{"version":3,"file":"index.cjs","names":["createClerkClient","verifyJwks"],"sources":["../../../packages/_internals/auth/dist/types/index.js","../../../packages/_internal-core/dist/logger/index.js","../../../packages/_internal-core/dist/base/index.js","../../../packages/_internals/auth/dist/provider/index.js","../src/index.ts"],"sourcesContent":["//#region src/types/index.ts\nfunction headerFromPlainObject(headers, name) {\n\tconst normalizedName = name.toLowerCase();\n\tconst matchingKey = Object.keys(headers).find((key) => key.toLowerCase() === normalizedName);\n\tconst value = matchingKey === void 0 ? void 0 : headers[matchingKey];\n\treturn Array.isArray(value) ? value[0] ?? null : value ?? null;\n}\n/**\n* Read a request header across fetch, Hono, and Express-style request shapes.\n* Must not throw when `headers` is a plain object (Express `IncomingHttpHeaders`).\n*/\nfunction getRequestHeader(request, name) {\n\tif (request instanceof Request) return request.headers.get(name);\n\tif (request.raw instanceof Request) return request.raw.headers.get(name);\n\tconst headers = request.headers;\n\tif (headers instanceof Headers) return headers.get(name);\n\tif (typeof request.header === \"function\") return request.header(name) ?? null;\n\tif (headers && typeof headers === \"object\") return headerFromPlainObject(headers, name);\n\treturn null;\n}\nfunction getWebRequest(request) {\n\tif (request instanceof Request) return request;\n\treturn request.raw instanceof Request ? request.raw : void 0;\n}\n//#endregion\nexport { getRequestHeader, getWebRequest };\n\n//# sourceMappingURL=index.js.map","import { Transform } from \"stream\";\n//#region src/logger/adapter.ts\nfunction isAdaptableLogger(logger) {\n\treturn typeof logger.__attachObservability === \"function\";\n}\n/**\n* Export a tracked exception through the adapter sink, mirroring the\n* DualLogger dual-write shape (`errorId`/`domain`/`category`/`details`/`cause`\n* when present on a MastraError-like value). Never throws into the caller.\n*/\nfunction exportTrackedException(ctx, error, metadata) {\n\tif (!ctx?.options.export) return;\n\ttry {\n\t\tconst mastraError = error;\n\t\tctx.getLogSink()?.error(error.message, {\n\t\t\t...mastraError.id !== void 0 ? { errorId: mastraError.id } : {},\n\t\t\t...mastraError.domain !== void 0 ? { domain: mastraError.domain } : {},\n\t\t\t...mastraError.category !== void 0 ? { category: mastraError.category } : {},\n\t\t\t...mastraError.details !== void 0 ? { details: mastraError.details } : {},\n\t\t\t...error.cause instanceof Error ? { cause: error.cause.message } : {},\n\t\t\t...metadata\n\t\t});\n\t} catch {}\n}\n/**\n* Adapt IMastraLogger's variadic args into the structured `data` payload of\n* an exported log record. Extracts the first plain object as data,\n* serializes an Error arg, and collects remaining primitives under `args`\n* so the derived record preserves all context from the native call.\n*/\nfunction buildLogRecordData(args) {\n\tconst objectData = args.find((arg) => arg !== null && typeof arg === \"object\" && !Array.isArray(arg) && !(arg instanceof Error));\n\tconst errorArg = args.find((arg) => arg instanceof Error);\n\tconst extraArgs = args.filter((arg) => arg !== objectData && arg !== errorArg);\n\tif (!objectData && !errorArg && extraArgs.length === 0) return void 0;\n\treturn {\n\t\t...objectData ?? {},\n\t\t...errorArg ? { error: {\n\t\t\tname: errorArg.name,\n\t\t\tmessage: errorArg.message,\n\t\t\tstack: errorArg.stack\n\t\t} } : {},\n\t\t...extraArgs.length > 0 ? { args: extraArgs } : {}\n\t};\n}\n//#endregion\n//#region src/logger/index.ts\nconst RegisteredLogger = {\n\tAGENT: \"AGENT\",\n\tOBSERVABILITY: \"OBSERVABILITY\",\n\tAUTH: \"AUTH\",\n\tBROWSER: \"BROWSER\",\n\tNETWORK: \"NETWORK\",\n\tWORKFLOW: \"WORKFLOW\",\n\tLLM: \"LLM\",\n\tTTS: \"TTS\",\n\tVOICE: \"VOICE\",\n\tVECTOR: \"VECTOR\",\n\tBUNDLER: \"BUNDLER\",\n\tDEPLOYER: \"DEPLOYER\",\n\tMEMORY: \"MEMORY\",\n\tSTORAGE: \"STORAGE\",\n\tEMBEDDINGS: \"EMBEDDINGS\",\n\tMCP_SERVER: \"MCP_SERVER\",\n\tSERVER_CACHE: \"SERVER_CACHE\",\n\tSERVER: \"SERVER\",\n\tWORKSPACE: \"WORKSPACE\",\n\tCHANNEL: \"CHANNEL\"\n};\nconst LogLevel = {\n\tDEBUG: \"debug\",\n\tINFO: \"info\",\n\tWARN: \"warn\",\n\tERROR: \"error\",\n\tNONE: \"silent\"\n};\nvar LoggerTransport = class extends Transform {\n\tconstructor(opts = {}) {\n\t\tsuper({\n\t\t\t...opts,\n\t\t\tobjectMode: true\n\t\t});\n\t}\n\tasync listLogsByRunId(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args?.page ?? 1,\n\t\t\tperPage: _args?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogs(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args?.page ?? 1,\n\t\t\tperPage: _args?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\nconst createCustomTransport = (stream, listLogs, listLogsByRunId) => {\n\tlet transport = stream;\n\tif (listLogs) transport.listLogs = listLogs;\n\tif (listLogsByRunId) transport.listLogsByRunId = listLogsByRunId;\n\treturn transport;\n};\nvar MastraLogger = class {\n\tname;\n\tlevel;\n\ttransports;\n\tconstructor(options = {}) {\n\t\tthis.name = options.name || \"Mastra\";\n\t\tthis.level = options.level || LogLevel.ERROR;\n\t\tthis.transports = new Map(Object.entries(options.transports || {}));\n\t}\n\tgetTransports() {\n\t\treturn this.transports;\n\t}\n\ttrackException(_error, _metadata) {}\n\tasync listLogs(transportId, params) {\n\t\tif (!transportId || !this.transports.has(transportId)) return {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: params?.page ?? 1,\n\t\t\tperPage: params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t\treturn this.transports.get(transportId).listLogs?.(params) ?? {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: params?.page ?? 1,\n\t\t\tperPage: params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogsByRunId({ transportId, runId, fromDate, toDate, logLevel, filters, page, perPage }) {\n\t\tif (!transportId || !this.transports.has(transportId) || !runId) return {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: page ?? 1,\n\t\t\tperPage: perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t\treturn this.transports.get(transportId).listLogsByRunId?.({\n\t\t\trunId,\n\t\t\tfromDate,\n\t\t\ttoDate,\n\t\t\tlogLevel,\n\t\t\tfilters,\n\t\t\tpage,\n\t\t\tperPage\n\t\t}) ?? {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: page ?? 1,\n\t\t\tperPage: perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\nvar ConsoleLogger = class ConsoleLogger extends MastraLogger {\n\tcomponent;\n\tfilter;\n\t#adapterContext;\n\tconstructor(options = {}) {\n\t\tsuper(options);\n\t\tthis.component = options.component;\n\t\tthis.filter = options.filter;\n\t}\n\t/**\n\t* Adapter hook (see `AdaptableLogger`): enables native trace correlation\n\t* (trace_id/span_id appended to console output) and observability export\n\t* derived from the same record. Called by Mastra during setup.\n\t*/\n\t__attachObservability(ctx) {\n\t\tthis.#adapterContext = ctx;\n\t}\n\tchild(componentOrBindings) {\n\t\tconst component = typeof componentOrBindings === \"string\" ? componentOrBindings : componentOrBindings?.component ?? this.component;\n\t\tconst child = new ConsoleLogger({\n\t\t\tname: this.name,\n\t\t\tlevel: this.level,\n\t\t\tcomponent,\n\t\t\tfilter: this.filter\n\t\t});\n\t\tif (this.#adapterContext) child.__attachObservability(this.#adapterContext);\n\t\treturn child;\n\t}\n\t/**\n\t* Native-record correlation: when a span is active, append the trace\n\t* fields object to the console args so every destination sees them.\n\t*/\n\t#correlate(args) {\n\t\tconst ctx = this.#adapterContext;\n\t\tif (!ctx?.options.correlation) return args;\n\t\ttry {\n\t\t\tconst fields = ctx.resolveTraceFields();\n\t\t\treturn fields ? [...args, fields] : args;\n\t\t} catch {\n\t\t\treturn args;\n\t\t}\n\t}\n\t/**\n\t* Export the record derived from the same native call to observability.\n\t* Mirrors DualLogger semantics: export is independent of the console\n\t* level filter, and never throws into the caller.\n\t*/\n\t#export(level, message, args) {\n\t\tconst ctx = this.#adapterContext;\n\t\tif (!ctx?.options.export) return;\n\t\ttry {\n\t\t\tctx.getLogSink()?.[level](message, buildLogRecordData(args));\n\t\t} catch {}\n\t}\n\tshouldLog(level, message, args) {\n\t\tif (!this.filter) return true;\n\t\ttry {\n\t\t\treturn this.filter({\n\t\t\t\tcomponent: this.component,\n\t\t\t\tlevel,\n\t\t\t\tmessage,\n\t\t\t\targs\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tconsole.