@shipdit/cli 0.0.2

package/dist/index.mjs

@@ -0,0 +1,4114 @@
+#!/usr/bin/env node
+import { Command, CommanderError } from "commander";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { z } from "zod";
+import { createJiti } from "jiti";
+
+//#region src/lib/config.ts
+function readJsonFile(filePath) {
+	if (!fs.existsSync(filePath)) return null;
+	return JSON.parse(fs.readFileSync(filePath, "utf8"));
+}
+function globalConfigDir() {
+	const xdg = process.env.XDG_CONFIG_HOME;
+	if (xdg) return path.join(xdg, "shipd");
+	return path.join(os.homedir(), ".config", "shipd");
+}
+function ensureDir(dir) {
+	fs.mkdirSync(dir, { recursive: true });
+}
+function loadGlobalConfig() {
+	return readJsonFile(path.join(globalConfigDir(), "config.json")) ?? {};
+}
+function saveGlobalConfig(config) {
+	const dir = globalConfigDir();
+	ensureDir(dir);
+	fs.writeFileSync(path.join(dir, "config.json"), `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
+}
+function loadCredentials() {
+	return readJsonFile(path.join(globalConfigDir(), "credentials.json")) ?? {};
+}
+function saveCredentials(credentials) {
+	const dir = globalConfigDir();
+	ensureDir(dir);
+	fs.writeFileSync(path.join(dir, "credentials.json"), `${JSON.stringify(credentials, null, 2)}\n`, { mode: 384 });
+}
+function clearCredentials() {
+	const file = path.join(globalConfigDir(), "credentials.json");
+	if (fs.existsSync(file)) fs.unlinkSync(file);
+}
+function findProjectRoot(start = process.cwd()) {
+	let current = path.resolve(start);
+	while (true) {
+		if (fs.existsSync(path.join(current, "shipd.config.ts")) || fs.existsSync(path.join(current, ".shipd", "config.json"))) return current;
+		const parent = path.dirname(current);
+		if (parent === current) return process.cwd();
+		current = parent;
+	}
+}
+function loadProjectConfig(projectRoot, configPath) {
+	return readJsonFile(configPath ?? path.join(projectRoot, ".shipd", "config.json")) ?? {};
+}
+function resolveRuntimeConfig(flags) {
+	const cwd = process.cwd();
+	const projectRoot = findProjectRoot(cwd);
+	const projectConfig = loadProjectConfig(projectRoot, flags.config);
+	const globalConfig = loadGlobalConfig();
+	const credentials = loadCredentials();
+	const ci = flags.ci === true || flags.yes === true || process.env.CI === "1" || process.env.CI === "true" || process.env.SHIPD_CI === "1";
+	const defaultConfigFile = fs.existsSync(path.join(projectRoot, "shipd.config.ts")) ? path.join(projectRoot, "shipd.config.ts") : path.join(cwd, "shipd.config.ts");
+	return {
+		apiUrl: flags.apiUrl ?? process.env.SHIPD_API_URL ?? projectConfig.apiUrl ?? globalConfig.apiUrl ?? credentials.apiUrl ?? "http://localhost:8000",
+		appUrl: process.env.SHIPD_APP_URL ?? projectConfig.appUrl ?? globalConfig.appUrl ?? "http://localhost:5173",
+		apiKey: process.env.SHIPD_API_KEY ?? credentials.apiKey,
+		org: flags.org ?? process.env.SHIPD_ORG ?? projectConfig.org ?? globalConfig.org,
+		project: flags.project ?? process.env.SHIPD_PROJECT ?? projectConfig.project ?? globalConfig.project,
+		env: flags.env ?? process.env.SHIPD_ENV ?? projectConfig.env ?? globalConfig.env,
+		configFile: flags.flagsConfig ? path.resolve(flags.flagsConfig) : projectConfig.configFile ?? defaultConfigFile,
+		typesOut: projectConfig.typesOut ?? "src/generated/flags.ts",
+		yes: ci,
+		json: flags.json === true,
+		cwd,
+		globalDir: globalConfigDir(),
+		projectDir: projectRoot
+	};
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/hono@4.13.0/node_modules/hono/dist/utils/cookie.js
+var validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/;
+var _serialize = (name, value, opt = {}) => {
+	if (!validCookieNameRegEx.test(name)) throw new Error("Invalid cookie name");
+	let cookie = `${name}=${value}`;
+	if (name.startsWith("__Secure-") && !opt.secure) throw new Error("__Secure- Cookie must have Secure attributes");
+	if (name.startsWith("__Host-")) {
+		if (!opt.secure) throw new Error("__Host- Cookie must have Secure attributes");
+		if (opt.path !== "/") throw new Error("__Host- Cookie must have Path attributes with \"/\"");
+		if (opt.domain) throw new Error("__Host- Cookie must not have Domain attributes");
+	}
+	for (const key of [
+		"domain",
+		"path",
+		"sameSite",
+		"priority"
+	]) if (opt[key] && /[;\r\n]/.test(opt[key])) throw new Error(`${key} must not contain ";", "\\r", or "\\n"`);
+	if (opt && typeof opt.maxAge === "number" && opt.maxAge >= 0) {
+		if (opt.maxAge > 3456e4) throw new Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");
+		cookie += `; Max-Age=${opt.maxAge | 0}`;
+	}
+	if (opt.domain && opt.prefix !== "host") cookie += `; Domain=${opt.domain}`;
+	if (opt.path) cookie += `; Path=${opt.path}`;
+	if (opt.expires) {
+		if (opt.expires.getTime() - Date.now() > 3456e7) throw new Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");
+		cookie += `; Expires=${opt.expires.toUTCString()}`;
+	}
+	if (opt.httpOnly) cookie += "; HttpOnly";
+	if (opt.secure) cookie += "; Secure";
+	if (opt.sameSite) cookie += `; SameSite=${opt.sameSite.charAt(0).toUpperCase() + opt.sameSite.slice(1)}`;
+	if (opt.priority) cookie += `; Priority=${opt.priority.charAt(0).toUpperCase() + opt.priority.slice(1)}`;
+	if (opt.partitioned) {
+		if (!opt.secure) throw new Error("Partitioned Cookie must have Secure attributes");
+		cookie += "; Partitioned";
+	}
+	return cookie;
+};
+var serialize = (name, value, opt) => {
+	value = encodeURIComponent(value);
+	return _serialize(name, value, opt);
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/hono@4.13.0/node_modules/hono/dist/client/utils.js
+var mergePath = (base, path) => {
+	base = base.replace(/\/+$/, "");
+	base = base + "/";
+	path = path.replace(/^\/+/, "");
+	return base + path;
+};
+var replaceUrlParam = (urlString, params) => {
+	for (const [k, v] of Object.entries(params)) {
+		const reg = new RegExp("/:" + k + "(?:{[^/]+})?\\??(?=/|$)");
+		urlString = urlString.replace(reg, v ? `/${v}` : "");
+	}
+	return urlString;
+};
+var buildSearchParams = (query) => {
+	const searchParams = new URLSearchParams();
+	for (const [k, v] of Object.entries(query)) {
+		if (v === void 0) continue;
+		if (Array.isArray(v)) for (const v2 of v) searchParams.append(k, v2);
+		else searchParams.set(k, v);
+	}
+	return searchParams;
+};
+var replaceUrlProtocol = (urlString, protocol) => {
+	switch (protocol) {
+		case "ws": return urlString.replace(/^http/, "ws");
+		case "http": return urlString.replace(/^ws/, "http");
+	}
+};
+var removeIndexString = (urlString) => {
+	if (/^https?:\/\/[^\/]+?\/index(?=\?|$)/.test(urlString)) return urlString.replace(/\/index(?=\?|$)/, "/");
+	return urlString.replace(/\/index(?=\?|$)/, "");
+};
+function isObject(item) {
+	return typeof item === "object" && item !== null && !Array.isArray(item);
+}
+function deepMerge(target, source) {
+	if (!isObject(target) && !isObject(source)) return source;
+	const merged = { ...target };
+	for (const key in source) {
+		const value = source[key];
+		if (isObject(merged[key]) && isObject(value)) merged[key] = deepMerge(merged[key], value);
+		else merged[key] = value;
+	}
+	return merged;
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/hono@4.13.0/node_modules/hono/dist/client/client.js
+var createProxy = (callback, path) => {
+	return new Proxy(() => {}, {
+		get(_obj, key) {
+			if (typeof key !== "string" || key === "then") return;
+			return createProxy(callback, [...path, key]);
+		},
+		apply(_1, _2, args) {
+			return callback({
+				path,
+				args
+			});
+		}
+	});
+};
+var ClientRequestImpl = class {
+	url;
+	method;
+	buildSearchParams;
+	queryParams = void 0;
+	pathParams = {};
+	rBody;
+	cType = void 0;
+	constructor(url, method, options) {
+		this.url = url;
+		this.method = method;
+		this.buildSearchParams = options.buildSearchParams;
+	}
+	fetch = async (args, opt) => {
+		if (args) {
+			if (args.query) this.queryParams = this.buildSearchParams(args.query);
+			if (args.form) {
+				const form = new FormData();
+				for (const [k, v] of Object.entries(args.form)) {
+					if (v === void 0) continue;
+					if (Array.isArray(v)) for (const v2 of v) form.append(k, v2);
+					else form.append(k, v);
+				}
+				this.rBody = form;
+			}
+			if (args.json) {
+				this.rBody = JSON.stringify(args.json);
+				this.cType = "application/json";
+			}
+			if (args.param) this.pathParams = args.param;
+		}
+		let methodUpperCase = this.method.toUpperCase();
+		const headerValues = {
+			...args?.header,
+			...typeof opt?.headers === "function" ? await opt.headers() : opt?.headers
+		};
+		if (args?.cookie) {
+			const cookies = [];
+			for (const [key, value] of Object.entries(args.cookie)) cookies.push(serialize(key, value, { path: "/" }));
+			headerValues["Cookie"] = cookies.join(",");
+		}
+		if (this.cType) headerValues["Content-Type"] = this.cType;
+		const headers = new Headers(headerValues ?? void 0);
+		let url = this.url;
+		url = removeIndexString(url);
+		url = replaceUrlParam(url, this.pathParams);
+		if (this.queryParams) url = url + "?" + this.queryParams.toString();
+		methodUpperCase = this.method.toUpperCase();
+		const setBody = !(methodUpperCase === "GET" || methodUpperCase === "HEAD");
+		return (opt?.fetch || fetch)(url, {
+			body: setBody ? this.rBody : void 0,
+			method: methodUpperCase,
+			headers,
+			...opt?.init
+		});
+	};
+};
+var hc = (baseUrl, options) => createProxy(function proxyCallback(opts) {
+	const buildSearchParamsOption = options?.buildSearchParams ?? buildSearchParams;
+	const parts = [...opts.path];
+	const lastParts = parts.slice(-3).reverse();
+	if (lastParts[0] === "toString") {
+		if (lastParts[1] === "name") return lastParts[2] || "";
+		return proxyCallback.toString();
+	}
+	if (lastParts[0] === "valueOf") {
+		if (lastParts[1] === "name") return lastParts[2] || "";
+		return proxyCallback;
+	}
+	let method = "";
+	if (/^\$/.test(lastParts[0])) {
+		const last = parts.pop();
+		if (last) method = last.replace(/^\$/, "");
+	}
+	const path = parts.join("/");
+	const url = mergePath(baseUrl, path);
+	if (method === "url" || method === "path") {
+		let result = url;
+		if (opts.args[0]) {
+			if (opts.args[0].param) result = replaceUrlParam(url, opts.args[0].param);
+			if (opts.args[0].query) result = result + "?" + buildSearchParamsOption(opts.args[0].query).toString();
+		}
+		result = removeIndexString(result);
+		if (method === "url") return new URL(result);
+		return result.slice(baseUrl.replace(/\/+$/, "").length).replace(/^\/?/, "/");
+	}
+	if (method === "ws") {
+		const webSocketUrl = replaceUrlProtocol(opts.args[0] && opts.args[0].param ? replaceUrlParam(url, opts.args[0].param) : url, "ws");
+		const targetUrl = new URL(webSocketUrl);
+		const queryParams = opts.args[0]?.query;
+		if (queryParams) Object.entries(queryParams).forEach(([key, value]) => {
+			if (Array.isArray(value)) value.forEach((item) => targetUrl.searchParams.append(key, item));
+			else targetUrl.searchParams.set(key, value);
+		});
+		const establishWebSocket = (...args) => {
+			if (options?.webSocket !== void 0 && typeof options.webSocket === "function") return options.webSocket(...args);
+			return new WebSocket(...args);
+		};
+		return establishWebSocket(targetUrl.toString());
+	}
+	const req = new ClientRequestImpl(url, method, { buildSearchParams: buildSearchParamsOption });
+	if (method) {
+		options ??= {};
+		const reqOptions = { ...opts.args[1] };
+		const baseHeaders = options.headers;
+		const reqHeaders = reqOptions.headers;
+		if (baseHeaders && reqHeaders) reqOptions.headers = async () => ({
+			...typeof baseHeaders === "function" ? await baseHeaders() : baseHeaders,
+			...typeof reqHeaders === "function" ? await reqHeaders() : reqHeaders
+		});
+		const args = deepMerge(options, reqOptions);
+		return req.fetch(opts.args[0], args);
+	}
+	return req;
+}, []);
+
+//#endregion
+//#region ../api-client/dist/index.mjs
+const t$2 = [
+	`unauthenticated`,
+	`forbidden`,
+	`not_found`,
+	`conflict`,
+	`validation_error`,
+	`internal`
+];
+function n$2(e) {
+	if (typeof e != `object` || !e || !(`error` in e)) return !1;
+	let t = e.error;
+	if (typeof t != `object` || !t) return !1;
+	let n = t;
+	return typeof n.code == `string` && typeof n.message == `string` && typeof n.requestId == `string`;
+}
+var r$1 = class e extends Error {
+	code;
+	status;
+	requestId;
+	details;
+	constructor(e) {
+		super(e.message), this.name = `ShipdApiError`, this.code = e.code, this.status = e.status, this.requestId = e.requestId, this.details = e.details;
+	}
+	static fromResponse(r, i) {
+		return n$2(i) ? new e({
+			code: t$2.includes(i.error.code) ? i.error.code : `unknown`,
+			message: i.error.message,
+			status: r,
+			requestId: i.error.requestId,
+			details: i.error.details
+		}) : new e({
+			code: `unknown`,
+			message: `Request failed with status ${r}`,
+			status: r,
+			requestId: `unknown`,
+			details: i
+		});
+	}
+};
+async function i$1(e) {
+	let t;
+	try {
+		t = await e.json();
+	} catch {
+		throw new r$1({
+			code: `internal`,
+			message: `Invalid JSON response`,
+			status: e.status,
+			requestId: `unknown`
+		});
+	}
+	if (!e.ok) throw r$1.fromResponse(e.status, t);
+	if (typeof t != `object` || !t || !(`data` in t)) throw new r$1({
+		code: `internal`,
+		message: `Malformed success response`,
+		status: e.status,
+		requestId: `unknown`,
+		details: t
+	});
+	return t.data;
+}
+const a$1 = (...t) => hc(...t);
+const o$1 = (...t) => hc(...t);
+const s$1 = (...t) => hc(...t);
+const c$2 = (...t) => hc(...t);
+const l$2 = (...t) => hc(...t);
+const u$1 = (...t) => hc(...t);
+const d$1 = (...t) => hc(...t);
+const f$1 = (...t) => hc(...t);
+const p$1 = (...t) => hc(...t);
+function m$1(e) {
+	return `${e.replace(/\/+$/, ``)}/api/v1/rpc`;
+}
+function h$1(e) {
+	return {
+		...e.fetch ? { fetch: e.fetch } : {},
+		init: { credentials: e.client === `dashboard` ? `include` : `same-origin` },
+		headers: async () => {
+			let t = new Headers(await e.getHeaders?.());
+			return t.set(`x-shipd-client`, e.client), Object.fromEntries(t.entries());
+		}
+	};
+}
+async function g$1(e, t) {
+	return i$1(await e({ json: t }));
+}
+function _$1(e) {
+	let t = m$1(e.baseUrl), n = h$1(e), r = a$1(t, n), i = o$1(t, n), _ = s$1(t, n), v = c$2(t, n), y = l$2(t, n), b = u$1(t, n), x = d$1(t, n), S = f$1(t, n), C = p$1(t, n);
+	return {
+		me: { get: (e = {}) => g$1(r.me.$post, e) },
+		project: {
+			list: (e = {}) => g$1(i.project.list.$post, e),
+			create: (e) => g$1(i.project.create.$post, e),
+			update: (e) => g$1(i.project.update.$post, e),
+			archive: (e) => g$1(i.project.archive.$post, e)
+		},
+		environment: {
+			list: (e) => g$1(_.environment.list.$post, e),
+			create: (e) => g$1(_.environment.create.$post, e),
+			update: (e) => g$1(_.environment.update.$post, e),
+			archive: (e) => g$1(_.environment.archive.$post, e)
+		},
+		flag: {
+			list: (e) => g$1(v.flag.list.$post, e),
+			get: (e) => g$1(v.flag.get.$post, e),
+			create: (e) => g$1(v.flag.create.$post, e),
+			update: (e) => g$1(v.flag.update.$post, e),
+			archive: (e) => g$1(v.flag.archive.$post, e),
+			updateEnvironment: (e) => g$1(v.flag.updateEnvironment.$post, e),
+			toggleEnvironment: (e) => g$1(v.flag.toggleEnvironment.$post, e),
+			pull: (e) => g$1(v.flag.pull.$post, e),
+			diff: (e) => g$1(v.flag.diff.$post, e),
+			push: (e) => g$1(v.flag.push.$post, e)
+		},
+		apiKey: {
+			list: (e = {}) => g$1(y.apiKey.list.$post, e),
+			create: (e) => g$1(y.apiKey.create.$post, e),
+			revoke: (e) => g$1(y.apiKey.revoke.$post, e)
+		},
+		sdkKey: {
+			list: (e = {}) => g$1(b.sdkKey.list.$post, e),
+			create: (e) => g$1(b.sdkKey.create.$post, e),
+			revoke: (e) => g$1(b.sdkKey.revoke.$post, e)
+		},
+		evaluatedEntity: {
+			list: (e) => g$1(x.evaluatedEntity.list.$post, e),
+			get: (e) => g$1(x.evaluatedEntity.get.$post, e),
+			delete: (e) => g$1(x.evaluatedEntity.delete.$post, e)
+		},
+		snapshot: { publish: (e) => g$1(S.snapshot.publish.$post, e) },
+		device: { authorize: (e) => g$1(C.device.authorize.$post, e) },
+		raw: {
+			me: r,
+			project: i,
+			environment: _,
+			flag: v,
+			apiKey: y,
+			sdkKey: b,
+			evaluatedEntity: x,
+			snapshot: S,
+			device: C
+		}
+	};
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_39d811f210df3a5f20302036ab91db01/node_modules/@better-auth/core/dist/utils/error-codes.mjs
+function defineErrorCodes(codes) {
+	return Object.fromEntries(Object.entries(codes).map(([key, value]) => [key, {
+		code: key,
+		message: value,
+		toString: () => key
+	}]));
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-call@1.3.7_zod@4.4.3/node_modules/better-call/dist/error.mjs
+function isErrorStackTraceLimitWritable() {
+	const desc = Object.getOwnPropertyDescriptor(Error, "stackTraceLimit");
+	if (desc === void 0) return Object.isExtensible(Error);
+	return Object.prototype.hasOwnProperty.call(desc, "writable") ? desc.writable : desc.set !== void 0;
+}
+/**
+* Hide internal stack frames from the error stack trace.
