npm - @voyant-travel/auth - Versions diffs - 0.133.1 → 0.133.2 - Mend

@voyant-travel/auth 0.133.1 → 0.133.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (15) hide show

package/dist/auth-realms.d.ts +50 -0
package/dist/auth-realms.js +13 -0
package/dist/auth-realms.js.map +1 -0
package/dist/edge.d.ts +6 -1
package/dist/edge.js +41 -19
package/dist/edge.js.map +1 -1
package/dist/node-runtime.d.ts +44 -2
package/dist/node-runtime.js +294 -30
package/dist/node-runtime.js.map +1 -1
package/dist/runtime-contributor.js +8 -4
package/dist/runtime-contributor.js.map +1 -1
package/dist/server.d.ts +30 -1
package/dist/server.js +127 -81
package/dist/server.js.map +1 -1
package/package.json +9 -4

package/dist/node-runtime.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"node-runtime.js","sourceRoot":"","sources":["../src/node-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAwB,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAClF,OAAO,EACL,QAAQ,EACR,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EACL,cAAc,EACd,eAAe,EACf,SAAS,GACV,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAEhE,OAAO,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAA;AAChG,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAA;AACzC,OAAO,EACL,gCAAgC,EAChC,qCAAqC,EACrC,kCAAkC,GACnC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,mCAAmC,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAClG,OAAO,EAEL,gBAAgB,EAChB,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAmDzD,mFAAmF;AACnF,MAAM,UAAU,oCAAoC,CAClD,GAAoD;IAIpD,MAAM,MAAM,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAA;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAE7B,OAAO;QACL,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;QAChD,uBAAuB,EAAE,EAAE,MAAM,EAAE;KACpC,CAAA;AACH,CAAC;AAwBD,MAAM,UAAU,6BAA6B,CAC3C,cAAyD;IAIzD,MAAM,YAAY,GAChB,cAAc,CAAC,YAAY;QAC3B,CAAC,CAAC,GAAQ,EAAE,EAAE;YACZ,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;YACtC,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAA;QACnE,CAAC,CAAC,CAAA;IAEJ,MAAM,IAAI,GAAG,IAAI,IAAI,EAAe,CAAA;IACpC,iEAAiE;IACjE,0EAA0E;IAC1E,+EAA+E;IAC/E,oEAAoE;IACpE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IACxB,oEAAoE;IACpE,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,8EAA8E;IAC9E,yEAAyE;IACzE,kEAAkE;IAClE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,IAAI,EAAE,CAAA;QACZ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACxB,eAAe,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,EAAE;gBAC1C,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE;gBAC/B,GAAG,EAAE,cAAc,CAAC,OAAO;gBAC3B,KAAK,EAAE,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC9D,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE;aAC3F,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;IACF,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CACtB,cAAc,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC,CAC/F,CAAA;IAED,MAAM,eAAe,GAAG,uBAAuB,CAAA;IAC/C,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;QAC1C,mBAAmB;QACnB,YAAY;QACZ,eAAe;QACf,gBAAgB;QAChB,aAAa;KACd,CAAC,CAAA;IAEF,SAAS,uBAAuB,CAAC,IAAS;QACxC,OAAO,cAAc,CAAC,QAAQ,CAAA;IAChC,CAAC;IAED,SAAS,qBAAqB,CAAC,GAAQ;QACrC,OAAO,uBAAuB,CAAC,GAAG,CAAC,KAAK,cAAc,CAAA;IACxD,CAAC;IAED,SAAS,6BAA6B,CAAC,OAAgB;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAA;QACxD,OAAO,2BAA2B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAClD,CAAC;IAED,SAAS,yBAAyB,CAAC,CAAuB;QACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0DAA0D,EAAE,EAAE,GAAG,CAAC,CAAA;IAC3F,CAAC;IAED,SAAS,8BAA8B,CAAC,CAAuB;QAC7D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,EAAE,GAAG,CAAC,CAAA;IACjF,CAAC;IAED,SAAS,YAAY,CAAC,GAAW;QAC/B,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACtC,CAAC;IAED,SAAS,SAAS,CAAC,GAAQ;QACzB,MAAM,UAAU,GAAG;YACjB,GAAG,CAAC,OAAO;YACX,GAAG,CAAC,aAAa;YACjB,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACjC,eAAe;SAChB,CAAA;QAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjE,OAAO,YAAY,CAAC,SAAS,CAAC,CAAA;YAChC,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,SAAS,iBAAiB,CAAC,GAAQ;QACjC,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CACL,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;aACvE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;aAC7B,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACtD,CACF,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACrB,CAAC;IAED,SAAS,cAAc,CAAC,GAAQ;QAC9B,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;YAC9B,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,CAAA;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IAED,SAAS,mBAAmB,CAAC,GAAQ;QACnC,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAA;QAC5F,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;QAE1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;YAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACtD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAA;gBACxB,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,SAAS,uBAAuB,CAAC,GAAQ;QACvC,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAA;QAC3D,MAAM,iBAAiB,GAAG,GAAG,CAAC,iCAAiC,EAAE,IAAI,EAAE,CAAA;QACvE,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAA;QAEpD,OAAO;YACL,iBAAiB;YACjB,YAAY;YACZ,gBAAgB,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,sBAAsB;YACnE,YAAY,EAAE,GAAG,CAAC,qBAAqB;YACvC,KAAK,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,SAAS;YACnD,WAAW,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,SAAS;SAC/D,CAAA;IACH,CAAC;IAED,SAAS,0BAA0B,CAAC,GAAQ;QAC1C,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAA;QAC3D,MAAM,WAAW,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAA;QACpE,MAAM,gBAAgB,GAAG,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE,CAAA;QACrE,MAAM,WAAW,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAA;QACpE,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,IAAI,CAAC,gBAAgB,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAA;QAEnF,OAAO;YACL,WAAW;YACX,YAAY;YACZ,WAAW;YACX,gBAAgB;YAChB,iBAAiB,EAAE,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE,IAAI,YAAY;SAChF,CAAA;IACH,CAAC;IAED,SAAS,4BAA4B,CAAC,GAAQ;QAC5C,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAA;QAC3D,MAAM,aAAa,GAAG,GAAG,CAAC,sCAAsC,EAAE,IAAI,EAAE,CAAA;QACxE,MAAM,WAAW,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAA;QACpE,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAA;QAEhE,OAAO;YACL,aAAa;YACb,YAAY;YACZ,WAAW;SACZ,CAAA;IACH,CAAC;IAED,SAAS,cAAc,CAAC,OAAgB;QACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;QAC9C,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,CAAA;IAC7D,CAAC;IAED,SAAS,oCAAoC,CAAC,GAAQ,EAAE,OAAgB;QACtE,OAAO,GAAG,CAAC,gCAAgC,KAAK,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAA;IAChF,CAAC;IAED,SAAS,sBAAsB,CAAC,GAAQ;QACtC,OAAO,GAAG,CAAC,gCAAgC,KAAK,GAAG,CAAA;IACrD,CAAC;IAgBD,SAAS,eAAe,CAAC,GAAQ,EAAE,EAAY,EAAE,UAAkC,EAAE;QACnF,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,EAAE,CAAC,GAAG,CAAC,CAAA;QAC5D,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC7F,MAAM,MAAM,GAAG,EAA+D,CAAA;QAC9E,MAAM,WAAW,GAAG,EAAkE,CAAA;QAEtF,OAAO,gBAAgB,CAAC;YACtB,4DAA4D;YAC5D,+DAA+D;YAC/D,4DAA4D;YAC5D,gEAAgE;YAChE,+DAA+D;YAC/D,iDAAiD;YACjD,EAAE,EAAE,MAAM;YACV,MAAM,EAAE,GAAG,CAAC,kBAAkB;YAC9B,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;YAC5B,QAAQ,EAAE,OAAO;YACjB,cAAc,EAAE,iBAAiB,CAAC,GAAG,CAAC;YACtC,QAAQ,EAAE,CAAC,cAAc,CAAC,cAAc,IAAI,oCAAoC,CAAC,CAAC,GAAG,CAAC;YACtF,sBAAsB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YACzE,OAAO,EAAE,iBAAiB;gBACxB,CAAC,CAAC;oBACE,gCAAgC,CAAC;wBAC/B,EAAE,EAAE,WAAW;wBACf,YAAY,EAAE,GAAG,CAAC,qBAAqB;wBACvC,QAAQ,EAAE,iBAAiB;qBAC5B,CAAC;iBACH;gBACH,CAAC,CAAC,SAAS;YACb,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBACzC,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,wEAAwE;oBACxE,iEAAiE;oBACjE,mEAAmE;oBACnE,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;wBAChC,OAAO,CAAC,IAAI,CAAC,6CAA6C,IAAI,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC,CAAA;wBAC/E,OAAM;oBACR,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;gBACpE,CAAC;gBACD,MAAM,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;YACpD,CAAC;YACD,mBAAmB,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;gBAClD,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,wEAAwE;oBACxE,gEAAgE;oBAChE,mEAAmE;oBACnE,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;wBAChC,OAAO,CAAC,IAAI,CAAC,6CAA6C,IAAI,QAAQ,KAAK,KAAK,GAAG,EAAE,CAAC,CAAA;wBACtF,OAAM;oBACR,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;gBACtE,CAAC;gBACD,MAAM,WAAW,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7D,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED,SAAS,0BAA0B,CAAC,OAAgB;QAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAA;QAC9D,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,MAAM,kBAAkB,GAAG,CAAC,GAAG,CAAC,CAAA;IAEhC,SAAS,qBAAqB,CAAC,IAA+B;QAC5D,MAAM,IAAI,GAAG,0BAA0B,CAAC,IAAI,EAAE,cAAc,CAAC,aAAa,CAAC,CAAA;QAC3E,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,MAAM,cAAc,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACxD,MAAM,QAAQ,GACZ,cAAc,KAAK,QAAQ;YACzB,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,cAAc,KAAK,OAAO;gBAC1B,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,cAAc,CAAA;QACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CACxD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,EAAE,KAAK,QAAQ,CAC9D,CAAA;QACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACpE,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,UAAU,mBAAmB,CAAC,EAAY,EAAE,GAAQ,EAAE,MAAc;QACvE,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;iBACpB,MAAM,CAAC,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC;iBACpF,IAAI,CAAC,kBAAkB,CAAC;iBACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;iBAC5C,KAAK,CAAC,CAAC,CAAC,CAAA;YACX,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAA;YAC7E,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,gBAAgB,CAAA;YAC5E,OAAO,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,UAAU,CAAC,CAAA;QACrF,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,WAAW,EAAE,CAAC;aACtD,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aACvC,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,OAAO,OAAO,EAAE,WAAW,IAAI,kBAAkB,CAAA;IACnD,CAAC;IAED,KAAK,UAAU,kBAAkB,CAC/B,OAAgB,EAChB,GAAQ;QAER,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;YAEvE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAA;YACb,CAAC;YAED,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAA;gBAC1D,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,qCAAqC,CAAC;wBAC/D,EAAE,EAAE,EAAuE;wBAC3E,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;wBAC7B,MAAM,EAAE,gBAAgB;qBACzB,CAAC,CAAA;oBAEF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;wBACrB,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAA;oBACjE,OAAO,IAAI,CAAA;gBACb,CAAC;YACH,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;gBAC7B,cAAc,EAAE,IAAI;gBACpB,UAAU,EAAE,SAAS;gBACrB,KAAK,EAAE,OAAO;gBACd,yEAAyE;gBACzE,uEAAuE;gBACvE,gEAAgE;gBAChE,sEAAsE;gBACtE,MAAM,EAAE,MAAM,mBAAmB,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3D,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;aAClC,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,gEAAgE;YAChE,kEAAkE;YAClE,0BAA0B;YAC1B,MAAM,OAAO,EAAE,CAAA;QACjB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,GAAQ;QACzD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACnD,OAAO,IAAI,KAAK,IAAI,CAAA;IACtB,CAAC;IAED,MAAM,wBAAyB,SAAQ,KAAK;QAC1C;YACE,KAAK,CAAC,gBAAgB,CAAC,CAAA;YACvB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;QACxC,CAAC;KACF;IAED,KAAK,UAAU,wBAAwB,CACrC,OAAgB,EAChB,GAAQ;QAER,IAAI,oCAAoC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC3C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;YAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC;gBACN,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS,EAAE,iBAAiB,CAAC,SAAS;gBACtC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;gBACpC,MAAM,EAAE,iBAAiB,CAAC,MAAM;gBAChC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;gBACpC,OAAO,EAAE,iBAAiB,CAAC,OAAO;gBAClC,SAAS,EAAE,iBAAiB,CAAC,SAAS;gBACtC,YAAY,EAAE,iBAAiB,CAAC,YAAY;gBAC5C,aAAa,EAAE,iBAAiB,CAAC,aAAa;aAC/C,CAAC;iBACD,IAAI,CAAC,QAAQ,CAAC;iBACd,QAAQ,CAAC,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;iBAClE,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;iBACvC,KAAK,CAAC,CAAC,CAAC,CAAA;YAEX,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,wBAAwB,EAAE,CAAA;YACtC,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAC5C,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;gBAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;gBAC9B,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;gBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;gBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;gBAC5B,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,KAAK;gBACvC,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,KAAK;gBACzC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnE,iBAAiB,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;aACzC,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,EAAE,CAAA;QACjB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,4BAA4B,CACzC,OAAgB,EAChB,GAAQ;QAER,IAAI,oCAAoC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC3B,CAAC;QAED,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAA;QACrD,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACnF,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;QAC/D,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,EAAE,CAAA;QACjB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,sBAAsB,CACnC,GAAQ,EACR,EAAY,EACZ,MAAoB;QAEpB,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAE5C,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAA;QAC1D,IAAI,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAA;QAEnC,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,kCAAkC,CAAC;gBAC5D,EAAE,EAAE,EAAoE;gBACxE,MAAM,EAAE,MAAM,CAAC,WAAW;gBAC1B,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAA;YACF,OAAO,YAAY,CAAC,EAAE,CAAA;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAA;YACnE,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAA;YACpE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;YAC/C,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;gBAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;YACjD,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;;OAKG;IACH,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,mEAAmE;QACnE,oCAAoC;QACpC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC7C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAA;YAC5D,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;YAE9B,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,EAAoD,EACpD,MAAM,CACP,CAAA;YACD,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC/C,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;gBACpD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YAC5B,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvB,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;OAIG;IACH,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,KAAK,UAAU,qBAAqB,CAAC,CAAuB;QAC1D,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC7C,MAAM,WAAW,GAAG,EAAuE,CAAA;YAE3F,IAAI,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,kEAAkE,EAAE,EAC7E,GAAG,CACJ,CAAA;gBACH,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,qCAAqC,CAAC;wBAC/D,EAAE,EAAE,WAAW;wBACf,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;wBAC7B,MAAM,EAAE,gBAAgB;qBACzB,CAAC,CAAA;oBAEF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;wBACrB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAA;oBAC9D,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAA;oBACpE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC/E,CAAC;YACH,CAAC;YAED,OAAO,CACL,CAAC,MAAM,+BAA+B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE;gBAC5D,EAAE;gBACF,aAAa,EAAE,cAAc,CAAC,aAAa;aAC5C,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAC3C,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED,KAAK,UAAU,+BAA+B,CAAC,CAAuB;QACpE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC7C,MAAM,WAAW,GAAG,EAAuE,CAAA;YAE3F,IAAI,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,wEAAwE,EAAE,EACnF,GAAG,CACJ,CAAA;gBACH,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,qCAAqC,CAAC;wBAC/D,EAAE,EAAE,WAAW;wBACf,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;wBAC7B,MAAM,EAAE,gBAAgB;qBACzB,CAAC,CAAA;oBAEF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;wBACrB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAA;