@mastra/auth-clerk 1.2.0 → 1.2.1

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;;AAmBA,IAAM,mBAAA,GAAsB,eAAA;AAG5B,IAAM,sBAAA,GAAyB,KAAA;AAG/B,IAAM,cAAA,GAAiB,CAAC,QAAA,EAAU,SAAA,EAAW,OAAO,CAAA;AAGpD,IAAM,WAAA,GAAc,EAAA;AAGpB,IAAM,SAAA,GAAY,EAAA;AAKlB,eAAe,SAAA,CAAU,QAAA,EAAkB,IAAA,EAAkB,KAAA,EAA8B;AACzF,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,WAAA,GAAc,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA,EAAG,QAAA,EAAU,KAAA,EAAO;AAAA,IAClG,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,OAAO,OAAO,MAAA,CAAO,SAAA;AAAA,IACnB,EAAE,IAAA,EAAM,QAAA,EAAU,MAAM,UAAA,EAAY,GAAA,EAAQ,MAAM,SAAA,EAAU;AAAA,IAC5D,WAAA;AAAA,IACA,EAAE,IAAA,EAAM,SAAA,EAAW,MAAA,EAAQ,GAAA,EAAI;AAAA,IAC/B,KAAA;AAAA,IACA,CAAC,KAAK;AAAA,GACR;AACF;AAMA,eAAe,cAAA,CAAe,MAAe,QAAA,EAAmC;AAC9E,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,OAAO,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,WAAW,CAAC,CAAA;AAC/D,EAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,QAAA,EAAU,MAAM,SAAS,CAAA;AACrD,EAAA,MAAM,KAAK,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,SAAS,CAAC,CAAA;AAC3D,EAAA,MAAM,YAAY,MAAM,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAG,EAAG,KAAK,OAAA,CAAQ,MAAA,CAAO,KAAK,SAAA,CAAU,IAAI,CAAC,CAAC,CAAA;AAChH,EAAA,MAAM,QAAA,GAAW,IAAI,UAAA,CAAW,IAAA,CAAK,MAAA,GAAS,EAAA,CAAG,MAAA,GAAS,IAAI,UAAA,CAAW,SAAS,CAAA,CAAE,MAAM,CAAA;AAC1F,EAAA,QAAA,CAAS,IAAI,IAAI,CAAA;AACjB,EAAA,QAAA,CAAS,GAAA,CAAI,EAAA,EAAI,IAAA,CAAK,MAAM,CAAA;AAC5B,EAAA,QAAA,CAAS,GAAA,CAAI,IAAI,UAAA,CAAW,SAAS,GAAG,IAAA,CAAK,MAAA,GAAS,GAAG,MAAM,CAAA;AAC/D,EAAA,OAAO,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa,GAAG,QAAQ,CAAC,CAAA;AAC9C;AAKA,eAAe,cAAA,CAAe,WAAmB,QAAA,EAAoC;AACnF,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,IAAA,CAAK,IAAA,CAAK,SAAS,GAAG,CAAA,CAAA,KAAK,CAAA,CAAE,UAAA,CAAW,CAAC,CAAC,CAAA;AACtE,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,WAAW,CAAA;AAC1C,EAAA,MAAM,EAAA,GAAK,QAAA,CAAS,KAAA,CAAM,WAAA,EAAa,cAAc,SAAS,CAAA;AAC9D,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,WAAA,GAAc,SAAS,CAAA;AACnD,EAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,QAAA,EAAU,MAAM,SAAS,CAAA;AACrD,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAG,EAAG,GAAA,EAAK,IAAI,CAAA;AAChF,EAAA,OAAO,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,SAAS,CAAC,CAAA;AACvD;AAGA,IAAM,qBAAA,GAAwB,KAAK,EAAA,GAAK,GAAA;AAexC,eAAe,QAAA,CAAS,MAAc,MAAA,EAAiC;AACrE,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,MAAA,CAAO,MAAM,CAAA;AACrC,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA;AAGrC,EAAA,MAAM,YAAY,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,OAAO,OAAA,EAAS,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,SAAA,EAAU,EAAG,KAAA,EAAO,CAAC,MAAM,CAAC,CAAA;AAGlH,EAAA,MAAM,YAAY,MAAM,MAAA,CAAO,OAAO,IAAA,CAAK,MAAA,EAAQ,WAAW,SAAS,CAAA;AAGvE,EAAA,MAAM,QAAA,GAAW,IAAI,UAAA,CAAW,SAAS,CAAA;AACzC,EAAA,OAAO,KAAK,MAAA,CAAO,YAAA,CAAa,GAAG,QAAQ,CAAC,CAAA,CACzC,OAAA,CAAQ,KAAA,EAAO,GAAG,EAClB,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,MAAM,EAAE,CAAA;AACrB;AAKA,SAAS,eAAA,CAAgB,GAAW,CAAA,EAAoB;AACtD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,MAAA,IAAU,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,MAAA,KAAW,CAAA;AACpB;AAMA,eAAe,gBAAA,CAAiB,aAAA,EAAuB,WAAA,EAAqB,MAAA,EAAiC;AAC3G,EAAA,MAAM,OAAA,GAAwB;AAAA,IAC5B,CAAA,EAAG,aAAA;AAAA,IACH,CAAA,EAAG,WAAA;AAAA,IACH,CAAA,EAAG,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,GAClB;AACA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAC/C,EAAA,MAAM,SAAA,GAAY,MAAM,QAAA,CAAS,UAAA,EAAY,MAAM,CAAA;AACnD,EAAA,OAAO,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA;AACnC;AAMA,eAAe,gBAAA,CACb,YACA,MAAA,EACyD;AACzD,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA;AAClC,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,CAAC,UAAA,EAAY,SAAS,CAAA,GAAI,KAAA;AAChC,EAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,UAAA,EAAa,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,eAAA,CAAgB,SAAA,EAAY,WAAW,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACjD;AAEA,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,UAAW,CAAC,CAAA;AAC5C,EAAA,IAAI,OAAA,CAAQ,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI,EAAG;AAC1B,IAAA,MAAM,IAAI,MAAM,yBAAyB,CAAA;AAAA,EAC3C;AAEA,EAAA,OAAO,EAAE,aAAA,EAAe,OAAA,CAAQ,CAAA,EAAG,WAAA,EAAa,QAAQ,CAAA,EAAE;AAC5D;AAKA,SAAS,YAAY,GAAA,EAAqB;AACxC,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAClD;AAMA,SAAS,cAAc,cAAA,EAAgC;AACrD,EAAA,MAAM,aAAA,GAAgB,cAAA,CAAe,OAAA,CAAQ,kBAAA,EAAoB,EAAE,CAAA;AACnE,EAAA,MAAM,OAAA,GAAU,KAAK,aAAa,CAAA;AAClC,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACxC,EAAA,OAAO,WAAW,MAAM,CAAA,CAAA;AAC1B;AAyEO,IAAM,eAAA,GAAN,cAA8B,kBAAA,CAA+D;AAAA,EACxF,KAAA;AAAA,EACA,OAAA;AAAA,EACA,cAAA;AAAA,EACA,OAAA;AAAA;AAAA,EAGF,aAAA;AAAA,EACA,iBAAA;AAAA,EACA,YAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EAER,YAAY,OAAA,EAAkC;AAC5C,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,SAAS,CAAA;AAExC,IAAA,MAAM,OAAA,GAAU,OAAA,EAAS,OAAA,IAAW,OAAA,CAAQ,GAAA,CAAI,cAAA;AAChD,IAAA,MAAM,SAAA,GAAY,OAAA,EAAS,SAAA,IAAa,OAAA,CAAQ,GAAA,CAAI,gBAAA;AACpD,IAAA,MAAM,cAAA,GAAiB,OAAA,EAAS,cAAA,IAAkB,OAAA,CAAQ,GAAA,CAAI,qBAAA;AAE9D,IAAA,IAAI,CAAC,OAAA,IAAW,CAAC,SAAA,IAAa,CAAC,cAAA,EAAgB;AAC7C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,cAAA,GAAiB,cAAA;AACtB,IAAA,IAAA,CAAK,OAAA,GAAU,cAAc,cAAc,CAAA;AAC3C,IAAA,IAAA,CAAK,QAAQ,iBAAA,CAAkB;AAAA,MAC7B,SAAA;AAAA,MACA;AAAA,KACD,CAAA;AAGD,IAAA,MAAM,aAAA,GAAgB,OAAA,EAAS,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,qBAAA;AAC5D,IAAA,MAAM,iBAAA,GAAoB,OAAA,EAAS,iBAAA,IAAqB,OAAA,CAAQ,GAAA,CAAI,yBAAA;AACpE,IAAA,MAAM,WAAA,GAAc,OAAA,EAAS,WAAA,IAAe,OAAA,CAAQ,GAAA,CAAI,wBAAA;AACxD,IAAA,MAAM,cAAA,GACJ,OAAA,EAAS,OAAA,EAAS,cAAA,IAClB,OAAA,CAAQ,GAAA,CAAI,qBAAA,IACZ,MAAA,CAAO,UAAA,EAAW,GAAI,MAAA,CAAO,UAAA,EAAW;AAE1C,IAAA,IAAA,CAAK,gBAAgB,aAAA,IAAiB,IAAA;AACtC,IAAA,IAAA,CAAK,oBAAoB,iBAAA,IAAqB,IAAA;AAC9C,IAAA,IAAA,CAAK,eAAe,WAAA,IAAe,IAAA;AACnC,IAAA,IAAA,CAAK,MAAA,GAAS,SAAS,MAAA,IAAU,cAAA;AACjC,IAAA,IAAA,CAAK,UAAA,GAAa,OAAA,EAAS,OAAA,EAAS,UAAA,IAAc,mBAAA;AAClD,IAAA,IAAA,CAAK,YAAA,GAAe,OAAA,EAAS,OAAA,EAAS,YAAA,IAAgB,sBAAA;AACtD,IAAA,IAAA,CAAK,cAAA,GAAiB,cAAA;AACtB,IAAA,IAAA,CAAK,gBAAgB,OAAA,EAAS,OAAA,EAAS,aAAA,IAAiB,OAAA,CAAQ,IAAI,QAAA,KAAa,YAAA;AAGjF,IAAA,IAAA,CAAK,UAAA,GAAa,CAAC,EAAE,aAAA,IAAiB,iBAAA,CAAA;AAEtC,IAAA,IAAI,KAAK,UAAA,EAAY;AACnB,MAAA,IAAI,cAAA,CAAe,SAAS,EAAA,EAAI;AAC9B,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,OAAA,EAAS,OAAA,EAAS,kBAAkB,CAAC,OAAA,CAAQ,IAAI,qBAAA,EAAuB;AAC3E,QAAA,OAAA,CAAQ,IAAA;AAAA,UACN;AAAA,SACF;AAAA,MACF;AAIA,MAAA,IAAA,CAAK,kBAAA,EAAmB;AACxB,MAAA,IAAA,CAAK,sBAAA,EAAuB;AAAA,IAC9B;AAEA,IAAA,IAAA,CAAK,gBAAgB,OAAO,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,iBAAA,CACJ,KAAA,EACA,OAAA,EAC2B;AAI3B,IAAA,IAAI,IAAA,CAAK,cAAc,OAAA,EAAS;AAC9B,MAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,wBAAA,CAAyB,OAAkB,CAAA;AAC1E,MAAA,IAAI,aAAa,OAAO,WAAA;AAAA,IAC1B;AAGA,IAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,UAAA,CAAW,KAAA,EAAO,KAAK,OAAO,CAAA;AACjD,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,IAAA,EAAiB;AAEnC,IAAA,OAAO,CAAC,EAAE,IAAA,CAAK,GAAA,IAAQ,IAAA,CAA2B,EAAA,CAAA;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,aAAa,OAAA,EAAiC;AACpD,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACtD,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAM,QAAQ,UAAA,CAAW,OAAA,CAAQ,aAAA,EAAe,EAAE,EAAE,IAAA,EAAK;AACzD,MAAA,IAAI,OAAO,OAAO,KAAA;AAAA,IACpB;AAEA,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AAC3C,IAAA,IAAI,MAAA,EAAQ;AAEV,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,mBAAmB,CAAA;AAC9C,MAAA,IAAI,KAAA,GAAQ,CAAC,CAAA,EAAG,OAAO,MAAM,CAAC,CAAA;AAAA,IAChC;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,eAAe,OAAA,EAA0C;AAE7D,IAAA,IAAI,KAAK,UAAA,EAAY;AACnB,MAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,wBAAA,CAAyB,OAAO,CAAA;AAC/D,MAAA,IAAI,aAAa,OAAO,WAAA;AAAA,IAC1B;AAGA,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,YAAA,CAAa,OAAO,CAAA;AACvC,IAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AAEnB,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,iBAAA,CAAkB,KAAK,CAAA;AAClD,MAAA,IAAI,CAAC,OAAA,EAAS,GAAA,EAAK,OAAO,IAAA;AAG1B,MAAA,IAAI;AACF,QAAA,MAAM,YAAY,MAAM,IAAA,CAAK,MAAM,KAAA,CAAM,OAAA,CAAQ,QAAQ,GAAG,CAAA;AAC5D,QAAA,OAAO;AAAA,UACL,IAAI,SAAA,CAAU,EAAA;AAAA,UACd,KAAA,EAAO,SAAA,CAAU,cAAA,GAAiB,CAAC,CAAA,EAAG,YAAA;AAAA,UACtC,IAAA,EAAM,CAAC,SAAA,CAAU,SAAA,EAAW,SAAA,CAAU,QAAQ,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,IAAK,MAAA;AAAA,UAC7E,WAAW,SAAA,CAAU,QAAA;AAAA,UACrB,UAAU,SAAA,CAAU;AAAA,SACtB;AAAA,MACF,CAAA,CAAA,MAAQ;AAEN,QAAA,OAAO;AAAA,UACL,IAAI,OAAA,CAAQ,GAAA;AAAA,UACZ,KAAA,EAAQ,QAAQ,KAAA,IAAoB,MAAA;AAAA,UACpC,IAAA,EAAO,QAAQ,IAAA,IAAmB;AAAA,SACpC;AAAA,MACF;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,MAAA,EAAwC;AACpD,IAAA,IAAI;AACF,MAAA,MAAM,YAAY,MAAM,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,QAAQ,MAAM,CAAA;AACvD,MAAA,OAAO;AAAA,QACL,IAAI,SAAA,CAAU,EAAA;AAAA,QACd,KAAA,EAAO,SAAA,CAAU,cAAA,GAAiB,CAAC,CAAA,EAAG,YAAA;AAAA,QACtC,IAAA,EAAM,CAAC,SAAA,CAAU,SAAA,EAAW,SAAA,CAAU,QAAQ,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,IAAK,MAAA;AAAA,QAC7E,WAAW,SAAA,CAAU,QAAA;AAAA,QACrB,UAAU,SAAA,CAAU;AAAA,OACtB;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,kBAAkB,IAAA,EAAsB;AACtC,IAAA,OAAO,CAAA,MAAA,EAAS,KAAK,EAAE,CAAA,CAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAA,GAAwB;AACtB,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,UAAA,GAAqB;AACnB,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKQ,YAAY,MAAA,EAAwB;AAC1C,IAAA,MAAM,KAAA,GAAQ,2CAA2C,MAAM,CAAA,CAAA;AAC/D,IAAA,OAAO,IAAA,CAAK,aAAA,GAAgB,CAAA,EAAG,KAAK,CAAA,QAAA,CAAA,GAAa,KAAA;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,yBACZ,OAAA,EACwB;AAExB,IAAA,MAAM,MAAA,GACJ,QAAA,IAAY,OAAA,IAAW,OAAQ,QAAgB,MAAA,KAAW,UAAA,GACrD,OAAA,CAAgB,MAAA,CAAO,QAAQ,CAAA,GAC/B,OAAA,CAAoB,OAAA,EAAS,IAAI,QAAQ,CAAA;AAChD,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AAEpB,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,IAAI,MAAA,CAAO,CAAA,WAAA,EAAc,WAAA,CAAY,IAAA,CAAK,UAAU,CAAC,CAAA,QAAA,CAAU,CAAC,CAAA;AAC3F,IAAA,IAAI,CAAC,KAAA,GAAQ,CAAC,CAAA,EAAG,OAAO,IAAA;AAExB,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAe,MAAM,cAAA,CAAe,kBAAA,CAAmB,MAAM,CAAC,CAAC,CAAA,EAAG,IAAA,CAAK,cAAc,CAAA;AAK3F,MAAA,IAAI,WAAA,CAAY,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,EAAG;AACtC,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,OAAO,WAAA,CAAY,IAAA;AAAA,IACrB,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,kBAAA,GAAqB;AAC3B,IAAA,MAAM,IAAA,GAAO,IAAA;AAEb,IAAC,IAAA,CAAyC,WAAA,GAAc,eACtD,WAAA,EACA,KAAA,EACiB;AAGjB,MAAA,MAAM,iBAAA,GAAoB,eAAe,IAAA,CAAK,YAAA;AAC9C,MAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,QAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAAA,MAC1D;AAEA,MAAA,MAAM,cAAc,MAAM,gBAAA,CAAiB,KAAA,EAAO,iBAAA,EAAmB,KAAK,cAAc,CAAA;AAExF,MAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,QACjC,WAAW,IAAA,CAAK,aAAA;AAAA,QAChB,aAAA,EAAe,MAAA;AAAA,QACf,KAAA,EAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA;AAAA,QAC3B,YAAA,EAAc,iBAAA;AAAA,QACd,KAAA,EAAO;AAAA,OACR,CAAA;AAED,MAAA,OAAO,GAAG,IAAA,CAAK,OAAO,CAAA,iBAAA,EAAoB,MAAA,CAAO,UAAU,CAAA,CAAA;AAAA,IAC7D,CAAA;AAEA,IAAC,IAAA,CAAyC,cAAA,GAAiB,eACzD,IAAA,EACA,UAAA,EACoC;AAEpC,MAAA,MAAM,EAAE,WAAA,EAAY,GAAI,MAAM,gBAAA,CAAiB,UAAA,EAAY,KAAK,cAAc,CAAA;AAG9E,MAAA,MAAM,gBAAgB,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,YAAA,CAAA,EAAgB;AAAA,QAC/D,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mCAAA;AAAA,UAChB,aAAA,EAAe,CAAA,MAAA,EAAS,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,aAAa,CAAA,CAAA,EAAI,IAAA,CAAK,iBAAiB,CAAA,CAAE,CAAC,CAAA;AAAA,SACjF;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,UACxB,UAAA,EAAY,oBAAA;AAAA,UACZ,IAAA;AAAA,UACA,YAAA,EAAc;AAAA,SACf,CAAA;AAAA,QACD,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAM;AAAA;AAAA,OACnC,CAAA;AAED,MAAA,IAAI,CAAC,cAAc,EAAA,EAAI;AACrB,QAAA,MAAM,KAAA,GAAQ,MAAM,aAAA,CAAc,IAAA,EAAK;AACvC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,KAAK,CAAA,CAAE,CAAA;AAAA,MACnD;AAEA,MAAA,MAAM,MAAA,GAAU,MAAM,aAAA,CAAc,IAAA,EAAK;AASzC,MAAA,IAAI,IAAA;AACJ,MAAA,IAAI,OAAO,QAAA,EAAU;AACnB,QAAA,MAAM,UAAU,MAAM,UAAA,CAAW,MAAA,CAAO,QAAA,EAAU,KAAK,OAAO,CAAA;AAC9D,QAAA,IAAA,GAAO;AAAA,UACL,IAAI,OAAA,CAAQ,GAAA;AAAA,UACZ,KAAA,EAAQ,QAAQ,KAAA,IAAoB,MAAA;AAAA,UACpC,IAAA,EAAO,QAAQ,IAAA,IAAmB,MAAA;AAAA,UAClC,SAAA,EAAY,QAAQ,OAAA,IAAsB;AAAA,SAC5C;AAAA,MACF,CAAA,MAAO;AACL,QAAA,MAAM,mBAAmB,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,eAAA,CAAA,EAAmB;AAAA,UACrE,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,MAAA,CAAO,YAAY,CAAA,CAAA,EAAG;AAAA,UAC1D,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAM;AAAA;AAAA,SACnC,CAAA;AAED,QAAA,IAAI,CAAC,iBAAiB,EAAA,EAAI;AACxB,UAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,QACxD;AAEA,QAAA,MAAM,QAAA,GAAY,MAAM,gBAAA,CAAiB,IAAA,EAAK;AAM9C,QAAA,IAAA,GAAO;AAAA,UACL,IAAI,QAAA,CAAS,GAAA;AAAA,UACb,OAAO,QAAA,CAAS,KAAA;AAAA,UAChB,MAAM,QAAA,CAAS,IAAA;AAAA,UACf,WAAW,QAAA,CAAS;AAAA,SACtB;AAAA,MACF;AAGA,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAK,EAAE,CAAA;AAC3C,QAAA,IAAI,QAAA,EAAU;AACZ,UAAA,IAAA,GAAO,QAAA;AAAA,QACT;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAGA,MAAA,MAAM,WAAA,GAAc;AAAA,QAClB,IAAA;AAAA,QACA,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,YAAA,GAAe;AAAA,OAC9C;AAEA,MAAA,MAAM,gBAAA,GAAmB,MAAM,cAAA,CAAe,WAAA,EAAa,KAAK,cAAc,CAAA;AAC9E,MAAA,MAAM,WAAA,GAAc,CAAA,EAAG,IAAA,CAAK,UAAU,CAAA,CAAA,EAAI,kBAAA,CAAmB,gBAAgB,CAAC,CAAA,EAAA,EAAK,IAAA,CAAK,WAAA,CAAY,IAAA,CAAK,YAAY,CAAC,CAAA,CAAA;AAEtH,MAAA,OAAO;AAAA,QACL,IAAA;AAAA,QACA,MAAA,EAAQ;AAAA,UACN,aAAa,MAAA,CAAO,YAAA;AAAA,UACpB,cAAc,MAAA,CAAO,aAAA;AAAA,UACrB,SAAS,MAAA,CAAO,QAAA;AAAA,UAChB,SAAA,EAAW,IAAI,IAAA,CAAK,IAAA,CAAK,KAAI,GAAI,MAAA,CAAO,aAAa,GAAI;AAAA,SAC3D;AAAA,QACA,OAAA,EAAS,CAAC,WAAW;AAAA,OACvB;AAAA,IACF,CAAA;AAEA,IAAC,IAAA,CAAyC,uBAAuB,WAA4B;AAC3F,MAAA,OAAO;AAAA,QACL,QAAA,EAAU,OAAA;AAAA,QACV,IAAA,EAAM,oBAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,IACF,CAAA;AAEA,IAAC,IAAA,CAAyC,eAAA,GAAkB,SAAU,MAAA,EAA0B;AAC9F,MAAA,OAAO,EAAC;AAAA,IACV,CAAA;AAEA,IAAC,IAAA,CAAyC,YAAA,GAAe,eACvD,YAAA,EACA,QAAA,EACwB;AACxB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,sBAAA,GAAyB;AAC/B,IAAA,MAAM,IAAA,GAAO,IAAA;AAEb,IAAC,IAAA,CAA8C,aAAA,GAAgB,eAC7D,MAAA,EACA,QAAA,EACkB;AAClB,MAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,OAAO,UAAA,EAAW;AAAA,QACtB,MAAA;AAAA,QACA,SAAA,EAAW,GAAA;AAAA,QACX,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAQ,GAAI,IAAA,CAAK,eAAe,GAAI,CAAA;AAAA,QAC5D;AAAA,OACF;AAAA,IACF,CAAA;AAGA,IAAC,IAAA,CAA8C,eAAA,GAAkB,eAC/D,UAAA,EACyB;AACzB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAGA,IAAC,IAAA,CAA8C,cAAA,GAAiB,eAC9D,UAAA,EACe;AAAA,IAAC,CAAA;AAGlB,IAAC,IAAA,CAA8C,cAAA,GAAiB,eAC9D,UAAA,EACyB;AACzB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAEA,IAAC,IAAA,CAA8C,uBAAA,GAA0B,SACvE,OAAA,EACe;AACf,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AAC3C,MAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,IAAI,MAAA,CAAO,CAAA,WAAA,EAAc,WAAA,CAAY,IAAA,CAAK,UAAU,CAAC,CAAA,QAAA,CAAU,CAAC,CAAA;AAC3F,MAAA,OAAO,QAAQ,CAAC,CAAA,GAAI,mBAAmB,KAAA,CAAM,CAAC,CAAC,CAAA,GAAI,IAAA;AAAA,IACrD,CAAA;AAEA,IAAC,IAAA,CAA8C,iBAAA,GAAoB,SACjE,QAAA,EACwB;AACxB,MAAA,OAAO,EAAC;AAAA,IACV,CAAA;AAEA,IAAC,IAAA,CAA8C,yBAAyB,WAAoC;AAC1G,MAAA,OAAO;AAAA,QACL,YAAA,EAAc,GAAG,IAAA,CAAK,UAAU,MAAM,IAAA,CAAK,WAAA,CAAY,CAAC,CAAC,CAAA;AAAA,OAC3D;AAAA,IACF,CAAA;AAAA,EACF;AACF","file":"index.js","sourcesContent":["import { createClerkClient } from '@clerk/backend';\nimport type { ClerkClient } from '@clerk/backend';\nimport { verifyJwks } from '@mastra/auth';\nimport type { JwtPayload } from '@mastra/auth';\nimport type {\n  ISSOProvider,\n  ISessionProvider,\n  IUserProvider,\n  Session,\n  SSOCallbackResult,\n  SSOLoginConfig,\n} from '@mastra/core/auth';\nimport type { EEUser } from '@mastra/core/auth/ee';\nimport type { MastraAuthProviderOptions } from '@mastra/core/server';\nimport { MastraAuthProvider } from '@mastra/core/server';\n\ntype ClerkUser = JwtPayload;\n\n/** Default cookie name for Clerk SSO sessions */\nconst DEFAULT_COOKIE_NAME = 'clerk_session';\n\n/** Default cookie max age (24 hours) */\nconst DEFAULT_COOKIE_MAX_AGE = 86400;\n\n/** Default OAuth scopes */\nconst DEFAULT_SCOPES = ['openid', 'profile', 'email'];\n\n/** PBKDF2 salt length in bytes */\nconst SALT_LENGTH = 16;\n\n/** AES-GCM IV length in bytes */\nconst IV_LENGTH = 12;\n\n/**\n * Derive an AES-GCM key from password + salt using PBKDF2.