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);\n\t\t\treturn true;\n\t\t}\n\t}\n\tprefix() {\n\t\treturn this.component ? `[${this.component}] ` : \"\";\n\t}\n\tdebug(message, ...args) {\n\t\tif (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) console.info(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"debug\", message, args);\n\t}\n\tinfo(message, ...args) {\n\t\tif ((this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.INFO, message, args)) console.info(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"info\", message, args);\n\t}\n\twarn(message, ...args) {\n\t\tif ((this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.WARN, message, args)) console.warn(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"warn\", message, args);\n\t}\n\terror(message, ...args) {\n\t\tif ((this.level === LogLevel.ERROR || this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.ERROR, message, args)) console.error(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"error\", message, args);\n\t}\n\ttrackException(error, metadata) {\n\t\texportTrackedException(this.#adapterContext, error, metadata);\n\t}\n\tasync listLogs(_transportId, _params) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _params?.page ?? 1,\n\t\t\tperPage: _params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogsByRunId(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args.page ?? 1,\n\t\t\tperPage: _args.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\n//#endregion\nexport { ConsoleLogger, LogLevel, LoggerTransport, MastraLogger, RegisteredLogger, buildLogRecordData, createCustomTransport, exportTrackedException, isAdaptableLogger };\n\n//# sourceMappingURL=index.js.map","import { ConsoleLogger, RegisteredLogger } from \"../logger/index.js\";\n//#region src/base/MastraBase.ts\nvar MastraBase = class {\n\tcomponent = RegisteredLogger.LLM;\n\tlogger;\n\tname;\n\t#rawConfig;\n\tconstructor({ component, name, rawConfig }) {\n\t\tthis.component = component || RegisteredLogger.LLM;\n\t\tthis.name = name;\n\t\tthis.#rawConfig = rawConfig;\n\t\tthis.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });\n\t}\n\t/**\n\t* Returns the raw storage configuration this primitive was created from,\n\t* or undefined if it was created from code.\n\t*/\n\ttoRawConfig() {\n\t\treturn this.#rawConfig;\n\t}\n\t/**\n\t* Sets the raw storage configuration for this primitive.\n\t* @internal\n\t*/\n\t__setRawConfig(rawConfig) {\n\t\tthis.#rawConfig = rawConfig;\n\t}\n\t/**\n\t* Set the logger for the agent\n\t* @param logger\n\t*/\n\t__setLogger(logger) {\n\t\tthis.logger = \"child\" in logger && typeof logger.child === \"function\" ? logger.child({ component: this.component }) : logger;\n\t}\n};\n//#endregion\nexport { MastraBase };\n\n//# sourceMappingURL=index.js.map","import { getRequestHeader } from \"../types/index.js\";\nimport { MastraBase } from \"@internal/core/base\";\n//#region src/provider/index.ts\nvar MastraAuthProvider = class extends MastraBase {\n\tprotected;\n\tpublic;\n\tconstructor(options) {\n\t\tsuper({\n\t\t\tcomponent: \"AUTH\",\n\t\t\tname: options?.name\n\t\t});\n\t\tif (options?.authorizeUser) this.authorizeUser = options.authorizeUser.bind(this);\n\t\tthis.protected = options?.protected;\n\t\tthis.public = options?.public;\n\t\tthis.mapUserToResourceId = options?.mapUserToResourceId;\n\t}\n\tregisterOptions(opts) {\n\t\tif (opts?.authorizeUser) this.authorizeUser = opts.authorizeUser.bind(this);\n\t\tif (opts?.mapUserToResourceId) this.mapUserToResourceId = opts.mapUserToResourceId;\n\t\tif (opts?.protected) this.protected = opts.protected;\n\t\tif (opts?.public) this.public = opts.public;\n\t}\n};\nfunction isSSOProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.getLoginUrl === \"function\" && typeof p.handleCallback === \"function\";\n}\nfunction isSessionProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.validateSession === \"function\" && typeof p.createSession === \"function\";\n}\nfunction isUserProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.getCurrentUser === \"function\";\n}\nfunction isCredentialsProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.signIn === \"function\";\n}\nfunction isOrganizationsProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.ensureOrganization === \"function\" && typeof p.isOrganizationAdmin === \"function\";\n}\nfunction isAuthHttpHandler(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.handleAuthRequest === \"function\";\n}\nfunction hasAuthInit(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.init === \"function\";\n}\nfunction isObjectLike(value) {\n\treturn typeof value === \"object\" && value !== null || typeof value === \"function\";\n}\nvar CompositeAuth = class CompositeAuth extends MastraAuthProvider {\n\tproviders;\n\tauthenticatedProviderByObject = /* @__PURE__ */ new WeakMap();\n\tauthenticatedProviderByPrimitive = /* @__PURE__ */ new Map();\n\tconstructor(providers) {\n\t\tconst combinedPublic = providers.flatMap((provider) => provider.public ?? []);\n\t\tconst combinedProtected = providers.flatMap((provider) => provider.protected ?? []);\n\t\tsuper({\n\t\t\tpublic: combinedPublic,\n\t\t\tprotected: combinedProtected\n\t\t});\n\t\tthis.providers = providers;\n\t\tif (providers.some((provider) => typeof provider.mapUserToResourceId === \"function\")) this.mapUserToResourceId = (user) => this.mapAuthenticatedUserToResourceId(user);\n\t\tif (!providers.some(isSSOProvider)) {\n\t\t\tthis.getLoginUrl = void 0;\n\t\t\tthis.handleCallback = void 0;\n\t\t\tthis.getLoginButtonConfig = void 0;\n\t\t}\n\t\tif (!providers.some(isSessionProvider)) {\n\t\t\tthis.createSession = void 0;\n\t\t\tthis.validateSession = void 0;\n\t\t\tthis.getSessionIdFromRequest = void 0;\n\t\t}\n\t\tif (!providers.some(isUserProvider)) {\n\t\t\tthis.getCurrentUser = void 0;\n\t\t\tthis.getUser = void 0;\n\t\t\tthis.getUsers = void 0;\n\t\t}\n\t\tconst credProvider = providers.find(isCredentialsProvider);\n\t\tif (credProvider) {\n\t\t\tthis.signIn = credProvider.signIn.bind(credProvider);\n\t\t\tif (typeof credProvider.signUp === \"function\") this.signUp = credProvider.signUp.bind(credProvider);\n\t\t\tif (typeof credProvider.requestPasswordReset === \"function\") this.requestPasswordReset = credProvider.requestPasswordReset.bind(credProvider);\n\t\t\tif (typeof credProvider.resetPassword === \"function\") this.resetPassword = credProvider.resetPassword.bind(credProvider);\n\t\t\tthis.isSignUpEnabled = typeof credProvider.isSignUpEnabled === \"function\" ? credProvider.isSignUpEnabled.bind(credProvider) : () => true;\n\t\t} else {\n\t\t\tthis.signIn = void 0;\n\t\t\tthis.signUp = void 0;\n\t\t\tthis.requestPasswordReset = void 0;\n\t\t\tthis.resetPassword = void 0;\n\t\t\tthis.isSignUpEnabled = void 0;\n\t\t}\n\t}\n\tfindProvider(check) {\n\t\treturn this.providers.find(check);\n\t}\n\trememberAuthenticatedProvider(user, provider) {\n\t\tif (isObjectLike(user)) {\n\t\t\tthis.authenticatedProviderByObject.set(user, provider);\n\t\t\treturn;\n\t\t}\n\t\tthis.authenticatedProviderByPrimitive.set(user, provider);\n\t}\n\ttakeAuthenticatedProvider(user) {\n\t\tif (isObjectLike(user)) {\n\t\t\tconst provider = this.authenticatedProviderByObject.get(user);\n\t\t\tthis.authenticatedProviderByObject.delete(user);\n\t\t\treturn provider;\n\t\t}\n\t\tconst primitiveUser = user;\n\t\tconst provider = this.authenticatedProviderByPrimitive.get(primitiveUser);\n\t\tthis.authenticatedProviderByPrimitive.delete(primitiveUser);\n\t\treturn provider;\n\t}\n\tmapAuthenticatedUserToResourceId(user) {\n\t\tconst provider = this.takeAuthenticatedProvider(user);\n\t\tif (typeof provider?.mapUserToResourceId !== \"function\") return;\n\t\tconst resourceId = provider.mapUserToResourceId(user);\n\t\tif (resourceId === void 0 && provider instanceof CompositeAuth) return;\n\t\tif (typeof resourceId !== \"string\" || !resourceId.trim()) throw new Error(\"mapUserToResourceId must return a non-empty string for the authenticated user\");\n\t\treturn resourceId;\n\t}\n\t/**\n\t* True if any provider is MastraCloudAuth (exempt from license requirement).\n\t*/\n\tget isMastraCloudAuth() {\n\t\treturn this.providers.some((p) => \"isMastraCloudAuth\" in p && p.isMastraCloudAuth === true);\n\t}\n\t/**\n\t* True if any provider is SimpleAuth (exempt from license requirement).\n\t*/\n\tget isSimpleAuth() {\n\t\treturn this.providers.some((p) => \"isSimpleAuth\" in p && p.isSimpleAuth === true);\n\t}\n\tasync authenticateToken(token, request) {\n\t\tfor (const provider of this.providers) try {\n\t\t\tconst user = await provider.authenticateToken(token, request);\n\t\t\tif (user) {\n\t\t\t\tthis.rememberAuthenticatedProvider(user, provider);\n\t\t\t\treturn user;\n\t\t\t}\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tconsumePendingResponseHeaders(request) {\n\t\tlet merged;\n\t\tfor (const provider of this.providers) try {\n\t\t\tconst pending = provider.consumePendingResponseHeaders?.