oBAC9D,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,wDAAwD,EAAE,KAAK,CAAC,CAAA;oBAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC/E,CAAC;YACH,CAAC;YAED,MAAM,qBAAqB,GAAG,EAEpB,CAAA;YACV,OAAO,CACL,CAAC,MAAM,gCAAgC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE;gBAC7D,EAAE,EAAE,qBAAqB;aAC1B,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAC3C,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,8BAA8B,CAAC,CAAC,CAAC,CAAA;QAC1C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC;gBAC5C,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG;gBACrB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;gBACzB,MAAM;aACP,CAAC,CAAA;YACF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,QAAQ,EAAE,KAAK,CAAC,WAAW;oBAC3B,YAAY,EAAE,KAAK,CAAC,SAAS;iBAC9B;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAA;YACjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5C,CAAC;QAED,MAAM,cAAc,GAAG,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACxD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kDAAkD,EAAE,EAAE,GAAG,EAAE;gBAChF,YAAY,EAAE,mCAAmC,CAC/C,GAAG,CAAC,QAAQ,KAAK,QAAQ,EACzB,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,aAAa,CACzD;aACF,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC7C,OAAO,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAA;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,GAAG,CAAC,CAAA;QACpE,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAA;IACnD,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,CAAA;IAC1D,IAAI,CAAC,GAAG,CAAC,gCAAgC,EAAE,qBAAqB,CAAC,CAAA;IACjE,IAAI,CAAC,GAAG,CAAC,iCAAiC,EAAE,+BAA+B,CAAC,CAAA;IAE5E,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;YACvE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACpD,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,IACE,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC;YAC5B,CAAC,6BAA6B,CAAC,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EACrE,CAAC;YACD,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAA;QACrC,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;YACvE,OAAO,MAAM,UAAU,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QACxE,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;;;OAMG;IACH,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,IAAI,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9E,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAA;QACrC,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC7C,OAAO,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5C,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,4BAA4B;QAC5B,wBAAwB;QACxB,iBAAiB;QACjB,kBAAkB;QAClB,sBAAsB;KACvB,CAAA;AACH,CAAC","sourcesContent":["/*\n Better Auth Node runtime for Hono.\n \n agent-quality: file-size exception -- Auth handler keeps local and Voyant Cloud auth flows co-located until the route surface is split by auth mode.\n \n Mounts Better Auth at /auth/* for authentication operations.\n * Same-origin — no CORS needed. Session cookies work naturally.\n \n Also provides /auth/status (user provisioning) and /auth/me (user info).\n /\n\nimport { type NodeDatabaseEnv, openNodeDatabase } from \"@voyant-travel/db/runtime\"\nimport {\n authUser,\n cloudAuthUserLinks,\n type SelectApikey,\n userProfilesTable,\n} from \"@voyant-travel/db/schema/iam\"\nimport type { Reporter, VoyantDb, VoyantRequestAuthContext } from \"@voyant-travel/hono\"\nimport {\n handleApiError,\n reportException,\n requestId,\n} from \"@voyant-travel/hono/middleware/error-boundary\"\nimport { getRequestId } from \"@voyant-travel/hono/observability\"\nimport type { AccessCatalog } from \"@voyant-travel/types/api-keys\"\nimport { accessCatalogScopesForRole, isFullAccessRole } from \"@voyant-travel/types/member-roles\"\nimport { eq, sql } from \"drizzle-orm\"\nimport { type Context, Hono } from \"hono\"\nimport {\n createVoyantCloudAdminAuthPlugin,\n revalidateVoyantCloudAdminAuthSession,\n revalidateVoyantCloudAdminAuthUser,\n} from \"./cloud-admin-session.js\"\nimport { buildClearCloudAdminAuthStateCookie, createCloudAdminAuthStart } from \"./cloud-broker.js\"\nimport {\n type CreateBetterAuthOptions,\n createBetterAuth,\n handleApiTokenManagementRequest,\n handleOrganizationMembersRequest,\n} from \"./server.js\"\nimport { ensureCurrentUserProfile } from \"./workspace.js\"\n\n// Type ctx so that `c.get(\"db\")` resolves to the parent app's middleware-\n// set `VoyantDb` from the deployment's database lifecycle adapter. Without\n// this, the sub-app sees `unknown` for context vars.\ntype OperatorAuthMode = \"local\" \| \"voyant-cloud\"\n\nexport interface OperatorAuthNodeEnv extends NodeDatabaseEnv {\n API_BASE_URL?: string\n APP_URL?: string\n AUTH_COOKIE_DOMAIN?: string\n BETTER_AUTH_SECRET: string\n CORS_ALLOWLIST?: string\n DASH_BASE_URL?: string\n EMAIL_FROM?: string\n SESSION_CLAIMS_SECRET: string\n VOYANT_ADMIN_AUTH_MODE?: string\n VOYANT_AUTH_LOG_SECRET_FALLBACKS?: string\n VOYANT_CLOUD_ADMIN_AUTH_AUDIENCE?: string\n VOYANT_CLOUD_ADMIN_AUTH_CLIENT_TOKEN?: string\n VOYANT_CLOUD_ADMIN_AUTH_EXCHANGE_URL?: string\n VOYANT_CLOUD_ADMIN_AUTH_JWKS_URL?: string\n VOYANT_CLOUD_ADMIN_AUTH_REVALIDATE_URL?: string\n VOYANT_CLOUD_ADMIN_AUTH_START_URL?: string\n VOYANT_CLOUD_APP_ID?: string\n VOYANT_CLOUD_DEPLOYMENT_ID?: string\n VOYANT_CLOUD_ENVIRONMENT?: string\n VOYANT_OPERATOR_BROWSER_EVIDENCE?: string\n}\n\nexport interface OperatorCurrentUser {\n id: string\n email: string\n firstName: string \| null\n lastName: string \| null\n locale: string\n timezone: string \| null\n uiPrefs: unknown\n isSuperAdmin: boolean\n isSupportUser: boolean\n createdAt: string\n profilePictureUrl: string \| null\n}\n\nexport type OperatorAuthBootstrapStatus = {\n hasUsers: boolean\n authMode?: OperatorAuthMode\n}\n\ntype BetterAuthAdvancedOptions = NonNullable<CreateBetterAuthOptions[\"advanced\"]>\n\n/* Resolve Better Auth's standard cross-subdomain cookie policy for Node hosts. /\nexport function buildBetterAuthCookieAdvancedOptions(\n env: Pick<OperatorAuthNodeEnv, \"AUTH_COOKIE_DOMAIN\">,\n):\n \| Pick<BetterAuthAdvancedOptions, \"crossSubDomainCookies\" \| \"defaultCookieAttributes\">\n \| undefined {\n const domain = env.AUTH_COOKIE_DOMAIN?.trim()\n if (!domain) return undefined\n\n return {\n crossSubDomainCookies: { enabled: true, domain },\n defaultCookieAttributes: { domain },\n }\n}\n\nexport interface OperatorAuthEmailSender {\n sendResetPassword: (input: {\n user: { email: string; name: string }\n url: string\n }) => Promise<void>\n sendVerificationOtp: (input: { email: string; otp: string; type: string }) => Promise<void>\n}\n\nexport interface CreateOperatorAuthNodeRuntimeOptions<Env extends OperatorAuthNodeEnv> {\n accessCatalog: AccessCatalog\n appName: string\n authMode: OperatorAuthMode\n reporter: Reporter\n openDatabase?: (env: Env) => { db: VoyantDb; dispose: () => Promise<void> }\n cookieAdvanced?: (\n env: Env,\n ) =>\n \| Pick<BetterAuthAdvancedOptions, \"crossSubDomainCookies\" \| \"defaultCookieAttributes\">\n \| undefined\n resolveEmailSender?: (env: Env) => OperatorAuthEmailSender \| null\n}\n\nexport function createOperatorAuthNodeRuntime<Env extends OperatorAuthNodeEnv>(\n runtimeOptions: CreateOperatorAuthNodeRuntimeOptions<Env>,\n) {\n type AuthHonoEnv = { Bindings: Env; Variables: { db: VoyantDb } }\n\n const openDatabase =\n runtimeOptions.openDatabase ??\n ((env: Env) => {\n const resource = openNodeDatabase(env)\n return { db: resource.db as VoyantDb, dispose: resource.dispose }\n })\n\n const auth = new Hono<AuthHonoEnv>()\n // This lean auth app is dispatched around `createVoyantApp` (see\n // api-dispatch.ts), so it must mint/propagate the correlation id and wire\n // the reporter itself — otherwise auth 5xx are an observability blind spot and\n // the user-facing requestId wouldn't be findable (RFC voyant#1553).\n auth.use(\"\", requestId)\n // `onError` only fires on THROWN exceptions. Several handlers (e.g.\n // /auth/status, the cloud token/revalidate/callback paths) instead RETURN a\n // 5xx via `c.json(..., 50x)`; those bypass `onError`, and this lean app is\n // dispatched around `createVoyantApp` so the framework's auth status-bridge\n // (`mountAuthForwarding`) never runs either. Bridge returned 5xx to the\n // reporter here so they aren't an observability blind spot (RFC voyant#1553).\n // Thrown errors skip this middleware's post-`next()` code (the rejection\n // propagates straight to `onError`), so there's no double report.\n auth.use(\"\", async (c, next) => {\n await next()\n if (c.res.status >= 500) {\n reportException(runtimeOptions.reporter, c, {\n requestId: getRequestId() ?? \"\",\n app: runtimeOptions.appName,\n error: new Error(`auth handler returned HTTP ${c.res.status}`),\n context: { path: c.req.path, method: c.req.method, status: c.res.status, surface: \"auth\" },\n })\n }\n })\n auth.onError((err, c) =>\n handleApiError(err, c, { reporter: runtimeOptions.reporter, appName: runtimeOptions.appName }),\n )\n\n const DEFAULT_APP_URL = \"http://localhost:3300\"\n const CLOUD_BETTER_AUTH_ALLOWLIST = new Set([\n \"/auth/get-session\",\n \"/auth/jwks\",\n \"/auth/session\",\n \"/auth/sign-out\",\n \"/auth/token\",\n ])\n\n function resolveOperatorAuthMode(_env: Env): OperatorAuthMode {\n return runtimeOptions.authMode\n }\n\n function isVoyantCloudAuthMode(env: Env): boolean {\n return resolveOperatorAuthMode(env) === \"voyant-cloud\"\n }\n\n function isCloudAllowedBetterAuthRoute(request: Request): boolean {\n const url = new URL(request.url)\n const pathname = url.pathname.replace(/\\/+$/, \"\") \|\| \"/\"\n return CLOUD_BETTER_AUTH_ALLOWLIST.has(pathname)\n }\n\n function localAuthDisabledResponse(c: Context<AuthHonoEnv>) {\n return c.json({ error: \"Local auth routes are disabled in Voyant Cloud auth mode\" }, 404)\n }\n\n function cloudAuthNotConfiguredResponse(c: Context<AuthHonoEnv>) {\n return c.json({ error: \"Voyant Cloud auth broker is not configured yet\" }, 501)\n }\n\n function normalizeUrl(url: string): string {\n return url.trim().replace(/\\/$/, \"\")\n }\n\n function getAppUrl(env: Env): string {\n const candidates = [\n env.APP_URL,\n env.DASH_BASE_URL,\n env.CORS_ALLOWLIST?.split(\",\")[0],\n DEFAULT_APP_URL,\n ]\n\n for (const candidate of candidates) {\n if (typeof candidate === \"string\" && candidate.trim().length > 0) {\n return normalizeUrl(candidate)\n }\n }\n\n return DEFAULT_APP_URL\n }\n\n function getTrustedOrigins(env: Env): string[] {\n return Array.from(\n new Set(\n [env.APP_URL, env.DASH_BASE_URL, ...(env.CORS_ALLOWLIST ?? \"\").split(\",\")]\n .map((value) => value?.trim())\n .filter((value): value is string => Boolean(value)),\n ),\n ).map(normalizeUrl)\n }\n\n function getAuthBaseUrl(env: Env): string {\n // entry.ts strips /api before delegating to the Hono app, so Better Auth\n // sees paths like /auth/. Its baseURL must be the origin only (no /api).\n const appUrl = getAppUrl(env)\n try {\n const parsed = new URL(appUrl)\n return `${parsed.protocol}//${parsed.host}`\n } catch {\n return appUrl\n }\n }\n\n function getPublicApiBaseUrl(env: Env): string {\n const candidate = env.API_BASE_URL?.trim() \|\| env.APP_URL?.trim() \|\| `${getAppUrl(env)}/api`\n const normalized = normalizeUrl(candidate)\n\n try {\n const parsed = new URL(normalized)\n if (parsed.pathname === \"/\" \|\| parsed.pathname === \"\") {\n parsed.pathname = \"/api\"\n return normalizeUrl(parsed.toString())\n }\n } catch {\n return normalized\n }\n\n return normalized\n }\n\n function getCloudAuthStartConfig(env: Env) {\n const deploymentId = env.VOYANT_CLOUD_DEPLOYMENT_ID?.trim()\n const cloudAuthStartUrl = env.VOYANT_CLOUD_ADMIN_AUTH_START_URL?.trim()\n if (!deploymentId \|\| !cloudAuthStartUrl) return null\n\n return {\n cloudAuthStartUrl,\n deploymentId,\n adminCallbackUrl: `${getPublicApiBaseUrl(env)}/auth/cloud/callback`,\n cookieSecret: env.SESSION_CLAIMS_SECRET,\n appId: env.VOYANT_CLOUD_APP_ID?.trim() \|\| undefined,\n environment: env.VOYANT_CLOUD_ENVIRONMENT?.trim() \|\| undefined,\n }\n }\n\n function getCloudAuthExchangeConfig(env: Env) {\n const deploymentId = env.VOYANT_CLOUD_DEPLOYMENT_ID?.trim()\n const exchangeUrl = env.VOYANT_CLOUD_ADMIN_AUTH_EXCHANGE_URL?.trim()\n const assertionJwksUrl = env.VOYANT_CLOUD_ADMIN_AUTH_JWKS_URL?.trim()\n const clientToken = env.VOYANT_CLOUD_ADMIN_AUTH_CLIENT_TOKEN?.trim()\n if (!deploymentId \|\| !exchangeUrl \|\| !assertionJwksUrl \|\| !clientToken) return null\n\n return {\n exchangeUrl,\n deploymentId,\n clientToken,\n assertionJwksUrl,\n assertionAudience: env.VOYANT_CLOUD_ADMIN_AUTH_AUDIENCE?.trim() \|\| deploymentId,\n }\n }\n\n function getCloudAuthRevalidateConfig(env: Env) {\n const deploymentId = env.VOYANT_CLOUD_DEPLOYMENT_ID?.trim()\n const revalidateUrl = env.VOYANT_CLOUD_ADMIN_AUTH_REVALIDATE_URL?.trim()\n const clientToken = env.VOYANT_CLOUD_ADMIN_AUTH_CLIENT_TOKEN?.trim()\n if (!deploymentId \|\| !revalidateUrl \|\| !clientToken) return null\n\n return {\n revalidateUrl,\n deploymentId,\n clientToken,\n }\n }\n\n function isLocalRequest(request: Request): boolean {\n const hostname = new URL(request.url).hostname\n return hostname === \"127.0.0.1\" \|\| hostname === \"localhost\"\n }\n\n function shouldUseBrowserEvidenceAuthFallback(env: Env, request: Request): boolean {\n return env.VOYANT_OPERATOR_BROWSER_EVIDENCE === \"1\" && isLocalRequest(request)\n }\n\n function allowAuthSecretLogging(env: Env): boolean {\n return env.VOYANT_AUTH_LOG_SECRET_FALLBACKS === \"1\"\n }\n\n /*\n Build a Better Auth instance backed by a caller-provided drizzle\n * client. The caller owns the Pool lifecycle (open before, dispose\n * after) so the same Pool can serve both the auth lookup and any\n * subsequent queries the route does — without spinning up a second\n * connection per request.\n \n The deployment decides whether this is a request-scoped or resident Node\n * pool. The Better Auth instance is not cached independently of that owner.\n /\n interface BuildBetterAuthOptions {\n customerSignup?: boolean\n }\n\n function buildBetterAuth(env: Env, db: VoyantDb, options: BuildBetterAuthOptions = {}) {\n const emailSender = runtimeOptions.resolveEmailSender?.(env)\n const cloudAuthExchange = isVoyantCloudAuthMode(env) ? getCloudAuthExchangeConfig(env) : null\n const authDb = db as NonNullable<Parameters<typeof createBetterAuth>[0]>[\"db\"]\n const cloudAuthDb = db as Parameters<typeof createVoyantCloudAdminAuthPlugin>[0][\"db\"]\n\n return createBetterAuth({\n // `db` is a `NeonDatabase` (neon-serverless WebSocket); the\n // `CreateBetterAuthOptions.db` type still references the older\n // `getDb` return union (postgres-js + neon-http). Drizzle's\n // PgDatabase surface is identical across flavors at runtime, so\n // the cast is structurally safe — better-auth's drizzleAdapter\n // works on any PgDatabase. See #500 for context.\n db: authDb,\n secret: env.BETTER_AUTH_SECRET,\n baseURL: getAuthBaseUrl(env),\n basePath: \"/auth\",\n trustedOrigins: getTrustedOrigins(env),\n advanced: (runtimeOptions.cookieAdvanced ?? buildBetterAuthCookieAdvancedOptions)(env),\n customerSignupSurfaces: options.customerSignup ? [\"customer\"] : undefined,\n plugins: cloudAuthExchange\n ? [\n createVoyantCloudAdminAuthPlugin({\n db: cloudAuthDb,\n cookieSecret: env.SESSION_CLAIMS_SECRET,\n exchange: cloudAuthExchange,\n }),\n ]\n : undefined,\n sendResetPassword: async ({ user, url }) => {\n if (!emailSender) {\n // No email provider (e.g. local dev without a sending domain): with the\n // debug flag on, log the link to the console instead of sending;\n // otherwise fail loudly. Never bypasses a configured cloud sender.\n if (allowAuthSecretLogging(env)) {\n console.info(`[auth] reset-password (debug fallback) -> ${user.email}: ${url}`)\n return\n }\n throw new Error(\"Password reset email provider is not configured\")\n }\n await emailSender.sendResetPassword({ user, url })\n },\n sendVerificationOTP: async ({ email, otp, type }) => {\n if (!emailSender) {\n // No email provider (e.g. local dev without a sending domain): with the\n // debug flag on, log the OTP to the console instead of sending;\n // otherwise fail loudly. Never bypasses a configured cloud sender.