{"version":3,"file":"create-context.mjs","names":[],"sources":["../../src/context/create-context.ts"],"sourcesContent":["import type {\n\tAuthContext,\n\tBetterAuthOptions,\n\tSecretConfig,\n} from \"@better-auth/core\";\nimport { getBetterAuthVersion } from \"@better-auth/core/context\";\nimport { getAuthTables } from \"@better-auth/core/db\";\nimport type { DBAdapter } from \"@better-auth/core/db/adapter\";\nimport { createLogger, env, isProduction, isTest } from \"@better-auth/core/env\";\nimport { BetterAuthError } from \"@better-auth/core/error\";\nimport type { OAuthProvider } from \"@better-auth/core/oauth2\";\nimport type { SocialProviders } from \"@better-auth/core/social-providers\";\nimport { socialProviders } from \"@better-auth/core/social-providers\";\nimport { generateId } from \"@better-auth/core/utils/id\";\nimport { createTelemetry } from \"@better-auth/telemetry\";\nimport defu from \"defu\";\nimport type { Entries } from \"type-fest\";\nimport { checkEndpointConflicts } from \"../api\";\nimport { matchesOriginPattern } from \"../auth/trusted-origins\";\nimport { createCookieGetter, getCookies } from \"../cookies\";\nimport { hashPassword, verifyPassword } from \"../crypto/password\";\nimport { createInternalAdapter } from \"../db/internal-adapter\";\nimport { DEFAULT_SECRET } from \"../utils/constants\";\nimport { isPromise } from \"../utils/is-promise\";\nimport { checkPassword } from \"../utils/password\";\nimport { getBaseURL, isDynamicBaseURLConfig } from \"../utils/url\";\nimport {\n\tgetInternalPlugins,\n\tgetTrustedOrigins,\n\tgetTrustedProviders,\n\trunPluginInit,\n} from \"./helpers\";\nimport {\n\tbuildSecretConfig,\n\tparseSecretsEnv,\n\tvalidateSecretsArray,\n} from \"./secret-utils\";\n\n/**\n * Estimates the entropy of a string in bits.\n * This is a simple approximation that helps detect low-entropy secrets.\n */\nfunction estimateEntropy(str: string): number {\n\tconst unique = new Set(str).size;\n\tif (unique === 0) return 0;\n\treturn Math.log2(Math.pow(unique, str.length));\n}\n\n/**\n * Validates that the secret meets minimum security requirements.\n * Throws BetterAuthError if the secret is invalid.\n * Skips validation for DEFAULT_SECRET in test environments only.\n * Only throws for DEFAULT_SECRET in production environment.\n */\nfunction validateSecret(\n\tsecret: string,\n\tlogger: ReturnType<typeof createLogger>,\n): void {\n\tconst isDefaultSecret = secret === DEFAULT_SECRET;\n\n\tif (isTest()) {\n\t\treturn;\n\t}\n\n\tif (isDefaultSecret && isProduction) {\n\t\tthrow new BetterAuthError(\n\t\t\t\"You are using the default secret. Please set `BETTER_AUTH_SECRET` in your environment variables or pass `secret` in your auth config.