(request);\n\t\t\tif (pending) merged = {\n\t\t\t\t...merged ?? {},\n\t\t\t\t...pending\n\t\t\t};\n\t\t} catch {}\n\t\treturn merged;\n\t}\n\tasync authorizeUser(user, request) {\n\t\tfor (const provider of this.providers) if (await provider.authorizeUser(user, request)) return true;\n\t\treturn false;\n\t}\n\t/**\n\t* Forward cookie header to SSO provider for PKCE validation.\n\t* Called by auth handler before handleCallback().\n\t*/\n\tsetCallbackCookieHeader(cookieHeader) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (sso && typeof sso.setCallbackCookieHeader === \"function\") sso.setCallbackCookieHeader(cookieHeader);\n\t}\n\tgetLoginUrl(redirectUri, state) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) throw new Error(\"No SSO provider configured in CompositeAuth\");\n\t\treturn sso.getLoginUrl(redirectUri, state);\n\t}\n\tgetLoginCookies(redirectUri, state) {\n\t\treturn this.findProvider(isSSOProvider)?.getLoginCookies?.(redirectUri, state);\n\t}\n\tasync handleCallback(code, state) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) throw new Error(\"No SSO provider configured in CompositeAuth\");\n\t\treturn sso.handleCallback(code, state);\n\t}\n\tgetLoginButtonConfig() {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) return {\n\t\t\tprovider: \"unknown\",\n\t\t\ttext: \"Sign in\"\n\t\t};\n\t\treturn sso.getLoginButtonConfig();\n\t}\n\tasync getLogoutUrl(redirectUri, request) {\n\t\tfor (const provider of this.providers) if (isSSOProvider(provider) && provider.getLogoutUrl) try {\n\t\t\tconst url = await provider.getLogoutUrl(redirectUri, request);\n\t\t\tif (url) return url;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync createSession(userId, metadata) {\n\t\tconst session = this.findProvider(isSessionProvider);\n\t\tif (!session) throw new Error(\"No session provider configured in CompositeAuth\");\n\t\treturn session.createSession(userId, metadata);\n\t}\n\tasync validateSession(sessionId) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst session = await provider.validateSession(sessionId);\n\t\t\tif (session) return session;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync destroySession(sessionId) {\n\t\tconst destroyPromises = [];\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) destroyPromises.push(provider.destroySession(sessionId).catch(() => {}));\n\t\tawait Promise.all(destroyPromises);\n\t}\n\tasync refreshSession(sessionId) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst session = await provider.refreshSession(sessionId);\n\t\t\tif (session) return session;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tgetSessionIdFromRequest(request) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst sessionId = provider.getSessionIdFromRequest(request);\n\t\t\tif (sessionId) return sessionId;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tgetSessionHeaders(session) {\n\t\treturn this.findProvider(isSessionProvider)?.getSessionHeaders(session) ?? {};\n\t}\n\tgetClearSessionHeaders() {\n\t\tconst headers = {};\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst providerHeaders = provider.getClearSessionHeaders();\n\t\t\tObject.assign(headers, providerHeaders);\n\t\t} catch {}\n\t\treturn headers;\n\t}\n\tasync getCurrentUser(request) {\n\t\tfor (const provider of this.providers) if (isUserProvider(provider)) try {\n\t\t\tconst user = await provider.getCurrentUser(request);\n\t\t\tif (user) return user;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync getUser(userId) {\n\t\tfor (const provider of this.providers) if (isUserProvider(provider)) try {\n\t\t\tconst user = await provider.getUser(userId);\n\t\t\tif (user) return user;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync getUsers(userIds) {\n\t\treturn Promise.all(userIds.map((userId) => this.getUser(userId)));\n\t}\n};\nconst DEFAULT_HEADERS = [\"Authorization\", \"X-Playground-Access\"];\nvar SimpleAuth = class extends MastraAuthProvider {\n\t/**\n\t* Marker to exempt SimpleAuth from EE license requirement.\n\t* SimpleAuth is for development/testing and should work without a license.\n\t*/\n\tisSimpleAuth = true;\n\ttokens;\n\theaders;\n\tusers;\n\tuserById;\n\tconstructor(options) {\n\t\tsuper(options);\n\t\tthis.tokens = options.tokens;\n\t\tthis.users = Object.values(this.tokens);\n\t\tthis.headers = [...DEFAULT_HEADERS].concat(options.headers || []);\n\t\tthis.userById = new Map(this.users.map((u) => [String(u?.id), u]));\n\t}\n\tasync authenticateToken(token, request) {\n\t\tconst requestTokens = this.getTokensFromHeaders(token, request);\n\t\tfor (const requestToken of requestTokens) {\n\t\t\tconst tokenToUser = this.tokens[requestToken];\n\t\t\tif (tokenToUser) return tokenToUser;\n\t\t}\n\t\treturn this.getUserFromCookie(getRequestHeader(request, \"Cookie\"));\n\t}\n\tasync authorizeUser(user, _request) {\n\t\treturn this.users.includes(user);\n\t}\n\t/** Get current user from request headers or cookie. */\n\tasync getCurrentUser(request) {\n\t\tfor (const headerName of this.headers) {\n\t\t\tconst headerValue = request.headers.get(headerName);\n\t\t\tif (headerValue) {\n\t\t\t\tconst token = this.stripBearerPrefix(headerValue);\n\t\t\t\tconst user = this.tokens[token];\n\t\t\t\tif (user) return user;\n\t\t\t}\n\t\t}\n\t\treturn this.getUserFromCookie(request.headers.get(\"Cookie\"));\n\t}\n\tgetUserFromCookie(cookieHeader) {\n\t\tif (!cookieHeader) return null;\n\t\tconst cookies = cookieHeader.split(\";\").map((c) => c.trim());\n\t\tfor (const cookie of cookies) if (cookie.startsWith(\"mastra-token=\")) {\n\t\t\tconst token = cookie.slice(13);\n\t\t\tconst user = this.tokens[token];\n\t\t\tif (user) return user;\n\t\t}\n\t\treturn null;\n\t}\n\t/** Get user by ID. */\n\tasync getUser(userId) {\n\t\treturn this.userById.get(userId) ?? null;\n\t}\n\tasync getUsers(userIds) {\n\t\treturn userIds.map((userId) => this.userById.get(userId) ?? null);\n\t}\n\t/**\n\t* Sign in with token (passed as password field).\n\t* The email field is ignored - only the token matters.\n\t*/\n\tasync signIn(_email, password, _request) {\n\t\tconst token = password;\n\t\tconst user = this.tokens[token];\n\t\tif (!user) throw new Error(\"Invalid token\");\n\t\treturn {\n\t\t\tuser,\n\t\t\ttoken,\n\t\t\tcookies: [`mastra-token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`]\n\t\t};\n\t}\n\tasync signUp() {\n\t\tthrow new Error(\"Sign up is not supported with SimpleAuth. Use pre-configured tokens.\");\n\t}\n\tisSignUpEnabled() {\n\t\treturn false;\n\t}\n\t/**\n\t* Get headers to clear the session cookie on logout.\n\t* Partial ISessionProvider implementation for logout support.\n\t*/\n\tgetClearSessionHeaders() {\n\t\treturn { \"Set-Cookie\": \"mastra-token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0\" };\n\t}\n\tstripBearerPrefix(token) {\n\t\treturn token.startsWith(\"Bearer \") ? token.slice(7) : token;\n\t}\n\tgetTokensFromHeaders(token, request) {\n\t\tconst tokens = [token];\n\t\tfor (const headerName of this.headers) {\n\t\t\tconst headerValue = getRequestHeader(request, headerName);\n\t\t\tif (headerValue) tokens.push(this.stripBearerPrefix(headerValue));\n\t\t}\n\t\treturn tokens;\n\t}\n};\n//#endregion\nexport { CompositeAuth, MastraAuthProvider, SimpleAuth, hasAuthInit, isAuthHttpHandler, isCredentialsProvider, isOrganizationsProvider, isSSOProvider, isSessionProvider, isUserProvider };\n\n//# sourceMappingURL=index.js.map","import { createClerkClient } from '@clerk/backend';\nimport type { ClerkClient } from '@clerk/backend';\nimport type {\n  ISSOProvider,\n  ISessionProvider,\n  IUserProvider,\n  MastraAuthRequest,\n  Session,\n  SSOCallbackResult,\n  SSOLoginConfig,\n} from '@internal/auth';\nimport { getRequestHeader } from '@internal/auth';\nimport type { EEUser } from '@internal/auth/ee';\nimport type { MastraAuthProviderOptions } from '@internal/auth/provider';\nimport { MastraAuthProvider } from '@internal/auth/provider';\nimport { verifyJwks } from '@mastra/auth';\nimport type { JwtPayload } from '@mastra/auth';\n\ntype ClerkUser = JwtPayload;\n\n/** Default cookie name for Clerk SSO sessions */\nconst DEFAULT_COOKIE_NAME = 'clerk_session';\n\n/** Default cookie max age (24 hours) */\nconst DEFAULT_COOKIE_MAX_AGE = 86400;\n\n/** Default OAuth scopes */\nconst DEFAULT_SCOPES = ['openid', 'profile', 'email'];\n\n/** PBKDF2 salt length in bytes */\nconst SALT_LENGTH = 16;\n\n/** AES-GCM IV length in bytes */\nconst IV_LENGTH = 12;\n\n/**\n * Derive an AES-GCM key from password + salt using PBKDF2.