@lenne.tech/ng-base 18.1.2 → 22.0.0

package/fesm2022/lenne.tech-ng-base-auth.mjs

@@ -0,0 +1,454 @@
+import { LT_AUTH_OPTIONS, LtAuthStore, readLtAuthAnswer } from "@lenne.tech/ng-base/auth/provide";
+import { LtApiUrlService, LtI18nService, ltArrayBufferToBase64Url, ltBase64UrlToUint8Array, ltSha256 } from "@lenne.tech/ng-base";
+import * as i0 from "@angular/core";
+import { Service, inject } from "@angular/core";
+export * from "@lenne.tech/ng-base/auth/provide";
+const pluginRegistry = [];
+function registerLtAuthPlugins(plugins) {
+	pluginRegistry.push(...plugins);
+}
+function getLtAuthPluginRegistry() {
+	return [...pluginRegistry];
+}
+function clearLtAuthPluginRegistry() {
+	pluginRegistry.length = 0;
+}
+function resolveLtAuthClientBase(resolution, basePath) {
+	const trimmed = (basePath || "/iam").replace(/\/+$/, "");
+	const path = trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+	if (resolution.proxy) return {
+		basePath: path === "/api" || path.startsWith("/api/") ? path : `/api${path}`,
+		baseURL: ""
+	};
+	return {
+		basePath: path,
+		baseURL: resolution.baseUrl
+	};
+}
+function resolveLtAuthClientUrl(baseURL, basePath) {
+	const path = basePath ? basePath.startsWith("/") ? basePath : `/${basePath}` : "";
+	if (baseURL) return `${baseURL.replace(/\/+$/, "")}${path}`;
+	const origin = typeof location !== "undefined" ? location.origin : "";
+	return origin && origin !== "null" ? `${origin}${path}` : path;
+}
+function loadBetterAuth() {
+	return Promise.all([import("better-auth/client"), import("better-auth/client/plugins")]);
+}
+async function createLtAuthClient(config) {
+	const [{ createAuthClient }, { adminClient, twoFactorClient }] = await loadBetterAuth();
+	const plugins = [];
+	if (config.enableTwoFactor !== false) plugins.push(twoFactorClient({ onTwoFactorRedirect: () => config.onTwoFactorRedirect?.() }));
+	if (config.enableAdmin) plugins.push(adminClient());
+	plugins.push(...config.plugins ?? [], ...pluginRegistry);
+	const fetchImpl = config.fetch;
+	const raw = createAuthClient({
+		baseURL: resolveLtAuthClientUrl(config.baseURL, config.basePath),
+		fetchOptions: {
+			credentials: "include",
+			...fetchImpl ? { customFetchImpl: (input, init) => fetchImpl(input, init) } : {}
+		},
+		plugins
+	});
+	const client = raw;
+	const call = (path, args) => {
+		let target = client;
+		for (const key of path) target = target[key];
+		return target(...args);
+	};
+	const hashed = async (params, fields, method) => {
+		const result = { ...params };
+		for (const field of fields) {
+			const value = params[field];
+			if (typeof value !== "string" || !value) throw new Error(`[@lenne.tech/ng-base] ${method}: "${field}" is required`);
+			result[field] = await ltSha256(value);
+		}
+		return result;
+	};
+	const withOptions = (options) => options ? [{ fetchOptions: options }] : [];
+	return {
+		raw,
+		changePassword: async (params, options) => call(["changePassword"], [await hashed(params, ["currentPassword", "newPassword"], "changePassword"), ...withOptions(options)]),
+		getSession: (options) => call(["getSession"], options ? [{ fetchOptions: options }] : []),
+		passkey: {
+			deletePasskey: (params, options) => call(["$fetch"], ["/passkey/delete-passkey", {
+				body: params,
+				method: "POST",
+				...options
+			}]),
+			listUserPasskeys: (options) => call(["$fetch"], ["/passkey/list-user-passkeys", {
+				method: "GET",
+				...options
+			}]),
+			updatePasskey: (params, options) => call(["$fetch"], ["/passkey/update-passkey", {
+				body: params,
+				method: "POST",
+				...options
+			}])
+		},
+		requestPasswordReset: (params, options) => call(["requestPasswordReset"], [params, ...withOptions(options)]),
+		resetPassword: async (params, options) => call(["resetPassword"], [await hashed(params, ["newPassword"], "resetPassword"), ...withOptions(options)]),
+		sendVerificationEmail: (params, options) => call(["sendVerificationEmail"], [params, ...withOptions(options)]),
+		signIn: { email: async (params, options) => call(["signIn", "email"], [await hashed(params, ["password"], "signIn.email"), ...withOptions(options)]) },
+		signOut: (options) => call(["signOut"], options ? [{ fetchOptions: options }] : []),
+		signUp: { email: async (params, options) => call(["signUp", "email"], [await hashed(params, ["password"], "signUp.email"), ...withOptions(options)]) },
+		twoFactor: {
+			disable: async (params, options) => call(["twoFactor", "disable"], [await hashed(params, ["password"], "twoFactor.disable"), ...withOptions(options)]),
+			enable: async (params, options) => call(["twoFactor", "enable"], [await hashed(params, ["password"], "twoFactor.enable"), ...withOptions(options)]),
+			generateBackupCodes: async (params, options) => call(["twoFactor", "generateBackupCodes"], [await hashed(params, ["password"], "twoFactor.generateBackupCodes"), ...withOptions(options)]),
+			verifyBackupCode: (params, options) => call(["twoFactor", "verifyBackupCode"], [params, ...withOptions(options)]),
+			verifyTotp: (params, options) => call(["twoFactor", "verifyTotp"], [params, ...withOptions(options)])
+		},
+		verifyEmail: (params, options) => call(["verifyEmail"], [{ query: params }, ...withOptions(options)])
+	};
+}
+const LT_AUTH_MESSAGES = {
+	de: { lt: { "auth": {
+		"loggingOut": "Abmelden...",
+		"noPasskeySelected": "Kein Passkey ausgewählt",
+		"passkeyAborted": "Passkey-Authentifizierung wurde abgebrochen",
+		"passkeyAlreadyRegistered": "Du hast bereits einen Passkey für diese Website registriert. Lösche ihn zuerst oder verwende einen anderen Authenticator.",
+		"passkeyCreationAborted": "Passkey-Erstellung wurde abgebrochen",
+		"passkeyError": "Konnte Passkey-Optionen nicht laden",
+		"passkeyFailed": "Passkey-Anmeldung fehlgeschlagen",
+		"passkeyRegisterFailed": "Passkey-Registrierung fehlgeschlagen",
+		"passkeyUnsupported": "Passkeys werden in diesem Browser nicht unterstützt",
+		"registerOptionsError": "Konnte Registrierungsoptionen nicht laden",
+		"sessionExpired": "Sitzung abgelaufen"
+	} } },
+	en: { lt: { "auth": {
+		"loggingOut": "Logging out...",
+		"noPasskeySelected": "No passkey selected",
+		"passkeyAborted": "Passkey authentication was cancelled",
+		"passkeyAlreadyRegistered": "You already registered a passkey for this website. Delete it first or use another authenticator.",
+		"passkeyCreationAborted": "Passkey creation was cancelled",
+		"passkeyError": "Could not load passkey options",
+		"passkeyFailed": "Passkey login failed",
+		"passkeyRegisterFailed": "Passkey registration failed",
+		"passkeyUnsupported": "Passkeys are not supported in this browser",
+		"registerOptionsError": "Could not load registration options",
+		"sessionExpired": "Session expired"
+	} } }
+};
+function injectLtAuthI18n() {
+	const i18n = inject(LtI18nService);
+	i18n.registerLibraryMessages("auth", LT_AUTH_MESSAGES);
+	return i18n;
+}
+var LtAuthService = class LtAuthService {
+	store = inject(LtAuthStore);
+	api = inject(LtApiUrlService);
+	options = inject(LT_AUTH_OPTIONS);
+	i18n = injectLtAuthI18n();
+	clientRequest = null;
+	user = this.store.user;
+	isAuthenticated = this.store.isAuthenticated;
+	authMode = this.store.authMode;
+	isJwtMode = this.store.isJwtMode;
+	isLoading = this.store.isLoading;
+	isAdmin = this.store.isAdmin;
+	is2FAEnabled = this.store.is2FAEnabled;
+	features = this.store.features;
+	passkeySupported = this.store.passkeySupported;
+	getClient() {
+		if (!this.clientRequest) {
+			this.clientRequest = createLtAuthClient({
+				...resolveLtAuthClientBase(this.api.resolve(), this.options.basePath),
+				enableAdmin: this.options.enableAdmin,
+				enableTwoFactor: this.options.enableTwoFactor,
+				fetch: (input, init) => this.store.fetchWithAuth(input, init),
+				plugins: this.options.plugins
+			});
+			this.clientRequest.catch(() => {
+				this.clientRequest = null;
+			});
+		}
+		return this.clientRequest;
+	}
+	jwtToken() {
+		return this.store.jwtToken();
+	}
+	hasRole(role) {
+		return this.store.hasRole(role);
+	}
+	hasAnyRole(...roles) {
+		return this.store.hasAnyRole(...roles);