\",\n\t\t);\n\t}\n\n\tif (!secret) {\n\t\tthrow new BetterAuthError(\n\t\t\t\"BETTER_AUTH_SECRET is missing. Set it in your environment or pass `secret` to betterAuth({ secret }).\",\n\t\t);\n\t}\n\n\tif (secret.length < 32) {\n\t\tlogger.warn(\n\t\t\t`[better-auth] Warning: your BETTER_AUTH_SECRET should be at least 32 characters long for adequate security. Generate one with \\`npx auth secret\\` or \\`openssl rand -base64 32\\`.`,\n\t\t);\n\t}\n\n\t// Optional high-entropy check: warn if entropy appears low\n\tconst entropy = estimateEntropy(secret);\n\tif (entropy < 120) {\n\t\tlogger.warn(\n\t\t\t\"[better-auth] Warning: your BETTER_AUTH_SECRET appears low-entropy. Use a randomly generated secret for production.\",\n\t\t);\n\t}\n}\n\nexport async function createAuthContext<Options extends BetterAuthOptions>(\n\tadapter: DBAdapter,\n\toptions: Options,\n\tgetDatabaseType: (database: Options[\"database\"]) => string,\n): Promise<AuthContext<Options>> {\n\t//set default options for stateless mode\n\tif (!options.database) {\n\t\toptions = defu(options, {\n\t\t\tsession: {\n\t\t\t\tcookieCache: {\n\t\t\t\t\tenabled: true,\n\t\t\t\t\tstrategy: \"jwe\" as const,\n\t\t\t\t\trefreshCache: true,\n\t\t\t\t},\n\t\t\t},\n\t\t\taccount: {\n\t\t\t\tstoreStateStrategy: \"cookie\" as const,\n\t\t\t\tstoreAccountCookie: true,\n\t\t\t},\n\t\t}) as Options;\n\t}\n\tconst plugins = options.plugins || [];\n\tconst internalPlugins = getInternalPlugins(options);\n\tconst logger = createLogger(options.logger);\n\n\tconst isDynamicConfig = isDynamicBaseURLConfig(options.baseURL);\n\n\tif (isDynamicBaseURLConfig(options.baseURL)) {\n\t\tconst { allowedHosts } = options.baseURL;\n\t\tif (!allowedHosts || allowedHosts.length === 0) {\n\t\t\tthrow new BetterAuthError(\n\t\t\t\t\"baseURL.allowedHosts cannot be empty. Provide at least one allowed host pattern \" +\n\t\t\t\t\t'(e.g., [\"myapp.com\", \"*.vercel.app\"]).',\n\t\t\t);\n\t\t}\n\t}\n\n\tconst baseURL = isDynamicConfig\n\t\t? undefined\n\t\t: getBaseURL(\n\t\t\t\ttypeof options.baseURL === \"string\" ? options.baseURL : undefined,\n\t\t\t\toptions.basePath,\n\t\t\t);\n\n\tif (!baseURL && !isDynamicConfig) {\n\t\tlogger.warn(\n\t\t\t`[better-auth] Base URL could not be determined. Please set a valid base URL using the baseURL config option or the BETTER_AUTH_URL environment variable. Without this, callbacks and redirects may not work correctly.`,\n\t\t);\n\t}\n\n\tif (\n\t\tadapter.id === \"memory\" &&\n\t\toptions.advanced?.database?.generateId === false\n\t) {\n\t\tlogger.error(\n\t\t\t`[better-auth] Misconfiguration detected.