\n if (allowAuthSecretLogging(env)) {\n console.info(`[auth] verification-otp (debug fallback) [${type}] -> ${email}: ${otp}`)\n return\n }\n throw new Error(\"Verification OTP email provider is not configured\")\n }\n await emailSender.sendVerificationOtp({ email, otp, type })\n },\n })\n }\n\n function rewriteCustomerAuthRequest(request: Request): Request {\n const url = new URL(request.url)\n url.pathname = url.pathname.replace(\"/auth/customer\", \"/auth\")\n return new Request(url, request)\n }\n\n const FULL_ACCESS_SCOPES = [\"\"]\n\n function scopesForOperatorRole(role: string \| null \| undefined): string[] \| null {\n const base = accessCatalogScopesForRole(role, runtimeOptions.accessCatalog)\n if (!base) return null\n const normalizedRole = (role ?? \"\").trim().toLowerCase()\n const presetId =\n normalizedRole === \"member\"\n ? \"editor\"\n : normalizedRole === \"guest\"\n ? \"viewer\"\n : normalizedRole\n const selected = runtimeOptions.accessCatalog.presets.find(\n (preset) => preset.kind === \"staff\" && preset.id === presetId,\n )\n return [...new Set([...base, ...(selected?.grants ?? [])])].sort()\n }\n\n /*\n Resolve a member's RBAC scope set for the request (`resource:action` strings,\n * shared with API keys — see @voyant-travel/types/member-roles, RFC voyant#2085).\n \n Phase 1: storage + seam are wired but default to full access, so behavior is\n * unchanged until an admin assigns permissions (Phase 2) and routes gate on them\n * (Phase 3).\n * - voyant-cloud: assertion-mirrored `cloud_auth_user_links.scopes` if the\n * platform sent them, else the role bundle for `roleSlug`, else full access.\n * - local: the member's `user_profiles.permissions` if assigned, else full\n * access (no local role concept yet).\n /\n async function resolveMemberScopes(db: VoyantDb, env: Env, userId: string): Promise<string[]> {\n if (isVoyantCloudAuthMode(env)) {\n const [link] = await db\n .select({ scopes: cloudAuthUserLinks.scopes, roleSlug: cloudAuthUserLinks.roleSlug })\n .from(cloudAuthUserLinks)\n .where(eq(cloudAuthUserLinks.userId, userId))\n .limit(1)\n const fullAccessScopes = scopesForOperatorRole(\"admin\") ?? FULL_ACCESS_SCOPES\n const roleScopes = scopesForOperatorRole(link?.roleSlug) ?? fullAccessScopes\n return isFullAccessRole(link?.roleSlug) ? roleScopes : (link?.scopes ?? roleScopes)\n }\n\n const [profile] = await db\n .select({ permissions: userProfilesTable.permissions })\n .from(userProfilesTable)\n .where(eq(userProfilesTable.id, userId))\n .limit(1)\n return profile?.permissions ?? FULL_ACCESS_SCOPES\n }\n\n async function resolveAuthRequest(\n request: Request,\n env: Env,\n ): Promise<VoyantRequestAuthContext \| null> {\n const { db, dispose } = openDatabase(env)\n try {\n const auth = buildBetterAuth(env, db)\n const session = await auth.api.getSession({ headers: request.headers })\n\n if (!session) {\n return null\n }\n\n if (isVoyantCloudAuthMode(env)) {\n const revalidateConfig = getCloudAuthRevalidateConfig(env)\n if (!revalidateConfig) {\n return null\n }\n\n try {\n const revalidation = await revalidateVoyantCloudAdminAuthSession({\n db: db as Parameters<typeof revalidateVoyantCloudAdminAuthSession>[0][\"db\"],\n sessionId: session.session.id,\n config: revalidateConfig,\n })\n\n if (!revalidation.ok) {\n return null\n }\n } catch (error) {\n console.error(\"[auth/session] Cloud revalidation failed:\", error)\n return null\n }\n }\n\n return {\n userId: session.user.id,\n sessionId: session.session.id,\n organizationId: null,\n callerType: \"session\",\n actor: \"staff\",\n // Member RBAC scope set (RFC voyant#2085). Defaults to full access until\n // an admin assigns permissions, so existing deployments are unchanged.\n // `actor: \"staff\"` is retained, so actor-gated paths (incl. the\n // bookings-pii reveal, which short-circuits on staff) are unaffected.\n scopes: await resolveMemberScopes(db, env, session.user.id),\n email: session.user.email ?? null,\n }\n } finally {\n // No `executionCtx` reachable here (called from middleware that\n // doesn't pass one through). Await inline so the WebSocket closes\n // before this fn returns.\n await dispose()\n }\n }\n\n /\n Single-tenant: every authenticated session is a staff user with full access.\n * When `resolveAuthRequest` has already granted a session, permissions are\n * implicitly allowed. If you need granular RBAC later, switch on\n * `user_profiles.isSuperAdmin` / `isSupportUser` here.\n /\n async function hasAuthPermission(request: Request, env: Env): Promise<boolean> {\n const auth = await resolveAuthRequest(request, env)\n return auth !== null\n }\n\n class CurrentUserNotFoundError extends Error {\n constructor() {\n super(\"User not found\")\n this.name = \"CurrentUserNotFoundError\"\n }\n }\n\n async function getCurrentUserForRequest(\n request: Request,\n env: Env,\n ): Promise<OperatorCurrentUser \| null> {\n if (shouldUseBrowserEvidenceAuthFallback(env, request)) {\n return null\n }\n\n const { db, dispose } = openDatabase(env)\n try {\n const betterAuth = buildBetterAuth(env, db)\n const session = await betterAuth.api.getSession({ headers: request.headers })\n if (!session) {\n return null\n }\n\n const [row] = await db\n .select({\n id: authUser.id,\n email: authUser.email,\n createdAt: authUser.createdAt,\n firstName: userProfilesTable.firstName,\n lastName: userProfilesTable.lastName,\n locale: userProfilesTable.locale,\n timezone: userProfilesTable.timezone,\n uiPrefs: userProfilesTable.uiPrefs,\n avatarUrl: userProfilesTable.avatarUrl,\n isSuperAdmin: userProfilesTable.isSuperAdmin,\n isSupportUser: userProfilesTable.isSupportUser,\n })\n .from(authUser)\n .leftJoin(userProfilesTable, eq(userProfilesTable.id, authUser.id))\n .where(eq(authUser.id, session.user.id))\n .limit(1)\n\n if (!row) {\n throw new CurrentUserNotFoundError()\n }\n\n return {\n id: row.id,\n email: row.email ?? session.user.email ?? \"\",\n firstName: row.firstName ?? null,\n lastName: row.lastName ?? null,\n locale: row.locale ?? \"en\",\n timezone: row.timezone ?? null,\n uiPrefs: row.uiPrefs ?? null,\n isSuperAdmin: row.isSuperAdmin ?? false,\n isSupportUser: row.isSupportUser ?? false,\n createdAt: row.createdAt?.toISOString() ?? new Date().toISOString(),\n profilePictureUrl: row.avatarUrl ?? null,\n }\n } finally {\n await dispose()\n }\n }\n\n async function getBootstrapStatusForRequest(\n request: Request,\n env: Env,\n ): Promise<OperatorAuthBootstrapStatus> {\n if (shouldUseBrowserEvidenceAuthFallback(env, request)) {\n return { hasUsers: true }\n }\n\n if (isVoyantCloudAuthMode(env)) {\n return { hasUsers: true, authMode: \"voyant-cloud\" }\n }\n\n const { db, dispose } = openDatabase(env)\n try {\n const [row] = await db.select({ count: sql<number>`count()::int` }).from(authUser)\n return { hasUsers: (row?.count ?? 0) > 0, authMode: \"local\" }\n } finally {\n await dispose()\n }\n }\n\n async function validateApiTokenAccess(\n env: Env,\n db: VoyantDb,\n apiKey: SelectApikey,\n ): Promise<boolean> {\n if (!isVoyantCloudAuthMode(env)) return true\n\n const revalidateConfig = getCloudAuthRevalidateConfig(env)\n if (!revalidateConfig) return false\n\n try {\n const revalidation = await revalidateVoyantCloudAdminAuthUser({\n db: db as Parameters<typeof revalidateVoyantCloudAdminAuthUser>[0][\"db\"],\n userId: apiKey.referenceId,\n config: revalidateConfig,\n })\n return revalidation.ok\n } catch (error) {\n console.error(\"[auth/api-token] Cloud revalidation failed:\", error)\n return false\n }\n }\n\n /*\n GET /auth/me\n * Returns the current authenticated user's profile.\n * Validates the session cookie directly (no Bearer token needed).\n /\n auth.get(\"/auth/me\", async (c) => {\n try {\n const currentUser = await getCurrentUserForRequest(c.req.raw, c.env)\n if (!currentUser) {\n return c.json({ error: \"Unauthorized\" }, 401)\n }\n return c.json(currentUser)\n } catch (error) {\n if (error instanceof CurrentUserNotFoundError) {\n return c.json({ error: \"User not found\" }, 404)\n }\n throw error\n }\n })\n\n /\n GET /auth/status\n * Ensures the authenticated user has a user_profiles row.\n * Profile is normally created by the BA databaseHook on sign-up,\n * but this route serves as an idempotent fallback.\n /\n auth.get(\"/auth/status\", async (c) => {\n // See `/auth/me` above — auth sub-app runs before the request `db`\n // middleware, so own the Pool here.\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db)\n const session = await betterAuth.api.getSession({ headers: c.req.raw.headers })\n if (!session) {\n return c.json({ userExists: false, authenticated: false })\n }\n\n const userId = session.user.id\n\n const status = await ensureCurrentUserProfile(\n db as Parameters<typeof ensureCurrentUserProfile>[0],\n userId,\n )\n if (!status.userExists && status.authenticated) {\n console.error(\"[auth/status] Error:\", status.reason)\n return c.json(status, 500)\n }\n\n return c.json(status)\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n /\n GET /auth/bootstrap-status\n * Public endpoint — reveals whether any user exists. Used by the sign-in /\n * sign-up route loaders to pick the right flow.\n /\n auth.get(\"/auth/bootstrap-status\", async (c) => {\n return c.json(await getBootstrapStatusForRequest(c.req.raw, c.env))\n })\n\n async function handleApiTokensFacade(c: Context<AuthHonoEnv>) {\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db)\n const cloudAuthDb = db as Parameters<typeof revalidateVoyantCloudAdminAuthSession>[0][\"db\"]\n\n if (isVoyantCloudAuthMode(c.env)) {\n const revalidateConfig = getCloudAuthRevalidateConfig(c.env)\n if (!revalidateConfig) {\n return c.json(\n { error: \"Cloud-mode API token management requires membership revalidation\" },\n 501,\n )\n }\n\n const session = await betterAuth.api.getSession({ headers: c.req.raw.headers })\n if (!session) {\n return c.json({ error: \"Unauthorized\" }, 401)\n }\n\n try {\n const revalidation = await revalidateVoyantCloudAdminAuthSession({\n db: cloudAuthDb,\n sessionId: session.session.id,\n config: revalidateConfig,\n })\n\n if (!revalidation.ok) {\n return c.json({ error: \"Voyant Cloud access revoked\" }, 403)\n }\n } catch (error) {\n console.error(\"[auth/api-tokens] Cloud revalidation failed:\", error)\n return c.json({ error: \"Voyant Cloud access could not be revalidated\" }, 503)\n }\n }\n\n return (\n (await handleApiTokenManagementRequest(c.req.raw, betterAuth, {\n db,\n accessCatalog: runtimeOptions.accessCatalog,\n })) ?? c.json({ error: \"Not found\" }, 404)\n )\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n }\n\n async function handleOrganizationMembersFacade(c: Context<AuthHonoEnv>) {\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db)\n const cloudAuthDb = db as Parameters<typeof revalidateVoyantCloudAdminAuthSession>[0][\"db\"]\n\n if (isVoyantCloudAuthMode(c.env)) {\n const revalidateConfig = getCloudAuthRevalidateConfig(c.env)\n if (!revalidateConfig) {\n return c.json(\n { error: \"Cloud-mode organization member lookup requires membership revalidation\" },\n 501,\n )\n }\n\n const session = await betterAuth.api.getSession({ headers: c.req.raw.headers })\n if (!session) {\n return c.json({ error: \"Unauthorized\" }, 401)\n }\n\n try {\n const revalidation = await revalidateVoyantCloudAdminAuthSession({\n db: cloudAuthDb,\n sessionId: session.session.id,\n config: revalidateConfig,\n })\n\n if (!revalidation.ok) {\n return c.json({ error: \"Voyant Cloud access revoked\" }, 403)\n }\n } catch (error) {\n console.error(\"[auth/organization-members] Cloud revalidation failed:\", error)\n return c.json({ error: \"Voyant Cloud access could not be revalidated\" }, 503)\n }\n }\n\n const organizationMembersDb = db as Parameters<\n typeof handleOrganizationMembersRequest\n >[2][\"db\"]\n return (\n (await handleOrganizationMembersRequest(c.req.raw, betterAuth, {\n db: organizationMembersDb,\n })) ?? c.json({ error: \"Not found\" }, 404)\n )\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n }\n\n auth.get(\"/auth/cloud/start\", async (c) => {\n if (!isVoyantCloudAuthMode(c.env)) {\n return c.json({ error: \"Not found\" }, 404)\n }\n\n const config = getCloudAuthStartConfig(c.env)\n if (!config) {\n return cloudAuthNotConfiguredResponse(c)\n }\n\n try {\n const start = await createCloudAdminAuthStart({\n requestUrl: c.req.url,\n next: c.req.query(\"next\"),\n config,\n })\n return new Response(null, {\n status: 302,\n headers: {\n Location: start.redirectUrl,\n \"Set-Cookie\": start.setCookie,\n },\n })\n } catch (error) {\n console.error(\"[auth/cloud/start] Error:\", error)\n return c.json({ error: \"Voyant Cloud auth broker is misconfigured\" }, 500)\n }\n })\n\n auth.get(\"/auth/cloud/callback\", async (c) => {\n if (!isVoyantCloudAuthMode(c.env)) {\n return c.json({ error: \"Not found\" }, 404)\n }\n\n const exchangeConfig = getCloudAuthExchangeConfig(c.env)\n if (!exchangeConfig) {\n const url = new URL(c.req.url)\n return c.json({ error: \"Voyant Cloud auth exchange is not configured yet\" }, 501, {\n \"Set-Cookie\": buildClearCloudAdminAuthStateCookie(\n url.protocol === \"https:\",\n url.pathname.replace(/\\/callback$/, \"\") \|\| \"/auth/cloud\",\n ),\n })\n }\n\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db)\n return await betterAuth.handler(c.req.raw)\n } catch (error) {\n console.error(\"[auth/cloud/callback] Error:\", error)\n return c.json({ error: \"Voyant Cloud auth callback failed\" }, 500)\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n auth.all(\"/auth/api-tokens\", handleApiTokensFacade)\n auth.all(\"/auth/api-tokens/:keyId\", handleApiTokensFacade)\n auth.all(\"/auth/api-tokens/:keyId/rotate\", handleApiTokensFacade)\n auth.get(\"/auth/organization/list-members\", handleOrganizationMembersFacade)\n\n auth.get(\"/auth/customer/status\", async (c) => {\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db, { customerSignup: true })\n const session = await betterAuth.api.getSession({ headers: c.req.raw.headers })\n return c.json({ authenticated: Boolean(session) })\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n auth.all(\"/auth/customer/\", async (c) => {\n if (\n isVoyantCloudAuthMode(c.env) &&\n !isCloudAllowedBetterAuthRoute(rewriteCustomerAuthRequest(c.req.raw))\n ) {\n return localAuthDisabledResponse(c)\n }\n\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db, { customerSignup: true })\n return await betterAuth.handler(rewriteCustomerAuthRequest(c.req.raw))\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n /*\n Catch-all: delegate to Better Auth handler.\n * Handles sign-in, sign-up, sign-out, password reset, OAuth callbacks, etc.\n \n Sign-up is gated by a `user.create.before` hook in @voyant-travel/auth — once a\n * user exists, the hook throws and BA returns an error to the client.\n /\n auth.all(\"/auth/\", async (c) => {\n if (isVoyantCloudAuthMode(c.env) && !isCloudAllowedBetterAuthRoute(c.req.raw)) {\n return localAuthDisabledResponse(c)\n }\n\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db)\n return await betterAuth.handler(c.req.raw)\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n return {\n handler: auth,\n getBootstrapStatusForRequest,\n getCurrentUserForRequest,\n hasAuthPermission,\n resolveAuthRequest,\n validateApiTokenAccess,\n }\n}\n"]}
