@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.4

package/dist/schemas/api/provider.d.ts

@@ -0,0 +1,85 @@
+import * as z from 'zod/v4';
+export declare const AuthProviderTypeSchema: z.ZodEnum<{
+    api: "api";
+    db: "db";
+}>;
+export type AuthProviderType = z.infer<typeof AuthProviderTypeSchema>;
+export declare const ApiAuthConfigSchema: z.ZodObject<{
+    tokenSource: z.ZodDefault<z.ZodEnum<{
+        secret: "secret";
+        config: "config";
+    }>>;
+    configKey: z.ZodOptional<z.ZodString>;
+    credential: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">>;
+    headerName: z.ZodDefault<z.ZodString>;
+    tokenPrefix: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+export type ApiAuthConfig = z.infer<typeof ApiAuthConfigSchema>;
+export declare const DbAuthConfigSchema: z.ZodObject<{
+    useSessionContext: z.ZodDefault<z.ZodBoolean>;
+    bypassAuth: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type DbAuthConfig = z.infer<typeof DbAuthConfigSchema>;
+export declare const AuthProviderDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    surfaces: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    kind: z.ZodLiteral<"auth/provider">;
+    type: z.ZodEnum<{
+        api: "api";
+        db: "db";
+    }>;
+    isDefault: z.ZodOptional<z.ZodBoolean>;
+    api: z.ZodOptional<z.ZodObject<{
+        tokenSource: z.ZodDefault<z.ZodEnum<{
+            secret: "secret";
+            config: "config";
+        }>>;
+        configKey: z.ZodOptional<z.ZodString>;
+        credential: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"secret">;
+            key: z.ZodString;
+            store: z.ZodOptional<z.ZodString>;
+            operation: z.ZodOptional<z.ZodCustom<object, object>>;
+        }, z.core.$strict>], "source">>;
+        headerName: z.ZodDefault<z.ZodString>;
+        tokenPrefix: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>>;
+    db: z.ZodOptional<z.ZodObject<{
+        useSessionContext: z.ZodDefault<z.ZodBoolean>;
+        bypassAuth: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    priority: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+export type AuthProviderDescriptor = z.infer<typeof AuthProviderDescriptorSchema>;
+export declare const AuthContextSchema: z.ZodObject<{
+    isAuthenticated: z.ZodBoolean;
+    userId: z.ZodOptional<z.ZodString>;
+    token: z.ZodOptional<z.ZodString>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AuthContext = z.infer<typeof AuthContextSchema>;
+export interface AuthProviderImplementation {
+    readonly descriptor: AuthProviderDescriptor;
+    readonly type: AuthProviderType;
+    getAuthContext(): Promise<AuthContext>;
+    isAvailable(): Promise<boolean>;
+    validateCredentials(): Promise<{
+        valid: boolean;
+        error?: string;
+    }>;
+    dispose?(): Promise<void>;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/schemas/api/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/schemas/api/provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAe5B,eAAO,MAAM,sBAAsB;;;EAAwB,CAAC;AAC5D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;iBAM9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,kBAAkB;;;iBAG7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAOvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,iBAAiB;;;;;;iBAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,mBAAmB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnE,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B"}

package/dist/schemas/api/provider.js

@@ -0,0 +1,42 @@
+import { CredentialReferenceSchema } from '@vibesdotdev/kernel/credentials';
+import * as z from 'zod/v4';
+const runtimeDescriptorSchema = z.object({
+    id: z.string().min(1),
+    kind: z.string().min(1),
+    name: z.string().optional(),
+    description: z.string().optional(),
+    tags: z.array(z.string()).optional(),
+    hardware: z.array(z.string()).optional(),
+    surfaces: z.array(z.string()).optional(),
+    enabled: z.boolean().optional(),
+    requiredContext: z.array(z.string()).optional(),
+    optionalContext: z.array(z.string()).optional()
+});
+export const AuthProviderTypeSchema = z.enum(['api', 'db']);
+export const ApiAuthConfigSchema = z.object({
+    tokenSource: z.enum(['config', 'secret']).default('config'),
+    configKey: z.string().optional(),
+    credential: CredentialReferenceSchema.optional(),
+    headerName: z.string().default('Authorization'),
+    tokenPrefix: z.string().default('Bearer')
+});
+export const DbAuthConfigSchema = z.object({
+    useSessionContext: z.boolean().default(true),
+    bypassAuth: z.boolean().default(false)
+});
+export const AuthProviderDescriptorSchema = runtimeDescriptorSchema.extend({
+    kind: z.literal('auth/provider'),
+    type: AuthProviderTypeSchema,
+    isDefault: z.boolean().optional(),
+    api: ApiAuthConfigSchema.optional(),
+    db: DbAuthConfigSchema.optional(),
+    priority: z.number().default(0)
+});
+export const AuthContextSchema = z.object({
+    isAuthenticated: z.boolean(),
+    userId: z.string().optional(),
+    token: z.string().optional(),
+    headers: z.record(z.string(), z.string()).optional(),
+    error: z.string().optional()
+});
+//# sourceMappingURL=provider.js.map

