@bitbaum/accountkit 0.0.0-stage → 0.6.3

package/dist/auth/methods.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Which sign-in methods this deployment offers — a pure function of its env,
+ * so "is this button shown" is a unit test, not a guess (fleet STACK.md,
+ * "Identity", 2026-10-11).
+ *
+ *  - Email + password, passkeys and two-factor need nothing external.
+ *  - A magic link needs mail (@bitbaum/mail-kit). Without it the option is
+ *    HIDDEN in production rather than offered and silently undeliverable; in
+ *    development the link is printed to the server console instead.
+ *  - "bitbaum sign-in" is the shared sign-in service that holds the Google,
+ *    GitHub, X, Meta and Apple credentials once and speaks OIDC to every app,
+ *    issuing a per-app (pairwise) subject. Shown only when SIGNIN_* is set.
+ *  - "Sign in with OrangeCat" is OrangeCat's OIDC provider: one click for
+ *    people who already have OrangeCat, never a requirement. OrangeCat's token
+ *    endpoint accepts ONLY client_secret_post and requires PKCE.
+ *
+ * A method whose env is missing is hidden, never broken.
+ */
+type Env = Record<string, string | undefined>;
+export declare const SIGNIN_PROVIDER_ID = "bitbaum-signin";
+export declare const ORANGECAT_PROVIDER_ID = "orangecat";
+export declare const ORANGECAT_DEFAULT_ISSUER = "https://orangecat.ch";
+export type OidcProviderId = typeof SIGNIN_PROVIDER_ID | typeof ORANGECAT_PROVIDER_ID;
+export interface OidcClient {
+    providerId: OidcProviderId;
+    issuer: string;
+    discoveryUrl: string;
+    clientId: string;
+    clientSecret: string;
+}
+/**
+ * An issuer we are willing to send people to: https, or http on localhost for
+ * development. Anything else is treated as not configured — a typo must hide
+ * the button, not send someone's sign-in over plain HTTP.
+ */
+export declare function usableIssuer(value: string): string | null;
+/** The shared bitbaum sign-in service (SIGNIN_ISSUER/CLIENT_ID/CLIENT_SECRET). */
+export declare function signinBroker(env: Env): OidcClient | null;
+/** OrangeCat, under the env names every fleet app already uses. */
+export declare function orangecatOidc(env: Env): OidcClient | null;
+export declare function oidcClients(env: Env): OidcClient[];
+export interface SignInMethods {
+    /** Recovery needs a real sender; absent on older capability objects. */
+    passwordReset?: boolean;
+    password: boolean;
+    passkey: boolean;
+    twoFactor: boolean;
+    magicLink: boolean;
+    /** Whether an email must be confirmed before a password account signs in. */
+    verifyEmail: boolean;
+    signin: boolean;
+    orangecat: boolean;
+}
+/** What the sign-in and sign-up pages offer. Safe to send to the browser: booleans only. */
+export declare function signInMethods(env: Env, mailConfigured: boolean): SignInMethods;
+/**
+ * The address given to a person who signed in with a method that brought no
+ * email, or whose email we do not trust as an identity.
+ *
+ * An address from a provider is CONTACT data, never an identity: linking by it
+ * lets whoever controls an unverified address at the provider take over the
+ * local account (fleet accountkit, `orangecatProfile`). So OIDC accounts never
+ * carry the provider's address. `.invalid` is reserved (RFC 2606): it cannot
+ * receive mail and cannot collide with a real address. Hashed so the
+ * provider's subject is not readable from it.