+	}
+	fetchFeatures() {
+		return this.store.fetchFeatures();
+	}
+	ensureFeatures() {
+		return this.store.ensureFeatures();
+	}
+	signIn = {
+		email: async (params, options) => this.store.withLoading(async () => {
+			const result = await (await this.getClient()).signIn.email(params, options);
+			if (readLtAuthAnswer(result).twoFactor) this.store.navigateKeepingRedirect(this.options.twoFactorRedirectPath);
+			else this.store.applyAuthResult(result);
+			return result;
+		}),
+		passkey: () => this.authenticateWithPasskey()
+	};
+	signUp = { email: async (params, options) => this.store.withLoading(async () => {
+		const result = await (await this.getClient()).signUp.email(params, options);
+		this.store.applyAuthResult(result);
+		return result;
+	}) };
+	signOut(options) {
+		return this.store.signOut(options);
+	}
+	setUser(user, mode = "cookie") {
+		this.store.setUser(user, mode);
+	}
+	clearUser() {
+		this.store.clearUser();
+	}
+	validateSession() {
+		return this.store.validateSession();
+	}
+	fetchWithAuth(input, init = {}) {
+		return this.store.fetchWithAuth(input, init);
+	}
+	recoverFrom401(url, sentToken) {
+		return this.store.recoverFrom401(url, sentToken);
+	}
+	handleUnauthorized(url) {
+		return this.store.handleUnauthorized(url);
+	}
+	switchToJwtMode() {
+		return this.store.switchToJwtMode();
+	}
+	refreshJwtToken() {
+		return this.store.refreshJwtToken();
+	}
+	async authenticateWithPasskey() {
+		if (!hasWebAuthn()) return {
+			error: this.i18n.t("lt.auth.passkeyUnsupported"),
+			success: false
+		};
+		return this.store.withLoading(async () => {
+			try {
+				const optionsResponse = await this.store.fetchWithAuth(this.store.authUrl("/passkey/generate-authenticate-options"), { method: "GET" });
+				if (!optionsResponse.ok) return {
+					error: this.i18n.t("lt.auth.passkeyError"),
+					success: false
+				};
+				const options = await optionsResponse.json();
+				const credential = await navigator.credentials.get({ publicKey: {
+					allowCredentials: (options.allowCredentials ?? []).map((descriptor) => ({
+						...descriptor,
+						id: typeof descriptor.id === "string" ? ltBase64UrlToUint8Array(descriptor.id).buffer : descriptor.id
+					})),
+					challenge: ltBase64UrlToUint8Array(options.challenge).buffer,
+					rpId: options.rpId,
+					timeout: options.timeout,
+					userVerification: options.userVerification
+				} });
+				if (!credential) return {
+					error: this.i18n.t("lt.auth.noPasskeySelected"),
+					success: false
+				};
+				const assertion = credential.response;
+				const authResponse = await this.store.fetchWithAuth(this.store.authUrl("/passkey/verify-authentication"), {
+					body: JSON.stringify({
+						challengeId: options.challengeId,
+						response: {
+							clientExtensionResults: credential.getClientExtensionResults?.() ?? {},
+							id: credential.id,
+							rawId: ltArrayBufferToBase64Url(credential.rawId),
+							response: {
+								authenticatorData: ltArrayBufferToBase64Url(assertion.authenticatorData),
+								clientDataJSON: ltArrayBufferToBase64Url(assertion.clientDataJSON),
+								signature: ltArrayBufferToBase64Url(assertion.signature),
+								userHandle: assertion.userHandle ? ltArrayBufferToBase64Url(assertion.userHandle) : null
+							},
+							type: credential.type
+						}
+					}),
+					headers: { "Content-Type": "application/json" },
+					method: "POST"
+				});
+				const result = await authResponse.json().catch(() => ({})) ?? {};
+				if (!authResponse.ok) return {
+					error: result.message || this.i18n.t("lt.auth.passkeyFailed"),
+					success: false
+				};
+				const user = await this.store.adoptVerifiedSession(result);
+				if (!user) return {
+					error: this.i18n.t("lt.auth.passkeyFailed"),
+					success: false
+				};
+				return {
+					session: result.session,
+					success: true,
+					user
+				};
+			} catch (error) {
+				if (error instanceof Error && error.name === "NotAllowedError") return {
+					error: this.i18n.t("lt.auth.passkeyAborted"),
+					success: false
+				};
+				return {
+					error: error instanceof Error && error.message ? error.message : this.i18n.t("lt.auth.passkeyFailed"),
+					success: false
+				};
+			}
+		});
+	}
+	async registerPasskey(name) {
+		if (!hasWebAuthn()) return {
+			error: this.i18n.t("lt.auth.passkeyUnsupported"),
+			success: false
+		};
+		return this.store.withLoading(async () => {
+			try {
+				const optionsResponse = await this.store.fetchWithAuth(this.store.authUrl("/passkey/generate-register-options"), { method: "GET" });
+				if (!optionsResponse.ok) return {
+					error: (await optionsResponse.json().catch(() => ({})))?.message || this.i18n.t("lt.auth.registerOptionsError"),
+					success: false
+				};
+				const options = await optionsResponse.json();
+				const credential = await navigator.credentials.create({ publicKey: {
+					attestation: options.attestation,
+					authenticatorSelection: options.authenticatorSelection,
+					challenge: ltBase64UrlToUint8Array(options.challenge).buffer,
+					excludeCredentials: (options.excludeCredentials ?? []).map((descriptor) => ({
+						...descriptor,
+						id: ltBase64UrlToUint8Array(descriptor.id).buffer
+					})),
+					pubKeyCredParams: options.pubKeyCredParams,
+					rp: options.rp,
+					timeout: options.timeout,
+					user: {
+						...options.user,
+						id: ltBase64UrlToUint8Array(options.user.id).buffer
+					}
+				} });
+				if (!credential) return {
+					error: this.i18n.t("lt.auth.passkeyCreationAborted"),
+					success: false
+				};
+				const attestation = credential.response;
+				const registerResponse = await this.store.fetchWithAuth(this.store.authUrl("/passkey/verify-registration"), {
+					body: JSON.stringify({
+						challengeId: options.challengeId,
+						name,
+						response: {
+							clientExtensionResults: credential.getClientExtensionResults?.() ?? {},
+							id: credential.id,
+							rawId: ltArrayBufferToBase64Url(credential.rawId),
+							response: {
+								attestationObject: ltArrayBufferToBase64Url(attestation.attestationObject),
+								clientDataJSON: ltArrayBufferToBase64Url(attestation.clientDataJSON),
+								transports: attestation.getTransports?.() ?? []
+							},
+							type: credential.type
+						}
+					}),
+					headers: { "Content-Type": "application/json" },
+					method: "POST"
+				});
+				const result = await registerResponse.json().catch(() => ({}));
+				if (!registerResponse.ok) return {
+					error: result?.message || this.i18n.t("lt.auth.passkeyRegisterFailed"),
+					success: false
+				};
+				return {
+					passkey: result,
+					success: true
+				};
+			} catch (error) {
+				if (error instanceof Error) {
+					if (error.name === "NotAllowedError") return {
+						error: this.i18n.t("lt.auth.passkeyCreationAborted"),
+						success: false
+					};
+					if (error.name === "InvalidStateError" || error.message.includes("already registered")) return {
+						error: this.i18n.t("lt.auth.passkeyAlreadyRegistered"),
+						success: false
+					};
+					return {
+						error: error.message || this.i18n.t("lt.auth.passkeyRegisterFailed"),
+						success: false
+					};
+				}
+				return {
+					error: this.i18n.t("lt.auth.passkeyRegisterFailed"),
+					success: false
+				};
+			}
+		});
+	}
+	passkey = {
+		delete: async (id) => (await this.getClient()).passkey.deletePasskey({ id }),
+		list: async () => (await this.getClient()).passkey.listUserPasskeys(),
+		update: async (id, name) => (await this.getClient()).passkey.updatePasskey({
+			id,
+			name
+		})
+	};
+	twoFactor = {
+		disable: async (params) => (await this.getClient()).twoFactor.disable(params),
+		enable: async (params) => (await this.getClient()).twoFactor.enable(params),
+		generateBackupCodes: async (params) => (await this.getClient()).twoFactor.generateBackupCodes(params),
+		verifyBackupCode: async (params) => this.adoptVerifiedSession(await (await this.getClient()).twoFactor.verifyBackupCode(params)),
+		verifyTotp: async (params) => this.adoptVerifiedSession(await (await this.getClient()).twoFactor.verifyTotp(params))
