`,{[e.ATTR_HOOK_TYPE]:"create.before",[e.ATTR_DB_COLLECTION_NAME]:f,[e.ATTR_CONTEXT]:a},()=>c(i,h));if(!1===b)return null;"object"==typeof b&&"data"in b&&(i={...i,...b.data})}}let j=null;for(let{source:b,hooks:k}of((!g||g.executeMainFn)&&(j=await (await (0,d.getCurrentAdapter)(a)).create({model:f,data:i,forceAllowId:!0})),g?.fn&&(j=await g.fn(j??i)),c)){let a=k[f]?.create?.after;a&&await (0,d.queueAfterTransactionHook)(async()=>{await (0,e.withSpan)(`db create.after ${f}`,{[e.ATTR_HOOK_TYPE]:"create.after",[e.ATTR_DB_COLLECTION_NAME]:f,[e.ATTR_CONTEXT]:b},()=>a(j,h))})}return j},updateWithHooks:f,updateManyWithHooks:g,deleteWithHooks:h,deleteManyWithHooks:i,consumeOneWithHooks:j}}]),c()}catch(a){c(a)}},!1),427051,a=>a.a(async(b,c)=>{try{var d=a.i(531093),e=a.i(704551),f=a.i(186673),g=a.i(81391),h=a.i(563980),i=a.i(782645),j=a.i(979282),k=a.i(140257),l=a.i(711159),m=a.i(531429),n=b([d,e,h,i,j,k]);function o(a,b=Date.now()){let c="number"==typeof a?a:a.getTime();return Math.max(Math.floor((c-b)/1e3),0)}[d,e,h,i,j,k]=n.then?(await n)():n,a.s(["createInternalAdapter",0,(a,b)=>{let c=b.logger,n=b.options,p=n.secondaryStorage,q=new Map,r=!1,s=n.session?.expiresIn||604800,{createWithHooks:t,updateWithHooks:u,updateManyWithHooks:v,deleteWithHooks:w,deleteManyWithHooks:x,consumeOneWithHooks:y}=(0,h.getWithHooks)(a,b);async function z(a){if(!p)return;let b=await p.get(`active-sessions-${a.id}`);if(!b)return;let c=Date.now(),d=((0,k.safeJSONParse)(b)||[]).filter(a=>a.expiresAt>c);await Promise.all(d.map(async({token:b})=>{let d=await p.get(b);if(!d)return;let e=(0,k.safeJSONParse)(d);if(!e)return;let f=o(e.session.expiresAt,c);await p.set(b,JSON.stringify({session:e.session,user:a}),Math.floor(f))}))}async function A(a,b){let c,d=q.get(a)??Promise.resolve(),e=new Promise(a=>{c=a}),f=d.catch(()=>{}).then(()=>e);q.set(a,f),await d.catch(()=>{});try{return await b()}finally{c(),q.get(a)===f&&q.delete(a)}}return{createOAuthUser:async(b,c)=>(0,i.runWithTransaction)(a,async()=>{let a=await t({createdAt:new Date,updatedAt:new Date,...b,email:b.email?.toLowerCase()},"user",void 0);return{user:a,account:await t({...c,userId:a.id,createdAt:new Date,updatedAt:new Date},"account",void 0)}}),createUser:async a=>await t({createdAt:new Date,updatedAt:new Date,...a,email:a.email?.toLowerCase()},"user",void 0),createAccount:async a=>await t({createdAt:new Date,updatedAt:new Date,...a},"account",void 0),listSessions:async(c,d)=>{if(p){let a=await p.get(`active-sessions-${c}`);if(!a)return[];let d=(0,k.safeJSONParse)(a)||[],f=Date.now(),g=new Set,h=[];for(let{token:a,expiresAt:c}of d){if(c<=f||g.has(a))continue;g.add(a);let d=await p.get(a);if(d)try{let a="string"==typeof d?JSON.parse(d):d;if(!a?.session)continue;h.push((0,e.parseSessionOutput)(b.options,{...a.session,expiresAt:new Date(a.session.expiresAt)}))}catch{continue}}return h}return await (await (0,i.getCurrentAdapter)(a)).findMany({model:"session",where:[{field:"userId",value:c},...d?.onlyActiveSessions?[{field:"expiresAt",value:new Date,operator:"gt"}]:[]]})},listUsers:async(b,c,d,e)=>await (await (0,i.getCurrentAdapter)(a)).findMany({model:"user",limit:b,offset:c,sortBy:d,where:e}),countTotalUsers:async b=>{let c=await (await (0,i.getCurrentAdapter)(a)).count({model:"user",where:b});return"string"==typeof c?parseInt(c):c},deleteUser:async a=>{(!p||n.session?.storeSessionInDatabase)&&await x([{field:"userId",value:a}],"session",void 0),await x([{field:"userId",value:a}],"account",void 0),await w([{field:"id",value:a}],"user",void 0)},createSession:async(c,g,h,l)=>{let m,q=await (async()=>{let a=await (0,i.getCurrentAuthContext)().catch(()=>null);return a?.headers||a?.request?.headers})(),r=n.session?.storeSessionInDatabase,{id:u,...v}=h||{};if(p&&!r){let a=b.generateId({model:"session"});m=!1!==a?a:(0,j.generateId)()}let w=(0,e.getSessionDefaultFields)(n),x={...m?{id:m}:{},ipAddress:q&&(0,d.getIp)(q,n)||"",userAgent:q?.get("user-agent")||"",...v,expiresAt:g?(0,f.getDate)(86400,"sec"):(0,f.getDate)(s,"sec"),userId:c,token:(0,j.generateId)(32),createdAt:new Date,updatedAt:new Date,...w,...l?v:{}};return await t(x,"session",p?{fn:async b=>{let d=await p.get(`active-sessions-${c}`),e=[],f=Date.now();d&&(e=(e=(0,k.safeJSONParse)(d)||[]).filter(a=>a.expiresAt>f&&a.token!==x.token));let g=[...e,{token:x.token,expiresAt:x.expiresAt.getTime()}].sort((a,b)=>a.expiresAt-b.expiresAt),h=o(g.at(-1)?.expiresAt??x.expiresAt.getTime(),f);h>0&&await p.set(`active-sessions-${c}`,JSON.stringify(g),h);let j=await (await (0,i.getCurrentAdapter)(a)).findOne({model:"user",where:[{field:"id",value:c}]}),l=o(x.expiresAt,f);return l>0&&await p.set(x.token,JSON.stringify({session:b,user:j}),l),b},executeMainFn:r}:void 0)},findSession:async c=>{if(p){let a=await p.get(c);if(!a&&(!n.session?.storeSessionInDatabase||b.options.session?.preserveSessionInDatabase))return null;if(a){let c=(0,k.safeJSONParse)(a);return c?{session:(0,e.parseSessionOutput)(b.options,{...c.session,expiresAt:new Date(c.session.expiresAt),createdAt:new Date(c.session.createdAt),updatedAt:new Date(c.session.updatedAt)}),user:(0,e.parseUserOutput)(b.options,{...c.user,createdAt:new Date(c.user.createdAt),updatedAt:new Date(c.user.updatedAt)})}:null}}let d=await (await (0,i.getCurrentAdapter)(a)).findOne({model:"session",where:[{value:c,field:"token"}],join:{user:!0}});if(!d)return null;let{user:f,...g}=d;return f?{session:(0,e.parseSessionOutput)(b.options,g),user:(0,e.parseUserOutput)(b.options,f)}:null},findSessions:async(b,c)=>{if(p){let a=[];for(let d of b){let b=await p.get(d);if(b)try{let d="string"==typeof b?JSON.parse(b):b;if(!d)return[];let e=new Date(d.session.expiresAt);if(c?.onlyActiveSessions&&e<=new Date)continue;let f={session:{...d.session,expiresAt:new Date(d.session.expiresAt)},user:{...d.user,createdAt:new Date(d.user.createdAt),updatedAt:new Date(d.user.updatedAt)}};a.push(f)}catch{continue}}return a}let d=await (await (0,i.getCurrentAdapter)(a)).findMany({model:"session",where:[{field:"token",value:b,operator:"in"},...c?.onlyActiveSessions?[{field:"expiresAt",value:new Date,operator:"gt"}]:[]],join:{user:!0}});return!d.length||d.some(a=>!a.user)?[]:d.map(a=>{let{user:b,...c}=a;return{session:c,user:b}})},updateSession:async(a,c)=>await u(c,[{field:"token",value:a}],"session",p?{async fn(c){let d=await p.get(a);if(!d)return null;let f=(0,k.safeJSONParse)(d);if(!f)return null;let g={...f.session,...c,expiresAt:new Date(c.expiresAt??f.session.expiresAt),createdAt:new Date(f.session.createdAt),updatedAt:new Date(c.updatedAt??f.session.updatedAt)},h=(0,e.parseSessionOutput)(b.options,g),i=Date.now(),j=new Date(h.expiresAt).getTime(),l=o(j,i);if(l>0){await p.set(a,JSON.stringify({session:h,user:f.user}),l);let b=`active-sessions-${h.userId}`,c=await p.get(b),d=(c&&(0,k.safeJSONParse)(c)||[]).filter(b=>b.token!==a&&b.expiresAt>i).concat([{token:a,expiresAt:j}]).sort((a,b)=>a.expiresAt-b.expiresAt),e=d.at(-1)?.expiresAt;e&&e>i?await p.set(b,JSON.stringify(d),o(e,i)):await p.delete(b)}return h},executeMainFn:n.session?.storeSessionInDatabase}:void 0),deleteSession:async a=>{if(p){let d=await p.get(a);if(d){let{session:b}=(0,k.safeJSONParse)(d)??{};if(!b)return void c.error("Session not found in secondary storage");let e=b.userId,f=await p.get(`active-sessions-${e}`);if(f){let b=(0,k.safeJSONParse)(f)||[],c=Date.now(),d=b.filter(b=>b.expiresAt>c&&b.token!==a),g=d.sort((a,b)=>a.expiresAt-b.expiresAt).at(-1)?.expiresAt;d.length>0&&g&&g>Date.now()?await p.set(`active-sessions-${e}`,JSON.stringify(d),o(g,c)):await p.delete(`active-sessions-${e}`)}else c.error("Active sessions list not found in secondary storage")}if(await p.delete(a),!n.session?.storeSessionInDatabase||b.options.session?.preserveSessionInDatabase)return}await w([{field:"token",value:a}],"session",void 0)},deleteAccounts:async a=>{await x([{field:"userId",value:a}],"account",void 0)},deleteAccount:async a=>{await w([{field:"id",value:a}],"account",void 0)},deleteUserSessions:async a=>{if(p){let c=await p.get(`active-sessions-${a}`),d=c?(0,k.safeJSONParse)(c):[];if(!d)return;for(let a of d)await p.delete(a.token);if(await p.delete(`active-sessions-${a}`),!n.session?.storeSessionInDatabase||b.options.session?.preserveSessionInDatabase)return}await x([{field:"userId",value:a}],"session",void 0)},deleteSessions:async a=>{if(p){for(let b of a)await p.get(b)&&await p.delete(b);if(!n.session?.storeSessionInDatabase||b.options.session?.preserveSessionInDatabase)return}await x([{field:"token",value:a,operator:"in"}],"session",void 0)},findOAuthUser:async(b,c,d)=>{let e=await (await (0,i.getCurrentAdapter)(a)).findOne({model:"account",where:[{value:c,field:"accountId"},{value:d,field:"providerId"}],join:{user:!0}});if(e)if(e.user)return{user:e.user,linkedAccount:e,accounts:[e]};else{let c=await (await (0,i.getCurrentAdapter)(a)).findOne({model:"user",where:[{value:b.toLowerCase(),field:"email"}]});return c?{user:c,linkedAccount:e,accounts:[e]}:null}{let c=await (await (0,i.getCurrentAdapter)(a)).findOne({model:"user",where:[{value:b.toLowerCase(),field:"email"}]});return c?{user:c,linkedAccount:null,accounts:await (await (0,i.getCurrentAdapter)(a)).findMany({model:"account",where:[{value:c.id,field:"userId"}]})||[]}:null}},findUserByEmail:async(b,c)=>{let d=await (await (0,i.getCurrentAdapter)(a)).findOne({model:"user",where:[{value:b.toLowerCase(),field:"email"}],join:{...c?.includeAccounts?{account:!0}:{}}});if(!d)return null;let{account:e,...f}=d;return{user:f,accounts:e??[]}},findUserById:async b=>b?await (await (0,i.getCurrentAdapter)(a)).findOne({model:"user",where:[{field:"id",value:b}]}):null,linkAccount:async a=>await t({createdAt:new Date,updatedAt:new Date,...a},"account",void 0),updateUser:async(a,b)=>{let c=await u({...b,...b.email?{email:b.email.toLowerCase()}:{}},[{field:"id",value:a}],"user",void 0);return await z(c),c},updateUserByEmail:async(a,b)=>{let c=await u({...b,...b.email?{email:b.email.toLowerCase()}:{}},[{field:"email",value:a.toLowerCase()}],"user",void 0);return await z(c),c},updatePassword:async(a,b)=>{await v({password:b},[{field:"userId",value:a},{field:"providerId",value:"credential"}],"account",void 0)},findAccounts:async b=>await (await (0,i.getCurrentAdapter)(a)).findMany({model:"account",where:[{field:"userId",value:b}]}),findAccountByProviderId:async(b,c)=>await (await (0,i.getCurrentAdapter)(a)).findOne({model:"account",where:[{field:"accountId",value:b},{field:"providerId",value:c}]}),findAccountByUserId:async b=>await (await (0,i.getCurrentAdapter)(a)).findMany({model:"account",where:[{field:"userId",value:b}]}),updateAccount:async(a,b)=>await u(b,[{field:"id",value:a}],"account",void 0),createVerificationValue:async a=>{let b=(0,g.getStorageOption)(a.identifier,n.verification?.storeIdentifier),c=await (0,g.processIdentifier)(a.identifier,b);return await t({createdAt:new Date,updatedAt:new Date,...a,identifier:c},"verification",p?{async fn(a){let b=o(a.expiresAt);return b>0&&await p.set(`verification:${c}`,JSON.stringify(a),b),a},executeMainFn:n.verification?.storeInDatabase}:void 0)},findVerificationValue:async b=>{let c=(0,g.getStorageOption)(b,n.verification?.storeIdentifier),d=await (0,g.processIdentifier)(b,c);if(p){let a=await p.get(`verification:${d}`);if(a){let b=(0,k.safeJSONParse)(a);if(b)return b}if(c&&"plain"!==c){let a=await p.get(`verification:${b}`);if(a){let b=(0,k.safeJSONParse)(a);if(b)return b}}if(!n.verification?.storeInDatabase)return null}let e=await (0,i.getCurrentAdapter)(a);async function f(a){return e.findMany({model:"verification",where:[{field:"identifier",value:a}],sortBy:{field:"createdAt",direction:"desc"},limit:1})}let h=await f(d);return!h.length&&c&&"plain"!==c&&(h=await f(b)),n.verification?.disableCleanup||await x([{field:"expiresAt",value:new Date,operator:"lt"}],"verification",void 0),h[0]||null},deleteVerificationByIdentifier:async a=>{let b=await (0,g.processIdentifier)(a,(0,g.getStorageOption)(a,n.verification?.storeIdentifier));p&&await p.delete(`verification:${b}`),(!p||n.verification?.storeInDatabase)&&await w([{field:"identifier",value:b}],"verification",void 0)},consumeVerificationValue:async b=>{let d=(0,g.getStorageOption)(b,n.verification?.storeIdentifier),e=await (0,g.processIdentifier)(b,d),f=d&&"plain"!==d?[e,b]:[e],h=a=>{if(!a)return null;let b="string"==typeof a?(0,k.safeJSONParse)(a):"object"==typeof a?a:null;if(!b)return null;let c=new Date(b.expiresAt);return Number.isFinite(c.getTime())?{...b,expiresAt:c}:null},j=null;if(p&&!n.verification?.storeInDatabase){let a=async a=>p.getAndDelete?h(await p.getAndDelete(a)):(r||(r=!0,c.warn("Secondary storage does not implement `getAndDelete`, so single-use verification values cannot be consumed atomically across processes. Implement `getAndDelete` or use database-backed verification storage to guarantee single use.")),A(a,async()=>{let b=h(await p.get(a));return b?(await p.delete(a),b):null}));for(let b of f){let c=await a(`verification:${b}`);if(c){await Promise.all(f.filter(a=>a!==b).map(a=>p.delete(`verification:${a}`))),j=c;break}}}else{let b=async b=>A(`verification:${b}`,()=>(0,i.runWithTransaction)(a,async()=>{let c=await (0,i.getCurrentAdapter)(a),d=[{field:"identifier",value:b}],e=(await c.findMany({model:"verification",where:d,sortBy:{field:"createdAt",direction:"desc"},limit:1}))[0]??null;return e?y("verification",[{field:"id",value:e.id}],async()=>{let a=await c.consumeOne({model:"verification",where:[{field:"id",value:e.id}]});return a?(await c.deleteMany({model:"verification",where:d}),a):null},e):null}));for(let a of f)if(j=await b(a))break;j&&p&&await Promise.all(f.map(a=>p.delete(`verification:${a}`)))}return!j||j.expiresAt<new Date?null:j},reserveVerificationValue:async b=>{let c=l.base64Url.encode(new Uint8Array(await (0,m.createHash)("SHA-256").digest(new TextEncoder().encode("reserve:"+b.identifier))),{padding:!1}),d=(0,g.getStorageOption)(b.identifier,n.verification?.storeIdentifier),e=await (0,g.processIdentifier)(b.identifier,d);if(p&&!n.verification?.storeInDatabase){let a=`verification:${e}`;return!await p.get(a)&&(await p.set(a,JSON.stringify({id:c,identifier:e,value:b.value,expiresAt:b.expiresAt}),o(b.expiresAt)),!0)}try{await a.create({model:"verification",data:{id:c,identifier:e,value:b.value,expiresAt:b.expiresAt,createdAt:new Date,updatedAt:new Date},forceAllowId:!0})}catch(b){if(await a.findOne({model:"verification",where:[{field:"id",value:c}]}))return!1;throw b}if(p){let a=o(b.expiresAt);a>0&&await p.set(`verification:${e}`,JSON.stringify({id:c,identifier:e,value:b.value,expiresAt:b.expiresAt}),a)}return!0},updateVerificationByIdentifier:async(a,b)=>{let c=await (0,g.processIdentifier)(a,(0,g.getStorageOption)(a,n.verification?.storeIdentifier));if(p){let a=await p.get(`verification:${c}`);if(a){let d=(0,k.safeJSONParse)(a);if(d){let a={...d,...b},e=a.expiresAt??d.expiresAt,f=o(e instanceof Date?e:new Date(e));if(f>0&&await p.set(`verification:${c}`,JSON.stringify(a),f),!n.verification?.storeInDatabase)return a}}}return!p||n.verification?.storeInDatabase?await u(b,[{field:"identifier",value:c}],"verification",void 0):b},refreshUserSessions:z}}]),c()}catch(a){c(a)}},!1),583025,a=>{"use strict";function b(a){if(null===a||"object"!=typeof a)return!1;let b=Object.getPrototypeOf(a);return(null===b||b===Object.prototype||null===Object.getPrototypeOf(b))&&!(Symbol.iterator in a)&&(!(Symbol.toStringTag in a)||"[object Module]"===Object.prototype.toString.call(a))}function c(a){return(...c)=>c.reduce((c,d)=>(function a(c,d,e=".",f){if(!b(d))return a(c,{},e,f);let g={...d};for(let d of Object.keys(c)){if("__proto__"===d||"constructor"===d)continue;let h=c[d];null!=h&&(f&&f(g,d,h,e)||(Array.isArray(h)&&Array.isArray(g[d])?g[d]=[...h,...g[d]]:b(h)&&b(g[d])?g[d]=a(h,g[d],(e?`${e}.`:"")+d.toString(),f):g[d]=h))}return g})(c,d,"",a),{})}let d=c();c((a,b,c)=>{if(void 0!==a[b]&&"function"==typeof c)return a[b]=c(a[b]),!0}),c((a,b,c)=>{if(Array.isArray(a[b])&&"function"==typeof c)return a[b]=c(a[b]),!0}),a.s(["createDefu",0,c,"default",0,d,"defu",0,d])},878243,a=>a.a(async(b,c)=>{try{var d=a.i(592474),e=a.i(649021),f=a.i(46585),g=a.i(427051),h=a.i(28675),i=a.i(815291),j=a.i(583025),k=a.i(258029),l=b([d,f,g,h,i,k]);async function m(a){let b=a.options,c=b.plugins||[],d=[],f=[];for(let g of c)if(g.init){let c,h=g.init(a);if(c=(0,e.isPromise)(h)?await h:h,"object"==typeof c){if(c.options){let{databaseHooks:a,trustedOrigins:e,...h}=c.options;a&&f.push({source:`plugin:${g.id}`,hooks:a}),e&&d.push(e),b=(0,j.defu)(b,h)}c.context&&Object.assign(a,c.context)}}if(d.length>0){let a=[...b.trustedOrigins?[b.trustedOrigins]:[],...d],c=a.filter(Array.isArray).flat(),e=a.filter(a=>"function"==typeof a);e.length>0?b.trustedOrigins=async a=>{let b=await Promise.all(e.map(b=>b(a)));return[...c,...b.flat()].filter(a=>"string"==typeof a&&""!==a)}:b.trustedOrigins=c}b.databaseHooks&&f.push({source:"user",hooks:b.databaseHooks}),a.internalAdapter=(0,g.createInternalAdapter)(a.adapter,{options:b,logger:a.logger,hooks:f,generateId:a.generateId}),a.options=b}async function n(a,b){let c=[];if((0,d.isDynamicBaseURLConfig)(a.baseURL)){let b=a.baseURL.allowedHosts,d=a.baseURL.protocol;for(let a of b)a.includes("://")?c.push(a):(d&&"https"!==d&&"auto"!==d||c.push(`https://${a}`),("http"===d||"auto"===d||(0,k.isLoopbackHost)(a))&&c.push(`http://${a}`));if(a.baseURL.fallback)try{c.push(new URL(a.baseURL.fallback).origin)}catch{}}else{let e=(0,d.getBaseURL)("string"==typeof a.baseURL?a.baseURL:void 0,a.basePath,b);e&&c.push(new URL(e).origin)}if(a.trustedOrigins&&(Array.isArray(a.trustedOrigins)&&c.push(...a.trustedOrigins),"function"==typeof a.trustedOrigins)){let d=await a.trustedOrigins(b);c.push(...d)}let e=h.env.BETTER_AUTH_TRUSTED_ORIGINS;return e&&c.push(...e.split(",")),c.filter(a=>!!a)}async function o(a,b,c){let e,g=a.options.baseURL,h=(0,d.resolveBaseURL)(g,a.options.basePath||"/api/auth",b,void 0,c);if(!h)throw new i.BetterAuthError("Could not resolve base URL from request. Check your allowedHosts config.");let j=Object.create(Object.getPrototypeOf(a),Object.getOwnPropertyDescriptors(a));j.baseURL=h,j.options={...a.options,baseURL:(0,d.getOrigin)(h)||void 0};let k={...j.options,baseURL:g};return e="function"==typeof a.options.trustedOrigins||"function"==typeof a.options.account?.accountLinking?.trustedProviders?(0,d.isRequestLike)(b)?b:b?new Request(h,{headers:b}):void 0:void 0,j.trustedOrigins=await n(k,e),j.trustedProviders=await q(j.options,e),a.options.advanced?.crossSubDomainCookies?.enabled&&(j.authCookies=(0,f.getCookies)(j.options),j.createAuthCookie=(0,f.createCookieGetter)(j.options)),j}async function p(a,b){if(a)for(let c of a){let a="function"==typeof c?await c():c;if(a[b.field??"id"]===b.value)return a}}async function q(a,b){let c=a.account?.accountLinking?.trustedProviders;return c?Array.isArray(c)?c.filter(a=>!!a):(await c(b)??[]).filter(a=>!!a):[]}[d,f,g,h,i,k]=l.then?(await l)():l,a.s(["getAwaitableValue",0,p,"getInternalPlugins",0,function(a){return a.advanced?.crossSubDomainCookies?.enabled,[]},"getTrustedOrigins",0,n,"getTrustedProviders",0,q,"pickSource",0,function(a){if((0,d.isRequestLike)(a?.request))return a.request;if(!a?.headers)return;let b=a.headers instanceof Headers?a.headers:new Headers(a.headers);if(b.has("host")||b.has("x-forwarded-host"))return b},"resolveDynamicTrustedProxyHeaders",0,function(a){return a.advanced?.trustedProxyHeaders??!0},"resolveRequestContext",0,o,"runPluginInit",0,m]),c()}catch(a){c(a)}},!1),942812,a=>a.a(async(b,c)=>{try{var d=a.i(815291),e=b([d]);async function f(a,b){let c=(await a.context.internalAdapter.findAccounts(b.userId))?.find(a=>"credential"===a.providerId),d=c?.password;return!!c&&!!d&&await a.context.password.verify({hash:d,password:b.password})}async function g(a,b){let c=(await b.context.internalAdapter.findAccounts(a))?.find(a=>"credential"===a.providerId),e=c?.password,f=b.body.password;if(!c||!e||!f)throw f&&await b.context.password.hash(f),d.APIError.from("BAD_REQUEST",d.BASE_ERROR_CODES.INVALID_PASSWORD);if(!await b.context.password.verify({hash:e,password:f}))throw d.APIError.from("BAD_REQUEST",d.BASE_ERROR_CODES.INVALID_PASSWORD);return!0}[d]=e.then?(await e)():e,a.s(["checkPassword",0,g,"validatePassword",0,f]),c()}catch(a){c(a)}},!1),318083,a=>a.a(async(b,c)=>{try{var d=a.i(815291),e=a.i(596343),f=b([d,e]);[d,e]=f.then?(await f)():f,a.s(["requireOrgRole",0,function(a){return(0,e.createAuthMiddleware)(async b=>{let c=b.context.session;if(!c?.user?.id)throw new d.APIError("UNAUTHORIZED");if(!b.context.hasPlugin("organization"))throw new d.APIError("BAD_REQUEST",{message:"Organization plugin is required for org role authorization"});let e=("body"===a.orgIdSource?b.body:b.query)?.[a.orgIdParam];if(!e)throw new d.APIError("BAD_REQUEST",{message:`Missing required parameter: ${a.orgIdParam}`});let f=await b.context.adapter.findOne({model:"member",where:[{field:"userId",value:c.user.id},{field:"organizationId",value:e}]});if(!f)throw new d.APIError("FORBIDDEN",{message:"Not a member of this organization"});if(a.allowedRoles?.length&&!(f.role??"").split(",").map(a=>a.trim()).filter(Boolean).some(b=>a.allowedRoles.includes(b)))throw new d.APIError("FORBIDDEN",{message:"Insufficient role for this operation"});return{verifiedMember:f}})},"requireResourceOwnership",0,function(a){let b=a.ownerField??"userId",c=a.forbiddenStatus??"FORBIDDEN";return(0,e.createAuthMiddleware)(async e=>{let f=e.context.session;if(!f?.user?.id)throw new d.APIError("UNAUTHORIZED");let g=("body"===a.idSource?e.body:e.query)?.[a.idParam];if(!g)throw new d.APIError("BAD_REQUEST",{message:`Missing required parameter: ${a.idParam}`});let h=await e.context.adapter.findOne({model:a.model,where:[{field:"id",value:g}]});if(!h){if(a.notFoundError)throw d.APIError.from("NOT_FOUND",a.notFoundError);throw new d.APIError("NOT_FOUND")}if(h[b]!==f.user.id){if(a.forbiddenError)throw d.APIError.from(c,a.forbiddenError);throw new d.APIError(c)}return{verifiedResource:h}})}]),c()}catch(a){c(a)}},!1),798331,a=>a.a(async(b,c)=>{try{var d=a.i(129522),e=a.i(815291),f=a.i(202987),g=a.i(596343),h=a.i(16005),i=b([d,e,f,g,h]);function j(a){return!0===a.context.skipOriginCheck&&a.context.options.advanced?.disableCSRFCheck===void 0}function k(a){let b=a.context.skipOriginCheck;if(!0===b)return!0;if(Array.isArray(b)&&a.request)try{let c=new URL(a.context.baseURL).pathname,d=(0,f.normalizePathname)(a.request.url,c);return b.some(a=>{let b=a.replace(/\/+$/,"");return d===b||d.startsWith(`${b}/`)})}catch{}return!1}[d,e,f,g,h]=i.then?(await i)():i;let n=(0,h.deprecate)(function(){},"disableOriginCheck: true currently also disables CSRF checks. In a future version, disableOriginCheck will ONLY disable URL validation. To keep CSRF disabled, add disableCSRFCheck: true to your config."),o=(0,g.createAuthMiddleware)(async a=>{if(a.request?.method==="GET"||a.request?.method==="OPTIONS"||a.request?.method==="HEAD"||!a.request||(await l(a),k(a)))return;let{body:b,query:c}=a,d=b?.callbackURL||c?.callbackURL,f=b?.redirectTo,g=b?.errorCallbackURL,h=b?.newUserCallbackURL,i=(b,c)=>{if(b){if("string"!=typeof b)throw e.APIError.fromStatus("BAD_REQUEST",{message:`Invalid ${c}: expected a string`});if(!a.context.isTrustedOrigin(b,{allowRelativePaths:"origin"!==c})){if(a.context.logger.error(`Invalid ${c}: ${b}`),a.context.logger.info(`If it's a valid URL, please add ${b} to trustedOrigins in your auth config
+`,`Current list of trustedOrigins: ${a.context.trustedOrigins}`),"origin"===c)throw e.APIError.from("FORBIDDEN",e.BASE_ERROR_CODES.INVALID_ORIGIN);if("callbackURL"===c)throw e.APIError.from("FORBIDDEN",e.BASE_ERROR_CODES.INVALID_CALLBACK_URL);if("redirectURL"===c)throw e.APIError.from("FORBIDDEN",e.BASE_ERROR_CODES.INVALID_REDIRECT_URL);if("errorCallbackURL"===c)throw e.APIError.from("FORBIDDEN",e.BASE_ERROR_CODES.INVALID_ERROR_CALLBACK_URL);if("newUserCallbackURL"===c)throw e.APIError.from("FORBIDDEN",e.BASE_ERROR_CODES.INVALID_NEW_USER_CALLBACK_URL);throw e.APIError.fromStatus("FORBIDDEN",{message:`Invalid ${c}`})}}};d&&i(d,"callbackURL"),f&&i(f,"redirectURL"),g&&i(g,"errorCallbackURL"),h&&i(h,"newUserCallbackURL")});async function l(a,b=!1){let c=a.request?.headers;if(!c||!a.request)return;let f=c.get("origin")||c.get("referer")||"",g=c.has("cookie");if(a.context.skipCSRFCheck)return;if(j(a)){a.context.options.advanced?.disableOriginCheck===!0&&n();return}if(k(a)||!(b||g))return;if(!f||"null"===f)throw e.APIError.from("FORBIDDEN",e.BASE_ERROR_CODES.MISSING_OR_NULL_ORIGIN);let h=Array.isArray(a.context.options.trustedOrigins)?a.context.trustedOrigins:[...a.context.trustedOrigins,...(await a.context.options.trustedOrigins?.(a.request))?.filter(a=>!!a)||[]];if(!h.some(a=>(0,d.matchesOriginPattern)(f,a)))throw a.context.logger.error(`Invalid origin: ${f}`),a.context.logger.info(`If it's a valid URL, please add ${f} to trustedOrigins in your auth config
+`,`Current list of trustedOrigins: ${h}`),e.APIError.from("FORBIDDEN",e.BASE_ERROR_CODES.INVALID_ORIGIN)}let p=(0,g.createAuthMiddleware)(async a=>{a.request&&await m(a)});async function m(a){let b=a.request;if(!b||a.context.skipCSRFCheck||j(a))return;let c=b.headers;if(c.has("cookie"))return await l(a);let d=c.get("Sec-Fetch-Site"),f=c.get("Sec-Fetch-Mode"),g=c.get("Sec-Fetch-Dest");if(d&&d.trim()||f&&f.trim()||g&&g.trim()){if("cross-site"===d&&"navigate"===f)throw a.context.logger.error("Blocked cross-site navigation login attempt (CSRF protection)",{secFetchSite:d,secFetchMode:f,secFetchDest:g}),e.APIError.from("FORBIDDEN",e.BASE_ERROR_CODES.CROSS_SITE_NAVIGATION_LOGIN_BLOCKED);return await l(a,!0)}if(c.get("origin")||c.get("referer"))return await l(a,!0)}a.s(["formCsrfMiddleware",0,p,"originCheck",0,a=>(0,g.createAuthMiddleware)(async b=>{if(!b.request||k(b))return;let c=a(b),d=(a,c)=>{if(a&&!b.context.isTrustedOrigin(a,{allowRelativePaths:"origin"!==c})){if(b.context.logger.error(`Invalid ${c}: ${a}`),b.context.logger.info(`If it's a valid URL, please add ${a} to trustedOrigins in your auth config
+`,`Current list of trustedOrigins: ${b.context.trustedOrigins}`),"origin"===c)throw e.APIError.from("FORBIDDEN",e.BASE_ERROR_CODES.INVALID_ORIGIN);if("callbackURL"===c)throw e.APIError.from("FORBIDDEN",e.BASE_ERROR_CODES.INVALID_CALLBACK_URL);if("redirectURL"===c)throw e.APIError.from("FORBIDDEN",e.BASE_ERROR_CODES.INVALID_REDIRECT_URL);if("errorCallbackURL"===c)throw e.APIError.from("FORBIDDEN",e.BASE_ERROR_CODES.INVALID_ERROR_CALLBACK_URL);if("newUserCallbackURL"===c)throw e.APIError.from("FORBIDDEN",e.BASE_ERROR_CODES.INVALID_NEW_USER_CALLBACK_URL);throw e.APIError.fromStatus("FORBIDDEN",{message:`Invalid ${c}`})}};for(let a of Array.isArray(c)?c:[c])d(a,"callbackURL")}),"originCheckMiddleware",0,o]),c()}catch(a){c(a)}},!1),797070,a=>a.a(async(b,c)=>{try{var d=a.i(304777),e=a.i(531093),f=a.i(140257),g=a.i(202987),h=a.i(862e3),i=b([e,f,g,h]);[e,f,g,h]=i.then?(await i)():i;let q=new Map;function j(a,b,c){let d=1e3*b.window;return a?c-a.lastRequest>d?{next:{...a,count:1,lastRequest:c},update:!0,allowed:!0,retryAfter:null}:a.count>=b.max?{next:a,update:!0,allowed:!1,retryAfter:l(a.lastRequest,b.window)}:{next:{...a,count:a.count+1,lastRequest:c},update:!0,allowed:!0,retryAfter:null}:{next:{key:"",count:1,lastRequest:c},update:!1,allowed:!0,retryAfter:null}}function k(a){return new Response(JSON.stringify({message:"Too many requests. Please try again later."}),{status:429,statusText:"Too Many Requests",headers:{"X-Retry-After":a.toString()}})}function l(a,b){let c=Date.now();return Math.ceil((a+1e3*b-c)/1e3)}let r=!1;async function m(a,b){let c=new URL(b.baseURL).pathname,f=(0,g.normalizePathname)(a.url,c),i=b.rateLimit.window,j=b.rateLimit.max,k=(0,e.getIp)(a,b.options);if(!k&&b.options.advanced?.ipAddress?.disableIpTracking)return null;k||r||(b.logger.warn("Rate limiting could not determine a client IP and is falling back to a single shared per-path bucket. Ensure your runtime forwards a trusted client IP header and configure `advanced.ipAddress.ipAddressHeaders` if needed."),r=!0);let l=(0,h.createRateLimitKey)(k??"no-trusted-ip",f),m=p().find(a=>a.pathMatcher(f));for(let a of(m&&(i=m.window,j=m.max),b.options.plugins||[]))if(a.rateLimit){let b=a.rateLimit.find(a=>a.pathMatcher(f));if(b){i=b.window,j=b.max;break}}if(b.rateLimit.customRules){let c=Object.keys(b.rateLimit.customRules).find(a=>a.includes("*")?(0,d.wildcardMatch)(a)(f):a===f);if(c){let d=b.rateLimit.customRules[c],e="function"==typeof d?await d(a,{window:i,max:j}):d;if(e&&(i=e.window,j=e.max),!1===e)return null}}return{key:l,currentWindow:i,currentMax:j}}let s=!1;async function n(a,b){if(!b.rateLimit.enabled)return;let c=await m(a,b);if(!c)return;let{key:d,currentWindow:e,currentMax:g}=c,h=function(a,b){let c,d,e,g,h;if(a.options.rateLimit?.customStorage)return a.options.rateLimit.customStorage;let i=a.rateLimit.storage;if("secondary-storage"===i){let c=b=>b??a.options.rateLimit?.window??10;return{get:async b=>{let c=await a.options.secondaryStorage?.get(b);return c?(0,f.safeJSONParse)(c):null},set:async(d,e,f)=>{await a.options.secondaryStorage?.set?.(d,JSON.stringify(e),c(b.window))},consume:a.options.secondaryStorage?.increment?async(b,d)=>await a.options.secondaryStorage.increment(b,c(d.window))<=d.max?{allowed:!0,retryAfter:null}:{allowed:!1,retryAfter:d.window}:void 0}}if("memory"===i){let c=b=>b??a.options.rateLimit?.window??10;return{async get(a){let b=q.get(a);return b?Date.now()>=b.expiresAt?(q.delete(a),null):b.data:null},async set(a,d,e){let f=Date.now()+1e3*c(b.window);q.set(a,{data:d,expiresAt:f})},async consume(a,b){!function(){let a=Date.now();for(let[b,c]of q)a>=c.expiresAt&&q.delete(b);if(q.size<=1e5)return;let b=q.size-1e5,c=0;for(let a of q.keys())if(q.delete(a),++c>=b)break}();let d=Date.now(),e=q.get(a),f=j(e&&d<e.expiresAt?e.data:void 0,b,d);return f.allowed&&q.set(a,{data:{...f.next,key:a},expiresAt:d+1e3*c(b.window)}),{allowed:f.allowed,retryAfter:f.retryAfter}}}}return c="rateLimit",d=a.adapter,e=async a=>{let b=(await d.findMany({model:c,where:[{field:"key",value:a}]}))[0];return"bigint"==typeof b?.lastRequest&&(b.lastRequest=Number(b.lastRequest)),b},g=async(a,b)=>{let f=1e3*b.window,i=await e(a),j=Date.now();if(!i)try{return await d.create({model:c,data:{key:a,count:1,lastRequest:j}}),{allowed:!0,retryAfter:null}}catch(c){if(!await e(a))throw c;return g(a,b)}if(j-i.lastRequest>f)return await d.incrementOne({model:c,where:[{field:"key",value:a},{field:"lastRequest",operator:"lte",value:i.lastRequest}],increment:{},set:{count:1,lastRequest:j}})?(h(j),{allowed:!0,retryAfter:null}):g(a,b);let k=j-f;if(await d.incrementOne({model:c,where:[{field:"key",value:a},{field:"lastRequest",operator:"gt",value:k},{field:"count",operator:"lt",value:b.max}],increment:{count:1},set:{lastRequest:j}}))return{allowed:!0,retryAfter:null};let m=await e(a);return!m||j-m.lastRequest>f?g(a,b):{allowed:!1,retryAfter:l(m.lastRequest,b.window)}},h=b=>{let e=b-1e3*Math.max(a.rateLimit.window,...p().map(a=>a.window));a.runInBackground(d.deleteMany({model:c,where:[{field:"lastRequest",operator:"lt",value:e}]}).then(()=>void 0).catch(b=>a.logger.error("Error pruning rate limit rows",b)))},{get:e,set:async(b,e,f)=>{try{f?await d.updateMany({model:c,where:[{field:"key",value:b}],update:{count:e.count,lastRequest:e.lastRequest}}):await d.create({model:c,data:{key:b,count:e.count,lastRequest:e.lastRequest}})}catch(b){a.logger.error("Error setting rate limit",b)}},consume:g}}(b,{window:e}),i={window:e,max:g};if(h.consume){let{allowed:a,retryAfter:b}=await h.consume(d,i);return a?void 0:k(b??e)}return o(b,h,d,i)}async function o(a,b,c,d){s||(a.logger.warn("Rate limiting is best-effort: the configured storage has no atomic `consume`, so concurrent requests may bypass the limit. Provide a storage that implements `consume` for strict enforcement."),s=!0);let e=j(await b.get(c),d,Date.now());if(!e.allowed)return k(e.retryAfter??d.window);await b.set(c,{...e.next,key:c},e.update)}function p(){return[{pathMatcher:a=>a.startsWith("/sign-in")||a.startsWith("/sign-up")||a.startsWith("/change-password")||a.startsWith("/change-email"),window:10,max:3},{pathMatcher:a=>"/request-password-reset"===a||"/send-verification-email"===a||a.startsWith("/forget-password")||"/email-otp/send-verification-otp"===a||"/email-otp/request-password-reset"===a,window:60,max:3}]}a.s(["onRequestRateLimit",0,n]),c()}catch(a){c(a)}},!1),450259,a=>a.a(async(b,c)=>{try{var d=a.i(782645),e=b([d]);[d]=e.then?