@fanvue/builder-sdk 0.3.0

package/dist/nextjs/embedded-app/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":["createSharedConfig","z.object","z.string"],"sources":["../../../src/nextjs/bearer-session.ts","../../../src/nextjs/embedded-app/index.ts"],"sourcesContent":["import { headers } from 'next/headers';\n\nimport {\n  BEARER_PREFIX,\n  verifySessionJwt,\n  createSessionJwt,\n  createFanvueClient,\n  refreshAccessToken,\n  type FanvueClient,\n  type OAuthConfig,\n  type SessionPayload,\n} from '../core/index.js';\n\nimport { LOG_PREFIX } from './constants.js';\n\nconst TOKEN_REFRESH_THRESHOLD_MS = 30_000;\n\n/**\n * Reads and verifies the session JWT from the `Authorization: Bearer` header.\n *\n * Used by embedded apps, which hold the session JWT client-side and send it\n * with each request, instead of using cookies.\n *\n * @param secret - The secret used to verify the JWT.\n * @returns The verified {@link SessionPayload}, or `null` if missing/invalid.\n */\nexport async function getSession(secret: string): Promise<SessionPayload | null> {\n  const hdrs = await headers();\n  const auth = hdrs.get('authorization');\n  if (!auth?.startsWith(BEARER_PREFIX)) return null;\n  const token = auth.slice(BEARER_PREFIX.length);\n  const result = await verifySessionJwt(secret, token);\n  if (result.isErr()) {\n    console.warn(`${LOG_PREFIX} session verify failed:`, result.error);\n    return null;\n  }\n  return result.value;\n}\n\n/**\n * Returns an authenticated {@link FanvueClient} for the current\n * `Authorization: Bearer` session.\n *\n * If the access token is close to expiring and a refresh token is available,\n * the token is refreshed transparently. Because the session lives client-side\n * (not in a cookie), the refreshed JWT is returned as `refreshedJwt` — set it\n * on the response as the `X-Updated-Session` header so the client can store\n * it (the React `authFetch` helper picks it up automatically).\n *\n * @param opts - Session secret and OAuth config.\n * @returns The client and (when a refresh happened) the new session JWT, or\n *   `null` if no valid session exists or token refresh fails.\n */\nexport async function getAuthenticatedClient(opts: {\n  sessionSecret: string;\n  config: OAuthConfig;\n}): Promise<{ client: FanvueClient; refreshedJwt: string | null } | null> {\n  let session = await getSession(opts.sessionSecret);\n  if (!session) return null;\n\n  let refreshedJwt: string | null = null;\n  if (Date.now() >= session.expiresAt - TOKEN_REFRESH_THRESHOLD_MS && session.refreshToken) {\n    const refreshResult = await refreshAccessToken(opts.config, session.refreshToken);\n\n    if (refreshResult.isErr()) {\n      console.warn(`${LOG_PREFIX} token refresh failed:`, refreshResult.error);\n      return null;\n    }\n\n    const refreshed = refreshResult.value;\n    // When the refresh response omits optional fields (parsed as null by the schema),\n    // preserve the existing session values. Per RFC 6749 §6, a refresh response MAY\n    // include a new refresh_token; when absent, the existing one remains valid.\n    session = {\n      ...session,\n      accessToken: refreshed.access_token,\n      refreshToken: refreshed.refresh_token ?? session.refreshToken,\n      tokenType: refreshed.token_type ?? session.tokenType,\n      scope: refreshed.scope ?? session.scope,\n      idToken: refreshed.id_token ?? session.idToken,\n      expiresAt: Date.now() + refreshed.expires_in * 1000,\n    };\n    refreshedJwt = await createSessionJwt(opts.sessionSecret, session);\n  }\n\n  return {\n    client: createFanvueClient(session.accessToken, opts.config.apiBaseUrl),\n    refreshedJwt,\n  };\n}\n","import { NextResponse } from 'next/server';\nimport { z } from 'zod';\n\nimport {\n  exchangeSessionToken,\n  createSessionJwt,\n  type EmbeddedAuthConfig,\n  type FanvueUser,\n  type SessionPayload,\n  type TokenResponse,\n} from '../../core/index.js';\nimport { LOG_PREFIX } from '../constants.js';\nimport { createConfig as createSharedConfig } from '../index.js';\nimport { fetchUserProfile } from '../utils.js';\n\nimport type { FanvueAuthOptions, ResolvedConfig } from '../index.js';\n\nexport { getSession, getAuthenticatedClient } from '../bearer-session.js';\nexport { getSessionTokenFromUrl } from '../../core/index.js';\nexport { type FanvueAuthOptions } from '../index.js';\n\n/**\n * User-facing configuration options for an embedded Fanvue app.\n *\n * Extends {@link FanvueAuthOptions} with the Fanvue platform base URL. All\n * fields are optional — when omitted, values are read from environment\n * variables (`platformUrl` reads `FANVUE_PLATFORM_URL`).\n */\nexport type EmbeddedAppAuthOptions = FanvueAuthOptions & {\n  platformUrl?: string;\n};\n\n/**\n * Fully-resolved configuration for the embedded-app handlers, produced by\n * {@link createConfig}.\n */\nexport type EmbeddedAppConfig = ResolvedConfig & EmbeddedAuthConfig;\n\n/**\n * Resolves a complete {@link EmbeddedAppConfig} from the supplied options,\n * falling back to environment variables for any values not provided.\n *\n * @param opts - Optional overrides for the OAuth, session, and platform configuration.\n * @returns A fully-resolved configuration object.\n * @throws If any required value (`clientId`, `clientSecret`, `redirectUri`,\n *   `sessionSecret`) is missing from both `opts` and the environment.\n */\nexport function createConfig(opts?: EmbeddedAppAuthOptions): EmbeddedAppConfig {\n  const shared = createSharedConfig(opts);\n  const platformUrl = opts?.platformUrl ?? process.env['FANVUE_PLATFORM_URL'];\n  return { ...shared, platformUrl: platformUrl ?? null };\n}\n\nconst ExchangeRequestSchema = z.object({\n  token: z.string().min(1),\n});\n\n/**\n * Callback invoked after a successful session-token exchange, before the\n * response is sent. Use it to persist the refresh token per creator so your\n * app can act on their behalf later, without the iframe open.\n */\nexport type OnTokensCallback = (input: {\n  tokens: TokenResponse;\n  user: FanvueUser;\n}) => void | Promise<void>;\n\n/**\n * Creates a Next.js route handler that exchanges an embedded session token\n * for a Fanvue session.\n *\n * The embedded page reads the `?token=` query parameter that Fanvue appends\n * to the iframe URL and POSTs it here as JSON (`{ \"token\": \"...\" }`). The\n * handler runs the delegated authorize-on-behalf flow, fetches the user's\n * profile, and responds with a signed session JWT (`{ \"jwt\": \"...\" }`) that\n * the client sends back as an `Authorization: Bearer` header — the React\n * `useEmbeddedAuth` hook does all of this for you.\n *\n * Error responses mirror the platform's semantics:\n * - `400 { error: \"invalid_request\" }` — malformed body.\n * - `401 { error: \"invalid_session_token\" }` — the session token was\n *   rejected (they expire after ~60 seconds; reopening the surface mints a\n *   fresh one).\n * - `403 { error: \"consent_required\" }` — the creator has not approved (or\n *   has revoked) consent for this app in the Fanvue UI.\n * - `502 { error: \"exchange_failed\" }` — any other failure.\n *\n * @param config - The embedded-app configuration.\n * @param hooks - Optional `onTokens` callback for persisting tokens (e.g.\n *   the refresh token, keyed by `user.uuid`, for offline/background work).\n * @returns A route handler object with a `POST` method.