@aotter/mantle 0.1.5-alpha.1 → 0.2.0-alpha.2

package/dist/auth/createAuthRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createAuthRoutes.js","sourceRoot":"","sources":["../../src/auth/createAuthRoutes.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAenD,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,mBAAmB,EAAE,CAAC;AACzD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,yBAAyB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAClG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,qBAAqB,EAAE,0BAA0B,EAAE,6BAA6B,CAAC,CAAC,CAAC;AAC7G,MAAM,UAAU,GAAG,8EAA8E,CAAC;AAElG,qFAAqF;AACrF,MAAM,UAAU,gBAAgB,CAAC,IAAoB,EAAE,OAA0B;IAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,GAAG,IAAI,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9J,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxG,sHAAsH;QACtH,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpI,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAoB,EAAE,OAA0B;IACtE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACrE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;QAC/B,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QACjG,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAE/F,IAAI,KAAK,KAAK,yBAAyB,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YACxF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,4CAA4C;YACxH,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,KAAK,KAAK,qBAAqB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,QAAQ,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACpF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC3D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,MAAM;gBAAE,OAAO,IAAI,QAAQ,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACpH,mHAAmH;YACnH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3H,MAAM,MAAM,GAAG,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7E,IAAI,CAAC,MAAM,IAAI,qCAAqC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,QAAQ,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAClJ,2FAA2F;YAC3F,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACxE,IAAI,KAAK,KAAK,qBAAqB,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,iBAAiB;gBAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;YAC5H,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,QAAQ,CAAC,oCAAoC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1G,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,KAAK,KAAK,0BAA0B,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YACvF,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,KAAK,KAAK,6BAA6B,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,QAAQ,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACpF,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACvE,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;gBAAE,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACzF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC;AACJ,CAAC;AAED,6HAA6H;AAE7H;;;GAGG;AACH,SAAS,IAAI,CAAC,IAAY,EAAE,MAAc;IACxC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,GAAG,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,aAAa,EAAE,wBAAwB,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM;YACxJ,yBAAyB,EAAE,2GAA2G;SACvI;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,GAAG;IACR,EAAE,EAAE;QACF,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,OAAO,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG;QACzG,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,8HAA8H;QACvJ,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,+BAA+B,EAAE,WAAW,EAAE,gFAAgF;QAChO,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,sHAAsH,EAAE,KAAK,EAAE,+BAA+B,EAAE,MAAM,EAAE,YAAY;KACxN;IACD,OAAO,EAAE;QACP,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK;QAC7F,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,iDAAiD;QAC1E,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,6BAA6B;QAC9H,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,2CAA2C,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM;KAClH;CACO,CAAC;AAGX,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACjF,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE,CACtD,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,6GAA6G,KAAK,UAAU;IACnK,8PAA8P,IAAI,uBAAuB,CAAC;AAE5R,SAAS,WAAW,CAAC,CAAS,EAAE,KAAiC;IAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACf,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC;IACvG,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrC,0FAA0F;IAC1F,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IAC1I,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAChG,MAAM,CAAC,CAAC,SAAS,UAAU,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,WAAW,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,mDAAmD;QAChM,kDAAkD,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,4DAA4D,CAAC,CAAC,OAAO,YAAY;QACxJ,sDAAsD,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,QAAqC;IACzE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACf,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5E,gBAAgB,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,6DAA6D;QAC3H,iDAAiD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,MAAM,4BAA4B,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvI,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,QAAQ,OAAO,IAAI,EAAE,CAAC,CAAC;AAC1E,CAAC"}

package/dist/auth/createMantleAuth.d.ts

@@ -0,0 +1,3 @@
+import { type CreateMantleAuthOptions, type MantleAuth } from "./types.js";
+export declare function createMantleAuth(config: CreateMantleAuthOptions): MantleAuth;
+//# sourceMappingURL=createMantleAuth.d.ts.map

package/dist/auth/createMantleAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createMantleAuth.d.ts","sourceRoot":"","sources":["../../src/auth/createMantleAuth.ts"],"names":[],"mappings":"AAWA,OAAO,EAAuB,KAAK,uBAAuB,EAAE,KAAK,UAAU,EAAkB,MAAM,YAAY,CAAC;AAIhH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,uBAAuB,GAAG,UAAU,CAse5E"}

package/dist/auth/createMantleAuth.js

@@ -0,0 +1,508 @@
+import { getMigrations } from "better-auth/db/migration";
+import { createDpopReplayStore } from "better-auth/oauth2";
+import { decodeMemberCursor, encodeMemberCursor } from "../admin/consent.js";
+import { STAFF_ROLES } from "../spec/domain/index.js";
+import { dbOf } from "./db.js";
+import { staffInvitationEmail } from "./emailTemplates.js";
+import { backgroundTaskRetention, buildAuth } from "./buildAuth.js";
+import { normalizeAuthBasePath, normalizeAuthResponseCookies } from "./methods.js";
+import { assertActiveUserGrant, getProviderAccessTokenForRequest, mapRegisteredOAuthClient, parseStoredStringArray, verifyOAuthJwt, verifyOAuthJwtWithLocalJwks } from "./oauthTokens.js";
+import { STAFF_ROLE_SET } from "./types.js";
+const LEGACY_DCR_TTL_MS = 90 * 24 * 60 * 60 * 1_000;
+const LEGACY_DCR_CLEANUP_INTERVAL_MS = 60 * 60 * 1_000;
+export function createMantleAuth(config) {
+    const db = dbOf(config.driver);
+    const auth = buildAuth(config);
+    const ready = auth.$context.then(() => undefined);
+    // Observe eager initialization even for low-level callers; keep the original
+    // rejection available to callers awaiting ready and Better Auth's handlers.
+    void ready.catch(() => { });
+    // Auth owns its schema even when content uses a different semantic store.
+    // Keep schema work lazy: static/plan-only routes must not prepare tables.
+    let schemaReady = null;
+    const prepareAuth = () => schemaReady ??= (async () => {
+        // Better Auth converges its own tables on whatever engine it speaks; the role index is the one Mantle adds. A database that
+        // already holds this schema (its digest in Mantle's boot state) skips the introspection, so a warm isolate reads one row.