1	+ {"version":3,"file":"node-runtime.js","sourceRoot":"","sources":["../src/node-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAwB,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAClF,OAAO,EACL,QAAQ,EACR,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EACL,cAAc,EACd,eAAe,EACf,SAAS,GACV,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAEhE,OAAO,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAA;AAChG,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAA;AACzC,OAAO,EACL,gCAAgC,EAChC,qCAAqC,EACrC,kCAAkC,GACnC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,mCAAmC,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAClG,OAAO,EAGL,qBAAqB,EACrB,wBAAwB,EACxB,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAgEzD,mFAAmF;AACnF,MAAM,UAAU,oCAAoC,CAClD,GAAoD;IAIpD,MAAM,MAAM,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAA;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAE7B,OAAO;QACL,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;QAChD,uBAAuB,EAAE,EAAE,MAAM,EAAE;KACpC,CAAA;AACH,CAAC;AAsDD;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAA4B,EAC5B,gBAAwB;IAExB,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,CAAA;IACzC,IAAI,CAAC,SAAS;QAAE,OAAO,OAAO,CAAA;IAE9B,MAAM,0BAA0B,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAG,CAAC,QAAyC,EAAE,EAAE,CAC7D,GAAG,0BAA0B,2BAA2B,QAAQ,EAAE,CAAA;IACpE,MAAM,eAAe,GAAG,CACtB,QAA8B,EAC9B,WAAmB,EACG,EAAE;QACxB,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAC9D,MAAM,UAAU,GAAG,QAA+C,CAAA;QAClE,OAAO;YACL,GAAG,UAAU;YACb,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,WAAW;SAC3D,CAAA;IACH,CAAC,CAAA;IAED,OAAO;QACL,GAAG,OAAO;QACV,eAAe,EAAE;YACf,GAAG,SAAS;YACZ,GAAG,CAAC,SAAS,CAAC,MAAM;gBAClB,CAAC,CAAC;oBACE,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;iBAC9D;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,QAAQ;gBACpB,CAAC,CAAC;oBACE,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;iBACpE;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,KAAK;gBACjB,CAAC,CAAC;oBACE,KAAK,EAAE,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;iBAC3D;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,cAAyD;IAIzD,MAAM,YAAY,GAChB,cAAc,CAAC,YAAY;QAC3B,CAAC,CAAC,GAAQ,EAAE,EAAE;YACZ,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;YACtC,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAA;QACnE,CAAC,CAAC,CAAA;IAEJ,MAAM,IAAI,GAAG,IAAI,IAAI,EAAe,CAAA;IACpC,iEAAiE;IACjE,0EAA0E;IAC1E,+EAA+E;IAC/E,oEAAoE;IACpE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IACxB,oEAAoE;IACpE,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,8EAA8E;IAC9E,yEAAyE;IACzE,kEAAkE;IAClE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,IAAI,EAAE,CAAA;QACZ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACxB,eAAe,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,EAAE;gBAC1C,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE;gBAC/B,GAAG,EAAE,cAAc,CAAC,OAAO;gBAC3B,KAAK,EAAE,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC9D,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE;aAC3F,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;IACF,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CACtB,cAAc,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC,CAC/F,CAAA;IAED,MAAM,eAAe,GAAG,uBAAuB,CAAA;IAC/C,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;QAC1C,mBAAmB;QACnB,YAAY;QACZ,eAAe;QACf,gBAAgB;QAChB,aAAa;KACd,CAAC,CAAA;IAEF,SAAS,uBAAuB,CAAC,IAAS;QACxC,OAAO,cAAc,CAAC,QAAQ,CAAA;IAChC,CAAC;IAED,SAAS,qBAAqB,CAAC,GAAQ;QACrC,OAAO,uBAAuB,CAAC,GAAG,CAAC,KAAK,cAAc,CAAA;IACxD,CAAC;IAED,SAAS,6BAA6B,CAAC,OAAgB;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAA;QACxF,OAAO,2BAA2B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAClD,CAAC;IAED,SAAS,yBAAyB,CAAC,CAAuB;QACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0DAA0D,EAAE,EAAE,GAAG,CAAC,CAAA;IAC3F,CAAC;IAED,SAAS,8BAA8B,CAAC,CAAuB;QAC7D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,EAAE,GAAG,CAAC,CAAA;IACjF,CAAC;IAED,SAAS,YAAY,CAAC,GAAW;QAC/B,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACtC,CAAC;IAED,SAAS,SAAS,CAAC,GAAQ;QACzB,MAAM,UAAU,GAAG;YACjB,GAAG,CAAC,OAAO;YACX,GAAG,CAAC,aAAa;YACjB,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACjC,eAAe;SAChB,CAAA;QAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjE,OAAO,YAAY,CAAC,SAAS,CAAC,CAAA;YAChC,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,SAAS,iBAAiB,CAAC,GAAQ;QACjC,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CACL,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;aACvE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;aAC7B,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACtD,CACF,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACrB,CAAC;IAED,SAAS,cAAc,CAAC,GAAQ;QAC9B,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;YAC9B,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,CAAA;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IAED,SAAS,mBAAmB,CAAC,GAAQ;QACnC,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAA;QAC5F,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;QAE1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;YAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACtD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAA;gBACxB,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,SAAS,uBAAuB,CAAC,GAAQ;QACvC,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAA;QAC3D,MAAM,iBAAiB,GAAG,GAAG,CAAC,iCAAiC,EAAE,IAAI,EAAE,CAAA;QACvE,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAA;QAEpD,OAAO;YACL,iBAAiB;YACjB,YAAY;YACZ,gBAAgB,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,4BAA4B;YACzE,YAAY,EAAE,GAAG,CAAC,qBAAqB;YACvC,KAAK,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,SAAS;YACnD,WAAW,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,SAAS;SAC/D,CAAA;IACH,CAAC;IAED,SAAS,0BAA0B,CAAC,GAAQ;QAC1C,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAA;QAC3D,MAAM,WAAW,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAA;QACpE,MAAM,gBAAgB,GAAG,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE,CAAA;QACrE,MAAM,WAAW,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAA;QACpE,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,IAAI,CAAC,gBAAgB,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAA;QAEnF,OAAO;YACL,WAAW;YACX,YAAY;YACZ,WAAW;YACX,gBAAgB;YAChB,iBAAiB,EAAE,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE,IAAI,YAAY;SAChF,CAAA;IACH,CAAC;IAED,SAAS,4BAA4B,CAAC,GAAQ;QAC5C,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAA;QAC3D,MAAM,aAAa,GAAG,GAAG,CAAC,sCAAsC,EAAE,IAAI,EAAE,CAAA;QACxE,MAAM,WAAW,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAA;QACpE,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAA;QAEhE,OAAO;YACL,aAAa;YACb,YAAY;YACZ,WAAW;SACZ,CAAA;IACH,CAAC;IAED,SAAS,cAAc,CAAC,OAAgB;QACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;QAC9C,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,CAAA;IAC7D,CAAC;IAED,SAAS,oCAAoC,CAAC,GAAQ,EAAE,OAAgB;QACtE,OAAO,GAAG,CAAC,gCAAgC,KAAK,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAA;IAChF,CAAC;IAED,SAAS,sBAAsB,CAAC,GAAQ;QACtC,OAAO,GAAG,CAAC,gCAAgC,KAAK,GAAG,CAAA;IACrD,CAAC;IAED;;;;;;;;;OASG;IACH,SAAS,sBAAsB,CAAC,GAAQ;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAA;QACrF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QAC5E,OAAO,MAAM,CAAA;IACf,CAAC;IAED,SAAS,yBAAyB,CAAC,GAAQ;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAA;QACtD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QACzB,qEAAqE;QACrE,0EAA0E;QAC1E,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,wBAAwB,CAAA;IAC/D,CAAC;IAED,SAAS,UAAU,CAAC,KAAyB,EAAE,QAAiB;QAC9D,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC9C,IAAI,CAAC,UAAU;YAAE,OAAO,QAAQ,CAAA;QAChC,OAAO,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,KAAK,CAAA;IAC5E,CAAC;IAED,SAAS,uBAAuB,CAAC,GAAQ;QACvC,MAAM,QAAQ,GAAG;YACf,OAAO,EAAE;gBACP,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,+BAA+B,EAAE,IAAI,CAAC;gBAChE,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC;gBACxE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;gBAC/C,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;gBACjD,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;aAC/C;SAC2B,CAAA;QAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE,CAAA;QACxD,IAAI,CAAC,GAAG;YAAE,OAAO,QAAQ,CAAA;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAE5B,CAAA;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAA;YACpC,MAAM,MAAM,GAAG,CAAC,KAAc,EAA4B,EAAE;gBAC1D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAA;gBAChD,CAAC;gBACD,MAAM,MAAM,GAAG,KAAgC,CAAA;gBAC/C,OAAO;oBACL,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI;oBAChC,aAAa,EACX,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE;wBACrE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE;wBAC7B,CAAC,CAAC,IAAI;iBACX,CAAA;YACH,CAAC,CAAA;YACD,OAAO;gBACL,OAAO,EAAE;oBACP,SAAS,EACP,OAAO,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS;oBACzF,aAAa,EACX,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS;wBACxC,CAAC,CAAC,OAAO,CAAC,aAAa;wBACvB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa;oBACpC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC9B,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;oBAClC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;iBAC7B;aACF,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CACX,sFAAsF,CACvF,CAAA;YACD,OAAO,QAAQ,CAAA;QACjB,CAAC;IACH,CAAC;IAED,SAAS,0BAA0B,CACjC,GAAQ,EACR,MAA0B;QAE1B,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE,CAAC,CAAA;QAChF,MAAM,MAAM,GAAG,OAAO,CACpB,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE;YACxC,GAAG,CAAC,kCAAkC,EAAE,IAAI,EAAE;YAC9C,CAAC,CAAC,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CACzD,CAAA;QACD,MAAM,QAAQ,GAAG,OAAO,CACtB,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE;YAC1C,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE;YAChD,CAAC,CAAC,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC3D,CAAA;QACD,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE;YACvC,GAAG,CAAC,iCAAiC,EAAE,IAAI,EAAE;YAC7C,CAAC,CAAC,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CACxD,CAAA;QACD,OAAO;YACL,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;YAC5B,cAAc,EAAE,iBAAiB,CAAC,GAAG,CAAC;YACtC,OAAO,EAAE;gBACP,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;gBACnC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;gBAC3C,eAAe,EAAE;oBACf,GAAG,CAAC,MAAM;wBACR,CAAC,CAAC;4BACE,MAAM,EAAE;gCACN,QAAQ,EAAE,GAAG,CAAC,8BAA+B,CAAC,IAAI,EAAE;gCACpD,YAAY,EAAE,GAAG,CAAC,kCAAmC,CAAC,IAAI,EAAE;6BAC7D;yBACF;wBACH,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,QAAQ;wBACV,CAAC,CAAC;4BACE,QAAQ,EAAE;gCACR,QAAQ,EAAE,GAAG,CAAC,gCAAiC,CAAC,IAAI,EAAE;gCACtD,YAAY,EAAE,GAAG,CAAC,oCAAqC,CAAC,IAAI,EAAE;6BAC/D;yBACF;wBACH,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,KAAK;wBACP,CAAC,CAAC;4BACE,KAAK,EAAE;gCACL,QAAQ,EAAE,GAAG,CAAC,6BAA8B,CAAC,IAAI,EAAE;gCACnD,YAAY,EAAE,GAAG,CAAC,iCAAkC,CAAC,IAAI,EAAE;6BAC5D;yBACF;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;SACF,CAAA;IACH,CAAC;IAED,SAAS,0BAA0B,CAAC,GAAQ,EAAE,OAAgB;QAC5D,MAAM,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAA;QAC3C,OAAO,CACL,cAAc,CAAC,0BAA0B,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC;YACjE,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CACxC,CAAA;IACH,CAAC;IAED,SAAS,+BAA+B,CAAC,GAAQ,EAAE,OAAgB;QACjE,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAA;QAChE,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAA;QAC/C,OAAO;YACL,OAAO,EAAE;gBACP,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;gBACpC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;gBAC5C,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC;gBACjC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACrC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;aAChC;SACF,CAAA;IACH,CAAC;IAED,SAAS,oBAAoB,CAAC,GAAQ,EAAE,EAAY;QAClD,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,EAAE,CAAC,GAAG,CAAC,CAAA;QAC5D,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC7F,MAAM,MAAM,GAAG,EAAoE,CAAA;QACnF,MAAM,WAAW,GAAG,EAAkE,CAAA;QAEtF,OAAO,qBAAqB,CAAC;YAC3B,4DAA4D;YAC5D,+DAA+D;YAC/D,4DAA4D;YAC5D,gEAAgE;YAChE,+DAA+D;YAC/D,iDAAiD;YACjD,EAAE,EAAE,MAAM;YACV,MAAM,EAAE,sBAAsB,CAAC,GAAG,CAAC;YACnC,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;YAC5B,QAAQ,EAAE,aAAa;YACvB,cAAc,EAAE,iBAAiB,CAAC,GAAG,CAAC;YACtC,QAAQ,EAAE,CAAC,cAAc,CAAC,cAAc,IAAI,oCAAoC,CAAC,CAAC,GAAG,CAAC;YACtF,OAAO,EAAE,iBAAiB;gBACxB,CAAC,CAAC;oBACE,gCAAgC,CAAC;wBAC/B,EAAE,EAAE,WAAW;wBACf,YAAY,EAAE,GAAG,CAAC,qBAAqB;wBACvC,QAAQ,EAAE,iBAAiB;qBAC5B,CAAC;iBACH;gBACH,CAAC,CAAC,SAAS;YACb,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBACzC,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,wEAAwE;oBACxE,iEAAiE;oBACjE,mEAAmE;oBACnE,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;wBAChC,OAAO,CAAC,IAAI,CAAC,6CAA6C,IAAI,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC,CAAA;wBAC/E,OAAM;oBACR,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;gBACpE,CAAC;gBACD,MAAM,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;YACpD,CAAC;YACD,mBAAmB,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;gBAClD,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,wEAAwE;oBACxE,gEAAgE;oBAChE,mEAAmE;oBACnE,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;wBAChC,OAAO,CAAC,IAAI,CAAC,6CAA6C,IAAI,QAAQ,KAAK,KAAK,GAAG,EAAE,CAAC,CAAA;wBACtF,OAAM;oBACR,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;gBACtE,CAAC;gBACD,MAAM,WAAW,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7D,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED,SAAS,uBAAuB,CAAC,GAAQ,EAAE,EAAY,EAAE,OAAgB;QACvE,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,EAAE,CAAC,GAAG,CAAC,CAAA;QAC5D,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,EAAuE,CAAA;QACtF,OAAO,wBAAwB,CAAC;YAC9B,EAAE,EAAE,MAAM;YACV,MAAM,EAAE,yBAAyB,CAAC,GAAG,CAAC;YACtC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,gBAAgB;YAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,OAAO,EAAE,8BAA8B,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAClF,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBACzC,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;wBAChC,OAAO,CAAC,IAAI,CAAC,sDAAsD,IAAI,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC,CAAA;wBACxF,OAAM;oBACR,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;gBACpE,CAAC;gBACD,MAAM,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;YACpD,CAAC;YACD,mBAAmB,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;gBAClD,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;wBAChC,OAAO,CAAC,IAAI,CACV,sDAAsD,IAAI,QAAQ,KAAK,KAAK,GAAG,EAAE,CAClF,CAAA;wBACD,OAAM;oBACR,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;gBACtE,CAAC;gBACD,MAAM,WAAW,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7D,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED,SAAS,6BAA6B,CAAC,OAAgB;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;QAC3D,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,MAAM,kBAAkB,GAAG,CAAC,GAAG,CAAC,CAAA;IAEhC,SAAS,qBAAqB,CAAC,IAA+B;QAC5D,MAAM,IAAI,GAAG,0BAA0B,CAAC,IAAI,EAAE,cAAc,CAAC,aAAa,CAAC,CAAA;QAC3E,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,MAAM,cAAc,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACxD,MAAM,QAAQ,GACZ,cAAc,KAAK,QAAQ;YACzB,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,cAAc,KAAK,OAAO;gBAC1B,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,cAAc,CAAA;QACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CACxD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,EAAE,KAAK,QAAQ,CAC9D,CAAA;QACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACpE,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,UAAU,mBAAmB,CAAC,EAAY,EAAE,GAAQ,EAAE,MAAc;QACvE,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;iBACpB,MAAM,CAAC,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC;iBACpF,IAAI,CAAC,kBAAkB,CAAC;iBACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;iBAC5C,KAAK,CAAC,CAAC,CAAC,CAAA;YACX,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAA;YAC7E,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,gBAAgB,CAAA;YAC5E,OAAO,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,UAAU,CAAC,CAAA;QACrF,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,WAAW,EAAE,CAAC;aACtD,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aACvC,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,OAAO,OAAO,EAAE,WAAW,IAAI,kBAAkB,CAAA;IACnD,CAAC;IAED,KAAK,UAAU,kBAAkB,CAC/B,OAAgB,EAChB,GAAQ;QAER,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;YAC7E,MAAM,IAAI,GAAG,eAAe;gBAC1B,CAAC,CAAC,uBAAuB,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC;gBAC3C,CAAC,CAAC,oBAAoB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;YAEvE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAA;YACb,CAAC;YAED,IAAI,CAAC,eAAe,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAA;gBAC1D,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,qCAAqC,CAAC;wBAC/D,EAAE,EAAE,EAAuE;wBAC3E,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;wBAC7B,MAAM,EAAE,gBAAgB;qBACzB,CAAC,CAAA;oBAEF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;wBACrB,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAA;oBACjE,OAAO,IAAI,CAAA;gBACb,CAAC;YACH,CAAC;YAED,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO;oBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;oBACvB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;oBAC7B,cAAc,EAAE,IAAI;oBACpB,UAAU,EAAE,SAAS;oBACrB,KAAK,EAAE,UAAU;oBACjB,KAAK,EAAE,UAAU;oBACjB,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;iBAClC,CAAA;YACH,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;gBAC7B,cAAc,EAAE,IAAI;gBACpB,UAAU,EAAE,SAAS;gBACrB,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,OAAO;gBACd,yEAAyE;gBACzE,uEAAuE;gBACvE,gEAAgE;gBAChE,sEAAsE;gBACtE,MAAM,EAAE,MAAM,mBAAmB,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3D,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;aAClC,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,gEAAgE;YAChE,kEAAkE;YAClE,0BAA0B;YAC1B,MAAM,OAAO,EAAE,CAAA;QACjB