+	};
+	async changePassword(params) {
+		return (await this.getClient()).changePassword(params);
+	}
+	async requestPasswordReset(params) {
+		const redirectTo = params.redirectTo || this.absoluteAppUrl("/auth/reset-password");
+		return (await this.getClient()).requestPasswordReset({
+			...params,
+			redirectTo
+		});
+	}
+	async resetPassword(params) {
+		return (await this.getClient()).resetPassword(params);
+	}
+	async sendVerificationEmail(params) {
+		const callbackURL = params.callbackURL || this.absoluteAppUrl("/auth/login");
+		return (await this.getClient()).sendVerificationEmail({
+			...params,
+			callbackURL
+		});
+	}
+	async verifyEmail(params) {
+		return (await this.getClient()).verifyEmail(params);
+	}
+	absoluteAppUrl(path) {
+		return this.store.absoluteAppUrl(path);
+	}
+	async adoptVerifiedSession(result) {
+		if (!result || result.error || !result.data) return result;
+		await this.store.adoptVerifiedSession(result);
+		return result;
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.4",
+		ngImport: i0,
+		type: LtAuthService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Service
+	});
+	static ɵprov = i0.ɵɵngDeclareService({
+		minVersion: "22.0.0",
+		version: "22.2.4",
+		ngImport: i0,
+		type: LtAuthService
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.4",
+	ngImport: i0,
+	type: LtAuthService,
+	decorators: [{ type: Service }]
+});
+function hasWebAuthn() {
+	return typeof navigator !== "undefined" && !!navigator.credentials;
+}
+export { LtAuthService, clearLtAuthPluginRegistry, createLtAuthClient, getLtAuthPluginRegistry, registerLtAuthPlugins, resolveLtAuthClientBase, resolveLtAuthClientUrl };
+
+//# sourceMappingURL=lenne.tech-ng-base-auth.mjs.map

package/fesm2022/lenne.tech-ng-base-auth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"lenne.tech-ng-base-auth.mjs","names":[],"sources":["../../../projects/ng-base/auth/src/lib/auth-client.ts","../tmp-esm2022/auth/lib/i18n/de.json","../tmp-esm2022/auth/lib/i18n/en.json","../../../projects/ng-base/auth/src/lib/i18n.ts","../../../projects/ng-base/auth/src/lib/auth-service.ts"],"sourcesContent":["import type { createAuthClient } from 'better-auth/client';\nimport { ltSha256, type LtApiUrlResolution, type LtFetch } from '@lenne.tech/ng-base';\n\nimport type { LtAuthCallOptions, LtAuthResponse, LtNoStrayCredential, LtPasskey, LtTwoFactorEnableResult, LtUser } from '@lenne.tech/ng-base/auth/provide';\n\n/** Configuration of {@link createLtAuthClient}. */\nexport interface LtAuthClientConfig {\n  /** API origin (`''` for same-origin / proxy). */\n  baseURL: string;\n  /** Better Auth base path, e.g. `/iam` or `/api/iam` behind the dev proxy. */\n  basePath: string;\n  /** Register `adminClient()` (default `false`, see `LtAuthOptions.enableAdmin`). */\n  enableAdmin?: boolean;\n  /** Register `twoFactorClient()` (default `true`). */\n  enableTwoFactor?: boolean;\n  /** Fetch implementation (the auth-aware `LT_FETCH`). */\n  fetch?: LtFetch;\n  /** Called when a sign-in answers `twoFactorRedirect` (navigate to the 2FA page). */\n  onTwoFactorRedirect?: () => void | Promise<void>;\n  /** Additional Better Auth client plugins (e.g. `passkeyClient()` from `@better-auth/passkey/client`). */\n  plugins?: unknown[];\n}\n\n/**\n * The Better Auth client surface ng-base exposes. Every method that sends a credential hashes it with SHA-256 first\n * (`{ ...params, field: sha256(field) }`, never a whitelist), so a plaintext password never leaves the browser.\n */\nexport interface LtAuthClient {\n  /** The underlying Better Auth client (escape hatch; its methods do NOT hash). */\n  readonly raw: ReturnType<typeof createAuthClient>;\n  changePassword<T extends { currentPassword: string; newPassword: string; revokeOtherSessions?: boolean }>(\n    params: LtNoStrayCredential<T, 'currentPassword' | 'newPassword'>,\n    options?: LtAuthCallOptions,\n  ): Promise<LtAuthResponse>;\n  getSession(options?: LtAuthCallOptions): Promise<LtAuthResponse<{ session: Record<string, unknown>; user: LtUser } | null>>;\n  passkey: {\n    deletePasskey(params: { id: string }, options?: LtAuthCallOptions): Promise<LtAuthResponse>;\n    listUserPasskeys(options?: LtAuthCallOptions): Promise<LtAuthResponse<LtPasskey[]>>;\n    updatePasskey(params: { id: string; name: string }, options?: LtAuthCallOptions): Promise<LtAuthResponse>;\n  };\n  requestPasswordReset<T extends { email: string; redirectTo?: string }>(params: LtNoStrayCredential<T, never>, options?: LtAuthCallOptions): Promise<LtAuthResponse>;\n  resetPassword<T extends { newPassword: string; token: string }>(params: LtNoStrayCredential<T, 'newPassword'>, options?: LtAuthCallOptions): Promise<LtAuthResponse>;\n  sendVerificationEmail<T extends { callbackURL?: string; email: string }>(params: LtNoStrayCredential<T, never>, options?: LtAuthCallOptions): Promise<LtAuthResponse>;\n  signIn: {\n    email<T extends { callbackURL?: string; email: string; password: string; rememberMe?: boolean }>(\n      params: LtNoStrayCredential<T, 'password'>,\n      options?: LtAuthCallOptions,\n    ): Promise<LtAuthResponse>;\n  };\n  signOut(options?: LtAuthCallOptions): Promise<LtAuthResponse>;\n  signUp: {\n    email<T extends { callbackURL?: string; email: string; name: string; password: string }>(\n      params: LtNoStrayCredential<T, 'password'>,\n      options?: LtAuthCallOptions,\n    ): Promise<LtAuthResponse>;\n  };\n  twoFactor: {\n    disable<T extends { password: string }>(params: LtNoStrayCredential<T, 'password'>, options?: LtAuthCallOptions): Promise<LtAuthResponse>;\n    enable<T extends { issuer?: string; password: string }>(\n      params: LtNoStrayCredential<T, 'password'>,\n      options?: LtAuthCallOptions,\n    ): Promise<LtAuthResponse<LtTwoFactorEnableResult>>;\n    generateBackupCodes<T extends { password: string }>(\n      params: LtNoStrayCredential<T, 'password'>,\n      options?: LtAuthCallOptions,\n    ): Promise<LtAuthResponse<{ backupCodes: string[] }>>;\n    verifyBackupCode(params: { code: string; disableSession?: boolean; trustDevice?: boolean }, options?: LtAuthCallOptions): Promise<LtAuthResponse>;\n    verifyTotp(params: { code: string; trustDevice?: boolean }, options?: LtAuthCallOptions): Promise<LtAuthResponse>;\n  };\n  verifyEmail(params: { callbackURL?: string; token: string }, options?: LtAuthCallOptions): Promise<LtAuthResponse>;\n}\n\nconst pluginRegistry: unknown[] = [];\n\n/** Register extra Better Auth client plugins for every client created afterwards (prefer `provideLtAuth({ plugins })`). */\nexport function registerLtAuthPlugins(plugins: unknown[]): void {\n  pluginRegistry.push(...plugins);\n}\n\n/** Plugins registered via {@link registerLtAuthPlugins}. */\nexport function getLtAuthPluginRegistry(): readonly unknown[] {\n  return [...pluginRegistry];\n}\n\n/** Clear the plugin registry (tests). */\nexport function clearLtAuthPluginRegistry(): void {\n  pluginRegistry.length = 0;\n}\n\n/**\n * `baseURL` / `basePath` of the Better Auth client for an API URL resolution: behind the dev proxy the origin is the\n * app itself (`''`) and the path gets the `/api` prefix (`/iam` → `/api/iam`), otherwise the API base URL with the\n * configured path.\n */\nexport function resolveLtAuthClientBase(resolution: Pick<LtApiUrlResolution, 'baseUrl' | 'proxy'>, basePath: string): { basePath: string; baseURL: string } {\n  const trimmed = (basePath || '/iam').replace(/\\/+$/, '');\n  const path = trimmed.startsWith('/') ? trimmed : `/${trimmed}`;\n  if (resolution.proxy) {\n    return { basePath: path === '/api' || path.startsWith('/api/') ? path : `/api${path}`, baseURL: '' };\n  }\n  return { basePath: path, baseURL: resolution.baseUrl };\n}\n\n/**\n * Absolute Better Auth URL for `baseURL` + `basePath`.\n *\n * Better Auth rejects a relative `baseURL` (\"Invalid base URL\"), so an empty origin (same-origin deployment, dev proxy\n * `/api/iam`) is resolved against the browser origin. Without a usable origin (server without API URL) the path is\n * returned unchanged; such a client cannot reach the backend anyway.