\n */\nexport function createSessionExchangeHandler(\n  config: EmbeddedAppConfig,\n  hooks?: { onTokens?: OnTokensCallback },\n): {\n  POST(request: Request): Promise<NextResponse>;\n} {\n  return {\n    async POST(request: Request): Promise<NextResponse> {\n      let body: unknown;\n      try {\n        body = await request.json();\n      } catch {\n        return NextResponse.json({ error: 'invalid_request' }, { status: 400 });\n      }\n\n      const parsed = ExchangeRequestSchema.safeParse(body);\n      if (!parsed.success) {\n        return NextResponse.json({ error: 'invalid_request' }, { status: 400 });\n      }\n\n      const tokenResult = await exchangeSessionToken(config, parsed.data.token);\n      if (tokenResult.isErr()) {\n        const error = tokenResult.error;\n        if (error.code === 'SESSION_TOKEN_REJECTED') {\n          return NextResponse.json({ error: 'invalid_session_token' }, { status: 401 });\n        }\n        if (error.code === 'CONSENT_REQUIRED') {\n          return NextResponse.json({ error: 'consent_required' }, { status: 403 });\n        }\n        console.error(`${LOG_PREFIX} session token exchange failed:`, error);\n        return NextResponse.json({ error: 'exchange_failed' }, { status: 502 });\n      }\n\n      const tokens = tokenResult.value;\n      const user = await fetchUserProfile(tokens.access_token, config.apiBaseUrl);\n      if (!user) {\n        return NextResponse.json({ error: 'exchange_failed' }, { status: 502 });\n      }\n\n      if (hooks?.onTokens) {\n        try {\n          await hooks.onTokens({ tokens, user });\n        } catch (error) {\n          console.error(`${LOG_PREFIX} onTokens callback failed:`, error);\n          return NextResponse.json({ error: 'exchange_failed' }, { status: 502 });\n        }\n      }\n\n      const sessionPayload: SessionPayload = {\n        accessToken: tokens.access_token,\n        refreshToken: tokens.refresh_token,\n        tokenType: tokens.token_type,\n        scope: tokens.scope,\n        idToken: tokens.id_token,\n        expiresAt: Date.now() + tokens.expires_in * 1000,\n        userUuid: user.uuid,\n        handle: user.handle,\n        displayName: user.displayName,\n        isCreator: user.isCreator,\n        avatarUrl: user.avatarUrl,\n      };\n\n      const jwt = await createSessionJwt(config.sessionSecret, sessionPayload);\n      return NextResponse.json({ jwt });\n    },\n  };\n}\n"],"mappings":";;;;;AAeA,MAAM,6BAA6B;;;;;;;;;;AAWnC,eAAsB,WAAW,QAAgD;CAE/E,MAAM,QADO,MAAM,SAAS,EACV,IAAI,gBAAgB;AACtC,KAAI,CAAC,MAAM,WAAA,UAAyB,CAAE,QAAO;CAE7C,MAAM,SAAS,MAAM,iBAAiB,QADxB,KAAK,MAAM,cAAc,OAAO,CACM;AACpD,KAAI,OAAO,OAAO,EAAE;AAClB,UAAQ,KAAK,GAAG,WAAW,0BAA0B,OAAO,MAAM;AAClE,SAAO;;AAET,QAAO,OAAO;;;;;;;;;;;;;;;;AAiBhB,eAAsB,uBAAuB,MAG6B;CACxE,IAAI,UAAU,MAAM,WAAW,KAAK,cAAc;AAClD,KAAI,CAAC,QAAS,QAAO;CAErB,IAAI,eAA8B;AAClC,KAAI,KAAK,KAAK,IAAI,QAAQ,YAAY,8BAA8B,QAAQ,cAAc;EACxF,MAAM,gBAAgB,MAAM,mBAAmB,KAAK,QAAQ,QAAQ,aAAa;AAEjF,MAAI,cAAc,OAAO,EAAE;AACzB,WAAQ,KAAK,GAAG,WAAW,yBAAyB,cAAc,MAAM;AACxE,UAAO;;EAGT,MAAM,YAAY,cAAc;AAIhC,YAAU;GACR,GAAG;GACH,aAAa,UAAU;GACvB,cAAc,UAAU,iBAAiB,QAAQ;GACjD,WAAW,UAAU,cAAc,QAAQ;GAC3C,OAAO,UAAU,SAAS,QAAQ;GAClC,SAAS,UAAU,YAAY,QAAQ;GACvC,WAAW,KAAK,KAAK,GAAG,UAAU,aAAa;GAChD;AACD,iBAAe,MAAM,iBAAiB,KAAK,eAAe,QAAQ;;AAGpE,QAAO;EACL,QAAQ,mBAAmB,QAAQ,aAAa,KAAK,OAAO,WAAW;EACvE;EACD;;;;;;;;;;;;;ACzCH,SAAgB,aAAa,MAAkD;CAC7E,MAAM,SAASA,eAAmB,KAAK;CACvC,MAAM,cAAc,MAAM,eAAe,QAAQ,IAAI;AACrD,QAAO;EAAE,GAAG;EAAQ,aAAa,eAAe;EAAM;;AAGxD,MAAM,wBAAwBC,OAAS,EACrC,OAAOC,QAAU,CAAC,IAAI,EAAE,EACzB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCF,SAAgB,6BACd,QACA,OAGA;AACA,QAAO,EACL,MAAM,KAAK,SAAyC;EAClD,IAAI;AACJ,MAAI;AACF,UAAO,MAAM,QAAQ,MAAM;UACrB;AACN,UAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,EAAE,EAAE,QAAQ,KAAK,CAAC;;EAGzE,MAAM,SAAS,sBAAsB,UAAU,KAAK;AACpD,MAAI,CAAC,OAAO,QACV,QAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,EAAE,EAAE,QAAQ,KAAK,CAAC;EAGzE,MAAM,cAAc,MAAM,qBAAqB,QAAQ,OAAO,KAAK,MAAM;AACzE,MAAI,YAAY,OAAO,EAAE;GACvB,MAAM,QAAQ,YAAY;AAC1B,OAAI,MAAM,SAAS,yBACjB,QAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,EAAE,EAAE,QAAQ,KAAK,CAAC;AAE/E,OAAI,MAAM,SAAS,mBACjB,QAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,EAAE,EAAE,QAAQ,KAAK,CAAC;AAE1E,WAAQ,MAAM,GAAG,WAAW,kCAAkC,MAAM;AACpE,UAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,EAAE,EAAE,QAAQ,KAAK,CAAC;;EAGzE,MAAM,SAAS,YAAY;EAC3B,MAAM,OAAO,MAAM,iBAAiB,OAAO,cAAc,OAAO,WAAW;AAC3E,MAAI,CAAC,KACH,QAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,EAAE,EAAE,QAAQ,KAAK,CAAC;AAGzE,MAAI,OAAO,SACT,KAAI;AACF,SAAM,MAAM,SAAS;IAAE;IAAQ;IAAM,CAAC;WAC/B,OAAO;AACd,WAAQ,MAAM,GAAG,WAAW,6BAA6B,MAAM;AAC/D,UAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,EAAE,EAAE,QAAQ,KAAK,CAAC;;EAI3E,MAAM,iBAAiC;GACrC,aAAa,OAAO;GACpB,cAAc,OAAO;GACrB,WAAW,OAAO;GAClB,OAAO,OAAO;GACd,SAAS,OAAO;GAChB,WAAW,KAAK,KAAK,GAAG,OAAO,aAAa;GAC5C,UAAU,KAAK;GACf,QAAQ,KAAK;GACb,aAAa,KAAK;GAClB,WAAW,KAAK;GAChB,WAAW,KAAK;GACjB;EAED,MAAM,MAAM,MAAM,iBAAiB,OAAO,eAAe,eAAe;AACxE,SAAO,aAAa,KAAK,EAAE,KAAK,CAAC;IAEpC"}

package/dist/nextjs/off-platform/index.d.ts

@@ -0,0 +1,74 @@
+import { C as OAuthConfig, T as SessionPayload, t as FanvueClient } from "../../index-pS9wR5yg.js";
+import { n as ResolvedConfig, r as createConfig, t as FanvueAuthOptions } from "../../index-CweVyIKX.js";
+import { NextResponse } from "next/server";
+
+//#region src/nextjs/off-platform/session.d.ts
+/**
+ * Reads and verifies the session JWT from the cookie store.
+ *
+ * @param secret - The secret used to verify the JWT.
+ * @param cookieName - The cookie name to read. Defaults to {@link DEFAULT_SESSION_COOKIE_NAME}.
+ * @returns The verified {@link SessionPayload}, or `null` if missing/invalid.
+ */
+declare function getSession(secret: string, cookieName?: string | null): Promise<SessionPayload | null>;
+/**
+ * Returns an authenticated {@link FanvueClient} for the current session.
+ *
+ * If the access token is close to expiring and a refresh token is available,
+ * the token is refreshed transparently and the session cookie is updated.
+ *
+ * @param opts - Session secret, cookie name, and OAuth config.
+ * @returns A {@link FanvueClient} instance, or `null` if no valid session exists
+ *   or token refresh fails.
+ */
+declare function getAuthenticatedClient(opts: {
+  sessionSecret: string;
+  sessionCookieName: string | null;
+  config: OAuthConfig;
+}): Promise<FanvueClient | null>;
+//#endregion
+//#region src/nextjs/off-platform/index.d.ts
+/**
+ * Configuration for the off-platform OAuth handlers.
+ *
+ * Extends {@link ResolvedConfig} with optional routing overrides.
+ */
+type OffPlatformOptions = ResolvedConfig & {
+  afterLoginPath: string | null;
+  afterLogoutPath: string | null;
+};
+/**
+ * Creates a Next.js route handler that initiates the OAuth login flow.
+ *
+ * @param opts - The off-platform configuration.
+ * @returns A route handler object with a `GET` method.
+ */
+declare function createLoginHandler(opts: OffPlatformOptions): {
+  GET(request: Request): Promise<NextResponse>;
+};
+/**
+ * Creates a Next.js route handler that processes the OAuth callback.
+ *
+ * Supports both `GET` (query-string params) and `POST` (form-encoded body)
+ * response modes.
+ *
+ * @param opts - The off-platform configuration.
+ * @returns A route handler object with `GET` and `POST` methods.
+ */
+declare function createCallbackHandler(opts: OffPlatformOptions): {
+  GET(request: Request): Promise<NextResponse>;
+  POST(request: Request): Promise<NextResponse>;
+};
+/**
+ * Creates a Next.js route handler that logs the user out by deleting the
+ * session cookie and redirecting.
+ *
+ * @param opts - The off-platform configuration.
+ * @returns A route handler object with a `POST` method.