\nYou are using the memory DB with generateId: false.\nThis will cause no id to be generated for any model.\nMost of the features of Better Auth will not work correctly.`,\n\t\t);\n\t}\n\n\tconst secretsArray =\n\t\toptions.secrets ?? parseSecretsEnv(env.BETTER_AUTH_SECRETS);\n\n\tconst legacySecret =\n\t\toptions.secret || env.BETTER_AUTH_SECRET || env.AUTH_SECRET || \"\";\n\n\tlet secret: string;\n\tlet secretConfig: string | SecretConfig;\n\n\tif (secretsArray) {\n\t\tvalidateSecretsArray(secretsArray, logger);\n\t\tsecret = secretsArray[0]!.value;\n\t\tsecretConfig = buildSecretConfig(secretsArray, legacySecret);\n\t} else {\n\t\tsecret = legacySecret || DEFAULT_SECRET;\n\t\tvalidateSecret(secret, logger);\n\t\tsecretConfig = secret;\n\t}\n\n\toptions = {\n\t\t...options,\n\t\tsecret,\n\t\tbaseURL: isDynamicConfig\n\t\t\t? options.baseURL\n\t\t\t: baseURL\n\t\t\t\t? new URL(baseURL).origin\n\t\t\t\t: \"\",\n\t\tbasePath: options.basePath || \"/api/auth\",\n\t\tplugins: plugins.concat(internalPlugins),\n\t};\n\n\tcheckEndpointConflicts(options, logger);\n\tconst cookies = getCookies(options);\n\tconst tables = getAuthTables(options);\n\tconst providers = (\n\t\tawait Promise.all(\n\t\t\t(\n\t\t\t\tObject.entries(\n\t\t\t\t\toptions.socialProviders || {},\n\t\t\t\t) as unknown as Entries<SocialProviders>\n\t\t\t).map(async ([key, originalConfig]) => {\n\t\t\t\tconst config =\n\t\t\t\t\ttypeof originalConfig === \"function\"\n\t\t\t\t\t\t? await originalConfig()\n\t\t\t\t\t\t: originalConfig;\n\t\t\t\tif (config == null) {\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\t\t\t\tif (config.enabled === false) {\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\t\t\t\tif (!config.clientId) {\n\t\t\t\t\tlogger.warn(\n\t\t\t\t\t\t`Social provider ${key} is missing clientId or clientSecret`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tconst provider = socialProviders[key](config as never);\n\t\t\t\t(provider as OAuthProvider).disableImplicitSignUp =\n\t\t\t\t\tconfig.disableImplicitSignUp;\n\t\t\t\treturn provider as OAuthProvider;\n\t\t\t}),\n\t\t)\n\t).filter((x) => x !== null);\n\n\tconst generateIdFunc: AuthContext[\"generateId\"] = ({ model, size }) => {\n\t\tif (typeof (options.advanced as any)?.generateId === \"function\") {\n\t\t\treturn (options.advanced as any).generateId({ model, size });\n\t\t}\n\t\tconst dbGenerateId = options?.advanced?.database?.generateId;\n\t\tif (typeof dbGenerateId === \"function\") {\n\t\t\treturn dbGenerateId({ model, size });\n\t\t}\n\t\tif (dbGenerateId === \"uuid\") {\n\t\t\treturn crypto.randomUUID();\n\t\t}\n\t\tif (dbGenerateId === \"serial\" || dbGenerateId === false) {\n\t\t\treturn false;\n\t\t}\n\t\treturn generateId(size);\n\t};\n\n\tconst { publish } = await createTelemetry(options, {\n\t\tadapter: adapter.id,\n\t\tdatabase:\n\t\t\ttypeof options.database === \"function\"\n\t\t\t\t? \"adapter\"\n\t\t\t\t: getDatabaseType(options.database),\n\t});\n\n\tconst pluginIds = new Set(options.plugins!.map((p) => p.id));\n\n\tconst getPluginFn = (id: string) =>\n\t\t(options.plugins!.find((p) => p.id === id) as never | undefined) ?? null;\n\n\tconst hasPluginFn = (id: string) => pluginIds.has(id);\n\n\tconst trustedOrigins = await getTrustedOrigins(options);\n\tconst trustedProviders = await getTrustedProviders(options);\n\n\tconst ctx: AuthContext = {\n\t\tappName: options.appName || \"Better Auth\",\n\t\tbaseURL: baseURL || \"\",\n\t\tversion: getBetterAuthVersion(),\n\t\tsocialProviders: providers,\n\t\toptions,\n\t\toauthConfig: {\n\t\t\tstoreStateStrategy:\n\t\t\t\toptions.account?.storeStateStrategy ||\n\t\t\t\t(options.database ? \"database\" : \"cookie\"),\n\t\t\tskipStateCookieCheck: !!options.account?.skipStateCookieCheck,\n\t\t},\n\t\ttables,\n\t\ttrustedOrigins,\n\t\ttrustedProviders,\n\t\tisTrustedOrigin(\n\t\t\turl: string,\n\t\t\tsettings?: {\n\t\t\t\tallowRelativePaths: boolean;\n\t\t\t},\n\t\t) {\n\t\t\treturn this.trustedOrigins.some((origin) =>\n\t\t\t\tmatchesOriginPattern(url, origin, settings),\n\t\t\t);\n\t\t},\n\t\tsessionConfig: {\n\t\t\tupdateAge:\n\t\t\t\toptions.session?.updateAge !== undefined\n\t\t\t\t\t? options.session.updateAge\n\t\t\t\t\t: 24 * 60 * 60,\n\t\t\texpiresIn: options.session?.expiresIn || 60 * 60 * 24 * 7,\n\t\t\tfreshAge:\n\t\t\t\toptions.session?.freshAge === undefined\n\t\t\t\t\t? 60 * 60 * 24\n\t\t\t\t\t: options.session.freshAge,\n\t\t\tcookieRefreshCache: (() => {\n\t\t\t\tconst refreshCache = options.session?.cookieCache?.refreshCache;\n\t\t\t\tconst maxAge = options.session?.cookieCache?.maxAge || 60 * 5;\n\n\t\t\t\t// `refreshCache` is intended for fully stateless / DB-less setups.\n\t\t\t\t// If a server-side store is configured, prefer fetching/refreshing from that source\n\t\t\t\t// and disable stateless refresh behavior to avoid confusing/unsafe configurations.\n\t\t\t\tconst isStateful = !!options.database || !!options.secondaryStorage;\n\t\t\t\tif (isStateful && refreshCache) {\n\t\t\t\t\tlogger.warn(\n\t\t\t\t\t\t\"[better-auth] `session.cookieCache.refreshCache` is enabled while `database` or `secondaryStorage` is configured. `refreshCache` is meant for stateless (DB-less) setups. Disabling `refreshCache` — remove it from your config to silence this warning.