@tangle-network/agent-app 0.43.56 → 0.43.58

package/dist/DesignCanvas-UNL34LS2.js

@@ -0,0 +1,12 @@
+import {
+  DesignCanvas,
+  DesignCanvas_default
+} from "./chunk-22GLESKE.js";
+import "./chunk-VTWKH4YU.js";
+import "./chunk-VWOPOLVO.js";
+import "./chunk-PTUMBMVH.js";
+export {
+  DesignCanvas,
+  DesignCanvas_default as default
+};
+//# sourceMappingURL=DesignCanvas-UNL34LS2.js.map

package/dist/DesignCanvasEditor-FJIVYOA2.js

@@ -0,0 +1,13 @@
+import {
+  DesignCanvasEditor
+} from "./chunk-E7N67FYI.js";
+import "./chunk-22GLESKE.js";
+import "./chunk-VYECQAGM.js";
+import "./chunk-VTWKH4YU.js";
+import "./chunk-VWOPOLVO.js";
+import "./chunk-TZO3SOUL.js";
+import "./chunk-PTUMBMVH.js";
+export {
+  DesignCanvasEditor
+};
+//# sourceMappingURL=DesignCanvasEditor-FJIVYOA2.js.map

package/dist/IntakeInterview-3ZIQMZS6.js

@@ -0,0 +1,8 @@
+import {
+  IntakeInterview
+} from "./chunk-VOJB7MVG.js";
+import "./chunk-JDEGS53O.js";
+export {
+  IntakeInterview
+};
+//# sourceMappingURL=IntakeInterview-3ZIQMZS6.js.map

package/dist/InvitationsPanel-CJ7DR4F7.js

@@ -0,0 +1,8 @@
+import {
+  InvitationsPanel
+} from "./chunk-5SXS3YAB.js";
+import "./chunk-6XIAPIW6.js";
+export {
+  InvitationsPanel
+};
+//# sourceMappingURL=InvitationsPanel-CJ7DR4F7.js.map

package/dist/MembersPanel-BB4OD2KB.js

@@ -0,0 +1,8 @@
+import {
+  MembersPanel
+} from "./chunk-S564OFTL.js";
+import "./chunk-6XIAPIW6.js";
+export {
+  MembersPanel
+};
+//# sourceMappingURL=MembersPanel-BB4OD2KB.js.map

package/dist/{TimelineEditor-I35SJJAJ.js → TimelineEditor-2ECKSU6P.js}

@@ -2,11 +2,11 @@ import {
   SEQUENCE_MEDIA_DRAG_TYPE,
   TimelineEditor,
   TimelineEditor_default
-} from "./chunk-7SUPA2YT.js";
-import "./chunk-ZYBWGSAZ.js";
+} from "./chunk-4KKXZQPT.js";
+import "./chunk-BVKQKGRK.js";
 export {
   SEQUENCE_MEDIA_DRAG_TYPE,
   TimelineEditor,
   TimelineEditor_default as default
 };
-//# sourceMappingURL=TimelineEditor-I35SJJAJ.js.map
+//# sourceMappingURL=TimelineEditor-2ECKSU6P.js.map

package/dist/{VaultPane-DrQ_tH6c.d.ts → VaultPane-BDP6SB_K.d.ts}

@@ -138,6 +138,7 @@ interface VaultDockToggle {
 }
 /** The two editor surfaces the pane switches between for editable text files. */
 type VaultEditorMode = 'rich' | 'source';
+/** Define the properties and render methods for the vault pane UI components */
 interface VaultPaneProps {
     /** Product-owned data access. */
     port: VaultDataPort;

package/dist/{access-BZ81Btt5.d.ts → access-490O6aOU.d.ts}

@@ -1,17 +1,19 @@
 import * as drizzle_orm_sqlite_core from 'drizzle-orm/sqlite-core';
 import { AnySQLiteTable, AnySQLiteColumn, BaseSQLiteDatabase } from 'drizzle-orm/sqlite-core';
-import { O as OrganizationRole, f as WorkspaceRole } from './roles-BC1n4t37.js';
+import { O as OrganizationRole, f as WorkspaceRole } from './roles-B4nU3jDi.js';
 
 /** A product table referenced by FK — only the `id` column is touched. */
 type TeamParentTable = AnySQLiteTable & {
     id: AnySQLiteColumn;
 };
+/** Define options specifying user and workspace tables for creating team-related tables */
 interface CreateTeamTablesOptions {
     /** The product's user table — org/member rows reference `userTable.id`. */
     userTable: TeamParentTable;
     /** The product's workspace table — workspace members reference `workspaceTable.id`. */
     workspaceTable: TeamParentTable;
 }
+/** Build SQLite tables for organizations and related team structures using provided options */
 declare function createTeamTables(opts: CreateTeamTablesOptions): {
     organizations: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
         name: "organization";
@@ -460,9 +462,13 @@ declare function createTeamTables(opts: CreateTeamTablesOptions): {
         dialect: "sqlite";
     }>;
 };
+/** Resolve team tables by deriving the return type of createTeamTables */
 type TeamTables = ReturnType<typeof createTeamTables>;
+/** Resolve the structure of an organization row from the organizations table in TeamTables */
 type OrganizationRow = TeamTables['organizations']['$inferSelect'];
+/** Resolve the structure of an organization member row from the team tables selection */
 type OrganizationMemberRow = TeamTables['organizationMembers']['$inferSelect'];
+/** Resolve a workspace member row with selected fields from the workspaceMembers table */
 type WorkspaceMemberRow = TeamTables['workspaceMembers']['$inferSelect'];
 
 /**
@@ -498,42 +504,51 @@ interface WorkspaceAccessTable {
     name: any;
     updatedAt: any;
 }
+/** Define options required to create access with database, tables, and workspace table references */
 interface CreateAccessOptions {
     db: TeamDatabase;
     tables: TeamTables;
     /** The product's workspace table (the FK target passed to createTeamTables). */
     workspaceTable: TeamParentTable & WorkspaceAccessTable;
 }
+/** Define access details including workspace data, organization info, member info, and role within workspace */
 interface WorkspaceAccess {
     workspace: Record<string, unknown>;
     organization: OrganizationRow;
     organizationMember: OrganizationMemberRow;
     role: WorkspaceRole;
 }
+/** Describe a user's workspace details including organization and role information */
 interface UserWorkspaceSummary extends Record<string, unknown> {
     organizationId: string;
     organizationName: string;
     role: WorkspaceRole;
 }
+/** Define methods to retrieve and enforce user access permissions within workspaces */
 interface WorkspaceAccessApi {
     getWorkspaceAccess(workspaceId: string, userId: string, minRole?: WorkspaceRole): Promise<WorkspaceAccess | null>;
     requireWorkspaceAccess(workspaceId: string, userId: string, minRole?: WorkspaceRole): Promise<WorkspaceAccess>;
     listUserWorkspaces(userId: string): Promise<UserWorkspaceSummary[]>;
 }
+/** Create workspace access API to manage user roles and permissions within a workspace */
 declare function createWorkspaceAccess(opts: CreateAccessOptions): WorkspaceAccessApi;
+/** Define access details linking an organization, its member, and the member's role */
 interface OrganizationAccess {
     organization: OrganizationRow;
     member: OrganizationMemberRow;
     role: OrganizationRole;
 }
+/** Define methods to retrieve and enforce user access levels within an organization */
 interface OrganizationAccessApi {
     getOrganizationAccess(organizationId: string, userId: string, minRole?: OrganizationRole): Promise<OrganizationAccess | null>;
     requireOrganizationAccess(organizationId: string, userId: string, minRole?: OrganizationRole): Promise<OrganizationAccess>;
 }
+/** Define options required to create access for an organization including database and tables */
 interface CreateOrganizationAccessOptions {
     db: TeamDatabase;
     tables: TeamTables;
 }
+/** Resolve organization access API with specified database and table options */
 declare function createOrganizationAccess(opts: CreateOrganizationAccessOptions): OrganizationAccessApi;
 
 export { type CreateAccessOptions as C, type OrganizationRow as O, type TeamDatabase as T, type UserWorkspaceSummary as U, type WorkspaceAccess as W, type TeamTables as a, type OrganizationMemberRow as b, type CreateOrganizationAccessOptions as c, type CreateTeamTablesOptions as d, type OrganizationAccess as e, type OrganizationAccessApi as f, type TeamParentTable as g, type WorkspaceAccessApi as h, type WorkspaceAccessTable as i, type WorkspaceMemberRow as j, createOrganizationAccess as k, createTeamTables as l, createWorkspaceAccess as m };

package/dist/app-auth/index.d.ts

@@ -1,5 +1,5 @@
 import { Session, User, Auth, BetterAuthOptions } from 'better-auth';
-import { A as AuthGuard, T as TangleSsoHandlers, a as TangleSsoAuthClient, b as TangleSsoAccountStore } from '../sso-CNOsARMJ.js';
+import { A as AuthGuard, T as TangleSsoHandlers, a as TangleSsoAuthClient, b as TangleSsoAccountStore } from '../sso-Cm00S61u.js';
 
