@geekapps/auth-nextjs 0.3.7 → 0.3.9

package/dist/client.d.ts

@@ -183,6 +183,8 @@ type PermissionUpdateInput = {
 type SignInOptions = {
     redirectTo?: string;
     authorizationFlowId?: string;
+    /** When false, forces the IDP to show the login screen even if a session exists. Defaults to true (silent). */
+    silentLogin?: boolean;
 };
 type SignInInput = SignInOptions | MouseEvent<HTMLElement>;
 type CallbackUrlOptions = SignInOptions & {
@@ -240,6 +242,7 @@ declare function requestPasswordlessLink(params: {
 type GeekappsAuthContextValue = {
     basePath: string;
     user: User | null;
+    isAuthenticated: boolean;
     isLoading: boolean;
     accounts: ConnectedAccount[];
     isLoadingAccounts: boolean;

package/dist/client.js

@@ -224,6 +224,7 @@ function GeekappsAuthProvider({
       const url = new URL(buildUrl(basePath, "/sign-in"), window.location.origin);
       if (options?.redirectTo) url.searchParams.set("redirectTo", options.redirectTo);
       if (options?.authorizationFlowId) url.searchParams.set("flow_id", options.authorizationFlowId);
+      if (options?.silentLogin === false) url.searchParams.set("silentLogin", "false");
       redirectTo(url.toString());
     },
     [basePath]
@@ -234,6 +235,7 @@ function GeekappsAuthProvider({
       const url = new URL(buildUrl(basePath, "/sign-up"), window.location.origin);
       if (options?.redirectTo) url.searchParams.set("redirectTo", options.redirectTo);
       if (options?.authorizationFlowId) url.searchParams.set("flow_id", options.authorizationFlowId);
+      if (options?.silentLogin === false) url.searchParams.set("silentLogin", "false");
       redirectTo(url.toString());
     },
     [basePath]
@@ -279,6 +281,7 @@ function GeekappsAuthProvider({
     () => ({
       basePath,
       user,
+      isAuthenticated: !isLoading && user !== null,
       isLoading,
       accounts,
       isLoadingAccounts,

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client.tsx"],"sourcesContent":["\"use client\";\n\nimport {\n  createContext,\n  type MouseEvent,\n  type ReactElement,\n  type ReactNode,\n  useCallback,\n  useContext,\n  useEffect,\n  useMemo,\n  useState,\n} from \"react\";\n\nexport type UserStatus = \"active\" | \"inactive\" | \"suspended\";\nexport type OrganizationStatus = \"active\" | \"inactive\" | \"suspended\";\nexport type OAuthClientType = \"public\" | \"confidential\";\n\nexport type AuthResult<T = unknown> =\n  | { success: true; data: T }\n  | { success: false; error: string; status?: number };\n\nexport type User = {\n  id: string;\n  email: string;\n  name: string | null;\n  phone: string | null;\n  imageUrl: string | null;\n  status?: UserStatus;\n  createdAt?: string | Date;\n  updatedAt?: string | Date;\n};\n\nexport type ConnectedAccount = {\n  id: string;\n  sessionId?: string;\n  isActive: boolean;\n  user: User;\n};\n\nexport type Permission = {\n  id: string;\n  applicationId?: string | null;\n  key: string;\n  name: string;\n  description: string | null;\n  category: string | null;\n  isSystem: boolean;\n  isActive: boolean;\n  createdAt?: string | Date;\n  updatedAt?: string | Date;\n};\n\nexport type RolePermission = {\n  permissionDefinition: Permission;\n};\n\nexport type Role = {\n  id: string;\n  applicationId?: string | null;\n  /** Present only on custom roles */\n  organizationId?: string | null;\n  /** \"system\" | \"custom\" */\n  type?: string;\n  key: string;\n  name: string;\n  description: string | null;\n  isSystem?: boolean;\n  isDefault?: boolean;\n  isActive: boolean;\n  permissions: RolePermission[];\n  createdAt?: string | Date;\n  updatedAt?: string | Date;\n};\n\nexport type RoleAssignment = {\n  id: string;\n  roleDefinitionId?: string | null;\n  customRoleId?: string | null;\n  roleDefinition?: Role | null;\n  customRole?: Role | null;\n};\n\nexport type OrganizationMember = {\n  id: string;\n  organizationId?: string;\n  userId?: string;\n  createdAt?: string | Date;\n  user: User;\n  roleAssignments?: RoleAssignment[];\n};\n\nexport type OrganizationOwnedApplication = {\n  id: string;\n  name: string;\n  description: string | null;\n  imageUrl: string | null;\n  type?: OAuthClientType;\n  organizationId: string;\n  isFirstParty: boolean;\n  ssoEnabled: boolean;\n  status?: \"active\" | \"inactive\" | \"suspended\";\n  createdAt?: string | Date;\n  updatedAt?: string | Date;\n};\n\nexport type Organization = {\n  id: string;\n  name: string;\n  description: string | null;\n  slug: string;\n  domain: string | null;\n  imageUrl: string | null;\n  faviconUrl: string | null;\n  status: OrganizationStatus;\n  members?: OrganizationMember[];\n  ownedApplications?: OrganizationOwnedApplication[];\n  applicationLinks?: Array<{\n    id: string;\n    status: OrganizationStatus;\n    createdAt?: string | Date;\n    application: OrganizationOwnedApplication;\n  }>;\n  createdAt: string | Date;\n  updatedAt: string | Date;\n};\n\nexport type SessionApplication = {\n  id: string;\n  createdAt: string | Date;\n  expiresAt: string | Date;\n  application: {\n    id: string;\n    name: string;\n    organizationId: string;\n  };\n};\n\nexport type UserSession = {\n  id: string;\n  userId: string;\n  organizationId: string | null;\n  deviceAgent: string | null;\n  deviceId: string | null;\n  deviceName: string | null;\n  ip: string | null;\n  authState?: unknown;\n  authTime?: string | Date;\n  expiresAt: string | Date;\n  createdAt: string | Date;\n  updatedAt: string | Date;\n  user?: User;\n  applicationSessions?: SessionApplication[];\n};\n\nexport type UserInput = {\n  name?: string | null;\n  email?: string;\n  phone?: string | null;\n  imageUrl?: string | null;\n  password?: string;\n  organizationId?: string | null;\n  status?: UserStatus;\n};\n\nexport type OrganizationInput = {\n  name: string;\n  description?: string | null;\n  slug: string;\n  domain?: string | null;\n  imageUrl?: string | null;\n  faviconUrl?: string | null;\n};\n\nexport type OrganizationUpdateInput = Partial<OrganizationInput> & {\n  status?: OrganizationStatus;\n};\n\nexport type RoleInput = {\n  organizationId: string;\n  applicationId?: string | null;\n  key: string;\n  name: string;\n  description?: string | null;\n  permissionDefinitionIds?: string[];\n};\n\nexport type RoleUpdateInput = {\n  name?: string;\n  description?: string | null;\n  isActive?: boolean;\n  permissionDefinitionIds?: string[];\n};\n\nexport type PermissionInput = {\n  applicationId?: string | null;\n  key: string;\n  name: string;\n  description?: string | null;\n  category?: string | null;\n};\n\nexport type PermissionUpdateInput = {\n  name?: string;\n  description?: string | null;\n  category?: string | null;\n  isActive?: boolean;\n};\n\nexport type SignInOptions = {\n  redirectTo?: string;\n  authorizationFlowId?: string;\n};\n\nexport type SignInInput = SignInOptions | MouseEvent<HTMLElement>;\n\nexport type CallbackUrlOptions = SignInOptions & {\n  callbackUrl?: string;\n};\n\nexport type PermissionCheckOptions = {\n  permission: string;\n  organizationId?: string | null;\n  applicationId?: string | null;\n  resourceId?: string | null;\n};\n\nexport type LoginResponse = {\n  user: User;\n  redirectTo?: string | null;\n};\n\nexport type RegisterResponse = User;\n\nexport type GeekappsAuthProviderProps = {\n  children: ReactNode;\n  basePath?: string;\n  initialUser?: User | null;\n  initialOrganizations?: Organization[];\n  initialCurrentOrgId?: string | null;\n};\n\ntype RequestOptions = {\n  body?: unknown;\n  method?: \"GET\" | \"POST\" | \"PATCH\" | \"DELETE\";\n};\n\nfunction normalizeBasePath(basePath: string) {\n  return basePath.endsWith(\"/\") ? basePath.slice(0, -1) : basePath;\n}\n\nfunction buildUrl(basePath: string, path: string) {\n  const normalizedPath = path.startsWith(\"/\") ? path : `/${path}`;\n  return `${normalizeBasePath(basePath)}${normalizedPath}`;\n}\n\nasync function parseError(response: Response) {\n  const data = await response.json().catch(() => null);\n  return (\n    data?.error_description ??\n    data?.error ??\n    data?.message ??