package/dist/schemas/api/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/schemas/api/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAG5D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;CACzC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACtC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC1E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,IAAI,EAAE,sBAAsB;IAC5B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,GAAG,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACnC,EAAE,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC"}

package/dist/schemas/app-credentials.d.ts

@@ -0,0 +1,44 @@
+/**
+ * `auth.app-credentials`: which runtime credentials hold this app's own Auth
+ * client id and secret.
+ *
+ * An app calls Auth as itself (app-to-Auth reads such as registered-app
+ * resolution) with a `client_credentials` token minted from the confidential
+ * client Auth's internal registrar issued it. `vibes secrets oauth-client mint`
+ * stores that client's id and secret under the keys the operator chooses; this
+ * manifest names those keys. Values never live in config, only references, and
+ * the runtime credential mechanism resolves them per call.
+ *
+ * ```ts
+ * // vibes.config.ts
+ * config: {
+ *   'auth.app-credentials': {
+ *     clientId: { source: 'secret', key: 'HQ_WEB_OAUTH_CLIENT_ID' },
+ *     clientSecret: { source: 'secret', key: 'HQ_WEB_OAUTH_CLIENT_SECRET' }
+ *   }
+ * }
+ * ```
+ */
+import * as z from 'zod/v4';
+/** A JSON-storable secret reference (the kernel `CredentialReference` secret arm). */
+export declare const AppCredentialReferenceSchema: z.ZodObject<{
+    source: z.ZodLiteral<"secret">;
+    key: z.ZodString;
+    store: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type AppCredentialReference = z.infer<typeof AppCredentialReferenceSchema>;
+export declare const AuthAppCredentialsConfigSchema: z.ZodObject<{
+    clientId: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    clientSecret: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+}, z.core.$strip>;
+export type AuthAppCredentialsConfig = z.infer<typeof AuthAppCredentialsConfigSchema>;
+export declare const AUTH_APP_CREDENTIALS_MANIFEST_ID = "auth.app-credentials";
+//# sourceMappingURL=app-credentials.d.ts.map

package/dist/schemas/app-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-credentials.d.ts","sourceRoot":"","sources":["../../src/schemas/app-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,sFAAsF;AACtF,eAAO,MAAM,4BAA4B;;;;kBAIvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,8BAA8B;;;;;;;;;;;iBAKzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,gCAAgC,yBAAyB,CAAC"}

package/dist/schemas/app-credentials.js

@@ -0,0 +1,36 @@
+/**
+ * `auth.app-credentials`: which runtime credentials hold this app's own Auth
+ * client id and secret.
+ *
+ * An app calls Auth as itself (app-to-Auth reads such as registered-app
+ * resolution) with a `client_credentials` token minted from the confidential
+ * client Auth's internal registrar issued it. `vibes secrets oauth-client mint`
+ * stores that client's id and secret under the keys the operator chooses; this
+ * manifest names those keys. Values never live in config, only references, and
+ * the runtime credential mechanism resolves them per call.
+ *
+ * ```ts
+ * // vibes.config.ts
+ * config: {
+ *   'auth.app-credentials': {
+ *     clientId: { source: 'secret', key: 'HQ_WEB_OAUTH_CLIENT_ID' },
+ *     clientSecret: { source: 'secret', key: 'HQ_WEB_OAUTH_CLIENT_SECRET' }
+ *   }
+ * }
+ * ```
+ */
+import * as z from 'zod/v4';
+/** A JSON-storable secret reference (the kernel `CredentialReference` secret arm). */
+export const AppCredentialReferenceSchema = z.strictObject({
+    source: z.literal('secret'),
+    key: z.string().min(1).max(128),
+    store: z.string().min(1).optional()
+});
+export const AuthAppCredentialsConfigSchema = z.object({
+    /** The credential holding this app's Auth client id. Null: not configured. */
+    clientId: AppCredentialReferenceSchema.nullable().default(null),
+    /** The credential holding this app's Auth client secret. Null: not configured. */
+    clientSecret: AppCredentialReferenceSchema.nullable().default(null)
+});
+export const AUTH_APP_CREDENTIALS_MANIFEST_ID = 'auth.app-credentials';
+//# sourceMappingURL=app-credentials.js.map