+        const context = await auth.$context;
+        const digest = Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify(context.tables)))), (b) => b.toString(16).padStart(2, "0")).join("");
+        const done = await db.first("SELECT value FROM _mantle_boot_state WHERE key = 'auth-schema'").catch(() => null);
+        if (done?.value === digest)
+            return;
+        const migrate = async () => (await getMigrations(context.options)).runMigrations();
+        // Better Auth's statements are not idempotent: an isolate racing another retries until the other has finished its tables
+        for (let attempt = 1;; attempt++) {
+            try {
+                await migrate();
+                break;
+            }
+            catch (error) {
+                if (attempt === 5)
+                    throw error;
+                await new Promise((r) => setTimeout(r, 50 * attempt));
+            }
+        }
+        await db.batch([{ sql: 'CREATE INDEX IF NOT EXISTS user_role_idx ON "user" (role) WHERE role IS NOT NULL' }]);
+        // a store Mantle has not converged has no boot state: the next isolate introspects again
+        await db.batch([{ sql: "INSERT INTO _mantle_boot_state (key, value) VALUES ('auth-schema', ?) ON CONFLICT (key) DO UPDATE SET value = excluded.value", binds: [digest] }]).catch(() => undefined);
+    })().catch(error => { schemaReady = null; throw error; });
+    const basePath = normalizeAuthBasePath(config.basePath);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const api = auth.api;
+    const localJwksCacheKey = {};
+    let dpopReplayStore = null;
+    const getDpopReplayStore = async () => {
+        if (dpopReplayStore)
+            return dpopReplayStore;
+        const context = await auth.$context;
+        dpopReplayStore = createDpopReplayStore(context.internalAdapter);
+        return dpopReplayStore;
+    };
+    const verifyAccessToken = config.oauthProvider
+        ? async (token, audience) => {
+            await prepareAuth();
+            const context = await auth.$context;
+            const claims = await verifyOAuthJwtWithLocalJwks(token, audience, context.baseURL, async () => api.getJwks(), localJwksCacheKey);
+            if (config.oauthProvider?.mcpResource && (audience === config.oauthProvider.mcpResource || config.oauthProvider.resources?.includes(audience))) {
+                await assertActiveUserGrant(config.driver, claims, audience);
+            }
+            return claims;
+        }
+        : null;
+    let nextDcrCleanupAt = 0;
+    const pruneExpiredDynamicClients = async () => {
+        const now = Date.now();
+        if (!config.oauthProvider?.mcpResource || now < nextDcrCleanupAt)
+            return;
+        // Set before awaiting so concurrent OAuth requests do not fan out writes.
+        nextDcrCleanupAt = now + LEGACY_DCR_CLEANUP_INTERVAL_MS;
+        try {
+            await db.batch([{ sql: 'DELETE FROM "oauthClient" WHERE "clientDiscoveryId" IS NULL AND "userId" IS NULL AND "referenceId" IS NULL AND "createdAt" < ?', binds: [new Date(now - LEGACY_DCR_TTL_MS).toISOString()] }]);
+        }
+        catch (error) {
+            // Cleanup is bounded storage hygiene, not an authorization decision.
+            console.error("[better-auth] legacy DCR cleanup failed", error);
+        }
+    };
+    const readUserRole = async (userId) => {
+        await prepareAuth();
+        const row = await db.first('SELECT role FROM "user" WHERE id = ? LIMIT 1', userId);
+        return row?.role ?? null;
+    };
+    // A session user is a fresh database read unless a KV session cache or a
+    // cookie cache serves it; a cached snapshot only follows cache propagation.
+    // Plugins merge their `init` options into the context, not `auth.options`.
+    let cachedSessions;
+    const sessionsAreCached = () => cachedSessions ??= config.sessionCache
+        ? Promise.resolve(true)
+        : auth.$context.then((context) => Boolean(context.options.session?.cookieCache?.enabled));
+    return {
+        basePath,
+        ready,
+        ...(config.oauthProvider?.mcpResource
+            ? { mcpResource: config.oauthProvider.mcpResource }
+            : {}),
+        handler: (request, context) => {
+            const serve = async () => {
+                await prepareAuth();
+                const pathname = new URL(request.url).pathname;
+                if (pathname.startsWith(`${basePath}/oauth2/`)) {
+                    await pruneExpiredDynamicClients();
+                }
+                // Better Auth's admin endpoints authorize from the session snapshot.
+                // Refuse them while that snapshot's role disagrees with the database.
+                if (pathname.startsWith(`${basePath}/admin/`) && await sessionsAreCached()) {
+                    let session;
+                    try {
+                        // Read the snapshot the admin middleware will authorize from (it skips the cookie cache).
+                        session = await api.getSession({ headers: request.headers, query: { disableCookieCache: true } });
+                    }
+                    catch {
+                        return Response.json({ code: "SERVICE_UNAVAILABLE", message: "Could not verify the staff role." }, { status: 503 });
+                    }
+                    if (session && (session.user.role ?? null) !== await readUserRole(session.user.id)) {
+                        return Response.json({ code: "FORBIDDEN", message: "Staff role changed; sign in again." }, { status: 403 });
+                    }
+                }
+                const registration = request.method === "POST" && pathname === `${basePath}/oauth2/register` ? await loopbackClientsAreNative(request) : request;
+                return normalizeAuthResponseCookies(await auth.handler(registration));
+            };
+            const retain = context?.waitUntil;
+            return retain ? backgroundTaskRetention.run(retain, serve) : serve();
+        },
+        getSession: async (request) => {
+            let session;
+            try {
+                session = await api.getSession({ headers: request.headers });
+            }
+            catch {
+                // Existing sessions resolve from KV without paying the schema-ledger read.
+                // A fresh database with a stale cookie prepares once, then retries safely.
+                await prepareAuth();
+                session = await api.getSession({ headers: request.headers });
+            }
+            // A cached snapshot never vouches for a staff role, so callers re-read it
+            // and a demoted user is locked out immediately (ADR-0014 §5). A cached
+            // non-staff role may be trusted: at worst a fresh promotion waits for
+            // the cache, which fails closed.