\n    `Request failed with status ${response.status}`\n  );\n}\n\nfunction redirectTo(path: string) {\n  window.location.assign(path);\n}\n\nfunction isMouseEvent(value: unknown): value is MouseEvent<HTMLElement> {\n  return Boolean(value && typeof value === \"object\" && \"preventDefault\" in value);\n}\n\nfunction normalizeSignInOptions(input?: SignInInput): SignInOptions | undefined {\n  if (!input) return undefined;\n  if (isMouseEvent(input)) {\n    input.preventDefault();\n    return undefined;\n  }\n  return input;\n}\n\n\ntype ClientActionOptions = {\n  basePath?: string;\n};\n\nasync function clientRequest<T>(\n  path: string,\n  options: RequestOptions = {},\n  basePath = \"/api/auth\",\n): Promise<T> {\n  const response = await fetch(buildUrl(basePath, path), {\n    body: options.body === undefined ? undefined : JSON.stringify(options.body),\n    credentials: \"include\",\n    headers:\n      options.body === undefined\n        ? undefined\n        : {\n            \"content-type\": \"application/json\",\n          },\n    method: options.method ?? \"GET\",\n  });\n\n  if (!response.ok) {\n    throw new Error(await parseError(response));\n  }\n\n  if (response.status === 204) {\n    return null as T;\n  }\n\n  return (await response.json()) as T;\n}\n\nasync function toStandaloneAuthResult<T>(\n  fn: () => Promise<T>,\n): Promise<AuthResult<T>> {\n  try {\n    return {\n      success: true,\n      data: await fn(),\n    };\n  } catch (error) {\n    return {\n      success: false,\n      error: error instanceof Error ? error.message : \"Auth request failed\",\n    };\n  }\n}\n\nexport async function loginWithPassword(\n  params: {\n    identifier?: string;\n    email?: string;\n    phone?: string;\n    password: string;\n    authorizationFlowId?: string;\n    redirectTo?: string;\n  },\n  options?: ClientActionOptions,\n): Promise<AuthResult<LoginResponse>> {\n  return toStandaloneAuthResult(async () => {\n    const data = await clientRequest<LoginResponse>(\n      \"/login/password\",\n      {\n        body: params,\n        method: \"POST\",\n      },\n      options?.basePath,\n    );\n\n    if (params.redirectTo ?? data.redirectTo) {\n      redirectTo(params.redirectTo ?? data.redirectTo!);\n    }\n\n    return data;\n  });\n}\n\nexport async function registerWithPassword(\n  params: {\n    name: string;\n    email: string;\n    phone?: string;\n    imageUrl?: string;\n    address?: Record<string, unknown>;\n    password: string;\n    redirectTo?: string;\n  },\n  options?: ClientActionOptions,\n): Promise<AuthResult<RegisterResponse>> {\n  return toStandaloneAuthResult(async () => {\n    const data = await clientRequest<RegisterResponse>(\n      \"/register/password\",\n      {\n        body: params,\n        method: \"POST\",\n      },\n      options?.basePath,\n    );\n\n    if (params.redirectTo) {\n      redirectTo(params.redirectTo);\n    }\n\n    return data;\n  });\n}\n\nexport function startGoogleLogin(\n  params?: CallbackUrlOptions,\n  options?: ClientActionOptions,\n) {\n  const basePath = options?.basePath ?? \"/api/auth\";\n  const url = new URL(buildUrl(basePath, \"/login/google\"), window.location.origin);\n\n  if (params?.callbackUrl) {\n    url.searchParams.set(\"callbackUrl\", params.callbackUrl);\n  }\n\n  if (params?.redirectTo) {\n    url.searchParams.set(\"redirectTo\", params.redirectTo);\n  }\n\n  if (params?.authorizationFlowId) {\n    url.searchParams.set(\"flow_id\", params.authorizationFlowId);\n  }\n\n  redirectTo(url.toString());\n}\n\nexport async function requestPasswordlessLink(\n  params: {\n    email: string;\n    authorizationFlowId?: string;\n    redirectTo?: string;\n    callbackUrl?: string;\n  },\n  options?: ClientActionOptions,\n): Promise<AuthResult> {\n  return toStandaloneAuthResult(() =>\n    clientRequest(\n      \"/passwordless/link\",\n      {\n        body: params,\n        method: \"POST\",\n      },\n      options?.basePath,\n    ),\n  );\n}\n\nexport type GeekappsAuthContextValue = {\n  basePath: string;\n  user: User | null;\n  isLoading: boolean;\n  accounts: ConnectedAccount[];\n  isLoadingAccounts: boolean;\n  organizations: Organization[];\n  currentOrg: Organization | null;\n  currentOrgId: string | null;\n  isLoadingOrganizations: boolean;\n\n  request: <T>(path: string, options?: RequestOptions) => Promise<T>;\n\n  signIn: (options?: SignInInput) => Promise<void>;\n  signUp: (options?: SignInInput) => Promise<void>;\n  addAccount: (options?: SignInInput) => Promise<void>;\n  signOut: () => Promise<void>;\n  signOutAll: () => Promise<void>;\n  refreshUser: () => Promise<void>;\n  refreshAccounts: () => Promise<void>;\n  switchAccount: (sessionId: string, options?: SignInOptions) => Promise<void>;\n\n  loginWithPassword: (params: {\n    identifier?: string;\n    email?: string;\n    phone?: string;\n    password: string;\n    authorizationFlowId?: string;\n    redirectTo?: string;\n  }) => Promise<AuthResult<LoginResponse>>;\n  registerWithPassword: (params: {\n    name: string;\n    email: string;\n    phone?: string;\n    imageUrl?: string;\n    address?: Record<string, unknown>;\n    password: string;\n    redirectTo?: string;\n  }) => Promise<AuthResult<RegisterResponse>>;\n  startGoogleLogin: (params?: CallbackUrlOptions) => void;\n  requestPasswordlessLink: (params: {\n    email: string;\n    authorizationFlowId?: string;\n    redirectTo?: string;\n    callbackUrl?: string;\n  }) => Promise<AuthResult>;\n\n  refreshOrganizations: () => Promise<void>;\n  setCurrentOrg: (organizationId: string | null) => Promise<void>;\n  createOrganization: (input: OrganizationInput) => Promise<AuthResult<Organization>>;\n  updateOrganization: (id: string, input: OrganizationUpdateInput) => Promise<AuthResult<Organization>>;\n  deleteOrganization: (id: string) => Promise<AuthResult<null>>;\n  hasPermission: (options: PermissionCheckOptions) => Promise<boolean>;\n\n  listUsers: (params?: { organizationId?: string | null }) => Promise<User[]>;\n  getUser: (id: string) => Promise<User>;\n  createUser: (input: UserInput) => Promise<AuthResult<User>>;\n  updateUser: (id: string, input: UserInput) => Promise<AuthResult<User>>;\n  deleteUser: (id: string) => Promise<AuthResult<null>>;\n\n  listRoles: (params?: { organizationId?: string; applicationId?: string; type?: \"system\" | \"custom\" | \"all\" }) => Promise<{ systemRoles: Role[]; customRoles: Role[] }>;\n  getRole: (id: string, type: \"system\" | \"custom\") => Promise<Role>;\n  createRole: (input: RoleInput) => Promise<AuthResult<Role>>;\n  updateRole: (id: string, input: RoleUpdateInput) => Promise<AuthResult<Role>>;\n  deleteRole: (id: string) => Promise<AuthResult<null>>;\n\n  listPermissions: (params?: { applicationId?: string; roleId?: string | null }) => Promise<Permission[]>;\n  createPermission: (input: PermissionInput) => Promise<AuthResult<Permission>>;\n  updatePermission: (id: string, input: PermissionUpdateInput) => Promise<AuthResult<Permission>>;\n  deletePermission: (id: string) => Promise<AuthResult<null>>;\n\n  listUserSessions: (params?: { userId?: string; organizationId?: string | null }) => Promise<UserSession[]>;\n  revokeUserSession: (sessionId: string) => Promise<AuthResult<null>>;\n};\n\nexport type UseOrgResult = Pick<\n  GeekappsAuthContextValue,\n  | \"organizations\"\n  | \"currentOrg\"\n  | \"currentOrgId\"\n  | \"isLoadingOrganizations\"\n  | \"refreshOrganizations\"\n  | \"setCurrentOrg\"\n  | \"createOrganization\"\n  | \"updateOrganization\"\n  | \"deleteOrganization\"\n  | \"hasPermission\"\n>;\n\nexport type UseAccountsResult = Pick<\n  GeekappsAuthContextValue,\n  \"accounts\" | \"addAccount\" | \"isLoadingAccounts\" | \"refreshAccounts\" | \"switchAccount\"\n>;\n\nexport type UseUsersResult = Pick<\n  GeekappsAuthContextValue,\n  \"listUsers\" | \"getUser\" | \"createUser\" | \"updateUser\" | \"deleteUser\"\n>;\n\nexport type UseRolesResult = Pick<\n  GeekappsAuthContextValue,\n  \"listRoles\" | \"getRole\" | \"createRole\" | \"updateRole\" | \"deleteRole\"\n>;\n\nexport type UsePermissionsResult = Pick<\n  GeekappsAuthContextValue,\n  \"listPermissions\" | \"createPermission\" | \"updatePermission\" | \"deletePermission\"\n>;\n\nexport type UseSessionsResult = Pick<\n  GeekappsAuthContextValue,\n  \"listUserSessions\" | \"revokeUserSession\"\n>;\n\nconst GeekappsAuthContext = createContext<GeekappsAuthContextValue | null>(null);\n\nexport function GeekappsAuthProvider({\n  children,\n  basePath = \"/api/auth\",\n  initialUser = null,\n  initialOrganizations = [],\n  initialCurrentOrgId = null,\n}: GeekappsAuthProviderProps): ReactElement {\n  const [user, setUser] = useState<User | null>(initialUser);\n  const [isLoading, setIsLoading] = useState(true);\n  const [accounts, setAccounts] = useState<ConnectedAccount[]>([]);\n  const [isLoadingAccounts, setIsLoadingAccounts] = useState(true);\n  const [organizations, setOrganizations] = useState<Organization[]>(initialOrganizations);\n  const [currentOrgId, setCurrentOrgId] = useState<string | null>(initialCurrentOrgId);\n  const [isLoadingOrganizations, setIsLoadingOrganizations] = useState(true);\n\n  const request = useCallback(\n    async <T,>(path: string, options: RequestOptions = {}) => {\n      const response = await fetch(buildUrl(basePath, path), {\n        method: options.method ?? \"GET\",\n        credentials: \"include\",\n        headers:\n          options.body === undefined\n            ? undefined\n            : {\n                \"content-type\": \"application/json\",\n              },\n        body: options.body === undefined ? undefined : JSON.stringify(options.body),\n      });\n\n      if (!response.ok) {\n        throw new Error(await parseError(response));\n      }\n\n      if (response.status === 204) {\n        return null as T;\n      }\n\n      return (await response.json()) as T;\n    },\n    [basePath],\n  );\n\n  const refreshUser = useCallback(async () => {\n    setIsLoading(true);\n    try {\n      const { user: u } = await request<{ user: User | null }>(\"/me\");\n      setUser(u);\n    } catch {\n      setUser(null);\n    } finally {\n      setIsLoading(false);\n    }\n  }, []);\n\n  const refreshAccounts = useCallback(async () => {\n    setIsLoadingAccounts(true);\n    try {\n      const { accounts: a } = await request<{ accounts: ConnectedAccount[] }>(\n        \"/accounts\",\n      );\n      setAccounts(a);\n    } catch {\n      setAccounts([]);\n    } finally {\n      setIsLoadingAccounts(false);\n    }\n  }, []);\n\n  const refreshOrganizations = useCallback(async () => {\n    setIsLoadingOrganizations(true);\n    try {\n      const { organizations: orgs, currentOrgId: nextCurrentOrgId } =\n        await request<{\n          organizations: Organization[];\n          currentOrgId?: string | null;\n        }>(\"/organizations\");\n      setOrganizations(orgs);\n      setCurrentOrgId((current) => {\n        if (nextCurrentOrgId !