(await e)():e;let{get:f,set:g}=(0,d.defineRequestState)(()=>null);a.s(["getOAuthState",0,f,"setOAuthState",0,g]),c()}catch(a){c(a)}},!1),515578,a=>a.a(async(b,c)=>{try{var d=a.i(782645),e=b([d]);[d]=e.then?(await e)():e;let{get:f,set:g}=(0,d.defineRequestState)(()=>!1);a.s(["getShouldSkipSessionRefresh",0,f,"setShouldSkipSessionRefresh",0,g]),c()}catch(a){c(a)}},!1),750290,a=>a.a(async(b,c)=>{try{var d=a.i(417387),e=a.i(769675),f=a.i(405463),g=a.i(704551),h=a.i(186673),i=a.i(646762),j=a.i(46585),k=a.i(515578),l=a.i(815291),m=a.i(140257),n=a.i(596343),o=a.i(512418),p=a.i(711159),q=a.i(198465),r=a.i(958228),s=b([d,g,i,j,k,l,m,n]);[d,g,i,j,k,l,m,n]=s.then?(await s)():s;let t=()=>(0,n.createAuthEndpoint)("/get-session",{method:["GET","POST"],operationId:"getSession",query:i.getSessionQuerySchema,requireHeaders:!0,metadata:{openapi:{operationId:"getSession",description:"Get the current session",responses:{200:{description:"Success",content:{"application/json":{schema:{type:["object","null"],properties:{session:{$ref:"#/components/schemas/Session"},user:{$ref:"#/components/schemas/User"}},required:["session","user"]}}}}}}}},async a=>{let b=a.context.options.session?.deferSessionRefresh,c="POST"===a.method;if(c&&!b)throw l.APIError.from("METHOD_NOT_ALLOWED",l.BASE_ERROR_CODES.METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED);try{let d=await a.getSignedCookie(a.context.authCookies.sessionToken.name,a.context.secret);if(!d)return null;let e=(0,i.getChunkedCookie)(a,a.context.authCookies.sessionData.name),n=null;if(e){let b=a.context.options.session?.cookieCache?.strategy||"compact";if("jwe"===b){let b=await (0,f.symmetricDecodeJWT)(e,a.context.secretConfig,"better-auth-session");if(!b||!b.session||!b.user)return(0,j.expireCookie)(a,a.context.authCookies.sessionData),a.json(null);n={session:{session:b.session,user:b.user,updatedAt:b.updatedAt,version:b.version},expiresAt:b.exp?1e3*b.exp:Date.now()}}else if("jwt"===b){let b=await (0,f.verifyJWT)(e,a.context.secret);if(!b||!b.session||!b.user)return(0,j.expireCookie)(a,a.context.authCookies.sessionData),a.json(null);n={session:{session:b.session,user:b.user,updatedAt:b.updatedAt,version:b.version},expiresAt:b.exp?1e3*b.exp:Date.now()}}else{let b=(0,m.safeJSONParse)(q.binary.decode(p.base64Url.decode(e)));if(b)if(!await (0,r.createHMAC)("SHA-256","base64urlnopad").verify(a.context.secret,JSON.stringify({...b.session,expiresAt:b.expiresAt}),b.signature))return(0,j.expireCookie)(a,a.context.authCookies.sessionData),a.json(null);else n=b}}let o=await a.getSignedCookie(a.context.authCookies.dontRememberToken.name,a.context.secret);if(n?.session&&a.context.options.session?.cookieCache?.enabled&&!a.query?.disableCookieCache){let b=n.session,c=a.context.options.session?.cookieCache?.version,d="1";if(c){if("string"==typeof c)d=c;else if("function"==typeof c){let a=c(b.session,b.user);d=a instanceof Promise?await a:a}}if((b.version||"1")!==d)(0,j.expireCookie)(a,a.context.authCookies.sessionData);else{let c=new Date(b.session.expiresAt);if(n.expiresAt<Date.now()||c<new Date)(0,j.expireCookie)(a,a.context.authCookies.sessionData);else{let c=a.context.sessionConfig.cookieRefreshCache;if(!1===c){a.context.session=b;let c=(0,g.parseSessionOutput)(a.context.options,{...b.session,expiresAt:new Date(b.session.expiresAt),createdAt:new Date(b.session.createdAt),updatedAt:new Date(b.session.updatedAt)}),d=(0,g.parseUserOutput)(a.context.options,{...b.user,createdAt:new Date(b.user.createdAt),updatedAt:new Date(b.user.updatedAt)});return a.json({session:c,user:d})}let d=n.expiresAt-Date.now(),e=1e3*c.updateAge,f=await (0,k.getShouldSkipSessionRefresh)();if(d<e&&!f){let c={session:{...b.session},user:b.user,updatedAt:Date.now()};await (0,j.setCookieCache)(a,c,!1);let d=a.context.authCookies.sessionToken.attributes,e=o?void 0:a.context.sessionConfig.expiresIn;await a.setSignedCookie(a.context.authCookies.sessionToken.name,b.session.token,a.context.secret,{...d,maxAge:e});let f=(0,g.parseSessionOutput)(a.context.options,{...c.session,expiresAt:new Date(c.session.expiresAt),createdAt:new Date(c.session.createdAt),updatedAt:new Date(c.session.updatedAt)}),h=(0,g.parseUserOutput)(a.context.options,{...c.user,createdAt:new Date(c.user.createdAt),updatedAt:new Date(c.user.updatedAt)});return a.context.session={session:f,user:h},a.json({session:f,user:h})}let h=(0,g.parseSessionOutput)(a.context.options,{...b.session,expiresAt:new Date(b.session.expiresAt),createdAt:new Date(b.session.createdAt),updatedAt:new Date(b.session.updatedAt)}),i=(0,g.parseUserOutput)(a.context.options,{...b.user,createdAt:new Date(b.user.createdAt),updatedAt:new Date(b.user.updatedAt)});return a.context.session={session:h,user:i},a.json({session:h,user:i})}}}let s=await a.context.internalAdapter.findSession(d);if(a.context.session=s,!s||s.session.expiresAt<new Date)return(0,j.deleteSessionCookie)(a),s&&(!b||c)&&await a.context.internalAdapter.deleteSession(s.session.token),a.json(null);if(o||a.query?.disableRefresh){let b=(0,g.parseSessionOutput)(a.context.options,s.session),c=(0,g.parseUserOutput)(a.context.options,s.user);return a.json({session:b,user:c})}let t=a.context.sessionConfig.expiresIn,u=a.context.sessionConfig.updateAge,v=s.session.expiresAt.valueOf()-1e3*t+1e3*u<=Date.now(),w=a.query?.disableRefresh||a.context.options.session?.disableSessionRefresh,x=await (0,k.getShouldSkipSessionRefresh)(),y=v&&!w&&!x;if(b&&!c){await (0,j.setCookieCache)(a,s,!!o);let b=(0,g.parseSessionOutput)(a.context.options,s.session),c=(0,g.parseUserOutput)(a.context.options,s.user);return a.json({session:b,user:c,needsRefresh:y})}if(y){let b=await a.context.internalAdapter.updateSession(s.session.token,{expiresAt:(0,h.getDate)(a.context.sessionConfig.expiresIn,"sec"),updatedAt:new Date});if(!b)throw(0,j.deleteSessionCookie)(a),l.APIError.from("UNAUTHORIZED",l.BASE_ERROR_CODES.FAILED_TO_GET_SESSION);let c=(b.expiresAt.valueOf()-Date.now())/1e3;await (0,j.setSessionCookie)(a,{session:b,user:s.user},!1,{maxAge:c});let d=(0,g.parseSessionOutput)(a.context.options,b),e=(0,g.parseUserOutput)(a.context.options,s.user);return a.json({session:d,user:e})}await (0,j.setCookieCache)(a,s,!!o);let z=(0,g.parseSessionOutput)(a.context.options,s.session),A=(0,g.parseUserOutput)(a.context.options,s.user);return a.json({session:z,user:A})}catch(b){if((0,d.isAPIError)(b))throw b;throw a.context.logger.error("INTERNAL_SERVER_ERROR",b),l.APIError.from("INTERNAL_SERVER_ERROR",l.BASE_ERROR_CODES.FAILED_TO_GET_SESSION)}}),u=async(a,b)=>{if(a.context.session)return a.context.session;let c=await t()({...a,method:"GET",asResponse:!1,headers:a.headers,returnHeaders:!0,returnStatus:!1,query:{...b,...a.query,disableCookieCache:b?.disableCookieCache||a.query?.disableCookieCache,disableRefresh:b?.disableRefresh||a.query?.disableRefresh}}).catch(()=>null);return c?(c.headers&&c.headers.forEach((b,c)=>{a.context.responseHeaders?"set-cookie"===c.toLowerCase()?a.context.responseHeaders.append(c,b):a.context.responseHeaders.set(c,b):a.context.responseHeaders=new Headers({[c]:b})}),a.context.session=c.response,c.response):(a.context.session=null,null)},v=(0,n.createAuthMiddleware)(async a=>{let b=await u(a);if(!b?.session)throw l.APIError.from("UNAUTHORIZED",{message:"Unauthorized",code:"UNAUTHORIZED"});return{session:b}}),w=(0,n.createAuthMiddleware)(async a=>{let b=await u(a,{disableCookieCache:!0});if(!b?.session)throw l.APIError.from("UNAUTHORIZED",{message:"Unauthorized",code:"UNAUTHORIZED"});return{session:b}}),x=(0,n.createAuthMiddleware)(async a=>{let b=await u(a);if(!b?.session&&(a.request||a.headers))throw l.APIError.from("UNAUTHORIZED",{message:"Unauthorized",code:"UNAUTHORIZED"});return{session:b}}),y=(0,n.createAuthMiddleware)(async a=>{let b=await u(a);if(!b?.session)throw l.APIError.from("UNAUTHORIZED",{message:"Unauthorized",code:"UNAUTHORIZED"});if(0!==a.context.sessionConfig.freshAge){let c=new Date(b.session.createdAt).getTime(),d=1e3*a.context.sessionConfig.freshAge;if(Date.now()-c>=d)throw l.APIError.from("FORBIDDEN",l.BASE_ERROR_CODES.SESSION_NOT_FRESH)}return{session:b}}),z=(0,n.createAuthEndpoint)("/revoke-session",{method:"POST",body:o.object({token:o.string().meta({description:"The token to revoke"})}),use:[w],requireHeaders:!0,metadata:{openapi:{description:"Revoke a single session",requestBody:{content:{"application/json":{schema:{type:"object",properties:{token:{type:"string",description:"The token to revoke"}},required:["token"]}}}},responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{status:{type:"boolean",description:"Indicates if the session was revoked successfully"}},required:["status"]}}}}}}}},async a=>{let b=a.body.token;if((await a.context.internalAdapter.findSession(b))?.session.userId===a.context.session.user.id)try{await a.context.internalAdapter.deleteSession(b)}catch(b){throw a.context.logger.error(b&&"object"==typeof b&&"name"in b?b.name:"",b),l.APIError.from("INTERNAL_SERVER_ERROR",{message:"Internal Server Error",code:"INTERNAL_SERVER_ERROR"})}return a.json({status:!0})}),A=(0,n.createAuthEndpoint)("/revoke-sessions",{method:"POST",use:[w],requireHeaders:!0,metadata:{openapi:{description:"Revoke all sessions for the user",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{status:{type:"boolean",description:"Indicates if all sessions were revoked successfully"}},required:["status"]}}}}}}}},async a=>{try{await a.context.internalAdapter.deleteUserSessions(a.context.session.user.id)}catch(b){throw a.context.logger.error(b&&"object"==typeof b&&"name"in b?b.name:"",b),l.APIError.from("INTERNAL_SERVER_ERROR",{message:"Internal Server Error",code:"INTERNAL_SERVER_ERROR"})}return a.json({status:!0})}),B=(0,n.createAuthEndpoint)("/revoke-other-sessions",{method:"POST",requireHeaders:!0,use:[w],metadata:{openapi:{description:"Revoke all other sessions for the user except the current one",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{status:{type:"boolean",description:"Indicates if all other sessions were revoked successfully"}},required:["status"]}}}}}}}},async a=>{let b=a.context.session;if(!b.user)throw l.APIError.from("UNAUTHORIZED",{message:"Unauthorized",code:"UNAUTHORIZED"});let c=(await a.context.internalAdapter.listSessions(b.user.id)).filter(a=>a.expiresAt>new Date).filter(b=>b.token!==a.context.session.session.token);return await Promise.all(c.map(b=>a.context.internalAdapter.deleteSession(b.token))),a.json({status:!0})});a.s(["freshSessionMiddleware",0,y,"getSession",0,t,"getSessionFromCtx",0,u,"isStateful",0,a=>(0,e.hasServerSessionStore)(a.context.options),"listSessions",0,()=>(0,n.createAuthEndpoint)("/list-sessions",{method:"GET",operationId:"listUserSessions",use:[y],requireHeaders:!0,metadata:{openapi:{operationId:"listUserSessions",description:"List all active sessions for the user",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"array",items:{$ref:"#/components/schemas/Session"}}}}}}}}},async a=>{try{let b=(await a.context.internalAdapter.listSessions(a.context.session.user.id,{onlyActiveSessions:!0})).filter(a=>a.expiresAt>new Date);return a.json(b.map(b=>(0,g.parseSessionOutput)(a.context.options,b)))}catch(b){throw a.context.logger.error(b),a.error("INTERNAL_SERVER_ERROR")}}),"requestOnlySessionMiddleware",0,x,"revokeOtherSessions",0,B,"revokeSession",0,z,"revokeSessions",0,A,"sensitiveSessionMiddleware",0,w,"sessionMiddleware",0,v]),c()}catch(a){c(a)}},!1),44541,a=>{"use strict";a.s(["missingEmailLogMessage",0,function(a,b){return`${b?.source==="generic"?`Generic OAuth provider "${a}"`:`Provider "${a}"`} did not return an email${b?.source==="id_token"?" in the id token":""}. Either request the provider's email scope, or synthesize one via \`mapProfileToUser\`. See https://www.better-auth.com/docs/concepts/oauth#handling-providers-without-email`},"redirectOnError",0,function(a,b,c,d){let e=new URLSearchParams({error:c});d&&e.set("error_description",d);let f=b.includes("?")?"&":"?";throw a.redirect(`${b}${f}${e.toString()}`)}])},117649,a=>{"use strict";function b(a){switch(a){case"a-z":return"abcdefghijklmnopqrstuvwxyz";case"A-Z":return"ABCDEFGHIJKLMNOPQRSTUVWXYZ";case"0-9":return"0123456789";case"-_":return"-_";default:throw Error(`Unsupported alphabet: ${a}`)}}a.s(["createRandomStringGenerator",0,function(...a){let c=a.map(b).join("");if(0===c.length)throw Error("No valid characters provided for random string generation.");let d=c.length;return(a,...e)=>{let f;if(a<=0)throw Error("Length must be a positive integer.");let g=c,h=d;e.length>0&&(h=(g=e.map(b).join("")).length);let i=Math.floor(256/h)*h,j=new Uint8Array(2*a),k=j.length,l="",m=k;for(;l.length<a;)m>=k&&(crypto.getRandomValues(j),m=0),(f=j[m++])<i&&(l+=g[f%h]);return l}}])},597080,a=>{"use strict";let b=(0,a.i(117649).createRandomStringGenerator)("a-z","0-9","A-Z","-_");a.s(["generateRandomString",0,b])},252736,123084,a=>{"use strict";let b,c,d;a.i(405463),a.s(["constantTimeEqual",0,function(a,b){"string"==typeof a&&(a=new TextEncoder().encode(a)),"string"==typeof b&&(b=new TextEncoder().encode(b));let c=new Uint8Array(a),d=new Uint8Array(b),e=c.length^d.length,f=Math.max(c.length,d.length);for(let a=0;a<f;a++)e|=(a<c.length?c[a]:0)^(a<d.length?d[a]:0);return 0===e}],123084),a.i(827764),a.i(597080),a.i(956980);var e,f=a.i(531429);function g(a){if("boolean"!=typeof a)throw TypeError(`boolean expected, not ${a}`)}function h(a){if("number"!=typeof a)throw TypeError("number expected, got "+typeof a);if(!Number.isSafeInteger(a)||a<0)throw RangeError("positive integer expected, got "+a)}function i(a,b,c=""){let d=a instanceof Uint8Array||ArrayBuffer.isView(a)&&"Uint8Array"===a.constructor.name&&"BYTES_PER_ELEMENT"in a&&1===a.BYTES_PER_ELEMENT,e=a?.length,f=void 0!==b;if(!d||f&&e!==b){let g=(c&&`"${c}" `)+"expected Uint8Array"+(f?` of length ${b}`:"")+", got "+(d?`length=${e}`:`type=${typeof a}`);if(!d)throw TypeError(g);throw RangeError(g)}return a}function j(a,b=!0){if(a.destroyed)throw Error("Hash instance has been destroyed");if(b&&a.finished)throw Error("Hash#digest() has already been called")}function k(a){return new Uint32Array(a.buffer,a.byteOffset,Math.floor(a.byteLength/4))}function l(...a){for(let b=0;b<a.length;b++)a[b].fill(0)}let m=68===new Uint8Array(new Uint32Array([0x11223344]).buffer)[0],n=a=>a<<24&0xff000000|a<<8&0xff0000|a>>>8&65280|a>>>24&255,o=m?a=>a:a=>n(a)>>>0,p=m?a=>a:a=>{for(let b=0;b<a.length;b++)a[b]=n(a[b]);return a},q="function"==typeof Uint8Array.from([]).toHex&&"function"==typeof Uint8Array.fromHex,r=Array.from({length:256},(a,b)=>b.toString(16).padStart(2,"0"));function s(a){return a>=48&&a<=57?a-48:a>=65&&a<=70?a-55:a>=97&&a<=102?a-87:void 0}function t(a,b,c=!0){if(void 0===b)return new Uint8Array(a);if(i(b,void 0,"output"),b.length!==a)throw Error('"output" expected Uint8Array of length '+a+", got: "+b.length);if(c&&!u(b))throw Error("invalid output, must be aligned");return b}function u(a){return a.byteOffset%4==0}function v(a){return Uint8Array.from(i(a))}function w(a=32){h(a);let b="object"==typeof globalThis?globalThis.crypto:null;if("function"!=typeof b?.getRandomValues)throw Error("crypto.getRandomValues must be defined");return b.getRandomValues(new Uint8Array(a))}function x(a,b=w){let{nonceLength:c}=a;h(c);let d=(a,b,c)=>{let d=function(...a){let b=0;for(let c=0;c<a.length;c++){let d=a[c];i(d),b+=d.length}let c=new Uint8Array(b);for(let b=0,d=0;b<a.length;b++){let e=a[b];c.set(e,d),d+=e.length}return c}(a,b);return c.byteLength&&b.byteLength&&c.buffer===b.buffer&&c.byteOffset<b.byteOffset+b.byteLength&&b.byteOffset<c.byteOffset+c.byteLength||b.fill(0),d},e=(e,...f)=>({encrypt(g){i(g);let h=b(c),j=a(e,h,...f).encrypt(g);return j instanceof Promise?j.then(a=>d(h,a,g)):d(h,j,g)},decrypt(b){i(b);let d=b.subarray(0,c),g=b.subarray(c);return a(e,d,...f).decrypt(g)}});return"blockSize"in a&&(e.blockSize=a.blockSize),"tagLength"in a&&(e.tagLength=a.tagLength),e}let y=a=>Uint8Array.from(a.split(""),a=>a.charCodeAt(0)),z=p(k(y("expand 16-byte k"))),A=p(k(y("expand 32-byte k")));function B(a,b){return a<<b|a>>>32-b}let C=0x100000000-1,D=Uint32Array.of();function E(a,b){return 255&a[b++]|(255&a[b++])<<8}class F{blockLen=16;outputLen=16;buffer=new Uint8Array(16);r=new Uint16Array(10);h=new Uint16Array(10);pad=new Uint16Array(8);pos=0;finished=!1;destroyed=!1;constructor(a){const b=E(a=v(i(a,32,"key")),0),c=E(a,2),d=E(a,4),e=E(a,6),f=E(a,8),g=E(a,10),h=E(a,12),j=E(a,14);this.r[0]=8191&b,this.r[1]=(b>>>13|c<<3)&8191,this.r[2]=(c>>>10|d<<6)&7939,this.r[3]=(d>>>7|e<<9)&8191,this.r[4]=(e>>>4|f<<12)&255,this.r[5]=f>>>1&8190,this.r[6]=(f>>>14|g<<2)&8191,this.r[7]=(g>>>11|h<<5)&8065,this.r[8]=(h>>>8|j<<8)&8191,this.r[9]=j>>>5&127;for(let b=0;b<8;b++)this.pad[b]=E(a,16+2*b)}process(a,b,c=!1){let{h:d,r:e}=this,f=e[0],g=e[1],h=e[2],i=e[3],j=e[4],k=e[5],l=e[6],m=e[7],n=e[8],o=e[9],p=E(a,b+0),q=E(a,b+2),r=E(a,b+4),s=E(a,b+6),t=E(a,b+8),u=E(a,b+10),v=E(a,b+12),w=E(a,b+14),x=d[0]+(8191&p),y=d[1]+((p>>>13|q<<3)&8191),z=d[2]+((q>>>10|r<<6)&8191),A=d[3]+((r>>>7|s<<9)&8191),B=d[4]+((s>>>4|t<<12)&8191),C=d[5]+(t>>>1&8191),D=d[6]+((t>>>14|u<<2)&8191),F=d[7]+((u>>>11|v<<5)&8191),G=d[8]+((v>>>8|w<<8)&8191),H=d[9]+(w>>>5|2048*!c),I=0,J=0+x*f+5*o*y+5*n*z+5*m*A+5*l*B;I=J>>>13,J&=8191,J+=5*k*C+5*j*D+5*i*F+5*h*G+5*g*H,I+=J>>>13,J&=8191;let K=I+x*g+y*f+5*o*z+5*n*A+5*m*B;I=K>>>13,K&=8191,K+=5*l*C+5*k*D+5*j*F+5*i*G+5*h*H,I+=K>>>13,K&=8191;let L=I+x*h+y*g+z*f+5*o*A+5*n*B;I=L>>>13,L&=8191,L+=5*m*C+5*l*D+5*k*F+5*j*G+5*i*H,I+=L>>>13,L&=8191;let M=I+x*i+y*h+z*g+A*f+5*o*B;I=M>>>13,M&=8191,M+=5*n*C+5*m*D+5*l*F+5*k*G+5*j*H,I+=M>>>13,M&=8191;let N=I+x*j+y*i+z*h+A*g+B*f;I=N>>>13,N&=8191,N+=5*o*C+5*n*D+5*m*F+5*l*G+5*k*H,I+=N>>>13,N&=8191;let O=I+x*k+y*j+z*i+A*h+B*g;I=O>>>13,O&=8191,O+=C*f+5*o*D+5*n*F+5*m*G+5*l*H,I+=O>>>13,O&=8191;let P=I+x*l+y*k+z*j+A*i+B*h;I=P>>>13,P&=8191,P+=C*g+D*f+5*o*F+5*n*G+5*m*H,I+=P>>>13,P&=8191;let Q=I+x*m+y*l+z*k+A*j+B*i;I=Q>>>13,Q&=8191,Q+=C*h+D*g+F*f+5*o*G+5*n*H,I+=Q>>>13,Q&=8191;let R=I+x*n+y*m+z*l+A*k+B*j;I=R>>>13,R&=8191,R+=C*i+D*h+F*g+G*f+5*o*H,I+=R>>>13,R&=8191;let S=I+x*o+y*n+z*m+A*l+B*k;I=S>>>13,S&=8191,S+=C*j+D*i+F*h+G*g+H*f,I+=S>>>13,S&=8191,J=8191&(I=(I=(I<<2)+I|0)+J|0),I>>>=13,K+=I,d[0]=J,d[1]=K,d[2]=L,d[3]=M,d[4]=N,d[5]=O,d[6]=P,d[7]=Q,d[8]=R,d[9]=S}finalize(){let{h:a,pad:b}=this,c=new Uint16Array(10),d=a[1]>>>13;a[1]&=8191;for(let b=2;b<10;b++)a[b]+=d,d=a[b]>>>13,a[b]&=8191;a[0]+=5*d,d=a[0]>>>13,a[0]&=8191,a[1]+=d,d=a[1]>>>13,a[1]&=8191,a[2]+=d,c[0]=a[0]+5,d=c[0]>>>13,c[0]&=8191;for(let b=1;b<10;b++)c[b]=a[b]+d,d=c[b]>>>13,c[b]&=8191;c[9]-=8192;let e=(1^d)-1;for(let a=0;a<10;a++)c[a]&=e;e=~e;for(let b=0;b<10;b++)a[b]=a[b]&e|c[b];a[0]=(a[0]|a[1]<<13)&65535,a[1]=(a[1]>>>3|a[2]<<10)&65535,a[2]=(a[2]>>>6|a[3]<<7)&65535,a[3]=(a[3]>>>9|a[4]<<4)&65535,a[4]=(a[4]>>>12|a[5]<<1|a[6]<<14)&65535,a[5]=(a[6]>>>2|a[7]<<11)&65535,a[6]=(a[7]>>>5|a[8]<<8)&65535,a[7]=(a[8]>>>8|a[9]<<5)&65535;let f=a[0]+b[0];a[0]=65535&f;for(let c=1;c<8;c++)f=(a[c]+b[c]|0)+(f>>>16)|0,a[c]=65535&f;l(c)}update(a){j(this),i(a);let{buffer:b,blockLen:c}=this,d=(a=v(a)).length;for(let e=0;e<d;){let f=Math.min(c-this.pos,d-e);if(f===c){for(;c<=d-e;e+=c)this.process(a,e);continue}b.set(a.subarray(e,e+f),this.pos),this.pos+=f,e+=f,this.pos===c&&(this.process(b,0,!1),this.pos=0)}return this}destroy(){this.destroyed=!0,l(this.h,this.r,this.buffer,this.pad)}digestInto(a){j(this),function(a,b,c=!1){i(a,void 0,"output");let d=b.outputLen;if(a.length<d)throw RangeError("digestInto() expects output buffer of length at least "+d);if(c&&!u(a))throw Error("invalid output, must be aligned")}(a,this),this.finished=!0;let{buffer:b,h:c}=this,{pos:d}=this;if(d){for(b[d++]=1;d<16;d++)b[d]=0;this.process(b,0,!0)}this.finalize();let e=0;for(let b=0;b<8;b++)a[e++]=c[b]>>>0,a[e++]=c[b]>>>8}digest(){let{buffer:a,outputLen:b}=this;this.digestInto(a);let c=a.slice(0,b);return this.destroy(),c}}let G=(e=a=>new F(a),b=()=>[],(c=(a,c)=>e(c,...b(a)).update(a).digest()).outputLen=(d=e(new Uint8Array(32),...b(new Uint8Array(0)))).outputLen,c.blockLen=d.blockLen,c.create=(a,...b)=>e(a,...b),c),H=function(a,b){let{allowShortKeys:c,extendNonceFn:d,counterLength:e,counterRight:f,rounds:j}=function(a,b){if(null==b||"object"!=typeof b)throw Error("options must be defined");return Object.assign(a,b)}({allowShortKeys:!1,counterLength:8,counterRight:!1,rounds:20},b);if("function"!=typeof a)throw Error("core must be a function");return h(e),h(j),g(f),g(c),(b,g,n,o,q=0)=>{let r,s;if(i(b,void 0,"key"),i(g,void 0,"nonce"),i(n,void 0,"data"),o=t(n.length,o,!1),h(q),q<0||q>=C)throw Error("arx: counter overflow");let w=[],x=b.length;if(32===x)w.push(r=v(b)),s=A;else if(16===x&&c)(r=new Uint8Array(32)).set(b),r.set(b,16),s=z,w.push(r);else throw i(b,32,"arx key"),Error("invalid key size");m&&u(g)||w.push(g=v(g));let y=k(r);if(d){if(24!==g.length)throw Error("arx: extended nonce must be 24 bytes");let a=g.subarray(0,16);if(m)d(s,y,k(a),y);else{let b=p(Uint32Array.from(s));d(b,y,k(a),y),l(b),p(y)}g=g.subarray(16)}else m||p(y);let B=16-e;if(B!==g.length)throw Error(`arx: nonce must be ${B} or 16 bytes`);if(12!==B){let a=new Uint8Array(12);a.set(g,f?0:12-g.length),g=a,w.push(g)}let E=p(k(g));try{return!function(a,b,c,d,e,f,g,h){let i=e.length,j=new Uint8Array(64),l=k(j),n=m&&u(e)&&u(f),o=n?k(e):D,q=n?k(f):D;if(!m){for(let k=0;k<i;g++){if(a(b,c,d,l,g,h),p(l),g>=C)throw Error("arx: counter overflow");let m=Math.min(64,i-k);for(let a=0,b;a<m;a++)f[b=k+a]=e[b]^j[a];k+=m}return}for(let k=0;k<i;g++){if(a(b,c,d,l,g,h),g>=C)throw Error("arx: counter overflow");let m=Math.min(64,i-k);if(n&&64===m){let a=k/4;if(k%4!=0)throw Error("arx: invalid block position");for(let b=0,c;b<16;b++)q[c=a+b]=o[c]^l[b];k+=64;continue}for(let a=0,b;a<m;a++)f[b=k+a]=e[b]^j[a];k+=m}}(a,s,y,E,n,o,q,j),o}finally{l(...w)}}}(function(a,b,c,d,e,f=20){let g=a[0],h=a[1],i=a[2],j=a[3],k=b[0],l=b[1],m=b[2],n=b[3],o=b[4],p=b[5],q=b[6],r=b[7],s=c[0],t=c[1],u=c[2],v=g,w=h,x=i,y=j,z=k,A=l,C=m,D=n,E=o,F=p,G=q,H=r,I=e,J=s,K=t,L=u;for(let a=0;a<f;a+=2)E=E+(I=B(I^(v=v+z|0),16))|0,v=v+(z=B(z^E,12))|0,E=E+(I=B(I^v,8))|0,z=B(z^E,7),F=F+(J=B(J^(w=w+A|0),16))|0,w=w+(A=B(A^F,12))|0,F=F+(J=B(J^w,8))|0,A=B(A^F,7),G=G+(K=B(K^(x=x+C|0),16))|0,x=x+(C=B(C^G,12))|0,G=G+(K=B(K^x,8))|0,C=B(C^G,7),H=H+(L=B(L^(y=y+D|0),16))|0,y=y+(D=B(D^H,12))|0,H=H+(L=B(L^y,8))|0,D=B(D^H,7),G=G+(L=B(L^(v=v+A|0),16))|0,v=v+(A=B(A^G,12))|0,G=G+(L=B(L^v,8))|0,A=B(A^G,7),H=H+(I=B(I^(w=w+C|0),16))|0,w=w+(C=B(C^H,12))|0,H=H+(I=B(I^w,8))|0,C=B(C^H,7),E=E+(J=B(J^(x=x+D|0),16))|0,x=x+(D=B(D^E,12))|0,E=E+(J=B(J^x,8))|0,D=B(D^E,7),F=F+(K=B(K^(y=y+z|0),16))|0,y=y+(z=B(z^F,12))|0,F=F+(K=B(K^y,8))|0,z=B(z^F,7);let M=0;d[M++]=g+v|0,d[M++]=h+w|0,d[M++]=i+x|0,d[M++]=j+y|0,d[M++]=k+z|0,d[M++]=l+A|0,d[M++]=m+C|0,d[M++]=n+D|0,d[M++]=o+E|0,d[M++]=p+F|0,d[M++]=q+G|0,d[M++]=r+H|0,d[M++]=e+I|0,d[M++]=s+J|0,d[M++]=t+K|0,d[M++]=u+L|0},{counterRight:!1,counterLength:8,extendNonceFn:function(a,b,c,d){let e=o(a[0]),f=o(a[1]),g=o(a[2]),h=o(a[3]),i=o(b[0]),j=o(b[1]),k=o(b[2]),l=o(b[3]),m=o(b[4]),n=o(b[5]),q=o(b[6]),r=o(b[7]),s=o(c[0]),t=o(c[1]),u=o(c[2]),v=o(c[3]);for(let a=0;a<20;a+=2)m=m+(s=B(s^(e=e+i|0),16))|0,e=e+(i=B(i^m,12))|0,m=m+(s=B(s^e,8))|0,i=B(i^m,7),n=n+(t=B(t^(f=f+j|0),16))|0,f=f+(j=B(j^n,12))|0,n=n+(t=B(t^f,8))|0,j=B(j^n,7),q=q+(u=B(u^(g=g+k|0),16))|0,g=g+(k=B(k^q,12))|0,q=q+(u=B(u^g,8))|0,k=B(k^q,7),r=r+(v=B(v^(h=h+l|0),16))|0,h=h+(l=B(l^r,12))|0,r=r+(v=B(v^h,8))|0,l=B(l^r,7),q=q+(v=B(v^(e=e+j|0),16))|0,e=e+(j=B(j^q,12))|0,q=q+(v=B(v^e,8))|0,j=B(j^q,7),r=r+(s=B(s^(f=f+k|0),16))|0,f=f+(k=B(k^r,12))|0,r=r+(s=B(s^f,8))|0,k=B(k^r,7),m=m+(t=B(t^(g=g+l|0),16))|0,g=g+(l=B(l^m,12))|0,m=m+(t=B(t^g,8))|0,l=B(l^m,7),n=n+(u=B(u^(h=h+i|0),16))|0,h=h+(i=B(i^n,12))|0,n=n+(u=B(u^h,8))|0,i=B(i^n,7);let w=0;d[w++]=e,d[w++]=f,d[w++]=g,d[w++]=h,d[w++]=s,d[w++]=t,d[w++]=u,d[w++]=v,p(d)},allowShortKeys:!1}),I=new Uint8Array(16),J=(a,b)=>{a.update(b);let c=b.length%16;c&&a.update(I.subarray(c))},K=new Uint8Array(32);function L(a,b,c,d,e){var f,j;let k,m;void 0!==e&&i(e,void 0,"AAD");let n=a(b,c,K),o=(f=d.length,j=e?e.length:0,h(f),h(j),g(!0),(m=new DataView((k=new Uint8Array(16)).buffer,k.byteOffset,k.byteLength)).setBigUint64(0,BigInt(j),!0),m.setBigUint64(8,BigInt(f),!0),k),p=G.create(n);e&&J(p,e),J(p,d),p.update(o);let q=p.digest();return l(n,o),q}let M=((a,b)=>{function c(d,...e){i(d,void 0,"key"),void 0!==a.nonceLength&&i(e[0],a.varSizeNonce?void 0:a.nonceLength,"nonce");let f=a.tagLength;f&&void 0!==e[1]&&i(e[1],void 0,"AAD");let g=b(d,...e),h=(a,b)=>{if(void 0!==b){if(2!==a)throw Error("cipher output not supported");i(b,void 0,"output")}},j=!1;return{encrypt(a,b){if(j)throw Error("cannot encrypt() twice with same key + nonce");return j=!0,i(a),h(g.encrypt.length,b),g.encrypt(a,b)},decrypt(a,b){if(i(a),f&&a.length<f)throw Error('"ciphertext" expected length bigger than tagLength='+f);return h(g.decrypt.length,b),g.decrypt(a,b)}}}return Object.assign(c,a),c})({blockSize:64,nonceLength:24,tagLength:16},(a,b,c)=>({encrypt(d,e){let f=d.length;(e=t(f+16,e,!1)).set(d);let g=e.subarray(0,-16);H(a,b,g,g,1);let h=L(H,a,b,g,c);return e.set(h,f),l(h),e},decrypt(d,e){e=t(d.length-16,e,!1);let f=d.subarray(0,-16),g=d.subarray(-16),h=L(H,a,b,f,c);if(!function(a,b){if(a.length!==b.length)return!1;let c=0;for(let d=0;d<a.length;d++)c|=a[d]^b[d];return 0===c}(g,h))throw l(h),Error("invalid tag");return e.set(d.subarray(0,-16)),H(a,b,e,e,1),l(h),e}})),N="$ba$";async function O(a,b){let c=await (0,f.createHash)("SHA-256").digest(a),d=function(a){if("string"!=typeof a)throw TypeError("string expected");return new Uint8Array(new TextEncoder().encode(a))}(b);var e=x(M)(new Uint8Array(c)).encrypt(d);if(i(e),q)return e.toHex();let g="";for(let a=0;a<e.length;a++)g+=r[e[a]];return g}async function P(a,b){let c=await (0,f.createHash)("SHA-256").digest(a),d=function(a){if("string"!=typeof a)throw TypeError("hex string expected, got "+typeof a);if(q)try{return Uint8Array.fromHex(a)}catch(a){if(a instanceof SyntaxError)throw RangeError(a.message);throw a}let b=a.length,c=b/2;if(b%2)throw RangeError("hex string expected, got unpadded hex of length "+b);let d=new Uint8Array(c);for(let b=0,e=0;b<c;b++,e+=2){let c=s(a.charCodeAt(e)),f=s(a.charCodeAt(e+1));if(void 0===c||void 0===f)throw RangeError('hex string expected, got non-hex character "'+(a[e]+a[e+1])+'" at index '+e);d[b]=16*c+f}return d}(b),e=x(M)(new Uint8Array(c));return new TextDecoder().decode(e.decrypt(d))}let Q=async({key:a,data:b})=>{var c;if("string"==typeof a)return O(a,b);let d=a.keys.get(a.currentVersion);if(!d)throw Error(`Secret version ${a.currentVersion} not found in keys`);let e=await O(d,b);return c=a.currentVersion,`${N}${c}$${e}`},R=async({key:a,data:b})=>{if("string"==typeof a)return P(a,b);let c=function(a){if(!a.startsWith(N))return null;let b=a.indexOf("$",4);if(-1===b)return null;let c=parseInt(a.slice(4,b),10);return!Number.isInteger(c)||c<0?null:{version:c,ciphertext:a.slice(b+1)}}(b);if(c){let b=a.keys.get(c.version);if(!b)throw Error(`Secret version ${c.version} not found in keys (key may have been retired)`);return P(b,c.ciphertext)}if(a.legacySecret)return P(a.legacySecret,b);throw Error("Cannot decrypt legacy bare-hex payload: no legacy secret available. Set BETTER_AUTH_SECRET for backwards compatibility.")};a.s(["symmetricDecrypt",0,R,"symmetricEncrypt",0,Q],252736)},543600,a=>{"use strict";var b=a.i(252736);a.s(["decryptOAuthToken",0,function(a,c){if(!a)return a;if(c.options.account?.encryptOAuthTokens)return a.startsWith("$ba$")||a.length%2==0&&/^[0-9a-f]+$/i.test(a)?(0,b.symmetricDecrypt)({key:c.secretConfig,data:a}):a;return a},"setTokenUtil",0,function(a,c){return c.options.account?.encryptOAuthTokens&&a?(0,b.symmetricEncrypt)({key:c.secretConfig,data:a}):a}])},530027,a=>a.a(async(b,c)=>{try{var d=a.i(798331),e=a.i(405463),f=a.i(704551),g=a.i(46585),h=a.i(750290),i=a.i(815291),j=a.i(596343),k=a.i(512418),l=a.i(10862),m=a.i(832133),n=b([d,f,g,h,i,j]);async function o(a,b,c,d=3600,f){return await (0,e.signJWT)({email:b.toLowerCase(),updateTo:c?.toLowerCase(),...f},a,d)}async function p(a,b){if(!a.context.options.emailVerification?.sendVerificationEmail)throw a.context.logger.error("Verification email isn't enabled."),i.APIError.from("BAD_REQUEST",i.BASE_ERROR_CODES.VERIFICATION_EMAIL_NOT_ENABLED);let c=await o(a.context.secret,b.email,void 0,a.context.options.emailVerification?.expiresIn),d=a.body.callbackURL?encodeURIComponent(a.body.callbackURL):encodeURIComponent("/"),e=`${a.context.baseURL}/verify-email?token=${c}&callbackURL=${d}`;await a.context.runInBackgroundOrAwait(a.context.options.emailVerification.sendVerificationEmail({user:b,url:e,token:c},a.request?.clone()))}[d,f,g,h,i,j]=n.then?(await n)():n;let q=(0,j.createAuthEndpoint)("/send-verification-email",{method:"POST",operationId:"sendVerificationEmail",cloneRequest:!0,body:k.object({email:k.email().meta({description:"The email to send the verification email to"}),callbackURL:k.string().meta({description:"The URL to use for email verification callback"}).optional()}),metadata:{openapi:{operationId:"sendVerificationEmail",description:"Send a verification email to the user",requestBody:{content:{"application/json":{schema:{type:"object",properties:{email:{type:"string",description:"The email to send the verification email to",example:"user@example.com"},callbackURL:{type:"string",description:"The URL to use for email verification callback",example:"https://example.com/callback",nullable:!0}},required:["email"]}}}},responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{status:{type:"boolean",description:"Indicates if the email was sent successfully",example:!0}}}}}},400:{description:"Bad Request",content:{"application/json":{schema:{type:"object",properties:{message:{type:"string",description:"Error message",example:"Verification email isn't enabled"}}}}}}}}}},async a=>{if(!a.context.options.emailVerification?.sendVerificationEmail)throw a.context.logger.error("Verification email isn't enabled."),i.APIError.from("BAD_REQUEST",i.BASE_ERROR_CODES.VERIFICATION_EMAIL_NOT_ENABLED);let{email:b}=a.body,c=await (0,h.getSessionFromCtx)(a);if(!c){let c=await a.context.internalAdapter.findUserByEmail(b);return!c||c.user.emailVerified?await o(a.context.secret,b,void 0,a.context.options.emailVerification?.expiresIn):await p(a,c.user),a.json({status:!0})}if(c?.user.email.toLowerCase()!==b.toLowerCase())throw i.APIError.from("BAD_REQUEST",i.BASE_ERROR_CODES.EMAIL_MISMATCH);if(c?.user.emailVerified)throw i.APIError.from("BAD_REQUEST",i.BASE_ERROR_CODES.EMAIL_ALREADY_VERIFIED);return await p(a,c.user),a.json({status:!0})}),r=(0,j.createAuthEndpoint)("/verify-email",{method:"GET",operationId:"verifyEmail",query:k.object({token:k.string().meta({description:"The token to verify the email"}),callbackURL:k.string().meta({description:"The URL to redirect to after email verification"}).optional()}),use:[(0,d.originCheck)(a=>a.query.callbackURL)],metadata:{openapi:{description:"Verify the email of the user",parameters:[{name:"token",in:"query",description:"The token to verify the email",required:!0,schema:{type:"string"}},{name:"callbackURL",in:"query",description:"The URL to redirect to after email verification",required:!1,schema:{type:"string"}}],responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{user:{type:"object",$ref:"#/components/schemas/User"},status:{type:"boolean",description:"Indicates if the email was verified successfully"}},required:["user","status"]}}}}}}}},async a=>{let b;function c(b){if(a.query.callbackURL){if(a.query.callbackURL.includes("?"))throw a.redirect(`${a.query.callbackURL}&error=${b.code}`);throw a.redirect(`${a.query.callbackURL}?error=${b.code}`)}throw i.APIError.from("UNAUTHORIZED",b)}let{token:d}=a.query;try{b=await (0,l.jwtVerify)(d,new TextEncoder().encode(a.context.secret),{algorithms:["HS256"]})}catch(a){if(a instanceof m.JWTExpired)return c(i.BASE_ERROR_CODES.TOKEN_EXPIRED);return c(i.BASE_ERROR_CODES.INVALID_TOKEN)}let e=k.object({email:k.email(),updateTo:k.string().optional(),requestType:k.string().optional()}).parse(b.payload),j=await a.context.internalAdapter.findUserByEmail(e.email);if(!j)return c(i.BASE_ERROR_CODES.USER_NOT_FOUND);if(e.updateTo){let b=await (0,h.getSessionFromCtx)(a);if(b&&b.user.email!