+ */
+export declare function placeholderEmail(providerId: string, subject: string): string;
+/** Whether mail can ever reach this address. */
+export declare function isDeliverable(email: string | null | undefined): boolean;
+export {};
+//# sourceMappingURL=methods.d.ts.map

package/dist/auth/methods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../../src/auth/methods.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE9C,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AACnD,eAAO,MAAM,qBAAqB,cAAc,CAAC;AACjD,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAE/D,MAAM,MAAM,cAAc,GACxB,OAAO,kBAAkB,GAAG,OAAO,qBAAqB,CAAC;AAE3D,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,cAAc,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAczD;AAoBD,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,UAAU,GAAG,IAAI,CAOxD;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,GAAG,UAAU,GAAG,IAAI,CAOzD;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,UAAU,EAAE,CAIlD;AAED,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,6EAA6E;IAC7E,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,4FAA4F;AAC5F,wBAAgB,aAAa,CAC3B,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,OAAO,GACtB,aAAa,CAYf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAM5E;AAED,gDAAgD;AAChD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAIvE"}

package/dist/auth/methods.js

@@ -0,0 +1,92 @@
+import { createHash } from "node:crypto";
+export const SIGNIN_PROVIDER_ID = "bitbaum-signin";
+export const ORANGECAT_PROVIDER_ID = "orangecat";
+export const ORANGECAT_DEFAULT_ISSUER = "https://orangecat.ch";
+const text = (value) => value?.trim() || "";
+/**
+ * An issuer we are willing to send people to: https, or http on localhost for
+ * development. Anything else is treated as not configured — a typo must hide
+ * the button, not send someone's sign-in over plain HTTP.
+ */
+export function usableIssuer(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    const local = url.hostname === "localhost" || url.hostname === "127.0.0.1";
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && local))
+        return null;
+    if (url.search || url.hash || url.username || url.password)
+        return null;
+    // OIDC compares `iss` byte for byte; normalise only the trailing slash used
+    // to build the discovery URL, never the issuer itself.
+    return value;
+}
+function oidcClient(providerId, issuerValue, clientId, clientSecret) {
+    if (!issuerValue || !clientId || !clientSecret)
+        return null;
+    const issuer = usableIssuer(issuerValue);
+    if (!issuer)
+        return null;
+    return {
+        providerId,
+        issuer,
+        discoveryUrl: `${issuer.replace(/\/+$/, "")}/.well-known/openid-configuration`,
+        clientId,
+        clientSecret,
+    };
+}
+/** The shared bitbaum sign-in service (SIGNIN_ISSUER/CLIENT_ID/CLIENT_SECRET). */
+export function signinBroker(env) {
+    return oidcClient(SIGNIN_PROVIDER_ID, text(env.SIGNIN_ISSUER), text(env.SIGNIN_CLIENT_ID), text(env.SIGNIN_CLIENT_SECRET));
+}
+/** OrangeCat, under the env names every fleet app already uses. */
+export function orangecatOidc(env) {
+    return oidcClient(ORANGECAT_PROVIDER_ID, text(env.ORANGECAT_OAUTH_ISSUER) || ORANGECAT_DEFAULT_ISSUER, text(env.ORANGECAT_OAUTH_CLIENT_ID), text(env.ORANGECAT_OAUTH_CLIENT_SECRET));
+}
+export function oidcClients(env) {
+    return [signinBroker(env), orangecatOidc(env)].filter((c) => c !== null);
+}
+/** What the sign-in and sign-up pages offer. Safe to send to the browser: booleans only. */
+export function signInMethods(env, mailConfigured) {
+    const development = env.NODE_ENV === "development";
+    return {
+        passwordReset: mailConfigured,
+        password: true,
+        passkey: true,
+        twoFactor: true,
+        magicLink: mailConfigured || development,
+        verifyEmail: mailConfigured,
+        signin: signinBroker(env) !== null,
+        orangecat: orangecatOidc(env) !== null,
+    };
+}
+/**
+ * The address given to a person who signed in with a method that brought no
+ * email, or whose email we do not trust as an identity.
+ *
+ * An address from a provider is CONTACT data, never an identity: linking by it
+ * lets whoever controls an unverified address at the provider take over the
+ * local account (fleet accountkit, `orangecatProfile`). So OIDC accounts never
+ * carry the provider's address. `.invalid` is reserved (RFC 2606): it cannot
+ * receive mail and cannot collide with a real address. Hashed so the
+ * provider's subject is not readable from it.