+*/
+function hideInternalStackFrames(stack) {
+	const lines = stack.split("\n    at ");
+	if (lines.length <= 1) return stack;
+	lines.splice(1, 1);
+	return lines.join("\n    at ");
+}
+/**
+* Creates a custom error class that hides stack frames.
+*/
+function makeErrorForHideStackFrame(Base, clazz) {
+	class HideStackFramesError extends Base {
+		#hiddenStack;
+		constructor(...args) {
+			if (isErrorStackTraceLimitWritable()) {
+				const limit = Error.stackTraceLimit;
+				Error.stackTraceLimit = 0;
+				super(...args);
+				Error.stackTraceLimit = limit;
+			} else super(...args);
+			const stack = (/* @__PURE__ */ new Error()).stack;
+			if (stack) this.#hiddenStack = hideInternalStackFrames(stack.replace(/^Error/, this.name));
+		}
+		get errorStack() {
+			return this.#hiddenStack;
+		}
+	}
+	Object.defineProperty(HideStackFramesError.prototype, "constructor", {
+		get() {
+			return clazz;
+		},
+		enumerable: false,
+		configurable: true
+	});
+	return HideStackFramesError;
+}
+const statusCodes = {
+	OK: 200,
+	CREATED: 201,
+	ACCEPTED: 202,
+	NO_CONTENT: 204,
+	MULTIPLE_CHOICES: 300,
+	MOVED_PERMANENTLY: 301,
+	FOUND: 302,
+	SEE_OTHER: 303,
+	NOT_MODIFIED: 304,
+	TEMPORARY_REDIRECT: 307,
+	BAD_REQUEST: 400,
+	UNAUTHORIZED: 401,
+	PAYMENT_REQUIRED: 402,
+	FORBIDDEN: 403,
+	NOT_FOUND: 404,
+	METHOD_NOT_ALLOWED: 405,
+	NOT_ACCEPTABLE: 406,
+	PROXY_AUTHENTICATION_REQUIRED: 407,
+	REQUEST_TIMEOUT: 408,
+	CONFLICT: 409,
+	GONE: 410,
+	LENGTH_REQUIRED: 411,
+	PRECONDITION_FAILED: 412,
+	PAYLOAD_TOO_LARGE: 413,
+	URI_TOO_LONG: 414,
+	UNSUPPORTED_MEDIA_TYPE: 415,
+	RANGE_NOT_SATISFIABLE: 416,
+	EXPECTATION_FAILED: 417,
+	"I'M_A_TEAPOT": 418,
+	MISDIRECTED_REQUEST: 421,
+	UNPROCESSABLE_ENTITY: 422,
+	LOCKED: 423,
+	FAILED_DEPENDENCY: 424,
+	TOO_EARLY: 425,
+	UPGRADE_REQUIRED: 426,
+	PRECONDITION_REQUIRED: 428,
+	TOO_MANY_REQUESTS: 429,
+	REQUEST_HEADER_FIELDS_TOO_LARGE: 431,
+	UNAVAILABLE_FOR_LEGAL_REASONS: 451,
+	INTERNAL_SERVER_ERROR: 500,
+	NOT_IMPLEMENTED: 501,
+	BAD_GATEWAY: 502,
+	SERVICE_UNAVAILABLE: 503,
+	GATEWAY_TIMEOUT: 504,
+	HTTP_VERSION_NOT_SUPPORTED: 505,
+	VARIANT_ALSO_NEGOTIATES: 506,
+	INSUFFICIENT_STORAGE: 507,
+	LOOP_DETECTED: 508,
+	NOT_EXTENDED: 510,
+	NETWORK_AUTHENTICATION_REQUIRED: 511
+};
+var InternalAPIError = class extends Error {
+	constructor(status = "INTERNAL_SERVER_ERROR", body = void 0, headers = {}, statusCode = typeof status === "number" ? status : statusCodes[status]) {
+		super(body?.message, body?.cause ? { cause: body.cause } : void 0);
+		this.status = status;
+		this.body = body;
+		this.headers = headers;
+		this.statusCode = statusCode;
+		this.name = "APIError";
+		this.status = status;
+		this.headers = headers;
+		this.statusCode = statusCode;
+		this.body = body;
+	}
+};
+const APIError = makeErrorForHideStackFrame(InternalAPIError, Error);
+
+//#endregion
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_39d811f210df3a5f20302036ab91db01/node_modules/@better-auth/core/dist/error/index.mjs
+var BetterAuthError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "BetterAuthError";
+		this.message = message;
+		this.stack = "";
+	}
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/access/access.mjs
+function unknownResourceResponse(requestedResource) {
+	return {
+		success: false,
+		error: `You are not allowed to access resource: ${requestedResource}`
+	};
+}
+function unauthorizedResourceResponse(requestedResource) {
+	return {
+		success: false,
+		error: `unauthorized to access resource "${requestedResource}"`
+	};
+}
+function normalizeConnector(connector) {
+	return connector === "OR" ? "OR" : "AND";
+}
+function isActionList(actions) {
+	return Array.isArray(actions);
+}
+function normalizeActionRequest(requestedActions) {
+	if (isActionList(requestedActions)) return {
+		actions: requestedActions,
+		connector: "AND"
+	};
+	if (!requestedActions || typeof requestedActions !== "object") throw new BetterAuthError("Invalid access control request");
+	const { actions, connector } = requestedActions;
+	if (!isActionList(actions)) return {
+		actions: [],
+		connector: normalizeConnector(connector)
+	};
+	return {
+		actions,
+		connector: normalizeConnector(connector)
+	};
+}
+function hasAllowedAction(allowedActions, requestedAction) {
+	return typeof requestedAction === "string" && allowedActions.includes(requestedAction);
+}
+function isResourceAuthorized(allowedActions, { actions, connector }) {
+	if (actions.length === 0) return false;
+	if (connector === "OR") return actions.some((requestedAction) => hasAllowedAction(allowedActions, requestedAction));
+	return actions.every((requestedAction) => hasAllowedAction(allowedActions, requestedAction));
+}
+function role(statements) {
+	return {
+		authorize(request, connector = "AND") {
+			let hasAuthorizedResource = false;
+			for (const [requestedResource, requestedActions] of Object.entries(request)) {
+				const allowedActions = statements[requestedResource];
+				if (!allowedActions) {
+					if (connector === "AND") return unknownResourceResponse(requestedResource);
+					continue;
+				}
+				const isAuthorized = isResourceAuthorized(allowedActions, normalizeActionRequest(requestedActions));
+				if (isAuthorized) hasAuthorizedResource = true;
+				if (isAuthorized && connector === "OR") return { success: true };
+				if (!isAuthorized && connector === "AND") return unauthorizedResourceResponse(requestedResource);
+			}
+			if (hasAuthorizedResource) return { success: true };
+			return {
+				success: false,
+				error: "Not authorized"
+			};
+		},
+		statements
+	};
+}
+function createAccessControl(s) {
+	return {
+		newRole(statements) {
+			return role(statements);
+		},
+		statements: s
+	};
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/package.mjs
+var version = "1.6.26";
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/version.mjs
+const PACKAGE_VERSION$1 = version;
+
+//#endregion
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_39d811f210df3a5f20302036ab91db01/node_modules/@better-auth/core/dist/utils/url.mjs
+/**
+* Schemes that execute or embed code when navigated to or accepted as a
+* redirect target. These are never safe as an OAuth `redirect_uri` or as a
+* client-side navigation target (`window.location.href`, `location.assign`, ...).
+*/
+const DANGEROUS_URL_SCHEMES = [
+	"javascript:",
+	"data:",
+	"vbscript:"
+];
+/**
+* Returns `false` only when `value` is an absolute URL using a dangerous scheme
+* (`javascript:`, `data:`, `vbscript:`). Relative URLs (e.g. `/dashboard`) and
+* safe absolute schemes (`http`, `https`, custom app schemes such as
+* `myapp://`) return `true`.
+*
+* Use this to guard browser navigation sinks and any redirect target that may
+* originate from untrusted input. It is intentionally narrow: it blocks code
+* execution schemes without rejecting relative paths or mobile deep links.
+*/
+function isSafeUrlScheme(value) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return true;
+	}
+	return !DANGEROUS_URL_SCHEMES.includes(parsed.protocol);
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/admin/access/statement.mjs
+const defaultStatements$1 = {
+	user: [
+		"create",
+		"list",
+		"set-role",
+		"ban",
+		"impersonate",
+		"impersonate-admins",
+		"delete",
+		"set-password",
+		"set-email",
+		"get",
+		"update"
+	],
+	session: [
+		"list",
+		"revoke",
+		"delete"
+	]
+};
+const defaultAc$1 = createAccessControl(defaultStatements$1);
+const adminAc$1 = defaultAc$1.newRole({
+	user: [
+		"create",
+		"list",
+		"set-role",
+		"ban",
+		"impersonate",
+		"delete",
+		"set-password",
+		"set-email",
+		"get",
+		"update"
+	],
+	session: [
+		"list",
+		"revoke",
+		"delete"
+	]
+});
+const userAc = defaultAc$1.newRole({
+	user: [],
+	session: []
+});
+const defaultRoles$1 = {
+	admin: adminAc$1,
+	user: userAc
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/admin/error-codes.mjs
+const ADMIN_ERROR_CODES = defineErrorCodes({
+	FAILED_TO_CREATE_USER: "Failed to create user",
+	USER_ALREADY_EXISTS: "User already exists.",
+	USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: "User already exists. Use another email.",
+	YOU_CANNOT_BAN_YOURSELF: "You cannot ban yourself",
+	YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE: "You are not allowed to change users role",
+	YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS: "You are not allowed to create users",
+	YOU_ARE_NOT_ALLOWED_TO_LIST_USERS: "You are not allowed to list users",
+	YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS: "You are not allowed to list users sessions",
+	YOU_ARE_NOT_ALLOWED_TO_BAN_USERS: "You are not allowed to ban users",
+	YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS: "You are not allowed to impersonate users",
+	YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS: "You are not allowed to revoke users sessions",
+	YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS: "You are not allowed to delete users",
+	YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD: "You are not allowed to set users password",
+	BANNED_USER: "You have been banned from this application",
+	YOU_ARE_NOT_ALLOWED_TO_GET_USER: "You are not allowed to get user",
+	NO_DATA_TO_UPDATE: "No data to update",
+	YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS: "You are not allowed to update users",
+	YOU_CANNOT_REMOVE_YOURSELF: "You cannot remove yourself",
+	YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE: "You are not allowed to set a non-existent role value",
+	YOU_CANNOT_IMPERSONATE_ADMINS: "You cannot impersonate admins",
+	INVALID_ROLE_TYPE: "Invalid role type",
+	YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: "You are not allowed to update users email",
+	PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: "Password cannot be updated through update-user. Use the set-user-password endpoint instead"
+});
+
+//#endregion
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_39d811f210df3a5f20302036ab91db01/node_modules/@better-auth/core/dist/env/env-impl.mjs
+const _envShim = Object.create(null);
+const _getEnv = (useShim) => globalThis.process?.env || globalThis.Deno?.env.toObject() || globalThis.__env__ || (useShim ? _envShim : globalThis);
+const env = new Proxy(_envShim, {
+	get(_, prop) {
+		return _getEnv()[prop] ?? _envShim[prop];
+	},
+	has(_, prop) {
+		return prop in _getEnv() || prop in _envShim;
+	},
+	set(_, prop, value) {
+		const env = _getEnv(true);
+		env[prop] = value;
+		return true;
+	},
+	deleteProperty(_, prop) {
+		if (!prop) return false;
+		const env = _getEnv(true);
+		delete env[prop];
+		return true;
+	},
+	ownKeys() {
+		const env = _getEnv(true);
+		return Object.keys(env);
+	}
+});
+const nodeENV = env.NODE_ENV ?? "";
+/**
+* Get environment variable with fallback
+*/
+function getEnvVar(key, fallback) {
+	if (typeof process !== "undefined" && process.env) return process.env[key] ?? fallback;
+	if (typeof Deno !== "undefined") return Deno.env.get(key) ?? fallback;
+	if (typeof Bun !== "undefined") return Bun.env[key] ?? fallback;
+	return fallback;
+}
+/**
+* Common environment variables used in Better Auth
+*/
+const ENV = Object.freeze({
+	get BETTER_AUTH_SECRET() {
+		return getEnvVar("BETTER_AUTH_SECRET");
+	},
+	get AUTH_SECRET() {
+		return getEnvVar("AUTH_SECRET");
+	},
+	get BETTER_AUTH_TELEMETRY() {
+		return getEnvVar("BETTER_AUTH_TELEMETRY");
+	},
+	get BETTER_AUTH_TELEMETRY_ID() {
+		return getEnvVar("BETTER_AUTH_TELEMETRY_ID");
+	},
+	get NODE_ENV() {
+		return getEnvVar("NODE_ENV", "development");
+	},
+	get PACKAGE_VERSION() {
+		return getEnvVar("PACKAGE_VERSION", "0.0.0");
+	},
+	get BETTER_AUTH_TELEMETRY_ENDPOINT() {
+		return getEnvVar("BETTER_AUTH_TELEMETRY_ENDPOINT", "");
+	}
+});
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/utils/url.mjs
+const SLASH_CHAR_CODE = "/".charCodeAt(0);
+function trimTrailingSlashes(value) {
+	let end = value.length;
+	while (end > 0 && value.charCodeAt(end - 1) === SLASH_CHAR_CODE) end--;
+	return end === value.length ? value : value.slice(0, end);
+}
+function checkHasPath(url) {
+	try {
+		return (trimTrailingSlashes(new URL(url).pathname) || "/") !== "/";
+	} catch {
+		throw new BetterAuthError(`Invalid base URL: ${url}. Please provide a valid base URL.`);
+	}
+}
+function assertHasProtocol(url) {
+	try {
+		const parsedUrl = new URL(url);
+		if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") throw new BetterAuthError(`Invalid base URL: ${url}. URL must include 'http://' or 'https://'`);
+	} catch (error) {
+		if (error instanceof BetterAuthError) throw error;
+		throw new BetterAuthError(`Invalid base URL: ${url}. Please provide a valid base URL.`, { cause: error });
+	}
+}
+function withPath(url, path = "/api/auth") {
+	assertHasProtocol(url);
+	if (checkHasPath(url)) return url;
+	const trimmedUrl = trimTrailingSlashes(url);
+	if (!path || path === "/") return trimmedUrl;
+	path = path.startsWith("/") ? path : `/${path}`;
+	return `${trimmedUrl}${path}`;
+}
+function validateProxyHeader(header, type) {
+	if (!header || header.trim() === "") return false;
+	if (type === "proto") return header === "http" || header === "https";
+	if (type === "host") {
+		if ([
+			/\.\./,
+			/\0/,
+			/[\s]/,
+			/^[.]/,
+			/[<>'"]/,
+			/javascript:/i,
+			/file:/i,
+			/data:/i
+		].some((pattern) => pattern.test(header))) return false;
+		return /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*(:[0-9]{1,5})?$/.test(header) || /^(\d{1,3}\.){3}\d{1,3}(:[0-9]{1,5})?$/.test(header) || /^\[[0-9a-fA-F:]+\](:[0-9]{1,5})?$/.test(header) || /^localhost(:[0-9]{1,5})?$/i.test(header);
+	}
+	return false;
+}
+function getBaseURL(url, path, request, loadEnv, trustedProxyHeaders) {
+	if (url) return withPath(url, path);
+	if (loadEnv !== false) {
+		const fromEnv = env.BETTER_AUTH_URL || env.NEXT_PUBLIC_BETTER_AUTH_URL || env.PUBLIC_BETTER_AUTH_URL || env.NUXT_PUBLIC_BETTER_AUTH_URL || env.NUXT_PUBLIC_AUTH_URL || (env.BASE_URL !== "/" ? env.BASE_URL : void 0);
+		if (fromEnv) return withPath(fromEnv, path);
+	}
+	const fromRequest = request?.headers.get("x-forwarded-host");
+	const fromRequestProto = request?.headers.get("x-forwarded-proto");
+	if (fromRequest && fromRequestProto && trustedProxyHeaders) {
+		if (validateProxyHeader(fromRequestProto, "proto") && validateProxyHeader(fromRequest, "host")) try {
+			return withPath(`${fromRequestProto}://${fromRequest}`, path);
+		} catch (_error) {}
+	}
+	if (request) {
+		const url = getOrigin(request.url);
+		if (!url) throw new BetterAuthError("Could not get origin from request. Please provide a valid base URL.");
+		return withPath(url, path);
+	}
+	if (typeof window !== "undefined" && window.location) return withPath(window.location.origin, path);
+}
+function getOrigin(url) {
+	try {
+		const parsedUrl = new URL(url);
+		return parsedUrl.origin === "null" ? null : parsedUrl.origin;
+	} catch {
+		return null;
+	}
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/admin/has-permission.mjs
+const hasPermission = (input) => {
+	if (input.userId && input.options?.adminUserIds?.includes(input.userId)) return true;
+	if (!input.permissions) return false;
+	const roles = (input.role || input.options?.defaultRole || "user").split(",");
+	const acRoles = input.options?.roles || defaultRoles$1;
+	for (const role of roles) if ((acRoles[role]?.authorize(input.permissions))?.success) return true;
+	return false;
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/defu@6.1.7/node_modules/defu/dist/defu.mjs
+function isPlainObject$1(value) {
+	if (value === null || typeof value !== "object") return false;
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== null && prototype !== Object.prototype && Object.getPrototypeOf(prototype) !== null) return false;
+	if (Symbol.iterator in value) return false;
+	if (Symbol.toStringTag in value) return Object.prototype.toString.call(value) === "[object Module]";
+	return true;
+}
+function _defu(baseObject, defaults, namespace = ".", merger) {
+	if (!isPlainObject$1(defaults)) return _defu(baseObject, {}, namespace, merger);
+	const object = { ...defaults };
+	for (const key of Object.keys(baseObject)) {
+		if (key === "__proto__" || key === "constructor") continue;
+		const value = baseObject[key];
+		if (value === null || value === void 0) continue;
+		if (merger && merger(object, key, value, namespace)) continue;
+		if (Array.isArray(value) && Array.isArray(object[key])) object[key] = [...value, ...object[key]];
+		else if (isPlainObject$1(value) && isPlainObject$1(object[key])) object[key] = _defu(value, object[key], (namespace ? `${namespace}.` : "") + key.toString(), merger);
+		else object[key] = value;
+	}
+	return object;
+}
+function createDefu(merger) {
+	return (...arguments_) => arguments_.reduce((p, c) => _defu(p, c, "", merger), {});
+}
+const defu = createDefu();
+const defuFn = createDefu((object, key, currentValue) => {
+	if (object[key] !== void 0 && typeof currentValue === "function") {
+		object[key] = currentValue(object[key]);
+		return true;
+	}
+});
+const defuArrayFn = createDefu((object, key, currentValue) => {
+	if (Array.isArray(object[key]) && typeof currentValue === "function") {
+		object[key] = currentValue(object[key]);
+		return true;
+	}
+});
+
+//#endregion
+//#region ../../node_modules/.pnpm/@better-fetch+fetch@1.3.1/node_modules/@better-fetch/fetch/dist/index.js
+var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
+var __spreadValues = (a, b) => {
+	for (var prop in b || (b = {})) if (__hasOwnProp.call(b, prop)) __defNormalProp(a, prop, b[prop]);
+	if (__getOwnPropSymbols) {
+		for (var prop of __getOwnPropSymbols(b)) if (__propIsEnum.call(b, prop)) __defNormalProp(a, prop, b[prop]);
+	}
+	return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+var BetterFetchError = class extends Error {
+	constructor(status, statusText, error) {
+		super(statusText || status.toString(), { cause: error });
+		this.status = status;
+		this.statusText = statusText;
+		this.error = error;
+		Error.captureStackTrace(this, this.constructor);
+	}
+};
+var initializePlugins = async (url, options) => {
+	var _a, _b, _c, _d, _e, _f;
+	let opts = options || {};
+	const hooks = {
+		onRequest: [options == null ? void 0 : options.onRequest],
+		onResponse: [options == null ? void 0 : options.onResponse],