\n */\nasync function deriveKey(password: string, salt: Uint8Array, usage: 'encrypt' | 'decrypt') {\n  const encoder = new TextEncoder();\n  const keyMaterial = await crypto.subtle.importKey('raw', encoder.encode(password), 'PBKDF2', false, [\n    'deriveBits',\n    'deriveKey',\n  ]);\n  return crypto.subtle.deriveKey(\n    { name: 'PBKDF2', salt, iterations: 100000, hash: 'SHA-256' },\n    keyMaterial,\n    { name: 'AES-GCM', length: 256 },\n    false,\n    [usage],\n  );\n}\n\n/**\n * Encrypt session data for cookie storage.\n * Format: base64(salt || iv || ciphertext)\n */\nasync function encryptSession(data: unknown, password: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const salt = crypto.getRandomValues(new Uint8Array(SALT_LENGTH));\n  const key = await deriveKey(password, salt, 'encrypt');\n  const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));\n  const encrypted = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, encoder.encode(JSON.stringify(data)));\n  const combined = new Uint8Array(salt.length + iv.length + new Uint8Array(encrypted).length);\n  combined.set(salt);\n  combined.set(iv, salt.length);\n  combined.set(new Uint8Array(encrypted), salt.length + iv.length);\n  return btoa(String.fromCharCode(...combined));\n}\n\n/**\n * Decrypt session data from cookie.\n */\nasync function decryptSession(encrypted: string, password: string): Promise<unknown> {\n  const combined = Uint8Array.from(atob(encrypted), c => c.charCodeAt(0));\n  const salt = combined.slice(0, SALT_LENGTH);\n  const iv = combined.slice(SALT_LENGTH, SALT_LENGTH + IV_LENGTH);\n  const data = combined.slice(SALT_LENGTH + IV_LENGTH);\n  const key = await deriveKey(password, salt, 'decrypt');\n  const decrypted = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, data);\n  return JSON.parse(new TextDecoder().decode(decrypted));\n}\n\n/** OAuth state token expiry (10 minutes) */\nconst STATE_TOKEN_EXPIRY_MS = 10 * 60 * 1000;\n\ninterface StatePayload {\n  /** Original state from caller */\n  s: string;\n  /** Redirect URI */\n  r: string;\n  /** Expiry timestamp */\n  e: number;\n}\n\n/**\n * Sign data using HMAC-SHA256 (Web Crypto API).\n * Returns base64url-encoded signature.\n */\nasync function hmacSign(data: string, secret: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const keyData = encoder.encode(secret);\n  const dataBytes = encoder.encode(data);\n\n  // Import the secret key for HMAC-SHA256\n  const cryptoKey = await crypto.subtle.importKey('raw', keyData, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);\n\n  // Sign the data\n  const signature = await crypto.subtle.sign('HMAC', cryptoKey, dataBytes);\n\n  // Convert to base64url\n  const sigBytes = new Uint8Array(signature);\n  return btoa(String.fromCharCode(...sigBytes))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '');\n}\n\n/**\n * Timing-safe string comparison.\n */\nfunction timingSafeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false;\n  let result = 0;\n  for (let i = 0; i < a.length; i++) {\n    result |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return result === 0;\n}\n\n/**\n * Create a signed state token for OAuth CSRF protection (stateless).\n * Format: base64(payload).base64url(signature)\n */\nasync function createStateToken(originalState: string, redirectUri: string, secret: string): Promise<string> {\n  const payload: StatePayload = {\n    s: originalState,\n    r: redirectUri,\n    e: Date.now() + STATE_TOKEN_EXPIRY_MS,\n  };\n  const payloadB64 = btoa(JSON.stringify(payload));\n  const signature = await hmacSign(payloadB64, secret);\n  return `${payloadB64}.${signature}`;\n}\n\n/**\n * Verify and decode a state token.\n * Returns the original state and redirectUri if valid and not expired.\n */\nasync function verifyStateToken(\n  stateToken: string,\n  secret: string,\n): Promise<{ originalState: string; redirectUri: string }> {\n  const parts = stateToken.split('.');\n  if (parts.length !== 2) {\n    throw new Error('Invalid state token format');\n  }\n\n  const [payloadB64, signature] = parts;\n  const expectedSig = await hmacSign(payloadB64!, secret);\n  if (!timingSafeEqual(signature!, expectedSig)) {\n    throw new Error('Invalid state token signature');\n  }\n\n  const payload = JSON.parse(atob(payloadB64!)) as StatePayload;\n  if (payload.e < Date.now()) {\n    throw new Error('State token has expired');\n  }\n\n  return { originalState: payload.s, redirectUri: payload.r };\n}\n\n/**\n * Escape special regex characters in a string.\n */\nfunction escapeRegex(str: string): string {\n  return str.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\n/**\n * Derive the Frontend API (FAPI) URL from a Clerk publishable key.\n * The publishable key is: prefix + base64(fapiDomain + \"$\")\n */\nfunction deriveFapiUrl(publishableKey: string): string {\n  const withoutPrefix = publishableKey.replace(/^pk_(test|live)_/, '');\n  const decoded = atob(withoutPrefix);\n  const domain = decoded.replace(/\\$$/, '');\n  return `https://${domain}`;\n}\n\ninterface MastraAuthClerkSessionOptions {\n  /** Cookie name for the session (default: 'clerk_session') */\n  cookieName?: string;\n  /** Cookie max age in seconds (default: 86400 = 24 hours) */\n  cookieMaxAge?: number;\n  /** Cookie encryption password (min 32 chars). Falls back to CLERK_COOKIE_PASSWORD env var */\n  cookiePassword?: string;\n  /** Use Secure flag on cookies (default: true in production) */\n  secureCookies?: boolean;\n}\n\ninterface MastraAuthClerkOptions extends MastraAuthProviderOptions<ClerkUser> {\n  jwksUri?: string;\n  secretKey?: string;\n  publishableKey?: string;\n  /**\n   * OAuth Client ID for Clerk as IdP (SSO).\n   * Create an OAuth Application in the Clerk Dashboard to get this.\n   * Falls back to CLERK_OAUTH_CLIENT_ID env var.\n   */\n  oauthClientId?: string;\n  /**\n   * OAuth Client Secret for Clerk as IdP (SSO).\n   * Falls back to CLERK_OAUTH_CLIENT_SECRET env var.\n   */\n  oauthClientSecret?: string;\n  /**\n   * OAuth redirect URI for the SSO callback.\n   * Falls back to CLERK_OAUTH_REDIRECT_URI env var.\n   * Typically: http://localhost:4111/api/auth/sso/callback\n   */\n  redirectUri?: string;\n  /**\n   * OAuth scopes to request (default: ['openid', 'profile', 'email'])\n   */\n  scopes?: string[];\n  /**\n   * Restrict login to members of a single Clerk organization, identified by its ID.\n   * When set, users who are not members of this organization are denied access.\n   * Falls back to the CLERK_ORGANIZATION_ID env var.\n   */\n  organizationId?: string;\n  /**\n   * Restrict login to members of a single Clerk organization, identified by its slug.\n   * When set, users who are not members of this organization are denied access.\n   * Falls back to the CLERK_ORGANIZATION_SLUG env var.\n   */\n  organizationSlug?: string;\n  /**\n   * Session configuration for SSO cookie management.\n   */\n  session?: MastraAuthClerkSessionOptions;\n}\n\n/**\n * Clerk authentication provider for Mastra.\n *\n * Always implements IUserProvider for JWT-based user detection.\n *\n * When OAuth credentials are configured (oauthClientId + oauthClientSecret),\n * also dynamically adds ISSOProvider + ISessionProvider methods for Studio login\n * using Clerk as an OAuth 2.0 / OIDC Identity Provider.\n *\n * @example Basic usage (IUserProvider only — validates JWTs)\n * ```typescript\n * const auth = new MastraAuthClerk({\n *   jwksUri: 'https://your-app.clerk.accounts.dev/.well-known/jwks.json',\n *   secretKey: 'sk_test_...',\n *   publishableKey: 'pk_test_...',\n * });\n * ```\n *\n * @example With SSO for Studio login\n * ```typescript\n * const auth = new MastraAuthClerk({\n *   jwksUri: 'https://your-app.clerk.accounts.dev/.well-known/jwks.json',\n *   secretKey: 'sk_test_...',\n *   publishableKey: 'pk_test_...',\n *   oauthClientId: 'your-oauth-client-id',\n *   oauthClientSecret: 'your-oauth-client-secret',\n * });\n * ```\n */\nexport class MastraAuthClerk extends MastraAuthProvider<ClerkUser> implements IUserProvider<EEUser> {\n  protected clerk: ClerkClient;\n  protected jwksUri: string;\n  protected publishableKey: string;\n  protected fapiUrl: string;\n\n  // SSO fields\n  private oauthClientId: string | null;\n  private oauthClientSecret: string | null;\n  private _redirectUri: string | null;\n  private scopes: string[];\n  private cookieName: string;\n  private cookieMaxAge: number;\n  private cookiePassword: string;\n  private secureCookies: boolean;\n  private ssoEnabled: boolean;\n\n  // Single-organization restriction (optional)\n  private organizationId: string | null;\n  private organizationSlug: string | null;\n  private orgRestricted: boolean;\n\n  constructor(options?: MastraAuthClerkOptions) {\n    super({ name: options?.name ?? 