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,GAAQ;QACzD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACnD,OAAO,IAAI,KAAK,IAAI,CAAA;IACtB,CAAC;IAED,MAAM,wBAAyB,SAAQ,KAAK;QAC1C;YACE,KAAK,CAAC,gBAAgB,CAAC,CAAA;YACvB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;QACxC,CAAC;KACF;IAED,KAAK,UAAU,wBAAwB,CACrC,OAAgB,EAChB,GAAQ;QAER,IAAI,oCAAoC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAChD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;YAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC;gBACN,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS,EAAE,iBAAiB,CAAC,SAAS;gBACtC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;gBACpC,MAAM,EAAE,iBAAiB,CAAC,MAAM;gBAChC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;gBACpC,OAAO,EAAE,iBAAiB,CAAC,OAAO;gBAClC,SAAS,EAAE,iBAAiB,CAAC,SAAS;gBACtC,YAAY,EAAE,iBAAiB,CAAC,YAAY;gBAC5C,aAAa,EAAE,iBAAiB,CAAC,aAAa;aAC/C,CAAC;iBACD,IAAI,CAAC,QAAQ,CAAC;iBACd,QAAQ,CAAC,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;iBAClE,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;iBACvC,KAAK,CAAC,CAAC,CAAC,CAAA;YAEX,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,wBAAwB,EAAE,CAAA;YACtC,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAC5C,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;gBAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;gBAC9B,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;gBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;gBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;gBAC5B,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,KAAK;gBACvC,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,KAAK;gBACzC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnE,iBAAiB,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;aACzC,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,EAAE,CAAA;QACjB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,4BAA4B,CACzC,OAAgB,EAChB,GAAQ;QAER,IAAI,oCAAoC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC3B,CAAC;QAED,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAA;QACrD,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACnF,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;QAC/D,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,EAAE,CAAA;QACjB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,sBAAsB,CACnC,GAAQ,EACR,EAAY,EACZ,MAAoB;QAEpB,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAE5C,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAA;QAC1D,IAAI,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAA;QAEnC,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,kCAAkC,CAAC;gBAC5D,EAAE,EAAE,EAAoE;gBACxE,MAAM,EAAE,MAAM,CAAC,WAAW;gBAC1B,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAA;YACF,OAAO,YAAY,CAAC,EAAE,CAAA;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAA;YACnE,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAA;YACpE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;YAC/C,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;gBAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;YACjD,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;;OAKG;IACH,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,mEAAmE;QACnE,oCAAoC;QACpC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,oBAAoB,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAClD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAA;YAC5D,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;YAE9B,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,EAAoD,EACpD,MAAM,CACP,CAAA;YACD,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC/C,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;gBACpD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YAC5B,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvB,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;OAIG;IACH,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,KAAK,UAAU,qBAAqB,CAAC,CAAuB;QAC1D,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,oBAAoB,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAClD,MAAM,WAAW,GAAG,EAAuE,CAAA;YAE3F,IAAI,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,kEAAkE,EAAE,EAC7E,GAAG,CACJ,CAAA;gBACH,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,qCAAqC,CAAC;wBAC/D,EAAE,EAAE,WAAW;wBACf,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;wBAC7B,MAAM,EAAE,gBAAgB;qBACzB,CAAC,CAAA;oBAEF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;wBACrB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAA;oBAC9D,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAA;oBACpE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC/E,CAAC;YACH,CAAC;YAED,OAAO,CACL,CAAC,MAAM,+BAA+B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE;gBAC5D,EAAE;gBACF,aAAa,EAAE,cAAc,CAAC,aAAa;aAC5C,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAC3C,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED,KAAK,UAAU,+BAA+B,CAAC,CAAuB;QACpE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,oBAAoB,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAClD,MAAM,WAAW,GAAG,EAAuE,CAAA;YAE3F,IAAI,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,wEAAwE,EAAE,EACnF,GAAG,CACJ,CAAA;gBACH,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,qCAAqC,CAAC;wBAC/D,EAAE,EAAE,WAAW;wBACf,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;wBAC7B,MAAM,EAAE,gBAAgB;qBACzB,CAAC,CAAA;oBAEF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;wBACrB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAA;oBAC9D,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,wDAAwD,EAAE,KAAK,CAAC,CAAA;oBAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC/E,CAAC;YACH,CAAC;YAED,MAAM,qBAAqB,GAAG,EAEpB,CAAA;YACV,OAAO,CACL,CAAC,MAAM,gCAAgC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE;gBAC7D,EAAE,EAAE,qBAAqB;aAC1B,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAC3C,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED,KAAK,UAAU,oBAAoB,CAAC,CAAuB;QACzD,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,8BAA8B,CAAC,CAAC,CAAC,CAAA;QAC1C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC;gBAC5C,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG;gBACrB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;gBACzB,MAAM;aACP,CAAC,CAAA;YACF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,QAAQ,EAAE,KAAK,CAAC,WAAW;oBAC3B,YAAY,EAAE,KAAK,CAAC,SAAS;iBAC9B;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAA;YACjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IAED,KAAK,UAAU,uBAAuB,CAAC,CAAuB;QAC5D,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5C,CAAC;QAED,MAAM,cAAc,GAAG,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACxD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kDAAkD,EAAE,EAAE,GAAG,EAAE;gBAChF,YAAY,EAAE,mCAAmC,CAC/C,GAAG,CAAC,QAAQ,KAAK,QAAQ,EACzB,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,aAAa,CACzD;aACF,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,oBAAoB,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAClD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;gBACnD,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG;gBACX,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC5C,OAAO,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAA;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,GAAG,CAAC,CAAA;QACpE,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAA;IACzD,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,uBAAuB,CAAC,CAAA;IAC/D,2CAA2C;IAC3C,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAAA;IACnD,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAA;IAEzD,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAA;IACnD,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,CAAA;IAC1D,IAAI,CAAC,GAAG,CAAC,gCAAgC,EAAE,qBAAqB,CAAC,CAAA;IACjE,IAAI,CAAC,GAAG,CAAC,iCAAiC,EAAE,+BAA+B,CAAC,CAAA;IAE5E,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,uBAAuB,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAChE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACpD,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE;QACtC,IAAI,CAAC,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;YAC3D,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE;oBACP,SAAS,EAAE,KAAK;oBAChB,aAAa,EAAE,KAAK;oBACpB,MAAM,EAAE,KAAK;oBACb,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,KAAK;iBACb;aACF,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,IAAI,CAAC,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;YAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5D,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,uBAAuB,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAChE,OAAO,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5C,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;;;OAMG;IACH,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,IAAI,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9E,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAA;QACrC,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,oBAAoB,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAClD,OAAO,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5C,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,mEAAmE;IACnE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,SAAS,GAAG,6BAA6B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC1D,IAAI,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9E,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAA;QACrC,CAAC;QACD,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,OAAO,MAAM,oBAAoB,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACjE,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,4BAA4B;QAC5B,wBAAwB;QACxB,iBAAiB;QACjB,kBAAkB;QAClB,sBAAsB;KACvB,CAAA;AACH,CAAC","sourcesContent":["/*\n Better Auth Node runtime for Hono.\n \n agent-quality: file-size exception -- Auth handler keeps local and Voyant Cloud auth flows co-located until the route surface is split by auth mode.\n \n Mounts Better Auth at /auth/* for authentication operations.\n * Same-origin — no CORS needed. Session cookies work naturally.\n \n Also provides /auth/status (user provisioning) and /auth/me (user info).\n /\n\nimport { type NodeDatabaseEnv, openNodeDatabase } from \"@voyant-travel/db/runtime\"\nimport {\n authUser,\n cloudAuthUserLinks,\n type SelectApikey,\n userProfilesTable,\n} from \"@voyant-travel/db/schema/iam\"\nimport type { Reporter, VoyantDb, VoyantRequestAuthContext } from \"@voyant-travel/hono\"\nimport {\n handleApiError,\n reportException,\n requestId,\n} from \"@voyant-travel/hono/middleware/error-boundary\"\nimport { getRequestId } from \"@voyant-travel/hono/observability\"\nimport type { AccessCatalog } from \"@voyant-travel/types/api-keys\"\nimport { accessCatalogScopesForRole, isFullAccessRole } from \"@voyant-travel/types/member-roles\"\nimport { eq, sql } from \"drizzle-orm\"\nimport { type Context, Hono } from \"hono\"\nimport {\n createVoyantCloudAdminAuthPlugin,\n revalidateVoyantCloudAdminAuthSession,\n revalidateVoyantCloudAdminAuthUser,\n} from \"./cloud-admin-session.js\"\nimport { buildClearCloudAdminAuthStateCookie, createCloudAdminAuthStart } from \"./cloud-broker.js\"\nimport {\n type CreateBetterAuthOptions,\n type CustomerAuthMethods,\n createAdminBetterAuth,\n createCustomerBetterAuth,\n handleApiTokenManagementRequest,\n handleOrganizationMembersRequest,\n} from \"./server.js\"\nimport { ensureCurrentUserProfile } from \"./workspace.js\"\n\n// Type ctx so that `c.get(\"db\")` resolves to the parent app's middleware-\n// set `VoyantDb` from the deployment's database lifecycle adapter. Without\n// this, the sub-app sees `unknown` for context vars.\ntype OperatorAuthMode = \"local\" \| \"voyant-cloud\"\n\nexport interface OperatorAuthNodeEnv extends NodeDatabaseEnv {\n API_BASE_URL?: string\n APP_URL?: string\n AUTH_COOKIE_DOMAIN?: string\n /* @deprecated Use BETTER_AUTH_ADMIN_SECRET. /\n BETTER_AUTH_SECRET?: string\n BETTER_AUTH_ADMIN_SECRET?: string\n BETTER_AUTH_CUSTOMER_SECRET?: string\n CORS_ALLOWLIST?: string\n DASH_BASE_URL?: string\n EMAIL_FROM?: string\n SESSION_CLAIMS_SECRET: string\n VOYANT_ADMIN_AUTH_MODE?: string\n VOYANT_CUSTOMER_AUTH_MODE?: string\n VOYANT_CUSTOMER_AUTH_CONFIG_JSON?: string\n VOYANT_CUSTOMER_AUTH_EMAIL_CODE?: string\n VOYANT_CUSTOMER_AUTH_EMAIL_PASSWORD?: string\n CUSTOMER_AUTH_GOOGLE_CLIENT_ID?: string\n CUSTOMER_AUTH_GOOGLE_CLIENT_SECRET?: string\n CUSTOMER_AUTH_FACEBOOK_CLIENT_ID?: string\n CUSTOMER_AUTH_FACEBOOK_CLIENT_SECRET?: string\n CUSTOMER_AUTH_APPLE_CLIENT_ID?: string\n CUSTOMER_AUTH_APPLE_CLIENT_SECRET?: string\n VOYANT_AUTH_LOG_SECRET_FALLBACKS?: string\n VOYANT_CLOUD_ADMIN_AUTH_AUDIENCE?: string\n VOYANT_CLOUD_ADMIN_AUTH_CLIENT_TOKEN?: string\n VOYANT_CLOUD_ADMIN_AUTH_EXCHANGE_URL?: string\n VOYANT_CLOUD_ADMIN_AUTH_JWKS_URL?: string\n VOYANT_CLOUD_ADMIN_AUTH_REVALIDATE_URL?: string\n VOYANT_CLOUD_ADMIN_AUTH_START_URL?: string\n VOYANT_CLOUD_APP_ID?: string\n VOYANT_CLOUD_DEPLOYMENT_ID?: string\n VOYANT_CLOUD_ENVIRONMENT?: string\n VOYANT_OPERATOR_BROWSER_EVIDENCE?: string\n}\n\nexport interface OperatorCurrentUser {\n id: string\n email: string\n firstName: string \| null\n lastName: string \| null\n locale: string\n timezone: string \| null\n uiPrefs: unknown\n isSuperAdmin: boolean\n isSupportUser: boolean\n createdAt: string\n profilePictureUrl: string \| null\n}\n\nexport type OperatorAuthBootstrapStatus = {\n hasUsers: boolean\n authMode?: OperatorAuthMode\n}\n\ntype BetterAuthAdvancedOptions = NonNullable<CreateBetterAuthOptions[\"advanced\"]>\n\n/* Resolve Better Auth's standard cross-subdomain cookie policy for Node hosts. /\nexport function buildBetterAuthCookieAdvancedOptions(\n env: Pick<OperatorAuthNodeEnv, \"AUTH_COOKIE_DOMAIN\">,\n):\n \| Pick<BetterAuthAdvancedOptions, \"crossSubDomainCookies\" \| \"defaultCookieAttributes\">\n \| undefined {\n const domain = env.AUTH_COOKIE_DOMAIN?.trim()\n if (!domain) return undefined\n\n return {\n crossSubDomainCookies: { enabled: true, domain },\n defaultCookieAttributes: { domain },\n }\n}\n\nexport interface OperatorAuthEmailSender {\n sendResetPassword: (input: {\n user: { email: string; name: string }\n url: string\n }) => Promise<void>\n sendVerificationOtp: (input: { email: string; otp: string; type: string }) => Promise<void>\n}\n\nexport interface CreateOperatorAuthNodeRuntimeOptions<Env extends OperatorAuthNodeEnv> {\n accessCatalog: AccessCatalog\n appName: string\n authMode: OperatorAuthMode\n reporter: Reporter\n openDatabase?: (env: Env) => { db: VoyantDb; dispose: () => Promise<void> }\n cookieAdvanced?: (\n env: Env,\n ) =>\n \| Pick<BetterAuthAdvancedOptions, \"crossSubDomainCookies\" \| \"defaultCookieAttributes\">\n \| undefined\n resolveEmailSender?: (env: Env) => OperatorAuthEmailSender \| null\n /\n Storefront/BFF seam for a canonical public auth origin and resolved\n * merchant credentials. Never derive these values from Host/X-Forwarded-Host.\n /\n resolveCustomerAuthContext?: (\n env: Env,\n policy: CustomerAuthPolicy,\n request: Request,\n ) => CustomerAuthRuntimeContext\n}\n\nexport interface CustomerAuthRuntimeContext {\n baseURL: string\n trustedOrigins: string[]\n methods: CustomerAuthMethods\n}\n\nexport interface CustomerAuthSocialPolicy {\n enabled: boolean\n credentialRef: string \| null\n}\n\nexport interface CustomerAuthPolicy {\n methods: {\n emailCode: boolean\n emailPassword: boolean\n google: CustomerAuthSocialPolicy\n facebook: CustomerAuthSocialPolicy\n apple: CustomerAuthSocialPolicy\n }\n}\n\n/\n Better Auth is dispatched internally without the hosting `/api` prefix, but\n * OAuth providers must return to the browser-visible route. Keep explicit\n * merchant overrides and supply the canonical public callback otherwise.\n /\nexport function withCustomerSocialRedirectUris(\n methods: CustomerAuthMethods,\n publicApiBaseUrl: string,\n): CustomerAuthMethods {\n const providers = methods.socialProviders\n if (!providers) return methods\n\n const normalizedPublicApiBaseUrl = publicApiBaseUrl.replace(/\\/+$/, \"\")\n const callback = (provider: \"google\" \| \"facebook\" \| \"apple\") =>\n `${normalizedPublicApiBaseUrl}/auth/customer/callback/${provider}`\n const withRedirectUri = <Provider>(\n provider: Provider \| undefined,\n redirectURI: string,\n ): Provider \| undefined => {\n if (!provider \|\| typeof provider !== \"object\") return provider\n const configured = provider as Provider & { redirectURI?: string }\n return {\n ...configured,\n redirectURI: configured.redirectURI?.trim() \|\| redirectURI,\n }\n }\n\n return {\n ...methods,\n socialProviders: {\n ...providers,\n ...