+		onSuccess: [options == null ? void 0 : options.onSuccess],
+		onError: [options == null ? void 0 : options.onError],
+		onRetry: [options == null ? void 0 : options.onRetry]
+	};
+	if (!options || !(options == null ? void 0 : options.plugins)) return {
+		url,
+		options: opts,
+		hooks
+	};
+	for (const plugin of (options == null ? void 0 : options.plugins) || []) {
+		if (plugin.init) {
+			const pluginRes = await ((_a = plugin.init) == null ? void 0 : _a.call(plugin, url.toString(), options));
+			opts = pluginRes.options || opts;
+			url = pluginRes.url;
+		}
+		hooks.onRequest.push((_b = plugin.hooks) == null ? void 0 : _b.onRequest);
+		hooks.onResponse.push((_c = plugin.hooks) == null ? void 0 : _c.onResponse);
+		hooks.onSuccess.push((_d = plugin.hooks) == null ? void 0 : _d.onSuccess);
+		hooks.onError.push((_e = plugin.hooks) == null ? void 0 : _e.onError);
+		hooks.onRetry.push((_f = plugin.hooks) == null ? void 0 : _f.onRetry);
+	}
+	return {
+		url,
+		options: opts,
+		hooks
+	};
+};
+var LinearRetryStrategy = class {
+	constructor(options) {
+		this.options = options;
+	}
+	shouldAttemptRetry(attempt, response) {
+		if (this.options.shouldRetry) return Promise.resolve(attempt < this.options.attempts && this.options.shouldRetry(response));
+		return Promise.resolve(attempt < this.options.attempts);
+	}
+	getDelay() {
+		return this.options.delay;
+	}
+};
+var ExponentialRetryStrategy = class {
+	constructor(options) {
+		this.options = options;
+	}
+	shouldAttemptRetry(attempt, response) {
+		if (this.options.shouldRetry) return Promise.resolve(attempt < this.options.attempts && this.options.shouldRetry(response));
+		return Promise.resolve(attempt < this.options.attempts);
+	}
+	getDelay(attempt) {
+		return Math.min(this.options.maxDelay, this.options.baseDelay * 2 ** attempt);
+	}
+};
+function createRetryStrategy(options) {
+	if (typeof options === "number") return new LinearRetryStrategy({
+		type: "linear",
+		attempts: options,
+		delay: 1e3
+	});
+	switch (options.type) {
+		case "linear": return new LinearRetryStrategy(options);
+		case "exponential": return new ExponentialRetryStrategy(options);
+		default: throw new Error("Invalid retry strategy");
+	}
+}
+var getAuthHeader = async (options) => {
+	const headers = {};
+	const getValue = async (value) => typeof value === "function" ? await value() : value;
+	if (options == null ? void 0 : options.auth) {
+		if (options.auth.type === "Bearer") {
+			const token = await getValue(options.auth.token);
+			if (!token) return headers;
+			headers["authorization"] = `Bearer ${token}`;
+		} else if (options.auth.type === "Basic") {
+			const [username, password] = await Promise.all([getValue(options.auth.username), getValue(options.auth.password)]);
+			if (!username || !password) return headers;
+			headers["authorization"] = `Basic ${btoa(`${username}:${password}`)}`;
+		} else if (options.auth.type === "Custom") {
+			const [prefix, value] = await Promise.all([getValue(options.auth.prefix), getValue(options.auth.value)]);
+			if (!value) return headers;
+			headers["authorization"] = `${prefix != null ? prefix : ""} ${value}`;
+		}
+	}
+	return headers;
+};
+var JSON_RE = /^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;
+function detectResponseType(request) {
+	const _contentType = request.headers.get("content-type");
+	const textTypes = /* @__PURE__ */ new Set([
+		"image/svg",
+		"application/xml",
+		"application/xhtml",
+		"application/html"
+	]);
+	if (!_contentType) return "json";
+	const contentType = _contentType.split(";").shift() || "";
+	if (JSON_RE.test(contentType)) return "json";
+	if (textTypes.has(contentType) || contentType.startsWith("text/")) return "text";
+	return "blob";
+}
+function isJSONParsable(value) {
+	try {
+		JSON.parse(value);
+		return true;
+	} catch (error) {
+		return false;
+	}
+}
+function isJSONSerializable(value) {
+	if (value === void 0) return false;
+	const t = typeof value;
+	if (t === "string" || t === "number" || t === "boolean" || t === null) return true;
+	if (t !== "object") return false;
+	if (Array.isArray(value)) return true;
+	if (value.buffer) return false;
+	return value.constructor && value.constructor.name === "Object" || typeof value.toJSON === "function";
+}
+function jsonParse(text) {
+	try {
+		return JSON.parse(text);
+	} catch (error) {
+		return text;
+	}
+}
+function isFunction(value) {
+	return typeof value === "function";
+}
+function getFetch(options) {
+	if (options == null ? void 0 : options.customFetchImpl) return options.customFetchImpl;
+	if (typeof globalThis !== "undefined" && isFunction(globalThis.fetch)) return globalThis.fetch;
+	if (typeof window !== "undefined" && isFunction(window.fetch)) return window.fetch;
+	throw new Error("No fetch implementation found");
+}
+function mergeHeaders(...sources) {
+	const merged = {};
+	for (const source of sources) {
+		if (!source) continue;
+		if (source instanceof Headers) source.forEach((value, key) => {
+			merged[key] = value;
+		});
+		else {
+			const entries = Array.isArray(source) ? source : Object.entries(source);
+			for (const [key, value] of entries) if (value !== null && value !== void 0) merged[key] = value;
+		}
+	}
+	return merged;
+}
+async function getHeaders(opts) {
+	const headers = new Headers(mergeHeaders(opts == null ? void 0 : opts.headers, await getAuthHeader(opts)));
+	if (!headers.has("content-type")) {
+		const contentType = detectContentType(opts == null ? void 0 : opts.body);
+		if (contentType) headers.set("content-type", contentType);
+	}
+	return headers;
+}
+function detectContentType(body) {
+	if (isJSONSerializable(body)) return "application/json";
+	return null;
+}
+function getMediaType(headers) {
+	const contentType = headers.get("content-type");
+	return contentType ? contentType.split(";")[0].trim().toLowerCase() : null;
+}
+function getBody(options, headers) {
+	const { body } = options;
+	if (!body) return null;
+	if (!isJSONSerializable(body)) return body;
+	if (typeof body === "string") return body;
+	if (getMediaType(headers) === "application/x-www-form-urlencoded") return new URLSearchParams(body).toString();
+	return JSON.stringify(body);
+}
+function getMethod$1(url, options) {
+	var _a;
+	if (options == null ? void 0 : options.method) return options.method.toUpperCase();
+	if (url.startsWith("@")) {
+		const pMethod = (_a = url.split("@")[1]) == null ? void 0 : _a.split("/")[0];
+		if (!methods.includes(pMethod)) return (options == null ? void 0 : options.body) ? "POST" : "GET";
+		return pMethod.toUpperCase();
+	}
+	return (options == null ? void 0 : options.body) ? "POST" : "GET";
+}
+function getTimeout(options, controller) {
+	let abortTimeout;
+	if (!(options == null ? void 0 : options.signal) && (options == null ? void 0 : options.timeout)) abortTimeout = setTimeout(() => controller == null ? void 0 : controller.abort(), options == null ? void 0 : options.timeout);
+	return {
+		abortTimeout,
+		clearTimeout: () => {
+			if (abortTimeout) clearTimeout(abortTimeout);
+		}
+	};
+}
+var ValidationError = class _ValidationError extends Error {
+	constructor(issues, message) {
+		super(message || JSON.stringify(issues, null, 2));
+		this.issues = issues;
+		Object.setPrototypeOf(this, _ValidationError.prototype);
+	}
+};
+async function parseStandardSchema(schema, input) {
+	const result = await schema["~standard"].validate(input);
+	if (result.issues) throw new ValidationError(result.issues);
+	return result.value;
+}
+var methods = [
+	"get",
+	"post",
+	"put",
+	"patch",
+	"delete"
+];
+var applySchemaPlugin = (config) => ({
+	id: "apply-schema",
+	name: "Apply Schema",
+	version: "1.0.0",
+	async init(url, options) {
+		var _a, _b, _c, _d;
+		const schema = ((_b = (_a = config.plugins) == null ? void 0 : _a.find((plugin) => {
+			var _a2;
+			return ((_a2 = plugin.schema) == null ? void 0 : _a2.config) ? url.startsWith(plugin.schema.config.baseURL || "") || url.startsWith(plugin.schema.config.prefix || "") : false;
+		})) == null ? void 0 : _b.schema) || config.schema;
+		if (schema) {
+			let urlKey = url;
+			if ((_c = schema.config) == null ? void 0 : _c.prefix) {
+				if (urlKey.startsWith(schema.config.prefix)) {
+					urlKey = urlKey.replace(schema.config.prefix, "");
+					if (schema.config.baseURL) url = url.replace(schema.config.prefix, schema.config.baseURL);
+				}
+			}
+			if ((_d = schema.config) == null ? void 0 : _d.baseURL) {
+				if (urlKey.startsWith(schema.config.baseURL)) urlKey = urlKey.replace(schema.config.baseURL, "");
+			}
+			if (urlKey.startsWith("/") && urlKey.charAt(1) === "@") urlKey = urlKey.substring(1);
+			const keySchema = schema.schema[urlKey];
+			if (keySchema) {
+				let validatedHeaders = options == null ? void 0 : options.headers;
+				if (keySchema.headers && !(options == null ? void 0 : options.disableValidation)) {
+					const normalizedHeaders = {};
+					if (options == null ? void 0 : options.headers) {
+						if (options.headers instanceof Headers) options.headers.forEach((value, key) => {
+							normalizedHeaders[key.toLowerCase()] = value;
+						});
+						else if (typeof options.headers === "object") {
+							for (const [key, value] of Object.entries(options.headers)) if (value !== null && value !== void 0) normalizedHeaders[key.toLowerCase()] = value;
+						}
+					}
+					const validated = await parseStandardSchema(keySchema.headers, normalizedHeaders);
+					const finalHeaders = {};
+					for (const [key, value] of Object.entries(validated)) finalHeaders[key.toLowerCase()] = value;
+					validatedHeaders = finalHeaders;
+				}
+				let opts = __spreadProps(__spreadValues({}, options), {
+					method: keySchema.method,
+					output: keySchema.output,
+					headers: validatedHeaders
+				});
+				if (!(options == null ? void 0 : options.disableValidation)) opts = __spreadProps(__spreadValues({}, opts), {
+					body: keySchema.input ? await parseStandardSchema(keySchema.input, options == null ? void 0 : options.body) : options == null ? void 0 : options.body,
+					params: keySchema.params ? await parseStandardSchema(keySchema.params, options == null ? void 0 : options.params) : options == null ? void 0 : options.params,
+					query: keySchema.query ? await parseStandardSchema(keySchema.query, options == null ? void 0 : options.query) : options == null ? void 0 : options.query
+				});
+				return {
+					url,
+					options: opts
+				};
+			}
+		}
+		return {
+			url,
+			options
+		};
+	}
+});
+var createFetch = (config) => {
+	async function $fetch(url, options) {
+		const opts = __spreadProps(__spreadValues(__spreadValues({}, config), options), {
+			headers: mergeHeaders(config == null ? void 0 : config.headers, options == null ? void 0 : options.headers),
+			plugins: [
+				...(config == null ? void 0 : config.plugins) || [],
+				applySchemaPlugin(config || {}),
+				...(options == null ? void 0 : options.plugins) || []
+			]
+		});
+		if (config == null ? void 0 : config.catchAllError) try {
+			return await betterFetch(url, opts);
+		} catch (error) {
+			return {
+				data: null,
+				error: {
+					status: 500,
+					statusText: "Fetch Error",
+					message: "Fetch related error. Captured by catchAllError option. See error property for more details.",
+					error
+				}
+			};
+		}
+		return await betterFetch(url, opts);
+	}
+	return $fetch;
+};
+var isReservedPathSegment = (value) => value === "." || value === "..";
+function encodePathSegment(segment, pathParams) {
+	let pathSegment = segment;
+	for (const [key, value] of pathParams) pathSegment = pathSegment.replace(key, value);
+	if (isReservedPathSegment(pathSegment)) throw new TypeError("Path parameters cannot be reserved path segments");
+	return encodeURIComponent(pathSegment);
+}
+function getURL2(url, option) {
+	const { baseURL, params, query } = option || {
+		query: {},
+		params: {},
+		baseURL: ""
+	};
+	let basePath = url.startsWith("http") ? url.split("/").slice(0, 3).join("/") : baseURL || "";
+	if (url.startsWith("@")) {
+		const m = url.toString().split("@")[1].split("/")[0];
+		if (methods.includes(m)) url = url.replace(`@${m}/`, "/");
+	}
+	if (!basePath.endsWith("/")) basePath += "/";
+	let [path, urlQuery] = url.replace(basePath, "").split("?");
+	const queryParams = new URLSearchParams(urlQuery);
+	for (const [key, value] of Object.entries(query || {})) {
+		if (value == null) continue;
+		let serializedValue;
+		if (typeof value === "string") serializedValue = value;
+		else if (Array.isArray(value)) {
+			for (const val of value) queryParams.append(key, val);
+			continue;
+		} else serializedValue = JSON.stringify(value);
+		queryParams.set(key, serializedValue);
+	}
+	const pathParams = /* @__PURE__ */ new Map();
+	if (params) {
+		if (Array.isArray(params)) {
+			const paramPaths = path.split("/").filter((p) => p.startsWith(":"));
+			for (const [index, key] of paramPaths.entries()) {
+				const value = params[index];
+				pathParams.set(key, String(value));
+			}
+		} else for (const [key, value] of Object.entries(params)) pathParams.set(`:${key}`, String(value));
+	}
+	path = path.split("/").map((segment) => encodePathSegment(segment, pathParams)).join("/");
+	path = path.replace(/^\/+/, "");
+	let queryParamString = queryParams.toString();
+	queryParamString = queryParamString.length > 0 ? `?${queryParamString}`.replace(/\+/g, "%20") : "";
+	if (!basePath.startsWith("http")) return `${basePath}${path}${queryParamString}`;
+	return new URL(`${path}${queryParamString}`, basePath);
+}
+var betterFetch = async (url, options) => {
+	var _a, _b, _c, _d, _e, _f, _g, _h;
+	const { hooks, url: __url, options: opts } = await initializePlugins(url, options);
+	const fetch = getFetch(opts);
+	const controller = new AbortController();
+	const signal = (_a = opts.signal) != null ? _a : controller.signal;
+	const _url = getURL2(__url, opts);
+	const headers = await getHeaders(opts);
+	const body = getBody(opts, headers);
+	const method = getMethod$1(__url, opts);
+	const context = __spreadProps(__spreadValues({}, opts), {
+		url: _url,
+		headers,
+		body,
+		method,
+		signal
+	});
+	for (const onRequest of hooks.onRequest) if (onRequest) {
+		const res = await onRequest(context);
+		if (typeof res === "object" && res !== null) Object.assign(context, res);
+	}
+	if ("pipeTo" in context && typeof context.pipeTo === "function" || typeof ((_b = options == null ? void 0 : options.body) == null ? void 0 : _b.pipe) === "function") {
+		if (!("duplex" in context)) context.duplex = "half";
+	}
+	const { clearTimeout: clearTimeout2 } = getTimeout(opts, controller);
+	let response = await fetch(context.url, context);
+	clearTimeout2();
+	const responseContext = {
+		response,
+		request: context
+	};
+	for (const onResponse of hooks.onResponse) if (onResponse) {
+		const r = await onResponse(__spreadProps(__spreadValues({}, responseContext), { response: ((_c = options == null ? void 0 : options.hookOptions) == null ? void 0 : _c.cloneResponse) ? response.clone() : response }));
+		if (r instanceof Response) response = r;
+		else if (typeof r === "object" && r !== null) response = r.response;
+	}
+	if (response.ok) {
+		if (!(context.method !== "HEAD")) return {
+			data: "",
+			error: null
+		};
+		const responseType = detectResponseType(response);
+		const successContext = {
+			data: null,
+			response,
+			request: context
+		};
+		if (responseType === "json" || responseType === "text") {
+			const text = await response.text();
+			successContext.data = await ((_d = context.jsonParser) != null ? _d : jsonParse)(text);
+		} else successContext.data = await response[responseType]();
+		if (context == null ? void 0 : context.output) {
+			if (context.output && !context.disableValidation) successContext.data = await parseStandardSchema(context.output, successContext.data);
+		}
+		for (const onSuccess of hooks.onSuccess) if (onSuccess) await onSuccess(__spreadProps(__spreadValues({}, successContext), { response: ((_e = options == null ? void 0 : options.hookOptions) == null ? void 0 : _e.cloneResponse) ? response.clone() : response }));
+		if (options == null ? void 0 : options.throw) return successContext.data;
+		return {
+			data: successContext.data,
+			error: null
+		};
+	}
+	const parser = (_f = options == null ? void 0 : options.jsonParser) != null ? _f : jsonParse;
+	const responseText = await response.text();
+	const isJSONResponse = isJSONParsable(responseText);
+	const errorObject = isJSONResponse ? await parser(responseText) : null;
+	const errorContext = {
+		response,
+		responseText,
+		request: context,
+		error: __spreadProps(__spreadValues({}, errorObject), {
+			status: response.status,
+			statusText: response.statusText
+		})
+	};
+	for (const onError of hooks.onError) if (onError) await onError(__spreadProps(__spreadValues({}, errorContext), { response: ((_g = options == null ? void 0 : options.hookOptions) == null ? void 0 : _g.cloneResponse) ? response.clone() : response }));
+	if (options == null ? void 0 : options.retry) {
+		const retryStrategy = createRetryStrategy(options.retry);
+		const _retryAttempt = (_h = options.retryAttempt) != null ? _h : 0;
+		if (await retryStrategy.shouldAttemptRetry(_retryAttempt, response)) {
+			for (const onRetry of hooks.onRetry) if (onRetry) await onRetry(responseContext);
+			const delay = retryStrategy.getDelay(_retryAttempt);
+			await new Promise((resolve) => setTimeout(resolve, delay));
+			return await betterFetch(url, __spreadProps(__spreadValues({}, options), { retryAttempt: _retryAttempt + 1 }));
+		}
+	}
+	if (options == null ? void 0 : options.throw) throw new BetterFetchError(response.status, response.statusText, isJSONResponse ? errorObject : responseText);
+	return {
+		data: null,
+		error: __spreadProps(__spreadValues({}, errorObject), {
+			status: response.status,
+			statusText: response.statusText
+		})
+	};
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/parser.mjs
+const PROTO_POLLUTION_PATTERNS = {
+	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
+	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
+	protoShort: /"__proto__"\s*:/,
+	constructorShort: /"constructor"\s*:/
+};
+const JSON_SIGNATURE = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
+const SPECIAL_VALUES = {
+	true: true,
+	false: false,
+	null: null,
+	undefined: void 0,
+	nan: NaN,
