@geekapps/auth-nextjs 0.25.0 → 0.26.0

package/README.md

@@ -189,6 +189,53 @@ Depois de aplicar esse source, rode o build do package para gerar o `dist`:
 bun --filter @geekapps/auth-nextjs build
 ```
 
+## Lista de espera, códigos de erro e reset forçado
+
+### Códigos de erro tipados
+
+Os helpers de auth (`loginWithPassword`, `registerWithPassword`, `requestPasswordlessLink`, `joinWaitlist`, standalone e via `useAuth()`) devolvem `{ success: false, error, status, code, retryAfter? }`. `code` é um `AuthErrorCode` (exportado de `/client`): `waitlist_required`, `waitlist_disabled`, `password_reset_required`, `account_locked` (com `retryAfter` em segundos), `invalid_credentials`, `not_found`, ... (lista aberta). `GeekappsApiError` também carrega `retryAfter`.
+
+```ts
+const res = await loginWithPassword({ email, password });
+if (!res.success) {
+  if (res.code === "password_reset_required") router.push("/forgot-password");
+  else if (res.code === "account_locked") setWait(res.retryAfter);
+}
+const reg = await registerWithPassword({ name, email, password, authorizationFlowId });
+if (!reg.success && reg.code === "waitlist_required") showWaitlistForm();
+```
+
+### Entrar na lista de espera
+
+```ts
+import { joinWaitlist } from "@geekapps/auth-nextjs/client";
+// ou: const { joinWaitlist } = useAuth();
+const res = await joinWaitlist({ clientId, email, name });
+// res.data: { ok: true, status: "waiting" | "approved" | "joined", position: number | null }
+// erros: code "not_found" (404), "waitlist_disabled" (409)
+```
+
+### Erros OAuth no callback
+
+Quando o auth-server devolve `?error=&error_description=&state=` ao `redirect_uri` (fluxo expirado, `interaction_required` com 2FA pendente em `prompt=none`...), o callback mostra a página de erro padrão. Para tratar no app:
+
+```ts
+import { configureGeekappsAuth, parseAuthCallbackError } from "@geekapps/auth-nextjs/server";
+
+export const auth = configureGeekappsAuth({
+  // ...
+  onCallbackError: (err, request) => {
+    // err: { error, description, state }
+    if (err.error === "interaction_required") return Response.redirect(new URL("/sign-in", request.url));
+  },
+});
+// parseAuthCallbackError(url | URLSearchParams | string) -> AuthCallbackError | null
+```
+
+### Gestão (server actions, token do usuário)
+
+De `@geekapps/auth-nextjs/actions`: `listWaitlist(applicationId, { status?, limit? })`, `approveWaitlist(applicationId, { entryIds } | { next })`, `removeWaitlistEntry(applicationId, entryId)`, `forcePasswordReset({ organizationId, applicationId, userIds? | all? })`, `getForcePasswordResetProgress(organizationId, applicationId)` e `updateApplication(applicationId, { waitlistEnabled, ... })`. Tipos em `/client`: `WaitlistEntry`, `WaitlistList`, `ForcePasswordResetInput/Result/Progress`, `ApplicationUpdateInput`; `OrganizationOwnedApplication.waitlistEnabled`.
+
 ## App Connections: conectar e chamar outra app
 
 ```ts

package/dist/actions.d.ts

@@ -1,4 +1,4 @@
-import { ConnectedAccount, User, Organization } from './client.js';
+import { ForcePasswordResetInput, ForcePasswordResetResult, ConnectedAccount, ForcePasswordResetProgress, User, Organization, WaitlistStatus, WaitlistList, ApplicationUpdateInput, OrganizationOwnedApplication } from './client.js';
 import 'react';
 
 declare function getMe(): Promise<{
@@ -11,5 +11,21 @@ declare function getOrganizations(): Promise<{
     organizations: Organization[];
     currentOrgId?: string | null;
 }>;
+declare function listWaitlist(applicationId: string, options?: {
+    status?: WaitlistStatus;
+    limit?: number;
+}): Promise<WaitlistList>;
+declare function approveWaitlist(applicationId: string, input: {
+    entryIds: string[];
+} | {
+    next: number;
+}): Promise<{
+    ok: boolean;
+    approved: number;
+}>;
+declare function removeWaitlistEntry(applicationId: string, entryId: string): Promise<void>;
+declare function forcePasswordReset(input: ForcePasswordResetInput): Promise<ForcePasswordResetResult>;
+declare function getForcePasswordResetProgress(organizationId: string, applicationId: string): Promise<ForcePasswordResetProgress>;
+declare function updateApplication(applicationId: string, input: ApplicationUpdateInput): Promise<OrganizationOwnedApplication>;
 
-export { getAccounts, getMe, getOrganizations };
+export { approveWaitlist, forcePasswordReset, getAccounts, getForcePasswordResetProgress, getMe, getOrganizations, listWaitlist, removeWaitlistEntry, updateApplication };

package/dist/actions.js

@@ -128,12 +128,17 @@ async function refreshAndSaveTokens() {
   });
   return newAccessToken;
 }
-async function authFetch(path) {
+async function authFetch(path, init = {}) {
   let accessToken = await getActiveAccessToken();
   if (!accessToken) throw new Error("Not authenticated");
   const issuer = resolveIssuer();
   const doFetch = (token) => fetch(`${issuer}${path}`, {
-    headers: { authorization: `Bearer ${token}` },
+    method: init.method ?? "GET",
+    headers: {
+      authorization: `Bearer ${token}`,
+      ...init.body !== void 0 ? { "content-type": "application/json" } : {}
+    },
+    body: init.body === void 0 ? void 0 : JSON.stringify(init.body),
     cache: "no-store"
   });
   let response = await doFetch(accessToken);
@@ -197,13 +202,48 @@ async function getOrganizations() {
     const resolvedOrgId = activeOrgId ?? organizations[0]?.id ?? null;
     return { organizations, currentOrgId: resolvedOrgId };
   } catch (err) {
-    console.error("[getOrganizations] error:", err);
+    console.error("[getOrganizations] error:", err instanceof Error ? err.message : "unknown error");
     return { organizations: [] };
   }
 }
+async function listWaitlist(applicationId, options = {}) {
+  const qs = new URLSearchParams();
+  if (options.status) qs.set("status", options.status);
+  if (options.limit) qs.set("limit", String(options.limit));
+  const suffix = qs.size ? `?${qs}` : "";
+  return authFetch(`/applications/${encodeURIComponent(applicationId)}/waitlist${suffix}`);
+}
+async function approveWaitlist(applicationId, input) {
+  return authFetch(`/applications/${encodeURIComponent(applicationId)}/waitlist/approve`, {
+    method: "POST",
+    body: input
+  });
+}
+async function removeWaitlistEntry(applicationId, entryId) {
+  await authFetch(
+    `/applications/${encodeURIComponent(applicationId)}/waitlist/${encodeURIComponent(entryId)}`,
+    { method: "DELETE" }
+  );
+}
+async function forcePasswordReset(input) {
+  return authFetch("/lighthouse/force-password-reset", { method: "POST", body: input });
+}
+async function getForcePasswordResetProgress(organizationId, applicationId) {
+  const qs = new URLSearchParams({ organizationId, applicationId });
+  return authFetch(`/lighthouse/force-password-reset?${qs}`);
+}
+async function updateApplication(applicationId, input) {
+  return authFetch(`/applications/${encodeURIComponent(applicationId)}`, { method: "PATCH", body: input });
+}
 export {
+  approveWaitlist,
+  forcePasswordReset,
   getAccounts,
+  getForcePasswordResetProgress,
   getMe,
-  getOrganizations
+  getOrganizations,
+  listWaitlist,
+  removeWaitlistEntry,
+  updateApplication
 };
 //# sourceMappingURL=actions.js.map

package/dist/actions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/actions.ts","../src/server.ts"],"sourcesContent":["\"use server\";\n\nimport { cookies, headers } from \"next/headers\";\nimport type { ConnectedAccount, Organization, User } from \"./client\";\nimport { GEEKAPPS_AUTH_SERVER_URL } from \"./server\";\n\n// ── cookie helpers (duplicated from server.ts to keep this file self-contained) ──\n\nfunction env(name: string) {\n  const value = process.env[name];\n  return value && value.trim().length > 0 ? value : undefined;\n}\n\nfunction normalizeBaseUrl(url: string) {\n  return url.replace(/\\/$/, \"\");\n}\n\nfunction resolveIssuer() {\n  return normalizeBaseUrl(\n    // Deprecated: kept for backwards compatibility during the auth-server rename.\n    env(\"GEEKAPPS_AUTH_ISSUER\") ?? env(\"GEEKAPPS_AUTH_API_URL\") ?? GEEKAPPS_AUTH_SERVER_URL,\n  );\n}\n\n\nfunction hashClientId(clientId: string): string {\n  let h = 5381;\n  for (let i = 0; i < clientId.length; i++) {\n    h = ((h << 5) + h) ^ (clientId.charCodeAt(i) & 0xff);\n    h = h >>> 0;\n  }\n  return h.toString(16).padStart(8, \"0\");\n}\n\nfunction deriveCookiePrefix(): string {\n  const clientId = env(\"GEEKAPPS_AUTH_CLIENT_ID\") ?? \"\";\n  if (!clientId) return \"gk\";\n  return `gk_${hashClientId(clientId)}`;\n}\n\ntype SlotMeta = { id: string; sid?: string; n?: string; e?: string; p?: string };\n\nfunction decodeMeta(value: string): SlotMeta | null {\n  try {\n    const m = JSON.parse(Buffer.from(value, \"base64url\").toString(\"utf8\")) as SlotMeta;\n    return m.id ? m : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function getCookieNames() {\n  const prefix = deriveCookiePrefix();\n  return {\n    active: `${prefix}_active`,\n    count: `${prefix}_count`,\n    activeOrganizationId: `${prefix}_ao`,\n    slotMeta: (n: number) => `${prefix}_m${n}`,\n    slotAt: (n: number) => `${prefix}_at${n}`,\n    slotRt: (n: number) => `${prefix}_rt${n}`,\n  };\n}\n\nasync function getActiveAccessToken(): Promise<string | null> {\n  // Prefer the token injected by the middleware via request header (same-request refresh)\n  try {\n    const hdrs = await headers();\n    const auth = hdrs.get(\"authorization\");\n    if (auth?.startsWith(\"Bearer \")) return auth.slice(7);\n  } catch {}\n  const cookieStore = await cookies();\n  const cn = await getCookieNames();\n  const raw = cookieStore.get(cn.active)?.value;\n  const activeIdx = raw ? Number.parseInt(raw, 10) : 0;\n  const countRaw = cookieStore.get(cn.count)?.value;\n  const count = countRaw ? Number.parseInt(countRaw, 10) : 0;\n  if (count === 0) return null;\n  const idx = activeIdx >= 1 && activeIdx <= count ? activeIdx : 1;\n  return cookieStore.get(cn.slotAt(idx))?.value ?? null;\n}\n\nasync function getActiveRefreshToken(): Promise<string | null> {\n  const cookieStore = await cookies();\n  const cn = await getCookieNames();\n  const raw = cookieStore.get(cn.active)?.value;\n  const activeIdx = raw ? Number.parseInt(raw, 10) : 0;\n  const countRaw = cookieStore.get(cn.count)?.value;\n  const count = countRaw ? Number.parseInt(countRaw, 10) : 0;\n  if (count === 0) return null;\n  const idx = activeIdx >= 1 && activeIdx <= count ? activeIdx : 1;\n  return cookieStore.get(cn.slotRt(idx))?.value ?? null;\n}\n\nasync function refreshAndSaveTokens(): Promise<string | null> {\n  const refreshToken = await getActiveRefreshToken();\n  const clientId = env(\"GEEKAPPS_AUTH_CLIENT_ID\") ?? \"\";\n  const clientSecret = env(\"GEEKAPPS_AUTH_CLIENT_SECRET\") ?? \"\";\n  if (!refreshToken || !clientId) return null;\n\n  const basicAuth = Buffer.from(`${clientId}:${clientSecret}`).toString(\"base64\");\n  const response = await fetch(`${resolveIssuer()}/auth/token`, {\n    method: \"POST\",\n    headers: {\n      \"content-type\": \"application/x-www-form-urlencoded\",\n      authorization: `Basic ${basicAuth}`,\n    },\n    body: new URLSearchParams({ grant_type: \"refresh_token\", refresh_token: refreshToken }),\n    cache: \"no-store\",\n  });\n\n  if (!response.ok) return null;\n\n  const data = await response.json().catch(() => null) as Record<string, unknown> | null;\n  if (!data) return null;\n\n  const newAccessToken =\n    (data.accessToken ?? data.access_token) as string | undefined;\n  const newRefreshToken =\n    (data.refreshToken ?? data.refresh_token) as string | undefined;\n\n  if (!newAccessToken) return null;\n\n  // Update the active slot cookies\n  const cookieStore = await cookies();\n  const cn = await getCookieNames();\n  const raw = cookieStore.get(cn.active)?.value;\n  const activeIdx = raw ? Number.parseInt(raw, 10) : 1;\n  const opts = {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === \"production\",\n    sameSite: \"lax\" as const,\n    path: \"/\",\n    maxAge: 60 * 60 * 24 * 30,\n  };\n  cookieStore.set(cn.slotAt(activeIdx), newAccessToken, opts);\n  if (newRefreshToken) cookieStore.set(cn.slotRt(activeIdx), newRefreshToken, opts);\n  // Update public token cookie\n  cookieStore.set(`${deriveCookiePrefix()}_tp`, newAccessToken, {\n    httpOnly: false,\n    secure: process.env.NODE_ENV === \"production\",\n    sameSite: \"lax\",\n    path: \"/\",\n    maxAge: 60 * 60 * 24 * 30,\n  });\n\n  return newAccessToken;\n}\n\nasync function authFetch<T>(path: string): Promise<T> {\n  let accessToken = await getActiveAccessToken();\n  if (!accessToken) throw new Error(\"Not authenticated\");\n\n  const issuer = resolveIssuer();\n  const doFetch = (token: string) =>\n    fetch(`${issuer}${path}`, {\n      headers: { authorization: `Bearer ${token}` },\n      cache: \"no-store\",\n    });\n\n  let response = await doFetch(accessToken);\n\n  if (response.status === 401) {\n    const newToken = await refreshAndSaveTokens();\n    if (!newToken) throw new Error(\"Session expired\");\n    response = await doFetch(newToken);\n  }\n\n  if (!response.ok) {\n    const err = await response.json().catch(() => null) as Record<string, unknown> | null;\n    throw new Error((err?.error_description ?? err?.error ?? err?.message ?? `Auth error ${response.status}`) as string);\n  }\n\n  if (response.status === 204) return null as T;\n  return response.json() as Promise<T>;\n}\n\n// ── Exported server actions ────────────────────────────────────────────────────\n\nexport async function getMe(): Promise<{ user: User | null }> {\n  try {\n    const data = await authFetch<{ user: User | null } | User | null>(\"/auth/me\");\n    if (!data) return { user: null };\n    if (typeof data === \"object\" && \"user\" in data) return data as { user: User | null };\n    return { user: data as User | null };\n  } catch {\n    return { user: null };\n  }\n}\n\nexport async function getAccounts(): Promise<{ accounts: ConnectedAccount[] }> {\n  const cookieStore = await cookies();\n  const cn = await getCookieNames();\n  const countRaw = cookieStore.get(cn.count)?.value;\n  const count = countRaw ? Number.parseInt(countRaw, 10) : 0;\n  const activeRaw = cookieStore.get(cn.active)?.value;\n  const activeIdx = activeRaw ? Number.parseInt(activeRaw, 10) : 0;\n\n  const accounts: ConnectedAccount[] = [];\n  for (let i = 1; i <= count; i++) {\n    const at = cookieStore.get(cn.slotAt(i))?.value;\n    if (!at) continue;\n    const meta = decodeMeta(cookieStore.get(cn.slotMeta(i))?.value ?? \"\");\n    if (!meta) continue;\n    accounts.push({\n      id: meta.id,\n      sessionId: meta.sid ?? meta.id,\n      isActive: i === activeIdx,\n      user: {\n        id: meta.id,\n        name: meta.n ?? null,\n        email: meta.e ?? \"\",\n        imageUrl: meta.p ?? null,\n        phone: null,\n      },\n    });\n  }\n\n  return { accounts };\n}\n\nexport async function getOrganizations(): Promise<{ organizations: Organization[]; currentOrgId?: string | null }> {\n  try {\n    const cookieStore = await cookies();\n    const cn = await getCookieNames();\n    const activeOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;\n    const data = await authFetch<Organization[] | { organizations: Organization[] }>(\"/organizations\");\n    const organizations = Array.isArray(data) ? data : (data as { organizations: Organization[] }).organizations;\n    const resolvedOrgId = activeOrgId ?? organizations[0]?.id ?? null;\n    return { organizations, currentOrgId: resolvedOrgId };\n  } catch (err) {\n    console.error(\"[getOrganizations] error:\", err);\n    return { organizations: [] };\n  }\n}\n","import { createHash, randomBytes } from \"node:crypto\";\nimport { cookies, headers } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport { NextResponse, type NextRequest } from \"next/server\";\nimport { createRemoteJWKSet, jwtVerify, type JWTPayload } from \"jose\";\n\n/**\n * A sessão não vale mais: expirou, foi revogada no painel ou o refresh token\n * foi invalidado. Os cookies já foram limpos quando este erro é lançado, então\n * o tratamento normal é redirecionar para o login.\n */\nexport class GeekappsSessionExpiredError extends Error {\n  readonly code = \"session_expired\" as const;\n\n  constructor(message = \"A sessão expirou ou foi revogada. Entre novamente.\") {\n    super(message);\n    this.name = \"GeekappsSessionExpiredError\";\n  }\n}\n\n/**\n * Fixed URL of the Geekapps Auth Server (OIDC issuer + API). This never\n * changes per-environment, so it is hardcoded rather than read from env.\n */\nexport const GEEKAPPS_AUTH_SERVER_URL = \"https://accounts-api.geekapps.com.br\";\n\nexport type GeekappsAuthConfig = {\n  /**\n   * Auth Server (OIDC) issuer URL. Defaults to GEEKAPPS_AUTH_SERVER_URL and\n   * should not need overriding in normal use.\n   *\n   * Deprecated (still supported as a fallback): GEEKAPPS_AUTH_SERVER_ISSUER,\n   * GEEKAPPS_AUTH_ISSUER, GEEKAPPS_AUTH_SERVER_URL env, GEEKAPPS_AUTH_API_URL\n   */\n  issuer?: string;\n\n  /**\n   * OAuth client id. Optional when GEEKAPPS_AUTH_CLIENT_ID is defined.\n   */\n  clientId?: string;\n\n  /**\n   * OAuth client secret for confidential clients. Optional when\n   * GEEKAPPS_AUTH_CLIENT_SECRET is defined.\n   */\n  clientSecret?: string;\n\n  /**\n   * Callback URL. Optional when GEEKAPPS_AUTH_REDIRECT_URI is defined.\n   * If omitted, it is inferred from the current request origin + basePath/callback.\n   */\n  redirectUri?: string;\n\n  scopes?: string[];\n  basePath?: string;\n  /**\n   * @deprecated cookiePrefix is now auto-derived from clientId.\n   * This field is kept for backwards compatibility but is ignored.\n   */\n  cookiePrefix?: string;\n  secureCookies?: boolean;\n\n  /**\n   * Friendly alias used by apps. Same as afterSignInRedirectTo.