@nestjs-kit/better-auth 2.0.0 → 2.1.2

package/README.md

@@ -29,7 +29,7 @@ It supersedes the deprecated `nestjs-slightly-better-auth`; [Migrate from `nestj
 pnpm add @nestjs-kit/better-auth better-auth
 ```
 
-Peer dependencies: `@nestjs/common` and `@nestjs/core` 12, `better-auth` 1.7.5 or newer (below 2), `reflect-metadata` and `rxjs`. The package requires Node.js 24.11 or newer (`engines.node` is `>=24.11.0`). Install the Nest platform adapter your application uses, `@nestjs/platform-express` or `@nestjs/platform-fastify`; the `./express` and `./fastify` entries import neither at runtime.
+Peer dependencies: `@nestjs/common` and `@nestjs/core` 12, `better-auth` 1.7.7 or newer (below 2), `reflect-metadata` and `rxjs`. The package requires Node.js 24.11 or newer (`engines.node` is `>=24.11.0`). Install the Nest platform adapter your application uses, `@nestjs/platform-express` or `@nestjs/platform-fastify`; the `./express` and `./fastify` entries import neither at runtime.
 
 The `./testing` and `./testing/conformance` entries also need the optional peer `@nestjs/testing` 12; the root entry never loads it or a test runner. API keys use Better Auth's `@better-auth/api-key` plugin, which the application installs and registers itself (`pnpm add @better-auth/api-key`); the `./api-key` entry never imports it. [Compatibility](#compatibility) lists the tested versions and module systems.
 
@@ -77,13 +77,13 @@ Nest's gRPC transport uses `@grpc/grpc-js` and `@grpc/proto-loader`, Kafka uses
 | -------------------------------- | ------------------------------------------------- | -------------------------------------------------------------------------------- |
 | Node.js                          | 24.11.0 or newer                                  | 24.11.0 and the current LTS                                                      |
 | `@nestjs/common`, `@nestjs/core` | `^12.0.3`                                         | 12.0.3 and the newest 12.x release, with the matching `@nestjs/platform-express` |
-| `better-auth`                    | `>=1.7.5 <2`                                      | 1.7.5 and the newest 1.x release                                                 |
+| `better-auth`                    | `>=1.7.7 <2`                                      | 1.7.7 and the newest 1.x release                                                 |
 | TypeScript declarations          | `nodenext`, `node16` ESM and `bundler` resolution | TypeScript 5.9, the newest 6.x and 7 in each resolution mode                     |
 | Bundlers                         | esbuild, `nest build --webpack`                   | esbuild 0.28 and Nest CLI 12 with webpack 5                                      |
 
 The packaging tests pack this package, install the tarball with pnpm into temporary applications outside the workspace and run them with the peers installed at their declared floors and at the newest versions inside the peer ranges. The newest versions are those that pnpm's default minimum release age admits, so a new release enters the matrix after that delay. Each application compiles one Nest source as ESM and as CommonJS, signs up users of a default and a named Better Auth instance, calls a guarded route of each with its session cookie, checks that neither instance accepts the other's cookie, and closes. CI runs these tests on the current Node.js LTS and on Node.js 24.11.0.
 
-The declared floors are the supported floors. NestJS 11 and Better Auth releases before 1.7.5 are outside the peer ranges and are not tested.
+The declared floors are the supported floors. NestJS 11 and Better Auth releases before 1.7.7 are outside the peer ranges and are not tested.
 
 Module systems:
 
@@ -105,7 +105,7 @@ Toolchains:
 | esbuild ESM bundles with `--splitting`, esbuild CommonJS bundles, `nest build --webpack`                | Supported and tested                                |
 | TypeScript `node16` CommonJS files that import NestJS 12 or Better Auth                                 | Unsupported: their declarations are ESM only        |
 | CommonJS with `--no-experimental-require-module`                                                        | Unsupported: only `./platform` and `./fastify` load |
-| NestJS 11, Better Auth before 1.7.5                                                                     | Unsupported: outside the peer ranges                |
+| NestJS 11, Better Auth before 1.7.7                                                                     | Unsupported: outside the peer ranges                |
 | TypeScript before 5.9, the Nest CLI's rspack builder, webpack bundles of `node_modules`, other bundlers | Untested                                            |
 
 The packaging tests also inspect the packed archive. It contains only `package.json`, this README, the license and the `dist` files that the export map reaches; source maps name only this package's sources, and runtime maps embed them. Each entry exports exactly the names listed in [`fixtures/public-api.json`](fixtures/public-api.json), and no emitted file has a default export or top-level `await`.
@@ -695,7 +695,7 @@ Better Auth skips its own origin checks under `NODE_ENV=test` or a truthy `TEST`
 
 **Storage outages.** An outage never turns into a 401 or 403 where the library can tell it apart: resolution and policy failures surface as 5xx. Better Auth hides some outages itself:
 
-- With the `customSession` plugin, Better Auth catches storage errors inside `getSession`, so an outage during the guard's session read or a policy's re-read answers 401 instead of a 5xx.
+- Before Better Auth 1.7.8, the `customSession` plugin catches storage errors inside `getSession`, so an outage during the guard's session read or a policy's re-read answers 401 instead of a 5xx. Better Auth 1.7.8 and later propagate the error, and the request answers 5xx.
 - `verifyApiKey` reports storage failures as `INVALID_API_KEY`. `apiKeyPrincipal()` treats an `INVALID_API_KEY` that took longer than `outageProbe.slowMs` (default 500 ms) as an outage, and otherwise runs a probe (a read and a zero-row write on the key table, at most once per second per instance) before answering 401. Failures confined to the key's own row that return faster than `slowMs`, and keys stored only in secondary storage, still answer 401; set `slowMs` below your pool's lock and statement timeouts and above the cost of a custom key hasher. Better Auth logs `Failed to validate API key` at ERROR for every rejected key.
 - Public routes perform no principal I/O and keep working during an outage.
 
@@ -757,7 +757,7 @@ export class ViewerResolver {
 export class AppModule {}
 ```
 
-For Mercurius, use `MercuriusDriver`, `fastifyPlatform()` from `@nestjs-kit/better-auth/fastify` and `mercuriusTransport()`. `mercuriusSubscriptionContext()` returns a Mercurius `subscription.context` function that keeps the upgrade request and its original browser headers with every socket operation; the socket tests cover Mercurius with and without it. A custom GraphQL `context` must be a function that returns a fresh object for every operation and every graphql-ws connection; a function that returns a cached object is a configuration error that the transports cannot always detect. An HTTP operation whose context carries an answered request fails closed with `AUTH_MISCONFIGURED` (`GRAPHQL_CONTEXT_STALE_REQUEST`). The Apollo transport classifies an operation's graphql-ws socket once, when the operation starts. When that socket is not open, the operation reads no credential of its connection (connection parameters, cookies, `subscriptionCredentials`, upgrade-request headers or the upgrade-request query string) and runs anonymously: required operations answer the unauthenticated denial, and optional and public operations run without a principal. Its request URL, which principal sources receive as `PrincipalRequest.request` and policies as the context's `request`, is the upgrade URL without its query string or fragment, so a source that authenticates a URL query token finds none; the origin check still reads the connection's handshake, which grants no credential. The transport logs nothing at ERROR for it, because a client that closes its connection while graphql-ws prepares an operation leaves the same socket state. An operation whose socket closes after the operation started keeps its connection's credentials. A cached context of a closed connection therefore authenticates nothing. While the earlier request or connection is still open, its context is indistinguishable from the current operation's own, and the operation authenticates with the earlier caller's credentials, so the fresh-object rule is mandatory. Mercurius socket operations take their context from `subscription.context`, which Mercurius builds for every connection, so the GraphQL `context` option does not carry one connection's socket into another. For Apollo HTTP operations, it keeps the platform request at `context.req`: the Express request, or the Fastify request that the context function receives as its first argument, not that request's `raw` `IncomingMessage`. For Apollo socket operations, it either leaves `context.req` unset, so Nest assigns the graphql-ws context, or keeps graphql-ws's `extra` at `context.extra` and the connection parameters at `context.connectionParams`; the upgrade request alone is not recognized. An operation whose context carries neither fails closed with `AUTH_MISCONFIGURED` (`GRAPHQL_CONTEXT_UNRECOGNIZED`). Startup fails with `GRAPHQL_STATIC_CONTEXT` for a static context object and with `GRAPHQL_DRIVER_MISMATCH` when the transport does not match the configured driver.
+For Mercurius, use `MercuriusDriver`, `fastifyPlatform()` from `@nestjs-kit/better-auth/fastify` and `mercuriusTransport()`. `mercuriusSubscriptionContext()` returns a Mercurius `subscription.context` function that keeps the upgrade request and its original browser headers with every socket operation; the socket tests cover Mercurius with and without it. A custom GraphQL `context` must be a function that returns a fresh object for every operation and every graphql-ws connection; a function that returns a cached object is a configuration error that the transports cannot always detect. `@nestjs/apollo` 14.0.3 and later copy a returned object that leaves `context.req` unset and assign the operation's request to the copy, but share a cached object that sets `context.req`; 14.0.2 assigns the first operation's request to the returned object and shares it. An HTTP operation whose context carries an answered request fails closed with `AUTH_MISCONFIGURED` (`GRAPHQL_CONTEXT_STALE_REQUEST`). The Apollo transport classifies an operation's graphql-ws socket once, when the operation starts. When that socket is not open, the operation reads no credential of its connection (connection parameters, cookies, `subscriptionCredentials`, upgrade-request headers or the upgrade-request query string) and runs anonymously: required operations answer the unauthenticated denial, and optional and public operations run without a principal. Its request URL, which principal sources receive as `PrincipalRequest.request` and policies as the context's `request`, is the upgrade URL without its query string or fragment, so a source that authenticates a URL query token finds none; the origin check still reads the connection's handshake, which grants no credential. The transport logs nothing at ERROR for it, because a client that closes its connection while graphql-ws prepares an operation leaves the same socket state. An operation whose socket closes after the operation started keeps its connection's credentials. A cached context of a closed connection therefore authenticates nothing. While the earlier request or connection is still open, its context is indistinguishable from the current operation's own, and the operation authenticates with the earlier caller's credentials, so the fresh-object rule is mandatory. Mercurius socket operations take their context from `subscription.context`, which Mercurius builds for every connection, so the GraphQL `context` option does not carry one connection's socket into another. For Apollo HTTP operations, it keeps the platform request at `context.req`: the Express request, or the Fastify request that the context function receives as its first argument, not that request's `raw` `IncomingMessage`. For Apollo socket operations, it either leaves `context.req` unset, so Nest assigns the graphql-ws context, or keeps graphql-ws's `extra` at `context.extra` and the connection parameters at `context.connectionParams`; the upgrade request alone is not recognized. An operation whose context carries neither fails closed with `AUTH_MISCONFIGURED` (`GRAPHQL_CONTEXT_UNRECOGNIZED`). Startup fails with `GRAPHQL_STATIC_CONTEXT` for a static context object and with `GRAPHQL_DRIVER_MISMATCH` when the transport does not match the configured driver.