package/dist/schemas/app-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-credentials.js","sourceRoot":"","sources":["../../src/schemas/app-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,sFAAsF;AACtF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC3B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,8EAA8E;IAC9E,QAAQ,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/D,kFAAkF;IAClF,YAAY,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACnE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,sBAAsB,CAAC"}

package/dist/schemas/app-jwt.d.ts

@@ -0,0 +1,112 @@
+import * as z from 'zod/v4';
+import type { ApiClientImplementation } from '@vibesdotdev/client/schemas';
+export declare const credentialEnvironmentSchema: z.ZodOptional<z.ZodString>;
+/** Optional transport/credential overrides retain the public helper contract. */
+export declare const resolveAppJwtOptionsSchema: z.ZodObject<{
+    environment: z.ZodOptional<z.ZodString>;
+    authOrigin: z.ZodOptional<z.ZodPipe<z.ZodURL, z.ZodTransform<string, string>>>;
+    loadCredentials: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [], null>, z.ZodPromise<z.ZodNullable<z.ZodObject<{
+        type: z.ZodEnum<{
+            none: "none";
+            session: "session";
+            apiKey: "apiKey";
+        }>;
+        token: z.ZodOptional<z.ZodString>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        sessionToken: z.ZodOptional<z.ZodString>;
+        sessionTokenReference: z.ZodOptional<z.ZodObject<{
+            storeId: z.ZodString;
+            environment: z.ZodString;
+            key: z.ZodString;
+        }, z.core.$strip>>;
+        refreshToken: z.ZodOptional<z.ZodString>;
+        refreshTokenReference: z.ZodOptional<z.ZodObject<{
+            storeId: z.ZodString;
+            environment: z.ZodString;
+            key: z.ZodString;
+        }, z.core.$strip>>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        environment: z.ZodOptional<z.ZodString>;
+        userId: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            "chat:send": "chat:send";
+            "chat:read": "chat:read";
+            "knowledge:read": "knowledge:read";
+            "knowledge:write": "knowledge:write";
+            "session:join": "session:join";
+            "session:create": "session:create";
+            "forum:post": "forum:post";
+            "forum:react": "forum:react";
+            "presence:update": "presence:update";
+            "presentations:request": "presentations:request";
+            "presentations:review": "presentations:review";
+            "forge:read": "forge:read";
+            "forge:write": "forge:write";
+            "forge:review": "forge:review";
+            "forge:merge": "forge:merge";
+        }>>>;
+        projectId: z.ZodOptional<z.ZodString>;
+        ipWhitelist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        dailyQuota: z.ZodOptional<z.ZodNumber>;
+        source: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>>>;
+    createClient: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [], null>, z.ZodPromise<z.ZodCustom<ApiClientImplementation, ApiClientImplementation>>>>;
+}, z.core.$strict>;
+export type ResolveAppJwtOptions = z.infer<typeof resolveAppJwtOptionsSchema>;
+export declare const resolveFreshAppJwtOptionsSchema: z.ZodObject<{
+    environment: z.ZodOptional<z.ZodString>;
+    authOrigin: z.ZodOptional<z.ZodPipe<z.ZodURL, z.ZodTransform<string, string>>>;
+    loadCredentials: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [], null>, z.ZodPromise<z.ZodNullable<z.ZodObject<{
+        type: z.ZodEnum<{
+            none: "none";
+            session: "session";
+            apiKey: "apiKey";
+        }>;
+        token: z.ZodOptional<z.ZodString>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        sessionToken: z.ZodOptional<z.ZodString>;
+        sessionTokenReference: z.ZodOptional<z.ZodObject<{
+            storeId: z.ZodString;
+            environment: z.ZodString;
+            key: z.ZodString;
+        }, z.core.$strip>>;
+        refreshToken: z.ZodOptional<z.ZodString>;
+        refreshTokenReference: z.ZodOptional<z.ZodObject<{
+            storeId: z.ZodString;
+            environment: z.ZodString;
+            key: z.ZodString;
+        }, z.core.$strip>>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        environment: z.ZodOptional<z.ZodString>;
+        userId: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            "chat:send": "chat:send";
+            "chat:read": "chat:read";
+            "knowledge:read": "knowledge:read";
+            "knowledge:write": "knowledge:write";
+            "session:join": "session:join";
+            "session:create": "session:create";
+            "forum:post": "forum:post";
+            "forum:react": "forum:react";
+            "presence:update": "presence:update";
+            "presentations:request": "presentations:request";
+            "presentations:review": "presentations:review";
+            "forge:read": "forge:read";
+            "forge:write": "forge:write";
+            "forge:review": "forge:review";
+            "forge:merge": "forge:merge";
+        }>>>;
+        projectId: z.ZodOptional<z.ZodString>;
+        ipWhitelist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        dailyQuota: z.ZodOptional<z.ZodNumber>;
+        source: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>>>;
+    createClient: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [], null>, z.ZodPromise<z.ZodCustom<ApiClientImplementation, ApiClientImplementation>>>>;
+    now: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [], null>, z.ZodNumber>>;
+}, z.core.$strict>;
+export type ResolveFreshAppJwtInput = z.infer<typeof resolveFreshAppJwtOptionsSchema>;
+//# sourceMappingURL=app-jwt.d.ts.map