==e.email)return c(i.BASE_ERROR_CODES.INVALID_USER);switch(e.requestType){case"change-email-confirmation":{let b=await o(a.context.secret,e.email,e.updateTo,a.context.options.emailVerification?.expiresIn,{requestType:"change-email-verification"}),c=a.query.callbackURL?encodeURIComponent(a.query.callbackURL):encodeURIComponent("/"),d=`${a.context.baseURL}/verify-email?token=${b}&callbackURL=${c}`;if(a.context.options.emailVerification?.sendVerificationEmail&&await a.context.runInBackgroundOrAwait(a.context.options.emailVerification.sendVerificationEmail({user:{...j.user,email:e.updateTo},url:d,token:b},a.request?.clone())),a.query.callbackURL)throw a.redirect(a.query.callbackURL);return a.json({status:!0})}case"change-email-verification":{let c=b;if(!c){let b=await a.context.internalAdapter.createSession(j.user.id);if(!b)throw i.APIError.from("INTERNAL_SERVER_ERROR",i.BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);c={session:b,user:j.user}}let d=await a.context.internalAdapter.updateUserByEmail(e.email,{email:e.updateTo,emailVerified:!0});if(a.context.options.emailVerification?.afterEmailVerification&&await a.context.options.emailVerification.afterEmailVerification(d,a.request),await (0,g.setSessionCookie)(a,{session:c.session,user:{...c.user,email:e.updateTo,emailVerified:!0}}),a.query.callbackURL)throw a.redirect(a.query.callbackURL);return a.json({status:!0,user:(0,f.parseUserOutput)(a.context.options,d)})}default:{let c=b;if(!c){let b=await a.context.internalAdapter.createSession(j.user.id);if(!b)throw i.APIError.from("INTERNAL_SERVER_ERROR",i.BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);c={session:b,user:j.user}}let d=await a.context.internalAdapter.updateUserByEmail(e.email,{email:e.updateTo,emailVerified:!1}),h=await o(a.context.secret,e.updateTo),k=a.query.callbackURL?encodeURIComponent(a.query.callbackURL):encodeURIComponent("/");if(a.context.options.emailVerification?.sendVerificationEmail&&await a.context.runInBackgroundOrAwait(a.context.options.emailVerification.sendVerificationEmail({user:d,url:`${a.context.baseURL}/verify-email?token=${h}&callbackURL=${k}`,token:h},a.request?.clone())),await (0,g.setSessionCookie)(a,{session:c.session,user:{...c.user,email:e.updateTo,emailVerified:!1}}),a.query.callbackURL)throw a.redirect(a.query.callbackURL);return a.json({status:!0,user:(0,f.parseUserOutput)(a.context.options,d)})}}}if(j.user.emailVerified){if(a.query.callbackURL)throw a.redirect(a.query.callbackURL);return a.json({status:!0,user:null})}a.context.options.emailVerification?.beforeEmailVerification&&await a.context.options.emailVerification.beforeEmailVerification(j.user,a.request);let n=await a.context.internalAdapter.updateUserByEmail(e.email,{emailVerified:!0});if(a.context.options.emailVerification?.afterEmailVerification&&await a.context.options.emailVerification.afterEmailVerification(n,a.request),a.context.options.emailVerification?.autoSignInAfterVerification){let b=await (0,h.getSessionFromCtx)(a);if(b&&b.user.email===e.email)await (0,g.setSessionCookie)(a,{session:b.session,user:{...b.user,emailVerified:!0}});else{let b=await a.context.internalAdapter.createSession(j.user.id);if(!b)throw i.APIError.from("INTERNAL_SERVER_ERROR",i.BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);await (0,g.setSessionCookie)(a,{session:b,user:{...j.user,emailVerified:!0}})}}if(a.query.callbackURL)throw a.redirect(a.query.callbackURL);return a.json({status:!0,user:null})});a.s(["createEmailVerificationToken",0,o,"sendVerificationEmail",0,q,"sendVerificationEmailFn",0,p,"verifyEmail",0,r]),c()}catch(a){c(a)}},!1),804191,a=>a.a(async(b,c)=>{try{var d=a.i(417387),e=a.i(646762),f=a.i(44541),g=a.i(543600),h=a.i(530027),i=a.i(28675),j=b([d,e,h,i]);async function k(a,b){let{userInfo:c,account:j,callbackURL:k,disableSignUp:m,overrideUserInfo:n}=b,o=await a.context.internalAdapter.findOAuthUser(c.email.toLowerCase(),j.accountId,j.providerId).catch(b=>{i.logger.error("Better auth was unable to query your database.\nError: ",b),(0,f.redirectOnError)(a,a.context.options.onAPIError?.errorURL||`${a.context.baseURL}/error`,"internal_server_error")}),p=o?.user,q=!p;if(o){let d=o.linkedAccount??o.accounts.find(a=>a.providerId===j.providerId&&a.accountId===j.accountId);if(d){let b=a.context.options.account?.updateAccountOnSignIn!==!1?Object.fromEntries(Object.entries({idToken:j.idToken,accessToken:await (0,g.setTokenUtil)(j.accessToken,a.context),refreshToken:await (0,g.setTokenUtil)(j.refreshToken,a.context),accessTokenExpiresAt:j.accessTokenExpiresAt,refreshTokenExpiresAt:j.refreshTokenExpiresAt,scope:j.scope}).filter(([a,b])=>void 0!==b)):{};a.context.options.account?.storeAccountCookie&&await (0,e.setAccountCookie)(a,{...d,...b}),Object.keys(b).length>0&&await a.context.internalAdapter.updateAccount(d.id,b),c.emailVerified&&!o.user.emailVerified&&c.email.toLowerCase()===o.user.email&&await a.context.internalAdapter.updateUser(o.user.id,{emailVerified:!0})}else{let d=a.context.options.account?.accountLinking,e=b.isTrustedProvider||!1!==b.trustProviderByName&&a.context.trustedProviders.includes(j.providerId),f=d?.requireLocalEmailVerified??!0;if(!e&&!c.emailVerified||f&&!o.user.emailVerified||d?.enabled===!1||d?.disableImplicitLinking===!0)return(0,i.isDevelopment)()&&i.logger.warn(`User already exist but account isn't linked to ${j.providerId}. To read more about how account linking works in Better Auth see https://www.better-auth.com/docs/concepts/users-accounts#account-linking.`),{error:"account not linked",data:null};try{await a.context.internalAdapter.linkAccount({providerId:j.providerId,accountId:c.id.toString(),userId:o.user.id,accessToken:await (0,g.setTokenUtil)(j.accessToken,a.context),refreshToken:await (0,g.setTokenUtil)(j.refreshToken,a.context),idToken:j.idToken,accessTokenExpiresAt:j.accessTokenExpiresAt,refreshTokenExpiresAt:j.refreshTokenExpiresAt,scope:j.scope})}catch(a){return i.logger.error("Unable to link account",a),{error:"unable to link account",data:null}}c.emailVerified&&!o.user.emailVerified&&c.email.toLowerCase()===o.user.email&&await a.context.internalAdapter.updateUser(o.user.id,{emailVerified:!0}),p=await l(a,o.user.id,c)??p}if(n){let{id:b,...d}=c;p=await a.context.internalAdapter.updateUser(o.user.id,{...d,email:c.email.toLowerCase(),emailVerified:c.email.toLowerCase()===o.user.email&&o.user.emailVerified||c.emailVerified})}}else{if(m)return{error:"signup disabled",data:null,isRegister:!1};try{let{id:b,...d}=c,f={accessToken:await (0,g.setTokenUtil)(j.accessToken,a.context),refreshToken:await (0,g.setTokenUtil)(j.refreshToken,a.context),idToken:j.idToken,accessTokenExpiresAt:j.accessTokenExpiresAt,refreshTokenExpiresAt:j.refreshTokenExpiresAt,scope:j.scope,providerId:j.providerId,accountId:c.id.toString()},{user:i,account:l}=await a.context.internalAdapter.createOAuthUser({...d,email:c.email.toLowerCase()},f);if(p=i,a.context.options.account?.storeAccountCookie&&await (0,e.setAccountCookie)(a,l),!c.emailVerified&&p&&a.context.options.emailVerification?.sendOnSignUp&&a.context.options.emailVerification?.sendVerificationEmail){let b=await (0,h.createEmailVerificationToken)(a.context.secret,p.email,void 0,a.context.options.emailVerification?.expiresIn),c=`${a.context.baseURL}/verify-email?token=${b}&callbackURL=${encodeURIComponent(k||"/")}`;await a.context.runInBackgroundOrAwait(a.context.options.emailVerification.sendVerificationEmail({user:p,url:c,token:b},a.request))}}catch(a){if(i.logger.error(a),(0,d.isAPIError)(a))return{error:a.message,data:null,isRegister:!1};return{error:"unable to create user",data:null,isRegister:!1}}}if(!p)return{error:"unable to create user",data:null,isRegister:!1};let r=await a.context.internalAdapter.createSession(p.id);return r?{data:{session:r,user:p},error:null,isRegister:q}:{error:"unable to create session",data:null,isRegister:!1}}async function l(a,b,c){if(a.context.options.account?.accountLinking?.updateUserInfoOnLink!==!0)return;let{id:d,email:e,emailVerified:f,...g}=c;try{return await a.context.internalAdapter.updateUser(b,g)}catch(b){a.context.logger.warn("Could not update user info on account link",b);return}}[d,e,h,i]=j.then?(await j)():j,a.s(["applyUpdateUserInfoOnLink",0,l,"handleOAuthUserInfo",0,k]),c()}catch(a){c(a)}},!1),462315,a=>a.a(async(b,c)=>{try{var d=a.i(597080),e=a.i(252736),f=a.i(46585),g=a.i(815291),h=a.i(512418),i=a.i(142060),j=b([f,g]);[f,g]=j.then?(await j)():j;let n=h.looseObject({callbackURL:h.string(),codeVerifier:h.string(),errorURL:h.string().optional(),newUserURL:h.string().optional(),expiresAt:h.number(),oauthState:h.string().optional(),link:h.object({email:h.string(),userId:i.coerce.string()}).optional(),requestSignUp:h.boolean().optional()});var k=class extends g.BetterAuthError{code;details;errorURL;constructor(a,b){super(a,b),this.code=b.code,this.details=b.details,this.errorURL=b.errorURL}};async function l(a,b,c){let f=(0,d.generateRandomString)(32);if("cookie"===a.context.oauthConfig.storeStateStrategy){let d={...b,oauthState:f},g=await (0,e.symmetricEncrypt)({key:a.context.secretConfig,data:JSON.stringify(d)}),h=a.context.createAuthCookie(c?.cookieName??"oauth_state",{maxAge:600});return a.setCookie(h.name,g,h.attributes),{state:f,codeVerifier:b.codeVerifier}}let g=a.context.createAuthCookie(c?.cookieName??"state",{maxAge:300});await a.setSignedCookie(g.name,f,a.context.secret,g.attributes);let h=new Date;if(h.setMinutes(h.getMinutes()+10),!await a.context.internalAdapter.createVerificationValue({value:JSON.stringify({...b,oauthState:f}),identifier:f,expiresAt:h}))throw new k("Unable to create verification. Make sure the database adapter is properly working and there is a verification table in the database",{code:"state_generation_error"});return{state:f,codeVerifier:b.codeVerifier}}async function m(a,b,c){let d;if(!b)throw new k("State not found in OAuth callback",{code:"state_not_found"});let g=a.context.oauthConfig.storeStateStrategy;if("cookie"===g){let g=a.context.createAuthCookie(c?.cookieName??"oauth_state"),h=a.getCookie(g.name);if(!h)throw new k("State mismatch: auth state cookie not found",{code:"state_mismatch",details:{state:b}});try{let b=await (0,e.symmetricDecrypt)({key:a.context.secretConfig,data:h});d=n.parse(JSON.parse(b))}catch(a){throw new k("State invalid: Failed to decrypt or parse auth state",{code:"state_invalid",details:{state:b},cause:a})}if(!d.oauthState||d.oauthState!==b)throw new k("State mismatch: OAuth state parameter does not match stored state",{code:"state_security_mismatch",details:{state:b},errorURL:d.errorURL});(0,f.expireCookie)(a,g)}else{let e=await a.context.internalAdapter.findVerificationValue(b);if(!e)throw new k("State mismatch: verification not found",{code:"state_mismatch",details:{state:b}});if(d=n.parse(JSON.parse(e.value)),void 0!==d.oauthState&&d.oauthState!==b)throw new k("State mismatch: OAuth state parameter does not match stored state",{code:"state_security_mismatch",details:{state:b},errorURL:d.errorURL});let g=a.context.createAuthCookie(c?.cookieName??"state"),h=await a.getSignedCookie(g.name,a.context.secret);if(!(c?.skipStateCookieCheck??a.context.oauthConfig.skipStateCookieCheck)&&(!h||h!==b))throw new k("State mismatch: State not persisted correctly",{code:"state_security_mismatch",details:{state:b},errorURL:d.errorURL});(0,f.expireCookie)(a,g),await a.context.internalAdapter.deleteVerificationByIdentifier(b)}if(d.expiresAt<Date.now())throw new k("Invalid state: request expired",{code:"state_mismatch",details:{expiresAt:d.expiresAt},errorURL:d.errorURL});return d}a.s(["StateError",0,k,"generateGenericState",0,l,"parseGenericState",0,m]),c()}catch(a){c(a)}},!1),128209,a=>a.a(async(b,c)=>{try{var d=a.i(597080),e=a.i(44541),f=a.i(450259),g=a.i(462315),h=a.i(815291),i=b([f,g,h]);async function j(a,b,c){let e=a.body?.callbackURL||a.context.options.baseURL;if(!e)throw h.APIError.from("BAD_REQUEST",h.BASE_ERROR_CODES.CALLBACK_URL_REQUIRED);let i=(0,d.generateRandomString)(128),j={...c||{},callbackURL:e,codeVerifier:i,errorURL:a.body?.errorCallbackURL,newUserURL:a.body?.newUserCallbackURL,link:b,expiresAt:Date.now()+6e5,requestSignUp:a.body?.requestSignUp};await (0,f.setOAuthState)(j);try{return(0,g.generateGenericState)(a,j)}catch(b){throw a.context.logger.error("Failed to create verification",b),new h.APIError("INTERNAL_SERVER_ERROR",{message:"Unable to create verification",cause:b})}}async function k(a){let b,c=a.query.state||a.body?.state,d=a.context.options.onAPIError?.errorURL||`${a.context.baseURL}/error`;try{b=await (0,g.parseGenericState)(a,c)}catch(f){a.context.logger.error("Failed to parse state",f);let b="internal_server_error",c=d;f instanceof g.StateError&&(b="state_security_mismatch"===f.code?"state_mismatch":f.code,c=f.errorURL??d),(0,e.redirectOnError)(a,c,b)}return b.errorURL||(b.errorURL=d),b&&await (0,f.setOAuthState)(b),b}[f,g,h]=i.then?(await i)():i,a.s(["generateState",0,j,"parseState",0,k]),c()}catch(a){c(a)}},!1),184062,a=>a.a(async(b,c)=>{try{var d=a.i(769675),e=a.i(704551),f=a.i(646762),g=a.i(878243),h=a.i(44541),i=a.i(543600),j=a.i(804191),k=a.i(128209),l=a.i(750290),m=a.i(815291),n=a.i(227265),o=a.i(596343),p=a.i(512418),q=b([e,f,g,j,k,l,m,n,o]);[e,f,g,j,k,l,m,n,o]=q.then?(await q)():q;let u=(0,o.createAuthEndpoint)("/list-accounts",{method:"GET",use:[l.sessionMiddleware],metadata:{openapi:{operationId:"listUserAccounts",description:"List all accounts linked to the user",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"array",items:{type:"object",properties:{id:{type:"string"},providerId:{type:"string"},createdAt:{type:"string",format:"date-time"},updatedAt:{type:"string",format:"date-time"},accountId:{type:"string"},userId:{type:"string"},scopes:{type:"array",items:{type:"string"}}},required:["id","providerId","createdAt","updatedAt","accountId","userId","scopes"]}}}}}}}}},async a=>{let b=a.context.session,c=await a.context.internalAdapter.findAccounts(b.user.id);return a.json(c.map(b=>{let{scope:c,...d}=(0,e.parseAccountOutput)(a.context.options,b);return{...d,scopes:c?.split(",")||[]}}))}),v=(0,o.createAuthEndpoint)("/link-social",{method:"POST",requireHeaders:!0,body:p.object({callbackURL:p.string().meta({description:"The URL to redirect to after the user has signed in"}).optional(),provider:n.SocialProviderListEnum,idToken:p.object({token:p.string(),nonce:p.string().optional(),accessToken:p.string().optional(),refreshToken:p.string().optional(),scopes:p.array(p.string()).optional()}).optional(),requestSignUp:p.boolean().optional(),scopes:p.array(p.string()).meta({description:"Additional scopes to request from the provider"}).optional(),errorCallbackURL:p.string().meta({description:"The URL to redirect to if there is an error during the link process"}).optional(),disableRedirect:p.boolean().meta({description:"Disable automatic redirection to the provider. Useful for handling the redirection yourself"}).optional(),additionalData:p.record(p.string(),p.any()).optional()}),use:[l.sessionMiddleware],metadata:{openapi:{description:"Link a social account to the user",operationId:"linkSocialAccount",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{url:{type:"string",description:"The authorization URL to redirect the user to"},redirect:{type:"boolean",description:"Indicates if the user should be redirected to the authorization URL"},status:{type:"boolean"}},required:["redirect"]}}}}}}}},async a=>{let b=a.context.session,c=await (0,g.getAwaitableValue)(a.context.socialProviders,{value:a.body.provider});if(!c)throw a.context.logger.error("Provider not found. Make sure to add the provider in your auth config",{provider:a.body.provider}),m.APIError.from("NOT_FOUND",m.BASE_ERROR_CODES.PROVIDER_NOT_FOUND);if(a.body.idToken){if(!c.verifyIdToken)throw a.context.logger.error("Provider does not support id token verification",{provider:a.body.provider}),m.APIError.from("NOT_FOUND",m.BASE_ERROR_CODES.ID_TOKEN_NOT_SUPPORTED);let{token:d,nonce:e}=a.body.idToken;if(!await c.verifyIdToken(d,e))throw a.context.logger.warn("Invalid id token",{provider:a.body.provider}),m.APIError.from("UNAUTHORIZED",m.BASE_ERROR_CODES.INVALID_TOKEN);let f=await c.getUserInfo({idToken:d,accessToken:a.body.idToken.accessToken,refreshToken:a.body.idToken.refreshToken});if(!f||!f?.user)throw a.context.logger.error("Failed to get user info",{provider:a.body.provider}),m.APIError.from("UNAUTHORIZED",m.BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO);let g=String(f.user.id);if(!f.user.email)throw a.context.logger.error((0,h.missingEmailLogMessage)(a.body.provider,{source:"id_token"}),{provider:a.body.provider}),m.APIError.from("UNAUTHORIZED",m.BASE_ERROR_CODES.USER_EMAIL_NOT_FOUND);if((await a.context.internalAdapter.findAccounts(b.user.id)).find(a=>a.providerId===c.id&&a.accountId===g))return a.json({url:"",status:!0,redirect:!1});if(!a.context.trustedProviders.includes(c.id)&&!f.user.emailVerified||a.context.options.account?.accountLinking?.enabled===!1)throw m.APIError.from("UNAUTHORIZED",{message:"Account not linked - linking not allowed",code:"LINKING_NOT_ALLOWED"});if(f.user.email?.toLowerCase()!==b.user.email.toLowerCase()&&a.context.options.account?.accountLinking?.allowDifferentEmails!==!0)throw m.APIError.from("UNAUTHORIZED",{message:"Account not linked - different emails not allowed",code:"LINKING_DIFFERENT_EMAILS_NOT_ALLOWED"});try{await a.context.internalAdapter.createAccount({userId:b.user.id,providerId:c.id,accountId:g,accessToken:a.body.idToken.accessToken,idToken:d,refreshToken:a.body.idToken.refreshToken,scope:a.body.idToken.scopes?.join(",")})}catch(a){throw m.APIError.from("EXPECTATION_FAILED",{message:"Account not linked - unable to create account",code:"LINKING_FAILED"})}return await (0,j.applyUpdateUserInfoOnLink)(a,b.user.id,f.user),a.json({url:"",status:!0,redirect:!1})}let d=await (0,k.generateState)(a,{userId:b.user.id,email:b.user.email},a.body.additionalData),e=await c.createAuthorizationURL({state:d.state,codeVerifier:d.codeVerifier,redirectURI:`${a.context.baseURL}/callback/${c.id}`,scopes:a.body.scopes});return a.body.disableRedirect||a.setHeader("Location",e.toString()),a.json({url:e.toString(),redirect:!a.body.disableRedirect})}),w=(0,o.createAuthEndpoint)("/unlink-account",{method:"POST",body:p.object({providerId:p.string(),accountId:p.string().optional()}),use:[l.freshSessionMiddleware],metadata:{openapi:{description:"Unlink an account",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{status:{type:"boolean"}}}}}}}}}},async a=>{let{providerId:b,accountId:c}=a.body,d=await a.context.internalAdapter.findAccounts(a.context.session.user.id);if(1===d.length&&!a.context.options.account?.accountLinking?.allowUnlinkingAll)throw m.APIError.from("BAD_REQUEST",m.BASE_ERROR_CODES.FAILED_TO_UNLINK_LAST_ACCOUNT);let e=d.find(a=>c?a.accountId===c&&a.providerId===b:a.providerId===b);if(!e)throw m.APIError.from("BAD_REQUEST",m.BASE_ERROR_CODES.ACCOUNT_NOT_FOUND);return await a.context.internalAdapter.deleteAccount(e.id),a.json({status:!0})});async function r(a,b){let c=await (0,l.getSessionFromCtx)(a,{disableCookieCache:(0,l.isStateful)(a)});if(!c&&(a.request||a.headers))throw a.error("UNAUTHORIZED");let d=c?.user?.id||b;if(!d)throw m.APIError.from("BAD_REQUEST",{message:"Either userId or session is required",code:"USER_ID_OR_SESSION_REQUIRED"});return d}function s(a,b,{resolvedUserId:c,providerId:e,accountId:f}){return(!(0,d.shouldBindAccountCookieToSessionUser)(a.context.options)||b.userId===c)&&(!e||e===b.providerId)&&(!f||b.accountId===f)}async function t(a,{resolvedUserId:b,providerId:c,accountId:d,account:e}){let h=await (0,g.getAwaitableValue)(a.context.socialProviders,{value:c});if(!h)throw m.APIError.from("BAD_REQUEST",{message:`Provider ${c} is not supported.`,code:"PROVIDER_NOT_SUPPORTED"});let j=e;if(!j){let e=await (0,f.getAccountCookie)(a);j=e&&s(a,e,{resolvedUserId:b,providerId:c,accountId:d})?e:(await a.context.internalAdapter.findAccounts(b)).find(a=>d?a.accountId===d&&a.providerId===c:a.providerId===c)}if(!j)throw m.APIError.from("BAD_REQUEST",m.BASE_ERROR_CODES.ACCOUNT_NOT_FOUND);try{let b=null,c=j.accessTokenExpiresAt&&new Date(j.accessTokenExpiresAt).getTime()-Date.now()<5e3;if(j.refreshToken&&c&&h.refreshAccessToken){let c=await (0,i.decryptOAuthToken)(j.refreshToken,a.context);b=await h.refreshAccessToken(c);let d={accessToken:await (0,i.setTokenUtil)(b?.accessToken,a.context),accessTokenExpiresAt:b?.accessTokenExpiresAt,refreshToken:b?.refreshToken?await (0,i.setTokenUtil)(b.refreshToken,a.context):j.refreshToken,refreshTokenExpiresAt:b?.refreshTokenExpiresAt??j.refreshTokenExpiresAt,idToken:b?.idToken||j.idToken},e=null;j.id&&(e=await a.context.internalAdapter.updateAccount(j.id,d)),a.context.options.account?.storeAccountCookie&&await (0,f.setAccountCookie)(a,{...j,...e??d})}let d=b?.accessTokenExpiresAt?"string"==typeof b.accessTokenExpiresAt?new Date(b.accessTokenExpiresAt):b.accessTokenExpiresAt:j.accessTokenExpiresAt?"string"==typeof j.accessTokenExpiresAt?new Date(j.accessTokenExpiresAt):j.accessTokenExpiresAt:void 0;return{accessToken:b?.accessToken??await (0,i.decryptOAuthToken)(j.accessToken??"",a.context),accessTokenExpiresAt:d,scopes:j.scope?.split(",")??[],idToken:b?.idToken??j.idToken??void 0}}catch(a){throw m.APIError.from("BAD_REQUEST",{message:"Failed to get a valid access token",code:"FAILED_TO_GET_ACCESS_TOKEN"})}}let x=(0,o.createAuthEndpoint)("/get-access-token",{method:"POST",body:p.object({providerId:p.string().meta({description:"The provider ID for the OAuth provider"}),accountId:p.string().meta({description:"The account ID associated with the refresh token"}).optional(),userId:p.string().meta({description:"The user ID associated with the account"}).optional()}),metadata:{openapi:{description:"Get a valid access token, doing a refresh if needed",responses:{200:{description:"A Valid access token",content:{"application/json":{schema:{type:"object",properties:{tokenType:{type:"string"},idToken:{type:"string"},accessToken:{type:"string"},accessTokenExpiresAt:{type:"string",format:"date-time"}}}}}},400:{description:"Invalid refresh token or provider configuration"}}}}},async a=>{let{providerId:b,accountId:c,userId:d}=a.body||{},e=await t(a,{resolvedUserId:await r(a,d),providerId:b,accountId:c});return a.json(e)}),y=(0,o.createAuthEndpoint)("/refresh-token",{method:"POST",body:p.object({providerId:p.string().meta({description:"The provider ID for the OAuth provider"}),accountId:p.string().meta({description:"The account ID associated with the refresh token"}).optional(),userId:p.string().meta({description:"The user ID associated with the account"}).optional()}),metadata:{openapi:{description:"Refresh the access token using a refresh token",responses:{200:{description:"Access token refreshed successfully",content:{"application/json":{schema:{type:"object",properties:{tokenType:{type:"string"},idToken:{type:"string"},accessToken:{type:"string"},refreshToken:{type:"string"},accessTokenExpiresAt:{type:"string",format:"date-time"},refreshTokenExpiresAt:{type:"string",format:"date-time"}}}}}},400:{description:"Invalid refresh token or provider configuration"}}}}},async a=>{let b,{providerId:c,accountId:d,userId:e}=a.body,h=await r(a,e),j=await (0,g.getAwaitableValue)(a.context.socialProviders,{value:c});if(!j)throw m.APIError.from("BAD_REQUEST",{message:`Provider ${c} is not supported.`,code:"PROVIDER_NOT_SUPPORTED"});if(!j.refreshAccessToken)throw m.APIError.from("BAD_REQUEST",{message:`Provider ${c} does not support token refreshing.`,code:"TOKEN_REFRESH_NOT_SUPPORTED"});let k=await (0,f.getAccountCookie)(a),l=!!k&&s(a,k,{resolvedUserId:h,providerId:c,accountId:d});if(!(b=l?k:(await a.context.internalAdapter.findAccounts(h)).find(a=>d?a.accountId===d&&a.providerId===c:a.providerId===c)))throw m.APIError.from("BAD_REQUEST",m.BASE_ERROR_CODES.ACCOUNT_NOT_FOUND);let n=b.refreshToken??void 0;if(!n)throw m.APIError.from("BAD_REQUEST",{message:"Refresh token not found",code:"REFRESH_TOKEN_NOT_FOUND"});try{let c=await (0,i.decryptOAuthToken)(n,a.context),d=await j.refreshAccessToken(c),e=d.refreshToken?await (0,i.setTokenUtil)(d.refreshToken,a.context):n,g=d.refreshTokenExpiresAt??b.refreshTokenExpiresAt;if(b.id){let c={...b||{},accessToken:await (0,i.setTokenUtil)(d.accessToken,a.context),refreshToken:e,accessTokenExpiresAt:d.accessTokenExpiresAt,refreshTokenExpiresAt:g,scope:d.scopes?.join(",")||b.scope,idToken:d.idToken||b.idToken};await a.context.internalAdapter.updateAccount(b.id,c)}return l&&a.context.options.account?.storeAccountCookie&&await (0,f.setAccountCookie)(a,{...k,accessToken:await (0,i.setTokenUtil)(d.accessToken,a.context),refreshToken:e,accessTokenExpiresAt:d.accessTokenExpiresAt,refreshTokenExpiresAt:g,scope:d.scopes?.join(",")||k.scope,idToken:d.idToken||k.idToken}),a.json({accessToken:d.accessToken,refreshToken:d.refreshToken??c,accessTokenExpiresAt:d.accessTokenExpiresAt,refreshTokenExpiresAt:g,scope:d.scopes?.join(",")||b.scope,idToken:d.idToken||b.idToken,providerId:b.providerId,accountId:b.accountId})}catch(a){throw m.APIError.from("BAD_REQUEST",{message:"Failed to refresh access token",code:"FAILED_TO_REFRESH_ACCESS_TOKEN"})}}),z=p.optional(p.object({accountId:p.string().meta({description:"The provider given account id for which to get the account info"}).optional(),providerId:p.string().meta({description:"The provider ID to disambiguate provider-issued account IDs"}).optional(),userId:p.string().meta({description:"The user ID associated with the account"}).optional()})),A=(0,o.createAuthEndpoint)("/account-info",{method:"GET",metadata:{openapi:{description:"Get the account info provided by the provider",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{user:{type:"object",properties:{id:{type:"string"},name:{type:"string"},email:{type:"string"},image:{type:"string"},emailVerified:{type:"boolean"}},required:["id","emailVerified"]},data:{type:"object",properties:{},additionalProperties:!0}},required:["user","data"],additionalProperties:!1}}}}}}},query:z},async a=>{let b,{accountId:c,providerId:d,userId:e}=a.query||{},h=await r(a,e);if(c){let e=(await a.context.internalAdapter.findAccounts(h)).filter(a=>a.accountId===c&&(!d||a.providerId===d));if(e.length>1)throw m.APIError.from("BAD_REQUEST",{message:"Multiple accounts share this account ID. Pass a providerId to disambiguate.",code:"AMBIGUOUS_ACCOUNT"});b=e[0]}else if(a.context.options.account?.storeAccountCookie){let c=await (0,f.getAccountCookie)(a);c&&s(a,c,{resolvedUserId:h,providerId:d})&&(b=c)}if(!b||!s(a,b,{resolvedUserId:h}))throw m.APIError.from("BAD_REQUEST",m.BASE_ERROR_CODES.ACCOUNT_NOT_FOUND);let i=await (0,g.getAwaitableValue)(a.context.socialProviders,{value:b.providerId});if(!i)throw m.APIError.from("BAD_REQUEST",{message:"Account is not associated with a configured social provider.",code:"PROVIDER_NOT_CONFIGURED"});let j=await t(a,{resolvedUserId:h,providerId:b.providerId,accountId:b.accountId,account:b});if(!j.accessToken)throw m.APIError.from("BAD_REQUEST",{message:"Access token not found",code:"ACCESS_TOKEN_NOT_FOUND"});let k=await i.getUserInfo({...j,accessToken:j.accessToken});return a.json(k)});a.s(["accountInfo",0,A,"getAccessToken",0,x,"linkSocialAccount",0,v,"listUserAccounts",0,u,"refreshToken",0,y,"unlinkAccount",0,w]),c()}catch(a){c(a)}},!1),221972,a=>{"use strict";a.s(["HIDE_METADATA",0,{scope:"server"}])},799963,a=>a.a(async(b,c)=>{try{var d=a.i(417387),e=a.i(46585),f=a.i(878243),g=a.i(44541),h=a.i(543600),i=a.i(804191),j=a.i(128209),k=a.i(221972),l=a.i(140257),m=a.i(596343),n=a.i(512418),o=b([d,e,f,i,j,l,m]);[d,e,f,i,j,l,m]=o.then?(await o)():o;let p=n.object({code:n.string().optional(),error:n.string().optional(),device_id:n.string().optional(),error_description:n.string().optional(),state:n.string().optional(),user:n.string().optional()}),q=(0,m.createAuthEndpoint)("/callback/:id",{method:["GET","POST"],operationId:"handleOAuthCallback",body:p.optional(),query:p.optional(),metadata:{...k.HIDE_METADATA,allowedMediaTypes:["application/x-www-form-urlencoded","application/json"]}},async a=>{let b,c,k,m,n=a.context.options.onAPIError?.errorURL||`${a.context.baseURL}/error`;if("POST"===a.method){let b=a.body?p.parse(a.body):{},c=a.query?p.parse(a.query):{},d=p.parse({...b,...c}),e=new URLSearchParams;for(let[a,b]of Object.entries(d))null!=b&&e.set(a,String(b));let f=`${a.context.baseURL}/callback/${a.params.id}?${e.toString()}`;throw a.redirect(f)}try{if("GET"===a.method)b=p.parse(a.query);else if("POST"===a.method)b=p.parse(a.body);else throw Error("Unsupported method")}catch(b){a.context.logger.error("INVALID_CALLBACK_REQUEST",b),(0,g.redirectOnError)(a,n,"invalid_callback_request")}let{code:o,error:q,error_description:r,device_id:s,user:t}=b,{codeVerifier:u,callbackURL:v,link:w,errorURL:x,newUserURL:y,requestSignUp:z}=await (0,j.parseState)(a),A=x??n;q&&(0,g.redirectOnError)(a,A,q,r),o||(a.context.logger.warn("Code not found"),(0,g.redirectOnError)(a,A,"no_code"));let B=await (0,f.getAwaitableValue)(a.context.socialProviders,{value:a.params.id});B||(a.context.logger.warn("OAuth provider not found",{providerId:a.params.id}),(0,g.redirectOnError)(a,A,"oauth_provider_not_found"));try{c=await B.validateAuthorizationCode({code:o,codeVerifier:u,deviceId:s,redirectURI:`${a.context.baseURL}/callback/${B.id}`})}catch(b){a.context.logger.error("",b),(0,g.redirectOnError)(a,A,"invalid_code")}c||(0,g.redirectOnError)(a,A,"invalid_code");let C=t?(0,l.safeJSONParse)(t):null,D=await B.getUserInfo({...c,user:C??void 0}).then(a=>a?.user);D&&void 0!==D.id&&null!==D.id&&""!==D.id||(a.context.logger.error("Unable to get user info"),(0,g.redirectOnError)(a,A,"unable_to_get_user_info"));let E=String(D.id);if(v||(a.context.logger.error("No callback URL found"),(0,g.redirectOnError)(a,A,"no_callback_url")),w){let b;(a.context.trustedProviders.includes(B.id)||D.emailVerified)&&a.context.options.account?.accountLinking?.enabled!==!1||(a.context.logger.error("Unable to link account - untrusted provider"),(0,g.redirectOnError)(a,A,"unable_to_link_account")),D.email?.toLowerCase()!==w.email.toLowerCase()&&a.context.options.account?.accountLinking?.allowDifferentEmails!==!0&&(0,g.redirectOnError)(a,A,"email_doesn't_match");let d=await a.context.internalAdapter.findAccountByProviderId(E,B.id);if(d){d.userId.toString()!==w.userId.toString()&&(0,g.redirectOnError)(a,A,"account_already_linked_to_different_user");let b=Object.fromEntries(Object.entries({accessToken:await (0,h.setTokenUtil)(c.accessToken,a.context),refreshToken:await (0,h.setTokenUtil)(c.refreshToken,a.context),idToken:c.idToken,accessTokenExpiresAt:c.accessTokenExpiresAt,refreshTokenExpiresAt:c.refreshTokenExpiresAt,scope:c.scopes?.join(",")}).filter(([a,b])=>void 0!==b));await a.context.internalAdapter.updateAccount(d.id,b)}else await a.context.internalAdapter.createAccount({userId:w.userId,providerId:B.id,accountId:E,...c,accessToken:await (0,h.setTokenUtil)(c.accessToken,a.context),refreshToken:await (0,h.setTokenUtil)(c.refreshToken,a.context),scope:c.scopes?.join(",")})||(0,g.redirectOnError)(a,A,"unable_to_link_account");await (0,i.applyUpdateUserInfoOnLink)(a,w.userId,D);try{b=v.toString()}catch{b=v}throw a.redirect(b)}D.email||(a.context.logger.error((0,g.missingEmailLogMessage)(B.id)),(0,g.redirectOnError)(a,A,"email_not_found"));let F={providerId:B.id,accountId:E,...c,scope:c.scopes?.join(",")};try{k=await (0,i.handleOAuthUserInfo)(a,{userInfo:{...D,id:E,email:D.email,name:D.name||""},account:F,callbackURL:v,disableSignUp:B.disableImplicitSignUp&&!z||B.options?.disableSignUp,overrideUserInfo:B.options?.overrideUserInfoOnSignIn})}catch(b){throw(0,d.isAPIError)(b)&&b.body?.code&&(0,g.redirectOnError)(a,A,b.body.code,b.body.message),b}k.error&&(a.context.logger.error(k.error.split(" ").join("_")),(0,g.redirectOnError)(a,A,k.error.split(" ").join("_")));let{session:G,user:H}=k.data;await (0,e.setSessionCookie)(a,{session:G,user:H});try{m=(k.isRegister&&y||v).toString()}catch{m=k.isRegister&&y||v}throw a.redirect(m)});a.s(["callbackOAuth",0,q]),c()}catch(a){c(a)}},!1),890087,a=>a.a(async(b,c)=>{try{var d=a.i(221972),e=a.i(28675),f=a.i(596343),g=b([e,f]);function h(a){return a.replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;").replace(/&(?!amp;|lt;|gt;|quot;|#39;|#x[0-9a-fA-F]+;|#[0-9]+;)/g,"&amp;")}[e,f]=g.then?(await g)():g;let i=(0,f.createAuthEndpoint)("/error",{method:"GET",metadata:{...d.HIDE_METADATA,openapi:{description:"Displays an error page",responses:{200:{description:"Success",content:{"text/html":{schema:{type:"string",description:"The HTML content of the error page"}}}}}}}},async a=>{let b=new URL(a.request?.url||""),c=b.searchParams.get("error")||"UNKNOWN",d=b.searchParams.get("error_description")||null,f=/^[\'A-Za-z0-9_-]+$/.test(c||"")?c:"UNKNOWN",g=d?h(d):null,i=new URLSearchParams;i.set("error",f),d&&i.set("error_description",d);let j=a.context.options,k=j.onAPIError?.errorURL;return k?new Response(null,{status:302,headers:{Location:`${k}${k.includes("?")?"&":"?"}${i.toString()}`}}):e.isProduction&&!j.onAPIError?.customizeDefaultErrorPage?new Response(null,{status:302,headers:{Location:`/?${i.toString()}`}}):new Response(((a,b="Unknown",c=null)=>{let d=a.onAPIError?.customizeDefaultErrorPage;return`<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Error</title>