 /**
  * better-auth config factory for agent products (#188 Phase 1). Every product
@@ -33,6 +33,7 @@ interface AppAuthEmailClient {
         }): Promise<unknown>;
     };
 }
+/** Define email configuration for app authentication including client, sender, verification, and warning options */
 interface AppAuthEmailConfig {
     /** A Resend-style client, or a lazy getter returning null when the API key
      *  is absent (the products' dev default — mail is skipped with a warning,
@@ -52,6 +53,7 @@ interface AppAuthSocialProviderConfig {
     clientId?: string;
     clientSecret?: string;
 }
+/** Define social authentication configuration options for GitHub and Google providers */
 interface AppAuthSocialConfig {
     github?: AppAuthSocialProviderConfig;
     google?: AppAuthSocialProviderConfig;
@@ -83,12 +85,14 @@ interface AppAuthSsoConfig {
     /** Failure log hook (e.g. console.error). Default no-op. */
     log?: (message: string, error?: unknown) => void;
 }
+/** Define the structure for application authentication data including users, sessions, accounts, and verifications */
 interface AppAuthSchema {
     users: unknown;
     sessions: unknown;
     accounts: unknown;
     verifications: unknown;
 }
+/** Define configuration settings for app authentication including app name, base URL, secrets, and trusted origins */
 interface AppAuthConfig {
     /** Product name — used in email subjects and as the cookie-prefix default. */
     appName: string;
@@ -143,6 +147,7 @@ interface AppAuthSession {
     session: Session;
     user: User;
 }
+/** Define authentication guard with session retrieval and optional SSO handlers for app requests */
 interface AppAuth extends AuthGuard<AppAuthSession> {
     auth: AppAuthInstance;
     /** `auth.api.getSession` over a `Request` — the seam the guards consume. */

package/dist/app-auth/index.js

@@ -2,9 +2,9 @@ import {
   createAuthGuard,
   createBetterAuthSessionCookieMinter,
   createTangleSsoHandlers
-} from "../chunk-TKVJE63N.js";
-import "../chunk-HFC4BTWJ.js";
-import "../chunk-7W5XSTUF.js";
+} from "../chunk-YRMLYFVR.js";
+import "../chunk-PTUMBMVH.js";
+import "../chunk-JML7WKWU.js";
 
 // src/app-auth/index.ts
 import { betterAuth } from "better-auth";