\n */\nexport function resolveLtAuthClientUrl(baseURL: string, basePath: string): string {\n  const path = basePath ? (basePath.startsWith('/') ? basePath : `/${basePath}`) : '';\n  if (baseURL) {\n    return `${baseURL.replace(/\\/+$/, '')}${path}`;\n  }\n  const origin = typeof location !== 'undefined' ? location.origin : '';\n  return origin && origin !== 'null' ? `${origin}${path}` : path;\n}\n\n/**\n * Load `better-auth/client` and its plugins on demand. Dynamic imports keep Better Auth (and better-fetch) out of the\n * initial bundle: esbuild puts them into a lazy chunk that is fetched with the first auth action.\n */\nfunction loadBetterAuth(): Promise<[typeof import('better-auth/client'), typeof import('better-auth/client/plugins')]> {\n  return Promise.all([import('better-auth/client'), import('better-auth/client/plugins')]);\n}\n\n/**\n * Create the hashing Better Auth client wrapper.\n *\n * Uses the framework-agnostic `better-auth/client` (`createAuthClient`) with `twoFactorClient()` (and `adminClient()` when\n * enabled), the plugins of `config.plugins` and the registry, and the given fetch. Async because Better Auth is loaded\n * on first use (see `LtAuthService.getClient()`, which shares one client per app).\n */\nexport async function createLtAuthClient(config: LtAuthClientConfig): Promise<LtAuthClient> {\n  const [{ createAuthClient }, { adminClient, twoFactorClient }] = await loadBetterAuth();\n  const plugins: unknown[] = [];\n  if (config.enableTwoFactor !== false) {\n    plugins.push(twoFactorClient({ onTwoFactorRedirect: () => config.onTwoFactorRedirect?.() }));\n  }\n  if (config.enableAdmin) {\n    plugins.push(adminClient());\n  }\n  plugins.push(...(config.plugins ?? []), ...pluginRegistry);\n  const fetchImpl = config.fetch;\n  const raw = createAuthClient({\n    baseURL: resolveLtAuthClientUrl(config.baseURL, config.basePath),\n    fetchOptions: {\n      credentials: 'include',\n      ...(fetchImpl ? { customFetchImpl: (input: RequestInfo | URL, init?: RequestInit) => fetchImpl(input, init) } : {}),\n    },\n    plugins: plugins as never[],\n  });\n  // Better Auth's client is a Proxy without own keys: every member is listed explicitly, never spread.\n  const client = raw as unknown as Record<string, any>;\n  const call = (path: string[], args: unknown[]): Promise<LtAuthResponse<any>> => {\n    let target: any = client;\n    for (const key of path) {\n      target = target[key];\n    }\n    return target(...args);\n  };\n  const hashed = async <T extends Record<string, unknown>>(params: T, fields: string[], method: string): Promise<T> => {\n    const result: Record<string, unknown> = { ...params };\n    for (const field of fields) {\n      const value = params[field];\n      if (typeof value !== 'string' || !value) {\n        throw new Error(`[@lenne.tech/ng-base] ${method}: \"${field}\" is required`);\n      }\n      result[field] = await ltSha256(value);\n    }\n    return result as T;\n  };\n  const withOptions = (options?: LtAuthCallOptions) => (options ? [{ fetchOptions: options }] : []);\n\n  return {\n    raw,\n    changePassword: async (params, options) =>\n      call(['changePassword'], [await hashed(params as Record<string, unknown>, ['currentPassword', 'newPassword'], 'changePassword'), ...withOptions(options)]),\n    getSession: (options) => call(['getSession'], options ? [{ fetchOptions: options }] : []),\n    passkey: {\n      deletePasskey: (params, options) => call(['$fetch'], ['/passkey/delete-passkey', { body: params, method: 'POST', ...options }]),\n      listUserPasskeys: (options) => call(['$fetch'], ['/passkey/list-user-passkeys', { method: 'GET', ...options }]),\n      updatePasskey: (params, options) => call(['$fetch'], ['/passkey/update-passkey', { body: params, method: 'POST', ...options }]),\n    },\n    requestPasswordReset: (params, options) => call(['requestPasswordReset'], [params, ...withOptions(options)]),\n    resetPassword: async (params, options) => call(['resetPassword'], [await hashed(params as Record<string, unknown>, ['newPassword'], 'resetPassword'), ...withOptions(options)]),\n    sendVerificationEmail: (params, options) => call(['sendVerificationEmail'], [params, ...withOptions(options)]),\n    signIn: {\n      email: async (params, options) => call(['signIn', 'email'], [await hashed(params as Record<string, unknown>, ['password'], 'signIn.email'), ...withOptions(options)]),\n    },\n    signOut: (options) => call(['signOut'], options ? [{ fetchOptions: options }] : []),\n    signUp: {\n      email: async (params, options) => call(['signUp', 'email'], [await hashed(params as Record<string, unknown>, ['password'], 'signUp.email'), ...withOptions(options)]),\n    },\n    twoFactor: {\n      disable: async (params, options) =>\n        call(['twoFactor', 'disable'], [await hashed(params as Record<string, unknown>, ['password'], 'twoFactor.disable'), ...withOptions(options)]),\n      enable: async (params, options) =>\n        call(['twoFactor', 'enable'], [await hashed(params as Record<string, unknown>, ['password'], 'twoFactor.enable'), ...withOptions(options)]),\n      generateBackupCodes: async (params, options) =>\n        call(['twoFactor', 'generateBackupCodes'], [await hashed(params as Record<string, unknown>, ['password'], 'twoFactor.generateBackupCodes'), ...withOptions(options)]),\n      verifyBackupCode: (params, options) => call(['twoFactor', 'verifyBackupCode'], [params, ...withOptions(options)]),\n      verifyTotp: (params, options) => call(['twoFactor', 'verifyTotp'], [params, ...withOptions(options)]),\n    },\n    verifyEmail: (params, options) => call(['verifyEmail'], [{ query: params }, ...withOptions(options)]),\n  };\n}\n","","","import { inject } from '@angular/core';\nimport { LtI18nService } from '@lenne.tech/ng-base';\n\nimport de from './i18n/de.json';\nimport en from './i18n/en.json';\n\n/** The `lt.auth.*` texts (also shipped as `i18n/auth/{de,en}.json`). */\nexport const LT_AUTH_MESSAGES = { de, en } as const;\n\n/** `LtI18nService` with the `lt.auth.*` texts registered (injection context). */\nexport function injectLtAuthI18n(): LtI18nService {\n  const i18n = inject(LtI18nService);\n  i18n.registerLibraryMessages('auth', LT_AUTH_MESSAGES);\n  return i18n;\n}\n","import { inject, Service, type Signal } from '@angular/core';\nimport { LtApiUrlService, ltArrayBufferToBase64Url, ltBase64UrlToUint8Array } from '@lenne.tech/ng-base';\nimport {\n  LT_AUTH_OPTIONS,\n  LtAuthStore,\n  readLtAuthAnswer,\n  type LtAuthCallOptions,\n  type LtAuthFeatures,\n  type LtAuthMode,\n  type LtAuthResponse,\n  type LtNoStrayCredential,\n  type LtPasskey,\n  type LtPasskeyAuthResult,\n  type LtPasskeyRegisterResult,\n  type LtTwoFactorEnableResult,\n  type LtUser,\n  type LtUserInput,\n} from '@lenne.tech/ng-base/auth/provide';\n\nimport { createLtAuthClient, resolveLtAuthClientBase, type LtAuthClient } from './auth-client';\nimport { injectLtAuthI18n } from './i18n';\n\n/** Passkey authentication options as nest-server sends them (base64url strings, plus the `challengeId` extension). */\ninterface LtPasskeyAuthenticationOptions {\n  allowCredentials?: { id: string; transports?: string[]; type: string }[];\n  challenge: string;\n  challengeId?: string;\n  rpId?: string;\n  timeout?: number;\n  userVerification?: UserVerificationRequirement;\n}\n\n/** Passkey registration options as nest-server sends them. */\ninterface LtPasskeyRegistrationOptions {\n  attestation?: AttestationConveyancePreference;\n  authenticatorSelection?: AuthenticatorSelectionCriteria;\n  challenge: string;\n  challengeId?: string;\n  excludeCredentials?: { id: string; transports?: string[]; type: string }[];\n  pubKeyCredParams: PublicKeyCredentialParameters[];\n  rp: PublicKeyCredentialRpEntity;\n  timeout?: number;\n  user: { displayName: string; id: string; name: string };\n}\n\n/**\n * Authentication against nest-server's Better Auth integration (`/iam`), the Angular counterpart of `useLtAuth()`.