+ */
+export function placeholderEmail(providerId, subject) {
+    const digest = createHash("sha256")
+        .update(`${providerId}:${subject}`)
+        .digest("hex")
+        .slice(0, 32);
+    return `${digest}@${providerId}.invalid`;
+}
+/** Whether mail can ever reach this address. */
+export function isDeliverable(email) {
+    if (!email)
+        return false;
+    const domain = email.split("@")[1]?.toLowerCase() ?? "";
+    return domain.length > 0 && !domain.endsWith(".invalid");
+}
+//# sourceMappingURL=methods.js.map

package/dist/auth/methods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.js","sourceRoot":"","sources":["../../src/auth/methods.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAsBzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AACnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AACjD,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAa/D,MAAM,IAAI,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAEhE;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;IAC3E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxE,4EAA4E;IAC5E,uDAAuD;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CACjB,UAA0B,EAC1B,WAAmB,EACnB,QAAgB,EAChB,YAAoB;IAEpB,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,UAAU;QACV,MAAM;QACN,YAAY,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC;QAC9E,QAAQ;QACR,YAAY;KACb,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,GAAQ;IACnC,OAAO,UAAU,CACf,kBAAkB,EAClB,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EACvB,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAC1B,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,GAAQ;IACpC,OAAO,UAAU,CACf,qBAAqB,EACrB,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,wBAAwB,EAC5D,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,EACnC,IAAI,CAAC,GAAG,CAAC,6BAA6B,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAQ;IAClC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CACnD,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,IAAI,CACnC,CAAC;AACJ,CAAC;AAeD,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAC3B,GAAQ,EACR,cAAuB;IAEvB,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,KAAK,aAAa,CAAC;IACnD,OAAO;QACL,aAAa,EAAE,cAAc;QAC7B,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,cAAc,IAAI,WAAW;QACxC,WAAW,EAAE,cAAc;QAC3B,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,IAAI;QAClC,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,KAAK,IAAI;KACvC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,OAAe;IAClE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC;SAClC,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,GAAG,MAAM,IAAI,UAAU,UAAU,CAAC;AAC3C,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,aAAa,CAAC,KAAgC;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC3D,CAAC"}

package/dist/auth/next.d.ts

@@ -0,0 +1,73 @@
+import { type Auth, type CreateAuthOptions, type AuthSite, type AuthMailer, type AuthStatus } from "./server.js";
+export interface AuthRuntimeOptions {
+    site: AuthSite;
+    mail: AuthMailer;
+    /** Whether the product has a database to keep accounts in. */
+    isDatabaseConfigured: (env: NodeJS.ProcessEnv) => boolean;
+    /** The Drizzle database. Called on first use, never at import. */
+    getDatabase: () => unknown;
+    /** Only if the product keeps the account tables under its own definitions. */
+    schema?: Record<string, unknown>;
+    /**
+     * For a product whose rows were keyed on an OIDC subject before it had
+     * accounts (an OrangeCat actor id). A person who FIRST came in through that
+     * provider keeps the subject as their `actorId`, so every existing row stays
+     * theirs with no data migration. Everyone else's `actorId` is their user id.
+     * Linking the provider later never changes an id that already has data.
+     */
+    legacyIdentityProvider?: string;
+    /** See CreateAuthOptions.onAccountCreated. */
+    onAccountCreated?: CreateAuthOptions["onAccountCreated"];
+}
+type SessionUser = {
+    id: string;
+    actorId: string;
+    role?: unknown;
+};
+/**
+ * Everything a Next.js product needs from accounts, from one call:
+ *
+ *   export const { GET, POST, getSession, requireUser, authStatus } =
+ *     createAuthRuntime({ site, mail, isDatabaseConfigured, getDatabase });
+ *
+ * Built on first request, never at import: `next build` evaluates route
+ * modules, and an instance built there would make the build need a database
+ * and a secret. A running server without them answers "accounts unavailable"
+ * on every auth surface instead of crashing.