+ */
+declare function createLogoutHandler(opts: OffPlatformOptions): {
+  POST(request: Request): NextResponse;
+};
+//#endregion
+export { type FanvueAuthOptions, OffPlatformOptions, type ResolvedConfig, createCallbackHandler, createConfig, createLoginHandler, createLogoutHandler, getAuthenticatedClient, getSession };
+//# sourceMappingURL=index.d.ts.map

package/dist/nextjs/off-platform/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/nextjs/off-platform/session.ts","../../../src/nextjs/off-platform/index.ts"],"mappings":";;;;;;;;;AA2BA;;;iBAAsB,UAAA,CACpB,MAAA,UACA,UAAA,mBACC,OAAA,CAAQ,cAAA;;;;;;;;;;;iBAuDW,sBAAA,CAAuB,IAAA;EAC3C,aAAA;EACA,iBAAA;EACA,MAAA,EAAQ,WAAA;AAAA,IACN,OAAA,CAAQ,YAAA;;;;AA9DZ;;;;KCLY,kBAAA,GAAqB,cAAA;EAC/B,cAAA;EACA,eAAA;AAAA;;;AD6DF;;;;iBCpDgB,kBAAA,CAAmB,IAAA,EAAM,kBAAA;EACvC,GAAA,CAAI,OAAA,EAAS,OAAA,GAAU,OAAA,CAAQ,YAAA;AAAA;;;;;;;;;;iBAcjB,qBAAA,CAAsB,IAAA,EAAM,kBAAA;EAC1C,GAAA,CAAI,OAAA,EAAS,OAAA,GAAU,OAAA,CAAQ,YAAA;EAC/B,IAAA,CAAK,OAAA,EAAS,OAAA,GAAU,OAAA,CAAQ,YAAA;AAAA;AA5BlC;;;;;;;AAAA,iBAoEgB,mBAAA,CAAoB,IAAA,EAAM,kBAAA;EACxC,IAAA,CAAK,OAAA,EAAS,OAAA,GAAU,YAAA;AAAA"}

package/dist/nextjs/off-platform/index.js

@@ -0,0 +1,257 @@
+import { c as createAuthorizationUrl, l as exchangeCodeForToken, o as createSessionJwt, s as verifySessionJwt, t as createFanvueClient, u as refreshAccessToken } from "../../core-CvVOMyqr.js";
+import { i as getFormString, n as fetchUserProfile, o as LOG_PREFIX, r as getBaseUrl, s as SESSION_COOKIE_MAX_AGE_SECONDS, t as createConfig } from "../../nextjs-CESI_EiU.js";
+import { NextResponse } from "next/server";
+import { cookies } from "next/headers";
+//#region src/nextjs/callback.ts
+const COOKIE_OAUTH_STATE = "oauth_state";
+const COOKIE_OAUTH_VERIFIER = "oauth_verifier";
+const OAUTH_COOKIE_MAX_AGE_SECONDS = 600;
+const ERROR_STATE_MISMATCH = "oauth_state_mismatch";
+const ERROR_TOKEN_EXCHANGE_FAILED = "oauth_token_exchange_failed";
+const ERROR_USER_PROFILE_FAILED = "oauth_user_profile_failed";
+/**
+* Shared callback handler that validates the OAuth state, exchanges the
+* authorization code for tokens, fetches the user profile, creates a session
+* JWT, and delegates to the strategy for final response.
+*/
+async function handleOAuthCallback(request, opts, getParams, strategy) {
+	const baseUrl = getBaseUrl(opts, request.url);
+	const params = await getParams(request);
+	const cookieStore = await cookies();
+	const storedState = cookieStore.get(COOKIE_OAUTH_STATE)?.value;
+	const verifier = cookieStore.get(COOKIE_OAUTH_VERIFIER)?.value;
+	cookieStore.delete(COOKIE_OAUTH_STATE);
+	cookieStore.delete(COOKIE_OAUTH_VERIFIER);
+	if (params.kind === "error") {
+		const search = new URLSearchParams();
+		search.set("error", params.error);
+		if (params.errorDescription) search.set("error_description", params.errorDescription);
+		return NextResponse.redirect(new URL(`${baseUrl}/?${search.toString()}`, request.url));
+	}
+	if (params.kind === "empty" || !storedState || !verifier || params.state !== storedState) return NextResponse.redirect(new URL(`${baseUrl}/?error=${ERROR_STATE_MISMATCH}`, request.url));
+	const { code } = params;
+	const tokenResult = await exchangeCodeForToken(opts, {
+		code,
+		codeVerifier: verifier,
+		redirectUri: null
+	});
+	if (tokenResult.isErr()) {
+		console.error(`${LOG_PREFIX} token exchange failed:`, tokenResult.error);
+		return NextResponse.redirect(new URL(`${baseUrl}/?error=${ERROR_TOKEN_EXCHANGE_FAILED}`, request.url));
+	}
+	const token = tokenResult.value;
+	const user = await fetchUserProfile(token.access_token, opts.apiBaseUrl);
+	if (!user) return NextResponse.redirect(new URL(`${baseUrl}/?error=${ERROR_USER_PROFILE_FAILED}`, request.url));
+	const sessionPayload = {
+		accessToken: token.access_token,
+		refreshToken: token.refresh_token,
+		tokenType: token.token_type,
+		scope: token.scope,
+		idToken: token.id_token,
+		expiresAt: Date.now() + token.expires_in * 1e3,
+		userUuid: user.uuid,
+		handle: user.handle,
+		displayName: user.displayName,
+		isCreator: user.isCreator,
+		avatarUrl: user.avatarUrl
+	};
+	const jwt = await createSessionJwt(opts.sessionSecret, sessionPayload);
+	return strategy.complete(request, jwt, baseUrl);
+}
+/**
+* Creates a Next.js route handler that initiates the OAuth login flow.
+* Used by the off-platform module.
+*/
+function createLoginHandler$1(opts) {
+	return { async GET(request) {
+		const { url, codeVerifier, state } = await createAuthorizationUrl(opts);
+		const cookieStore = await cookies();
+		const secure = new URL(request.url).protocol === "https:";
+		cookieStore.set(COOKIE_OAUTH_STATE, state, {
+			httpOnly: true,
+			path: "/",
+			sameSite: "lax",
+			secure,
+			maxAge: OAUTH_COOKIE_MAX_AGE_SECONDS
+		});
+		cookieStore.set(COOKIE_OAUTH_VERIFIER, codeVerifier, {
+			httpOnly: true,
+			path: "/",
+			sameSite: "lax",
+			secure,
+			maxAge: OAUTH_COOKIE_MAX_AGE_SECONDS
+		});
+		return NextResponse.redirect(url);
+	} };
+}
+/** Extracts callback params from a GET request's query string. */
+function getParamsFromQuery(request) {
+	const url = new URL(request.url);
+	const error = url.searchParams.get("error");
+	if (error) return Promise.resolve({
+		kind: "error",
+		error,
+		errorDescription: url.searchParams.get("error_description")
+	});
+	const code = url.searchParams.get("code");
+	const state = url.searchParams.get("state");
+	if (code && state) return Promise.resolve({
+		kind: "success",
+		code,
+		state
+	});
+	return Promise.resolve({ kind: "empty" });
+}
+/** Extracts callback params from a POST request's form body. */
+async function getParamsFromForm(request, getFormString) {
+	const form = await request.formData();
+	const error = getFormString(form, "error");
+	if (error) return {
+		kind: "error",
+		error,
+		errorDescription: getFormString(form, "error_description")
+	};
+	const code = getFormString(form, "code");
+	const state = getFormString(form, "state");
+	if (code && state) return {
+		kind: "success",
+		code,
+		state
+	};
+	return { kind: "empty" };
+}
+//#endregion
+//#region src/nextjs/off-platform/session.ts
+const TOKEN_REFRESH_THRESHOLD_MS = 3e4;
+/**
+* Reads and verifies the session JWT from the cookie store.
+*
+* @param secret - The secret used to verify the JWT.
+* @param cookieName - The cookie name to read. Defaults to {@link DEFAULT_SESSION_COOKIE_NAME}.
+* @returns The verified {@link SessionPayload}, or `null` if missing/invalid.
+*/
+async function getSession(secret, cookieName = null) {
+	const token = (await cookies()).get(cookieName ?? "fanvue_session")?.value;
+	if (!token) return null;
+	const result = await verifySessionJwt(secret, token);
+	if (result.isErr()) {
+		console.warn(`${LOG_PREFIX} session verify failed:`, result.error);
+		return null;
+	}
+	return result.value;
+}
+/**
+* Creates or updates the session cookie with a fresh JWT.
+*
+* @param secret - The secret used to sign the JWT.
+* @param cookieName - The cookie name to set.
+* @param payload - The session data to encode into the JWT.
+*/
+async function setSession(secret, cookieName, payload) {
+	const jwt = await createSessionJwt(secret, payload);
+	(await cookies()).set(cookieName, jwt, {
+		httpOnly: true,
+		secure: process.env["NODE_ENV"] === "production",
+		sameSite: "lax",
+		path: "/",
+		maxAge: SESSION_COOKIE_MAX_AGE_SECONDS
+	});
+}
+/**
+* Returns an authenticated {@link FanvueClient} for the current session.
+*
+* If the access token is close to expiring and a refresh token is available,
+* the token is refreshed transparently and the session cookie is updated.
+*
+* @param opts - Session secret, cookie name, and OAuth config.
+* @returns A {@link FanvueClient} instance, or `null` if no valid session exists
+*   or token refresh fails.