package/dist/app-auth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/app-auth/index.ts"],"sourcesContent":["/**\n * better-auth config factory for agent products (#188 Phase 1). Every product\n * hand-rolls the same ~70–150 line setup — drizzle adapter over the standard\n * users/sessions/accounts/verifications tables, email+password with Resend\n * reset/verification mail, env-gated GitHub/Google social providers, session\n * cookie cache, and a per-app cookie prefix — and tax additionally\n * re-implemented better-auth's cookie signing for its Tangle SSO callback.\n * `createAppAuth` owns that mechanism once and returns the configured\n * better-auth instance plus the request guards products actually use.\n *\n * Domain stays a parameter: the drizzle db + schema, email client, provider\n * credentials, and SSO store/client all come from the product. No product\n * import, no engine re-implementation — the SSO path composes the existing\n * `platform/sso` cookie minter (`createBetterAuthSessionCookieMinter`), which\n * is byte-compatible with better-auth's own `makeSignature` contract.\n *\n * better-auth is an OPTIONAL peer: only this subpath imports it, so it is\n * deliberately NOT re-exported from the root barrel.\n */\n\nimport { betterAuth, type Auth, type BetterAuthOptions, type Session, type User } from 'better-auth'\nimport { drizzleAdapter } from 'better-auth/adapters/drizzle'\nimport { createAuthGuard, type AuthGuard } from '../platform/guards'\nimport {\n  createBetterAuthSessionCookieMinter,\n  createTangleSsoHandlers,\n  type TangleSsoAccountStore,\n  type TangleSsoAuthClient,\n  type TangleSsoHandlers,\n} from '../platform/sso'\n\nconst DEFAULT_STATE_COOKIE = 'tangle_sso_state'\nconst DEFAULT_SESSION_COOKIE_CACHE_SECONDS = 5 * 60\n\n/** Structural slice of a Resend-style client — no `resend` import. */\nexport interface AppAuthEmailClient {\n  emails: {\n    send(message: {\n      from: string\n      to: string\n      subject: string\n      html: string\n      text?: string\n    }): Promise<unknown>\n  }\n}\n\nexport interface AppAuthEmailConfig {\n  /** A Resend-style client, or a lazy getter returning null when the API key\n   *  is absent (the products' dev default — mail is skipped with a warning,\n   *  sign-up itself must not crash). */\n  resend: AppAuthEmailClient | (() => AppAuthEmailClient | null)\n  /** RFC 5322 From, e.g. `'Legal Agent <noreply@legal.tangle.tools>'`. */\n  from: string\n  /** Send a verification email on sign-up and auto-sign-in after verifying\n   *  (the tax/gtm behavior). Default false (the legal behavior). */\n  verifyOnSignUp?: boolean\n  /** Receives the \"email client unavailable\" warning. Default console.warn. */\n  warn?: (message: string) => void\n}\n\n/** Env-shaped: pass the env vars straight through; the provider is registered\n *  only when BOTH values are non-empty, so unset env disables it. */\nexport interface AppAuthSocialProviderConfig {\n  clientId?: string\n  clientSecret?: string\n}\n\nexport interface AppAuthSocialConfig {\n  github?: AppAuthSocialProviderConfig\n  google?: AppAuthSocialProviderConfig\n}\n\n/** Cross-site Tangle SSO wiring. The factory supplies the better-auth side —\n *  `setSessionCookie` via `createBetterAuthSessionCookieMinter(auth)` (signed\n *  `__Secure-`/prefixed cookie that `auth.api.getSession` accepts) — so the\n *  product no longer touches `better-auth/crypto` itself. */\nexport interface AppAuthSsoConfig {\n  /** Platform wire client (authorizeUrl + exchange). */\n  client: TangleSsoAuthClient\n  /** Product persistence: user upsert, session row, platform link. */\n  store: TangleSsoAccountStore\n  /** Absolute callback URL registered with the platform. */\n  callbackUrl: string\n  /** Default 'tangle_sso_state'. */\n  stateCookieName?: string\n  /** HMAC secret for the CSRF state cookie. Default: the auth `secret`. */\n  stateSecret?: string\n  /** Default: `baseURL` is https. Must match better-auth's own\n   *  secure-cookie decision or the cookie name lookup diverges. */\n  secureCookies?: boolean\n  sessionTtlSeconds?: number\n  stateTtlSeconds?: number\n  /** Post-login redirect fallback. Default '/app'. */\n  defaultRedirectPath?: string\n  /** Default: the top-level `loginPath`. */\n  loginPath?: string\n  /** Failure log hook (e.g. console.error). Default no-op. */\n  log?: (message: string, error?: unknown) => void\n}\n\nexport interface AppAuthSchema {\n  users: unknown\n  sessions: unknown\n  accounts: unknown\n  verifications: unknown\n}\n\nexport interface AppAuthConfig {\n  /** Product name — used in email subjects and as the cookie-prefix default. */\n  appName: string\n  /** Absolute origin better-auth serves from (`BETTER_AUTH_URL`). */\n  baseURL: string\n  /** better-auth HMAC secret. Optional only because better-auth falls back to\n   *  the BETTER_AUTH_SECRET env var; `sso` needs it explicitly (or\n   *  `sso.stateSecret`). */\n  secret?: string\n  trustedOrigins?: string[]\n  /**\n   * Session-cookie prefix. Default: slugified `appName`. A per-app prefix is\n   * load-bearing, not cosmetic: the platform (id.tangle.tools) mints its own\n   * better-auth cookie `Domain=.tangle.tools`-wide under the DEFAULT name, and\n   * the platform's (older) cookie wins the Cookie-header order — an app on the\n   * default prefix reads the platform's token, fails its own signature check,\n   * and every fresh login lands back on /login.\n   */\n  cookiePrefix?: string\n  /** Drizzle database instance; wired through better-auth's drizzle adapter\n   *  together with `schema`. */\n  db?: unknown\n  /** The product's users/sessions/accounts/verifications tables (mapped to\n   *  better-auth's user/session/account/verification models). */\n  schema?: AppAuthSchema\n  /** Drizzle dialect. Default 'sqlite' (D1). */\n  provider?: 'sqlite' | 'pg' | 'mysql'\n  /** Escape hatch: a pre-built better-auth database adapter (e.g.\n   *  `memoryAdapter` in tests). Wins over `db`/`schema`. */\n  database?: BetterAuthOptions['database']\n  /** Email+password sign-in. Default true (all current products enable it). */\n  emailAndPassword?: boolean\n  /** Reset/verification mail. Omit to disable password reset entirely. */\n  email?: AppAuthEmailConfig\n  social?: AppAuthSocialConfig\n  /** Session cookie-cache TTL in seconds; `false` disables the cache.\n   *  Default 300. */\n  sessionCookieCacheSeconds?: number | false\n  /** Tangle cross-site SSO (start/callback handlers). */\n  sso?: AppAuthSsoConfig\n  /** Where guards redirect unauthenticated page requests. Default '/login'. */\n  loginPath?: string\n  /** Merged over the factory's `advanced` block (cookiePrefix stays unless\n   *  overridden here). */\n  advanced?: BetterAuthOptions['advanced']\n}\n\n/** The configured better-auth instance, typed at better-auth's base surface\n *  (`handler`, `api`, `$context`, `$Infer`). */\nexport type AppAuthInstance = Auth\n\n/** What `getSession`/guards resolve: better-auth's base session + user rows. */\nexport interface AppAuthSession {\n  session: Session\n  user: User\n}\n\nexport interface AppAuth extends AuthGuard<AppAuthSession> {\n  auth: AppAuthInstance\n  /** `auth.api.getSession` over a `Request` — the seam the guards consume. */\n  getSession(request: Request): Promise<AppAuthSession | null>\n  /** Tangle SSO start/callback handlers; null unless `sso` was configured. */\n  sso: TangleSsoHandlers | null\n}\n\n/** Lowercased, non-alphanumerics collapsed to '-': `'Legal Agent'` → `'legal-agent'`. */\nfunction slugify(name: string): string {\n  return name\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-')\n    .replace(/^-+|-+$/g, '')\n}\n\nfunction resolveEmailClient(email: AppAuthEmailConfig): AppAuthEmailClient | null {\n  return typeof email.resend === 'function' ? email.resend() : email.resend\n}\n\n/** Resend reports failures in the resolved value, not by rejecting — surface\n *  them loud so better-auth's flow (and the caller's logs) see the failure. */\nasync function sendEmail(\n  client: AppAuthEmailClient,\n  message: { from: string; to: string; subject: string; html: string; text: string },\n): Promise<void> {\n  const result = (await client.emails.send(message)) as { error?: { message?: string } | null } | null | undefined\n  if (result && typeof result === 'object' && result.error) {\n    throw new Error(`[app-auth] email send failed: ${result.error.message ?? 