+ */
+export declare function createAuthRuntime(options: AuthRuntimeOptions): {
+    getAuth: () => Auth;
+    authStatus: (env?: NodeJS.ProcessEnv) => AuthStatus;
+    getSession: () => Promise<AuthSession | null>;
+    sessionFor: (requestHeaders: Headers) => Promise<AuthSession | null>;
+    requireUser: (request: Request) => Promise<{
+        user: SessionUser;
+        response?: never;
+    } | {
+        user?: never;
+        response: Response;
+    }>;
+    GET: (request: Request) => Promise<Response>;
+    POST: (request: Request) => Promise<Response>;
+};
+/** The signed-in person, as the products read them. */
+export interface AuthSession {
+    user: {
+        id: string;
+        /** The id the product's rows use: the user id, or a legacy subject (see legacyIdentityProvider). */
+        actorId: string;
+        createdAt?: Date | string;
+        name: string;
+        email: string;
+        emailVerified: boolean;
+        image?: string | null;
+        role?: string;
+        twoFactorEnabled?: boolean;
+    };
+    session: {
+        id: string;
+        expiresAt: Date;
+    };
+}
+export {};
+//# sourceMappingURL=next.d.ts.map

package/dist/auth/next.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.d.ts","sourceRoot":"","sources":["../../src/auth/next.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,IAAI,EACT,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,UAAU,CAAC;IACjB,8DAA8D;IAC9D,oBAAoB,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;IAC1D,kEAAkE;IAClE,WAAW,EAAE,MAAM,OAAO,CAAC;IAC3B,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;CAC1D;AAED,KAAK,WAAW,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB;mBAEvC,IAAI;uBAUC,MAAM,CAAC,UAAU,KAAiB,UAAU;sBA2DxC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;iCAdtC,OAAO,KACtB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;2BA6BnB,OAAO,KACf,OAAO,CACN;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;KAAE,GACvC;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CACvC;mBAsCsB,OAAO;oBAEN,OAAO;EAGhC;AAED,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,oGAAoG;QACpG,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QAC1B,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,OAAO,CAAC;QACvB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC;CAC1C"}

package/dist/auth/next.js

@@ -0,0 +1,131 @@
+import { headers } from "next/headers.js";
+import { toNextJsHandler } from "better-auth/next-js";
+import { asc, eq } from "drizzle-orm";
+import { rateLimitAuthRequest } from "./limits.js";
+import { authSchema } from "./schema.js";
+import { authStatusFor, createAuthInstance, } from "./server.js";
+/**
+ * Everything a Next.js product needs from accounts, from one call:
+ *
+ *   export const { GET, POST, getSession, requireUser, authStatus } =
+ *     createAuthRuntime({ site, mail, isDatabaseConfigured, getDatabase });
+ *
+ * Built on first request, never at import: `next build` evaluates route
+ * modules, and an instance built there would make the build need a database
+ * and a secret. A running server without them answers "accounts unavailable"
+ * on every auth surface instead of crashing.
+ */
+export function createAuthRuntime(options) {
+    let instance = null;
+    const getAuth = () => {
+        instance ??= createAuthInstance({
+            site: options.site,
+            mail: options.mail,
+            schema: options.schema,
+            onAccountCreated: options.onAccountCreated,
+            database: options.getDatabase(),
+        });
+        return instance;
+    };
+    const authStatus = (env = process.env) => authStatusFor(options.isDatabaseConfigured(env), env);
+    const noStore = { "Cache-Control": "no-store" };
+    const actorIds = new Map();
+    /** The id the product's own rows use for this person. */
+    async function actorIdOf(user) {
+        const provider = options.legacyIdentityProvider;
+        if (!provider)
+            return user.id;
+        const known = actorIds.get(user.id);
+        if (known)
+            return known;
+        const table = (options.schema?.account ??