\n   */\n  redirectTo?: string;\n\n  afterSignInRedirectTo?: string;\n  afterSignOutRedirectTo?: string;\n};\n\ntype ResolvedGeekappsAuthConfig = GeekappsAuthConfig & {\n  issuer: string;\n  clientId: string;\n  basePath: string;\n  cookiePrefix: string;\n};\n\nexport type SessionTokens = {\n  accessToken: string | null;\n  refreshToken: string | null;\n  idToken: string | null;\n  sessionId: string | null;\n};\n\nexport type StoredAccount = {\n  /** Stable identifier — `sub` from id_token or fallback to sessionId. */\n  id: string;\n  accessToken: string;\n  refreshToken: string | null;\n  idToken: string | null;\n  sessionId: string | null;\n  user: {\n    sub: string;\n    name?: string | null;\n    email?: string | null;\n    picture?: string | null;\n    phone?: string | null;\n  };\n};\n\nexport type ServerAuthApiClient = {\n  get: <T>(path: string) => Promise<T>;\n  post: <T>(path: string, body?: unknown) => Promise<T>;\n  patch: <T>(path: string, body?: unknown) => Promise<T>;\n  put: <T>(path: string, body?: unknown) => Promise<T>;\n  delete: <T>(path: string) => Promise<T>;\n};\n\ntype JsonObject = Record<string, unknown>;\n\ntype TokenLikeResponse = JsonObject & {\n  access_token?: string;\n  accessToken?: string;\n  refresh_token?: string;\n  refreshToken?: string;\n  id_token?: string;\n  idToken?: string;\n  session_id?: string;\n  sessionId?: string;\n  tokens?: {\n    access_token?: string;\n    accessToken?: string;\n    refresh_token?: string;\n    refreshToken?: string;\n    id_token?: string;\n    idToken?: string;\n    session_id?: string;\n    sessionId?: string;\n  };\n};\n\nconst MAX_ACCOUNTS = 8;\n\nfunction normalizeBaseUrl(url: string) {\n  return url.replace(/\\/$/, \"\");\n}\n\nfunction normalizeBasePath(path = \"/api/auth\") {\n  if (!path.startsWith(\"/\")) return `/${path}`;\n  return path.replace(/\\/$/, \"\");\n}\n\nfunction createUrl(baseUrl: string, path: string) {\n  if (/^https?:\\/\\//.test(path)) return path;\n  const normalizedPath = path.startsWith(\"/\") ? path : `/${path}`;\n  return `${normalizeBaseUrl(baseUrl)}${normalizedPath}`;\n}\n\nfunction env(name: string) {\n  const value = process.env[name];\n  return value && value.trim().length > 0 ? value : undefined;\n}\n\nfunction resolveIssuer(input: GeekappsAuthConfig) {\n  return normalizeBaseUrl(\n    input.issuer ??\n      env(\"GEEKAPPS_AUTH_SERVER_ISSUER\") ??\n      env(\"GEEKAPPS_AUTH_SERVER_URL\") ??\n      // Deprecated: kept for backwards compatibility during the auth-server rename.\n      env(\"GEEKAPPS_AUTH_ISSUER\") ??\n      env(\"GEEKAPPS_AUTH_API_URL\") ??\n      GEEKAPPS_AUTH_SERVER_URL,\n  );\n}\n\nfunction resolveClientId(input: GeekappsAuthConfig) {\n  return input.clientId ?? env(\"GEEKAPPS_AUTH_CLIENT_ID\") ?? \"\";\n}\n\nfunction resolveClientSecret(input: GeekappsAuthConfig) {\n  return input.clientSecret ?? env(\"GEEKAPPS_AUTH_CLIENT_SECRET\");\n}\n\n\nfunction resolveConfiguredRedirectUri(input: GeekappsAuthConfig) {\n  return input.redirectUri ?? env(\"GEEKAPPS_AUTH_REDIRECT_URI\");\n}\n\n/**\n * Derives a short stable 8-char hex hash from a clientId string.\n * Uses a simple djb2-style hash — no crypto dependency needed.\n */\nfunction hashClientId(clientId: string): string {\n  let h = 5381;\n  for (let i = 0; i < clientId.length; i++) {\n    h = ((h << 5) + h) ^ (clientId.charCodeAt(i) & 0xff);\n    h = h >>> 0; // keep unsigned 32-bit\n  }\n  return h.toString(16).padStart(8, \"0\");\n}\n\n/**\n * Auto-derives the cookie prefix from clientId.\n * Format: `gk_{8-char-hash}` — guaranteed unique per OAuth client.\n * Falls back to `gk` when clientId is empty (dev/test environments).\n */\nfunction deriveCookiePrefix(clientId: string): string {\n  if (!clientId) return \"gk\";\n  return `gk_${hashClientId(clientId)}`;\n}\n\n// GEEKAPPS_APP_URL é o override de produção: em prod o app roda atrás de\n// Docker sem proxy setando x-forwarded-host/x-forwarded-proto, então nem o\n// header Host nem request.nextUrl.origin são confiáveis (refletem o host\n// INTERNO do container, não o domínio público real) — por isso, quando\n// configurada, essa env var sempre vence. Sem ela (dev local, onde não está\n// setada no .env), deriva do próprio request — em localhost sem proxy o\n// Host já é localhost:PORTA mesmo, então funciona sem precisar de override.\nfunction requestOrigin(request: NextRequest) {\n  const configured = env(\"GEEKAPPS_APP_URL\");\n  if (configured) return configured.replace(/\\/$/, \"\");\n\n  if (request.nextUrl?.origin) return request.nextUrl.origin;\n\n  throw new Error(\n    \"Cannot determine app origin. Set GEEKAPPS_APP_URL or ensure request.nextUrl is available.\",\n  );\n}\n\nfunction resolveRedirectUri(config: ResolvedGeekappsAuthConfig, request: NextRequest) {\n  return config.redirectUri ?? `${requestOrigin(request)}${config.basePath}/callback`;\n}\n\nfunction tokenFromResponse(data: TokenLikeResponse): SessionTokens {\n  return {\n    accessToken: data.accessToken ?? data.access_token ?? data.tokens?.accessToken ?? data.tokens?.access_token ?? null,\n    refreshToken:\n      data.refreshToken ?? data.refresh_token ?? data.tokens?.refreshToken ?? data.tokens?.refresh_token ?? null,\n    idToken: data.idToken ?? data.id_token ?? data.tokens?.idToken ?? data.tokens?.id_token ?? null,\n    sessionId: data.sessionId ?? data.session_id ?? data.tokens?.sessionId ?? data.tokens?.session_id ?? null,\n  };\n}\n\n/** Decode a JWT payload without verifying signature (safe for client-visible claims). */\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split(\".\");\n    if (parts.length < 2) return null;\n    const payload = parts[1];\n    if (!payload) return null;\n    return JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf8\")) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nfunction parseAccountFromJwt(tokens: SessionTokens): StoredAccount | null {\n  if (!tokens.accessToken) return null;\n\n  const jwtToParse = tokens.idToken ?? tokens.accessToken;\n  const payload = decodeJwtPayload(jwtToParse);\n  if (!payload) return null;\n\n  const sub = typeof payload.sub === \"string\" ? payload.sub : null;\n  const id = sub ?? tokens.sessionId;\n  if (!id) return null;\n\n  return {\n    id,\n    accessToken: tokens.accessToken,\n    refreshToken: tokens.refreshToken,\n    idToken: tokens.idToken ?? null,\n    sessionId: tokens.sessionId,\n    user: {\n      sub: id,\n      name: typeof payload.name === \"string\" ? payload.name : null,\n      email: typeof payload.email === \"string\" ? payload.email : null,\n      picture: typeof payload.picture === \"string\" ? payload.picture : null,\n      phone: typeof payload.phone_number === \"string\" ? payload.phone_number : null,\n    },\n  };\n}\n\n/**\n * Cookie name scheme — 3 cookies per slot, each well under 4096 bytes:\n *\n *   {prefix}_m{n}   — metadata blob (base64url JSON): { id, sid?, n?, e?, p? }\n *                     Claims extracted from id_token at login. Never stores tokens.\n *   {prefix}_at{n}  — access token (httpOnly). ~1-2 KB.\n *   {prefix}_rt{n}  — refresh token (httpOnly). ~1 KB.\n *   {prefix}_active — active slot index (\"1\", \"2\", …)\n *   {prefix}_count  — total stored slots\n *   {prefix}_ao     — active org id for this app\n *   {prefix}_tp     — non-httpOnly copy of active access token for client-side axios\n *\n * id_token is NOT stored in cookies — claims are extracted at login and cached in\n * the metadata cookie. This is the key size saving.\n */\nfunction getCookieNames(prefix: string) {\n  return {\n    active: `${prefix}_active`,\n    count: `${prefix}_count`,\n    activeOrganizationId: `${prefix}_ao`,\n    tokenPub: `${prefix}_tp`,\n    pkceVerifier: `${prefix}_pkce`,\n    slotMeta: (n: number) => `${prefix}_m${n}`,\n    slotAt: (n: number) => `${prefix}_at${n}`,\n    slotRt: (n: number) => `${prefix}_rt${n}`,\n  };\n}\n\nfunction generateCodeVerifier(): string {\n  return randomBytes(64).toString(\"base64url\");\n}\n\nfunction createCodeChallenge(codeVerifier: string): string {\n  return createHash(\"sha256\").update(codeVerifier).digest(\"base64url\");\n}\n\ntype SlotMeta = {\n  id: string;\n  sid?: string;\n  n?: string;\n  e?: string;\n  p?: string;\n};\n\nfunction encodeMeta(account: StoredAccount): string {\n  const m: SlotMeta = { id: account.id };\n  if (account.sessionId) m.sid = account.sessionId;\n  if (account.user.name) m.n = account.user.name;\n  if (account.user.email) m.e = account.user.email;\n  if (account.user.picture) m.p = account.user.picture;\n  return Buffer.from(JSON.stringify(m), \"utf8\").toString(\"base64url\");\n}\n\nfunction decodeMeta(value: string): SlotMeta | null {\n  try {\n    const m = JSON.parse(Buffer.from(value, \"base64url\").toString(\"utf8\")) as SlotMeta;\n    return m.id ? m : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction getCookieOptions(config: ResolvedGeekappsAuthConfig) {\n  return {\n    httpOnly: true,\n    secure: config.secureCookies ?? process.env.NODE_ENV === \"production\",\n    sameSite: \"lax\" as const,\n    path: \"/\",\n  };\n}\n\nasync function readBody(request: NextRequest) {\n  const text = await request.text();\n  if (!text) return undefined;\n  try {\n    return JSON.parse(text);\n  } catch {\n    return text;\n  }\n}\n\nfunction appendSearchParams(url: string, request: NextRequest) {\n  const target = new URL(url);\n  request.nextUrl.searchParams.forEach((value, key) => {\n    target.searchParams.set(key, value);\n  });\n  return target.toString();\n}\n\nfunction routeFromRequest(request: NextRequest, basePath: string) {\n  const pathname = request.nextUrl.pathname;\n  if (!pathname.startsWith(basePath)) return pathname;\n  const route = pathname.slice(basePath.length);\n  return route || \"/\";\n}\n\nfunction isJsonResponse(response: Response) {\n  return response.headers.get(\"content-type\")?.includes(\"application/json\");\n}\n\nasync function responseFromApi(response: Response) {\n  if (response.status === 204) return new NextResponse(null, { status: 204 });\n  const body = isJsonResponse(response) ? await response.json().catch(() => null) : await response.text();\n  return NextResponse.json(body, { status: response.status });\n}\n\nconst _remoteJWKSCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\ntype ServiceTokenCache = { token: string; expiresAt: number };\nconst _serviceTokenCache = new Map<string, ServiceTokenCache>();\n\nasync function fetchServiceToken(issuer: string, clientId: string, clientSecret: string): Promise<string | null> {\n  const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString(\"base64\");\n  try {\n    const res = await fetch(createUrl(issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${credentials}`,\n      },\n      body: \"grant_type=service_account\",\n      cache: \"no-store\",\n    });\n    if (!res.ok) return null;\n    const data = (await res.json()) as { access_token?: string };\n    return data.access_token ?? null;\n  } catch {\n    return null;\n  }\n}\n\nasync function getServiceToken(issuer: string, clientId: string, clientSecret: string): Promise<string | null> {\n  const key = `${issuer}:${clientId}`;\n  const now = Date.now();\n  const cached = _serviceTokenCache.get(key);\n  if (cached && cached.expiresAt - 30_000 > now) return cached.token;\n  const token = await fetchServiceToken(issuer, clientId, clientSecret);\n  if (!token) return null;\n  _serviceTokenCache.set(key, { token, expiresAt: now + 420_000 });\n  return token;\n}\n\ntype ServiceAccountConfig = {\n  issuer?: string;\n  clientId?: string;\n  clientSecret?: string;\n};\n\n/**\n * Returns a service account access token.\n * The issuer is always the Geekapps Auth Server (GEEKAPPS_AUTH_SERVER_URL) —\n * it does not need to be configured. Reads GEEKAPPS_SERVICE_ACCOUNT_CLIENT_ID,\n * GEEKAPPS_SERVICE_ACCOUNT_CLIENT_SECRET by default.\n * Any field can be overridden via the optional config argument.\n * Tokens are cached per client and auto-renewed before expiry (~7 min TTL).\n */\nexport function getServiceAccountToken(override: ServiceAccountConfig = {}): Promise<string | null> {\n  const issuer = normalizeBaseUrl(\n    override.issuer ??\n      // Deprecated: kept for backwards compatibility during the auth-server rename.\n      env(\"GEEKAPPS_AUTH_ISSUER\") ??\n      env(\"GEEKAPPS_AUTH_API_URL\") ??\n      GEEKAPPS_AUTH_SERVER_URL,\n  );\n  const clientId = override.clientId ?? env(\"GEEKAPPS_SERVICE_ACCOUNT_CLIENT_ID\") ?? \"\";\n  const clientSecret = override.clientSecret ?? env(\"GEEKAPPS_SERVICE_ACCOUNT_CLIENT_SECRET\") ?? \"\";\n  if (!clientId || !clientSecret) return Promise.resolve(null);\n  return getServiceToken(issuer, clientId, clientSecret);\n}\n\nfunction getRemoteJWKS(issuer: string) {\n  if (!_remoteJWKSCache.has(issuer)) {\n    _remoteJWKSCache.set(issuer, createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`)));\n  }\n  return _remoteJWKSCache.get(issuer)!;\n}\n\nexport type VerifyTokenOptions = {\n  /** client_id desta app. Quando informado, o token precisa ter sido emitido para ela (`aud`). */\n  audience?: string;\n  /** Credenciais desta app, para conferir se uma App Connection ainda está ativa. */\n  clientId?: string;\n  clientSecret?: string;\n};\n\n/** Informações de App Connection lidas de um token já verificado. */\nexport type TokenConnectionInfo = {\n  /** true quando outra app está agindo em nome do usuário, sem ele presente. */\n  isAppConnection: boolean;\n  /** Application que está agindo (claim `act.sub`). */\n  actorAppId: string | null;\n  /** Id da App Connection. */\n  connectionId: string | null;\n};\n\nexport function getTokenConnectionInfo(payload: JWTPayload): TokenConnectionInfo {\n  const isAppConnection = payload.token_type === \"app_connection\";\n  const act = payload.act as { sub?: unknown } | undefined;\n  return {\n    isAppConnection,\n    actorAppId: isAppConnection && typeof act?.sub === \"string\" ? act.sub : null,\n    connectionId: isAppConnection && typeof payload.connection_id === \"string\" ? payload.connection_id : null,\n  };\n}\n\n/**\n * Pergunta ao Auth se a App Connection segue ativa. Sem cache: revogar\n * corta o acesso na próxima requisição.\n */\nasync function isAppConnectionActive(\n  issuer: string,\n  connectionId: string,\n  clientId: string,\n  clientSecret: string,\n): Promise<boolean> {\n  try {\n    const response = await fetch(`${issuer}/connections/introspect`, {\n      method: \"POST\",\n      headers: {\n        authorization: `Basic ${Buffer.from(`${encodeURIComponent(clientId)}:${encodeURIComponent(clientSecret)}`).toString(\"base64\")}`,\n        \"content-type\": \"application/json\",\n      },\n      body: JSON.stringify({ connection_id: connectionId }),\n      cache: \"no-store\",\n    });\n    const body = (await response.json().catch(() => null)) as { active?: boolean } | null;\n    return response.ok && body?.active === true;\n  } catch {\n    return false;\n  }\n}\n\nexport async function verifyToken(\n  token: string,\n  issuer: string,\n  options: VerifyTokenOptions = {},\n): Promise<JWTPayload | null> {\n  let payload: JWTPayload;\n  try {\n    ({ payload } = await jwtVerify(token, getRemoteJWKS(issuer), {\n      algorithms: [\"RS256\"],\n      issuer,\n      // aud = issuer também passa: é o que os tokens do painel do Auth usam.\n      ...(options.audience ? { audience: [options.audience, issuer] } : {}),\n    }));\n  } catch {\n    return null;\n  }\n\n  // Token de App Connection: só vale se a conexão continua ativa agora.\n  const info = getTokenConnectionInfo(payload);\n  if (info.isAppConnection) {\n    if (!info.connectionId || !options.clientId || !options.clientSecret) return null;\n    const active = await isAppConnectionActive(issuer, info.connectionId, options.clientId, options.clientSecret);\n    if (!active) return null;\n  }\n\n  return payload;\n}\n\n// Renovações em andamento por refresh token (por processo) — ver tryRefreshTokens.\nconst inflightServerRefreshes = new Map<string, Promise<SessionTokens | null>>();\n\nexport function configureGeekappsAuth(input: GeekappsAuthConfig = {}) {\n  const clientId = resolveClientId(input);\n  const config: ResolvedGeekappsAuthConfig = {\n    ...input,\n    issuer: resolveIssuer(input),\n    clientId,\n    clientSecret: resolveClientSecret(input),\n    redirectUri: resolveConfiguredRedirectUri(input),\n    afterSignInRedirectTo:\n      input.afterSignInRedirectTo ?? input.redirectTo ?? \"/\",\n    basePath: normalizeBasePath(input.basePath),\n    cookiePrefix: deriveCookiePrefix(clientId),\n  };\n\n  const cn = getCookieNames(config.cookiePrefix);\n\n  // ── Slot helpers ──────────────────────────────────────────────────────────\n\n  async function getCount(): Promise<number> {\n    const cookieStore = await cookies();\n    const raw = cookieStore.get(cn.count)?.value;\n    const n = raw ? Number.parseInt(raw, 10) : 0;\n    return Number.isNaN(n) ? 0 : n;\n  }\n\n  async function getActiveIndex(): Promise<number> {\n    const cookieStore = await cookies();\n    const raw = cookieStore.get(cn.active)?.value;\n    if (!raw) return 0;\n    const n = Number.parseInt(raw, 10);\n    return Number.isNaN(n) ? 