\n */\nasync function deriveKey(password: string, salt: Uint8Array, usage: 'encrypt' | 'decrypt') {\n  const encoder = new TextEncoder();\n  const keyMaterial = await crypto.subtle.importKey('raw', encoder.encode(password), 'PBKDF2', false, [\n    'deriveBits',\n    'deriveKey',\n  ]);\n  return crypto.subtle.deriveKey(\n    { name: 'PBKDF2', salt, iterations: 100000, hash: 'SHA-256' },\n    keyMaterial,\n    { name: 'AES-GCM', length: 256 },\n    false,\n    [usage],\n  );\n}\n\n/**\n * Encrypt session data for cookie storage.\n * Format: base64(salt || iv || ciphertext)\n */\nasync function encryptSession(data: unknown, password: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const salt = crypto.getRandomValues(new Uint8Array(SALT_LENGTH));\n  const key = await deriveKey(password, salt, 'encrypt');\n  const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));\n  const encrypted = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, encoder.encode(JSON.stringify(data)));\n  const combined = new Uint8Array(salt.length + iv.length + new Uint8Array(encrypted).length);\n  combined.set(salt);\n  combined.set(iv, salt.length);\n  combined.set(new Uint8Array(encrypted), salt.length + iv.length);\n  return btoa(String.fromCharCode(...combined));\n}\n\n/**\n * Decrypt session data from cookie.\n */\nasync function decryptSession(encrypted: string, password: string): Promise<unknown> {\n  const combined = Uint8Array.from(atob(encrypted), c => c.charCodeAt(0));\n  const salt = combined.slice(0, SALT_LENGTH);\n  const iv = combined.slice(SALT_LENGTH, SALT_LENGTH + IV_LENGTH);\n  const data = combined.slice(SALT_LENGTH + IV_LENGTH);\n  const key = await deriveKey(password, salt, 'decrypt');\n  const decrypted = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, data);\n  return JSON.parse(new TextDecoder().decode(decrypted));\n}\n\n/** OAuth state token expiry (10 minutes) */\nconst STATE_TOKEN_EXPIRY_MS = 10 * 60 * 1000;\n\ninterface StatePayload {\n  /** Original state from caller */\n  s: string;\n  /** Redirect URI */\n  r: string;\n  /** Expiry timestamp */\n  e: number;\n}\n\n/**\n * Sign data using HMAC-SHA256 (Web Crypto API).\n * Returns base64url-encoded signature.\n */\nasync function hmacSign(data: string, secret: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const keyData = encoder.encode(secret);\n  const dataBytes = encoder.encode(data);\n\n  // Import the secret key for HMAC-SHA256\n  const cryptoKey = await crypto.subtle.importKey('raw', keyData, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);\n\n  // Sign the data\n  const signature = await crypto.subtle.sign('HMAC', cryptoKey, dataBytes);\n\n  // Convert to base64url\n  const sigBytes = new Uint8Array(signature);\n  return btoa(String.fromCharCode(...sigBytes))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '');\n}\n\n/**\n * Timing-safe string comparison.\n */\nfunction timingSafeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false;\n  let result = 0;\n  for (let i = 0; i < a.length; i++) {\n    result |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return result === 0;\n}\n\n/**\n * Create a signed state token for OAuth CSRF protection (stateless).\n * Format: base64(payload).base64url(signature)\n */\nasync function createStateToken(originalState: string, redirectUri: string, secret: string): Promise<string> {\n  const payload: StatePayload = {\n    s: originalState,\n    r: redirectUri,\n    e: Date.now() + STATE_TOKEN_EXPIRY_MS,\n  };\n  const payloadB64 = btoa(JSON.stringify(payload));\n  const signature = await hmacSign(payloadB64, secret);\n  return `${payloadB64}.${signature}`;\n}\n\n/**\n * Verify and decode a state token.\n * Returns the original state and redirectUri if valid and not expired.\n */\nasync function verifyStateToken(\n  stateToken: string,\n  secret: string,\n): Promise<{ originalState: string; redirectUri: string }> {\n  const parts = stateToken.split('.');\n  if (parts.length !== 2) {\n    throw new Error('Invalid state token format');\n  }\n\n  const [payloadB64, signature] = parts;\n  const expectedSig = await hmacSign(payloadB64!, secret);\n  if (!timingSafeEqual(signature!, expectedSig)) {\n    throw new Error('Invalid state token signature');\n  }\n\n  const payload = JSON.parse(atob(payloadB64!)) as StatePayload;\n  if (payload.e < Date.now()) {\n    throw new Error('State token has expired');\n  }\n\n  return { originalState: payload.s, redirectUri: payload.r };\n}\n\n/**\n * Escape special regex characters in a string.\n */\nfunction escapeRegex(str: string): string {\n  return str.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\n/**\n * Derive the Frontend API (FAPI) URL from a Clerk publishable key.\n * The publishable key is: prefix + base64(fapiDomain + \"$\")\n */\nfunction deriveFapiUrl(publishableKey: string): string {\n  const withoutPrefix = publishableKey.replace(/^pk_(test|live)_/, '');\n  const decoded = atob(withoutPrefix);\n  const domain = decoded.replace(/\\$$/, '');\n  return `https://${domain}`;\n}\n\ninterface MastraAuthClerkSessionOptions {\n  /** Cookie name for the session (default: 'clerk_session') */\n  cookieName?: string;\n  /** Cookie max age in seconds (default: 86400 = 24 hours) */\n  cookieMaxAge?: number;\n  /** Cookie encryption password (min 32 chars). Falls back to CLERK_COOKIE_PASSWORD env var */\n  cookiePassword?: string;\n  /** Use Secure flag on cookies (default: true in production) */\n  secureCookies?: boolean;\n}\n\ninterface MastraAuthClerkOptions extends MastraAuthProviderOptions<ClerkUser> {\n  jwksUri?: string;\n  secretKey?: string;\n  publishableKey?: string;\n  /**\n   * OAuth Client ID for Clerk as IdP (SSO).\n   * Create an OAuth Application in the Clerk Dashboard to get this.\n   * Falls back to CLERK_OAUTH_CLIENT_ID env var.\n   */\n  oauthClientId?: string;\n  /**\n   * OAuth Client Secret for Clerk as IdP (SSO).\n   * Falls back to CLERK_OAUTH_CLIENT_SECRET env var.\n   */\n  oauthClientSecret?: string;\n  /**\n   * OAuth redirect URI for the SSO callback.\n   * Falls back to CLERK_OAUTH_REDIRECT_URI env var.\n   * Typically: http://localhost:4111/api/auth/sso/callback\n   */\n  redirectUri?: string;\n  /**\n   * OAuth scopes to request (default: ['openid', 'profile', 'email'])\n   */\n  scopes?: string[];\n  /**\n   * Session configuration for SSO cookie management.\n   */\n  session?: MastraAuthClerkSessionOptions;\n}\n\n/**\n * Clerk authentication provider for Mastra.\n *\n * Always implements IUserProvider for JWT-based user detection.\n *\n * When OAuth credentials are configured (oauthClientId + oauthClientSecret),\n * also dynamically adds ISSOProvider + ISessionProvider methods for Studio login\n * using Clerk as an OAuth 2.0 / OIDC Identity Provider.\n *\n * @example Basic usage (IUserProvider only — validates JWTs)\n * ```typescript\n * const auth = new MastraAuthClerk({\n *   jwksUri: 'https://your-app.clerk.accounts.dev/.well-known/jwks.json',\n *   secretKey: 'sk_test_...',\n *   publishableKey: 'pk_test_...',\n * });\n * ```\n *\n * @example With SSO for Studio login\n * ```typescript\n * const auth = new MastraAuthClerk({\n *   jwksUri: 'https://your-app.clerk.accounts.dev/.well-known/jwks.json',\n *   secretKey: 'sk_test_...',\n *   publishableKey: 'pk_test_...',\n *   oauthClientId: 'your-oauth-client-id',\n *   oauthClientSecret: 'your-oauth-client-secret',\n * });\n * ```\n */\nexport class MastraAuthClerk extends MastraAuthProvider<ClerkUser> implements IUserProvider<EEUser> {\n  protected clerk: ClerkClient;\n  protected jwksUri: string;\n  protected publishableKey: string;\n  protected fapiUrl: string;\n\n  // SSO fields\n  private oauthClientId: string | null;\n  private oauthClientSecret: string | null;\n  private _redirectUri: string | null;\n  private scopes: string[];\n  private cookieName: string;\n  private cookieMaxAge: number;\n  private cookiePassword: string;\n  private secureCookies: boolean;\n  private ssoEnabled: boolean;\n\n  constructor(options?: MastraAuthClerkOptions) {\n    super({ name: options?.name ?? 'clerk' });\n\n    const jwksUri = options?.jwksUri ?? process.env.CLERK_JWKS_URI;\n    const secretKey = options?.secretKey ?? process.env.CLERK_SECRET_KEY;\n    const publishableKey = options?.publishableKey ?? process.env.CLERK_PUBLISHABLE_KEY;\n\n    if (!jwksUri || !secretKey || !publishableKey) {\n      throw new Error(\n        'Clerk JWKS URI, secret key and publishable key are required, please provide them in the options or set the environment variables CLERK_JWKS_URI, CLERK_SECRET_KEY and CLERK_PUBLISHABLE_KEY',\n      );\n    }\n\n    this.jwksUri = jwksUri;\n    this.publishableKey = publishableKey;\n    this.fapiUrl = deriveFapiUrl(publishableKey);\n    this.clerk = createClerkClient({\n      secretKey,\n      publishableKey,\n    });\n\n    // SSO configuration (optional — enables Studio login)\n    const oauthClientId = options?.oauthClientId ?? process.env.CLERK_OAUTH_CLIENT_ID;\n    const oauthClientSecret = options?.oauthClientSecret ?? process.env.CLERK_OAUTH_CLIENT_SECRET;\n    const redirectUri = options?.redirectUri ?? process.env.CLERK_OAUTH_REDIRECT_URI;\n    const cookiePassword =\n      options?.session?.cookiePassword ??\n      process.env.CLERK_COOKIE_PASSWORD ??\n      crypto.randomUUID() + crypto.randomUUID();\n\n    this.oauthClientId = oauthClientId ?? null;\n    this.oauthClientSecret = oauthClientSecret ?? null;\n    this._redirectUri = redirectUri ?? null;\n    this.scopes = options?.scopes ?? DEFAULT_SCOPES;\n    this.cookieName = options?.session?.cookieName ?? DEFAULT_COOKIE_NAME;\n    this.cookieMaxAge = options?.session?.cookieMaxAge ?? DEFAULT_COOKIE_MAX_AGE;\n    this.cookiePassword = cookiePassword;\n    this.secureCookies = options?.session?.secureCookies ?? process.env.NODE_ENV === 'production';\n\n    // SSO is enabled when OAuth credentials are configured\n    this.ssoEnabled = !!(oauthClientId && oauthClientSecret);\n\n    if (this.ssoEnabled) {\n      if (cookiePassword.length < 32) {\n        throw new Error(\n          'Cookie password must be at least 32 characters for SSO. Set CLERK_COOKIE_PASSWORD environment variable.',\n        );\n      }\n\n      if (!options?.session?.cookiePassword && !process.env.CLERK_COOKIE_PASSWORD) {\n        console.warn(\n          '[MastraAuthClerk] No cookie password set — using auto-generated value. Sessions will not survive restarts. Set CLERK_COOKIE_PASSWORD for production use.',\n        );\n      }\n\n      // Dynamically add ISSOProvider + ISessionProvider methods\n      // so that duck-typing detection (implementsInterface) only finds them when SSO is configured\n      this._attachSSOProvider();\n      this._attachSessionProvider();\n    }\n\n    this.registerOptions(options);\n  }\n\n  // ============================================================================\n  // MastraAuthProvider Implementation\n  // ============================================================================\n\n  async authenticateToken(\n    token: string,\n    request?: Request | { header(name: string): string | undefined },\n  ): Promise<ClerkUser | null> {\n    // When SSO is enabled, try the encrypted session cookie first (like Okta pattern).\n    // The auth middleware may call this with an empty token for browser requests\n    // that only carry a session cookie.\n    if (this.ssoEnabled && request) {\n      const sessionUser = await this.getUserFromSessionCookie(request as Request);\n      if (sessionUser) return sessionUser as unknown as ClerkUser;\n    }\n\n    // Fall back to JWT verification from Authorization header\n    if (!token || typeof token !== 'string') {\n      return null;\n    }\n\n    try {\n      const user = await verifyJwks(token, this.jwksUri);\n      return user;\n    } catch {\n      return null;\n    }\n  }\n\n  async authorizeUser(user: ClerkUser) {\n    // Session cookie users have `id`, JWT users have `sub`\n    return !!(user.sub || (user as unknown as EEUser).id);\n  }\n\n  // ============================================================================\n  // IUserProvider Implementation\n  // ============================================================================\n\n  /**\n   * Extract the bearer token from the request's Authorization header or __session cookie.\n   */\n  private extractToken(request: Request): string | null {\n    const authHeader = request.headers.get('Authorization');\n    if (authHeader) {\n      const token = authHeader.replace(/^Bearer\\s+/i, '').trim();\n      if (token) return token;\n    }\n\n    const cookie = request.headers.get('Cookie');\n    if (cookie) {\n      // Clerk's default session cookie is __session\n      const match = cookie.match(/__session=([^;]+)/);\n      if (match?.[1]) return match[1];\n    }\n\n    return null;\n  }\n\n  async getCurrentUser(request: Request): Promise<EEUser | null> {\n    // First try to get user from our SSO session cookie\n    if (this.ssoEnabled) {\n      const sessionUser = await this.getUserFromSessionCookie(request);\n      if (sessionUser) return sessionUser;\n    }\n\n    // Fall back to token-based auth (Authorization header or __session cookie)\n    const token = this.extractToken(request);\n    if (!token) return null;\n\n    try {\n      const payload = await this.authenticateToken(token);\n      if (!payload?.sub) return null;\n\n      // Try to fetch full user details from Clerk API\n      try {\n        const clerkUser = await this.clerk.users.getUser(payload.sub);\n        return {\n          id: clerkUser.id,\n          email: clerkUser.emailAddresses?.