+    <style>
+      * {
+        box-sizing: border-box;
+      }
+      body {
+        font-family: ${d?.font?.defaultFamily||"-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif"};
+        background: ${d?.colors?.background||"var(--background)"};
+        color: var(--foreground);
+        margin: 0;
+      }
+      :root,
+      :host {
+        --spacing: 0.25rem;
+        --container-md: 28rem;
+        --text-sm: ${d?.size?.textSm||"0.875rem"};
+        --text-sm--line-height: calc(1.25 / 0.875);
+        --text-2xl: ${d?.size?.text2xl||"1.5rem"};
+        --text-2xl--line-height: calc(2 / 1.5);
+        --text-4xl: ${d?.size?.text4xl||"2.25rem"};
+        --text-4xl--line-height: calc(2.5 / 2.25);
+        --text-6xl: ${d?.size?.text6xl||"3rem"};
+        --text-6xl--line-height: 1;
+        --font-weight-medium: 500;
+        --font-weight-semibold: 600;
+        --font-weight-bold: 700;
+        --default-transition-duration: 150ms;
+        --default-transition-timing-function: cubic-bezier(0.4, 0, 0.2, 1);
+        --radius: ${d?.size?.radiusSm||"0.625rem"};
+        --default-mono-font-family: ${d?.font?.monoFamily||"var(--font-geist-mono)"};
+        --primary: ${d?.colors?.primary||"black"};
+        --primary-foreground: ${d?.colors?.primaryForeground||"white"};
+        --background: ${d?.colors?.background||"white"};
+        --foreground: ${d?.colors?.foreground||"oklch(0.271 0 0)"};
+        --border: ${d?.colors?.border||"oklch(0.89 0 0)"};
+        --destructive: ${d?.colors?.destructive||"oklch(0.55 0.15 25.723)"};
+        --muted-foreground: ${d?.colors?.mutedForeground||"oklch(0.545 0 0)"};
+        --corner-border: ${d?.colors?.cornerBorder||"#404040"};
+      }
+      button, .btn {
+        cursor: pointer;
+        background: none;
+        border: none;
+        color: inherit;
+        font: inherit;
+        transition: all var(--default-transition-duration)
+          var(--default-transition-timing-function);
+      }
+      button:hover, .btn:hover {
+        opacity: 0.8;
+      }
+      @media (prefers-color-scheme: dark) {
+        :root,
+        :host {
+          --primary: ${d?.colors?.primary||"white"};
+          --primary-foreground: ${d?.colors?.primaryForeground||"black"};
+          --background: ${d?.colors?.background||"oklch(0.15 0 0)"};
+          --foreground: ${d?.colors?.foreground||"oklch(0.98 0 0)"};
+          --border: ${d?.colors?.border||"oklch(0.27 0 0)"};
+          --destructive: ${d?.colors?.destructive||"oklch(0.65 0.15 25.723)"};
+          --muted-foreground: ${d?.colors?.mutedForeground||"oklch(0.65 0 0)"};
+          --corner-border: ${d?.colors?.cornerBorder||"#a0a0a0"};
+        }
+      }
+      @media (max-width: 640px) {
+        :root, :host {
+          --text-6xl: 2.5rem;
+          --text-2xl: 1.25rem;
+          --text-sm: 0.8125rem;
+        }
+      }
+      @media (max-width: 480px) {
+        :root, :host {
+          --text-6xl: 2rem;
+          --text-2xl: 1.125rem;
+        }
+      }
+    </style>
+  </head>
+  <body style="width: 100vw; min-height: 100vh; overflow-x: hidden; overflow-y: auto;">
+    <div
+        style="
+            display: flex;
+            flex-direction: column;
+            align-items: center;
+            justify-content: center;
+            gap: 1.5rem;
+            position: relative;
+            width: 100%;
+            min-height: 100vh;
+            padding: 1rem;
+        "
+        >
+${d?.disableBackgroundGrid?"":`
+      <div
+        style="
+          position: absolute;
+          inset: 0;
+          background-image: linear-gradient(to right, ${d?.colors?.gridColor||"var(--border)"} 1px, transparent 1px),
+            linear-gradient(to bottom, ${d?.colors?.gridColor||"var(--border)"} 1px, transparent 1px);
+          background-size: 40px 40px;
+          opacity: 0.6;
+          pointer-events: none;
+          width: 100vw;
+          height: 100vh;
+        "
+      ></div>
+      <div
+        style="
+          position: absolute;
+          inset: 0;
+          display: flex;
+          align-items: center;
+          justify-content: center;
+          background: ${d?.colors?.background||"var(--background)"};
+          mask-image: radial-gradient(ellipse at center, transparent 20%, black);
+          -webkit-mask-image: radial-gradient(ellipse at center, transparent 20%, black);
+          pointer-events: none;
+        "
+      ></div>
+`}
+<div
+  style="
+    position: relative;
+    z-index: 10;
+    border: 2px solid var(--border);
+    background: ${d?.colors?.cardBackground||"var(--background)"};
+    padding: 1.5rem;
+    max-width: 42rem;
+    width: 100%;
+  "
+>
+    ${d?.disableCornerDecorations?"":`
+        <!-- Corner decorations -->
+        <div
+          style="
+            position: absolute;
+            top: -2px;
+            left: -2px;
+            width: 2rem;
+            height: 2rem;
+            border-top: 4px solid var(--corner-border);
+            border-left: 4px solid var(--corner-border);
+          "
+        ></div>
+        <div
+          style="
+            position: absolute;
+            top: -2px;
+            right: -2px;
+            width: 2rem;
+            height: 2rem;
+            border-top: 4px solid var(--corner-border);
+            border-right: 4px solid var(--corner-border);
+          "
+        ></div>
+        <div
+          style="
+            position: absolute;
+            bottom: -2px;
+            left: -2px;
+            width: 2rem;
+            height: 2rem;
+            border-bottom: 4px solid var(--corner-border);
+            border-left: 4px solid var(--corner-border);
+          "
+        ></div>
+        <div
+          style="
+            position: absolute;
+            bottom: -2px;
+            right: -2px;
+            width: 2rem;
+            height: 2rem;
+            border-bottom: 4px solid var(--corner-border);
+            border-right: 4px solid var(--corner-border);
+          "
+        ></div>`}
+        <div style="text-align: center; margin-bottom: 1.5rem;">
+          <div style="margin-bottom: 1.5rem;">
+            <div
+              style="
+                display: inline-block;
+                border: 2px solid ${d?.disableTitleBorder?"transparent":d?.colors?.titleBorder||"var(--destructive)"};
+                padding: 0.375rem 1rem;
+              "
+            >
+              <h1
+                style="
+                  font-size: var(--text-6xl);
+                  font-weight: var(--font-weight-semibold);
+                  color: ${d?.colors?.titleColor||"var(--foreground)"};
+                  letter-spacing: -0.02em;
+                  margin: 0;
+                "
+              >
+                ERROR
+              </h1>
+            </div>
+            <div
+              style="
+                height: 2px;
+                background-color: var(--border);
+                width: calc(100% + 3rem);
+                margin-left: -1.5rem;
+                margin-top: 1.5rem;
+              "
+            ></div>
+          </div>
+          <h2
+            style="
+              font-size: var(--text-2xl);
+              font-weight: var(--font-weight-semibold);
+              color: var(--foreground);
+              margin: 0 0 1rem;
+            "
+          >
+            Something went wrong
+          </h2>
+          <div
+            style="
+                display: inline-flex;
+                align-items: center;
+                gap: 0.5rem;
+                border: 2px solid var(--border);
+                background-color: var(--muted);
+                padding: 0.375rem 0.75rem;
+                margin: 0 0 1rem;
+                flex-wrap: wrap;
+                justify-content: center;
+            "
+            >
+            <span
+                style="
+                font-size: 0.75rem;
+                color: var(--muted-foreground);
+                font-weight: var(--font-weight-semibold);
+                "
+            >
+                CODE:
+            </span>
+            <span
+                style="
+                font-size: var(--text-sm);
+                font-family: var(--default-mono-font-family, monospace);
+                color: var(--foreground);
+                word-break: break-all;
+                "
+            >
+                ${h(b)}
+            </span>
+            </div>
+          <p
+            style="
+              color: var(--muted-foreground);
+              max-width: 28rem;
+              margin: 0 auto;
+              font-size: var(--text-sm);
+              line-height: 1.5;
+              text-wrap: pretty;
+            "
+          >
+            ${!c?`We encountered an unexpected error. Please try again or return to the home page. If you're a developer, you can find <a href='https://better-auth.com/docs/reference/errors/${encodeURIComponent(b)}' target='_blank' rel="noopener noreferrer" style='color: var(--foreground); text-decoration: underline;'>more information about the error</a>.`:c}
+          </p>
+        </div>
+        <div
+          style="
+            display: flex;
+            gap: 0.75rem;
+            margin-top: 1.5rem;
+            justify-content: center;
+            flex-wrap: wrap;
+          "
+        >
+          <a
+            href="/"
+            style="
+              text-decoration: none;
+            "
+          >
+            <div
+              style="
+                border: 2px solid var(--border);
+                background: var(--primary);
+                color: var(--primary-foreground);
+                padding: 0.5rem 1rem;
+                border-radius: 0;
+                white-space: nowrap;
+              "
+              class="btn"
+            >
+              Go Home
+            </div>
+          </a>
+          <a
+            href="https://better-auth.com/docs/reference/errors/${encodeURIComponent(b)}?askai=${encodeURIComponent(`What does the error code ${b} mean?`)}"
+            target="_blank"
+            rel="noopener noreferrer"
+            style="
+              text-decoration: none;
+            "
+          >
+            <div
+              style="
+                border: 2px solid var(--border);
+                background: transparent;
+                color: var(--foreground);
+                padding: 0.5rem 1rem;
+                border-radius: 0;
+                white-space: nowrap;
+              "
+              class="btn"
+            >
+              Ask AI
+            </div>
+          </a>
+        </div>
+      </div>
+    </div>
+  </body>
+</html>`})(a.context.options,f,g),{headers:{"Content-Type":"text/html"}})});a.s(["error",0,i]),c()}catch(a){c(a)}},!1),245449,a=>a.a(async(b,c)=>{try{var d=a.i(221972),e=a.i(596343),f=b([e]);[e]=f.then?(await f)():f;let g=(0,e.createAuthEndpoint)("/ok",{method:"GET",metadata:{...d.HIDE_METADATA,openapi:{description:"Check if the API is working",responses:{200:{description:"API is working",content:{"application/json":{schema:{type:"object",properties:{ok:{type:"boolean",description:"Indicates if the API is working"}},required:["ok"]}}}}}}}},async a=>a.json({ok:!0}));a.s(["ok",0,g]),c()}catch(a){c(a)}},!1),621897,a=>a.a(async(b,c)=>{try{var d=a.i(798331),e=a.i(186673),f=a.i(750290),g=a.i(942812),h=a.i(815291),i=a.i(979282),j=a.i(596343),k=a.i(512418),l=b([d,f,g,h,i,j]);function m(a,b,c){let d=b?new URL(b,a.baseURL):new URL(`${a.baseURL}/error`);return c&&Object.entries(c).forEach(([a,b])=>d.searchParams.set(a,b)),d.href}[d,f,g,h,i,j]=l.then?(await l)():l;let n=(0,j.createAuthEndpoint)("/request-password-reset",{method:"POST",body:k.object({email:k.email().meta({description:"The email address of the user to send a password reset email to"}),redirectTo:k.string().meta({description:"The URL to redirect the user to reset their password. If the token isn't valid or expired, it'll be redirected with a query parameter `?error=INVALID_TOKEN`. If the token is valid, it'll be redirected with a query parameter `?token=VALID_TOKEN"}).optional()}),metadata:{openapi:{operationId:"requestPasswordReset",description:"Send a password reset email to the user",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{status:{type:"boolean"},message:{type:"string"}}}}}}}}},use:[(0,d.originCheck)(a=>a.body.redirectTo)]},async a=>{if(!a.context.options.emailAndPassword?.sendResetPassword)throw a.context.logger.error("Reset password isn't enabled.Please pass an emailAndPassword.sendResetPassword function in your auth config!"),h.APIError.from("BAD_REQUEST",{message:"Reset password isn't enabled",code:"RESET_PASSWORD_DISABLED"});let{email:b,redirectTo:c}=a.body,d=await a.context.internalAdapter.findUserByEmail(b,{includeAccounts:!0});if(!d)return(0,i.generateId)(24),await a.context.internalAdapter.findVerificationValue("dummy-verification-token"),a.context.logger.warn("Reset Password: User not found"),a.json({status:!0,message:"If this email exists in our system, check your email for the reset link"});let f=(0,e.getDate)(a.context.options.emailAndPassword.resetPasswordTokenExpiresIn||3600,"sec"),g=(0,i.generateId)(24);await a.context.internalAdapter.createVerificationValue({value:d.user.id,identifier:`reset-password:${g}`,expiresAt:f});let j=c?encodeURIComponent(c):"",k=`${a.context.baseURL}/reset-password/${g}?callbackURL=${j}`;return await a.context.runInBackgroundOrAwait(a.context.options.emailAndPassword.sendResetPassword({user:d.user,url:k,token:g},a.request)),a.json({status:!0,message:"If this email exists in our system, check your email for the reset link"})}),o=(0,j.createAuthEndpoint)("/reset-password/:token",{method:"GET",operationId:"resetPasswordCallback",query:k.object({callbackURL:k.string().meta({description:"The URL to redirect the user to reset their password"})}),use:[(0,d.originCheck)(a=>a.query.callbackURL)],metadata:{openapi:{operationId:"resetPasswordCallback",description:"Redirects the user to the callback URL with the token",parameters:[{name:"token",in:"path",required:!0,description:"The token to reset the password",schema:{type:"string"}},{name:"callbackURL",in:"query",required:!0,description:"The URL to redirect the user to reset their password",schema:{type:"string"}}],responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{token:{type:"string"}}}}}}}}}},async a=>{var b,c;let d,{token:e}=a.params,{callbackURL:f}=a.query;if(!e||!f)throw a.redirect(m(a.context,f,{error:"INVALID_TOKEN"}));let g=await a.context.internalAdapter.findVerificationValue(`reset-password:${e}`);if(!g||g.expiresAt<new Date)throw a.redirect(m(a.context,f,{error:"INVALID_TOKEN"}));throw a.redirect((b=a.context,c={token:e},d=new URL(f,b.baseURL),c&&Object.entries(c).forEach(([a,b])=>d.searchParams.set(a,b)),d.href))}),p=(0,j.createAuthEndpoint)("/reset-password",{method:"POST",operationId:"resetPassword",query:k.object({token:k.string().optional()}).optional(),body:k.object({newPassword:k.string().meta({description:"The new password to set"}),token:k.string().meta({description:"The token to reset the password"}).optional()}),metadata:{openapi:{operationId:"resetPassword",description:"Reset the password for a user",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{status:{type:"boolean"}}}}}}}}}},async a=>{let b=a.body.token||a.query?.token;if(!b)throw h.APIError.from("BAD_REQUEST",h.BASE_ERROR_CODES.INVALID_TOKEN);let{newPassword:c}=a.body,d=a.context.password?.config.minPasswordLength,e=a.context.password?.config.maxPasswordLength;if(c.length<d)throw h.APIError.from("BAD_REQUEST",h.BASE_ERROR_CODES.PASSWORD_TOO_SHORT);if(c.length>e)throw h.APIError.from("BAD_REQUEST",h.BASE_ERROR_CODES.PASSWORD_TOO_LONG);let f=`reset-password:${b}`,g=await a.context.internalAdapter.consumeVerificationValue(f);if(!g)throw h.APIError.from("BAD_REQUEST",h.BASE_ERROR_CODES.INVALID_TOKEN);let i=g.value,j=await a.context.password.hash(c);if((await a.context.internalAdapter.findAccounts(i)).find(a=>"credential"===a.providerId)?await a.context.internalAdapter.updatePassword(i,j):await a.context.internalAdapter.createAccount({userId:i,providerId:"credential",password:j,accountId:i}),a.context.options.emailAndPassword?.onPasswordReset){let b=await a.context.internalAdapter.findUserById(i);b&&await a.context.options.emailAndPassword.onPasswordReset({user:b},a.request)}return a.context.options.emailAndPassword?.revokeSessionsOnPasswordReset&&await a.context.internalAdapter.deleteUserSessions(i),a.json({status:!0})}),q=(0,j.createAuthEndpoint)("/verify-password",{method:"POST",body:k.object({password:k.string().meta({description:"The password to verify"})}),metadata:{scope:"server",openapi:{operationId:"verifyPassword",description:"Verify the current user's password",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{status:{type:"boolean"}}}}}}}}},use:[f.sensitiveSessionMiddleware]},async a=>{let{password:b}=a.body,c=a.context.session;if(!await (0,g.validatePassword)(a,{password:b,userId:c.user.id}))throw h.APIError.from("BAD_REQUEST",h.BASE_ERROR_CODES.INVALID_PASSWORD);return a.json({status:!0})});a.s(["requestPasswordReset",0,n,"requestPasswordResetCallback",0,o,"resetPassword",0,p,"verifyPassword",0,q]),c()}catch(a){c(a)}},!1),620976,a=>a.a(async(b,c)=>{try{var d=a.i(798331),e=a.i(704551),f=a.i(46585),g=a.i(878243),h=a.i(44541),i=a.i(804191),j=a.i(128209),k=a.i(530027),l=a.i(815291),m=a.i(227265),n=a.i(596343),o=a.i(512418),p=b([d,e,f,g,i,j,k,l,m,n]);[d,e,f,g,i,j,k,l,m,n]=p.then?(await p)():p;let q=o.object({callbackURL:o.string().meta({description:"Callback URL to redirect to after the user has signed in"}).optional(),newUserCallbackURL:o.string().optional(),errorCallbackURL:o.string().meta({description:"Callback URL to redirect to if an error happens"}).optional(),provider:m.SocialProviderListEnum,disableRedirect:o.boolean().meta({description:"Disable automatic redirection to the provider. Useful for handling the redirection yourself"}).optional(),idToken:o.optional(o.object({token:o.string().meta({description:"ID token from the provider"}),nonce:o.string().meta({description:"Nonce used to generate the token"}).optional(),accessToken:o.string().meta({description:"Access token from the provider"}).optional(),refreshToken:o.string().meta({description:"Refresh token from the provider"}).optional(),expiresAt:o.number().meta({description:"Expiry date of the token"}).optional(),user:o.object({name:o.object({firstName:o.string().optional(),lastName:o.string().optional()}).optional(),email:o.string().optional()}).meta({description:"The user object from the provider. Only available for some providers like Apple."}).optional()})),scopes:o.array(o.string()).meta({description:"Array of scopes to request from the provider. This will override the default scopes passed."}).optional(),requestSignUp:o.boolean().meta({description:"Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider"}).optional(),loginHint:o.string().meta({description:"The login hint to use for the authorization code request"}).optional(),additionalData:o.record(o.string(),o.any()).optional().meta({description:"Additional data to be passed through the OAuth flow"})});a.s(["signInEmail",0,()=>(0,n.createAuthEndpoint)("/sign-in/email",{method:"POST",operationId:"signInEmail",use:[d.formCsrfMiddleware],cloneRequest:!0,body:o.object({email:o.string().meta({description:"Email of the user"}),password:o.string().meta({description:"Password of the user"}),callbackURL:o.string().meta({description:"Callback URL to use as a redirect for email verification"}).optional(),rememberMe:o.boolean().meta({description:"If this is false, the session will not be remembered. Default is `true`."}).default(!0).optional()}),metadata:{allowedMediaTypes:["application/x-www-form-urlencoded","application/json"],$Infer:{body:{},returned:{}},openapi:{operationId:"signInEmail",description:"Sign in with email and password",responses:{200:{description:"Success - Returns either session details or redirect URL",content:{"application/json":{schema:{type:"object",description:"Session response when idToken is provided",properties:{redirect:{type:"boolean",enum:[!1]},token:{type:"string",description:"Session token"},url:{type:"string",nullable:!0},user:{type:"object",$ref:"#/components/schemas/User"}},required:["redirect","token","user"]}}}}}}}},async a=>{if(!a.context.options?.emailAndPassword?.enabled)throw a.context.logger.error("Email and password is not enabled. Make sure to enable it in the options on you `auth.ts` file. Check `https://better-auth.com/docs/authentication/email-password` for more!"),l.APIError.from("BAD_REQUEST",{code:"EMAIL_PASSWORD_DISABLED",message:"Email and password is not enabled"});let{email:b,password:c}=a.body;if(!o.email().safeParse(b).success)throw l.APIError.from("BAD_REQUEST",l.BASE_ERROR_CODES.INVALID_EMAIL);let d=await a.context.internalAdapter.findUserByEmail(b,{includeAccounts:!0});if(!d)throw await a.context.password.hash(c),a.context.logger.warn("User not found"),l.APIError.from("UNAUTHORIZED",l.BASE_ERROR_CODES.INVALID_EMAIL_OR_PASSWORD);let g=d.accounts.find(a=>"credential"===a.providerId);if(!g)throw await a.context.password.hash(c),a.context.logger.warn("Credential account not found"),l.APIError.from("UNAUTHORIZED",l.BASE_ERROR_CODES.INVALID_EMAIL_OR_PASSWORD);let h=g?.password;if(!h)throw await a.context.password.hash(c),a.context.logger.warn("Password not found"),l.APIError.from("UNAUTHORIZED",l.BASE_ERROR_CODES.INVALID_EMAIL_OR_PASSWORD);if(!await a.context.password.verify({hash:h,password:c}))throw a.context.logger.warn("Invalid password"),l.APIError.from("UNAUTHORIZED",l.BASE_ERROR_CODES.INVALID_EMAIL_OR_PASSWORD);if(a.context.options?.emailAndPassword?.requireEmailVerification&&!d.user.emailVerified){if(!a.context.options?.emailVerification?.sendVerificationEmail)throw l.APIError.from("FORBIDDEN",l.BASE_ERROR_CODES.EMAIL_NOT_VERIFIED);if(a.context.options?.emailVerification?.sendOnSignIn){let b=await (0,k.createEmailVerificationToken)(a.context.secret,d.user.email,void 0,a.context.options.emailVerification?.expiresIn),c=a.body.callbackURL?encodeURIComponent(a.body.callbackURL):encodeURIComponent("/"),e=`${a.context.baseURL}/verify-email?token=${b}&callbackURL=${c}`;await a.context.runInBackgroundOrAwait(a.context.options.emailVerification.sendVerificationEmail({user:d.user,url:e,token:b},a.request?.clone()))}throw l.APIError.from("FORBIDDEN",l.BASE_ERROR_CODES.EMAIL_NOT_VERIFIED)}let i=await a.context.internalAdapter.createSession(d.user.id,!1===a.body.rememberMe);if(!i)throw a.context.logger.error("Failed to create session"),l.APIError.from("UNAUTHORIZED",l.BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);return await (0,f.setSessionCookie)(a,{session:i,user:d.user},!1===a.body.rememberMe),a.body.callbackURL&&a.setHeader("Location",a.body.callbackURL),a.json({redirect:!!a.body.callbackURL,token:i.token,url:a.body.callbackURL,user:(0,e.parseUserOutput)(a.context.options,d.user)})}),"signInSocial",0,()=>(0,n.createAuthEndpoint)("/sign-in/social",{method:"POST",operationId:"socialSignIn",body:q,metadata:{$Infer:{body:{},returned:{}},openapi:{description:"Sign in with a social provider",operationId:"socialSignIn",responses:{200:{description:"Success - Returns session details (idToken branch) or an authorize URL (redirect branch)",content:{"application/json":{schema:{type:"object",description:"Returns session details when idToken is provided, or an authorize URL otherwise",properties:{token:{type:"string"},user:{type:"object",$ref:"#/components/schemas/User"},url:{type:"string"},redirect:{type:"boolean"}},required:["redirect"]}}}}}}}},async a=>{let b=await (0,g.getAwaitableValue)(a.context.socialProviders,{value:a.body.provider});if(!b)throw a.context.logger.error("Provider not found. Make sure to add the provider in your auth config",{provider:a.body.provider}),l.APIError.from("NOT_FOUND",l.BASE_ERROR_CODES.PROVIDER_NOT_FOUND);if(a.body.idToken){if(!b.verifyIdToken)throw a.context.logger.error("Provider does not support id token verification",{provider:a.body.provider}),l.APIError.from("NOT_FOUND",l.BASE_ERROR_CODES.ID_TOKEN_NOT_SUPPORTED);let{token:c,nonce:d}=a.body.idToken;if(!await b.verifyIdToken(c,d))throw a.context.logger.warn("Invalid id token",{provider:a.body.provider}),l.APIError.from("UNAUTHORIZED",l.BASE_ERROR_CODES.INVALID_TOKEN);let g=await b.getUserInfo({idToken:c,accessToken:a.body.idToken.accessToken,refreshToken:a.body.idToken.refreshToken,user:a.body.idToken.user});if(!g||!g?.user)throw a.context.logger.error("Failed to get user info",{provider:a.body.provider}),l.APIError.from("UNAUTHORIZED",l.BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO);if(!g.user.email)throw a.context.logger.error((0,h.missingEmailLogMessage)(a.body.provider,{source:"id_token"}),{provider:a.body.provider}),l.APIError.from("UNAUTHORIZED",l.BASE_ERROR_CODES.USER_EMAIL_NOT_FOUND);let j=await (0,i.handleOAuthUserInfo)(a,{userInfo:{...g.user,email:g.user.email,id:String(g.user.id),name:g.user.name||"",image:g.user.image,emailVerified:g.user.emailVerified||!1},account:{providerId:b.id,accountId:String(g.user.id),accessToken:a.body.idToken.accessToken},callbackURL:a.body.callbackURL,disableSignUp:b.disableImplicitSignUp&&!a.body.requestSignUp||b.disableSignUp});if(j.error)throw l.APIError.from("UNAUTHORIZED",{message:j.error,code:"OAUTH_LINK_ERROR"});return await (0,f.setSessionCookie)(a,j.data),a.json({redirect:!1,token:j.data.session.token,url:void 0,user:(0,e.parseUserOutput)(a.context.options,j.data.user)})}let{codeVerifier:c,state:d}=await (0,j.generateState)(a,void 0,a.body.additionalData),k=await b.createAuthorizationURL({state:d,codeVerifier:c,redirectURI:`${a.context.baseURL}/callback/${b.id}`,scopes:a.body.scopes,loginHint:a.body.loginHint});return a.body.disableRedirect||a.setHeader("Location",k.toString()),a.json({url:k.toString(),redirect:!a.body.disableRedirect})})]),c()}catch(a){c(a)}},!1),531460,a=>a.a(async(b,c)=>{try{var d=a.i(46585),e=a.i(596343),f=b([d,e]);[d,e]=f.then?(await f)():f;let g=(0,e.createAuthEndpoint)("/sign-out",{method:"POST",operationId:"signOut",requireHeaders:!0,metadata:{openapi:{operationId:"signOut",description:"Sign out the current user",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean"}}}}}}}}}},async a=>{let b=await a.getSignedCookie(a.context.authCookies.sessionToken.name,a.context.secret);if(b)try{await a.context.internalAdapter.deleteSession(b)}catch(b){a.context.logger.error("Failed to delete session from database",b)}return(0,d.deleteSessionCookie)(a),a.json({success:!0})});a.s(["signOut",0,g]),c()}catch(a){c(a)}},!1),311100,a=>a.a(async(b,c)=>{try{var d=a.i(417387),e=a.i(798331),f=a.i(704551),g=a.i(46585),h=a.i(530027),i=a.i(782645),j=a.i(28675),k=a.i(815291),l=a.i(979282),m=a.i(596343),n=a.i(512418),o=b([d,e,f,g,h,i,j,k,l,m]);[d,e,f,g,h,i,j,k,l,m]=o.then?(await o)():o;let p=n.object({name:n.string(),email:n.email(),password:n.string().nonempty(),image:n.string().optional(),callbackURL:n.string().optional(),rememberMe:n.boolean().optional()}).and(n.record(n.string(),n.any()));a.s(["signUpEmail",0,()=>(0,m.createAuthEndpoint)("/sign-up/email",{method:"POST",operationId:"signUpWithEmailAndPassword",use:[e.formCsrfMiddleware],body:p,cloneRequest:!0,metadata:{allowedMediaTypes:["application/x-www-form-urlencoded","application/json"],$Infer:{body:{},returned:{}},openapi:{operationId:"signUpWithEmailAndPassword",description:"Sign up a user using email and password",requestBody:{content:{"application/json":{schema:{type:"object",properties:{name:{type:"string",description:"The name of the user"},email:{type:"string",description:"The email of the user"},password:{type:"string",description:"The password of the user"},image:{type:"string",description:"The profile image URL of the user"},callbackURL:{type:"string",description:"The URL to use for email verification callback"},rememberMe:{type:"boolean",description:"If this is false, the session will not be remembered. Default is `true`."}},required:["name","email","password"]}}}},responses:{200:{description:"Successfully created user",content:{"application/json":{schema:{type:"object",properties:{token:{type:"string",nullable:!0,description:"Authentication token for the session"},user:{type:"object",properties:{id:{type:"string",description:"The unique identifier of the user"},email:{type:"string",format:"email",description:"The email address of the user"},name:{type:"string",description:"The name of the user"},image:{type:"string",format:"uri",nullable:!0,description:"The profile image URL of the user"},emailVerified:{type:"boolean",description:"Whether the email has been verified"},createdAt:{type:"string",format:"date-time",description:"When the user was created"},updatedAt:{type:"string",format:"date-time",description:"When the user was last updated"}},required:["id","email","name","emailVerified","createdAt","updatedAt"]}},required:["user"]}}}},422:{description:"Unprocessable Entity. User already exists or failed to create user.",content:{"application/json":{schema:{type:"object",properties:{message:{type:"string"}}}}}}}}}},async a=>(0,i.runWithTransaction)(a.context.adapter,async()=>{let b;if(!a.context.options.emailAndPassword?.enabled||a.context.options.emailAndPassword?.disableSignUp)throw k.APIError.from("BAD_REQUEST",{message:"Email and password sign up is not enabled",code:"EMAIL_PASSWORD_SIGN_UP_DISABLED"});let c=a.body,{name:e,email:i,password:m,image:o,callbackURL:p,rememberMe:q,...r}=c;if(!n.email().safeParse(i).success)throw k.APIError.from("BAD_REQUEST",k.BASE_ERROR_CODES.INVALID_EMAIL);if(!m||"string"!=typeof m)throw k.APIError.from("BAD_REQUEST",k.BASE_ERROR_CODES.INVALID_PASSWORD);let s=a.context.password.config.minPasswordLength;if(m.length<s)throw a.context.logger.warn("Password is too short"),k.APIError.from("BAD_REQUEST",k.BASE_ERROR_CODES.PASSWORD_TOO_SHORT);let t=a.context.password.config.maxPasswordLength;if(m.length>t)throw a.context.logger.warn("Password is too long"),k.APIError.from("BAD_REQUEST",k.BASE_ERROR_CODES.PASSWORD_TOO_LONG);let u=a.context.options.emailAndPassword.requireEmailVerification||!1===a.context.options.emailAndPassword.autoSignIn,v=!1===a.context.options.emailAndPassword.autoSignIn||u,w=(0,f.parseUserInput)(a.context.options,r,"create"),x=i.toLowerCase(),y=await a.context.internalAdapter.findUserByEmail(x);if(y?.user){if(a.context.logger.info(`Sign-up attempt for existing email: ${i}`),u){let b;await a.context.password.hash(m),a.context.options.emailAndPassword?.onExistingUserSignUp&&await a.context.runInBackgroundOrAwait(a.context.options.emailAndPassword.onExistingUserSignUp({user:y.user},a.request?.clone()));let c=new Date,d=a.context.generateId({model:"user"})||(0,l.generateId)(),g={name:e,email:x,emailVerified:!1,image:o??null,createdAt:c,updatedAt:c},h=a.context.options.emailAndPassword?.customSyntheticUser;if(h){let c=Object.keys(a.context.options.user?.additionalFields??