0 : n;\n  }\n\n  function readSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n  ): StoredAccount | null {\n    const at = cookieStore.get(cn.slotAt(n))?.value;\n    if (!at) return null;\n    const meta = decodeMeta(cookieStore.get(cn.slotMeta(n))?.value ?? \"\");\n    if (!meta) return null;\n    return {\n      id: meta.id,\n      accessToken: at,\n      refreshToken: cookieStore.get(cn.slotRt(n))?.value ?? null,\n      idToken: null, // not stored in cookies; claims are in meta\n      sessionId: meta.sid ?? null,\n      user: {\n        sub: meta.id,\n        name: meta.n ?? null,\n        email: meta.e ?? null,\n        picture: meta.p ?? null,\n      },\n    };\n  }\n\n  function writeSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n    account: StoredAccount,\n  ) {\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    cookieStore.set(cn.slotMeta(n), encodeMeta(account), opts);\n    cookieStore.set(cn.slotAt(n), account.accessToken, opts);\n    if (account.refreshToken) cookieStore.set(cn.slotRt(n), account.refreshToken, opts);\n  }\n\n  function clearSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n  ) {\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n    cookieStore.set(cn.slotMeta(n), \"\", clear);\n    cookieStore.set(cn.slotAt(n), \"\", clear);\n    cookieStore.set(cn.slotRt(n), \"\", clear);\n  }\n\n  // ── Public account helpers ─────────────────────────────────────────────────\n\n  async function getAccountsList(): Promise<StoredAccount[]> {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const accounts: StoredAccount[] = [];\n    for (let i = 1; i <= count; i++) {\n      const slot = readSlot(cookieStore, i);\n      if (slot) accounts.push(slot);\n    }\n    return accounts;\n  }\n\n  async function getActiveAccount(): Promise<StoredAccount | null> {\n    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);\n    if (count === 0) return null;\n    if (activeIdx >= 1 && activeIdx <= count) {\n      const slot = readSlot(cookieStore, activeIdx);\n      if (slot) return slot;\n    }\n    // Fall back to slot 1\n    return readSlot(cookieStore, 1);\n  }\n\n  async function getAccessToken() {\n    // Prefer the token injected by the middleware via request header (same-request refresh)\n    try {\n      const hdrs = await headers();\n      const auth = hdrs.get(\"authorization\");\n      if (auth?.startsWith(\"Bearer \")) return auth.slice(7);\n    } catch {}\n    const active = await getActiveAccount();\n    return active?.accessToken ?? null;\n  }\n\n  async function getRefreshToken() {\n    const active = await getActiveAccount();\n    return active?.refreshToken ?? null;\n  }\n\n  async function getSession(): Promise<SessionTokens | null> {\n    const active = await getActiveAccount();\n    if (!active) return null;\n    return {\n      accessToken: active.accessToken,\n      refreshToken: active.refreshToken,\n      idToken: active.idToken,\n      sessionId: active.sessionId,\n    };\n  }\n\n  async function getUser(): Promise<StoredAccount[\"user\"] | null> {\n    const active = await getActiveAccount();\n    return active?.user ?? null;\n  }\n\n  async function getUserById(userId: string, applicationId?: string): Promise<unknown | null> {\n    const qs = new URLSearchParams({ ...(applicationId ? { applicationId } : {}) });\n    try {\n      return await apiRequest<unknown>(`/users/${userId}?${qs}`);\n    } catch {\n      return null;\n    }\n  }\n\n  async function getOrganizations(): Promise<{ organizations: unknown[]; currentOrgId: string | null }> {\n    const cookieStore = await cookies();\n    const currentOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;\n    try {\n      const data = await apiRequest<unknown[] | { organizations: unknown[] }>(\"/organizations\");\n      const organizations = Array.isArray(data) ? data : (data as { organizations: unknown[] }).organizations;\n      return { organizations, currentOrgId };\n    } catch {\n      return { organizations: [], currentOrgId };\n    }\n  }\n\n  function clearPublicTokenCookie(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n  ) {\n    // Clear legacy _tp cookie if present\n    if (cookieStore.get(cn.tokenPub)?.value) {\n      cookieStore.set(cn.tokenPub, \"\", { httpOnly: false, maxAge: 0, path: \"/\" });\n    }\n  }\n\n  async function saveAccountToList(tokens: SessionTokens) {\n    const account = parseAccountFromJwt(tokens);\n    if (!account) return;\n\n    const cookieStore = await cookies();\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    const count = await getCount();\n\n    // Find existing slot for this account id\n    let targetSlot = 0;\n    for (let i = 1; i <= count; i++) {\n      const existing = readSlot(cookieStore, i);\n      if (existing?.id === account.id) {\n        targetSlot = i;\n        break;\n      }\n    }\n\n    if (targetSlot === 0) {\n      if (count >= MAX_ACCOUNTS) return;\n      targetSlot = count + 1;\n      cookieStore.set(cn.count, String(targetSlot), opts);\n    }\n\n    writeSlot(cookieStore, targetSlot, account);\n    cookieStore.set(cn.active, String(targetSlot), opts);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  // Alias for backwards compat\n  const setSessionCookies = saveAccountToList;\n\n  async function switchAccount(accountId: string): Promise<boolean> {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n\n    for (let i = 1; i <= count; i++) {\n      const slot = readSlot(cookieStore, i);\n      if (slot && (slot.id === accountId || slot.sessionId === accountId)) {\n        cookieStore.set(cn.active, String(i), opts);\n        clearPublicTokenCookie(cookieStore);\n        return true;\n      }\n    }\n    return false;\n  }\n\n  async function removeActiveAccount() {\n    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n\n    if (count === 0) return;\n\n    const remaining: StoredAccount[] = [];\n    for (let i = 1; i <= count; i++) {\n      if (i === activeIdx) continue;\n      const slot = readSlot(cookieStore, i);\n      if (slot) remaining.push(slot);\n    }\n\n    for (let i = 1; i <= count; i++) {\n      clearSlot(cookieStore, i);\n    }\n\n    if (remaining.length === 0) {\n      cookieStore.set(cn.count, \"0\", clear);\n      cookieStore.set(cn.active, \"0\", clear);\n      await clearPublicTokenCookie(cookieStore);\n      return;\n    }\n\n    // Re-compact remaining accounts into slots 1..n\n    for (let i = 0; i < remaining.length; i++) {\n      await writeSlot(cookieStore, i + 1, remaining[i]!);\n    }\n    cookieStore.set(cn.count, String(remaining.length), opts);\n    cookieStore.set(cn.active, \"1\", opts);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  async function clearAllSessionCookies() {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n    for (let i = 1; i <= count; i++) {\n      clearSlot(cookieStore, i);\n    }\n    cookieStore.set(cn.count, \"0\", clear);\n    cookieStore.set(cn.active, \"0\", clear);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  async function tryRefreshTokens(): Promise<string | null> {\n    const refreshToken = await getRefreshToken();\n    if (!refreshToken || !config.clientId) return null;\n\n    // Chamadas simultâneas com o mesmo refresh token dividem uma renovação só\n    // (ver middleware): renovar duas vezes com o mesmo token parece reuso.\n    let pending = inflightServerRefreshes.get(refreshToken);\n    if (!pending) {\n      pending = refreshWithToken(refreshToken).finally(() => {\n        setTimeout(() => inflightServerRefreshes.delete(refreshToken), 10_000);\n      });\n      inflightServerRefreshes.set(refreshToken, pending);\n    }\n    const tokens = await pending;\n    if (!tokens?.accessToken) return null;\n\n    // Em Server Component o Next não deixa gravar cookie: a renovação vale\n    // para esta requisição, e o middleware grava o par novo na próxima. O\n    // auth-server aceita a reapresentação do token antigo nesse caso.\n    try {\n      await saveAccountToList(tokens);\n    } catch {\n      // cookies() somente leitura neste contexto\n    }\n    return tokens.accessToken;\n  }\n\n  async function refreshWithToken(refreshToken: string) {\n\n    const basicAuth = Buffer.from(`${config.clientId}:${config.clientSecret ?? \"\"}`).toString(\"base64\");\n\n    const response = await fetch(createUrl(config.issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${basicAuth}`,\n      },\n      body: new URLSearchParams({\n        grant_type: \"refresh_token\",\n        refresh_token: refreshToken,\n      }),\n      cache: \"no-store\",\n    });\n\n    if (!response.ok) return null;\n\n    const data = (await response.json().catch(() => null)) as TokenLikeResponse | null;\n    if (!data) return null;\n\n    const tokens = tokenFromResponse(data);\n    return tokens.accessToken ? tokens : null;\n  }\n\n  async function apiRequest<T>(path: string, init: RequestInit = {}): Promise<T> {\n    const accessToken = await getAccessToken();\n    const requestHeaders = new Headers(init.headers);\n\n    if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n    if (init.body !== undefined && !requestHeaders.has(\"content-type\")) {\n      requestHeaders.set(\"content-type\", \"application/json\");\n    }\n\n    const url = new URL(createUrl(config.issuer, path));\n\n    const response = await fetch(url, {\n      ...init,\n      headers: requestHeaders,\n      cache: \"no-store\",\n    });\n\n    if (response.status === 401) {\n      const newAccessToken = await tryRefreshTokens();\n\n      if (!newAccessToken) {\n        // Sem renovar depois de um 401, a sessão acabou: expirou, foi revogada\n        // no painel ou o refresh token caiu. Os cookies apontam para algo que\n        // não existe mais, então saem — senão toda requisição seguinte repete\n        // o mesmo ciclo. Quem chamou recebe um erro que dá para tratar, em vez\n        // de \"Auth API error 401\" vindo do fundo da pilha.\n        await clearAllSessionCookies().catch(() => {});\n        throw new GeekappsSessionExpiredError();\n      }\n\n      if (newAccessToken) {\n        const retryHeaders = new Headers(init.headers);\n        retryHeaders.set(\"authorization\", `Bearer ${newAccessToken}`);\n        if (init.body !== undefined && !retryHeaders.has(\"content-type\")) {\n          retryHeaders.set(\"content-type\", \"application/json\");\n        }\n        const retryUrl = new URL(createUrl(config.issuer, path));\n        const retryResponse = await fetch(retryUrl, {\n          ...init,\n          headers: retryHeaders,\n          cache: \"no-store\",\n        });\n        if (!retryResponse.ok) {\n          const error = await retryResponse.json().catch(() => null);\n          throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${retryResponse.status}`);\n        }\n        if (retryResponse.status === 204) return null as T;\n        return (await retryResponse.json()) as T;\n      }\n    }\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => null);\n      throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${response.status}`);\n    }\n\n    if (response.status === 204) return null as T;\n    return (await response.json()) as T;\n  }\n\n  function createApiClient(): ServerAuthApiClient {\n    return {\n      get: (path) => apiRequest(path),\n      post: (path, body) => apiRequest(path, { method: \"POST\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      patch: (path, body) => apiRequest(path, { method: \"PATCH\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      put: (path, body) => apiRequest(path, { method: \"PUT\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      delete: (path) => apiRequest(path, { method: \"DELETE\" }),\n    };\n  }\n\n  async function requireUser(options: { redirectTo?: string } = {}) {\n    const accessToken = await getAccessToken();\n    if (!accessToken) {\n      redirect(options.redirectTo ?? \"/\");\n    }\n    return accessToken;\n  }\n\n  function escapeHtml(str: string): string {\n    return str.replace(/&/g, \"&amp;\").replace(/</g, \"&lt;\").replace(/>/g, \"&gt;\").replace(/\"/g, \"&quot;\");\n  }\n\n  function sanitizeRedirectTo(value: string | null | undefined): string {\n    const raw = value ?? \"/\";\n    // Never redirect back into the auth basePath — that would loop or replay a stale code.\n    if (raw.startsWith(config.basePath)) return \"/\";\n    // Only allow relative paths to prevent open-redirect.\n    if (raw.startsWith(\"/\") && !raw.startsWith(\"//\")) return raw;\n    return \"/\";\n  }\n\n  async function createAuthorizeRedirect(request: NextRequest, mode: \"login\" | \"register\" | \"add-account\" | \"google\") {\n    const redirectTo = sanitizeRedirectTo(request.nextUrl.searchParams.get(\"redirectTo\") ?? config.afterSignInRedirectTo);\n    const flowId = request.nextUrl.searchParams.get(\"flow_id\");\n    const url = new URL(createUrl(config.issuer, mode === \"google\" ? \"/auth/google\" : \"/authorize\"));\n\n    if (!config.clientId) {\n      return NextResponse.json(\n        { error: \"missing_client_id\", message: \"Missing GEEKAPPS_AUTH_CLIENT_ID or clientId.\" },\n        { status: 500 },\n      );\n    }\n\n    url.searchParams.set(\"client_id\", config.clientId);\n    url.searchParams.set(\"redirect_uri\", resolveRedirectUri(config, request));\n    url.searchParams.set(\"response_type\", \"code\");\n    const scopes = config.scopes ?? [\"openid\", \"profile\", \"email\"];\n    if (!scopes.includes(\"offline_access\")) scopes.push(\"offline_access\");\n    url.searchParams.set(\"scope\", scopes.join(\" \"));\n    url.searchParams.set(\"state\", Buffer.from(JSON.stringify({ redirectTo, mode })).toString(\"base64url\"));\n    if (mode === \"register\") url.searchParams.set(\"screen_hint\", \"signup\");\n    if (mode === \"add-account\") {\n      // Adding an account always needs a fresh login, regardless of any existing session.\n      url.searchParams.set(\"prompt\", \"login\");\n    } else {\n      // `prompt` (login | select_account | none | consent) is forwarded as-is to\n      // the IDP — see OidcPrompt in client.tsx for what each value does.\n      const prompt = request.nextUrl.searchParams.get(\"prompt\");\n      // Legacy fallback: silentLogin=false is equivalent to prompt=login.\n      const silentLogin = request.nextUrl.searchParams.get(\"silentLogin\");\n      const resolvedPrompt = prompt ?? (silentLogin === \"false\" ? \"login\" : null);\n      if (resolvedPrompt) url.searchParams.set(\"prompt\", resolvedPrompt);\n    }\n    if (flowId) url.searchParams.set(\"flow_id\", flowId);\n\n    const codeVerifier = generateCodeVerifier();\n    url.searchParams.set(\"code_challenge\", createCodeChallenge(codeVerifier));\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n    const response = NextResponse.redirect(url);\n    const cn = getCookieNames(config.cookiePrefix);\n    response.cookies.set(cn.pkceVerifier, codeVerifier, {\n      ...getCookieOptions(config),\n      maxAge: 60 * 10,\n    });\n    return response;\n  }\n\n  async function exchangeCode(request: NextRequest) {\n    const code = request.nextUrl.searchParams.get(\"code\");\n    const state = request.nextUrl.searchParams.get(\"state\");\n\n    const origin = requestOrigin(request);\n\n    if (!code) {\n      const err = request.nextUrl.searchParams.get(\"error\") ?? \"missing_code\";\n      const desc = request.nextUrl.searchParams.get(\"error_description\") ?? request.nextUrl.searchParams.get(\"error_message\") ?? \"No authorization code received\";\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=${encodeURIComponent(err)}&error_description=${encodeURIComponent(desc)}`, origin));\n    }\n\n    if (!config.clientId) {\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=missing_client_id&error_description=Auth+client+is+not+configured`, origin));\n    }\n\n    const basicAuth = Buffer.from(\n      `${config.clientId}:${config.clientSecret ?? \"\"}`,\n    ).toString(\"base64\");\n\n    const cn = getCookieNames(config.cookiePrefix);\n    const cookieStore = await cookies();\n    const codeVerifier = cookieStore.get(cn.pkceVerifier)?.value;\n    cookieStore.set(cn.pkceVerifier, \"\", { ...getCookieOptions(config), maxAge: 0 });\n\n    const tokenBody = new URLSearchParams({\n      grant_type: \"authorization_code\",\n      code,\n      redirect_uri: resolveRedirectUri(config, request),\n    });\n    if (codeVerifier) tokenBody.set(\"code_verifier\", codeVerifier);\n\n    const response = await fetch(createUrl(config.issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${basicAuth}`,\n      },\n      body: tokenBody,\n      cache: \"no-store\",\n    });\n\n    const data = (await response.json().catch(() => ({}))) as TokenLikeResponse & { error?: string; error_description?: string };\n    if (!response.ok) {\n      const error = encodeURIComponent((data.error as string | undefined) ?? \"token_exchange_failed\");\n      const desc = encodeURIComponent((data.error_description as string | undefined) ?? `Token exchange failed with status ${response.status}`);\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=${error}&error_description=${desc}`, origin));\n    }\n\n    await saveAccountToList(tokenFromResponse(data));\n\n    let redirectTo = sanitizeRedirectTo(config.afterSignInRedirectTo);\n    if (state) {\n      try {\n        const parsed = JSON.parse(Buffer.from(state, \"base64url\").toString(\"utf8\")) as { redirectTo?: string };\n        redirectTo = sanitizeRedirectTo(parsed.redirectTo);\n      } catch {\n        // ignore malformed state\n      }\n    }\n\n    return NextResponse.redirect(new URL(redirectTo, origin));\n  }\n\n  function mapLocalPathToApiPath(route: string) {\n    if (route === \"/me\") return \"/auth/me\";\n    if (route === \"/accounts/switch\") return \"/auth/accounts/switch\";\n    if (route === \"/organizations/active\") return \"/auth/organizations/active\";\n    if (route === \"/permissions/check\") return \"/auth/permissions/check\";\n    if (route === \"/login/password\") return \"/auth/login/password\";\n    if (route === \"/register/password\") return \"/auth/register/password\";\n    if (route === \"/passwordless/link\") return \"/auth/passwordless/link\";\n    return route;\n  }\n\n  async function handleAccountsLocal(): Promise<NextResponse> {\n    const [accounts, activeIdx] = await Promise.all([getAccountsList(), getActiveIndex()]);\n\n    return NextResponse.json({\n      accounts: accounts.map((a, i) => ({\n        id: a.id,\n        sessionId: a.sessionId ?? a.id,\n        isActive: i + 1 === activeIdx,\n        user: {\n          id: a.user.sub,\n          name: a.user.name ?? null,\n          email: a.user.email ?? null,\n          imageUrl: a.user.picture ?? null,\n          phone: a.user.phone ?? null,\n        },\n      })),\n    });\n  }\n\n  async function handleOrganizationsLocal(): Promise<NextResponse> {\n    const cookieStore = await cookies();\n    const activeOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;\n    try {\n      const data = await apiRequest<unknown[]|{ organizations: unknown[] }>(\"/organizations\");\n      const organizations = Array.isArray(data) ? data : (data as { organizations: unknown[] }).organizations;\n      return NextResponse.json({ organizations, currentOrgId: activeOrgId });\n    } catch {\n      return NextResponse.json({ organizations: [], currentOrgId: activeOrgId });\n    }\n  }\n\n  async function handleSwitchAccountLocal(request: NextRequest): Promise<NextResponse> {\n    const body = await readBody(request);\n    const targetId =\n      body && typeof body === \"object\"\n        ? String(\n            (body as Record<string, unknown>).accountId ??