(providers.google\n ? {\n google: withRedirectUri(providers.google, callback(\"google\")),\n }\n : {}),\n ...(providers.facebook\n ? {\n facebook: withRedirectUri(providers.facebook, callback(\"facebook\")),\n }\n : {}),\n ...(providers.apple\n ? {\n apple: withRedirectUri(providers.apple, callback(\"apple\")),\n }\n : {}),\n },\n }\n}\n\nexport function createOperatorAuthNodeRuntime<Env extends OperatorAuthNodeEnv>(\n runtimeOptions: CreateOperatorAuthNodeRuntimeOptions<Env>,\n) {\n type AuthHonoEnv = { Bindings: Env; Variables: { db: VoyantDb } }\n\n const openDatabase =\n runtimeOptions.openDatabase ??\n ((env: Env) => {\n const resource = openNodeDatabase(env)\n return { db: resource.db as VoyantDb, dispose: resource.dispose }\n })\n\n const auth = new Hono<AuthHonoEnv>()\n // This lean auth app is dispatched around `createVoyantApp` (see\n // api-dispatch.ts), so it must mint/propagate the correlation id and wire\n // the reporter itself — otherwise auth 5xx are an observability blind spot and\n // the user-facing requestId wouldn't be findable (RFC voyant#1553).\n auth.use(\"\", requestId)\n // `onError` only fires on THROWN exceptions. Several handlers (e.g.\n // /auth/status, the cloud token/revalidate/callback paths) instead RETURN a\n // 5xx via `c.json(..., 50x)`; those bypass `onError`, and this lean app is\n // dispatched around `createVoyantApp` so the framework's auth status-bridge\n // (`mountAuthForwarding`) never runs either. Bridge returned 5xx to the\n // reporter here so they aren't an observability blind spot (RFC voyant#1553).\n // Thrown errors skip this middleware's post-`next()` code (the rejection\n // propagates straight to `onError`), so there's no double report.\n auth.use(\"\", async (c, next) => {\n await next()\n if (c.res.status >= 500) {\n reportException(runtimeOptions.reporter, c, {\n requestId: getRequestId() ?? \"\",\n app: runtimeOptions.appName,\n error: new Error(`auth handler returned HTTP ${c.res.status}`),\n context: { path: c.req.path, method: c.req.method, status: c.res.status, surface: \"auth\" },\n })\n }\n })\n auth.onError((err, c) =>\n handleApiError(err, c, { reporter: runtimeOptions.reporter, appName: runtimeOptions.appName }),\n )\n\n const DEFAULT_APP_URL = \"http://localhost:3300\"\n const CLOUD_BETTER_AUTH_ALLOWLIST = new Set([\n \"/auth/get-session\",\n \"/auth/jwks\",\n \"/auth/session\",\n \"/auth/sign-out\",\n \"/auth/token\",\n ])\n\n function resolveOperatorAuthMode(_env: Env): OperatorAuthMode {\n return runtimeOptions.authMode\n }\n\n function isVoyantCloudAuthMode(env: Env): boolean {\n return resolveOperatorAuthMode(env) === \"voyant-cloud\"\n }\n\n function isCloudAllowedBetterAuthRoute(request: Request): boolean {\n const url = new URL(request.url)\n const pathname = url.pathname.replace(\"/auth/admin\", \"/auth\").replace(/\\/+$/, \"\") \|\| \"/\"\n return CLOUD_BETTER_AUTH_ALLOWLIST.has(pathname)\n }\n\n function localAuthDisabledResponse(c: Context<AuthHonoEnv>) {\n return c.json({ error: \"Local auth routes are disabled in Voyant Cloud auth mode\" }, 404)\n }\n\n function cloudAuthNotConfiguredResponse(c: Context<AuthHonoEnv>) {\n return c.json({ error: \"Voyant Cloud auth broker is not configured yet\" }, 501)\n }\n\n function normalizeUrl(url: string): string {\n return url.trim().replace(/\\/$/, \"\")\n }\n\n function getAppUrl(env: Env): string {\n const candidates = [\n env.APP_URL,\n env.DASH_BASE_URL,\n env.CORS_ALLOWLIST?.split(\",\")[0],\n DEFAULT_APP_URL,\n ]\n\n for (const candidate of candidates) {\n if (typeof candidate === \"string\" && candidate.trim().length > 0) {\n return normalizeUrl(candidate)\n }\n }\n\n return DEFAULT_APP_URL\n }\n\n function getTrustedOrigins(env: Env): string[] {\n return Array.from(\n new Set(\n [env.APP_URL, env.DASH_BASE_URL, ...(env.CORS_ALLOWLIST ?? \"\").split(\",\")]\n .map((value) => value?.trim())\n .filter((value): value is string => Boolean(value)),\n ),\n ).map(normalizeUrl)\n }\n\n function getAuthBaseUrl(env: Env): string {\n // entry.ts strips /api before delegating to the Hono app, so Better Auth\n // sees paths like /auth/. Its baseURL must be the origin only (no /api).\n const appUrl = getAppUrl(env)\n try {\n const parsed = new URL(appUrl)\n return `${parsed.protocol}//${parsed.host}`\n } catch {\n return appUrl\n }\n }\n\n function getPublicApiBaseUrl(env: Env): string {\n const candidate = env.API_BASE_URL?.trim() \|\| env.APP_URL?.trim() \|\| `${getAppUrl(env)}/api`\n const normalized = normalizeUrl(candidate)\n\n try {\n const parsed = new URL(normalized)\n if (parsed.pathname === \"/\" \|\| parsed.pathname === \"\") {\n parsed.pathname = \"/api\"\n return normalizeUrl(parsed.toString())\n }\n } catch {\n return normalized\n }\n\n return normalized\n }\n\n function getCloudAuthStartConfig(env: Env) {\n const deploymentId = env.VOYANT_CLOUD_DEPLOYMENT_ID?.trim()\n const cloudAuthStartUrl = env.VOYANT_CLOUD_ADMIN_AUTH_START_URL?.trim()\n if (!deploymentId \|\| !cloudAuthStartUrl) return null\n\n return {\n cloudAuthStartUrl,\n deploymentId,\n adminCallbackUrl: `${getPublicApiBaseUrl(env)}/auth/admin/cloud/callback`,\n cookieSecret: env.SESSION_CLAIMS_SECRET,\n appId: env.VOYANT_CLOUD_APP_ID?.trim() \|\| undefined,\n environment: env.VOYANT_CLOUD_ENVIRONMENT?.trim() \|\| undefined,\n }\n }\n\n function getCloudAuthExchangeConfig(env: Env) {\n const deploymentId = env.VOYANT_CLOUD_DEPLOYMENT_ID?.trim()\n const exchangeUrl = env.VOYANT_CLOUD_ADMIN_AUTH_EXCHANGE_URL?.trim()\n const assertionJwksUrl = env.VOYANT_CLOUD_ADMIN_AUTH_JWKS_URL?.trim()\n const clientToken = env.VOYANT_CLOUD_ADMIN_AUTH_CLIENT_TOKEN?.trim()\n if (!deploymentId \|\| !exchangeUrl \|\| !assertionJwksUrl \|\| !clientToken) return null\n\n return {\n exchangeUrl,\n deploymentId,\n clientToken,\n assertionJwksUrl,\n assertionAudience: env.VOYANT_CLOUD_ADMIN_AUTH_AUDIENCE?.trim() \|\| deploymentId,\n }\n }\n\n function getCloudAuthRevalidateConfig(env: Env) {\n const deploymentId = env.VOYANT_CLOUD_DEPLOYMENT_ID?.trim()\n const revalidateUrl = env.VOYANT_CLOUD_ADMIN_AUTH_REVALIDATE_URL?.trim()\n const clientToken = env.VOYANT_CLOUD_ADMIN_AUTH_CLIENT_TOKEN?.trim()\n if (!deploymentId \|\| !revalidateUrl \|\| !clientToken) return null\n\n return {\n revalidateUrl,\n deploymentId,\n clientToken,\n }\n }\n\n function isLocalRequest(request: Request): boolean {\n const hostname = new URL(request.url).hostname\n return hostname === \"127.0.0.1\" \|\| hostname === \"localhost\"\n }\n\n function shouldUseBrowserEvidenceAuthFallback(env: Env, request: Request): boolean {\n return env.VOYANT_OPERATOR_BROWSER_EVIDENCE === \"1\" && isLocalRequest(request)\n }\n\n function allowAuthSecretLogging(env: Env): boolean {\n return env.VOYANT_AUTH_LOG_SECRET_FALLBACKS === \"1\"\n }\n\n /*\n Build a Better Auth instance backed by a caller-provided drizzle\n * client. The caller owns the Pool lifecycle (open before, dispose\n * after) so the same Pool can serve both the auth lookup and any\n * subsequent queries the route does — without spinning up a second\n * connection per request.\n \n The deployment decides whether this is a request-scoped or resident Node\n * pool. The Better Auth instance is not cached independently of that owner.\n /\n function requireAdminAuthSecret(env: Env): string {\n const secret = env.BETTER_AUTH_ADMIN_SECRET?.trim() \|\| env.BETTER_AUTH_SECRET?.trim()\n if (!secret) throw new Error(\"Admin auth requires BETTER_AUTH_ADMIN_SECRET\")\n return secret\n }\n\n function requireCustomerAuthSecret(env: Env): string {\n const secret = env.BETTER_AUTH_CUSTOMER_SECRET?.trim()\n if (secret) return secret\n // Compatibility bridge for deployments created before realm-specific\n // secrets. The suffix gives the customer cookie an independent signature.\n return `${requireAdminAuthSecret(env)}:voyant-customer-realm`\n }\n\n function envEnabled(value: string \| undefined, fallback: boolean): boolean {\n const normalized = value?.trim().toLowerCase()\n if (!normalized) return fallback\n return normalized === \"1\" \|\| normalized === \"true\" \|\| normalized === \"yes\"\n }\n\n function parseCustomerAuthPolicy(env: Env): CustomerAuthPolicy {\n const fallback = {\n methods: {\n emailCode: envEnabled(env.VOYANT_CUSTOMER_AUTH_EMAIL_CODE, true),\n emailPassword: envEnabled(env.VOYANT_CUSTOMER_AUTH_EMAIL_PASSWORD, true),\n google: { enabled: false, credentialRef: null },\n facebook: { enabled: false, credentialRef: null },\n apple: { enabled: false, credentialRef: null },\n },\n } satisfies CustomerAuthPolicy\n const raw = env.VOYANT_CUSTOMER_AUTH_CONFIG_JSON?.trim()\n if (!raw) return fallback\n try {\n const parsed = JSON.parse(raw) as {\n methods?: Record<string, unknown>\n }\n const methods = parsed.methods ?? {}\n const social = (value: unknown): CustomerAuthSocialPolicy => {\n if (!value \|\| typeof value !== \"object\" \|\| Array.isArray(value)) {\n return { enabled: false, credentialRef: null }\n }\n const record = value as Record<string, unknown>\n return {\n enabled: record.enabled === true,\n credentialRef:\n typeof record.credentialRef === \"string\" && record.credentialRef.trim()\n ? record.credentialRef.trim()\n : null,\n }\n }\n return {\n methods: {\n emailCode:\n typeof methods.emailCode === \"boolean\" ? methods.emailCode : fallback.methods.emailCode,\n emailPassword:\n typeof methods.emailPassword === \"boolean\"\n ? methods.emailPassword\n : fallback.methods.emailPassword,\n google: social(methods.google),\n facebook: social(methods.facebook),\n apple: social(methods.apple),\n },\n }\n } catch {\n console.error(\n \"[auth/customer] Invalid VOYANT_CUSTOMER_AUTH_CONFIG_JSON; failing social auth closed\",\n )\n return fallback\n }\n }\n\n function defaultCustomerAuthContext(\n env: Env,\n policy: CustomerAuthPolicy,\n ): CustomerAuthRuntimeContext {\n const hasCanonicalPolicy = Boolean(env.VOYANT_CUSTOMER_AUTH_CONFIG_JSON?.trim())\n const google = Boolean(\n env.CUSTOMER_AUTH_GOOGLE_CLIENT_ID?.trim() &&\n env.CUSTOMER_AUTH_GOOGLE_CLIENT_SECRET?.trim() &&\n (!hasCanonicalPolicy \|\| policy.methods.google.enabled),\n )\n const facebook = Boolean(\n env.CUSTOMER_AUTH_FACEBOOK_CLIENT_ID?.trim() &&\n env.CUSTOMER_AUTH_FACEBOOK_CLIENT_SECRET?.trim() &&\n (!hasCanonicalPolicy \|\| policy.methods.facebook.enabled),\n )\n const apple = Boolean(\n env.CUSTOMER_AUTH_APPLE_CLIENT_ID?.trim() &&\n env.CUSTOMER_AUTH_APPLE_CLIENT_SECRET?.trim() &&\n (!hasCanonicalPolicy \|\| policy.methods.apple.enabled),\n )\n return {\n baseURL: getAuthBaseUrl(env),\n trustedOrigins: getTrustedOrigins(env),\n methods: {\n emailCode: policy.methods.emailCode,\n emailPassword: policy.methods.emailPassword,\n socialProviders: {\n ...(google\n ? {\n google: {\n clientId: env.CUSTOMER_AUTH_GOOGLE_CLIENT_ID!.trim(),\n clientSecret: env.CUSTOMER_AUTH_GOOGLE_CLIENT_SECRET!.trim(),\n },\n }\n : {}),\n ...(facebook\n ? {\n facebook: {\n clientId: env.CUSTOMER_AUTH_FACEBOOK_CLIENT_ID!.trim(),\n clientSecret: env.CUSTOMER_AUTH_FACEBOOK_CLIENT_SECRET!.trim(),\n },\n }\n : {}),\n ...(apple\n ? {\n apple: {\n clientId: env.CUSTOMER_AUTH_APPLE_CLIENT_ID!.trim(),\n clientSecret: env.CUSTOMER_AUTH_APPLE_CLIENT_SECRET!.trim(),\n },\n }\n : {}),\n },\n },\n }\n }\n\n function resolveCustomerAuthContext(env: Env, request: Request): CustomerAuthRuntimeContext {\n const policy = parseCustomerAuthPolicy(env)\n return (\n runtimeOptions.resolveCustomerAuthContext?.(env, policy, request) ??\n defaultCustomerAuthContext(env, policy)\n )\n }\n\n function publicCustomerAuthConfiguration(env: Env, request: Request) {\n const methods = resolveCustomerAuthContext(env, request).methods\n const providers = methods.socialProviders ?? {}\n return {\n methods: {\n emailCode: methods.emailCode ?? true,\n emailPassword: methods.emailPassword ?? true,\n google: Boolean(providers.google),\n facebook: Boolean(providers.facebook),\n apple: Boolean(providers.apple),\n },\n }\n }\n\n function buildAdminBetterAuth(env: Env, db: VoyantDb) {\n const emailSender = runtimeOptions.resolveEmailSender?.(env)\n const cloudAuthExchange = isVoyantCloudAuthMode(env) ? getCloudAuthExchangeConfig(env) : null\n const authDb = db as NonNullable<Parameters<typeof createAdminBetterAuth>[0]>[\"db\"]\n const cloudAuthDb = db as Parameters<typeof createVoyantCloudAdminAuthPlugin>[0][\"db\"]\n\n return createAdminBetterAuth({\n // `db` is a `NeonDatabase` (neon-serverless WebSocket); the\n // `CreateBetterAuthOptions.db` type still references the older\n // `getDb` return union (postgres-js + neon-http). Drizzle's\n // PgDatabase surface is identical across flavors at runtime, so\n // the cast is structurally safe — better-auth's drizzleAdapter\n // works on any PgDatabase. See #500 for context.\n db: authDb,\n secret: requireAdminAuthSecret(env),\n baseURL: getAuthBaseUrl(env),\n basePath: \"/auth/admin\",\n trustedOrigins: getTrustedOrigins(env),\n advanced: (runtimeOptions.cookieAdvanced ?? buildBetterAuthCookieAdvancedOptions)(env),\n plugins: cloudAuthExchange\n ? [\n createVoyantCloudAdminAuthPlugin({\n db: cloudAuthDb,\n cookieSecret: env.SESSION_CLAIMS_SECRET,\n exchange: cloudAuthExchange,\n }),\n ]\n : undefined,\n sendResetPassword: async ({ user, url }) => {\n if (!emailSender) {\n // No email provider (e.g. local dev without a sending domain): with the\n // debug flag on, log the link to the console instead of sending;\n // otherwise fail loudly. Never bypasses a configured cloud sender.\n if (allowAuthSecretLogging(env)) {\n console.info(`[auth] reset-password (debug fallback) -> ${user.email}: ${url}`)\n return\n }\n throw new Error(\"Password reset email provider is not configured\")\n }\n await emailSender.sendResetPassword({ user, url })\n },\n sendVerificationOTP: async ({ email, otp, type }) => {\n if (!emailSender) {\n // No email provider (e.g. local dev without a sending domain): with the\n // debug flag on, log the OTP to the console instead of sending;\n // otherwise fail loudly. Never bypasses a configured cloud sender.\n if (allowAuthSecretLogging(env)) {\n console.info(`[auth] verification-otp (debug fallback) [${type}] -> ${email}: ${otp}`)\n return\n }\n throw new Error(\"Verification OTP email provider is not configured\")\n }\n await emailSender.sendVerificationOtp({ email, otp, type })\n },\n })\n }\n\n function buildCustomerBetterAuth(env: Env, db: VoyantDb, request: Request) {\n const emailSender = runtimeOptions.resolveEmailSender?.(env)\n const context = resolveCustomerAuthContext(env, request)\n const authDb = db as NonNullable<Parameters<typeof createCustomerBetterAuth>[0]>[\"db\"]\n return createCustomerBetterAuth({\n db: authDb,\n secret: requireCustomerAuthSecret(env),\n baseURL: context.baseURL,\n basePath: \"/auth/customer\",\n trustedOrigins: context.trustedOrigins,\n methods: withCustomerSocialRedirectUris(context.methods, getPublicApiBaseUrl(env)),\n sendResetPassword: async ({ user, url }) => {\n if (!emailSender) {\n if (allowAuthSecretLogging(env)) {\n console.info(`[auth/customer] reset-password (debug fallback) -> ${user.email}: ${url}`)\n return\n }\n throw new Error(\"Password reset email provider is not configured\")\n }\n await emailSender.sendResetPassword({ user, url })\n },\n sendVerificationOTP: async ({ email, otp, type }) => {\n if (!emailSender) {\n if (allowAuthSecretLogging(env)) {\n console.info(\n `[auth/customer] verification-otp (debug fallback) [${type}] -> ${email}: ${otp}`,\n )\n return\n }\n throw new Error(\"Verification OTP email provider is not configured\")\n }\n await emailSender.sendVerificationOtp({ email, otp, type })\n },\n })\n }\n\n function rewriteLegacyAdminAuthRequest(request: Request): Request {\n const url = new URL(request.url)\n url.pathname = url.pathname.replace(\"/auth\", \"/auth/admin\")\n return new Request(url, request)\n }\n\n const FULL_ACCESS_SCOPES = [\"\"]\n\n function scopesForOperatorRole(role: string \| null \| undefined): string[] \| null {\n const base = accessCatalogScopesForRole(role, runtimeOptions.accessCatalog)\n if (!base) return null\n const normalizedRole = (role ?? \"\").trim().toLowerCase()\n const presetId =\n normalizedRole === \"member\"\n ? \"editor\"\n : normalizedRole === \"guest\"\n ? \"viewer\"\n : normalizedRole\n const selected = runtimeOptions.accessCatalog.presets.find(\n (preset) => preset.kind === \"staff\" && preset.id === presetId,\n )\n return [...new Set([...base, ...