+            authSchema.account);
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const db = options.getDatabase();
+        // The person's FIRST sign-in method decides: if it was the provider, their
+        // rows were written under its subject before this account existed.
+        const rows = await db
+            .select({ accountId: table.accountId, providerId: table.providerId })
+            .from(table)
+            .where(eq(table.userId, user.id))
+            .orderBy(asc(table.createdAt))
+            .limit(1);
+        const id = rows[0]?.providerId === provider ? rows[0].accountId : user.id;
+        actorIds.set(user.id, id);
+        return id;
+    }
+    /**
+     * The session behind these request headers, with the `actorId` the
+     * product's rows use — or null. The one reader both `getSession` and
+     * `requireUser` go through, so the two cannot disagree about who somebody
+     * is.
+     *
+     * `actorId` is computed HERE and not left to the caller: `getSession` used
+     * to return better-auth's raw session, whose user has no `actorId`, while
+     * `requireUser` attached one. A product reading `session.user.actorId` in
+     * a server component got `undefined` for every signed-in person and drew
+     * the signed-out page, while its API routes, going through `requireUser`,
+     * worked — which is how the fault stayed invisible.
+     */
+    async function sessionFor(requestHeaders) {
+        if (!authStatus().ready)
+            return null;
+        const session = (await getAuth().api.getSession({
+            headers: requestHeaders,
+        }));
+        if (!session)
+            return null;
+        return {
+            ...session,
+            user: { ...session.user, actorId: await actorIdOf(session.user) },
+        };
+    }
+    /** Who is signed in, for a server component. Null also when accounts are unavailable. */
+    async function getSession() {
+        // Always cross the request boundary, even when a build has no database or
+        // secret. Otherwise Next can pre-render an anonymous redirect permanently.
+        // Keep this outside the catch: framework dynamic-render signals must escape.
+        const requestHeaders = await headers();
+        if (!authStatus().ready)
+            return null;
+        try {
+            return await sessionFor(requestHeaders);
+        }
+        catch (error) {
+            console.error(`[auth] session read failed: ${error.name}`);
+            return null;
+        }
+    }
+    /** The signed-in person behind an API request, or the Response to send instead. */
+    async function requireUser(request) {
+        if (!authStatus().ready) {
+            return {
+                response: Response.json({ error: "accounts_unavailable" }, { status: 503, headers: noStore }),
+            };
+        }
+        const session = await sessionFor(request.headers).catch(() => null);
+        if (!session) {
+            return {
+                response: Response.json({ error: "sign_in_required" }, { status: 401, headers: noStore }),
+            };
+        }
+        return { user: session.user };
+    }
+    async function guard(request) {
+        const status = authStatus();
+        if (!status.ready) {
+            return Response.json({ error: "accounts_unavailable", reason: status.reason }, { status: 503, headers: noStore });
+        }
+        return rateLimitAuthRequest(request);
+    }
+    return {
+        getAuth,
+        authStatus,
+        getSession,
+        sessionFor,
+        requireUser,
+        GET: async (request) => (await guard(request)) ?? toNextJsHandler(getAuth()).GET(request),
+        POST: async (request) => (await guard(request)) ?? toNextJsHandler(getAuth()).POST(request),
+    };
+}
+//# sourceMappingURL=next.js.map