{}),e={};for(let a of c)a in w&&(e[a]=w[a]);let i=h({coreFields:g,additionalFields:e,id:d});b=(0,f.buildSyntheticUserOutput)(a.context.options,i)}else b=(0,f.buildSyntheticUserOutput)(a.context.options,{...g,...w,id:d});return a.json({token:null,user:(0,f.parseUserOutput)(a.context.options,b)})}throw k.APIError.from("UNPROCESSABLE_ENTITY",k.BASE_ERROR_CODES.USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL)}let z=await a.context.password.hash(m);try{if(!(b=await a.context.internalAdapter.createUser({email:x,name:e,image:o,...w,emailVerified:!1})))throw k.APIError.from("BAD_REQUEST",k.BASE_ERROR_CODES.FAILED_TO_CREATE_USER)}catch(b){if((0,j.isDevelopment)()&&a.context.logger.error("Failed to create user",b),(0,d.isAPIError)(b))throw b;throw a.context.logger?.error("Failed to create user",b),k.APIError.from("UNPROCESSABLE_ENTITY",k.BASE_ERROR_CODES.FAILED_TO_CREATE_USER)}if(!b)throw k.APIError.from("UNPROCESSABLE_ENTITY",k.BASE_ERROR_CODES.FAILED_TO_CREATE_USER);if(await a.context.internalAdapter.linkAccount({userId:b.id,providerId:"credential",accountId:b.id,password:z}),a.context.options.emailVerification?.sendOnSignUp??a.context.options.emailAndPassword.requireEmailVerification){let d=await (0,h.createEmailVerificationToken)(a.context.secret,b.email,void 0,a.context.options.emailVerification?.expiresIn),e=c.callbackURL?encodeURIComponent(c.callbackURL):encodeURIComponent("/"),f=`${a.context.baseURL}/verify-email?token=${d}&callbackURL=${e}`;a.context.options.emailVerification?.sendVerificationEmail&&await a.context.runInBackgroundOrAwait(a.context.options.emailVerification.sendVerificationEmail({user:b,url:f,token:d},a.request?.clone()))}if(v)return a.json({token:null,user:(0,f.parseUserOutput)(a.context.options,b)});let A=await a.context.internalAdapter.createSession(b.id,!1===q);if(!A)throw k.APIError.from("BAD_REQUEST",k.BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);return await (0,g.setSessionCookie)(a,{session:A,user:b},!1===q),a.json({token:A.token,user:(0,f.parseUserOutput)(a.context.options,b)})}))]),c()}catch(a){c(a)}},!1),324795,a=>a.a(async(b,c)=>{try{var d=a.i(704551),e=a.i(46585),f=a.i(750290),g=a.i(815291),h=a.i(596343),i=a.i(512418),j=b([d,e,f,g,h]);[d,e,f,g,h]=j.then?(await j)():j;let k=i.record(i.string().meta({description:"Field name must be a string"}),i.any());a.s(["updateSession",0,()=>(0,h.createAuthEndpoint)("/update-session",{method:"POST",operationId:"updateSession",body:k,use:[f.sessionMiddleware],metadata:{$Infer:{body:{}},openapi:{operationId:"updateSession",description:"Update the current session",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{session:{type:"object",$ref:"#/components/schemas/Session"}}}}}}}}}},async a=>{let b=a.body;if("object"!=typeof b||Array.isArray(b))throw g.APIError.from("BAD_REQUEST",g.BASE_ERROR_CODES.BODY_MUST_BE_AN_OBJECT);let c=a.context.session,h=(0,d.parseSessionInput)(a.context.options,b,"update");if(0===Object.keys(h).length)throw g.APIError.fromStatus("BAD_REQUEST",{message:"No fields to update"});let i=await a.context.internalAdapter.updateSession(c.session.token,{...h,updatedAt:new Date});if(!i&&(0,f.isStateful)(a))throw(0,e.deleteSessionCookie)(a),g.APIError.from("UNAUTHORIZED",g.BASE_ERROR_CODES.FAILED_TO_GET_SESSION);let j=i??{...c.session,...h,updatedAt:new Date};return await (0,e.setSessionCookie)(a,{session:j,user:c.user}),a.json({session:(0,d.parseSessionOutput)(a.context.options,j)})})]),c()}catch(a){c(a)}},!1),2563,a=>a.a(async(b,c)=>{try{var d=a.i(798331),e=a.i(704551),f=a.i(597080),g=a.i(46585),h=a.i(750290),i=a.i(530027),j=a.i(815291),k=a.i(596343),l=a.i(512418),m=b([d,e,g,h,i,j,k]);[d,e,g,h,i,j,k]=m.then?(await m)():m;let n=l.record(l.string().meta({description:"Field name must be a string"}),l.any()),o=(0,k.createAuthEndpoint)("/change-password",{method:"POST",operationId:"changePassword",body:l.object({newPassword:l.string().meta({description:"The new password to set"}),currentPassword:l.string().meta({description:"The current password is required"}),revokeOtherSessions:l.boolean().meta({description:"Must be a boolean value"}).optional()}),use:[h.sensitiveSessionMiddleware],metadata:{openapi:{operationId:"changePassword",description:"Change the password of the user",responses:{200:{description:"Password successfully changed",content:{"application/json":{schema:{type:"object",properties:{token:{type:"string",nullable:!0,description:"New session token if other sessions were revoked"},user:{type:"object",properties:{id:{type:"string",description:"The unique identifier of the user"},email:{type:"string",format:"email",description:"The email address of the user"},name:{type:"string",description:"The name of the user"},image:{type:"string",format:"uri",nullable:!0,description:"The profile image URL of the user"},emailVerified:{type:"boolean",description:"Whether the email has been verified"},createdAt:{type:"string",format:"date-time",description:"When the user was created"},updatedAt:{type:"string",format:"date-time",description:"When the user was last updated"}},required:["id","email","name","emailVerified","createdAt","updatedAt"]}},required:["user"]}}}}}}}},async a=>{let{newPassword:b,currentPassword:c,revokeOtherSessions:d}=a.body,f=a.context.session,h=a.context.password.config.minPasswordLength;if(b.length<h)throw a.context.logger.warn("Password is too short"),j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.PASSWORD_TOO_SHORT);let i=a.context.password.config.maxPasswordLength;if(b.length>i)throw a.context.logger.warn("Password is too long"),j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.PASSWORD_TOO_LONG);let k=(await a.context.internalAdapter.findAccounts(f.user.id)).find(a=>"credential"===a.providerId&&a.password);if(!k||!k.password)throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.CREDENTIAL_ACCOUNT_NOT_FOUND);let l=await a.context.password.hash(b);if(!await a.context.password.verify({hash:k.password,password:c}))throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.INVALID_PASSWORD);await a.context.internalAdapter.updateAccount(k.id,{password:l});let m=null;if(d){await a.context.internalAdapter.deleteUserSessions(f.user.id);let b=await a.context.internalAdapter.createSession(f.user.id);if(!b)throw j.APIError.from("INTERNAL_SERVER_ERROR",j.BASE_ERROR_CODES.FAILED_TO_GET_SESSION);await (0,g.setSessionCookie)(a,{session:b,user:f.user}),m=b.token}return a.json({token:m,user:(0,e.parseUserOutput)(a.context.options,f.user)})}),p=k.createAuthEndpoint.serverOnly({method:"POST",body:l.object({newPassword:l.string().meta({description:"The new password to set is required"})}),use:[h.sensitiveSessionMiddleware]},async a=>{let{newPassword:b}=a.body,c=a.context.session,d=a.context.password.config.minPasswordLength;if(b.length<d)throw a.context.logger.warn("Password is too short"),j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.PASSWORD_TOO_SHORT);let e=a.context.password.config.maxPasswordLength;if(b.length>e)throw a.context.logger.warn("Password is too long"),j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.PASSWORD_TOO_LONG);let f=(await a.context.internalAdapter.findAccounts(c.user.id)).find(a=>"credential"===a.providerId&&a.password),g=await a.context.password.hash(b);if(!f)return await a.context.internalAdapter.linkAccount({userId:c.user.id,providerId:"credential",accountId:c.user.id,password:g}),a.json({status:!0});throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.PASSWORD_ALREADY_SET)}),q=(0,k.createAuthEndpoint)("/delete-user",{method:"POST",use:[h.sensitiveSessionMiddleware],body:l.object({callbackURL:l.string().meta({description:"The callback URL to redirect to after the user is deleted"}).optional(),password:l.string().meta({description:"The password of the user is required to delete the user"}).optional(),token:l.string().meta({description:"The token to delete the user is required"}).optional()}),metadata:{openapi:{operationId:"deleteUser",description:"Delete the user",requestBody:{content:{"application/json":{schema:{type:"object",properties:{callbackURL:{type:"string",description:"The callback URL to redirect to after the user is deleted"},password:{type:"string",description:"The user's password. Required if session is not fresh"},token:{type:"string",description:"The deletion verification token"}}}}}},responses:{200:{description:"User deletion processed successfully",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean",description:"Indicates if the operation was successful"},message:{type:"string",enum:["User deleted","Verification email sent"],description:"Status message of the deletion process"}},required:["success","message"]}}}}}}}},async a=>{if(!a.context.options.user?.deleteUser?.enabled)throw a.context.logger.error("Delete user is disabled. Enable it in the options"),j.APIError.fromStatus("NOT_FOUND");let b=a.context.session;if(a.body.password){let c=(await a.context.internalAdapter.findAccounts(b.user.id)).find(a=>"credential"===a.providerId&&a.password);if(!c||!c.password)throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.CREDENTIAL_ACCOUNT_NOT_FOUND);if(!await a.context.password.verify({hash:c.password,password:a.body.password}))throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.INVALID_PASSWORD)}if(a.body.token)return await r({...a,query:{token:a.body.token}}),a.json({success:!0,message:"User deleted"});if(a.context.options.user.deleteUser?.sendDeleteAccountVerification){let c=(0,f.generateRandomString)(32,"0-9","a-z");await a.context.internalAdapter.createVerificationValue({value:b.user.id,identifier:`delete-account-${c}`,expiresAt:new Date(Date.now()+1e3*(a.context.options.user.deleteUser?.deleteTokenExpiresIn||86400))});let d=`${a.context.baseURL}/delete-user/callback?token=${c}&callbackURL=${encodeURIComponent(a.body.callbackURL||"/")}`;return await a.context.runInBackgroundOrAwait(a.context.options.user.deleteUser.sendDeleteAccountVerification({user:b.user,url:d,token:c},a.request)),a.json({success:!0,message:"Verification email sent"})}if(!a.body.password&&0!==a.context.sessionConfig.freshAge){let c=new Date(b.session.createdAt).getTime(),d=1e3*a.context.sessionConfig.freshAge;if(Date.now()-c>=d)throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.SESSION_EXPIRED)}let c=a.context.options.user.deleteUser?.beforeDelete;c&&await c(b.user,a.request),await a.context.internalAdapter.deleteUser(b.user.id),await a.context.internalAdapter.deleteUserSessions(b.user.id),(0,g.deleteSessionCookie)(a);let d=a.context.options.user.deleteUser?.afterDelete;return d&&await d(b.user,a.request),a.json({success:!0,message:"User deleted"})}),r=(0,k.createAuthEndpoint)("/delete-user/callback",{method:"GET",query:l.object({token:l.string().meta({description:"The token to verify the deletion request"}),callbackURL:l.string().meta({description:"The URL to redirect to after deletion"}).optional()}),use:[(0,d.originCheck)(a=>a.query.callbackURL)],metadata:{openapi:{description:"Callback to complete user deletion with verification token",responses:{200:{description:"User successfully deleted",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean",description:"Indicates if the deletion was successful"},message:{type:"string",enum:["User deleted"],description:"Confirmation message"}},required:["success","message"]}}}}}}}},async a=>{if(!a.context.options.user?.deleteUser?.enabled)throw a.context.logger.error("Delete user is disabled. Enable it in the options"),j.APIError.from("NOT_FOUND",{message:"Not found",code:"NOT_FOUND"});let b=await (0,h.getSessionFromCtx)(a,{disableCookieCache:(0,h.isStateful)(a)});if(!b)throw j.APIError.from("NOT_FOUND",j.BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO);let c=await a.context.internalAdapter.consumeVerificationValue(`delete-account-${a.query.token}`);if(!c||c.value!==b.user.id)throw j.APIError.from("NOT_FOUND",j.BASE_ERROR_CODES.INVALID_TOKEN);let d=a.context.options.user.deleteUser?.beforeDelete;d&&await d(b.user,a.request),await a.context.internalAdapter.deleteUser(b.user.id),await a.context.internalAdapter.deleteUserSessions(b.user.id),await a.context.internalAdapter.deleteAccounts(b.user.id),(0,g.deleteSessionCookie)(a);let e=a.context.options.user.deleteUser?.afterDelete;if(e&&await e(b.user,a.request),a.query.callbackURL)throw a.redirect(a.query.callbackURL||"/");return a.json({success:!0,message:"User deleted"})}),s=(0,k.createAuthEndpoint)("/change-email",{method:"POST",body:l.object({newEmail:l.email().meta({description:"The new email address to set must be a valid email address"}),callbackURL:l.string().meta({description:"The URL to redirect to after email verification"}).optional()}),use:[h.sensitiveSessionMiddleware],metadata:{openapi:{operationId:"changeEmail",responses:{200:{description:"Email change request processed successfully",content:{"application/json":{schema:{type:"object",properties:{user:{type:"object",$ref:"#/components/schemas/User"},status:{type:"boolean",description:"Indicates if the request was successful"},message:{type:"string",enum:["Email updated","Verification email sent"],description:"Status message of the email change process",nullable:!0}},required:["status"]}}}}}}}},async a=>{if(!a.context.options.user?.changeEmail?.enabled)throw a.context.logger.error("Change email is disabled."),j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.CHANGE_EMAIL_DISABLED);let b=a.body.newEmail.toLowerCase();if(b===a.context.session.user.email)throw a.context.logger.warn("Email is the same"),j.APIError.fromStatus("BAD_REQUEST",{message:"Email is the same"});let c=!0!==a.context.session.user.emailVerified&&a.context.options.user.changeEmail.updateEmailWithoutVerification,d=a.context.options.emailVerification?.sendVerificationEmail,e=d&&a.context.session.user.emailVerified&&a.context.options.user.changeEmail.sendChangeEmailConfirmation;if(!c&&!e&&!d)throw a.context.logger.error("Verification email isn't enabled."),j.APIError.fromStatus("BAD_REQUEST",{message:"Verification email isn't enabled"});if(await a.context.internalAdapter.findUserByEmail(b))return await (0,i.createEmailVerificationToken)(a.context.secret,a.context.session.user.email,b,a.context.options.emailVerification?.expiresIn),a.context.logger.info("Change email attempt for existing email"),a.json({status:!0});if(c){if(await a.context.internalAdapter.updateUserByEmail(a.context.session.user.email,{email:b}),await (0,g.setSessionCookie)(a,{session:a.context.session.session,user:{...a.context.session.user,email:b}}),d){let c=await (0,i.createEmailVerificationToken)(a.context.secret,b,void 0,a.context.options.emailVerification?.expiresIn),e=`${a.context.baseURL}/verify-email?token=${c}&callbackURL=${encodeURIComponent(a.body.callbackURL||"/")}`;await a.context.runInBackgroundOrAwait(d({user:{...a.context.session.user,email:b},url:e,token:c},a.request))}return a.json({status:!0})}if(e){let c=await (0,i.createEmailVerificationToken)(a.context.secret,a.context.session.user.email,b,a.context.options.emailVerification?.expiresIn,{requestType:"change-email-confirmation"}),d=`${a.context.baseURL}/verify-email?token=${c}&callbackURL=${encodeURIComponent(a.body.callbackURL||"/")}`;return await a.context.runInBackgroundOrAwait(e({user:a.context.session.user,newEmail:b,url:d,token:c},a.request)),a.json({status:!0})}if(!d)throw a.context.logger.error("Verification email isn't enabled."),j.APIError.fromStatus("BAD_REQUEST",{message:"Verification email isn't enabled"});let f=await (0,i.createEmailVerificationToken)(a.context.secret,a.context.session.user.email,b,a.context.options.emailVerification?.expiresIn,{requestType:"change-email-verification"}),h=`${a.context.baseURL}/verify-email?token=${f}&callbackURL=${encodeURIComponent(a.body.callbackURL||"/")}`;return await a.context.runInBackgroundOrAwait(d({user:{...a.context.session.user,email:b},url:h,token:f},a.request)),a.json({status:!0})});a.s(["changeEmail",0,s,"changePassword",0,o,"deleteUser",0,q,"deleteUserCallback",0,r,"setPassword",0,p,"updateUser",0,()=>(0,k.createAuthEndpoint)("/update-user",{method:"POST",operationId:"updateUser",body:n,use:[h.sessionMiddleware],metadata:{$Infer:{body:{}},openapi:{operationId:"updateUser",description:"Update the current user",requestBody:{content:{"application/json":{schema:{type:"object",properties:{name:{type:"string",description:"The name of the user"},image:{type:"string",description:"The image of the user",nullable:!0}}}}}},responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{user:{type:"object",$ref:"#/components/schemas/User"}}}}}}}}}},async a=>{let b=a.body;if("object"!=typeof b||Array.isArray(b))throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.BODY_MUST_BE_AN_OBJECT);if(b.email)throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.EMAIL_CAN_NOT_BE_UPDATED);let{name:c,image:d,...f}=b,h=a.context.session,i=(0,e.parseUserInput)(a.context.options,f,"update");if(void 0===d&&void 0===c&&0===Object.keys(i).length)throw j.APIError.fromStatus("BAD_REQUEST",{message:"No fields to update"});let k=await a.context.internalAdapter.updateUser(h.user.id,{name:c,image:d,...i})??{...h.user,...void 0!==c&&{name:c},...void 0!==d&&{image:d},...i};return await (0,g.setSessionCookie)(a,{session:h.session,user:k}),a.json({status:!0})})]),c()}catch(a){c(a)}},!1),541931,a=>{"use strict";function b(a){let b=a.split("\n    at ");return b.length<=1?a:(b.splice(1,1),b.join("\n    at "))}function c(a,c){class d extends a{#o;constructor(...a){if(function(){let a=Object.getOwnPropertyDescriptor(Error,"stackTraceLimit");return void 0===a?Object.isExtensible(Error):Object.prototype.hasOwnProperty.call(a,"writable")?a.writable:void 0!==a.set}()){const b=Error.stackTraceLimit;Error.stackTraceLimit=0,super(...a),Error.stackTraceLimit=b}else super(...a);const c=Error().stack;c&&(this.#o=b(c.replace(/^Error/,this.name)))}get errorStack(){return this.#o}}return Object.defineProperty(d.prototype,"constructor",{get:()=>c,enumerable:!1,configurable:!0}),d}let d={OK:200,CREATED:201,ACCEPTED:202,NO_CONTENT:204,MULTIPLE_CHOICES:300,MOVED_PERMANENTLY:301,FOUND:302,SEE_OTHER:303,NOT_MODIFIED:304,TEMPORARY_REDIRECT:307,BAD_REQUEST:400,UNAUTHORIZED:401,PAYMENT_REQUIRED:402,FORBIDDEN:403,NOT_FOUND:404,METHOD_NOT_ALLOWED:405,NOT_ACCEPTABLE:406,PROXY_AUTHENTICATION_REQUIRED:407,REQUEST_TIMEOUT:408,CONFLICT:409,GONE:410,LENGTH_REQUIRED:411,PRECONDITION_FAILED:412,PAYLOAD_TOO_LARGE:413,URI_TOO_LONG:414,UNSUPPORTED_MEDIA_TYPE:415,RANGE_NOT_SATISFIABLE:416,EXPECTATION_FAILED:417,"I'M_A_TEAPOT":418,MISDIRECTED_REQUEST:421,UNPROCESSABLE_ENTITY:422,LOCKED:423,FAILED_DEPENDENCY:424,TOO_EARLY:425,UPGRADE_REQUIRED:426,PRECONDITION_REQUIRED:428,TOO_MANY_REQUESTS:429,REQUEST_HEADER_FIELDS_TOO_LARGE:431,UNAVAILABLE_FOR_LEGAL_REASONS:451,INTERNAL_SERVER_ERROR:500,NOT_IMPLEMENTED:501,BAD_GATEWAY:502,SERVICE_UNAVAILABLE:503,GATEWAY_TIMEOUT:504,HTTP_VERSION_NOT_SUPPORTED:505,VARIANT_ALSO_NEGOTIATES:506,INSUFFICIENT_STORAGE:507,LOOP_DETECTED:508,NOT_EXTENDED:510,NETWORK_AUTHENTICATION_REQUIRED:511};var e=class extends Error{constructor(a="INTERNAL_SERVER_ERROR",b,c={},e="number"==typeof a?a:d[a]){super(b?.message,b?.cause?{cause:b.cause}:void 0),this.status=a,this.body=b,this.headers=c,this.statusCode=e,this.name="APIError",this.status=a,this.headers=c,this.statusCode=e,this.body=b}},f=class extends e{constructor(a,b){super(400,{message:a,code:"VALIDATION_ERROR"}),this.message=a,this.issues=b,this.issues=b}},g=class extends Error{constructor(a){super(a),this.name="BetterCallError"}};let h=Symbol.for("better-call:api-error-headers"),i=c(e,Error);a.s(["APIError",0,i,"BetterCallError",0,g,"ValidationError",0,f,"hideInternalStackFrames",0,b,"kAPIErrorHeaderSymbol",0,h,"makeErrorForHideStackFrame",0,c,"statusCodes",0,d])},441099,a=>{"use strict";var b=a.i(541931);let c=/^application\/([a-z0-9.+-]*\+)?json/i;async function d(a,d){let e=a.headers.get("content-type")||"",f=e.toLowerCase();if(a.body){if(d&&d.length>0&&!d.some(a=>{let b=f.split(";")[0].trim(),c=a.toLowerCase().trim();return b===c||b.includes(c)})){if(!f)throw new b.APIError(415,{message:`Content-Type is required. Allowed types: ${d.join(", ")}`,code:"UNSUPPORTED_MEDIA_TYPE"});throw new b.APIError(415,{message:`Content-Type "${e}" is not allowed. Allowed types: ${d.join(", ")}`,code:"UNSUPPORTED_MEDIA_TYPE"})}if(c.test(f))try{return await a.json()}catch(a){if(a instanceof SyntaxError)throw new b.APIError(400,{message:"Invalid JSON in request body",code:"BAD_REQUEST"});throw a}if(f.includes("application/x-www-form-urlencoded")){let b=await a.formData(),c={};return b.forEach((a,b)=>{c[b]=a.toString()}),c}if(f.includes("multipart/form-data")){let b=await a.formData(),c={};return b.forEach((a,b)=>{c[b]=a}),c}return f.includes("text/plain")?await a.text():f.includes("application/octet-stream")?await a.arrayBuffer():f.includes("application/pdf")||f.includes("image/")||f.includes("video/")?await a.blob():f.includes("application/stream")||a.body instanceof ReadableStream?a.body:await a.text()}}async function e(a){try{return{data:await a,error:null}}catch(a){return{data:null,error:a}}}a.s(["getBody",0,d,"isAPIError",0,function(a){return a instanceof b.APIError||a?.name==="APIError"},"isRequest",0,function(a){return a instanceof Request||"[object Request]"===Object.prototype.toString.call(a)},"tryCatch",0,e,"tryDecode",0,function(a){try{return a.includes("%")?decodeURIComponent(a):a}catch{return a}}])},489888,a=>{"use strict";a.i(541931);var b=a.i(441099);let c=new Set(["host","user-agent","referer","from","expect","authorization","proxy-authorization","cookie","origin","accept-charset","accept-encoding","accept-language","if-match","if-none-match","if-modified-since","if-unmodified-since","if-range","range","max-forwards","connection","keep-alive","transfer-encoding","te","upgrade","trailer","proxy-connection","content-length"]);function d(a){for(let b of c)a.delete(b)}function e(a,b){if(b)for(let[c,d]of new Headers(b).entries())"set-cookie"===c.toLowerCase()?a.append(c,d):a.set(c,d)}a.s(["toResponse",0,function a(c,f){if(c instanceof Response){if(f?.headers){let a=new Headers(f.headers);d(a),e(c.headers,a)}return c}if(c&&"object"==typeof c&&"_flag"in c&&"json"===c._flag){let a=c.body,b=c.routerResponse;if(b instanceof Response)return b;let g=new Headers;if(e(g,b?.headers),e(g,c.headers),f?.headers){let a=new Headers(f.headers);d(a),e(g,a)}return g.set("Content-Type","application/json"),new Response(JSON.stringify(a),{...b,headers:g,status:c.status??f?.status??b?.status,statusText:f?.statusText??b?.statusText})}if((0,b.isAPIError)(c))return a(c.body,{status:f?.status??c.statusCode,statusText:c.status.toString(),headers:f?.headers||c.headers});let g=c,h=new Headers(f?.headers);if(d(h),c){if("string"==typeof c)g=c,h.set("Content-Type","text/plain");else if(c instanceof ArrayBuffer||ArrayBuffer.isView(c))g=c,h.set("Content-Type","application/octet-stream");else if(c instanceof Blob)g=c,h.set("Content-Type",c.type||"application/octet-stream");else if(c instanceof FormData)g=c;else if(c instanceof URLSearchParams)g=c,h.set("Content-Type","application/x-www-form-urlencoded");else if(c instanceof ReadableStream)g=c,h.set("Content-Type","application/octet-stream");else if(function(a){if(void 0===a)return!1;let b=typeof a;return"string"===b||"number"===b||"boolean"===b||null===b||"object"===b&&(!!Array.isArray(a)||!a.buffer&&(a.constructor&&"Object"===a.constructor.name||"function"==typeof a.toJSON))}(c)){let a,b,d;a=new WeakMap,b=new WeakMap,d=0,g=JSON.stringify(c,function(c,e){if("bigint"==typeof e)return e.toString();if("object"==typeof e&&null!==e){if(((b,c)=>{let d=c;for(;d;){if(d===b)return!0;d=a.get(d)}return!1})(e,this))return`[Circular ref-${b.get(e)}]`;a.set(e,this),b.has(e)||b.set(e,d++)}return e}),h.set("Content-Type","application/json")}}else null===c&&(g=JSON.stringify(null)),h.set("content-type","application/json");return new Response(g,{...f,headers:h})}])},616448,820025,a=>{"use strict";var b=a.i(441099),c=a.i(956980);let d={name:"HMAC",hash:"SHA-256"},e=async a=>{let b="string"==typeof a?new TextEncoder().encode(a):a;return await (0,c.getWebcryptoSubtle)().importKey("raw",b,d,!1,["sign","verify"])},f=async(a,b,e)=>{try{let f=atob(a),g=new Uint8Array(f.length);for(let a=0,b=f.length;a<b;a++)g[a]=f.charCodeAt(a);return await (0,c.getWebcryptoSubtle)().verify(d,e,g,new TextEncoder().encode(b))}catch(a){return!1}},g=async(a,b)=>{let f=await e(b);return btoa(String.fromCharCode(...new Uint8Array(await (0,c.getWebcryptoSubtle)().sign(d.name,f,new TextEncoder().encode(a)))))},h=async(a,b)=>{let c=await g(a,b);return encodeURIComponent(a=`${a}.${c}`)};a.s(["getCryptoKey",0,e,"signCookieValue",0,h,"verifySignature",0,f],820025);let i=(a,b,c={})=>{let d;if(d=c?.prefix==="secure"?`__Secure-${a}=${b}`:c?.prefix==="host"?`__Host-${a}=${b}`:`${a}=${b}`,a.startsWith("__Secure-")&&!c.secure&&(c.secure=!0),a.startsWith("__Host-")&&(c.secure||(c.secure=!0),"/"!==c.path&&(c.path="/"),c.domain&&(c.domain=void 0)),c&&"number"==typeof c.maxAge&&c.maxAge>=0){if(c.maxAge>3456e4)throw Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");d+=`; Max-Age=${Math.floor(c.maxAge)}`}if(c.domain&&"host"!==c.prefix&&(d+=`; Domain=${c.domain}`),c.path&&(d+=`; Path=${c.path}`),c.expires){if(c.expires.getTime()-Date.now()>3456e7)throw Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");d+=`; Expires=${c.expires.toUTCString()}`}return c.httpOnly&&(d+="; HttpOnly"),c.secure&&(d+="; Secure"),c.sameSite&&(d+=`; SameSite=${c.sameSite.charAt(0).toUpperCase()+c.sameSite.slice(1)}`),c.partitioned&&(c.secure||(c.secure=!0),d+="; Partitioned"),d},j=async(a,b,c,d)=>i(a,b=await h(b,c),d);a.s(["getCookieKey",0,(a,b)=>{let c=a;if(b)if("secure"===b)c="__Secure-"+a;else{if("host"!==b)return;c="__Host-"+a}return c},"parseCookies",0,function(a){if("string"!=typeof a)throw TypeError("argument str must be a string");let c=new Map,d=0;for(;d<a.length;){let e=a.indexOf("=",d);if(-1===e)break;let f=a.indexOf(";",d);if(-1===f)f=a.length;else if(f<e){d=a.lastIndexOf(";",e-1)+1;continue}let g=a.slice(d,e).trim();if(!c.has(g)){let d=a.slice(e+1,f).trim();34===d.codePointAt(0)&&(d=d.slice(1,-1)),c.set(g,(0,b.tryDecode)(d))}d=f+1}return c},"serializeCookie",0,(a,b,c)=>i(a,b=encodeURIComponent(b),c),"serializeSignedCookie",0,j],616448)},108662,893295,24862,817564,a=>{"use strict";let b;var c=a.i(541931),d=a.i(441099);async function e(a,b={}){let c={body:b.body,query:b.query};if(a.body){let d=await a.body["~standard"].validate(b.body);if(d.issues)return{data:null,error:f(d.issues,"body")};c.body=d.value}if(a.query){let d=await a.query["~standard"].validate(b.query);if(d.issues)return{data:null,error:f(d.issues,"query")};c.query=d.value}return a.requireHeaders&&!b.headers?{data:null,error:{message:"Headers is required",issues:[]}}:a.requireRequest&&!b.request?{data:null,error:{message:"Request is required",issues:[]}}:{data:c,error:null}}function f(a,b){return{message:a.map(a=>`[${a.path?.length?`${b}.`+a.path.map(a=>"object"==typeof a?a.key:a).join("."):b}] ${a.message}`).join("; "),issues:a}}var g=a.i(820025),h=a.i(616448);let i=async(a,{options:b,path:f})=>{let i,j=new Headers,{data:k,error:l}=await e(b,a);if(l)throw new c.ValidationError(l.message,l.issues);let m="headers"in a?a.headers instanceof Headers?a.headers:new Headers(a.headers):"request"in a&&(0,d.isRequest)(a.request)?a.request.headers:null,n=m?.get("cookie"),o=n?(0,h.parseCookies)(n):void 0,p={...a,body:k.body,query:k.query,path:a.path||f||"virtual:",context:"context"in a&&a.context?a.context:{},returned:void 0,headers:a?.headers,request:a?.request,params:"params"in a?a.params:void 0,method:a.method??(Array.isArray(b.method)?b.method[0]:"*"===b.method?"GET":b.method),setHeader:(a,b)=>{j.set(a,b)},getHeader:a=>m?m.get(a):null,getCookie:(a,b)=>{let c=(0,h.getCookieKey)(a,b);return c&&o?.get(c)||null},getSignedCookie:async(a,b,c)=>{let d=(0,h.getCookieKey)(a,c);if(!d)return null;let e=o?.get(d);if(!e)return null;let f=e.lastIndexOf(".");if(f<1)return null;let i=e.substring(0,f),j=e.substring(f+1);return 44===j.length&&j.endsWith("=")?!!await (0,g.verifySignature)(j,i,await (0,g.getCryptoKey)(b))&&i:null},setCookie:(a,b,c)=>{let d=(0,h.serializeCookie)(a,b,c);return j.append("set-cookie",d),d},setSignedCookie:async(a,b,c,d)=>{let e=await (0,h.serializeSignedCookie)(a,b,c,d);return j.append("set-cookie",e),e},redirect:a=>(j.set("location",a),new c.APIError("FOUND",void 0,j)),error:(a,b,d)=>new c.APIError(a,b,d),setStatus:a=>{i=a},json:(b,c)=>a.asResponse?{body:c?.body||b,routerResponse:c,_flag:"json"}:b,responseHeaders:j,get responseStatus(){return i}};for(let a of b.use||[]){let b=await a({...p,returnHeaders:!0,asResponse:!1});b.response&&Object.assign(p.context,b.response),b.headers&&b.headers.forEach((a,b)=>{p.responseHeaders.set(b,a)})}return p};a.s(["createInternalContext",0,i],108662);var j=a.i(489888);function k(a,b,e){let f="string"==typeof a?a:void 0,g="object"==typeof b?b:a,h="function"==typeof b?b:e;if(("GET"===g.method||"HEAD"===g.method)&&g.body)throw new c.BetterCallError("Body is not allowed with GET or HEAD methods");if(f&&/\/{2,}/.test(f))throw new c.BetterCallError("Path cannot contain consecutive slashes");let k=async(...a)=>{let b=a[0]||{},{data:e,error:k}=await (0,d.tryCatch)(i(b,{options:g,path:f}));if(k){if(!(k instanceof c.ValidationError))throw k;throw g.onValidationError&&await g.onValidationError({message:k.message,issues:k.issues}),new c.APIError(400,{message:k.message,code:"VALIDATION_ERROR"})}let l=await h(e).catch(async a=>{if((0,d.isAPIError)(a)){let c=g.onAPIError;if(c&&await c(a),b.asResponse)return a}throw a}),m=e.responseHeaders,n=e.responseStatus;return b.asResponse?(0,j.toResponse)(l,{headers:m,status:n}):b.returnHeaders?b.returnStatus?{headers:m,response:l,status:n}:{headers:m,response:l}:b.returnStatus?{response:l,status:n}:l};return k.options=g,k.path=f,k}k.create=a=>(b,c,d)=>k(b,{...c,use:[...c?.use||[],...a?.use||[]]},d),a.s(["createEndpoint",0,k],893295);var l=a.i(512418);let m={};function n(a){switch(a.constructor.name){case"ZodString":default:return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodObject":return"object";case"ZodArray":return"array"}}function o(a){let b=[];return a.metadata?.openapi?.parameters?b.push(...a.metadata.openapi.parameters):a.query instanceof l.ZodObject&&Object.entries(a.query.shape).forEach(([a,c])=>{c instanceof l.ZodObject&&b.push({name:a,in:"query",schema:{type:n(c),..."minLength"in c&&c.minLength?{minLength:c.minLength}:{},description:c.description}})}),b}function p(a){return{400:{content:{"application/json":{schema:{type:"object",properties:{message:{type:"string"}},required:["message"]}}},description:"Bad Request. Usually due to missing parameters, or invalid parameters."},401:{content:{"application/json":{schema:{type:"object",properties:{message:{type:"string"}},required:["message"]}}},description:"Unauthorized. Due to missing or invalid authentication."},403:{content:{"application/json":{schema:{type:"object",properties:{message:{type:"string"}}}}},description:"Forbidden. You do not have permission to access this resource or to perform this action."},404:{content:{"application/json":{schema:{type:"object",properties:{message:{type:"string"}}}}},description:"Not Found. The requested resource was not found."},429:{content:{"application/json":{schema:{type:"object",properties:{message:{type:"string"}}}}},description:"Too Many Requests. You have exceeded the rate limit. Try again later."},500:{content:{"application/json":{schema:{type:"object",properties:{message:{type:"string"}}}}},description:"Internal Server Error. This is a problem with the server that you cannot fix."},...a}}async function q(a,b){return Object.entries(a).forEach(([a,b])=>{let c=b.options;if(!(!b.path||c.metadata?.SERVER_ONLY)&&("GET"===c.method&&(m[b.path]={get:{tags:["Default",...c.metadata?.openapi?.tags||[]],description:c.metadata?.openapi?.description,operationId:c.metadata?.openapi?.operationId,security:[{bearerAuth:[]}],parameters:o(c),responses:p(c.metadata?.openapi?.responses)}}),"POST"===c.method)){let a=function(a){if(a.metadata?.openapi?.requestBody)return a.metadata.openapi.requestBody;if(a.body&&(a.body instanceof l.ZodObject||a.body instanceof l.ZodOptional)){let b=a.body.shape;if(!b)return;let c={},d=[];return Object.entries(b).forEach(([a,b])=>{b instanceof l.ZodObject&&(c[a]={type:n(b),description:b.description},b instanceof l.ZodOptional||d.push(a))}),{required:!(a.body instanceof l.ZodOptional)&&!!a.body,content:{"application/json":{schema:{type:"object",properties:c,required:d}}}}}}(c);m[b.path]={post:{tags:["Default",...c.metadata?.openapi?.tags||[]],description:c.metadata?.openapi?.description,operationId:c.metadata?.openapi?.operationId,security:[{bearerAuth:[]}],parameters:o(c),...a?{requestBody:a}:{requestBody:{content:{"application/json":{schema:{type:"object",properties:{}}}}}},responses:p(c.metadata?.openapi?.responses)}}}}),{openapi:"3.1.1",info:{title:"Better Auth",description:"API Reference for your Better Auth Instance",version:"1.1.0"},components:{schemas:{}},security:[{apiKeyCookie:[]}],servers:[{url:b?.url}],tags:[{name:"Default",description:"Default endpoints that are included with Better Auth by default. These endpoints are not part of any plugin."}],paths:m}}let r=(a,b)=>`<!doctype html>