+	infinity: Number.POSITIVE_INFINITY,
+	"-infinity": Number.NEGATIVE_INFINITY
+};
+const ISO_DATE_REGEX = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,7}))?(?:Z|([+-])(\d{2}):(\d{2}))$/;
+function isValidDate(date) {
+	return date instanceof Date && !isNaN(date.getTime());
+}
+function parseISODate(value) {
+	const match = ISO_DATE_REGEX.exec(value);
+	if (!match) return null;
+	const [, year, month, day, hour, minute, second, ms, offsetSign, offsetHour, offsetMinute] = match;
+	const date = new Date(Date.UTC(parseInt(year, 10), parseInt(month, 10) - 1, parseInt(day, 10), parseInt(hour, 10), parseInt(minute, 10), parseInt(second, 10), ms ? parseInt(ms.padEnd(3, "0"), 10) : 0));
+	if (offsetSign) {
+		const offset = (parseInt(offsetHour, 10) * 60 + parseInt(offsetMinute, 10)) * (offsetSign === "+" ? -1 : 1);
+		date.setUTCMinutes(date.getUTCMinutes() + offset);
+	}
+	return isValidDate(date) ? date : null;
+}
+function betterJSONParse(value, options = {}) {
+	const { strict = false, warnings = false, reviver, parseDates = true } = options;
+	if (typeof value !== "string") return value;
+	const trimmed = value.trim();
+	const lowerValue = trimmed.toLowerCase();
+	if (lowerValue.length <= 9 && lowerValue in SPECIAL_VALUES) return SPECIAL_VALUES[lowerValue];
+	if (!JSON_SIGNATURE.test(trimmed)) {
+		if (strict) throw new SyntaxError("[better-json] Invalid JSON");
+		return value;
+	}
+	if (Object.entries(PROTO_POLLUTION_PATTERNS).some(([key, pattern]) => {
+		const matches = pattern.test(trimmed);
+		if (matches && warnings) console.warn(`[better-json] Detected potential prototype pollution attempt using ${key} pattern`);
+		return matches;
+	}) && strict) throw new Error("[better-json] Potential prototype pollution attempt detected");
+	try {
+		const secureReviver = (key, value) => {
+			if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
+				if (warnings) console.warn(`[better-json] Dropping "${key}" key to prevent prototype pollution`);
+				return;
+			}
+			if (parseDates && typeof value === "string") {
+				const date = parseISODate(value);
+				if (date) return date;
+			}
+			return reviver ? reviver(key, value) : value;
+		};
+		return JSON.parse(trimmed, secureReviver);
+	} catch (error) {
+		if (strict) throw error;
+		return value;
+	}
+}
+function parseJSON(value, options = { strict: true }) {
+	return betterJSONParse(value, options);
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/organization/access/statement.mjs
+const defaultStatements = {
+	organization: ["update", "delete"],
+	member: [
+		"create",
+		"update",
+		"delete"
+	],
+	invitation: ["create", "cancel"],
+	team: [
+		"create",
+		"update",
+		"delete"
+	],
+	ac: [
+		"create",
+		"read",
+		"update",
+		"delete"
+	]
+};
+const defaultAc = createAccessControl(defaultStatements);
+const adminAc = defaultAc.newRole({
+	organization: ["update"],
+	invitation: ["create", "cancel"],
+	member: [
+		"create",
+		"update",
+		"delete"
+	],
+	team: [
+		"create",
+		"update",
+		"delete"
+	],
+	ac: [
+		"create",
+		"read",
+		"update",
+		"delete"
+	]
+});
+const ownerAc = defaultAc.newRole({
+	organization: ["update", "delete"],
+	member: [
+		"create",
+		"update",
+		"delete"
+	],
+	invitation: ["create", "cancel"],
+	team: [
+		"create",
+		"update",
+		"delete"
+	],
+	ac: [
+		"create",
+		"read",
+		"update",
+		"delete"
+	]
+});
+const memberAc = defaultAc.newRole({
+	organization: [],
+	member: [],
+	invitation: [],
+	team: [],
+	ac: ["read"]
+});
+const defaultRoles = {
+	admin: adminAc,
+	owner: ownerAc,
+	member: memberAc
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/organization/permission.mjs
+const hasPermissionFn = (input, acRoles) => {
+	if (!input.permissions) return false;
+	const roles = input.role.split(",");
+	const creatorRole = input.options.creatorRole || "owner";
+	const isCreator = roles.includes(creatorRole);
+	const allowCreatorsAllPermissions = input.allowCreatorAllPermissions || false;
+	if (isCreator && allowCreatorsAllPermissions) return true;
+	for (const role of roles) if ((acRoles[role]?.authorize(input.permissions))?.success) return true;
+	return false;
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/organization/error-codes.mjs
+const ORGANIZATION_ERROR_CODES = defineErrorCodes({
+	YOU_ARE_NOT_ALLOWED_TO_CREATE_A_NEW_ORGANIZATION: "You are not allowed to create a new organization",
+	YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_ORGANIZATIONS: "You have reached the maximum number of organizations",
+	ORGANIZATION_ALREADY_EXISTS: "Organization already exists",
+	ORGANIZATION_SLUG_ALREADY_TAKEN: "Organization slug already taken",
+	ORGANIZATION_NOT_FOUND: "Organization not found",
+	USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION: "User is not a member of the organization",
+	YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_ORGANIZATION: "You are not allowed to update this organization",
+	YOU_ARE_NOT_ALLOWED_TO_DELETE_THIS_ORGANIZATION: "You are not allowed to delete this organization",
+	NO_ACTIVE_ORGANIZATION: "No active organization",
+	USER_IS_ALREADY_A_MEMBER_OF_THIS_ORGANIZATION: "User is already a member of this organization",
+	MEMBER_NOT_FOUND: "Member not found",
+	ROLE_NOT_FOUND: "Role not found",
+	YOU_ARE_NOT_ALLOWED_TO_CREATE_A_NEW_TEAM: "You are not allowed to create a new team",
+	TEAM_ALREADY_EXISTS: "Team already exists",
+	TEAM_NOT_FOUND: "Team not found",
+	YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER: "You cannot leave the organization as the only owner",
+	YOU_CANNOT_LEAVE_THE_ORGANIZATION_WITHOUT_AN_OWNER: "You cannot leave the organization without an owner",
+	YOU_ARE_NOT_ALLOWED_TO_DELETE_THIS_MEMBER: "You are not allowed to delete this member",
+	YOU_ARE_NOT_ALLOWED_TO_INVITE_USERS_TO_THIS_ORGANIZATION: "You are not allowed to invite users to this organization",
+	USER_IS_ALREADY_INVITED_TO_THIS_ORGANIZATION: "User is already invited to this organization",
+	INVITATION_NOT_FOUND: "Invitation not found",
+	YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION: "You are not the recipient of the invitation",
+	EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION: "Email verification required before accepting or rejecting invitation",
+	EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION: "Email verification required to view or list invitations for the session email",
+	YOU_ARE_NOT_ALLOWED_TO_CANCEL_THIS_INVITATION: "You are not allowed to cancel this invitation",
+	INVITER_IS_NO_LONGER_A_MEMBER_OF_THE_ORGANIZATION: "Inviter is no longer a member of the organization",
+	YOU_ARE_NOT_ALLOWED_TO_INVITE_USER_WITH_THIS_ROLE: "You are not allowed to invite a user with this role",
+	FAILED_TO_RETRIEVE_INVITATION: "Failed to retrieve invitation",
+	YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_TEAMS: "You have reached the maximum number of teams",
+	UNABLE_TO_REMOVE_LAST_TEAM: "Unable to remove last team",
+	YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_MEMBER: "You are not allowed to update this member",
+	ORGANIZATION_MEMBERSHIP_LIMIT_REACHED: "Organization membership limit reached",
+	YOU_ARE_NOT_ALLOWED_TO_CREATE_TEAMS_IN_THIS_ORGANIZATION: "You are not allowed to create teams in this organization",
+	YOU_ARE_NOT_ALLOWED_TO_DELETE_TEAMS_IN_THIS_ORGANIZATION: "You are not allowed to delete teams in this organization",
+	YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_TEAM: "You are not allowed to update this team",
+	YOU_ARE_NOT_ALLOWED_TO_DELETE_THIS_TEAM: "You are not allowed to delete this team",
+	INVITATION_LIMIT_REACHED: "Invitation limit reached",
+	TEAM_MEMBER_LIMIT_REACHED: "Team member limit reached",
+	USER_IS_NOT_A_MEMBER_OF_THE_TEAM: "User is not a member of the team",
+	YOU_CAN_NOT_ACCESS_THE_MEMBERS_OF_THIS_TEAM: "You are not allowed to list the members of this team",
+	YOU_DO_NOT_HAVE_AN_ACTIVE_TEAM: "You do not have an active team",
+	YOU_ARE_NOT_ALLOWED_TO_CREATE_A_NEW_TEAM_MEMBER: "You are not allowed to create a new member",
+	YOU_ARE_NOT_ALLOWED_TO_REMOVE_A_TEAM_MEMBER: "You are not allowed to remove a team member",
+	YOU_ARE_NOT_ALLOWED_TO_ACCESS_THIS_ORGANIZATION: "You are not allowed to access this organization as an owner",
+	YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION: "You are not a member of this organization",
+	MISSING_AC_INSTANCE: "Dynamic Access Control requires a pre-defined ac instance on the server auth plugin. Read server logs for more information",
+	YOU_MUST_BE_IN_AN_ORGANIZATION_TO_CREATE_A_ROLE: "You must be in an organization to create a role",
+	YOU_ARE_NOT_ALLOWED_TO_CREATE_A_ROLE: "You are not allowed to create a role",
+	YOU_ARE_NOT_ALLOWED_TO_UPDATE_A_ROLE: "You are not allowed to update a role",
+	YOU_ARE_NOT_ALLOWED_TO_DELETE_A_ROLE: "You are not allowed to delete a role",
+	YOU_ARE_NOT_ALLOWED_TO_READ_A_ROLE: "You are not allowed to read a role",
+	YOU_ARE_NOT_ALLOWED_TO_LIST_A_ROLE: "You are not allowed to list a role",
+	YOU_ARE_NOT_ALLOWED_TO_GET_A_ROLE: "You are not allowed to get a role",
+	TOO_MANY_ROLES: "This organization has too many roles",
+	INVALID_RESOURCE: "The provided permission includes an invalid resource",
+	ROLE_NAME_IS_ALREADY_TAKEN: "That role name is already taken",
+	CANNOT_DELETE_A_PRE_DEFINED_ROLE: "Cannot delete a pre-defined role",
+	ROLE_IS_ASSIGNED_TO_MEMBERS: "Cannot delete a role that is assigned to members. Please reassign the members to a different role first",
+	INVALID_TEAM_ID: "Team id contains a reserved character"
+});
+
+//#endregion
+//#region ../auth/dist/rbac.mjs
+const t$1 = createAccessControl({
+	organization: [`update`, `delete`],
+	member: [
+		`create`,
+		`update`,
+		`delete`
+	],
+	project: [
+		`create`,
+		`read`,
+		`update`,
+		`archive`
+	],
+	environment: [
+		`create`,
+		`read`,
+		`update`,
+		`archive`,
+		`set_production`
+	],
+	flag: [
+		`read`,
+		`create`,
+		`update`,
+		`archive`
+	],
+	flag_state: [`update`],
+	flag_production: [`toggle`],
+	apiKey: [
+		`create`,
+		`read`,
+		`revoke`
+	],
+	sdk_key: [
+		`create`,
+		`read`,
+		`revoke`
+	],
+	evaluated_entity: [`read`, `delete`]
+});
+const n$1 = {
+	viewer: t$1.newRole({
+		project: [`read`],
+		environment: [`read`],
+		flag: [`read`],
+		evaluated_entity: [`read`]
+	}),
+	editor: t$1.newRole({
+		project: [`read`, `update`],
+		environment: [`read`],
+		flag: [
+			`read`,
+			`create`,
+			`update`,
+			`archive`
+		],
+		flag_state: [`update`],
+		apiKey: [`read`],
+		sdk_key: [`read`],
+		evaluated_entity: [`read`]
+	}),
+	admin: t$1.newRole({
+		organization: [`update`],
+		member: [`create`, `update`],
+		project: [
+			`create`,
+			`read`,
+			`update`,
+			`archive`
+		],
+		environment: [
+			`create`,
+			`read`,
+			`update`,
+			`archive`,
+			`set_production`
+		],
+		flag: [
+			`read`,
+			`create`,
+			`update`,
+			`archive`
+		],
+		flag_state: [`update`],
+		flag_production: [`toggle`],
+		apiKey: [
+			`create`,
+			`read`,
+			`revoke`
+		],
+		sdk_key: [
+			`create`,
+			`read`,
+			`revoke`
+		],
+		evaluated_entity: [`read`, `delete`]
+	}),
+	owner: t$1.newRole({
+		organization: [`update`, `delete`],
+		member: [
+			`create`,
+			`update`,
+			`delete`
+		],
+		project: [
+			`create`,
+			`read`,
+			`update`,
+			`archive`
+		],
+		environment: [
+			`create`,
+			`read`,
+			`update`,
+			`archive`,
+			`set_production`
+		],
+		flag: [
+			`read`,
+			`create`,
+			`update`,
+			`archive`
+		],
+		flag_state: [`update`],
+		flag_production: [`toggle`],
+		apiKey: [
+			`create`,
+			`read`,
+			`revoke`
+		],
+		sdk_key: [
+			`create`,
+			`read`,
+			`revoke`
+		],
+		evaluated_entity: [`read`, `delete`]
+	})
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/broadcast-channel.mjs
+const kBroadcastChannel = Symbol.for("better-auth:broadcast-channel");
+const now$1 = () => Math.floor(Date.now() / 1e3);
+var WindowBroadcastChannel = class {
+	listeners = /* @__PURE__ */ new Set();
+	name;
+	constructor(name = "better-auth.message") {
+		this.name = name;
+	}
+	subscribe(listener) {
+		this.listeners.add(listener);
+		return () => {
+			this.listeners.delete(listener);
+		};
+	}
+	post(message) {
+		if (typeof window === "undefined") return;
+		try {
+			localStorage.setItem(this.name, JSON.stringify({
+				...message,
+				timestamp: now$1()
+			}));
+		} catch {}
+	}
+	setup() {
+		if (typeof window === "undefined" || typeof window.addEventListener === "undefined") return () => {};
+		const handler = (event) => {
+			if (event.key !== this.name) return;
+			const message = JSON.parse(event.newValue ?? "{}");
+			if (message?.event !== "session" || !message?.data) return;
+			this.listeners.forEach((listener) => listener(message));
+		};
+		window.addEventListener("storage", handler);
+		return () => {
+			window.removeEventListener("storage", handler);
+		};
+	}
+};
+function getGlobalBroadcastChannel(name = "better-auth.message") {
+	if (!globalThis[kBroadcastChannel]) globalThis[kBroadcastChannel] = new WindowBroadcastChannel(name);
+	return globalThis[kBroadcastChannel];
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/nanostores@1.4.2/node_modules/nanostores/clean-stores/index.js
+const clean = Symbol("clean");
+
+//#endregion
+//#region ../../node_modules/.pnpm/nanostores@1.4.2/node_modules/nanostores/atom/index.js
+let listenerQueue = [];
+let lqIndex = 0;
+let batchSeen = null;
+const QUEUE_ITEMS_PER_LISTENER = 4;
+const nanostoresGlobal = globalThis.nanostoresGlobal ||= { epoch: 0 };
+let drainQueue = () => {
+	for (lqIndex = 0; lqIndex < listenerQueue.length; lqIndex += QUEUE_ITEMS_PER_LISTENER) listenerQueue[lqIndex](listenerQueue[lqIndex + 1].value, listenerQueue[lqIndex + 2], listenerQueue[lqIndex + 3]);
+	listenerQueue.length = 0;
+};
+const atom = /* @__NO_SIDE_EFFECTS__ */ (initialValue) => {
+	let listeners = [];
+	let $atom = {
+		get() {
+			if (!$atom.lc) $atom.listen(() => {})();
+			return $atom.value;
+		},
+		init: initialValue,
+		lc: 0,
+		listen(listener) {
+			$atom.lc = listeners.push(listener);
+			return () => {
+				for (let i = lqIndex + QUEUE_ITEMS_PER_LISTENER; i < listenerQueue.length;) if (listenerQueue[i] === listener) listenerQueue.splice(i, QUEUE_ITEMS_PER_LISTENER);
+				else i += QUEUE_ITEMS_PER_LISTENER;
+				let index = listeners.indexOf(listener);
+				if (~index) {
+					listeners.splice(index, 1);
+					if (!--$atom.lc) $atom.off();
+				}
+			};
+		},
+		notify(oldValue, changedKey) {
+			nanostoresGlobal.epoch++;
+			let runListenerQueue = !listenerQueue.length && !batchSeen;
+			for (let listener of listeners) {
+				if (batchSeen?.has(listener)) continue;
+				batchSeen?.add(listener);
+				listenerQueue.push(listener, $atom, oldValue, batchSeen ? void 0 : changedKey);
+			}
+			if (runListenerQueue) drainQueue();
+		},
+		off() {},
+		set(newValue) {
+			let oldValue = $atom.value;
+			if (oldValue !== newValue) {
+				$atom.value = newValue;
+				$atom.notify(oldValue);
+			}
+		},
+		subscribe(listener) {
+			let unbind = $atom.listen(listener);
+			listener($atom.value);
+			return unbind;
+		},
+		value: initialValue
+	};
+	if (process.env.NODE_ENV !== "production") $atom[clean] = () => {
+		listeners = [];
+		$atom.lc = 0;
+		$atom.off();
+	};
+	return $atom;
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/nanostores@1.4.2/node_modules/nanostores/lifecycle/index.js
+const SET = 2;
+const MOUNT = 5;
+const UNMOUNT = 6;
+const REVERT_MUTATION = 10;
+let on = (object, listener, eventKey, mutateStore) => {
+	object.events = object.events || {};
+	if (!object.events[eventKey + REVERT_MUTATION]) object.events[eventKey + REVERT_MUTATION] = mutateStore((eventProps) => {
+		object.events[eventKey].reduceRight((event, l) => (l(event), event), {
+			shared: {},
+			...eventProps
+		});
+	});
+	object.events[eventKey] = object.events[eventKey] || [];
+	object.events[eventKey].push(listener);
+	return () => {
+		let currentListeners = object.events[eventKey];
+		let index = currentListeners.indexOf(listener);
+		currentListeners.splice(index, 1);
+		if (!currentListeners.length) {
+			delete object.events[eventKey];
+			object.events[eventKey + REVERT_MUTATION]();
+			delete object.events[eventKey + REVERT_MUTATION];
+		}
+	};
+};
+let onSet = ($store, listener) => on($store, listener, SET, (runListeners) => {
+	let originSet = $store.set;
+	let originSetKey = $store.setKey;
+	if ($store.setKey) $store.setKey = (changed, changedValue) => {
+		let isAborted;
+		let abort = () => {
+			isAborted = true;
+		};
+		runListeners({
+			abort,
+			changed,
+			newValue: {
+				...$store.value,
+				[changed]: changedValue
+			}
+		});
+		if (!isAborted) return originSetKey(changed, changedValue);
+	};
+	$store.set = (newValue) => {
+		let isAborted;
+		let abort = () => {
+			isAborted = true;
+		};
+		runListeners({
+			abort,
+			newValue
+		});
+		if (!isAborted) return originSet(newValue);
+	};
+	return () => {
+		$store.set = originSet;
+		$store.setKey = originSetKey;
+	};
+});
+const STORE_UNMOUNT_DELAY = 1e3;
+let onMount = ($store, initialize) => {
+	let listener = (payload) => {
+		let destroy = initialize(payload);
+		if (destroy) $store.events[UNMOUNT].push(destroy);
+	};
+	return on($store, listener, MOUNT, (runListeners) => {
+		let originListen = $store.listen;
+		$store.listen = (...args) => {
+			if (!$store.lc && !$store.active) {
+				$store.active = true;
+				runListeners();
+			}
+			return originListen(...args);
+		};
+		let originOff = $store.off;
+		$store.events[UNMOUNT] = [];
+		$store.off = () => {
+			originOff();
+			setTimeout(() => {
+				if ($store.active && !$store.lc) {
+					$store.active = false;
+					for (let destroy of $store.events[UNMOUNT]) destroy();
+					$store.events[UNMOUNT] = [];
+				}
+			}, STORE_UNMOUNT_DELAY);
+		};
+		if (process.env.NODE_ENV !== "production") {
+			let originClean = $store[clean];
+			$store[clean] = () => {
+				for (let destroy of $store.events[UNMOUNT]) destroy();
+				$store.events[UNMOUNT] = [];
+				$store.active = false;
+				originClean();
+			};
+		}
+		return () => {
+			$store.listen = originListen;
+			$store.off = originOff;
+		};
+	});
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/equality.mjs
+function isPlainObject(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+/**
+* Deep structural equality for JSON-serializable values.