+            const role = session?.user?.role;
+            return session
+                ? {
+                    ...session,
+                    // a session read back from the session cache carries its dates as strings
+                    session: { ...session.session, createdAt: new Date(session.session.createdAt), expiresAt: new Date(session.session.expiresAt) },
+                    user: {
+                        ...session.user,
+                        ...(Object.hasOwn(session.user, "role") && (!await sessionsAreCached() || !STAFF_ROLE_SET.has(role ?? ""))
+                            ? { roleCurrent: true }
+                            : {}),
+                    },
+                }
+                : null;
+        },
+        getUserRole: readUserRole,
+        getUser: async (userId) => {
+            await prepareAuth();
+            const row = await db.first('SELECT id, email, name, image, role, "githubLogin", "emailVerified", "createdAt" FROM "user" WHERE id = ? LIMIT 1', userId);
+            if (!row)
+                return null;
+            const createdAt = new Date(row.createdAt);
+            if (Number.isNaN(createdAt.getTime())) {
+                throw new Error("Auth user row has an invalid createdAt timestamp.");
+            }
+            return {
+                id: row.id,
+                email: row.email,
+                name: row.name,
+                image: row.image,
+                role: row.role,
+                githubLogin: row.githubLogin,
+                emailVerified: Boolean(row.emailVerified),
+                createdAt,
+            };
+        },
+        getProviderAccessToken: async (request, providerId) => {
+            await prepareAuth();
+            const session = await api.getSession({ headers: request.headers });
+            const userId = session?.user?.id;
+            const account = userId
+                ? await db.first('SELECT id FROM account WHERE "userId" = ? AND "providerId" = ? LIMIT 1', userId, providerId)
+                : null;
+            if (!account) {
+                throw new Error(`getProviderAccessToken: provider '${providerId}' is not linked to the current user.`);
+            }
+            return getProviderAccessTokenForRequest(api, request, account.id, providerId);
+        },
+        verifyOAuthAccessToken: async (tokenOrRequest, options) => {
+            return verifyOAuthJwt(tokenOrRequest, options, verifyAccessToken, getDpopReplayStore);
+        },
+        getOAuthConsentRequest: async (request) => {
+            if (!config.oauthProvider)
+                return null;
+            const url = new URL(request.url);
+            const clientId = url.searchParams.get("client_id");
+            if (!clientId || !url.search)
+                return null;
+            await prepareAuth();
+            const oauthQuery = url.search.slice(1);
+            const client = await api.getOAuthClientPublicPrelogin({
+                headers: request.headers,
+                body: { client_id: clientId, oauth_query: oauthQuery },
+            });
+            const redirectUri = url.searchParams.get("redirect_uri") ??
+                (Array.isArray(client?.redirect_uris) &&
+                    typeof client.redirect_uris[0] === "string"
+                    ? client.redirect_uris[0]
+                    : "");
+            return {
+                clientName: typeof client?.client_name === "string"
+                    ? client.client_name
+                    : clientId,
+                redirectUri,
+                scopes: (url.searchParams.get("scope") ?? "")
+                    .split(/\s+/u)
+                    .filter(Boolean),
+                oauthQuery,
+            };
+        },
+        completeOAuthConsent: async (request, accept) => {
+            if (!config.oauthProvider) {
+                throw new Error("completeOAuthConsent: oauthProvider is not configured.");
+            }
+            const form = await request.formData();
+            const oauthQuery = form.get("oauth_query");
+            if (typeof oauthQuery !== "string" || oauthQuery.length === 0) {
+                throw new Error("completeOAuthConsent: oauth_query is missing.");
+            }
+            await prepareAuth();
+            const headers = new Headers(request.headers);
+            headers.set("content-type", "application/json");
+            headers.delete("content-length");
+            const response = await auth.handler(new Request(new URL(`${basePath}/oauth2/consent`, request.url), {
+                method: "POST",
+                headers,
+                body: JSON.stringify({ accept, oauth_query: oauthQuery }),
+            }));
+            if (!response.ok) {
+                throw new Error(`completeOAuthConsent: Better Auth returned ${response.status}.`);
+            }
+            const result = await response.json();
+            if (!result || typeof result.url !== "string") {
+                throw new Error("completeOAuthConsent: Better Auth omitted the redirect URL.");
+            }
+            return result.url;
+        },
+        ...(config.oauthProvider
+            ? {
+                listOAuthConsents: async (userId) => {
+                    await prepareAuth();
+                    const result = await db.all(`SELECT consent.id, consent."clientId" AS "clientId",
+                        COALESCE(client.name, consent."clientId") AS "clientName",
+                        consent.scopes
+                   FROM "oauthConsent" AS consent
+                   LEFT JOIN "oauthClient" AS client ON client."clientId" = consent."clientId"
+                  WHERE consent."userId" = ?