[0]?.emailAddress,\n          name: [clerkUser.firstName, clerkUser.lastName].filter(Boolean).join(' ') || undefined,\n          avatarUrl: clerkUser.imageUrl,\n          metadata: clerkUser.publicMetadata as Record<string, unknown> | undefined,\n        };\n      } catch {\n        // Fall back to JWT claims if Clerk API call fails\n        return {\n          id: payload.sub,\n          email: (payload.email as string) ?? undefined,\n          name: (payload.name as string) ?? undefined,\n        };\n      }\n    } catch {\n      return null;\n    }\n  }\n\n  async getUser(userId: string): Promise<EEUser | null> {\n    try {\n      const clerkUser = await this.clerk.users.getUser(userId);\n      return {\n        id: clerkUser.id,\n        email: clerkUser.emailAddresses?.[0]?.emailAddress,\n        name: [clerkUser.firstName, clerkUser.lastName].filter(Boolean).join(' ') || undefined,\n        avatarUrl: clerkUser.imageUrl,\n        metadata: clerkUser.publicMetadata as Record<string, unknown> | undefined,\n      };\n    } catch {\n      return null;\n    }\n  }\n\n  getUserProfileUrl(user: EEUser): string {\n    return `/user/${user.id}`;\n  }\n\n  // ============================================================================\n  // Helper Methods\n  // ============================================================================\n\n  /**\n   * Check if SSO is enabled (OAuth credentials are configured).\n   */\n  isSSOEnabled(): boolean {\n    return this.ssoEnabled;\n  }\n\n  /**\n   * Get the derived Frontend API URL.\n   */\n  getFapiUrl(): string {\n    return this.fapiUrl;\n  }\n\n  /**\n   * Build consistent cookie attribute string for set/clear operations.\n   */\n  private cookieFlags(maxAge: number): string {\n    const flags = `Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAge}`;\n    return this.secureCookies ? `${flags}; Secure` : flags;\n  }\n\n  /**\n   * Extract user from the encrypted SSO session cookie.\n   */\n  private async getUserFromSessionCookie(\n    request: Request | { header(name: string): string | undefined },\n  ): Promise<EEUser | null> {\n    // Handle both standard Request and HonoRequest (.header() vs .headers.get())\n    const cookie =\n      'header' in request && typeof (request as any).header === 'function'\n        ? (request as any).header('cookie')\n        : (request as Request).headers?.get('cookie');\n    if (!cookie) return null;\n\n    const match = cookie.match(new RegExp(`(?:^|;\\\\s*)${escapeRegex(this.cookieName)}=([^;]+)`));\n    if (!match?.[1]) return null;\n\n    try {\n      const sessionData = (await decryptSession(decodeURIComponent(match[1]), this.cookiePassword)) as {\n        user: EEUser;\n        expiresAt: number;\n      };\n\n      if (sessionData.expiresAt < Date.now()) {\n        return null; // Session expired\n      }\n\n      return sessionData.user;\n    } catch {\n      return null; // Invalid/corrupt cookie\n    }\n  }\n\n  // ============================================================================\n  // Dynamic ISSOProvider attachment (only when OAuth is configured)\n  // ============================================================================\n\n  /**\n   * Dynamically attach ISSOProvider methods to this instance.\n   * This ensures duck-typing detection only finds these methods when SSO is configured.\n   */\n  private _attachSSOProvider() {\n    const self = this;\n\n    (this as unknown as ISSOProvider<EEUser>).getLoginUrl = async function (\n      redirectUri: string,\n      state: string,\n    ): Promise<string> {\n      // Create signed state token containing redirectUri and expiry\n      // This is stateless — works in serverless and load-balanced environments\n      const actualRedirectUri = redirectUri ?? self._redirectUri;\n      if (!actualRedirectUri) {\n        throw new Error('Redirect URI is required for SSO login');\n      }\n\n      const signedState = await createStateToken(state, actualRedirectUri, self.cookiePassword);\n\n      const params = new URLSearchParams({\n        client_id: self.oauthClientId!,\n        response_type: 'code',\n        scope: self.scopes.join(' '),\n        redirect_uri: actualRedirectUri,\n        state: signedState,\n      });\n\n      return `${self.fapiUrl}/oauth/authorize?${params.toString()}`;\n    };\n\n    (this as unknown as ISSOProvider<EEUser>).handleCallback = async function (\n      code: string,\n      stateToken: string,\n    ): Promise<SSOCallbackResult<EEUser>> {\n      // Verify and decode the signed state token (throws if invalid/expired)\n      const { redirectUri } = await verifyStateToken(stateToken, self.cookiePassword);\n\n      // Exchange code for tokens using client_secret (confidential client)\n      const tokenResponse = await fetch(`${self.fapiUrl}/oauth/token`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n          Authorization: `Basic ${btoa(`${self.oauthClientId}:${self.oauthClientSecret}`)}`,\n        },\n        body: new URLSearchParams({\n          grant_type: 'authorization_code',\n          code,\n          redirect_uri: redirectUri,\n        }),\n        signal: AbortSignal.timeout(10_000), // 10 second timeout\n      });\n\n      if (!tokenResponse.ok) {\n        const error = await tokenResponse.text();\n        throw new Error(`Token exchange failed: ${error}`);\n      }\n\n      const tokens = (await tokenResponse.json()) as {\n        access_token: string;\n        id_token?: string;\n        refresh_token?: string;\n        expires_in: number;\n        token_type: string;\n      };\n\n      // Get user info — try ID token first, fall back to userinfo endpoint\n      let user: EEUser;\n      if (tokens.id_token) {\n        const payload = await verifyJwks(tokens.id_token, self.jwksUri);\n        user = {\n          id: payload.sub!,\n          email: (payload.email as string) ?? undefined,\n          name: (payload.name as string) ?? undefined,\n          avatarUrl: (payload.picture as string) ?? undefined,\n        };\n      } else {\n        const userInfoResponse = await fetch(`${self.fapiUrl}/oauth/userinfo`, {\n          headers: { Authorization: `Bearer ${tokens.access_token}` },\n          signal: AbortSignal.timeout(10_000), // 10 second timeout\n        });\n\n        if (!userInfoResponse.ok) {\n          throw new Error('Failed to fetch user info from Clerk');\n        }\n\n        const userInfo = (await userInfoResponse.json()) as {\n          sub: string;\n          email?: string;\n          name?: string;\n          picture?: string;\n        };\n        user = {\n          id: userInfo.sub,\n          email: userInfo.email,\n          name: userInfo.name,\n          avatarUrl: userInfo.picture,\n        };\n      }\n\n      // Try to enrich user with full Clerk data\n      try {\n        const fullUser = await self.getUser(user.id);\n        if (fullUser) {\n          user = fullUser;\n        }\n      } catch {\n        // Use the user info we already have\n      }\n\n      // Create encrypted session cookie\n      const sessionData = {\n        user,\n        expiresAt: Date.now() + self.cookieMaxAge * 1000,\n      };\n\n      const encryptedSession = await encryptSession(sessionData, self.cookiePassword);\n      const cookieValue = `${self.cookieName}=${encodeURIComponent(encryptedSession)}; ${self.cookieFlags(self.cookieMaxAge)}`;\n\n      return {\n        user,\n        tokens: {\n          accessToken: tokens.access_token,\n          refreshToken: tokens.refresh_token,\n          idToken: tokens.id_token,\n          expiresAt: new Date(Date.now() + tokens.expires_in * 1000),\n        },\n        cookies: [cookieValue],\n      };\n    };\n\n    (this as unknown as ISSOProvider<EEUser>).getLoginButtonConfig = function (): SSOLoginConfig {\n      return {\n        provider: 'clerk',\n        text: 'Sign in with Clerk',\n        description: 'Sign in using your Clerk account',\n      };\n    };\n\n    (this as unknown as ISSOProvider<EEUser>).getLoginCookies = function (_state: string): string[] {\n      return [];\n    };\n\n    (this as unknown as ISSOProvider<EEUser>).getLogoutUrl = async function (\n      _redirectUri: string,\n      _request?: Request,\n    ): Promise<string | null> {\n      return null;\n    };\n  }\n\n  // ============================================================================\n  // Dynamic ISessionProvider attachment (only when OAuth is configured)\n  // ============================================================================\n\n  /**\n   * Dynamically attach ISessionProvider methods to this instance.\n   */\n  private _attachSessionProvider() {\n    const self = this;\n\n    (this as unknown as ISessionProvider<Session>).createSession = async function (\n      userId: string,\n      metadata?: Record<string, unknown>,\n    ): Promise<Session> {\n      const now = new Date();\n      return {\n        id: crypto.randomUUID(),\n        userId,\n        createdAt: now,\n        expiresAt: new Date(now.getTime() + self.cookieMaxAge * 1000),\n        metadata,\n      };\n    };\n\n    // Cookie-only sessions — validation happens via decryption in getUserFromSessionCookie/authenticateToken\n    (this as unknown as ISessionProvider<Session>).validateSession = async function (\n      _sessionId: string,\n    ): Promise<Session | null> {\n      return null;\n    };\n\n    // Cookie-only sessions — destruction happens via getClearSessionHeaders setting Max-Age=0\n    (this as unknown as ISessionProvider<Session>).destroySession = async function (\n      _sessionId: string,\n    ): Promise<void> {};\n\n    // Cookie-only sessions — refresh not supported; user must re-authenticate after expiry\n    (this as unknown as ISessionProvider<Session>).refreshSession = async function (\n      _sessionId: string,\n    ): Promise<Session | null> {\n      return null;\n    };\n\n    (this as unknown as ISessionProvider<Session>).getSessionIdFromRequest = function (\n      request: Request,\n    ): string | null {\n      const cookie = request.headers.get('Cookie');\n      if (!cookie) return null;\n      const match = cookie.match(new RegExp(`(?:^|;\\\\s*)${escapeRegex(self.cookieName)}=([^;]+)`));\n      return match?.[1] ? decodeURIComponent(match[1]) : null;\n    };\n\n    (this as unknown as ISessionProvider<Session>).getSessionHeaders = function (\n      _session: Session,\n    ): Record<string, string> {\n      return {};\n    };\n\n    (this as unknown as ISessionProvider<Session>).getClearSessionHeaders = function (): Record<string, string> {\n      return {\n        'Set-Cookie': `${self.cookieName}=; ${self.cookieFlags(0)}`,\n      };\n    };\n  }\n}\n"]}
+{"version":3,"sources":["../../../packages/_internal-core/src/logger/index.ts","../../../packages/_internal-core/src/base/MastraBase.ts","../../../packages/_internals/auth/src/provider/index.ts","../src/index.ts"],"names":[],"mappings":";;;;;;AAEO,IAAM,gBAAA,GAAmB;EAO9B,GAAA,EAAK,KAcP,CAAA;AAIO,IAAM,QAAA,GAAW;EACtB,KAAA,EAAO,OAAA;EACP,IAAA,EAAM,MAAA;EACN,IAAA,EAAM,MAAA;EACN,KAAA,EAAO,OAET,CAAA;AAsGO,IAAe,eAAf,MAAqD;AAChD,EAAA,IAAA;AACA,EAAA,KAAA;AACA,EAAA,UAAA;EAEV,WAAA,CACE,OAAA,GAII,EAAA,EACJ;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,QAAQ,IAAA,IAAQ,QAAA;AAC5B,IAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,QAAA,CAAS,KAAA;AACvC,IAAA,IAAA,CAAK,UAAA,GAAa,IAAI,GAAA,CAAI,MAAA,CAAO,QAAQ,OAAA,CAAQ,UAAA,IAAc,EAAE,CAAC,CAAA;AACpE,EAAA;EAOA,aAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;AAEA,EAAA,cAAA,CAAe,QAAe,SAAA,EAAqC;AAAC,EAAA;EAEpE,MAAM,QAAA,CACJ,aACA,MAAA,EAQA;AACA,IAAA,IAAI,CAAC,WAAA,IAAe,CAAC,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,EAAG;AACrD,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,MAAA,EAAQ,IAAA,IAAQ,GAAG,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClG,IAAA;AAEA,IAAA,OACE,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,CAAG,QAAA,GAAW,MAAM,CAAA,IAAK;AACtD,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,QAAQ,IAAA,IAAQ,CAAA;AACtB,MAAA,OAAA,EAAS,QAAQ,OAAA,IAAW,GAAA;MAC5B,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AAEA,EAAA,MAAM,eAAA,CAAgB;AACpB,IAAA,WAAA;AACA,IAAA,KAAA;AACA,IAAA,QAAA;AACA,IAAA,MAAA;AACA,IAAA,QAAA;AACA,IAAA,OAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAUC;AACD,IAAA,IAAI,CAAC,eAAe,CAAC,IAAA,CAAK,WAAW,GAAA,CAAI,WAAW,CAAA,IAAK,CAAC,KAAA,EAAO;AAC/D,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,KAAA,EAAO,CAAA,EAAG,IAAA,EAAM,IAAA,IAAQ,CAAA,EAAG,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClF,IAAA;AAEA,IAAA,OACE,IAAA,CAAK,UAAA,CACF,GAAA,CAAI,WAAW,EACf,eAAA,GAAkB,EAAE,KAAA,EAAO,QAAA,EAAU,QAAQ,QAAA,EAAU,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,IAAK;AACrF,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,IAAA,IAAQ,CAAA;AACd,MAAA,OAAA,EAAS,OAAA,IAAW,GAAA;MACpB,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AACF,CAAA;AAkBO,IAAM,aAAA,GAAN,MAAM,cAAA,SAAsB,YAAA,CAAa;AACpC,EAAA,SAAA;AACA,EAAA,MAAA;EAEV,WAAA,CAAY,OAAA,GAAgC,EAAA,EAAI;AAC9C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACxB,EAAA;AAEA,EAAA,KAAA,CAAM,mBAAA,EAAgF;AACpF,IAAA,MAAM,YACJ,OAAO,mBAAA,KAAwB,WAC3B,mBAAA,GACE,mBAAA,EAAqB,aAAkC,IAAA,CAAK,SAAA;AACpE,IAAA,OAAO,IAAI,cAAA,CAAc;AACvB,MAAA,IAAA,EAAM,IAAA,CAAK,IAAA;AACX,MAAA,KAAA,EAAO,IAAA,CAAK,KAAA;AACZ,MAAA,SAAA;AACA,MAAA,MAAA,EAAQ,IAAA,CAAK;KACd,CAAA;AACH,EAAA;EAEQ,SAAA,CAAU,KAAA,EAAiB,SAAiB,IAAA,EAA0B;AAC5E,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,OAAO,IAAA;AACzB,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,OAAO,EAAE,SAAA,EAAW,KAAK,SAAA,EAAW,KAAA,EAAO,OAAA,EAAS,IAAA,EAAM,CAAA;AACxE,IAAA,CAAA,CAAA,OAAS,CAAA,EAAG;AACV,MAAA,OAAA,CAAQ,MAAM,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAS,CAAA,OAAA,EAAU,KAAK,KAAK,CAAC,CAAA;AACxF,MAAA,OAAO,IAAA;AACT,IAAA;AACF,EAAA;EAEQ,MAAA,GAAiB;AACvB,IAAA,OAAO,IAAA,CAAK,SAAA,GAAY,CAAA,CAAA,EAAI,IAAA,CAAK,SAAS,CAAA,EAAA,CAAA,GAAO,EAAA;AACnD,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,KAAA,IAAS,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAAG;AAClF,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IAAQ,KAAK,KAAA,KAAU,QAAA,CAAS,KAAA,KACzD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,KAAK,KAAA,KAAU,QAAA,CAAS,QAAQ,IAAA,CAAK,KAAA,KAAU,SAAS,IAAA,IAAQ,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,UACzF,IAAA,CAAK,SAAA,CAAU,SAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAA,CACG,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,IACvB,KAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IACxB,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,QACxB,IAAA,CAAK,KAAA,KAAU,SAAS,KAAA,KAC1B,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAC5C;AACA,MAAA,OAAA,CAAQ,KAAA,CAAM,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACrD,IAAA;AACF,EAAA;EAEA,MAAM,QAAA,CACJ,cACA,OAAA,EAQA;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,GAAG,OAAA,EAAS,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AACpG,EAAA;AAEA,EAAA,MAAM,gBAAgB,KAAA,EASnB;AACD,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,GAAG,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAC9F,EAAA;AACF,CAAA;;;AClVO,IAAM,aAAN,MAAiB;AACtB,EAAA,SAAA,GAA8B,gBAAA,CAAiB,GAAA;AACrC,EAAA,MAAA;AACV,EAAA,IAAA;AACA,EAAA,UAAA;EAEA,WAAA,CAAY;AACV,IAAA,SAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAKC;AACD,IAAA,IAAA,CAAK,SAAA,GAAY,aAAa,gBAAA,CAAiB,GAAA;AAC/C,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AAClB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,aAAA,CAAc,EAAE,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,GAAA,EAAM,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,CAAA;AAC9E,EAAA;;;;;EAMA,WAAA,GAAmD;AACjD,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;;;;;AAMA,EAAA,cAAA,CAAe,SAAA,EAA0C;AACvD,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AACpB,EAAA;;;;;AAMA,EAAA,WAAA,CAAY,MAAA,EAAuB;AACjC,IAAA,IAAA,CAAK,MAAA,GACH,OAAA,IAAW,MAAA,IAAU,OAAQ,OAAe,KAAA,KAAU,UAAA,GACjD,MAAA,CAAe,KAAA,CAAM,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,EAAW,CAAA,GACnD,MAAA;AACR,EAAA;AACF,CAAA;;;ACtBO,IAAe,kBAAA,GAAf,cAA2D,UAAA,CAAW;AACpE,EAAA,SAAA;AACA,EAAA,MAAA;AAGP,EAAA,WAAA,CAAY,OAAA,EAA4C;AACtD,IAAA,KAAA,CAAM,EAAE,SAAA,EAAW,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,MAAM,CAAA;AAEhD,IAAA,IAAI,SAAS,aAAA,EAAe;AAC1B,MAAA,IAAA,CAAK,aAAA,GAAgB,OAAA,CAAQ,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACtD,IAAA;AAEA,IAAA,IAAA,CAAK,YAAY,OAAA,EAAS,SAAA;AAC1B,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,sBAAsB,OAAA,EAAS,mBAAA;AACtC,EAAA;AAkBU,EAAA,eAAA,CAAgB,IAAA,EAAyC;AACjE,IAAA,IAAI,MAAM,aAAA,EAAe;AACvB,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACnD,IAAA;AACA,IAAA,IAAI,MAAM,mBAAA,EAAqB;AAC7B,MAAA,IAAA,CAAK,sBAAsB,IAAA,CAAK,mBAAA;AAClC,IAAA;AACA,IAAA,IAAI,MAAM,SAAA,EAAW;AACnB,MAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AACxB,IAAA;AACA,IAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,MAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACrB,IAAA;AACF,EAAA;AACF,CAAA;ACxDA,IAAM,mBAAA,GAAsB,eAAA;AAG5B,IAAM,sBAAA,GAAyB,KAAA;AAG/B,IAAM,cAAA,GAAiB,CAAC,QAAA,EAAU,SAAA,EAAW,OAAO,CAAA;AAGpD,IAAM,WAAA,GAAc,EAAA;AAGpB,IAAM,SAAA,GAAY,EAAA;AAKlB,eAAe,SAAA,CAAU,QAAA,EAAkB,IAAA,EAAkB,KAAA,EAA8B;AACzF,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,WAAA,GAAc,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA,EAAG,QAAA,EAAU,KAAA,EAAO;AAAA,IAClG,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,OAAO,OAAO,MAAA,CAAO,SAAA;AAAA,IACnB,EAAE,IAAA,EAAM,QAAA,EAAU,MAAM,UAAA,EAAY,GAAA,EAAQ,MAAM,SAAA,EAAU;AAAA,IAC5D,WAAA;AAAA,IACA,EAAE,IAAA,EAAM,SAAA,EAAW,MAAA,EAAQ,GAAA,EAAI;AAAA,IAC/B,KAAA;AAAA,IACA,CAAC,KAAK;AAAA,GACR;AACF;AAMA,eAAe,cAAA,CAAe,MAAe,QAAA,EAAmC;AAC9E,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,OAAO,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,WAAW,CAAC,CAAA;AAC/D,EAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,QAAA,EAAU,MAAM,SAAS,CAAA;AACrD,EAAA,MAAM,KAAK,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,SAAS,CAAC,CAAA;AAC3D,EAAA,MAAM,YAAY,MAAM,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAG,EAAG,KAAK,OAAA,CAAQ,MAAA,CAAO,KAAK,SAAA,CAAU,IAAI,CAAC,CAAC,CAAA;AAChH,EAAA,MAAM,QAAA,GAAW,IAAI,UAAA,CAAW,IAAA,CAAK,MAAA,GAAS,EAAA,CAAG,MAAA,GAAS,IAAI,UAAA,CAAW,SAAS,CAAA,CAAE,MAAM,CAAA;AAC1F,EAAA,QAAA,CAAS,IAAI,IAAI,CAAA;AACjB,EAAA,QAAA,CAAS,GAAA,CAAI,EAAA,EAAI,IAAA,CAAK,MAAM,CAAA;AAC5B,EAAA,QAAA,CAAS,GAAA,CAAI,IAAI,UAAA,CAAW,SAAS,GAAG,IAAA,CAAK,MAAA,GAAS,GAAG,MAAM,CAAA;AAC/D,EAAA,OAAO,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa,GAAG,QAAQ,CAAC,CAAA;AAC9C;AAKA,eAAe,cAAA,CAAe,WAAmB,QAAA,EAAoC;AACnF,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,IAAA,CAAK,IAAA,CAAK,SAAS,GAAG,CAAA,CAAA,KAAK,CAAA,CAAE,UAAA,CAAW,CAAC,CAAC,CAAA;AACtE,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,WAAW,CAAA;AAC1C,EAAA,MAAM,EAAA,GAAK,QAAA,CAAS,KAAA,CAAM,WAAA,EAAa,cAAc,SAAS,CAAA;AAC9D,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,WAAA,GAAc,SAAS,CAAA;AACnD,EAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,QAAA,EAAU,MAAM,SAAS,CAAA;AACrD,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAG,EAAG,GAAA,EAAK,IAAI,CAAA;AAChF,EAAA,OAAO,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,SAAS,CAAC,CAAA;AACvD;AAGA,IAAM,qBAAA,GAAwB,KAAK,EAAA,GAAK,GAAA;AAexC,eAAe,QAAA,CAAS,MAAc,MAAA,EAAiC;AACrE,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,MAAA,CAAO,MAAM,CAAA;AACrC,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA;AAGrC,EAAA,MAAM,YAAY,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,OAAO,OAAA,EAAS,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,SAAA,EAAU,EAAG,KAAA,EAAO,CAAC,MAAM,CAAC,CAAA;AAGlH,EAAA,MAAM,YAAY,MAAM,MAAA,CAAO,OAAO,IAAA,CAAK,MAAA,EAAQ,WAAW,SAAS,CAAA;AAGvE,EAAA,MAAM,QAAA,GAAW,IAAI,UAAA,CAAW,SAAS,CAAA;AACzC,EAAA,OAAO,KAAK,MAAA,CAAO,YAAA,CAAa,GAAG,QAAQ,CAAC,CAAA,CACzC,OAAA,CAAQ,KAAA,EAAO,GAAG,EAClB,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,MAAM,EAAE,CAAA;AACrB;AAKA,SAAS,eAAA,CAAgB,GAAW,CAAA,EAAoB;AACtD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,MAAA,IAAU,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,MAAA,KAAW,CAAA;AACpB;AAMA,eAAe,gBAAA,CAAiB,aAAA,EAAuB,WAAA,EAAqB,MAAA,EAAiC;AAC3G,EAAA,MAAM,OAAA,GAAwB;AAAA,IAC5B,CAAA,EAAG,aAAA;AAAA,IACH,CAAA,EAAG,WAAA;AAAA,IACH,CAAA,EAAG,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,GAClB;AACA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAC/C,EAAA,MAAM,SAAA,GAAY,MAAM,QAAA,CAAS,UAAA,EAAY,MAAM,CAAA;AACnD,EAAA,OAAO,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA;AACnC;AAMA,eAAe,gBAAA,CACb,YACA,MAAA,EACyD;AACzD,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA;AAClC,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,CAAC,UAAA,EAAY,SAAS,CAAA,GAAI,KAAA;AAChC,EAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,UAAA,EAAa,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,eAAA,CAAgB,SAAA,EAAY,WAAW,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACjD;AAEA,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,UAAW,CAAC,CAAA;AAC5C,EAAA,IAAI,OAAA,CAAQ,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI,EAAG;AAC1B,IAAA,MAAM,IAAI,MAAM,yBAAyB,CAAA;AAAA,EAC3C;AAEA,EAAA,OAAO,EAAE,aAAA,EAAe,OAAA,CAAQ,CAAA,EAAG,WAAA,EAAa,QAAQ,CAAA,EAAE;AAC5D;AAKA,SAAS,YAAY,GAAA,EAAqB;AACxC,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AAClD;AAMA,SAAS,cAAc,cAAA,EAAgC;AACrD,EAAA,MAAM,aAAA,GAAgB,cAAA,CAAe,OAAA,CAAQ,kBAAA,EAAoB,EAAE,CAAA;AACnE,EAAA,MAAM,OAAA,GAAU,KAAK,aAAa,CAAA;AAClC,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACxC,EAAA,OAAO,WAAW,MAAM,CAAA,CAAA;AAC1B;AAyEO,IAAM,eAAA,GAAN,cAA8B,kBAAA,CAA+D;AAAA,EACxF,KAAA;AAAA,EACA,OAAA;AAAA,EACA,cAAA;AAAA,EACA,OAAA;AAAA;AAAA,EAGF,aAAA;AAAA,EACA,iBAAA;AAAA,EACA,YAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EAER,YAAY,OAAA,EAAkC;AAC5C,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,SAAS,CAAA;AAExC,IAAA,MAAM,OAAA,GAAU,OAAA,EAAS,OAAA,IAAW,OAAA,CAAQ,GAAA,CAAI,cAAA;AAChD,IAAA,MAAM,SAAA,GAAY,OAAA,EAAS,SAAA,IAAa,OAAA,CAAQ,GAAA,CAAI,gBAAA;AACpD,IAAA,MAAM,cAAA,GAAiB,OAAA,EAAS,cAAA,IAAkB,OAAA,CAAQ,GAAA,CAAI,qBAAA;AAE9D,IAAA,IAAI,CAAC,OAAA,IAAW,CAAC,SAAA,IAAa,CAAC,cAAA,EAAgB;AAC7C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,cAAA,GAAiB,cAAA;AACtB,IAAA,IAAA,CAAK,OAAA,GAAU,cAAc,cAAc,CAAA;AAC3C,IAAA,IAAA,CAAK,QAAQ,iBAAA,CAAkB;AAAA,MAC7B,SAAA;AAAA,MACA;AAAA,KACD,CAAA;AAGD,IAAA,MAAM,aAAA,GAAgB,OAAA,EAAS,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,qBAAA;AAC5D,IAAA,MAAM,iBAAA,GAAoB,OAAA,EAAS,iBAAA,IAAqB,OAAA,CAAQ,GAAA,CAAI,yBAAA;AACpE,IAAA,MAAM,WAAA,GAAc,OAAA,EAAS,WAAA,IAAe,OAAA,CAAQ,GAAA,CAAI,wBAAA;AACxD,IAAA,MAAM,cAAA,GACJ,OAAA,EAAS,OAAA,EAAS,cAAA,IAClB,OAAA,CAAQ,GAAA,CAAI,qBAAA,IACZ,MAAA,CAAO,UAAA,EAAW,GAAI,MAAA,CAAO,UAAA,EAAW;AAE1C,IAAA,IAAA,CAAK,gBAAgB,aAAA,IAAiB,IAAA;AACtC,IAAA,IAAA,CAAK,oBAAoB,iBAAA,IAAqB,IAAA;AAC9C,IAAA,IAAA,CAAK,eAAe,WAAA,IAAe,IAAA;AACnC,IAAA,IAAA,CAAK,MAAA,GAAS,SAAS,MAAA,IAAU,cAAA;AACjC,IAAA,IAAA,CAAK,UAAA,GAAa,OAAA,EAAS,OAAA,EAAS,UAAA,IAAc,mBAAA;AAClD,IAAA,IAAA,CAAK,YAAA,GAAe,OAAA,EAAS,OAAA,EAAS,YAAA,IAAgB,sBAAA;AACtD,IAAA,IAAA,CAAK,cAAA,GAAiB,cAAA;AACtB,IAAA,IAAA,CAAK,gBAAgB,OAAA,EAAS,OAAA,EAAS,aAAA,IAAiB,OAAA,CAAQ,IAAI,QAAA,KAAa,YAAA;AAGjF,IAAA,IAAA,CAAK,UAAA,GAAa,CAAC,EAAE,aAAA,IAAiB,iBAAA,CAAA;AAEtC,IAAA,IAAI,KAAK,UAAA,EAAY;AACnB,MAAA,IAAI,cAAA,CAAe,SAAS,EAAA,EAAI;AAC9B,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,OAAA,EAAS,OAAA,EAAS,kBAAkB,CAAC,OAAA,CAAQ,IAAI,qBAAA,EAAuB;AAC3E,QAAA,OAAA,CAAQ,IAAA;AAAA,UACN;AAAA,SACF;AAAA,MACF;AAIA,MAAA,IAAA,CAAK,kBAAA,EAAmB;AACxB,MAAA,IAAA,CAAK,sBAAA,EAAuB;AAAA,IAC9B;AAEA,IAAA,IAAA,CAAK,gBAAgB,OAAO,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,iBAAA,CACJ,KAAA,EACA,OAAA,EAC2B;AAI3B,IAAA,IAAI,IAAA,CAAK,cAAc,OAAA,EAAS;AAC9B,MAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,wBAAA,CAAyB,OAAkB,CAAA;AAC1E,MAAA,IAAI,aAAa,OAAO,WAAA;AAAA,IAC1B;AAGA,IAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,UAAA,CAAW,KAAA,EAAO,KAAK,OAAO,CAAA;AACjD,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,IAAA,EAAiB;AAEnC,IAAA,OAAO,CAAC,EAAE,IAAA,CAAK,GAAA,IAAQ,IAAA,CAA2B,EAAA,CAAA;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,aAAa,OAAA,EAAiC;AACpD,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACtD,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAM,QAAQ,UAAA,CAAW,OAAA,CAAQ,aAAA,EAAe,EAAE,EAAE,IAAA,EAAK;AACzD,MAAA,IAAI,OAAO,OAAO,KAAA;AAAA,IACpB;AAEA,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AAC3C,IAAA,IAAI,MAAA,EAAQ;AAEV,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,mBAAmB,CAAA;AAC9C,MAAA,IAAI,KAAA,GAAQ,CAAC,CAAA,EAAG,OAAO,MAAM,CAAC,CAAA;AAAA,IAChC;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,eAAe,OAAA,EAA0C;AAE7D,IAAA,IAAI,KAAK,UAAA,EAAY;AACnB,MAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,wBAAA,CAAyB,OAAO,CAAA;AAC/D,MAAA,IAAI,aAAa,OAAO,WAAA;AAAA,IAC1B;AAGA,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,YAAA,CAAa,OAAO,CAAA;AACvC,IAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AAEnB,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,iBAAA,CAAkB,KAAK,CAAA;AAClD,MAAA,IAAI,CAAC,OAAA,EAAS,GAAA,EAAK,OAAO,IAAA;AAG1B,MAAA,IAAI;AACF,QAAA,MAAM,YAAY,MAAM,IAAA,CAAK,MAAM,KAAA,CAAM,OAAA,CAAQ,QAAQ,GAAG,CAAA;AAC5D,QAAA,OAAO;AAAA,UACL,IAAI,SAAA,CAAU,EAAA;AAAA,UACd,KAAA,EAAO,SAAA,CAAU,cAAA,GAAiB,CAAC,CAAA,EAAG,YAAA;AAAA,UACtC,IAAA,EAAM,CAAC,SAAA,CAAU,SAAA,EAAW,SAAA,CAAU,QAAQ,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,IAAK,MAAA;AAAA,UAC7E,WAAW,SAAA,CAAU,QAAA;AAAA,UACrB,UAAU,SAAA,CAAU;AAAA,SACtB;AAAA,MACF,CAAA,CAAA,MAAQ;AAEN,QAAA,OAAO;AAAA,UACL,IAAI,OAAA,CAAQ,GAAA;AAAA,UACZ,KAAA,EAAQ,QAAQ,KAAA,IAAoB,MAAA;AAAA,UACpC,IAAA,EAAO,QAAQ,IAAA,IAAmB;AAAA,SACpC;AAAA,MACF;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,MAAA,EAAwC;AACpD,IAAA,IAAI;AACF,MAAA,MAAM,YAAY,MAAM,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,QAAQ,MAAM,CAAA;AACvD,MAAA,OAAO;AAAA,QACL,IAAI,SAAA,CAAU,EAAA;AAAA,QACd,KAAA,EAAO,SAAA,CAAU,cAAA,GAAiB,CAAC,CAAA,EAAG,YAAA;AAAA,QACtC,IAAA,EAAM,CAAC,SAAA,CAAU,SAAA,EAAW,SAAA,CAAU,QAAQ,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,IAAK,MAAA;AAAA,QAC7E,WAAW,SAAA,CAAU,QAAA;AAAA,QACrB,UAAU,SAAA,CAAU;AAAA,OACtB;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,kBAAkB,IAAA,EAAsB;AACtC,IAAA,OAAO,CAAA,MAAA,EAAS,KAAK,EAAE,CAAA,CAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAA,GAAwB;AACtB,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,UAAA,GAAqB;AACnB,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKQ,YAAY,MAAA,EAAwB;AAC1C,IAAA,MAAM,KAAA,GAAQ,2CAA2C,MAAM,CAAA,CAAA;AAC/D,IAAA,OAAO,IAAA,CAAK,aAAA,GAAgB,CAAA,EAAG,KAAK,CAAA,QAAA,CAAA,GAAa,KAAA;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,yBACZ,OAAA,EACwB;AAExB,IAAA,MAAM,MAAA,GACJ,QAAA,IAAY,OAAA,IAAW,OAAQ,QAAgB,MAAA,KAAW,UAAA,GACrD,OAAA,CAAgB,MAAA,CAAO,QAAQ,CAAA,GAC/B,OAAA,CAAoB,OAAA,EAAS,IAAI,QAAQ,CAAA;AAChD,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AAEpB,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,IAAI,MAAA,CAAO,CAAA,WAAA,EAAc,WAAA,CAAY,IAAA,CAAK,UAAU,CAAC,CAAA,QAAA,CAAU,CAAC,CAAA;AAC3F,IAAA,IAAI,CAAC,KAAA,GAAQ,CAAC,CAAA,EAAG,OAAO,IAAA;AAExB,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAe,MAAM,cAAA,CAAe,kBAAA,CAAmB,MAAM,CAAC,CAAC,CAAA,EAAG,IAAA,CAAK,cAAc,CAAA;AAK3F,MAAA,IAAI,WAAA,CAAY,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,EAAG;AACtC,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,OAAO,WAAA,CAAY,IAAA;AAAA,IACrB,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,kBAAA,GAAqB;AAC3B,IAAA,MAAM,IAAA,GAAO,IAAA;AAEb,IAAC,IAAA,CAAyC,WAAA,GAAc,eACtD,WAAA,EACA,KAAA,EACiB;AAGjB,MAAA,MAAM,iBAAA,GAAoB,eAAe,IAAA,CAAK,YAAA;AAC9C,MAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,QAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAAA,MAC1D;AAEA,MAAA,MAAM,cAAc,MAAM,gBAAA,CAAiB,KAAA,EAAO,iBAAA,EAAmB,KAAK,cAAc,CAAA;AAExF,MAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,QACjC,WAAW,IAAA,CAAK,aAAA;AAAA,QAChB,aAAA,EAAe,MAAA;AAAA,QACf,KAAA,EAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA;AAAA,QAC3B,YAAA,EAAc,iBAAA;AAAA,QACd,KAAA,EAAO;AAAA,OACR,CAAA;AAED,MAAA,OAAO,GAAG,IAAA,CAAK,OAAO,CAAA,iBAAA,EAAoB,MAAA,CAAO,UAAU,CAAA,CAAA;AAAA,IAC7D,CAAA;AAEA,IAAC,IAAA,CAAyC,cAAA,GAAiB,eACzD,IAAA,EACA,UAAA,EACoC;AAEpC,MAAA,MAAM,EAAE,WAAA,EAAY,GAAI,MAAM,gBAAA,CAAiB,UAAA,EAAY,KAAK,cAAc,CAAA;AAG9E,MAAA,MAAM,gBAAgB,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,YAAA,CAAA,EAAgB;AAAA,QAC/D,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mCAAA;AAAA,UAChB,aAAA,EAAe,CAAA,MAAA,EAAS,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,aAAa,CAAA,CAAA,EAAI,IAAA,CAAK,iBAAiB,CAAA,CAAE,CAAC,CAAA;AAAA,SACjF;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,UACxB,UAAA,EAAY,oBAAA;AAAA,UACZ,IAAA;AAAA,UACA,YAAA,EAAc;AAAA,SACf,CAAA;AAAA,QACD,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAM;AAAA;AAAA,OACnC,CAAA;AAED,MAAA,IAAI,CAAC,cAAc,EAAA,EAAI;AACrB,QAAA,MAAM,KAAA,GAAQ,MAAM,aAAA,CAAc,IAAA,EAAK;AACvC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,KAAK,CAAA,CAAE,CAAA;AAAA,MACnD;AAEA,MAAA,MAAM,MAAA,GAAU,MAAM,aAAA,CAAc,IAAA,EAAK;AASzC,MAAA,IAAI,IAAA;AACJ,MAAA,IAAI,OAAO,QAAA,EAAU;AACnB,QAAA,MAAM,UAAU,MAAM,UAAA,CAAW,MAAA,CAAO,QAAA,EAAU,KAAK,OAAO,CAAA;AAC9D,QAAA,IAAA,GAAO;AAAA,UACL,IAAI,OAAA,CAAQ,GAAA;AAAA,UACZ,KAAA,EAAQ,QAAQ,KAAA,IAAoB,MAAA;AAAA,UACpC,IAAA,EAAO,QAAQ,IAAA,IAAmB,MAAA;AAAA,UAClC,SAAA,EAAY,QAAQ,OAAA,IAAsB;AAAA,SAC5C;AAAA,MACF,CAAA,MAAO;AACL,QAAA,MAAM,mBAAmB,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