\n            (body as Record<string, unknown>).sessionId ??\n            \"\",\n          )\n        : \"\";\n\n    if (!targetId) {\n      return NextResponse.json({ error: \"accountId required\" }, { status: 400 });\n    }\n\n    const switched = await switchAccount(targetId);\n    if (!switched) {\n      return NextResponse.json({ error: \"Account not found\" }, { status: 404 });\n    }\n\n    return NextResponse.json({ ok: true });\n  }\n\n  async function proxy(request: NextRequest, route: string) {\n    const accessToken = await getAccessToken();\n    const body = [\"GET\", \"HEAD\"].includes(request.method) ? undefined : await readBody(request);\n    const url = new URL(appendSearchParams(createUrl(config.issuer, mapLocalPathToApiPath(route)), request));\n    const requestHeaders = new Headers();\n\n    if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n    if (body !== undefined) requestHeaders.set(\"content-type\", \"application/json\");\n\n    let response = await fetch(url, {\n      method: request.method,\n      headers: requestHeaders,\n      body: body === undefined ? undefined : typeof body === \"string\" ? body : JSON.stringify(body),\n      cache: \"no-store\",\n    });\n\n    if (response.status === 401) {\n      // Mesmo tratamento do apiRequest: tenta renovar uma vez e, se a sessão\n      // já não existe (expirada ou revogada no painel), limpa os cookies. Sem\n      // isso o cliente repetiria o mesmo token morto a cada chamada.\n      const refreshed = await tryRefreshTokens();\n\n      if (refreshed) {\n        requestHeaders.set(\"authorization\", `Bearer ${refreshed}`);\n        response = await fetch(url, {\n          method: request.method,\n          headers: requestHeaders,\n          body:\n            body === undefined\n              ? undefined\n              : typeof body === \"string\"\n                ? body\n                : JSON.stringify(body),\n          cache: \"no-store\",\n        });\n      } else {\n        await clearAllSessionCookies().catch(() => {});\n        return NextResponse.json(\n          { error: \"session_expired\" },\n          { status: 401 },\n        );\n      }\n    }\n\n    const data = isJsonResponse(response) ? ((await response.json().catch(() => null)) as TokenLikeResponse | null) : null;\n    if (data) {\n      const tokens = tokenFromResponse(data);\n      if (tokens.accessToken || tokens.refreshToken || tokens.idToken || tokens.sessionId) {\n        await saveAccountToList(tokens);\n      }\n      return NextResponse.json(data, { status: response.status });\n    }\n\n    return responseFromApi(response);\n  }\n\n  async function handle(request: NextRequest) {\n    const route = routeFromRequest(request, config.basePath);\n\n    if (request.method === \"GET\" && route === \"/sign-in\") return createAuthorizeRedirect(request, \"login\");\n    if (request.method === \"GET\" && route === \"/sign-up\") return createAuthorizeRedirect(request, \"register\");\n    if (request.method === \"GET\" && route === \"/add-account\") return createAuthorizeRedirect(request, \"add-account\");\n    if (request.method === \"GET\" && route === \"/login/google\") return createAuthorizeRedirect(request, \"google\");\n    if (request.method === \"GET\" && route === \"/callback\") {\n      const error = request.nextUrl.searchParams.get(\"error\");\n      if (error) {\n        const description = request.nextUrl.searchParams.get(\"error_description\") ?? request.nextUrl.searchParams.get(\"error_message\") ?? \"An authentication error occurred.\";\n        return new NextResponse(\n          `<!doctype html><html><head><meta charset=\"utf-8\"><title>Authentication Error</title></head><body style=\"font-family:sans-serif;max-width:480px;margin:80px auto;padding:0 16px\"><h2>Authentication Error</h2><p><strong>${escapeHtml(error)}</strong></p><p>${escapeHtml(description)}</p><a href=\"/\">Go back</a></body></html>`,\n          { status: 400, headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n        );\n      }\n      return exchangeCode(request);\n    }\n    if (request.method === \"GET\" && route === \"/token\") {\n      const accessToken = await getAccessToken();\n      if (!accessToken) return NextResponse.json({ error: \"missing_token\" }, { status: 401 });\n      return NextResponse.json({ accessToken });\n    }\n\n\n    if (request.method === \"GET\" && route === \"/accounts\") return handleAccountsLocal();\n    if (request.method === \"POST\" && route === \"/accounts/switch\") return handleSwitchAccountLocal(request);\n    if (request.method === \"GET\" && route === \"/organizations\") return handleOrganizationsLocal();\n\n    if (request.method === \"POST\" && route === \"/organizations\") {\n      const accessToken = await getAccessToken();\n      const body = (await readBody(request)) as Record<string, unknown> | undefined;\n      if (body && accessToken && !body.applicationId) {\n        const claims = decodeJwtPayload(accessToken);\n        const applicationId =\n          (typeof claims?.application_id === \"string\" ? claims.application_id : null) ??\n          (typeof claims?.client_id === \"string\" ? claims.client_id : null) ??\n          (typeof claims?.applicationId === \"string\" ? claims.applicationId : null);\n        if (applicationId) body.applicationId = applicationId;\n      }\n      const orgUrl = new URL(createUrl(config.issuer, \"/organizations\"));\n      const requestHeaders = new Headers();\n      if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n      if (body !== undefined) requestHeaders.set(\"content-type\", \"application/json\");\n      const response = await fetch(orgUrl, {\n        method: \"POST\",\n        headers: requestHeaders,\n        body: JSON.stringify(body),\n        cache: \"no-store\",\n      });\n      return responseFromApi(response);\n    }\n\n    if (request.method === \"POST\" && route === \"/sign-out\") {\n      await apiRequest(\"/auth/sign-out\", { method: \"POST\" }).catch(() => null);\n      await removeActiveAccount();\n      return NextResponse.json({ ok: true });\n    }\n\n    if (request.method === \"POST\" && route === \"/sign-out-all\") {\n      await apiRequest(\"/auth/sign-out-all\", { method: \"POST\" }).catch(() => null);\n      await clearAllSessionCookies();\n      return NextResponse.json({ ok: true });\n    }\n\n    if (request.method === \"POST\" && route === \"/organizations/active\") {\n      const body = await readBody(request);\n      const organizationId =\n        body && typeof body === \"object\" && \"organizationId\" in body\n          ? (body as Record<string, unknown>).organizationId\n          : null;\n      const response = NextResponse.json({ ok: true });\n      if (typeof organizationId === \"string\") {\n        const cookieOpts = {\n          httpOnly: true,\n          sameSite: \"lax\" as const,\n          path: \"/\",\n          secure: process.env.NODE_ENV === \"production\",\n          maxAge: 60 * 60 * 24 * 7,\n        };\n        response.cookies.set(cn.activeOrganizationId, organizationId, cookieOpts);\n      }\n      return response;\n    }\n\n    return proxy(request, route);\n  }\n\n  return {\n    handlers: {\n      GET: handle,\n      POST: handle,\n      PATCH: handle,\n      DELETE: handle,\n    },\n    GetSession: getSession,\n    GetUser: getUser,\n    GetUserById: getUserById,\n    GetOrganizations: getOrganizations,\n    SaveSession: saveAccountToList,\n    GetAccessToken: getAccessToken,\n    GetRefreshToken: getRefreshToken,\n    IsAuthenticated: async () => (await getAccessToken()) !== null,\n    TryRefreshTokens: tryRefreshTokens,\n    RequireUser: requireUser,\n    CreateAuthApiClient: createApiClient,\n    cookiePrefix: config.cookiePrefix,\n    VerifyToken: (token: string) =>\n      verifyToken(token, config.issuer, {\n        audience: config.clientId || undefined,\n        clientId: config.clientId || undefined,\n        clientSecret: config.clientSecret,\n      }),\n    GetTokenConnectionInfo: getTokenConnectionInfo,\n    SignInUrl: async (redirectTo?: string) => {\n      const configured = env(\"GEEKAPPS_APP_URL\");\n      if (!configured) throw new Error(\"Cannot determine app origin. Set GEEKAPPS_APP_URL.\");\n      const origin = configured.replace(/\\/$/, \"\");\n      const url = new URL(`${origin}${config.basePath}/sign-in`);\n      if (redirectTo) url.searchParams.set(\"redirectTo\", redirectTo);\n      return url.toString();\n    },\n  };\n}\n\nexport function handlers(options?: GeekappsAuthConfig) {\n  return configureGeekappsAuth(options).handlers;\n}\n\n/**\n * Returns true if the current request has a valid access token in cookies.\n * Safe to call in Server Components, Server Actions, and Route Handlers.\n */\nexport async function isAuthenticated(options?: GeekappsAuthConfig): Promise<boolean> {\n  const { GetAccessToken } = configureGeekappsAuth(options);\n  return (await GetAccessToken()) !== null;\n}\n"],"mappings":";;;AAEA,SAAS,WAAAA,UAAS,WAAAC,gBAAe;;;ACFjC,SAAS,YAAY,mBAAmB;AACxC,SAAS,SAAS,eAAe;AACjC,SAAS,gBAAgB;AACzB,SAAS,oBAAsC;AAC/C,SAAS,oBAAoB,iBAAkC;AAoBxD,IAAM,2BAA2B;;;ADhBxC,SAAS,IAAI,MAAc;AACzB,QAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,SAAO,SAAS,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AACpD;AAEA,SAAS,iBAAiB,KAAa;AACrC,SAAO,IAAI,QAAQ,OAAO,EAAE;AAC9B;AAEA,SAAS,gBAAgB;AACvB,SAAO;AAAA;AAAA,IAEL,IAAI,sBAAsB,KAAK,IAAI,uBAAuB,KAAK;AAAA,EACjE;AACF;AAGA,SAAS,aAAa,UAA0B;AAC9C,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,SAAM,KAAK,KAAK,IAAM,SAAS,WAAW,CAAC,IAAI;AAC/C,QAAI,MAAM;AAAA,EACZ;AACA,SAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACvC;AAEA,SAAS,qBAA6B;AACpC,QAAM,WAAW,IAAI,yBAAyB,KAAK;AACnD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,MAAM,aAAa,QAAQ,CAAC;AACrC;AAIA,SAAS,WAAW,OAAgC;AAClD,MAAI;AACF,UAAM,IAAI,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM,CAAC;AACrE,WAAO,EAAE,KAAK,IAAI;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB;AAC9B,QAAM,SAAS,mBAAmB;AAClC,SAAO;AAAA,IACL,QAAQ,GAAG,MAAM;AAAA,IACjB,OAAO,GAAG,MAAM;AAAA,IAChB,sBAAsB,GAAG,MAAM;AAAA,IAC/B,UAAU,CAAC,MAAc,GAAG,MAAM,KAAK,CAAC;AAAA,IACxC,QAAQ,CAAC,MAAc,GAAG,MAAM,MAAM,CAAC;AAAA,IACvC,QAAQ,CAAC,MAAc,GAAG,MAAM,MAAM,CAAC;AAAA,EACzC;AACF;AAEA,eAAe,uBAA+C;AAE5D,MAAI;AACF,UAAM,OAAO,MAAMC,SAAQ;AAC3B,UAAM,OAAO,KAAK,IAAI,eAAe;AACrC,QAAI,MAAM,WAAW,SAAS,EAAG,QAAO,KAAK,MAAM,CAAC;AAAA,EACtD,QAAQ;AAAA,EAAC;AACT,QAAM,cAAc,MAAMC,SAAQ;AAClC,QAAM,KAAK,MAAM,eAAe;AAChC,QAAM,MAAM,YAAY,IAAI,GAAG,MAAM,GAAG;AACxC,QAAM,YAAY,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AACnD,QAAM,WAAW,YAAY,IAAI,GAAG,KAAK,GAAG;AAC5C,QAAM,QAAQ,WAAW,OAAO,SAAS,UAAU,EAAE,IAAI;AACzD,MAAI,UAAU,EAAG,QAAO;AACxB,QAAM,MAAM,aAAa,KAAK,aAAa,QAAQ,YAAY;AAC/D,SAAO,YAAY,IAAI,GAAG,OAAO,GAAG,CAAC,GAAG,SAAS;AACnD;AAEA,eAAe,wBAAgD;AAC7D,QAAM,cAAc,MAAMA,SAAQ;AAClC,QAAM,KAAK,MAAM,eAAe;AAChC,QAAM,MAAM,YAAY,IAAI,GAAG,MAAM,GAAG;AACxC,QAAM,YAAY,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AACnD,QAAM,WAAW,YAAY,IAAI,GAAG,KAAK,GAAG;AAC5C,QAAM,QAAQ,WAAW,OAAO,SAAS,UAAU,EAAE,IAAI;AACzD,MAAI,UAAU,EAAG,QAAO;AACxB,QAAM,MAAM,aAAa,KAAK,aAAa,QAAQ,YAAY;AAC/D,SAAO,YAAY,IAAI,GAAG,OAAO,GAAG,CAAC,GAAG,SAAS;AACnD;AAEA,eAAe,uBAA+C;AAC5D,QAAM,eAAe,MAAM,sBAAsB;AACjD,QAAM,WAAW,IAAI,yBAAyB,KAAK;AACnD,QAAM,eAAe,IAAI,6BAA6B,KAAK;AAC3D,MAAI,CAAC,gBAAgB,CAAC,SAAU,QAAO;AAEvC,QAAM,YAAY,OAAO,KAAK,GAAG,QAAQ,IAAI,YAAY,EAAE,EAAE,SAAS,QAAQ;AAC9E,QAAM,WAAW,MAAM,MAAM,GAAG,cAAc,CAAC,eAAe;AAAA,IAC5D,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,eAAe,SAAS,SAAS;AAAA,IACnC;AAAA,IACA,MAAM,IAAI,gBAAgB,EAAE,YAAY,iBAAiB,eAAe,aAAa,CAAC;AAAA,IACtF,OAAO;AAAA,EACT,CAAC;AAED,MAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,QAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACnD,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,iBACH,KAAK,eAAe,KAAK;AAC5B,QAAM,kBACH,KAAK,gBAAgB,KAAK;AAE7B,MAAI,CAAC,eAAgB,QAAO;AAG5B,QAAM,cAAc,MAAMA,SAAQ;AAClC,QAAM,KAAK,MAAM,eAAe;AAChC,QAAM,MAAM,YAAY,IAAI,GAAG,MAAM,GAAG;AACxC,QAAM,YAAY,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AACnD,QAAM,OAAO;AAAA,IACX,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,KAAK,KAAK,KAAK;AAAA,EACzB;AACA,cAAY,IAAI,GAAG,OAAO,SAAS,GAAG,gBAAgB,IAAI;AAC1D,MAAI,gBAAiB,aAAY,IAAI,GAAG,OAAO,SAAS,GAAG,iBAAiB,IAAI;AAEhF,cAAY,IAAI,GAAG,mBAAmB,CAAC,OAAO,gBAAgB;AAAA,IAC5D,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,KAAK,KAAK,KAAK;AAAA,EACzB,CAAC;AAED,SAAO;AACT;AAEA,eAAe,UAAa,MAA0B;AACpD,MAAI,cAAc,MAAM,qBAAqB;AAC7C,MAAI,CAAC,YAAa,OAAM,IAAI,MAAM,mBAAmB;AAErD,QAAM,SAAS,cAAc;AAC7B,QAAM,UAAU,CAAC,UACf,MAAM,GAAG,MAAM,GAAG,IAAI,IAAI;AAAA,IACxB,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,IAC5C,OAAO;AAAA,EACT,CAAC;AAEH,MAAI,WAAW,MAAM,QAAQ,WAAW;AAExC,MAAI,SAAS,WAAW,KAAK;AAC3B,UAAM,WAAW,MAAM,qBAAqB;AAC5C,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,iBAAiB;AAChD,eAAW,MAAM,QAAQ,QAAQ;AAAA,EACnC;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAM,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AAClD,UAAM,IAAI,MAAO,KAAK,qBAAqB,KAAK,SAAS,KAAK,WAAW,cAAc,SAAS,MAAM,EAAa;AAAA,EACrH;AAEA,MAAI,SAAS,WAAW,IAAK,QAAO;AACpC,SAAO,SAAS,KAAK;AACvB;AAIA,eAAsB,QAAwC;AAC5D,MAAI;AACF,UAAM,OAAO,MAAM,UAA+C,UAAU;AAC5E,QAAI,CAAC,KAAM,QAAO,EAAE,MAAM,KAAK;AAC/B,QAAI,OAAO,SAAS,YAAY,UAAU,KAAM,QAAO;AACvD,WAAO,EAAE,MAAM,KAAoB;AAAA,EACrC,QAAQ;AACN,WAAO,EAAE,MAAM,KAAK;AAAA,EACtB;AACF;AAEA,eAAsB,cAAyD;AAC7E,QAAM,cAAc,MAAMA,SAAQ;AAClC,QAAM,KAAK,MAAM,eAAe;AAChC,QAAM,WAAW,YAAY,IAAI,GAAG,KAAK,GAAG;AAC5C,QAAM,QAAQ,WAAW,OAAO,SAAS,UAAU,EAAE,IAAI;AACzD,QAAM,YAAY,YAAY,IAAI,GAAG,MAAM,GAAG;AAC9C,QAAM,YAAY,YAAY,OAAO,SAAS,WAAW,EAAE,IAAI;AAE/D,QAAM,WAA+B,CAAC;AACtC,WAAS,IAAI,GAAG,KAAK,OAAO,KAAK;AAC/B,UAAM,KAAK,YAAY,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG;AAC1C,QAAI,CAAC,GAAI;AACT,UAAM,OAAO,WAAW,YAAY,IAAI,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,EAAE;AACpE,QAAI,CAAC,KAAM;AACX,aAAS,KAAK;AAAA,MACZ,IAAI,KAAK;AAAA,MACT,WAAW,KAAK,OAAO,KAAK;AAAA,MAC5B,UAAU,MAAM;AAAA,MAChB,MAAM;AAAA,QACJ,IAAI,KAAK;AAAA,QACT,MAAM,KAAK,KAAK;AAAA,QAChB,OAAO,KAAK,KAAK;AAAA,QACjB,UAAU,KAAK,KAAK;AAAA,QACpB,OAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,SAAS;AACpB;AAEA,eAAsB,mBAA6F;AACjH,MAAI;AACF,UAAM,cAAc,MAAMA,SAAQ;AAClC,UAAM,KAAK,MAAM,eAAe;AAChC,UAAM,cAAc,YAAY,IAAI,GAAG,oBAAoB,GAAG,SAAS;AACvE,UAAM,OAAO,MAAM,UAA8D,gBAAgB;AACjG,UAAM,gBAAgB,MAAM,QAAQ,IAAI,IAAI,OAAQ,KAA2C;AAC/F,UAAM,gBAAgB,eAAe,cAAc,CAAC,GAAG,MAAM;AAC7D,WAAO,EAAE,eAAe,cAAc,cAAc;AAAA,EACtD,SAAS,KAAK;AACZ,YAAQ,MAAM,6BAA6B,GAAG;AAC9C,WAAO,EAAE,eAAe,CAAC,EAAE;AAAA,EAC7B;AACF;","names":["cookies","headers","headers","cookies"]}
+{"version":3,"sources":["../src/actions.ts","../src/server.ts"],"sourcesContent":["\"use server\";\n\nimport { cookies, headers } from \"next/headers\";\nimport type {\n  ApplicationUpdateInput,\n  ConnectedAccount,\n  ForcePasswordResetInput,\n  ForcePasswordResetProgress,\n  ForcePasswordResetResult,\n  Organization,\n  OrganizationOwnedApplication,\n  User,\n  WaitlistList,\n  WaitlistStatus,\n} from \"./client\";\nimport { GEEKAPPS_AUTH_SERVER_URL } from \"./server\";\n\n// ── cookie helpers (duplicated from server.ts to keep this file self-contained) ──\n\nfunction env(name: string) {\n  const value = process.env[name];\n  return value && value.trim().length > 0 ? value : undefined;\n}\n\nfunction normalizeBaseUrl(url: string) {\n  return url.replace(/\\/$/, \"\");\n}\n\nfunction resolveIssuer() {\n  return normalizeBaseUrl(\n    // Deprecated: kept for backwards compatibility during the auth-server rename.