package/dist/schemas/app-jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-jwt.d.ts","sourceRoot":"","sources":["../../src/schemas/app-jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAG3E,eAAO,MAAM,2BAA2B,4BAAsC,CAAC;AAE/E,iFAAiF;AACjF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAK5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAE1C,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC"}

package/dist/schemas/app-jwt.js

@@ -0,0 +1,14 @@
+import * as z from 'zod/v4';
+import { credentialInfoSchema } from "./credentials.js";
+export const credentialEnvironmentSchema = z.string().trim().min(1).optional();
+/** Optional transport/credential overrides retain the public helper contract. */
+export const resolveAppJwtOptionsSchema = z.object({
+    environment: credentialEnvironmentSchema,
+    authOrigin: z.url().transform(value => new URL(value).origin).optional(),
+    loadCredentials: z.function({ input: [], output: z.promise(credentialInfoSchema.nullable()) }).optional(),
+    createClient: z.function({ input: [], output: z.promise(z.custom()) }).optional()
+}).strict();
+export const resolveFreshAppJwtOptionsSchema = resolveAppJwtOptionsSchema.extend({
+    now: z.function({ input: [], output: z.number() }).optional()
+});
+//# sourceMappingURL=app-jwt.js.map

package/dist/schemas/app-jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-jwt.js","sourceRoot":"","sources":["../../src/schemas/app-jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAE/E,iFAAiF;AACjF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,WAAW,EAAE,2BAA2B;IACxC,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IACxE,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzG,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAA2B,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1G,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,+BAA+B,GAAG,0BAA0B,CAAC,MAAM,CAAC;IAChF,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAC"}

package/dist/schemas/auth/better-auth.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Better Auth inferred types (schema-compliant export location).
+ *
+ * Note: these are type-only exports; they compile away and are safe to import in client code.
+ * User type is the canonical identity type from account (relocated from users).
+ */
+import type { User } from '@vibesdotdev/account/schemas';
+import type { SessionWithUser } from './common.ts';
+export type BetterAuthUser = User;
+export type BetterAuthSession = SessionWithUser;
+//# sourceMappingURL=better-auth.d.ts.map

package/dist/schemas/auth/better-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth.d.ts","sourceRoot":"","sources":["../../../src/schemas/auth/better-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC;AAClC,MAAM,MAAM,iBAAiB,GAAG,eAAe,CAAC"}

package/dist/schemas/auth/better-auth.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=better-auth.js.map

package/dist/schemas/auth/better-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth.js","sourceRoot":"","sources":["../../../src/schemas/auth/better-auth.ts"],"names":[],"mappings":""}

package/dist/schemas/auth/capabilities.d.ts

@@ -0,0 +1,42 @@
+import * as z from 'zod/v4';
+export declare const authCapabilitySchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const authCapabilitiesSchema: z.ZodObject<{
+    emailVerification: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        reason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    passwordReset: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        reason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    magicLink: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        reason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    phoneOtp: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        reason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    twoFactor: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        reason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    apiKeys: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        reason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    deviceAuthorization: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        reason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    walletAuth: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        reason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type AuthCapability = z.infer<typeof authCapabilitySchema>;
+export type AuthCapabilities = z.infer<typeof authCapabilitiesSchema>;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/schemas/auth/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../../src/schemas/auth/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBASjC,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/schemas/auth/capabilities.js