 
 ### Operations and fields
 
@@ -973,7 +973,7 @@ Better Auth treats a process with `NODE_ENV=test` or a truthy `TEST` variable (V
 
 The kits verify extension units against the invariants of the [reviewed specification](docs/design/design-v7.md) (§4 and §14.1). Each kit returns `ConformanceCase[]` (`{ id, title, skip?, run() }`) that `runConformance(cases, { describe, it })` registers with Vitest, Jest or `node:test`. Assertions use `node:assert/strict`; the kits import no test runner.
 
-Applicability comes from the unit, not from the options a harness passes. A platform that declares `capabilities.http2` needs the `http2` option. The platform kit's trusted-hop rows need `trustOneProxy`, which trusts one forwarding hop on a created application (Express `app.set("trust proxy", 1)`), or `createTrustingHttpAdapter` (and `http2.createTrustingHttpAdapter` for their HTTP/2 rows), which returns a fresh adapter that already trusts it, for platforms that fix proxy trust at construction (Fastify `new FastifyAdapter({ trustProxy: "loopback" })`; the kit's requests come from loopback). Its microservice rows of `H-no-adapter` need `microservice`, which returns the transport options to boot with (for example `{ transport: Transport.TCP, options: { host: "127.0.0.1", port: 0 } }`); the kit does not load the optional `@nestjs/microservices` peer itself. The production-mode rows set `process.env.NODE_ENV` to `production` while they run and restore it afterwards, so run the kit's cases sequentially. A transport with a lineage needs `invokeTwice`, one that nests handlers (`defaultAccessFor`) needs `invokeGraph`, and one that claims the kit's federation reference resolver needs `invokeEntities`. A transport whose browser leg is a connection's handshake, shared by the connection's messages (the WebSocket transports), runs the `T-ws-origin-*` cases instead of the `T-csrf-*` cases and needs `invokeConnection`, plus `authenticateConnection` when the app provides `WS_CONNECTION_AUTH`. Such a case fails when the helper is missing, and `T-selection` fails `expectBrowserLeg: false` for a transport that describes a browser leg. A transport that nests handlers needs `graphqlContexts` to list `'static'` and `'cached'` for `T-stale-context`. Its cached-context row closes the first caller's request or connection before a later caller runs. After a completed request, it expects the later caller's own principal or `GRAPHQL_CONTEXT_STALE_REQUEST`. Where the browser leg is a connection's handshake, it runs through `invokeConnection`, which resolves only after the server has observed the connection's close, and expects the later caller's own principal, an anonymous answer or the unauthenticated denial, never the first caller's principal, with nothing logged at ERROR; the custom-context rows of `T-subscription-origin` run for the listed `'fresh'` and `'plain-request'` contexts. The `T-subscription-*` cases run when `invocationShapes` includes `'subscriptions'` and need `invokeConnection` with its `connectionParams` option. `T-inherited-handler` runs with `invokeInherited`; harnesses of transports that address a handler by a name one inherited method shares across subclasses (an RPC pattern, a GraphQL root field) omit it, and the case is skipped with the reason. A case whose optional capability is absent is skipped with the reason. The kits read these members from unit objects before running; for classes and `defineExtension()` definitions they boot once and read the resolved unit. A case known to be inapplicable registers with its reason in the test name. A case that finds out at run time resolves with `{ skipped: reason }`, which `runConformance` reports through the runner's `context.skip(reason)` (Vitest, `node:test`; Jest has no runtime skip, so the test passes).
+Applicability comes from the unit, not from the options a harness passes. A platform that declares `capabilities.http2` needs the `http2` option. The platform kit's trusted-hop rows need `trustOneProxy`, which trusts one forwarding hop on a created application (Express `app.set("trust proxy", 1)`), or `createTrustingHttpAdapter` (and `http2.createTrustingHttpAdapter` for their HTTP/2 rows), which returns a fresh adapter that already trusts it, for platforms that fix proxy trust at construction (Fastify `new FastifyAdapter({ trustProxy: "loopback" })`; the kit's requests come from loopback). Its microservice rows of `H-no-adapter` need `microservice`, which returns the transport options to boot with (for example `{ transport: Transport.TCP, options: { host: "127.0.0.1", port: 0 } }`); the kit does not load the optional `@nestjs/microservices` peer itself. The production-mode rows set `process.env.NODE_ENV` to `production` while they run and restore it afterwards, so run the kit's cases sequentially. A transport with a lineage needs `invokeTwice`, one that nests handlers (`defaultAccessFor`) needs `invokeGraph`, and one that claims the kit's federation reference resolver needs `invokeEntities`. A transport whose browser leg is a connection's handshake, shared by the connection's messages (the WebSocket transports), runs the `T-ws-origin-*` cases instead of the `T-csrf-*` cases and needs `invokeConnection`, plus `authenticateConnection` when the app provides `WS_CONNECTION_AUTH`. Such a case fails when the helper is missing, and `T-selection` fails `expectBrowserLeg: false` for a transport that describes a browser leg. A transport that nests handlers needs `graphqlContexts` to list `'static'` and `'cached'` for `T-stale-context`. Its cached-context row closes the first caller's request or connection before a later caller runs. The harness's `'cached'` context keeps the first call's request at `context.req` (for Apollo socket operations, the graphql-ws context that Nest would assign), because `@nestjs/apollo` 14.0.3 and later copy a returned object without `req` for every operation, so a cached object without it carries no closed connection. After a completed request, it expects the later caller's own principal or `GRAPHQL_CONTEXT_STALE_REQUEST`. Where the browser leg is a connection's handshake, it runs through `invokeConnection`, which resolves only after the server has observed the connection's close, and expects an anonymous answer or the unauthenticated denial, never the first caller's principal, with nothing logged at ERROR. A later caller there that reads its own principal shows that the driver built a new context for its connection instead of serving the cached one (Mercurius socket operations, or an Apollo `'cached'` context without `req` under `@nestjs/apollo` 14.0.3 and later), so no closed connection's context reached the transport and the case resolves skipped with that reason; the custom-context rows of `T-subscription-origin` run for the listed `'fresh'` and `'plain-request'` contexts. The `T-subscription-*` cases run when `invocationShapes` includes `'subscriptions'` and need `invokeConnection` with its `connectionParams` option. `T-inherited-handler` runs with `invokeInherited`; harnesses of transports that address a handler by a name one inherited method shares across subclasses (an RPC pattern, a GraphQL root field) omit it, and the case is skipped with the reason. A case whose optional capability is absent is skipped with the reason. The kits read these members from unit objects before running; for classes and `defineExtension()` definitions they boot once and read the resolved unit. A case known to be inapplicable registers with its reason in the test name. A case that finds out at run time resolves with `{ skipped: reason }`, which `runConformance` reports through the runner's `context.skip(reason)` (Vitest, `node:test`; Jest has no runtime skip, so the test passes).