\",\n\t\t\t\t\t);\n\t\t\t\t\treturn false;\n\t\t\t\t}\n\n\t\t\t\tif (refreshCache === false || refreshCache === undefined) {\n\t\t\t\t\treturn false;\n\t\t\t\t}\n\n\t\t\t\tif (refreshCache === true) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tenabled: true,\n\t\t\t\t\t\tupdateAge: Math.floor(maxAge * 0.2),\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\treturn {\n\t\t\t\t\tenabled: true,\n\t\t\t\t\tupdateAge:\n\t\t\t\t\t\trefreshCache.updateAge !== undefined\n\t\t\t\t\t\t\t? refreshCache.updateAge\n\t\t\t\t\t\t\t: Math.floor(maxAge * 0.2),\n\t\t\t\t};\n\t\t\t})(),\n\t\t},\n\t\tsecret,\n\t\tsecretConfig,\n\t\trateLimit: {\n\t\t\t...options.rateLimit,\n\t\t\tenabled: options.rateLimit?.enabled ?? isProduction,\n\t\t\twindow: options.rateLimit?.window || 10,\n\t\t\tmax: options.rateLimit?.max || 100,\n\t\t\tstorage:\n\t\t\t\toptions.rateLimit?.storage ||\n\t\t\t\t(options.secondaryStorage ? \"secondary-storage\" : \"memory\"),\n\t\t},\n\t\tauthCookies: cookies,\n\t\tlogger,\n\t\tgenerateId: generateIdFunc,\n\t\tsession: null,\n\t\tsecondaryStorage: options.secondaryStorage,\n\t\tpassword: {\n\t\t\thash: options.emailAndPassword?.password?.hash || hashPassword,\n\t\t\tverify: options.emailAndPassword?.password?.verify || verifyPassword,\n\t\t\tconfig: {\n\t\t\t\tminPasswordLength: options.emailAndPassword?.minPasswordLength || 8,\n\t\t\t\tmaxPasswordLength: options.emailAndPassword?.maxPasswordLength || 128,\n\t\t\t},\n\t\t\tcheckPassword,\n\t\t},\n\t\tsetNewSession(session) {\n\t\t\tthis.newSession = session;\n\t\t},\n\t\tnewSession: null,\n\t\tadapter: adapter,\n\t\tinternalAdapter: createInternalAdapter(adapter, {\n\t\t\toptions,\n\t\t\tlogger,\n\t\t\thooks: options.databaseHooks\n\t\t\t\t? [{ source: \"user\", hooks: options.databaseHooks }]\n\t\t\t\t: [],\n\t\t\tgenerateId: generateIdFunc,\n\t\t}),\n\t\tcreateAuthCookie: createCookieGetter(options),\n\t\tasync runMigrations() {\n\t\t\tthrow new BetterAuthError(\n\t\t\t\t\"runMigrations will be set by the specific init implementation\",\n\t\t\t);\n\t\t},\n\t\tpublishTelemetry: publish,\n\t\tskipCSRFCheck: !!options.advanced?.disableCSRFCheck,\n\t\tskipOriginCheck:\n\t\t\toptions.advanced?.disableOriginCheck !== undefined\n\t\t\t\t? options.advanced.disableOriginCheck\n\t\t\t\t: isTest()\n\t\t\t\t\t? true\n\t\t\t\t\t: false,\n\t\trunInBackground:\n\t\t\toptions.advanced?.backgroundTasks?.handler ??