package/dist/auth/next.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.js","sourceRoot":"","sources":["../../src/auth/next.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,aAAa,EACb,kBAAkB,GAMnB,MAAM,aAAa,CAAC;AAyBrB;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,IAAI,QAAQ,GAAgB,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,QAAQ,KAAK,kBAAkB,CAAC;YAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE;SAChC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAc,EAAE,CACtE,aAAa,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3C,yDAAyD;IACzD,KAAK,UAAU,SAAS,CAAC,IAGxB;QACC,MAAM,QAAQ,GAAG,OAAO,CAAC,sBAAsB,CAAC;QAChD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO;YACpC,UAAU,CAAC,OAAO,CAA8B,CAAC;QACnD,8DAA8D;QAC9D,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAS,CAAC;QACxC,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,IAAI,GAAgD,MAAM,EAAE;aAC/D,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;aACpE,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;aAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;aAC7B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,UAAU,UAAU,CACvB,cAAuB;QAEvB,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC;YAC9C,OAAO,EAAE,cAAc;SACxB,CAAC,CAAuB,CAAC;QAC1B,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO;YACL,GAAG,OAAO;YACV,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;SAClE,CAAC;IACJ,CAAC;IAED,yFAAyF;IACzF,KAAK,UAAU,UAAU;QACvB,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,cAAc,GAAG,MAAM,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,+BAAgC,KAAe,CAAC,IAAI,EAAE,CAAC,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,KAAK,UAAU,WAAW,CACxB,OAAgB;QAKhB,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC;YACxB,OAAO;gBACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CACrB,EAAE,KAAK,EAAE,sBAAsB,EAAE,EACjC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAClC;aACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CACrB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAC7B,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAClC;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,OAAgB;QACnC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACxD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAClC,CAAC;QACJ,CAAC;QACD,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,OAAO;QACL,OAAO;QACP,UAAU;QACV,UAAU;QACV,UAAU;QACV,WAAW;QACX,GAAG,EAAE,KAAK,EAAE,OAAgB,EAAE,EAAE,CAC9B,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QACnE,IAAI,EAAE,KAAK,EAAE,OAAgB,EAAE,EAAE,CAC/B,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;KACrE,CAAC;AACJ,CAAC"}

package/dist/auth/react.d.ts

@@ -0,0 +1,174 @@
+import { type ReactNode } from "react";
+import type { SignInMethods } from "./methods.js";
+import { DEFAULT_AUTH_LABELS, authErrorText, fill, type AuthError, type AuthLabels } from "./labels.js";
+/**
+ * The account screens every product shows: sign in, create an account, and
+ * the account page. Logic and words here, look in the product: pass `classes`
+ * with your own class names and `labels` in your own language. The client is
+ * the product's own (`createAuthClient({ plugins: authClientPlugins() })`).
+ */
+type Result<T = unknown> = Promise<{
+    data?: T | null;
+    error?: AuthError;
+}>;
+/** What these screens call on the product's better-auth client. */
+export interface AuthClientLike {
+    requestPasswordReset?(input: {
+        email: string;
+        redirectTo: string;
+    }): Result;
+    resetPassword?(input: {
+        newPassword: string;
+        token: string;
+    }): Result;
+    signIn: {
+        email(input: {
+            email: string;
+            password: string;
+            callbackURL?: string;
+        }): Result;
+        social(input: {
+            provider: string;
+            callbackURL?: string;
+            errorCallbackURL?: string;
+        }): Result;
+        magicLink(input: {
+            email: string;
+            name?: string;
+            callbackURL?: string;
+            errorCallbackURL?: string;
+        }): Result;
+        passkey(): Promise<{
+            error?: AuthError;
+        } | undefined | null>;
+    };
+    signUp: {
+        email(input: {
+            name: string;
+            email: string;