 
 ```ts
 import { ExpressAdapter } from "@nestjs/platform-express";

package/dist/admin.cjs

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_auth_errors = require("./auth-errors-DmiKl0L_.cjs");
-const require_auth_decorators = require("./auth-decorators-Cu_nxWnF.cjs");
+const require_auth_decorators = require("./auth-decorators-CJKE9wlT.cjs");
+const require_auth_errors = require("./auth-errors-RW7hOVI-.cjs");
 let better_auth_api = require("better-auth/api");
-//#region src/admin.ts
+// src/admin.ts
 const adminPermissionPolicy = {
 	id: "better-auth:admin/permission",
 	requires: {
@@ -80,7 +80,6 @@ function permission(permissions, options = {}) {
 function RequirePermission(permissions, options) {
 	return require_auth_decorators.Require(permission(permissions, options));
 }
-//#endregion
 exports.RequirePermission = RequirePermission;
 exports.adminPermissionPolicy = adminPermissionPolicy;
 exports.permission = permission;

package/dist/admin.d.cts

@@ -1,5 +1,4 @@
-import { Ct as AuthPrincipal, Nt as PrincipalKind, f as AuthorizationPolicy, ot as Requirement, vt as AdminPermissions } from "./auth-contracts-Brh_Qko9.cjs";
-//#region src/admin.d.ts
+import { Ct as AuthPrincipal, Nt as PrincipalKind, f as AuthorizationPolicy, ot as Requirement, vt as AdminPermissions } from "./auth-contracts-zvt8ysoZ.cjs";
 export interface PermissionOptions {
   principals?: readonly PrincipalKind[];
 }
@@ -9,6 +8,5 @@ export interface AdminPermissionParams {
 export declare const adminPermissionPolicy: AuthorizationPolicy<AdminPermissionParams, AuthPrincipal>;
 export declare function permission<N extends string = "default">(permissions: AdminPermissions<N>, options?: PermissionOptions): Requirement<AdminPermissionParams>;
 export declare function RequirePermission<N extends string = "default">(permissions: AdminPermissions<N>, options?: PermissionOptions): ClassDecorator & MethodDecorator;
-//#endregion
 export type { AdminPermissions };
 //# sourceMappingURL=admin.d.cts.map

package/dist/admin.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.cts","names":[],"sources":["../src/admin.ts"],"mappings":";;iBAUiB;EACf,sBAAsB;;iBAEP;WACN,aAAa;;qBAWX,uBAAuB,oBAClC,uBACA;wBA+Fc,WAAW,8BACzB,aAAa,iBAAiB,IAC9B,UAAS,oBACR,YAAY;wBAOC,kBAAkB,8BAChC,aAAa,iBAAiB,IAC9B,UAAU,oBACT,iBAAiB"}
+{"version":3,"file":"admin.d.cts","names":[],"sources":["../src/admin.ts"],"mappings":";iBAUiB;EACf,sBAAsB;;iBAEP;WACN,aAAa;;qBAWX,uBAAuB,oBAClC,uBACA;wBA+Fc,WAAW,8BACzB,aAAa,iBAAiB,IAC9B,UAAS,oBACR,YAAY;wBAOC,kBAAkB,8BAChC,aAAa,iBAAiB,IAC9B,UAAU,oBACT,iBAAiB"}

package/dist/admin.d.mts

@@ -1,5 +1,4 @@
-import { Ct as AuthPrincipal, Nt as PrincipalKind, f as AuthorizationPolicy, ot as Requirement, vt as AdminPermissions } from "./auth-contracts-Cz7C4_Ch.mjs";
-//#region src/admin.d.ts
+import { Ct as AuthPrincipal, Nt as PrincipalKind, f as AuthorizationPolicy, ot as Requirement, vt as AdminPermissions } from "./auth-contracts-CADGyI0O.mjs";
 export interface PermissionOptions {
   principals?: readonly PrincipalKind[];
 }
@@ -9,6 +8,5 @@ export interface AdminPermissionParams {
 export declare const adminPermissionPolicy: AuthorizationPolicy<AdminPermissionParams, AuthPrincipal>;
 export declare function permission<N extends string = "default">(permissions: AdminPermissions<N>, options?: PermissionOptions): Requirement<AdminPermissionParams>;
 export declare function RequirePermission<N extends string = "default">(permissions: AdminPermissions<N>, options?: PermissionOptions): ClassDecorator & MethodDecorator;
-//#endregion
 export type { AdminPermissions };
 //# sourceMappingURL=admin.d.mts.map

package/dist/admin.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.mts","names":[],"sources":["../src/admin.ts"],"mappings":";;iBAUiB;EACf,sBAAsB;;iBAEP;WACN,aAAa;;qBAWX,uBAAuB,oBAClC,uBACA;wBA+Fc,WAAW,8BACzB,aAAa,iBAAiB,IAC9B,UAAS,oBACR,YAAY;wBAOC,kBAAkB,8BAChC,aAAa,iBAAiB,IAC9B,UAAU,oBACT,iBAAiB"}
+{"version":3,"file":"admin.d.mts","names":[],"sources":["../src/admin.ts"],"mappings":";iBAUiB;EACf,sBAAsB;;iBAEP;WACN,aAAa;;qBAWX,uBAAuB,oBAClC,uBACA;wBA+Fc,WAAW,8BACzB,aAAa,iBAAiB,IAC9B,UAAS,oBACR,YAAY;wBAOC,kBAAkB,8BAChC,aAAa,iBAAiB,IAC9B,UAAU,oBACT,iBAAiB"}

package/dist/admin.mjs

@@ -1,7 +1,7 @@
-import { n as BetterAuthConfigurationError } from "./auth-errors-C3rbTV9p.mjs";
-import { u as Require } from "./auth-decorators-B1mFnGJ6.mjs";
+import { u as Require } from "./auth-decorators-CkNkLNpU.mjs";
+import { n as BetterAuthConfigurationError } from "./auth-errors-JjxGDVSt.mjs";
 import { isAPIError } from "better-auth/api";
-//#region src/admin.ts
+// src/admin.ts
 const adminPermissionPolicy = {
 	id: "better-auth:admin/permission",
 	requires: {
@@ -79,7 +79,6 @@ function permission(permissions, options = {}) {
 function RequirePermission(permissions, options) {
 	return Require(permission(permissions, options));
 }
-//#endregion
 export { RequirePermission, adminPermissionPolicy, permission };
 
 //# sourceMappingURL=admin.mjs.map

package/dist/api-key.cjs

@@ -1,9 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_auth_errors = require("./auth-errors-DmiKl0L_.cjs");
-const require_auth_scope_interceptor = require("./auth-scope-interceptor-BjxAL1-S.cjs");
-const require_auth_decorators = require("./auth-decorators-Cu_nxWnF.cjs");
+const require_auth_decorators = require("./auth-decorators-CJKE9wlT.cjs");
+const require_auth_errors = require("./auth-errors-RW7hOVI-.cjs");
+const require_auth_scope_interceptor = require("./auth-scope-interceptor-Bui20-Ps.cjs");
 let better_auth_plugins_access = require("better-auth/plugins/access");
-//#region src/api-key.ts
+// src/api-key.ts
 const API_KEY_PRINCIPAL_KIND = "api-key";
 function apiKeyPrincipal(options = {}) {
 	const header = options.header ?? "x-api-key";
@@ -155,7 +155,6 @@ function apiKeyPermission(permissions) {
 function RequireApiKeyPermission(permissions) {
 	return require_auth_decorators.Require(apiKeyPermission(permissions));
 }
-//#endregion
 exports.API_KEY_PRINCIPAL_KIND = API_KEY_PRINCIPAL_KIND;
 exports.RequireApiKeyPermission = RequireApiKeyPermission;
 exports.apiKeyPermission = apiKeyPermission;

package/dist/api-key.d.cts

@@ -1,5 +1,4 @@
-import { $ as PrincipalDelegation, it as PrincipalSource, o as AuthPrincipalBase, ot as Requirement } from "./auth-contracts-Brh_Qko9.cjs";
-//#region src/api-key.d.ts
+import { $ as PrincipalDelegation, it as PrincipalSource, o as AuthPrincipalBase, ot as Requirement } from "./auth-contracts-zvt8ysoZ.cjs";