'unknown error'}`)\n  }\n}\n\nfunction resolveDatabase(config: AppAuthConfig): NonNullable<BetterAuthOptions['database']> {\n  if (config.database) return config.database\n  if (config.db && config.schema) {\n    return drizzleAdapter(config.db as Record<string, unknown>, {\n      provider: config.provider ?? 'sqlite',\n      schema: {\n        user: config.schema.users,\n        session: config.schema.sessions,\n        account: config.schema.accounts,\n        verification: config.schema.verifications,\n      } as Record<string, unknown>,\n    })\n  }\n  throw new Error(\n    'createAppAuth requires a database: pass `db` + `schema` (drizzle) or `database` (a better-auth adapter)',\n  )\n}\n\nfunction resolveSocialProviders(social: AppAuthSocialConfig | undefined): BetterAuthOptions['socialProviders'] {\n  const providers: NonNullable<BetterAuthOptions['socialProviders']> = {}\n  if (social?.github?.clientId && social.github.clientSecret) {\n    providers.github = { clientId: social.github.clientId, clientSecret: social.github.clientSecret }\n  }\n  if (social?.google?.clientId && social.google.clientSecret) {\n    providers.google = { clientId: social.google.clientId, clientSecret: social.google.clientSecret }\n  }\n  return Object.keys(providers).length > 0 ? providers : undefined\n}\n\nfunction emailAndPasswordOptions(config: AppAuthConfig): BetterAuthOptions['emailAndPassword'] {\n  const email = config.email\n  if (!email) return { enabled: true }\n  const warn = email.warn ?? ((message: string) => console.warn(message))\n  return {\n    enabled: true,\n    sendResetPassword: async ({ user, url }) => {\n      const client = resolveEmailClient(email)\n      if (!client) {\n        warn('[app-auth] email client unavailable — password reset email not sent')\n        return\n      }\n      await sendEmail(client, {\n        from: email.from,\n        to: user.email,\n        subject: 'Reset your password',\n        html: `<p>Click the link below to reset your password:</p><p><a href=\"${url}\">${url}</a></p><p>This link expires in 1 hour.</p>`,\n        text: `Reset your password:\\n\\n${url}\\n\\nThis link expires in 1 hour.`,\n      })\n    },\n  }\n}\n\nfunction emailVerificationOptions(config: AppAuthConfig): BetterAuthOptions['emailVerification'] {\n  const email = config.email\n  if (!email?.verifyOnSignUp) return undefined\n  const warn = email.warn ?? ((message: string) => console.warn(message))\n  return {\n    sendOnSignUp: true,\n    autoSignInAfterVerification: true,\n    sendVerificationEmail: async ({ user, url }) => {\n      const client = resolveEmailClient(email)\n      if (!client) {\n        warn('[app-auth] email client unavailable — verification email not sent')\n        return\n      }\n      await sendEmail(client, {\n        from: email.from,\n        to: user.email,\n        subject: `Verify your ${config.appName} email`,\n        html: `<p>Verify your email to finish accessing ${config.appName}:</p><p><a href=\"${url}\">${url}</a></p><p>This link expires in 1 hour.</p>`,\n        text: `Verify your email to finish accessing ${config.appName}:\\n\\n${url}\\n\\nThis link expires in 1 hour.`,\n      })\n    },\n  }\n}\n\n/**\n * Build the product's better-auth instance plus the request-boundary helpers:\n * `getSession` (Request → session|null), the `createAuthGuard` quartet\n * (`requireUser` 302, `requireApiUser` JSON 401, `requireSession`,\n * `getOptionalSession`), and — when `sso` is configured — the Tangle SSO\n * start/callback handlers with the session cookie minted through better-auth's\n * own name/attributes/signing (no `better-auth/crypto` in product code).\n */\nexport function createAppAuth(config: AppAuthConfig): AppAuth {\n  if (!config.appName) throw new Error('createAppAuth: appName is required')\n  if (!config.baseURL) throw new Error('createAppAuth: baseURL is required')\n\n  const cookiePrefix = config.cookiePrefix ?? slugify(config.appName)\n  if (!cookiePrefix) throw new Error('createAppAuth: cookiePrefix (or a slugifiable appName) is required')\n\n  const socialProviders = resolveSocialProviders(config.social)\n  const options: BetterAuthOptions = {\n    appName: config.appName,\n    baseURL: config.baseURL,\n    ...(config.secret ? { secret: config.secret } : {}),\n    ...(config.trustedOrigins ? { trustedOrigins: config.trustedOrigins } : {}),\n    database: resolveDatabase(config),\n    ...(config.emailAndPassword === false ? {} : { emailAndPassword: emailAndPasswordOptions(config) }),\n    ...(config.email?.verifyOnSignUp ? { emailVerification: emailVerificationOptions(config) } : {}),\n    ...(socialProviders ? { socialProviders } : {}),\n    ...(config.sessionCookieCacheSeconds === false\n      ? {}\n      : {\n          session: {\n            cookieCache: {\n              enabled: true,\n              maxAge: config.sessionCookieCacheSeconds ?? DEFAULT_SESSION_COOKIE_CACHE_SECONDS,\n            },\n          },\n        }),\n    advanced: { cookiePrefix, ...config.advanced },\n  }\n\n  const auth: AppAuthInstance = betterAuth(options)\n\n  const getSession = async (request: Request): Promise<AppAuthSession | null> => {\n    const session = await auth.api.getSession({ headers: request.headers })\n    return (session as AppAuthSession | null) ?? null\n  }\n\n  const loginPath = config.loginPath ?? '/login'\n  const guard = createAuthGuard<AppAuthSession>({ getSession, loginPath })\n\n  let sso: TangleSsoHandlers | null = null\n  if (config.sso) {\n    const stateSecret = config.sso.stateSecret ?? config.secret\n    if (!stateSecret) {\n      throw new Error(\n        'createAppAuth: sso requires `secret` (or sso.stateSecret) — the signed-state CSRF cookie needs an HMAC secret',\n      )\n    }\n    sso = createTangleSsoHandlers({\n      auth: config.sso.client,\n      store: config.sso.store,\n      stateSecret,\n      callbackUrl: config.sso.callbackUrl,\n      stateCookieName: config.sso.stateCookieName ?? DEFAULT_STATE_COOKIE,\n      setSessionCookie: createBetterAuthSessionCookieMinter(auth),\n      secureCookies: config.sso.secureCookies ?? config.baseURL.startsWith('https:'),\n      ...(config.sso.sessionTtlSeconds !== undefined ? { sessionTtlSeconds: config.sso.sessionTtlSeconds } : {}),\n      ...(config.sso.stateTtlSeconds !== undefined ? { stateTtlSeconds: config.sso.stateTtlSeconds } : {}),\n      ...(config.sso.defaultRedirectPath ? { defaultRedirectPath: config.sso.defaultRedirectPath } : {}),\n      loginPath: config.sso.loginPath ?? loginPath,\n      ...