\n    env(\"GEEKAPPS_AUTH_ISSUER\") ?? env(\"GEEKAPPS_AUTH_API_URL\") ?? GEEKAPPS_AUTH_SERVER_URL,\n  );\n}\n\n\nfunction hashClientId(clientId: string): string {\n  let h = 5381;\n  for (let i = 0; i < clientId.length; i++) {\n    h = ((h << 5) + h) ^ (clientId.charCodeAt(i) & 0xff);\n    h = h >>> 0;\n  }\n  return h.toString(16).padStart(8, \"0\");\n}\n\nfunction deriveCookiePrefix(): string {\n  const clientId = env(\"GEEKAPPS_AUTH_CLIENT_ID\") ?? \"\";\n  if (!clientId) return \"gk\";\n  return `gk_${hashClientId(clientId)}`;\n}\n\ntype SlotMeta = { id: string; sid?: string; n?: string; e?: string; p?: string };\n\nfunction decodeMeta(value: string): SlotMeta | null {\n  try {\n    const m = JSON.parse(Buffer.from(value, \"base64url\").toString(\"utf8\")) as SlotMeta;\n    return m.id ? m : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function getCookieNames() {\n  const prefix = deriveCookiePrefix();\n  return {\n    active: `${prefix}_active`,\n    count: `${prefix}_count`,\n    activeOrganizationId: `${prefix}_ao`,\n    slotMeta: (n: number) => `${prefix}_m${n}`,\n    slotAt: (n: number) => `${prefix}_at${n}`,\n    slotRt: (n: number) => `${prefix}_rt${n}`,\n  };\n}\n\nasync function getActiveAccessToken(): Promise<string | null> {\n  // Prefer the token injected by the middleware via request header (same-request refresh)\n  try {\n    const hdrs = await headers();\n    const auth = hdrs.get(\"authorization\");\n    if (auth?.startsWith(\"Bearer \")) return auth.slice(7);\n  } catch {}\n  const cookieStore = await cookies();\n  const cn = await getCookieNames();\n  const raw = cookieStore.get(cn.active)?.value;\n  const activeIdx = raw ? Number.parseInt(raw, 10) : 0;\n  const countRaw = cookieStore.get(cn.count)?.value;\n  const count = countRaw ? Number.parseInt(countRaw, 10) : 0;\n  if (count === 0) return null;\n  const idx = activeIdx >= 1 && activeIdx <= count ? activeIdx : 1;\n  return cookieStore.get(cn.slotAt(idx))?.value ?? null;\n}\n\nasync function getActiveRefreshToken(): Promise<string | null> {\n  const cookieStore = await cookies();\n  const cn = await getCookieNames();\n  const raw = cookieStore.get(cn.active)?.value;\n  const activeIdx = raw ? Number.parseInt(raw, 10) : 0;\n  const countRaw = cookieStore.get(cn.count)?.value;\n  const count = countRaw ? Number.parseInt(countRaw, 10) : 0;\n  if (count === 0) return null;\n  const idx = activeIdx >= 1 && activeIdx <= count ? activeIdx : 1;\n  return cookieStore.get(cn.slotRt(idx))?.value ?? null;\n}\n\nasync function refreshAndSaveTokens(): Promise<string | null> {\n  const refreshToken = await getActiveRefreshToken();\n  const clientId = env(\"GEEKAPPS_AUTH_CLIENT_ID\") ?? \"\";\n  const clientSecret = env(\"GEEKAPPS_AUTH_CLIENT_SECRET\") ?? \"\";\n  if (!refreshToken || !clientId) return null;\n\n  const basicAuth = Buffer.from(`${clientId}:${clientSecret}`).toString(\"base64\");\n  const response = await fetch(`${resolveIssuer()}/auth/token`, {\n    method: \"POST\",\n    headers: {\n      \"content-type\": \"application/x-www-form-urlencoded\",\n      authorization: `Basic ${basicAuth}`,\n    },\n    body: new URLSearchParams({ grant_type: \"refresh_token\", refresh_token: refreshToken }),\n    cache: \"no-store\",\n  });\n\n  if (!response.ok) return null;\n\n  const data = await response.json().catch(() => null) as Record<string, unknown> | null;\n  if (!data) return null;\n\n  const newAccessToken =\n    (data.accessToken ?? data.access_token) as string | undefined;\n  const newRefreshToken =\n    (data.refreshToken ?? data.refresh_token) as string | undefined;\n\n  if (!newAccessToken) return null;\n\n  // Update the active slot cookies\n  const cookieStore = await cookies();\n  const cn = await getCookieNames();\n  const raw = cookieStore.get(cn.active)?.value;\n  const activeIdx = raw ? Number.parseInt(raw, 10) : 1;\n  const opts = {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === \"production\",\n    sameSite: \"lax\" as const,\n    path: \"/\",\n    maxAge: 60 * 60 * 24 * 30,\n  };\n  cookieStore.set(cn.slotAt(activeIdx), newAccessToken, opts);\n  if (newRefreshToken) cookieStore.set(cn.slotRt(activeIdx), newRefreshToken, opts);\n  // Update public token cookie\n  cookieStore.set(`${deriveCookiePrefix()}_tp`, newAccessToken, {\n    httpOnly: false,\n    secure: process.env.NODE_ENV === \"production\",\n    sameSite: \"lax\",\n    path: \"/\",\n    maxAge: 60 * 60 * 24 * 30,\n  });\n\n  return newAccessToken;\n}\n\nasync function authFetch<T>(path: string, init: { method?: string; body?: unknown } = {}): Promise<T> {\n  let accessToken = await getActiveAccessToken();\n  if (!accessToken) throw new Error(\"Not authenticated\");\n\n  const issuer = resolveIssuer();\n  const doFetch = (token: string) =>\n    fetch(`${issuer}${path}`, {\n      method: init.method ?? \"GET\",\n      headers: {\n        authorization: `Bearer ${token}`,\n        ...(init.body !== undefined ? { \"content-type\": \"application/json\" } : {}),\n      },\n      body: init.body === undefined ? undefined : JSON.stringify(init.body),\n      cache: \"no-store\",\n    });\n\n  let response = await doFetch(accessToken);\n\n  if (response.status === 401) {\n    const newToken = await refreshAndSaveTokens();\n    if (!newToken) throw new Error(\"Session expired\");\n    response = await doFetch(newToken);\n  }\n\n  if (!response.ok) {\n    const err = await response.json().catch(() => null) as Record<string, unknown> | null;\n    throw new Error((err?.error_description ?? err?.error ?? err?.message ?? `Auth error ${response.status}`) as string);\n  }\n\n  if (response.status === 204) return null as T;\n  return response.json() as Promise<T>;\n}\n\n// ── Exported server actions ────────────────────────────────────────────────────\n\nexport async function getMe(): Promise<{ user: User | null }> {\n  try {\n    const data = await authFetch<{ user: User | null } | User | null>(\"/auth/me\");\n    if (!data) return { user: null };\n    if (typeof data === \"object\" && \"user\" in data) return data as { user: User | null };\n    return { user: data as User | null };\n  } catch {\n    return { user: null };\n  }\n}\n\nexport async function getAccounts(): Promise<{ accounts: ConnectedAccount[] }> {\n  const cookieStore = await cookies();\n  const cn = await getCookieNames();\n  const countRaw = cookieStore.get(cn.count)?.value;\n  const count = countRaw ? Number.parseInt(countRaw, 10) : 0;\n  const activeRaw = cookieStore.get(cn.active)?.value;\n  const activeIdx = activeRaw ? Number.parseInt(activeRaw, 10) : 0;\n\n  const accounts: ConnectedAccount[] = [];\n  for (let i = 1; i <= count; i++) {\n    const at = cookieStore.get(cn.slotAt(i))?.value;\n    if (!at) continue;\n    const meta = decodeMeta(cookieStore.get(cn.slotMeta(i))?.value ?? \"\");\n    if (!meta) continue;\n    accounts.push({\n      id: meta.id,\n      sessionId: meta.sid ?? meta.id,\n      isActive: i === activeIdx,\n      user: {\n        id: meta.id,\n        name: meta.n ?? null,\n        email: meta.e ?? \"\",\n        imageUrl: meta.p ?? null,\n        phone: null,\n      },\n    });\n  }\n\n  return { accounts };\n}\n\nexport async function getOrganizations(): Promise<{ organizations: Organization[]; currentOrgId?: string | null }> {\n  try {\n    const cookieStore = await cookies();\n    const cn = await getCookieNames();\n    const activeOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;\n    const data = await authFetch<Organization[] | { organizations: Organization[] }>(\"/organizations\");\n    const organizations = Array.isArray(data) ? data : (data as { organizations: Organization[] }).organizations;\n    const resolvedOrgId = activeOrgId ?? organizations[0]?.id ?? null;\n    return { organizations, currentOrgId: resolvedOrgId };\n  } catch (err) {\n    // Só a mensagem: o objeto de erro pode carregar a requisição (URL, headers).\n    console.error(\"[getOrganizations] error:\", err instanceof Error ? err.message : \"unknown error\");\n    return { organizations: [] };\n  }\n}\n\n// ── Waitlist, reset forçado de senha e Applications (rotas protegidas) ─────────\n\nexport async function listWaitlist(\n  applicationId: string,\n  options: { status?: WaitlistStatus; limit?: number } = {},\n): Promise<WaitlistList> {\n  const qs = new URLSearchParams();\n  if (options.status) qs.set(\"status\", options.status);\n  if (options.limit) qs.set(\"limit\", String(options.limit));\n  const suffix = qs.size ? `?${qs}` : \"\";\n  return authFetch<WaitlistList>(`/applications/${encodeURIComponent(applicationId)}/waitlist${suffix}`);\n}\n\nexport async function approveWaitlist(\n  applicationId: string,\n  input: { entryIds: string[] } | { next: number },\n): Promise<{ ok: boolean; approved: number }> {\n  return authFetch(`/applications/${encodeURIComponent(applicationId)}/waitlist/approve`, {\n    method: \"POST\",\n    body: input,\n  });\n}\n\nexport async function removeWaitlistEntry(applicationId: string, entryId: string): Promise<void> {\n  await authFetch<null>(\n    `/applications/${encodeURIComponent(applicationId)}/waitlist/${encodeURIComponent(entryId)}`,\n    { method: \"DELETE\" },\n  );\n}\n\nexport async function forcePasswordReset(input: ForcePasswordResetInput): Promise<ForcePasswordResetResult> {\n  return authFetch(\"/lighthouse/force-password-reset\", { method: \"POST\", body: input });\n}\n\nexport async function getForcePasswordResetProgress(\n  organizationId: string,\n  applicationId: string,\n): Promise<ForcePasswordResetProgress> {\n  const qs = new URLSearchParams({ organizationId, applicationId });\n  return authFetch(`/lighthouse/force-password-reset?${qs}`);\n}\n\nexport async function updateApplication(\n  applicationId: string,\n  input: ApplicationUpdateInput,\n): Promise<OrganizationOwnedApplication> {\n  return authFetch(`/applications/${encodeURIComponent(applicationId)}`, { method: \"PATCH\", body: input });\n}\n","import { createHash, randomBytes } from \"node:crypto\";\nimport { cookies, headers } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport { NextResponse, type NextRequest } from \"next/server\";\nimport { createRemoteJWKSet, jwtVerify, type JWTPayload } from \"jose\";\n\n/**\n * A sessão não vale mais: expirou, foi revogada no painel ou o refresh token\n * foi invalidado. Os cookies já foram limpos quando este erro é lançado, então\n * o tratamento normal é redirecionar para o login.\n */\nexport class GeekappsSessionExpiredError extends Error {\n  readonly code = \"session_expired\" as const;\n\n  constructor(message = \"A sessão expirou ou foi revogada. Entre novamente.\") {\n    super(message);\n    this.name = \"GeekappsSessionExpiredError\";\n  }\n}\n\n/**\n * Fixed URL of the Geekapps Auth Server (OIDC issuer + API). This never\n * changes per-environment, so it is hardcoded rather than read from env.\n */\nexport const GEEKAPPS_AUTH_SERVER_URL = \"https://accounts-api.geekapps.com.br\";\n\n/** Erro padrão OAuth devolvido ao redirect_uri (`?error=&error_description=&state=`). */\nexport type AuthCallbackError = {\n  error: \"invalid_request\" | \"interaction_required\" | \"access_denied\" | \"login_required\" | \"missing_code\" | \"missing_client_id\" | \"token_exchange_failed\" | (string & {});\n  description: string;\n  state: string | null;\n};\n\n/** Lê o erro OAuth de uma URL de callback; null quando não há `error`. */\nexport function parseAuthCallbackError(\n  input: URL | URLSearchParams | string,\n): AuthCallbackError | null {\n  const params =\n    input instanceof URLSearchParams\n      ? input\n      : input instanceof URL\n        ? input.searchParams\n        : new URL(input, \"http://localhost\").searchParams;\n  const error = params.get(\"error\");\n  if (!error) return null;\n  return {\n    error,\n    description: params.get(\"error_description\") ?? params.get(\"error_message\") ?? \"An authentication error occurred.\",\n    state: params.get(\"state\"),\n  };\n}\n\nexport type GeekappsAuthConfig = {\n  /**\n   * Chamado quando o callback recebe um erro OAuth (fluxo expirado, 2FA pendente\n   * com prompt=none, acesso negado...). Devolva uma Response (ex.: redirect para\n   * uma página sua) para assumir; devolva undefined para a página de erro padrão.\n   */\n  onCallbackError?: (\n    error: AuthCallbackError,\n    request: NextRequest,\n  ) => Response | NextResponse | undefined | Promise<Response | NextResponse | undefined>;\n  /**\n   * Auth Server (OIDC) issuer URL. Defaults to GEEKAPPS_AUTH_SERVER_URL and\n   * should not need overriding in normal use.\n   *\n   * Deprecated (still supported as a fallback): GEEKAPPS_AUTH_SERVER_ISSUER,\n   * GEEKAPPS_AUTH_ISSUER, GEEKAPPS_AUTH_SERVER_URL env, GEEKAPPS_AUTH_API_URL\n   */\n  issuer?: string;\n\n  /**\n   * OAuth client id. Optional when GEEKAPPS_AUTH_CLIENT_ID is defined.\n   */\n  clientId?: string;\n\n  /**\n   * OAuth client secret for confidential clients. Optional when\n   * GEEKAPPS_AUTH_CLIENT_SECRET is defined.\n   */\n  clientSecret?: string;\n\n  /**\n   * Callback URL. Optional when GEEKAPPS_AUTH_REDIRECT_URI is defined.\n   * If omitted, it is inferred from the current request origin + basePath/callback.\n   */\n  redirectUri?: string;\n\n  scopes?: string[];\n  basePath?: string;\n  /**\n   * @deprecated cookiePrefix is now auto-derived from clientId.\n   * This field is kept for backwards compatibility but is ignored.\n   */\n  cookiePrefix?: string;\n  secureCookies?: boolean;\n\n  /**\n   * Friendly alias used by apps. Same as afterSignInRedirectTo.\n   */\n  redirectTo?: string;\n\n  afterSignInRedirectTo?: string;\n  afterSignOutRedirectTo?: string;\n};\n\ntype ResolvedGeekappsAuthConfig = GeekappsAuthConfig & {\n  issuer: string;\n  clientId: string;\n  basePath: string;\n  cookiePrefix: string;\n};\n\nexport type SessionTokens = {\n  accessToken: string | null;\n  refreshToken: string | null;\n  idToken: string | null;\n  sessionId: string | null;\n};\n\nexport type StoredAccount = {\n  /** Stable identifier — `sub` from id_token or fallback to sessionId. */\n  id: string;\n  accessToken: string;\n  refreshToken: string | null;\n  idToken: string | null;\n  sessionId: string | null;\n  user: {\n    sub: string;\n    name?: string | null;\n    email?: string | null;\n    picture?: string | null;\n    phone?: string | null;\n  };\n};\n\nexport type ServerAuthApiClient = {\n  get: <T>(path: string) => Promise<T>;\n  post: <T>(path: string, body?: unknown) => Promise<T>;\n  patch: <T>(path: string, body?: unknown) => Promise<T>;\n  put: <T>(path: string, body?: unknown) => Promise<T>;\n  delete: <T>(path: string) => Promise<T>;\n};\n\ntype JsonObject = Record<string, unknown>;\n\ntype TokenLikeResponse = JsonObject & {\n  access_token?: string;\n  accessToken?: string;\n  refresh_token?: string;\n  refreshToken?: string;\n  id_token?: string;\n  idToken?: string;\n  session_id?: string;\n  sessionId?: string;\n  tokens?: {\n    access_token?: string;\n    accessToken?: string;\n    refresh_token?: string;\n    refreshToken?: string;\n    id_token?: string;\n    idToken?: string;\n    session_id?: string;\n    sessionId?: string;\n  };\n};\n\nconst MAX_ACCOUNTS = 8;\n\nfunction normalizeBaseUrl(url: string) {\n  return url.replace(/\\/$/, \"\");\n}\n\nfunction normalizeBasePath(path = \"/api/auth\") {\n  if (!path.startsWith(\"/\")) return `/${path}`;\n  return path.replace(/\\/$/, \"\");\n}\n\nfunction createUrl(baseUrl: string, path: string) {\n  if (/^https?:\\/\\//.test(path)) return path;\n  const normalizedPath = path.startsWith(\"/\") ? path : `/${path}`;\n  return `${normalizeBaseUrl(baseUrl)}${normalizedPath}`;\n}\n\nfunction env(name: string) {\n  const value = process.env[name];\n  return value && value.trim().length > 0 ? value : undefined;\n}\n\nfunction resolveIssuer(input: GeekappsAuthConfig) {\n  return normalizeBaseUrl(\n    input.issuer ??\n      env(\"GEEKAPPS_AUTH_SERVER_ISSUER\") ??\n      env(\"GEEKAPPS_AUTH_SERVER_URL\") ??\n      // Deprecated: kept for backwards compatibility during the auth-server rename.\n      env(\"GEEKAPPS_AUTH_ISSUER\") ??\n      env(\"GEEKAPPS_AUTH_API_URL\") ??\n      GEEKAPPS_AUTH_SERVER_URL,\n  );\n}\n\nfunction resolveClientId(input: GeekappsAuthConfig) {\n  return input.clientId ?? env(\"GEEKAPPS_AUTH_CLIENT_ID\") ?? \"\";\n}\n\nfunction resolveClientSecret(input: GeekappsAuthConfig) {\n  return input.clientSecret ?? env(\"GEEKAPPS_AUTH_CLIENT_SECRET\");\n}\n\n\nfunction resolveConfiguredRedirectUri(input: GeekappsAuthConfig) {\n  return input.redirectUri ?? env(\"GEEKAPPS_AUTH_REDIRECT_URI\");\n}\n\n/**\n * Derives a short stable 8-char hex hash from a clientId string.\n * Uses a simple djb2-style hash — no crypto dependency needed.\n */\nfunction hashClientId(clientId: string): string {\n  let h = 5381;\n  for (let i = 0; i < clientId.length; i++) {\n    h = ((h << 5) + h) ^ (clientId.charCodeAt(i) & 0xff);\n    h = h >>> 0; // keep unsigned 32-bit\n  }\n  return h.toString(16).padStart(8, \"0\");\n}\n\n/**\n * Auto-derives the cookie prefix from clientId.\n * Format: `gk_{8-char-hash}` — guaranteed unique per OAuth client.\n * Falls back to `gk` when clientId is empty (dev/test environments).\n */\nfunction deriveCookiePrefix(clientId: string): string {\n  if (!clientId) return \"gk\";\n  return `gk_${hashClientId(clientId)}`;\n}\n\n// GEEKAPPS_APP_URL é o override de produção: em prod o app roda atrás de\n// Docker sem proxy setando x-forwarded-host/x-forwarded-proto, então nem o\n// header Host nem request.nextUrl.origin são confiáveis (refletem o host\n// INTERNO do container, não o domínio público real) — por isso, quando\n// configurada, essa env var sempre vence. Sem ela (dev local, onde não está\n// setada no .env), deriva do próprio request — em localhost sem proxy o\n// Host já é localhost:PORTA mesmo, então funciona sem precisar de override.\nfunction requestOrigin(request: NextRequest) {\n  const configured = env(\"GEEKAPPS_APP_URL\");\n  if (configured) return configured.replace(/\\/$/, \"\");\n\n  if (request.nextUrl?.origin) return request.nextUrl.origin;\n\n  throw new Error(\n    \"Cannot determine app origin. Set GEEKAPPS_APP_URL or ensure request.nextUrl is available.\",\n  );\n}\n\nfunction resolveRedirectUri(config: ResolvedGeekappsAuthConfig, request: NextRequest) {\n  return config.redirectUri ?? `${requestOrigin(request)}${config.basePath}/callback`;\n}\n\nfunction tokenFromResponse(data: TokenLikeResponse): SessionTokens {\n  return {\n    accessToken: data.accessToken ?? data.access_token ?? data.tokens?.accessToken ?? data.tokens?.access_token ?? null,\n    refreshToken:\n      data.refreshToken ?? data.refresh_token ?? data.tokens?.refreshToken ?? data.tokens?.refresh_token ?? null,\n    idToken: data.idToken ?? data.id_token ?? data.tokens?.idToken ?? data.tokens?.id_token ?? null,\n    sessionId: data.sessionId ?? data.session_id ?? data.tokens?.sessionId ?? data.tokens?.session_id ?? null,\n  };\n}\n\n/** Decode a JWT payload without verifying signature (safe for client-visible claims). */\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split(\".\");\n    if (parts.length < 2) return null;\n    const payload = parts[1];\n    if (!payload) return null;\n    return JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf8\")) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nfunction parseAccountFromJwt(tokens: SessionTokens): StoredAccount | null {\n  if (!tokens.accessToken) return null;\n\n  const jwtToParse = tokens.idToken ?? tokens.accessToken;\n  const payload = decodeJwtPayload(jwtToParse);\n  if (!payload) return null;\n\n  const sub = typeof payload.sub === \"string\" ? payload.sub : null;\n  const id = sub ?? tokens.sessionId;\n  if (!id) return null;\n\n  return {\n    id,\n    accessToken: tokens.accessToken,\n    refreshToken: tokens.refreshToken,\n    idToken: tokens.idToken ?? null,\n    sessionId: tokens.sessionId,\n    user: {\n      sub: id,\n      name: typeof payload.name === \"string\" ? payload.name : null,\n      email: typeof payload.email === \"string\" ? payload.email : null,\n      picture: typeof payload.picture === \"string\" ? payload.picture : null,\n      phone: typeof payload.phone_number === \"string\" ? payload.phone_number : null,\n    },\n  };\n}\n\n/**\n * Cookie name scheme — 3 cookies per slot, each well under 4096 bytes:\n *\n *   {prefix}_m{n}   — metadata blob (base64url JSON): { id, sid?, n?, e?, p? }\n *                     Claims extracted from id_token at login. Never stores tokens.