 export declare const API_KEY_PRINCIPAL_KIND: "api-key";
 export interface ApiKeyPrincipal extends AuthPrincipalBase {
   readonly kind: "api-key";
@@ -38,5 +37,4 @@ export interface ApiKeyPrincipalOptions {
 export declare function apiKeyPrincipal(options?: ApiKeyPrincipalOptions): PrincipalSource<ApiKeyPrincipal>;
 export declare function apiKeyPermission(permissions: Record<string, string[]>): Requirement<Record<string, string[]>>;
 export declare function RequireApiKeyPermission(permissions: Record<string, string[]>): ClassDecorator & MethodDecorator;
-//#endregion
 //# sourceMappingURL=api-key.d.cts.map

package/dist/api-key.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"api-key.d.cts","names":[],"sources":["../src/api-key.ts"],"mappings":";;qBAkBa;iBACI,wBAAwB;WAC9B;WACA;WACA;WACA;WACA;WACA;WACA,aAAa,SAAS;WACtB,YAAY;;;YAIX;IACR,WAAW;;;iBAGE;EACf;EACA;EACA,yCAGM;aAAgB;;;;;;;;;;EAStB;aAAmC;;EACnC;;wBAmBc,gBACd,UAAS,yBACR,gBAAgB;wBAwMH,iBACd,aAAa,2BACZ,YAAY;wBAGC,wBACd,aAAa,2BACZ,iBAAiB"}
+{"version":3,"file":"api-key.d.cts","names":[],"sources":["../src/api-key.ts"],"mappings":";qBAkBa;iBACI,wBAAwB;WAC9B;WACA;WACA;WACA;WACA;WACA;WACA,aAAa,SAAS;WACtB,YAAY;;;YAIX;IACR,WAAW;;;iBAGE;EACf;EACA;EACA,yCAGM;aAAgB;;;;;;;;;;EAStB;aAAmC;;EACnC;;wBAmBc,gBACd,UAAS,yBACR,gBAAgB;wBAwMH,iBACd,aAAa,2BACZ,YAAY;wBAGC,wBACd,aAAa,2BACZ,iBAAiB"}

package/dist/api-key.d.mts

@@ -1,5 +1,4 @@
-import { $ as PrincipalDelegation, it as PrincipalSource, o as AuthPrincipalBase, ot as Requirement } from "./auth-contracts-Cz7C4_Ch.mjs";
-//#region src/api-key.d.ts
+import { $ as PrincipalDelegation, it as PrincipalSource, o as AuthPrincipalBase, ot as Requirement } from "./auth-contracts-CADGyI0O.mjs";
 export declare const API_KEY_PRINCIPAL_KIND: "api-key";
 export interface ApiKeyPrincipal extends AuthPrincipalBase {
   readonly kind: "api-key";
@@ -38,5 +37,4 @@ export interface ApiKeyPrincipalOptions {
 export declare function apiKeyPrincipal(options?: ApiKeyPrincipalOptions): PrincipalSource<ApiKeyPrincipal>;
 export declare function apiKeyPermission(permissions: Record<string, string[]>): Requirement<Record<string, string[]>>;
 export declare function RequireApiKeyPermission(permissions: Record<string, string[]>): ClassDecorator & MethodDecorator;
-//#endregion
 //# sourceMappingURL=api-key.d.mts.map

package/dist/api-key.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"api-key.d.mts","names":[],"sources":["../src/api-key.ts"],"mappings":";;qBAkBa;iBACI,wBAAwB;WAC9B;WACA;WACA;WACA;WACA;WACA;WACA,aAAa,SAAS;WACtB,YAAY;;;YAIX;IACR,WAAW;;;iBAGE;EACf;EACA;EACA,yCAGM;aAAgB;;;;;;;;;;EAStB;aAAmC;;EACnC;;wBAmBc,gBACd,UAAS,yBACR,gBAAgB;wBAwMH,iBACd,aAAa,2BACZ,YAAY;wBAGC,wBACd,aAAa,2BACZ,iBAAiB"}
+{"version":3,"file":"api-key.d.mts","names":[],"sources":["../src/api-key.ts"],"mappings":";qBAkBa;iBACI,wBAAwB;WAC9B;WACA;WACA;WACA;WACA;WACA;WACA,aAAa,SAAS;WACtB,YAAY;;;YAIX;IACR,WAAW;;;iBAGE;EACf;EACA;EACA,yCAGM;aAAgB;;;;;;;;;;EAStB;aAAmC;;EACnC;;wBAmBc,gBACd,UAAS,yBACR,gBAAgB;wBAwMH,iBACd,aAAa,2BACZ,YAAY;wBAGC,wBACd,aAAa,2BACZ,iBAAiB"}

package/dist/api-key.mjs

@@ -1,8 +1,8 @@
-import { n as BetterAuthConfigurationError, r as BetterAuthInfrastructureError, t as AuthFailures, u as normalizeThrown } from "./auth-errors-C3rbTV9p.mjs";
-import { a as absent, l as rejected, o as authenticated } from "./auth-scope-interceptor-DYPn3b8M.mjs";
-import { u as Require } from "./auth-decorators-B1mFnGJ6.mjs";
+import { u as Require } from "./auth-decorators-CkNkLNpU.mjs";
+import { n as BetterAuthConfigurationError, r as BetterAuthInfrastructureError, t as AuthFailures, u as normalizeThrown } from "./auth-errors-JjxGDVSt.mjs";
+import { a as absent, l as rejected, o as authenticated } from "./auth-scope-interceptor-CvCQ52dV.mjs";
 import { role } from "better-auth/plugins/access";
-//#region src/api-key.ts
+// src/api-key.ts
 const API_KEY_PRINCIPAL_KIND = "api-key";
 function apiKeyPrincipal(options = {}) {
 	const header = options.header ?? "x-api-key";
@@ -154,7 +154,6 @@ function apiKeyPermission(permissions) {
 function RequireApiKeyPermission(permissions) {
 	return Require(apiKeyPermission(permissions));
 }
-//#endregion
 export { API_KEY_PRINCIPAL_KIND, RequireApiKeyPermission, apiKeyPermission, apiKeyPrincipal };
 
 //# sourceMappingURL=api-key.mjs.map

package/dist/{auth-contracts-Brh_Qko9.d.cts → auth-contracts-CADGyI0O.d.mts}

@@ -1,9 +1,8 @@
-import { IncomingHttpHeaders, IncomingMessage } from "node:http";
 import { CallHandler, CanActivate, DynamicModule, ExecutionContext, InjectionToken, IntrinsicException, Logger, LoggerService, ModuleMetadata, NestInterceptor, OptionalFactoryDependency, Provider, Type } from "@nestjs/common";
 import { AbstractHttpAdapter, DiscoveryService, HttpAdapterHost, ModuleRef, Reflector } from "@nestjs/core";
-import { HookEndpointContext } from "better-auth";
 import { Observable } from "rxjs";
-//#region src/auth-errors.d.ts
+import { IncomingHttpHeaders, IncomingMessage } from "node:http";
+import { HookEndpointContext } from "better-auth";
 type AuthErrorCode = "UNAUTHENTICATED" | "FORBIDDEN" | "RATE_LIMITED";
 /** A transport-neutral denial. Only transports make it throwable. */
 interface AuthFailure {
@@ -83,8 +82,6 @@ declare class BetterAuthInfrastructureError extends Error {
   });
 }
 declare function getRawCause(error: BetterAuthInfrastructureError): unknown;
-//#endregion
-//#region src/auth-tokens.d.ts
 declare function getBetterAuthInstanceToken(alias?: string): string;
 declare function getBetterAuthOptionsToken(alias?: string): string;
 declare function getBetterAuthServiceToken(alias?: string): string;
@@ -102,8 +99,6 @@ declare const SKIP_ORIGIN_CHECK_METADATA: unique symbol;
 declare const AUTH_ENHANCER: unique symbol;
 /** Connection-time WebSocket authentication, provided by the socket.io and ws transport definitions. */
 declare const WS_CONNECTION_AUTH: unique symbol;
-//#endregion
-//#region src/auth-module.d.ts
 declare class BetterAuthModule {
   static forRoot<A extends AuthLike = RegisteredAuth>(options: BetterAuthModuleOptions<A> & BetterAuthAppOptions & {
     name?: "default";
@@ -118,8 +113,6 @@ declare class BetterAuthModule {
     name: string;
   } & NoAppOptions): DynamicModule;
 }
-//#endregion
-//#region src/bridge-protocol.d.ts
 declare const EXTENSION_DEFINITION: unique symbol;
 declare const UPGRADE_REQUEST: unique symbol;