== undefined) return nextCurrentOrgId ?? null;\n        if (current && orgs.some((org) => org.id === current)) return current;\n        return orgs[0]?.id ?? null;\n      });\n    } catch {\n      setOrganizations([]);\n      setCurrentOrgId(null);\n    } finally {\n      setIsLoadingOrganizations(false);\n    }\n  }, []);\n\n  useEffect(() => {\n    void refreshUser();\n    void refreshAccounts();\n    void refreshOrganizations();\n  }, [refreshAccounts, refreshOrganizations, refreshUser]);\n\n  const currentOrg = useMemo(\n    () => organizations.find((organization) => organization.id === currentOrgId) ?? null,\n    [currentOrgId, organizations],\n  );\n\n  const setCurrentOrg = useCallback(\n    async (organizationId: string | null) => {\n      await request(\"/organizations/active\", {\n        method: \"POST\",\n        body: { organizationId },\n      });\n      setCurrentOrgId(organizationId);\n    },\n    [request],\n  );\n\n  const signIn = useCallback(\n    async (input?: SignInInput) => {\n      const options = normalizeSignInOptions(input);\n      const url = new URL(buildUrl(basePath, \"/sign-in\"), window.location.origin);\n      if (options?.redirectTo) url.searchParams.set(\"redirectTo\", options.redirectTo);\n      if (options?.authorizationFlowId) url.searchParams.set(\"flow_id\", options.authorizationFlowId);\n      redirectTo(url.toString());\n    },\n    [basePath],\n  );\n\n  const signUp = useCallback(\n    async (input?: SignInInput) => {\n      const options = normalizeSignInOptions(input);\n      const url = new URL(buildUrl(basePath, \"/sign-up\"), window.location.origin);\n      if (options?.redirectTo) url.searchParams.set(\"redirectTo\", options.redirectTo);\n      if (options?.authorizationFlowId) url.searchParams.set(\"flow_id\", options.authorizationFlowId);\n      redirectTo(url.toString());\n    },\n    [basePath],\n  );\n\n  const addAccount = useCallback(\n    async (input?: SignInInput) => {\n      const options = normalizeSignInOptions(input);\n      const url = new URL(buildUrl(basePath, \"/add-account\"), window.location.origin);\n      if (options?.redirectTo) url.searchParams.set(\"redirectTo\", options.redirectTo);\n      redirectTo(url.toString());\n    },\n    [basePath],\n  );\n\n  const signOut = useCallback(async () => {\n    await request(\"/sign-out\", { method: \"POST\" });\n    setUser(null);\n    await refreshAccounts();\n  }, [refreshAccounts, request]);\n\n  const signOutAll = useCallback(async () => {\n    await request(\"/sign-out-all\", { method: \"POST\" });\n    setUser(null);\n    setAccounts([]);\n  }, [request]);\n\n  const switchAccount = useCallback(\n    async (sessionId: string, options?: SignInOptions) => {\n      await request(\"/accounts/switch\", {\n        method: \"POST\",\n        body: { sessionId },\n      });\n      await Promise.all([refreshUser(), refreshAccounts(), refreshOrganizations()]);\n      if (options?.redirectTo) redirectTo(options.redirectTo);\n    },\n    [refreshAccounts, refreshOrganizations, refreshUser, request],\n  );\n\n  async function toAuthResult<T>(fn: () => Promise<T>): Promise<AuthResult<T>> {\n    try {\n      return { success: true, data: await fn() };\n    } catch (error) {\n      return { success: false, error: error instanceof Error ? error.message : \"Unexpected error\" };\n    }\n  }\n\n  const value = useMemo<GeekappsAuthContextValue>(\n    () => ({\n      basePath,\n      user,\n      isLoading,\n      accounts,\n      isLoadingAccounts,\n      organizations,\n      currentOrg,\n      currentOrgId,\n      isLoadingOrganizations,\n      request,\n      signIn,\n      signUp,\n      addAccount,\n      signOut,\n      signOutAll,\n      refreshUser,\n      refreshAccounts,\n      switchAccount,\n      loginWithPassword: (params) =>\n        toAuthResult(async () => {\n          const data = await request<LoginResponse>(\"/login/password\", { method: \"POST\", body: params });\n          await Promise.all([refreshUser(), refreshAccounts(), refreshOrganizations()]);\n          if (params.redirectTo ?? data.redirectTo) redirectTo(params.redirectTo ?? data.redirectTo!);\n          return data;\n        }),\n      registerWithPassword: (params) =>\n        toAuthResult(async () => {\n          const data = await request<RegisterResponse>(\"/register/password\", { method: \"POST\", body: params });\n          await Promise.all([refreshUser(), refreshAccounts(), refreshOrganizations()]);\n          if (params.redirectTo) redirectTo(params.redirectTo);\n          return data;\n        }),\n      startGoogleLogin: (params) => {\n        const url = new URL(buildUrl(basePath, \"/login/google\"), window.location.origin);\n        if (params?.callbackUrl) url.searchParams.set(\"callbackUrl\", params.callbackUrl);\n        if (params?.redirectTo) url.searchParams.set(\"redirectTo\", params.redirectTo);\n        if (params?.authorizationFlowId) url.searchParams.set(\"flow_id\", params.authorizationFlowId);\n        redirectTo(url.toString());\n      },\n      requestPasswordlessLink: (params) =>\n        toAuthResult(() => request(\"/passwordless/link\", { method: \"POST\", body: params })),\n      refreshOrganizations,\n      setCurrentOrg,\n      createOrganization: (input) =>\n        toAuthResult(async () => {\n          const organization = await request<Organization>(\"/organizations\", { method: \"POST\", body: input });\n          await refreshOrganizations();\n          setCurrentOrgId(organization.id);\n          return organization;\n        }),\n      updateOrganization: (id, input) =>\n        toAuthResult(async () => {\n          const organization = await request<Organization>(`/organizations/${id}`, { method: \"PATCH\", body: input });\n          await refreshOrganizations();\n          return organization;\n        }),\n      deleteOrganization: (id) =>\n        toAuthResult(async () => {\n          await request<null>(`/organizations/${id}`, { method: \"DELETE\" });\n          await refreshOrganizations();\n          return null;\n        }),\n      hasPermission: async (options) => {\n        try {\n          const data = await request<{ allowed: boolean }>(\"/permissions/check\", {\n            method: \"POST\",\n            body: options,\n          });\n          return data.allowed;\n        } catch {\n          return false;\n        }\n      },\n      listUsers: (params) => {\n        const query = new URLSearchParams();\n        if (params?.organizationId) query.set(\"organizationId\", params.organizationId);\n        return request<User[]>(`/users${query.size ? `?${query.toString()}` : \"\"}`);\n      },\n      getUser: (id) => request<User>(`/users/${id}`),\n      createUser: (input) => toAuthResult(() => request<User>(\"/users\", { method: \"POST\", body: input })),\n      updateUser: (id, input) => toAuthResult(() => request<User>(`/users/${id}`, { method: \"PATCH\", body: input })),\n      deleteUser: (id) =>\n        toAuthResult(async () => {\n          await request<null>(`/users/${id}`, { method: \"DELETE\" });\n          return null;\n        }),\n      listRoles: (params) => {\n        const query = new URLSearchParams();\n        if (params?.organizationId) query.set(\"organizationId\", params.organizationId);\n        if (params?.applicationId) query.set(\"applicationId\", params.applicationId);\n        if (params?.type) query.set(\"type\", params.type);\n        return request<{ systemRoles: Role[]; customRoles: Role[] }>(`/roles${query.size ? `?${query.toString()}` : \"\"}`);\n      },\n      getRole: (id, type) => request<Role>(type === \"custom\" ? `/roles/custom/${id}` : `/roles/definitions/${id}`),\n      createRole: (input) => toAuthResult(() => request<Role>(\"/roles\", { method: \"POST\", body: input })),\n      updateRole: (id, input) => toAuthResult(() => request<Role>(`/roles/custom/${id}`, { method: \"PATCH\", body: input })),\n      deleteRole: (id) =>\n        toAuthResult(async () => {\n          await request<null>(`/roles/custom/${id}`, { method: \"DELETE\" });\n          return null;\n        }),\n      listPermissions: (params) => {\n        const query = new URLSearchParams();\n        if (params?.applicationId) query.set(\"applicationId\", params.applicationId);\n        if (params?.roleId) query.set(\"roleId\", params.roleId);\n        return request<Permission[]>(`/permissions${query.size ? `?${query.toString()}` : \"\"}`);\n      },\n      createPermission: (input) =>\n        toAuthResult(() => request<Permission>(\"/permissions\", { method: \"POST\", body: input })),\n      updatePermission: (id, input) =>\n        toAuthResult(() => request<Permission>(`/permissions/${id}`, { method: \"PATCH\", body: input })),\n      deletePermission: (id) =>\n        toAuthResult(async () => {\n          await request<null>(`/permissions/${id}`, { method: \"DELETE\" });\n          return null;\n        }),\n      listUserSessions: (params) => {\n        const query = new URLSearchParams();\n        if (params?.userId) query.set(\"userId\", params.userId);\n        if (params?.organizationId) query.set(\"organizationId\", params.organizationId);\n        return request<UserSession[]>(`/sessions${query.size ? `?