,eAAA,CAAA,EAAmB;AAAA,UACrE,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,MAAA,CAAO,YAAY,CAAA,CAAA,EAAG;AAAA,UAC1D,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAM;AAAA;AAAA,SACnC,CAAA;AAED,QAAA,IAAI,CAAC,iBAAiB,EAAA,EAAI;AACxB,UAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,QACxD;AAEA,QAAA,MAAM,QAAA,GAAY,MAAM,gBAAA,CAAiB,IAAA,EAAK;AAM9C,QAAA,IAAA,GAAO;AAAA,UACL,IAAI,QAAA,CAAS,GAAA;AAAA,UACb,OAAO,QAAA,CAAS,KAAA;AAAA,UAChB,MAAM,QAAA,CAAS,IAAA;AAAA,UACf,WAAW,QAAA,CAAS;AAAA,SACtB;AAAA,MACF;AAGA,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAK,EAAE,CAAA;AAC3C,QAAA,IAAI,QAAA,EAAU;AACZ,UAAA,IAAA,GAAO,QAAA;AAAA,QACT;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAGA,MAAA,MAAM,WAAA,GAAc;AAAA,QAClB,IAAA;AAAA,QACA,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,YAAA,GAAe;AAAA,OAC9C;AAEA,MAAA,MAAM,gBAAA,GAAmB,MAAM,cAAA,CAAe,WAAA,EAAa,KAAK,cAAc,CAAA;AAC9E,MAAA,MAAM,WAAA,GAAc,CAAA,EAAG,IAAA,CAAK,UAAU,CAAA,CAAA,EAAI,kBAAA,CAAmB,gBAAgB,CAAC,CAAA,EAAA,EAAK,IAAA,CAAK,WAAA,CAAY,IAAA,CAAK,YAAY,CAAC,CAAA,CAAA;AAEtH,MAAA,OAAO;AAAA,QACL,IAAA;AAAA,QACA,MAAA,EAAQ;AAAA,UACN,aAAa,MAAA,CAAO,YAAA;AAAA,UACpB,cAAc,MAAA,CAAO,aAAA;AAAA,UACrB,SAAS,MAAA,CAAO,QAAA;AAAA,UAChB,SAAA,EAAW,IAAI,IAAA,CAAK,IAAA,CAAK,KAAI,GAAI,MAAA,CAAO,aAAa,GAAI;AAAA,SAC3D;AAAA,QACA,OAAA,EAAS,CAAC,WAAW;AAAA,OACvB;AAAA,IACF,CAAA;AAEA,IAAC,IAAA,CAAyC,uBAAuB,WAA4B;AAC3F,MAAA,OAAO;AAAA,QACL,QAAA,EAAU,OAAA;AAAA,QACV,IAAA,EAAM,oBAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,IACF,CAAA;AAEA,IAAC,IAAA,CAAyC,eAAA,GAAkB,SAAU,MAAA,EAA0B;AAC9F,MAAA,OAAO,EAAC;AAAA,IACV,CAAA;AAEA,IAAC,IAAA,CAAyC,YAAA,GAAe,eACvD,YAAA,EACA,QAAA,EACwB;AACxB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,sBAAA,GAAyB;AAC/B,IAAA,MAAM,IAAA,GAAO,IAAA;AAEb,IAAC,IAAA,CAA8C,aAAA,GAAgB,eAC7D,MAAA,EACA,QAAA,EACkB;AAClB,MAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,OAAO,UAAA,EAAW;AAAA,QACtB,MAAA;AAAA,QACA,SAAA,EAAW,GAAA;AAAA,QACX,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAQ,GAAI,IAAA,CAAK,eAAe,GAAI,CAAA;AAAA,QAC5D;AAAA,OACF;AAAA,IACF,CAAA;AAGA,IAAC,IAAA,CAA8C,eAAA,GAAkB,eAC/D,UAAA,EACyB;AACzB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAGA,IAAC,IAAA,CAA8C,cAAA,GAAiB,eAC9D,UAAA,EACe;AAAA,IAAC,CAAA;AAGlB,IAAC,IAAA,CAA8C,cAAA,GAAiB,eAC9D,UAAA,EACyB;AACzB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAEA,IAAC,IAAA,CAA8C,uBAAA,GAA0B,SACvE,OAAA,EACe;AACf,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AAC3C,MAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,IAAI,MAAA,CAAO,CAAA,WAAA,EAAc,WAAA,CAAY,IAAA,CAAK,UAAU,CAAC,CAAA,QAAA,CAAU,CAAC,CAAA;AAC3F,MAAA,OAAO,QAAQ,CAAC,CAAA,GAAI,mBAAmB,KAAA,CAAM,CAAC,CAAC,CAAA,GAAI,IAAA;AAAA,IACrD,CAAA;AAEA,IAAC,IAAA,CAA8C,iBAAA,GAAoB,SACjE,QAAA,EACwB;AACxB,MAAA,OAAO,EAAC;AAAA,IACV,CAAA;AAEA,IAAC,IAAA,CAA8C,yBAAyB,WAAoC;AAC1G,MAAA,OAAO;AAAA,QACL,YAAA,EAAc,GAAG,IAAA,CAAK,UAAU,MAAM,IAAA,CAAK,WAAA,CAAY,CAAC,CAAC,CAAA;AAAA,OAC3D;AAAA,IACF,CAAA;AAAA,EACF;AACF","file":"index.js","sourcesContent":["import { Transform } from 'node:stream';\n\nexport const RegisteredLogger = {\n  AGENT: 'AGENT',\n  OBSERVABILITY: 'OBSERVABILITY',\n  AUTH: 'AUTH',\n  BROWSER: 'BROWSER',\n  NETWORK: 'NETWORK',\n  WORKFLOW: 'WORKFLOW',\n  LLM: 'LLM',\n  TTS: 'TTS',\n  VOICE: 'VOICE',\n  VECTOR: 'VECTOR',\n  BUNDLER: 'BUNDLER',\n  DEPLOYER: 'DEPLOYER',\n  MEMORY: 'MEMORY',\n  STORAGE: 'STORAGE',\n  EMBEDDINGS: 'EMBEDDINGS',\n  MCP_SERVER: 'MCP_SERVER',\n  SERVER_CACHE: 'SERVER_CACHE',\n  SERVER: 'SERVER',\n  WORKSPACE: 'WORKSPACE',\n  CHANNEL: 'CHANNEL',\n} as const;\n\nexport type RegisteredLogger = (typeof RegisteredLogger)[keyof typeof RegisteredLogger];\n\nexport const LogLevel = {\n  DEBUG: 'debug',\n  INFO: 'info',\n  WARN: 'warn',\n  ERROR: 'error',\n  NONE: 'silent',\n} as const;\n\nexport type LogLevel = (typeof LogLevel)[keyof typeof LogLevel];\n\nexport interface BaseLogMessage {\n  runId?: string;\n  msg: string;\n  level: LogLevel;\n  time: Date;\n  pid: number;\n  hostname: string;\n  name: string;\n}\n\nexport abstract class LoggerTransport extends Transform {\n  constructor(opts: any = {}) {\n    super({ ...opts, objectMode: true });\n  }\n\n  async listLogsByRunId(_args: {\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }): Promise<{\n    logs: BaseLogMessage[];\n    total: number;\n    page: number;\n    perPage: number;\n    hasMore: boolean;\n  }> {\n    return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n  }\n\n  async listLogs(_args?: {\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    returnPaginationResults?: boolean;\n    page?: number;\n    perPage?: number;\n  }): Promise<{\n    logs: BaseLogMessage[];\n    total: number;\n    page: number;\n    perPage: number;\n    hasMore: boolean;\n  }> {\n    return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n  }\n}\n\nexport const createCustomTransport = (\n  stream: Transform,\n  listLogs?: LoggerTransport['listLogs'],\n  listLogsByRunId?: LoggerTransport['listLogsByRunId'],\n) => {\n  let transport = stream as LoggerTransport;\n  if (listLogs) {\n    transport.listLogs = listLogs;\n  }\n  if (listLogsByRunId) {\n    transport.listLogsByRunId = listLogsByRunId;\n  }\n  return transport as LoggerTransport;\n};\n\nexport interface IMastraLogger {\n  debug(message: string, ...args: any[]): void;\n  info(message: string, ...args: any[]): void;\n  warn(message: string, ...args: any[]): void;\n  error(message: string, ...args: any[]): void;\n  trackException(error: Error, metadata?: Record<string, unknown>): void;\n\n  getTransports(): Map<string, LoggerTransport>;\n  listLogs(\n    _transportId: string,\n    _params?: {\n      fromDate?: Date;\n      toDate?: Date;\n      logLevel?: LogLevel;\n      filters?: Record<string, any>;\n      page?: number;\n      perPage?: number;\n    },\n  ): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n  listLogsByRunId(_args: {\n    transportId: string;\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n}\n\nexport abstract class MastraLogger implements IMastraLogger {\n  protected name: string;\n  protected level: LogLevel;\n  protected transports: Map<string, LoggerTransport>;\n\n  constructor(\n    options: {\n      name?: string;\n      level?: LogLevel;\n      transports?: Record<string, LoggerTransport>;\n    } = {},\n  ) {\n    this.name = options.name || 'Mastra';\n    this.level = options.level || LogLevel.ERROR;\n    this.transports = new Map(Object.entries(options.transports || {}));\n  }\n\n  abstract debug(message: string, ...args: any[]): void;\n  abstract info(message: string, ...args: any[]): void;\n  abstract warn(message: string, ...args: any[]): void;\n  abstract error(message: string, ...args: any[]): void;\n\n  getTransports() {\n    return this.transports;\n  }\n\n  trackException(_error: Error, _metadata?: Record<string, unknown>) {}\n\n  async listLogs(\n    transportId: string,\n    params?: {\n      fromDate?: Date;\n      toDate?: Date;\n      logLevel?: LogLevel;\n      filters?: Record<string, any>;\n      page?: number;\n      perPage?: number;\n    },\n  ) {\n    if (!transportId || !this.transports.has(transportId)) {\n      return { logs: [], total: 0, page: params?.page ?? 1, perPage: params?.perPage ?? 100, hasMore: false };\n    }\n\n    return (\n      this.transports.get(transportId)!.listLogs?.(params) ?? {\n        logs: [],\n        total: 0,\n        page: params?.page ?? 1,\n        perPage: params?.perPage ?? 100,\n        hasMore: false,\n      }\n    );\n  }\n\n  async listLogsByRunId({\n    transportId,\n    runId,\n    fromDate,\n    toDate,\n    logLevel,\n    filters,\n    page,\n    perPage,\n  }: {\n    transportId: string;\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }) {\n    if (!transportId || !this.transports.has(transportId) || !runId) {\n      return { logs: [], total: 0, page: page ?? 1, perPage: perPage ?? 100, hasMore: false };\n    }\n\n    return (\n      this.transports\n        .get(transportId)!\n        .listLogsByRunId?.({ runId, fromDate, toDate, logLevel, filters, page, perPage }) ?? {\n        logs: [],\n        total: 0,\n        page: page ?? 1,\n        perPage: perPage ?? 100,\n        hasMore: false,\n      }\n    );\n  }\n}\n\nexport type LogFilterContext = {\n  component?: RegisteredLogger;\n  level: LogLevel;\n  message: string;\n  args: unknown[];\n};\n\nexport type LogFilter = (ctx: LogFilterContext) => boolean;\n\nexport interface ConsoleLoggerOptions {\n  name?: string;\n  level?: LogLevel;\n  component?: RegisteredLogger;\n  filter?: LogFilter;\n}\n\nexport class ConsoleLogger extends MastraLogger {\n  protected component?: RegisteredLogger;\n  protected filter?: LogFilter;\n\n  constructor(options: ConsoleLoggerOptions = {}) {\n    super(options);\n    this.component = options.component;\n    this.filter = options.filter;\n  }\n\n  child(componentOrBindings: RegisteredLogger | Record<string, unknown>): ConsoleLogger {\n    const component =\n      typeof componentOrBindings === 'string'\n        ? componentOrBindings\n        : ((componentOrBindings?.component as RegisteredLogger) ?? this.component);\n    return new ConsoleLogger({\n      name: this.name,\n      level: this.level,\n      component,\n      filter: this.filter,\n    });\n  }\n\n  private shouldLog(level: LogLevel, message: string, args: unknown[]): boolean {\n    if (!this.filter) return true;\n    try {\n      return this.filter({ component: this.component, level, message, args });\n    } catch (e) {\n      console.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);\n      return true;\n    }\n  }\n\n  private prefix(): string {\n    return this.component ? `[${this.component}] ` : '';\n  }\n\n  debug(message: string, ...args: any[]): void {\n    if (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) {\n      console.info(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  info(message: string, ...args: any[]): void {\n    if (\n      (this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n      this.shouldLog(LogLevel.INFO, message, args)\n    ) {\n      console.info(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  warn(message: string, ...args: any[]): void {\n    if (\n      (this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n      this.shouldLog(LogLevel.WARN, message, args)\n    ) {\n      console.warn(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  error(message: string, ...args: any[]): void {\n    if (\n      (this.level === LogLevel.ERROR ||\n        this.level === LogLevel.WARN ||\n        this.level === LogLevel.INFO ||\n        this.level === LogLevel.DEBUG) &&\n      this.shouldLog(LogLevel.ERROR, message, args)\n    ) {\n      console.error(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  async listLogs(\n    _transportId: string,\n    _params?: {\n      fromDate?: Date;\n      toDate?: Date;\n      logLevel?: LogLevel;\n      filters?: Record<string, any>;\n      page?: number;\n      perPage?: number;\n    },\n  ) {\n    return { logs: [], total: 0, page: _params?.page ?? 1, perPage: _params?.perPage ?? 100, hasMore: false };\n  }\n\n  async listLogsByRunId(_args: {\n    transportId: string;\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }) {\n    return { logs: [], total: 0, page: _args.page ?? 1, perPage: _args.perPage ?? 100, hasMore: false };\n  }\n}\n","import type { IMastraLogger } from '../logger';\nimport { ConsoleLogger, RegisteredLogger } from '../logger';\n\nexport class MastraBase {\n  component: RegisteredLogger = RegisteredLogger.LLM;\n  protected logger: IMastraLogger;\n  name?: string;\n  #rawConfig?: Record<string, unknown>;\n\n  constructor({\n    component,\n    name,\n    rawConfig,\n  }: {\n    component?: RegisteredLogger;\n    name?: string;\n    rawConfig?: Record<string, unknown>;\n  }) {\n    this.component = component || RegisteredLogger.LLM;\n    this.name = name;\n    this.#rawConfig = rawConfig;\n    this.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });\n  }\n\n  /**\n   * Returns the raw storage configuration this primitive was created from,\n   * or undefined if it was created from code.\n   */\n  toRawConfig(): Record<string, unknown> | undefined {\n    return this.#rawConfig;\n  }\n\n  /**\n   * Sets the raw storage configuration for this primitive.\n   * @internal\n   */\n  __setRawConfig(rawConfig: Record<string, unknown>): void {\n    this.#rawConfig = rawConfig;\n  }\n\n  /**\n   * Set the logger for the agent\n   * @param logger\n   */\n  __setLogger(logger: IMastraLogger) {\n    this.logger =\n      'child' in logger && typeof (logger as any).child === 'function'\n        ? (logger as any).child({ component: this.component })\n        : logger;\n  }\n}\n","import { MastraBase } from '@internal/core/base';\nimport type {\n  CredentialsResult,\n  ISSOProvider,\n  ISessionProvider,\n  IUserProvider,\n  Session,\n  SSOCallbackResult,\n  SSOLoginConfig,\n  User,\n} from '..';\nimport type { AuthorizeUserFn, MastraAuthConfig, MastraAuthRequest } from '../types';\nimport { getRequestHeader } from '../types';\n\nexport interface MastraAuthProviderOptions<TUser = unknown> {\n  name?: string;\n  authorizeUser?: AuthorizeUserFn<TUser>;\n  mapUserToResourceId?(user: TUser): string | undefined | null;\n  /**\n   * Protected paths for the auth provider\n   */\n  protected?: MastraAuthConfig['protected'];\n  /**\n   * Public paths for the auth provider\n   */\n  public?: MastraAuthConfig['public'];\n}\n\nexport abstract class MastraAuthProvider<TUser = unknown> extends MastraBase {\n  public protected?: MastraAuthConfig['protected'];\n  public public?: MastraAuthConfig['public'];\n  public mapUserToResourceId?(user: TUser): string | undefined | null;\n\n  constructor(options?: MastraAuthProviderOptions<TUser>) {\n    super({ component: 'AUTH', name: options?.name });\n\n    if (options?.authorizeUser) {\n      this.authorizeUser = options.authorizeUser.bind(this);\n    }\n\n    this.protected = options?.protected;\n    this.public = options?.public;\n    this.mapUserToResourceId = options?.mapUserToResourceId;\n  }\n\n  /**\n   * Authenticate a token and return the payload\n   * @param token - The token to authenticate\n   * @param request - The request\n   * @returns The payload\n   */\n  abstract authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;\n\n  /**\n   * Authorize a user for a path and method\n   * @param user - The user to authorize\n   * @param request - The request\n   * @returns The authorization result\n   */\n  abstract authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;\n\n  protected registerOptions(opts?: MastraAuthProviderOptions<TUser>) {\n    if (opts?.authorizeUser) {\n      this.authorizeUser = opts.authorizeUser.bind(this);\n    }\n    if (opts?.mapUserToResourceId) {\n      this.mapUserToResourceId = opts.mapUserToResourceId;\n    }\n    if (opts?.protected) {\n      this.protected = opts.protected;\n    }\n    if (opts?.public) {\n      this.public = opts.public;\n    }\n  }\n}\n\ntype PrimitiveAuthUser = string | number | boolean | bigint | symbol | null | undefined;\n\n// Type guards for interface detection\nfunction isSSOProvider(p: unknown): p is ISSOProvider {\n  return (\n    p !