+                  ORDER BY consent."updatedAt" DESC, consent.id ASC`, userId);
+                    return result.map((row) => ({
+                        id: row.id,
+                        clientId: row.clientId,
+                        clientName: row.clientName,
+                        scopes: parseStoredStringArray(row.scopes) ?? [],
+                    }));
+                },
+                revokeOAuthConsent: async (userId, consentId) => {
+                    await prepareAuth();
+                    const consent = await db.first('SELECT "clientId" FROM "oauthConsent" WHERE id = ? AND "userId" = ? LIMIT 1', consentId, userId);
+                    if (!consent)
+                        return false;
+                    // the consent and its tokens go first, in one batch: without the consent no new code is issued without a prompt
+                    const revokedAt = new Date().toISOString();
+                    await db.batch([
+                        { sql: 'DELETE FROM "oauthConsent" WHERE "userId" = ? AND "clientId" = ?', binds: [userId, consent.clientId] },
+                        { sql: 'UPDATE "oauthRefreshToken" SET revoked = ? WHERE "userId" = ? AND "clientId" = ? AND revoked IS NULL', binds: [revokedAt, userId, consent.clientId] },
+                        { sql: 'UPDATE "oauthAccessToken" SET revoked = ? WHERE "userId" = ? AND "clientId" = ? AND revoked IS NULL', binds: [revokedAt, userId, consent.clientId] },
+                    ]);
+                    // then every pending code of the grant, paged past the rows it keeps (other clients' codes, other verifications)
+                    const { adapter } = await auth.$context;
+                    const code = (v) => { try {
+                        const x = JSON.parse(v);
+                        return x?.type === "authorization_code" && x.userId === userId && x.query?.client_id === consent.clientId;
+                    }
+                    catch {
+                        return false;
+                    } };
+                    const where = [{ field: "value", operator: "contains", value: JSON.stringify(userId) }, { field: "value", operator: "contains", value: JSON.stringify(consent.clientId) }];
+                    for (let offset = 0;;) {
+                        const page = await adapter.findMany({ model: "verification", where, limit: 100, offset, sortBy: { field: "id", direction: "asc" } });
+                        const ids = page.filter((v) => code(v.value)).map((v) => v.id);
+                        if (ids.length)
+                            await adapter.deleteMany({ model: "verification", where: [{ field: "id", operator: "in", value: ids }] });
+                        if (page.length < 100)
+                            break;
+                        offset += page.length - ids.length;
+                    }
+                    return true;
+                },
+            }
+            : {}),
+        methods: config.methods.map((m) => {
+            switch (m.kind) {
+                case "social":
+                    return { kind: "social", provider: m.provider };
+                case "oauth":
+                    return {
+                        kind: "oauth",
+                        providerId: m.options.providerId,
+                        ...(m.displayName ? { displayName: m.displayName } : {}),
+                    };
+                case "email-otp":
+                case "magic-link":
+                    return { kind: m.kind };
+            }
+        }),
+        listLinkedAccounts: async (userId) => {
+            await prepareAuth();
+            const result = await db.all('SELECT id, "providerId", "accountId", "createdAt", "updatedAt" FROM account WHERE "userId" = ? ORDER BY "createdAt" ASC, id ASC', userId);
+            return result.map((row) => ({
+                id: row.id,
+                providerId: row.providerId,
+                accountId: row.accountId,
+                createdAt: new Date(row.createdAt),
+                updatedAt: new Date(row.updatedAt),
+            }));
+        },
+        unlinkAccount: async (userId, providerId) => {
+            await prepareAuth();
+            return (await db.all('DELETE FROM account WHERE "userId" = ? AND "providerId" = ? RETURNING id', userId, providerId)).length > 0;
+        },
+        listUsers: async (request) => {
+            await prepareAuth();
+            const query = { filterField: "role", filterOperator: "in", filterValue: [...STAFF_ROLES], sortBy: "createdAt", sortDirection: "asc" };
+            let { users, total } = await api.listUsers({ headers: request.headers, query });
+            // Better Auth returns 100 users unless given a limit: ask once more for all of them, in one ordered read
+            if (users.length < total)
+                ({ users } = await api.listUsers({ headers: request.headers, query: { ...query, limit: total } }));
+            return users.map(({ id, email, name, role, githubLogin, emailVerified, createdAt }) => ({ id, email, name, role, githubLogin: githubLogin ?? null, emailVerified, createdAt: new Date(createdAt) }));
+        },
+        listMembers: async ({ search, cursor, cursorDirection = "forward", limit }) => {
+            await prepareAuth();
+            const parsedCursor = cursor ? decodeMemberCursor(cursor) : null;
+            const backward = cursorDirection === "backward";
+            const conditions = [
+                `(role IS NULL OR role NOT IN (${STAFF_ROLES.map(() => "?").join(",")}))`,
+            ];
+            const bindings = [...STAFF_ROLES];
+            const term = search?.trim().toLowerCase();
+            if (term) {
+                conditions.push("(LOWER(id) LIKE ? ESCAPE '\\' OR LOWER(name) LIKE ? ESCAPE '\\' OR LOWER(email) LIKE ? ESCAPE '\\')");
+                const like = `%${term.replace(/[\\%_]/g, (character) => `\\${character}`)}%`;
+                bindings.push(like, like, like);
+            }
+            if (parsedCursor) {
+                const operator = backward ? "<" : ">";
+                conditions.push(`("createdAt" ${operator} ? OR ("createdAt" = ? AND id ${operator} ?))`);
+                bindings.push(parsedCursor[0], parsedCursor[0], parsedCursor[1]);
+            }
+            bindings.push(limit + 1);
+            const result = await db.all(`SELECT id, email, name, "emailVerified", "createdAt" FROM "user" WHERE ${conditions.join(" AND ")} ORDER BY "createdAt" ${backward ? "DESC" : "ASC"}, id ${backward ? "DESC" : "ASC"} LIMIT ?`, ...bindings);
+            const rows = result.slice(0, limit);
+            if (backward)
+                rows.reverse();
+            const items = rows.map((row) => ({
+                id: row.id,
+                email: row.email,