(config.sso.log ? { log: config.sso.log } : {}),\n    })\n  }\n\n  return { auth, getSession, ...guard, sso }\n}\n"],"mappings":";;;;;;;;;AAoBA,SAAS,kBAA8E;AACvF,SAAS,sBAAsB;AAU/B,IAAM,uBAAuB;AAC7B,IAAM,uCAAuC,IAAI;AA8IjD,SAAS,QAAQ,MAAsB;AACrC,SAAO,KACJ,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE;AAC3B;AAEA,SAAS,mBAAmB,OAAsD;AAChF,SAAO,OAAO,MAAM,WAAW,aAAa,MAAM,OAAO,IAAI,MAAM;AACrE;AAIA,eAAe,UACb,QACA,SACe;AACf,QAAM,SAAU,MAAM,OAAO,OAAO,KAAK,OAAO;AAChD,MAAI,UAAU,OAAO,WAAW,YAAY,OAAO,OAAO;AACxD,UAAM,IAAI,MAAM,iCAAiC,OAAO,MAAM,WAAW,eAAe,EAAE;AAAA,EAC5F;AACF;AAEA,SAAS,gBAAgB,QAAmE;AAC1F,MAAI,OAAO,SAAU,QAAO,OAAO;AACnC,MAAI,OAAO,MAAM,OAAO,QAAQ;AAC9B,WAAO,eAAe,OAAO,IAA+B;AAAA,MAC1D,UAAU,OAAO,YAAY;AAAA,MAC7B,QAAQ;AAAA,QACN,MAAM,OAAO,OAAO;AAAA,QACpB,SAAS,OAAO,OAAO;AAAA,QACvB,SAAS,OAAO,OAAO;AAAA,QACvB,cAAc,OAAO,OAAO;AAAA,MAC9B;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,uBAAuB,QAA+E;AAC7G,QAAM,YAA+D,CAAC;AACtE,MAAI,QAAQ,QAAQ,YAAY,OAAO,OAAO,cAAc;AAC1D,cAAU,SAAS,EAAE,UAAU,OAAO,OAAO,UAAU,cAAc,OAAO,OAAO,aAAa;AAAA,EAClG;AACA,MAAI,QAAQ,QAAQ,YAAY,OAAO,OAAO,cAAc;AAC1D,cAAU,SAAS,EAAE,UAAU,OAAO,OAAO,UAAU,cAAc,OAAO,OAAO,aAAa;AAAA,EAClG;AACA,SAAO,OAAO,KAAK,SAAS,EAAE,SAAS,IAAI,YAAY;AACzD;AAEA,SAAS,wBAAwB,QAA8D;AAC7F,QAAM,QAAQ,OAAO;AACrB,MAAI,CAAC,MAAO,QAAO,EAAE,SAAS,KAAK;AACnC,QAAM,OAAO,MAAM,SAAS,CAAC,YAAoB,QAAQ,KAAK,OAAO;AACrE,SAAO;AAAA,IACL,SAAS;AAAA,IACT,mBAAmB,OAAO,EAAE,MAAM,IAAI,MAAM;AAC1C,YAAM,SAAS,mBAAmB,KAAK;AACvC,UAAI,CAAC,QAAQ;AACX,aAAK,0EAAqE;AAC1E;AAAA,MACF;AACA,YAAM,UAAU,QAAQ;AAAA,QACtB,MAAM,MAAM;AAAA,QACZ,IAAI,KAAK;AAAA,QACT,SAAS;AAAA,QACT,MAAM,kEAAkE,GAAG,KAAK,GAAG;AAAA,QACnF,MAAM;AAAA;AAAA,EAA2B,GAAG;AAAA;AAAA;AAAA,MACtC,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,QAA+D;AAC/F,QAAM,QAAQ,OAAO;AACrB,MAAI,CAAC,OAAO,eAAgB,QAAO;AACnC,QAAM,OAAO,MAAM,SAAS,CAAC,YAAoB,QAAQ,KAAK,OAAO;AACrE,SAAO;AAAA,IACL,cAAc;AAAA,IACd,6BAA6B;AAAA,IAC7B,uBAAuB,OAAO,EAAE,MAAM,IAAI,MAAM;AAC9C,YAAM,SAAS,mBAAmB,KAAK;AACvC,UAAI,CAAC,QAAQ;AACX,aAAK,wEAAmE;AACxE;AAAA,MACF;AACA,YAAM,UAAU,QAAQ;AAAA,QACtB,MAAM,MAAM;AAAA,QACZ,IAAI,KAAK;AAAA,QACT,SAAS,eAAe,OAAO,OAAO;AAAA,QACtC,MAAM,4CAA4C,OAAO,OAAO,oBAAoB,GAAG,KAAK,GAAG;AAAA,QAC/F,MAAM,yCAAyC,OAAO,OAAO;AAAA;AAAA,EAAQ,GAAG;AAAA;AAAA;AAAA,MAC1E,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAUO,SAAS,cAAc,QAAgC;AAC5D,MAAI,CAAC,OAAO,QAAS,OAAM,IAAI,MAAM,oCAAoC;AACzE,MAAI,CAAC,OAAO,QAAS,OAAM,IAAI,MAAM,oCAAoC;AAEzE,QAAM,eAAe,OAAO,gBAAgB,QAAQ,OAAO,OAAO;AAClE,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM,oEAAoE;AAEvG,QAAM,kBAAkB,uBAAuB,OAAO,MAAM;AAC5D,QAAM,UAA6B;AAAA,IACjC,SAAS,OAAO;AAAA,IAChB,SAAS,OAAO;AAAA,IAChB,GAAI,OAAO,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IACjD,GAAI,OAAO,iBAAiB,EAAE,gBAAgB,OAAO,eAAe,IAAI,CAAC;AAAA,IACzE,UAAU,gBAAgB,MAAM;AAAA,IAChC,GAAI,OAAO,qBAAqB,QAAQ,CAAC,IAAI,EAAE,kBAAkB,wBAAwB,MAAM,EAAE;AAAA,IACjG,GAAI,OAAO,OAAO,iBAAiB,EAAE,mBAAmB,yBAAyB,MAAM,EAAE,IAAI,CAAC;AAAA,IAC9F,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;AAAA,IAC7C,GAAI,OAAO,8BAA8B,QACrC,CAAC,IACD;AAAA,MACE,SAAS;AAAA,QACP,aAAa;AAAA,UACX,SAAS;AAAA,UACT,QAAQ,OAAO,6BAA6B;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAAA,IACJ,UAAU,EAAE,cAAc,GAAG,OAAO,SAAS;AAAA,EAC/C;AAEA,QAAM,OAAwB,WAAW,OAAO;AAEhD,QAAM,aAAa,OAAO,YAAqD;AAC7E,UAAM,UAAU,MAAM,KAAK,IAAI,WAAW,EAAE,SAAS,QAAQ,QAAQ,CAAC;AACtE,WAAQ,WAAqC;AAAA,EAC/C;AAEA,QAAM,YAAY,OAAO,aAAa;AACtC,QAAM,QAAQ,gBAAgC,EAAE,YAAY,UAAU,CAAC;AAEvE,MAAI,MAAgC;AACpC,MAAI,OAAO,KAAK;AACd,UAAM,cAAc,OAAO,IAAI,eAAe,OAAO;AACrD,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,wBAAwB;AAAA,MAC5B,MAAM,OAAO,IAAI;AAAA,MACjB,OAAO,OAAO,IAAI;AAAA,MAClB;AAAA,MACA,aAAa,OAAO,IAAI;AAAA,MACxB,iBAAiB,OAAO,IAAI,mBAAmB;AAAA,MAC/C,kBAAkB,oCAAoC,IAAI;AAAA,MAC1D,eAAe,OAAO,IAAI,iBAAiB,OAAO,QAAQ,WAAW,QAAQ;AAAA,MAC7E,GAAI,OAAO,IAAI,sBAAsB,SAAY,EAAE,mBAAmB,OAAO,IAAI,kBAAkB,IAAI,CAAC;AAAA,MACxG,GAAI,OAAO,IAAI,oBAAoB,SAAY,EAAE,iBAAiB,OAAO,IAAI,gBAAgB,IAAI,CAAC;AAAA,MAClG,GAAI,OAAO,IAAI,sBAAsB,EAAE,qBAAqB,OAAO,IAAI,oBAAoB,IAAI,CAAC;AAAA,MAChG,WAAW,OAAO,IAAI,aAAa;AAAA,MACnC,GAAI,OAAO,IAAI,MAAM,EAAE,KAAK,OAAO,IAAI,IAAI,IAAI,CAAC;AAAA,IAClD,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,MAAM,YAAY,GAAG,OAAO,IAAI;AAC3C;","names":[]}
+{"version":3,"sources":["../../src/app-auth/index.ts"],"sourcesContent":["/**\n * better-auth config factory for agent products (#188 Phase 1). Every product\n * hand-rolls the same ~70–150 line setup — drizzle adapter over the standard\n * users/sessions/accounts/verifications tables, email+password with Resend\n * reset/verification mail, env-gated GitHub/Google social providers, session\n * cookie cache, and a per-app cookie prefix — and tax additionally\n * re-implemented better-auth's cookie signing for its Tangle SSO callback.\n * `createAppAuth` owns that mechanism once and returns the configured\n * better-auth instance plus the request guards products actually use.\n *\n * Domain stays a parameter: the drizzle db + schema, email client, provider\n * credentials, and SSO store/client all come from the product. No product\n * import, no engine re-implementation — the SSO path composes the existing\n * `platform/sso` cookie minter (`createBetterAuthSessionCookieMinter`), which\n * is byte-compatible with better-auth's own `makeSignature` contract.\n *\n * better-auth is an OPTIONAL peer: only this subpath imports it, so it is\n * deliberately NOT re-exported from the root barrel.\n */\n\nimport { betterAuth, type Auth, type BetterAuthOptions, type Session, type User } from 'better-auth'\nimport { drizzleAdapter } from 'better-auth/adapters/drizzle'\nimport { createAuthGuard, type AuthGuard } from '../platform/guards'\nimport {\n  createBetterAuthSessionCookieMinter,\n  createTangleSsoHandlers,\n  type TangleSsoAccountStore,\n  type TangleSsoAuthClient,\n  type TangleSsoHandlers,\n} from '../platform/sso'\n\nconst DEFAULT_STATE_COOKIE = 'tangle_sso_state'\nconst DEFAULT_SESSION_COOKIE_CACHE_SECONDS = 5 * 60\n\n/** Structural slice of a Resend-style client — no `resend` import. */\nexport interface AppAuthEmailClient {\n  emails: {\n    send(message: {\n      from: string\n      to: string\n      subject: string\n      html: string\n      text?: string\n    }): Promise<unknown>\n  }\n}\n\n/** Define email configuration for app authentication including client, sender, verification, and warning options */\nexport interface AppAuthEmailConfig {\n  /** A Resend-style client, or a lazy getter returning null when the API key\n   *  is absent (the products' dev default — mail is skipped with a warning,\n   *  sign-up itself must not crash). */\n  resend: AppAuthEmailClient | (() => AppAuthEmailClient | null)\n  /** RFC 5322 From, e.g. `'Legal Agent <noreply@legal.tangle.tools>'`. */\n  from: string\n  /** Send a verification email on sign-up and auto-sign-in after verifying\n   *  (the tax/gtm behavior). Default false (the legal behavior). */\n  verifyOnSignUp?: boolean\n  /** Receives the \"email client unavailable\" warning. Default console.warn. */\n  warn?: (message: string) => void\n}\n\n/** Env-shaped: pass the env vars straight through; the provider is registered\n *  only when BOTH values are non-empty, so unset env disables it. */\nexport interface AppAuthSocialProviderConfig {\n  clientId?: string\n  clientSecret?: string\n}\n\n/** Define social authentication configuration options for GitHub and Google providers */\nexport interface AppAuthSocialConfig {\n  github?: AppAuthSocialProviderConfig\n  google?: AppAuthSocialProviderConfig\n}\n\n/** Cross-site Tangle SSO wiring. The factory supplies the better-auth side —\n *  `setSessionCookie` via `createBetterAuthSessionCookieMinter(auth)` (signed\n *  `__Secure-`/prefixed cookie that `auth.api.getSession` accepts) — so the\n *  product no longer touches `better-auth/crypto` itself. */\nexport interface AppAuthSsoConfig {\n  /** Platform wire client (authorizeUrl + exchange). */\n  client: TangleSsoAuthClient\n  /** Product persistence: user upsert, session row, platform link. */\n  store: TangleSsoAccountStore\n  /** Absolute callback URL registered with the platform. */\n  callbackUrl: string\n  /** Default 'tangle_sso_state'. */\n  stateCookieName?: string\n  /** HMAC secret for the CSRF state cookie. Default: the auth `secret`. */\n  stateSecret?: string\n  /** Default: `baseURL` is https. Must match