 interface BridgeHandle {
@@ -197,8 +190,6 @@ interface CompiledHook {
   matches(ctx: HookEndpointContext, scope: ScopeView | undefined): boolean;
   run(ctx: HookEndpointContext): Promise<unknown>;
 }
-//#endregion
-//#region src/request-scope.d.ts
 interface ScopeState {
   readonly view: ScopeView;
   readonly call?: TransportCall;
@@ -245,8 +236,6 @@ declare class RequestScope {
     lineage?: InvocationLineage;
   }): boolean;
 }
-//#endregion
-//#region src/origin-check.d.ts
 /** Bounded, per-application diagnostics; the next denial rolls the window without timers. */
 declare class OriginDiagnostics {
   #private;
@@ -277,8 +266,6 @@ declare class OriginCheck {
   private calculationFailures;
   private verdict;
 }
-//#endregion
-//#region src/instance-registry.d.ts
 interface InstanceEntry {
   readonly name: string;
   readonly instance: AuthLike;
@@ -323,8 +310,6 @@ declare class InstanceRegistry implements InstanceLookup {
   initialize(issues: BetterAuthConfigurationError[]): Promise<void>;
   reset(): void;
 }
-//#endregion
-//#region src/mount-coordinator.d.ts
 declare class MountCoordinator {
   #private;
   readonly host: HttpAdapterHost;
@@ -345,8 +330,6 @@ declare class MountCoordinator {
   mount(): Promise<void>;
   reset(): void;
 }
-//#endregion
-//#region src/principal-readings.d.ts
 interface ReadingInput {
   readonly args: readonly unknown[];
   readonly call?: TransportCall;
@@ -376,16 +359,12 @@ declare class PrincipalReadings {
   deliver(error: BetterAuthConfigurationError, input?: ReadingInput, instance?: string): BetterAuthConfigurationError | RepeatedReaderError;
   stamp(args: readonly unknown[], instance: string, result: PrincipalResult): void;
 }
-//#endregion
-//#region src/policy-resolver.d.ts
 declare class PolicyResolver {
   private readonly moduleRef;
   private readonly cache;
   constructor(moduleRef: ModuleRef);
   resolve<P>(reference: PolicyRef<P>): AuthorizationPolicy<P, any>;
 }
-//#endregion
-//#region src/transport-registry.d.ts
 declare class TransportRegistry {
   private transports;
   private readonly owners;
@@ -399,8 +378,6 @@ declare class TransportRegistry {
   idOf(call: TransportCall): string;
   describe(context: ExecutionContext, transport?: AuthTransport): TransportCall;
 }
-//#endregion
-//#region src/route-planner.d.ts
 declare class RoutePlanner {
   private readonly instances;
   private readonly policies;
@@ -412,8 +389,6 @@ declare class RoutePlanner {
   forContext(context: ExecutionContext): RoutePlan;
   plan(target: Type, method: string): RoutePlan;
 }
-//#endregion
-//#region src/auth-service.d.ts
 declare class BetterAuthService<A extends AuthLike = RegisteredAuth> {
   #private;
   private readonly registry;
@@ -440,8 +415,6 @@ declare class BetterAuthService<A extends AuthLike = RegisteredAuth> {
   withoutCookies<T>(fn: () => Promise<T>): Promise<T>;
   runOutsideScope<T>(fn: () => Promise<T>): Promise<T>;
 }
-//#endregion
-//#region src/authorization-evaluator.d.ts
 declare const allow: () => AuthorizationDecision;
 declare const deny: (input: {
   reason: string;
@@ -459,8 +432,6 @@ declare class AuthorizationEvaluator {
   constructor(policies: PolicyResolver, invoker: PolicyInvoker, resolver: PrincipalResolver, scope: RequestScope);
   evaluate(plan: RoutePlan, principal: AuthPrincipal, call: TransportCall, entry: InstanceEntry, execution: ExecutionContext, transport: string): Promise<AuthorizationDecision>;
 }
-//#endregion
-//#region src/auth-guard.d.ts
 declare class BetterAuthGuard implements CanActivate {
   private readonly core;
   static readonly [AUTH_ENHANCER] = "guard";
@@ -479,8 +450,6 @@ declare class GuardCore implements CanActivate {
   constructor(instances: InstanceLookup, planner: RoutePlanner, transports: TransportRegistry, resolver: PrincipalResolver, evaluator: AuthorizationEvaluator, scope: RequestScope, readings: PrincipalReadings);
   canActivate(context: ExecutionContext): Promise<boolean>;
 }
-//#endregion
-//#region src/auth-scope-interceptor.d.ts
 declare class BetterAuthScopeInterceptor implements NestInterceptor {
   private readonly core;
   static readonly [AUTH_ENHANCER] = "scope";
@@ -497,13 +466,9 @@ declare class ScopeCore implements NestInterceptor {
   constructor(instances: InstanceLookup, planner: RoutePlanner, transports: TransportRegistry, scope: RequestScope, readings: PrincipalReadings);
   intercept(context: ExecutionContext, next: CallHandler): Observable<unknown>;
 }
-//#endregion
-//#region src/auth-module-definition.d.ts
 declare function defineExtension<T>(definition: Omit<ExtensionDefinition<T>, typeof EXTENSION_DEFINITION>): ExtensionDefinition<T>;
 declare function defineHttpPlatform<P extends HttpPlatform>(platform: P): P;
 declare function defineTransport<T extends AuthTransport>(transport: T): T;
-//#endregion
-//#region src/auth-decorators.d.ts
 declare const Public: () => import("@nestjs/common").CustomDecorator<typeof ACCESS_METADATA>;
 declare const OptionalAuth: () => import("@nestjs/common").CustomDecorator<typeof ACCESS_METADATA>;
 declare const RequireAuth: (options?: {
@@ -532,8 +497,6 @@ declare const BeforeAuth: <const P extends EndpointPath | (string & {})>(match?:
 declare const AfterAuth: <const P extends EndpointPath | (string & {})>(match?: P | readonly P[] | HookPredicate, options?: HookOptions) => HookMethodDecorator<P>;
 declare const BeforeDatabase: <E extends DatabaseHookTarget>(target: E, options?: DbHookOptions) => DbHookMethodDecorator<E, "before">;
 declare const AfterDatabase: <E extends DatabaseHookTarget>(target: E, options?: DbHookOptions) => DbHookMethodDecorator<E, "after">;
-//#endregion
-//#region src/session-principal.d.ts
 declare const SESSION_PRINCIPAL_KIND: "session";
 declare const CurrentSession: () => ParameterDecorator;
 declare const CurrentUser: () => ParameterDecorator;
@@ -546,27 +509,17 @@ declare const freshSession: (options?: {
 declare const RequireFreshSession: (options?: {
   maxAgeSeconds?: number;
 }) => ClassDecorator & MethodDecorator;
-//#endregion
-//#region src/principal-resolver.d.ts
 declare const definePrincipalSource: <P extends AuthPrincipalBase>(source: PrincipalSource<P>) => PrincipalSource<P>;
 declare const authenticated: <P extends AuthPrincipalBase>(principal: P) => PrincipalResult<P>;
 declare const absent: () => PrincipalResult<never>;
 declare const rejected: (failure: AuthFailure) => PrincipalResult<never>;
-//#endregion