+                name: row.name,
+                emailVerified: Boolean(row.emailVerified),
+                createdAt: new Date(row.createdAt),
+            }));
+            const hasMore = result.length > limit;
+            return {
+                items,
+                previousCursor: (backward ? hasMore : Boolean(parsedCursor)) && rows[0]
+                    ? encodeMemberCursor(rows[0].createdAt, rows[0].id)
+                    : null,
+                nextCursor: (backward ? Boolean(parsedCursor) : hasMore) && rows.at(-1)
+                    ? encodeMemberCursor(rows.at(-1).createdAt, rows.at(-1).id)
+                    : null,
+            };
+        },
+        setUserRole: async (request, userId, role) => {
+            if (role !== null && !STAFF_ROLE_SET.has(role)) {
+                throw new Error(`setUserRole: '${role}' is not a staff role — expected one of [${STAFF_ROLES.join(", ")}] or null.`);
+            }
+            await prepareAuth();
+            try {
+                // Better Auth's default role is not staff, so it is what revoking stores
+                await api.setRole({ headers: request.headers, body: { userId, role: role ?? "user" } });
+                return true;
+            }
+            catch (error) {
+                if (error.status === "NOT_FOUND")
+                    return false;
+                throw error;
+            }
+        },
+        inviteUser: async (request, email, role) => {
+            if (!STAFF_ROLE_SET.has(role)) {
+                throw new Error(`inviteUser: '${role}' is not a staff role — expected one of [${STAFF_ROLES.join(", ")}].`);
+            }
+            await prepareAuth();
+            const normalized = email.trim().toLowerCase();
+            const headers = request.headers;
+            const { users } = await api.listUsers({ headers, query: { filterField: "email", filterValue: normalized, limit: 1 } });
+            if (users[0])
+                return { kind: "exists", id: users[0].id };
+            // `name` is the address's local part until the invitee's first sign-in brings a real one; the row starts unverified
+            const { user } = await api.createUser({ headers, body: { email: normalized, name: normalized.split("@")[0] || normalized, role } });
+            return { kind: "created", id: user.id };
+        },
+        ...(config.staffInvitationSender ? {
+            sendStaffInvitation: async (email, role) => {
+                const normalized = email.trim().toLowerCase();
+                await config.staffInvitationSender.send({
+                    to: normalized,
+                    ...staffInvitationEmail(role, new URL("/admin/sign-in", config.baseURL).href),
+                    locale: "en",
+                    category: "auth.staff-invitation",
+                });
+            },
+        } : {}),
+        revokeInvite: async (userId) => {
+            await prepareAuth();
+            return (await db.all('DELETE FROM "user" WHERE id = ? AND NOT "emailVerified" AND NOT EXISTS (SELECT 1 FROM account WHERE account."userId" = "user".id) RETURNING id', userId)).length > 0;
+        },
+        deleteUser: async (userId) => {
+            await prepareAuth();
+            // no session to act as, so Better Auth's own delete, which also clears cached sessions
+            const context = await auth.$context;
+            const user = await context.internalAdapter.findUserById(userId);
+            if (!user)
+                return false;
+            // Clean address-keyed codes first: a failure must leave the user available for retry.
+            const email = user.email.toLowerCase();
+            await context.adapter.deleteMany({ model: "verification", where: [{ field: "identifier", operator: "in", value: ["sign-in", "email-verification", "forget-password"].map((type) => `${type}-otp-${email}`) }] });
+            await context.internalAdapter.deleteUser(userId);
+            return true;
+        },
+        registerOAuthClient: async (input) => {
+            if (!config.oauthProvider) {
+                throw new Error("registerOAuthClient: oauthProvider is not configured.");
+            }
+            await prepareAuth();
+            const created = await api.adminCreateOAuthClient({
+                headers: new Headers(input.requestHeaders),
+                body: {
+                    redirect_uris: [...input.redirectUris],
+                    ...(input.scope ? { scope: input.scope.join(" ") } : {}),
+                    ...(input.clientName ? { client_name: input.clientName } : {}),
+                    ...(input.clientUri ? { client_uri: input.clientUri } : {}),
+                    ...(input.logoUri ? { logo_uri: input.logoUri } : {}),
+                    ...(input.contacts ? { contacts: [...input.contacts] } : {}),
+                    ...(input.tosUri ? { tos_uri: input.tosUri } : {}),
+                    ...(input.policyUri ? { policy_uri: input.policyUri } : {}),
+                    ...(input.postLogoutRedirectUris
+                        ? { post_logout_redirect_uris: [...input.postLogoutRedirectUris] }
+                        : {}),
+                    ...(input.tokenEndpointAuthMethod
+                        ? { token_endpoint_auth_method: input.tokenEndpointAuthMethod }
+                        : {}),
+                    ...(input.grantTypes ? { grant_types: [...input.grantTypes] } : {}),
+                    ...(input.responseTypes ? { response_types: [...input.responseTypes] } : {}),
+                    ...(input.applicationType ? { application_type: input.applicationType } : {}),
+                    ...(input.skipConsent !== undefined ? { skip_consent: input.skipConsent } : {}),
+                    ...(input.enableEndSession !== undefined
+                        ? { enable_end_session: input.enableEndSession }
+                        : {}),
+                    ...(input.requirePKCE !== undefined ? { require_pkce: input.requirePKCE } : {}),
+                    ...(input.subjectType ? { subject_type: input.subjectType } : {}),
+                    ...(input.metadata ? { metadata: input.metadata } : {}),
+                },
+            });
+            return mapRegisteredOAuthClient(created);
+        },
+    };
+}
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+/**
+ * A dynamic registration whose every redirect URI is http on a loopback host and that names no application_type is a
+ * native app (RFC 8252 7.3): local MCP clients register this way. Better Auth reads the missing type as `web`, which
+ * needs https on a non-loopback host, so it would refuse them all. Mark it native, as the client could itself; a
+ * registration naming a type, mixing hosts or using any other redirect is passed through unchanged.