+* Handles: primitives, null, arrays, and plain objects.
+* Short-circuits on referential equality at every recursion level.
+*/
+function isJsonEqual(a, b) {
+	if (a === b) return true;
+	if (Array.isArray(a) && Array.isArray(b)) {
+		if (a.length !== b.length) return false;
+		for (let i = 0; i < a.length; i++) if (!isJsonEqual(a[i], b[i])) return false;
+		return true;
+	}
+	if (isPlainObject(a) && isPlainObject(b)) {
+		const keysA = Object.keys(a);
+		const keysB = Object.keys(b);
+		if (keysA.length !== keysB.length) return false;
+		for (const key of keysA) if (!(key in b) || !isJsonEqual(a[key], b[key])) return false;
+		return true;
+	}
+	return false;
+}
+/**
+* Attach an equality gate to a nanostores atom via `onSet`.
+* When `isEqual(currentValue, newValue)` returns true, the `set()` call
+* is aborted: no listeners fire, no framework re-renders occur.
+*
+* Returns the unsubscribe function from `onSet`.
+*/
+function withEquality(store, isEqual) {
+	return onSet(store, ({ newValue, abort }) => {
+		if (isEqual(store.value, newValue)) abort();
+	});
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/focus-manager.mjs
+const kFocusManager = Symbol.for("better-auth:focus-manager");
+var WindowFocusManager = class {
+	listeners = /* @__PURE__ */ new Set();
+	subscribe(listener) {
+		this.listeners.add(listener);
+		return () => {
+			this.listeners.delete(listener);
+		};
+	}
+	setFocused(focused) {
+		this.listeners.forEach((listener) => listener(focused));
+	}
+	setup() {
+		if (typeof window === "undefined" || typeof document === "undefined" || typeof window.addEventListener === "undefined") return () => {};
+		const visibilityHandler = () => {
+			if (document.visibilityState === "visible") this.setFocused(true);
+		};
+		document.addEventListener("visibilitychange", visibilityHandler, false);
+		return () => {
+			document.removeEventListener("visibilitychange", visibilityHandler, false);
+		};
+	}
+};
+function getGlobalFocusManager() {
+	if (!globalThis[kFocusManager]) globalThis[kFocusManager] = new WindowFocusManager();
+	return globalThis[kFocusManager];
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/online-manager.mjs
+const kOnlineManager = Symbol.for("better-auth:online-manager");
+var WindowOnlineManager = class {
+	listeners = /* @__PURE__ */ new Set();
+	isOnline = typeof navigator !== "undefined" ? navigator.onLine : true;
+	subscribe(listener) {
+		this.listeners.add(listener);
+		return () => {
+			this.listeners.delete(listener);
+		};
+	}
+	setOnline(online) {
+		this.isOnline = online;
+		this.listeners.forEach((listener) => listener(online));
+	}
+	setup() {
+		if (typeof window === "undefined" || typeof window.addEventListener === "undefined") return () => {};
+		const onOnline = () => this.setOnline(true);
+		const onOffline = () => this.setOnline(false);
+		window.addEventListener("online", onOnline, false);
+		window.addEventListener("offline", onOffline, false);
+		return () => {
+			window.removeEventListener("online", onOnline, false);
+			window.removeEventListener("offline", onOffline, false);
+		};
+	}
+};
+function getGlobalOnlineManager() {
+	if (!globalThis[kOnlineManager]) globalThis[kOnlineManager] = new WindowOnlineManager();
+	return globalThis[kOnlineManager];
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/query.mjs
+const isServer$1 = () => typeof window === "undefined";
+function isAuthQueryStateEqual(a, b) {
+	return isJsonEqual(a.data, b.data) && a.error === b.error && a.isPending === b.isPending && a.isRefetching === b.isRefetching && a.refetch === b.refetch;
+}
+const useAuthQuery = (initializedAtom, path, $fetch, options) => {
+	const value = /* @__PURE__ */ atom({
+		data: null,
+		error: null,
+		isPending: true,
+		isRefetching: false,
+		refetch: (queryParams) => fn(queryParams)
+	});
+	withEquality(value, isAuthQueryStateEqual);
+	const fn = async (queryParams) => {
+		return new Promise((resolve) => {
+			const opts = typeof options === "function" ? options({
+				data: value.get().data,
+				error: value.get().error,
+				isPending: value.get().isPending
+			}) : options;
+			$fetch(path, {
+				...opts,
+				query: {
+					...opts?.query,
+					...queryParams?.query
+				},
+				async onSuccess(context) {
+					const current = value.get();
+					const stableData = current.data != null && context.data != null && isJsonEqual(current.data, context.data) ? current.data : context.data;
+					value.set({
+						data: stableData,
+						error: null,
+						isPending: false,
+						isRefetching: false,
+						refetch: value.value.refetch
+					});
+					await opts?.onSuccess?.(context);
+				},
+				async onError(context) {
+					const { request } = context;
+					const retryAttempts = typeof request.retry === "number" ? request.retry : request.retry?.attempts;
+					const retryAttempt = request.retryAttempt || 0;
+					if (retryAttempts && retryAttempt < retryAttempts) return;
+					const isUnauthorized = context.error.status === 401;
+					value.set({
+						error: context.error,
+						data: isUnauthorized ? null : value.get().data,
+						isPending: false,
+						isRefetching: false,
+						refetch: value.value.refetch
+					});
+					await opts?.onError?.(context);
+				},
+				async onRequest(context) {
+					const currentValue = value.get();
+					value.set({
+						isPending: currentValue.data === null,
+						data: currentValue.data,
+						error: null,
+						isRefetching: true,
+						refetch: value.value.refetch
+					});
+					await opts?.onRequest?.(context);
+				}
+			}).catch((error) => {
+				value.set({
+					error,
+					data: value.get().data,
+					isPending: false,
+					isRefetching: false,
+					refetch: value.value.refetch
+				});
+			}).finally(() => {
+				resolve(void 0);
+			});
+		});
+	};
+	initializedAtom = Array.isArray(initializedAtom) ? initializedAtom : [initializedAtom];
+	let isMountFetchPending = false;
+	let isMounted = false;
+	let shouldRefetchAfterPending = false;
+	const fetchOnMount = () => {
+		if (isMountFetchPending) {
+			shouldRefetchAfterPending = true;
+			return;
+		}
+		isMountFetchPending = true;
+		fn().finally(() => {
+			isMountFetchPending = false;
+			const shouldRefetch = shouldRefetchAfterPending && isMounted;
+			shouldRefetchAfterPending = false;
+			if (shouldRefetch) fetchOnMount();
+		});
+	};
+	onMount(value, () => {
+		if (isServer$1()) return;
+		isMounted = true;
+		let isInitialized = false;
+		let timeoutId;
+		const cleanups = initializedAtom.map((initAtom) => initAtom.listen(() => {
+			if (isInitialized) fn();
+			else {
+				isInitialized = true;
+				clearTimeout(timeoutId);
+				fetchOnMount();
+			}
+		}));
+		timeoutId = setTimeout(() => {
+			isInitialized = true;
+			fetchOnMount();
+		}, 0);
+		return () => {
+			isMounted = false;
+			for (const cleanup of cleanups) cleanup();
+			clearTimeout(timeoutId);
+		};
+	});
+	return value;
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/session-refresh.mjs
+const now = () => Math.floor(Date.now() / 1e3);
+/**
+* Rate limit: don't refetch on focus if a session request was made within this many seconds
+*/
+const FOCUS_REFETCH_RATE_LIMIT_SECONDS = 5;
+function createSessionRefreshManager(opts) {
+	const { fetchSession, shouldPollSession = () => true, sessionSignal, options = {} } = opts;
+	const refetchInterval = options.sessionOptions?.refetchInterval ?? 0;
+	const refetchOnWindowFocus = options.sessionOptions?.refetchOnWindowFocus ?? true;
+	const refetchWhenOffline = options.sessionOptions?.refetchWhenOffline ?? false;
+	const state = {
+		isInitialized: false,
+		lastSessionRequest: 0
+	};
+	const shouldRefetch = () => {
+		return refetchWhenOffline || getGlobalOnlineManager().isOnline;
+	};
+	const triggerRefetch = (event) => {
+		if (!shouldRefetch()) return;
+		if (event?.event === "storage") {
+			fetchSession();
+			return;
+		}
+		if (event?.event === "poll") {
+			state.lastSessionRequest = now();
+			fetchSession();
+			return;
+		}
+		if (event?.event === "visibilitychange") {
+			if (now() - state.lastSessionRequest < FOCUS_REFETCH_RATE_LIMIT_SECONDS) return;
+			state.lastSessionRequest = now();
+			fetchSession();
+			return;
+		}
+		fetchSession();
+	};
+	const broadcastSessionUpdate = (trigger) => {
+		getGlobalBroadcastChannel().post({
+			event: "session",
+			data: { trigger },
+			clientId: Math.random().toString(36).substring(7)
+		});
+	};
+	const setupPolling = () => {
+		if (refetchInterval && refetchInterval > 0) state.pollInterval = setInterval(() => {
+			if (shouldPollSession()) triggerRefetch({ event: "poll" });
+		}, refetchInterval * 1e3);
+	};
+	const setupBroadcast = () => {
+		state.unsubscribeBroadcast = getGlobalBroadcastChannel().subscribe(() => {
+			triggerRefetch({ event: "storage" });
+		});
+	};
+	const setupFocusRefetch = () => {
+		if (!refetchOnWindowFocus) return;
+		state.unsubscribeFocus = getGlobalFocusManager().subscribe(() => {
+			triggerRefetch({ event: "visibilitychange" });
+		});
+	};
+	const setupOnlineRefetch = () => {
+		state.unsubscribeOnline = getGlobalOnlineManager().subscribe((online) => {
+			if (online) triggerRefetch({ event: "visibilitychange" });
+		});
+	};
+	const setupSignalSubscription = () => {
+		state.unsubscribeSignal = sessionSignal.listen(() => {
+			fetchSession();
+		});
+	};
+	const init = () => {
+		if (state.isInitialized) return;
+		state.isInitialized = true;
+		setupPolling();
+		setupBroadcast();
+		setupFocusRefetch();
+		setupOnlineRefetch();
+		setupSignalSubscription();
+		state.cleanupBroadcastSetup = getGlobalBroadcastChannel().setup();
+		state.cleanupFocusSetup = getGlobalFocusManager().setup();
+		state.cleanupOnlineSetup = getGlobalOnlineManager().setup();
+	};
+	const cleanup = () => {
+		if (!state.isInitialized) return;
+		if (state.pollInterval) {
+			clearInterval(state.pollInterval);
+			state.pollInterval = void 0;
+		}
+		if (state.unsubscribeBroadcast) {
+			state.unsubscribeBroadcast();
+			state.unsubscribeBroadcast = void 0;
+		}
+		if (state.unsubscribeFocus) {
+			state.unsubscribeFocus();
+			state.unsubscribeFocus = void 0;
+		}
+		if (state.unsubscribeOnline) {
+			state.unsubscribeOnline();
+			state.unsubscribeOnline = void 0;
+		}
+		if (state.unsubscribeSignal) {
+			state.unsubscribeSignal();
+			state.unsubscribeSignal = void 0;
+		}
+		if (state.cleanupBroadcastSetup) {
+			state.cleanupBroadcastSetup();
+			state.cleanupBroadcastSetup = void 0;
+		}
+		if (state.cleanupFocusSetup) {
+			state.cleanupFocusSetup();
+			state.cleanupFocusSetup = void 0;
+		}
+		if (state.cleanupOnlineSetup) {
+			state.cleanupOnlineSetup();
+			state.cleanupOnlineSetup = void 0;
+		}
+		state.isInitialized = false;
+		state.lastSessionRequest = 0;
+	};
+	return {
+		init,
+		cleanup,
+		triggerRefetch,
+		broadcastSessionUpdate
+	};
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/fetch-plugins.mjs
+const redirectPlugin = {
+	id: "redirect",
+	name: "Redirect",
+	hooks: { onSuccess(context) {
+		if (context.data?.url && context.data?.redirect && isSafeUrlScheme(context.data.url)) {
+			if (typeof window !== "undefined" && window.location) {
+				if (window.location) try {
+					window.location.href = context.data.url;
+				} catch {}
+			}
+		}
+	} }
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/session-atom.mjs
+const isServer = () => typeof window === "undefined";
+/**
+* Normalize $fetch response: `throw: true` returns data directly,
+* otherwise `{ data, error }`.
+*/
+function normalizeSessionResponse(res) {
+	if (typeof res === "object" && res !== null && "data" in res && "error" in res) return res;
+	return {
+		data: res,
+		error: null
+	};
+}
+function normalizeSessionData(data) {
+	if (!data) return null;
+	if (data.session === null && data.user === null) return null;
+	return data;
+}
+function isSessionAtomEqual(a, b) {
+	return isJsonEqual(a.data, b.data) && a.error === b.error && a.isPending === b.isPending && a.isRefetching === b.isRefetching && a.refetch === b.refetch;
+}
+function getSessionAtom($fetch, options) {
+	const $signal = /* @__PURE__ */ atom(false);
+	let abortController;
+	const refetch = (queryParams) => fetchSession(queryParams);
+	const session = /* @__PURE__ */ atom({
+		data: null,
+		error: null,
+		isPending: true,
+		isRefetching: false,
+		refetch
+	});
+	withEquality(session, isSessionAtomEqual);
+	const settleAbortedFetch = (controller) => {
+		if (abortController !== controller) return;
+		const current = session.get();
+		abortController = void 0;
+		if (!current.isPending && !current.isRefetching) return;
+		session.set({
+			...current,
+			isPending: false,
+			isRefetching: false,
+			refetch
+		});
+	};
+	const fetchSession = async (queryParams) => {
+		abortController?.abort();
+		const controller = new AbortController();
+		abortController = controller;
+		const current = session.get();
+		session.set({
+			...current,
+			isPending: current.data === null,
+			isRefetching: true,
+			error: null,
+			refetch
+		});
+		try {
+			const res = await $fetch("/get-session", {
+				method: "GET",
+				query: queryParams?.query,
+				signal: controller.signal
+			});
+			if (controller.signal.aborted) {
+				settleAbortedFetch(controller);
+				return;
+			}
+			let { data, error } = normalizeSessionResponse(res);
+			if (data?.needsRefresh) try {
+				const refreshRes = await $fetch("/get-session", {
+					method: "POST",
+					signal: controller.signal
+				});
+				if (controller.signal.aborted) {
+					settleAbortedFetch(controller);
+					return;
+				}
+				({data, error} = normalizeSessionResponse(refreshRes));
+			} catch {
+				if (controller.signal.aborted) {
+					settleAbortedFetch(controller);
+					return;
+				}
+			}
+			if (error) {
+				const latest = session.get();
+				const isUnauthorized = error?.status === 401;
+				session.set({
+					data: isUnauthorized ? null : latest.data,
+					error,
+					isPending: false,
+					isRefetching: false,
+					refetch
+				});
+				return;
+			}
+			const sessionData = normalizeSessionData(data);
+			const current = session.get();
+			const stableData = current.data != null && sessionData != null && isJsonEqual(current.data, sessionData) ? current.data : sessionData;
+			session.set({
+				data: stableData,
+				error: null,
+				isPending: false,
+				isRefetching: false,
+				refetch
+			});
+		} catch (fetchError) {
+			if (controller.signal.aborted) {
+				settleAbortedFetch(controller);
+				return;
+			}
+			const latest = session.get();
+			session.set({
+				data: latest.data,
+				error: fetchError,
+				isPending: false,
+				isRefetching: false,
+				refetch
+			});
+		}
+	};
+	let broadcastSessionUpdate = () => {};
+	onMount(session, () => {
+		let timeoutId;
+		if (!isServer()) timeoutId = setTimeout(() => {
+			fetchSession();
+		}, 0);
+		const refreshManager = createSessionRefreshManager({
+			fetchSession,
+			shouldPollSession: () => session.get().data != null,
+			sessionSignal: $signal,
+			options
+		});
+		refreshManager.init();
+		broadcastSessionUpdate = refreshManager.broadcastSessionUpdate;
+		return () => {
+			if (timeoutId) clearTimeout(timeoutId);
+			const controller = abortController;
+			controller?.abort();
+			if (controller) settleAbortedFetch(controller);
+			refreshManager.cleanup();
+		};
+	});
+	return {
+		session,
+		$sessionSignal: $signal,
+		broadcastSessionUpdate: (trigger) => broadcastSessionUpdate(trigger)
+	};
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/config.mjs
+const resolvePublicAuthUrl = (basePath) => {
+	if (typeof process === "undefined") return void 0;
+	const path = basePath ?? "/api/auth";
+	if (process.env.NEXT_PUBLIC_AUTH_URL) return process.env.NEXT_PUBLIC_AUTH_URL;
+	if (typeof window === "undefined") {
+		if (process.env.NEXTAUTH_URL) try {
+			return process.env.NEXTAUTH_URL;
+		} catch {}
+		if (process.env.VERCEL_URL) try {
+			const protocol = process.env.VERCEL_URL.startsWith("http") ? "" : "https://";
+			return `${new URL(`${protocol}${process.env.VERCEL_URL}`).origin}${path}`;
+		} catch {}
+	}
+};