@@ -0,0 +1,16 @@
+import * as z from 'zod/v4';
+export const authCapabilitySchema = z.object({
+    enabled: z.boolean(),
+    reason: z.string().optional()
+});
+export const authCapabilitiesSchema = z.object({
+    emailVerification: authCapabilitySchema,
+    passwordReset: authCapabilitySchema,
+    magicLink: authCapabilitySchema,
+    phoneOtp: authCapabilitySchema,
+    twoFactor: authCapabilitySchema,
+    apiKeys: authCapabilitySchema,
+    deviceAuthorization: authCapabilitySchema,
+    walletAuth: authCapabilitySchema
+});
+//# sourceMappingURL=capabilities.js.map

package/dist/schemas/auth/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../../src/schemas/auth/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,iBAAiB,EAAE,oBAAoB;IACvC,aAAa,EAAE,oBAAoB;IACnC,SAAS,EAAE,oBAAoB;IAC/B,QAAQ,EAAE,oBAAoB;IAC9B,SAAS,EAAE,oBAAoB;IAC/B,OAAO,EAAE,oBAAoB;IAC7B,mBAAmB,EAAE,oBAAoB;IACzC,UAAU,EAAE,oBAAoB;CAChC,CAAC,CAAC"}

package/dist/schemas/auth/common.d.ts

@@ -0,0 +1,158 @@
+import * as z from 'zod/v4';
+export interface DatabaseUserAttributes {
+    email: string;
+    displayName: string | null;
+    avatarUrl: string | null;
+}
+export declare const sessionSchema: z.ZodObject<{
+    id: z.ZodString;
+    userId: z.ZodUUID;
+    expiresAt: z.ZodDate;
+    twoFactorVerified: z.ZodNullable<z.ZodBoolean>;
+}, z.core.$strip>;
+export type Session = z.infer<typeof sessionSchema>;
+export declare const authKeySchema: z.ZodObject<{
+    id: z.ZodUUID;
+    userId: z.ZodUUID;
+    hashedPassword: z.ZodNullable<z.ZodString>;
+    provider: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type AuthKey = z.infer<typeof authKeySchema>;
+export declare const authAttemptSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    userId: z.ZodNullable<z.ZodUUID>;
+    attempts: z.ZodNumber;
+    lastAttemptAt: z.ZodDate;
+    lockedUntil: z.ZodNullable<z.ZodDate>;
+}, z.core.$strip>;
+export type AuthAttempt = z.infer<typeof authAttemptSchema>;
+export declare const apiScopes: {
+    readonly READ_PROFILE: "profile:read";
+    readonly WRITE_PROFILE: "profile:write";
+    readonly READ_AGENTS: "agents:read";
+    readonly WRITE_AGENTS: "agents:write";
+    readonly RUN_AGENTS: "agents:run";
+    readonly READ_KNOWLEDGE: "knowledge:read";
+    readonly WRITE_KNOWLEDGE: "knowledge:write";
+};
+export type ApiScope = (typeof apiScopes)[keyof typeof apiScopes];
+export declare const apiKeySchema: z.ZodObject<{
+    id: z.ZodUUID;
+    userId: z.ZodUUID;
+    name: z.ZodString;
+    description: z.ZodNullable<z.ZodString>;
+    key: z.ZodString;
+    scopes: z.ZodArray<z.ZodString>;
+    createdAt: z.ZodDate;
+    expiresAt: z.ZodNullable<z.ZodDate>;
+    lastUsedAt: z.ZodNullable<z.ZodDate>;
+    isRevoked: z.ZodBoolean;
+    applicationId: z.ZodNullable<z.ZodString>;
+    ipRestrictions: z.ZodNullable<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type ApiKey = z.infer<typeof apiKeySchema>;
+export declare const externalApplicationSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodNullable<z.ZodString>;
+    redirectUris: z.ZodArray<z.ZodString>;
+    createdAt: z.ZodDate;
+    isVerified: z.ZodBoolean;
+    icon: z.ZodNullable<z.ZodString>;
+    website: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ExternalApplication = z.infer<typeof externalApplicationSchema>;
+export declare const authTokenSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    userId: z.ZodUUID;
+    tokenHash: z.ZodString;
+    tokenType: z.ZodEnum<{
+        email_verification: "email_verification";
+        password_reset: "password_reset";
+    }>;
+    expiresAt: z.ZodDate;
+    usedAt: z.ZodNullable<z.ZodDate>;
+    createdAt: z.ZodDate;
+}, z.core.$strip>;
+export type AuthToken = z.infer<typeof authTokenSchema>;
+export declare const totpSecretSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    userId: z.ZodUUID;
+    secret: z.ZodString;
+    verified: z.ZodBoolean;
+    createdAt: z.ZodDate;
+}, z.core.$strip>;
+export type TotpSecret = z.infer<typeof totpSecretSchema>;
+export declare const recoveryCodeSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    userId: z.ZodUUID;