+ */
+async function loopbackClientsAreNative(request) {
+    const body = await request.clone().json().catch(() => null);
+    const uris = body?.redirect_uris;
+    if (!body || typeof body !== "object" || Array.isArray(body) || body.application_type !== undefined || !Array.isArray(uris) || !uris.length)
+        return request;
+    const loopback = uris.every((uri) => {
+        if (typeof uri !== "string" || !URL.canParse(uri))
+            return false;
+        const url = new URL(uri);
+        return url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname);
+    });
+    if (!loopback)
+        return request;
+    const headers = new Headers(request.headers);
+    headers.delete("content-length");
+    return new Request(request.url, { method: "POST", headers, body: JSON.stringify({ ...body, application_type: "native" }) });
+}
+//# sourceMappingURL=createMantleAuth.js.map

package/dist/auth/createMantleAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createMantleAuth.js","sourceRoot":"","sources":["../../src/auth/createMantleAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAwB,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,EAAE,WAAW,EAAkB,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAC/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,EAAE,qBAAqB,EAAE,gCAAgC,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,cAAc,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC1L,OAAO,EAAsE,cAAc,EAAE,MAAM,YAAY,CAAC;AAChH,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AACpD,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAEvD,MAAM,UAAU,gBAAgB,CAAC,MAA+B;IAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAClD,6EAA6E;IAC7E,4EAA4E;IAC5E,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3B,0EAA0E;IAC1E,0EAA0E;IAC1E,IAAI,WAAW,GAAyB,IAAI,CAAC;IAC7C,MAAM,WAAW,GAAG,GAAkB,EAAE,CAAC,WAAW,KAAK,CAAC,KAAK,IAAI,EAAE;QACnE,4HAA4H;QAC5H,0HAA0H;QAC1H,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5L,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAoB,gEAAgE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnI,IAAI,IAAI,EAAE,KAAK,KAAK,MAAM;YAAE,OAAO;QACnC,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACnF,yHAAyH;QACzH,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC;gBAAC,MAAM,OAAO,EAAE,CAAC;gBAAC,MAAM;YAAC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAI,OAAO,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;YAAC,CAAC;QAC1I,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,kFAAkF,EAAE,CAAC,CAAC,CAAC;QAC9G,yFAAyF;QACzF,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,8HAA8H,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpM,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,8DAA8D;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAU,CAAC;IAC5B,MAAM,iBAAiB,GAAG,EAAE,CAAC;IAC7B,IAAI,eAAe,GAA2B,IAAI,CAAC;IACnD,MAAM,kBAAkB,GAAG,KAAK,IAA8B,EAAE;QAC9D,IAAI,eAAe;YAAE,OAAO,eAAe,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;QACpC,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACjE,OAAO,eAAe,CAAC;IACzB,CAAC,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,CAAC,aAAa;QAC5C,CAAC,CAAC,KAAK,EAAE,KAAa,EAAE,QAAgB,EAAE,EAAE;YACxC,MAAM,WAAW,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAC9C,KAAK,EACL,QAAQ,EACR,OAAO,CAAC,OAAO,EACf,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,EACzB,iBAAiB,CAClB,CAAC;YACF,IAAI,MAAM,CAAC,aAAa,EAAE,WAAW,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,aAAa,CAAC,WAAW,IAAI,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAC/I,MAAM,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACH,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,gBAAgB,GAAG,CAAC,CAAC;IAEzB,MAAM,0BAA0B,GAAG,KAAK,IAAmB,EAAE;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,IAAI,GAAG,GAAG,gBAAgB;YAAE,OAAO;QACzE,0EAA0E;QAC1E,gBAAgB,GAAG,GAAG,GAAG,8BAA8B,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,gIAAgI,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACxN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qEAAqE;YACrE,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,EAAE,MAAc,EAA0B,EAAE;QACpE,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAA0B,8CAA8C,EAAE,MAAM,CAAC,CAAC;QAC5G,OAAO,GAAG,EAAE,IAAI,IAAI,IAAI,CAAC;IAC3B,CAAC,CAAC;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,cAA4C,CAAC;IACjD,MAAM,iBAAiB,GAAG,GAAqB,EAAE,CAAC,cAAc,KAAK,MAAM,CAAC,YAAY;QACtF,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACvB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CACpC,OAAO,CAAC,OAAiE,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjH,OAAO;QACL,QAAQ;QACR,KAAK;QACL,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW;YACnC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE;YACnD,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;YAC5B,MAAM,KAAK,GAAG,KAAK,IAAuB,EAAE;gBAC1C,MAAM,WAAW,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAC/C,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,UAAU,CAAC,EAAE,CAAC;oBAC/C,MAAM,0BAA0B,EAAE,CAAC;gBACrC,CAAC;gBACD,qEAAqE;gBACrE,sEAAsE;gBACtE,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,SAAS,CAAC,IAAI,MAAM,iBAAiB,EAAE,EAAE,CAAC;oBAC3E,IAAI,OAAO,CAAC;oBACZ,IAAI,CAAC;wBACH,0FAA0F;wBAC1F,OAAO,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;oBACpG,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,kCAAkC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;oBACtH,CAAC;oBACD,IAAI,OAAO,IAAI,CAAE,OAAO,CAAC,IAAiC,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;wBACjH,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,oCAAoC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC9G,CAAC;gBACH,CAAC;gBACD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,KAAK,GAAG,QAAQ,kBAAkB,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;gBACjJ,OAAO,4BAA4B,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YACxE,CAAC,CAAC;YACF,MAAM,MAAM,GAAG,OAAO,EAAE,SAAS,CAAC;YAClC,OAAO,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACvE,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC5B,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,2EAA2E;gBAC3E,2EAA2E;gBAC3E,MAAM,WAAW,EAAE,CAAC;gBACpB,OAAO,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,0EAA0E;YAC1E,uEAAuE;YACvE,sEAAsE;YACtE,iCAAiC;YACjC,MAAM,IAAI,GAAI,OAAO,EAAE,IAA6C,EAAE,IAAI,CAAC;YAC3E,OAAO,OAAO;gBACZ,CAAC,CAAC;oBACE,GAAG,OAAO;oBACV,0EAA0E;oBAC1E,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;oBAC/H,IAAI,EAAE;wBACJ,GAAG,OAAO,CAAC,IAAI;wBACf,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,iBAAiB,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;4BACxG,CAAC,CAAC,EAAE,WAAW,EAAE,IAAa,EAAE;4BAChC,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF;gBACH,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QACD,WAAW,EAAE,YAAY;QACzB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACxB,MAAM,WAAW,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CASrB,mHAAmH,EAAE,MAAM,CAAC,CAAC;YAClI,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;gBACzC,SAAS;aACV,CAAC;QACJ,CAAC;QACD,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;YACpD,MAAM,WAAW,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM;gBACpB,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAiB,wEAAwE,EAAE,MAAM,EAAE,UAAU,CAAC;gBAC9H,CAAC,CAAC,IAAI,CAAC;YACT,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,UAAU,sCAAsC,CAAC,CAAC;YACzG,CAAC;YACD,OAAO,gCAAgC,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAChF,CAAC;QACD,sBAAsB,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE;YACxD,OAAO,cAAc,CACnB,cAAc,EACd,OAAO,EACP,iBAAiB,EACjB,kBAAkB,CACnB,CAAC;QACJ,CAAC;QACD,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACxC,IAAI,CAAC,MAAM,CAAC,aAAa;gBAAE,OAAO,IAAI,CAAC;YACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAC1C,MAAM,WAAW,EAAE,CAAC;YACpB,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,4BAA4B,CAAC;gBACpD,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE;aACvD,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC;gBACtD,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC;oBACjC,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,QAAQ;oBAC7C,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;oBACzB,CAAC,CAAC,EAAE,CAAC,CAAC;YACV,OAAO;gBACL,UAAU,EAAE,OAAO,MAAM,EAAE,WAAW,KAAK,QAAQ;oBACjD,CAAC,CAAC,MAAM,CAAC,WAAW;oBACpB,CAAC,CAAC,QAAQ;gBACZ,WAAW;gBACX,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;qBAC1C,KAAK,CAAC,MAAM,CAAC;qBACb,MAAM,CAAC,OAAO,CAAC;gBAClB,UAAU;aACX,CAAC;QACJ,CAAC;QACD,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9C,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,WAAW,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAChD,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAC7C,IAAI,GAAG,CAAC,GAAG,QAAQ,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,EAClD;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;aAC1D,CACF,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,8CAA8C,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAuB,CAAC;YAC1D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,MAAM,CAAC,GAAG,CAAC;QACpB,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,aAAa;YACtB,CAAC,CAAC;gBACE,iBAAiB,EAAE,KAAK,EAAE,MAAc,EAAE,EAAE;oBAC1C,MAAM,WAAW,EAAE,CAAC;oBACpB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAKtB;;;;;;oEAMmD,EAAE,MAAM,CAAC,CAAC;oBAClE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;wBAC1B,EAAE,EAAE,GAAG,CAAC,EAAE;wBACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,UAAU,EAAE,GAAG,CAAC,UAAU;wBAC1B,MAAM,EAAE,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;qBACjD,CAAC,CAAC,CAAC;gBACN,CAAC;gBACD,kBAAkB,EAAE,KAAK,EAAE,MAAc,EAAE,SAAiB,EAAE,EAAE;oBAC9D,MAAM,WAAW,EAAE,CAAC;oBACpB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAuB,6EAA6E,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;oBACvJ,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAC;oBAC3B,gHAAgH;oBAChH,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;oBAC3C,MAAM,EAAE,CAAC,KAAK,CAAC;wBACb,EAAE,GAAG,EAAE,kEAAkE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;wBAC9G,EAAE,GAAG,EAAE,sGAAsG,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;wBAC7J,EAAE,GAAG,EAAE,qGAAqG,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;qBAC7J,CAAC,CAAC;oBACH,iHAAiH;oBACjH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;oBACxC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,GAAG,IAAI,CAAC;wBAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;wBAAC,OAAO,CAAC,EAAE,IAAI,KAAK,oBAAoB,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC;wBAAC,OAAO,KAAK,CAAC;oBAAC,CAAC,CAAC,CAAC,CAAC;oBACpM,MAAM,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAmB,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAmB,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAC7L,KAAK,IAAI,MAAM,GAAG,CAAC,IAAK,CAAC;wBACvB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAgC,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;wBACpK,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;wBAC/D,IAAI,GAAG,CAAC,MAAM;4BAAE,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;wBAC1H,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;4BAAE,MAAM;wBAC7B,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;oBACrC,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAiB,CAAC,CAAC,EAAE,EAAE;YAChD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACf,KAAK,QAAQ;oBACX,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAClD,KAAK,OAAO;oBACV,OAAO;wBACL,IAAI,EAAE,OAAO;wBACb,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU;wBAChC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACzD,CAAC;gBACJ,KAAK,WAAW,CAAC;gBACjB,KAAK,YAAY;oBACf,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC;QACF,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACnC,MAAM,WAAW,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAMtB,iIAAiI,EAAE,MAAM,CAAC,CAAC;YAChJ,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC1B,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;gBAClC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;aACnC,CAAC,CAAC,CAAC;QACN,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE;YAC1C,MAAM,WAAW,EAAE,CAAC;YACpB,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,0EAA0E,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACnI,CAAC;QACD,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC3B,MAAM,WAAW,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAW,CAAC;YAE/I,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,CAAS,CAAC;YACxF,yGAAyG;YACzG,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;gBAAE,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAS,CAAC,CAAC;YACrI,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,IAAI,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QACvM,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;YAC5E,MAAM,WAAW,EAAE,CAAC;YACpB,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChE,MAAM,QAAQ,GAAG,eAAe,KAAK,UAAU,CAAC;YAChD,MAAM,UAAU,GAAG;gBACjB,iCAAiC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;aAC1E,CAAC;YACF,MAAM,QAAQ,GAAc,CAAC,GAAG,WAAW,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC1C,IAAI,IAAI,EAAE,CAAC;gBACT,UAAU,CAAC,IAAI,CAAC,qGAAqG,CAAC,CAAC;gBACvH,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC,GAAG,CAAC;gBAC7E,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC,gBAAgB,QAAQ,iCAAiC,QAAQ,MAAM,CAAC,CAAC;gBACzF,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YACnE,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAMtB,0EAA0E,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,GAAG,QAAQ,CAAC,CAAC;YACnN,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACpC,IAAI,QAAQ;gBAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/B,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;gBACzC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;aACnC,CAAC,CAAC,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;YACtC,OAAO;gBACL,KAAK;gBACL,cAAc,EACZ,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;oBACrD,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnD,CAAC,CAAC,IAAI;gBACV,UAAU,EACR,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBACzD,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;oBAC7D,CAAC,CAAC,IAAI;aACX,CAAC;QACJ,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,4CAA4C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACvH,CAAC;YACD,MAAM,WAAW,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,yEAAyE;gBACzE,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;gBACxF,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA8B,CAAC,MAAM,KAAK,WAAW;oBAAE,OAAO,KAAK,CAAC;gBACzE,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACzC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,4CAA4C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9G,CAAC;YACD,MAAM,WAAW,EAAE,CAAC;YACpB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YAChC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAgC,CAAC;YACtJ,IAAI,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACzD,oHAAoH;YACpH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,IAAI,EAAE,EAAE,CAA6B,CAAC;YAChK,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QAC1C,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC;YACjC,mBAAmB,EAAE,KAAK,EAAE,KAAa,EAAE,IAAe,EAAE,EAAE;gBAC5D,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC9C,MAAM,MAAM,CAAC,qBAAsB,CAAC,IAAI,CAAC;oBACvC,EAAE,EAAE,UAAU;oBACd,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;oBAC7E,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,uBAAuB;iBAClC,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC7B,MAAM,WAAW,EAAE,CAAC;YACpB,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,gJAAgJ,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7L,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3B,MAAM,WAAW,EAAE,CAAC;YACpB,uFAAuF;YACvF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;YACpC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAChE,IAAI,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YACxB,sFAAsF;YACtF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACjN,MAAM,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,mBAAmB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACnC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,WAAW,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,sBAAsB,CAAC;gBAC/C,OAAO,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC1C,IAAI,EAAE;oBACJ,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;oBACtC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxD,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9D,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,KAAK,CAAC,sBAAsB;wBAC9B,CAAC,CAAC,EAAE,yBAAyB,EAAE,CAAC,GAAG,KAAK,CAAC,sBAAsB,CAAC,EAAE;wBAClE,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,KAAK,CAAC,uBAAuB;wBAC/B,CAAC,CAAC,EAAE,0BAA0B,EAAE,KAAK,CAAC,uBAAuB,EAAE;wBAC/D,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7E,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/E,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS;wBACtC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,EAAE;wBAChD,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/E,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxD;aACF,CAAC,CAAC;YACH,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AACpE;;;;;GAKG;AACH,KAAK,UAAU,wBAAwB,CAAC,OAAgB;IACtD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAmC,CAAC;IAC9F,MAAM,IAAI,GAAG,IAAI,EAAE,aAAa,CAAC;IACjC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5J,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;AAC9H,CAAC"}

package/dist/auth/db.d.ts

@@ -0,0 +1,17 @@
+import type { DatabaseDriver } from "../core/index.js";
+/**
+ * The few statements Better Auth's API has no call for (ADR-0035 decision 9), over the store's one port. They are portable
+ * SQL: camelCase names and `"user"` quoted, anonymous `?` binds numbered, a write's count read from its `RETURNING` rows,
+ * no engine functions.
+ */
+export declare function dbOf(driver: DatabaseDriver): {
+    all: <T>(sql: string, ...binds: unknown[]) => Promise<T[]>;
+    first: <T>(sql: string, ...binds: unknown[]) => Promise<T | null>;
+    batch: (statements: readonly {
+        sql: string;
+        binds?: readonly unknown[];
+    }[]) => Promise<readonly import("../core/driver.js").SqlResult[]>;
+};
+/** The namespace a session cache keys by: the id the store minted when it was first converged (Mantle's boot state). */
+export declare function readStoreInstanceId(driver: DatabaseDriver): Promise<string>;
+//# sourceMappingURL=db.d.ts.map

package/dist/auth/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/auth/db.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,MAAM,EAAE,cAAc;UAGtB,CAAC,OAAO,MAAM,YAAY,OAAO,EAAE,KAAG,OAAO,CAAC,CAAC,EAAE,CAAC;YAGrD,CAAC,OAAO,MAAM,YAAY,OAAO,EAAE,KAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;wBACjD,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;KAAE,EAAE;EAE7E;AAED,wHAAwH;AACxH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAKjF"}

package/dist/auth/db.js

@@ -0,0 +1,24 @@
+/**
+ * The few statements Better Auth's API has no call for (ADR-0035 decision 9), over the store's one port. They are portable
+ * SQL: camelCase names and `"user"` quoted, anonymous `?` binds numbered, a write's count read from its `RETURNING` rows,
+ * no engine functions.
+ */
+export function dbOf(driver) {
+    // each anonymous `?` outside a quoted string or name becomes `?1`, `?2`: the port binds by number
+    const numbered = (sql) => { let i = 0; return sql.replace(/'(?:[^']|'')*'|"(?:[^"]|"")*"|\?/g, (m) => (m === "?" ? `?${++i}` : m)); };
+    const all = async (sql, ...binds) => (await driver.batch([{ sql: numbered(sql), binds }]))[0].rows;
+    return {
+        all,
+        first: async (sql, ...binds) => (await all(sql, ...binds))[0] ?? null,
+        batch: (statements) => driver.batch(statements.map((s) => ({ ...s, sql: numbered(s.sql) }))),
+    };
+}
+/** The namespace a session cache keys by: the id the store minted when it was first converged (Mantle's boot state). */
+export async function readStoreInstanceId(driver) {
+    let cause;
+    const id = (await driver.batch([{ sql: "SELECT value FROM _mantle_boot_state WHERE key = 'instance'" }]).catch((e) => void (cause = e)))?.[0]?.rows[0]?.value;
+    if (typeof id !== "string")
+        throw new Error("Mantle storage must be converged before using derivative storage.", { cause });
+    return id;
+}
+//# sourceMappingURL=db.js.map

package/dist/auth/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/auth/db.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAAC,MAAsB;IACzC,kGAAkG;IAClG,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,mCAAmC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9I,MAAM,GAAG,GAAG,KAAK,EAAK,GAAW,EAAE,GAAG,KAAgB,EAAgB,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAW,CAAC;IAC/I,OAAO;QACL,GAAG;QACH,KAAK,EAAE,KAAK,EAAK,GAAW,EAAE,GAAG,KAAgB,EAAqB,EAAE,CAAC,CAAC,MAAM,GAAG,CAAI,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;QACjH,KAAK,EAAE,CAAC,UAAkE,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;KACrJ,CAAC;AACJ,CAAC;AAED,wHAAwH;AACxH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAsB;IAC9D,IAAI,KAAc,CAAC;IACnB,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,6DAA6D,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IAC9J,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5H,OAAO,EAAE,CAAC;AACZ,CAAC"}