+const getClientConfig = (options, loadEnv) => {
+	const isCredentialsSupported = "credentials" in Request.prototype;
+	const baseURL = getBaseURL(options?.baseURL, options?.basePath, void 0, loadEnv) ?? resolvePublicAuthUrl(options?.basePath) ?? "/api/auth";
+	const pluginsFetchPlugins = options?.plugins?.flatMap((plugin) => plugin.fetchPlugins).filter((pl) => pl !== void 0) || [];
+	const lifeCyclePlugin = {
+		id: "lifecycle-hooks",
+		name: "lifecycle-hooks",
+		hooks: {
+			onSuccess: options?.fetchOptions?.onSuccess,
+			onError: options?.fetchOptions?.onError,
+			onRequest: options?.fetchOptions?.onRequest,
+			onResponse: options?.fetchOptions?.onResponse
+		}
+	};
+	const { onSuccess: _onSuccess, onError: _onError, onRequest: _onRequest, onResponse: _onResponse, ...restOfFetchOptions } = options?.fetchOptions || {};
+	const $fetch = createFetch({
+		baseURL,
+		...isCredentialsSupported ? { credentials: "include" } : {},
+		method: "GET",
+		jsonParser(text) {
+			if (!text) return null;
+			return parseJSON(text, { strict: false });
+		},
+		customFetchImpl: fetch,
+		...restOfFetchOptions,
+		plugins: [
+			lifeCyclePlugin,
+			...restOfFetchOptions.plugins || [],
+			...options?.disableDefaultFetchPlugins ? [] : [redirectPlugin],
+			...pluginsFetchPlugins
+		]
+	});
+	const { $sessionSignal, session, broadcastSessionUpdate } = getSessionAtom($fetch, options);
+	const plugins = options?.plugins || [];
+	let pluginsActions = {};
+	const pluginsAtoms = {
+		$sessionSignal,
+		session
+	};
+	const pluginPathMethods = {
+		"/sign-out": "POST",
+		"/revoke-sessions": "POST",
+		"/revoke-other-sessions": "POST",
+		"/delete-user": "POST"
+	};
+	const atomListeners = [{
+		signal: "$sessionSignal",
+		matcher(path) {
+			return path === "/sign-out" || path === "/update-user" || path === "/update-session" || path === "/sign-up/email" || path === "/sign-in/email" || path === "/delete-user" || path === "/verify-email" || path === "/revoke-sessions" || path === "/revoke-session" || path === "/revoke-other-sessions" || path === "/change-email" || path === "/change-password";
+		},
+		callback(path) {
+			if (path === "/sign-out") broadcastSessionUpdate("signout");
+			else if (path === "/update-user" || path === "/update-session") broadcastSessionUpdate("updateUser");
+		}
+	}];
+	for (const plugin of plugins) {
+		if (plugin.getAtoms) Object.assign(pluginsAtoms, plugin.getAtoms?.($fetch));
+		if (plugin.pathMethods) Object.assign(pluginPathMethods, plugin.pathMethods);
+		if (plugin.atomListeners) atomListeners.push(...plugin.atomListeners);
+	}
+	const $store = {
+		notify: (signal) => {
+			pluginsAtoms[signal].set(!pluginsAtoms[signal].get());
+		},
+		listen: (signal, listener) => {
+			pluginsAtoms[signal].subscribe(listener);
+		},
+		atoms: pluginsAtoms
+	};
+	for (const plugin of plugins) if (plugin.getActions) pluginsActions = defu(plugin.getActions?.($fetch, $store, options) ?? {}, pluginsActions);
+	return {
+		get baseURL() {
+			return baseURL;
+		},
+		pluginsActions,
+		pluginsAtoms,
+		pluginPathMethods,
+		atomListeners,
+		$fetch,
+		$store
+	};
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/utils/is-atom.mjs
+function isAtom(value) {
+	return typeof value === "object" && value !== null && "get" in value && typeof value.get === "function" && "lc" in value && typeof value.lc === "number";
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_39d811f210df3a5f20302036ab91db01/node_modules/@better-auth/core/dist/utils/string.mjs
+function capitalizeFirstLetter(str) {
+	return str.charAt(0).toUpperCase() + str.slice(1);
+}
+const WORD_PATTERN = /[\p{Ll}\d]+|\p{Lu}+(?!\p{Ll})|\p{Lu}[\p{Ll}\d]+|\p{Lo}+/gu;
+const APOSTROPHE_PATTERN = /['\u2019]/g;
+function splitWords(input) {
+	return input.replace(APOSTROPHE_PATTERN, "").match(WORD_PATTERN) ?? [];
+}
+function toKebabCase(input) {
+	return splitWords(input).map((word) => word.toLowerCase()).join("-");
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/proxy.mjs
+function getMethod(path, knownPathMethods, args) {
+	const method = knownPathMethods[path];
+	const { fetchOptions, query: _query, ...body } = args || {};
+	if (method) return method;
+	if (fetchOptions?.method) return fetchOptions.method;
+	if (body && Object.keys(body).length > 0) return "POST";
+	return "GET";
+}
+function createDynamicPathProxy(routes, client, knownPathMethods, atoms, atomListeners) {
+	function createProxy(path = []) {
+		return new Proxy(function() {}, {
+			get(_, prop) {
+				if (typeof prop !== "string") return;
+				if (prop === "then" || prop === "catch" || prop === "finally") return;
+				const fullPath = [...path, prop];
+				let current = routes;
+				for (const segment of fullPath) if (current && typeof current === "object" && segment in current) current = current[segment];
+				else {
+					current = void 0;
+					break;
+				}
+				if (typeof current === "function") return current;
+				if (isAtom(current)) return current;
+				return createProxy(fullPath);
+			},
+			apply: async (_, __, args) => {
+				const routePath = "/" + path.map(toKebabCase).join("/");
+				const arg = args[0] || {};
+				const fetchOptions = args[1] || {};
+				const { query, fetchOptions: argFetchOptions, ...body } = arg;
+				const options = {
+					...fetchOptions,
+					...argFetchOptions
+				};
+				const method = getMethod(routePath, knownPathMethods, arg);
+				return await client(routePath, {
+					...options,
+					body: method === "GET" ? void 0 : {
+						...body,
+						...options?.body || {}
+					},
+					query: query || options?.query,
+					method,
+					async onSuccess(context) {
+						await options?.onSuccess?.(context);
+						if (!atomListeners || options.disableSignal) return;
+						/**
+						* We trigger listeners
+						*/
+						const matches = atomListeners.filter((s) => s.matcher(routePath));
+						if (!matches.length) return;
+						const visited = /* @__PURE__ */ new Set();
+						for (const match of matches) {
+							const signal = atoms[match.signal];
+							if (!signal) return;
+							if (visited.has(match.signal)) continue;
+							visited.add(match.signal);
+							/**
+							* To avoid race conditions we set the signal in a setTimeout
+							*/
+							const val = signal.get();
+							setTimeout(() => {
+								signal.set(!val);
+							}, 10);
+							match.callback?.(routePath);
+						}
+					}
+				});
+			}
+		});
+	}
+	return createProxy();
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/client/vanilla.mjs
+function createAuthClient(options) {
+	const { pluginPathMethods, pluginsActions, pluginsAtoms, $fetch, atomListeners, $store } = getClientConfig(options);
+	const resolvedHooks = {};
+	for (const [key, value] of Object.entries(pluginsAtoms)) resolvedHooks[`use${capitalizeFirstLetter(key)}`] = value;
+	return createDynamicPathProxy({
+		...pluginsActions,
+		...resolvedHooks,
+		$fetch,
+		$store
+	}, $fetch, pluginPathMethods, pluginsAtoms, atomListeners);
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/additional-fields/client.mjs
+const inferAdditionalFields = (schema) => {
+	return {
+		id: "additional-fields-client",
+		version: PACKAGE_VERSION$1,
+		$InferServerPlugin: {}
+	};
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/admin/client.mjs
+const adminClient = (options) => {
+	const roles = {
+		admin: adminAc$1,
+		user: userAc,
+		...options?.roles
+	};
+	return {
+		id: "admin-client",
+		version: PACKAGE_VERSION$1,
+		$InferServerPlugin: {},
+		getActions: () => ({ admin: { checkRolePermission: (data) => {
+			return hasPermission({
+				role: data.role,
+				options: {
+					ac: options?.ac,
+					roles
+				},
+				permissions: data.permissions
+			});
+		} } }),
+		pathMethods: {
+			"/admin/list-users": "GET",
+			"/admin/impersonate-user": "POST",
+			"/admin/stop-impersonating": "POST"
+		},
+		atomListeners: [{
+			matcher: (path) => path === "/admin/impersonate-user" || path === "/admin/stop-impersonating",
+			signal: "$sessionSignal"
+		}],
+		$ERROR_CODES: ADMIN_ERROR_CODES
+	};
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/device-authorization/client.mjs
+const deviceAuthorizationClient = () => {
+	return {
+		id: "device-authorization",
+		version: PACKAGE_VERSION$1,
+		$InferServerPlugin: {},
+		pathMethods: {
+			"/device/code": "POST",
+			"/device/token": "POST",
+			"/device": "GET",
+			"/device/approve": "POST",
+			"/device/deny": "POST"
+		}
+	};
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.26_@opentelemetry+api@1.9.1_drizzle-orm@1.0.0-rc.4_@opentelemetry+api@1_56a4a2a6caec5e04d8eab345894c8059/node_modules/better-auth/dist/plugins/organization/client.mjs
+/**
+* Using the same `hasPermissionFn` function, but without the need for a `ctx` parameter or the `organizationId` parameter.
+*/
+const clientSideHasPermission = (input) => {
+	return hasPermissionFn(input, input.options.roles || defaultRoles);
+};
+const organizationClient = (options) => {
+	const $listOrg = /* @__PURE__ */ atom(false);
+	const $activeOrgSignal = /* @__PURE__ */ atom(false);
+	const $activeMemberSignal = /* @__PURE__ */ atom(false);
+	const $activeMemberRoleSignal = /* @__PURE__ */ atom(false);
+	const roles = {
+		admin: adminAc,
+		member: memberAc,
+		owner: ownerAc,
+		...options?.roles
+	};
+	return {
+		id: "organization",
+		version: PACKAGE_VERSION$1,
+		$InferServerPlugin: {},
+		getActions: ($fetch, _$store, co) => ({
+			$Infer: {
+				ActiveOrganization: {},
+				Organization: {},
+				Invitation: {},
+				Member: {},
+				Team: {}
+			},
+			organization: { checkRolePermission: (data) => {
+				return clientSideHasPermission({
+					role: data.role,
+					options: {
+						ac: options?.ac,
+						roles
+					},
+					permissions: data.permissions
+				});
+			} }
+		}),
+		getAtoms: ($fetch) => {
+			const listOrganizations = useAuthQuery($listOrg, "/organization/list", $fetch, { method: "GET" });
+			const activeOrganization = useAuthQuery([$activeOrgSignal], "/organization/get-full-organization", $fetch, () => ({ method: "GET" }));
+			const activeMember = useAuthQuery([$activeOrgSignal, $activeMemberSignal], "/organization/get-active-member", $fetch, { method: "GET" });
+			const activeMemberRole = useAuthQuery([$activeOrgSignal, $activeMemberRoleSignal], "/organization/get-active-member-role", $fetch, { method: "GET" });
+			return {
+				$listOrg,
+				$activeOrgSignal,
+				$activeMemberSignal,
+				$activeMemberRoleSignal,
+				activeOrganization,
+				listOrganizations,
+				activeMember,
+				activeMemberRole
+			};
+		},
+		pathMethods: {
+			"/organization/get-full-organization": "GET",
+			"/organization/list-user-teams": "GET"
+		},
+		atomListeners: [
+			{
+				matcher(path) {
+					return path === "/organization/create" || path === "/organization/delete" || path === "/organization/update";
+				},
+				signal: "$listOrg"
+			},
+			{
+				matcher(path) {
+					return path === "/sign-out" || path.startsWith("/organization");
+				},
+				signal: "$activeOrgSignal"
+			},
+			{
+				matcher(path) {
+					return path.startsWith("/organization/set-active") || path === "/organization/create" || path === "/organization/delete" || path === "/organization/remove-member" || path === "/organization/leave" || path === "/organization/accept-invitation";
+				},
+				signal: "$sessionSignal"
+			},
+			{
+				matcher(path) {
+					return path.includes("/organization/update-member-role") || path.startsWith("/organization/set-active");
+				},
+				signal: "$activeMemberSignal"
+			},
+			{
+				matcher(path) {
+					return path.includes("/organization/update-member-role") || path.startsWith("/organization/set-active");
+				},
+				signal: "$activeMemberRoleSignal"
+			}
+		],
+		$ERROR_CODES: ORGANIZATION_ERROR_CODES
+	};
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/@better-auth+api-key@1.6.26_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-f_7fcf2d2039ede21128af994b19d00ab6/node_modules/@better-auth/api-key/dist/version-vgVyvied.mjs
+const API_KEY_ERROR_CODES = defineErrorCodes({
+	INVALID_METADATA_TYPE: "metadata must be an object or undefined",
+	REFILL_AMOUNT_AND_INTERVAL_REQUIRED: "refillAmount is required when refillInterval is provided",
+	REFILL_INTERVAL_AND_AMOUNT_REQUIRED: "refillInterval is required when refillAmount is provided",
+	USER_BANNED: "User is banned",
+	UNAUTHORIZED_SESSION: "Unauthorized or invalid session",
+	KEY_NOT_FOUND: "API Key not found",
+	KEY_DISABLED: "API Key is disabled",
+	KEY_EXPIRED: "API Key has expired",
+	USAGE_EXCEEDED: "API Key has reached its usage limit",
+	KEY_NOT_RECOVERABLE: "API Key is not recoverable",
+	EXPIRES_IN_IS_TOO_SMALL: "The expiresIn is smaller than the predefined minimum value.",
+	EXPIRES_IN_IS_TOO_LARGE: "The expiresIn is larger than the predefined maximum value.",
+	INVALID_REMAINING: "The remaining count is either too large or too small.",
+	INVALID_PREFIX_LENGTH: "The prefix length is either too large or too small.",
+	INVALID_NAME_LENGTH: "The name length is either too large or too small.",
+	METADATA_DISABLED: "Metadata is disabled.",
+	RATE_LIMIT_EXCEEDED: "Rate limit exceeded.",
+	NO_VALUES_TO_UPDATE: "No values to update.",
+	KEY_DISABLED_EXPIRATION: "Custom key expiration values are disabled.",
+	INVALID_API_KEY: "Invalid API key.",
+	INVALID_USER_ID_FROM_API_KEY: "The user id from the API key is invalid.",
+	INVALID_REFERENCE_ID_FROM_API_KEY: "The reference id from the API key is invalid.",
+	INVALID_API_KEY_GETTER_RETURN_TYPE: "API Key getter returned an invalid key type. Expected string.",
+	SERVER_ONLY_PROPERTY: "The property you're trying to set can only be set from the server auth instance only.",
+	FAILED_TO_UPDATE_API_KEY: "Failed to update API key",
+	NAME_REQUIRED: "API Key name is required.",
+	ORGANIZATION_ID_REQUIRED: "Organization ID is required for organization-owned API keys.",
+	USER_NOT_MEMBER_OF_ORGANIZATION: "You are not a member of the organization that owns this API key.",
+	INSUFFICIENT_API_KEY_PERMISSIONS: "You do not have permission to perform this action on organization API keys.",
+	NO_DEFAULT_API_KEY_CONFIGURATION_FOUND: "No default api-key configuration found.",
+	ORGANIZATION_PLUGIN_REQUIRED: "Organization plugin is required for organization-owned API keys. Please install and configure the organization plugin."
+});
+const PACKAGE_VERSION = "1.6.26";
+
+//#endregion
+//#region ../../node_modules/.pnpm/@better-auth+api-key@1.6.26_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-f_7fcf2d2039ede21128af994b19d00ab6/node_modules/@better-auth/api-key/dist/client.mjs
+const apiKeyClient = () => {
+	return {
+		id: "api-key",
+		version: PACKAGE_VERSION,
+		$InferServerPlugin: {},
+		pathMethods: {
+			"/api-key/create": "POST",
+			"/api-key/delete": "POST",
+			"/api-key/delete-all-expired-api-keys": "POST"
+		},
+		$ERROR_CODES: API_KEY_ERROR_CODES
+	};
+};
+
+//#endregion
+//#region ../auth/dist/client.mjs
+function c$1() {
+	return [
+		apiKeyClient(),
+		adminClient(),
+		deviceAuthorizationClient(),
+		organizationClient({
+			ac: t$1,
+			roles: n$1
+		}),
+		inferAdditionalFields()
+	];
+}
+const l$1 = (e) => createAuthClient({
+	baseURL: e.baseURL,
+	basePath: e.basePath,
+	plugins: c$1()
+});
+
+//#endregion
+//#region src/lib/errors.ts
+var CliError = class extends Error {
+	code;
+	exitCode;
+	details;
+	constructor(code, message, options) {
+		super(message);
+		this.name = "CliError";
+		this.code = code;
+		this.exitCode = options?.exitCode ?? 1;
+		this.details = options?.details;
+	}
+};
+function exitCodeForError(error) {
+	if (error instanceof CliError) return error.exitCode;
+	return 1;
+}
+
+//#endregion
+//#region src/lib/client.ts
+const AUTH_BASE_PATH = "/api/v1/auth";
+function createCliAuthClient(apiUrl) {
+	return l$1({
+		baseURL: apiUrl,
+		basePath: AUTH_BASE_PATH
+	});
+}
+function bearerFetchOptions(sessionToken) {
+	return { headers: { Authorization: `Bearer ${sessionToken}` } };
+}
+/**
+* RPC requires `session.activeOrganizationId`. Used when a caller still has a
+* user session token (not the management-key path from `shipd login`).