${query.toString()}` : \"\"}`);\n      },\n      revokeUserSession: (sessionId) =>\n        toAuthResult(async () => {\n          await request<null>(`/sessions/${sessionId}`, { method: \"DELETE\" });\n          return null;\n        }),\n    }),\n    [\n      accounts,\n      addAccount,\n      basePath,\n      currentOrg,\n      currentOrgId,\n      isLoading,\n      isLoadingAccounts,\n      isLoadingOrganizations,\n      organizations,\n      refreshAccounts,\n      refreshOrganizations,\n      refreshUser,\n      request,\n      setCurrentOrg,\n      signIn,\n      signOut,\n      signOutAll,\n      signUp,\n      switchAccount,\n      user,\n    ],\n  );\n\n  return <GeekappsAuthContext.Provider value={value}>{children}</GeekappsAuthContext.Provider>;\n}\n\nexport function useAuth(): GeekappsAuthContextValue {\n  const context = useContext(GeekappsAuthContext);\n  if (!context) throw new Error(\"useAuth must be used inside GeekappsAuthProvider\");\n  return context;\n}\n\nexport function useOrg(): UseOrgResult {\n  const context = useAuth();\n  return {\n    organizations: context.organizations,\n    currentOrg: context.currentOrg,\n    currentOrgId: context.currentOrgId,\n    isLoadingOrganizations: context.isLoadingOrganizations,\n    refreshOrganizations: context.refreshOrganizations,\n    setCurrentOrg: context.setCurrentOrg,\n    createOrganization: context.createOrganization,\n    updateOrganization: context.updateOrganization,\n    deleteOrganization: context.deleteOrganization,\n    hasPermission: context.hasPermission,\n  };\n}\n\nexport function useAccounts(): UseAccountsResult {\n  const context = useAuth();\n  return {\n    accounts: context.accounts,\n    addAccount: context.addAccount,\n    isLoadingAccounts: context.isLoadingAccounts,\n    refreshAccounts: context.refreshAccounts,\n    switchAccount: context.switchAccount,\n  };\n}\n\nexport function useUsers(): UseUsersResult {\n  const context = useAuth();\n  return {\n    listUsers: context.listUsers,\n    getUser: context.getUser,\n    createUser: context.createUser,\n    updateUser: context.updateUser,\n    deleteUser: context.deleteUser,\n  };\n}\n\nexport function useRoles(): UseRolesResult {\n  const context = useAuth();\n  return {\n    listRoles: context.listRoles,\n    getRole: context.getRole,\n    createRole: context.createRole,\n    updateRole: context.updateRole,\n    deleteRole: context.deleteRole,\n  };\n}\n\nexport function usePermissions(): UsePermissionsResult {\n  const context = useAuth();\n  return {\n    listPermissions: context.listPermissions,\n    createPermission: context.createPermission,\n    updatePermission: context.updatePermission,\n    deletePermission: context.deletePermission,\n  };\n}\n\nexport function useSessions(): UseSessionsResult {\n  const context = useAuth();\n  return {\n    listUserSessions: context.listUserSessions,\n    revokeUserSession: context.revokeUserSession,\n  };\n}\n\n// ── Service Accounts ─────────────────────────────────────────────────────────\n\nexport type ServiceAccount = {\n  id: string;\n  membershipId: string;\n  organizationId: string;\n  applicationId: string | null;\n  name: string;\n  status: \"active\" | \"inactive\" | \"suspended\";\n  serviceId: string | null;\n  roleAssignment: { role: { id: string; key: string; name: string } } | null;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type ServiceAccountWithSecret = ServiceAccount & { serviceSecret: string };\n\nexport type CreateServiceAccountInput = {\n  organizationId: string;\n  applicationId?: string;\n  name: string;\n  description?: string;\n  roleId?: string;\n};\n\nexport type UseServiceAccountResult = {\n  listServiceAccounts: (params: { organizationId: string; applicationId?: string }) => Promise<ServiceAccount[]>;\n  createServiceAccount: (input: CreateServiceAccountInput) => Promise<ServiceAccountWithSecret>;\n  updateServiceAccountRole: (id: string, roleId: string | null) => Promise<void>;\n  revokeServiceAccount: (id: string) => Promise<void>;\n  rotateServiceAccountSecret: (id: string) => Promise<{ serviceId: string; serviceSecret: string }>;\n  deleteServiceAccount: (id: string) => Promise<void>;\n};\n\nexport function useServiceAccount(): UseServiceAccountResult {\n  const { request } = useAuth();\n\n  const listServiceAccounts = useCallback(\n    (params: { organizationId: string; applicationId?: string }) => {\n      const query = new URLSearchParams({ organizationId: params.organizationId });\n      if (params.applicationId) query.set(\"applicationId\", params.applicationId);\n      return request<ServiceAccount[]>(`/service-accounts?${query.toString()}`);\n    },\n    [request],\n  );\n\n  const createServiceAccount = useCallback(\n    (input: CreateServiceAccountInput) =>\n      request<ServiceAccountWithSecret>(\"/service-accounts\", { method: \"POST\", body: input }),\n    [request],\n  );\n\n  const updateServiceAccountRole = useCallback(\n    async (id: string, roleId: string | null) => {\n      await request<void>(`/service-accounts/${id}`, { method: \"PATCH\", body: { roleId } });\n    },\n    [request],\n  );\n\n  const revokeServiceAccount = useCallback(\n    async (id: string) => {\n      await request<void>(`/service-accounts/${id}/revoke`, { method: \"POST\" });\n    },\n    [request],\n  );\n\n  const rotateServiceAccountSecret = useCallback(\n    (id: string) =>\n      request<{ serviceId: string; serviceSecret: string }>(`/service-accounts/${id}/rotate-secret`, {\n        method: \"POST\",\n      }),\n    [request],\n  );\n\n  const deleteServiceAccount = useCallback(\n    async (id: string) => {\n      await request<null>(`/service-accounts/${id}`, { method: \"DELETE\" });\n    },\n    [request],\n  );\n\n  return {\n    listServiceAccounts,\n    createServiceAccount,\n    updateServiceAccountRole,\n    revokeServiceAccount,\n    rotateServiceAccountSecret,\n    deleteServiceAccount,\n  };\n}\n"],"mappings":";;;AAEA;AAAA,EACE;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAo2BE;AAznBT,SAAS,kBAAkB,UAAkB;AAC3C,SAAO,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;AAC1D;AAEA,SAAS,SAAS,UAAkB,MAAc;AAChD,QAAM,iBAAiB,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AAC7D,SAAO,GAAG,kBAAkB,QAAQ,CAAC,GAAG,cAAc;AACxD;AAEA,eAAe,WAAW,UAAoB;AAC5C,QAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACnD,SACE,MAAM,qBACN,MAAM,SACN,MAAM,WACN,8BAA8B,SAAS,MAAM;AAEjD;AAEA,SAAS,WAAW,MAAc;AAChC,SAAO,SAAS,OAAO,IAAI;AAC7B;AAEA,SAAS,aAAa,OAAkD;AACtE,SAAO,QAAQ,SAAS,OAAO,UAAU,YAAY,oBAAoB,KAAK;AAChF;AAEA,SAAS,uBAAuB,OAAgD;AAC9E,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,aAAa,KAAK,GAAG;AACvB,UAAM,eAAe;AACrB,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOA,eAAe,cACb,MACA,UAA0B,CAAC,GAC3B,WAAW,aACC;AACZ,QAAM,WAAW,MAAM,MAAM,SAAS,UAAU,IAAI,GAAG;AAAA,IACrD,MAAM,QAAQ,SAAS,SAAY,SAAY,KAAK,UAAU,QAAQ,IAAI;AAAA,IAC1E,aAAa;AAAA,IACb,SACE,QAAQ,SAAS,SACb,SACA;AAAA,MACE,gBAAgB;AAAA,IAClB;AAAA,IACN,QAAQ,QAAQ,UAAU;AAAA,EAC5B,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,MAAM,MAAM,WAAW,QAAQ,CAAC;AAAA,EAC5C;AAEA,MAAI,SAAS,WAAW,KAAK;AAC3B,WAAO;AAAA,EACT;AAEA,SAAQ,MAAM,SAAS,KAAK;AAC9B;AAEA,eAAe,uBACb,IACwB;AACxB,MAAI;AACF,WAAO;AAAA,MACL,SAAS;AAAA,MACT,MAAM,MAAM,GAAG;AAAA,IACjB;AAAA,EACF,SAAS,OAAO;AACd,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD;AAAA,EACF;AACF;AAEA,eAAsB,kBACpB,QAQA,SACoC;AACpC,SAAO,uBAAuB,YAAY;AACxC,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,QAAQ;AAAA,MACV;AAAA,MACA,SAAS;AAAA,IACX;AAEA,QAAI,OAAO,cAAc,KAAK,YAAY;AACxC,iBAAW,OAAO,cAAc,KAAK,UAAW;AAAA,IAClD;AAEA,WAAO;AAAA,EACT,CAAC;AACH;AAEA,eAAsB,qBACpB,QASA,SACuC;AACvC,SAAO,uBAAuB,YAAY;AACxC,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,QAAQ;AAAA,MACV;AAAA,MACA,SAAS;AAAA,IACX;AAEA,QAAI,OAAO,YAAY;AACrB,iBAAW,OAAO,UAAU;AAAA,IAC9B;AAEA,WAAO;AAAA,EACT,CAAC;AACH;AAEO,SAAS,iBACd,QACA,SACA;AACA,QAAM,WAAW,SAAS,YAAY;AACtC,QAAM,MAAM,IAAI,IAAI,SAAS,UAAU,eAAe,GAAG,OAAO,SAAS,MAAM;AAE/E,MAAI,QAAQ,aAAa;AACvB,QAAI,aAAa,IAAI,eAAe,OAAO,WAAW;AAAA,EACxD;AAEA,MAAI,QAAQ,YAAY;AACtB,QAAI,aAAa,IAAI,cAAc,OAAO,UAAU;AAAA,EACtD;AAEA,MAAI,QAAQ,qBAAqB;AAC/B,QAAI,aAAa,IAAI,WAAW,OAAO,mBAAmB;AAAA,EAC5D;AAEA,aAAW,IAAI,SAAS,CAAC;AAC3B;AAEA,eAAsB,wBACpB,QAMA,SACqB;AACrB,SAAO;AAAA,IAAuB,MAC5B;AAAA,MACE;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,QAAQ;AAAA,MACV;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAoHA,IAAM,sBAAsB,cAA+C,IAAI;AAExE,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA,WAAW;AAAA,EACX,cAAc;AAAA,EACd,uBAAuB,CAAC;AAAA,EACxB,sBAAsB;AACxB,GAA4C;AAC1C,QAAM,CAAC,MAAM,OAAO,IAAI,SAAsB,WAAW;AACzD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAC/C,QAAM,CAAC,UAAU,WAAW,IAAI,SAA6B,CAAC,CAAC;AAC/D,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,SAAS,IAAI;AAC/D,QAAM,CAAC,eAAe,gBAAgB,IAAI,SAAyB,oBAAoB;AACvF,QAAM,CAAC,cAAc,eAAe,IAAI,SAAwB,mBAAmB;AACnF,QAAM,CAAC,wBAAwB,yBAAyB,IAAI,SAAS,IAAI;AAEzE,QAAM,UAAU;AAAA,IACd,OAAW,MAAc,UAA0B,CAAC,MAAM;AACxD,YAAM,WAAW,MAAM,MAAM,SAAS,UAAU,IAAI,GAAG;AAAA,QACrD,QAAQ,QAAQ,UAAU;AAAA,QAC1B,aAAa;AAAA,QACb,SACE,QAAQ,SAAS,SACb,SACA;AAAA,UACE,gBAAgB;AAAA,QAClB;AAAA,QACN,MAAM,QAAQ,SAAS,SAAY,SAAY,KAAK,UAAU,QAAQ,IAAI;AAAA,MAC5E,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,IAAI,MAAM,MAAM,WAAW,QAAQ,CAAC;AAAA,MAC5C;AAEA,UAAI,SAAS,WAAW,KAAK;AAC3B,eAAO;AAAA,MACT;AAEA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,cAAc,YAAY,YAAY;AAC1C,iBAAa,IAAI;AACjB,QAAI;AACF,YAAM,EAAE,MAAM,EAAE,IAAI,MAAM,QAA+B,KAAK;AAC9D,cAAQ,CAAC;AAAA,IACX,QAAQ;AACN,cAAQ,IAAI;AAAA,IACd,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,kBAAkB,YAAY,YAAY;AAC9C,yBAAqB,IAAI;AACzB,QAAI;AACF,YAAM,EAAE,UAAU,EAAE,IAAI,MAAM;AAAA,QAC5B;AAAA,MACF;AACA,kBAAY,CAAC;AAAA,IACf,QAAQ;AACN,kBAAY,CAAC,CAAC;AAAA,IAChB,UAAE;AACA,2BAAqB,KAAK;AAAA,IAC5B;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,uBAAuB,YAAY,YAAY;AACnD,8BAA0B,IAAI;AAC9B,QAAI;AACF,YAAM,EAAE,eAAe,MAAM,cAAc,iBAAiB,IAC1D,MAAM,QAGH,gBAAgB;AACrB,uBAAiB,IAAI;AACrB,sBAAgB,CAAC,YAAY;AAC3B,YAAI,qBAAqB,OAAW,QAAO,oBAAoB;AAC/D,YAAI,WAAW,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,OAAO,EAAG,QAAO;AAC9D,eAAO,KAAK,CAAC,GAAG,MAAM;AAAA,MACxB,CAAC;AAAA,IACH,QAAQ;AACN,uBAAiB,CAAC,CAAC;AACnB,sBAAgB,IAAI;AAAA,IACtB,UAAE;AACA,gCAA0B,KAAK;AAAA,IACjC;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,YAAU,MAAM;AACd,SAAK,YAAY;AACjB,SAAK,gBAAgB;AACrB,SAAK,qBAAqB;AAAA,EAC5B,GAAG,CAAC,iBAAiB,sBAAsB,WAAW,CAAC;AAEvD,QAAM,aAAa;AAAA,IACjB,MAAM,cAAc,KAAK,CAAC,iBAAiB,aAAa,OAAO,YAAY,KAAK;AAAA,IAChF,CAAC,cAAc,aAAa;AAAA,EAC9B;AAEA,QAAM,gBAAgB;AAAA,IACpB,OAAO,mBAAkC;AACvC,YAAM,QAAQ,yBAAyB;AAAA,QACrC,QAAQ;AAAA,QACR,MAAM,EAAE,eAAe;AAAA,MACzB,CAAC;AACD,sBAAgB,cAAc;AAAA,IAChC;AAAA,IACA,CAAC,OAAO;AAAA,EACV;AAEA,QAAM,SAAS;AAAA,IACb,OAAO,UAAwB;AAC7B,YAAM,UAAU,uBAAuB,KAAK;AAC5C,YAAM,MAAM,IAAI,IAAI,SAAS,UAAU,UAAU,GAAG,OAAO,SAAS,MAAM;AAC1E,UAAI,SAAS,WAAY,KAAI,aAAa,IAAI,cAAc,QAAQ,UAAU;AAC9E,UAAI,SAAS,oBAAqB,KAAI,aAAa,IAAI,WAAW,QAAQ,mBAAmB;AAC7F,iBAAW,IAAI,SAAS,CAAC;AAAA,IAC3B;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,SAAS;AAAA,IACb,OAAO,UAAwB;AAC7B,YAAM,UAAU,uBAAuB,KAAK;AAC5C,YAAM,MAAM,IAAI,IAAI,SAAS,UAAU,UAAU,GAAG,OAAO,SAAS,MAAM;AAC1E,UAAI,SAAS,WAAY,KAAI,aAAa,IAAI,cAAc,QAAQ,UAAU;AAC9E,UAAI,SAAS,oBAAqB,KAAI,aAAa,IAAI,WAAW,QAAQ,mBAAmB;AAC7F,iBAAW,IAAI,SAAS,CAAC;AAAA,IAC3B;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,aAAa;AAAA,IACjB,OAAO,UAAwB;AAC7B,YAAM,UAAU,uBAAuB,KAAK;AAC5C,YAAM,MAAM,IAAI,IAAI,SAAS,UAAU,cAAc,GAAG,OAAO,SAAS,MAAM;AAC9E,UAAI,SAAS,WAAY,KAAI,aAAa,IAAI,cAAc,QAAQ,UAAU;AAC9E,iBAAW,IAAI,SAAS,CAAC;AAAA,IAC3B;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,UAAU,YAAY,YAAY;AACtC,UAAM,QAAQ,aAAa,EAAE,QAAQ,OAAO,CAAC;AAC7C,YAAQ,IAAI;AACZ,UAAM,gBAAgB;AAAA,EACxB,GAAG,CAAC,iBAAiB,OAAO,CAAC;AAE7B,QAAM,aAAa,YAAY,YAAY;AACzC,UAAM,QAAQ,iBAAiB,EAAE,QAAQ,OAAO,CAAC;AACjD,YAAQ,IAAI;AACZ,gBAAY,CAAC,CAAC;AAAA,EAChB,GAAG,CAAC,OAAO,CAAC;AAEZ,QAAM,gBAAgB;AAAA,IACpB,OAAO,WAAmB,YAA4B;AACpD,YAAM,QAAQ,oBAAoB;AAAA,QAChC,QAAQ;AAAA,QACR,MAAM,EAAE,UAAU;AAAA,MACpB,CAAC;AACD,YAAM,QAAQ,IAAI,CAAC,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,CAAC,CAAC;AAC5E,UAAI,SAAS,WAAY,YAAW,QAAQ,UAAU;AAAA,IACxD;AAAA,IACA,CAAC,iBAAiB,sBAAsB,aAAa,OAAO;AAAA,EAC9D;AAEA,iBAAe,aAAgB,IAA8C;AAC3E,QAAI;AACF,aAAO,EAAE,SAAS,MAAM,MAAM,MAAM,GAAG,EAAE;AAAA,IAC3C,SAAS,OAAO;AACd,aAAO,EAAE,SAAS,OAAO,OAAO,iBAAiB,QAAQ,MAAM,UAAU,mBAAmB;AAAA,IAC9F;AAAA,EACF;AAEA,QAAM,QAAQ;AAAA,IACZ,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,mBAAmB,CAAC,WAClB,aAAa,YAAY;AACvB,cAAM,OAAO,MAAM,QAAuB,mBAAmB,EAAE,QAAQ,QAAQ,MAAM,OAAO,CAAC;AAC7F,cAAM,QAAQ,IAAI,CAAC,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,CAAC,CAAC;AAC5E,YAAI,OAAO,cAAc,KAAK,WAAY,YAAW,OAAO,cAAc,KAAK,UAAW;AAC1F,eAAO;AAAA,MACT,CAAC;AAAA,MACH,sBAAsB,CAAC,WACrB,aAAa,YAAY;AACvB,cAAM,OAAO,MAAM,QAA0B,sBAAsB,EAAE,QAAQ,QAAQ,MAAM,OAAO,CAAC;AACnG,cAAM,QAAQ,IAAI,CAAC,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,CAAC,CAAC;AAC5E,YAAI,OAAO,WAAY,YAAW,OAAO,UAAU;AACnD,eAAO;AAAA,MACT,CAAC;AAAA,MACH,kBAAkB,CAAC,WAAW;AAC5B,cAAM,MAAM,IAAI,IAAI,SAAS,UAAU,eAAe,GAAG,OAAO,SAAS,MAAM;AAC/E,YAAI,QAAQ,YAAa,KAAI,aAAa,IAAI,eAAe,OAAO,WAAW;AAC/E,YAAI,QAAQ,WAAY,KAAI,aAAa,IAAI,cAAc,OAAO,UAAU;AAC5E,YAAI,QAAQ,oBAAqB,KAAI,aAAa,IAAI,WAAW,OAAO,mBAAmB;AAC3F,mBAAW,IAAI,SAAS,CAAC;AAAA,MAC3B;AAAA,MACA,yBAAyB,CAAC,WACxB,aAAa,MAAM,QAAQ,sBAAsB,EAAE,QAAQ,QAAQ,MAAM,OAAO,CAAC,CAAC;AAAA,MACpF;AAAA,MACA;AAAA,MACA,oBAAoB,CAAC,UACnB,aAAa,YAAY;AACvB,cAAM,eAAe,MAAM,QAAsB,kBAAkB,EAAE,QAAQ,QAAQ,MAAM,MAAM,CAAC;AAClG,cAAM,qBAAqB;AAC3B,wBAAgB,aAAa,EAAE;AAC/B,eAAO;AAAA,MACT,CAAC;AAAA,MACH,oBAAoB,CAAC,IAAI,UACvB,aAAa,YAAY;AACvB,cAAM,eAAe,MAAM,QAAsB,kBAAkB,EAAE,IAAI,EAAE,QAAQ,SAAS,MAAM,MAAM,CAAC;AACzG,cAAM,qBAAqB;AAC3B,eAAO;AAAA,MACT,CAAC;AAAA,MACH,oBAAoB,CAAC,OACnB,aAAa,YAAY;AACvB,cAAM,QAAc,kBAAkB,EAAE,IAAI,EAAE,QAAQ,SAAS,CAAC;AAChE,cAAM,qBAAqB;AAC3B,eAAO;AAAA,MACT,CAAC;AAAA,MACH,eAAe,OAAO,YAAY;AAChC,YAAI;AACF,gBAAM,OAAO,MAAM,QAA8B,sBAAsB;AAAA,YACrE,QAAQ;AAAA,YACR,MAAM;AAAA,UACR,CAAC;AACD,iBAAO,KAAK;AAAA,QACd,QAAQ;AACN,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,MACA,WAAW,CAAC,WAAW;AACrB,cAAM,QAAQ,IAAI,gBAAgB;AAClC,YAAI,QAAQ,eAAgB,OAAM,IAAI,kBAAkB,OAAO,cAAc;AAC7E,eAAO,QAAgB,SAAS,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE;AAAA,MAC5E;AAAA,MACA,SAAS,CAAC,OAAO,QAAc,UAAU,EAAE,EAAE;AAAA,MAC7C,YAAY,CAAC,UAAU,aAAa,MAAM,QAAc,UAAU,EAAE,QAAQ,QAAQ,MAAM,MAAM,CAAC,CAAC;AAAA,MAClG,YAAY,CAAC,IAAI,UAAU,aAAa,MAAM,QAAc,UAAU,EAAE,IAAI,EAAE,QAAQ,SAAS,MAAM,MAAM,CAAC,CAAC;AAAA,MAC7G,YAAY,CAAC,OACX,aAAa,YAAY;AACvB,cAAM,QAAc,UAAU,EAAE,IAAI,EAAE,QAAQ,SAAS,CAAC;AACxD,eAAO;AAAA,MACT,CAAC;AAAA,MACH,WAAW,CAAC,WAAW;AACrB,cAAM,QAAQ,IAAI,gBAAgB;AAClC,YAAI,QAAQ,eAAgB,OAAM,IAAI,kBAAkB,OAAO,cAAc;AAC7E,YAAI,QAAQ,cAAe,OAAM,IAAI,iBAAiB,OAAO,aAAa;AAC1E,YAAI,QAAQ,KAAM,OAAM,IAAI,QAAQ,OAAO,IAAI;AAC/C,eAAO,QAAsD,SAAS,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE;AAAA,MAClH;AAAA,MACA,SAAS,CAAC,IAAI,SAAS,QAAc,SAAS,WAAW,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,EAAE;AAAA,MAC3G,YAAY,CAAC,UAAU,aAAa,MAAM,QAAc,UAAU,EAAE,QAAQ,QAAQ,MAAM,MAAM,CAAC,CAAC;AAAA,MAClG,YAAY,CAAC,IAAI,UAAU,aAAa,MAAM,QAAc,iBAAiB,EAAE,IAAI,EAAE,QAAQ,SAAS,MAAM,MAAM,CAAC,CAAC;AAAA,MACpH,YAAY,CAAC,OACX,aAAa,YAAY;AACvB,cAAM,QAAc,iBAAiB,EAAE,IAAI,EAAE,QAAQ,SAAS,CAAC;AAC/D,eAAO;AAAA,MACT,CAAC;AAAA,MACH,iBAAiB,CAAC,WAAW;AAC3B,cAAM,QAAQ,IAAI,gBAAgB;AAClC,YAAI,QAAQ,cAAe,OAAM,IAAI,iBAAiB,OAAO,aAAa;AAC1E,YAAI,QAAQ,OAAQ,OAAM,IAAI,UAAU,OAAO,MAAM;AACrD,eAAO,QAAsB,eAAe,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE;AAAA,MACxF;AAAA,MACA,kBAAkB,CAAC,UACjB,aAAa,MAAM,QAAoB,gBAAgB,EAAE,QAAQ,QAAQ,MAAM,MAAM,CAAC,CAAC;AAAA,MACzF,kBAAkB,CAAC,IAAI,UACrB,aAAa,MAAM,QAAoB,gBAAgB,EAAE,IAAI,EAAE,QAAQ,SAAS,MAAM,MAAM,CAAC,CAAC;AAAA,MAChG,kBAAkB,CAAC,OACjB,aAAa,YAAY;AACvB,cAAM,QAAc,gBAAgB,EAAE,IAAI,EAAE,QAAQ,SAAS,CAAC;AAC9D,eAAO;AAAA,MACT,CAAC;AAAA,MACH,kBAAkB,CAAC,WAAW;AAC5B,cAAM,QAAQ,IAAI,gBAAgB;AAClC,YAAI,QAAQ,OAAQ,OAAM,IAAI,UAAU,OAAO,MAAM;AACrD,YAAI,QAAQ,eAAgB,OAAM,IAAI,kBAAkB,OAAO,cAAc;AAC7E,eAAO,QAAuB,YAAY,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE;AAAA,MACtF;AAAA,MACA,mBAAmB,CAAC,cAClB,aAAa,YAAY;AACvB,cAAM,QAAc,aAAa,SAAS,IAAI,EAAE,QAAQ,SAAS,CAAC;AAClE,eAAO;AAAA,MACT,CAAC;AAAA,IACL;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO,oBAAC,oBAAoB,UAApB,EAA6B,OAAe,UAAS;AAC/D;AAEO,SAAS,UAAoC;AAClD,QAAM,UAAU,WAAW,mBAAmB;AAC9C,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,kDAAkD;AAChF,SAAO;AACT;AAEO,SAAS,SAAuB;AACrC,QAAM,UAAU,QAAQ;AACxB,SAAO;AAAA,IACL,eAAe,QAAQ;AAAA,IACvB,YAAY,QAAQ;AAAA,IACpB,cAAc,QAAQ;AAAA,IACtB,wBAAwB,QAAQ;AAAA,IAChC,sBAAsB,QAAQ;AAAA,IAC9B,eAAe,QAAQ;AAAA,IACvB,oBAAoB,QAAQ;AAAA,IAC5B,oBAAoB,QAAQ;AAAA,IAC5B,oBAAoB,QAAQ;AAAA,IAC5B,eAAe,QAAQ;AAAA,EACzB;AACF;AAEO,SAAS,cAAiC;AAC/C,QAAM,UAAU,QAAQ;AACxB,SAAO;AAAA,IACL,UAAU,QAAQ;AAAA,IAClB,YAAY,QAAQ;AAAA,IACpB,mBAAmB,QAAQ;AAAA,IAC3B,iBAAiB,QAAQ;AAAA,IACzB,eAAe,QAAQ;AAAA,EACzB;AACF;AAEO,SAAS,WAA2B;AACzC,QAAM,UAAU,QAAQ;AACxB,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,SAAS,QAAQ;AAAA,IACjB,YAAY,QAAQ;AAAA,IACpB,YAAY,QAAQ;AAAA,IACpB,YAAY,QAAQ;AAAA,EACtB;AACF;AAEO,SAAS,WAA2B;AACzC,QAAM,UAAU,QAAQ;AACxB,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,SAAS,QAAQ;AAAA,IACjB,YAAY,QAAQ;AAAA,IACpB,YAAY,QAAQ;AAAA,IACpB,YAAY,QAAQ;AAAA,EACtB;AACF;AAEO,SAAS,iBAAuC;AACrD,QAAM,UAAU,QAAQ;AACxB,SAAO;AAAA,IACL,iBAAiB,QAAQ;AAAA,IACzB,kBAAkB,QAAQ;AAAA,IAC1B,kBAAkB,QAAQ;AAAA,IAC1B,kBAAkB,QAAQ;AAAA,EAC5B;AACF;AAEO,SAAS,cAAiC;AAC/C,QAAM,UAAU,QAAQ;AACxB,SAAO;AAAA,IACL,kBAAkB,QAAQ;AAAA,IAC1B,mBAAmB,QAAQ;AAAA,EAC7B;AACF;AAoCO,SAAS,oBAA6C;AAC3D,QAAM,EAAE,QAAQ,IAAI,QAAQ;AAE5B,QAAM,sBAAsB;AAAA,IAC1B,CAAC,WAA+D;AAC9D,YAAM,QAAQ,IAAI,gBAAgB,EAAE,gBAAgB,OAAO,eAAe,CAAC;AAC3E,UAAI,OAAO,cAAe,OAAM,IAAI,iBAAiB,OAAO,aAAa;AACzE,aAAO,QAA0B,qBAAqB,MAAM,SAAS,CAAC,EAAE;AAAA,IAC1E;AAAA,IACA,CAAC,OAAO;AAAA,EACV;AAEA,QAAM,uBAAuB;AAAA,IAC3B,CAAC,UACC,QAAkC,qBAAqB,EAAE,QAAQ,QAAQ,MAAM,MAAM,CAAC;AAAA,IACxF,CAAC,OAAO;AAAA,EACV;AAEA,QAAM,2BAA2B;AAAA,IAC/B,OAAO,IAAY,WAA0B;AAC3C,YAAM,QAAc,qBAAqB,EAAE,IAAI,EAAE,QAAQ,SAAS,MAAM,EAAE,OAAO,EAAE,CAAC;AAAA,IACtF;AAAA,IACA,CAAC,OAAO;AAAA,EACV;AAEA,QAAM,uBAAuB;AAAA,IAC3B,OAAO,OAAe;AACpB,YAAM,QAAc,qBAAqB,EAAE,WAAW,EAAE,QAAQ,OAAO,CAAC;AAAA,IAC1E;AAAA,IACA,CAAC,OAAO;AAAA,EACV;AAEA,QAAM,6BAA6B;AAAA,IACjC,CAAC,OACC,QAAsD,qBAAqB,EAAE,kBAAkB;AAAA,MAC7F,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,CAAC,OAAO;AAAA,EACV;AAEA,QAAM,uBAAuB;AAAA,IAC3B,OAAO,OAAe;AACpB,YAAM,QAAc,qBAAqB,EAAE,IAAI,EAAE,QAAQ,SAAS,CAAC;AAAA,IACrE;AAAA,IACA,CAAC,OAAO;AAAA,EACV;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/client.tsx"],"sourcesContent":["\"use client\";\n\nimport {\n  createContext,\n  type MouseEvent,\n  type ReactElement,\n  type ReactNode,\n  useCallback,\n  useContext,\n  useEffect,\n  useMemo,\n  useState,\n} from \"react\";\n\nexport type UserStatus = \"active\" | \"inactive\" | \"suspended\";\nexport type OrganizationStatus = \"active\" | \"inactive\" | \"suspended\";\nexport type OAuthClientType = \"public\" | \"confidential\";\n\nexport type AuthResult<T = unknown> =\n  | { success: true; data: T }\n  | { success: false; error: string; status?: number };\n\nexport type User = {\n  id: string;\n  email: string;\n  name: string | null;\n  phone: string | null;\n  imageUrl: string | null;\n  status?: UserStatus;\n  createdAt?: string | Date;\n  updatedAt?: string | Date;\n};\n\nexport type ConnectedAccount = {\n  id: string;\n  sessionId?: string;\n  isActive: boolean;\n  user: User;\n};\n\nexport type Permission = {\n  id: string;\n  applicationId?: string | null;\n  key: string;\n  name: string;\n  description: string | null;\n  category: string | null;\n  isSystem: boolean;\n  isActive: boolean;\n  createdAt?: string | Date;\n  updatedAt?: string | Date;\n};\n\nexport type RolePermission = {\n  permissionDefinition: Permission;\n};\n\nexport type Role = {\n  id: string;\n  applicationId?: string | null;\n  /** Present only on custom roles */\n  organizationId?: string | null;\n  /** \"system\" | \"custom\" */\n  type?: string;\n  key: string;\n  name: string;\n  description: string | null;\n  isSystem?: boolean;\n  isDefault?: boolean;\n  isActive: boolean;\n  permissions: RolePermission[];\n  createdAt?: string | Date;\n  updatedAt?: string | Date;\n};\n\nexport type RoleAssignment = {\n  id: string;\n  roleDefinitionId?: string | null;\n  customRoleId?: string | null;\n  roleDefinition?: Role | null;\n  customRole?: Role | null;\n};\n\nexport type OrganizationMember = {\n  id: string;\n  organizationId?: string;\n  userId?: string;\n  createdAt?: string | Date;\n  user: User;\n  roleAssignments?: RoleAssignment[];\n};\n\nexport type OrganizationOwnedApplication = {\n  id: string;\n  name: string;\n  description: string | null;\n  imageUrl: string | null;\n  type?: OAuthClientType;\n  organizationId: string;\n  isFirstParty: boolean;\n  ssoEnabled: boolean;\n  status?: \"active\" | \"inactive\" | \"suspended\";\n  createdAt?: string | Date;\n  updatedAt?: string | Date;\n};\n\nexport type Organization = {\n  id: string;\n  name: string;\n  description: string | null;\n  slug: string;\n  domain: string | null;\n  imageUrl: string | null;\n  faviconUrl: string | null;\n  status: OrganizationStatus;\n  members?: OrganizationMember[];\n  ownedApplications?: OrganizationOwnedApplication[];\n  applicationLinks?: Array<{\n    id: string;\n    status: OrganizationStatus;\n    createdAt?: string | Date;\n    application: OrganizationOwnedApplication;\n  }>;\n  createdAt: string | Date;\n  updatedAt: string | Date;\n};\n\nexport type SessionApplication = {\n  id: string;\n  createdAt: string | Date;\n  expiresAt: string | Date;\n  application: {\n    id: string;\n    name: string;\n    organizationId: string;\n  };\n};\n\nexport type UserSession = {\n  id: string;\n  userId: string;\n  organizationId: string | null;\n  deviceAgent: string | null;\n  deviceId: string | null;\n  deviceName: string | null;\n  ip: string | null;\n  authState?: unknown;\n  authTime?: string | Date;\n  expiresAt: string | Date;\n  createdAt: string | Date;\n  updatedAt: string | Date;\n  user?: User;\n  applicationSessions?: SessionApplication[];\n};\n\nexport type UserInput = {\n  name?: string | null;\n  email?: string;\n  phone?: string | null;\n  imageUrl?: string | null;\n  password?: string;\n  organizationId?: string | null;\n  status?: UserStatus;\n};\n\nexport type OrganizationInput = {\n  name: string;\n  description?: string | null;\n  slug: string;\n  domain?: string | null;\n  imageUrl?: string | null;\n  faviconUrl?: string | null;\n};\n\nexport type OrganizationUpdateInput = Partial<OrganizationInput> & {\n  status?: OrganizationStatus;\n};\n\nexport type RoleInput = {\n  organizationId: string;\n  applicationId?: string | null;\n  key: string;\n  name: string;\n  description?: string | null;\n  permissionDefinitionIds?: string[];\n};\n\nexport type RoleUpdateInput = {\n  name?: string;\n  description?: string | null;\n  isActive?: boolean;\n  permissionDefinitionIds?: string[];\n};\n\nexport type PermissionInput = {\n  applicationId?: string | null;\n  key: string;\n  name: string;\n  description?: string | null;\n  category?: string | null;\n};\n\nexport type PermissionUpdateInput = {\n  name?: string;\n  description?: string | null;\n  category?: string | null;\n  isActive?: boolean;\n};\n\nexport type SignInOptions = {\n  redirectTo?: string;\n  authorizationFlowId?: string;\n  /** When false, forces the IDP to show the login screen even if a session exists. Defaults to true (silent). */\n  silentLogin?: boolean;\n};\n\nexport type SignInInput = SignInOptions | MouseEvent<HTMLElement>;\n\nexport type CallbackUrlOptions = SignInOptions & {\n  callbackUrl?: string;\n};\n\nexport type PermissionCheckOptions = {\n  permission: string;\n  organizationId?: string | null;\n  applicationId?: string | null;\n  resourceId?: string | null;\n};\n\nexport type LoginResponse = {\n  user: User;\n  redirectTo?: string | null;\n};\n\nexport type RegisterResponse = User;\n\nexport type GeekappsAuthProviderProps = {\n  children: ReactNode;\n  basePath?: string;\n  initialUser?: User | null;\n  initialOrganizations?: Organization[];\n  initialCurrentOrgId?: string | null;\n};\n\ntype RequestOptions = {\n  body?: unknown;\n  method?: \"GET\" | \"POST\" | \"PATCH\" | \"DELETE\";\n};\n\nfunction normalizeBasePath(basePath: string) {\n  return basePath.endsWith(\"/\") ? basePath.slice(0, -1) : basePath;\n}\n\nfunction buildUrl(basePath: string, path: string) {\n  const normalizedPath = path.startsWith(\"/\") ? path : `/${path}`;\n  return `${normalizeBasePath(basePath)}${normalizedPath}`;\n}\n\nasync function parseError(response: Response) {\n  const data = await response.json().catch(() => null);\n  return (\n    data?.error_description ??\n    data?.error ??\n    data?.message ??\n    `Request failed with status ${response.status}`\n  );\n}\n\nfunction redirectTo(path: string) {\n  window.location.assign(path);\n}\n\nfunction isMouseEvent(value: unknown): value is MouseEvent<HTMLElement> {\n  return Boolean(value && typeof value === \"object\" && \"preventDefault\" in value);\n}\n\nfunction normalizeSignInOptions(input?: SignInInput): SignInOptions | undefined {\n  if (!input) return undefined;\n  if (isMouseEvent(input)) {\n    input.preventDefault();\n    return undefined;\n  }\n  return input;\n}\n\n\ntype ClientActionOptions = {\n  basePath?: string;\n};\n\nasync function clientRequest<T>(\n  path: string,\n  options: RequestOptions = {},\n  basePath = \"/api/auth\",\n): Promise<T> {\n  const response = await fetch(buildUrl(basePath, path), {\n    body: options.body === undefined ? undefined : JSON.stringify(options.body),\n    credentials: \"include\",\n    headers:\n      options.body === undefined\n        ? undefined\n        : {\n            \"content-type\": \"application/json\",\n          },\n    method: options.method ?? \"GET\",\n  });\n\n  if (!response.ok) {\n    throw new Error(await parseError(response));\n  }\n\n  if (response.status === 204) {\n    return null as T;\n  }\n\n  return (await response.json()) as T;\n}\n\nasync function toStandaloneAuthResult<T>(\n  fn: () => Promise<T>,\n): Promise<AuthResult<T>> {\n  try {\n    return {\n      success: true,\n      data: await fn(),\n    };\n  } catch (error) {\n    return {\n      success: false,\n      error: error instanceof Error ? error.message : \"Auth request failed\",\n    };\n  }\n}\n\nexport async function loginWithPassword(\n  params: {\n    identifier?: string;\n    email?: string;\n    phone?: string;\n    password: string;\n    authorizationFlowId?: string;\n    redirectTo?: string;\n  },\n  options?: ClientActionOptions,\n): Promise<AuthResult<LoginResponse>> {\n  return toStandaloneAuthResult(async () => {\n    const data = await clientRequest<LoginResponse>(\n      \"/login/password\",\n      {\n        body: params,\n        method: \"POST\",\n      },\n      options?.basePath,\n    );\n\n    if (params.redirectTo ?? data.redirectTo) {\n      redirectTo(params.redirectTo ?? data.redirectTo!);\n    }\n\n    return data;\n  });\n}\n\nexport async function registerWithPassword(\n  params: {\n    name: string;\n    email: string;\n    phone?: string;\n    imageUrl?: string;\n    address?: Record<string, unknown>;\n    password: string;\n    redirectTo?: string;\n  },\n  options?: ClientActionOptions,\n): Promise<AuthResult<RegisterResponse>> {\n  return toStandaloneAuthResult(async () => {\n    const data = await clientRequest<RegisterResponse>(\n      \"/register/password\",\n      {\n        body: params,\n        method: \"POST\",\n      },\n      options?.basePath,\n    );\n\n    if (params.redirectTo) {\n      redirectTo(params.redirectTo);\n    }\n\n    return data;\n  });\n}\n\nexport function startGoogleLogin(\n  params?: CallbackUrlOptions,\n  options?: ClientActionOptions,\n) {\n  const basePath = options?.basePath ?? \"/api/auth\";\n  const url = new URL(buildUrl(basePath, \"/login/google\"), window.location.origin);\n\n  if (params?.callbackUrl) {\n    url.searchParams.set(\"callbackUrl\", params.callbackUrl);\n  }\n\n  if (params?.redirectTo) {\n    url.searchParams.set(\"redirectTo\", params.redirectTo);\n  }\n\n  if (params?.authorizationFlowId) {\n    url.searchParams.set(\"flow_id\", params.authorizationFlowId);\n  }\n\n  redirectTo(url.toString());\n}\n\nexport async function requestPasswordlessLink(\n  params: {\n    email: string;\n    authorizationFlowId?: string;\n    redirectTo?: string;\n    callbackUrl?: string;\n  },\n  options?: ClientActionOptions,\n): Promise<AuthResult> {\n  return toStandaloneAuthResult(() =>\n    clientRequest(\n      \"/passwordless/link\",\n      {\n        body: params,\n        method: \"POST\",\n      },\n      options?.basePath,\n    ),\n  );\n}\n\nexport type GeekappsAuthContextValue = {\n  basePath: string;\n  user: User | null;\n  isAuthenticated: boolean;\n  isLoading: boolean;\n  accounts: ConnectedAccount[];\n  isLoadingAccounts: boolean;\n  organizations: Organization[];\n  currentOrg: Organization | null;\n  currentOrgId: string | null;\n  isLoadingOrganizations: boolean;\n\n  request: <T>(path: string, options?: RequestOptions) => Promise<T>;\n\n  signIn: (options?: SignInInput) => Promise<void>;\n  signUp: (options?: SignInInput) => Promise<void>;\n  addAccount: (options?: SignInInput) => Promise<void>;\n  signOut: () => Promise<void>;\n  signOutAll: () => Promise<void>;\n  refreshUser: () => Promise<void>;\n  refreshAccounts: () => Promise<void>;\n  switchAccount: (sessionId: string, options?: SignInOptions) => Promise<void>;\n\n  loginWithPassword: (params: {\n    identifier?: string;\n    email?: string;\n    phone?: string;\n    password: string;\n    authorizationFlowId?: string;\n    redirectTo?: string;\n  }) => Promise<AuthResult<LoginResponse>>;\n  registerWithPassword: (params: {\n    name: string;\n    email: string;\n    phone?: string;\n    imageUrl?: string;\n    address?: Record<string, unknown>;\n    password: string;\n    redirectTo?: string;\n  }) => Promise<AuthResult<RegisterResponse>>;\n  startGoogleLogin: (params?: CallbackUrlOptions) => void;\n  requestPasswordlessLink: (params: {\n    email: string;\n    authorizationFlowId?: string;\n    redirectTo?: string;\n    callbackUrl?: string;\n  }) => Promise<AuthResult>;\n\n  refreshOrganizations: () => Promise<void>;\n  setCurrentOrg: (organizationId: string | null) => Promise<void>;\n  createOrganization: (input: OrganizationInput) => Promise<AuthResult<Organization>>;\n  updateOrganization: (id: string, input: OrganizationUpdateInput) => Promise<AuthResult<Organization>>;\n  deleteOrganization: (id: string) => Promise<AuthResult<null>>;\n  hasPermission: (options: PermissionCheckOptions) => Promise<boolean>;\n\n  listUsers: (params?: { organizationId?: string | null }) => Promise<User[]>;\n  getUser: (id: string) => Promise<User>;\n  createUser: (input: UserInput) => Promise<AuthResult<User>>;\n  updateUser: (id: string, input: UserInput) => Promise<AuthResult<User>>;\n  deleteUser: (id: string) => Promise<AuthResult<null>>;\n\n  listRoles: (params?: { organizationId?: string; applicationId?: string; type?: \"system\" | \"custom\" | \"all\" }) => Promise<{ systemRoles: Role[]; customRoles: Role[] }>;\n  getRole: (id: string, type: \"system\" | \"custom\") => Promise<Role>;\n  createRole: (input: RoleInput) => Promise<AuthResult<Role>>;\n  updateRole: (id: string, input: RoleUpdateInput) => Promise<AuthResult<Role>>;\n  deleteRole: (id: string) => Promise<AuthResult<null>>;\n\n  listPermissions: (params?: { applicationId?: string; roleId?: string | null }) => Promise<Permission[]>;\n  createPermission: (input: PermissionInput) => Promise<AuthResult<Permission>>;\n  updatePermission: (id: string, input: PermissionUpdateInput) => Promise<AuthResult<Permission>>;\n  deletePermission: (id: string) => Promise<AuthResult<null>>;\n\n  listUserSessions: (params?: { userId?: string; organizationId?: string | null }) => Promise<UserSession[]>;\n  revokeUserSession: (sessionId: string) => Promise<AuthResult<null>>;\n};\n\nexport type UseOrgResult = Pick<\n  GeekappsAuthContextValue,\n  | \"organizations\"\n  | \"currentOrg\"\n  | \"currentOrgId\"\n  | \"isLoadingOrganizations\"\n  | \"refreshOrganizations\"\n  | \"setCurrentOrg\"\n  | \"createOrganization\"\n  | \"updateOrganization\"\n  | \"deleteOrganization\"\n  | \"hasPermission\"\n>;\n\nexport type UseAccountsResult = Pick<\n  GeekappsAuthContextValue,\n  \"accounts\" | \"addAccount\" | \"isLoadingAccounts\" | \"refreshAccounts\" | \"switchAccount\"\n>;\n\nexport type UseUsersResult = Pick<\n  GeekappsAuthContextValue,\n  \"listUsers\" | \"getUser\" | \"createUser\" | \"updateUser\" | \"deleteUser\"\n>;\n\nexport type UseRolesResult = Pick<\n  GeekappsAuthContextValue,\n  \"listRoles\" | \"getRole\" | \"createRole\" | \"updateRole\" | \"deleteRole\"\n>;\n\nexport type UsePermissionsResult = Pick<\n  GeekappsAuthContextValue,\n  \"listPermissions\" | \"createPermission\" | \"updatePermission\" | \"deletePermission\"\n>;\n\nexport type UseSessionsResult = Pick<\n  GeekappsAuthContextValue,\n  \"listUserSessions\" | \"revokeUserSession\"\n>;\n\nconst GeekappsAuthContext = createContext<GeekappsAuthContextValue | null>(null);\n\nexport function GeekappsAuthProvider({\n  children,\n  basePath = \"/api/auth\",\n  initialUser = null,\n  initialOrganizations = [],\n  initialCurrentOrgId = null,\n}: GeekappsAuthProviderProps): ReactElement {\n  const [user, setUser] = useState<User | null>(initialUser);\n  const [isLoading, setIsLoading] = useState(true);\n  const [accounts, setAccounts] = useState<ConnectedAccount[]>([]);\n  const [isLoadingAccounts, setIsLoadingAccounts] = useState(true);\n  const [organizations, setOrganizations] = useState<Organization[]>(initialOrganizations);\n  const [currentOrgId, setCurrentOrgId] = useState<string | null>(initialCurrentOrgId);\n  const [isLoadingOrganizations, setIsLoadingOrganizations] = useState(true);\n\n  const request = useCallback(\n    async <T,>(path: string, options: RequestOptions = {}) => {\n      const response = await fetch(buildUrl(basePath, path), {\n        method: options.method ?? \"GET\",\n        credentials: \"include\",\n        headers:\n          options.body === undefined\n            ? undefined\n            : {\n                \"content-type\": \"application/json\",\n              },\n        body: options.body === undefined ? undefined : JSON.stringify(options.body),\n      });\n\n      if (!response.ok) {\n        throw new Error(await parseError(response));\n      }\n\n      if (response.status === 204) {\n        return null as T;\n      }\n\n      return (await response.json()) as T;\n    },\n    [basePath],\n  );\n\n  const refreshUser = useCallback(async () => {\n    setIsLoading(true);\n    try {\n      const { user: u } = await request<{ user: User | null }>(\"/me\");\n      setUser(u);\n    } catch {\n      setUser(null);\n    } finally {\n      setIsLoading(false);\n    }\n  }, []);\n\n  const refreshAccounts = useCallback(async () => {\n    setIsLoadingAccounts(true);\n    try {\n      const { accounts: a } = await request<{ accounts: ConnectedAccount[] }>(\n        \"/accounts\",\n      );\n      setAccounts(a);\n    } catch {\n      setAccounts([]);\n    } finally {\n      setIsLoadingAccounts(false);\n    }\n  }, []);\n\n  const refreshOrganizations = useCallback(async () => {\n    setIsLoadingOrganizations(true);\n    try {\n      const { organizations: orgs, currentOrgId: nextCurrentOrgId } =\n        await request<{\n          organizations: Organization[];\n          currentOrgId?: string | null;\n        }>(\"/organizations\");\n      setOrganizations(orgs);\n      setCurrentOrgId((current) => {\n        if (nextCurrentOrgId !== undefined) return nextCurrentOrgId ?? null;\n        if (current && orgs.some((org) => org.id === current)) return current;\n        return orgs[0]?.id ?? null;\n      });\n    } catch {\n      setOrganizations([]);\n      setCurrentOrgId(null);\n    } finally {\n      setIsLoadingOrganizations(false);\n    }\n  }, []);\n\n  useEffect(() => {\n    void refreshUser();\n    void refreshAccounts();\n    void refreshOrganizations();\n  }, [refreshAccounts, refreshOrganizations, refreshUser]);\n\n  const currentOrg = useMemo(\n    () => organizations.find((organization) => organization.id === currentOrgId) ?? null,\n    [currentOrgId, organizations],\n  );\n\n  const setCurrentOrg = useCallback(\n    async (organizationId: string | null) => {\n      await request(\"/organizations/active\", {\n        method: \"POST\",\n        body: { organizationId },\n      });\n      setCurrentOrgId(organizationId);\n    },\n    [request],\n  );\n\n  const signIn = useCallback(\n    async (input?: SignInInput) => {\n      const options = normalizeSignInOptions(input);\n      const url = new URL(buildUrl(basePath, \"/sign-in\"), window.location.origin);\n      if (options?.redirectTo) url.searchParams.set(\"redirectTo\", options.redirectTo);\n      if (options?.authorizationFlowId) url.searchParams.set(\"flow_id\", options.authorizationFlowId);\n      if (options?.silentLogin === false) url.searchParams.set(\"silentLogin\", \"false\");\n      redirectTo(url.toString());\n    },\n    [basePath],\n  );\n\n  const signUp = useCallback(\n    async (input?: SignInInput) => {\n      const options = normalizeSignInOptions(input);\n      const url = new URL(buildUrl(basePath, \"/sign-up\"), window.location.origin);\n      if (options?.redirectTo) url.searchParams.set(\"redirectTo\", options.redirectTo);\n      if (options?.authorizationFlowId) url.searchParams.set(\"flow_id\", options.authorizationFlowId);\n      if (options?.silentLogin === false) url.searchParams.set(\"silentLogin\", \"false\");\n      redirectTo(url.toString());\n    },\n    [basePath],\n  );\n\n  const addAccount = useCallback(\n    async (input?: SignInInput) => {\n      const options = normalizeSignInOptions(input);\n      const url = new URL(buildUrl(basePath, \"/add-account\"), window.location.origin);\n      if (options?.redirectTo) url.searchParams.set(\"redirectTo\", options.redirectTo);\n      redirectTo(url.toString());\n    },\n    [basePath],\n  );\n\n  const signOut = useCallback(async () => {\n    await request(\"/sign-out\", { method: \"POST\" });\n    setUser(null);\n    await refreshAccounts();\n  }, [refreshAccounts, request]);\n\n  const signOutAll = useCallback(async () => {\n    await request(\"/sign-out-all\", { method: \"POST\" });\n    setUser(null);\n    setAccounts([]);\n  }, [request]);\n\n  const switchAccount = useCallback(\n    async (sessionId: string, options?: SignInOptions) => {\n      await request(\"/accounts/switch\", {\n        method: \"POST\",\n        body: { sessionId },\n      });\n      await Promise.all([refreshUser(), refreshAccounts(), refreshOrganizations()]);\n      if (options?.redirectTo) redirectTo(options.redirectTo);\n    },\n    [refreshAccounts, refreshOrganizations, refreshUser, request],\n  );\n\n  async function toAuthResult<T>(fn: () => Promise<T>): Promise<AuthResult<T>> {\n    try {\n      return { success: true, data: await fn() };\n    } catch (error) {\n      return { success: false, error: error instanceof Error ? error.message : \"Unexpected error\" };\n    }\n  }\n\n  const value = useMemo<GeekappsAuthContextValue>(\n    () => ({\n      basePath,\n      user,\n      isAuthenticated: !isLoading && user !