'clerk' });\n\n    const jwksUri = options?.jwksUri ?? process.env.CLERK_JWKS_URI;\n    const secretKey = options?.secretKey ?? process.env.CLERK_SECRET_KEY;\n    const publishableKey = options?.publishableKey ?? process.env.CLERK_PUBLISHABLE_KEY;\n\n    if (!jwksUri || !secretKey || !publishableKey) {\n      throw new Error(\n        'Clerk JWKS URI, secret key and publishable key are required, please provide them in the options or set the environment variables CLERK_JWKS_URI, CLERK_SECRET_KEY and CLERK_PUBLISHABLE_KEY',\n      );\n    }\n\n    this.jwksUri = jwksUri;\n    this.publishableKey = publishableKey;\n    this.fapiUrl = deriveFapiUrl(publishableKey);\n    this.clerk = createClerkClient({\n      secretKey,\n      publishableKey,\n    });\n\n    // SSO configuration (optional — enables Studio login)\n    const oauthClientId = options?.oauthClientId ?? process.env.CLERK_OAUTH_CLIENT_ID;\n    const oauthClientSecret = options?.oauthClientSecret ?? process.env.CLERK_OAUTH_CLIENT_SECRET;\n    const redirectUri = options?.redirectUri ?? process.env.CLERK_OAUTH_REDIRECT_URI;\n    const cookiePassword =\n      options?.session?.cookiePassword ??\n      process.env.CLERK_COOKIE_PASSWORD ??\n      crypto.randomUUID() + crypto.randomUUID();\n\n    this.oauthClientId = oauthClientId ?? null;\n    this.oauthClientSecret = oauthClientSecret ?? null;\n    this._redirectUri = redirectUri ?? null;\n    this.scopes = options?.scopes ?? DEFAULT_SCOPES;\n    this.cookieName = options?.session?.cookieName ?? DEFAULT_COOKIE_NAME;\n    this.cookieMaxAge = options?.session?.cookieMaxAge ?? DEFAULT_COOKIE_MAX_AGE;\n    this.cookiePassword = cookiePassword;\n    this.secureCookies = options?.session?.secureCookies ?? process.env.NODE_ENV === 'production';\n\n    // Single-organization restriction (optional)\n    this.organizationId = options?.organizationId ?? process.env.CLERK_ORGANIZATION_ID ?? null;\n    this.organizationSlug = options?.organizationSlug ?? process.env.CLERK_ORGANIZATION_SLUG ?? null;\n    if (this.organizationId && this.organizationSlug) {\n      // Both selectors set (e.g. an option paired with a stale env var) could\n      // resolve to two different organizations and grant access to both,\n      // contradicting the single-organization guarantee. Require exactly one.\n      throw new Error(\n        'Configure only one of organizationId (CLERK_ORGANIZATION_ID) or organizationSlug (CLERK_ORGANIZATION_SLUG) to restrict login to a single Clerk organization',\n      );\n    }\n    this.orgRestricted = !!(this.organizationId || this.organizationSlug);\n\n    // SSO is enabled when OAuth credentials are configured\n    this.ssoEnabled = !!(oauthClientId && oauthClientSecret);\n\n    if (this.ssoEnabled) {\n      if (cookiePassword.length < 32) {\n        throw new Error(\n          'Cookie password must be at least 32 characters for SSO. Set CLERK_COOKIE_PASSWORD environment variable.',\n        );\n      }\n\n      if (!options?.session?.cookiePassword && !process.env.CLERK_COOKIE_PASSWORD) {\n        console.warn(\n          '[MastraAuthClerk] No cookie password set — using auto-generated value. Sessions will not survive restarts. Set CLERK_COOKIE_PASSWORD for production use.',\n        );\n      }\n\n      // Dynamically add ISSOProvider + ISessionProvider methods\n      // so that duck-typing detection (implementsInterface) only finds them when SSO is configured\n      this._attachSSOProvider();\n      this._attachSessionProvider();\n    }\n\n    this.registerOptions(options);\n  }\n\n  // ============================================================================\n  // MastraAuthProvider Implementation\n  // ============================================================================\n\n  async authenticateToken(token: string, request?: MastraAuthRequest): Promise<ClerkUser | null> {\n    // When SSO is enabled, try the encrypted session cookie first (like Okta pattern).\n    // The auth middleware may call this with an empty token for browser requests\n    // that only carry a session cookie.\n    if (this.ssoEnabled && request) {\n      const sessionUser = await this.getUserFromSessionCookie(request);\n      if (sessionUser) return sessionUser as unknown as ClerkUser;\n    }\n\n    // Fall back to JWT verification from Authorization header\n    if (!token || typeof token !== 'string') {\n      return null;\n    }\n\n    try {\n      const user = await verifyJwks(token, this.jwksUri);\n      return user;\n    } catch {\n      return null;\n    }\n  }\n\n  async authorizeUser(user: ClerkUser) {\n    // Session cookie users have `id`, JWT users have `sub`\n    const userId = user.sub || (user as unknown as EEUser).id;\n    if (!userId) return false;\n\n    if (this.orgRestricted) {\n      return this.isUserInOrganization(userId, user);\n    }\n\n    return true;\n  }\n\n  /**\n   * Check whether a user belongs to the configured single organization.\n   *\n   * Fast path: if the token/claims already carry `org_id`/`org_slug` for an\n   * org-scoped session, match against them without an API call. Otherwise fall\n   * back to listing the user's organization memberships via the Clerk API.\n   *\n   * Fails closed: if membership cannot be determined (e.g. API error), access\n   * is denied.\n   */\n  protected async isUserInOrganization(userId: string, claims?: ClerkUser): Promise<boolean> {\n    const claimOrgId = (claims as Record<string, unknown> | undefined)?.org_id as string | undefined;\n    const claimOrgSlug = (claims as Record<string, unknown> | undefined)?.org_slug as string | undefined;\n\n    if (\n      (this.organizationId && claimOrgId === this.organizationId) ||\n      (this.organizationSlug && claimOrgSlug === this.organizationSlug)\n    ) {\n      return true;\n    }\n\n    const matches = (membership: { organization?: { id?: string; slug?: string } }) =>\n      (this.organizationId && membership.organization?.id === this.organizationId) ||\n      (this.organizationSlug && membership.organization?.slug === this.organizationSlug);\n\n    // The Clerk API paginates memberships (default page size 10), so a user in\n    // more organizations than one page could be falsely denied. Walk every page\n    // until a match is found or the full list is exhausted.\n    const limit = 100;\n    try {\n      for (let offset = 0; ; offset += limit) {\n        const memberships = await this.clerk.users.getOrganizationMembershipList({ userId, limit, offset });\n        const list = (memberships as { data?: Array<{ organization?: { id?: string; slug?: string } }> })?.data ?? [];\n        if (list.some(matches)) return true;\n\n        const totalCount = (memberships as { totalCount?: number })?.totalCount;\n        const fetched = offset + list.length;\n        if (list.length < limit || (typeof totalCount === 'number' && fetched >= totalCount)) {\n          return false;\n        }\n      }\n    } catch {\n      return false;\n    }\n  }\n\n  // ============================================================================\n  // IUserProvider Implementation\n  // ============================================================================\n\n  /**\n   * Extract the bearer token from the request's Authorization header or __session cookie.\n   */\n  private extractToken(request: Request): string | null {\n    const authHeader = request.headers.get('Authorization');\n    if (authHeader) {\n      const token = authHeader.replace(/^Bearer\\s+/i, '').trim();\n      if (token) return token;\n    }\n\n    const cookie = request.headers.get('Cookie');\n    if (cookie) {\n      // Clerk's default session cookie is __session\n      const match = cookie.match(/__session=([^;]+)/);\n      if (match?.[1]) return match[1];\n    }\n\n    return null;\n  }\n\n  async getCurrentUser(request: Request): Promise<EEUser | null> {\n    // First try to get user from our SSO session cookie\n    if (this.ssoEnabled) {\n      const sessionUser = await this.getUserFromSessionCookie(request);\n      if (sessionUser) return sessionUser;\n    }\n\n    // Fall back to token-based auth (Authorization header or __session cookie)\n    const token = this.extractToken(request);\n    if (!token) return null;\n\n    try {\n      const payload = await this.authenticateToken(token);\n      if (!payload?.sub) return null;\n\n      // Try to fetch full user details from Clerk API\n      try {\n        const clerkUser = await this.clerk.users.getUser(payload.sub);\n        return {\n          id: clerkUser.id,\n          email: clerkUser.emailAddresses?.