\n *   {prefix}_at{n}  — access token (httpOnly). ~1-2 KB.\n *   {prefix}_rt{n}  — refresh token (httpOnly). ~1 KB.\n *   {prefix}_active — active slot index (\"1\", \"2\", …)\n *   {prefix}_count  — total stored slots\n *   {prefix}_ao     — active org id for this app\n *   {prefix}_tp     — non-httpOnly copy of active access token for client-side axios\n *\n * id_token is NOT stored in cookies — claims are extracted at login and cached in\n * the metadata cookie. This is the key size saving.\n */\nfunction getCookieNames(prefix: string) {\n  return {\n    active: `${prefix}_active`,\n    count: `${prefix}_count`,\n    activeOrganizationId: `${prefix}_ao`,\n    tokenPub: `${prefix}_tp`,\n    pkceVerifier: `${prefix}_pkce`,\n    slotMeta: (n: number) => `${prefix}_m${n}`,\n    slotAt: (n: number) => `${prefix}_at${n}`,\n    slotRt: (n: number) => `${prefix}_rt${n}`,\n  };\n}\n\nfunction generateCodeVerifier(): string {\n  return randomBytes(64).toString(\"base64url\");\n}\n\nfunction createCodeChallenge(codeVerifier: string): string {\n  return createHash(\"sha256\").update(codeVerifier).digest(\"base64url\");\n}\n\ntype SlotMeta = {\n  id: string;\n  sid?: string;\n  n?: string;\n  e?: string;\n  p?: string;\n};\n\nfunction encodeMeta(account: StoredAccount): string {\n  const m: SlotMeta = { id: account.id };\n  if (account.sessionId) m.sid = account.sessionId;\n  if (account.user.name) m.n = account.user.name;\n  if (account.user.email) m.e = account.user.email;\n  if (account.user.picture) m.p = account.user.picture;\n  return Buffer.from(JSON.stringify(m), \"utf8\").toString(\"base64url\");\n}\n\nfunction decodeMeta(value: string): SlotMeta | null {\n  try {\n    const m = JSON.parse(Buffer.from(value, \"base64url\").toString(\"utf8\")) as SlotMeta;\n    return m.id ? m : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction getCookieOptions(config: ResolvedGeekappsAuthConfig) {\n  return {\n    httpOnly: true,\n    secure: config.secureCookies ?? process.env.NODE_ENV === \"production\",\n    sameSite: \"lax\" as const,\n    path: \"/\",\n  };\n}\n\nasync function readBody(request: NextRequest) {\n  const text = await request.text();\n  if (!text) return undefined;\n  try {\n    return JSON.parse(text);\n  } catch {\n    return text;\n  }\n}\n\nfunction appendSearchParams(url: string, request: NextRequest) {\n  const target = new URL(url);\n  request.nextUrl.searchParams.forEach((value, key) => {\n    target.searchParams.set(key, value);\n  });\n  return target.toString();\n}\n\nfunction routeFromRequest(request: NextRequest, basePath: string) {\n  const pathname = request.nextUrl.pathname;\n  if (!pathname.startsWith(basePath)) return pathname;\n  const route = pathname.slice(basePath.length);\n  return route || \"/\";\n}\n\nfunction isJsonResponse(response: Response) {\n  return response.headers.get(\"content-type\")?.includes(\"application/json\");\n}\n\nasync function responseFromApi(response: Response) {\n  if (response.status === 204) return new NextResponse(null, { status: 204 });\n  const body = isJsonResponse(response) ? await response.json().catch(() => null) : await response.text();\n  return NextResponse.json(body, { status: response.status });\n}\n\nconst _remoteJWKSCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\ntype ServiceTokenCache = { token: string; expiresAt: number };\nconst _serviceTokenCache = new Map<string, ServiceTokenCache>();\n\nasync function fetchServiceToken(issuer: string, clientId: string, clientSecret: string): Promise<string | null> {\n  const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString(\"base64\");\n  try {\n    const res = await fetch(createUrl(issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${credentials}`,\n      },\n      body: \"grant_type=service_account\",\n      cache: \"no-store\",\n    });\n    if (!res.ok) return null;\n    const data = (await res.json()) as { access_token?: string };\n    return data.access_token ?? null;\n  } catch {\n    return null;\n  }\n}\n\nasync function getServiceToken(issuer: string, clientId: string, clientSecret: string): Promise<string | null> {\n  const key = `${issuer}:${clientId}`;\n  const now = Date.now();\n  const cached = _serviceTokenCache.get(key);\n  if (cached && cached.expiresAt - 30_000 > now) return cached.token;\n  const token = await fetchServiceToken(issuer, clientId, clientSecret);\n  if (!token) return null;\n  _serviceTokenCache.set(key, { token, expiresAt: now + 420_000 });\n  return token;\n}\n\ntype ServiceAccountConfig = {\n  issuer?: string;\n  clientId?: string;\n  clientSecret?: string;\n};\n\n/**\n * Returns a service account access token.\n * The issuer is always the Geekapps Auth Server (GEEKAPPS_AUTH_SERVER_URL) —\n * it does not need to be configured. Reads GEEKAPPS_SERVICE_ACCOUNT_CLIENT_ID,\n * GEEKAPPS_SERVICE_ACCOUNT_CLIENT_SECRET by default.\n * Any field can be overridden via the optional config argument.\n * Tokens are cached per client and auto-renewed before expiry (~7 min TTL).\n */\nexport function getServiceAccountToken(override: ServiceAccountConfig = {}): Promise<string | null> {\n  const issuer = normalizeBaseUrl(\n    override.issuer ??\n      // Deprecated: kept for backwards compatibility during the auth-server rename.\n      env(\"GEEKAPPS_AUTH_ISSUER\") ??\n      env(\"GEEKAPPS_AUTH_API_URL\") ??\n      GEEKAPPS_AUTH_SERVER_URL,\n  );\n  const clientId = override.clientId ?? env(\"GEEKAPPS_SERVICE_ACCOUNT_CLIENT_ID\") ?? \"\";\n  const clientSecret = override.clientSecret ?? env(\"GEEKAPPS_SERVICE_ACCOUNT_CLIENT_SECRET\") ?? \"\";\n  if (!clientId || !clientSecret) return Promise.resolve(null);\n  return getServiceToken(issuer, clientId, clientSecret);\n}\n\nfunction getRemoteJWKS(issuer: string) {\n  if (!_remoteJWKSCache.has(issuer)) {\n    _remoteJWKSCache.set(issuer, createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`)));\n  }\n  return _remoteJWKSCache.get(issuer)!;\n}\n\nexport type VerifyTokenOptions = {\n  /** client_id desta app. Quando informado, o token precisa ter sido emitido para ela (`aud`). */\n  audience?: string;\n  /** Credenciais desta app, para conferir se uma App Connection ainda está ativa. */\n  clientId?: string;\n  clientSecret?: string;\n};\n\n/** Informações de App Connection lidas de um token já verificado. */\nexport type TokenConnectionInfo = {\n  /** true quando outra app está agindo em nome do usuário, sem ele presente. */\n  isAppConnection: boolean;\n  /** Application que está agindo (claim `act.sub`). */\n  actorAppId: string | null;\n  /** Id da App Connection. */\n  connectionId: string | null;\n};\n\nexport function getTokenConnectionInfo(payload: JWTPayload): TokenConnectionInfo {\n  const isAppConnection = payload.token_type === \"app_connection\";\n  const act = payload.act as { sub?: unknown } | undefined;\n  return {\n    isAppConnection,\n    actorAppId: isAppConnection && typeof act?.sub === \"string\" ? act.sub : null,\n    connectionId: isAppConnection && typeof payload.connection_id === \"string\" ? payload.connection_id : null,\n  };\n}\n\n/**\n * Pergunta ao Auth se a App Connection segue ativa. Sem cache: revogar\n * corta o acesso na próxima requisição.\n */\nasync function isAppConnectionActive(\n  issuer: string,\n  connectionId: string,\n  clientId: string,\n  clientSecret: string,\n): Promise<boolean> {\n  try {\n    const response = await fetch(`${issuer}/connections/introspect`, {\n      method: \"POST\",\n      headers: {\n        authorization: `Basic ${Buffer.from(`${encodeURIComponent(clientId)}:${encodeURIComponent(clientSecret)}`).toString(\"base64\")}`,\n        \"content-type\": \"application/json\",\n      },\n      body: JSON.stringify({ connection_id: connectionId }),\n      cache: \"no-store\",\n    });\n    const body = (await response.json().catch(() => null)) as { active?: boolean } | null;\n    return response.ok && body?.active === true;\n  } catch {\n    return false;\n  }\n}\n\nexport async function verifyToken(\n  token: string,\n  issuer: string,\n  options: VerifyTokenOptions = {},\n): Promise<JWTPayload | null> {\n  let payload: JWTPayload;\n  try {\n    ({ payload } = await jwtVerify(token, getRemoteJWKS(issuer), {\n      algorithms: [\"RS256\"],\n      issuer,\n      // aud = issuer também passa: é o que os tokens do painel do Auth usam.\n      ...(options.audience ? { audience: [options.audience, issuer] } : {}),\n    }));\n  } catch {\n    return null;\n  }\n\n  // Token de App Connection: só vale se a conexão continua ativa agora.\n  const info = getTokenConnectionInfo(payload);\n  if (info.isAppConnection) {\n    if (!info.connectionId || !options.clientId || !options.clientSecret) return null;\n    const active = await isAppConnectionActive(issuer, info.connectionId, options.clientId, options.clientSecret);\n    if (!active) return null;\n  }\n\n  return payload;\n}\n\n// Renovações em andamento por refresh token (por processo) — ver tryRefreshTokens.\nconst inflightServerRefreshes = new Map<string, Promise<SessionTokens | null>>();\n\nexport function configureGeekappsAuth(input: GeekappsAuthConfig = {}) {\n  const clientId = resolveClientId(input);\n  const config: ResolvedGeekappsAuthConfig = {\n    ...input,\n    issuer: resolveIssuer(input),\n    clientId,\n    clientSecret: resolveClientSecret(input),\n    redirectUri: resolveConfiguredRedirectUri(input),\n    afterSignInRedirectTo:\n      input.afterSignInRedirectTo ?? input.redirectTo ?? \"/\",\n    basePath: normalizeBasePath(input.basePath),\n    cookiePrefix: deriveCookiePrefix(clientId),\n  };\n\n  const cn = getCookieNames(config.cookiePrefix);\n\n  // ── Slot helpers ──────────────────────────────────────────────────────────\n\n  async function getCount(): Promise<number> {\n    const cookieStore = await cookies();\n    const raw = cookieStore.get(cn.count)?.value;\n    const n = raw ? Number.parseInt(raw, 10) : 0;\n    return Number.isNaN(n) ? 0 : n;\n  }\n\n  async function getActiveIndex(): Promise<number> {\n    const cookieStore = await cookies();\n    const raw = cookieStore.get(cn.active)?.value;\n    if (!raw) return 0;\n    const n = Number.parseInt(raw, 10);\n    return Number.isNaN(n) ? 0 : n;\n  }\n\n  function readSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n  ): StoredAccount | null {\n    const at = cookieStore.get(cn.slotAt(n))?.value;\n    if (!at) return null;\n    const meta = decodeMeta(cookieStore.get(cn.slotMeta(n))?.value ?? \"\");\n    if (!meta) return null;\n    return {\n      id: meta.id,\n      accessToken: at,\n      refreshToken: cookieStore.get(cn.slotRt(n))?.value ?? null,\n      idToken: null, // not stored in cookies; claims are in meta\n      sessionId: meta.sid ?? null,\n      user: {\n        sub: meta.id,\n        name: meta.n ?? null,\n        email: meta.e ?? null,\n        picture: meta.p ?? null,\n      },\n    };\n  }\n\n  function writeSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n    account: StoredAccount,\n  ) {\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    cookieStore.set(cn.slotMeta(n), encodeMeta(account), opts);\n    cookieStore.set(cn.slotAt(n), account.accessToken, opts);\n    if (account.refreshToken) cookieStore.set(cn.slotRt(n), account.refreshToken, opts);\n  }\n\n  function clearSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n  ) {\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n    cookieStore.set(cn.slotMeta(n), \"\", clear);\n    cookieStore.set(cn.slotAt(n), \"\", clear);\n    cookieStore.set(cn.slotRt(n), \"\", clear);\n  }\n\n  // ── Public account helpers ─────────────────────────────────────────────────\n\n  async function getAccountsList(): Promise<StoredAccount[]> {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const accounts: StoredAccount[] = [];\n    for (let i = 1; i <= count; i++) {\n      const slot = readSlot(cookieStore, i);\n      if (slot) accounts.push(slot);\n    }\n    return accounts;\n  }\n\n  async function getActiveAccount(): Promise<StoredAccount | null> {\n    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);\n    if (count === 0) return null;\n    if (activeIdx >= 1 && activeIdx <= count) {\n      const slot = readSlot(cookieStore, activeIdx);\n      if (slot) return slot;\n    }\n    // Fall back to slot 1\n    return readSlot(cookieStore, 1);\n  }\n\n  async function getAccessToken() {\n    // Prefer the token injected by the middleware via request header (same-request refresh)\n    try {\n      const hdrs = await headers();\n      const auth = hdrs.get(\"authorization\");\n      if (auth?.startsWith(\"Bearer \")) return auth.slice(7);\n    } catch {}\n    const active = await getActiveAccount();\n    return active?.accessToken ?? null;\n  }\n\n  async function getRefreshToken() {\n    const active = await getActiveAccount();\n    return active?.refreshToken ?? null;\n  }\n\n  async function getSession(): Promise<SessionTokens | null> {\n    const active = await getActiveAccount();\n    if (!active) return null;\n    return {\n      accessToken: active.accessToken,\n      refreshToken: active.refreshToken,\n      idToken: active.idToken,\n      sessionId: active.sessionId,\n    };\n  }\n\n  async function getUser(): Promise<StoredAccount[\"user\"] | null> {\n    const active = await getActiveAccount();\n    return active?.user ?? null;\n  }\n\n  async function getUserById(userId: string, applicationId?: string): Promise<unknown | null> {\n    const qs = new URLSearchParams({ ...(applicationId ? { applicationId } : {}) });\n    try {\n      return await apiRequest<unknown>(`/users/${userId}?${qs}`);\n    } catch {\n      return null;\n    }\n  }\n\n  async function getOrganizations(): Promise<{ organizations: unknown[]; currentOrgId: string | null }> {\n    const cookieStore = await cookies();\n    const currentOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;\n    try {\n      const data = await apiRequest<unknown[] | { organizations: unknown[] }>(\"/organizations\");\n      const organizations = Array.isArray(data) ? data : (data as { organizations: unknown[] }).organizations;\n      return { organizations, currentOrgId };\n    } catch {\n      return { organizations: [], currentOrgId };\n    }\n  }\n\n  function clearPublicTokenCookie(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n  ) {\n    // Clear legacy _tp cookie if present\n    if (cookieStore.get(cn.tokenPub)?.value) {\n      cookieStore.set(cn.tokenPub, \"\", { httpOnly: false, maxAge: 0, path: \"/\" });\n    }\n  }\n\n  async function saveAccountToList(tokens: SessionTokens) {\n    const account = parseAccountFromJwt(tokens);\n    if (!account) return;\n\n    const cookieStore = await cookies();\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    const count = await getCount();\n\n    // Find existing slot for this account id\n    let targetSlot = 0;\n    for (let i = 1; i <= count; i++) {\n      const existing = readSlot(cookieStore, i);\n      if (existing?.id === account.id) {\n        targetSlot = i;\n        break;\n      }\n    }\n\n    if (targetSlot === 0) {\n      if (count >= MAX_ACCOUNTS) return;\n      targetSlot = count + 1;\n      cookieStore.set(cn.count, String(targetSlot), opts);\n    }\n\n    writeSlot(cookieStore, targetSlot, account);\n    cookieStore.set(cn.active, String(targetSlot), opts);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  // Alias for backwards compat\n  const setSessionCookies = saveAccountToList;\n\n  async function switchAccount(accountId: string): Promise<boolean> {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n\n    for (let i = 1; i <= count; i++) {\n      const slot = readSlot(cookieStore, i);\n      if (slot && (slot.id === accountId || slot.sessionId === accountId)) {\n        cookieStore.set(cn.active, String(i), opts);\n        clearPublicTokenCookie(cookieStore);\n        return true;\n      }\n    }\n    return false;\n  }\n\n  async function removeActiveAccount() {\n    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n\n    if (count === 0) return;\n\n    const remaining: StoredAccount[] = [];\n    for (let i = 1; i <= count; i++) {\n      if (i === activeIdx) continue;\n      const slot = readSlot(cookieStore, i);\n      if (slot) remaining.push(slot);\n    }\n\n    for (let i = 1; i <= count; i++) {\n      clearSlot(cookieStore, i);\n    }\n\n    if (remaining.length === 0) {\n      cookieStore.set(cn.count, \"0\", clear);\n      cookieStore.set(cn.active, \"0\", clear);\n      await clearPublicTokenCookie(cookieStore);\n      return;\n    }\n\n    // Re-compact remaining accounts into slots 1..n\n    for (let i = 0; i < remaining.length; i++) {\n      await writeSlot(cookieStore, i + 1, remaining[i]!);\n    }\n    cookieStore.set(cn.count, String(remaining.length), opts);\n    cookieStore.set(cn.active, \"1\", opts);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  async function clearAllSessionCookies() {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n    for (let i = 1; i <= count; i++) {\n      clearSlot(cookieStore, i);\n    }\n    cookieStore.set(cn.count, \"0\", clear);\n    cookieStore.set(cn.active, \"0\", clear);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  async function tryRefreshTokens(): Promise<string | null> {\n    const refreshToken = await getRefreshToken();\n    if (!refreshToken || !config.clientId) return null;\n\n    // Chamadas simultâneas com o mesmo refresh token dividem uma renovação só\n    // (ver middleware): renovar duas vezes com o mesmo token parece reuso.\n    let pending = inflightServerRefreshes.get(refreshToken);\n    if (!pending) {\n      pending = refreshWithToken(refreshToken).finally(() => {\n        setTimeout(() => inflightServerRefreshes.delete(refreshToken), 10_000);\n      });\n      inflightServerRefreshes.set(refreshToken, pending);\n    }\n    const tokens = await pending;\n    if (!tokens?.accessToken) return null;\n\n    // Em Server Component o Next não deixa gravar cookie: a renovação vale\n    // para esta requisição, e o middleware grava o par novo na próxima. O\n    // auth-server aceita a reapresentação do token antigo nesse caso.