\n\t\t\t((p) => {\n\t\t\t\tp.catch(() => {});\n\t\t\t}),\n\t\tasync runInBackgroundOrAwait(\n\t\t\tpromise: Promise<unknown> | Promise<void> | void | unknown,\n\t\t) {\n\t\t\ttry {\n\t\t\t\tif (options.advanced?.backgroundTasks?.handler) {\n\t\t\t\t\tif (promise instanceof Promise) {\n\t\t\t\t\t\toptions.advanced.backgroundTasks.handler(\n\t\t\t\t\t\t\tpromise.catch((e) => {\n\t\t\t\t\t\t\t\tlogger.error(\"Failed to run background task:\", e);\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\tawait promise;\n\t\t\t\t}\n\t\t\t} catch (e) {\n\t\t\t\tlogger.error(\"Failed to run background task:\", e);\n\t\t\t}\n\t\t},\n\t\tgetPlugin: getPluginFn,\n\t\thasPlugin: hasPluginFn as never,\n\t};\n\n\tconst initOrPromise = runPluginInit(ctx);\n\tif (isPromise(initOrPromise)) {\n\t\tawait initOrPromise;\n\t}\n\n\treturn ctx as unknown as AuthContext<Options>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA0CA,SAAS,gBAAgB,KAAqB;CAC7C,MAAM,SAAS,IAAI,IAAI,IAAI,CAAC;AAC5B,KAAI,WAAW,EAAG,QAAO;AACzB,QAAO,KAAK,KAAK,KAAK,IAAI,QAAQ,IAAI,OAAO,CAAC;;;;;;;;AAS/C,SAAS,eACR,QACA,QACO;CACP,MAAM,kBAAkB,WAAW;AAEnC,KAAI,QAAQ,CACX;AAGD,KAAI,mBAAmB,aACtB,OAAM,IAAI,gBACT,wIACA;AAGF,KAAI,CAAC,OACJ,OAAM,IAAI,gBACT,wGACA;AAGF,KAAI,OAAO,SAAS,GACnB,QAAO,KACN,oLACA;AAKF,KADgB,gBAAgB,OAAO,GACzB,IACb,QAAO,KACN,sHACA;;AAIH,eAAsB,kBACrB,SACA,SACA,iBACgC;AAEhC,KAAI,CAAC,QAAQ,SACZ,WAAU,KAAK,SAAS;EACvB,SAAS,EACR,aAAa;GACZ,SAAS;GACT,UAAU;GACV,cAAc;GACd,EACD;EACD,SAAS;GACR,oBAAoB;GACpB,oBAAoB;GACpB;EACD,CAAC;CAEH,MAAM,UAAU,QAAQ,WAAW,EAAE;CACrC,MAAM,kBAAkB,mBAAmB,QAAQ;CACnD,MAAM,SAAS,aAAa,QAAQ,OAAO;CAE3C,MAAM,kBAAkB,uBAAuB,QAAQ,QAAQ;AAE/D,KAAI,uBAAuB,QAAQ,QAAQ,EAAE;EAC5C,MAAM,EAAE,iBAAiB,QAAQ;AACjC,MAAI,CAAC,gBAAgB,aAAa,WAAW,EAC5C,OAAM,IAAI,gBACT,6HAEA;;CAIH,MAAM,UAAU,kBACb,SACA,WACA,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU,QACxD,QAAQ,SACR;AAEH,KAAI,CAAC,WAAW,CAAC,gBAChB,QAAO,KACN,yNACA;AAGF,KACC,QAAQ,OAAO,YACf,QAAQ,UAAU,UAAU,eAAe,MAE3C,QAAO,MACN;;;8DAIA;CAGF,MAAM,eACL,QAAQ,WAAW,gBAAgB,IAAI,oBAAoB;CAE5D,MAAM,eACL,QAAQ,UAAU,IAAI,sBAAsB,IAAI,eAAe;CAEhE,IAAI;CACJ,IAAI;AAEJ,KAAI,cAAc;AACjB,uBAAqB,cAAc,OAAO;AAC1C,WAAS,aAAa,GAAI;AAC1B,iBAAe,kBAAkB,cAAc,aAAa;QACtD;AACN,WAAS,gBAAgB;AACzB,iBAAe,QAAQ,OAAO;AAC9B,iBAAe;;AAGhB,WAAU;EACT,GAAG;EACH;EACA,SAAS,kBACN,QAAQ,UACR,UACC,IAAI,IAAI,QAAQ,CAAC,SACjB;EACJ,UAAU,QAAQ,YAAY;EAC9B,SAAS,QAAQ,OAAO,gBAAgB;EACxC;AAED,wBAAuB,SAAS,OAAO;CACvC,MAAM,UAAU,WAAW,QAAQ;CACnC,MAAM,SAAS,cAAc,QAAQ;CACrC,MAAM,aACL,MAAM,QAAQ,IAEZ,OAAO,QACN,QAAQ,mBAAmB,EAAE,CAC7B,CACA,IAAI,OAAO,CAAC,KAAK,oBAAoB;EACtC,MAAM,SACL,OAAO,mBAAmB,aACvB,MAAM,gBAAgB,GACtB;AACJ,MAAI,UAAU,KACb,QAAO;AAER,MAAI,OAAO,YAAY,MACtB,QAAO;AAER,MAAI,CAAC,OAAO,SACX,QAAO,KACN,mBAAmB,IAAI,sCACvB;EAEF,MAAM,WAAW,gBAAgB,KAAK,OAAgB;AACtD,EAAC