+            password: string;
+            callbackURL?: string;
+        }): Result;
+    };
+    signOut(): Result;
+    sendVerificationEmail(input: {
+        email: string;
+        callbackURL?: string;
+    }): Result;
+    updateUser(input: {
+        name: string;
+    }): Result;
+    deleteUser(input: {
+        password?: string;
+    }): Result;
+    linkSocial(input: {
+        provider: string;
+        callbackURL?: string;
+    }): Result;
+    twoFactor: {
+        verifyTotp(input: {
+            code: string;
+            trustDevice?: boolean;
+        }): Result;
+        verifyBackupCode(input: {
+            code: string;
+            trustDevice?: boolean;
+        }): Result;
+        enable(input: {
+            password?: string;
+        }): Result<object>;
+        disable(input: {
+            password?: string;
+        }): Result;
+    };
+    passkey: {
+        addPasskey(input: {
+            name?: string;
+        }): Promise<{
+            error?: AuthError;
+        } | undefined | null>;
+        listUserPasskeys(): Result<Passkey[]>;
+        deletePasskey(input: {
+            id: string;
+        }): Result;
+    };
+}
+type Passkey = {
+    id: string;
+    name?: string | null;
+};
+export interface AuthClasses {
+    button: string;
+    buttonQuiet: string;
+    input: string;
+    label: string;
+    hint: string;
+    notice: string;
+    error: string;
+    section: string;
+    sectionTitle: string;
+    divider: string;
+    link: string;
+    stack: string;
+    field: string;
+    check: string;
+}
+/** Class names styled by @bitbaum/accountkit/styles.css on --acct-* variables. */
+export declare const DEFAULT_AUTH_CLASSES: AuthClasses;
+interface Common {
+    client: AuthClientLike;
+    methods: SignInMethods;
+    labels?: AuthLabels;
+    classes?: Partial<AuthClasses>;
+}
+/** "Continue with …" for each OIDC method this deployment has switched on. */
+export declare function OidcButtons({ client, methods, labels, classes, callbackURL, errorCallbackURL, onError, }: Common & {
+    callbackURL: string;
+    errorCallbackURL: string;
+    onError: (error: AuthError) => void;
+}): import("react").JSX.Element | null;
+/**
+ * Every way in, on one screen: password, passkey, a link by email, and the
+ * OIDC buttons this deployment has switched on. A second factor, when the
+ * account has one, is asked for on the same card.
+ */
+export declare function SignInForm({ client, methods, labels, classes, next, signInPath, signUpLink, initialError, }: Common & {
+    /** Where to land, already localised (`/de/account`). */
+    next: string;
+    /** This page, localised: where a failed OIDC round trip comes back to. */
+    signInPath: string;
+    /** The link to the sign-up page, rendered by the product's router. */
+    signUpLink: ReactNode;
+    initialError?: boolean;
+}): import("react").JSX.Element;
+export { PasswordRecoveryForm } from "./recovery.js";
+/**
+ * A new account in one step. No real name is asked for — a display name is
+ * optional and may be anything. A passkey is added from the account page once
+ * the account exists.
+ */
+export declare function SignUpForm({ client, methods, labels, classes, next, signUpPath, signInPath, signInLink, }: Common & {
+    next: string;
+    signUpPath: string;
+    /** Where an existing account completes a second factor after passwordless signup. */
+    signInPath?: string;
+    /** The link to the sign-in page, rendered by the product's router. */
+    signInLink: ReactNode;
+}): import("react").JSX.Element;
+/** Everything about one's own account, and the way out of it. */
+export declare function AccountPanel({ client, methods, labels, classes, user, linked, accountPath, homePath, }: Common & {
+    user: {
+        name: string;
+        /** Null when the account has no address that can receive mail. */
+        email: string | null;
+        emailVerified: boolean;
+        role: string;
+        twoFactorEnabled: boolean;
+    };