+*/
+async function getAuthenticatedClient(opts) {
+	const cookieName = opts.sessionCookieName ?? "fanvue_session";
+	let session = await getSession(opts.sessionSecret, cookieName);
+	if (!session) return null;
+	if (Date.now() >= session.expiresAt - TOKEN_REFRESH_THRESHOLD_MS && session.refreshToken) {
+		const refreshResult = await refreshAccessToken(opts.config, session.refreshToken);
+		if (refreshResult.isErr()) {
+			console.warn(`${LOG_PREFIX} token refresh failed:`, refreshResult.error);
+			return null;
+		}
+		const refreshed = refreshResult.value;
+		session = {
+			...session,
+			accessToken: refreshed.access_token,
+			refreshToken: refreshed.refresh_token ?? session.refreshToken,
+			tokenType: refreshed.token_type ?? session.tokenType,
+			scope: refreshed.scope ?? session.scope,
+			idToken: refreshed.id_token ?? session.idToken,
+			expiresAt: Date.now() + refreshed.expires_in * 1e3
+		};
+		try {
+			await setSession(opts.sessionSecret, cookieName, session);
+		} catch (error) {
+			console.warn(`${LOG_PREFIX} failed to persist refreshed session:`, error);
+		}
+	}
+	return createFanvueClient(session.accessToken, opts.config.apiBaseUrl);
+}
+//#endregion
+//#region src/nextjs/off-platform/index.ts
+/**
+* Creates a Next.js route handler that initiates the OAuth login flow.
+*
+* @param opts - The off-platform configuration.
+* @returns A route handler object with a `GET` method.
+*/
+function createLoginHandler(opts) {
+	return createLoginHandler$1(opts);
+}
+/**
+* Creates a Next.js route handler that processes the OAuth callback.
+*
+* Supports both `GET` (query-string params) and `POST` (form-encoded body)
+* response modes.
+*
+* @param opts - The off-platform configuration.
+* @returns A route handler object with `GET` and `POST` methods.
+*/
+function createCallbackHandler(opts) {
+	const strategy = { complete(request, jwt, baseUrl) {
+		const res = NextResponse.redirect(new URL(`${baseUrl}${opts.afterLoginPath ?? "/"}`, request.url));
+		res.cookies.set(opts.sessionCookieName, jwt, {
+			httpOnly: true,
+			secure: new URL(request.url).protocol === "https:",
+			sameSite: "lax",
+			path: "/",
+			maxAge: SESSION_COOKIE_MAX_AGE_SECONDS
+		});
+		return res;
+	} };
+	return {
+		async GET(request) {
+			return handleOAuthCallback(request, opts, getParamsFromQuery, strategy);
+		},
+		async POST(request) {
+			return handleOAuthCallback(request, opts, (req) => getParamsFromForm(req, getFormString), strategy);
+		}
+	};
+}
+/**
+* Creates a Next.js route handler that logs the user out by deleting the
+* session cookie and redirecting.
+*
+* @param opts - The off-platform configuration.
+* @returns A route handler object with a `POST` method.
+*/
+function createLogoutHandler(opts) {
+	return { POST(request) {
+		const baseUrl = getBaseUrl(opts, request.url);
+		const res = NextResponse.redirect(new URL(`${baseUrl}${opts.afterLogoutPath ?? "/"}`, request.url));
+		res.cookies.delete(opts.sessionCookieName);
+		return res;
+	} };
+}
+//#endregion
+export { createCallbackHandler, createConfig, createLoginHandler, createLogoutHandler, getAuthenticatedClient, getSession };
+
+//# sourceMappingURL=index.js.map

package/dist/nextjs/off-platform/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":["createLoginHandler","createSharedLoginHandler"],"sources":["../../../src/nextjs/callback.ts","../../../src/nextjs/off-platform/session.ts","../../../src/nextjs/off-platform/index.ts"],"sourcesContent":["import { cookies } from 'next/headers';\nimport { NextResponse } from 'next/server';\n\nimport {\n  createAuthorizationUrl,\n  exchangeCodeForToken,\n  createSessionJwt,\n  type SessionPayload,\n} from '../core/index.js';\n\nimport { LOG_PREFIX, COOKIE_SAME_SITE } from './constants.js';\nimport { fetchUserProfile, getBaseUrl } from './utils.js';\n\nimport type { ResolvedConfig } from './index.js';\n\nconst COOKIE_OAUTH_STATE = 'oauth_state';\nconst COOKIE_OAUTH_VERIFIER = 'oauth_verifier';\nconst OAUTH_COOKIE_MAX_AGE_SECONDS = 600;\nconst ERROR_STATE_MISMATCH = 'oauth_state_mismatch';\nconst ERROR_TOKEN_EXCHANGE_FAILED = 'oauth_token_exchange_failed';\nconst ERROR_USER_PROFILE_FAILED = 'oauth_user_profile_failed';\n\n/** Parameters extracted from the OAuth callback request. */\nexport type CallbackParams =\n  | { kind: 'success'; code: string; state: string }\n  | { kind: 'error'; error: string; errorDescription: string | null }\n  | { kind: 'empty' };\n\n/** Strategy for completing the OAuth callback — how the JWT is delivered to the client. */\nexport interface CallbackStrategy {\n  complete(request: Request, jwt: string, baseUrl: string): NextResponse;\n}\n\n/** Options required by the shared callback handler. */\nexport type CallbackHandlerOptions = ResolvedConfig;\n\n/**\n * Shared callback handler that validates the OAuth state, exchanges the\n * authorization code for tokens, fetches the user profile, creates a session\n * JWT, and delegates to the strategy for final response.\n */\nexport async function handleOAuthCallback(\n  request: Request,\n  opts: CallbackHandlerOptions,\n  getParams: (request: Request) => Promise<CallbackParams>,\n  strategy: CallbackStrategy,\n): Promise<NextResponse> {\n  const baseUrl = getBaseUrl(opts, request.url);\n  const params = await getParams(request);\n\n  const cookieStore = await cookies();\n  const storedState = cookieStore.get(COOKIE_OAUTH_STATE)?.value;\n  const verifier = cookieStore.get(COOKIE_OAUTH_VERIFIER)?.value;\n\n  cookieStore.delete(COOKIE_OAUTH_STATE);\n  cookieStore.delete(COOKIE_OAUTH_VERIFIER);\n\n  if (params.kind === 'error') {\n    const search = new URLSearchParams();\n    search.set('error', params.error);\n    if (params.errorDescription) search.set('error_description', params.errorDescription);\n    return NextResponse.redirect(new URL(`${baseUrl}/?${search.toString()}`, request.url));\n  }\n\n  if (params.kind === 'empty' || !storedState || !verifier || params.state !== storedState) {\n    return NextResponse.redirect(new URL(`${baseUrl}/?error=${ERROR_STATE_MISMATCH}`, request.url));\n  }\n\n  const { code } = params;\n\n  const tokenResult = await exchangeCodeForToken(opts, {\n    code,\n    codeVerifier: verifier,\n    redirectUri: null,\n  });\n\n  if (tokenResult.isErr()) {\n    console.error(`${LOG_PREFIX} token exchange failed:`, tokenResult.error);\n    return NextResponse.redirect(\n      new URL(`${baseUrl}/?error=${ERROR_TOKEN_EXCHANGE_FAILED}`, request.url),\n    );\n  }\n\n  const token = tokenResult.value;\n  const user = await fetchUserProfile(token.access_token, opts.apiBaseUrl);\n\n  if (!user) {\n    return NextResponse.redirect(\n      new URL(`${baseUrl}/?error=${ERROR_USER_PROFILE_FAILED}`, request.url),\n    );\n  }\n\n  const sessionPayload: SessionPayload = {\n    accessToken: token.access_token,\n    refreshToken: token.refresh_token,\n    tokenType: token.token_type,\n    scope: token.scope,\n    idToken: token.id_token,\n    expiresAt: Date.now() + token.expires_in * 1000,\n    userUuid: user.uuid,\n    handle: user.handle,\n    displayName: user.displayName,\n    isCreator: user.isCreator,\n    avatarUrl: user.avatarUrl,\n  };\n\n  const jwt = await createSessionJwt(opts.sessionSecret, sessionPayload);\n\n  return strategy.complete(request, jwt, baseUrl);\n}\n\n/**\n * Creates a Next.js route handler that initiates the OAuth login flow.