(selected?.grants ?? [])])].sort()\n }\n\n /*\n Resolve a member's RBAC scope set for the request (`resource:action` strings,\n * shared with API keys — see @voyant-travel/types/member-roles, RFC voyant#2085).\n \n Phase 1: storage + seam are wired but default to full access, so behavior is\n * unchanged until an admin assigns permissions (Phase 2) and routes gate on them\n * (Phase 3).\n * - voyant-cloud: assertion-mirrored `cloud_auth_user_links.scopes` if the\n * platform sent them, else the role bundle for `roleSlug`, else full access.\n * - local: the member's `user_profiles.permissions` if assigned, else full\n * access (no local role concept yet).\n /\n async function resolveMemberScopes(db: VoyantDb, env: Env, userId: string): Promise<string[]> {\n if (isVoyantCloudAuthMode(env)) {\n const [link] = await db\n .select({ scopes: cloudAuthUserLinks.scopes, roleSlug: cloudAuthUserLinks.roleSlug })\n .from(cloudAuthUserLinks)\n .where(eq(cloudAuthUserLinks.userId, userId))\n .limit(1)\n const fullAccessScopes = scopesForOperatorRole(\"admin\") ?? FULL_ACCESS_SCOPES\n const roleScopes = scopesForOperatorRole(link?.roleSlug) ?? fullAccessScopes\n return isFullAccessRole(link?.roleSlug) ? roleScopes : (link?.scopes ?? roleScopes)\n }\n\n const [profile] = await db\n .select({ permissions: userProfilesTable.permissions })\n .from(userProfilesTable)\n .where(eq(userProfilesTable.id, userId))\n .limit(1)\n return profile?.permissions ?? FULL_ACCESS_SCOPES\n }\n\n async function resolveAuthRequest(\n request: Request,\n env: Env,\n ): Promise<VoyantRequestAuthContext \| null> {\n const { db, dispose } = openDatabase(env)\n try {\n const customerSurface = new URL(request.url).pathname.includes(\"/v1/public/\")\n const auth = customerSurface\n ? buildCustomerBetterAuth(env, db, request)\n : buildAdminBetterAuth(env, db)\n const session = await auth.api.getSession({ headers: request.headers })\n\n if (!session) {\n return null\n }\n\n if (!customerSurface && isVoyantCloudAuthMode(env)) {\n const revalidateConfig = getCloudAuthRevalidateConfig(env)\n if (!revalidateConfig) {\n return null\n }\n\n try {\n const revalidation = await revalidateVoyantCloudAdminAuthSession({\n db: db as Parameters<typeof revalidateVoyantCloudAdminAuthSession>[0][\"db\"],\n sessionId: session.session.id,\n config: revalidateConfig,\n })\n\n if (!revalidation.ok) {\n return null\n }\n } catch (error) {\n console.error(\"[auth/session] Cloud revalidation failed:\", error)\n return null\n }\n }\n\n if (customerSurface) {\n return {\n userId: session.user.id,\n sessionId: session.session.id,\n organizationId: null,\n callerType: \"session\",\n actor: \"customer\",\n realm: \"customer\",\n scopes: [],\n email: session.user.email ?? null,\n }\n }\n\n return {\n userId: session.user.id,\n sessionId: session.session.id,\n organizationId: null,\n callerType: \"session\",\n actor: \"staff\",\n realm: \"admin\",\n // Member RBAC scope set (RFC voyant#2085). Defaults to full access until\n // an admin assigns permissions, so existing deployments are unchanged.\n // `actor: \"staff\"` is retained, so actor-gated paths (incl. the\n // bookings-pii reveal, which short-circuits on staff) are unaffected.\n scopes: await resolveMemberScopes(db, env, session.user.id),\n email: session.user.email ?? null,\n }\n } finally {\n // No `executionCtx` reachable here (called from middleware that\n // doesn't pass one through). Await inline so the WebSocket closes\n // before this fn returns.\n await dispose()\n }\n }\n\n /\n Single-tenant: every authenticated session is a staff user with full access.\n * When `resolveAuthRequest` has already granted a session, permissions are\n * implicitly allowed. If you need granular RBAC later, switch on\n * `user_profiles.isSuperAdmin` / `isSupportUser` here.\n /\n async function hasAuthPermission(request: Request, env: Env): Promise<boolean> {\n const auth = await resolveAuthRequest(request, env)\n return auth !== null\n }\n\n class CurrentUserNotFoundError extends Error {\n constructor() {\n super(\"User not found\")\n this.name = \"CurrentUserNotFoundError\"\n }\n }\n\n async function getCurrentUserForRequest(\n request: Request,\n env: Env,\n ): Promise<OperatorCurrentUser \| null> {\n if (shouldUseBrowserEvidenceAuthFallback(env, request)) {\n return null\n }\n\n const { db, dispose } = openDatabase(env)\n try {\n const betterAuth = buildAdminBetterAuth(env, db)\n const session = await betterAuth.api.getSession({ headers: request.headers })\n if (!session) {\n return null\n }\n\n const [row] = await db\n .select({\n id: authUser.id,\n email: authUser.email,\n createdAt: authUser.createdAt,\n firstName: userProfilesTable.firstName,\n lastName: userProfilesTable.lastName,\n locale: userProfilesTable.locale,\n timezone: userProfilesTable.timezone,\n uiPrefs: userProfilesTable.uiPrefs,\n avatarUrl: userProfilesTable.avatarUrl,\n isSuperAdmin: userProfilesTable.isSuperAdmin,\n isSupportUser: userProfilesTable.isSupportUser,\n })\n .from(authUser)\n .leftJoin(userProfilesTable, eq(userProfilesTable.id, authUser.id))\n .where(eq(authUser.id, session.user.id))\n .limit(1)\n\n if (!row) {\n throw new CurrentUserNotFoundError()\n }\n\n return {\n id: row.id,\n email: row.email ?? session.user.email ?? \"\",\n firstName: row.firstName ?? null,\n lastName: row.lastName ?? null,\n locale: row.locale ?? \"en\",\n timezone: row.timezone ?? null,\n uiPrefs: row.uiPrefs ?? null,\n isSuperAdmin: row.isSuperAdmin ?? false,\n isSupportUser: row.isSupportUser ?? false,\n createdAt: row.createdAt?.toISOString() ?? new Date().toISOString(),\n profilePictureUrl: row.avatarUrl ?? null,\n }\n } finally {\n await dispose()\n }\n }\n\n async function getBootstrapStatusForRequest(\n request: Request,\n env: Env,\n ): Promise<OperatorAuthBootstrapStatus> {\n if (shouldUseBrowserEvidenceAuthFallback(env, request)) {\n return { hasUsers: true }\n }\n\n if (isVoyantCloudAuthMode(env)) {\n return { hasUsers: true, authMode: \"voyant-cloud\" }\n }\n\n const { db, dispose } = openDatabase(env)\n try {\n const [row] = await db.select({ count: sql<number>`count()::int` }).from(authUser)\n return { hasUsers: (row?.count ?? 0) > 0, authMode: \"local\" }\n } finally {\n await dispose()\n }\n }\n\n async function validateApiTokenAccess(\n env: Env,\n db: VoyantDb,\n apiKey: SelectApikey,\n ): Promise<boolean> {\n if (!isVoyantCloudAuthMode(env)) return true\n\n const revalidateConfig = getCloudAuthRevalidateConfig(env)\n if (!revalidateConfig) return false\n\n try {\n const revalidation = await revalidateVoyantCloudAdminAuthUser({\n db: db as Parameters<typeof revalidateVoyantCloudAdminAuthUser>[0][\"db\"],\n userId: apiKey.referenceId,\n config: revalidateConfig,\n })\n return revalidation.ok\n } catch (error) {\n console.error(\"[auth/api-token] Cloud revalidation failed:\", error)\n return false\n }\n }\n\n /*\n GET /auth/me\n * Returns the current authenticated user's profile.\n * Validates the session cookie directly (no Bearer token needed).\n /\n auth.get(\"/auth/me\", async (c) => {\n try {\n const currentUser = await getCurrentUserForRequest(c.req.raw, c.env)\n if (!currentUser) {\n return c.json({ error: \"Unauthorized\" }, 401)\n }\n return c.json(currentUser)\n } catch (error) {\n if (error instanceof CurrentUserNotFoundError) {\n return c.json({ error: \"User not found\" }, 404)\n }\n throw error\n }\n })\n\n /\n GET /auth/status\n * Ensures the authenticated user has a user_profiles row.\n * Profile is normally created by the BA databaseHook on sign-up,\n * but this route serves as an idempotent fallback.\n /\n auth.get(\"/auth/status\", async (c) => {\n // See `/auth/me` above — auth sub-app runs before the request `db`\n // middleware, so own the Pool here.\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildAdminBetterAuth(c.env, db)\n const session = await betterAuth.api.getSession({ headers: c.req.raw.headers })\n if (!session) {\n return c.json({ userExists: false, authenticated: false })\n }\n\n const userId = session.user.id\n\n const status = await ensureCurrentUserProfile(\n db as Parameters<typeof ensureCurrentUserProfile>[0],\n userId,\n )\n if (!status.userExists && status.authenticated) {\n console.error(\"[auth/status] Error:\", status.reason)\n return c.json(status, 500)\n }\n\n return c.json(status)\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n /\n GET /auth/bootstrap-status\n * Public endpoint — reveals whether any user exists. Used by the sign-in /\n * sign-up route loaders to pick the right flow.\n /\n auth.get(\"/auth/bootstrap-status\", async (c) => {\n return c.json(await getBootstrapStatusForRequest(c.req.raw, c.env))\n })\n\n async function handleApiTokensFacade(c: Context<AuthHonoEnv>) {\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildAdminBetterAuth(c.env, db)\n const cloudAuthDb = db as Parameters<typeof revalidateVoyantCloudAdminAuthSession>[0][\"db\"]\n\n if (isVoyantCloudAuthMode(c.env)) {\n const revalidateConfig = getCloudAuthRevalidateConfig(c.env)\n if (!revalidateConfig) {\n return c.json(\n { error: \"Cloud-mode API token management requires membership revalidation\" },\n 501,\n )\n }\n\n const session = await betterAuth.api.getSession({ headers: c.req.raw.headers })\n if (!session) {\n return c.json({ error: \"Unauthorized\" }, 401)\n }\n\n try {\n const revalidation = await revalidateVoyantCloudAdminAuthSession({\n db: cloudAuthDb,\n sessionId: session.session.id,\n config: revalidateConfig,\n })\n\n if (!revalidation.ok) {\n return c.json({ error: \"Voyant Cloud access revoked\" }, 403)\n }\n } catch (error) {\n console.error(\"[auth/api-tokens] Cloud revalidation failed:\", error)\n return c.json({ error: \"Voyant Cloud access could not be revalidated\" }, 503)\n }\n }\n\n return (\n (await handleApiTokenManagementRequest(c.req.raw, betterAuth, {\n db,\n accessCatalog: runtimeOptions.accessCatalog,\n })) ?? c.json({ error: \"Not found\" }, 404)\n )\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n }\n\n async function handleOrganizationMembersFacade(c: Context<AuthHonoEnv>) {\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildAdminBetterAuth(c.env, db)\n const cloudAuthDb = db as Parameters<typeof revalidateVoyantCloudAdminAuthSession>[0][\"db\"]\n\n if (isVoyantCloudAuthMode(c.env)) {\n const revalidateConfig = getCloudAuthRevalidateConfig(c.env)\n if (!revalidateConfig) {\n return c.json(\n { error: \"Cloud-mode organization member lookup requires membership revalidation\" },\n 501,\n )\n }\n\n const session = await betterAuth.api.getSession({ headers: c.req.raw.headers })\n if (!session) {\n return c.json({ error: \"Unauthorized\" }, 401)\n }\n\n try {\n const revalidation = await revalidateVoyantCloudAdminAuthSession({\n db: cloudAuthDb,\n sessionId: session.session.id,\n config: revalidateConfig,\n })\n\n if (!revalidation.ok) {\n return c.json({ error: \"Voyant Cloud access revoked\" }, 403)\n }\n } catch (error) {\n console.error(\"[auth/organization-members] Cloud revalidation failed:\", error)\n return c.json({ error: \"Voyant Cloud access could not be revalidated\" }, 503)\n }\n }\n\n const organizationMembersDb = db as Parameters<\n typeof handleOrganizationMembersRequest\n >[2][\"db\"]\n return (\n (await handleOrganizationMembersRequest(c.req.raw, betterAuth, {\n db: organizationMembersDb,\n })) ?? c.json({ error: \"Not found\" }, 404)\n )\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n }\n\n async function handleCloudAuthStart(c: Context<AuthHonoEnv>) {\n if (!isVoyantCloudAuthMode(c.env)) {\n return c.json({ error: \"Not found\" }, 404)\n }\n\n const config = getCloudAuthStartConfig(c.env)\n if (!config) {\n return cloudAuthNotConfiguredResponse(c)\n }\n\n try {\n const start = await createCloudAdminAuthStart({\n requestUrl: c.req.url,\n next: c.req.query(\"next\"),\n config,\n })\n return new Response(null, {\n status: 302,\n headers: {\n Location: start.redirectUrl,\n \"Set-Cookie\": start.setCookie,\n },\n })\n } catch (error) {\n console.error(\"[auth/cloud/start] Error:\", error)\n return c.json({ error: \"Voyant Cloud auth broker is misconfigured\" }, 500)\n }\n }\n\n async function handleCloudAuthCallback(c: Context<AuthHonoEnv>) {\n if (!isVoyantCloudAuthMode(c.env)) {\n return c.json({ error: \"Not found\" }, 404)\n }\n\n const exchangeConfig = getCloudAuthExchangeConfig(c.env)\n if (!exchangeConfig) {\n const url = new URL(c.req.url)\n return c.json({ error: \"Voyant Cloud auth exchange is not configured yet\" }, 501, {\n \"Set-Cookie\": buildClearCloudAdminAuthStateCookie(\n url.protocol === \"https:\",\n url.pathname.replace(/\\/callback$/, \"\") \|\| \"/auth/cloud\",\n ),\n })\n }\n\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildAdminBetterAuth(c.env, db)\n const request = c.req.path.startsWith(\"/auth/admin/\")\n ? c.req.raw\n : rewriteLegacyAdminAuthRequest(c.req.raw)\n return await betterAuth.handler(request)\n } catch (error) {\n console.error(\"[auth/cloud/callback] Error:\", error)\n return c.json({ error: \"Voyant Cloud auth callback failed\" }, 500)\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n }\n\n auth.get(\"/auth/admin/cloud/start\", handleCloudAuthStart)\n auth.get(\"/auth/admin/cloud/callback\", handleCloudAuthCallback)\n /* @deprecated Use /auth/admin/cloud/. /\n auth.get(\"/auth/cloud/start\", handleCloudAuthStart)\n auth.get(\"/auth/cloud/callback\", handleCloudAuthCallback)\n\n auth.all(\"/auth/api-tokens\", handleApiTokensFacade)\n auth.all(\"/auth/api-tokens/:keyId\", handleApiTokensFacade)\n auth.all(\"/auth/api-tokens/:keyId/rotate\", handleApiTokensFacade)\n auth.get(\"/auth/organization/list-members\", handleOrganizationMembersFacade)\n\n auth.get(\"/auth/customer/status\", async (c) => {\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildCustomerBetterAuth(c.env, db, c.req.raw)\n const session = await betterAuth.api.getSession({ headers: c.req.raw.headers })\n return c.json({ authenticated: Boolean(session) })\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n auth.get(\"/auth/customer/config\", (c) => {\n if (c.env.VOYANT_CUSTOMER_AUTH_MODE?.trim() === \"disabled\") {\n return c.json({\n methods: {\n emailCode: false,\n emailPassword: false,\n google: false,\n facebook: false,\n apple: false,\n },\n })\n }\n return c.json(publicCustomerAuthConfiguration(c.env, c.req.raw))\n })\n\n auth.all(\"/auth/customer/\", async (c) => {\n if (c.env.VOYANT_CUSTOMER_AUTH_MODE?.trim() === \"disabled\") {\n return c.json({ error: \"Customer auth is disabled\" }, 404)\n }\n\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildCustomerBetterAuth(c.env, db, c.req.raw)\n return await betterAuth.handler(c.req.raw)\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n /\n Catch-all: delegate to Better Auth handler.\n * Handles sign-in, sign-up, sign-out, password reset, OAuth callbacks, etc.\n \n Sign-up is gated by a `user.create.before` hook in @voyant-travel/auth — once a\n * user exists, the hook throws and BA returns an error to the client.\n /\n auth.all(\"/auth/admin/\", async (c) => {\n if (isVoyantCloudAuthMode(c.env) && !isCloudAllowedBetterAuthRoute(c.req.raw)) {\n return localAuthDisabledResponse(c)\n }\n\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildAdminBetterAuth(c.env, db)\n return await betterAuth.handler(c.req.raw)\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n /** @deprecated Admin Better Auth routes moved to /auth/admin/. /\n auth.all(\"/auth/*\", async (c) => {\n const rewritten = rewriteLegacyAdminAuthRequest(c.req.raw)\n if (isVoyantCloudAuthMode(c.env) && !isCloudAllowedBetterAuthRoute(rewritten)) {\n return localAuthDisabledResponse(c)\n }\n const { db, dispose } = openDatabase(c.env)\n try {\n return await buildAdminBetterAuth(c.env, db).handler(rewritten)\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n return {\n handler: auth,\n getBootstrapStatusForRequest,\n getCurrentUserForRequest,\n hasAuthPermission,\n resolveAuthRequest,\n validateApiTokenAccess,\n }\n}\n"]}

package/dist/runtime-contributor.js CHANGED Viewed

@@ -4,14 +4,18 @@ import { createCloudTeamManagementAdapter } from "./team-management-cloud-adapte
 import { createLocalTeamManagementAdapter } from "./team-management-local-adapter.js";
 import { createGuardedTeamManagementProvider } from "./team-management-policy.js";
 import { teamManagementRuntimePort } from "./team-management-runtime-port.js";
+function selectedAdminAuthProvider(host, bindings) {
+    return (host.primitives.config.read(bindings, "deployment.providers.adminAuth") ??