+*/
+async function ensureActiveOrganization(input) {
+	const fetchOptions = bearerFetchOptions(input.sessionToken);
+	const listed = await input.auth.organization.list({ fetchOptions });
+	if (listed.error) throw new CliError("unauthenticated", listed.error.message ?? "Failed to list organizations");
+	const orgs = listed.data ?? [];
+	if (input.orgSlug) {
+		const match = orgs.find((org) => org.slug === input.orgSlug || org.id === input.orgSlug);
+		if (!match) throw new CliError("not_found", `Organization not found: ${input.orgSlug}. Join or create it, then retry with --org.`);
+		const activated = await input.auth.organization.setActive({
+			organizationId: match.id,
+			fetchOptions
+		});
+		if (activated.error) throw new CliError("unauthenticated", activated.error.message ?? "Failed to set active organization");
+		return match;
+	}
+	if (orgs.length === 1) {
+		const only = orgs[0];
+		const activated = await input.auth.organization.setActive({
+			organizationId: only.id,
+			fetchOptions
+		});
+		if (activated.error) throw new CliError("unauthenticated", activated.error.message ?? "Failed to set active organization");
+		return only;
+	}
+	if (orgs.length > 1) {
+		const slugs = orgs.map((org) => org.slug).join(", ");
+		throw new CliError("validation_error", `Multiple organizations available (${slugs}). Pass --org <slug> to choose one.`);
+	}
+	const slug = `personal-${Date.now().toString(36)}`;
+	const created = await input.auth.organization.create({
+		name: "Personal",
+		slug,
+		fetchOptions
+	});
+	if (created.error) throw new CliError("unauthenticated", created.error.message ?? "Failed to create a personal organization");
+	const org = created.data;
+	if (!org?.id) throw new CliError("internal", "Organization create returned no organization");
+	await input.auth.organization.setActive({
+		organizationId: org.id,
+		fetchOptions
+	});
+	return org;
+}
+async function createCliApiClient(runtime) {
+	const credentials = loadCredentials();
+	const apiKey = runtime.apiKey ?? credentials.apiKey;
+	const sessionToken = apiKey ? void 0 : credentials.sessionToken;
+	if (sessionToken) await ensureActiveOrganization({
+		auth: createCliAuthClient(runtime.apiUrl),
+		sessionToken,
+		orgSlug: runtime.org
+	});
+	const client = _$1({
+		baseUrl: runtime.apiUrl,
+		client: "cli",
+		getHeaders: () => {
+			const headers = new Headers();
+			if (apiKey) headers.set("x-api-key", apiKey);
+			else if (sessionToken) headers.set("Authorization", `Bearer ${sessionToken}`);
+			return headers;
+		}
+	});
+	if (apiKey && runtime.org) {
+		const me = await client.me.get({}).catch(mapApiError);
+		if (me.organization.slug !== runtime.org && me.organization.id !== runtime.org) throw new CliError("validation_error", `Organization mismatch: API key is bound to "${me.organization.slug}", but --org/SHIPD_ORG is "${runtime.org}". Re-login for that org or omit --org.`);
+	}
+	return client;
+}
+function mapApiError(error) {
+	if (error instanceof r$1) {
+		const details = error.details;
+		let exitCode = 1;
+		if (error.code === "conflict") exitCode = 3;
+		else if (error.code === "validation_error" && details?.code === "unlinked") exitCode = 4;
+		throw new CliError(error.code, error.message, {
+			exitCode,
+			details: error.details
+		});
+	}
+	throw error;
+}
+async function resolveProjectId(client, runtime) {
+	const me = await client.me.get({}).catch(mapApiError);
+	let projectId = me.project?.id;
+	if (runtime.project) {
+		const match = (await client.project.list({}).catch(mapApiError)).find((p) => p.slug === runtime.project || p.id === runtime.project);
+		if (!match) throw new CliError("not_found", `Project not found: ${runtime.project}`);
+		projectId = match.id;
+	}
+	if (!projectId) throw new CliError("validation_error", "Project is required. Pass --project, set SHIPD_PROJECT, or use an API key with project metadata.");
+	return {
+		organizationId: me.organization.id,
+		projectId
+	};
+}
+async function resolveIds(client, runtime) {
+	const { organizationId, projectId } = await resolveProjectId(client, runtime);
+	let environmentId = (await client.me.get({}).catch(mapApiError)).environment?.id;
+	if (runtime.env) {
+		const match = (await client.environment.list({ projectId }).catch(mapApiError)).find((e) => e.slug === runtime.env || e.id === runtime.env);
+		if (!match) throw new CliError("not_found", `Environment not found: ${runtime.env}`);
+		environmentId = match.id;
+	}
+	if (!environmentId) throw new CliError("validation_error", "Environment is required. Pass --env, set SHIPD_ENV, or use an API key with environment metadata.");
+	return {
+		organizationId,
+		projectId,
+		environmentId
+	};
+}
+
+//#endregion
+//#region src/lib/output.ts
+function getRuntime(command) {
+	const opts = command.optsWithGlobals();
+	return resolveRuntimeConfig(opts);
+}
+function printResult(runtime, data, human) {
+	if (runtime.json) {
+		console.log(JSON.stringify(data, null, 2));
+		return;
+	}
+	console.log(human);
+}
+async function confirm(runtime, message) {
+	if (runtime.yes) return true;
+	if (!process.stdin.isTTY) return false;
+	process.stderr.write(`${message} [y/N] `);
+	const answer = await new Promise((resolve) => {
+		const onData = (chunk) => {
+			process.stdin.pause();
+			process.stdin.off("data", onData);
+			resolve(String(chunk).trim());
+		};
+		process.stdin.resume();
+		process.stdin.setEncoding("utf8");
+		process.stdin.on("data", onData);
+	});
+	return /^y(es)?$/i.test(answer);
+}
+
+//#endregion
+//#region ../auth/dist/device.mjs
+function e(e) {
+	return e;
+}
+
+//#endregion
+//#region src/commands/auth.ts
+const CLIENT_ID = "shipd-cli";
+const MANAGEMENT_KEY_PREFIX = "shipd_mgmt_";
+function registerAuthCommands(program) {
+	program.command("login").description("Authenticate via browser device authorization").action(async (_opts, command) => {
+		const runtime = getRuntime(command);
+		const auth = e(createCliAuthClient(runtime.apiUrl));
+		const codeResult = await auth.device.code({ client_id: CLIENT_ID });
+		if (codeResult.error) throw new CliError("unauthenticated", codeResult.error.error_description ?? "Failed to start device authorization");
+		const data = codeResult.data;
+		if (!data) throw new CliError("unauthenticated", "Device authorization returned no data");
+		const verificationUrl = data.verification_uri_complete?.startsWith("http") ? data.verification_uri_complete : new URL(data.verification_uri_complete ?? data.verification_uri, runtime.appUrl).toString();
+		if (runtime.json) console.error(JSON.stringify({
+			user_code: data.user_code,
+			verification_uri: verificationUrl,
+			expires_in: data.expires_in
+		}, null, 2));
+		else {
+			console.log("Open the following URL in your browser and enter the code:\n");
+			console.log(`  ${verificationUrl}`);
+			console.log(`\n  Code: ${data.user_code}\n`);
+			console.log("Waiting for approval…");
+		}
+		const intervalMs = Math.max((data.interval ?? 5) * 1e3, 1e3);
+		const deadline = Date.now() + (data.expires_in ?? 300) * 1e3;
+		while (Date.now() < deadline) {
+			await new Promise((resolve) => setTimeout(resolve, intervalMs));
+			const tokenResult = await auth.device.token({
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+				device_code: data.device_code,
+				client_id: CLIENT_ID
+			});
+			if (tokenResult.error) {
+				const code = tokenResult.error.error;
+				if (code === "authorization_pending" || code === "slow_down") {
+					if (code === "slow_down") await new Promise((resolve) => setTimeout(resolve, intervalMs));
+					continue;
+				}
+				throw new CliError("unauthenticated", tokenResult.error.error_description ?? "Device authorization failed");
+			}
+			const scope = tokenResult.data?.scope?.trim() ?? "";
+			if (!scope.startsWith(MANAGEMENT_KEY_PREFIX)) throw new CliError("unauthenticated", "Device authorization did not return a management API key. Approve org, project, and environment in the browser.");
+			saveCredentials({
+				apiKey: scope,
+				apiUrl: runtime.apiUrl
+			});
+			const me = await (await createCliApiClient({
+				...runtime,
+				apiKey: scope,
+				org: void 0
+			})).me.get({}).catch(mapApiError);
+			saveGlobalConfig({
+				...loadGlobalConfig(),
+				org: me.organization.slug,
+				...me.project ? { project: me.project.slug } : {},
+				...me.environment ? { env: me.environment.slug } : {}
+			});
+			printResult(runtime, {
+				authenticated: true,
+				organization: me.organization,
+				project: me.project,
+				environment: me.environment
+			}, me.project && me.environment ? `Logged in successfully (${me.organization.slug} / ${me.project.slug} / ${me.environment.slug}).` : `Logged in successfully (org: ${me.organization.slug}).`);
+			return;
+		}
+		throw new CliError("unauthenticated", "Device authorization timed out");
+	});
+	program.command("logout").description("Clear stored credentials").action(async (_opts, command) => {
+		const runtime = getRuntime(command);
+		clearCredentials();
+		printResult(runtime, { loggedOut: true }, "Logged out.");
+	});
+	program.command("whoami").description("Show the current authenticated identity").action(async (_opts, command) => {
+		const runtime = getRuntime(command);
+		const me = await (await createCliApiClient(runtime)).me.get({}).catch(mapApiError);
+		if (runtime.json) {
+			console.log(JSON.stringify(me, null, 2));
+			return;
+		}
+		if (me.auth.type === "user") console.log(`User: ${me.auth.name} <${me.auth.email}>`);
+		else console.log(`API key: ${me.auth.keyId}`);
+		console.log(`Organization: ${me.organization.slug} (${me.organization.id})`);
+		if (me.project) console.log(`Project: ${me.project.slug} (${me.project.id})`);
+		if (me.environment) console.log(`Environment: ${me.environment.slug} (${me.environment.id})`);
+	});
+}
+
+//#endregion
+//#region ../contracts/dist/flag.mjs
+const t = z.enum([
+	`boolean`,
+	`variant`,
+	`number`,
+	`json`
+]);
+const n = z.enum([
+	`any`,
+	`code`,
+	`dashboard`
+]);
+const r = z.enum([
+	`active`,
+	`deprecated`,
+	`archived`,
+	`deleted`
+]);
+const i = /* @__PURE__ */ new Set([`__proto__`]);
+function a(e) {
+	return i.has(e);
+}
+const o = z.string().min(1).refine((e) => e.trim().length > 0, { message: `flag key must not be empty or whitespace-only` }).refine((e) => !a(e), { message: `flag key "__proto__" is reserved` });
+const s = z.discriminatedUnion(`kind`, [
+	z.object({
+		kind: z.literal(`boolean`),
+		value: z.boolean()
+	}),
+	z.object({
+		kind: z.literal(`variant`),
+		value: z.string()
+	}),
+	z.object({
+		kind: z.literal(`number`),
+		value: z.number()
+	}),
+	z.object({
+		kind: z.literal(`json`),
+		value: z.unknown()
+	}),
+	z.object({ kind: z.literal(`disabled`) })
+]);
+const c = z.union([
+	z.object({
+		kind: z.literal(`attribute`),
+		attribute: z.string().min(1),
+		operator: z.enum([
+			`eq`,
+			`neq`,
+			`contains`
+		]),
+		value: z.union([
+			z.string(),
+			z.number(),
+			z.boolean()
+		])
+	}),
+	z.object({
+		kind: z.literal(`attribute`),
+		attribute: z.string().min(1),
+		operator: z.literal(`in`),
+		value: z.array(z.string())
+	}),
+	z.object({
+		kind: z.literal(`percentage`),
+		rollout: z.number().min(0).max(100),
+		seed: z.string().min(1).optional()
+	})
+]);
+const l = z.object({
+	id: z.string().min(1),
+	description: z.string().optional(),
+	conditions: z.array(c),
+	serve: s
+});
+const u = z.object({ projectId: z.string().min(1) });
+const d = z.object({
+	projectId: z.string().min(1),
+	key: z.string().min(1)
+});
+const f = z.object({
+	projectId: z.string().min(1),
+	key: o,
+	name: z.string().min(1),
+	description: z.string().optional(),
+	type: t,
+	variants: z.array(z.string()).optional(),
+	tags: z.array(z.string()).optional()
+}).superRefine((e, t) => {
+	e.type === `variant` && (e.variants?.length ?? 0) === 0 && t.addIssue({
+		code: `custom`,
+		path: [`variants`],
+		message: `variant flag requires a non-empty variants array`
+	});
+});
+const p = z.object({
+	flagId: z.string().min(1),
+	key: o.optional(),
+	name: z.string().min(1).optional(),
+	description: z.string().nullable().optional(),
+	type: t.optional(),
+	variants: z.array(z.string()).nullable().optional(),
+	tags: z.array(z.string()).optional()
+});
+const m = z.object({ flagId: z.string().min(1) });
+const h = z.object({
+	flagId: z.string().min(1),
+	environmentId: z.string().min(1),
+	enabled: z.boolean().optional(),
+	rules: z.array(l).optional(),
+	fallthrough: s.optional()
+});
+const g = z.object({
+	flagId: z.string().min(1),
+	environmentId: z.string().min(1),
+	enabled: z.boolean()
+});
+const _ = z.enum([`active`, `deprecated`]);
+function v(e) {
+	let t = Object.getPrototypeOf(e);
+	return t === Object.prototype || t === null;
+}
+function y(e, t) {
+	if (e === null) return !0;
+	switch (typeof e) {
+		case `boolean`:
+		case `string`: return !0;
+		case `number`: return Number.isFinite(e);
+		case `object`: {
+			let n = t ?? /* @__PURE__ */ new WeakSet();
+			return !n.has(e) && (n.add(e), Array.isArray(e) ? e.every((e) => y(e, n)) : !v(e) || Object.getOwnPropertySymbols(e).length > 0 ? !1 : Object.keys(e).every((t) => y(e[t], n)));
+		}
+		default: return !1;
+	}
+}
+const b = z.custom(y, { message: `default must be JSON-serializable` });
+function x(e, t) {
+	switch (e.type) {
+		case `boolean`:
+			typeof e.default != `boolean` && t.addIssue({
+				code: `custom`,
+				path: [`default`],
+				message: `boolean flag default must be a boolean`
+			});
+			break;
+		case `number`:
+			(typeof e.default != `number` || !Number.isFinite(e.default)) && t.addIssue({
+				code: `custom`,
+				path: [`default`],
+				message: `number flag default must be a finite number`
+			});
+			break;
+		case `variant`: {
+			let n = e.variants ?? [];
+			n.length === 0 && t.addIssue({
+				code: `custom`,
+				path: [`variants`],
+				message: `variant flag requires a non-empty variants array`
+			}), (typeof e.default != `string` || !n.includes(e.default)) && t.addIssue({
+				code: `custom`,
+				path: [`default`],
+				message: `variant default must be one of: ${n.join(`, `) || `(none)`}`
+			});
+			break;
+		}
+		case `json`: b.safeParse(e.default).success || t.addIssue({
+			code: `custom`,
+			path: [`default`],
+			message: `json flag default must be JSON-serializable`
+		});
+	}
+}
+const S = z.object({
+	key: o,
+	type: t,
+	default: z.unknown(),
+	description: z.string().optional(),
+	tags: z.array(z.string()).default([]),
+	lifecycle: _.default(`active`),
+	variants: z.array(z.string()).optional(),
+	disabled: z.boolean().optional()
+});
+const C = S.superRefine(x);
+const w = S.extend({
+	version: z.number().int().positive(),
+	environmentVersion: z.number().int().positive().optional(),
+	managedBy: n
+}).superRefine(x);
+const T = z.object({
+	version: z.number().int().positive(),
+	environmentVersion: z.number().int().positive().optional()
+});
+const E = z.object({
+	projectId: z.string().min(1),
+	environmentId: z.string().min(1)
+});
+const D = z.object({
+	projectId: z.string(),
+	environmentId: z.string(),
+	flags: z.array(w)
+});
+function O(e, t) {
+	let n = /* @__PURE__ */ new Set();
+	for (let [r, i] of e.entries()) n.has(i.key) && t.addIssue({
+		code: `custom`,
+		path: [
+			`flags`,
+			r,
+			`key`
+		],
+		message: `duplicate flag key "${i.key}"`
+	}), n.add(i.key);
+}
+const k = z.object({
+	projectId: z.string().min(1),
+	environmentId: z.string().min(1),
+	flags: z.array(C)
+}).superRefine((e, t) => O(e.flags, t));
+const A = z.object({
+	key: z.string(),
+	op: z.enum([
+		`add`,
+		`update`,
+		`remove`,
+		`unlinked`
+	]),
+	before: w.optional(),
+	after: C.optional(),
+	message: z.string().optional()
+});
+const j = z.object({
+	projectId: z.string(),
+	environmentId: z.string(),
+	changes: z.array(A),
+	remoteOnly: z.array(w).default([])
+});
+const M = z.object({
+	projectId: z.string().min(1),
+	environmentId: z.string().min(1),
+	flags: z.array(C),
+	apply: z.boolean().default(!1),
+	prune: z.boolean().default(!1),
+	force: z.boolean().default(!1),
+	adopt: z.boolean().default(!1),
+	expectedVersions: z.record(z.string(), T).optional()
+}).superRefine((e, t) => O(e.flags, t));
+const N = z.object({
+	projectId: z.string(),
+	environmentId: z.string(),
+	applied: z.boolean(),
+	changes: z.array(A),
+	remoteOnly: z.array(w).default([]),
+	forced: z.boolean().default(!1),
+	adopted: z.boolean().default(!1)
+});
+
+//#endregion
+//#region src/lib/local-config.ts
+const localFlagsArraySchema = z.array(C).superRefine((flags, ctx) => {
+	const seen = /* @__PURE__ */ new Set();
+	for (const [index, flag] of flags.entries()) {
+		if (seen.has(flag.key)) ctx.addIssue({
+			code: "custom",
+			path: [index, "key"],
+			message: `duplicate flag key "${flag.key}"`
+		});
+		seen.add(flag.key);
+	}
+});
+async function loadLocalFlags(configFile) {
+	const absolute = path.resolve(configFile);
+	if (!fs.existsSync(absolute)) throw new CliError("not_found", `Config file not found: ${absolute}`);
+	const jiti = createJiti(import.meta.url, { interopDefault: true });
+	let loaded;
+	try {
+		loaded = await jiti.import(absolute);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		throw new CliError("validation_error", `Failed to load config ${absolute}: ${message}`);
+	}
+	const config = loaded.default ?? loaded;
+	if (!config.flags || typeof config.flags !== "object") throw new CliError("validation_error", "shipd.config.ts must export defineFlags(...) result");
+	const candidates = Object.entries(config.flags).map(([key, flag]) => ({
+		key,
+		type: flag.type,
+		default: flag.default,
+		description: flag.description,
+		tags: flag.tags ?? [],
+		lifecycle: flag.lifecycle ?? "active",
+		variants: flag.variants,
+		disabled: flag.disabled
+	}));
+	const parsed = localFlagsArraySchema.safeParse(candidates);
+	if (!parsed.success) {
+		const detail = parsed.error.issues.map((issue) => `${issue.path.join(".") || "flags"}: ${issue.message}`).join("; ");
+		throw new CliError("validation_error", `Invalid flag definitions: ${detail}`);
+	}
+	return parsed.data.map((flag) => ({
+		key: flag.key,
+		type: flag.type,
+		default: flag.default,
+		description: flag.description,
+		tags: flag.tags,
+		lifecycle: flag.lifecycle,
+		variants: flag.variants,
+		disabled: flag.disabled
+	}));
+}
+function serializeValue(value) {
+	return JSON.stringify(value, null, 2).replace(/\n/g, "\n    ");
+}
+function generateShipdConfigSource(flags) {
+	return `import { defineFlags } from "shipdit/config";
+
+/**
+ * Generated by \`shipd pull\`. This file is regenerated on pull — edit carefully.
+ * \`shipd push\` syncs definitions (project-global) and defaults for the target env.