,SAA2B,wBAC3B,OAAO;AACR,SAAO;GACN,CACF,EACA,QAAQ,MAAM,MAAM,KAAK;CAE3B,MAAM,kBAA6C,EAAE,OAAO,WAAW;AACtE,MAAI,OAAQ,QAAQ,UAAkB,eAAe,WACpD,QAAQ,QAAQ,SAAiB,WAAW;GAAE;GAAO;GAAM,CAAC;EAE7D,MAAM,eAAe,SAAS,UAAU,UAAU;AAClD,MAAI,OAAO,iBAAiB,WAC3B,QAAO,aAAa;GAAE;GAAO;GAAM,CAAC;AAErC,MAAI,iBAAiB,OACpB,QAAO,OAAO,YAAY;AAE3B,MAAI,iBAAiB,YAAY,iBAAiB,MACjD,QAAO;AAER,SAAO,WAAW,KAAK;;CAGxB,MAAM,EAAE,YAAY,MAAM,gBAAgB,SAAS;EAClD,SAAS,QAAQ;EACjB,UACC,OAAO,QAAQ,aAAa,aACzB,YACA,gBAAgB,QAAQ,SAAS;EACrC,CAAC;CAEF,MAAM,YAAY,IAAI,IAAI,QAAQ,QAAS,KAAK,MAAM,EAAE,GAAG,CAAC;CAE5D,MAAM,eAAe,OACnB,QAAQ,QAAS,MAAM,MAAM,EAAE,OAAO,GAAG,IAA0B;CAErE,MAAM,eAAe,OAAe,UAAU,IAAI,GAAG;CAErD,MAAM,iBAAiB,MAAM,kBAAkB,QAAQ;CACvD,MAAM,mBAAmB,MAAM,oBAAoB,QAAQ;CAE3D,MAAM,MAAmB;EACxB,SAAS,QAAQ,WAAW;EAC5B,SAAS,WAAW;EACpB,SAAS,sBAAsB;EAC/B,iBAAiB;EACjB;EACA,aAAa;GACZ,oBACC,QAAQ,SAAS,uBAChB,QAAQ,WAAW,aAAa;GAClC,sBAAsB,CAAC,CAAC,QAAQ,SAAS;GACzC;EACD;EACA;EACA;EACA,gBACC,KACA,UAGC;AACD,UAAO,KAAK,eAAe,MAAM,WAChC,qBAAqB,KAAK,QAAQ,SAAS,CAC3C;;EAEF,eAAe;GACd,WACC,QAAQ,SAAS,cAAc,SAC5B,QAAQ,QAAQ,YAChB,OAAU;GACd,WAAW,QAAQ,SAAS,aAAa,OAAU,KAAK;GACxD,UACC,QAAQ,SAAS,aAAa,SAC3B,OAAU,KACV,QAAQ,QAAQ;GACpB,2BAA2B;IAC1B,MAAM,eAAe,QAAQ,SAAS,aAAa;IACnD,MAAM,SAAS,QAAQ,SAAS,aAAa,UAAU;AAMvD,SADmB,CAAC,CAAC,QAAQ,YAAY,CAAC,CAAC,QAAQ,qBACjC,cAAc;AAC/B,YAAO,KACN,2PACA;AACD,YAAO;;AAGR,QAAI,iBAAiB,SAAS,iBAAiB,OAC9C,QAAO;AAGR,QAAI,iBAAiB,KACpB,QAAO;KACN,SAAS;KACT,WAAW,KAAK,MAAM,SAAS,GAAI;KACnC;AAGF,WAAO;KACN,SAAS;KACT,WACC,aAAa,cAAc,SACxB,aAAa,YACb,KAAK,MAAM,SAAS,GAAI;KAC5B;OACE;GACJ;EACD;EACA;EACA,WAAW;GACV,GAAG,QAAQ;GACX,SAAS,QAAQ,WAAW,WAAW;GACvC,QAAQ,QAAQ,WAAW,UAAU;GACrC,KAAK,QAAQ,WAAW,OAAO;GAC/B,SACC,QAAQ,WAAW,YAClB,QAAQ,mBAAmB,sBAAsB;GACnD;EACD,aAAa;EACb;EACA,YAAY;EACZ,SAAS;EACT,kBAAkB,QAAQ;EAC1B,UAAU;GACT,MAAM,QAAQ,kBAAkB,UAAU,QAAQ;GAClD,QAAQ,QAAQ,kBAAkB,UAAU,UAAU;GACtD,QAAQ;IACP,mBAAmB,QAAQ,kBAAkB,qBAAqB;IAClE,mBAAmB,QAAQ,kBAAkB,qBAAqB;IAClE;GACD;GACA;EACD,cAAc,SAAS;AACtB,QAAK,aAAa;;EAEnB,YAAY;EACH;EACT,iBAAiB,sBAAsB,SAAS;GAC/C;GACA;GACA,OAAO,QAAQ,gBACZ,CAAC;IAAE,QAAQ;IAAQ,OAAO,QAAQ;IAAe,CAAC,GAClD,EAAE;GACL,YAAY;GACZ,CAAC;EACF,kBAAkB,mBAAmB,QAAQ;EAC7C,MAAM,gBAAgB;AACrB,SAAM,IAAI,gBACT,gEACA;;EAEF,kBAAkB;EAClB,eAAe,CAAC,CAAC,QAAQ,UAAU;EACnC,iBACC,QAAQ,UAAU,uBAAuB,SACtC,QAAQ,SAAS,qBACjB,QAAQ,GACP,OACA;EACL,iBACC,QAAQ,UAAU,iBAAiB,aACjC,MAAM;AACP,KAAE,YAAY,GAAG;;EAEnB,MAAM,uBACL,SACC;AACD,OAAI;AACH,QAAI,QAAQ,UAAU,iBAAiB,SACtC;SAAI,mBAAmB,QACtB,SAAQ,SAAS,gBAAgB,QAChC,QAAQ,OAAO,MAAM;AACpB,aAAO,MAAM,kCAAkC,EAAE;OAChD,CACF;UAGF,OAAM;YAEC,GAAG;AACX,WAAO,MAAM,kCAAkC,EAAE;;;EAGnD,WAAW;EACX,WAAW;EACX;CAED,MAAM,gBAAgB,cAAc,IAAI;AACxC,KAAI,UAAU,cAAc,CAC3B,OAAM;AAGP,QAAO"}