\n    try {\n      await saveAccountToList(tokens);\n    } catch {\n      // cookies() somente leitura neste contexto\n    }\n    return tokens.accessToken;\n  }\n\n  async function refreshWithToken(refreshToken: string) {\n\n    const basicAuth = Buffer.from(`${config.clientId}:${config.clientSecret ?? \"\"}`).toString(\"base64\");\n\n    const response = await fetch(createUrl(config.issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${basicAuth}`,\n      },\n      body: new URLSearchParams({\n        grant_type: \"refresh_token\",\n        refresh_token: refreshToken,\n      }),\n      cache: \"no-store\",\n    });\n\n    if (!response.ok) return null;\n\n    const data = (await response.json().catch(() => null)) as TokenLikeResponse | null;\n    if (!data) return null;\n\n    const tokens = tokenFromResponse(data);\n    return tokens.accessToken ? tokens : null;\n  }\n\n  async function apiRequest<T>(path: string, init: RequestInit = {}): Promise<T> {\n    const accessToken = await getAccessToken();\n    const requestHeaders = new Headers(init.headers);\n\n    if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n    if (init.body !== undefined && !requestHeaders.has(\"content-type\")) {\n      requestHeaders.set(\"content-type\", \"application/json\");\n    }\n\n    const url = new URL(createUrl(config.issuer, path));\n\n    const response = await fetch(url, {\n      ...init,\n      headers: requestHeaders,\n      cache: \"no-store\",\n    });\n\n    if (response.status === 401) {\n      const newAccessToken = await tryRefreshTokens();\n\n      if (!newAccessToken) {\n        // Sem renovar depois de um 401, a sessão acabou: expirou, foi revogada\n        // no painel ou o refresh token caiu. Os cookies apontam para algo que\n        // não existe mais, então saem — senão toda requisição seguinte repete\n        // o mesmo ciclo. Quem chamou recebe um erro que dá para tratar, em vez\n        // de \"Auth API error 401\" vindo do fundo da pilha.\n        await clearAllSessionCookies().catch(() => {});\n        throw new GeekappsSessionExpiredError();\n      }\n\n      if (newAccessToken) {\n        const retryHeaders = new Headers(init.headers);\n        retryHeaders.set(\"authorization\", `Bearer ${newAccessToken}`);\n        if (init.body !== undefined && !retryHeaders.has(\"content-type\")) {\n          retryHeaders.set(\"content-type\", \"application/json\");\n        }\n        const retryUrl = new URL(createUrl(config.issuer, path));\n        const retryResponse = await fetch(retryUrl, {\n          ...init,\n          headers: retryHeaders,\n          cache: \"no-store\",\n        });\n        if (!retryResponse.ok) {\n          const error = await retryResponse.json().catch(() => null);\n          throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${retryResponse.status}`);\n        }\n        if (retryResponse.status === 204) return null as T;\n        return (await retryResponse.json()) as T;\n      }\n    }\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => null);\n      throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${response.status}`);\n    }\n\n    if (response.status === 204) return null as T;\n    return (await response.json()) as T;\n  }\n\n  function createApiClient(): ServerAuthApiClient {\n    return {\n      get: (path) => apiRequest(path),\n      post: (path, body) => apiRequest(path, { method: \"POST\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      patch: (path, body) => apiRequest(path, { method: \"PATCH\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      put: (path, body) => apiRequest(path, { method: \"PUT\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      delete: (path) => apiRequest(path, { method: \"DELETE\" }),\n    };\n  }\n\n  async function requireUser(options: { redirectTo?: string } = {}) {\n    const accessToken = await getAccessToken();\n    if (!accessToken) {\n      redirect(options.redirectTo ?? \"/\");\n    }\n    return accessToken;\n  }\n\n  function escapeHtml(str: string): string {\n    return str.replace(/&/g, \"&amp;\").replace(/</g, \"&lt;\").replace(/>/g, \"&gt;\").replace(/\"/g, \"&quot;\");\n  }\n\n  function sanitizeRedirectTo(value: string | null | undefined): string {\n    const raw = value ?? \"/\";\n    // Never redirect back into the auth basePath — that would loop or replay a stale code.\n    if (raw.startsWith(config.basePath)) return \"/\";\n    // Only allow relative paths to prevent open-redirect.\n    if (raw.startsWith(\"/\") && !raw.startsWith(\"//\")) return raw;\n    return \"/\";\n  }\n\n  async function createAuthorizeRedirect(request: NextRequest, mode: \"login\" | \"register\" | \"add-account\" | \"google\") {\n    const redirectTo = sanitizeRedirectTo(request.nextUrl.searchParams.get(\"redirectTo\") ?? config.afterSignInRedirectTo);\n    const flowId = request.nextUrl.searchParams.get(\"flow_id\");\n    const url = new URL(createUrl(config.issuer, mode === \"google\" ? \"/auth/google\" : \"/authorize\"));\n\n    if (!config.clientId) {\n      return NextResponse.json(\n        { error: \"missing_client_id\", message: \"Missing GEEKAPPS_AUTH_CLIENT_ID or clientId.\" },\n        { status: 500 },\n      );\n    }\n\n    url.searchParams.set(\"client_id\", config.clientId);\n    url.searchParams.set(\"redirect_uri\", resolveRedirectUri(config, request));\n    url.searchParams.set(\"response_type\", \"code\");\n    const scopes = config.scopes ?? [\"openid\", \"profile\", \"email\"];\n    if (!scopes.includes(\"offline_access\")) scopes.push(\"offline_access\");\n    url.searchParams.set(\"scope\", scopes.join(\" \"));\n    url.searchParams.set(\"state\", Buffer.from(JSON.stringify({ redirectTo, mode })).toString(\"base64url\"));\n    if (mode === \"register\") url.searchParams.set(\"screen_hint\", \"signup\");\n    if (mode === \"add-account\") {\n      // Adding an account always needs a fresh login, regardless of any existing session.\n      url.searchParams.set(\"prompt\", \"login\");\n    } else {\n      // `prompt` (login | select_account | none | consent) is forwarded as-is to\n      // the IDP — see OidcPrompt in client.tsx for what each value does.\n      const prompt = request.nextUrl.searchParams.get(\"prompt\");\n      // Legacy fallback: silentLogin=false is equivalent to prompt=login.\n      const silentLogin = request.nextUrl.searchParams.get(\"silentLogin\");\n      const resolvedPrompt = prompt ?? (silentLogin === \"false\" ? \"login\" : null);\n      if (resolvedPrompt) url.searchParams.set(\"prompt\", resolvedPrompt);\n    }\n    if (flowId) url.searchParams.set(\"flow_id\", flowId);\n\n    const codeVerifier = generateCodeVerifier();\n    url.searchParams.set(\"code_challenge\", createCodeChallenge(codeVerifier));\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n    const response = NextResponse.redirect(url);\n    const cn = getCookieNames(config.cookiePrefix);\n    response.cookies.set(cn.pkceVerifier, codeVerifier, {\n      ...getCookieOptions(config),\n      maxAge: 60 * 10,\n    });\n    return response;\n  }\n\n  async function exchangeCode(request: NextRequest) {\n    const code = request.nextUrl.searchParams.get(\"code\");\n    const state = request.nextUrl.searchParams.get(\"state\");\n\n    const origin = requestOrigin(request);\n\n    if (!code) {\n      const err = request.nextUrl.searchParams.get(\"error\") ?? \"missing_code\";\n      const desc = request.nextUrl.searchParams.get(\"error_description\") ?? request.nextUrl.searchParams.get(\"error_message\") ?? \"No authorization code received\";\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=${encodeURIComponent(err)}&error_description=${encodeURIComponent(desc)}${state ? `&state=${encodeURIComponent(state)}` : \"\"}`, origin));\n    }\n\n    if (!config.clientId) {\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=missing_client_id&error_description=Auth+client+is+not+configured`, origin));\n    }\n\n    const basicAuth = Buffer.from(\n      `${config.clientId}:${config.clientSecret ?? \"\"}`,\n    ).toString(\"base64\");\n\n    const cn = getCookieNames(config.cookiePrefix);\n    const cookieStore = await cookies();\n    const codeVerifier = cookieStore.get(cn.pkceVerifier)?.value;\n    cookieStore.set(cn.pkceVerifier, \"\", { ...getCookieOptions(config), maxAge: 0 });\n\n    const tokenBody = new URLSearchParams({\n      grant_type: \"authorization_code\",\n      code,\n      redirect_uri: resolveRedirectUri(config, request),\n    });\n    if (codeVerifier) tokenBody.set(\"code_verifier\", codeVerifier);\n\n    const response = await fetch(createUrl(config.issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${basicAuth}`,\n      },\n      body: tokenBody,\n      cache: \"no-store\",\n    });\n\n    const data = (await response.json().catch(() => ({}))) as TokenLikeResponse & { error?: string; error_description?: string };\n    if (!response.ok) {\n      const error = encodeURIComponent((data.error as string | undefined) ?? \"token_exchange_failed\");\n      const desc = encodeURIComponent((data.error_description as string | undefined) ?? `Token exchange failed with status ${response.status}`);\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=${error}&error_description=${desc}`, origin));\n    }\n\n    await saveAccountToList(tokenFromResponse(data));\n\n    let redirectTo = sanitizeRedirectTo(config.afterSignInRedirectTo);\n    if (state) {\n      try {\n        const parsed = JSON.parse(Buffer.from(state, \"base64url\").toString(\"utf8\")) as { redirectTo?: string };\n        redirectTo = sanitizeRedirectTo(parsed.redirectTo);\n      } catch {\n        // ignore malformed state\n      }\n    }\n\n    return NextResponse.redirect(new URL(redirectTo, origin));\n  }\n\n  function mapLocalPathToApiPath(route: string) {\n    if (route === \"/me\") return \"/auth/me\";\n    if (route === \"/accounts/switch\") return \"/auth/accounts/switch\";\n    if (route === \"/organizations/active\") return \"/auth/organizations/active\";\n    if (route === \"/permissions/check\") return \"/permissions/check\";\n    if (route === \"/login/password\") return \"/auth/login\";\n    if (route === \"/register/password\") return \"/auth/register\";\n    if (route === \"/passwordless/link\") return \"/auth/passwordless/request\";\n    return route;\n  }\n\n  async function handleAccountsLocal(): Promise<NextResponse> {\n    const [accounts, activeIdx] = await Promise.all([getAccountsList(), getActiveIndex()]);\n\n    return NextResponse.json({\n      accounts: accounts.map((a, i) => ({\n        id: a.id,\n        sessionId: a.sessionId ?? a.id,\n        isActive: i + 1 === activeIdx,\n        user: {\n          id: a.user.sub,\n          name: a.user.name ?? null,\n          email: a.user.email ?? null,\n          imageUrl: a.user.picture ?? null,\n          phone: a.user.phone ?? null,\n        },\n      })),\n    });\n  }\n\n  async function handleOrganizationsLocal(): Promise<NextResponse> {\n    const cookieStore = await cookies();\n    const activeOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;\n    try {\n      const data = await apiRequest<unknown[]|{ organizations: unknown[] }>(\"/organizations\");\n      const organizations = Array.isArray(data) ? data : (data as { organizations: unknown[] }).organizations;\n      return NextResponse.json({ organizations, currentOrgId: activeOrgId });\n    } catch {\n      return NextResponse.json({ organizations: [], currentOrgId: activeOrgId });\n    }\n  }\n\n  async function handleSwitchAccountLocal(request: NextRequest): Promise<NextResponse> {\n    const body = await readBody(request);\n    const targetId =\n      body && typeof body === \"object\"\n        ? String(\n            (body as Record<string, unknown>).accountId ??\n            (body as Record<string, unknown>).sessionId ??\n            \"\",\n          )\n        : \"\";\n\n    if (!targetId) {\n      return NextResponse.json({ error: \"accountId required\" }, { status: 400 });\n    }\n\n    const switched = await switchAccount(targetId);\n    if (!switched) {\n      return NextResponse.json({ error: \"Account not found\" }, { status: 404 });\n    }\n\n    return NextResponse.json({ ok: true });\n  }\n\n  async function proxy(request: NextRequest, route: string) {\n    const accessToken = await getAccessToken();\n    const body = [\"GET\", \"HEAD\"].includes(request.method) ? undefined : await readBody(request);\n    const url = new URL(appendSearchParams(createUrl(config.issuer, mapLocalPathToApiPath(route)), request));\n    const requestHeaders = new Headers();\n\n    if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n    if (body !== undefined) requestHeaders.set(\"content-type\", \"application/json\");\n\n    let response = await fetch(url, {\n      method: request.method,\n      headers: requestHeaders,\n      body: body === undefined ? undefined : typeof body === \"string\" ? body : JSON.stringify(body),\n      cache: \"no-store\",\n    });\n\n    if (response.status === 401) {\n      // Mesmo tratamento do apiRequest: tenta renovar uma vez e, se a sessão\n      // já não existe (expirada ou revogada no painel), limpa os cookies. Sem\n      // isso o cliente repetiria o mesmo token morto a cada chamada.\n      const refreshed = await tryRefreshTokens();\n\n      if (refreshed) {\n        requestHeaders.set(\"authorization\", `Bearer ${refreshed}`);\n        response = await fetch(url, {\n          method: request.method,\n          headers: requestHeaders,\n          body:\n            body === undefined\n              ? undefined\n              : typeof body === \"string\"\n                ? body\n                : JSON.stringify(body),\n          cache: \"no-store\",\n        });\n      } else {\n        await clearAllSessionCookies().catch(() => {});\n        return NextResponse.json(\n          { error: \"session_expired\" },\n          { status: 401 },\n        );\n      }\n    }\n\n    const data = isJsonResponse(response) ? ((await response.json().catch(() => null)) as TokenLikeResponse | null) : null;\n    if (data) {\n      const tokens = tokenFromResponse(data);\n      if (tokens.accessToken || tokens.refreshToken || tokens.idToken || tokens.sessionId) {\n        await saveAccountToList(tokens);\n      }\n      return NextResponse.json(data, { status: response.status });\n    }\n\n    return responseFromApi(response);\n  }\n\n  async function handle(request: NextRequest) {\n    const route = routeFromRequest(request, config.basePath);\n\n    if (request.method === \"GET\" && route === \"/sign-in\") return createAuthorizeRedirect(request, \"login\");\n    if (request.method === \"GET\" && route === \"/sign-up\") return createAuthorizeRedirect(request, \"register\");\n    if (request.method === \"GET\" && route === \"/add-account\") return createAuthorizeRedirect(request, \"add-account\");\n    if (request.method === \"GET\" && route === \"/login/google\") return createAuthorizeRedirect(request, \"google\");\n    if (request.method === \"GET\" && route === \"/callback\") {\n      const callbackError = parseAuthCallbackError(request.nextUrl.searchParams);\n      if (callbackError) {\n        const custom = await config.onCallbackError?.(callbackError, request);\n        if (custom) return custom;\n        const error = callbackError.error;\n        const description = callbackError.description;\n        return new NextResponse(\n          `<!doctype html><html><head><meta charset=\"utf-8\"><title>Authentication Error</title></head><body style=\"font-family:sans-serif;max-width:480px;margin:80px auto;padding:0 16px\"><h2>Authentication Error</h2><p><strong>${escapeHtml(error)}</strong></p><p>${escapeHtml(description)}</p><a href=\"/\">Go back</a></body></html>`,\n          { status: 400, headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n        );\n      }\n      return exchangeCode(request);\n    }\n    if (request.method === \"GET\" && route === \"/token\") {\n      const accessToken = await getAccessToken();\n      if (!accessToken) return NextResponse.json({ error: \"missing_token\" }, { status: 401 });\n      return NextResponse.json({ accessToken });\n    }\n\n\n    if (request.method === \"GET\" && route === \"/accounts\") return handleAccountsLocal();\n    if (request.method === \"POST\" && route === \"/accounts/switch\") return handleSwitchAccountLocal(request);\n    if (request.method === \"GET\" && route === \"/organizations\") return handleOrganizationsLocal();\n\n    if (request.method === \"POST\" && route === \"/organizations\") {\n      const accessToken = await getAccessToken();\n      const body = (await readBody(request)) as Record<string, unknown> | undefined;\n      if (body && accessToken && !body.applicationId) {\n        const claims = decodeJwtPayload(accessToken);\n        const applicationId =\n          (typeof claims?.application_id === \"string\" ? claims.application_id : null) ??\n          (typeof claims?.client_id === \"string\" ? claims.client_id : null) ??\n          (typeof claims?.applicationId === \"string\" ? claims.applicationId : null);\n        if (applicationId) body.applicationId = applicationId;\n      }\n      const orgUrl = new URL(createUrl(config.issuer, \"/organizations\"));\n      const requestHeaders = new Headers();\n      if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n      if (body !