+ */
+export default defineFlags({
+${flags.map((flag) => {
+		const lines = [`  ${JSON.stringify(flag.key)}: {`, `    type: ${JSON.stringify(flag.type)},`];
+		if (flag.type === "variant" && flag.variants) lines.push(`    variants: ${JSON.stringify(flag.variants)} as const,`, `    default: ${JSON.stringify(flag.default)},`);
+		else if (flag.type === "json") lines.push(`    default: ${serializeValue(flag.default)},`);
+		else lines.push(`    default: ${JSON.stringify(flag.default)},`);
+		if (flag.description !== void 0) lines.push(`    description: ${JSON.stringify(flag.description)},`);
+		if (flag.tags.length > 0) lines.push(`    tags: ${JSON.stringify(flag.tags)},`);
+		if (flag.lifecycle === "deprecated") lines.push(`    deprecated: true,`);
+		lines.push(`  },`);
+		return lines.join("\n");
+	}).join("\n")}
+});
+`;
+}
+function generateTypesSource(flags) {
+	const entries = flags.map((flag) => {
+		const lines = [`  ${JSON.stringify(flag.key)}: {`, `    type: ${JSON.stringify(flag.type)};`];
+		if (flag.type === "variant") {
+			const variants = flag.variants && flag.variants.length > 0 ? flag.variants.map((v) => JSON.stringify(v)).join(" | ") : "string";
+			lines.push(`    variants: ${variants};`);
+		}
+		lines.push(`    default: ${serializeTypeLiteral(flag.default)};`);
+		lines.push(`  };`);
+		return lines.join("\n");
+	}).join("\n\n");
+	return `/* eslint-disable */
+/* This file is generated by shipd types gen. Do not edit. */
+
+export interface FlagDefinitions {
+${flags.length === 0 ? "  // No flags defined in shipd.config.ts\n" : `${entries}\n`}}
+
+export type FlagKey = keyof FlagDefinitions;
+
+export type BooleanFlagKey = {
+  [K in FlagKey]: FlagDefinitions[K]["type"] extends "boolean" ? K : never;
+}[FlagKey];
+
+export type VariantFlagKey = {
+  [K in FlagKey]: FlagDefinitions[K]["type"] extends "variant" ? K : never;
+}[FlagKey];
+
+export type NumberFlagKey = {
+  [K in FlagKey]: FlagDefinitions[K]["type"] extends "number" ? K : never;
+}[FlagKey];
+
+export type JsonFlagKey = {
+  [K in FlagKey]: FlagDefinitions[K]["type"] extends "json" ? K : never;
+}[FlagKey];
+`;
+}
+function serializeTypeLiteral(value) {
+	if (value === void 0) return "undefined";
+	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return JSON.stringify(value);
+	if (value === null) return "null";
+	return JSON.stringify(value);
+}
+
+//#endregion
+//#region src/lib/plan.ts
+const DEFINITION_FIELDS = [
+	"type",
+	"default",
+	"disabled",
+	"description",
+	"tags",
+	"lifecycle",
+	"variants"
+];
+function formatValue(value) {
+	if (value === void 0) return "undefined";
+	return JSON.stringify(value, null, 0).replace(/,(?=\S)/g, ", ");
+}
+function fieldChanges(before, after) {
+	const fields = {};
+	for (const field of DEFINITION_FIELDS) {
+		const from = before[field];
+		const to = after[field];
+		if (JSON.stringify(from ?? null) !== JSON.stringify(to ?? null)) fields[field] = {
+			from,
+			to
+		};
+	}
+	return fields;
+}
+const DEFINITION_ONLY_FIELDS = [
+	"type",
+	"description",
+	"tags",
+	"lifecycle",
+	"variants"
+];
+function planHasDefinitionChanges(plan) {
+	if (plan.creates.length > 0 || plan.archives.length > 0) return true;
+	for (const update of plan.updates) {
+		if (update.before.managedBy && update.before.managedBy !== "code") return true;
+		for (const field of DEFINITION_ONLY_FIELDS) if (update.fields[field]) return true;
+	}
+	return false;
+}
+function buildSyncPlan(changes) {
+	const plan = {
+		creates: [],
+		updates: [],
+		archives: [],
+		unlinked: [],
+		conflicts: []
+	};
+	for (const change of changes) {
+		if (change.op === "add" && change.after) {
+			plan.creates.push({
+				key: change.key,
+				after: change.after
+			});
+			continue;
+		}
+		if (change.op === "update" && change.before && change.after) {
+			plan.updates.push({
+				key: change.key,
+				before: change.before,
+				after: change.after,
+				fields: fieldChanges(change.before, change.after)
+			});
+			continue;
+		}
+		if (change.op === "remove" && change.before) {
+			plan.archives.push({
+				key: change.key,
+				before: change.before
+			});
+			continue;
+		}
+		if (change.op === "unlinked") plan.unlinked.push({
+			key: change.key,
+			message: change.message ?? "unlinked remote flag",
+			before: change.before,
+			after: change.after
+		});
+	}
+	return plan;
+}
+function planIsEmpty(plan) {
+	return plan.creates.length === 0 && plan.updates.length === 0 && plan.archives.length === 0 && plan.unlinked.length === 0 && plan.conflicts.length === 0;
+}
+function planHasDrift(plan) {
+	return plan.creates.length > 0 || plan.updates.length > 0 || plan.archives.length > 0;
+}
+function formatSyncPlan(plan) {
+	if (planIsEmpty(plan)) return "No drift.";
+	const lines = [];
+	if (plan.conflicts.length > 0) {
+		lines.push("Conflict:");
+		for (const conflict of plan.conflicts) {
+			lines.push(`  flag "${conflict.key}" ${conflict.message}`);
+			if (conflict.localBaseVersion !== void 0) lines.push(`  local base version: ${conflict.localBaseVersion}`);
+			if (conflict.remoteVersion !== void 0) lines.push(`  remote version: ${conflict.remoteVersion}`);
+			lines.push("");
+			lines.push("Run:");
+			lines.push("  shipd pull");
+			lines.push("");
+		}
+	}
+	if (plan.unlinked.length > 0) {
+		lines.push("Unlinked:");
+		for (const item of plan.unlinked) lines.push(`  ! flag "${item.key}" ${item.message}`);
+		lines.push("");
+		lines.push("Pass --adopt to link ownership to code.");
+		lines.push("");
+	}
+	if (plan.creates.length > 0 || plan.updates.length > 0 || plan.archives.length > 0) {
+		lines.push("Plan:");
+		for (const create of plan.creates) lines.push(`  + create flag "${create.key}"`);
+		for (const update of plan.updates) {
+			lines.push(`  ~ update flag "${update.key}"`);
+			for (const [field, change] of Object.entries(update.fields)) lines.push(`      ${field}: ${formatValue(change.from)} -> ${formatValue(change.to)}`);
+		}
+		for (const archive of plan.archives) lines.push(`  - archive flag "${archive.key}"`);
+	}
+	if (planHasDefinitionChanges(plan)) {
+		lines.push("");
+		lines.push("Note: definition changes (type, variants, tags, lifecycle, description) and ownership adoption apply to all environments.");
+	}
+	return lines.join("\n").trimEnd();
+}
+
+//#endregion
+//#region src/commands/diff.ts
+function registerDiffCommand(program) {
+	program.command("diff").description("Show drift between local definitions and the server").option("--exit-code", "Exit 2 on drift, 4 on unlinked (0 when clean)", false).action(async (opts, command) => {
+		const runtime = getRuntime(command);
+		const client = await createCliApiClient(runtime);
+		const { projectId, environmentId } = await resolveIds(client, runtime);
+		const localFlags = await loadLocalFlags(runtime.configFile);
+		const result = await client.flag.diff({
+			projectId,
+			environmentId,
+			flags: localFlags
+		}).catch(mapApiError);
+		const plan = buildSyncPlan(result.changes);
+		if (runtime.json) console.log(JSON.stringify({
+			...plan,
+			remoteOnly: result.remoteOnly ?? []
+		}, null, 2));
+		else {
+			console.log(formatSyncPlan(plan));
+			if ((result.remoteOnly?.length ?? 0) > 0) console.error(`\nNote: ${result.remoteOnly.length} remote flag(s) are missing locally. shipd push leaves them alone unless you pass --prune.`);
+		}
+		if (opts.exitCode) {
+			if (plan.unlinked.length > 0) process.exitCode = 4;
+			else if (planHasDrift(plan)) process.exitCode = 2;
+			else if (!planIsEmpty(plan)) process.exitCode = 2;
+		}
+	});
+}
+
+//#endregion
+//#region src/commands/environments.ts
+function registerEnvironmentsCommands(program) {
+	program.command("environments").description("Environment operations").command("list").description("List environments for the current project").action(async (_opts, command) => {
+		const runtime = getRuntime(command);
+		const client = await createCliApiClient(runtime);
+		const { projectId } = await resolveProjectId(client, runtime);
+		const result = await client.environment.list({ projectId }).catch(mapApiError);
+		if (runtime.json) {
+			console.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		if (result.length === 0) {
+			console.log("No environments.");
+			return;
+		}
+		for (const environment of result) {
+			const marker = environment.isProduction ? "production" : environment.type;
+			console.log(`${environment.slug}\t${environment.name}\t${marker}\t${environment.id}`);
+		}
+	});
+}
+
+//#endregion
+//#region src/lib/flag-options.ts
+/** Parse `--variants a,b` / `--variants a --variants b` into a deduped list. */
+function parseVariantsOption(raw) {
+	const parts = (Array.isArray(raw) ? raw : raw !== void 0 ? [raw] : []).flatMap((value) => value.split(",")).map((value) => value.trim()).filter((value) => value.length > 0);
+	return [...new Set(parts)];
+}
+
+//#endregion
+//#region src/commands/flags.ts
+const FLAG_TYPES = [
+	"boolean",
+	"variant",
+	"number",
+	"json"
+];
+function registerFlagsCommands(program) {
+	const flags = program.command("flags").description("Lower-level flag operations");
+	flags.command("list").description("List flags in the current project").action(async (_opts, command) => {
+		const runtime = getRuntime(command);
+		const client = await createCliApiClient(runtime);
+		const { projectId } = await resolveProjectId(client, runtime);
+		const result = await client.flag.list({ projectId }).catch(mapApiError);
+		if (runtime.json) {
+			console.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		if (result.length === 0) {
+			console.log("No flags.");
+			return;
+		}
+		for (const flag of result) console.log(`${flag.key}\t${flag.type}\t${flag.lifecycle}\t${flag.managedBy}`);
+	});
+	flags.command("create").description("Create a flag").requiredOption("--key <key>", "Flag key").option("--name <name>", "Display name").option("--type <type>", "Flag type (boolean | variant | number | json)", "boolean").option("--variants <names>", "Comma-separated variant names (required when --type variant; repeatable)", (value, previous) => previous.concat([value]), []).option("--description <text>", "Description").action(async (opts, command) => {
+		const runtime = getRuntime(command);
+		const client = await createCliApiClient(runtime);
+		const { projectId } = await resolveProjectId(client, runtime);
+		if (!FLAG_TYPES.includes(opts.type)) throw new CliError("validation_error", `Unsupported flag type: ${opts.type}`);
+		const type = opts.type;
+		const variants = parseVariantsOption(opts.variants);
+		if (type === "variant" && variants.length === 0) throw new CliError("validation_error", "Variant flags require --variants (e.g. --variants control,treatment)");
+		if (type !== "variant" && variants.length > 0) throw new CliError("validation_error", `--variants is only valid with --type variant (got --type ${type})`);
+		const created = await client.flag.create({
+			projectId,
+			key: opts.key,
+			name: opts.name ?? opts.key,
+			type,
+			description: opts.description,
+			...type === "variant" ? { variants } : {}
+		}).catch(mapApiError);
+		printResult(runtime, created, `Created flag ${created.key}`);
+	});
+	flags.command("archive").description("Archive a flag").requiredOption("--key <key>", "Flag key").action(async (opts, command) => {
+		const runtime = getRuntime(command);
+		const client = await createCliApiClient(runtime);
+		const { projectId } = await resolveProjectId(client, runtime);
+		const existing = await client.flag.get({
+			projectId,
+			key: opts.key
+		}).catch(mapApiError);
+		if (!await confirm(runtime, `Archive flag ${existing.key}?`)) throw new CliError("validation_error", "Archive cancelled");
+		const archived = await client.flag.archive({ flagId: existing.id }).catch(mapApiError);
+		printResult(runtime, archived, `Archived flag ${archived.key}`);
+	});
+}
+
+//#endregion
+//#region src/commands/projects.ts
+function registerProjectsCommands(program) {
+	program.command("projects").description("Project operations").command("list").description("List projects in the active organization").action(async (_opts, command) => {
+		const runtime = getRuntime(command);
+		const result = await (await createCliApiClient(runtime)).project.list({}).catch(mapApiError);
+		if (runtime.json) {
+			console.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		if (result.length === 0) {
+			console.log("No projects.");
+			return;
+		}
+		for (const project of result) console.log(`${project.slug}\t${project.name}\t${project.id}`);
+	});
+}
+
+//#endregion
+//#region src/lib/typegen.ts
+async function runTypegen(runtime, outPath = runtime.typesOut) {
+	const flags = await loadLocalFlags(runtime.configFile);
+	const absolute = path.resolve(outPath);
+	const source = generateTypesSource(flags);
+	fs.mkdirSync(path.dirname(absolute), { recursive: true });
+	fs.writeFileSync(absolute, source);
+	return {
+		written: absolute,
+		flagCount: flags.length
+	};
+}
+
+//#endregion
+//#region src/commands/pull.ts
+function registerPullCommand(program) {
+	program.command("pull").description("Regenerate shipd.config.ts from the server and run typegen").action(async (_opts, command) => {
+		const runtime = getRuntime(command);
+		const client = await createCliApiClient(runtime);
+		const { projectId, environmentId } = await resolveIds(client, runtime);
+		const localFlags = (await client.flag.pull({
+			projectId,
+			environmentId
+		}).catch(mapApiError)).flags.map((flag) => ({
+			key: flag.key,
+			type: flag.type,
+			default: flag.default,
+			description: flag.description,
+			tags: flag.tags,
+			lifecycle: flag.lifecycle,
+			variants: flag.variants,
+			disabled: flag.disabled
+		}));
+		const source = generateShipdConfigSource(localFlags);
+		const outPath = path.resolve(runtime.configFile);
+		fs.mkdirSync(path.dirname(outPath), { recursive: true });
+		fs.writeFileSync(outPath, source);
+		const types = await runTypegen(runtime);
+		printResult(runtime, {
+			written: outPath,
+			flagCount: localFlags.length,
+			types
+		}, [`Wrote ${localFlags.length} flag(s) to ${outPath}`, `Wrote types for ${types.flagCount} flag(s) to ${types.written}`].join("\n"));
+	});
+}
+
+//#endregion
+//#region src/commands/push.ts
+function expectedVersionsFromChanges(changes) {
+	const expected = {};
+	for (const change of changes) if (change.before?.version !== void 0) expected[change.key] = {
+		version: change.before.version,
+		...change.before.environmentVersion !== void 0 ? { environmentVersion: change.before.environmentVersion } : {}
+	};
+	return expected;
+}
+function warnRemoteOnly(keys, json) {
+	if (keys.length === 0 || json) return;
+	console.error(`Warning: ${keys.length} remote flag(s) not in local config (pass --prune to archive):`);
+	for (const key of keys) console.error(`  - ${key}`);
+}
+function registerPushCommand(program) {
+	program.command("push").description("Plan and apply local flag definitions to the server").option("--prune", "Archive remote flags missing from local config", false).option("--force", "Override stale-version conflicts (audited); does not adopt ownership", false).option("--adopt", "Link local flags to remote non-code flags by key", false).action(async (opts, command) => {
+		const runtime = getRuntime(command);
+		const client = await createCliApiClient(runtime);
+		const { projectId, environmentId } = await resolveIds(client, runtime);
+		const localFlags = await loadLocalFlags(runtime.configFile);
+		const prune = opts.prune === true;
+		const force = opts.force === true;
+		const adopt = opts.adopt === true;
+		const planned = await client.flag.push({
+			projectId,
+			environmentId,
+			flags: localFlags,
+			apply: false,
+			prune,
+			force,
+			adopt
+		}).catch(mapApiError);
+		const plan = buildSyncPlan(planned.changes);
+		const remoteOnly = planned.remoteOnly ?? [];
+		warnRemoteOnly(remoteOnly.map((flag) => flag.key), runtime.json);
+		if (!runtime.json) console.log(planIsEmpty(plan) ? "Nothing to push." : formatSyncPlan(plan));
+		if (plan.unlinked.length > 0 && !adopt) throw new CliError("unlinked", `${plan.unlinked.length} unlinked flag(s). Pass --adopt to link ownership to code.`, {
+			exitCode: 4,
+			details: { keys: plan.unlinked.map((item) => item.key) }
+		});
+		if (!(planHasDrift(plan) || adopt && plan.updates.length > 0)) {
+			if (runtime.json) console.log(JSON.stringify({
+				plan,
+				remoteOnly
+			}, null, 2));
+			return;
+		}
+		if (planHasDefinitionChanges(plan) && !runtime.json) console.error("Note: definition/ownership changes apply to all environments (requires production permission).");
+		if (!await confirm(runtime, "Apply this plan?")) throw new CliError("validation_error", "Push cancelled (pass --yes or --ci to apply non-interactively)");
+		const expectedVersions = expectedVersionsFromChanges(planned.changes);
+		const applied = await client.flag.push({
+			projectId,
+			environmentId,
+			flags: localFlags,
+			apply: true,
+			prune,
+			force,
+			adopt,
+			expectedVersions
+		}).catch(mapApiError);
+		const appliedPlan = buildSyncPlan(applied.changes);
+		const types = await runTypegen(runtime);
+		printResult(runtime, {
+			plan: appliedPlan,
+			remoteOnly,
+			forced: applied.forced === true,
+			adopted: applied.adopted === true,
+			types
+		}, [
+			`Applied ${applied.changes.length} change(s).`,
+			applied.forced ? "Forced through version conflicts (audited)." : null,
+			applied.adopted ? "Adopted remote ownership to code." : null,
+			`Wrote types for ${types.flagCount} flag(s) to ${types.written}`
+		].filter(Boolean).join("\n"));
+	});
+}
+
+//#endregion
+//#region src/commands/snapshots.ts
+function registerSnapshotsCommands(program) {
+	program.command("snapshots").description("Data-plane snapshot operations").command("publish").description("Materialize the environment snapshot from Postgres and publish to the data plane").action(async (_opts, command) => {
+		const runtime = getRuntime(command);
+		const client = await createCliApiClient(runtime);
+		const { environmentId } = await resolveIds(client, runtime);
+		const result = await client.snapshot.publish({ environmentId }).catch(mapApiError);
+		if (runtime.json) {
+			console.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		console.log(`Published ${result.environmentKey} v${result.version} (${result.flagCount} flags) → ${result.keys.current}`);
+	});
+}
+
+//#endregion
+//#region src/commands/types.ts
+function registerTypesCommands(program) {
+	program.command("types").description("Type generation helpers").command("gen").description("Generate TypeScript types from shipd.config.ts").option("-o, --out <path>", "Output file path").action(async (opts, command) => {
+		const runtime = getRuntime(command);
+		const result = await runTypegen(runtime, opts.out ?? runtime.typesOut);
+		printResult(runtime, result, `Wrote types for ${result.flagCount} flag(s) to ${result.written}`);
+	});
+}
+
+//#endregion
+//#region src/index.ts
+/** Detected before parse so usage errors can suppress Commander text under `--json`. */
+const jsonRequested = process.argv.includes("--json");
+const program = new Command().name("shipd").description("shipd CLI — flags as code").option("--json", "Machine-readable JSON output", false).option("--yes", "Skip confirmation prompts", false).option("--ci", "Non-interactive mode (same as --yes / CI=1)", false).option("--api-url <url>", "API origin").option("--org <slug>", "Organization slug (session: select; API key: must match)").option("--project <slug>", "Project slug").option("--env <slug>", "Environment slug").option("--config <path>", "Project settings JSON (.shipd/config.json shape)").option("--flags-config <path>", "Path to shipd.config.ts").exitOverride().showHelpAfterError(!jsonRequested);
+if (jsonRequested) program.configureOutput({
+	writeErr: () => {},
+	writeOut: () => {}
+});
+registerAuthCommands(program);
+registerPullCommand(program);
+registerDiffCommand(program);
+registerPushCommand(program);
+registerTypesCommands(program);
+registerFlagsCommands(program);
+registerProjectsCommands(program);
+registerEnvironmentsCommands(program);
+registerSnapshotsCommands(program);
+function commanderMessage(error) {
+	return error.message.replace(/^error:\s*/i, "");
+}
+async function main() {
+	try {
+		await program.parseAsync(process.argv);
+	} catch (error) {
+		if (error instanceof CommanderError && (error.code === "commander.helpDisplayed" || error.code === "commander.version")) {
+			process.exitCode = error.exitCode;
+			return;
+		}
+		const json = jsonRequested || program.opts().json === true;
+		if (error instanceof CommanderError) {
+			if (json) console.error(JSON.stringify({ error: {
+				code: "validation_error",
+				message: commanderMessage(error)
+			} }));
+			process.exitCode = error.exitCode;
+			return;
+		}
+		if (json) {
+			const payload = error instanceof CliError ? { error: {
+				code: error.code,
+				message: error.message,
+				details: error.details
+			} } : { error: {
+				code: "internal",
+				message: error instanceof Error ? error.message : String(error)
+			} };
+			console.error(JSON.stringify(payload));
+		} else if (error instanceof CliError) console.error(`Error: ${error.message}`);
+		else if (error instanceof Error) console.error(`Error: ${error.message}`);
+		else console.error(String(error));
+		process.exitCode = exitCodeForError(error);
+	}
+}
+main();
+
+//#endregion
+export {  };