+    code: z.ZodString;
+    used: z.ZodBoolean;
+    createdAt: z.ZodDate;
+}, z.core.$strip>;
+export type RecoveryCode = z.infer<typeof recoveryCodeSchema>;
+export declare const apiKeyWithApplicationSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    userId: z.ZodUUID;
+    name: z.ZodString;
+    description: z.ZodNullable<z.ZodString>;
+    key: z.ZodString;
+    scopes: z.ZodArray<z.ZodString>;
+    createdAt: z.ZodDate;
+    expiresAt: z.ZodNullable<z.ZodDate>;
+    lastUsedAt: z.ZodNullable<z.ZodDate>;
+    isRevoked: z.ZodBoolean;
+    applicationId: z.ZodNullable<z.ZodString>;
+    ipRestrictions: z.ZodNullable<z.ZodArray<z.ZodString>>;
+    application: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        description: z.ZodNullable<z.ZodString>;
+        redirectUris: z.ZodArray<z.ZodString>;
+        createdAt: z.ZodDate;
+        isVerified: z.ZodBoolean;
+        icon: z.ZodNullable<z.ZodString>;
+        website: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ApiKeyWithApplication = z.infer<typeof apiKeyWithApplicationSchema>;
+export declare const sessionWithUserSchema: z.ZodObject<{
+    id: z.ZodString;
+    userId: z.ZodUUID;
+    expiresAt: z.ZodDate;
+    twoFactorVerified: z.ZodNullable<z.ZodBoolean>;
+    user: z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodString;
+        displayName: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type SessionWithUser = z.infer<typeof sessionWithUserSchema>;
+export declare const authStateSchema: z.ZodObject<{
+    isAuthenticated: z.ZodBoolean;
+    user: z.ZodNullable<z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodString;
+        displayName: z.ZodNullable<z.ZodString>;
+        avatarUrl: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    session: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        userId: z.ZodUUID;
+        expiresAt: z.ZodDate;
+        twoFactorVerified: z.ZodNullable<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    twoFactorEnabled: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type AuthState = z.infer<typeof authStateSchema>;
+export declare const analyticsEventPayloadSchema: z.ZodObject<{
+    type: z.ZodString;
+    properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    timestamp: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AnalyticsEventPayload = z.infer<typeof analyticsEventPayloadSchema>;
+export interface ValidatedSessionContext {
+    user: import('@vibesdotdev/account/schemas').User;
+    session: Session;
+}
+//# sourceMappingURL=common.d.ts.map

package/dist/schemas/auth/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/schemas/auth/common.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,MAAM,WAAW,sBAAsB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAGD,eAAO,MAAM,aAAa;;;;;iBAKxB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAGpD,eAAO,MAAM,aAAa;;;;;iBAKxB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAGpD,eAAO,MAAM,iBAAiB;;;;;;iBAM5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAG5D,eAAO,MAAM,SAAS;;;;;;;;CAQZ,CAAC;AACX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAGlE,eAAO,MAAM,YAAY;;;;;;;;;;;;;iBAavB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAGlD,eAAO,MAAM,yBAAyB;;;;;;;;;iBASpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAG5E,eAAO,MAAM,eAAe;;;;;;;;;;;iBAQ1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAGxD,eAAO,MAAM,gBAAgB;;;;;;iBAM3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAG1D,eAAO,MAAM,kBAAkB;;;;;;iBAM7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAK9D,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;iBAEtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAGhF,eAAO,MAAM,qBAAqB;;;;;;;;;;iBAMhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAGpE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;iBAY1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,2BAA2B;;;;iBAItC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAGhF,MAAM,WAAW,uBAAuB;IACvC,IAAI,EAAE,OAAO,8BAA8B,EAAE,IAAI,CAAC;IAClD,OAAO,EAAE,OAAO,CAAC;CACjB"}