\n *\n * A facade over {@link LtAuthStore} (`@lenne.tech/ng-base/auth/provide`): state, transport, session validation and\n * sign-out are the store's (same signals, same methods), this service adds the flows that need Better Auth or WebAuthn\n * — sign-in/up, 2FA, passkeys, password and email. Guards, the interceptor and `provideLtAuth()` use the store only, so\n * this service (and Better Auth, loaded on first use) stays out of the initial bundle until a page injects it.\n *\n * State is signal-based and backed by the client-readable `lt-auth-state` cookie, so SSR renders the signed-in shell\n * from the request cookie (UI gating only; the session itself is the httpOnly `iam.session_token`).\n *\n * Transport: session cookie first; when cookies do not work (401 while the state says signed in) the service switches\n * to JWT mode (`GET /iam/token`, Bearer header) and refreshes a stale JWT once per burst. All credentials are SHA-256\n * hashed before they leave the browser.\n */\n@Service()\nexport class LtAuthService {\n  private readonly store = inject(LtAuthStore);\n  private readonly api = inject(LtApiUrlService);\n  private readonly options = inject(LT_AUTH_OPTIONS);\n  private readonly i18n = injectLtAuthI18n();\n  private clientRequest: Promise<LtAuthClient> | null = null;\n\n  // ── state (the store's signals) ────────────────────────────────────────────────────────────────────────────────────\n  /** Signed-in user (from the auth-state cookie, refreshed by `validateSession()` and every sign-in). */\n  readonly user: Signal<LtUser | null> = this.store.user;\n  /** Whether a user is signed in (UI gating; the backend decides). */\n  readonly isAuthenticated: Signal<boolean> = this.store.isAuthenticated;\n  /** Current transport. */\n  readonly authMode: Signal<LtAuthMode> = this.store.authMode;\n  /** Whether the JWT fallback is active. */\n  readonly isJwtMode: Signal<boolean> = this.store.isJwtMode;\n  /** Whether a sign-in/up/out or passkey flow is running. */\n  readonly isLoading: Signal<boolean> = this.store.isLoading;\n  /** Whether the user has the `admin` role (UX gate only). */\n  readonly isAdmin: Signal<boolean> = this.store.isAdmin;\n  /** Whether two-factor authentication is enabled for the user. */\n  readonly is2FAEnabled: Signal<boolean> = this.store.is2FAEnabled;\n  /** nest-server feature flags (`GET /iam/features`); fetched on the server and transferred to the browser. */\n  readonly features: Signal<LtAuthFeatures> = this.store.features;\n  /** Whether passkeys can be used: enabled in the options, backend feature on and WebAuthn available in this browser. */\n  readonly passkeySupported: Signal<boolean> = this.store.passkeySupported;\n\n  /**\n   * The hashing Better Auth client (see {@link LtAuthClient}), created once per app on first use. Better Auth is loaded\n   * lazily (dynamic import), so it is not part of the initial bundle; session state, guards, the interceptor and\n   * {@link fetchWithAuth} never need it. The client sends every request through {@link fetchWithAuth} (the same\n   * auth-aware fetch as `LT_FETCH`). During SSR it never carries the request's cookies, so do not use it on the\n   * server for anything that needs the user's session. A failed load is retried on the next call.\n   */\n  getClient(): Promise<LtAuthClient> {\n    if (!this.clientRequest) {\n      this.clientRequest = createLtAuthClient({\n        ...resolveLtAuthClientBase(this.api.resolve(), this.options.basePath),\n        enableAdmin: this.options.enableAdmin,\n        enableTwoFactor: this.options.enableTwoFactor,\n        // No onTwoFactorRedirect: nest-server answers `requiresTwoFactor`, Better Auth's plugin only sees\n        // `twoFactorRedirect`, so `signIn.email` recognises both itself and navigates once.\n        fetch: (input, init) => this.store.fetchWithAuth(input, init),\n        plugins: this.options.plugins,\n      });\n      this.clientRequest.catch(() => {\n        this.clientRequest = null;\n      });\n    }\n    return this.clientRequest;\n  }\n\n  /** The current JWT (JWT mode only), or `null`. */\n  jwtToken(): string | null {\n    return this.store.jwtToken();\n  }\n\n  // ── roles ──────────────────────────────────────────────────────────────────────────────────────────────────────────\n  /** `user.role === role` or `user.roles` contains it (case-sensitive). */\n  hasRole(role: string): boolean {\n    return this.store.hasRole(role);\n  }\n\n  /** Whether the user has any of the roles. */\n  hasAnyRole(...roles: string[]): boolean {\n    return this.store.hasAnyRole(...roles);\n  }\n\n  // ── features ───────────────────────────────────────────────────────────────────────────────────────────────────────\n  /** Fetch the feature flags (`GET /iam/features`, see {@link LtAuthStore.fetchFeatures}). */\n  fetchFeatures(): Promise<LtAuthFeatures> {\n    return this.store.fetchFeatures();\n  }\n\n  /** The feature flags, fetched at most once (transferred from SSR, or fetched on first call). */\n  ensureFeatures(): Promise<LtAuthFeatures> {\n    return this.store.ensureFeatures();\n  }\n\n  // ── sign-in / sign-up / sign-out ───────────────────────────────────────────────────────────────────────────────────\n  /**\n   * Email sign-in (password hashed). A second factor (`requiresTwoFactor` from nest-server or `twoFactorRedirect` from\n   * Better Auth) navigates to `twoFactorRedirectPath` (keeping the current `redirect` query parameter) and sets no user. A JWT-shaped body token (nest-server\n   * `cookies: false`) switches to JWT mode; otherwise the session cookie is used and a JWT is fetched in the background.\n   */\n  readonly signIn = {\n    email: async <T extends { callbackURL?: string; email: string; password: string; rememberMe?: boolean }>(\n      params: LtNoStrayCredential<T, 'password'>,\n      options?: LtAuthCallOptions,\n    ): Promise<LtAuthResponse> =>\n      this.store.withLoading(async () => {\n        const result = await (await this.getClient()).signIn.email(params, options);\n        if (readLtAuthAnswer(result).twoFactor) {\n          this.store.navigateKeepingRedirect(this.options.twoFactorRedirectPath);\n        } else {\n          this.store.applyAuthResult(result);\n        }\n        return result;\n      }),\n    /** Passkey sign-in (same as {@link authenticateWithPasskey}). */\n    passkey: (): Promise<LtPasskeyAuthResult> => this.authenticateWithPasskey(),\n  };\n\n  /**\n   * Email sign-up (password hashed), same token handling as sign-in. With email verification nest-server answers\n   * `emailVerificationRequired: true` and revokes the session: no user is set, the caller leads to the verify page.\n   */\n  readonly signUp = {\n    email: async <T extends { callbackURL?: string; email: string; name: string; password: string }>(\n      params: LtNoStrayCredential<T, 'password'>,\n      options?: LtAuthCallOptions,\n    ): Promise<LtAuthResponse> =>\n      this.store.withLoading(async () => {\n        const result = await (await this.getClient()).signUp.email(params, options);\n        this.store.applyAuthResult(result);\n        return result;\n      }),\n  };\n\n  /**\n   * Sign out: sign-out hooks (offline sync flush), `POST /iam/sign-out`, local state cleared, after-hooks (sync wipe).\n   * The local state is cleared even when the request fails (offline device). See {@link LtAuthStore.signOut}.\n   */\n  signOut(options?: LtAuthCallOptions): Promise<void> {\n    return this.store.signOut(options);\n  }\n\n  // ── session ────────────────────────────────────────────────────────────────────────────────────────────────────────\n  /** Store the user in state and cookie (browser always; SSR never writes). `image: null` becomes `undefined`. */\n  setUser(user: LtUserInput | null, mode: LtAuthMode = 'cookie'): void {\n    this.store.setUser(user, mode);\n  }\n\n  /** Clear local auth state and cookies (browser). Does not delete offline data (use `signOut()` for that). */\n  clearUser(): void {\n    this.store.clearUser();\n  }\n\n  /**\n   * Validate the session (app start / hard reload). Server: answers from the cookie, no backend call. Browser:\n   * `GET /iam/get-session` (≤ 10 s); a user is merged with the cached one (nest-server-only fields kept, authz keys\n   * fail-closed); no user but a cached one → `true` (e.g. right after 2FA); else `false`.