[0]?.emailAddress,\n          name: [clerkUser.firstName, clerkUser.lastName].filter(Boolean).join(' ') || undefined,\n          avatarUrl: clerkUser.imageUrl,\n          metadata: clerkUser.publicMetadata as Record<string, unknown> | undefined,\n        };\n      } catch {\n        // Fall back to JWT claims if Clerk API call fails\n        return {\n          id: payload.sub,\n          email: (payload.email as string) ?? undefined,\n          name: (payload.name as string) ?? undefined,\n        };\n      }\n    } catch {\n      return null;\n    }\n  }\n\n  async getUser(userId: string): Promise<EEUser | null> {\n    try {\n      const clerkUser = await this.clerk.users.getUser(userId);\n      return {\n        id: clerkUser.id,\n        email: clerkUser.emailAddresses?.[0]?.emailAddress,\n        name: [clerkUser.firstName, clerkUser.lastName].filter(Boolean).join(' ') || undefined,\n        avatarUrl: clerkUser.imageUrl,\n        metadata: clerkUser.publicMetadata as Record<string, unknown> | undefined,\n      };\n    } catch {\n      return null;\n    }\n  }\n\n  getUserProfileUrl(user: EEUser): string {\n    return `/user/${user.id}`;\n  }\n\n  // ============================================================================\n  // Helper Methods\n  // ============================================================================\n\n  /**\n   * Check if SSO is enabled (OAuth credentials are configured).\n   */\n  isSSOEnabled(): boolean {\n    return this.ssoEnabled;\n  }\n\n  /**\n   * Get the derived Frontend API URL.\n   */\n  getFapiUrl(): string {\n    return this.fapiUrl;\n  }\n\n  /**\n   * Build consistent cookie attribute string for set/clear operations.\n   */\n  private cookieFlags(maxAge: number): string {\n    const flags = `Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAge}`;\n    return this.secureCookies ? `${flags}; Secure` : flags;\n  }\n\n  /**\n   * Extract user from the encrypted SSO session cookie.\n   */\n  private async getUserFromSessionCookie(request: MastraAuthRequest): Promise<EEUser | null> {\n    const cookie = getRequestHeader(request, 'cookie');\n    if (!cookie) return null;\n\n    const match = cookie.match(new RegExp(`(?:^|;\\\\s*)${escapeRegex(this.cookieName)}=([^;]+)`));\n    if (!match?.[1]) return null;\n\n    try {\n      const sessionData = (await decryptSession(decodeURIComponent(match[1]), this.cookiePassword)) as {\n        user: EEUser;\n        expiresAt: number;\n      };\n\n      if (sessionData.expiresAt < Date.now()) {\n        return null; // Session expired\n      }\n\n      return sessionData.user;\n    } catch {\n      return null; // Invalid/corrupt cookie\n    }\n  }\n\n  // ============================================================================\n  // Dynamic ISSOProvider attachment (only when OAuth is configured)\n  // ============================================================================\n\n  /**\n   * Dynamically attach ISSOProvider methods to this instance.\n   * This ensures duck-typing detection only finds these methods when SSO is configured.\n   */\n  private _attachSSOProvider() {\n    const self = this;\n\n    (this as unknown as ISSOProvider<EEUser>).getLoginUrl = async function (\n      redirectUri: string,\n      state: string,\n    ): Promise<string> {\n      // Create signed state token containing redirectUri and expiry\n      // This is stateless — works in serverless and load-balanced environments\n      const actualRedirectUri = redirectUri ?? self._redirectUri;\n      if (!actualRedirectUri) {\n        throw new Error('Redirect URI is required for SSO login');\n      }\n\n      const signedState = await createStateToken(state, actualRedirectUri, self.cookiePassword);\n\n      const params = new URLSearchParams({\n        client_id: self.oauthClientId!,\n        response_type: 'code',\n        scope: self.scopes.join(' '),\n        redirect_uri: actualRedirectUri,\n        state: signedState,\n      });\n\n      return `${self.fapiUrl}/oauth/authorize?${params.toString()}`;\n    };\n\n    (this as unknown as ISSOProvider<EEUser>).handleCallback = async function (\n      code: string,\n      stateToken: string,\n    ): Promise<SSOCallbackResult<EEUser>> {\n      // Verify and decode the signed state token (throws if invalid/expired)\n      const { redirectUri } = await verifyStateToken(stateToken, self.cookiePassword);\n\n      // Exchange code for tokens using client_secret (confidential client)\n      const tokenResponse = await fetch(`${self.fapiUrl}/oauth/token`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n          Authorization: `Basic ${btoa(`${self.oauthClientId}:${self.oauthClientSecret}`)}`,\n        },\n        body: new URLSearchParams({\n          grant_type: 'authorization_code',\n          code,\n          redirect_uri: redirectUri,\n        }),\n        signal: AbortSignal.timeout(10_000), // 10 second timeout\n      });\n\n      if (!tokenResponse.ok) {\n        const error = await tokenResponse.text();\n        throw new Error(`Token exchange failed: ${error}`);\n      }\n\n      const tokens = (await tokenResponse.json()) as {\n        access_token: string;\n        id_token?: string;\n        refresh_token?: string;\n        expires_in: number;\n        token_type: string;\n      };\n\n      // Get user info — try ID token first, fall back to userinfo endpoint\n      let user: EEUser;\n      if (tokens.id_token) {\n        const payload = await verifyJwks(tokens.id_token, self.jwksUri);\n        user = {\n          id: payload.sub!,\n          email: (payload.email as string) ?? undefined,\n          name: (payload.name as string) ?? undefined,\n          avatarUrl: (payload.picture as string) ?? undefined,\n        };\n      } else {\n        const userInfoResponse = await fetch(`${self.fapiUrl}/oauth/userinfo`, {\n          headers: { Authorization: `Bearer ${tokens.access_token}` },\n          signal: AbortSignal.timeout(10_000), // 10 second timeout\n        });\n\n        if (!userInfoResponse.ok) {\n          throw new Error('Failed to fetch user info from Clerk');\n        }\n\n        const userInfo = (await userInfoResponse.json()) as {\n          sub: string;\n          email?: string;\n          name?: string;\n          picture?: string;\n        };\n        user = {\n          id: userInfo.sub,\n          email: userInfo.email,\n          name: userInfo.name,\n          avatarUrl: userInfo.picture,\n        };\n      }\n\n      // Try to enrich user with full Clerk data\n      try {\n        const fullUser = await self.getUser(user.id);\n        if (fullUser) {\n          user = fullUser;\n        }\n      } catch {\n        // Use the user info we already have\n      }\n\n      // Enforce single-organization restriction (fails closed)\n      if (self.orgRestricted && !(await self.isUserInOrganization(user.id))) {\n        throw new Error('User is not a member of the required organization');\n      }\n\n      // Create encrypted session cookie\n      const sessionData = {\n        user,\n        expiresAt: Date.now() + self.cookieMaxAge * 1000,\n      };\n\n      const encryptedSession = await encryptSession(sessionData, self.cookiePassword);\n      const cookieValue = `${self.cookieName}=${encodeURIComponent(encryptedSession)}; ${self.cookieFlags(self.cookieMaxAge)}`;\n\n      return {\n        user,\n        tokens: {\n          accessToken: tokens.access_token,\n          refreshToken: tokens.refresh_token,\n          idToken: tokens.id_token,\n          expiresAt: new Date(Date.now() + tokens.expires_in * 1000),\n        },\n        cookies: [cookieValue],\n      };\n    };\n\n    (this as unknown as ISSOProvider<EEUser>).getLoginButtonConfig = function (): SSOLoginConfig {\n      return {\n        provider: 'clerk',\n        text: 'Sign in with Clerk',\n        description: 'Sign in using your Clerk account',\n      };\n    };\n\n    (this as unknown as ISSOProvider<EEUser>).getLoginCookies = function (_state: string): string[] {\n      return [];\n    };\n\n    (this as unknown as ISSOProvider<EEUser>).getLogoutUrl = async function (\n      _redirectUri: string,\n      _request?: Request,\n    ): Promise<string | null> {\n      return null;\n    };\n  }\n\n  // ============================================================================\n  // Dynamic ISessionProvider attachment (only when OAuth is configured)\n  // ============================================================================\n\n  /**\n   * Dynamically attach ISessionProvider methods to this instance.