== null &&\n    typeof p === 'object' &&\n    typeof (p as any).getLoginUrl === 'function' &&\n    typeof (p as any).handleCallback === 'function'\n  );\n}\n\nfunction isSessionProvider(p: unknown): p is ISessionProvider {\n  return (\n    p !== null &&\n    typeof p === 'object' &&\n    typeof (p as any).validateSession === 'function' &&\n    typeof (p as any).createSession === 'function'\n  );\n}\n\nfunction isUserProvider(p: unknown): p is IUserProvider {\n  return p !== null && typeof p === 'object' && typeof (p as any).getCurrentUser === 'function';\n}\nfunction isCredentialsProvider(p: unknown): boolean {\n  return p !== null && typeof p === 'object' && typeof (p as any).signIn === 'function';\n}\n\nfunction isObjectLike(value: unknown): value is object {\n  return (typeof value === 'object' && value !== null) || typeof value === 'function';\n}\n\nexport class CompositeAuth\n  extends MastraAuthProvider\n  implements ISSOProvider<User>, ISessionProvider<Session>, IUserProvider<User>\n{\n  private providers: MastraAuthProvider[];\n  private authenticatedProviderByObject = new WeakMap<object, MastraAuthProvider>();\n  private authenticatedProviderByPrimitive = new Map<PrimitiveAuthUser, MastraAuthProvider>();\n\n  constructor(providers: MastraAuthProvider[]) {\n    const combinedPublic = providers.flatMap(provider => provider.public ?? []);\n    const combinedProtected = providers.flatMap(provider => provider.protected ?? []);\n\n    super({\n      public: combinedPublic,\n      protected: combinedProtected,\n    });\n\n    this.providers = providers;\n    if (providers.some(provider => typeof provider.mapUserToResourceId === 'function')) {\n      this.mapUserToResourceId = user => this.mapAuthenticatedUserToResourceId(user);\n    }\n\n    // Null out interface methods when no inner provider supports them.\n    // This ensures duck-typing checks (typeof auth.method === 'function')\n    // accurately reflect the composite's actual capabilities — preventing\n    // Studio from showing login options that no provider can handle.\n    if (!providers.some(isSSOProvider)) {\n      this.getLoginUrl = undefined as any;\n      this.handleCallback = undefined as any;\n      this.getLoginButtonConfig = undefined as any;\n    }\n    if (!providers.some(isSessionProvider)) {\n      this.createSession = undefined as any;\n      this.validateSession = undefined as any;\n      this.getSessionIdFromRequest = undefined as any;\n    }\n    if (!providers.some(isUserProvider)) {\n      this.getCurrentUser = undefined as any;\n      this.getUser = undefined as any;\n      this.getUsers = undefined as any;\n    }\n    // Proxy credentials provider methods if any inner provider supports them.\n    const credProvider = this.findProvider(isCredentialsProvider as (p: unknown) => p is MastraAuthProvider) as any;\n    if (credProvider) {\n      (this as any).signIn = credProvider.signIn.bind(credProvider);\n      if (typeof credProvider.signUp === 'function') {\n        (this as any).signUp = credProvider.signUp.bind(credProvider);\n      }\n      if (typeof credProvider.requestPasswordReset === 'function') {\n        (this as any).requestPasswordReset = credProvider.requestPasswordReset.bind(credProvider);\n      }\n      if (typeof credProvider.resetPassword === 'function') {\n        (this as any).resetPassword = credProvider.resetPassword.bind(credProvider);\n      }\n      (this as any).isSignUpEnabled =\n        typeof credProvider.isSignUpEnabled === 'function'\n          ? credProvider.isSignUpEnabled.bind(credProvider)\n          : () => true;\n    } else {\n      (this as any).signIn = undefined;\n      (this as any).signUp = undefined;\n      (this as any).requestPasswordReset = undefined;\n      (this as any).resetPassword = undefined;\n      (this as any).isSignUpEnabled = undefined;\n    }\n  }\n\n  // Find first provider implementing an interface\n  private findProvider<T>(check: (p: unknown) => p is T): T | undefined {\n    return this.providers.find(check) as T | undefined;\n  }\n\n  private rememberAuthenticatedProvider(user: unknown, provider: MastraAuthProvider): void {\n    if (isObjectLike(user)) {\n      this.authenticatedProviderByObject.set(user, provider);\n      return;\n    }\n\n    this.authenticatedProviderByPrimitive.set(user as PrimitiveAuthUser, provider);\n  }\n\n  private takeAuthenticatedProvider(user: unknown): MastraAuthProvider | undefined {\n    if (isObjectLike(user)) {\n      const provider = this.authenticatedProviderByObject.get(user);\n      this.authenticatedProviderByObject.delete(user);\n      return provider;\n    }\n\n    const primitiveUser = user as PrimitiveAuthUser;\n    const provider = this.authenticatedProviderByPrimitive.get(primitiveUser);\n    this.authenticatedProviderByPrimitive.delete(primitiveUser);\n    return provider;\n  }\n\n  private mapAuthenticatedUserToResourceId(user: unknown): string | undefined | null {\n    const provider = this.takeAuthenticatedProvider(user);\n    return provider?.mapUserToResourceId?.(user);\n  }\n\n  // ============================================================================\n  // License Exemption Markers\n  // Expose these if any underlying provider has them\n  // ============================================================================\n\n  /**\n   * True if any provider is MastraCloudAuth (exempt from license requirement).\n   */\n  get isMastraCloudAuth(): boolean {\n    return this.providers.some(\n      p => 'isMastraCloudAuth' in p && (p as { isMastraCloudAuth: boolean }).isMastraCloudAuth === true,\n    );\n  }\n\n  /**\n   * True if any provider is SimpleAuth (exempt from license requirement).\n   */\n  get isSimpleAuth(): boolean {\n    return this.providers.some(p => 'isSimpleAuth' in p && (p as { isSimpleAuth: boolean }).isSimpleAuth === true);\n  }\n\n  // ============================================================================\n  // MastraAuthProvider Implementation\n  // ============================================================================\n\n  async authenticateToken(token: string, request: MastraAuthRequest): Promise<unknown | null> {\n    for (const provider of this.providers) {\n      try {\n        const user = await provider.authenticateToken(token, request);\n        if (user) {\n          this.rememberAuthenticatedProvider(user, provider);\n          return user;\n        }\n      } catch {\n        // ignore error, try next provider\n      }\n    }\n    return null;\n  }\n\n  async authorizeUser(user: unknown, request: MastraAuthRequest): Promise<boolean> {\n    for (const provider of this.providers) {\n      const authorized = await provider.authorizeUser(user, request);\n      if (authorized) {\n        return true;\n      }\n    }\n    return false;\n  }\n\n  // ============================================================================\n  // ISSOProvider Implementation\n  // ============================================================================\n\n  /**\n   * Forward cookie header to SSO provider for PKCE validation.\n   * Called by auth handler before handleCallback().\n   */\n  setCallbackCookieHeader(cookieHeader: string | null): void {\n    const sso = this.findProvider(isSSOProvider);\n    if (sso && typeof (sso as any).setCallbackCookieHeader === 'function') {\n      (sso as any).setCallbackCookieHeader(cookieHeader);\n    }\n  }\n\n  getLoginUrl(redirectUri: string, state: string): string | Promise<string> {\n    const sso = this.findProvider(isSSOProvider);\n    if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n    return sso.getLoginUrl(redirectUri, state);\n  }\n\n  getLoginCookies(redirectUri: string, state: string): string[] | undefined {\n    const sso = this.findProvider(isSSOProvider);\n    return sso?.getLoginCookies?.(redirectUri, state);\n  }\n\n  async handleCallback(code: string, state: string): Promise<SSOCallbackResult<User>> {\n    const sso = this.findProvider(isSSOProvider);\n    if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n    return sso.handleCallback(code, state) as Promise<SSOCallbackResult<User>>;\n  }\n\n  getLoginButtonConfig(): SSOLoginConfig {\n    const sso = this.findProvider(isSSOProvider);\n    if (!sso) return { provider: 'unknown', text: 'Sign in' };\n    return sso.getLoginButtonConfig();\n  }\n\n  async getLogoutUrl(redirectUri: string, request?: Request): Promise<string | null> {\n    // Try each SSO provider until one returns a logout URL\n    for (const provider of this.providers) {\n      if (isSSOProvider(provider) && provider.getLogoutUrl) {\n        try {\n          const url = await provider.getLogoutUrl(redirectUri, request);\n          if (url) return url;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  // ============================================================================\n  // ISessionProvider Implementation\n  // ============================================================================\n\n  async createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session> {\n    const session = this.findProvider(isSessionProvider);\n    if (!session) throw new Error('No session provider configured in CompositeAuth');\n    return session.createSession(userId, metadata);\n  }\n\n  async validateSession(sessionId: string): Promise<Session | null> {\n    // Try each session provider until one validates\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const session = await provider.validateSession(sessionId);\n          if (session) return session;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  async destroySession(sessionId: string): Promise<void> {\n    // Destroy session on ALL providers (user may have sessions in multiple stores)\n    const destroyPromises: Promise<void>[] = [];\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        destroyPromises.push(\n          provider.destroySession(sessionId).catch(() => {\n            // Ignore errors, session may not exist in this provider\n          }),\n        );\n      }\n    }\n    await Promise.all(destroyPromises);\n  }\n\n  async refreshSession(sessionId: string): Promise<Session | null> {\n    // Try each session provider until one refreshes\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const session = await provider.refreshSession(sessionId);\n          if (session) return session;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  getSessionIdFromRequest(request: Request): string | null {\n    // Try each session provider until one finds a session ID\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const sessionId = provider.getSessionIdFromRequest(request);\n          if (sessionId) return sessionId;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  getSessionHeaders(session: Session): Record<string, string> {\n    // Intentionally uses only the first session provider: a session is created by one\n    // provider, so we only set its cookie. clearSession clears ALL providers to ensure\n    // no stale cookies remain.\n    const sessionProvider = this.findProvider(isSessionProvider);\n    return sessionProvider?.getSessionHeaders(session) ?? {};\n  }\n\n  getClearSessionHeaders(): Record<string, string> {\n    // Merge clear headers from ALL providers to ensure no stale session cookies remain\n    const headers: Record<string, string> = {};\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const providerHeaders = provider.getClearSessionHeaders();\n          Object.assign(headers, providerHeaders);\n        } catch {\n          // Ignore errors\n        }\n      }\n    }\n    return headers;\n  }\n\n  // ============================================================================\n  // IUserProvider Implementation\n  // Try each provider until one returns a user (like authenticateToken)\n  // ============================================================================\n\n  async getCurrentUser(request: Request): Promise<User | null> {\n    for (const provider of this.providers) {\n      if (isUserProvider(provider)) {\n        try {\n          const user = await provider.getCurrentUser(request);\n          if (user) return user;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  async getUser(userId: string): Promise<User | null> {\n    for (const provider of this.providers) {\n      if (isUserProvider(provider)) {\n        try {\n          const user = await provider.getUser(userId);\n          if (user) return user;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  async getUsers(userIds: string[]): Promise<Array<User | null>> {\n    return Promise.all(userIds.map(userId => this.getUser(userId)));\n  }\n}\n\nconst DEFAULT_HEADERS = ['Authorization', 'X-Playground-Access'];\n\ntype TokenToUser<TUser> = Record<string, TUser>;\n\nexport interface SimpleAuthOptions<TUser> extends MastraAuthProviderOptions<TUser> {\n  /**\n   * Valid tokens to authenticate against\n   */\n  tokens: TokenToUser<TUser>;\n  /**\n   * Headers to check for authentication\n   * @default ['Authorization', 'X-Playground-Access']\n   */\n  headers?: string | string[];\n}\n\nexport class SimpleAuth<TUser> extends MastraAuthProvider<TUser> {\n  /**\n   * Marker to exempt SimpleAuth from EE license requirement.\n   * SimpleAuth is for development/testing and should work without a license.