-//#region src/auth-exchange.d.ts
 /** Credentialed CORS for the auth mount, using the initialized SDK trusted origins. */
 declare function betterAuthCorsOrigin(auth: AuthLike, options?: CorsOriginOptions): (origin: string | undefined, cb: (err: Error | null, allow?: boolean) => void) => void;
-//#endregion
-//#region src/http-transport.d.ts
 declare function httpTransport(): ExtensionRef<AuthTransport>;
-//#endregion
-//#region src/index.d.ts
 /** Augment this public interface to register an optional principal kind. */
 interface PrincipalKinds {
   session: SessionPrincipal;
 }
-//#endregion
-//#region src/auth-types.d.ts
 /** Structural minimum; accepts any betterAuth() result incl. plugins and customSession (EXP-C2, EXP-A:types/). */
 interface AuthLike {
   handler(request: Request): Promise<Response>;
@@ -675,8 +628,6 @@ interface SessionPrincipal<S = AuthSession> extends AuthPrincipalBase {
   readonly kind: "session";
   readonly session: S;
 }
-//#endregion
-//#region src/auth-contracts.d.ts
 interface BetterAuthAppOptions {
   /** HTTP platforms. Exactly one must support the running HTTP adapter when the app has one. Default []. */
   platforms?: readonly ExtensionRef<HttpPlatform>[];
@@ -1649,6 +1600,5 @@ interface PolicyBootContext {
   readonly context: AuthContextView;
   readonly site: string;
 }
-//#endregion
 export { PrincipalDelegation as $, ErrorMappingOptions as $n, SESSION_PRINCIPAL_KIND as $t, DatabaseHookTarget as A, BetterAuthService as An, GetSessionWithHeaders as At, HookOptions as B, WS_CONNECTION_AUTH as Bn, UnvalidatedBody as Bt, ConformanceCase as C, defineHttpPlatform as Cn, AuthPrincipal as Ct, CookieForwardingOptions as D, allow as Dn, DatabaseHookMethod as Dt, ConformanceSkip as E, BetterAuthGuard as En, DatabaseHookData as Et, ExtensionDefinition as F, BetterAuthModule as Fn, Register as Ft, InboundAuthRequest as G, AuthErrorBody as Gn, betterAuthCorsOrigin as Gt, HttpMountOptions as H, getBetterAuthInstanceToken as Hn, WithActiveOrganization as Ht, ExtensionRef as I, GUARD_CORE as In, RegisteredAuth as It, PlatformMountContext as J, AuthFailures as Jn, definePrincipalSource as Jt, InvocationLineage as K, AuthErrorCode as Kn, absent as Kt, FastifyPlatformOptions as L, POLICY_INVOKER as Ln, RegisteredInstances as Lt, DbHookOptions as M, InstanceLookup as Mn, OrgPermissions as Mt, DefaultInstanceCheck as N, EXTENSION_DEFINITION as Nn, PrincipalKind as Nt, CookieSink as O, definePolicy as On, DatabaseHookResult as Ot, ExpressPlatformOptions as P, UPGRADE_REQUEST as Pn, PrincipalOfKind as Pt, PolicyRef as Q, BetterAuthInfrastructureError as Qn, RequireFreshSession as Qt, GuardReach as R, PRINCIPAL_RESOLVER as Rn, SessionOf as Rt, ClaimOptions as S, defineExtension as Sn, AuthOf as St, ConformanceRunner as T, BetterAuthScopeInterceptor as Tn, AuthUser as Tt, HttpPlatform as U, getBetterAuthOptionsToken as Un, PrincipalKinds as Ut, HookPredicate as V, getBetterAuthHandleToken as Vn, UserOf as Vt, HttpRequestAccessor as W, getBetterAuthServiceToken as Wn, httpTransport as Wt, PolicyBootContext as X, AuthTransportErrorPayload as Xn, CurrentSession as Xt, PlatformPrepareContext as Y, AuthGraphqlExtensions as Yn, rejected as Yt, PolicyInvoker as Z, BetterAuthConfigurationError as Zn, CurrentUser as Zt, BetterAuthRuntimeOptions as _, allOf as _n, TransportValidationContext as _t, AuthHandlerInterceptor as a, BeforeAuth as an, ProxyTrust as at, BootAdviceContext as b, definePrincipalParam as bn, AuthHookContext as bt, AuthTransport as c, ForwardAuthCookies as cn, RequirementOptions as ct, AuthorizationLimits as d, Require as dn, ScopeInit as dt, freshSession as en, getRawCause as er, PrincipalReading as et, AuthorizationPolicy as f, RequireAuth as fn, SessionOption as ft, BetterAuthModuleOptions as g, UseBetterAuth as gn, TransportKit as gt, BetterAuthModuleAsyncOptions as h, UseAuthInstance as hn, TransportCall as ht, AuthHandle as i, AfterDatabase as in, PrincipalSource as it, DbHookMethodDecorator as j, TransportRegistry as jn, IsRegistered as jt, CorsOriginOptions as k, deny as kn, EndpointPath as kt, AuthorizationContext as l, OptionalAuth as ln, ResolutionRequest as lt, BetterAuthFactoryResult as m, SkipOriginCheck as mn, StaticOptionMustBePassedToForRootAsync as mt, ApplicationRouteDescriptor as n, AcceptPrincipals as nn, isConfigurationError as nr, PrincipalResolver as nt, AuthPrincipalBase as o, BeforeDatabase as on, Requirement as ot, BetterAuthAppOptions as p, SkipDefaultRequirements as pn, SessionPrincipalOptions as pt, OriginCheckOptions as q, AuthFailure as qn, authenticated as qt, AuthContextView as r, AfterAuth as rn, isInfrastructureError as rr, PrincipalResult as rt, AuthRouteBinding as s, CurrentPrincipal as sn, RequirementExpr as st, AdvisedHandler as t, sessionPrincipal as tn, isAuthFailure as tr, PrincipalRequest as tt, AuthorizationDecision as u, Public as un, RoutePlan as ut, BetterAuthStaticOptions as v, anyOf as vn, AdminPermissions as vt, ConformanceOutcome as w, defineTransport as wn, AuthSession as wt, BrowserExposure as x, requirement as xn, AuthLike as xt, BootAdvice as y, defineInvocationParam as yn, AuthAfterHookContext as yt, HookMethodDecorator as z, SCOPE_CORE as zn, SessionPrincipal as zt };
-//# sourceMappingURL=auth-contracts-Brh_Qko9.d.cts.map
+//# sourceMappingURL=auth-contracts-CADGyI0O.d.mts.map

package/dist/auth-contracts-CADGyI0O.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-contracts-CADGyI0O.d.mts","names":["tokens.ACCESS_METADATA","tokens.AUTH_INSTANCE_METADATA","tokens.ACCEPT_PRINCIPALS_METADATA","tokens.SKIP_DEFAULT_REQUIREMENTS_METADATA","tokens.FORWARD_COOKIES_METADATA","tokens.SKIP_ORIGIN_CHECK_METADATA"],"sources":["../src/auth-errors.ts","../src/auth-tokens.ts","../src/auth-module.ts","../src/bridge-protocol.ts","../src/request-scope.ts","../src/origin-check.ts","../src/instance-registry.ts","../src/mount-coordinator.ts","../src/principal-readings.ts","../src/policy-resolver.ts","../src/transport-registry.ts","../src/route-planner.ts","../src/auth-service.ts","../src/authorization-evaluator.ts","../src/auth-guard.ts","../src/auth-scope-interceptor.ts","../src/auth-module-definition.ts","../src/auth-decorators.ts","../src/session-principal.ts","../src/principal-resolver.ts","../src/auth-exchange.ts","../src/http-transport.ts","../src/index.ts","../src/auth-types.ts","../src/auth-contracts.ts"],"mappings":";;;;;KAoBY;;UAGK;WACN;WACA,MAAM;WACN;WACA;WACA;WACA,UAAU;;UAGJ;EACf;EACA;EACA,MAAM;EACN;EACA;;UAGe;EACf,MAAM;EACN;EACA;;UAGe;EACf;EACA;EACA,MAAM;EACN;EACA;;UAGe;EACf,OACE,SAAS,aACT,SAAS,kBACT;EAEF;;iBAQc,cAAc,iBAAiB,SAAS;iBAIxC,sBACd,iBACC,SAAS;iBAII,qBACd,iBACC,SAAS;iBAqDH,UAAU;EACjB;EACA;EACA;EACA;EACA;IACE;cA6BS;EACe,gBAAA,mBAAS;;EAIjB,UAAA,gBAAM,mBAAqB;EAGzB,aAAA,iBAAU;;cA4BnB,qCAAqC;WACvC;WACA;WACA;WACA;WACA;WACA;;;;;WAKA,kBAAkB;EAEf,YAAA,cAAc,gBAAgB;SAUnC,UACL,cACA,gBACA;IAAY;IAAe;MAC1B;;cAeQ,sCAAsC;WACxC,OAAO;WACP;;;;;EAMG,YAAA,gBAAgB;IAAY;;;iBAmD1B,YAAY,OAAO;iBC1SnB,2BAA2B;iBAI3B,0BAA0B;iBAI1B,0BAA0B;iBAI1B,yBAAyB;cA0B5B;cACA;cACA;cAGA;cAKA;cACA;cAMA;cAMA;cASA;cAGA;cAQA;;cAEA;cC9EA;SACJ,QAAQ,UAAU,WAAW,gBAClC,SAAS,wBAAwB,KAC/B;IAAyB;MAAqB,qBAAqB,KACpE;SACI,QAAQ,UAAU,UACvB,SAAS,wBAAwB;IAAO;MAAiB,eACxD;SAWI,aAAa,UAAU,WAAW,gBACvC,SAAS,6BAA6B,KACpC;IAAyB;MAC1B;SACI,aAAa,UAAU,UAC5B,SAAS,6BAA6B;IAAO;MAAiB,eAC7D;;cC/BQ;cAGA;UAII;WACN;WACA;;WAEA;;WAEA;;;;;;;;;EAST,KAAK,SAAS;IAAkB;IAAe;;;EAE/C,mBAAmB;;UAEJ;;WAEN;aAAkB;;;WAElB;;;;;EAKT;;EAEA,WAAW;;WAEF;WACA,iBAAiB;WACjB,gBAAgB;WAChB,UAAU,YAChB,KAAK;aACK,iBAAiB,mBAAmB;aACpC,gBAAgB,mBAAmB;;;EAIhD,UAAU;;UAEK;;WAEN,SAAS;WACT;WACA,gBAAgB;WAChB;;;;;;;WAOA,sBAAsB,cAAc;;;WAGpC,uBAAuB;;UAEjB;;;;;;;;EAQf,QAAQ,KAAK,qBAAqB,OAAO;EACzC,IAAI,KAAK,sBAAsB;;UClEhB;WACN,MAAM;WACN,OAAO;WACP,OAAO;WACP,gBAAgB;;;UAGV;WACN,UAAU;WACV,oBAAoB;;UAEd;WACN,WAAW,YAAY,QAAQ;WAC/B,UAAU,YAAY;WACtB,WAAW,YAAY,QAAQ;WAC/B,QAAQ;WACR,oBAAoB;WACpB,SAAS,YAAY,QAAQ;WAC7B,UAAU;WACV,aAAa;IAGlB,OAAO,QAAQ;MAAmB;;IAClC;;;cAmCO;;EAOX,IAAI,GAAG,OAAO,YAAY,UAAU,IAAI;EAIxC,KAAK,GAAG,UAAU,IAAI;EAItB,WAAW;EAIX,SAAS,cAAc;EAkBvB,cACE,MAAM,KAAK,yDACX;IACE;IACA;IACA;KAEF,eAAe,QAAQ,mBACtB,QAAQ;EAqCX,aAAa,GACX,iBACA,kBACA,qBACA,eAAe,QAAQ,IACvB,yBACC,QAAQ;EA0BX,aACE,oBACA,kBACA,qBACA,eAAe,QAAQ,mBACtB,QAAQ;EAWX,SAAS,kBAAkB;EAc3B,SACE,aACA,eACA;IAAW;IAAkB;IAAc,UAAU;;;;cCxL5C;;mBAOQ;EAAA,YAAA;IACf,KAAK;IACL,MAAM;;EAIV,OACE,kBACA,SAAS,aACT,SAAS,SACT;EA6BF,gBACE,kBACA,SAAS,SACT;;UAWa;WACN;WACA,SAAS;WACT,UAAU;WACV,cAAc;WACd;WACA;;cAGE;;mBAKQ;mBACA;EADA,YAAA,OAAO,cACP,MAAM;EAKzB,MACE,SAAS,iBACT,0BACC,QAAQ;EAsEL,SAAS,SAAS,kBAAkB;EAkB1C,oBACE,SAAS,iBACT,cACA;UAuBM;UAkBM;;UCxLC;WACN;WACA,UAAU;WACV,SAAS,yBAAyB;WAClC,eAAe;WACf,kBAAkB;WAClB,QAAQ;WACR,SAAS;WACT,QAAQ;WACR,QAAQ;WACR;;UAEM;EACf,IAAI,eAAe;EACnB,iBAAiB;;UAEF;WACN;WACA,UAAU;WACV,SAAS,yBAAyB;WAClC,eAAe;WACf,YAAY;WACZ,kBAAkB;WAClB,QAAQ;;cAgBN,4BAA4B;;mBASa;WAN3C,QAAM;WACN,aAAW;EACpB;EACA,SAAS;EACT;;;EAEoD,YAAA,OAAO;EAE3D,SACE,SAAS,yBAAyB,WAClC,eAAe,yBACf,kBAAkB,mBAClB,YAAY,uBACX;EAiBH,0BAA0B;EAI1B,IAAI,eAAe;EAYnB,iBAAiB;EAIjB,MAAM,SAAS;EAmBT,WAAW,QAAQ,iCAAiC;EAyK1D;;cClTW;;WAUyB,MAAM;mBACI;WAVrC,QAAM;EASqB,YAAA,MAAM,iBACI,UAAU,kBAC/B,OAAO;EAMhC,kBAAkB,oBAAoB;MAKlC,YAAY;MAIZ,WAAW;UAIP;EAqDR,cAAc,QAAQ;EAmBtB,QAAQ,QAAQ;EAyEhB,MAAM,mBAAmB;EAMzB,QAAQ,eAAe;EAIvB,qBAAqB;EAIrB,0BAA0B;EAO1B,0BACE,iBAAiB,8BACjB,QAAQ;EAkBJ,SAAS;EAwBf;;UChQe;WACN;WACA,OAAO;WACP,UAAU;WACV,OAAO,KAAK;WACZ;WACA;;;cAwEE,4BAA4B;EAC3B,YAAA,OAAO;;cAMR;mBACkB;EAAA,YAAA,OAAO;EAEpC,OACE,MAAM,KAAK,0CACX,SAAS;EAUX,cAAc,SAAS,mBAAmB,SAAS;EAMnD,UACE,SAAS,mBACT,2BACC;EAWH,KAAK,OAAO,eAAe;EA0E3B,WAAW;EAWX,QAAQ,GACN,SAAS,kBACT;IACE;IACA;IACA;IACA,UAAU,WAAW,kBAAkB;KAEzC,QAAQ,eACP;EAqBH,QACE,OAAO,8BACP,QAAQ,cACR,oBACC,+BAA+B;EAmBlC,MACE,0BACA,kBACA,QAAQ;;cC5RC;mBAMkB;mBALZ;EAKY,YAAA,WAAW;EAExC,QAAQ,GAAG,WAAW,UAAU,KAAK,oBAAoB;;cCJ9C;UACH;mBACS;UACT;EAER,SAAS,qBAAqB;EAI9B,OAAO,KAAK;EAIZ,iBAAiB;EAKjB,iBAAiB,QAAQ,UAAU;EAUnC,KAAK,SAAS,mBAAmB;EAIjC,OAAO,SAAS,mBAAmB;EAWnC,KAAK,MAAM;EAIX,SACE,SAAS,kBACT,YAAS,gBACR;;cCsBQ;mBAKQ;mBACA;mBACA;mBALF;EAGE,YAAA,WAAW,gBACX,UAAU,gBACV,YAAY;UAGvB;EAoGR,eAAe,QAAQ,MAAM,0BAA0B;EAIvD,WAAW,SAAS,mBAAmB;EAiBvC,KAAK,QAAQ,MAAM,iBAAiB;;cCrLzB,kBAAkB,UAAU,WAAW;;mBAQJ;mBACJ;mBACK;mBACL;mBACK;mBACD;WAZrC;WACA,UAAU;WACV,KAAK;EAIyB,YAAA,SAAS,yBAAyB,IAC3B,UAAU,kBACd,OAAO,cACF,UAAU,mBACf,SAAS,cACJ,YAAY,mBACb,aAAa;EAiB3D,WAAW,QAAQ,QAAQ;EAI3B;aAEe;aACA;aACA;;EAcf,gBAAgB,QAAQ;EAUxB,cAAc,QAAQ,UAAU;EAIhC,aAAa,SAAS,mBAAmB;EAiBzC,YAAY,2BAA2B;EA0BvC,sBAAsB,GAAG,UAAU,QAAQ,KAAK,QAAQ;EA0BxD,eAAe,GAAG,UAAU,QAAQ,KAAK,QAAQ;EAiBjD,gBAAgB,GAAG,UAAU,QAAQ,KAAK,QAAQ;;cCrJvC,aAAY;cACZ,OAAQ;EACnB;EACA;EACA;EACA;MACE;iBACY,aAAa,GAAG,UAAU,gBAAgB,eACxD,QAAQ,oBAAoB,GAAG,gBAAgB,OAC7C,QAAQ,GAAG,UAAU,uBAAuB,YAAY;cAY/C;mBAIQ;mBACA;mBACA;mBACA;mBANF;EAGE,YAAA,UAAU,gBACV,SAAS,eACT,UAAU,mBACV,OAAO;EAGpB,SACJ,MAAM,WACN,WAAW,eACX,MAAM,eACN,OAAO,eACP,WAAW,kBACX,oBACC,QAAQ;;cC3CA,2BAA2B;mBAKC;mBAJtB;YACP;EAG6B,YAAA,MAAM,KAAK;EAGlD,YAAY,SAAS,mBAAmB;;cAI7B,qBAAqB;mBAEb;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;EANA,YAAA,WAAW,gBACX,SAAS,cACT,YAAY,mBACZ,UAAU,mBACV,WAAW,wBACX,OAAO,cACP,UAAU;EAGvB,YAAY,SAAS,mBAAmB;;cChCnC,sCAAsC;mBAKV;mBAJtB;YACP;EAG6B,YAAA,MAAM,KAAK;EAGlD,UAAU,SAAS,kBAAkB,MAAM,cAAc;;cAI9C,qBAAqB;mBAEb;mBACA;mBACA;mBACA;mBACA;EAJA,YAAA,WAAW,gBACX,SAAS,cACT,YAAY,mBACZ,OAAO,cACP,UAAU;EAG7B,UAAU,SAAS,kBAAkB,MAAM,cAAc;;iBCc3C,gBAAgB,GAC9B,YAAY,KAAK,oBAAoB,WAAW,wBAC/C,oBAAoB;iBAGP,mBAAmB,UAAU,cAAc,UAAU,IAAI;iBAGzD,gBAAgB,UAAU,eAAe,WAAW,IAAI;cCtB3D,uCAAM,uBAAAA;cACN,6CAAY,uBAAAA;cAEZ,cAAe;EAAY;OAAyB,kBAAA,UAAA,GAAA,QAAA,oBAAA,+BAAA,aAAA,wBAAA;cAKpD,kBAAmB,0CAAY,uBAAAC;cAE/B,sBACR,iBAAiB,kBAAkB,8CAAgB,uBAAAC;cAE3C,wDAAuB,uBAAAC;cAEvB,qBAAsB,+CAAc,uBAAAC;cAEpC,gDAAe,uBAAAC;cAEf,sBAAa,kBAAA,UAAA,GAAA,QAAA,oBAAA,+BAAA,aAAA,wBAAA;iBAMV,WACX,uBAAuB,oBACzB,iBAAiB;cAeP,WACR,uBAAuB,sBACzB;cACU,WACR,uBAAuB,sBACzB;cACU,cAAe,GAC1B,QAAQ,UAAU,IAClB,QAAQ,GACR,UAAU,uBACT,YAAY;cAyEF,wBAAuB;iBACpB,qBAAqB,UAAU,eAAe,GAAG;WACtD,MAAM;WACN;WACA,UAAU,WAAW,gBAAgB,OAAO;UAC7C;iBAGM,sBACd,cACA;WAAiB;UACV;cA2HI,mBAAoB,UAAU,8BACzC,QAAQ,aAAa,MAAM,eAC3B,UAAU,gBACT,oBAAoB;cACV,kBAAmB,UAAU,8BACxC,QAAQ,aAAa,MAAM,eAC3B,UAAU,gBACT,oBAAoB;cAqBV,iBAAkB,UAAU,oBACvC,QAAQ,GACR,UAAU,kBACT,sBAAsB;cAEZ,gBAAiB,UAAU,oBACtC,QAAQ,GACR,UAAU,kBACT,sBAAsB;cC1TZ;cACA,sBAAc;cAKd,mBAAW;iBAgBR,iBAAiB,IAAI,aACnC,UAAS,wBAAwB,KAChC,gBAAgB,iBAAiB;cAuLvB,eACX;EAAW;MACV;EAAc;;cAIJ,sBAAuB;EAClC;MACE,iBAAiB;cCvNR,wBAAyB,UAAU,mBAC9C,QAAQ,gBAAgB,OACvB,gBAAgB;cACN,gBAAiB,UAAU,mBACtC,WAAW,MACV,gBAAgB;cACN,cAAa;cACb,WAAY,SAAS,gBAAc;;iBCoShC,qBACd,MAAM,UACN,UAAU,qBAEV,4BACA,KAAK,KAAK,cAAc;iBC9IV,iBAAiB,aAAa;;UCpL7B;EACf,SAAS;;;UCIM;EACf,QAAQ,SAAS,UAAU,QAAQ;EACnC;IACE,WAAW;MACT,SAAS;MACT;QAAU;QAA8B;;MACxC;QACE;;EAEN,UAAU;;;UAGK;WACN,UAAU;WACV;;;UAKM;KACL,eAAe;EAAmB,MAAM;;KACxC,iBAAiB;EAAmB,YAAY,UAAU;IAClE,IACA;KACQ,sBAAsB;EAChC,iBAAiB,UAAU,eAAe;IAExC,IACA;KACQ,OAAO,gCAAgC,sBAC/C,iBACA,gBAAgB,sBACd,oBAAoB,KACpB;;KAGD;EACH,+BAA+B;EAC/B,4BAA4B;;KAElB,UAAU,KAAK;EAAY;IAAU,eAAe;;IAC5D,YAAY,KACZ;KACQ,OAAO,KAAK,UAAU;EAAa,YAAY;IAAM;KACrD,YAAY,gCAAgC,UAAU,OAAO;KAC7D,SAAS,gCAAgC,OAAO,OAAO;KACvD,UAAU,KAAK;EAAY;IAAQ;;;KAG1C,OAAO,KAAK,YAAW,WAAW,kBAClC,YAAY;EAAe,aAAa;KACvC,YAAY;KAGb,cAAc,GAAG,oBAAoB;EACxC,QAAQ,KAAK,UAAU;IAErB,OAAO;EAAa,oBAAoB;IACtC,YAAY;KAGN,iBAAiB,gCAC3B,4BACI,cAAc,OAAO,2BACrB;KACM,eAAe,gCACzB,4BACI,cAAc,OAAO,uBACrB;KAID,MAAM,KAAK;EAAY,WAAW;IAAQ;KACnC,aAAa,IAAI,qBAC1B,WAAW,MAAM,KAAK,MAAM,GAAG;EAAa,YAAY;IACrD,mBAEE,MAAM;KACT,WAAW,kBAAkB,IAAI,qBACnC,WAAW,MAAM,KAAK,MAAM,GAAG;EAAa,MAAM;IAAM,MAAM,GAAG,oBAC5D,MAAM;KACT,OAAO,qBAAqB,WAAW,gCAExC,OAAO,WAAW;;;;;KAKV,gBAAgB,MAAM,+BAE9B,+BACc,WAAW,kBAAiB,SAAS;KAE3C,gBAAgB,6BAA6B,2BACjC;EAElB,MAAM;EAAG,qBAAqB,cAAc,gBAAgB,OAAO;;KAC7D,qBAAqB,6BAC/B,gBAAgB;KAIb,UAAU,kCACS;;KAGZ,SACV,UAAU,oBACV,iCACE,mBAAmB,gBAAgB,0BAA0B,6CAC7D,YAAY,YAAY,YAAY,QAAQ,IAAI,IAAI;;KAGnD,cAAc,KAAK,mBACpB,OAAO,kBACP,sBACE,UAAU;EAA0B,eAAe;IACjD;KAGH,YAAY,UAAU,sBACzB,mBAAmB,WAAW,OACzB,cAAc,sBACb,uBACA,qBACE,QAAQ,cAAc,MACtB,cAAc,KAClB;;KAEM,iBACV,UAAU,oBACV,4CACE,WAAW,SAAS,GAAG,UAAU,YAAY;;KAErC,mBACV,UAAU,oBACV,iCACE,QAAQ,WAAW,SAAS,GAAG;KACvB,mBACV,UAAU,oBACV,kCAEA,MAAM,iBAAiB,GAAG,KAC1B,2BAA2B,8CACxB,mBAAmB,GAAG,MAAM,QAAQ,mBAAmB,GAAG;;KAGnD,uBAAuB,KAAK;EACtC;IAAW;;;KAID,sBAAsB;KACtB,gBAAgB,eAAe;KAC/B,gBAAgB,UAAU,iBAAiB,eAAe;UACrD,iBAAiB,IAAI,qBAAqB;WAChD;WACA,SAAS;;UC9HH;;EAEf,qBAAqB,aAAa;;EAElC,sBAAsB,aAAa;;KAEzB;WACD;WACA;;;UAIM;;EAEf;;EAEA;;;;;EAKA;;;;;;;EAOA;;EAEA,sBAAsB,aAAa;;;KAIzB,yBAAyB,UAAU,WAAW;;EAExD,MAAM;;EAEN;;;;;;;;EAQA,+BAA+B;;EAE/B,OAAO;;EAEP,UAAU;;EAEV,cAAc;;EAEd,SAAS;;EAET,SAAS;;EAET;IACE,cAAc;UAED;;;;;;EAMf;;UAGe;;;;;;;;;EASf;;UAGe;;;;;EAKf;;;;;;;;EAQA;;;KAIU,cAAc,UAAU,YAClC,UAAU,UAAU;EACd,UAAU,wBAAwB,UAAU;;EAE5C,UACK,wBAAwB,UAAU;IACjC,SAAS,GAAG,UAAU;;;UAKnB,wBAAwB;;EAEvC,UAAU,SAAS;;EAEnB;;;;;;;EAOA;;UAGe;;EAEf;;EAEA;;EAEA,kBAAkB;;EAElB;;;;;;EAMA;;EAEA;;KAGU,0BACV;WACW,SAAS;WACT;WACA;GAEX,OAAO,UAAU,YAAY,QAAQ,cAClC,QAAQ;KAED,wBAAwB,UAAU,YAC5C,0BAA0B,yBAAyB;UAEpC,6BACf,UAAU,kBACF;EACR,UAAU;EACV,mBAAmB,iBAAiB;EACpC,gBACK,gBACA,wBAAwB,KAAK,QAAQ,wBAAwB;;;KAIxD,wBAAwB,UAAU,YAC5C,yBAAyB,QAErB,YAAY,0BAA0B,yBACpC,uCAAuC;UAE9B,uCAAuC;WAC7C,aAAa;;;KAGZ,qBAAqB,KAAK,4BAClC,UAAU;EAEN,MAAM;;;KAKF,aAAa,KAAK,KAAK,KAAK,IAAI,oBAAoB;UAC/C,oBAAoB;YACzB;WACD;aACM,UAAU,KAAK;;aAEf,gBAAgB,gBAAgB,IAAI,QAAQ;aAC5C,kBAAkB;;aAElB,aAAa,eAAe;;WAClC,qBAAqB;WACrB,UAAU;;WAEV,mBAAmB;;UAGb;WACN;;;;;;;WAOA;;WAEA;;;;;WAKA,uBAAuB;;WAEvB;;;;;;WAMA;;WAEA;;WAEA,SAAS;;WAET;aACE;aACA;;;;;;;WAOF;;WAEA;;WAEA;WACA;;KAKC,oBACR;WACW;;WACA;;;;;;UAME;EACf,QACE,MAAM,eACN,SAAS,oBACR,QAAQ;;UAEI;WACN,MAAM;WACN;;WAEA,SAAS;;WAET;;;;;;WAMA;aAAwB;;;;UAIlB;EACf,OAAO,GACL,QAAQ,oBAAoB,SAC5B,QAAQ,GACR,SAAS,uBACR,QAAQ;;UAGI;WACN;;WAEA,sBAAsB;;WAEtB;;UAGM;;EAEf;;EAEA;;EAEA;;EAEA;;UAEe;EACf;EACA;;KAEU,iBAAiB,KAAK;;;;;KAKtB,oBAAoB,qBAC9B,WAAW,KAAK,gBAAgB,gBAEhC,gBACA,sBACA,YAAY,wBAAwB;;KAG1B,sBACV,UAAU,oBACV,kCACG,UAAU,mBAAmB,GAAG,KACnC,gBACA,sBACA,YAAY,wBAAwB;KAE1B;UAGK;;EAEf;;UAae;;EAEf,YAAY,KAAK;IAAoB;;;UAGtB;;EAEf,YAAY;IAAW;IAAa,KAAK;;;UAiJ1B;WACN;WACA;;WAEA;;;;;EAKT,OAAO,QAAQ;;;UAIA;WACN;;;KAKC,4BAA4B;UAEvB;EACf,SAAS,cAAc;;;;;EAKvB,GAAG,cAAc,KAAK,sBAAsB;;UAG7B;WACN;;WAEA;WACA;WACA;;UAEM;WACN;WACA,MAAM;;WAEN,SAAS;;WAET;WACA;;WAEA;aACE;aACA;;;WAGF,mBAAmB;WACnB;aACE;aACA;;WAEF,kBAAkB,KACzB;;WAIO,mBAAmB,KAAK;;UAElB;WACN,MAAM;;WAEN;;WAEA;;UAGM;;WAEN;;;;;;WAMA;aACE;aACA;;;EAGX,SAAS,SAAS;;;;;;;;;EASlB,SAAS,KAAK;;;;;;;EAOd,MAAM,KAAK,8BAA8B;;WAEhC,UAAU;;EAEnB,YAAY,SAAS,sBAAsB;;EAE3C,UAAU,SAAS;;;;;EAKnB,mBACE,iBAAiB,8BACjB,mBAAmB;;EAGrB,QACE,KAAK,6BACK,eAAe,iBAAiB;;UAG7B;;WAEN;;WAEA;;WAEA;;WAEA;;UAGM;;;;;;WAMN;WACA;;UAGM;WACN,SAAS;WACT,QAAQ;;EAEjB,MAAM,mBAAmB;;UAGV;WACN,SAAS;WACT,QAAQ;WACR,SAAS;;UAGH;WACN;;WAEA;WACA;;WAEA;;EAET,QAAQ;;;;;EAKR,OAAO,SAAS,qBAAqB,QAAQ;;EAE7C,mBAAmB;;UAGJ;WACN;;WAEA;;WAEA,SAAS;;WAET,MAAM,aAAa,eAAe;;WAElC;;WAEA;;WAEA,SAAS;;UAGH;;;;;;EAMf,UAAU;;;;;;;;EAQV,OAAO;;EAEP,IAAI;;EAEJ,QAAQ,eAAe;;EAEvB,QAAQ;aAA0B;aAAyB;;;EAE3D,SAAS;;EAET,MAAM,cAAc;;EAEpB,WAAW,cAAc,eAAe;;EAExC,aAAa;;UAGE;;EAEf,OAAO;;UAGQ;;WAEN;;;;;EAKT,QAAQ,SAAS;;;;;;EAMjB,SAAS,SAAS,kBAAkB,KAAK,eAAe;;EAExD,YAAY,SAAS,aAAa,SAAS;;;;;;;;EAQ3C,qBACE,OAAO,gCAAgC,8BACvC,SAAS,kBACT;aAAiB;;;;;;EAMnB,UAAU,KAAK,oCAAoC;;;;;;;;EASnD,kBAAkB,QAAQ,UAAU;;;;;;;EAOpC,SAAS,SAAS,mBAAmB;;WAE5B;aAAsB;;;EAE/B,QACE,KAAK,6BACK,eAAe,iBAAiB;;UAG7B;;;;;WAKN;;;;;;;;;;WAUA;;WAEA;;WAEA;;;;;;WAMA,UAAU;;;;;;EAMnB,WAAW;;WAEF;;WAEA,SAAS;;WAET;aAAqB;aAAyB;;;EAEvD,MAAM;;WAEG,UAAU;;UAGJ;;;;;;WAMN;;;;;EAKT,WAAW;;WAEF;;WAEA;;;UAIM;;WAEN;;;;;;;;WAQA;;;;;;;WAOA,YAAY,6BAA6B;;;;;;WAMzC,kBAAkB;;UAGZ;;WAEN,MAAM;;UAGA;WACN,WAAW;WACX,WAAW;WACX,WAAW;WACX;;WAGA,SAAS,QAAQ,UAAU,mBAAmB;;;;;EAKvD,MAEE,QAAQ,UACR,4BACA,OAAO,YACP,SAAS;WAEF,QAAQ;;;;;;;;;KASP;UACK;;WAEN;;WAEA;;WAEA;;WAEA;;;;;WAKA;;UAGM;WACN;;WAEA;;WAEA;;;;;WAKA,aAAa;;UAGP;;EAEf,OAAO,aAAa,SAAS;;WAEpB;;UAGM,gBAAgB,UAAU,oBAAoB;WACpD;;WAEA,gBAAgB;;;;;WAKhB;;;;;WAKA;;WAEA;aACE;aACA;;;;;;;;WAQF;;;;;;WAMA;;;;;WAKA;aACE;aACA;;;EAGX,WAAW,SAAS;;;;;EAKpB,QAAQ,SAAS,mBAAmB,QAAQ,gBAAgB;;EAE5D,QACE,KAAK,6BACK,eAAe,iBAAiB;;KAGlC,gBAAgB,UAAU,oBAAoB;WAC3C;WAAmC,WAAW;;WAC9C;;WACA;WAA8B,SAAS;;UAErC;WACN,SAAS;WACT,SAAS;WACT;WACA;aAAqB;aAAyB;;WAC9C;WACA,MAAM;;EAEf,KAAK,GAAG,+BAA+B,eAAe,QAAQ,KAAK,QAAQ;;;UAI5D,WAAW,UAAU,WAAW;WACtC;WACA,UAAU;WACV,KAAK;EACd,WAAW,QAAQ;EACnB,UAAU,aAAa;;EAEvB,IAAI,GAAG,MAAM,WAAW,UAAU,QAAQ,KAAK,QAAQ;;EAEvD,YACE,SAAS,iBACT,0BACC,QAAQ;;;;;EAKX,mBAAmB;;EAEnB,gBAAgB,gBAAgB,UAAU,UAAU;;UAErC;;WAEN,SAAS;;;;;WAKT;;WAEA,gBAAgB;;WAEhB;;;UAGM;WACN;WACA;WACA;WACA;;WAEA;;WAEA;aAAsB;;WACtB;aACE;aACA;aACA;aACA;;aAEA;eAAuB;;aACvB,uCAEH,UAAU;aACP;eACE;eACA;iBAAmB;;;aAErB;eAAwB;;aACxB;eACE;iBACE;iBACA;;eAEF;eACA;eACA;;;;WAIJ;IACP,aAAa,iBAAiB;eACnB;eACA;eACA;eACA,aAAa;;;WAGjB,aAAa,SACpB;aAGa;aACA;eACE;eACA;;;WAKR;aACE;aACA;aACA;;WAEF;IACP,QAAQ;MACN;MACA;QAAkB;QAAe;;QAC/B;IACJ,WAAW;MACT;MACA;QAAkB;QAAe;;MACjC,QAAQ;QACN;;EAEN,UAAU;EACV,UAAU;EACV,gBACE,aACA;IAAa;;;UAIA,oBACf,kBACA,UAAU,oBAAoB;;WAGrB;WACA;;aAEE;;;;;;;aAOA,sBAAsB;;aAEtB;;aAEA;;aAEA;;;EAGX,SACE,QAAQ,QACR,SAAS,qBAAqB,KAC7B,wBAAwB,QAAQ;;EAEnC,UAAU,QAAQ,QAAQ,MAAM,2BAA2B;;EAE3D,QACE,KAAK,6BACK,eAAe,iBAAiB;;;;;;KAOlC,UAAU,UAClB,oBAAoB,eACpB,KAAK,oBAAoB,gBACzB;UAEa,YAAY;WAClB,QAAQ,UAAU;WAClB,QAAQ;WACR;;WAEA;;WAEA;;KAEC,kBACR;WACW,gBAAgB;;WAChB,gBAAgB;;KAEnB;WACG;;WAEA;WACA;WACA;WACA;WACA;;UAGE,qBACf,UAAU,oBAAoB;WAErB,WAAW;WACX;WACA;WACA,SAAS;WACT,SAAS;WACT;aAAqB;aAAyB;;EACvD,MAAM;WACG;aAAoB,OAAO;aAAe;;WAC1C,MAAM;;;;;EAKf,KAAK,GAAG,+BAA+B,eAAe,QAAQ,KAAK,QAAQ;;EAE3E,QAAQ,cAAc;WACb,WAAW;;UAGL;WACN,MAAM;WACN,SAAS;WACT"}