better-auth's own\n   *  secure-cookie decision or the cookie name lookup diverges. */\n  secureCookies?: boolean\n  sessionTtlSeconds?: number\n  stateTtlSeconds?: number\n  /** Post-login redirect fallback. Default '/app'. */\n  defaultRedirectPath?: string\n  /** Default: the top-level `loginPath`. */\n  loginPath?: string\n  /** Failure log hook (e.g. console.error). Default no-op. */\n  log?: (message: string, error?: unknown) => void\n}\n\n/** Define the structure for application authentication data including users, sessions, accounts, and verifications */\nexport interface AppAuthSchema {\n  users: unknown\n  sessions: unknown\n  accounts: unknown\n  verifications: unknown\n}\n\n/** Define configuration settings for app authentication including app name, base URL, secrets, and trusted origins */\nexport interface AppAuthConfig {\n  /** Product name — used in email subjects and as the cookie-prefix default. */\n  appName: string\n  /** Absolute origin better-auth serves from (`BETTER_AUTH_URL`). */\n  baseURL: string\n  /** better-auth HMAC secret. Optional only because better-auth falls back to\n   *  the BETTER_AUTH_SECRET env var; `sso` needs it explicitly (or\n   *  `sso.stateSecret`). */\n  secret?: string\n  trustedOrigins?: string[]\n  /**\n   * Session-cookie prefix. Default: slugified `appName`. A per-app prefix is\n   * load-bearing, not cosmetic: the platform (id.tangle.tools) mints its own\n   * better-auth cookie `Domain=.tangle.tools`-wide under the DEFAULT name, and\n   * the platform's (older) cookie wins the Cookie-header order — an app on the\n   * default prefix reads the platform's token, fails its own signature check,\n   * and every fresh login lands back on /login.\n   */\n  cookiePrefix?: string\n  /** Drizzle database instance; wired through better-auth's drizzle adapter\n   *  together with `schema`. */\n  db?: unknown\n  /** The product's users/sessions/accounts/verifications tables (mapped to\n   *  better-auth's user/session/account/verification models). */\n  schema?: AppAuthSchema\n  /** Drizzle dialect. Default 'sqlite' (D1). */\n  provider?: 'sqlite' | 'pg' | 'mysql'\n  /** Escape hatch: a pre-built better-auth database adapter (e.g.\n   *  `memoryAdapter` in tests). Wins over `db`/`schema`. */\n  database?: BetterAuthOptions['database']\n  /** Email+password sign-in. Default true (all current products enable it). */\n  emailAndPassword?: boolean\n  /** Reset/verification mail. Omit to disable password reset entirely. */\n  email?: AppAuthEmailConfig\n  social?: AppAuthSocialConfig\n  /** Session cookie-cache TTL in seconds; `false` disables the cache.\n   *  Default 300. */\n  sessionCookieCacheSeconds?: number | false\n  /** Tangle cross-site SSO (start/callback handlers). */\n  sso?: AppAuthSsoConfig\n  /** Where guards redirect unauthenticated page requests. Default '/login'. */\n  loginPath?: string\n  /** Merged over the factory's `advanced` block (cookiePrefix stays unless\n   *  overridden here). */\n  advanced?: BetterAuthOptions['advanced']\n}\n\n/** The configured better-auth instance, typed at better-auth's base surface\n *  (`handler`, `api`, `$context`, `$Infer`). */\nexport type AppAuthInstance = Auth\n\n/** What `getSession`/guards resolve: better-auth's base session + user rows. */\nexport interface AppAuthSession {\n  session: Session\n  user: User\n}\n\n/** Define authentication guard with session retrieval and optional SSO handlers for app requests */\nexport interface AppAuth extends AuthGuard<AppAuthSession> {\n  auth: AppAuthInstance\n  /** `auth.api.getSession` over a `Request` — the seam the guards consume. */\n  getSession(request: Request): Promise<AppAuthSession | null>\n  /** Tangle SSO start/callback handlers; null unless `sso` was configured. */\n  sso: TangleSsoHandlers | null\n}\n\n/** Lowercased, non-alphanumerics collapsed to '-': `'Legal Agent'` → `'legal-agent'`. */\nfunction slugify(name: string): string {\n  return name\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-')\n    .replace(/^-+|-+$/g, '')\n}\n\nfunction resolveEmailClient(email: AppAuthEmailConfig): AppAuthEmailClient | null {\n  return typeof email.resend === 'function' ? email.resend() : email.resend\n}\n\n/** Resend reports failures in the resolved value, not by rejecting — surface\n *  them loud so better-auth's flow (and the caller's logs) see the failure. */\nasync function sendEmail(\n  client: AppAuthEmailClient,\n  message: { from: string; to: string; subject: string; html: string; text: string },\n): Promise<void> {\n  const result = (await client.emails.send(message)) as { error?: { message?: string } | null } | null | undefined\n  if (result && typeof result === 'object' && result.error) {\n    throw new Error(`[app-auth] email send failed: ${result.error.message ?? 'unknown error'}`)\n  }\n}\n\nfunction resolveDatabase(config: AppAuthConfig): NonNullable<BetterAuthOptions['database']> {\n  if (config.database) return config.database\n  if (config.db && config.schema) {\n    return drizzleAdapter(config.db as Record<string, unknown>, {\n      provider: config.provider ?? 'sqlite',\n      schema: {\n        user: config.schema.users,\n        session: config.schema.sessions,\n        account: config.schema.accounts,\n        verification: config.schema.verifications,\n      } as Record<string, unknown>,\n    })\n  }\n  throw new Error(\n    'createAppAuth requires a database: pass `db` + `schema` (drizzle) or `database` (a better-auth adapter)',\n  )\n}\n\nfunction resolveSocialProviders(social: AppAuthSocialConfig | undefined): BetterAuthOptions['socialProviders'] {\n  const providers: NonNullable<BetterAuthOptions['socialProviders']> = {}\n  if (social?.github?.clientId && social.github.clientSecret) {\n    providers.github = { clientId: social.github.clientId, clientSecret: social.github.clientSecret }\n  }\n  if (social?.google?.clientId && social.google.clientSecret) {\n    providers.google = { clientId: social.google.clientId, clientSecret: social.google.clientSecret }\n  }\n  return Object.keys(providers).length > 0 ? providers : undefined\n}\n\nfunction emailAndPasswordOptions(config: AppAuthConfig): BetterAuthOptions['emailAndPassword'] {\n  const email = config.email\n  if (!email) return { enabled: true }\n  const warn = email.warn ?? ((message: string) => console.warn(message))\n  return {\n    enabled: true,\n    sendResetPassword: async ({ user, url }) => {\n      const client = resolveEmailClient(email)\n      if (!client) {\n        warn('[app-auth] email client unavailable — password reset email not sent')\n        return\n      }\n      await sendEmail(client, {\n        from: email.from,\n        to: user.email,\n        subject: 'Reset your password',\n        html: `<p>Click the link below to reset your password:</p><p><a href=\"${url}\">${url}</a></p><p>This link expires in 1 hour.</p>`,\n        text: `Reset your password:\\n\\n${url}\\n\\nThis link expires in 1 hour.`,\n      })\n    },\n  }\n}\n\nfunction emailVerificationOptions(config: AppAuthConfig): BetterAuthOptions['emailVerification'] {\n  const email = config.email\n  if (!email?.verifyOnSignUp) return undefined\n  const warn = email.warn ?? ((message: string) => console.warn(message))\n  return {\n    sendOnSignUp: true,\n    autoSignInAfterVerification: true,\n    sendVerificationEmail: async ({ user, url }) => {\n      const client = resolveEmailClient(email)\n      if (!client) {\n        warn('[app-auth] email client unavailable — verification email not sent')\n        return\n      }\n      await sendEmail(client, {\n        from: email.from,\n        to: user.email,\n        subject: `Verify your ${config.appName} email`,\n        html: `<p>Verify your email to finish accessing ${config.appName}:</p><p><a href=\"${url}\">${url}</a></p><p>This link expires in 1 hour.