\n   */\n  readonly isSimpleAuth = true;\n\n  private tokens: TokenToUser<TUser>;\n  private headers: string[];\n  private users: TUser[];\n  private userById: Map<string, TUser>;\n\n  constructor(options: SimpleAuthOptions<TUser>) {\n    super(options);\n    this.tokens = options.tokens;\n    this.users = Object.values(this.tokens);\n    this.headers = [...DEFAULT_HEADERS].concat(options.headers || []);\n    this.userById = new Map(this.users.map(u => [String((u as any)?.id), u]));\n  }\n\n  async authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null> {\n    const requestTokens = this.getTokensFromHeaders(token, request);\n\n    for (const requestToken of requestTokens) {\n      const tokenToUser = this.tokens[requestToken];\n      if (tokenToUser) {\n        return tokenToUser;\n      }\n    }\n\n    return this.getUserFromCookie(getRequestHeader(request, 'Cookie'));\n  }\n\n  async authorizeUser(user: TUser, _request: MastraAuthRequest): Promise<boolean> {\n    return this.users.includes(user);\n  }\n\n  /** Get current user from request headers or cookie. */\n  async getCurrentUser(request: Request): Promise<TUser | null> {\n    // Check headers first\n    for (const headerName of this.headers) {\n      const headerValue = request.headers.get(headerName);\n      if (headerValue) {\n        const token = this.stripBearerPrefix(headerValue);\n        const user = this.tokens[token];\n        if (user) {\n          return user;\n        }\n      }\n    }\n\n    return this.getUserFromCookie(request.headers.get('Cookie'));\n  }\n\n  private getUserFromCookie(cookieHeader: string | null | undefined): TUser | null {\n    if (!cookieHeader) return null;\n\n    const cookies = cookieHeader.split(';').map(c => c.trim());\n    for (const cookie of cookies) {\n      if (cookie.startsWith('mastra-token=')) {\n        const token = cookie.slice('mastra-token='.length);\n        const user = this.tokens[token];\n        if (user) {\n          return user;\n        }\n      }\n    }\n    return null;\n  }\n\n  /** Get user by ID. */\n  async getUser(userId: string): Promise<TUser | null> {\n    return this.userById.get(userId) ?? null;\n  }\n\n  async getUsers(userIds: string[]): Promise<Array<TUser | null>> {\n    return userIds.map(userId => this.userById.get(userId) ?? null);\n  }\n\n  /**\n   * Sign in with token (passed as password field).\n   * The email field is ignored - only the token matters.\n   */\n  async signIn(_email: string, password: string, _request: Request): Promise<CredentialsResult<TUser>> {\n    const token = password;\n    const user = this.tokens[token];\n\n    if (!user) {\n      throw new Error('Invalid token');\n    }\n\n    // Set cookie so the token persists across requests\n    const cookie = `mastra-token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`;\n\n    return {\n      user,\n      token,\n      cookies: [cookie],\n    };\n  }\n\n  async signUp(): Promise<CredentialsResult<TUser>> {\n    throw new Error('Sign up is not supported with SimpleAuth. Use pre-configured tokens.');\n  }\n\n  isSignUpEnabled(): boolean {\n    return false;\n  }\n\n  /**\n   * Get headers to clear the session cookie on logout.\n   * Partial ISessionProvider implementation for logout support.\n   */\n  getClearSessionHeaders(): Record<string, string> {\n    return {\n      'Set-Cookie': 'mastra-token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n    };\n  }\n\n  private stripBearerPrefix(token: string): string {\n    return token.startsWith('Bearer ') ? token.slice(7) : token;\n  }\n\n  private getTokensFromHeaders(token: string, request: MastraAuthRequest): string[] {\n    const tokens = [token];\n    for (const headerName of this.headers) {\n      const headerValue = getRequestHeader(request, headerName);\n      if (headerValue) {\n        tokens.push(this.stripBearerPrefix(headerValue));\n      }\n    }\n    return tokens;\n  }\n}\n","import { createClerkClient } from '@clerk/backend';\nimport type { ClerkClient } from '@clerk/backend';\nimport type {\n  ISSOProvider,\n  ISessionProvider,\n  IUserProvider,\n  Session,\n  SSOCallbackResult,\n  SSOLoginConfig,\n} from '@internal/auth';\nimport type { EEUser } from '@internal/auth/ee';\nimport type { MastraAuthProviderOptions } from '@internal/auth/provider';\nimport { MastraAuthProvider } from '@internal/auth/provider';\nimport { verifyJwks } from '@mastra/auth';\nimport type { JwtPayload } from '@mastra/auth';\n\ntype ClerkUser = JwtPayload;\n\n/** Default cookie name for Clerk SSO sessions */\nconst DEFAULT_COOKIE_NAME = 'clerk_session';\n\n/** Default cookie max age (24 hours) */\nconst DEFAULT_COOKIE_MAX_AGE = 86400;\n\n/** Default OAuth scopes */\nconst DEFAULT_SCOPES = ['openid', 'profile', 'email'];\n\n/** PBKDF2 salt length in bytes */\nconst SALT_LENGTH = 16;\n\n/** AES-GCM IV length in bytes */\nconst IV_LENGTH = 12;\n\n/**\n * Derive an AES-GCM key from password + salt using PBKDF2.\n */\nasync function deriveKey(password: string, salt: Uint8Array, usage: 'encrypt' | 'decrypt') {\n  const encoder = new TextEncoder();\n  const keyMaterial = await crypto.subtle.importKey('raw', encoder.encode(password), 'PBKDF2', false, [\n    'deriveBits',\n    'deriveKey',\n  ]);\n  return crypto.subtle.deriveKey(\n    { name: 'PBKDF2', salt, iterations: 100000, hash: 'SHA-256' },\n    keyMaterial,\n    { name: 'AES-GCM', length: 256 },\n    false,\n    [usage],\n  );\n}\n\n/**\n * Encrypt session data for cookie storage.\n * Format: base64(salt || iv || ciphertext)\n */\nasync function encryptSession(data: unknown, password: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const salt = crypto.getRandomValues(new Uint8Array(SALT_LENGTH));\n  const key = await deriveKey(password, salt, 'encrypt');\n  const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));\n  const encrypted = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, encoder.encode(JSON.stringify(data)));\n  const combined = new Uint8Array(salt.length + iv.length + new Uint8Array(encrypted).length);\n  combined.set(salt);\n  combined.set(iv, salt.length);\n  combined.set(new Uint8Array(encrypted), salt.length + iv.length);\n  return btoa(String.fromCharCode(...combined));\n}\n\n/**\n * Decrypt session data from cookie.\n */\nasync function decryptSession(encrypted: string, password: string): Promise<unknown> {\n  const combined = Uint8Array.from(atob(encrypted), c => c.charCodeAt(0));\n  const salt = combined.slice(0, SALT_LENGTH);\n  const iv = combined.slice(SALT_LENGTH, SALT_LENGTH + IV_LENGTH);\n  const data = combined.slice(SALT_LENGTH + IV_LENGTH);\n  const key = await deriveKey(password, salt, 'decrypt');\n  const decrypted = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, data);\n  return JSON.parse(new TextDecoder().decode(decrypted));\n}\n\n/** OAuth state token expiry (10 minutes) */\nconst STATE_TOKEN_EXPIRY_MS = 10 * 60 * 1000;\n\ninterface StatePayload {\n  /** Original state from caller */\n  s: string;\n  /** Redirect URI */\n  r: string;\n  /** Expiry timestamp */\n  e: number;\n}\n\n/**\n * Sign data using HMAC-SHA256 (Web Crypto API).\n * Returns base64url-encoded signature.\n */\nasync function hmacSign(data: string, secret: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const keyData = encoder.encode(secret);\n  const dataBytes = encoder.encode(data);\n\n  // Import the secret key for HMAC-SHA256\n  const cryptoKey = await crypto.subtle.importKey('raw', keyData, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);\n\n  // Sign the data\n  const signature = await crypto.subtle.sign('HMAC', cryptoKey, dataBytes);\n\n  // Convert to base64url\n  const sigBytes = new Uint8Array(signature);\n  return btoa(String.fromCharCode(...sigBytes))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '');\n}\n\n/**\n * Timing-safe string comparison.\n */\nfunction timingSafeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false;\n  let result = 0;\n  for (let i = 0; i < a.length; i++) {\n    result |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return result === 0;\n}\n\n/**\n * Create a signed state token for OAuth CSRF protection (stateless).\n * Format: base64(payload).base64url(signature)\n */\nasync function createStateToken(originalState: string, redirectUri: string, secret: string): Promise<string> {\n  const payload: StatePayload = {\n    s: originalState,\n    r: redirectUri,\n    e: Date.now() + STATE_TOKEN_EXPIRY_MS,\n  };\n  const payloadB64 = btoa(JSON.stringify(payload));\n  const signature = await hmacSign(payloadB64, secret);\n  return `${payloadB64}.${signature}`;\n}\n\n/**\n * Verify and decode a state token.\n * Returns the original state and redirectUri if valid and not expired.\n */\nasync function verifyStateToken(\n  stateToken: string,\n  secret: string,\n): Promise<{ originalState: string; redirectUri: string }> {\n  const parts = stateToken.split('.');\n  if (parts.length !== 2) {\n    throw new Error('Invalid state token format');\n  }\n\n  const [payloadB64, signature] = parts;\n  const expectedSig = await hmacSign(payloadB64!, secret);\n  if (!timingSafeEqual(signature!, expectedSig)) {\n    throw new Error('Invalid state token signature');\n  }\n\n  const payload = JSON.parse(atob(payloadB64!)) as StatePayload;\n  if (payload.e < Date.now()) {\n    throw new Error('State token has expired');\n  }\n\n  return { originalState: payload.s, redirectUri: payload.r };\n}\n\n/**\n * Escape special regex characters in a string.\n */\nfunction escapeRegex(str: string): string {\n  return str.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\n/**\n * Derive the Frontend API (FAPI) URL from a Clerk publishable key.\n * The publishable key is: prefix + base64(fapiDomain + \"$\")\n */\nfunction deriveFapiUrl(publishableKey: string): string {\n  const withoutPrefix = publishableKey.replace(/^pk_(test|live)_/, '');\n  const decoded = atob(withoutPrefix);\n  const domain = decoded.replace(/\\$$/, '');\n  return `https://${domain}`;\n}\n\ninterface MastraAuthClerkSessionOptions {\n  /** Cookie name for the session (default: 'clerk_session') */\n  cookieName?: string;\n  /** Cookie max age in seconds (default: 86400 = 24 hours) */\n  cookieMaxAge?: number;\n  /** Cookie encryption password (min 32 chars). Falls back to CLERK_COOKIE_PASSWORD env var */\n  cookiePassword?: string;\n  /** Use Secure flag on cookies (default: true in production) */\n  secureCookies?: boolean;\n}\n\ninterface MastraAuthClerkOptions extends MastraAuthProviderOptions<ClerkUser> {\n  jwksUri?: string;\n  secretKey?: string;\n  publishableKey?: string;\n  /**\n   * OAuth Client ID for Clerk as IdP (SSO).\n   * Create an OAuth Application in the Clerk Dashboard to get this.\n   * Falls back to CLERK_OAUTH_CLIENT_ID env var.\n   */\n  oauthClientId?: string;\n  /**\n   * OAuth Client Secret for Clerk as IdP (SSO).\n   * Falls back to CLERK_OAUTH_CLIENT_SECRET env var.\n   */\n  oauthClientSecret?: string;\n  /**\n   * OAuth redirect URI for the SSO callback.\n   * Falls back to CLERK_OAUTH_REDIRECT_URI env var.\n   * Typically: http://localhost:4111/api/auth/sso/callback\n   */\n  redirectUri?: string;\n  /**\n   * OAuth scopes to request (default: ['openid', 'profile', 'email'])\n   */\n  scopes?: string[];\n  /**\n   * Session configuration for SSO cookie management.\n   */\n  session?: MastraAuthClerkSessionOptions;\n}\n\n/**\n * Clerk authentication provider for Mastra.\n *\n * Always implements IUserProvider for JWT-based user detection.\n *\n * When OAuth credentials are configured (oauthClientId + oauthClientSecret),\n * also dynamically adds ISSOProvider + ISessionProvider methods for Studio login\n * using Clerk as an OAuth 2.0 / OIDC Identity Provider.\n *\n * @example Basic usage (IUserProvider only — validates JWTs)\n * ```typescript\n * const auth = new MastraAuthClerk({\n *   jwksUri: 'https://your-app.clerk.accounts.dev/.well-known/jwks.json',\n *   secretKey: 'sk_test_...',\n *   publishableKey: 'pk_test_...',\n * });\n * ```\n *\n * @example With SSO for Studio login\n * ```typescript\n * const auth = new MastraAuthClerk({\n *   jwksUri: 'https://your-app.clerk.accounts.dev/.well-known/jwks.json',\n *   secretKey: 'sk_test_...',\n *   publishableKey: 'pk_test_...',\n *   oauthClientId: 'your-oauth-client-id',\n *   oauthClientSecret: 'your-oauth-client-secret',\n * });\n * ```\n */\nexport class MastraAuthClerk extends MastraAuthProvider<ClerkUser> implements IUserProvider<EEUser> {\n  protected clerk: ClerkClient;\n  protected jwksUri: string;\n  protected publishableKey: string;\n  protected fapiUrl: string;\n\n  // SSO fields\n  private oauthClientId: string | null;\n  private oauthClientSecret: string | null;\n  private _redirectUri: string | null;\n  private scopes: string[];\n  private cookieName: string;\n  private cookieMaxAge: number;\n  private cookiePassword: string;\n  private secureCookies: boolean;\n  private ssoEnabled: boolean;\n\n  constructor(options?: MastraAuthClerkOptions) {\n    super({ name: options?.name ?? 'clerk' });\n\n    const jwksUri = options?.jwksUri ?? process.env.CLERK_JWKS_URI;\n    const secretKey = options?.secretKey ?? process.env.CLERK_SECRET_KEY;\n    const publishableKey = options?.publishableKey ?? process.env.CLERK_PUBLISHABLE_KEY;\n\n    if (!jwksUri || !secretKey || !publishableKey) {\n      throw new Error(\n        'Clerk JWKS URI, secret key and publishable key are required, please provide them in the options or set the environment variables CLERK_JWKS_URI, CLERK_SECRET_KEY and CLERK_PUBLISHABLE_KEY',\n      );\n    }\n\n    this.jwksUri = jwksUri;\n    this.publishableKey = publishableKey;\n    this.fapiUrl = deriveFapiUrl(publishableKey);\n    this.clerk = createClerkClient({\n      secretKey,\n      publishableKey,\n    });\n\n    // SSO configuration (optional — enables Studio login)\n    const oauthClientId = options?.oauthClientId ?? process.env.CLERK_OAUTH_CLIENT_ID;\n    const oauthClientSecret = options?.oauthClientSecret ?? process.env.CLERK_OAUTH_CLIENT_SECRET;\n    const redirectUri = options?.redirectUri ?? process.env.CLERK_OAUTH_REDIRECT_URI;\n    const cookiePassword =\n      options?.session?.cookiePassword ??\n      process.env.CLERK_COOKIE_PASSWORD ??\n      crypto.randomUUID() + crypto.randomUUID();\n\n    this.oauthClientId = oauthClientId ?? null;\n    this.oauthClientSecret = oauthClientSecret ?? null;\n    this._redirectUri = redirectUri ?? null;\n    this.scopes = options?.scopes ?? DEFAULT_SCOPES;\n    this.cookieName = options?.session?.cookieName ?? DEFAULT_COOKIE_NAME;\n    this.cookieMaxAge = options?.session?.cookieMaxAge ?? DEFAULT_COOKIE_MAX_AGE;\n    this.cookiePassword = cookiePassword;\n    this.secureCookies = options?.session?.secureCookies ?? process.env.NODE_ENV === 'production';\n\n    // SSO is enabled when OAuth credentials are configured\n    this.ssoEnabled = !!(oauthClientId && oauthClientSecret);\n\n    if (this.ssoEnabled) {\n      if (cookiePassword.length < 32) {\n        throw new Error(\n          'Cookie password must be at least 32 characters for SSO. Set CLERK_COOKIE_PASSWORD environment variable.',\n        );\n      }\n\n      if (!options?.session?.cookiePassword && !process.env.CLERK_COOKIE_PASSWORD) {\n        console.warn(\n          '[MastraAuthClerk] No cookie password set — using auto-generated value. Sessions will not survive restarts. Set CLERK_COOKIE_PASSWORD for production use.',\n        );\n      }\n\n      // Dynamically add ISSOProvider + ISessionProvider methods\n      // so that duck-typing detection (implementsInterface) only finds them when SSO is configured\n      this._attachSSOProvider();\n      this._attachSessionProvider();\n    }\n\n    this.registerOptions(options);\n  }\n\n  // ============================================================================\n  // MastraAuthProvider Implementation\n  // ============================================================================\n\n  async authenticateToken(\n    token: string,\n    request?: Request | { header(name: string): string | undefined },\n  ): Promise<ClerkUser | null> {\n    // When SSO is enabled, try the encrypted session cookie first (like Okta pattern).