+    /** Provider ids of the sign-in methods this account has ("credential", "orangecat", …). */
+    linked: string[];
+    accountPath: string;
+    homePath: string;
+}): import("react").JSX.Element;
+export { DEFAULT_AUTH_LABELS, authErrorText, fill, type AuthError, type AuthLabels, };
+//# sourceMappingURL=react.d.ts.map

package/dist/auth/react.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../../src/auth/react.tsx"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,IAAI,EACJ,KAAK,SAAS,EACd,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAErB;;;;;GAKG;AAEH,KAAK,MAAM,CAAC,CAAC,GAAG,OAAO,IAAI,OAAO,CAAC;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC;AAE3E,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,oBAAoB,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IAC5E,aAAa,CAAC,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IACtE,MAAM,EAAE;QACN,KAAK,CAAC,KAAK,EAAE;YACX,KAAK,EAAE,MAAM,CAAC;YACd,QAAQ,EAAE,MAAM,CAAC;YACjB,WAAW,CAAC,EAAE,MAAM,CAAC;SACtB,GAAG,MAAM,CAAC;QACX,MAAM,CAAC,KAAK,EAAE;YACZ,QAAQ,EAAE,MAAM,CAAC;YACjB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC3B,GAAG,MAAM,CAAC;QACX,SAAS,CAAC,KAAK,EAAE;YACf,KAAK,EAAE,MAAM,CAAC;YACd,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC3B,GAAG,MAAM,CAAC;QACX,OAAO,IAAI,OAAO,CAAC;YAAE,KAAK,CAAC,EAAE,SAAS,CAAA;SAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;KAC9D,CAAC;IACF,MAAM,EAAE;QACN,KAAK,CAAC,KAAK,EAAE;YACX,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,EAAE,MAAM,CAAC;YACd,QAAQ,EAAE,MAAM,CAAC;YACjB,WAAW,CAAC,EAAE,MAAM,CAAC;SACtB,GAAG,MAAM,CAAC;KACZ,CAAC;IACF,OAAO,IAAI,MAAM,CAAC;IAClB,qBAAqB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IAC9E,UAAU,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IAC5C,UAAU,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IACjD,UAAU,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IACtE,SAAS,EAAE;QACT,UAAU,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,MAAM,CAAC;QACnE,gBAAgB,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,MAAM,CAAC;QACzE,MAAM,CAAC,KAAK,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,CAAC;KAC/C,CAAC;IACF,OAAO,EAAE;QACP,UAAU,CAAC,KAAK,EAAE;YAChB,IAAI,CAAC,EAAE,MAAM,CAAC;SACf,GAAG,OAAO,CAAC;YAAE,KAAK,CAAC,EAAE,SAAS,CAAA;SAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;QACtD,gBAAgB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACtC,aAAa,CAAC,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,CAAC;KAC9C,CAAC;CACH;AAED,KAAK,OAAO,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEpD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,EAAE,WAelC,CAAC;AAEF,UAAU,MAAM;IACd,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;CAChC;AA8BD,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,EAC1B,MAAM,EACN,OAAO,EACP,MAA4B,EAC5B,OAAO,EACP,WAAW,EACX,gBAAgB,EAChB,OAAO,GACR,EAAE,MAAM,GAAG;IACV,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;CACrC,sCAkCA;AAID;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,EACzB,MAAM,EACN,OAAO,EACP,MAA4B,EAC5B,OAAO,EACP,IAAI,EACJ,UAAU,EACV,UAAU,EACV,YAAoB,GACrB,EAAE,MAAM,GAAG;IACV,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,UAAU,EAAE,SAAS,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,+BA6SA;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,EACzB,MAAM,EACN,OAAO,EACP,MAA4B,EAC5B,OAAO,EACP,IAAI,EACJ,UAAU,EACV,UAEc,EACd,UAAU,GACX,EAAE,MAAM,GAAG;IACV,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,UAAU,EAAE,SAAS,CAAC;CACvB,+BA8IA;AAuBD,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,EAC3B,MAAM,EACN,OAAO,EACP,MAA4B,EAC5B,OAAO,EACP,IAAI,EACJ,MAAM,EACN,WAAW,EACX,QAAQ,GACT,EAAE,MAAM,GAAG;IACV,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAC;QACb,kEAAkE;QAClE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,aAAa,EAAE,OAAO,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC;QACb,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,2FAA2F;IAC3F,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,+BA8UA;AAED,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,IAAI,EACJ,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,CAAC"}