+<html>
+  <head>
+    <title>Scalar API Reference</title>
+    <meta charset="utf-8" />
+    <meta
+      name="viewport"
+      content="width=device-width, initial-scale=1" />
+  </head>
+  <body>
+    <script
+      id="api-reference"
+      type="application/json">
+    ${JSON.stringify(a)}
+    </script>
+	 <script>
+      var configuration = {
+	  	favicon: ${b?.logo?`data:image/svg+xml;utf8,${encodeURIComponent(b.logo)}`:void 0} ,
+	   	theme: ${b?.theme||"saturn"},
+        metaData: {
+			title: ${b?.title||"Open API Reference"},
+			description: ${b?.description||"Better Call Open API"},
+		}
+      }
+      document.getElementById('api-reference').dataset.configuration =
+        JSON.stringify(configuration)
+    </script>
+	  <script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference"></script>
+  </body>
+</html>`;a.s(["generator",0,q,"getHTML",0,r],24862);let s=((b=function(){}).prototype=Object.create(null),Object.freeze(b.prototype),b);function t(){return{root:{key:""},static:new s}}function u(a){let[b,...c]=a.split("/");return""===c[c.length-1]?c.slice(0,-1):c}function v(a,b){let c=new s;for(let[d,e]of b){let b=d<0?a.slice(-(d+1)).join("/"):a[d];if("string"==typeof e)c[e]=b;else{let a=b.match(e);if(a)for(let b in a.groups)c[b]=a.groups[b]}}return c}function w(a,b="",c,d){b=b.toUpperCase(),47!==c.charCodeAt(0)&&(c=`/${c}`);let e=u(c=c.replace(/\\:/g,"%3A")),f=a.root,g=0,h=[],i=[];for(let a=0;a<e.length;a++){let b=e[a];if(b.startsWith("**")){f.wildcard||(f.wildcard={key:"**"}),f=f.wildcard,h.push([-(a+1),b.split(":")[1]||"_",2===b.length]);break}if("*"===b||b.includes(":")){if(f.param||(f.param={key:"*"}),f=f.param,"*"===b)h.push([a,`_${g++}`,!0]);else if(b.includes(":",1)){let c=function(a){let b=a.replace(/:(\w+)/g,(a,b)=>`(?<${b}>[^/]+)`).replace(/\./g,"\\.");return RegExp(`^${b}$`)}(b);i[a]=c,f.hasRegexParam=!0,h.push([a,c,!1])}else h.push([a,b.slice(1),!1]);continue}"\\*"===b?b=e[a]="*":"\\*\\*"===b&&(b=e[a]="**");let c=f.static?.[b];if(c)f=c;else{let a={key:b};f.static||(f.static=new s),f.static[b]=a,f=a}}let j=h.length>0;f.methods||(f.methods=new s),f.methods[b]??=[],f.methods[b].push({data:d||null,paramsRegexp:i,paramsMap:j?h:void 0}),j||(a.static["/"+e.join("/")]=f)}a.s(["createRouter",0,(a,b)=>{if(!b?.openapi?.disabled){let c={path:"/api/reference",...b?.openapi};a.openapi=k(c.path,{method:"GET"},async b=>new Response(r(await q(a),c.scalar),{headers:{"Content-Type":"text/html"}}))}let c=t(),e=t();for(let b of Object.values(a))if(!(!b.options||!b.path||b.options?.metadata?.SERVER_ONLY))for(let a of Array.isArray(b.options?.method)?b.options.method:[b.options?.method])w(c,a,b.path,b);if(b?.routerMiddleware?.length)for(let{path:a,middleware:c}of b.routerMiddleware)w(e,"*",a,c);let f=async a=>{let f=new URL(a.url),g=f.pathname,h=b?.basePath&&"/"!==b.basePath?g.split(b.basePath).reduce((a,c,d)=>(0!==d&&(d>1?a.push(`${b.basePath}${c}`):a.push(c)),a),[]).join(""):f.pathname;if(!h?.length||/\/{2,}/.test(h))return new Response(null,{status:404,statusText:"Not Found"});let i=function(a,b="",c){47===c.charCodeAt(c.length-1)&&(c=c.slice(0,-1));let d=a.static[c];if(d&&d.methods){let a=d.methods[b]||d.methods[""];if(void 0!==a)return a[0]}let e=u(c),f=function a(b,c,d,e,f){if(f===e.length){if(c.methods){let a=c.methods[d]||c.methods[""];if(a)return a}if(c.param&&c.param.methods){let a=c.param.methods[d]||c.param.methods[""];if(a){let b=a[0].paramsMap;if(b?.[b?.length-1]?.[2])return a}}if(c.wildcard&&c.wildcard.methods){let a=c.wildcard.methods[d]||c.wildcard.methods[""];if(a){let b=a[0].paramsMap;if(b?.[b?.length-1]?.[2])return a}}return}let g=e[f];if(c.static){let h=c.static[g];if(h){let c=a(b,h,d,e,f+1);if(c)return c}}if(c.param){let h=a(b,c.param,d,e,f+1);if(h){if(c.param.hasRegexParam){let a=h.find(a=>a.paramsRegexp[f]?.test(g))||h.find(a=>!a.paramsRegexp[f]);return a?[a]:void 0}return h}}if(c.wildcard&&c.wildcard.methods)return c.wildcard.methods[d]||c.wildcard.methods[""]}(a,a.root,b,e,0)?.[0];if(void 0!==f)return{data:f.data,params:f.paramsMap?v(e,f.paramsMap):void 0}}(c,a.method,h);if(h.endsWith("/")!==i?.data?.path?.endsWith("/")&&!b?.skipTrailingSlashes||!i?.data)return new Response(null,{status:404,statusText:"Not Found"});let k={};f.searchParams.forEach((a,b)=>{b in k?Array.isArray(k[b])?k[b].push(a):k[b]=[k[b],a]:k[b]=a});let l=i.data;try{let c=l.options.metadata?.allowedMediaTypes||b?.allowedMediaTypes,f={path:h,method:a.method,headers:a.headers,params:i.params?JSON.parse(JSON.stringify(i.params)):{},request:a,body:l.options.disableBody?void 0:await (0,d.getBody)(l.options.cloneRequest?a.clone():a,c),query:k,_flag:"router",asResponse:!0,context:b?.routerContext},g=function(a,b="",c){47===c.charCodeAt(c.length-1)&&(c=c.slice(0,-1));let d=u(c);return(function a(b,c,d,e,f,g=[]){let h=e[f];if(c.wildcard&&c.wildcard.methods){let a=c.wildcard.methods[d]||c.wildcard.methods[""];a&&g.push(...a)}if(c.param&&(a(b,c.param,d,e,f+1,g),f===e.length&&c.param.methods)){let a=c.param.methods[d]||c.param.methods[""];if(a){let b=a[0].paramsMap;b?.[b?.length-1]?.[2]&&g.push(...a)}}let i=c.static?.[h];if(i&&a(b,i,d,e,f+1,g),f===e.length&&c.methods){let a=c.methods[d]||c.methods[""];a&&g.push(...a)}return g})(a,a.root,b,d,0).map(a=>({data:a.data,params:a.paramsMap?v(d,a.paramsMap):void 0}))}(e,"*",h);if(g?.length)for(let{data:a,params:b}of g){let c=await a({...f,params:b,asResponse:!1});if(c instanceof Response)return c}return await l(f)}catch(c){if(b?.onError)try{let d=await b.onError(c,a);if(d instanceof Response)return(0,j.toResponse)(d)}catch(a){if((0,d.isAPIError)(a))return(0,j.toResponse)(a);throw a}if(b?.throwError)throw c;if((0,d.isAPIError)(c))return(0,j.toResponse)(c);return console.error("# SERVER_ERROR: ",c),new Response(null,{status:500,statusText:"Internal Server Error"})}};return{handler:async a=>{let c=await b?.onRequest?.(a);if(c instanceof Response)return c;let e=(0,d.isRequest)(c)?c:a,g=await f(e),h=await b?.onResponse?.(g,e);return h instanceof Response?h:g},endpoints:a}}],817564)},798811,a=>{"use strict";var b=a.i(541931);a.i(489888),a.i(616448);var c=a.i(108662);a.i(893295);var d=a.i(441099);function e(a,e){let f=async f=>{let g="function"==typeof a?a:e,h=await (0,c.createInternalContext)(f,{options:"function"==typeof a?{}:a,path:"/"});if(!g)throw Error("handler must be defined");try{let a=await g(h),b=h.responseHeaders;return f.returnHeaders?{headers:b,response:a}:a}catch(a){throw(0,d.isAPIError)(a)&&Object.defineProperty(a,b.kAPIErrorHeaderSymbol,{enumerable:!1,configurable:!0,get:()=>h.responseHeaders}),a}};return f.options="function"==typeof a?{}:a,f}e.create=a=>function(b,c){if("function"==typeof b)return e({use:a?.use},b);if(!c)throw Error("Middleware handler is required");return e({...b,method:"*",use:[...a?.use||[],...b.use||[]]},c)},a.i(24862),a.i(817564),a.s([],798811)},641050,a=>a.a(async(b,c)=>{try{var d=a.i(417387),e=a.i(592474),f=a.i(782645),g=a.i(28675),h=a.i(815291),i=a.i(583025),j=a.i(596657);a.i(798811);var k=a.i(541931),l=a.i(489888),m=b([d,e,f,g,h,j]);[d,e,f,g,h,j]=m.then?(await m)():m;let t=(0,i.createDefu)((a,b,c)=>{if(Array.isArray(a[b])&&Array.isArray(c))return a[b]=c,!0}),u=new WeakMap;function n(a,b){let c=a.options;return c?.operationId??c?.metadata?.openapi?.operationId??b??a.path??"/:virtual"}function o(a,b){b&&b.forEach((b,c)=>{a.responseHeaders?"set-cookie"===c.toLowerCase()?a.responseHeaders.append(c,b):a.responseHeaders.set(c,b):a.responseHeaders=new Headers({[c]:b})})}function p(a){let b=a[k.kAPIErrorHeaderSymbol],c=a.headers&&a.headers!==b?new Headers(a.headers):null;if(!b&&!c)return null;let d=new Headers;return b?.forEach((a,b)=>{d.append(b,a)}),c?.forEach((a,b)=>{"set-cookie"===b.toLowerCase()?d.append(b,a):d.set(b,a)}),d}async function q(a,b,c,e){let f={};for(let i of b){let b=!1;try{b=i.matcher(a)}catch(c){let b=u.get(i.handler)??"unknown";throw a.context.logger.error(`An error occurred during ${b} hook matcher execution:`,c),new h.APIError("INTERNAL_SERVER_ERROR",{message:"An error occurred during hook matcher execution. Check the logs for more details."})}if(!b)continue;let k=u.get(i.handler)??"unknown",l=c.path??"/:virtual",m=await (0,j.withSpan)(`hook before ${l} ${k}`,{[j.ATTR_HOOK_TYPE]:"before",[j.ATTR_HTTP_ROUTE]:l,[j.ATTR_CONTEXT]:k,[j.ATTR_OPERATION_ID]:e},()=>i.handler({...a,returnHeaders:!0})).catch(b=>{throw(0,d.isAPIError)(b)&&(0,g.shouldPublishLog)(a.context.logger.level,"debug")&&(b.stack=b.errorStack),b});o(a.context,m?.headers);let n=m?.response;if(n&&"object"==typeof n){if("context"in n&&"object"==typeof n.context){let{headers:a,...b}=n.context;a instanceof Headers&&(f.headers?a.forEach((a,b)=>{f.headers?.set(b,a)}):f.headers=a),f=t(b,f);continue}return n}}return{context:f}}async function r(a,b,c,e){for(let f of b){if(!f.matcher(a))continue;let b=u.get(f.handler)??"unknown",h=c.path??"/:virtual",i=await (0,j.withSpan)(`hook after ${h} ${b}`,{[j.ATTR_HOOK_TYPE]:"after",[j.ATTR_HTTP_ROUTE]:h,[j.ATTR_CONTEXT]:b,[j.ATTR_OPERATION_ID]:e},()=>f.handler(a)).catch(b=>{if((0,d.isAPIError)(b))return(0,g.shouldPublishLog)(a.context.logger.level,"debug")&&(b.stack=b.errorStack),{response:b,headers:p(b)};throw b});o(a.context,i.headers),void 0!==i.response&&(a.context.returned=i.response)}return{response:a.context.returned,headers:a.context.responseHeaders}}async function s(a,b){let c=b.operationId??n(a),h=a.path??"/:virtual",i=a.options?.method,m=Array.isArray(i)?i[0]:i,o=b.method??b.request?.method??m??"?",s=b.asResponse??(0,e.isRequestLike)(b.request),v={...b,context:{...b.context,returned:void 0,responseHeaders:void 0,session:b.context.session??null},path:a.path,headers:b.headers?new Headers(b.headers):void 0};return(0,j.withSpan)(`${o} ${h}`,{[j.ATTR_HTTP_ROUTE]:h,[j.ATTR_OPERATION_ID]:c},async()=>(0,f.runWithEndpointContext)(v,async()=>{var e;let i,m,n,o,w,x,y,{beforeHooks:z,afterHooks:A}=(i=(e=v.context).options.plugins||[],m=[],n=[],(o=e.options.hooks?.before)&&(u.set(o,"user"),m.push({matcher:()=>!0,handler:o})),(w=e.options.hooks?.after)&&(u.set(w,"user"),n.push({matcher:()=>!0,handler:w})),x=i.flatMap(a=>(a.hooks?.before??[]).map(b=>(u.set(b.handler,`plugin:${a.id}`),b))),y=i.flatMap(a=>(a.hooks?.after??[]).map(b=>(u.set(b.handler,`plugin:${a.id}`),b))),x.length&&m.push(...x),y.length&&n.push(...y),{beforeHooks:m,afterHooks:n}),B=await q(v,z,a,c);if("context"in B&&B.context&&"object"==typeof B.context){let{headers:a,...b}=B.context;if(a){v.headers||(v.headers=new Headers);let b=v.headers;a.forEach((a,c)=>{b.set(c,a)})}v=t(b,v)}else if(B){let a=v.context.responseHeaders;return s?(0,l.toResponse)(B,{headers:a}):b.returnHeaders?{headers:a,response:B}:B}v.asResponse=!1,v.returnHeaders=!0,v.returnStatus=!0;let C=await (0,f.runWithEndpointContext)(v,()=>(0,j.withSpan)(`handler ${h}`,{[j.ATTR_HTTP_ROUTE]:h,[j.ATTR_OPERATION_ID]:c},()=>a(v))).catch(a=>{if((0,d.isAPIError)(a))return{response:a,status:a.statusCode,headers:p(a)};throw a});if(C instanceof Response)return C;v.context.returned=C.response,v.context.responseHeaders=C.headers??void 0;let D=await r(v,A,a,c);if(void 0!==D.response&&(C.response=D.response),C.headers=D.headers??C.headers,(0,d.isAPIError)(C.response)&&(0,g.shouldPublishLog)(v.context.logger.level,"debug")&&(C.response.stack=C.response.errorStack),(0,d.isAPIError)(C.response)&&!s)throw C.headers&&Object.defineProperty(C.response,k.kAPIErrorHeaderSymbol,{enumerable:!1,configurable:!0,writable:!1,value:C.headers}),C.response;return s?(0,l.toResponse)(C.response,{headers:C.headers??void 0,status:C.status}):b.returnHeaders?b.returnStatus?{headers:C.headers,response:C.response,status:C.status}:{headers:C.headers,response:C.response}:b.returnStatus?{response:C.response,status:C.status}:C.response}))}a.s(["dispatchAuthEndpoint",0,s,"getOperationId",0,n]),c()}catch(a){c(a)}},!1),849950,a=>a.a(async(b,c)=>{try{var d=a.i(592474),e=a.i(878243),f=a.i(641050),g=a.i(782645),h=a.i(815291),i=b([d,e,f,g,h]);async function j(a,b){if(a.baseURL)return a;let c=(0,e.pickSource)(b),f=a.options.baseURL,g=(0,d.isDynamicBaseURLConfig)(f)&&!!f.fallback;if(void 0===c&&!g)throw new h.APIError("INTERNAL_SERVER_ERROR",{message:"Dynamic baseURL could not be resolved for this direct auth.api call. Pass `headers: request.headers` (or `request`) to the call, or add `fallback` to your baseURL config."});try{return await (0,e.resolveRequestContext)(a,c,(0,e.resolveDynamicTrustedProxyHeaders)(a.options))}catch(a){if(a instanceof h.BetterAuthError)throw new h.APIError("INTERNAL_SERVER_ERROR",{message:a.message});throw a}}[d,e,f,g,h]=i.then?(await i)():i,a.s(["toAuthEndpoints",0,function(a,b){let c={};for(let[e,h]of Object.entries(a))c[e]=async a=>{let c=(0,f.getOperationId)(h,e),i=async()=>{let e=await b,g=(0,d.isDynamicBaseURLConfig)(e.options.baseURL)?await j(e,a):e;return(0,f.dispatchAuthEndpoint)(h,{...a,context:g,operationId:c,asResponse:a?.asResponse??(0,d.isRequestLike)(a?.request)})};return await (0,g.hasRequestState)()?i():(0,g.runWithRequestState)(new WeakMap,i)},c[e].path=h.path,c[e].options=h.options;return c}]),c()}catch(a){c(a)}},!1),165245,a=>a.a(async(b,c)=>{try{var d=a.i(417387),e=a.i(318083),f=a.i(798331),g=a.i(531093),h=a.i(797070),i=a.i(450259),j=a.i(515578),k=a.i(750290),l=a.i(184062),m=a.i(799963),n=a.i(530027),o=a.i(890087),p=a.i(245449),q=a.i(621897),r=a.i(620976),s=a.i(531460),t=a.i(311100),u=a.i(324795),v=a.i(2563),w=a.i(641050),x=a.i(849950),y=a.i(28675),z=a.i(815291),A=a.i(596657),B=a.i(202987);a.i(798811);var C=a.i(817564),D=a.i(596343),E=b([d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z,A,B,D]);function F(a,b){let c=b.plugins?.reduce((a,b)=>({...a,...b.endpoints}),{})??{},d=b.plugins?.map(b=>b.middlewares?.map(c=>{let d=async d=>{let e=await a;return(0,A.withSpan)(`middleware ${c.path} ${b.id}`,{[A.ATTR_HOOK_TYPE]:"middleware",[A.ATTR_HTTP_ROUTE]:c.path,[A.ATTR_CONTEXT]:`plugin:${b.id}`},()=>c.middleware({...d,context:{...e,...d.context}}))};return d.options=c.middleware.options,{path:c.path,middleware:d}})).filter(a=>void 0!==a).flat()||[];return{api:(0,x.toAuthEndpoints)({signInSocial:(0,r.signInSocial)(),callbackOAuth:m.callbackOAuth,getSession:(0,k.getSession)(),signOut:s.signOut,signUpEmail:(0,t.signUpEmail)(),signInEmail:(0,r.signInEmail)(),resetPassword:q.resetPassword,verifyPassword:q.verifyPassword,verifyEmail:n.verifyEmail,sendVerificationEmail:n.sendVerificationEmail,changeEmail:v.changeEmail,changePassword:v.changePassword,setPassword:v.setPassword,updateSession:(0,u.updateSession)(),updateUser:(0,v.updateUser)(),deleteUser:v.deleteUser,requestPasswordReset:q.requestPasswordReset,requestPasswordResetCallback:q.requestPasswordResetCallback,listSessions:(0,k.listSessions)(),revokeSession:k.revokeSession,revokeSessions:k.revokeSessions,revokeOtherSessions:k.revokeOtherSessions,linkSocialAccount:l.linkSocialAccount,listUserAccounts:l.listUserAccounts,deleteUserCallback:v.deleteUserCallback,unlinkAccount:l.unlinkAccount,refreshToken:l.refreshToken,getAccessToken:l.getAccessToken,accountInfo:l.accountInfo,...c,ok:p.ok,error:o.error},a),middlewares:d}}[d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z,A,B,D]=E.then?(await E)():E,a.s(["checkEndpointConflicts",0,function(a,b){let c=new Map;a.plugins?.forEach(a=>{if(a.endpoints){for(let[b,d]of Object.entries(a.endpoints))if(d&&"path"in d&&"string"==typeof d.path){let e=d.path,f=[];d.options&&"method"in d.options&&(Array.isArray(d.options.method)?f=d.options.method:"string"==typeof d.options.method&&(f=[d.options.method])),0===f.length&&(f=["*"]),c.has(e)||c.set(e,[]),c.get(e).push({pluginId:a.id,endpointKey:b,methods:f})}}});let d=[];for(let[a,b]of c.entries())if(b.length>1){let c=new Map,e=!1;for(let a of b)for(let d of a.methods)c.has(d)||c.set(d,[]),c.get(d).push(a.pluginId),c.get(d).length>1&&(e=!0),"*"===d&&b.length>1?e=!0:"*"!==d&&c.has("*")&&(e=!0);if(e){let e=[...new Set(b.map(a=>a.pluginId))],f=[];for(let[a,d]of c.entries())(d.length>1||"*"===a&&b.length>1||"*"!==a&&c.has("*"))&&f.push(a);d.push({path:a,plugins:e,conflictingMethods:f})}}if(d.length>0){let a=d.map(a=>`  - "${a.path}" [${a.conflictingMethods.join(", ")}] used by plugins: ${a.plugins.join(", ")}`).join("\n");b.error(`Endpoint path conflicts detected! Multiple plugins are trying to use the same endpoint paths with conflicting HTTP methods:
+${a}
+To resolve this, you can:
+	1. Use only one of the conflicting plugins
+	2. Configure the plugins to use different paths (if supported)
+	3. Ensure plugins use different HTTP methods for the same path
+`)}},"getEndpoints",0,F,"router",0,(a,b)=>{let{api:c,middlewares:e}=F(a,b),g=new URL(a.baseURL).pathname;return(0,C.createRouter)(c,{routerContext:a,openapi:{disabled:!0},basePath:g,routerMiddleware:[{path:"/**",middleware:f.originCheckMiddleware},...e],allowedMediaTypes:["application/json"],skipTrailingSlashes:b.advanced?.skipTrailingSlashes??!1,async onRequest(b){let c=a.options.disabledPaths||[],d=(0,B.normalizePathname)(b.url,g);if(c.includes(d))return new Response("Not Found",{status:404});let e=b;for(let b of a.options.plugins||[])if(b.onRequest){let c=await (0,A.withSpan)(`onRequest ${b.id}`,{[A.ATTR_HOOK_TYPE]:"onRequest",[A.ATTR_CONTEXT]:`plugin:${b.id}`},()=>b.onRequest(e,a));if(c&&"response"in c)return c.response;c&&"request"in c&&(e=c.request)}let f=await (0,h.onRequestRateLimit)(e,a);return f||e},async onResponse(b,c){for(let c of a.options.plugins||[])if(c.onResponse){let d=await (0,A.withSpan)(`onResponse ${c.id}`,{[A.ATTR_HOOK_TYPE]:"onResponse",[A.ATTR_CONTEXT]:`plugin:${c.id}`,[A.ATTR_HTTP_RESPONSE_STATUS_CODE]:b.status},()=>c.onResponse(b,a));if(d)return d.response}return b},onError(c){if((0,d.isAPIError)(c)&&"FOUND"===c.status)return;if(b.onAPIError?.throw)throw c;if(b.onAPIError?.onError)return void b.onAPIError.onError(c,a);let e=b.logger?.level,f="error"===e||"warn"===e||"debug"===e?y.logger:void 0;if(b.logger?.disabled!==!0){if(c&&"object"==typeof c&&"message"in c&&"string"==typeof c.message&&(c.message.includes("no column")||c.message.includes("column")||c.message.includes("relation")||c.message.includes("table")||c.message.includes("does not exist")))return void a.logger?.error(c.message);(0,d.isAPIError)(c)?("INTERNAL_SERVER_ERROR"===c.status&&a.logger.error(c.status,c),f?.error(c.message)):a.logger?.error(c&&"object"==typeof c&&"name"in c?c.name:"",c)}}})}]),c()}catch(a){c(a)}},!1),328371,a=>{"use strict";a.s(["DEFAULT_SECRET",0,"better-auth-secret-12345678901234567890"])},220447,a=>a.a(async(b,c)=>{try{var d=a.i(815291),e=b([d]);[d]=e.then?(await e)():e,a.s(["buildSecretConfig",0,function(a,b){let c=new Map;for(let b of a)c.set(parseInt(String(b.version),10),b.value);return{keys:c,currentVersion:parseInt(String(a[0].version),10),legacySecret:b&&"better-auth-secret-12345678901234567890"!==b?b:void 0}},"parseSecretsEnv",0,function(a){return a?a.split(",").map(a=>{let b=(a=a.trim()).indexOf(":");if(-1===b)throw new d.BetterAuthError(`Invalid BETTER_AUTH_SECRETS entry: "${a}". Expected format: "<version>:<secret>"`);let c=parseInt(a.slice(0,b),10);if(!Number.isInteger(c)||c<0)throw new d.BetterAuthError(`Invalid version in BETTER_AUTH_SECRETS: "${a.slice(0,b)}". Version must be a non-negative integer.`);let e=a.slice(b+1).trim();if(!e)throw new d.BetterAuthError(`Empty secret value for version ${c} in BETTER_AUTH_SECRETS.`);return{version:c,value:e}}):null},"validateSecretsArray",0,function(a,b){var c;let e;if(0===a.length)throw new d.BetterAuthError("`secrets` array must contain at least one entry.");let f=new Set;for(let b of a){let a=parseInt(String(b.version),10);if(!Number.isInteger(a)||a<0||String(a)!==String(b.version).trim())throw new d.BetterAuthError(`Invalid version ${b.version} in \`secrets\`. Version must be a non-negative integer.`);if(!b.value)throw new d.BetterAuthError(`Empty secret value for version ${a} in \`secrets\`.`);if(f.has(a))throw new d.BetterAuthError(`Duplicate version ${a} in \`secrets\`. Each version must be unique.`);f.add(a)}let g=a[0];g.value.length<32&&b.warn(`[better-auth] Warning: the current secret (version ${g.version}) should be at least 32 characters long for adequate security.`),120>(c=g.value,e=new Set(c).size,0===e?0:Math.log2(Math.pow(e,c.length)))&&b.warn("[better-auth] Warning: the current secret appears low-entropy. Use a randomly generated secret for production.")}]),c()}catch(a){c(a)}},!1),307606,a=>{"use strict";var b=Object.defineProperty,c=Object.defineProperties,d=Object.getOwnPropertyDescriptors,e=Object.getOwnPropertySymbols,f=Object.prototype.hasOwnProperty,g=Object.prototype.propertyIsEnumerable,h=(a,c,d)=>c in a?b(a,c,{enumerable:!0,configurable:!0,writable:!0,value:d}):a[c]=d,i=(a,b)=>{for(var c in b||(b={}))f.call(b,c)&&h(a,c,b[c]);if(e)for(var c of e(b))g.call(b,c)&&h(a,c,b[c]);return a},j=(a,b)=>c(a,d(b)),k=class extends Error{constructor(a,b,c){super(b||a.toString(),{cause:c}),this.status=a,this.statusText=b,this.error=c,Error.captureStackTrace(this,this.constructor)}},l=async(a,b)=>{var c,d,e,f,g,h;let i=b||{},j={onRequest:[null==b?void 0:b.onRequest],onResponse:[null==b?void 0:b.onResponse],onSuccess:[null==b?void 0:b.onSuccess],onError:[null==b?void 0:b.onError],onRetry:[null==b?void 0:b.onRetry]};if(!b||!(null==b?void 0:b.plugins))return{url:a,options:i,hooks:j};for(let k of(null==b?void 0:b.plugins)||[]){if(k.init){let d=await (null==(c=k.init)?void 0:c.call(k,a.toString(),b));i=d.options||i,a=d.url}j.onRequest.push(null==(d=k.hooks)?void 0:d.onRequest),j.onResponse.push(null==(e=k.hooks)?void 0:e.onResponse),j.onSuccess.push(null==(f=k.hooks)?void 0:f.onSuccess),j.onError.push(null==(g=k.hooks)?void 0:g.onError),j.onRetry.push(null==(h=k.hooks)?void 0:h.onRetry)}return{url:a,options:i,hooks:j}},m=class{constructor(a){this.options=a}shouldAttemptRetry(a,b){return this.options.shouldRetry?Promise.resolve(a<this.options.attempts&&this.options.shouldRetry(b)):Promise.resolve(a<this.options.attempts)}getDelay(){return this.options.delay}},n=class{constructor(a){this.options=a}shouldAttemptRetry(a,b){return this.options.shouldRetry?Promise.resolve(a<this.options.attempts&&this.options.shouldRetry(b)):Promise.resolve(a<this.options.attempts)}getDelay(a){return Math.min(this.options.maxDelay,this.options.baseDelay*2**a)}},o=async a=>{let b={},c=async a=>"function"==typeof a?await a():a;if(null==a?void 0:a.auth){if("Bearer"===a.auth.type){let d=await c(a.auth.token);if(!d)return b;b.authorization=`Bearer ${d}`}else if("Basic"===a.auth.type){let[d,e]=await Promise.all([c(a.auth.username),c(a.auth.password)]);if(!d||!e)return b;b.authorization=`Basic ${btoa(`${d}:${e}`)}`}else if("Custom"===a.auth.type){let[d,e]=await Promise.all([c(a.auth.prefix),c(a.auth.value)]);if(!e)return b;b.authorization=`${null!=d?d:""} ${e}`}}return b},p=/^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;function q(a){if(void 0===a)return!1;let b=typeof a;return"string"===b||"number"===b||"boolean"===b||null===b||"object"===b&&(!!Array.isArray(a)||!a.buffer&&(a.constructor&&"Object"===a.constructor.name||"function"==typeof a.toJSON))}function r(a){try{return JSON.parse(a)}catch(b){return a}}async function s(a){let b=new Headers(function(...a){let b={};for(let c of a)if(c)if(c instanceof Headers)c.forEach((a,c)=>{b[c]=a});else for(let[a,d]of Array.isArray(c)?c:Object.entries(c))null!=d&&(b[a]=d);return b}(null==a?void 0:a.headers,await o(a)));if(!b.has("content-type")){let c=q(null==a?void 0:a.body)?"application/json":null;c&&b.set("content-type",c)}return b}var t=class a extends Error{constructor(b,c){super(c||JSON.stringify(b,null,2)),this.issues=b,Object.setPrototypeOf(this,a.prototype)}};async function u(a,b){let c=await a["~standard"].validate(b);if(c.issues)throw new t(c.issues);return c.value}var v=["get","post","put","patch","delete"],w=async(a,b)=>{var c,d,e,f,g,h,o,t;let x,{hooks:y,url:z,options:A}=await l(a,b),B=function(a){if(null==a?void 0:a.customFetchImpl)return a.customFetchImpl;if("u">typeof globalThis&&"function"==typeof globalThis.fetch)return globalThis.fetch;throw Error("No fetch implementation found")}(A),C=new AbortController,D=null!=(c=A.signal)?c:C.signal,E=function(a,b){let{baseURL:c,params:d,query:e}=b||{query:{},params:{},baseURL:""},f=a.startsWith("http")?a.split("/").slice(0,3).join("/"):c||"";if(a.startsWith("@")){let b=a.toString().split("@")[1].split("/")[0];v.includes(b)&&(a=a.replace(`@${b}/`,"/"))}f.endsWith("/")||(f+="/");let[g,h]=a.replace(f,"").split("?"),i=new URLSearchParams(h);for(let[a,b]of Object.entries(e||{})){let c;if(null!=b){if("string"==typeof b)c=b;else if(Array.isArray(b)){for(let c of b)i.append(a,c);continue}else c=JSON.stringify(b);i.set(a,c)}}if(d)if(Array.isArray(d))for(let[a,b]of g.split("/").filter(a=>a.startsWith(":")).entries()){let c=d[a];g=g.replace(b,c)}else for(let[a,b]of Object.entries(d))g=g.replace(`:${a}`,String(b));(g=g.split("/").map(encodeURIComponent).join("/")).startsWith("/")&&(g=g.slice(1));let j=i.toString();return(j=j.length>0?`?${j}`.replace(/\+/g,"%20"):"",f.startsWith("http"))?new URL(`${g}${j}`,f):`${f}${g}${j}`}(z,A),F=await s(A),G=function(a,b){let c,{body:d}=a;return d?q(d)&&"string"!=typeof d?"application/x-www-form-urlencoded"===((c=b.get("content-type"))?c.split(";")[0].trim().toLowerCase():null)?new URLSearchParams(d).toString():JSON.stringify(d):d:null}(A,F),H=function(a,b){var c;if(null==b?void 0:b.method)return b.method.toUpperCase();if(a.startsWith("@")){let d=null==(c=a.split("@")[1])?void 0:c.split("/")[0];return v.includes(d)?d.toUpperCase():(null==b?void 0:b.body)?"POST":"GET"}return(null==b?void 0:b.body)?"POST":"GET"}(z,A),I=j(i({},A),{url:E,headers:F,body:G,method:H,signal:D});for(let a of y.onRequest)if(a){let b=await a(I);"object"==typeof b&&null!==b&&Object.assign(I,b)}("pipeTo"in I&&"function"==typeof I.pipeTo||"function"==typeof(null==(d=null==b?void 0:b.body)?void 0:d.pipe))&&!("duplex"in I)&&(I.duplex="half");let{clearTimeout:J}=(!(null==A?void 0:A.signal)&&(null==A?void 0:A.timeout)&&(x=setTimeout(()=>null==C?void 0:C.abort(),null==A?void 0:A.timeout)),{abortTimeout:x,clearTimeout:()=>{x&&clearTimeout(x)}}),K=await B(I.url,I);J();let L={response:K,request:I};for(let a of y.onResponse)if(a){let c=await a(j(i({},L),{response:(null==(e=null==b?void 0:b.hookOptions)?void 0:e.cloneResponse)?K.clone():K}));c instanceof Response?K=c:"object"==typeof c&&null!==c&&(K=c.response)}if(K.ok){if("HEAD"===I.method)return{data:"",error:null};let a=function(a){let b=a.headers.get("content-type"),c=new Set(["image/svg","application/xml","application/xhtml","application/html"]);if(!b)return"json";let d=b.split(";").shift()||"";return p.test(d)?"json":c.has(d)||d.startsWith("text/")?"text":"blob"}(K),c={data:null,response:K,request:I};if("json"===a||"text"===a){let a=await K.text(),b=null!=(f=I.jsonParser)?f:r;c.data=await b(a)}else c.data=await K[a]();for(let a of((null==I?void 0:I.output)&&I.output&&!I.disableValidation&&(c.data=await u(I.output,c.data)),y.onSuccess))a&&await a(j(i({},c),{response:(null==(g=null==b?void 0:b.hookOptions)?void 0:g.cloneResponse)?K.clone():K}));return(null==b?void 0:b.throw)?c.data:{data:c.data,error:null}}let M=null!=(h=null==b?void 0:b.jsonParser)?h:r,N=await K.text(),O=function(a){try{return JSON.parse(a),!0}catch(a){return!1}}(N),P=O?await M(N):null,Q={response:K,responseText:N,request:I,error:j(i({},P),{status:K.status,statusText:K.statusText})};for(let a of y.onError)a&&await a(j(i({},Q),{response:(null==(o=null==b?void 0:b.hookOptions)?void 0:o.cloneResponse)?K.clone():K}));if(null==b?void 0:b.retry){let c=function(a){if("number"==typeof a)return new m({type:"linear",attempts:a,delay:1e3});switch(a.type){case"linear":return new m(a);case"exponential":return new n(a);default:throw Error("Invalid retry strategy")}}(b.retry),d=null!=(t=b.retryAttempt)?t:0;if(await c.shouldAttemptRetry(d,K)){for(let a of y.onRetry)a&&await a(L);let e=c.getDelay(d);return await new Promise(a=>setTimeout(a,e)),await w(a,j(i({},b),{retryAttempt:d+1}))}}if(null==b?void 0:b.throw)throw new k(K.status,K.statusText,O?P:N);return{data:null,error:j(i({},P),{status:K.status,statusText:K.statusText})}};a.s(["betterFetch",0,w])},961938,a=>a.a(async(b,c)=>{try{let D,E,F;var d=a.i(902157),e=a.i(912714),f=a.i(660526),g=a.i(750227),h=a.i(28675),i=a.i(307606),j=a.i(711159),k=a.i(531429),l=a.i(117649),m=b([h]);async function n(a,b){return{database:b?.database,adapter:b?.adapter,emailVerification:{sendVerificationEmail:!!a.emailVerification?.sendVerificationEmail,sendOnSignUp:!!a.emailVerification?.sendOnSignUp,sendOnSignIn:!!a.emailVerification?.sendOnSignIn,autoSignInAfterVerification:!!a.emailVerification?.autoSignInAfterVerification,expiresIn:a.emailVerification?.expiresIn,beforeEmailVerification:!!a.emailVerification?.beforeEmailVerification,afterEmailVerification:!!a.emailVerification?.afterEmailVerification},emailAndPassword:{enabled:!!a.emailAndPassword?.enabled,disableSignUp:!!a.emailAndPassword?.disableSignUp,requireEmailVerification:!!a.emailAndPassword?.requireEmailVerification,maxPasswordLength:a.emailAndPassword?.maxPasswordLength,minPasswordLength:a.emailAndPassword?.minPasswordLength,sendResetPassword:!!a.emailAndPassword?.sendResetPassword,resetPasswordTokenExpiresIn:a.emailAndPassword?.resetPasswordTokenExpiresIn,onPasswordReset:!!a.emailAndPassword?.onPasswordReset,password:{hash:!!a.emailAndPassword?.password?.hash,verify:!!a.emailAndPassword?.password?.verify},autoSignIn:!!a.emailAndPassword?.autoSignIn,revokeSessionsOnPasswordReset:!!a.emailAndPassword?.revokeSessionsOnPasswordReset},socialProviders:await Promise.all(Object.keys(a.socialProviders||{}).map(async b=>{let c=a.socialProviders?.