\n   */\n  private _attachSessionProvider() {\n    const self = this;\n\n    (this as unknown as ISessionProvider<Session>).createSession = async function (\n      userId: string,\n      metadata?: Record<string, unknown>,\n    ): Promise<Session> {\n      const now = new Date();\n      return {\n        id: crypto.randomUUID(),\n        userId,\n        createdAt: now,\n        expiresAt: new Date(now.getTime() + self.cookieMaxAge * 1000),\n        metadata,\n      };\n    };\n\n    // Cookie-only sessions — validation happens via decryption in getUserFromSessionCookie/authenticateToken\n    (this as unknown as ISessionProvider<Session>).validateSession = async function (\n      _sessionId: string,\n    ): Promise<Session | null> {\n      return null;\n    };\n\n    // Cookie-only sessions — destruction happens via getClearSessionHeaders setting Max-Age=0\n    (this as unknown as ISessionProvider<Session>).destroySession = async function (\n      _sessionId: string,\n    ): Promise<void> {};\n\n    // Cookie-only sessions — refresh not supported; user must re-authenticate after expiry\n    (this as unknown as ISessionProvider<Session>).refreshSession = async function (\n      _sessionId: string,\n    ): Promise<Session | null> {\n      return null;\n    };\n\n    (this as unknown as ISessionProvider<Session>).getSessionIdFromRequest = function (\n      request: Request,\n    ): string | null {\n      const cookie = request.headers.get('Cookie');\n      if (!cookie) return null;\n      const match = cookie.match(new RegExp(`(?:^|;\\\\s*)${escapeRegex(self.cookieName)}=([^;]+)`));\n      return match?.[1] ? decodeURIComponent(match[1]) : null;\n    };\n\n    (this as unknown as ISessionProvider<Session>).getSessionHeaders = function (\n      _session: Session,\n    ): Record<string, string> {\n      return {};\n    };\n\n    (this as unknown as ISessionProvider<Session>).getClearSessionHeaders = function (): Record<string, string> {\n      return {\n        'Set-Cookie': `${self.cookieName}=; ${self.cookieFlags(0)}`,\n      };\n    };\n  }\n}\n"],"mappings":";;;;AACA,SAAS,sBAAsB,SAAS,MAAM;CAC7C,MAAM,iBAAiB,KAAK,YAAY;CACxC,MAAM,cAAc,OAAO,KAAK,OAAO,CAAC,CAAC,MAAM,QAAQ,IAAI,YAAY,MAAM,cAAc;CAC3F,MAAM,QAAQ,gBAAgB,KAAK,IAAI,KAAK,IAAI,QAAQ;CACxD,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,MAAM,OAAO,SAAS;AAC3D;;;;;AAKA,SAAS,iBAAiB,SAAS,MAAM;CACxC,IAAI,mBAAmB,SAAS,OAAO,QAAQ,QAAQ,IAAI,IAAI;CAC/D,IAAI,QAAQ,eAAe,SAAS,OAAO,QAAQ,IAAI,QAAQ,IAAI,IAAI;CACvE,MAAM,UAAU,QAAQ;CACxB,IAAI,mBAAmB,SAAS,OAAO,QAAQ,IAAI,IAAI;CACvD,IAAI,OAAO,QAAQ,WAAW,YAAY,OAAO,QAAQ,OAAO,IAAI,KAAK;CACzE,IAAI,WAAW,OAAO,YAAY,UAAU,OAAO,sBAAsB,SAAS,IAAI;CACtF,OAAO;AACR;;;;;;;;ACTA,SAAS,uBAAuB,KAAK,OAAO,UAAU;CACrD,IAAI,CAAC,KAAK,QAAQ,QAAQ;CAC1B,IAAI;EACH,MAAM,cAAc;EACpB,IAAI,WAAW,CAAC,EAAE,MAAM,MAAM,SAAS;GACtC,GAAG,YAAY,OAAO,KAAK,IAAI,EAAE,SAAS,YAAY,GAAG,IAAI,CAAC;GAC9D,GAAG,YAAY,WAAW,KAAK,IAAI,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;GACrE,GAAG,YAAY,aAAa,KAAK,IAAI,EAAE,UAAU,YAAY,SAAS,IAAI,CAAC;GAC3E,GAAG,YAAY,YAAY,KAAK,IAAI,EAAE,SAAS,YAAY,QAAQ,IAAI,CAAC;GACxE,GAAG,MAAM,iBAAiB,QAAQ,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,CAAC;GACpE,GAAG;EACJ,CAAC;CACF,QAAQ,CAAC;AACV;;;;;;;AAOA,SAAS,mBAAmB,MAAM;CACjC,MAAM,aAAa,KAAK,MAAM,QAAQ,QAAQ,QAAQ,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,KAAK,EAAE,eAAe,MAAM;CAC/H,MAAM,WAAW,KAAK,MAAM,QAAQ,eAAe,KAAK;CACxD,MAAM,YAAY,KAAK,QAAQ,QAAQ,QAAQ,cAAc,QAAQ,QAAQ;CAC7E,IAAI,CAAC,cAAc,CAAC,YAAY,UAAU,WAAW,GAAG,OAAO,KAAK;CACpE,OAAO;EACN,GAAG,cAAc,CAAC;EAClB,GAAG,WAAW,EAAE,OAAO;GACtB,MAAM,SAAS;GACf,SAAS,SAAS;GAClB,OAAO,SAAS;EACjB,EAAE,IAAI,CAAC;EACP,GAAG,UAAU,SAAS,IAAI,EAAE,MAAM,UAAU,IAAI,CAAC;CAClD;AACD;AAGA,MAAM,mBAAmB;CACxB,OAAO;CACP,eAAe;CACf,MAAM;CACN,SAAS;CACT,SAAS;CACT,UAAU;CACV,KAAK;CACL,KAAK;CACL,OAAO;CACP,QAAQ;CACR,SAAS;CACT,UAAU;CACV,QAAQ;CACR,SAAS;CACT,YAAY;CACZ,YAAY;CACZ,cAAc;CACd,QAAQ;CACR,WAAW;CACX,SAAS;AACV;AACA,MAAM,WAAW;CAChB,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACP,MAAM;AACP;AAiCA,IAAI,eAAe,MAAM;CACxB;CACA;CACA;CACA,YAAY,UAAU,CAAC,GAAG;EACzB,KAAK,OAAO,QAAQ,QAAQ;EAC5B,KAAK,QAAQ,QAAQ,SAAS,SAAS;EACvC,KAAK,aAAa,IAAI,IAAI,OAAO,QAAQ,QAAQ,cAAc,CAAC,CAAC,CAAC;CACnE;CACA,gBAAgB;EACf,OAAO,KAAK;CACb;CACA,eAAe,QAAQ,WAAW,CAAC;CACnC,MAAM,SAAS,aAAa,QAAQ;EACnC,IAAI,CAAC,eAAe,CAAC,KAAK,WAAW,IAAI,WAAW,GAAG,OAAO;GAC7D,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ,QAAQ;GACtB,SAAS,QAAQ,WAAW;GAC5B,SAAS;EACV;EACA,OAAO,KAAK,WAAW,IAAI,WAAW,CAAC,CAAC,WAAW,MAAM,KAAK;GAC7D,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ,QAAQ;GACtB,SAAS,QAAQ,WAAW;GAC5B,SAAS;EACV;CACD;CACA,MAAM,gBAAgB,EAAE,aAAa,OAAO,UAAU,QAAQ,UAAU,SAAS,MAAM,WAAW;EACjG,IAAI,CAAC,eAAe,CAAC,KAAK,WAAW,IAAI,WAAW,KAAK,CAAC,OAAO,OAAO;GACvE,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ;GACd,SAAS,WAAW;GACpB,SAAS;EACV;EACA,OAAO,KAAK,WAAW,IAAI,WAAW,CAAC,CAAC,kBAAkB;GACzD;GACA;GACA;GACA;GACA;GACA;GACA;EACD,CAAC,KAAK;GACL,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ;GACd,SAAS,WAAW;GACpB,SAAS;EACV;CACD;AACD;AACA,IAAI,gBAAgB,MAAM,sBAAsB,aAAa;CAC5D;CACA;CACA;CACA,YAAY,UAAU,CAAC,GAAG;EACzB,MAAM,OAAO;EACb,KAAK,YAAY,QAAQ;EACzB,KAAK,SAAS,QAAQ;CACvB;;;;;;CAMA,sBAAsB,KAAK;EAC1B,KAAK,kBAAkB;CACxB;CACA,MAAM,qBAAqB;EAC1B,MAAM,YAAY,OAAO,wBAAwB,WAAW,sBAAsB,qBAAqB,aAAa,KAAK;EACzH,MAAM,QAAQ,IAAI,cAAc;GAC/B,MAAM,KAAK;GACX,OAAO,KAAK;GACZ;GACA,QAAQ,KAAK;EACd,CAAC;EACD,IAAI,KAAK,iBAAiB,MAAM,sBAAsB,KAAK,eAAe;EAC1E,OAAO;CACR;;;;;CAKA,WAAW,MAAM;EAChB,MAAM,MAAM,KAAK;EACjB,IAAI,CAAC,KAAK,QAAQ,aAAa,OAAO;EACtC,IAAI;GACH,MAAM,SAAS,IAAI,mBAAmB;GACtC,OAAO,SAAS,CAAC,GAAG,MAAM,MAAM,IAAI;EACrC,QAAQ;GACP,OAAO;EACR;CACD;;;;;;CAMA,QAAQ,OAAO,SAAS,MAAM;EAC7B,MAAM,MAAM,KAAK;EACjB,IAAI,CAAC,KAAK,QAAQ,QAAQ;EAC1B,IAAI;GACH,IAAI,WAAW,CAAC,GAAG,MAAM,CAAC,SAAS,mBAAmB,IAAI,CAAC;EAC5D,QAAQ,CAAC;CACV;CACA,UAAU,OAAO,SAAS,MAAM;EAC/B,IAAI,CAAC,KAAK,QAAQ,OAAO;EACzB,IAAI;GACH,OAAO,KAAK,OAAO;IAClB,WAAW,KAAK;IAChB;IACA;IACA;GACD,CAAC;EACF,SAAS,GAAG;GACX,QAAQ,MAAM,uCAAuC,KAAK,UAAU,SAAS,MAAM,IAAI,CAAC;GACxF,OAAO;EACR;CACD;CACA,SAAS;EACR,OAAO,KAAK,YAAY,IAAI,KAAK,UAAU,MAAM;CAClD;CACA,MAAM,SAAS,GAAG,MAAM;EACvB,IAAI,KAAK,UAAU,SAAS,SAAS,KAAK,UAAU,SAAS,OAAO,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAK,WAAW,IAAI,CAAC;EACvJ,KAAK,QAAQ,SAAS,SAAS,IAAI;CACpC;CACA,KAAK,SAAS,GAAG,MAAM;EACtB,KAAK,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,MAAM,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAK,WAAW,IAAI,CAAC;EACxL,KAAK,QAAQ,QAAQ,SAAS,IAAI;CACnC;CACA,KAAK,SAAS,GAAG,MAAM;EACtB,KAAK,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,MAAM,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAK,WAAW,IAAI,CAAC;EACxN,KAAK,QAAQ,QAAQ,SAAS,IAAI;CACnC;CACA,MAAM,SAAS,GAAG,MAAM;EACvB,KAAK,KAAK,UAAU,SAAS,SAAS,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,OAAO,SAAS,IAAI,GAAG,QAAQ,MAAM,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAK,WAAW,IAAI,CAAC;EAC3P,KAAK,QAAQ,SAAS,SAAS,IAAI;CACpC;CACA,eAAe,OAAO,UAAU;EAC/B,uBAAuB,KAAK,iBAAiB,OAAO,QAAQ;CAC7D;CACA,MAAM,SAAS,cAAc,SAAS;EACrC,OAAO;GACN,MAAM,CAAC;GACP,OAAO;GACP,MAAM,SAAS,QAAQ;GACvB,SAAS,SAAS,WAAW;GAC7B,SAAS;EACV;CACD;CACA,MAAM,gBAAgB,OAAO;EAC5B,OAAO;GACN,MAAM,CAAC;GACP,OAAO;GACP,MAAM,MAAM,QAAQ;GACpB,SAAS,MAAM,WAAW;GAC1B,SAAS;EACV;CACD;AACD;;;AC5QA,IAAI,aAAa,MAAM;CACtB,YAAY,iBAAiB;CAC7B;CACA;CACA;CACA,YAAY,EAAE,WAAW,MAAM,aAAa;EAC3C,KAAK,YAAY,aAAa,iBAAiB;EAC/C,KAAK,OAAO;EACZ,KAAK,aAAa;EAClB,KAAK,SAAS,IAAI,cAAc,EAAE,MAAM,GAAG,KAAK,UAAU,KAAK,KAAK,OAAO,CAAC;CAC7E;;;;;CAKA,cAAc;EACb,OAAO,KAAK;CACb;;;;;CAKA,eAAe,WAAW;EACzB,KAAK,aAAa;CACnB;;;;;CAKA,YAAY,QAAQ;EACnB,KAAK,SAAS,WAAW,UAAU,OAAO,OAAO,UAAU,aAAa,OAAO,MAAM,EAAE,WAAW,KAAK,UAAU,CAAC,IAAI;CACvH;AACD;;;AC/BA,IAAI,qBAAqB,cAAc,WAAW;CACjD;CACA;CACA,YAAY,SAAS;EACpB,MAAM;GACL,WAAW;GACX,MAAM,SAAS;EAChB,CAAC;EACD,IAAI,SAAS,eAAe,KAAK,gBAAgB,QAAQ,cAAc,KAAK,IAAI;EAChF,KAAK,YAAY,SAAS;EAC1B,KAAK,SAAS,SAAS;EACvB,KAAK,sBAAsB,SAAS;CACrC;CACA,gBAAgB,MAAM;EACrB,IAAI,MAAM,eAAe,KAAK,gBAAgB,KAAK,cAAc,KAAK,IAAI;EAC1E,IAAI,MAAM,qBAAqB,KAAK,sBAAsB,KAAK;EAC/D,IAAI,MAAM,WAAW,KAAK,YAAY,KAAK;EAC3C,IAAI,MAAM,QAAQ,KAAK,SAAS,KAAK;CACtC;AACD;;;;ACDA,MAAM,sBAAsB;;AAG5B,MAAM,yBAAyB;;AAG/B,MAAM,iBAAiB;CAAC;CAAU;CAAW;AAAO;;AAGpD,MAAM,cAAc;;AAGpB,MAAM,YAAY;;;;AAKlB,eAAe,UAAU,UAAkB,MAAkB,OAA8B;CACzF,MAAM,UAAU,IAAI,YAAY;CAChC,MAAM,cAAc,MAAM,OAAO,OAAO,UAAU,OAAO,QAAQ,OAAO,QAAQ,GAAG,UAAU,OAAO,CAClG,cACA,WACF,CAAC;CACD,OAAO,OAAO,OAAO,UACnB;EAAE,MAAM;EAAU;EAAM,YAAY;EAAQ,MAAM;CAAU,GAC5D,aACA;EAAE,MAAM;EAAW,QAAQ;CAAI,GAC/B,OACA,CAAC,KAAK,CACR;AACF;;;;;AAMA,eAAe,eAAe,MAAe,UAAmC;CAC9E,MAAM,UAAU,IAAI,YAAY;CAChC,MAAM,OAAO,OAAO,gBAAgB,IAAI,WAAW,WAAW,CAAC;CAC/D,MAAM,MAAM,MAAM,UAAU,UAAU,MAAM,SAAS;CACrD,MAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,SAAS,CAAC;CAC3D,MAAM,YAAY,MAAM,OAAO,OAAO,QAAQ;EAAE,MAAM;EAAW;CAAG,GAAG,KAAK,QAAQ,OAAO,KAAK,UAAU,IAAI,CAAC,CAAC;CAChH,MAAM,WAAW,IAAI,WAAW,KAAK,SAAS,GAAG,SAAS,IAAI,WAAW,SAAS,CAAC,CAAC,MAAM;CAC1F,SAAS,IAAI,IAAI;CACjB,SAAS,IAAI,IAAI,KAAK,MAAM;CAC5B,SAAS,IAAI,IAAI,WAAW,SAAS,GAAG,KAAK,SAAS,GAAG,MAAM;CAC/D,OAAO,KAAK,OAAO,aAAa,GAAG,QAAQ,CAAC;AAC9C;;;;AAKA,eAAe,eAAe,WAAmB,UAAoC;