\n   */\n  validateSession(): Promise<boolean> {\n    return this.store.validateSession();\n  }\n\n  /** The auth-aware fetch, also provided as `LT_FETCH` (see {@link LtAuthStore.fetchWithAuth}). */\n  fetchWithAuth(input: RequestInfo | URL, init: RequestInit = {}): Promise<Response> {\n    return this.store.fetchWithAuth(input, init);\n  }\n\n  /** Token to retry a request with after a 401 (see {@link LtAuthStore.recoverFrom401}). */\n  recoverFrom401(url: string, sentToken: string | null): Promise<string | null> {\n    return this.store.recoverFrom401(url, sentToken);\n  }\n\n  /** Session-loss handling for a 401 from `url` (see `LtUnauthorizedHandler`). */\n  handleUnauthorized(url?: string): Promise<boolean> {\n    return this.store.handleUnauthorized(url);\n  }\n\n  /** `GET /iam/token` → store the JWT and switch to JWT mode. One request per burst. Browser only. */\n  switchToJwtMode(): Promise<boolean> {\n    return this.store.switchToJwtMode();\n  }\n\n  /** Re-mint the JWT (JWT mode only). */\n  refreshJwtToken(): Promise<boolean> {\n    return this.store.refreshJwtToken();\n  }\n\n  // ── passkeys (WebAuthn, nest-server challengeId) ───────────────────────────────────────────────────────────────────\n  /** Passkey sign-in: options → `navigator.credentials.get` → `verify-authentication` (`challengeId`) → user set. */\n  async authenticateWithPasskey(): Promise<LtPasskeyAuthResult> {\n    if (!hasWebAuthn()) {\n      return { error: this.i18n.t('lt.auth.passkeyUnsupported'), success: false };\n    }\n    return this.store.withLoading(async () => {\n      try {\n        const optionsResponse = await this.store.fetchWithAuth(this.store.authUrl('/passkey/generate-authenticate-options'), { method: 'GET' });\n        if (!optionsResponse.ok) {\n          return { error: this.i18n.t('lt.auth.passkeyError'), success: false };\n        }\n        const options = (await optionsResponse.json()) as LtPasskeyAuthenticationOptions;\n        const credential = (await navigator.credentials.get({\n          publicKey: {\n            allowCredentials: (options.allowCredentials ?? []).map((descriptor) => ({\n              ...descriptor,\n              id: typeof descriptor.id === 'string' ? ltBase64UrlToUint8Array(descriptor.id).buffer : descriptor.id,\n            })) as PublicKeyCredentialDescriptor[],\n            challenge: ltBase64UrlToUint8Array(options.challenge).buffer,\n            rpId: options.rpId,\n            timeout: options.timeout,\n            userVerification: options.userVerification,\n          },\n        })) as PublicKeyCredential | null;\n        if (!credential) {\n          return { error: this.i18n.t('lt.auth.noPasskeySelected'), success: false };\n        }\n        const assertion = credential.response as AuthenticatorAssertionResponse;\n        const authResponse = await this.store.fetchWithAuth(this.store.authUrl('/passkey/verify-authentication'), {\n          body: JSON.stringify({\n            challengeId: options.challengeId,\n            response: {\n              clientExtensionResults: credential.getClientExtensionResults?.() ?? {},\n              id: credential.id,\n              rawId: ltArrayBufferToBase64Url(credential.rawId),\n              response: {\n                authenticatorData: ltArrayBufferToBase64Url(assertion.authenticatorData),\n                clientDataJSON: ltArrayBufferToBase64Url(assertion.clientDataJSON),\n                signature: ltArrayBufferToBase64Url(assertion.signature),\n                userHandle: assertion.userHandle ? ltArrayBufferToBase64Url(assertion.userHandle) : null,\n              },\n              type: credential.type,\n            },\n          }),\n          headers: { 'Content-Type': 'application/json' },\n          method: 'POST',\n        });\n        const result = ((await authResponse.json().catch(() => ({}))) ?? {}) as { message?: string; session?: { token: string }; user?: LtUserInput };\n        if (!authResponse.ok) {\n          return { error: result.message || this.i18n.t('lt.auth.passkeyFailed'), success: false };\n        }\n        // A JWT in the answer (nest-server with `cookies: false`) → JWT mode; otherwise the verification set the session\n        // cookie. The opaque session token (`session.token`, or `token` from older servers) is never stored as JWT (it\n        // would land in a script-readable cookie). Without user in the answer it is loaded from the session.\n        const user = await this.store.adoptVerifiedSession(result);\n        if (!user) {\n          return { error: this.i18n.t('lt.auth.passkeyFailed'), success: false };\n        }\n        return { session: result.session, success: true, user };\n      } catch (error) {\n        if (error instanceof Error && error.name === 'NotAllowedError') {\n          return { error: this.i18n.t('lt.auth.passkeyAborted'), success: false };\n        }\n        return { error: error instanceof Error && error.message ? error.message : this.i18n.t('lt.auth.passkeyFailed'), success: false };\n      }\n    });\n  }\n\n  /** Register a passkey for the signed-in user (`challengeId` body as nest-server expects). */\n  async registerPasskey(name?: string): Promise<LtPasskeyRegisterResult> {\n    if (!hasWebAuthn()) {\n      return { error: this.i18n.t('lt.auth.passkeyUnsupported'), success: false };\n    }\n    return this.store.withLoading(async () => {\n      try {\n        const optionsResponse = await this.store.fetchWithAuth(this.store.authUrl('/passkey/generate-register-options'), { method: 'GET' });\n        if (!optionsResponse.ok) {\n          const body = (await optionsResponse.json().catch(() => ({}))) as { message?: string } | null;\n          return { error: body?.message || this.i18n.t('lt.auth.registerOptionsError'), success: false };\n        }\n        const options = (await optionsResponse.json()) as LtPasskeyRegistrationOptions;\n        const credential = (await navigator.credentials.create({\n          publicKey: {\n            attestation: options.attestation,\n            authenticatorSelection: options.authenticatorSelection,\n            challenge: ltBase64UrlToUint8Array(options.challenge).buffer,\n            excludeCredentials: (options.excludeCredentials ?? []).map((descriptor) => ({\n              ...descriptor,\n              id: ltBase64UrlToUint8Array(descriptor.id).buffer,\n            })) as PublicKeyCredentialDescriptor[],\n            pubKeyCredParams: options.pubKeyCredParams,\n            rp: options.rp,\n            timeout: options.timeout,\n            user: { ...options.user, id: ltBase64UrlToUint8Array(options.user.id).buffer },\n          },\n        })) as PublicKeyCredential | null;\n        if (!credential) {\n          return { error: this.i18n.t('lt.auth.passkeyCreationAborted'), success: false };\n        }\n        const attestation = credential.response as AuthenticatorAttestationResponse;\n        const registerResponse = await this.store.fetchWithAuth(this.store.authUrl('/passkey/verify-registration'), {\n          body: JSON.stringify({\n            challengeId: options.challengeId,\n            name,\n            response: {\n              clientExtensionResults: credential.getClientExtensionResults?.() ?? {},\n              id: credential.id,\n              rawId: ltArrayBufferToBase64Url(credential.rawId),\n              response: {\n                attestationObject: ltArrayBufferToBase64Url(attestation.attestationObject),\n                clientDataJSON: ltArrayBufferToBase64Url(attestation.clientDataJSON),\n                transports: attestation.getTransports?.