\n * Used by the off-platform module.\n */\nexport function createLoginHandler(opts: CallbackHandlerOptions): {\n  GET(request: Request): Promise<NextResponse>;\n} {\n  return {\n    async GET(request: Request): Promise<NextResponse> {\n      const { url, codeVerifier, state } = await createAuthorizationUrl(opts);\n\n      const cookieStore = await cookies();\n      const reqUrl = new URL(request.url);\n      const secure = reqUrl.protocol === 'https:';\n\n      cookieStore.set(COOKIE_OAUTH_STATE, state, {\n        httpOnly: true,\n        path: '/',\n        sameSite: COOKIE_SAME_SITE,\n        secure,\n        maxAge: OAUTH_COOKIE_MAX_AGE_SECONDS,\n      });\n      cookieStore.set(COOKIE_OAUTH_VERIFIER, codeVerifier, {\n        httpOnly: true,\n        path: '/',\n        sameSite: COOKIE_SAME_SITE,\n        secure,\n        maxAge: OAUTH_COOKIE_MAX_AGE_SECONDS,\n      });\n\n      return NextResponse.redirect(url);\n    },\n  };\n}\n\n/** Extracts callback params from a GET request's query string. */\nexport function getParamsFromQuery(request: Request): Promise<CallbackParams> {\n  const url = new URL(request.url);\n  const error = url.searchParams.get('error');\n  if (error) {\n    return Promise.resolve({\n      kind: 'error',\n      error,\n      errorDescription: url.searchParams.get('error_description'),\n    });\n  }\n  const code = url.searchParams.get('code');\n  const state = url.searchParams.get('state');\n  if (code && state) {\n    return Promise.resolve({ kind: 'success', code, state });\n  }\n  return Promise.resolve({ kind: 'empty' });\n}\n\n/** Extracts callback params from a POST request's form body. */\nexport async function getParamsFromForm(\n  request: Request,\n  getFormString: (form: FormData, key: string) => string | null,\n): Promise<CallbackParams> {\n  const form = await request.formData();\n  const error = getFormString(form, 'error');\n  if (error) {\n    return {\n      kind: 'error',\n      error,\n      errorDescription: getFormString(form, 'error_description'),\n    };\n  }\n  const code = getFormString(form, 'code');\n  const state = getFormString(form, 'state');\n  if (code && state) {\n    return { kind: 'success', code, state };\n  }\n  return { kind: 'empty' };\n}\n","import { cookies } from 'next/headers';\n\nimport {\n  verifySessionJwt,\n  createSessionJwt,\n  createFanvueClient,\n  refreshAccessToken,\n  type FanvueClient,\n  type OAuthConfig,\n  type SessionPayload,\n} from '../../core/index.js';\nimport {\n  DEFAULT_SESSION_COOKIE_NAME,\n  SESSION_COOKIE_MAX_AGE_SECONDS,\n  COOKIE_SAME_SITE,\n  LOG_PREFIX,\n} from '../constants.js';\n\nconst TOKEN_REFRESH_THRESHOLD_MS = 30_000;\n\n/**\n * Reads and verifies the session JWT from the cookie store.\n *\n * @param secret - The secret used to verify the JWT.\n * @param cookieName - The cookie name to read. Defaults to {@link DEFAULT_SESSION_COOKIE_NAME}.\n * @returns The verified {@link SessionPayload}, or `null` if missing/invalid.\n */\nexport async function getSession(\n  secret: string,\n  cookieName: string | null = null,\n): Promise<SessionPayload | null> {\n  const cookieStore = await cookies();\n  const token = cookieStore.get(cookieName ?? DEFAULT_SESSION_COOKIE_NAME)?.value;\n  if (!token) return null;\n  const result = await verifySessionJwt(secret, token);\n  if (result.isErr()) {\n    console.warn(`${LOG_PREFIX} session verify failed:`, result.error);\n    return null;\n  }\n  return result.value;\n}\n\n/**\n * Creates or updates the session cookie with a fresh JWT.\n *\n * @param secret - The secret used to sign the JWT.\n * @param cookieName - The cookie name to set.\n * @param payload - The session data to encode into the JWT.\n */\nexport async function setSession(\n  secret: string,\n  cookieName: string,\n  payload: SessionPayload,\n): Promise<void> {\n  const jwt = await createSessionJwt(secret, payload);\n  const cookieStore = await cookies();\n  cookieStore.set(cookieName, jwt, {\n    httpOnly: true,\n    secure: process.env['NODE_ENV'] === 'production',\n    sameSite: COOKIE_SAME_SITE,\n    path: '/',\n    maxAge: SESSION_COOKIE_MAX_AGE_SECONDS,\n  });\n}\n\n/**\n * Deletes the session cookie.\n *\n * @param cookieName - The cookie name to delete.\n */\nexport async function clearSession(cookieName: string): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.delete(cookieName);\n}\n\n/**\n * Returns an authenticated {@link FanvueClient} for the current session.\n *\n * If the access token is close to expiring and a refresh token is available,\n * the token is refreshed transparently and the session cookie is updated.\n *\n * @param opts - Session secret, cookie name, and OAuth config.\n * @returns A {@link FanvueClient} instance, or `null` if no valid session exists\n *   or token refresh fails.\n */\nexport async function getAuthenticatedClient(opts: {\n  sessionSecret: string;\n  sessionCookieName: string | null;\n  config: OAuthConfig;\n}): Promise<FanvueClient | null> {\n  const cookieName = opts.sessionCookieName ?? DEFAULT_SESSION_COOKIE_NAME;\n  let session = await getSession(opts.sessionSecret, cookieName);\n  if (!session) return null;\n\n  if (Date.now() >= session.expiresAt - TOKEN_REFRESH_THRESHOLD_MS && session.refreshToken) {\n    const refreshResult = await refreshAccessToken(opts.config, session.refreshToken);\n\n    if (refreshResult.isErr()) {\n      console.warn(`${LOG_PREFIX} token refresh failed:`, refreshResult.error);\n      return null;\n    }\n\n    const refreshed = refreshResult.value;\n    // When the refresh response omits optional fields (parsed as null by the schema),\n    // preserve the existing session values. Per RFC 6749 §6, a refresh response MAY\n    // include a new refresh_token; when absent, the existing one remains valid.\n    session = {\n      ...session,\n      accessToken: refreshed.access_token,\n      refreshToken: refreshed.refresh_token ?? session.refreshToken,\n      tokenType: refreshed.token_type ?? session.tokenType,\n      scope: refreshed.scope ?? session.scope,\n      idToken: refreshed.id_token ?? session.idToken,\n      expiresAt: Date.now() + refreshed.expires_in * 1000,\n    };\n    try {\n      await setSession(opts.sessionSecret, cookieName, session);\n    } catch (error) {\n      console.warn(`${LOG_PREFIX} failed to persist refreshed session:`, error);\n    }\n  }\n\n  return createFanvueClient(session.accessToken, opts.config.apiBaseUrl);\n}\n","import { NextResponse } from 'next/server';\n\nimport {\n  handleOAuthCallback,\n  createLoginHandler as createSharedLoginHandler,\n  getParamsFromQuery,\n  getParamsFromForm,\n} from '../callback.js';\nimport { COOKIE_SAME_SITE, SESSION_COOKIE_MAX_AGE_SECONDS } from '../constants.js';\nimport { type ResolvedConfig } from '../index.js';\nimport { getBaseUrl, getFormString } from '../utils.js';\n\nimport type { CallbackStrategy } from '../callback.js';\n\nexport { getSession, getAuthenticatedClient } from './session.js';\nexport { createConfig, type FanvueAuthOptions, type ResolvedConfig } from '../index.js';\n\n/**\n * Configuration for the off-platform OAuth handlers.\n *\n * Extends {@link ResolvedConfig} with optional routing overrides.\n */\nexport type OffPlatformOptions = ResolvedConfig & {\n  afterLoginPath: string | null;\n  afterLogoutPath: string | null;\n};\n\n/**\n * Creates a Next.js route handler that initiates the OAuth login flow.