+        host.primitives.config.read(bindings, "deployment.providers.auth"));
+}
 /** Package-owned registration map for Auth deployment adapters. */
 export function createAuthRuntimePortContribution(host) {
     const identityAccess = {
         resolveDeployment(bindings) {
             const env = bindings;
-            const selectedAuthProvider = host.primitives.config.read(bindings, "deployment.providers.auth");
+            const selectedAuthProvider = selectedAdminAuthProvider(host, bindings);
             if (selectedAuthProvider !== "better-auth" && selectedAuthProvider !== "voyant-cloud") {
-                throw new Error("Auth runtime requires deployment.providers.auth to select better-auth or voyant-cloud.");
+                throw new Error("Auth runtime requires deployment.providers.adminAuth to select better-auth or voyant-cloud.");
             }
             const appUrl = (env.APP_URL || env.DASH_BASE_URL || "http://localhost:3300")
                 .trim()
@@ -54,12 +58,12 @@ export function createAuthRuntimePortContribution(host) {
     const localTeamManagement = createLocalTeamManagementAdapter(identityAccess);
     const cloudTeamManagement = createCloudTeamManagementAdapter(identityAccess);
     const teamManagement = createGuardedTeamManagementProvider((context) => {
-        const selectedAuthProvider = host.primitives.config.read(context.bindings, "deployment.providers.auth");
+        const selectedAuthProvider = selectedAdminAuthProvider(host, context.bindings);
         if (selectedAuthProvider === "better-auth")
             return localTeamManagement;
         if (selectedAuthProvider === "voyant-cloud")
             return cloudTeamManagement;
-        throw new Error("Team management requires deployment.providers.auth to select better-auth or voyant-cloud.");
+        throw new Error("Team management requires deployment.providers.adminAuth to select better-auth or voyant-cloud.");
     });
     return {
         [identityAccessRuntimePort.id]: identityAccess,

package/dist/runtime-contributor.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"runtime-contributor.js","sourceRoot":"","sources":["../src/runtime-contributor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qCAAqC,EAAE,MAAM,mBAAmB,CAAA;AACzE,OAAO,EAEL,yBAAyB,GAC1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAA;AACrF,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAA;AACrF,OAAO,EAAE,mCAAmC,EAAE,MAAM,6BAA6B,CAAA;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAiB7E,mEAAmE;AACnE,MAAM,UAAU,iCAAiC,CAC/C,IAAgC;IAEhC,MAAM,cAAc,GAAkC;QACpD,iBAAiB,CAAC,QAAQ;YACxB,MAAM,GAAG,GAAG,QAA8C,CAAA;YAC1D,MAAM,oBAAoB,GAAG,~~IAAI~~,CAAC,~~UAAU,CAAC,MAAM,CAAC,~~IAAI,~~CACtD~~,QAAQ,~~EACR~~,~~2BAA2B,CAC5B,~~CAAA;~~YACD~~,IAAI,oBAAoB,KAAK,aAAa,IAAI,oBAAoB,KAAK,cAAc,EAAE,CAAC;gBACtF,MAAM,IAAI,KAAK,CACb,~~wFAAwF~~,~~CACzF~~,CAAA;YACH,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,aAAa,IAAI,uBAAuB,CAAC;iBACzE,IAAI,EAAE;iBACN,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACrB,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAA;YAC3D,MAAM,aAAa,GAAG,GAAG,CAAC,sCAAsC,EAAE,IAAI,EAAE,CAAA;YACxE,MAAM,WAAW,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAA;YACpE,OAAO;gBACL,MAAM;gBACN,QAAQ,EAAE,oBAAoB,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;gBAC5E,iBAAiB,EACf,YAAY,IAAI,aAAa,IAAI,WAAW;oBAC1C,CAAC,CAAC,qCAAqC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;oBACrF,CAAC,CAAC,IAAI;aACX,CAAA;QACH,CAAC;QACD,KAAK,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO;YACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAA;YAC/E,MAAM,SAAS,GACb,OAAO,QAAQ,KAAK,UAAU;gBAC5B,CAAC,CAAE,QAAQ,CACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CACoB;gBACrD,CAAC,CAAC,EAAE,CAAA;YACR,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;YACpF,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAA;YAC3B,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,IAAI,CAAC;oBAClB,OAAO,EAAE,OAAO;oBAChB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,+BAA+B;oBACxC,IAAI,EAAE,qEAAqE,OAAO,CAAC,SAAS,qDAAqD,OAAO,CAAC,cAAc,aAAa;iBACrL,CAAC,CAAA;gBACF,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAA;gBACxD,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;KACF,CAAA;IAED,MAAM,mBAAmB,GAAG,gCAAgC,CAAC,cAAc,CAAC,CAAA;IAC5E,MAAM,mBAAmB,GAAG,gCAAgC,CAAC,cAAc,CAAC,CAAA;IAC5E,MAAM,cAAc,GAAG,mCAAmC,CAAC,CAAC,OAAO,EAAE,EAAE;QACrE,MAAM,oBAAoB,GAAG,~~IAAI~~,CAAC,~~UAAU,CAAC,MAAM,CAAC,~~IAAI,~~CACtD~~,OAAO,CAAC,QAAQ,~~EAChB~~,~~2BAA2B,CAC5B,~~CAAA;~~QACD~~,IAAI,oBAAoB,KAAK,aAAa;YAAE,OAAO,mBAAmB,CAAA;QACtE,IAAI,oBAAoB,KAAK,cAAc;YAAE,OAAO,mBAAmB,CAAA;QACvE,MAAM,IAAI,KAAK,CACb,~~2FAA2F~~,~~CAC5F~~,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,cAAc;QAC9C,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,cAAc;KAC/C,CAAA;AACH,CAAC","sourcesContent":["import type { VoyantRuntimeHostPrimitives } from \"@voyant-travel/core\"\nimport { cloudAdminMembersConfigFromRevalidate } from \"./cloud-broker.js\"\nimport {\n type IdentityAccessRuntimeProvider,\n identityAccessRuntimePort,\n} from \"./identity-access-runtime-port.js\"\nimport { createCloudTeamManagementAdapter } from \"./team-management-cloud-adapter.js\"\nimport { createLocalTeamManagementAdapter } from \"./team-management-local-adapter.js\"\nimport { createGuardedTeamManagementProvider } from \"./team-management-policy.js\"\nimport { teamManagementRuntimePort } from \"./team-management-runtime-port.js\"\n\ninterface InvitationNotificationProvider {\n readonly channels: ReadonlyArray<string>\n send(payload: {\n channel: \"email\"\n to: string\n template: string\n subject: string\n html: string\n }): Promise<unknown>\n}\n\nexport interface AuthRuntimeContributorHost {\n primitives: VoyantRuntimeHostPrimitives\n}\n\n/** Package-owned registration map for Auth deployment adapters. */\nexport function createAuthRuntimePortContribution(\n host: AuthRuntimeContributorHost,\n): Readonly<Record<string, unknown>> {\n const identityAccess: IdentityAccessRuntimeProvider = {\n resolveDeployment(bindings) {\n const env = bindings as Record<string, string \| undefined>\n const selectedAuthProvider = host~~.primitives.config.read(\n~~ bindings~~,\n \"deployment.providers.auth\",\n~~ )\n if (selectedAuthProvider !== \"better-auth\" && selectedAuthProvider !== \"voyant-cloud\") {\n throw new Error(\n \"Auth runtime requires deployment.providers.~~auth~~ to select better-auth or voyant-cloud.\",\n )\n }\n const appUrl = (env.APP_URL \|\| env.DASH_BASE_URL \|\| \"http://localhost:3300\")\n .trim()\n .replace(/\\/$/, \"\")\n const deploymentId = env.VOYANT_CLOUD_DEPLOYMENT_ID?.trim()\n const revalidateUrl = env.VOYANT_CLOUD_ADMIN_AUTH_REVALIDATE_URL?.trim()\n const clientToken = env.VOYANT_CLOUD_ADMIN_AUTH_CLIENT_TOKEN?.trim()\n return {\n appUrl,\n authMode: selectedAuthProvider === \"voyant-cloud\" ? \"voyant-cloud\" : \"local\",\n cloudAdminMembers:\n deploymentId && revalidateUrl && clientToken\n ? cloudAdminMembersConfigFromRevalidate({ revalidateUrl, deploymentId, clientToken })\n : null,\n }\n },\n async sendInvitationEmail(bindings, message) {\n const resolver = host.primitives.config.read(bindings, \"notificationProviders\")\n const providers =\n typeof resolver === \"function\"\n ? (resolver(\n host.primitives.env(bindings),\n ) as ReadonlyArray<InvitationNotificationProvider>)\n : []\n const provider = providers.find((candidate) => candidate.channels.includes(\"email\"))\n if (!provider) return false\n try {\n await provider.send({\n channel: \"email\",\n to: message.to,\n template: \"auth.invitation\",\n subject: \"You've been invited to Voyant\",\n html: `<p>You've been invited to join a Voyant workspace.</p><p><a href=\"${message.acceptUrl}\">Accept invitation</a></p><p>The link expires in ${message.expiresInHours} hours.</p>`,\n })\n return true\n } catch (error) {\n console.error(\"[invitations] email send failed:\", error)\n return false\n }\n },\n }\n\n const localTeamManagement = createLocalTeamManagementAdapter(identityAccess)\n const cloudTeamManagement = createCloudTeamManagementAdapter(identityAccess)\n const teamManagement = createGuardedTeamManagementProvider((context) => {\n const selectedAuthProvider = host~~.primitives.config.read(\n~~ context.bindings~~,\n \"deployment.providers.auth\",\n~~ )\n if (selectedAuthProvider === \"better-auth\") return localTeamManagement\n if (selectedAuthProvider === \"voyant-cloud\") return cloudTeamManagement\n throw new Error(\n \"Team management requires deployment.providers.~~auth~~ to select better-auth or voyant-cloud.\",\n )\n })\n\n return {\n [identityAccessRuntimePort.id]: identityAccess,\n [teamManagementRuntimePort.id]: teamManagement,\n }\n}\n"]}
1	+ {"version":3,"file":"runtime-contributor.js","sourceRoot":"","sources":["../src/runtime-contributor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qCAAqC,EAAE,MAAM,mBAAmB,CAAA;AACzE,OAAO,EAEL,yBAAyB,GAC1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAA;AACrF,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAA;AACrF,OAAO,EAAE,mCAAmC,EAAE,MAAM,6BAA6B,CAAA;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAiB7E,SAAS,yBAAyB,CAAC,IAAgC,EAAE,QAAiB;IACpF,OAAO,CACL,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,gCAAgC,CAAC;QACvE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CACnE,CAAA;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,iCAAiC,CAC/C,IAAgC;IAEhC,MAAM,cAAc,GAAkC;QACpD,iBAAiB,CAAC,QAAQ;YACxB,MAAM,GAAG,GAAG,QAA8C,CAAA;YAC1D,MAAM,oBAAoB,GAAG,yBAAyB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YACtE,IAAI,oBAAoB,KAAK,aAAa,IAAI,oBAAoB,KAAK,cAAc,EAAE,CAAC;gBACtF,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAA;YACH,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,aAAa,IAAI,uBAAuB,CAAC;iBACzE,IAAI,EAAE;iBACN,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACrB,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAA;YAC3D,MAAM,aAAa,GAAG,GAAG,CAAC,sCAAsC,EAAE,IAAI,EAAE,CAAA;YACxE,MAAM,WAAW,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAA;YACpE,OAAO;gBACL,MAAM;gBACN,QAAQ,EAAE,oBAAoB,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;gBAC5E,iBAAiB,EACf,YAAY,IAAI,aAAa,IAAI,WAAW;oBAC1C,CAAC,CAAC,qCAAqC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;oBACrF,CAAC,CAAC,IAAI;aACX,CAAA;QACH,CAAC;QACD,KAAK,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO;YACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAA;YAC/E,MAAM,SAAS,GACb,OAAO,QAAQ,KAAK,UAAU;gBAC5B,CAAC,CAAE,QAAQ,CACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CACoB;gBACrD,CAAC,CAAC,EAAE,CAAA;YACR,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;YACpF,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAA;YAC3B,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,IAAI,CAAC;oBAClB,OAAO,EAAE,OAAO;oBAChB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,+BAA+B;oBACxC,IAAI,EAAE,qEAAqE,OAAO,CAAC,SAAS,qDAAqD,OAAO,CAAC,cAAc,aAAa;iBACrL,CAAC,CAAA;gBACF,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAA;gBACxD,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;KACF,CAAA;IAED,MAAM,mBAAmB,GAAG,gCAAgC,CAAC,cAAc,CAAC,CAAA;IAC5E,MAAM,mBAAmB,GAAG,gCAAgC,CAAC,cAAc,CAAC,CAAA;IAC5E,MAAM,cAAc,GAAG,mCAAmC,CAAC,CAAC,OAAO,EAAE,EAAE;QACrE,MAAM,oBAAoB,GAAG,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC9E,IAAI,oBAAoB,KAAK,aAAa;YAAE,OAAO,mBAAmB,CAAA;QACtE,IAAI,oBAAoB,KAAK,cAAc;YAAE,OAAO,mBAAmB,CAAA;QACvE,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,cAAc;QAC9C,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,cAAc;KAC/C,CAAA;AACH,CAAC","sourcesContent":["import type { VoyantRuntimeHostPrimitives } from \"@voyant-travel/core\"\nimport { cloudAdminMembersConfigFromRevalidate } from \"./cloud-broker.js\"\nimport {\n type IdentityAccessRuntimeProvider,\n identityAccessRuntimePort,\n} from \"./identity-access-runtime-port.js\"\nimport { createCloudTeamManagementAdapter } from \"./team-management-cloud-adapter.js\"\nimport { createLocalTeamManagementAdapter } from \"./team-management-local-adapter.js\"\nimport { createGuardedTeamManagementProvider } from \"./team-management-policy.js\"\nimport { teamManagementRuntimePort } from \"./team-management-runtime-port.js\"\n\ninterface InvitationNotificationProvider {\n readonly channels: ReadonlyArray<string>\n send(payload: {\n channel: \"email\"\n to: string\n template: string\n subject: string\n html: string\n }): Promise<unknown>\n}\n\nexport interface AuthRuntimeContributorHost {\n primitives: VoyantRuntimeHostPrimitives\n}\n\nfunction selectedAdminAuthProvider(host: AuthRuntimeContributorHost, bindings: unknown): unknown {\n return (\n host.primitives.config.read(bindings, \"deployment.providers.adminAuth\") ??\n host.primitives.config.read(bindings, \"deployment.providers.auth\")\n )\n}\n\n/** Package-owned registration map for Auth deployment adapters. */\nexport function createAuthRuntimePortContribution(\n host: AuthRuntimeContributorHost,\n): Readonly<Record<string, unknown>> {\n const identityAccess: IdentityAccessRuntimeProvider = {\n resolveDeployment(bindings) {\n const env = bindings as Record<string, string \| undefined>\n const selectedAuthProvider = selectedAdminAuthProvider(host, bindings)\n if (selectedAuthProvider !== \"better-auth\" && selectedAuthProvider !== \"voyant-cloud\") {\n throw new Error(\n \"Auth runtime requires deployment.providers.adminAuth to select better-auth or voyant-cloud.\",\n )\n }\n const appUrl = (env.APP_URL \|\| env.DASH_BASE_URL \|\| \"http://localhost:3300\")\n .trim()\n .replace(/\\/$/, \"\")\n const deploymentId = env.VOYANT_CLOUD_DEPLOYMENT_ID?.trim()\n const revalidateUrl = env.VOYANT_CLOUD_ADMIN_AUTH_REVALIDATE_URL?.trim()\n const clientToken = env.VOYANT_CLOUD_ADMIN_AUTH_CLIENT_TOKEN?.trim()\n return {\n appUrl,\n authMode: selectedAuthProvider === \"voyant-cloud\" ? \"voyant-cloud\" : \"local\",\n cloudAdminMembers:\n deploymentId && revalidateUrl && clientToken\n ? cloudAdminMembersConfigFromRevalidate({ revalidateUrl, deploymentId, clientToken })\n : null,\n }\n },\n async sendInvitationEmail(bindings, message) {\n const resolver = host.primitives.config.read(bindings, \"notificationProviders\")\n const providers =\n typeof resolver === \"function\"\n ? (resolver(\n host.primitives.env(bindings),\n ) as ReadonlyArray<InvitationNotificationProvider>)\n : []\n const provider = providers.find((candidate) => candidate.channels.includes(\"email\"))\n if (!provider) return false\n try {\n await provider.send({\n channel: \"email\",\n to: message.to,\n template: \"auth.invitation\",\n subject: \"You've been invited to Voyant\",\n html: `<p>You've been invited to join a Voyant workspace.</p><p><a href=\"${message.acceptUrl}\">Accept invitation</a></p><p>The link expires in ${message.expiresInHours} hours.</p>`,\n })\n return true\n } catch (error) {\n console.error(\"[invitations] email send failed:\", error)\n return false\n }\n },\n }\n\n const localTeamManagement = createLocalTeamManagementAdapter(identityAccess)\n const cloudTeamManagement = createCloudTeamManagementAdapter(identityAccess)\n const teamManagement = createGuardedTeamManagementProvider((context) => {\n const selectedAuthProvider = selectedAdminAuthProvider(host, context.bindings)\n if (selectedAuthProvider === \"better-auth\") return localTeamManagement\n if (selectedAuthProvider === \"voyant-cloud\") return cloudTeamManagement\n throw new Error(\n \"Team management requires deployment.providers.adminAuth to select better-auth or voyant-cloud.\",\n )\n })\n\n return {\n [identityAccessRuntimePort.id]: identityAccess,\n [teamManagementRuntimePort.id]: teamManagement,\n }\n}\n"]}

package/dist/server.d.ts CHANGED Viewed

@@ -28,7 +28,7 @@ type VoyantBetterAuthPlugins = [
     ReturnType<typeof emailOTP>,
     ReturnType<typeof createLocalMemberAccessPlugin>
 ];
-type ResolvedBetterAuthPlugins<Plugins extends BetterAuthPlugin[] | undefined> = Plugins extends BetterAuthPlugin[] ? [...VoyantBetterAuthPlugins, ...Plugins] : VoyantBetterAuthPlugins;
+type ResolvedBetterAuthPlugins<_Plugins extends BetterAuthPlugin[] | undefined> = VoyantBetterAuthPlugins | BetterAuthPlugin[];
 export interface DisableSignupWhenUsersExistOptions {
     /**
      * Set to false when the consuming app owns all signup admission checks.
@@ -51,12 +51,24 @@ type ResolvedCreateBetterAuthOptions<UserOptions extends BetterAuthOptions["user
     user: ResolvedBetterAuthUserOptions<UserOptions>;
 };
 export type BetterAuthDrizzleSchema = Record<string, AnyPgTable>;
+export type VoyantAuthRealm = "admin" | "customer";
+export interface BetterAuthRealmTables {
+    user: AnyPgTable;
+    session: AnyPgTable;
+    account: AnyPgTable;
+    verification: AnyPgTable;
+    apikey?: AnyPgTable;
+}
 export interface CreateBetterAuthOptions<UserOptions extends BetterAuthOptions["user"] = BetterAuthOptions["user"], Plugins extends BetterAuthPlugin[] | undefined = BetterAuthPlugin[] | undefined> {
     db?: ReturnType<typeof getDb>;
     secret?: string;
     baseURL?: string;
     basePath?: string;
     trustedOrigins?: string[];
+    /** Security realm. Existing callers default to the isolated admin realm. */
+    realm?: VoyantAuthRealm;
+    /** Override only when an adapter owns a compatible Better Auth schema. */
+    realmTables?: BetterAuthRealmTables;
     /**
      * Additional Drizzle tables for Better Auth plugins. The consuming app owns
      * matching migrations for every table passed here.
@@ -64,6 +76,10 @@ export interface CreateBetterAuthOptions<UserOptions extends BetterAuthOptions["
     extraSchema?: BetterAuthDrizzleSchema;
     plugins?: Plugins;
     user?: UserOptions;
+    /** Resolved credentials; the auth package never persists provider secrets. */
+    socialProviders?: BetterAuthOptions["socialProviders"];
+    emailCodeEnabled?: boolean;
+    emailPasswordEnabled?: boolean;
     /**
      * Surfaces stamped on Better Auth customer self-signups before the bundled
      * single-tenant signup guard evaluates the new user. Applies to Better
@@ -116,3 +132,16 @@ export interface CreateBetterAuthOptions<UserOptions extends BetterAuthOptions["
  * Does NOT depend on Next.js — safe to use in Hono workers, TanStack Start, etc.
  */
 export declare function createBetterAuth<const UserOptions extends BetterAuthOptions["user"] = undefined, const Plugins extends BetterAuthPlugin[] | undefined = undefined>(options?: CreateBetterAuthOptions<UserOptions, Plugins>): import("better-auth").Auth<ResolvedCreateBetterAuthOptions<UserOptions, Plugins>>;
+export type CreateAdminBetterAuthOptions<UserOptions extends BetterAuthOptions["user"] = BetterAuthOptions["user"], Plugins extends BetterAuthPlugin[] | undefined = BetterAuthPlugin[] | undefined> = Omit<CreateBetterAuthOptions<UserOptions, Plugins>, "realm" | "realmTables">;
+export declare function createAdminBetterAuth<const UserOptions extends BetterAuthOptions["user"] = undefined, const Plugins extends BetterAuthPlugin[] | undefined = undefined>(options?: CreateAdminBetterAuthOptions<UserOptions, Plugins>): import("better-auth").Auth<ResolvedCreateBetterAuthOptions<UserOptions, Plugins>>;
+export interface CustomerAuthMethods {
+    emailCode?: boolean;
+    emailPassword?: boolean;
+    /** Better Auth provider configs such as google, facebook, and apple. */
+    socialProviders?: BetterAuthOptions["socialProviders"];
+}
+export type CreateCustomerBetterAuthOptions<UserOptions extends BetterAuthOptions["user"] = BetterAuthOptions["user"], Plugins extends BetterAuthPlugin[] | undefined = BetterAuthPlugin[] | undefined> = Omit<CreateBetterAuthOptions<UserOptions, Plugins>, "realm" | "realmTables" | "customerSignupSurfaces" | "disableSignupWhenUsersExist" | "socialProviders" | "emailCodeEnabled" | "emailPasswordEnabled"> & {
+    methods?: CustomerAuthMethods;
+};
+/** Storefront realm factory with isolated tables, cookies, secret, and routes. */
+export declare function createCustomerBetterAuth<const UserOptions extends BetterAuthOptions["user"] = undefined, const Plugins extends BetterAuthPlugin[] | undefined = undefined>(options?: CreateCustomerBetterAuthOptions<UserOptions, Plugins>): import("better-auth").Auth<ResolvedCreateBetterAuthOptions<UserOptions, Plugins>>;