\n    // The auth middleware may call this with an empty token for browser requests\n    // that only carry a session cookie.\n    if (this.ssoEnabled && request) {\n      const sessionUser = await this.getUserFromSessionCookie(request as Request);\n      if (sessionUser) return sessionUser as unknown as ClerkUser;\n    }\n\n    // Fall back to JWT verification from Authorization header\n    if (!token || typeof token !== 'string') {\n      return null;\n    }\n\n    try {\n      const user = await verifyJwks(token, this.jwksUri);\n      return user;\n    } catch {\n      return null;\n    }\n  }\n\n  async authorizeUser(user: ClerkUser) {\n    // Session cookie users have `id`, JWT users have `sub`\n    return !!(user.sub || (user as unknown as EEUser).id);\n  }\n\n  // ============================================================================\n  // IUserProvider Implementation\n  // ============================================================================\n\n  /**\n   * Extract the bearer token from the request's Authorization header or __session cookie.\n   */\n  private extractToken(request: Request): string | null {\n    const authHeader = request.headers.get('Authorization');\n    if (authHeader) {\n      const token = authHeader.replace(/^Bearer\\s+/i, '').trim();\n      if (token) return token;\n    }\n\n    const cookie = request.headers.get('Cookie');\n    if (cookie) {\n      // Clerk's default session cookie is __session\n      const match = cookie.match(/__session=([^;]+)/);\n      if (match?.[1]) return match[1];\n    }\n\n    return null;\n  }\n\n  async getCurrentUser(request: Request): Promise<EEUser | null> {\n    // First try to get user from our SSO session cookie\n    if (this.ssoEnabled) {\n      const sessionUser = await this.getUserFromSessionCookie(request);\n      if (sessionUser) return sessionUser;\n    }\n\n    // Fall back to token-based auth (Authorization header or __session cookie)\n    const token = this.extractToken(request);\n    if (!token) return null;\n\n    try {\n      const payload = await this.authenticateToken(token);\n      if (!payload?.sub) return null;\n\n      // Try to fetch full user details from Clerk API\n      try {\n        const clerkUser = await this.clerk.users.getUser(payload.sub);\n        return {\n          id: clerkUser.id,\n          email: clerkUser.emailAddresses?.[0]?.emailAddress,\n          name: [clerkUser.firstName, clerkUser.lastName].filter(Boolean).join(' ') || undefined,\n          avatarUrl: clerkUser.imageUrl,\n          metadata: clerkUser.publicMetadata as Record<string, unknown> | undefined,\n        };\n      } catch {\n        // Fall back to JWT claims if Clerk API call fails\n        return {\n          id: payload.sub,\n          email: (payload.email as string) ?? undefined,\n          name: (payload.name as string) ?? undefined,\n        };\n      }\n    } catch {\n      return null;\n    }\n  }\n\n  async getUser(userId: string): Promise<EEUser | null> {\n    try {\n      const clerkUser = await this.clerk.users.getUser(userId);\n      return {\n        id: clerkUser.id,\n        email: clerkUser.emailAddresses?.[0]?.emailAddress,\n        name: [clerkUser.firstName, clerkUser.lastName].filter(Boolean).join(' ') || undefined,\n        avatarUrl: clerkUser.imageUrl,\n        metadata: clerkUser.publicMetadata as Record<string, unknown> | undefined,\n      };\n    } catch {\n      return null;\n    }\n  }\n\n  getUserProfileUrl(user: EEUser): string {\n    return `/user/${user.id}`;\n  }\n\n  // ============================================================================\n  // Helper Methods\n  // ============================================================================\n\n  /**\n   * Check if SSO is enabled (OAuth credentials are configured).\n   */\n  isSSOEnabled(): boolean {\n    return this.ssoEnabled;\n  }\n\n  /**\n   * Get the derived Frontend API URL.\n   */\n  getFapiUrl(): string {\n    return this.fapiUrl;\n  }\n\n  /**\n   * Build consistent cookie attribute string for set/clear operations.\n   */\n  private cookieFlags(maxAge: number): string {\n    const flags = `Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAge}`;\n    return this.secureCookies ? `${flags}; Secure` : flags;\n  }\n\n  /**\n   * Extract user from the encrypted SSO session cookie.\n   */\n  private async getUserFromSessionCookie(\n    request: Request | { header(name: string): string | undefined },\n  ): Promise<EEUser | null> {\n    // Handle both standard Request and HonoRequest (.header() vs .headers.get())\n    const cookie =\n      'header' in request && typeof (request as any).header === 'function'\n        ? (request as any).header('cookie')\n        : (request as Request).headers?.get('cookie');\n    if (!cookie) return null;\n\n    const match = cookie.match(new RegExp(`(?:^|;\\\\s*)${escapeRegex(this.cookieName)}=([^;]+)`));\n    if (!match?.[1]) return null;\n\n    try {\n      const sessionData = (await decryptSession(decodeURIComponent(match[1]), this.cookiePassword)) as {\n        user: EEUser;\n        expiresAt: number;\n      };\n\n      if (sessionData.expiresAt < Date.now()) {\n        return null; // Session expired\n      }\n\n      return sessionData.user;\n    } catch {\n      return null; // Invalid/corrupt cookie\n    }\n  }\n\n  // ============================================================================\n  // Dynamic ISSOProvider attachment (only when OAuth is configured)\n  // ============================================================================\n\n  /**\n   * Dynamically attach ISSOProvider methods to this instance.\n   * This ensures duck-typing detection only finds these methods when SSO is configured.\n   */\n  private _attachSSOProvider() {\n    const self = this;\n\n    (this as unknown as ISSOProvider<EEUser>).getLoginUrl = async function (\n      redirectUri: string,\n      state: string,\n    ): Promise<string> {\n      // Create signed state token containing redirectUri and expiry\n      // This is stateless — works in serverless and load-balanced environments\n      const actualRedirectUri = redirectUri ?? self._redirectUri;\n      if (!actualRedirectUri) {\n        throw new Error('Redirect URI is required for SSO login');\n      }\n\n      const signedState = await createStateToken(state, actualRedirectUri, self.cookiePassword);\n\n      const params = new URLSearchParams({\n        client_id: self.oauthClientId!,\n        response_type: 'code',\n        scope: self.scopes.join(' '),\n        redirect_uri: actualRedirectUri,\n        state: signedState,\n      });\n\n      return `${self.fapiUrl}/oauth/authorize?${params.toString()}`;\n    };\n\n    (this as unknown as ISSOProvider<EEUser>).handleCallback = async function (\n      code: string,\n      stateToken: string,\n    ): Promise<SSOCallbackResult<EEUser>> {\n      // Verify and decode the signed state token (throws if invalid/expired)\n      const { redirectUri } = await verifyStateToken(stateToken, self.cookiePassword);\n\n      // Exchange code for tokens using client_secret (confidential client)\n      const tokenResponse = await fetch(`${self.fapiUrl}/oauth/token`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n          Authorization: `Basic ${btoa(`${self.oauthClientId}:${self.oauthClientSecret}`)}`,\n        },\n        body: new URLSearchParams({\n          grant_type: 'authorization_code',\n          code,\n          redirect_uri: redirectUri,\n        }),\n        signal: AbortSignal.timeout(10_000), // 10 second timeout\n      });\n\n      if (!tokenResponse.ok) {\n        const error = await tokenResponse.text();\n        throw new Error(`Token exchange failed: ${error}`);\n      }\n\n      const tokens = (await tokenResponse.json()) as {\n        access_token: string;\n        id_token?: string;\n        refresh_token?: string;\n        expires_in: number;\n        token_type: string;\n      };\n\n      // Get user info — try ID token first, fall back to userinfo endpoint\n      let user: EEUser;\n      if (tokens.id_token) {\n        const payload = await verifyJwks(tokens.id_token, self.jwksUri);\n        user = {\n          id: payload.sub!,\n          email: (payload.email as string) ?? undefined,\n          name: (payload.name as string) ?? undefined,\n          avatarUrl: (payload.picture as string) ?? undefined,\n        };\n      } else {\n        const userInfoResponse = await fetch(`${self.fapiUrl}/oauth/userinfo`, {\n          headers: { Authorization: `Bearer ${tokens.access_token}` },\n          signal: AbortSignal.timeout(10_000), // 10 second timeout\n        });\n\n        if (!userInfoResponse.ok) {\n          throw new Error('Failed to fetch user info from Clerk');\n        }\n\n        const userInfo = (await userInfoResponse.json()) as {\n          sub: string;\n          email?: string;\n          name?: string;\n          picture?: string;\n        };\n        user = {\n          id: userInfo.sub,\n          email: userInfo.email,\n          name: userInfo.name,\n          avatarUrl: userInfo.picture,\n        };\n      }\n\n      // Try to enrich user with full Clerk data\n      try {\n        const fullUser = await self.getUser(user.id);\n        if (fullUser) {\n          user = fullUser;\n        }\n      } catch {\n        // Use the user info we already have\n      }\n\n      // Create encrypted session cookie\n      const sessionData = {\n        user,\n        expiresAt: Date.now() + self.cookieMaxAge * 1000,\n      };\n\n      const encryptedSession = await encryptSession(sessionData, self.cookiePassword);\n      const cookieValue = `${self.cookieName}=${encodeURIComponent(encryptedSession)}; ${self.cookieFlags(self.cookieMaxAge)}`;\n\n      return {\n        user,\n        tokens: {\n          accessToken: tokens.access_token,\n          refreshToken: tokens.refresh_token,\n          idToken: tokens.id_token,\n          expiresAt: new Date(Date.now() + tokens.expires_in * 1000),\n        },\n        cookies: [cookieValue],\n      };\n    };\n\n    (this as unknown as ISSOProvider<EEUser>).getLoginButtonConfig = function (): SSOLoginConfig {\n      return {\n        provider: 'clerk',\n        text: 'Sign in with Clerk',\n        description: 'Sign in using your Clerk account',\n      };\n    };\n\n    (this as unknown as ISSOProvider<EEUser>).getLoginCookies = function (_state: string): string[] {\n      return [];\n    };\n\n    (this as unknown as ISSOProvider<EEUser>).getLogoutUrl = async function (\n      _redirectUri: string,\n      _request?: Request,\n    ): Promise<string | null> {\n      return null;\n    };\n  }\n\n  // ============================================================================\n  // Dynamic ISessionProvider attachment (only when OAuth is configured)\n  // ============================================================================\n\n  /**\n   * Dynamically attach ISessionProvider methods to this instance.\n   */\n  private _attachSessionProvider() {\n    const self = this;\n\n    (this as unknown as ISessionProvider<Session>).createSession = async function (\n      userId: string,\n      metadata?: Record<string, unknown>,\n    ): Promise<Session> {\n      const now = new Date();\n      return {\n        id: crypto.randomUUID(),\n        userId,\n        createdAt: now,\n        expiresAt: new Date(now.getTime() + self.cookieMaxAge * 1000),\n        metadata,\n      };\n    };\n\n    // Cookie-only sessions — validation happens via decryption in getUserFromSessionCookie/authenticateToken\n    (this as unknown as ISessionProvider<Session>).validateSession = async function (\n      _sessionId: string,\n    ): Promise<Session | null> {\n      return null;\n    };\n\n    // Cookie-only sessions — destruction happens via getClearSessionHeaders setting Max-Age=0\n    (this as unknown as ISessionProvider<Session>).destroySession = async function (\n      _sessionId: string,\n    ): Promise<void> {};\n\n    // Cookie-only sessions — refresh not supported; user must re-authenticate after expiry\n    (this as unknown as ISessionProvider<Session>).refreshSession = async function (\n      _sessionId: string,\n    ): Promise<Session | null> {\n      return null;\n    };\n\n    (this as unknown as ISessionProvider<Session>).getSessionIdFromRequest = function (\n      request: Request,\n    ): string | null {\n      const cookie = request.headers.get('Cookie');\n      if (!cookie) return null;\n      const match = cookie.match(new RegExp(`(?:^|;\\\\s*)${escapeRegex(self.cookieName)}=([^;]+)`));\n      return match?.[1] ? decodeURIComponent(match[1]) : null;\n    };\n\n    (this as unknown as ISessionProvider<Session>).getSessionHeaders = function (\n      _session: Session,\n    ): Record<string, string> {\n      return {};\n    };\n\n    (this as unknown as ISessionProvider<Session>).getClearSessionHeaders = function (): Record<string, string> {\n      return {\n        'Set-Cookie': `${self.cookieName}=; ${self.cookieFlags(0)}`,\n      };\n    };\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mastra/auth-clerk",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Mastra Clerk Auth integration",
   "type": "module",
   "main": "dist/index.js",
@@ -21,10 +21,7 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@clerk/backend": "^1.34.0",
-    "@mastra/auth": "1.1.0"
-  },
-  "peerDependencies": {
-    "@mastra/core": ">=1.32.0-0 <2.0.0-0"
+    "@mastra/auth": "1.1.1"
   },
   "devDependencies": {
     "@types/node": "22.19.21",
@@ -34,9 +31,9 @@
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
     "vitest": "4.1.8",
-    "@internal/lint": "0.0.107",
-    "@internal/types-builder": "0.0.82",
-    "@mastra/core": "1.45.0"
+    "@internal/lint": "0.0.109",
+    "@internal/types-builder": "0.0.84",
+    "@internal/auth": "0.0.1"
   },
   "files": [
     "dist",

package/LICENSE.md

@@ -1,30 +0,0 @@
-Portions of this software are licensed as follows:
-
-- All content that resides under any directory named "ee/" within this
-  repository, including but not limited to:
-  - `packages/core/src/auth/ee/`
-  - `packages/server/src/server/auth/ee/`
-    is licensed under the license defined in `ee/LICENSE`.
-
-- All third-party components incorporated into the Mastra Software are
-  licensed under the original license provided by the owner of the
-  applicable component.
-
-- Content outside of the above-mentioned directories or restrictions is
-  available under the "Apache License 2.0" as defined below.
-
-# Apache License 2.0
-
-Copyright (c) 2025 Kepler Software, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.