\n *\n * @param opts - The off-platform configuration.\n * @returns A route handler object with a `GET` method.\n */\nexport function createLoginHandler(opts: OffPlatformOptions): {\n  GET(request: Request): Promise<NextResponse>;\n} {\n  return createSharedLoginHandler(opts);\n}\n\n/**\n * Creates a Next.js route handler that processes the OAuth callback.\n *\n * Supports both `GET` (query-string params) and `POST` (form-encoded body)\n * response modes.\n *\n * @param opts - The off-platform configuration.\n * @returns A route handler object with `GET` and `POST` methods.\n */\nexport function createCallbackHandler(opts: OffPlatformOptions): {\n  GET(request: Request): Promise<NextResponse>;\n  POST(request: Request): Promise<NextResponse>;\n} {\n  const strategy: CallbackStrategy = {\n    complete(request: Request, jwt: string, baseUrl: string): NextResponse {\n      const res = NextResponse.redirect(\n        new URL(`${baseUrl}${opts.afterLoginPath ?? '/'}`, request.url),\n      );\n      res.cookies.set(opts.sessionCookieName, jwt, {\n        httpOnly: true,\n        secure: new URL(request.url).protocol === 'https:',\n        sameSite: COOKIE_SAME_SITE,\n        path: '/',\n        maxAge: SESSION_COOKIE_MAX_AGE_SECONDS,\n      });\n      return res;\n    },\n  };\n\n  return {\n    async GET(request: Request): Promise<NextResponse> {\n      return handleOAuthCallback(request, opts, getParamsFromQuery, strategy);\n    },\n    async POST(request: Request): Promise<NextResponse> {\n      return handleOAuthCallback(\n        request,\n        opts,\n        (req) => getParamsFromForm(req, getFormString),\n        strategy,\n      );\n    },\n  };\n}\n\n/**\n * Creates a Next.js route handler that logs the user out by deleting the\n * session cookie and redirecting.\n *\n * @param opts - The off-platform configuration.\n * @returns A route handler object with a `POST` method.\n */\nexport function createLogoutHandler(opts: OffPlatformOptions): {\n  POST(request: Request): NextResponse;\n} {\n  return {\n    POST(request: Request): NextResponse {\n      const baseUrl = getBaseUrl(opts, request.url);\n      const res = NextResponse.redirect(\n        new URL(`${baseUrl}${opts.afterLogoutPath ?? '/'}`, request.url),\n      );\n      res.cookies.delete(opts.sessionCookieName);\n      return res;\n    },\n  };\n}\n"],"mappings":";;;;;AAeA,MAAM,qBAAqB;AAC3B,MAAM,wBAAwB;AAC9B,MAAM,+BAA+B;AACrC,MAAM,uBAAuB;AAC7B,MAAM,8BAA8B;AACpC,MAAM,4BAA4B;;;;;;AAqBlC,eAAsB,oBACpB,SACA,MACA,WACA,UACuB;CACvB,MAAM,UAAU,WAAW,MAAM,QAAQ,IAAI;CAC7C,MAAM,SAAS,MAAM,UAAU,QAAQ;CAEvC,MAAM,cAAc,MAAM,SAAS;CACnC,MAAM,cAAc,YAAY,IAAI,mBAAmB,EAAE;CACzD,MAAM,WAAW,YAAY,IAAI,sBAAsB,EAAE;AAEzD,aAAY,OAAO,mBAAmB;AACtC,aAAY,OAAO,sBAAsB;AAEzC,KAAI,OAAO,SAAS,SAAS;EAC3B,MAAM,SAAS,IAAI,iBAAiB;AACpC,SAAO,IAAI,SAAS,OAAO,MAAM;AACjC,MAAI,OAAO,iBAAkB,QAAO,IAAI,qBAAqB,OAAO,iBAAiB;AACrF,SAAO,aAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,IAAI,OAAO,UAAU,IAAI,QAAQ,IAAI,CAAC;;AAGxF,KAAI,OAAO,SAAS,WAAW,CAAC,eAAe,CAAC,YAAY,OAAO,UAAU,YAC3E,QAAO,aAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,UAAU,wBAAwB,QAAQ,IAAI,CAAC;CAGjG,MAAM,EAAE,SAAS;CAEjB,MAAM,cAAc,MAAM,qBAAqB,MAAM;EACnD;EACA,cAAc;EACd,aAAa;EACd,CAAC;AAEF,KAAI,YAAY,OAAO,EAAE;AACvB,UAAQ,MAAM,GAAG,WAAW,0BAA0B,YAAY,MAAM;AACxE,SAAO,aAAa,SAClB,IAAI,IAAI,GAAG,QAAQ,UAAU,+BAA+B,QAAQ,IAAI,CACzE;;CAGH,MAAM,QAAQ,YAAY;CAC1B,MAAM,OAAO,MAAM,iBAAiB,MAAM,cAAc,KAAK,WAAW;AAExE,KAAI,CAAC,KACH,QAAO,aAAa,SAClB,IAAI,IAAI,GAAG,QAAQ,UAAU,6BAA6B,QAAQ,IAAI,CACvE;CAGH,MAAM,iBAAiC;EACrC,aAAa,MAAM;EACnB,cAAc,MAAM;EACpB,WAAW,MAAM;EACjB,OAAO,MAAM;EACb,SAAS,MAAM;EACf,WAAW,KAAK,KAAK,GAAG,MAAM,aAAa;EAC3C,UAAU,KAAK;EACf,QAAQ,KAAK;EACb,aAAa,KAAK;EAClB,WAAW,KAAK;EAChB,WAAW,KAAK;EACjB;CAED,MAAM,MAAM,MAAM,iBAAiB,KAAK,eAAe,eAAe;AAEtE,QAAO,SAAS,SAAS,SAAS,KAAK,QAAQ;;;;;;AAOjD,SAAgBA,qBAAmB,MAEjC;AACA,QAAO,EACL,MAAM,IAAI,SAAyC;EACjD,MAAM,EAAE,KAAK,cAAc,UAAU,MAAM,uBAAuB,KAAK;EAEvE,MAAM,cAAc,MAAM,SAAS;EAEnC,MAAM,SADS,IAAI,IAAI,QAAQ,IAAI,CACb,aAAa;AAEnC,cAAY,IAAI,oBAAoB,OAAO;GACzC,UAAU;GACV,MAAM;GACN,UAAA;GACA;GACA,QAAQ;GACT,CAAC;AACF,cAAY,IAAI,uBAAuB,cAAc;GACnD,UAAU;GACV,MAAM;GACN,UAAA;GACA;GACA,QAAQ;GACT,CAAC;AAEF,SAAO,aAAa,SAAS,IAAI;IAEpC;;;AAIH,SAAgB,mBAAmB,SAA2C;CAC5E,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;CAChC,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAC3C,KAAI,MACF,QAAO,QAAQ,QAAQ;EACrB,MAAM;EACN;EACA,kBAAkB,IAAI,aAAa,IAAI,oBAAoB;EAC5D,CAAC;CAEJ,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;CACzC,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAC3C,KAAI,QAAQ,MACV,QAAO,QAAQ,QAAQ;EAAE,MAAM;EAAW;EAAM;EAAO,CAAC;AAE1D,QAAO,QAAQ,QAAQ,EAAE,MAAM,SAAS,CAAC;;;AAI3C,eAAsB,kBACpB,SACA,eACyB;CACzB,MAAM,OAAO,MAAM,QAAQ,UAAU;CACrC,MAAM,QAAQ,cAAc,MAAM,QAAQ;AAC1C,KAAI,MACF,QAAO;EACL,MAAM;EACN;EACA,kBAAkB,cAAc,MAAM,oBAAoB;EAC3D;CAEH,MAAM,OAAO,cAAc,MAAM,OAAO;CACxC,MAAM,QAAQ,cAAc,MAAM,QAAQ;AAC1C,KAAI,QAAQ,MACV,QAAO;EAAE,MAAM;EAAW;EAAM;EAAO;AAEzC,QAAO,EAAE,MAAM,SAAS;;;;ACtK1B,MAAM,6BAA6B;;;;;;;;AASnC,eAAsB,WACpB,QACA,aAA4B,MACI;CAEhC,MAAM,SADc,MAAM,SAAS,EACT,IAAI,cAAA,iBAA0C,EAAE;AAC1E,KAAI,CAAC,MAAO,QAAO;CACnB,MAAM,SAAS,MAAM,iBAAiB,QAAQ,MAAM;AACpD,KAAI,OAAO,OAAO,EAAE;AAClB,UAAQ,KAAK,GAAG,WAAW,0BAA0B,OAAO,MAAM;AAClE,SAAO;;AAET,QAAO,OAAO;;;;;;;;;AAUhB,eAAsB,WACpB,QACA,YACA,SACe;CACf,MAAM,MAAM,MAAM,iBAAiB,QAAQ,QAAQ;AAEnD,EADoB,MAAM,SAAS,EACvB,IAAI,YAAY,KAAK;EAC/B,UAAU;EACV,QAAQ,QAAQ,IAAI,gBAAgB;EACpC,UAAA;EACA,MAAM;EACN,QAAQ;EACT,CAAC;;;;;;;;;;;;AAuBJ,eAAsB,uBAAuB,MAIZ;CAC/B,MAAM,aAAa,KAAK,qBAAA;CACxB,IAAI,UAAU,MAAM,WAAW,KAAK,eAAe,WAAW;AAC9D,KAAI,CAAC,QAAS,QAAO;AAErB,KAAI,KAAK,KAAK,IAAI,QAAQ,YAAY,8BAA8B,QAAQ,cAAc;EACxF,MAAM,gBAAgB,MAAM,mBAAmB,KAAK,QAAQ,QAAQ,aAAa;AAEjF,MAAI,cAAc,OAAO,EAAE;AACzB,WAAQ,KAAK,GAAG,WAAW,yBAAyB,cAAc,MAAM;AACxE,UAAO;;EAGT,MAAM,YAAY,cAAc;AAIhC,YAAU;GACR,GAAG;GACH,aAAa,UAAU;GACvB,cAAc,UAAU,iBAAiB,QAAQ;GACjD,WAAW,UAAU,cAAc,QAAQ;GAC3C,OAAO,UAAU,SAAS,QAAQ;GAClC,SAAS,UAAU,YAAY,QAAQ;GACvC,WAAW,KAAK,KAAK,GAAG,UAAU,aAAa;GAChD;AACD,MAAI;AACF,SAAM,WAAW,KAAK,eAAe,YAAY,QAAQ;WAClD,OAAO;AACd,WAAQ,KAAK,GAAG,WAAW,wCAAwC,MAAM;;;AAI7E,QAAO,mBAAmB,QAAQ,aAAa,KAAK,OAAO,WAAW;;;;;;;;;;ACzFxE,SAAgB,mBAAmB,MAEjC;AACA,QAAOC,qBAAyB,KAAK;;;;;;;;;;;AAYvC,SAAgB,sBAAsB,MAGpC;CACA,MAAM,WAA6B,EACjC,SAAS,SAAkB,KAAa,SAA+B;EACrE,MAAM,MAAM,aAAa,SACvB,IAAI,IAAI,GAAG,UAAU,KAAK,kBAAkB,OAAO,QAAQ,IAAI,CAChE;AACD,MAAI,QAAQ,IAAI,KAAK,mBAAmB,KAAK;GAC3C,UAAU;GACV,QAAQ,IAAI,IAAI,QAAQ,IAAI,CAAC,aAAa;GAC1C,UAAA;GACA,MAAM;GACN,QAAQ;GACT,CAAC;AACF,SAAO;IAEV;AAED,QAAO;EACL,MAAM,IAAI,SAAyC;AACjD,UAAO,oBAAoB,SAAS,MAAM,oBAAoB,SAAS;;EAEzE,MAAM,KAAK,SAAyC;AAClD,UAAO,oBACL,SACA,OACC,QAAQ,kBAAkB,KAAK,cAAc,EAC9C,SACD;;EAEJ;;;;;;;;;AAUH,SAAgB,oBAAoB,MAElC;AACA,QAAO,EACL,KAAK,SAAgC;EACnC,MAAM,UAAU,WAAW,MAAM,QAAQ,IAAI;EAC7C,MAAM,MAAM,aAAa,SACvB,IAAI,IAAI,GAAG,UAAU,KAAK,mBAAmB,OAAO,QAAQ,IAAI,CACjE;AACD,MAAI,QAAQ,OAAO,KAAK,kBAAkB;AAC1C,SAAO;IAEV"}

package/dist/nextjs-CESI_EiU.js

@@ -0,0 +1,80 @@
+import { C as assertFanvueDomain, t as createFanvueClient } from "./core-CvVOMyqr.js";
+//#region src/nextjs/constants.ts
+/** Default name for the session cookie. */
+const DEFAULT_SESSION_COOKIE_NAME = "fanvue_session";
+/** Session cookie max-age in seconds (30 days). */
+const SESSION_COOKIE_MAX_AGE_SECONDS = 3600 * 24 * 30;
+/** Log prefix for all library log messages. */
+const LOG_PREFIX = "[fanvue/auth]";
+//#endregion
+//#region src/nextjs/utils.ts
+/**
+* Fetches the authenticated user's profile from the Fanvue API.