() ?? [],\n              },\n              type: credential.type,\n            },\n          }),\n          headers: { 'Content-Type': 'application/json' },\n          method: 'POST',\n        });\n        const result = (await registerResponse.json().catch(() => ({}))) as { message?: string } | null;\n        if (!registerResponse.ok) {\n          return { error: result?.message || this.i18n.t('lt.auth.passkeyRegisterFailed'), success: false };\n        }\n        return { passkey: result, success: true };\n      } catch (error) {\n        if (error instanceof Error) {\n          if (error.name === 'NotAllowedError') {\n            return { error: this.i18n.t('lt.auth.passkeyCreationAborted'), success: false };\n          }\n          // The authenticator already holds a credential of this account (it was in excludeCredentials).\n          if (error.name === 'InvalidStateError' || error.message.includes('already registered')) {\n            return { error: this.i18n.t('lt.auth.passkeyAlreadyRegistered'), success: false };\n          }\n          return { error: error.message || this.i18n.t('lt.auth.passkeyRegisterFailed'), success: false };\n        }\n        return { error: this.i18n.t('lt.auth.passkeyRegisterFailed'), success: false };\n      }\n    });\n  }\n\n  /** Passkey management of the signed-in user. */\n  readonly passkey = {\n    delete: async (id: string): Promise<LtAuthResponse> => (await this.getClient()).passkey.deletePasskey({ id }),\n    list: async (): Promise<LtAuthResponse<LtPasskey[]>> => (await this.getClient()).passkey.listUserPasskeys(),\n    update: async (id: string, name: string): Promise<LtAuthResponse> => (await this.getClient()).passkey.updatePasskey({ id, name }),\n  };\n\n  // ── two-factor (TOTP + backup codes) ───────────────────────────────────────────────────────────────────────────────\n  /** Two-factor methods (passwords hashed). `verifyTotp` / `verifyBackupCode` set the user on success (fix vs. Nuxt). */\n  readonly twoFactor = {\n    disable: async <T extends { password: string }>(params: LtNoStrayCredential<T, 'password'>): Promise<LtAuthResponse> => (await this.getClient()).twoFactor.disable(params),\n    enable: async <T extends { issuer?: string; password: string }>(params: LtNoStrayCredential<T, 'password'>): Promise<LtAuthResponse<LtTwoFactorEnableResult>> =>\n      (await this.getClient()).twoFactor.enable(params),\n    generateBackupCodes: async <T extends { password: string }>(params: LtNoStrayCredential<T, 'password'>): Promise<LtAuthResponse<{ backupCodes: string[] }>> =>\n      (await this.getClient()).twoFactor.generateBackupCodes(params),\n    verifyBackupCode: async (params: { code: string; trustDevice?: boolean }): Promise<LtAuthResponse> =>\n      this.adoptVerifiedSession(await (await this.getClient()).twoFactor.verifyBackupCode(params)),\n    verifyTotp: async (params: { code: string; trustDevice?: boolean }): Promise<LtAuthResponse> =>\n      this.adoptVerifiedSession(await (await this.getClient()).twoFactor.verifyTotp(params)),\n  };\n\n  // ── password & email ───────────────────────────────────────────────────────────────────────────────────────────────\n  /** `POST /iam/change-password` (both passwords hashed; `revokeOtherSessions` forwarded). */\n  async changePassword<T extends { currentPassword: string; newPassword: string; revokeOtherSessions?: boolean }>(\n    params: LtNoStrayCredential<T, 'currentPassword' | 'newPassword'>,\n  ): Promise<LtAuthResponse> {\n    return (await this.getClient()).changePassword(params);\n  }\n\n  /** `POST /iam/request-password-reset`; `redirectTo` defaults to `<siteUrl>/auth/reset-password` (absolute, never user-derived). */\n  async requestPasswordReset<T extends { email: string; redirectTo?: string }>(params: LtNoStrayCredential<T, never>): Promise<LtAuthResponse> {\n    const redirectTo = params.redirectTo || this.absoluteAppUrl('/auth/reset-password');\n    return (await this.getClient()).requestPasswordReset({ ...params, redirectTo });\n  }\n\n  /** `POST /iam/reset-password` with `{ newPassword (hashed), token }`. */\n  async resetPassword<T extends { newPassword: string; token: string }>(params: LtNoStrayCredential<T, 'newPassword'>): Promise<LtAuthResponse> {\n    return (await this.getClient()).resetPassword(params);\n  }\n\n  /** `POST /iam/send-verification-email`; `callbackURL` defaults to `<siteUrl>/auth/login` (absolute). */\n  async sendVerificationEmail<T extends { callbackURL?: string; email: string }>(params: LtNoStrayCredential<T, never>): Promise<LtAuthResponse> {\n    const callbackURL = params.callbackURL || this.absoluteAppUrl('/auth/login');\n    return (await this.getClient()).sendVerificationEmail({ ...params, callbackURL });\n  }\n\n  /** `GET /iam/verify-email?token=` (JSON answer without `callbackURL`). */\n  async verifyEmail(params: { callbackURL?: string; token: string }): Promise<LtAuthResponse> {\n    return (await this.getClient()).verifyEmail(params);\n  }\n\n  /**\n   * Build an absolute app URL from `NG_PUBLIC_SITE_URL` (or the browser origin), for `redirectTo` / `callbackURL`.\n   * Never derived from the request: on the server without a site URL it throws. Absolute input is returned unchanged.\n   */\n  absoluteAppUrl(path: string): string {\n    return this.store.absoluteAppUrl(path);\n  }\n\n  /**\n   * After a successful 2FA verification: see {@link LtAuthStore.adoptVerifiedSession} (a JWT in the answer → JWT mode,\n   * else cookie mode; Better Auth's opaque session token is never stored as JWT, that would put the session into a\n   * script-readable cookie).\n   */\n  private async adoptVerifiedSession(result: LtAuthResponse): Promise<LtAuthResponse> {\n    if (!result || result.error || !result.data) {\n      return result;\n    }\n    await this.store.adoptVerifiedSession(result);\n    return result;\n  }\n}\n\nfunction hasWebAuthn(): boolean {\n  return typeof navigator !== 'undefined' && !!navigator.credentials;\n}\n"],"mappings":";;;;;AAwEA,MAAM,iBAA4B,CAAA;AAGlC,SAAgB,sBAAsB,SAAkB;CACtD,eAAe,KAAK,GAAG,OAAO;AAChC;AAGA,SAAgB,0BAAuB;CACrC,OAAO,CAAC,GAAG,cAAc;AAC3B;AAGA,SAAgB,4BAAyB;CACvC,eAAe,SAAS;AAC1B;AAOA,SAAgB,wBAAwB,YAA2D,UAAgB;CACjH,MAAM,WAAW,YAAY,OAAA,CAAQ,QAAQ,QAAQ,EAAE;CACvD,MAAM,OAAO,QAAQ,WAAW,GAAG,IAAI,UAAU,IAAI;CACrD,IAAI,WAAW,OACb,OAAO;EAAE,UAAU,SAAS,UAAU,KAAK,WAAW,OAAO,IAAI,OAAO,OAAO;EAAQ,SAAS;CAAE;CAEpG,OAAO;EAAE,UAAU;EAAM,SAAS,WAAW;CAAO;AACtD;AASA,SAAgB,uBAAuB,SAAiB,UAAgB;CACtE,MAAM,OAAO,WAAY,SAAS,WAAW,GAAG,IAAI,WAAW,IAAI,aAAc;CACjF,IAAI,SACF,OAAO,GAAG,QAAQ,QAAQ,QAAQ,EAAE,IAAI;CAE1C,MAAM,SAAS,OAAO,aAAa,cAAc,SAAS,SAAS;CACnE,OAAO,UAAU,WAAW,SAAS,GAAG,SAAS,SAAS;AAC5D;AAMA,SAAS,iBAAc;CACrB,OAAO,QAAQ,IAAI,CAAC,OAAO,uBAAuB,OAAO,6BAA6B,CAAC;AACzF;AASA,eAAsB,mBAAmB,QAA0B;CACjE,MAAM,CAAC,EAAE,oBAAoB,EAAE,aAAa,qBAAqB,MAAM,eAAc;CACrF,MAAM,UAAqB,CAAA;CAC3B,IAAI,OAAO,oBAAoB,OAC7B,QAAQ,KAAK,gBAAgB,EAAE,2BAA2B,OAAO,sBAAqB,EAAE,CAAE,CAAC;CAE7F,IAAI,OAAO,aACT,QAAQ,KAAK,YAAW,CAAE;CAE5B,QAAQ,KAAK,GAAI,OAAO,WAAW,CAAA,GAAK,GAAG,cAAc;CACzD,MAAM,YAAY,OAAO;CACzB,MAAM,MAAM,iBAAiB;EAC3B,SAAS,uBAAuB,OAAO,SAAS,OAAO,QAAQ;EAC/D,cAAc;GACZ,aAAa;GACb,GAAI,YAAY,EAAE,kBAAkB,OAA0B,SAAuB,UAAU,OAAO,IAAI,EAAC,IAAK,CAAA;EACjH;EACQ;CACV,CAAA;CAED,MAAM,SAAS;CACf,MAAM,QAAQ,MAAgB,SAAiD;EAC7E,IAAI,SAAc;EAClB,KAAK,MAAM,OAAO,MAChB,SAAS,OAAO;EAElB,OAAO,OAAO,GAAG,IAAI;CACvB;CACA,MAAM,SAAS,OAA0C,QAAW,QAAkB,WAA8B;EAClH,MAAM,SAAkC,EAAE,GAAG,OAAM;EACnD,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,QAAQ,OAAO;GACrB,IAAI,OAAO,UAAU,YAAY,CAAC,OAChC,MAAM,IAAI,MAAM,yBAAyB,OAAM,KAAM,MAAK,cAAe;GAE3E,OAAO,SAAS,MAAM,SAAS,KAAK;EACtC;EACA,OAAO;CACT;CACA,MAAM,eAAe,YAAiC,UAAU,CAAC,EAAE,cAAc,QAAO,CAAE,IAAI,CAAA;CAE9F,OAAO;EACL;EACA,gBAAgB,OAAO,QAAQ,YAC7B,KAAK,CAAC,gBAAgB,GAAG,CAAC,MAAM,OAAO,QAAmC,CAAC,mBAAmB,aAAa,GAAG,gBAAgB,GAAG,GAAG,YAAY,OAAO,CAAC,CAAC;EAC3J,aAAa,YAAY,KAAK,CAAC,YAAY,GAAG,UAAU,CAAC,EAAE,cAAc,QAAO,CAAE,IAAI,CAAA,CAAE;EACxF,SAAS;GACP,gBAAgB,QAAQ,YAAY,KAAK,CAAC,QAAQ,GAAG,CAAC,2BAA2B;IAAE,MAAM;IAAQ,QAAQ;IAAQ,GAAG;GAAO,CAAE,CAAC;GAC9H,mBAAmB,YAAY,KAAK,CAAC,QAAQ,GAAG,CAAC,+BAA+B;IAAE,QAAQ;IAAO,GAAG;GAAO,CAAE,CAAC;GAC9G,gBAAgB,QAAQ,YAAY,KAAK,CAAC,QAAQ,GAAG,CAAC,2BAA2B;IAAE,MAAM;IAAQ,QAAQ;IAAQ,GAAG;GAAO,CAAE,CAAC;EAC/H;EACD,uBAAuB,QAAQ,YAAY,KAAK,CAAC,sBAAsB,GAAG,CAAC,QAAQ,GAAG,YAAY,OAAO,CAAC,CAAC;EAC3G,eAAe,OAAO,QAAQ,YAAY,KAAK,CAAC,eAAe,GAAG,CAAC,MAAM,OAAO,QAAmC,CAAC,aAAa,GAAG,eAAe,GAAG,GAAG,YAAY,OAAO,CAAC,CAAC;EAC9K,wBAAwB,QAAQ,YAAY,KAAK,CAAC,uBAAuB,GAAG,CAAC,QAAQ,GAAG,YAAY,OAAO,CAAC,CAAC;EAC7G,QAAQ,EACN,OAAO,OAAO,QAAQ,YAAY,KAAK,CAAC,UAAU,OAAO,GAAG,CAAC,MAAM,OAAO,QAAmC,CAAC,UAAU,GAAG,cAAc,GAAG,GAAG,YAAY,OAAO,CAAC,CAAC,EACrK;EACD,UAAU,YAAY,KAAK,CAAC,SAAS,GAAG,UAAU,CAAC,EAAE,cAAc,QAAO,CAAE,IAAI,CAAA,CAAE;EAClF,QAAQ,EACN,OAAO,OAAO,QAAQ,YAAY,KAAK,CAAC,UAAU,OAAO,GAAG,CAAC,MAAM,OAAO,QAAmC,CAAC,UAAU,GAAG,cAAc,GAAG,GAAG,YAAY,OAAO,CAAC,CAAC,EACrK;EACD,WAAW;GACT,SAAS,OAAO,QAAQ,YACtB,KAAK,CAAC,aAAa,SAAS,GAAG,CAAC,MAAM,OAAO,QAAmC,CAAC,UAAU,GAAG,mBAAmB,GAAG,GAAG,YAAY,OAAO,CAAC,CAAC;GAC9I,QAAQ,OAAO,QAAQ,YACrB,KAAK,CAAC,aAAa,QAAQ,GAAG,CAAC,MAAM,OAAO,QAAmC,CAAC,UAAU,GAAG,kBAAkB,GAAG,GAAG,YAAY,OAAO,CAAC,CAAC;GAC5I,qBAAqB,OAAO,QAAQ,YAClC,KAAK,CAAC,aAAa,qBAAqB,GAAG,CAAC,MAAM,OAAO,QAAmC,CAAC,UAAU,GAAG,+BAA+B,GAAG,GAAG,YAAY,OAAO,CAAC,CAAC;GACtK,mBAAmB,QAAQ,YAAY,KAAK,CAAC,aAAa,kBAAkB,GAAG,CAAC,QAAQ,GAAG,YAAY,OAAO,CAAC,CAAC;GAChH,aAAa,QAAQ,YAAY,KAAK,CAAC,aAAa,YAAY,GAAG,CAAC,QAAQ,GAAG,YAAY,OAAO,CAAC,CAAC;EACrG;EACD,cAAc,QAAQ,YAAY,KAAK,CAAC,aAAa,GAAG,CAAC,EAAE,OAAO,OAAM,GAAI,GAAG,YAAY,OAAO,CAAC,CAAC;CACrG;AACH;AGxMA,MAAa,mBAAmB;CAAE,IAAA,E;;;;;;;;;;;;C,IAAA;CAAI,IAAA,E;;;;;;;;;;;;C,IAAA;AAAE;AAGxC,SAAgB,mBAAgB;CAC9B,MAAM,OAAO,OAAO,aAAa;CACjC,KAAK,wBAAwB,QAAQ,gBAAgB;CACrD,OAAO;AACT;AC+CA,IAAa,gBAAb,MAAa,cAAa;CACP,QAAQ,OAAO,WAAW;CAC1B,MAAM,OAAO,eAAe;CAC5B,UAAU,OAAO,eAAe;CAChC,OAAO,iBAAgB;CAChC,gBAA8C;CAI7C,OAA8B,KAAK,MAAM;CAEzC,kBAAmC,KAAK,MAAM;CAE9C,WAA+B,KAAK,MAAM;CAE1C,YAA6B,KAAK,MAAM;CAExC,YAA6B,KAAK,MAAM;CAExC,UAA2B,KAAK,MAAM;CAEtC,eAAgC,KAAK,MAAM;CAE3C,WAAmC,KAAK,MAAM;CAE9C,mBAAoC,KAAK,MAAM;CASxD,YAAS;EACP,IAAI,CAAC,KAAK,eAAe;GACvB,KAAK,gBAAgB,mBAAmB;IACtC,GAAG,wBAAwB,KAAK,IAAI,QAAO,GAAI,KAAK,QAAQ,QAAQ;IACpE,aAAa,KAAK,QAAQ;IAC1B,iBAAiB,KAAK,QAAQ;IAG9B,QAAQ,OAAO,SAAS,KAAK,MAAM,cAAc,OAAO,IAAI;IAC5D,SAAS,KAAK,QAAQ;GACvB,CAAA;GACD,KAAK,cAAc,YAAW;IAC5B,KAAK,gBAAgB;GACvB,CAAC;EACH;EACA,OAAO,KAAK;CACd;CAGA,WAAQ;EACN,OAAO,KAAK,MAAM,SAAQ;CAC5B;CAIA,QAAQ,MAAY;EAClB,OAAO,KAAK,MAAM,QAAQ,IAAI;CAChC;CAGA,WAAW,GAAG,OAAe;EAC3B,OAAO,KAAK,MAAM,WAAW,GAAG,KAAK;CACvC;CAIA,gBAAa;EACX,OAAO,KAAK,MAAM,cAAa;CACjC;CAGA,iBAAc;EACZ,OAAO,KAAK,MAAM,eAAc;CAClC;CAQS,SAAS;EAChB,OAAO,OACL,QACA,YAEA,KAAK,MAAM,YAAY,YAAW;GAChC,MAAM,SAAS,OAAO,MAAM,KAAK,UAAS,EAAA,CAAI,OAAO,MAAM,QAAQ,OAAO;GAC1E,IAAI,iBAAiB,MAAM,CAAC,CAAC,WAC3B,KAAK,MAAM,wBAAwB,KAAK,QAAQ,qBAAqB;QAErE,KAAK,MAAM,gBAAgB,MAAM;GAEnC,OAAO;EACT,CAAC;EAEH,eAA6C,KAAK,wBAAuB;CAC1E;CAMQ,SAAS,EAChB,OAAO,OACL,QACA,YAEA,KAAK,MAAM,YAAY,YAAW;EAChC,MAAM,SAAS,OAAO,MAAM,KAAK,UAAS,EAAA,CAAI,OAAO,MAAM,QAAQ,OAAO;EAC1E,KAAK,MAAM,gBAAgB,MAAM;EACjC,OAAO;CACT,CAAC,EACJ;CAMD,QAAQ,SAA2B;EACjC,OAAO,KAAK,MAAM,QAAQ,OAAO;CACnC;CAIA,QAAQ,MAA0B,OAAmB,UAAQ;EAC3D,KAAK,MAAM,QAAQ,MAAM,IAAI;CAC/B;CAGA,YAAS;EACP,KAAK,MAAM,UAAS;CACtB;CAOA,kBAAe;EACb,OAAO,KAAK,MAAM,gBAAe;CACnC;CAGA,cAAc,OAA0B,OAAoB,CAAA,GAAE;EAC5D,OAAO,KAAK,MAAM,cAAc,OAAO,IAAI;CAC7C;CAGA,eAAe,KAAa,WAAwB;EAClD,OAAO,KAAK,MAAM,eAAe,KAAK,SAAS;CACjD;CAGA,mBAAmB,KAAY;EAC7B,OAAO,KAAK,MAAM,mBAAmB,GAAG;CAC1C;CAGA,kBAAe;EACb,OAAO,KAAK,MAAM,gBAAe;CACnC;CAGA,kBAAe;EACb,OAAO,KAAK,MAAM,gBAAe;CACnC;CAIA,MAAM,0BAAuB;EAC3B,IAAI,CAAC,YAAW,GACd,OAAO;GAAE,OAAO,KAAK,KAAK,EAAE,4BAA4B;GAAG,SAAS;EAAK;EAE3E,OAAO,KAAK,MAAM,YAAY,YAAW;GACvC,IAAI;IACF,MAAM,kBAAkB,MAAM,KAAK,MAAM,cAAc,KAAK,MAAM,QAAQ,wCAAwC,GAAG,EAAE,QAAQ,MAAK,CAAE;IACtI,IAAI,CAAC,gBAAgB,IACnB,OAAO;KAAE,OAAO,KAAK,KAAK,EAAE,sBAAsB;KAAG,SAAS;IAAK;IAErE,MAAM,UAAW,MAAM,gBAAgB,KAAI;IAC3C,MAAM,aAAc,MAAM,UAAU,YAAY,IAAI,EAClD,WAAW;KACT,mBAAmB,QAAQ,oBAAoB,CAAA,EAAA,CAAI,KAAK,gBAAgB;MACtE,GAAG;MACH,IAAI,OAAO,WAAW,OAAO,WAAW,wBAAwB,WAAW,EAAE,CAAC,CAAC,SAAS,WAAW;KACpG,EAAC;KACF,WAAW,wBAAwB,QAAQ,SAAS,CAAC,CAAC;KACtD,MAAM,QAAQ;KACd,SAAS,QAAQ;KACjB,kBAAkB,QAAQ;IAC3B,EACF,CAAA;IACD,IAAI,CAAC,YACH,OAAO;KAAE,OAAO,KAAK,KAAK,EAAE,2BAA2B;KAAG,SAAS;IAAK;IAE1E,MAAM,YAAY,WAAW;IAC7B,MAAM,eAAe,MAAM,KAAK,MAAM,cAAc,KAAK,MAAM,QAAQ,gCAAgC,GAAG;KACxG,MAAM,KAAK,UAAU;MACnB,aAAa,QAAQ;MACrB,UAAU;OACR,wBAAwB,WAAW,4BAA2B,KAAM,CAAA;OACpE,IAAI,WAAW;OACf,OAAO,yBAAyB,WAAW,KAAK;OAChD,UAAU;QACR,mBAAmB,yBAAyB,UAAU,iBAAiB;QACvE,gBAAgB,yBAAyB,UAAU,cAAc;QACjE,WAAW,yBAAyB,UAAU,SAAS;QACvD,YAAY,UAAU,aAAa,yBAAyB,UAAU,UAAU,IAAI;OACrF;OACD,MAAM,WAAW;MAClB;KACF,CAAA;KACD,SAAS,EAAE,gBAAgB,mBAAkB;KAC7C,QAAQ;IACT,CAAA;IACD,MAAM,SAAW,MAAM,aAAa,KAAI,CAAE,CAAC,aAAa,CAAA,EAAG,KAAM,CAAA;IACjE,IAAI,CAAC,aAAa,IAChB,OAAO;KAAE,OAAO,OAAO,WAAW,KAAK,KAAK,EAAE,uBAAuB;KAAG,SAAS;IAAK;IAKxF,MAAM,OAAO,MAAM,KAAK,MAAM,qBAAqB,MAAM;IACzD,IAAI,CAAC,MACH,OAAO;KAAE,OAAO,KAAK,KAAK,EAAE,uBAAuB;KAAG,SAAS;IAAK;IAEtE,OAAO;KAAE,SAAS,OAAO;KAAS,SAAS;KAAM;IAAI;GACvD,SAAS,OAAO;IACd,IAAI,iBAAiB,SAAS,MAAM,SAAS,mBAC3C,OAAO;KAAE,OAAO,KAAK,KAAK,EAAE,wBAAwB;KAAG,SAAS;IAAK;IAEvE,OAAO;KAAE,OAAO,iBAAiB,SAAS,MAAM,UAAU,MAAM,UAAU,KAAK,KAAK,EAAE,uBAAuB;KAAG,SAAS;IAAK;GAChI;EACF,CAAC;CACH;CAGA,MAAM,gBAAgB,MAAa;EACjC,IAAI,CAAC,YAAW,GACd,OAAO;GAAE,OAAO,KAAK,KAAK,EAAE,4BAA4B;GAAG,SAAS;EAAK;EAE3E,OAAO,KAAK,MAAM,YAAY,YAAW;GACvC,IAAI;IACF,MAAM,kBAAkB,MAAM,KAAK,MAAM,cAAc,KAAK,MAAM,QAAQ,oCAAoC,GAAG,EAAE,QAAQ,MAAK,CAAE;IAClI,IAAI,CAAC,gBAAgB,IAEnB,OAAO;KAAE,QAAO,MADI,gBAAgB,KAAI,CAAE,CAAC,aAAa,CAAA,EAAG,EAC3C,EAAM,WAAW,KAAK,KAAK,EAAE,8BAA8B;KAAG,SAAS;IAAK;IAE9F,MAAM,UAAW,MAAM,gBAAgB,KAAI;IAC3C,MAAM,aAAc,MAAM,UAAU,YAAY,OAAO,EACrD,WAAW;KACT,aAAa,QAAQ;KACrB,wBAAwB,QAAQ;KAChC,WAAW,wBAAwB,QAAQ,SAAS,CAAC,CAAC;KACtD,qBAAqB,QAAQ,sBAAsB,CAAA,EAAA,CAAI,KAAK,gBAAgB;MAC1E,GAAG;MACH,IAAI,wBAAwB,WAAW,EAAE,CAAC,CAAC;KAC5C,EAAC;KACF,kBAAkB,QAAQ;KAC1B,IAAI,QAAQ;KACZ,SAAS,QAAQ;KACjB,MAAM;MAAE,GAAG,QAAQ;MAAM,IAAI,wBAAwB,QAAQ,KAAK,EAAE,CAAC,CAAC;KAAM;IAC7E,EACF,CAAA;IACD,IAAI,CAAC,YACH,OAAO;KAAE,OAAO,KAAK,KAAK,EAAE,gCAAgC;KAAG,SAAS;IAAK;IAE/E,MAAM,cAAc,WAAW;IAC/B,MAAM,mBAAmB,MAAM,KAAK,MAAM,cAAc,KAAK,MAAM,QAAQ,8BAA8B,GAAG;KAC1G,MAAM,KAAK,UAAU;MACnB,aAAa,QAAQ;MACrB;MACA,UAAU;OACR,wBAAwB,WAAW,4BAA2B,KAAM,CAAA;OACpE,IAAI,WAAW;OACf,OAAO,yBAAyB,WAAW,KAAK;OAChD,UAAU;QACR,mBAAmB,yBAAyB,YAAY,iBAAiB;QACzE,gBAAgB,yBAAyB,YAAY,cAAc;QACnE,YAAY,YAAY,gBAAe,KAAM,CAAA;OAC9C;OACD,MAAM,WAAW;MAClB;KACF,CAAA;KACD,SAAS,EAAE,gBAAgB,mBAAkB;KAC7C,QAAQ;IACT,CAAA;IACD,MAAM,SAAU,MAAM,iBAAiB,KAAI,CAAE,CAAC,aAAa,CAAA,EAAG;IAC9D,IAAI,CAAC,iBAAiB,IACpB,OAAO;KAAE,OAAO,QAAQ,WAAW,KAAK,KAAK,EAAE,+BAA+B;KAAG,SAAS;IAAK;IAEjG,OAAO;KAAE,SAAS;KAAQ,SAAS;IAAI;GACzC,SAAS,OAAO;IACd,IAAI,iBAAiB,OAAO;KAC1B,IAAI,MAAM,SAAS,mBACjB,OAAO;MAAE,OAAO,KAAK,KAAK,EAAE,gCAAgC;MAAG,SAAS;KAAK;KAG/E,IAAI,MAAM,SAAS,uBAAuB,MAAM,QAAQ,SAAS,oBAAoB,GACnF,OAAO;MAAE,OAAO,KAAK,KAAK,EAAE,kCAAkC;MAAG,SAAS;KAAK;KAEjF,OAAO;MAAE,OAAO,MAAM,WAAW,KAAK,KAAK,EAAE,+BAA+B;MAAG,SAAS;KAAK;IAC/F;IACA,OAAO;KAAE,OAAO,KAAK,KAAK,EAAE,+BAA+B;KAAG,SAAS;IAAK;GAC9E;EACF,CAAC;CACH;CAGS,UAAU;EACjB,QAAQ,OAAO,QAAyC,MAAM,KAAK,UAAS,EAAA,CAAI,QAAQ,cAAc,EAAE,GAAE,CAAE;EAC5G,MAAM,aAAmD,MAAM,KAAK,UAAS,EAAA,CAAI,QAAQ,iBAAgB;EACzG,QAAQ,OAAO,IAAY,UAA2C,MAAM,KAAK,UAAS,EAAA,CAAI,QAAQ,cAAc;GAAE;GAAI;EAAI,CAAE;CACjI;CAIQ,YAAY;EACnB,SAAS,OAAuC,YAAyE,MAAM,KAAK,UAAS,EAAA,CAAI,UAAU,QAAQ,MAAM;EACzK,QAAQ,OAAwD,YAC7D,MAAM,KAAK,UAAS,EAAA,CAAI,UAAU,OAAO,MAAM;EAClD,qBAAqB,OAAuC,YACzD,MAAM,KAAK,UAAS,EAAA,CAAI,UAAU,oBAAoB,MAAM;EAC/D,kBAAkB,OAAO,WACvB,KAAK,qBAAqB,OAAO,MAAM,KAAK,UAAS,EAAA,CAAI,UAAU,iBAAiB,MAAM,CAAC;EAC7F,YAAY,OAAO,WACjB,KAAK,qBAAqB,OAAO,MAAM,KAAK,UAAS,EAAA,CAAI,UAAU,WAAW,MAAM,CAAC;CACxF;CAID,MAAM,eACJ,QAAiE;EAEjE,QAAQ,MAAM,KAAK,UAAS,EAAA,CAAI,eAAe,MAAM;CACvD;CAGA,MAAM,qBAAuE,QAAqC;EAChH,MAAM,aAAa,OAAO,cAAc,KAAK,eAAe,sBAAsB;EAClF,QAAQ,MAAM,KAAK,UAAS,EAAA,CAAI,qBAAqB;GAAE,GAAG;GAAQ;EAAU,CAAE;CAChF;CAGA,MAAM,cAAgE,QAA6C;EACjH,QAAQ,MAAM,KAAK,UAAS,EAAA,CAAI,cAAc,MAAM;CACtD;CAGA,MAAM,sBAAyE,QAAqC;EAClH,MAAM,cAAc,OAAO,eAAe,KAAK,eAAe,aAAa;EAC3E,QAAQ,MAAM,KAAK,UAAS,EAAA,CAAI,sBAAsB;GAAE,GAAG;GAAQ;EAAW,CAAE;CAClF;CAGA,MAAM,YAAY,QAA+C;EAC/D,QAAQ,MAAM,KAAK,UAAS,EAAA,CAAI,YAAY,MAAM;CACpD;CAMA,eAAe,MAAY;EACzB,OAAO,KAAK,MAAM,eAAe,IAAI;CACvC;CAOQ,MAAM,qBAAqB,QAAsB;EACvD,IAAI,CAAC,UAAU,OAAO,SAAS,CAAC,OAAO,MACrC,OAAO;EAET,MAAM,KAAK,MAAM,qBAAqB,MAAM;EAC5C,OAAO;CACT;CA/XW,OAAA,OAAA,GAAA,mBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;EAAa,MAAA,CAAA;EAAA,QAAA,GAAA,gBAAA;CAAA,CAAA;CAAb,OAAA,QAAA,GAAA,mBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;CAAa,CAAA;;AAAb,GAAA,yBAAA;CAAA,YAAA;CAAA,SAAA;CAAA,UAAA;CAAA,MAAA;CAAa,YAAA,CAAA,EADzB,MAAA,Q;;AAmYD,SAAS,cAAW;CAClB,OAAO,OAAO,cAAc,eAAe,CAAC,CAAC,UAAU;AACzD"}