</p>`,\n        text: `Verify your email to finish accessing ${config.appName}:\\n\\n${url}\\n\\nThis link expires in 1 hour.`,\n      })\n    },\n  }\n}\n\n/**\n * Build the product's better-auth instance plus the request-boundary helpers:\n * `getSession` (Request → session|null), the `createAuthGuard` quartet\n * (`requireUser` 302, `requireApiUser` JSON 401, `requireSession`,\n * `getOptionalSession`), and — when `sso` is configured — the Tangle SSO\n * start/callback handlers with the session cookie minted through better-auth's\n * own name/attributes/signing (no `better-auth/crypto` in product code).\n */\nexport function createAppAuth(config: AppAuthConfig): AppAuth {\n  if (!config.appName) throw new Error('createAppAuth: appName is required')\n  if (!config.baseURL) throw new Error('createAppAuth: baseURL is required')\n\n  const cookiePrefix = config.cookiePrefix ?? slugify(config.appName)\n  if (!cookiePrefix) throw new Error('createAppAuth: cookiePrefix (or a slugifiable appName) is required')\n\n  const socialProviders = resolveSocialProviders(config.social)\n  const options: BetterAuthOptions = {\n    appName: config.appName,\n    baseURL: config.baseURL,\n    ...(config.secret ? { secret: config.secret } : {}),\n    ...(config.trustedOrigins ? { trustedOrigins: config.trustedOrigins } : {}),\n    database: resolveDatabase(config),\n    ...(config.emailAndPassword === false ? {} : { emailAndPassword: emailAndPasswordOptions(config) }),\n    ...(config.email?.verifyOnSignUp ? { emailVerification: emailVerificationOptions(config) } : {}),\n    ...(socialProviders ? { socialProviders } : {}),\n    ...(config.sessionCookieCacheSeconds === false\n      ? {}\n      : {\n          session: {\n            cookieCache: {\n              enabled: true,\n              maxAge: config.sessionCookieCacheSeconds ?? DEFAULT_SESSION_COOKIE_CACHE_SECONDS,\n            },\n          },\n        }),\n    advanced: { cookiePrefix, ...config.advanced },\n  }\n\n  const auth: AppAuthInstance = betterAuth(options)\n\n  const getSession = async (request: Request): Promise<AppAuthSession | null> => {\n    const session = await auth.api.getSession({ headers: request.headers })\n    return (session as AppAuthSession | null) ?? null\n  }\n\n  const loginPath = config.loginPath ?? '/login'\n  const guard = createAuthGuard<AppAuthSession>({ getSession, loginPath })\n\n  let sso: TangleSsoHandlers | null = null\n  if (config.sso) {\n    const stateSecret = config.sso.stateSecret ?? config.secret\n    if (!stateSecret) {\n      throw new Error(\n        'createAppAuth: sso requires `secret` (or sso.stateSecret) — the signed-state CSRF cookie needs an HMAC secret',\n      )\n    }\n    sso = createTangleSsoHandlers({\n      auth: config.sso.client,\n      store: config.sso.store,\n      stateSecret,\n      callbackUrl: config.sso.callbackUrl,\n      stateCookieName: config.sso.stateCookieName ?? DEFAULT_STATE_COOKIE,\n      setSessionCookie: createBetterAuthSessionCookieMinter(auth),\n      secureCookies: config.sso.secureCookies ?? config.baseURL.startsWith('https:'),\n      ...(config.sso.sessionTtlSeconds !== undefined ? { sessionTtlSeconds: config.sso.sessionTtlSeconds } : {}),\n      ...(config.sso.stateTtlSeconds !== undefined ? { stateTtlSeconds: config.sso.stateTtlSeconds } : {}),\n      ...(config.sso.defaultRedirectPath ? { defaultRedirectPath: config.sso.defaultRedirectPath } : {}),\n      loginPath: config.sso.loginPath ?? loginPath,\n      ...(config.sso.log ? { log: config.sso.log } : {}),\n    })\n  }\n\n  return { auth, getSession, ...guard, sso }\n}\n"],"mappings":";;;;;;;;;AAoBA,SAAS,kBAA8E;AACvF,SAAS,sBAAsB;AAU/B,IAAM,uBAAuB;AAC7B,IAAM,uCAAuC,IAAI;AAmJjD,SAAS,QAAQ,MAAsB;AACrC,SAAO,KACJ,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE;AAC3B;AAEA,SAAS,mBAAmB,OAAsD;AAChF,SAAO,OAAO,MAAM,WAAW,aAAa,MAAM,OAAO,IAAI,MAAM;AACrE;AAIA,eAAe,UACb,QACA,SACe;AACf,QAAM,SAAU,MAAM,OAAO,OAAO,KAAK,OAAO;AAChD,MAAI,UAAU,OAAO,WAAW,YAAY,OAAO,OAAO;AACxD,UAAM,IAAI,MAAM,iCAAiC,OAAO,MAAM,WAAW,eAAe,EAAE;AAAA,EAC5F;AACF;AAEA,SAAS,gBAAgB,QAAmE;AAC1F,MAAI,OAAO,SAAU,QAAO,OAAO;AACnC,MAAI,OAAO,MAAM,OAAO,QAAQ;AAC9B,WAAO,eAAe,OAAO,IAA+B;AAAA,MAC1D,UAAU,OAAO,YAAY;AAAA,MAC7B,QAAQ;AAAA,QACN,MAAM,OAAO,OAAO;AAAA,QACpB,SAAS,OAAO,OAAO;AAAA,QACvB,SAAS,OAAO,OAAO;AAAA,QACvB,cAAc,OAAO,OAAO;AAAA,MAC9B;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,uBAAuB,QAA+E;AAC7G,QAAM,YAA+D,CAAC;AACtE,MAAI,QAAQ,QAAQ,YAAY,OAAO,OAAO,cAAc;AAC1D,cAAU,SAAS,EAAE,UAAU,OAAO,OAAO,UAAU,cAAc,OAAO,OAAO,aAAa;AAAA,EAClG;AACA,MAAI,QAAQ,QAAQ,YAAY,OAAO,OAAO,cAAc;AAC1D,cAAU,SAAS,EAAE,UAAU,OAAO,OAAO,UAAU,cAAc,OAAO,OAAO,aAAa;AAAA,EAClG;AACA,SAAO,OAAO,KAAK,SAAS,EAAE,SAAS,IAAI,YAAY;AACzD;AAEA,SAAS,wBAAwB,QAA8D;AAC7F,QAAM,QAAQ,OAAO;AACrB,MAAI,CAAC,MAAO,QAAO,EAAE,SAAS,KAAK;AACnC,QAAM,OAAO,MAAM,SAAS,CAAC,YAAoB,QAAQ,KAAK,OAAO;AACrE,SAAO;AAAA,IACL,SAAS;AAAA,IACT,mBAAmB,OAAO,EAAE,MAAM,IAAI,MAAM;AAC1C,YAAM,SAAS,mBAAmB,KAAK;AACvC,UAAI,CAAC,QAAQ;AACX,aAAK,0EAAqE;AAC1E;AAAA,MACF;AACA,YAAM,UAAU,QAAQ;AAAA,QACtB,MAAM,MAAM;AAAA,QACZ,IAAI,KAAK;AAAA,QACT,SAAS;AAAA,QACT,MAAM,kEAAkE,GAAG,KAAK,GAAG;AAAA,QACnF,MAAM;AAAA;AAAA,EAA2B,GAAG;AAAA;AAAA;AAAA,MACtC,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,QAA+D;AAC/F,QAAM,QAAQ,OAAO;AACrB,MAAI,CAAC,OAAO,eAAgB,QAAO;AACnC,QAAM,OAAO,MAAM,SAAS,CAAC,YAAoB,QAAQ,KAAK,OAAO;AACrE,SAAO;AAAA,IACL,cAAc;AAAA,IACd,6BAA6B;AAAA,IAC7B,uBAAuB,OAAO,EAAE,MAAM,IAAI,MAAM;AAC9C,YAAM,SAAS,mBAAmB,KAAK;AACvC,UAAI,CAAC,QAAQ;AACX,aAAK,wEAAmE;AACxE;AAAA,MACF;AACA,YAAM,UAAU,QAAQ;AAAA,QACtB,MAAM,MAAM;AAAA,QACZ,IAAI,KAAK;AAAA,QACT,SAAS,eAAe,OAAO,OAAO;AAAA,QACtC,MAAM,4CAA4C,OAAO,OAAO,oBAAoB,GAAG,KAAK,GAAG;AAAA,QAC/F,MAAM,yCAAyC,OAAO,OAAO;AAAA;AAAA,EAAQ,GAAG;AAAA;AAAA;AAAA,MAC1E,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAUO,SAAS,cAAc,QAAgC;AAC5D,MAAI,CAAC,OAAO,QAAS,OAAM,IAAI,MAAM,oCAAoC;AACzE,MAAI,CAAC,OAAO,QAAS,OAAM,IAAI,MAAM,oCAAoC;AAEzE,QAAM,eAAe,OAAO,gBAAgB,QAAQ,OAAO,OAAO;AAClE,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM,oEAAoE;AAEvG,QAAM,kBAAkB,uBAAuB,OAAO,MAAM;AAC5D,QAAM,UAA6B;AAAA,IACjC,SAAS,OAAO;AAAA,IAChB,SAAS,OAAO;AAAA,IAChB,GAAI,OAAO,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IACjD,GAAI,OAAO,iBAAiB,EAAE,gBAAgB,OAAO,eAAe,IAAI,CAAC;AAAA,IACzE,UAAU,gBAAgB,MAAM;AAAA,IAChC,GAAI,OAAO,qBAAqB,QAAQ,CAAC,IAAI,EAAE,kBAAkB,wBAAwB,MAAM,EAAE;AAAA,IACjG,GAAI,OAAO,OAAO,iBAAiB,EAAE,mBAAmB,yBAAyB,MAAM,EAAE,IAAI,CAAC;AAAA,IAC9F,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;AAAA,IAC7C,GAAI,OAAO,8BAA8B,QACrC,CAAC,IACD;AAAA,MACE,SAAS;AAAA,QACP,aAAa;AAAA,UACX,SAAS;AAAA,UACT,QAAQ,OAAO,6BAA6B;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAAA,IACJ,UAAU,EAAE,cAAc,GAAG,OAAO,SAAS;AAAA,EAC/C;AAEA,QAAM,OAAwB,WAAW,OAAO;AAEhD,QAAM,aAAa,OAAO,YAAqD;AAC7E,UAAM,UAAU,MAAM,KAAK,IAAI,WAAW,EAAE,SAAS,QAAQ,QAAQ,CAAC;AACtE,WAAQ,WAAqC;AAAA,EAC/C;AAEA,QAAM,YAAY,OAAO,aAAa;AACtC,QAAM,QAAQ,gBAAgC,EAAE,YAAY,UAAU,CAAC;AAEvE,MAAI,MAAgC;AACpC,MAAI,OAAO,KAAK;AACd,UAAM,cAAc,OAAO,IAAI,eAAe,OAAO;AACrD,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,wBAAwB;AAAA,MAC5B,MAAM,OAAO,IAAI;AAAA,MACjB,OAAO,OAAO,IAAI;AAAA,MAClB;AAAA,MACA,aAAa,OAAO,IAAI;AAAA,MACxB,iBAAiB,OAAO,IAAI,mBAAmB;AAAA,MAC/C,kBAAkB,oCAAoC,IAAI;AAAA,MAC1D,eAAe,OAAO,IAAI,iBAAiB,OAAO,QAAQ,WAAW,QAAQ;AAAA,MAC7E,GAAI,OAAO,IAAI,sBAAsB,SAAY,EAAE,mBAAmB,OAAO,IAAI,kBAAkB,IAAI,CAAC;AAAA,MACxG,GAAI,OAAO,IAAI,oBAAoB,SAAY,EAAE,iBAAiB,OAAO,IAAI,gBAAgB,IAAI,CAAC;AAAA,MAClG,GAAI,OAAO,IAAI,sBAAsB,EAAE,qBAAqB,OAAO,IAAI,oBAAoB,IAAI,CAAC;AAAA,MAChG,WAAW,OAAO,IAAI,aAAa;AAAA,MACnC,GAAI,OAAO,IAAI,MAAM,EAAE,KAAK,OAAO,IAAI,IAAI,IAAI,CAAC;AAAA,IAClD,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,MAAM,YAAY,GAAG,OAAO,IAAI;AAC3C;","names":[]}

package/dist/{apply-Gk4raT2j.d.ts → apply-6wlMOLf8.d.ts}

@@ -1,4 +1,4 @@
-import { q as SequenceTrackKind, f as SequenceExportFormat, p as SequenceTrack, o as SequenceTimeline, T as TimelineClipBounds, S as SequenceClip, g as SequenceExportRecord, k as SequenceMeta, m as SequenceStore } from './store-gckrNq-g.js';
+import { c as SequenceTrackKind, d as SequenceExportFormat, e as SequenceTrack, f as SequenceTimeline, T as TimelineClipBounds, g as SequenceClip, h as SequenceExportRecord, i as SequenceMeta, b as SequenceStore } from './store-B7LLlk9p.js';
 
 /**
  * The sequence operation union — the ONE mutation vocabulary shared by every
@@ -14,6 +14,7 @@ import { q as SequenceTrackKind, f as SequenceExportFormat, p as SequenceTrack,
  * undo work: every operation has a computable inverse given the pre-state.
  */
 
+/** Define an operation to place a media clip with timing, track, and playback options */
 interface PlaceClipOperation {
     type: 'place_clip';
     /** Omitted → first unlocked track matching the media kind. */
@@ -37,6 +38,7 @@ interface PlaceClipOperation {
     assetId?: string;
     metadata?: Record<string, unknown>;
 }
+/** Add a caption with optional language, timing, and track placement details */
 interface AddCaptionOperation {
     type: 'add_caption';
     text: string;
@@ -49,12 +51,14 @@ interface AddCaptionOperation {
      *  a per-language track when `language` names one that has none. */
     trackId?: string;
 }
+/** Resolve an operation to move a clip to a new start frame and optional track */
 interface MoveClipOperation {
     type: 'move_clip';
     clipId: string;
     startFrame: number;
     trackId?: string;
 }
+/** Define an operation to trim a clip by adjusting its start, duration, and optional source in/out points */
 interface TrimClipOperation {
     type: 'trim_clip';
     clipId: string;
@@ -68,41 +72,49 @@ interface TrimClipOperation {
      *  by the durable inverse of `split_clip` to restore the original window. */
     sourceOutFrame?: number | null;
 }
+/** Split a clip at a specified frame inside the clip to create two separate segments */
 interface SplitClipOperation {
     type: 'split_clip';
     clipId: string;
     /** Sequence-frame to cut at; must fall strictly inside the clip. */
     atFrame: number;
 }
+/** Resolve an operation to set clipboard text with optional language and clip identifier */
 interface SetClipTextOperation {
     type: 'set_clip_text';
     clipId: string;
     text: string;
     language?: string;
 }
+/** Define an operation to enable or disable a clip by its identifier */
 interface SetClipDisabledOperation {
     type: 'set_clip_disabled';
     clipId: string;
     disabled: boolean;
 }
+/** Represent a delete clip operation with a specified clip identifier */
 interface DeleteClipOperation {
     type: 'delete_clip';
     clipId: string;
 }
+/** Define an operation to create a new sequence track with a specified kind and name */
 interface CreateTrackOperation {
     type: 'create_track';
     kind: SequenceTrackKind;
     name: string;
 }
+/** Define an operation to extend a sequence by a specified number of frames */
 interface ExtendSequenceOperation {
     type: 'extend_sequence';
     durationFrames: number;
 }
+/** Define the structure for a queue export operation with format and optional metadata */
 interface QueueExportOperation {
     type: 'queue_export';
     format: SequenceExportFormat;
     metadata?: Record<string, unknown>;
 }
+/** Represent sequence editing actions for manipulating clips, tracks, captions, and exports */
 type SequenceOperation = PlaceClipOperation | AddCaptionOperation | MoveClipOperation | TrimClipOperation | SplitClipOperation | SetClipTextOperation | SetClipDisabledOperation | DeleteClipOperation | CreateTrackOperation | ExtendSequenceOperation | QueueExportOperation;
 /** A batch of operations with the agent's stated intent — the decision-log
  *  unit for agent edits. */
@@ -110,7 +122,9 @@ interface SequencePlan {
     summary: string;
     operations: SequenceOperation[];
 }
+/** Extract the type of operation from a sequence operation object */
 type SequenceOperationType = SequenceOperation['type'];
+/** List all valid sequence operation types used in editing workflows */
 declare const SEQUENCE_OPERATION_TYPES: readonly SequenceOperationType[];
 
 /**
@@ -136,18 +150,31 @@ declare const SEQUENCE_OPERATION_TYPES: readonly SequenceOperationType[];
 interface SequenceOperationContext {
     playheadFrame: number;
 }
+/** Validate each operation in a sequence against the timeline and context, throwing detailed errors on failure */
 declare function validateSequenceOperations(timeline: SequenceTimeline, operations: SequenceOperation[], ctx: SequenceOperationContext): void;
+/** Validate a sequence operation against the timeline and context to ensure correctness */
 declare function validateSequenceOperation(timeline: SequenceTimeline, operation: SequenceOperation, ctx: SequenceOperationContext): void;
+/** Validate the properties and constraints of a PlaceClipOperation within a SequenceTimeline */
 declare function validatePlaceClip(timeline: SequenceTimeline, operation: PlaceClipOperation): void;
+/** Validate the parameters and context of an AddCaptionOperation within a sequence timeline */
 declare function validateAddCaption(timeline: SequenceTimeline, operation: AddCaptionOperation, ctx: SequenceOperationContext): void;
+/** Validate that a clip move operation is within bounds and targets a compatible unlocked track */
 declare function validateMoveClip(timeline: SequenceTimeline, operation: MoveClipOperation): void;
+/** Validate that a trim clip operation respects timeline bounds and source frame constraints */
 declare function validateTrimClip(timeline: SequenceTimeline, operation: TrimClipOperation): void;
+/** Validate that a split operation on a clip is within valid frame boundaries and conditions */
 declare function validateSplitClip(timeline: SequenceTimeline, operation: SplitClipOperation): void;
+/** Validate that a SetClipTextOperation targets a caption clip with non-empty text and valid language tag */
 declare function validateSetClipText(timeline: SequenceTimeline, operation: SetClipTextOperation): void;
+/** Validate that the clip can be disabled within the given timeline and operation constraints */
 declare function validateSetClipDisabled(timeline: SequenceTimeline, operation: SetClipDisabledOperation): void;
+/** Validate that the clip to delete exists and is mutable in the given timeline */
 declare function validateDeleteClip(timeline: SequenceTimeline, operation: DeleteClipOperation): void;
+/** Validate that a CreateTrackOperation has a supported kind and a non-empty name */
 declare function validateCreateTrack(operation: CreateTrackOperation): void;
+/** Validate that the extend sequence operation has a positive duration and exceeds the last clip end frame */
 declare function validateExtendSequence(timeline: SequenceTimeline, operation: ExtendSequenceOperation): void;
+/** Validate that the queue export operation uses a supported export format */
 declare function validateQueueExport(operation: QueueExportOperation): void;
 /**
  * Shape-gate untrusted JSON (a product's `onApplyOperations` route body) into
@@ -159,6 +186,7 @@ declare function validateQueueExport(operation: QueueExportOperation): void;
  * validator and store.
  */
 declare function parseSequenceOperations(input: unknown): SequenceOperation[];
+/** Resolve caption target by specifying an existing track or creating a new one with language and name */
 type CaptionTargetResolution = {
     kind: 'existing';
     track: SequenceTrack;
@@ -246,6 +274,7 @@ type SequenceApplyResult = {
  * MCP layer records `agent_edit`, an editor route records `human_edit`.
  */
 declare function applySequenceOperations(store: SequenceStore, operations: SequenceOperation[], ctx: SequenceOperationContext): Promise<SequenceApplyResult[]>;
+/** Apply a sequence operation to update the store and timeline asynchronously */
 declare function applySequenceOperation(store: SequenceStore, timeline: SequenceTimeline, op: SequenceOperation, ctx: SequenceOperationContext): Promise<SequenceApplyResult>;
 
 export { type AddCaptionOperation as A, validateSequenceOperations as B, type CaptionTargetResolution as C, type DeleteClipOperation as D, type ExtendSequenceOperation as E, validateSetClipDisabled as F, validateSetClipText as G, validateSplitClip as H, validateTrimClip as I, type MoveClipOperation as M, type PlaceClipOperation as P, type QueueExportOperation as Q, SEQUENCE_OPERATION_TYPES as S, type TrimClipOperation as T, type CreateTrackOperation as a, type SequenceApplyResult as b, type SequenceOperation as c, type SequenceOperationContext as d, type SequenceOperationType as e, type SequencePlan as f, type SetClipDisabledOperation as g, type SetClipTextOperation as h, type SplitClipOperation as i, applySequenceOperation as j, applySequenceOperations as k, assertSequenceMediaUrl as l, captionTrackNameForLanguage as m, lastClipEndFrame as n, resolveCaptionTarget as o, parseSequenceOperations as p, resolvePlaceClipTrack as q, resolveCaptionPlacement as r, validateCreateTrack as s, validateDeleteClip as t, validateExtendSequence as u, validateAddCaption as v, validateMoveClip as w, validatePlaceClip as x, validateQueueExport as y, validateSequenceOperation as z };