+*
+* @returns The user profile on success, or `null` on failure.
+*/
+async function fetchUserProfile(accessToken, apiBaseUrl) {
+	const result = await createFanvueClient(accessToken, apiBaseUrl).getCurrentUser();
+	if (result.isErr()) {
+		console.warn(`${LOG_PREFIX} user profile fetch failed:`, result.error);
+		return null;
+	}
+	return result.value;
+}
+/**
+* Extracts a string value from `FormData`, returning `null` when the value
+* is missing or is not a string (e.g. a `File`).
+*/
+function getFormString(form, key) {
+	const value = form.get(key);
+	return typeof value === "string" ? value : null;
+}
+/**
+* Derives the application base URL from the options or falls back to the
+* request's origin.
+*/
+function getBaseUrl(opts, requestUrl) {
+	return opts.baseUrl ?? new URL(requestUrl).origin;
+}
+//#endregion
+//#region src/nextjs/index.ts
+/**
+* Resolves a complete {@link ResolvedConfig} from the supplied options,
+* falling back to environment variables for any values not provided.
+*
+* @param opts - Optional overrides for the OAuth and session configuration.
+* @returns A fully-resolved configuration object.
+* @throws If any required value (`clientId`, `clientSecret`, `redirectUri`,
+*   `sessionSecret`) is missing from both `opts` and the environment.
+*/
+function createConfig(opts) {
+	const clientId = opts?.clientId ?? process.env["OAUTH_CLIENT_ID"];
+	const clientSecret = opts?.clientSecret ?? process.env["OAUTH_CLIENT_SECRET"];
+	const redirectUri = opts?.redirectUri ?? process.env["OAUTH_REDIRECT_URI"];
+	const sessionSecret = opts?.sessionSecret ?? process.env["SESSION_SECRET"];
+	if (!clientId || !clientSecret || !redirectUri || !sessionSecret) throw new Error("Missing required OAuth configuration. Provide via options or env vars: OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, OAUTH_REDIRECT_URI, SESSION_SECRET");
+	const issuerUrl = opts?.issuerUrl ?? process.env["OAUTH_ISSUER_BASE_URL"];
+	const apiBaseUrl = opts?.apiBaseUrl ?? process.env["API_BASE_URL"];
+	if (apiBaseUrl != null) assertFanvueDomain(apiBaseUrl);
+	const scopes = opts?.scopes ?? process.env["OAUTH_SCOPES"];
+	const responseMode = opts?.responseMode ?? process.env["OAUTH_RESPONSE_MODE"];
+	const prompt = opts?.prompt ?? process.env["OAUTH_PROMPT"];
+	const baseUrl = opts?.baseUrl ?? process.env["BASE_URL"];
+	return {
+		clientId,
+		clientSecret,
+		redirectUri,
+		issuerUrl: issuerUrl ?? null,
+		apiBaseUrl: apiBaseUrl ?? null,
+		scopes: scopes ?? null,
+		responseMode: responseMode ?? null,
+		prompt: prompt ?? null,
+		baseUrl: baseUrl ?? null,
+		sessionSecret,
+		sessionCookieName: opts?.sessionCookieName ?? process.env["SESSION_COOKIE_NAME"] ?? "fanvue_session"
+	};
+}
+//#endregion
+export { DEFAULT_SESSION_COOKIE_NAME as a, getFormString as i, fetchUserProfile as n, LOG_PREFIX as o, getBaseUrl as r, SESSION_COOKIE_MAX_AGE_SECONDS as s, createConfig as t };
+
+//# sourceMappingURL=nextjs-CESI_EiU.js.map

package/dist/nextjs-CESI_EiU.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextjs-CESI_EiU.js","names":[],"sources":["../src/nextjs/constants.ts","../src/nextjs/utils.ts","../src/nextjs/index.ts"],"sourcesContent":["/** Default name for the session cookie. */\nexport const DEFAULT_SESSION_COOKIE_NAME = 'fanvue_session' as const;\n\n/** Session cookie max-age in seconds (30 days). */\nexport const SESSION_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;\n\n/** SameSite attribute for cookies. */\nexport const COOKIE_SAME_SITE = 'lax' as const;\n\n/** Log prefix for all library log messages. */\nexport const LOG_PREFIX = '[fanvue/auth]' as const;\n","import { createFanvueClient } from '../core/index.js';\n\nimport { LOG_PREFIX } from './constants.js';\n\nimport type { FanvueUser } from '../core/index.js';\n\n/**\n * Fetches the authenticated user's profile from the Fanvue API.\n *\n * @returns The user profile on success, or `null` on failure.\n */\nexport async function fetchUserProfile(\n  accessToken: string,\n  apiBaseUrl: string | null,\n): Promise<FanvueUser | null> {\n  const client = createFanvueClient(accessToken, apiBaseUrl);\n  const result = await client.getCurrentUser();\n  if (result.isErr()) {\n    console.warn(`${LOG_PREFIX} user profile fetch failed:`, result.error);\n    return null;\n  }\n  return result.value;\n}\n\n/**\n * Extracts a string value from `FormData`, returning `null` when the value\n * is missing or is not a string (e.g. a `File`).\n */\nexport function getFormString(form: FormData, key: string): string | null {\n  const value = form.get(key);\n  return typeof value === 'string' ? value : null;\n}\n\n/**\n * Derives the application base URL from the options or falls back to the\n * request's origin.\n */\nexport function getBaseUrl(opts: { baseUrl: string | null }, requestUrl: string): string {\n  return opts.baseUrl ?? new URL(requestUrl).origin;\n}\n","import { assertFanvueDomain } from '../core/index.js';\n\nimport { DEFAULT_SESSION_COOKIE_NAME } from './constants.js';\n\nimport type { OAuthConfig } from '../core/index.js';\n\n/**\n * User-facing configuration options for Fanvue OAuth.\n *\n * All fields are optional — when omitted, values are read from the\n * corresponding environment variables at runtime. This type uses optional\n * properties (`?`) rather than nullable fields because every value has an\n * env-var fallback, so `undefined` genuinely means \"use the default.\"\n */\nexport type FanvueAuthOptions = {\n  clientId?: string;\n  clientSecret?: string;\n  redirectUri?: string;\n  issuerUrl?: string;\n  apiBaseUrl?: string;\n  scopes?: string;\n  sessionSecret?: string;\n  sessionCookieName?: string;\n  responseMode?: string;\n  prompt?: string;\n  baseUrl?: string;\n};\n\n/**\n * Fully-resolved configuration produced by {@link createConfig}.\n *\n * Extends the core {@link OAuthConfig} with session-specific settings that\n * are guaranteed to be present.\n */\nexport type ResolvedConfig = OAuthConfig & {\n  sessionSecret: string;\n  sessionCookieName: string;\n  baseUrl: string | null;\n};\n\n/**\n * Resolves a complete {@link ResolvedConfig} from the supplied options,\n * falling back to environment variables for any values not provided.\n *\n * @param opts - Optional overrides for the OAuth and session configuration.\n * @returns A fully-resolved configuration object.\n * @throws If any required value (`clientId`, `clientSecret`, `redirectUri`,\n *   `sessionSecret`) is missing from both `opts` and the environment.