[b];if(!c)return{};let d="function"==typeof c?await c():c;return{id:b,mapProfileToUser:!!d.mapProfileToUser,disableDefaultScope:!!d.disableDefaultScope,disableIdTokenSignIn:!!d.disableIdTokenSignIn,disableImplicitSignUp:d.disableImplicitSignUp,disableSignUp:d.disableSignUp,getUserInfo:!!d.getUserInfo,overrideUserInfoOnSignIn:!!d.overrideUserInfoOnSignIn,prompt:d.prompt,verifyIdToken:!!d.verifyIdToken,scope:d.scope,refreshAccessToken:!!d.refreshAccessToken}})),plugins:a.plugins?.map(a=>a.id.toString()),user:{modelName:a.user?.modelName,fields:a.user?.fields,additionalFields:a.user?.additionalFields,changeEmail:{enabled:a.user?.changeEmail?.enabled,sendChangeEmailConfirmation:!!a.user?.changeEmail?.sendChangeEmailConfirmation}},verification:{modelName:a.verification?.modelName,disableCleanup:a.verification?.disableCleanup,fields:a.verification?.fields},session:{modelName:a.session?.modelName,additionalFields:a.session?.additionalFields,cookieCache:{enabled:a.session?.cookieCache?.enabled,maxAge:a.session?.cookieCache?.maxAge,strategy:a.session?.cookieCache?.strategy},disableSessionRefresh:a.session?.disableSessionRefresh,expiresIn:a.session?.expiresIn,fields:a.session?.fields,freshAge:a.session?.freshAge,preserveSessionInDatabase:a.session?.preserveSessionInDatabase,storeSessionInDatabase:a.session?.storeSessionInDatabase,updateAge:a.session?.updateAge},account:{modelName:a.account?.modelName,fields:a.account?.fields,encryptOAuthTokens:a.account?.encryptOAuthTokens,updateAccountOnSignIn:a.account?.updateAccountOnSignIn,accountLinking:{enabled:a.account?.accountLinking?.enabled,trustedProviders:a.account?.accountLinking?.trustedProviders,updateUserInfoOnLink:a.account?.accountLinking?.updateUserInfoOnLink,allowUnlinkingAll:a.account?.accountLinking?.allowUnlinkingAll}},hooks:{after:!!a.hooks?.after,before:!!a.hooks?.before},secondaryStorage:!!a.secondaryStorage,advanced:{cookiePrefix:!!a.advanced?.cookiePrefix,cookies:!!a.advanced?.cookies,crossSubDomainCookies:{domain:!!a.advanced?.crossSubDomainCookies?.domain,enabled:a.advanced?.crossSubDomainCookies?.enabled,additionalCookies:a.advanced?.crossSubDomainCookies?.additionalCookies},database:{generateId:a.advanced?.database?.generateId,defaultFindManyLimit:a.advanced?.database?.defaultFindManyLimit},useSecureCookies:a.advanced?.useSecureCookies,ipAddress:{disableIpTracking:a.advanced?.ipAddress?.disableIpTracking,ipAddressHeaders:a.advanced?.ipAddress?.ipAddressHeaders},disableCSRFCheck:a.advanced?.disableCSRFCheck,cookieAttributes:{expires:a.advanced?.defaultCookieAttributes?.expires,secure:a.advanced?.defaultCookieAttributes?.secure,sameSite:a.advanced?.defaultCookieAttributes?.sameSite,domain:!!a.advanced?.defaultCookieAttributes?.domain,path:a.advanced?.defaultCookieAttributes?.path,httpOnly:a.advanced?.defaultCookieAttributes?.httpOnly}},trustedOrigins:a.trustedOrigins?.length,rateLimit:{storage:a.rateLimit?.storage,modelName:a.rateLimit?.modelName,window:a.rateLimit?.window,customStorage:!!a.rateLimit?.customStorage,enabled:a.rateLimit?.enabled,max:a.rateLimit?.max},onAPIError:{errorURL:a.onAPIError?.errorURL,onError:!!a.onAPIError?.onError,throw:a.onAPIError?.throw},logger:{disabled:a.logger?.disabled,level:a.logger?.level,log:!!a.logger?.log},databaseHooks:{user:{create:{after:!!a.databaseHooks?.user?.create?.after,before:!!a.databaseHooks?.user?.create?.before},update:{after:!!a.databaseHooks?.user?.update?.after,before:!!a.databaseHooks?.user?.update?.before}},session:{create:{after:!!a.databaseHooks?.session?.create?.after,before:!!a.databaseHooks?.session?.create?.before},update:{after:!!a.databaseHooks?.session?.update?.after,before:!!a.databaseHooks?.session?.update?.before}},account:{create:{after:!!a.databaseHooks?.account?.create?.after,before:!!a.databaseHooks?.account?.create?.before},update:{after:!!a.databaseHooks?.account?.update?.after,before:!!a.databaseHooks?.account?.update?.before}},verification:{create:{after:!!a.databaseHooks?.verification?.create?.after,before:!!a.databaseHooks?.verification?.create?.before},update:{after:!!a.databaseHooks?.verification?.update?.after,before:!!a.databaseHooks?.verification?.update?.before}}}}}async function o(a){let b=await (0,k.createHash)("SHA-256").digest(a);return j.base64.encode(b)}async function p(){if(D)return D;try{let a=process.cwd();if(!a)return;let b=await e.default.readFile(g.default.join(a,"package.json"),"utf-8");return D=JSON.parse(b)}catch{}}async function q(a){if(D)return D.dependencies?.[a]||D.devDependencies?.[a]||D.peerDependencies?.[a];try{let b=process.cwd();if(!b)throw Error("no-cwd");let c=g.default.join(b,"node_modules",a,"package.json"),d=await e.default.readFile(c,"utf-8");return JSON.parse(d).version||await r(a)||void 0}catch{}return r(a)}async function r(a){let b=await p();if(b)return({...b.dependencies,...b.devDependencies,...b.peerDependencies})[a]}async function s(){return(await p())?.name}async function t(){try{let a,b,c=f.default.cpus();return{deploymentVendor:(a=process.env,(b=(...b)=>b.some(b=>!!a[b]))("CF_PAGES","CF_PAGES_URL","CF_ACCOUNT_ID")||"u">typeof navigator&&"Cloudflare-Workers"===navigator.userAgent?"cloudflare":b("VERCEL","VERCEL_URL","VERCEL_ENV")?"vercel":b("NETLIFY","NETLIFY_URL")?"netlify":b("RENDER","RENDER_URL","RENDER_INTERNAL_HOSTNAME","RENDER_SERVICE_ID")?"render":b("AWS_LAMBDA_FUNCTION_NAME","AWS_EXECUTION_ENV","LAMBDA_TASK_ROOT")?"aws":b("GOOGLE_CLOUD_FUNCTION_NAME","GOOGLE_CLOUD_PROJECT","GCP_PROJECT","K_SERVICE")?"gcp":b("AZURE_FUNCTION_NAME","FUNCTIONS_WORKER_RUNTIME","WEBSITE_INSTANCE_ID","WEBSITE_SITE_NAME")?"azure":b("DENO_DEPLOYMENT_ID","DENO_REGION")?"deno-deploy":b("FLY_APP_NAME","FLY_REGION","FLY_ALLOC_ID")?"fly-io":b("RAILWAY_STATIC_URL","RAILWAY_ENVIRONMENT_NAME")?"railway":b("DYNO","HEROKU_APP_NAME")?"heroku":b("DO_DEPLOYMENT_ID","DO_APP_NAME","DIGITALOCEAN")?"digitalocean":b("KOYEB","KOYEB_DEPLOYMENT_ID","KOYEB_APP_NAME")?"koyeb":null),systemPlatform:f.default.platform(),systemRelease:f.default.release(),systemArchitecture:f.default.arch(),cpuCount:c.length,cpuModel:c.length?c[0].model:null,cpuSpeed:c.length?c[0].speed:null,memory:f.default.totalmem(),isWSL:await y(),isDocker:await w(),isTTY:process.stdout?process.stdout.isTTY:null}}catch{return{systemPlatform:null,systemRelease:null,systemArchitecture:null,cpuCount:null,cpuModel:null,cpuSpeed:null,memory:null,isWSL:null,isDocker:null,isTTY:null}}}async function u(){try{return d.default.statSync("/.dockerenv"),!0}catch{return!1}}async function v(){try{return d.default.readFileSync("/proc/self/cgroup","utf8").includes("docker")}catch{return!1}}async function w(){return void 0===E&&(E=await u()||await v()),E}[h]=m.then?(await m)():m;let G=async()=>{try{return d.default.statSync("/run/.containerenv"),!0}catch{return!1}};async function x(){return void 0===F&&(F=await G()||await w()),F}async function y(){try{if(f.default.release().toLowerCase().includes("microsoft")){if(await x())return!1;return!0}return!!d.default.readFileSync("/proc/version","utf8").toLowerCase().includes("microsoft")&&!await x()}catch{return!1}}let H=null;async function z(a){if(H)return H;let b=await s();return b?H=await o(a?a+b:b):a?H=await o(a):H=(0,l.createRandomStringGenerator)("a-z","A-Z","0-9")(32)}async function A(){for(let[a,b]of Object.entries({pg:"postgresql",mysql:"mysql",mariadb:"mariadb",sqlite3:"sqlite","better-sqlite3":"sqlite","@prisma/client":"prisma",mongoose:"mongodb",mongodb:"mongodb","drizzle-orm":"drizzle"})){let c=await q(a);if(c)return{name:b,version:c}}}async function B(){for(let[a,b]of Object.entries({next:"next",nuxt:"nuxt","react-router":"react-router",astro:"astro","@sveltejs/kit":"sveltekit","solid-start":"solid-start","tanstack-start":"tanstack-start",hono:"hono",express:"express",elysia:"elysia",expo:"expo"})){let c=await q(a);if(c)return{name:b,version:c}}}let I=async function(){};async function C(a,b){let c,d=a.telemetry?.debug||(0,h.getBooleanEnvVar)("BETTER_AUTH_TELEMETRY_DEBUG",!1),e=h.ENV.BETTER_AUTH_TELEMETRY_ENDPOINT;if(!e&&!b?.customTrack)return{publish:I};let f=async a=>{b?.customTrack?await b.customTrack(a).catch(h.logger.error):e&&(d?h.logger.info("telemetry event",JSON.stringify(a,null,2)):await (0,i.betterFetch)(e,{method:"POST",body:a}).catch(h.logger.error))},g=async()=>{let c=a.telemetry?.enabled!==void 0&&a.telemetry.enabled;return((0,h.getBooleanEnvVar)("BETTER_AUTH_TELEMETRY",!1)||c)&&(b?.skipTestCheck||!(0,h.isTest)())},j=await g();return j&&(c=await z("string"==typeof a.baseURL?a.baseURL:void 0),f({type:"init",payload:{config:await n(a,b),runtime:"u">typeof Deno?{name:"deno",version:Deno?.version?.deno??null}:"u">typeof Bun?{name:"bun",version:Bun?.version??null}:"u">typeof process&&process?.versions?.node?{name:"node",version:process.versions.node??null}:{name:"edge",version:null},database:await A(),framework:await B(),environment:"production"===(0,h.getEnvVar)("NODE_ENV")?"production":"false"!==h.env.CI&&("BUILD_ID"in h.env||"BUILD_NUMBER"in h.env||"CI"in h.env||"CI_APP_ID"in h.env||"CI_BUILD_ID"in h.env||"CI_BUILD_NUMBER"in h.env||"CI_NAME"in h.env||"CONTINUOUS_INTEGRATION"in h.env||"RUN_ID"in h.env)?"ci":(0,h.isTest)()?"test":"development",systemInfo:await t(),packageManager:function(){let a=h.env.npm_config_user_agent;if(!a)return;let b=a.split(" ")[0],c=b.lastIndexOf("/"),d=b.substring(0,c);return{name:"npminstall"===d?"cnpm":d,version:b.substring(c+1)}}()},anonymousId:c})),{publish:async b=>{j&&(c||(c=await z("string"==typeof a.baseURL?a.baseURL:void 0)),await f({type:b.type,payload:b.payload,anonymousId:c}))}}}a.s(["createTelemetry",0,C]),c()}catch(a){c(a)}},!1),351989,a=>a.a(async(b,c)=>{try{var d=a.i(592474),e=a.i(129522),f=a.i(769675),g=a.i(649021),h=a.i(827764),i=a.i(46585),j=a.i(427051),k=a.i(878243),l=a.i(942812),m=a.i(165245),n=a.i(328371),o=a.i(220447),p=a.i(782645),q=a.i(224321),r=a.i(28675),s=a.i(815291),t=a.i(979282),u=a.i(227265),v=a.i(961938),w=a.i(583025),x=b([d,e,i,j,k,l,m,o,p,q,r,s,t,u,v]);async function y(a,b,c){let x,y,z,A,B=(0,f.hasServerSessionStore)(b);B||(b=(0,w.default)(b,{session:{cookieCache:{enabled:!0,strategy:"jwe",refreshCache:!0,maxAge:b.session?.expiresIn||604800}}})),b.database||(b=(0,w.default)(b,{account:{storeAccountCookie:!0}}));let C=b.plugins||[],D=(0,k.getInternalPlugins)(b),E=(0,r.createLogger)(b.logger),F=(0,d.isDynamicBaseURLConfig)(b.baseURL);if((0,d.isDynamicBaseURLConfig)(b.baseURL)){let{allowedHosts:a}=b.baseURL;if(!a||0===a.length)throw new s.BetterAuthError('baseURL.allowedHosts cannot be empty. Provide at least one allowed host pattern (e.g., ["myapp.com", "*.vercel.app"]).')}let G=F?void 0:(0,d.getBaseURL)("string"==typeof b.baseURL?b.baseURL:void 0,b.basePath);G||F||E.warn("[better-auth] Base URL is not set. Set the baseURL option or BETTER_AUTH_URL env, or use a dynamic baseURL with allowedHosts for multi-host setups. Without it the origin is derived from the incoming request, and callbacks and redirects may not work correctly."),"memory"===a.id&&b.advanced?.database?.generateId===!1&&E.error(`[better-auth] Misconfiguration detected.
+You are using the memory DB with generateId: false.
+This will cause no id to be generated for any model.
+Most of the features of Better Auth will not work correctly.`);let H=b.secrets??(0,o.parseSecretsEnv)(r.env.BETTER_AUTH_SECRETS),I=b.secret||r.env.BETTER_AUTH_SECRET||r.env.AUTH_SECRET||"";if(H)(0,o.validateSecretsArray)(H,E),x=H[0].value,y=(0,o.buildSecretConfig)(H,I);else{var J=x=I||"better-auth-secret-12345678901234567890";let a=J===n.DEFAULT_SECRET;if(!(0,r.isTest)()){let b;if(a&&r.isProduction)throw new s.BetterAuthError("You are using the default secret. Please set `BETTER_AUTH_SECRET` in your environment variables or pass `secret` in your auth config.");if(!J)throw new s.BetterAuthError("BETTER_AUTH_SECRET is missing. Set it in your environment or pass `secret` to betterAuth({ secret }).");J.length<32&&E.warn("[better-auth] Warning: your BETTER_AUTH_SECRET should be at least 32 characters long for adequate security. Generate one with `npx auth secret` or `openssl rand -base64 32`."),120>(b=new Set(J).size,0===b?0:Math.log2(Math.pow(b,J.length)))&&E.warn("[better-auth] Warning: your BETTER_AUTH_SECRET appears low-entropy. Use a randomly generated secret for production.")}y=x}b={...b,secret:x,baseURL:F?b.baseURL:G?new URL(G).origin:"",basePath:b.basePath||"/api/auth",plugins:C.concat(D)},(0,m.checkEndpointConflicts)(b,E);let K=(0,i.getCookies)(b),L=(0,q.getAuthTables)(b),M=(await Promise.all(Object.entries(b.socialProviders||{}).map(async([a,b])=>{let c="function"==typeof b?await b():b;if(null==c||!1===c.enabled)return null;c.clientId||E.warn(`Social provider ${a} is missing clientId or clientSecret`);let d=u.socialProviders[a](c);return d.disableImplicitSignUp=c.disableImplicitSignUp,d}))).filter(a=>null!==a),N=({model:a,size:c})=>{if("function"==typeof b.advanced?.generateId)return b.advanced.generateId({model:a,size:c});let d=b?.advanced?.database?.generateId;return"function"==typeof d?d({model:a,size:c}):"uuid"===d?crypto.randomUUID():"serial"!==d&&!1!==d&&(0,t.generateId)(c)},{publish:O}=await (0,v.createTelemetry)(b,{adapter:a.id,database:"function"==typeof b.database?"adapter":c(b.database)}),P=new Set(b.plugins.map(a=>a.id)),Q=await (0,k.getTrustedOrigins)(b),R=await (0,k.getTrustedProviders)(b),S={appName:b.appName||"Better Auth",baseURL:G||"",version:(0,p.getBetterAuthVersion)(),socialProviders:M,options:b,oauthConfig:{storeStateStrategy:b.account?.storeStateStrategy||(B?"database":"cookie"),skipStateCookieCheck:!!b.account?.skipStateCookieCheck},tables:L,trustedOrigins:Q,trustedProviders:R,isTrustedOrigin(a,b){return this.trustedOrigins.some(c=>(0,e.matchesOriginPattern)(a,c,b))},sessionConfig:{updateAge:b.session?.updateAge!==void 0?b.session.updateAge:86400,expiresIn:b.session?.expiresIn||604800,freshAge:b.session?.freshAge===void 0?86400:b.session.freshAge,cookieRefreshCache:(z=b.session?.cookieCache?.refreshCache,A=b.session?.cookieCache?.maxAge||300,B&&z?(E.warn("[better-auth] `session.cookieCache.refreshCache` is enabled while `database` or `secondaryStorage` is configured. `refreshCache` is meant for stateless (DB-less) setups. Disabling `refreshCache` — remove it from your config to silence this warning."),!1):!1!==z&&void 0!==z&&(!0===z?{enabled:!0,updateAge:Math.floor(.2*A)}:{enabled:!0,updateAge:void 0!==z.updateAge?z.updateAge:Math.floor(.2*A)}))},secret:x,secretConfig:y,rateLimit:{...b.rateLimit,enabled:b.rateLimit?.enabled??r.isProduction,window:b.rateLimit?.window||10,max:b.rateLimit?.max||100,storage:b.rateLimit?.storage||(b.secondaryStorage?"secondary-storage":"memory")},authCookies:K,logger:E,generateId:N,session:null,secondaryStorage:b.secondaryStorage,password:{hash:b.emailAndPassword?.password?.hash||h.hashPassword,verify:b.emailAndPassword?.password?.verify||h.verifyPassword,config:{minPasswordLength:b.emailAndPassword?.minPasswordLength||8,maxPasswordLength:b.emailAndPassword?.maxPasswordLength||128},checkPassword:l.checkPassword},setNewSession(a){this.newSession=a},newSession:null,adapter:a,internalAdapter:(0,j.createInternalAdapter)(a,{options:b,logger:E,hooks:b.databaseHooks?[{source:"user",hooks:b.databaseHooks}]:[],generateId:N}),createAuthCookie:(0,i.createCookieGetter)(b),async runMigrations(){throw new s.BetterAuthError("runMigrations will be set by the specific init implementation")},publishTelemetry:O,skipCSRFCheck:!!b.advanced?.disableCSRFCheck,skipOriginCheck:b.advanced?.disableOriginCheck!==void 0?b.advanced.disableOriginCheck:!!(0,r.isTest)(),runInBackground:b.advanced?.backgroundTasks?.handler??(a=>{a.catch(()=>{})}),async runInBackgroundOrAwait(a){try{b.advanced?.backgroundTasks?.handler?a instanceof Promise&&b.advanced.backgroundTasks.handler(a.catch(a=>{E.error("Failed to run background task:",a)})):await a}catch(a){E.error("Failed to run background task:",a)}},getPlugin:a=>b.plugins.find(b=>b.id===a)??null,hasPlugin:a=>P.has(a)},T=(0,k.runPluginInit)(S);return(0,g.isPromise)(T)&&await T,S}[d,e,i,j,k,l,m,o,p,q,r,s,t,u,v]=x.then?(await x)():x,a.s(["createAuthContext",0,y]),c()}catch(a){c(a)}},!1),551921,a=>a.a(async(b,c)=>{try{var d=a.i(292608),e=a.i(350242),f=a.i(351989),g=a.i(815291),h=a.i(838087),i=b([d,e,f,g,h]);[d,e,f,g,h]=i.then?(await i)():i;let j=async a=>{let b=await (0,d.getAdapter)(a),c=await (0,f.createAuthContext)(b,a,a=>(0,h.getKyselyDatabaseType)(a)||"unknown");return c.runMigrations=async function(){if(!a.database||"updateMany"in a.database)throw new g.BetterAuthError("Database is not provided or it's an adapter. Migrations are only supported with a database instance.");let{runMigrations:b}=await (0,e.getMigrations)(a);await b()},c};a.s(["init",0,j]),c()}catch(a){c(a)}},!1),199523,a=>a.a(async(b,c)=>{try{var d=a.i(592474),e=a.i(878243),f=a.i(165245),g=a.i(782645),h=a.i(815291),i=b([d,e,f,g,h]);[d,e,f,g,h]=i.then?(await i)():i,a.s(["createBetterAuth",0,(a,b)=>{let c=b(a),{api:i}=(0,f.getEndpoints)(c,a);return{handler:async b=>{let i,j=await c,k=j.options.basePath||"/api/auth";if((0,d.isDynamicBaseURLConfig)(a.baseURL))i=await (0,e.resolveRequestContext)(j,b,(0,e.resolveDynamicTrustedProxyHeaders)(j.options));else{i=Object.create(Object.getPrototypeOf(j),Object.getOwnPropertyDescriptors(j));let a=j.options;if(!j.options.baseURL){let c=(0,d.getBaseURL)(void 0,k,b,void 0,j.options.advanced?.trustedProxyHeaders);if(!c)throw new h.BetterAuthError("Could not get base URL from request. Please provide a valid base URL.");i.baseURL=c,i.options={...j.options,baseURL:(0,d.getOrigin)(c)||void 0},a=i.options}i.trustedOrigins=await (0,e.getTrustedOrigins)(a,b),i.trustedProviders=await (0,e.getTrustedProviders)(a,b)}let{handler:l}=(0,f.router)(i,a);return(0,g.runWithAdapter)(i.adapter,()=>l(b))},api:i,options:a,$context:c,$ERROR_CODES:{...a.plugins?.reduce((a,b)=>b.$ERROR_CODES?{...a,...b.$ERROR_CODES}:a,{}),...h.BASE_ERROR_CODES}}}]),c()}catch(a){c(a)}},!1),180925,a=>a.a(async(b,c)=>{try{var d=a.i(551921),e=a.i(199523),f=b([d,e]);[d,e]=f.then?(await f)():f,a.s(["betterAuth",0,a=>(0,e.createBetterAuth)(a,d.init)]),c()}catch(a){c(a)}},!1),489810,a=>{"use strict";a.s(["PACKAGE_VERSION",0,"1.6.18"],489810)},17715,a=>a.a(async(b,c)=>{try{var d=a.i(233795),e=b([d]);[d]=e.then?(await e)():e;let f=(0,d.defineErrorCodes)({OTP_EXPIRED:"OTP expired",INVALID_OTP:"Invalid OTP",TOO_MANY_ATTEMPTS:"Too many attempts"});a.s(["EMAIL_OTP_ERROR_CODES",0,f]),c()}catch(a){c(a)}},!1),208586,a=>a.a(async(b,c)=>{try{var d=a.i(417387),e=b([d]);[d]=e.then?(await e)():e;let f=async a=>{let b=a.context.returned;return b?b instanceof Response?200!==b.status?null:await b.clone().json():(0,d.isAPIError)(b)?null:b:null};a.s(["getEndpointResponse",0,f]),c()}catch(a){c(a)}},!1),337990,a=>{"use strict";var b=a.i(711159),c=a.i(531429);let d=async a=>{let d=await (0,c.createHash)("SHA-256").digest(new TextEncoder().encode(a));return b.base64Url.encode(new Uint8Array(d),{padding:!1})};a.s(["defaultKeyHasher",0,d,"splitAtLastColon",0,function(a){let b=a.lastIndexOf(":");return -1===b?[a,""]:[a.slice(0,b),a.slice(b+1)]},"toOTPIdentifier",0,function(a,b){return`${a}-otp-${b}`}])},840838,a=>{"use strict";var b=a.i(186673),c=a.i(123084),d=a.i(252736),e=a.i(337990);async function f(a,b,c){return"encrypted"===b.storeOTP?await (0,d.symmetricEncrypt)({key:a.context.secretConfig,data:c}):"hashed"===b.storeOTP?await (0,e.defaultKeyHasher)(c):"object"==typeof b.storeOTP&&"hash"in b.storeOTP?await b.storeOTP.hash(c):"object"==typeof b.storeOTP&&"encrypt"in b.storeOTP?await b.storeOTP.encrypt(c):c}async function g(a,b,f,g){return"encrypted"===b.storeOTP?(0,c.constantTimeEqual)(await (0,d.symmetricDecrypt)({key:a.context.secretConfig,data:f}),g):"hashed"===b.storeOTP?(0,c.constantTimeEqual)(await (0,e.defaultKeyHasher)(g),f):"object"==typeof b.storeOTP&&"hash"in b.storeOTP?(0,c.constantTimeEqual)(await b.storeOTP.hash(g),f):"object"==typeof b.storeOTP&&"decrypt"in b.storeOTP?(0,c.constantTimeEqual)(await b.storeOTP.decrypt(f),g):(0,c.constantTimeEqual)(g,f)}async function h(a,b,c){return"plain"===b.storeOTP||void 0===b.storeOTP?c:"encrypted"===b.storeOTP?await (0,d.symmetricDecrypt)({key:a.context.secretConfig,data:c}):"object"==typeof b.storeOTP&&"decrypt"in b.storeOTP?await b.storeOTP.decrypt(c):null}async function i(a,c,d){let f=await a.context.internalAdapter.findVerificationValue(d);if(!f||f.expiresAt<new Date)return null;let[g,i]=(0,e.splitAtLastColon)(f.value),j=c.allowedAttempts||3;if(i&&parseInt(i)>=j)return null;let k=await h(a,c,g);return k?(await a.context.internalAdapter.updateVerificationByIdentifier(d,{expiresAt:(0,b.getDate)(c.expiresIn,"sec")}),k):null}a.s(["storeOTP",0,f,"tryReuseOTP",0,i,"verifyStoredOTP",0,g])},885030,a=>a.a(async(b,c)=>{try{var d=a.i(704551),e=a.i(186673),f=a.i(597080),g=a.i(252736),h=a.i(46585),i=a.i(750290),j=a.i(815291),k=a.i(17715),l=a.i(337990),m=a.i(840838),n=a.i(596343),o=a.i(16005),p=a.i(512418),q=b([d,h,i,j,k,n,o]);[d,h,i,j,k,n,o]=q.then?(await q)():q;let t=["email-verification","sign-in","forget-password","change-email"];async function r(a,b,c,d){let f=(0,l.toOTPIdentifier)(d,c);if("reuse"===b.resendStrategy){let c=await (0,m.tryReuseOTP)(a,b,f);if(c)return c}let g=b.generateOTP({email:c,type:d},a)||F(b),h=await (0,m.storeOTP)(a,b,g);return await a.context.internalAdapter.createVerificationValue({value:`${h}:0`,identifier:f,expiresAt:(0,e.getDate)(b.expiresIn,"sec")}).catch(async()=>{await a.context.internalAdapter.deleteVerificationByIdentifier(f),await a.context.internalAdapter.createVerificationValue({value:`${h}:0`,identifier:f,expiresAt:(0,e.getDate)(b.expiresIn,"sec")})}),g}let u=p.object({email:p.string({}).meta({description:"Email address to send the OTP"}),type:p.enum(t).meta({description:"Type of the OTP"})}),v=p.object({email:p.string({}).meta({description:"Email address to send the OTP"}),type:p.enum(t).meta({required:!0,description:"Type of the OTP"})}),w=p.object({email:p.string({}).meta({description:"Email address the OTP was sent to"}),type:p.enum(t).meta({required:!0,description:"Type of the OTP"})}),x=p.object({email:p.string().meta({description:"Email address the OTP was sent to"}),type:p.enum(t).meta({required:!0,description:"Type of the OTP"}),otp:p.string().meta({required:!0,description:"OTP to verify"})}),y=p.object({email:p.string({}).meta({description:"Email address to verify"}),otp:p.string().meta({required:!0,description:"OTP to verify"})}),z=p.object({email:p.string({}).meta({description:"Email address to sign in"}),otp:p.string().meta({required:!0,description:"OTP sent to the email"}),name:p.string().meta({description:'User display name. Only used if the user is registering for the first time. Eg: "my-name"'}).optional(),image:p.string().meta({description:"User profile image URL. Only used if the user is registering for the first time."}).optional()}).and(p.record(p.string(),p.any())),A=p.object({email:p.string().meta({description:"Email address to send the OTP"})}),B=p.object({email:p.string().meta({description:"Email address to send the OTP"})}),C=p.object({email:p.string().meta({description:"Email address to reset the password"}),otp:p.string().meta({description:"OTP sent to the email"}),password:p.string().meta({description:"New password"})}),D=p.object({newEmail:p.string().meta({description:"New email address to send the OTP"}),otp:p.string().optional().meta({description:"OTP sent to the current email. This is required if changeEmail.verifyCurrentEmail option is set to true"})}),E=p.object({newEmail:p.string().meta({description:"New email address to verify and change to"}),otp:p.string().meta({description:"OTP sent to the new email"})}),F=a=>(0,f.generateRandomString)(a.otpLength??6,"0-9");async function s(a,b,c,d){let e=await a.context.internalAdapter.findVerificationValue(c);if(e&&e.expiresAt<new Date)throw await a.context.internalAdapter.deleteVerificationByIdentifier(c),j.APIError.from("BAD_REQUEST",k.EMAIL_OTP_ERROR_CODES.OTP_EXPIRED);let f=await a.context.internalAdapter.consumeVerificationValue(c);if(!f)throw j.APIError.from("BAD_REQUEST",k.EMAIL_OTP_ERROR_CODES.INVALID_OTP);let[g,h]=(0,l.splitAtLastColon)(f.value),i=b?.allowedAttempts||3,n=parseInt(h||"0");if(n>=i)throw j.APIError.from("FORBIDDEN",k.EMAIL_OTP_ERROR_CODES.TOO_MANY_ATTEMPTS);if(!await (0,m.verifyStoredOTP)(a,b,g,d))throw await a.context.internalAdapter.createVerificationValue({value:`${g}:${n+1}`,identifier:c,expiresAt:f.expiresAt}),j.APIError.from("BAD_REQUEST",k.EMAIL_OTP_ERROR_CODES.INVALID_OTP)}a.s(["changeEmailEmailOTP",0,a=>(0,n.createAuthEndpoint)("/email-otp/change-email",{method:"POST",body:E,use:[i.sensitiveSessionMiddleware],metadata:{openapi:{operationId:"changeEmailWithEmailOTP",description:"Verify new email with OTP and change the email if verification is successful",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean"}}}}}}}}}},async b=>{if(!a.changeEmail?.enabled)throw b.context.logger.error("Change email with OTP is disabled."),j.APIError.fromStatus("BAD_REQUEST",{message:"Change email with OTP is disabled"});let c=b.context.session,d=c.user.email.toLowerCase(),e=b.body.newEmail.toLowerCase();if(!p.email().safeParse(e).success)throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.INVALID_EMAIL);if(e===d)throw b.context.logger.error("Email is the same"),j.APIError.fromStatus("BAD_REQUEST",{message:"Email is the same"});await s(b,a,(0,l.toOTPIdentifier)("change-email",`${d}-${e}`),b.body.otp);let f=await b.context.internalAdapter.findUserByEmail(d);if(!f)throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.USER_NOT_FOUND);if(await b.context.internalAdapter.findUserByEmail(e))throw j.APIError.fromStatus("BAD_REQUEST",{message:"Email already in use"});b.context.options.emailVerification?.beforeEmailVerification&&await b.context.options.emailVerification.beforeEmailVerification(f.user,b.request);let g=await b.context.internalAdapter.updateUser(f.user.id,{email:e,emailVerified:!0});return b.context.options.emailVerification?.afterEmailVerification&&await b.context.options.emailVerification.afterEmailVerification(g,b.request),await (0,h.setSessionCookie)(b,{session:c.session,user:{...c.user,email:e,emailVerified:!0}}),b.json({success:!0})}),"checkVerificationOTP",0,a=>(0,n.createAuthEndpoint)("/email-otp/check-verification-otp",{method:"POST",body:x,metadata:{openapi:{operationId:"verifyEmailWithOTP",description:"Verify an email with an OTP",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean"}}}}}}}}}},async b=>{let c=b.body.email.toLowerCase();if(!p.email().safeParse(c).success)throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.INVALID_EMAIL);if(!await b.context.internalAdapter.findUserByEmail(c))throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.USER_NOT_FOUND);let d=(0,l.toOTPIdentifier)(b.body.type,c),e=await b.context.internalAdapter.findVerificationValue(d);if(!e)throw j.APIError.from("BAD_REQUEST",k.EMAIL_OTP_ERROR_CODES.INVALID_OTP);if(e.expiresAt<new Date)throw await b.context.internalAdapter.deleteVerificationByIdentifier(d),j.APIError.from("BAD_REQUEST",k.EMAIL_OTP_ERROR_CODES.OTP_EXPIRED);let[f,g]=(0,l.splitAtLastColon)(e.value),h=a?.allowedAttempts||3;if(g&&parseInt(g)>=h)throw await b.context.internalAdapter.deleteVerificationByIdentifier(d),j.APIError.from("FORBIDDEN",k.EMAIL_OTP_ERROR_CODES.TOO_MANY_ATTEMPTS);if(!await (0,m.verifyStoredOTP)(b,a,f,b.body.otp))throw await b.context.internalAdapter.updateVerificationByIdentifier(d,{value:`${f}:${parseInt(g||"0")+1}`}),j.APIError.from("BAD_REQUEST",k.EMAIL_OTP_ERROR_CODES.INVALID_OTP);return b.json({success:!0})}),"createVerificationOTP",0,a=>n.createAuthEndpoint.serverOnly({method:"POST",body:v,metadata:{openapi:{operationId:"createEmailVerificationOTP",description:"Create a verification OTP for an email",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"string"}}}}}}}},async b=>{let c=b.body.email.toLowerCase(),d=a.generateOTP({email:c,type:b.body.type},b)||F(a),f=await (0,m.storeOTP)(b,a,d);return await b.context.internalAdapter.createVerificationValue({value:`${f}:0`,identifier:(0,l.toOTPIdentifier)(b.body.type,c),expiresAt:(0,e.getDate)(a.expiresIn,"sec")}),d}),"forgetPasswordEmailOTP",0,a=>{let b=(0,o.deprecate)(()=>{},'The "/forget-password/email-otp" endpoint is deprecated. Please use "/email-otp/request-password-reset" instead. This endpoint will be removed in the next major version.');return(0,n.createAuthEndpoint)("/forget-password/email-otp",{method:"POST",body:B,metadata:{openapi:{operationId:"forgetPasswordWithEmailOTP",description:"Deprecated: Use /email-otp/request-password-reset instead.",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean",description:"Indicates if the OTP was sent successfully"}}}}}}}}}},async c=>{b();let d=c.body.email.toLowerCase(),e=(0,l.toOTPIdentifier)("forget-password",d),f=await r(c,a,d,"forget-password");return await c.context.internalAdapter.findUserByEmail(d)?await c.context.runInBackgroundOrAwait(a.sendVerificationOTP({email:d,otp:f,type:"forget-password"},c)):await c.context.internalAdapter.deleteVerificationByIdentifier(e),c.json({success:!0})})},"getVerificationOTP",0,a=>n.createAuthEndpoint.serverOnly({method:"GET",query:w,metadata:{openapi:{operationId:"getEmailVerificationOTP",description:"Get a verification OTP for an email",responses:{200:{description:"OTP retrieved successfully or not found/expired",content:{"application/json":{schema:{type:"object",properties:{otp:{type:"string",nullable:!0,description:"The stored OTP, or null if not found or expired"}},required:["otp"]}}}}}}}},async b=>{let c=b.query.email.toLowerCase(),d=await b.context.internalAdapter.findVerificationValue((0,l.toOTPIdentifier)(b.query.type,c));if(!d||d.expiresAt<new Date)return b.json({otp:null});if("hashed"===a.storeOTP||"object"==typeof a.storeOTP&&"hash"in a.storeOTP)throw j.APIError.fromStatus("BAD_REQUEST",{message:"OTP is hashed, cannot return the plain text OTP"});let[e,f]=(0,l.splitAtLastColon)(d.value),h=e;return"encrypted"===a.storeOTP&&(h=await (0,g.symmetricDecrypt)({key:b.context.secretConfig,data:e})),"object"==typeof a.storeOTP&&"decrypt"in a.storeOTP&&(h=await a.storeOTP.decrypt(e)),b.json({otp:h})}),"requestEmailChangeEmailOTP",0,a=>(0,n.createAuthEndpoint)("/email-otp/request-email-change",{method:"POST",body:D,use:[i.sensitiveSessionMiddleware],metadata:{openapi:{operationId:"requestEmailChangeWithEmailOTP",description:"Request email change with verification OTP sent to the new email",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean"}}}}}}}}}},async b=>{if(!a.changeEmail?.enabled)throw b.context.logger.error("Change email with OTP is disabled."),j.APIError.fromStatus("BAD_REQUEST",{message:"Change email with OTP is disabled"});let c=b.context.session.user.email.toLowerCase(),d=b.body.newEmail.toLowerCase();if(!p.email().safeParse(d).success)throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.INVALID_EMAIL);if(d===c)throw b.context.logger.error("Email is the same"),j.APIError.fromStatus("BAD_REQUEST",{message:"Email is the same"});if(a.changeEmail?.verifyCurrentEmail){if(!b.body.otp)throw j.APIError.fromStatus("BAD_REQUEST",{message:"OTP is required to verify current email"});await s(b,a,(0,l.toOTPIdentifier)("email-verification",c),b.body.otp)}else b.body.otp&&b.context.logger.warn("OTP provided but not required for verifying current email. If you want to require OTP verification for current email, please set the changeEmail.verifyCurrentEmail option to true in the configuration");let f=a.generateOTP({email:d,type:"change-email"},b)||F(a),g=await (0,m.storeOTP)(b,a,f);return(await b.context.internalAdapter.createVerificationValue({value:`${g}:0`,identifier:(0,l.toOTPIdentifier)("change-email",`${c}-${d}`),expiresAt:(0,e.getDate)(a.expiresIn,"sec")}),await b.context.internalAdapter.findUserByEmail(d))?await b.context.internalAdapter.deleteVerificationByIdentifier((0,l.toOTPIdentifier)("change-email",`${c}-${d}`)):await b.context.runInBackgroundOrAwait(a.sendVerificationOTP({email:d,otp:f,type:"change-email"},b)),b.json({success:!0})}),"requestPasswordResetEmailOTP",0,a=>(0,n.createAuthEndpoint)("/email-otp/request-password-reset",{method:"POST",body:A,metadata:{openapi:{operationId:"requestPasswordResetWithEmailOTP",description:"Request password reset with email and OTP",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean",description:"Indicates if the OTP was sent successfully"}}}}}}}}}},async b=>{let c=b.body.email.toLowerCase(),d=(0,l.toOTPIdentifier)("forget-password",c),e=await r(b,a,c,"forget-password");return await b.context.internalAdapter.findUserByEmail(c)?await b.context.runInBackgroundOrAwait(a.sendVerificationOTP({email:c,otp:e,type:"forget-password"},b)):await b.context.internalAdapter.deleteVerificationByIdentifier(d),b.json({success:!0})}),"resetPasswordEmailOTP",0,a=>(0,n.createAuthEndpoint)("/email-otp/reset-password",{method:"POST",body:C,metadata:{openapi:{operationId:"resetPasswordWithEmailOTP",description:"Reset password with email and OTP",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean"}}}}}}}}}},async b=>{let c=b.body.email.toLowerCase();await s(b,a,(0,l.toOTPIdentifier)("forget-password",c),b.body.otp);let d=await b.context.internalAdapter.findUserByEmail(c,{includeAccounts:!0});if(!d)throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.USER_NOT_FOUND);let e=b.context.password.config.minPasswordLength;if(b.body.password.length<e)throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.PASSWORD_TOO_SHORT);let f=b.context.password.config.maxPasswordLength;if(b.body.password.length>f)throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.PASSWORD_TOO_LONG);let g=await b.context.password.hash(b.body.password);return d.accounts?.find(a=>"credential"===a.providerId)?await b.context.internalAdapter.updatePassword(d.user.id,g):await b.context.internalAdapter.createAccount({userId:d.user.id,providerId:"credential",accountId:d.user.id,password:g}),b.context.options.emailAndPassword?.onPasswordReset&&await b.context.options.emailAndPassword.onPasswordReset({user:d.user},b.request),d.user.emailVerified||await b.context.internalAdapter.updateUser(d.user.id,{emailVerified:!0}),b.context.options.emailAndPassword?.revokeSessionsOnPasswordReset&&await b.context.internalAdapter.deleteUserSessions(d.user.id),b.json({success:!0})}),"sendVerificationOTP",0,a=>(0,n.createAuthEndpoint)("/email-otp/send-verification-otp",{method:"POST",body:u,metadata:{openapi:{operationId:"sendEmailVerificationOTP",description:"Send a verification OTP to an email",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean"}}}}}}}}}},async b=>{if(!a?.sendVerificationOTP)throw b.context.logger.error("send email verification is not implemented"),j.APIError.fromStatus("BAD_REQUEST",{message:"send email verification is not implemented"});let c=b.body.email.toLowerCase();if(!p.email().safeParse(c).success)throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.INVALID_EMAIL);if("change-email"===b.body.type)throw b.context.logger.error("Use the /email-otp/request-email-change endpoint to send OTP for changing email"),j.APIError.fromStatus("BAD_REQUEST",{message:"Invalid OTP type"});let d=(0,l.toOTPIdentifier)(b.body.type,c),e=await r(b,a,c,b.body.type),f="sign-in"===b.body.type&&!a.disableSignUp;return await b.context.internalAdapter.findUserByEmail(c)||f?await b.context.runInBackgroundOrAwait(a.sendVerificationOTP({email:c,otp:e,type:b.body.type},b)):await b.context.internalAdapter.deleteVerificationByIdentifier(d),b.json({success:!0})}),"signInEmailOTP",0,a=>(0,n.createAuthEndpoint)("/sign-in/email-otp",{method:"POST",body:z,metadata:{openapi:{operationId:"signInWithEmailOTP",description:"Sign in with email and OTP",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{token:{type:"string",description:"Session token for the authenticated session"},user:{$ref:"#/components/schemas/User"}},required:["token","user"]}}}}}}}},async b=>{let{email:c,otp:e,name:f,image:g,...i}=b.body,m=c.toLowerCase();await s(b,a,(0,l.toOTPIdentifier)("sign-in",m),e);let n=await b.context.internalAdapter.findUserByEmail(m);if(!n){if(a.disableSignUp)throw j.APIError.from("BAD_REQUEST",k.EMAIL_OTP_ERROR_CODES.INVALID_OTP);let c=(0,d.parseUserInput)(b.context.options,i,"create"),e=await b.context.internalAdapter.createUser({...c,email:m,emailVerified:!0,name:f||"",image:g}),l=await b.context.internalAdapter.createSession(e.id);return await (0,h.setSessionCookie)(b,{session:l,user:e}),b.json({token:l.token,user:(0,d.parseUserOutput)(b.context.options,e)})}n.user.emailVerified||await b.context.internalAdapter.updateUser(n.user.id,{emailVerified:!0});let o=await b.context.internalAdapter.createSession(n.user.id);return await (0,h.setSessionCookie)(b,{session:o,user:n.user}),b.json({token:o.token,user:(0,d.parseUserOutput)(b.context.options,n.user)})}),"verifyEmailOTP",0,a=>(0,n.createAuthEndpoint)("/email-otp/verify-email",{method:"POST",body:y,metadata:{openapi:{description:"Verify email with OTP",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{status:{type:"boolean",description:"Indicates if the verification was successful",enum:[!0]},token:{type:"string",nullable:!0,description:"Session token if autoSignInAfterVerification is enabled, otherwise null"},user:{$ref:"#/components/schemas/User"}},required:["status","token","user"]}}}}}}}},async b=>{let c=b.body.email.toLowerCase();if(!p.email().safeParse(c).success)throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.INVALID_EMAIL);await s(b,a,(0,l.toOTPIdentifier)("email-verification",c),b.body.otp);let e=await b.context.internalAdapter.findUserByEmail(c);if(!e)throw j.APIError.from("BAD_REQUEST",j.BASE_ERROR_CODES.USER_NOT_FOUND);b.context.options.emailVerification?.beforeEmailVerification&&await b.context.options.emailVerification.beforeEmailVerification(e.user,b.request);let f=await b.context.internalAdapter.updateUser(e.user.id,{email:c,emailVerified:!0});if(await b.context.options.emailVerification?.afterEmailVerification?.