CACnF,MAAM,WAAW,WAAW,KAAK,KAAK,SAAS,IAAG,MAAK,EAAE,WAAW,CAAC,CAAC;CACtE,MAAM,OAAO,SAAS,MAAM,GAAG,WAAW;CAC1C,MAAM,KAAK,SAAS,MAAM,aAAa,EAAuB;CAC9D,MAAM,OAAO,SAAS,MAAM,EAAuB;CACnD,MAAM,MAAM,MAAM,UAAU,UAAU,MAAM,SAAS;CACrD,MAAM,YAAY,MAAM,OAAO,OAAO,QAAQ;EAAE,MAAM;EAAW;CAAG,GAAG,KAAK,IAAI;CAChF,OAAO,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS,CAAC;AACvD;;AAGA,MAAM,wBAAwB;;;;;AAe9B,eAAe,SAAS,MAAc,QAAiC;CACrE,MAAM,UAAU,IAAI,YAAY;CAChC,MAAM,UAAU,QAAQ,OAAO,MAAM;CACrC,MAAM,YAAY,QAAQ,OAAO,IAAI;CAGrC,MAAM,YAAY,MAAM,OAAO,OAAO,UAAU,OAAO,SAAS;EAAE,MAAM;EAAQ,MAAM;CAAU,GAAG,OAAO,CAAC,MAAM,CAAC;CAGlH,MAAM,YAAY,MAAM,OAAO,OAAO,KAAK,QAAQ,WAAW,SAAS;CAGvE,MAAM,WAAW,IAAI,WAAW,SAAS;CACzC,OAAO,KAAK,OAAO,aAAa,GAAG,QAAQ,CAAC,CAAC,CAC1C,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,MAAM,EAAE;AACrB;;;;AAKA,SAAS,gBAAgB,GAAW,GAAoB;CACtD,IAAI,EAAE,WAAW,EAAE,QAAQ,OAAO;CAClC,IAAI,SAAS;CACb,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,KAC5B,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;CAE5C,OAAO,WAAW;AACpB;;;;;AAMA,eAAe,iBAAiB,eAAuB,aAAqB,QAAiC;CAC3G,MAAM,UAAwB;EAC5B,GAAG;EACH,GAAG;EACH,GAAG,KAAK,IAAI,IAAI;CAClB;CACA,MAAM,aAAa,KAAK,KAAK,UAAU,OAAO,CAAC;CAE/C,OAAO,GAAG,WAAW,GAAG,MADA,SAAS,YAAY,MAAM;AAErD;;;;;AAMA,eAAe,iBACb,YACA,QACyD;CACzD,MAAM,QAAQ,WAAW,MAAM,GAAG;CAClC,IAAI,MAAM,WAAW,GACnB,MAAM,IAAI,MAAM,4BAA4B;CAG9C,MAAM,CAAC,YAAY,aAAa;CAEhC,IAAI,CAAC,gBAAgB,WAAY,MADP,SAAS,YAAa,MAAM,CACV,GAC1C,MAAM,IAAI,MAAM,+BAA+B;CAGjD,MAAM,UAAU,KAAK,MAAM,KAAK,UAAW,CAAC;CAC5C,IAAI,QAAQ,IAAI,KAAK,IAAI,GACvB,MAAM,IAAI,MAAM,yBAAyB;CAG3C,OAAO;EAAE,eAAe,QAAQ;EAAG,aAAa,QAAQ;CAAE;AAC5D;;;;AAKA,SAAS,YAAY,KAAqB;CACxC,OAAO,IAAI,QAAQ,uBAAuB,MAAM;AAClD;;;;;AAMA,SAAS,cAAc,gBAAgC;CACrD,MAAM,gBAAgB,eAAe,QAAQ,oBAAoB,EAAE;CAGnE,OAAO,WAFS,KAAK,aACA,CAAC,CAAC,QAAQ,OAAO,EACf;AACzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqFA,IAAa,kBAAb,cAAqC,mBAA+D;CAClG;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CAEA,YAAY,SAAkC;EAC5C,MAAM,EAAE,MAAM,SAAS,QAAQ,QAAQ,CAAC;EAExC,MAAM,UAAU,SAAS,WAAW,QAAQ,IAAI;EAChD,MAAM,YAAY,SAAS,aAAa,QAAQ,IAAI;EACpD,MAAM,iBAAiB,SAAS,kBAAkB,QAAQ,IAAI;EAE9D,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,gBAC7B,MAAM,IAAI,MACR,6LACF;EAGF,KAAK,UAAU;EACf,KAAK,iBAAiB;EACtB,KAAK,UAAU,cAAc,cAAc;EAC3C,KAAK,SAAA,GAAQA,eAAAA,kBAAAA,CAAkB;GAC7B;GACA;EACF,CAAC;EAGD,MAAM,gBAAgB,SAAS,iBAAiB,QAAQ,IAAI;EAC5D,MAAM,oBAAoB,SAAS,qBAAqB,QAAQ,IAAI;EACpE,MAAM,cAAc,SAAS,eAAe,QAAQ,IAAI;EACxD,MAAM,iBACJ,SAAS,SAAS,kBAClB,QAAQ,IAAI,yBACZ,OAAO,WAAW,IAAI,OAAO,WAAW;EAE1C,KAAK,gBAAgB,iBAAiB;EACtC,KAAK,oBAAoB,qBAAqB;EAC9C,KAAK,eAAe,eAAe;EACnC,KAAK,SAAS,SAAS,UAAU;EACjC,KAAK,aAAa,SAAS,SAAS,cAAc;EAClD,KAAK,eAAe,SAAS,SAAS,gBAAgB;EACtD,KAAK,iBAAiB;EACtB,KAAK,gBAAgB,SAAS,SAAS,iBAAiB,QAAQ,IAAI,aAAa;EAGjF,KAAK,iBAAiB,SAAS,kBAAkB,QAAQ,IAAI,yBAAyB;EACtF,KAAK,mBAAmB,SAAS,oBAAoB,QAAQ,IAAI,2BAA2B;EAC5F,IAAI,KAAK,kBAAkB,KAAK,kBAI9B,MAAM,IAAI,MACR,6JACF;EAEF,KAAK,gBAAgB,CAAC,EAAE,KAAK,kBAAkB,KAAK;EAGpD,KAAK,aAAa,CAAC,EAAE,iBAAiB;EAEtC,IAAI,KAAK,YAAY;GACnB,IAAI,eAAe,SAAS,IAC1B,MAAM,IAAI,MACR,yGACF;GAGF,IAAI,CAAC,SAAS,SAAS,kBAAkB,CAAC,QAAQ,IAAI,uBACpD,QAAQ,KACN,0JACF;GAKF,KAAK,mBAAmB;GACxB,KAAK,uBAAuB;EAC9B;EAEA,KAAK,gBAAgB,OAAO;CAC9B;CAMA,MAAM,kBAAkB,OAAe,SAAwD;EAI7F,IAAI,KAAK,cAAc,SAAS;GAC9B,MAAM,cAAc,MAAM,KAAK,yBAAyB,OAAO;GAC/D,IAAI,aAAa,OAAO;EAC1B;EAGA,IAAI,CAAC,SAAS,OAAO,UAAU,UAC7B,OAAO;EAGT,IAAI;GAEF,OAAO,OAAA,GADYC,aAAAA,WAAAA,CAAW,OAAO,KAAK,OAAO;EAEnD,QAAQ;GACN,OAAO;EACT;CACF;CAEA,MAAM,cAAc,MAAiB;EAEnC,MAAM,SAAS,KAAK,OAAQ,KAA2B;EACvD,IAAI,CAAC,QAAQ,OAAO;EAEpB,IAAI,KAAK,eACP,OAAO,KAAK,qBAAqB,QAAQ,IAAI;EAG/C,OAAO;CACT;;;;;;;;;;;CAYA,MAAgB,qBAAqB,QAAgB,QAAsC;EACzF,MAAM,aAAc,QAAgD;EACpE,MAAM,eAAgB,QAAgD;EAEtE,IACG,KAAK,kBAAkB,eAAe,KAAK,kBAC3C,KAAK,oBAAoB,iBAAiB,KAAK,kBAEhD,OAAO;EAGT,MAAM,WAAW,eACd,KAAK,kBAAkB,WAAW,cAAc,OAAO,KAAK,kBAC5D,KAAK,oBAAoB,WAAW,cAAc,SAAS,KAAK;EAKnE,MAAM,QAAQ;EACd,IAAI;GACF,KAAK,IAAI,SAAS,IAAK,UAAU,OAAO;IACtC,MAAM,cAAc,MAAM,KAAK,MAAM,MAAM,8BAA8B;KAAE;KAAQ;KAAO;IAAO,CAAC;IAClG,MAAM,OAAQ,aAAqF,QAAQ,CAAC;IAC5G,IAAI,KAAK,KAAK,OAAO,GAAG,OAAO;IAE/B,MAAM,aAAc,aAAyC;IAC7D,MAAM,UAAU,SAAS,KAAK;IAC9B,IAAI,KAAK,SAAS,SAAU,OAAO,eAAe,YAAY,WAAW,YACvE,OAAO;GAEX;EACF,QAAQ;GACN,OAAO;EACT;CACF;;;;CASA,aAAqB,SAAiC;EACpD,MAAM,aAAa,QAAQ,QAAQ,IAAI,eAAe;EACtD,IAAI,YAAY;GACd,MAAM,QAAQ,WAAW,QAAQ,eAAe,EAAE,CAAC,CAAC,KAAK;GACzD,IAAI,OAAO,OAAO;EACpB;EAEA,MAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;EAC3C,IAAI,QAAQ;GAEV,MAAM,QAAQ,OAAO,MAAM,mBAAmB;GAC9C,IAAI,QAAQ,IAAI,OAAO,MAAM;EAC/B;EAEA,OAAO;CACT;CAEA,MAAM,eAAe,SAA0C;EAE7D,IAAI,KAAK,YAAY;GACnB,MAAM,cAAc,MAAM,KAAK,yBAAyB,OAAO;GAC/D,IAAI,aAAa,OAAO;EAC1B;EAGA,MAAM,QAAQ,KAAK,aAAa,OAAO;EACvC,IAAI,CAAC,OAAO,OAAO;EAEnB,IAAI;GACF,MAAM,UAAU,MAAM,KAAK,kBAAkB,KAAK;GAClD,IAAI,CAAC,SAAS,KAAK,OAAO;GAG1B,IAAI;IACF,MAAM,YAAY,MAAM,KAAK,MAAM,MAAM,QAAQ,QAAQ,GAAG;IAC5D,OAAO;KACL,IAAI,UAAU;KACd,OAAO,UAAU,iBAAiB,EAAE,EAAE;KACtC,MAAM,CAAC,UAAU,WAAW,UAAU,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG,KAAK,KAAA;KAC7E,WAAW,UAAU;KACrB,UAAU,UAAU;IACtB;GACF,QAAQ;IAEN,OAAO;KACL,IAAI,QAAQ;KACZ,OAAQ,QAAQ,SAAoB,KAAA;KACpC,MAAO,QAAQ,QAAmB,KAAA;IACpC;GACF;EACF,QAAQ;GACN,OAAO;EACT;CACF;CAEA,MAAM,QAAQ,QAAwC;EACpD,IAAI;GACF,MAAM,YAAY,MAAM,KAAK,MAAM,MAAM,QAAQ,MAAM;GACvD,OAAO;IACL,IAAI,UAAU;IACd,OAAO,UAAU,iBAAiB,EAAE,EAAE;IACtC,MAAM,CAAC,UAAU,WAAW,UAAU,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG,KAAK,KAAA;IAC7E,WAAW,UAAU;IACrB,UAAU,UAAU;GACtB;EACF,QAAQ;GACN,OAAO;EACT;CACF;CAEA,kBAAkB,MAAsB;EACtC,OAAO,SAAS,KAAK;CACvB;;;;CASA,eAAwB;EACtB,OAAO,KAAK;CACd;;;;CAKA,aAAqB;EACnB,OAAO,KAAK;CACd;;;;CAKA,YAAoB,QAAwB;EAC1C,MAAM,QAAQ,2CAA2C;EACzD,OAAO,KAAK,gBAAgB,GAAG,MAAM,YAAY;CACnD;;;;CAKA,MAAc,yBAAyB,SAAoD;EACzF,MAAM,SAAS,iBAAiB,SAAS,QAAQ;EACjD,IAAI,CAAC,QAAQ,OAAO;EAEpB,MAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,YAAY,KAAK,UAAU,EAAE,SAAS,CAAC;EAC3F,IAAI,CAAC,QAAQ,IAAI,OAAO;EAExB,IAAI;GACF,MAAM,cAAe,MAAM,eAAe,mBAAmB,MAAM,EAAE,GAAG,KAAK,cAAc;GAK3F,IAAI,YAAY,YAAY,KAAK,IAAI,GACnC,OAAO;GAGT,OAAO,YAAY;EACrB,QAAQ;GACN,OAAO;EACT;CACF;;;;;CAUA,qBAA6B;EAC3B,MAAM,OAAO;EAEb,KAA0C,cAAc,eACtD,aACA,OACiB;GAGjB,MAAM,oBAAoB,eAAe,KAAK;GAC9C,IAAI,CAAC,mBACH,MAAM,IAAI,MAAM,wCAAwC;GAG1D,MAAM,cAAc,MAAM,iBAAiB,OAAO,mBAAmB,KAAK,cAAc;GAExF,MAAM,SAAS,IAAI,gBAAgB;IACjC,WAAW,KAAK;IAChB,eAAe;IACf,OAAO,KAAK,OAAO,KAAK,GAAG;IAC3B,cAAc;IACd,OAAO;GACT,CAAC;GAED,OAAO,GAAG,KAAK,QAAQ,mBAAmB,OAAO,SAAS;EAC5D;EAEA,KAA0C,iBAAiB,eACzD,MACA,YACoC;GAEpC,MAAM,EAAE,gBAAgB,MAAM,iBAAiB,YAAY,KAAK,cAAc;GAG9E,MAAM,gBAAgB,MAAM,MAAM,GAAG,KAAK,QAAQ,eAAe;IAC/D,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,eAAe,SAAS,KAAK,GAAG,KAAK,cAAc,GAAG,KAAK,mBAAmB;IAChF;IACA,MAAM,IAAI,gBAAgB;KACxB,YAAY;KACZ;KACA,cAAc;IAChB,CAAC;IACD,QAAQ,YAAY,QAAQ,GAAM;GACpC,CAAC;GAED,IAAI,CAAC,cAAc,IAAI;IACrB,MAAM,QAAQ,MAAM,cAAc,KAAK;IACvC,MAAM,IAAI,MAAM,0BAA0B,OAAO;GACnD;GAEA,MAAM,SAAU,MAAM,cAAc,KAAK;GASzC,IAAI;GACJ,IAAI,OAAO,UAAU;IACnB,MAAM,UAAU,OAAA,GAAMA,aAAAA,WAAAA,CAAW,OAAO,UAAU,KAAK,OAAO;IAC9D,OAAO;KACL,IAAI,QAAQ;KACZ,OAAQ,QAAQ,SAAoB,KAAA;KACpC,MAAO,QAAQ,QAAmB,KAAA;KAClC,WAAY,QAAQ,WAAsB,KAAA;IAC5C;GACF,OAAO;IACL,MAAM,mBAAmB,MAAM,MAAM,GAAG,KAAK,QAAQ,kBAAkB;KACrE,SAAS,EAAE,eAAe,UAAU,OAAO,eAAe;KAC1D,QAAQ,YAAY,QAAQ,GAAM;IACpC,CAAC;IAED,IAAI,CAAC,iBAAiB,IACpB,MAAM,IAAI,MAAM,sCAAsC;IAGxD,MAAM,WAAY,MAAM,iBAAiB,KAAK;IAM9C,OAAO;KACL,IAAI,SAAS;KACb,OAAO,SAAS;KAChB,MAAM,SAAS;KACf,WAAW,SAAS;IACtB;GACF;GAGA,IAAI;IACF,MAAM,WAAW,MAAM,KAAK,QAAQ,KAAK,EAAE;IAC3C,IAAI,UACF,OAAO;GAEX,QAAQ,CAER;GAGA,IAAI,KAAK,iBAAiB,CAAE,MAAM,KAAK,qBAAqB,KAAK,EAAE,GACjE,MAAM,IAAI,MAAM,mDAAmD;GASrE,MAAM,mBAAmB,MAAM,eAAe;IAJ5C;IACA,WAAW,KAAK,IAAI,IAAI,KAAK,eAAe;GAGU,GAAG,KAAK,cAAc;GAC9E,MAAM,cAAc,GAAG,KAAK,WAAW,GAAG,mBAAmB,gBAAgB,EAAE,IAAI,KAAK,YAAY,KAAK,YAAY;GAErH,OAAO;IACL;IACA,QAAQ;KACN,aAAa,OAAO;KACpB,cAAc,OAAO;KACrB,SAAS,OAAO;KAChB,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI;IAC3D;IACA,SAAS,CAAC,WAAW;GACvB;EACF;EAEA,KAA0C,uBAAuB,WAA4B;GAC3F,OAAO;IACL,UAAU;IACV,MAAM;IACN,aAAa;GACf;EACF;EAEA,KAA0C,kBAAkB,SAAU,QAA0B;GAC9F,OAAO,CAAC;EACV;EAEA,KAA0C,eAAe,eACvD,cACA,UACwB;GACxB,OAAO;EACT;CACF;;;;CASA,yBAAiC;EAC/B,MAAM,OAAO;EAEb,KAA+C,gBAAgB,eAC7D,QACA,UACkB;GAClB,MAAM,sBAAM,IAAI,KAAK;GACrB,OAAO;IACL,IAAI,OAAO,WAAW;IACtB;IACA,WAAW;IACX,WAAW,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK,eAAe,GAAI;IAC5D;GACF;EACF;EAGA,KAA+C,kBAAkB,eAC/D,YACyB;GACzB,OAAO;EACT;EAGA,KAA+C,iBAAiB,eAC9D,YACe,CAAC;EAGlB,KAA+C,iBAAiB,eAC9D,YACyB;GACzB,OAAO;EACT;EAEA,KAA+C,0BAA0B,SACvE,SACe;GACf,MAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;GAC3C,IAAI,CAAC,QAAQ,OAAO;GACpB,MAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,cAAc,YAAY,KAAK,UAAU,EAAE,SAAS,CAAC;GAC3F,OAAO,QAAQ,KAAK,mBAAmB,MAAM,EAAE,IAAI;EACrD;EAEA,KAA+C,oBAAoB,SACjE,UACwB;GACxB,OAAO,CAAC;EACV;EAEA,KAA+C,yBAAyB,WAAoC;GAC1G,OAAO,EACL,cAAc,GAAG,KAAK,WAAW,KAAK,KAAK,YAAY,CAAC,IAC1D;EACF;CACF;AACF"}