\n */\nexport function createConfig(opts?: FanvueAuthOptions): ResolvedConfig {\n  const clientId = opts?.clientId ?? process.env['OAUTH_CLIENT_ID'];\n  const clientSecret = opts?.clientSecret ?? process.env['OAUTH_CLIENT_SECRET'];\n  const redirectUri = opts?.redirectUri ?? process.env['OAUTH_REDIRECT_URI'];\n  const sessionSecret = opts?.sessionSecret ?? process.env['SESSION_SECRET'];\n\n  if (!clientId || !clientSecret || !redirectUri || !sessionSecret) {\n    throw new Error(\n      'Missing required OAuth configuration. Provide via options or env vars: OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, OAUTH_REDIRECT_URI, SESSION_SECRET',\n    );\n  }\n\n  const issuerUrl = opts?.issuerUrl ?? process.env['OAUTH_ISSUER_BASE_URL'];\n  const apiBaseUrl = opts?.apiBaseUrl ?? process.env['API_BASE_URL'];\n  if (apiBaseUrl != null) assertFanvueDomain(apiBaseUrl);\n  const scopes = opts?.scopes ?? process.env['OAUTH_SCOPES'];\n  const responseMode = opts?.responseMode ?? process.env['OAUTH_RESPONSE_MODE'];\n  const prompt = opts?.prompt ?? process.env['OAUTH_PROMPT'];\n  const baseUrl = opts?.baseUrl ?? process.env['BASE_URL'];\n\n  return {\n    clientId,\n    clientSecret,\n    redirectUri,\n    issuerUrl: issuerUrl ?? null,\n    apiBaseUrl: apiBaseUrl ?? null,\n    scopes: scopes ?? null,\n    responseMode: responseMode ?? null,\n    prompt: prompt ?? null,\n    baseUrl: baseUrl ?? null,\n    sessionSecret,\n    sessionCookieName:\n      opts?.sessionCookieName ?? process.env['SESSION_COOKIE_NAME'] ?? DEFAULT_SESSION_COOKIE_NAME,\n  };\n}\n"],"mappings":";;;AACA,MAAa,8BAA8B;;AAG3C,MAAa,iCAAiC,OAAU,KAAK;;AAM7D,MAAa,aAAa;;;;;;;;ACC1B,eAAsB,iBACpB,aACA,YAC4B;CAE5B,MAAM,SAAS,MADA,mBAAmB,aAAa,WAAW,CAC9B,gBAAgB;AAC5C,KAAI,OAAO,OAAO,EAAE;AAClB,UAAQ,KAAK,GAAG,WAAW,8BAA8B,OAAO,MAAM;AACtE,SAAO;;AAET,QAAO,OAAO;;;;;;AAOhB,SAAgB,cAAc,MAAgB,KAA4B;CACxE,MAAM,QAAQ,KAAK,IAAI,IAAI;AAC3B,QAAO,OAAO,UAAU,WAAW,QAAQ;;;;;;AAO7C,SAAgB,WAAW,MAAkC,YAA4B;AACvF,QAAO,KAAK,WAAW,IAAI,IAAI,WAAW,CAAC;;;;;;;;;;;;;ACW7C,SAAgB,aAAa,MAA0C;CACrE,MAAM,WAAW,MAAM,YAAY,QAAQ,IAAI;CAC/C,MAAM,eAAe,MAAM,gBAAgB,QAAQ,IAAI;CACvD,MAAM,cAAc,MAAM,eAAe,QAAQ,IAAI;CACrD,MAAM,gBAAgB,MAAM,iBAAiB,QAAQ,IAAI;AAEzD,KAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,eAAe,CAAC,cACjD,OAAM,IAAI,MACR,kJACD;CAGH,MAAM,YAAY,MAAM,aAAa,QAAQ,IAAI;CACjD,MAAM,aAAa,MAAM,cAAc,QAAQ,IAAI;AACnD,KAAI,cAAc,KAAM,oBAAmB,WAAW;CACtD,MAAM,SAAS,MAAM,UAAU,QAAQ,IAAI;CAC3C,MAAM,eAAe,MAAM,gBAAgB,QAAQ,IAAI;CACvD,MAAM,SAAS,MAAM,UAAU,QAAQ,IAAI;CAC3C,MAAM,UAAU,MAAM,WAAW,QAAQ,IAAI;AAE7C,QAAO;EACL;EACA;EACA;EACA,WAAW,aAAa;EACxB,YAAY,cAAc;EAC1B,QAAQ,UAAU;EAClB,cAAc,gBAAgB;EAC9B,QAAQ,UAAU;EAClB,SAAS,WAAW;EACpB;EACA,mBACE,MAAM,qBAAqB,QAAQ,IAAI,0BAAA;EAC1C"}

package/dist/react/index.d.ts

@@ -0,0 +1,96 @@
+import { c as FanvueTheme } from "../index-pS9wR5yg.js";
+import { ReactNode } from "react";
+
+//#region src/react/auth-context.d.ts
+/**
+ * The value exposed by {@link AuthProvider} via React context.
+ *
+ * Includes the current JWT, authentication status, and helpers for
+ * managing credentials and making authenticated requests.
+ */
+interface AuthContextValue {
+  jwt: string | null;
+  isAuthenticated: boolean;
+  setJwt: (jwt: string) => void;
+  clearJwt: () => void;
+  authFetch: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+}
+/**
+ * Provides authentication state to the React component tree.
+ *
+ * Wrap your application (or the authenticated section) with this provider
+ * so that descendant components can access auth helpers via {@link useAuth}.
+ */
+declare function AuthProvider(props: {
+  children: ReactNode;
+}): ReactNode;
+/**
+ * Access the current authentication context.
+ *
+ * Must be called from a component that is a descendant of {@link AuthProvider}.
+ *
+ * @throws {Error} If called outside of an `AuthProvider`.
+ */
+declare function useAuth(): AuthContextValue;
+//#endregion
+//#region src/react/use-embedded-auth.d.ts
+/**
+ * The state of the embedded session exchange.
+ *
+ * - `idle` — no session token in the URL (the page was not opened from a
+ *   Fanvue embedded surface) and no existing session.
+ * - `exchanging` — the session token is being exchanged with the backend.
+ * - `authenticated` — a session JWT is available; `authFetch` will attach it.
+ * - `error` — the exchange failed; see `error` for the cause.
+ */
+type EmbeddedAuthStatus = 'idle' | 'exchanging' | 'authenticated' | 'error';
+/**
+ * Options for {@link useEmbeddedAuth}.
+ *
+ * @property exchangePath - The path of the session-exchange route created by
+ *   `createSessionExchangeHandler`. Defaults to `/api/fanvue/session`.
+ */
+interface UseEmbeddedAuthOptions {
+  exchangePath?: string;
+}
+/**
+ * The value returned by {@link useEmbeddedAuth}.
+ *
+ * @property status - The current state of the embedded session exchange.
+ * @property error - The error code when `status` is `error` (e.g.
+ *   `consent_required`, `invalid_session_token`), otherwise `null`.
+ * @property theme - The creator's active colour scheme (`'light'` or `'dark'`)
+ *   read from the iframe URL, or `null` when absent (e.g. the app was opened
+ *   outside Fanvue). Use it to theme-match Fanvue.
+ */
+interface UseEmbeddedAuthResult {
+  status: EmbeddedAuthStatus;
+  error: string | null;
+  theme: FanvueTheme | null;
+}
+/**
+ * Completes embedded authentication when the app is opened inside Fanvue.
+ *
+ * On mount, reads the short-lived session token that Fanvue appends to the
+ * iframe URL (`?token=`), exchanges it with your backend session route
+ * (created by `createSessionExchangeHandler`), and stores the returned
+ * session JWT in the auth context — after which `authFetch` automatically
+ * authenticates your API calls.
+ *
+ * Must be used inside an `AuthProvider`.
+ *
+ * @param opts - Optional overrides (e.g. a custom `exchangePath`).
+ * @returns The exchange {@link EmbeddedAuthStatus} and error code, if any.
+ *
+ * @example
+ * function EmbeddedHome() {
+ *   const { status, error, theme } = useEmbeddedAuth();
+ *   if (status === 'exchanging') return <p>Connecting…</p>;
+ *   if (status === 'error') return <p>Auth failed: {error}</p>;
+ *   return <Dashboard theme={theme ?? 'light'} />;
+ * }
+ */
+declare function useEmbeddedAuth(opts?: UseEmbeddedAuthOptions): UseEmbeddedAuthResult;
+//#endregion
+export { type AuthContextValue, AuthProvider, type EmbeddedAuthStatus, type FanvueTheme, type UseEmbeddedAuthOptions, type UseEmbeddedAuthResult, useAuth, useEmbeddedAuth };
+//# sourceMappingURL=index.d.ts.map

package/dist/react/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/react/auth-context.tsx","../../src/react/use-embedded-auth.ts"],"mappings":";;;;;;;;;;UAuDiB,gBAAA;EACf,GAAA;EACA,eAAA;EACA,MAAA,GAAS,GAAA;EACT,QAAA;EACA,SAAA,GAAY,KAAA,EAAO,WAAA,GAAc,GAAA,EAAK,IAAA,GAAO,WAAA,KAAgB,OAAA,CAAQ,QAAA;AAAA;;;;;;;iBAWvD,YAAA,CAAa,KAAA;EAAS,QAAA,EAAU,SAAA;AAAA,IAAc,SAAA;;;;;;;;iBA6D9C,OAAA,CAAA,GAAW,gBAAA;;;;;;AA7E3B;;;;;;KCpCY,kBAAA;;;;;;;UAQK,sBAAA;EACf,YAAA;AAAA;;;;;;;;;;AD2CF;UC9BiB,qBAAA;EACf,MAAA,EAAQ,kBAAA;EACR,KAAA;EACA,KAAA,EAAO,WAAA;AAAA;;;;;ADwFT;;;;;;;;ACjHA;;;;;AAQA;;;;;iBA0CgB,eAAA,CAAgB,IAAA,GAAO,sBAAA,GAAyB,qBAAA"}