(f,b.request),b.context.options.emailVerification?.autoSignInAfterVerification){let a=await b.context.internalAdapter.createSession(f.id);return await (0,h.setSessionCookie)(b,{session:a,user:f}),b.json({status:!0,token:a.token,user:(0,d.parseUserOutput)(b.context.options,f)})}let g=await (0,i.getSessionFromCtx)(b);if(g&&f.emailVerified&&g.user.id===f.id){let a=await b.getSignedCookie(b.context.authCookies.dontRememberToken.name,b.context.secret);await (0,h.setCookieCache)(b,{session:g.session,user:{...g.user,emailVerified:!0}},!!a)}return b.json({status:!0,token:null,user:(0,d.parseUserOutput)(b.context.options,f)})})]),c()}catch(a){c(a)}},!1),445323,a=>a.a(async(b,c)=>{try{var d=a.i(186673),e=a.i(597080),f=a.i(489810),g=a.i(17715),h=a.i(208586),i=a.i(337990),j=a.i(840838),k=a.i(885030),l=a.i(596343),m=b([g,h,k,l]);[g,h,k,l]=m.then?(await m)():m;let n=a=>(0,e.generateRandomString)(a.otpLength??6,"0-9");a.s(["emailOTP",0,a=>{let b={expiresIn:300,generateOTP:()=>n(a),storeOTP:"plain",...a},c=(0,k.sendVerificationOTP)(b);return{id:"email-otp",version:f.PACKAGE_VERSION,init(a){if(b.overrideDefaultEmailVerification)return{options:{emailVerification:{async sendVerificationEmail(b,d){await a.runInBackgroundOrAwait(c({context:a,request:d,body:{email:b.user.email,type:"email-verification"},ctx:a}))}}}}},endpoints:{sendVerificationOTP:c,createVerificationOTP:(0,k.createVerificationOTP)(b),getVerificationOTP:(0,k.getVerificationOTP)(b),checkVerificationOTP:(0,k.checkVerificationOTP)(b),verifyEmailOTP:(0,k.verifyEmailOTP)(b),signInEmailOTP:(0,k.signInEmailOTP)(b),requestPasswordResetEmailOTP:(0,k.requestPasswordResetEmailOTP)(b),forgetPasswordEmailOTP:(0,k.forgetPasswordEmailOTP)(b),resetPasswordEmailOTP:(0,k.resetPasswordEmailOTP)(b),requestEmailChangeEmailOTP:(0,k.requestEmailChangeEmailOTP)(b),changeEmailEmailOTP:(0,k.changeEmailEmailOTP)(b)},hooks:{after:[{matcher:a=>!!(a.path?.startsWith("/sign-up")&&b.sendVerificationOnSignUp&&!b.overrideDefaultEmailVerification),handler:(0,l.createAuthMiddleware)(async c=>{let e=(await (0,h.getEndpointResponse)(c))?.user.email;if(e){let f=b.generateOTP({email:e,type:c.body.type},c)||n(b),g=await (0,j.storeOTP)(c,b,f);await c.context.internalAdapter.createVerificationValue({value:`${g}:0`,identifier:(0,i.toOTPIdentifier)("email-verification",e),expiresAt:(0,d.getDate)(b.expiresIn,"sec")}),await c.context.runInBackgroundOrAwait(a.sendVerificationOTP({email:e,otp:f,type:"email-verification"},c))}})}]},rateLimit:[{pathMatcher:a=>"/email-otp/send-verification-otp"===a,window:b.rateLimit?.window||60,max:b.rateLimit?.max||3},{pathMatcher:a=>"/email-otp/check-verification-otp"===a,window:b.rateLimit?.window||60,max:b.rateLimit?.max||3},{pathMatcher:a=>"/email-otp/verify-email"===a,window:b.rateLimit?.window||60,max:b.rateLimit?.max||3},{pathMatcher:a=>"/sign-in/email-otp"===a,window:b.rateLimit?.window||60,max:b.rateLimit?.max||3},{pathMatcher:a=>"/email-otp/request-password-reset"===a,window:b.rateLimit?.window||60,max:b.rateLimit?.max||3},{pathMatcher:a=>"/email-otp/reset-password"===a,window:b.rateLimit?.window||60,max:b.rateLimit?.max||3},{pathMatcher:a=>"/forget-password/email-otp"===a,window:b.rateLimit?.window||60,max:b.rateLimit?.max||3},{pathMatcher:a=>"/email-otp/request-email-change"===a,window:b.rateLimit?.window||60,max:b.rateLimit?.max||3},{pathMatcher:a=>"/email-otp/change-email"===a,window:b.rateLimit?.window||60,max:b.rateLimit?.max||3}],options:a,$ERROR_CODES:g.EMAIL_OTP_ERROR_CODES}}]),c()}catch(a){c(a)}},!1),295518,a=>a.a(async(b,c)=>{try{var d=a.i(233795),e=b([d]);[d]=e.then?(await e)():e;let f=(0,d.defineErrorCodes)({INVALID_DEVICE_CODE:"Invalid device code",EXPIRED_DEVICE_CODE:"Device code has expired",EXPIRED_USER_CODE:"User code has expired",AUTHORIZATION_PENDING:"Authorization pending",ACCESS_DENIED:"Access denied",INVALID_USER_CODE:"Invalid user code",DEVICE_CODE_ALREADY_PROCESSED:"Device code already processed",DEVICE_CODE_NOT_CLAIMED:"Device code has not been claimed by a verifying session; call `GET /device` with the `user_code` while signed in before approving or denying",POLLING_TOO_FREQUENTLY:"Polling too frequently",USER_NOT_FOUND:"User not found",FAILED_TO_CREATE_SESSION:"Failed to create session",INVALID_DEVICE_CODE_STATUS:"Invalid device code status",AUTHENTICATION_REQUIRED:"Authentication required"});a.s(["DEVICE_AUTHORIZATION_ERROR_CODES",0,f]),c()}catch(a){c(a)}},!1),859462,a=>a.a(async(b,c)=>{try{var d=a.i(584085),e=a.i(597080),f=a.i(750290),g=a.i(295518),h=a.i(815291),i=a.i(596343),j=a.i(512418),k=b([f,g,h,i]);[f,g,h,i]=k.then?(await k)():k;let l=j.object({client_id:j.string().meta({description:"The client ID of the application"}),scope:j.string().meta({description:"Space-separated list of scopes"}).optional()}),m=j.object({error:j.enum(["invalid_request","invalid_client"]).meta({description:"Error code"}),error_description:j.string().meta({description:"Detailed error description"})}),n=j.object({grant_type:j.literal("urn:ietf:params:oauth:grant-type:device_code").meta({description:"The grant type for device flow"}),device_code:j.string().meta({description:"The device verification code"}),client_id:j.string().meta({description:"The client ID of the application"})}),o=j.object({error:j.enum(["authorization_pending","slow_down","expired_token","access_denied","invalid_request","invalid_grant"]).meta({description:"Error code"}),error_description:j.string().meta({description:"Detailed error description"})}),p=(0,i.createAuthEndpoint)("/device",{method:"GET",query:j.object({user_code:j.string().meta({description:"The user code to verify"})}),error:j.object({error:j.enum(["invalid_request"]).meta({description:"Error code"}),error_description:j.string().meta({description:"Detailed error description"})}),metadata:{openapi:{description:"Verify user code and get device authorization status",responses:{200:{description:"Device authorization status",content:{"application/json":{schema:{type:"object",properties:{user_code:{type:"string",description:"The user code to verify"},status:{type:"string",enum:["pending","approved","denied"],description:"Current status of the device authorization"}}}}}}}}}},async a=>{let{user_code:b}=a.query,c=b.replace(/-/g,""),d=await a.context.adapter.findOne({model:"deviceCode",where:[{field:"userCode",value:c}]});if(!d)throw new h.APIError("BAD_REQUEST",{error:"invalid_request",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_USER_CODE.message});if(d.expiresAt<new Date)throw new h.APIError("BAD_REQUEST",{error:"expired_token",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.EXPIRED_USER_CODE.message});let e=await (0,f.getSessionFromCtx)(a);return e?.user?.id&&!d.userId&&"pending"===d.status&&await a.context.adapter.update({model:"deviceCode",where:[{field:"id",value:d.id},{field:"status",value:"pending"},{field:"userId",operator:"eq",value:null}],update:{userId:e.user.id}})&&(d.userId=e.user.id),a.json({user_code:b,status:d.status})}),q=(0,i.createAuthEndpoint)("/device/approve",{method:"POST",body:j.object({userCode:j.string().meta({description:"The user code to approve"})}),error:j.object({error:j.enum(["invalid_request","expired_token","device_code_already_processed","unauthorized","access_denied"]).meta({description:"Error code"}),error_description:j.string().meta({description:"Detailed error description"})}),requireHeaders:!0,metadata:{openapi:{description:"Approve device authorization",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean"}}}}}}}}}},async a=>{let b=await (0,f.getSessionFromCtx)(a);if(!b)throw new h.APIError("UNAUTHORIZED",{error:"unauthorized",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.AUTHENTICATION_REQUIRED.message});let{userCode:c}=a.body,d=c.replace(/-/g,""),e=await a.context.adapter.findOne({model:"deviceCode",where:[{field:"userCode",value:d}]});if(!e)throw new h.APIError("BAD_REQUEST",{error:"invalid_request",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_USER_CODE.message});if(e.expiresAt<new Date)throw new h.APIError("BAD_REQUEST",{error:"expired_token",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.EXPIRED_USER_CODE.message});if("pending"!==e.status)throw new h.APIError("BAD_REQUEST",{error:"invalid_request",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.DEVICE_CODE_ALREADY_PROCESSED.message});if(!e.userId)throw new h.APIError("BAD_REQUEST",{error:"invalid_request",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.DEVICE_CODE_NOT_CLAIMED.message});if(e.userId!==b.user.id)throw new h.APIError("FORBIDDEN",{error:"access_denied",error_description:"You are not authorized to approve this device authorization"});return await a.context.adapter.update({model:"deviceCode",where:[{field:"id",value:e.id}],update:{status:"approved",userId:b.user.id}}),a.json({success:!0})}),r=(0,i.createAuthEndpoint)("/device/deny",{method:"POST",body:j.object({userCode:j.string().meta({description:"The user code to deny"})}),error:j.object({error:j.enum(["invalid_request","expired_token","unauthorized","access_denied"]).meta({description:"Error code"}),error_description:j.string().meta({description:"Detailed error description"})}),requireHeaders:!0,metadata:{openapi:{description:"Deny device authorization",responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{success:{type:"boolean"}}}}}}}}}},async a=>{let b=await (0,f.getSessionFromCtx)(a);if(!b)throw new h.APIError("UNAUTHORIZED",{error:"unauthorized",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.AUTHENTICATION_REQUIRED.message});let{userCode:c}=a.body,d=c.replace(/-/g,""),e=await a.context.adapter.findOne({model:"deviceCode",where:[{field:"userCode",value:d}]});if(!e)throw new h.APIError("BAD_REQUEST",{error:"invalid_request",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_USER_CODE.message});if(e.expiresAt<new Date)throw new h.APIError("BAD_REQUEST",{error:"expired_token",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.EXPIRED_USER_CODE.message});if("pending"!==e.status)throw new h.APIError("BAD_REQUEST",{error:"invalid_request",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.DEVICE_CODE_ALREADY_PROCESSED.message});if(!e.userId)throw new h.APIError("BAD_REQUEST",{error:"invalid_request",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.DEVICE_CODE_NOT_CLAIMED.message});if(e.userId!==b.user.id)throw new h.APIError("FORBIDDEN",{error:"access_denied",error_description:"You are not authorized to deny this device authorization"});return await a.context.adapter.update({model:"deviceCode",where:[{field:"id",value:e.id}],update:{status:"denied",userId:b.user.id}}),a.json({success:!0})});a.s(["deviceApprove",0,q,"deviceCode",0,a=>{let b=async()=>{let b;return a.generateDeviceCode?a.generateDeviceCode():(b=a.deviceCodeLength,(0,e.generateRandomString)(b,"a-z","A-Z","0-9"))},c=async()=>{var b;let c;return a.generateUserCode?a.generateUserCode():(b=a.userCodeLength,c=new Uint8Array(b),Array.from(crypto.getRandomValues(c)).map(a=>"ABCDEFGHJKLMNPQRSTUVWXYZ23456789"[a%32]).join(""))};return(0,i.createAuthEndpoint)("/device/code",{method:"POST",body:l,error:m,metadata:{openapi:{description:`Request a device and user code
+Follow [rfc8628#section-3.2](https://datatracker.ietf.org/doc/html/rfc8628#section-3.2)`,responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{device_code:{type:"string",description:"The device verification code"},user_code:{type:"string",description:"The user code to display"},verification_uri:{type:"string",format:"uri",description:"The URL for user verification. Defaults to /device if not configured."},verification_uri_complete:{type:"string",format:"uri",description:"The complete URL with user code as query parameter."},expires_in:{type:"number",description:"Lifetime in seconds of the device code"},interval:{type:"number",description:"Minimum polling interval in seconds"}}}}}},400:{description:"Error response",content:{"application/json":{schema:{type:"object",properties:{error:{type:"string",enum:["invalid_request","invalid_client"]},error_description:{type:"string"}}}}}}}}}},async e=>{if(a.validateClient&&!await a.validateClient(e.body.client_id))throw new h.APIError("BAD_REQUEST",{error:"invalid_client",error_description:"Invalid client ID"});a.onDeviceAuthRequest&&await a.onDeviceAuthRequest(e.body.client_id,e.body.scope);let f=await b(),g=await c(),i=(0,d.ms)(a.expiresIn),j=new Date(Date.now()+i);await e.context.adapter.create({model:"deviceCode",data:{deviceCode:f,userCode:g,userId:null,expiresAt:j,status:"pending",pollingInterval:(0,d.ms)(a.interval),clientId:e.body.client_id,scope:e.body.scope}});let{verificationUri:k,verificationUriComplete:l}=((a,b,c)=>{let d,e=a||"/device";try{d=new URL(e)}catch{d=new URL(e,b)}let f=new URL(d);return f.searchParams.set("user_code",c),{verificationUri:d.toString(),verificationUriComplete:f.toString()}})(a.verificationUri,e.context.baseURL,g);return e.json({device_code:f,user_code:g,verification_uri:k,verification_uri_complete:l,expires_in:Math.floor(i/1e3),interval:Math.floor((0,d.ms)(a.interval)/1e3)},{headers:{"Cache-Control":"no-store"}})})},"deviceDeny",0,r,"deviceToken",0,a=>(0,i.createAuthEndpoint)("/device/token",{method:"POST",body:n,error:o,metadata:{openapi:{description:`Exchange device code for access token
+Follow [rfc8628#section-3.4](https://datatracker.ietf.org/doc/html/rfc8628#section-3.4)`,responses:{200:{description:"Success",content:{"application/json":{schema:{type:"object",properties:{session:{$ref:"#/components/schemas/Session"},user:{$ref:"#/components/schemas/User"}}}}}},400:{description:"Error response",content:{"application/json":{schema:{type:"object",properties:{error:{type:"string",enum:["authorization_pending","slow_down","expired_token","access_denied","invalid_request","invalid_grant"]},error_description:{type:"string"}}}}}}}}}},async b=>{let{device_code:c,client_id:d}=b.body;if(a.validateClient&&!await a.validateClient(d))throw new h.APIError("BAD_REQUEST",{error:"invalid_grant",error_description:"Invalid client ID"});let e=await b.context.adapter.findOne({model:"deviceCode",where:[{field:"deviceCode",value:c}]});if(!e)throw new h.APIError("BAD_REQUEST",{error:"invalid_grant",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_DEVICE_CODE.message});if(e.clientId&&e.clientId!==d)throw new h.APIError("BAD_REQUEST",{error:"invalid_grant",error_description:"Client ID mismatch"});if(e.lastPolledAt&&e.pollingInterval&&Date.now()-new Date(e.lastPolledAt).getTime()<e.pollingInterval)throw new h.APIError("BAD_REQUEST",{error:"slow_down",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.POLLING_TOO_FREQUENTLY.message});if(await b.context.adapter.update({model:"deviceCode",where:[{field:"id",value:e.id}],update:{lastPolledAt:new Date}}),e.expiresAt<new Date)throw await b.context.adapter.delete({model:"deviceCode",where:[{field:"id",value:e.id}]}),new h.APIError("BAD_REQUEST",{error:"expired_token",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.EXPIRED_DEVICE_CODE.message});if("pending"===e.status)throw new h.APIError("BAD_REQUEST",{error:"authorization_pending",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.AUTHORIZATION_PENDING.message});if("denied"===e.status)throw await b.context.adapter.delete({model:"deviceCode",where:[{field:"id",value:e.id}]}),new h.APIError("BAD_REQUEST",{error:"access_denied",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.ACCESS_DENIED.message});if("approved"===e.status&&e.userId){let a=await b.context.adapter.consumeOne({model:"deviceCode",where:[{field:"deviceCode",value:c},{field:"status",value:"approved"}]});if(!a?.userId)throw new h.APIError("BAD_REQUEST",{error:"invalid_grant",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_DEVICE_CODE.message});let d=await b.context.internalAdapter.findUserById(a.userId);if(!d)throw new h.APIError("INTERNAL_SERVER_ERROR",{error:"server_error",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.USER_NOT_FOUND.message});let e=await b.context.internalAdapter.createSession(d.id);if(!e)throw new h.APIError("INTERNAL_SERVER_ERROR",{error:"server_error",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.FAILED_TO_CREATE_SESSION.message});return b.context.setNewSession({session:e,user:d}),b.context.options.secondaryStorage&&await b.context.secondaryStorage?.set(e.token,JSON.stringify({user:d,session:e}),Math.floor((new Date(e.expiresAt).getTime()-Date.now())/1e3)),b.json({access_token:e.token,token_type:"Bearer",expires_in:Math.floor((new Date(e.expiresAt).getTime()-Date.now())/1e3),scope:a.scope||""},{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}throw new h.APIError("INTERNAL_SERVER_ERROR",{error:"server_error",error_description:g.DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_DEVICE_CODE_STATUS.message})}),"deviceVerify",0,p]),c()}catch(a){c(a)}},!1),641382,a=>{"use strict";var b=a.i(512418);b.object({id:b.string(),deviceCode:b.string(),userCode:b.string(),userId:b.string().optional(),expiresAt:b.date(),status:b.string(),lastPolledAt:b.date().optional(),pollingInterval:b.number().optional(),clientId:b.string().optional(),scope:b.string().optional()}),a.s(["schema",0,{deviceCode:{fields:{deviceCode:{type:"string",required:!0},userCode:{type:"string",required:!0},userId:{type:"string",required:!1},expiresAt:{type:"date",required:!0},status:{type:"string",required:!0},lastPolledAt:{type:"date",required:!1},pollingInterval:{type:"number",required:!1},clientId:{type:"string",required:!1},scope:{type:"string",required:!1}}}}])},700102,a=>a.a(async(b,c)=>{try{var d=a.i(704551),e=a.i(584085),f=a.i(489810),g=a.i(295518),h=a.i(859462),i=a.i(641382),j=a.i(512418),k=b([d,g,h]);[d,g,h]=k.then?(await k)():k;let l=j.custom(a=>{if("string"!=typeof a)return!1;try{return(0,e.ms)(a),!0}catch{return!1}},{message:"Invalid time string format. Use formats like '30m', '5s', '1h', etc."}),m=j.object({expiresIn:l.default("30m").describe("Time in seconds until the device code expires. Use formats like '30m', '5s', '1h', etc."),interval:l.default("5s").describe("Time in seconds between polling attempts. Use formats like '30m', '5s', '1h', etc."),deviceCodeLength:j.number().int().positive().default(40).describe("Length of the device code to be generated. Default is 40 characters."),userCodeLength:j.number().int().positive().default(8).describe("Length of the user code to be generated. Default is 8 characters."),generateDeviceCode:j.custom(a=>"function"==typeof a,{message:"generateDeviceCode must be a function that returns a string or a promise that resolves to a string."}).optional().describe("Function to generate a device code. If not provided, a default random string generator will be used."),generateUserCode:j.custom(a=>"function"==typeof a,{message:"generateUserCode must be a function that returns a string or a promise that resolves to a string."}).optional().describe("Function to generate a user code. If not provided, a default random string generator will be used."),validateClient:j.custom(a=>"function"==typeof a,{message:"validateClient must be a function that returns a boolean or a promise that resolves to a boolean."}).optional().describe("Function to validate the client ID. If not provided, no validation will be performed."),onDeviceAuthRequest:j.custom(a=>"function"==typeof a,{message:"onDeviceAuthRequest must be a function that returns void or a promise that resolves to void."}).optional().describe("Function to handle device authorization requests. If not provided, no additional actions will be taken."),verificationUri:j.string().optional().describe("The URI where users verify their device code. Can be an absolute URL (https://example.com/device) or relative path (/custom-path). This will be returned as verification_uri in the device code response. If not provided, defaults to /device."),schema:j.custom(()=>!0)});a.s(["deviceAuthorization",0,(a={})=>{let b=m.parse(a);return{id:"device-authorization",version:f.PACKAGE_VERSION,schema:(0,d.mergeSchema)(i.schema,a?.schema),endpoints:{deviceCode:(0,h.deviceCode)(b),deviceToken:(0,h.deviceToken)(b),deviceVerify:h.deviceVerify,deviceApprove:h.deviceApprove,deviceDeny:h.deviceDeny},$ERROR_CODES:g.DEVICE_AUTHORIZATION_ERROR_CODES,options:a}}]),c()}catch(a){c(a)}},!1),112920,a=>a.a(async(b,c)=>{try{var d=a.i(583048),e=a.i(489810);a.i(798811);var f=a.i(616448),g=a.i(596343),h=a.i(958228),i=b([g]);function j(a){try{return decodeURIComponent(a)}catch{return a}}[g]=i.then?(await i)():i,a.s(["bearer",0,a=>({id:"bearer",version:e.PACKAGE_VERSION,hooks:{before:[{matcher:a=>!!(a.request?.headers.get("authorization")||a.headers?.get("authorization")),handler:(0,g.createAuthMiddleware)(async b=>{let c,e=b.request?.headers.get("authorization")||b.headers?.get("Authorization");if(!e||"bearer "!==e.slice(0,7).toLowerCase())return;let g=e.slice(7).trim();if(!g)return;if(g.includes("."))c=g.includes("%")?j(g):g;else{if(a?.requireSignature)return;c=j((await (0,f.serializeSignedCookie)("",g,b.context.secret)).replace("=",""))}try{if(!await (0,h.createHMAC)("SHA-256","base64urlnopad").verify(b.context.secret,c.split(".")[0],c.split(".")[1]))return}catch{return}let i=b.request?.headers||b.headers,k=new Headers({...Object.fromEntries(i?.entries())});return(0,d.setRequestCookie)(k,b.context.authCookies.sessionToken.name,c),{context:{headers:k}}})}],after:[{matcher:a=>!0,handler:(0,g.createAuthMiddleware)(async a=>{let b=a.context.responseHeaders?.get("set-cookie");if(!b)return;let c=(0,d.parseSetCookieHeader)(b),e=a.context.authCookies.sessionToken.name,f=c.get(e);if(!f||!f.value||0===f["max-age"])return;let g=f.value,h=a.context.responseHeaders?.get("access-control-expose-headers")||"",i=new Set(h.split(",").map(a=>a.trim()).filter(Boolean));i.add("set-auth-token"),a.setHeader("set-auth-token",g),a.setHeader("Access-Control-Expose-Headers",Array.from(i).join(", "))})}]},options:a})]),c()}catch(a){c(a)}},!1),25131,a=>{"use strict";let b={debug:0,info:1,warn:2,error:3,silent:4};class c{service;level;pretty;fields;constructor(a,c){this.service=a.service,this.level=b[a.level??"info"],this.pretty=a.pretty??!1,this.fields=c??{}}debug(a,b){this.write("debug",a,b)}info(a,b){this.write("info",a,b)}warn(a,b){this.write("warn",a,b)}error(a,b){this.write("error",a,b)}child(a){let b={...this.fields,...a};return new c({service:this.service,level:this.levelName(),pretty:this.pretty},b)}levelName(){for(let[a,c]of Object.entries(b))if(c===this.level)return a;return"info"}write(a,c,d){let e;if(b[a]<this.level)return;let f={level:a,msg:c,service:this.service,...this.fields,...d,ts:new Date().toISOString()};for(let[a,b]of Object.entries(f))b instanceof Error&&(f[a]={message:b.message,stack:b.stack});if(this.pretty){let a=f.ts.replace("T"," ").replace("Z",""),b=f.level.toUpperCase().padEnd(5),c=Object.entries(f).filter(([a])=>"level"!==a&&"msg"!==a&&"service"!==a&&"ts"!==a).map(([a,b])=>`${a}=${"object"==typeof b?JSON.stringify(b):b}`).join(" ");e=`${a} ${b} [${f.service}] ${f.msg}${c?" "+c:""}`}else e=JSON.stringify(f);"error"===a?console.error(e):console.log(e)}}a.s(["createLogger",0,function(a){return new c(a)}])},8574,a=>{"use strict";let b={"sign-in":"Your Alook sign-in code","email-verification":"Verify your Alook email","forget-password":"Reset your Alook password","change-email":"Confirm your new email address"},c={"sign-in":"Sign in to Alook","email-verification":"Verify your email","forget-password":"Reset your password","change-email":"Confirm email change"},d={"sign-in":"Enter this code to sign in to your account.","email-verification":"Enter this code to verify your email address.","forget-password":"Enter this code to reset your password.","change-email":"Enter this code to confirm your new email address."};a.s(["getOtpSubject",0,function(a){return b[a]},"renderOtpEmail",0,function(a,b){let e=c[b],f=d[b];return`<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>${e}</title>
+</head>
+<body style="margin:0;padding:0;background-color:#f5f3f0;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">
+<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background-color:#f5f3f0;padding:40px 20px;">
+<tr><td align="center">
+<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:440px;background-color:#ffffff;border-radius:8px;padding:40px 36px;box-shadow:0 1px 3px rgba(0,0,0,0.06);">
+<tr><td>
+  <p style="margin:0 0 8px;font-size:14px;font-weight:600;color:#8c7e6f;letter-spacing:0.04em;text-transform:uppercase;">Alook</p>
+  <h1 style="margin:0 0 12px;font-size:22px;font-weight:600;color:#2c2825;line-height:1.3;">${e}</h1>
+  <p style="margin:0 0 28px;font-size:15px;color:#6b6057;line-height:1.5;">${f}</p>
+  <div style="background-color:#faf8f6;border:1px solid #ebe7e2;border-radius:6px;padding:20px;text-align:center;margin:0 0 28px;">
+    <span style="font-size:32px;font-weight:700;letter-spacing:0.2em;color:#2c2825;font-family:'SF Mono',SFMono-Regular,Consolas,'Liberation Mono',Menlo,Courier,monospace;">${a}</span>
+  </div>
+  <p style="margin:0;font-size:13px;color:#9b9189;line-height:1.5;">This code expires in 5 minutes. If you didn't request this, you can safely ignore this email.</p>
+</td></tr>
+</table>
+</td></tr>
+</table>
+</body>
+</html>`}])},799732,a=>a.a(async(b,c)=>{try{var d=a.i(180925),e=a.i(445323),f=a.i(700102),g=a.i(112920);a.i(250195);var h=a.i(25131),i=a.i(681532),j=a.i(731875),k=a.i(8574),l=b([d,e,f,g]);[d,e,f,g]=l.then?(await l)():l;let n=(0,h.createLogger)({service:"auth"});function m(a,b){if(!a)return b;let c=Number.parseInt(a,10);return Number.isFinite(c)&&c>0?c:b}a.s(["createAuth",0,function(a){let b=(0,j.resolveMode)({nodeEnv:a.NODE_ENV??"production"}),c="production"===b,h=m(a.AUTH_OTP_RATE_LIMIT_MAX,5),l=m(a.AUTH_OTP_RATE_LIMIT_WINDOW_SEC,60),o=Math.max(60,l),p=b=>(a.DEVICE_CLIENT_IDS||"").split(",").map(a=>a.trim()).filter(Boolean).includes(b);return(0,d.betterAuth)({baseURL:a.BETTER_AUTH_URL,database:a.DB,secret:a.BETTER_AUTH_SECRET,session:{expiresIn:2592e3,updateAge:86400,cookieCache:{enabled:!0,maxAge:300}},emailAndPassword:{enabled:!c,requireEmailVerification:!1},socialProviders:{github:{clientId:a.GITHUB_CLIENT_ID,clientSecret:a.GITHUB_CLIENT_SECRET},google:{clientId:a.GOOGLE_CLIENT_ID,clientSecret:a.GOOGLE_CLIENT_SECRET}},rateLimit:{enabled:c,customRules:{"/email-otp/send-verification-otp":{window:l,max:h}},customStorage:{get:async b=>{let c=await a.RATE_LIMIT_KV.get(b);return c?JSON.parse(c):void 0},set:async(b,c)=>{await a.RATE_LIMIT_KV.put(b,JSON.stringify(c),{expirationTtl:o})}}},databaseHooks:{user:{create:{after:async(a,b)=>{if(!b)return;let d=b.request?.url?new URL(b.request.url).pathname:"",e="unknown";d.includes("email-otp")?e="email":d.includes("github")?e="github":d.includes("google")&&(e="google"),b.setCookie("is_new_signup",e,{maxAge:60,path:"/",httpOnly:!1,secure:c,sameSite:"lax"})}}},session:{create:{after:async(a,b)=>{if(!b||b.getCookie("is_new_signup"))return;let d=b.request?.url?new URL(b.request.url).pathname:"",e="unknown";d.includes("email-otp")?e="email_otp":d.includes("github")?e="github":d.includes("google")&&(e="google"),b.setCookie("is_sign_in",e,{maxAge:60,path:"/",httpOnly:!1,secure:c,sameSite:"lax"})}}}},plugins:c?[(0,f.deviceAuthorization)({verificationUri:"/device",validateClient:p,expiresIn:"5m",schema:{}}),(0,g.bearer)(),(0,e.emailOTP)({async sendVerificationOTP({email:b,otp:c,type:d}){n.info("sending OTP email",{to:b,type:d});try{let e,f=JSON.stringify({to:b,subject:(0,k.getOtpSubject)(d),html:(0,k.renderOtpEmail)(c,d)}),g={method:"POST",headers:{"Content-Type":"application/json"},body:f};try{e=await a.EMAIL_WORKER.fetch("http://internal/send/otp",g)}catch{e=await fetch(`${i.DEV_EMAIL_WORKER_URL}/send/otp`,g)}if(!e.ok){let a=await e.text();throw Error(`EMAIL_WORKER /send/otp failed: ${e.status} ${a}`)}n.info("OTP email sent",{to:b,type:d})}catch(a){throw n.error("OTP email failed",{to:b,type:d,err:a}),a}}})]:[(0,f.deviceAuthorization)({verificationUri:"/device",validateClient:p,expiresIn:"5m",schema:{}}),(0,g.bearer)()]})}]),c()}catch(a){c(a)}},!1),678327,a=>a.a(async(b,c)=>{try{var d=a.i(353675),e=a.i(665620),f=a.i(799732),g=b([f]);async function h(){let{env:a}=await (0,e.getCloudflareContext)({async:!0});return(0,f.createAuth)(a).api.getSession({headers:await (0,d.headers)()})}async function i(){let a=await h();if(!a)throw Error("Unauthorized");return a}[f]=g.then?(await g)():g,a.s(["getSession",0,h,"requireSession",0,i]),c()}catch(a){c(a)}},!1)];
+//# sourceMappingURL=_1t_zwti._.js.map