== undefined) requestHeaders.set(\"content-type\", \"application/json\");\n      const response = await fetch(orgUrl, {\n        method: \"POST\",\n        headers: requestHeaders,\n        body: JSON.stringify(body),\n        cache: \"no-store\",\n      });\n      return responseFromApi(response);\n    }\n\n    if (request.method === \"POST\" && route === \"/sign-out\") {\n      await apiRequest(\"/auth/sign-out\", { method: \"POST\" }).catch(() => null);\n      await removeActiveAccount();\n      return NextResponse.json({ ok: true });\n    }\n\n    if (request.method === \"POST\" && route === \"/sign-out-all\") {\n      await apiRequest(\"/auth/sign-out-all\", { method: \"POST\" }).catch(() => null);\n      await clearAllSessionCookies();\n      return NextResponse.json({ ok: true });\n    }\n\n    if (request.method === \"POST\" && route === \"/organizations/active\") {\n      const body = await readBody(request);\n      const organizationId =\n        body && typeof body === \"object\" && \"organizationId\" in body\n          ? (body as Record<string, unknown>).organizationId\n          : null;\n      const response = NextResponse.json({ ok: true });\n      if (typeof organizationId === \"string\") {\n        const cookieOpts = {\n          httpOnly: true,\n          sameSite: \"lax\" as const,\n          path: \"/\",\n          secure: process.env.NODE_ENV === \"production\",\n          maxAge: 60 * 60 * 24 * 7,\n        };\n        response.cookies.set(cn.activeOrganizationId, organizationId, cookieOpts);\n      }\n      return response;\n    }\n\n    return proxy(request, route);\n  }\n\n  return {\n    handlers: {\n      GET: handle,\n      POST: handle,\n      PATCH: handle,\n      DELETE: handle,\n    },\n    GetSession: getSession,\n    GetUser: getUser,\n    GetUserById: getUserById,\n    GetOrganizations: getOrganizations,\n    SaveSession: saveAccountToList,\n    GetAccessToken: getAccessToken,\n    GetRefreshToken: getRefreshToken,\n    IsAuthenticated: async () => (await getAccessToken()) !== null,\n    TryRefreshTokens: tryRefreshTokens,\n    RequireUser: requireUser,\n    CreateAuthApiClient: createApiClient,\n    cookiePrefix: config.cookiePrefix,\n    VerifyToken: (token: string) =>\n      verifyToken(token, config.issuer, {\n        audience: config.clientId || undefined,\n        clientId: config.clientId || undefined,\n        clientSecret: config.clientSecret,\n      }),\n    GetTokenConnectionInfo: getTokenConnectionInfo,\n    SignInUrl: async (redirectTo?: string) => {\n      const configured = env(\"GEEKAPPS_APP_URL\");\n      if (!configured) throw new Error(\"Cannot determine app origin. Set GEEKAPPS_APP_URL.\");\n      const origin = configured.replace(/\\/$/, \"\");\n      const url = new URL(`${origin}${config.basePath}/sign-in`);\n      if (redirectTo) url.searchParams.set(\"redirectTo\", redirectTo);\n      return url.toString();\n    },\n  };\n}\n\nexport function handlers(options?: GeekappsAuthConfig) {\n  return configureGeekappsAuth(options).handlers;\n}\n\n/**\n * Returns true if the current request has a valid access token in cookies.\n * Safe to call in Server Components, Server Actions, and Route Handlers.\n */\nexport async function isAuthenticated(options?: GeekappsAuthConfig): Promise<boolean> {\n  const { GetAccessToken } = configureGeekappsAuth(options);\n  return (await GetAccessToken()) !== null;\n}\n"],"mappings":";;;AAEA,SAAS,WAAAA,UAAS,WAAAC,gBAAe;;;ACFjC,SAAS,YAAY,mBAAmB;AACxC,SAAS,SAAS,eAAe;AACjC,SAAS,gBAAgB;AACzB,SAAS,oBAAsC;AAC/C,SAAS,oBAAoB,iBAAkC;AAoBxD,IAAM,2BAA2B;;;ADLxC,SAAS,IAAI,MAAc;AACzB,QAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,SAAO,SAAS,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AACpD;AAEA,SAAS,iBAAiB,KAAa;AACrC,SAAO,IAAI,QAAQ,OAAO,EAAE;AAC9B;AAEA,SAAS,gBAAgB;AACvB,SAAO;AAAA;AAAA,IAEL,IAAI,sBAAsB,KAAK,IAAI,uBAAuB,KAAK;AAAA,EACjE;AACF;AAGA,SAAS,aAAa,UAA0B;AAC9C,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,SAAM,KAAK,KAAK,IAAM,SAAS,WAAW,CAAC,IAAI;AAC/C,QAAI,MAAM;AAAA,EACZ;AACA,SAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACvC;AAEA,SAAS,qBAA6B;AACpC,QAAM,WAAW,IAAI,yBAAyB,KAAK;AACnD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,MAAM,aAAa,QAAQ,CAAC;AACrC;AAIA,SAAS,WAAW,OAAgC;AAClD,MAAI;AACF,UAAM,IAAI,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM,CAAC;AACrE,WAAO,EAAE,KAAK,IAAI;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB;AAC9B,QAAM,SAAS,mBAAmB;AAClC,SAAO;AAAA,IACL,QAAQ,GAAG,MAAM;AAAA,IACjB,OAAO,GAAG,MAAM;AAAA,IAChB,sBAAsB,GAAG,MAAM;AAAA,IAC/B,UAAU,CAAC,MAAc,GAAG,MAAM,KAAK,CAAC;AAAA,IACxC,QAAQ,CAAC,MAAc,GAAG,MAAM,MAAM,CAAC;AAAA,IACvC,QAAQ,CAAC,MAAc,GAAG,MAAM,MAAM,CAAC;AAAA,EACzC;AACF;AAEA,eAAe,uBAA+C;AAE5D,MAAI;AACF,UAAM,OAAO,MAAMC,SAAQ;AAC3B,UAAM,OAAO,KAAK,IAAI,eAAe;AACrC,QAAI,MAAM,WAAW,SAAS,EAAG,QAAO,KAAK,MAAM,CAAC;AAAA,EACtD,QAAQ;AAAA,EAAC;AACT,QAAM,cAAc,MAAMC,SAAQ;AAClC,QAAM,KAAK,MAAM,eAAe;AAChC,QAAM,MAAM,YAAY,IAAI,GAAG,MAAM,GAAG;AACxC,QAAM,YAAY,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AACnD,QAAM,WAAW,YAAY,IAAI,GAAG,KAAK,GAAG;AAC5C,QAAM,QAAQ,WAAW,OAAO,SAAS,UAAU,EAAE,IAAI;AACzD,MAAI,UAAU,EAAG,QAAO;AACxB,QAAM,MAAM,aAAa,KAAK,aAAa,QAAQ,YAAY;AAC/D,SAAO,YAAY,IAAI,GAAG,OAAO,GAAG,CAAC,GAAG,SAAS;AACnD;AAEA,eAAe,wBAAgD;AAC7D,QAAM,cAAc,MAAMA,SAAQ;AAClC,QAAM,KAAK,MAAM,eAAe;AAChC,QAAM,MAAM,YAAY,IAAI,GAAG,MAAM,GAAG;AACxC,QAAM,YAAY,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AACnD,QAAM,WAAW,YAAY,IAAI,GAAG,KAAK,GAAG;AAC5C,QAAM,QAAQ,WAAW,OAAO,SAAS,UAAU,EAAE,IAAI;AACzD,MAAI,UAAU,EAAG,QAAO;AACxB,QAAM,MAAM,aAAa,KAAK,aAAa,QAAQ,YAAY;AAC/D,SAAO,YAAY,IAAI,GAAG,OAAO,GAAG,CAAC,GAAG,SAAS;AACnD;AAEA,eAAe,uBAA+C;AAC5D,QAAM,eAAe,MAAM,sBAAsB;AACjD,QAAM,WAAW,IAAI,yBAAyB,KAAK;AACnD,QAAM,eAAe,IAAI,6BAA6B,KAAK;AAC3D,MAAI,CAAC,gBAAgB,CAAC,SAAU,QAAO;AAEvC,QAAM,YAAY,OAAO,KAAK,GAAG,QAAQ,IAAI,YAAY,EAAE,EAAE,SAAS,QAAQ;AAC9E,QAAM,WAAW,MAAM,MAAM,GAAG,cAAc,CAAC,eAAe;AAAA,IAC5D,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,eAAe,SAAS,SAAS;AAAA,IACnC;AAAA,IACA,MAAM,IAAI,gBAAgB,EAAE,YAAY,iBAAiB,eAAe,aAAa,CAAC;AAAA,IACtF,OAAO;AAAA,EACT,CAAC;AAED,MAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,QAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACnD,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,iBACH,KAAK,eAAe,KAAK;AAC5B,QAAM,kBACH,KAAK,gBAAgB,KAAK;AAE7B,MAAI,CAAC,eAAgB,QAAO;AAG5B,QAAM,cAAc,MAAMA,SAAQ;AAClC,QAAM,KAAK,MAAM,eAAe;AAChC,QAAM,MAAM,YAAY,IAAI,GAAG,MAAM,GAAG;AACxC,QAAM,YAAY,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AACnD,QAAM,OAAO;AAAA,IACX,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,KAAK,KAAK,KAAK;AAAA,EACzB;AACA,cAAY,IAAI,GAAG,OAAO,SAAS,GAAG,gBAAgB,IAAI;AAC1D,MAAI,gBAAiB,aAAY,IAAI,GAAG,OAAO,SAAS,GAAG,iBAAiB,IAAI;AAEhF,cAAY,IAAI,GAAG,mBAAmB,CAAC,OAAO,gBAAgB;AAAA,IAC5D,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,KAAK,KAAK,KAAK;AAAA,EACzB,CAAC;AAED,SAAO;AACT;AAEA,eAAe,UAAa,MAAc,OAA4C,CAAC,GAAe;AACpG,MAAI,cAAc,MAAM,qBAAqB;AAC7C,MAAI,CAAC,YAAa,OAAM,IAAI,MAAM,mBAAmB;AAErD,QAAM,SAAS,cAAc;AAC7B,QAAM,UAAU,CAAC,UACf,MAAM,GAAG,MAAM,GAAG,IAAI,IAAI;AAAA,IACxB,QAAQ,KAAK,UAAU;AAAA,IACvB,SAAS;AAAA,MACP,eAAe,UAAU,KAAK;AAAA,MAC9B,GAAI,KAAK,SAAS,SAAY,EAAE,gBAAgB,mBAAmB,IAAI,CAAC;AAAA,IAC1E;AAAA,IACA,MAAM,KAAK,SAAS,SAAY,SAAY,KAAK,UAAU,KAAK,IAAI;AAAA,IACpE,OAAO;AAAA,EACT,CAAC;AAEH,MAAI,WAAW,MAAM,QAAQ,WAAW;AAExC,MAAI,SAAS,WAAW,KAAK;AAC3B,UAAM,WAAW,MAAM,qBAAqB;AAC5C,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,iBAAiB;AAChD,eAAW,MAAM,QAAQ,QAAQ;AAAA,EACnC;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAM,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AAClD,UAAM,IAAI,MAAO,KAAK,qBAAqB,KAAK,SAAS,KAAK,WAAW,cAAc,SAAS,MAAM,EAAa;AAAA,EACrH;AAEA,MAAI,SAAS,WAAW,IAAK,QAAO;AACpC,SAAO,SAAS,KAAK;AACvB;AAIA,eAAsB,QAAwC;AAC5D,MAAI;AACF,UAAM,OAAO,MAAM,UAA+C,UAAU;AAC5E,QAAI,CAAC,KAAM,QAAO,EAAE,MAAM,KAAK;AAC/B,QAAI,OAAO,SAAS,YAAY,UAAU,KAAM,QAAO;AACvD,WAAO,EAAE,MAAM,KAAoB;AAAA,EACrC,QAAQ;AACN,WAAO,EAAE,MAAM,KAAK;AAAA,EACtB;AACF;AAEA,eAAsB,cAAyD;AAC7E,QAAM,cAAc,MAAMA,SAAQ;AAClC,QAAM,KAAK,MAAM,eAAe;AAChC,QAAM,WAAW,YAAY,IAAI,GAAG,KAAK,GAAG;AAC5C,QAAM,QAAQ,WAAW,OAAO,SAAS,UAAU,EAAE,IAAI;AACzD,QAAM,YAAY,YAAY,IAAI,GAAG,MAAM,GAAG;AAC9C,QAAM,YAAY,YAAY,OAAO,SAAS,WAAW,EAAE,IAAI;AAE/D,QAAM,WAA+B,CAAC;AACtC,WAAS,IAAI,GAAG,KAAK,OAAO,KAAK;AAC/B,UAAM,KAAK,YAAY,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG;AAC1C,QAAI,CAAC,GAAI;AACT,UAAM,OAAO,WAAW,YAAY,IAAI,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,EAAE;AACpE,QAAI,CAAC,KAAM;AACX,aAAS,KAAK;AAAA,MACZ,IAAI,KAAK;AAAA,MACT,WAAW,KAAK,OAAO,KAAK;AAAA,MAC5B,UAAU,MAAM;AAAA,MAChB,MAAM;AAAA,QACJ,IAAI,KAAK;AAAA,QACT,MAAM,KAAK,KAAK;AAAA,QAChB,OAAO,KAAK,KAAK;AAAA,QACjB,UAAU,KAAK,KAAK;AAAA,QACpB,OAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,SAAS;AACpB;AAEA,eAAsB,mBAA6F;AACjH,MAAI;AACF,UAAM,cAAc,MAAMA,SAAQ;AAClC,UAAM,KAAK,MAAM,eAAe;AAChC,UAAM,cAAc,YAAY,IAAI,GAAG,oBAAoB,GAAG,SAAS;AACvE,UAAM,OAAO,MAAM,UAA8D,gBAAgB;AACjG,UAAM,gBAAgB,MAAM,QAAQ,IAAI,IAAI,OAAQ,KAA2C;AAC/F,UAAM,gBAAgB,eAAe,cAAc,CAAC,GAAG,MAAM;AAC7D,WAAO,EAAE,eAAe,cAAc,cAAc;AAAA,EACtD,SAAS,KAAK;AAEZ,YAAQ,MAAM,6BAA6B,eAAe,QAAQ,IAAI,UAAU,eAAe;AAC/F,WAAO,EAAE,eAAe,CAAC,EAAE;AAAA,EAC7B;AACF;AAIA,eAAsB,aACpB,eACA,UAAuD,CAAC,GACjC;AACvB,QAAM,KAAK,IAAI,gBAAgB;AAC/B,MAAI,QAAQ,OAAQ,IAAG,IAAI,UAAU,QAAQ,MAAM;AACnD,MAAI,QAAQ,MAAO,IAAG,IAAI,SAAS,OAAO,QAAQ,KAAK,CAAC;AACxD,QAAM,SAAS,GAAG,OAAO,IAAI,EAAE,KAAK;AACpC,SAAO,UAAwB,iBAAiB,mBAAmB,aAAa,CAAC,YAAY,MAAM,EAAE;AACvG;AAEA,eAAsB,gBACpB,eACA,OAC4C;AAC5C,SAAO,UAAU,iBAAiB,mBAAmB,aAAa,CAAC,qBAAqB;AAAA,IACtF,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AACH;AAEA,eAAsB,oBAAoB,eAAuB,SAAgC;AAC/F,QAAM;AAAA,IACJ,iBAAiB,mBAAmB,aAAa,CAAC,aAAa,mBAAmB,OAAO,CAAC;AAAA,IAC1F,EAAE,QAAQ,SAAS;AAAA,EACrB;AACF;AAEA,eAAsB,mBAAmB,OAAmE;AAC1G,SAAO,UAAU,oCAAoC,EAAE,QAAQ,QAAQ,MAAM,MAAM,CAAC;AACtF;AAEA,eAAsB,8BACpB,gBACA,eACqC;AACrC,QAAM,KAAK,IAAI,gBAAgB,EAAE,gBAAgB,cAAc,CAAC;AAChE,SAAO,UAAU,oCAAoC,EAAE,EAAE;AAC3D;AAEA,eAAsB,kBACpB,eACA,OACuC;AACvC,SAAO,UAAU,iBAAiB,mBAAmB,aAAa,CAAC,IAAI,EAAE,QAAQ,SAAS,MAAM,MAAM,CAAC;AACzG;","names":["cookies","headers","headers","cookies"]}

package/dist/client.d.ts

@@ -11,6 +11,11 @@ declare class GeekappsSessionExpiredError extends Error {
 type UserStatus = "active" | "inactive" | "suspended";
 type OrganizationStatus = "active" | "inactive" | "suspended";
 type OAuthClientType = "public" | "confidential";
+/**
+ * Códigos de erro conhecidos devolvidos pelo auth-server. A lista é aberta
+ * (`string & {}`): códigos novos continuam tipados como string.
+ */
+type AuthErrorCode = "waitlist_required" | "waitlist_disabled" | "password_reset_required" | "account_locked" | "invalid_credentials" | "not_found" | "invalid_request" | "interaction_required" | (string & {});
 type AuthResult<T = unknown> = {
     success: true;
     data: T;
@@ -18,8 +23,10 @@ type AuthResult<T = unknown> = {
     success: false;
     error: string;
     status?: number;
-    /** Código de erro da API (ex.: "legal_fields_required", "invalid_tax_id"). */
-    code?: string;
+    /** Código de erro da API (ex.: "waitlist_required", "account_locked", "legal_fields_required"). */
+    code?: AuthErrorCode;
+    /** Segundos até poder tentar de novo (`account_locked`). */
+    retryAfter?: number;
     /** Campos obrigatórios que faltaram (ex.: "legalName", "legalAddress.city"). */
     missingFields?: string[];
 };
@@ -28,7 +35,8 @@ declare class GeekappsApiError extends Error {
     readonly status: number;
     readonly code?: string | undefined;
     readonly missingFields?: string[] | undefined;
-    constructor(message: string, status: number, code?: string | undefined, missingFields?: string[] | undefined);
+    readonly retryAfter?: number | undefined;
+    constructor(message: string, status: number, code?: string | undefined, missingFields?: string[] | undefined, retryAfter?: number | undefined);
 }
 /** standard: organização comum. legal: pessoa jurídica associada a um Tax ID (CNPJ ou genérico). */
 type OrganizationType = "standard" | "legal";
@@ -296,7 +304,52 @@ type OrganizationJoinRequest = {
     createdAt: string | Date;
     updatedAt: string | Date;
 };
+type WaitlistEntry = {
+    id: string;
+    email: string;
+    name: string | null;
+    status: WaitlistStatus;
+    position: number | null;
+    createdAt: string;
+    approvedAt: string | null;
+};
+type WaitlistList = {
+    waiting: number;
+    entries: WaitlistEntry[];
+};
+type ForcePasswordResetInput = {
+    organizationId: string;
+    applicationId: string;
+    userIds?: string[];
+    all?: boolean;
+};
+type ForcePasswordResetResult = {
+    ok: boolean;
+    scheduled: number;
+    alreadyPending: number;
+    skipped: number;
+    estimatedMinutes: number;
+    batchSize: number;
+    intervalSeconds: number;
+};
+type ForcePasswordResetProgress = {
+    pending: number;
+    done: number;
+    failed: number;
+    batchSize: number;
+    intervalSeconds: number;
+};
+/** Campos graváveis de uma Application via PATCH /applications/:id. */
+type ApplicationUpdateInput = {
+    name?: string;
+    description?: string | null;
+    imageUrl?: string | null;
+    /** Só e-mails aprovados na lista de espera podem se cadastrar. */
+    waitlistEnabled?: boolean;
+    [key: string]: unknown;
+};
 type OrganizationOwnedApplication = {
+    waitlistEnabled?: boolean;
     id: string;
     name: string;
     description: string | null;
@@ -506,6 +559,7 @@ declare function registerWithPassword(params: {
     imageUrl?: string;
     address?: Record<string, unknown>;
     password: string;
+    authorizationFlowId?: string;
     redirectTo?: string;
 }, options?: ClientActionOptions): Promise<AuthResult<RegisterResponse>>;
 declare function startGoogleLogin(params?: CallbackUrlOptions, options?: ClientActionOptions): void;
@@ -515,6 +569,22 @@ declare function requestPasswordlessLink(params: {
     redirectTo?: string;
     callbackUrl?: string;
 }, options?: ClientActionOptions): Promise<AuthResult>;
+type WaitlistStatus = "waiting" | "approved" | "joined";
+type JoinWaitlistParams = {
+    clientId: string;
+    email: string;
+    name?: string;
+};
+type JoinWaitlistResponse = {
+    ok: true;
+    status: WaitlistStatus;
+    position: number | null;
+};
+/**
+ * Entra na lista de espera de uma app com `waitlistEnabled`.
+ * Erros: code "not_found" (404) ou "waitlist_disabled" (409).
+ */
+declare function joinWaitlist(params: JoinWaitlistParams, options?: ClientActionOptions): Promise<AuthResult<JoinWaitlistResponse>>;
 type GeekappsAuthContextValue = {
     basePath: string;
     user: User | null;
@@ -553,6 +623,7 @@ type GeekappsAuthContextValue = {
         redirectTo?: string;
     }) => Promise<AuthResult<RegisterResponse>>;
     startGoogleLogin: (params?: CallbackUrlOptions) => void;
+    joinWaitlist: (params: JoinWaitlistParams) => Promise<AuthResult<JoinWaitlistResponse>>;
     requestPasswordlessLink: (params: {
         email: string;
         authorizationFlowId?: string;
@@ -736,4 +807,4 @@ type UseServiceAccountResult = {
 };
 declare function useServiceAccount(): UseServiceAccountResult;
 
-export { type AcceptInviteResult, type AddMemberInput, type AuthResult, type CallbackUrlOptions, type ConnectedAccount, type CreateServiceAccountInput, GeekappsApiError, type GeekappsAuthContextValue, GeekappsAuthProvider, type GeekappsAuthProviderProps, GeekappsSessionExpiredError, type JoinRequestStatus, type LoginResponse, type MemberInviteInput, type MemberRole, type MyOrganizationInvite, type OAuthClientType, type OidcPrompt, type Organization, type OrganizationInput, type OrganizationInvite, type OrganizationInvitePreview, type OrganizationJoinRequest, type OrganizationLegalAddress, type OrganizationLegalData, type OrganizationMember, type OrganizationMembership, type OrganizationOwnedApplication, type OrganizationStatus, type OrganizationType, type OrganizationUpdateInput, type Permission, type PermissionCheckOptions, type PermissionInput, type PermissionUpdateInput, type PublicOrganization, type RegisterResponse, type Role, type RoleAssignment, type RoleInput, type RolePermission, type RoleUpdateInput, type ServiceAccount, type ServiceAccountWithSecret, type SessionApplication, type SignInInput, type SignInOptions, type TaxIdLookupResult, type TaxIdType, type UpdateMemberInput, type UpdateMemberRoleInput, type UseAccountsResult, type UseInvitesResult, type UseJoinRequestsResult, type UseMembersResult, type UseOrgResult, type UsePermissionsResult, type UsePublicOrganizationsResult, type UseRolesResult, type UseServiceAccountResult, type UseSessionsResult, type UseUsersResult, type User, type UserInput, type UserSession, type UserStatus, loginWithPassword, registerWithPassword, requestPasswordlessLink, startGoogleLogin, useAccounts, useAuth, useInvites, useJoinRequests, useMembers, useOrg, usePermissions, usePublicOrganizations, useRoles, useServiceAccount, useSessions, useUsers };
+export { type AcceptInviteResult, type AddMemberInput, type ApplicationUpdateInput, type AuthErrorCode, type AuthResult, type CallbackUrlOptions, type ConnectedAccount, type CreateServiceAccountInput, type ForcePasswordResetInput, type ForcePasswordResetProgress, type ForcePasswordResetResult, GeekappsApiError, type GeekappsAuthContextValue, GeekappsAuthProvider, type GeekappsAuthProviderProps, GeekappsSessionExpiredError, type JoinRequestStatus, type JoinWaitlistParams, type JoinWaitlistResponse, type LoginResponse, type MemberInviteInput, type MemberRole, type MyOrganizationInvite, type OAuthClientType, type OidcPrompt, type Organization, type OrganizationInput, type OrganizationInvite, type OrganizationInvitePreview, type OrganizationJoinRequest, type OrganizationLegalAddress, type OrganizationLegalData, type OrganizationMember, type OrganizationMembership, type OrganizationOwnedApplication, type OrganizationStatus, type OrganizationType, type OrganizationUpdateInput, type Permission, type PermissionCheckOptions, type PermissionInput, type PermissionUpdateInput, type PublicOrganization, type RegisterResponse, type Role, type RoleAssignment, type RoleInput, type RolePermission, type RoleUpdateInput, type ServiceAccount, type ServiceAccountWithSecret, type SessionApplication, type SignInInput, type SignInOptions, type TaxIdLookupResult, type TaxIdType, type UpdateMemberInput, type UpdateMemberRoleInput, type UseAccountsResult, type UseInvitesResult, type UseJoinRequestsResult, type UseMembersResult, type UseOrgResult, type UsePermissionsResult, type UsePublicOrganizationsResult, type UseRolesResult, type UseServiceAccountResult, type UseSessionsResult, type UseUsersResult, type User, type UserInput, type UserSession, type UserStatus, type WaitlistEntry, type WaitlistList, type WaitlistStatus, joinWaitlist, loginWithPassword, registerWithPassword, requestPasswordlessLink, startGoogleLogin, useAccounts, useAuth, useInvites, useJoinRequests, useMembers, useOrg, usePermissions, usePublicOrganizations, useRoles, useServiceAccount, useSessions, useUsers };