== null,\n      isLoading,\n      accounts,\n      isLoadingAccounts,\n      organizations,\n      currentOrg,\n      currentOrgId,\n      isLoadingOrganizations,\n      request,\n      signIn,\n      signUp,\n      addAccount,\n      signOut,\n      signOutAll,\n      refreshUser,\n      refreshAccounts,\n      switchAccount,\n      loginWithPassword: (params) =>\n        toAuthResult(async () => {\n          const data = await request<LoginResponse>(\"/login/password\", { method: \"POST\", body: params });\n          await Promise.all([refreshUser(), refreshAccounts(), refreshOrganizations()]);\n          if (params.redirectTo ?? data.redirectTo) redirectTo(params.redirectTo ?? data.redirectTo!);\n          return data;\n        }),\n      registerWithPassword: (params) =>\n        toAuthResult(async () => {\n          const data = await request<RegisterResponse>(\"/register/password\", { method: \"POST\", body: params });\n          await Promise.all([refreshUser(), refreshAccounts(), refreshOrganizations()]);\n          if (params.redirectTo) redirectTo(params.redirectTo);\n          return data;\n        }),\n      startGoogleLogin: (params) => {\n        const url = new URL(buildUrl(basePath, \"/login/google\"), window.location.origin);\n        if (params?.callbackUrl) url.searchParams.set(\"callbackUrl\", params.callbackUrl);\n        if (params?.redirectTo) url.searchParams.set(\"redirectTo\", params.redirectTo);\n        if (params?.authorizationFlowId) url.searchParams.set(\"flow_id\", params.authorizationFlowId);\n        redirectTo(url.toString());\n      },\n      requestPasswordlessLink: (params) =>\n        toAuthResult(() => request(\"/passwordless/link\", { method: \"POST\", body: params })),\n      refreshOrganizations,\n      setCurrentOrg,\n      createOrganization: (input) =>\n        toAuthResult(async () => {\n          const organization = await request<Organization>(\"/organizations\", { method: \"POST\", body: input });\n          await refreshOrganizations();\n          setCurrentOrgId(organization.id);\n          return organization;\n        }),\n      updateOrganization: (id, input) =>\n        toAuthResult(async () => {\n          const organization = await request<Organization>(`/organizations/${id}`, { method: \"PATCH\", body: input });\n          await refreshOrganizations();\n          return organization;\n        }),\n      deleteOrganization: (id) =>\n        toAuthResult(async () => {\n          await request<null>(`/organizations/${id}`, { method: \"DELETE\" });\n          await refreshOrganizations();\n          return null;\n        }),\n      hasPermission: async (options) => {\n        try {\n          const data = await request<{ allowed: boolean }>(\"/permissions/check\", {\n            method: \"POST\",\n            body: options,\n          });\n          return data.allowed;\n        } catch {\n          return false;\n        }\n      },\n      listUsers: (params) => {\n        const query = new URLSearchParams();\n        if (params?.organizationId) query.set(\"organizationId\", params.organizationId);\n        return request<User[]>(`/users${query.size ? `?${query.toString()}` : \"\"}`);\n      },\n      getUser: (id) => request<User>(`/users/${id}`),\n      createUser: (input) => toAuthResult(() => request<User>(\"/users\", { method: \"POST\", body: input })),\n      updateUser: (id, input) => toAuthResult(() => request<User>(`/users/${id}`, { method: \"PATCH\", body: input })),\n      deleteUser: (id) =>\n        toAuthResult(async () => {\n          await request<null>(`/users/${id}`, { method: \"DELETE\" });\n          return null;\n        }),\n      listRoles: (params) => {\n        const query = new URLSearchParams();\n        if (params?.organizationId) query.set(\"organizationId\", params.organizationId);\n        if (params?.applicationId) query.set(\"applicationId\", params.applicationId);\n        if (params?.type) query.set(\"type\", params.type);\n        return request<{ systemRoles: Role[]; customRoles: Role[] }>(`/roles${query.size ? `?${query.toString()}` : \"\"}`);\n      },\n      getRole: (id, type) => request<Role>(type === \"custom\" ? `/roles/custom/${id}` : `/roles/definitions/${id}`),\n      createRole: (input) => toAuthResult(() => request<Role>(\"/roles\", { method: \"POST\", body: input })),\n      updateRole: (id, input) => toAuthResult(() => request<Role>(`/roles/custom/${id}`, { method: \"PATCH\", body: input })),\n      deleteRole: (id) =>\n        toAuthResult(async () => {\n          await request<null>(`/roles/custom/${id}`, { method: \"DELETE\" });\n          return null;\n        }),\n      listPermissions: (params) => {\n        const query = new URLSearchParams();\n        if (params?.applicationId) query.set(\"applicationId\", params.applicationId);\n        if (params?.roleId) query.set(\"roleId\", params.roleId);\n        return request<Permission[]>(`/permissions${query.size ? `?${query.toString()}` : \"\"}`);\n      },\n      createPermission: (input) =>\n        toAuthResult(() => request<Permission>(\"/permissions\", { method: \"POST\", body: input })),\n      updatePermission: (id, input) =>\n        toAuthResult(() => request<Permission>(`/permissions/${id}`, { method: \"PATCH\", body: input })),\n      deletePermission: (id) =>\n        toAuthResult(async () => {\n          await request<null>(`/permissions/${id}`, { method: \"DELETE\" });\n          return null;\n        }),\n      listUserSessions: (params) => {\n        const query = new URLSearchParams();\n        if (params?.userId) query.set(\"userId\", params.userId);\n        if (params?.organizationId) query.set(\"organizationId\", params.organizationId);\n        return request<UserSession[]>(`/sessions${query.size ? `?${query.toString()}` : \"\"}`);\n      },\n      revokeUserSession: (sessionId) =>\n        toAuthResult(async () => {\n          await request<null>(`/sessions/${sessionId}`, { method: \"DELETE\" });\n          return null;\n        }),\n    }),\n    [\n      accounts,\n      addAccount,\n      basePath,\n      currentOrg,\n      currentOrgId,\n      isLoading,\n      isLoadingAccounts,\n      isLoadingOrganizations,\n      organizations,\n      refreshAccounts,\n      refreshOrganizations,\n      refreshUser,\n      request,\n      setCurrentOrg,\n      signIn,\n      signOut,\n      signOutAll,\n      signUp,\n      switchAccount,\n      user,\n    ],\n  );\n\n  return <GeekappsAuthContext.Provider value={value}>{children}</GeekappsAuthContext.Provider>;\n}\n\nexport function useAuth(): GeekappsAuthContextValue {\n  const context = useContext(GeekappsAuthContext);\n  if (!context) throw new Error(\"useAuth must be used inside GeekappsAuthProvider\");\n  return context;\n}\n\nexport function useOrg(): UseOrgResult {\n  const context = useAuth();\n  return {\n    organizations: context.organizations,\n    currentOrg: context.currentOrg,\n    currentOrgId: context.currentOrgId,\n    isLoadingOrganizations: context.isLoadingOrganizations,\n    refreshOrganizations: context.refreshOrganizations,\n    setCurrentOrg: context.setCurrentOrg,\n    createOrganization: context.createOrganization,\n    updateOrganization: context.updateOrganization,\n    deleteOrganization: context.deleteOrganization,\n    hasPermission: context.hasPermission,\n  };\n}\n\nexport function useAccounts(): UseAccountsResult {\n  const context = useAuth();\n  return {\n    accounts: context.accounts,\n    addAccount: context.addAccount,\n    isLoadingAccounts: context.isLoadingAccounts,\n    refreshAccounts: context.refreshAccounts,\n    switchAccount: context.switchAccount,\n  };\n}\n\nexport function useUsers(): UseUsersResult {\n  const context = useAuth();\n  return {\n    listUsers: context.listUsers,\n    getUser: context.getUser,\n    createUser: context.createUser,\n    updateUser: context.updateUser,\n    deleteUser: context.deleteUser,\n  };\n}\n\nexport function useRoles(): UseRolesResult {\n  const context = useAuth();\n  return {\n    listRoles: context.listRoles,\n    getRole: context.getRole,\n    createRole: context.createRole,\n    updateRole: context.updateRole,\n    deleteRole: context.deleteRole,\n  };\n}\n\nexport function usePermissions(): UsePermissionsResult {\n  const context = useAuth();\n  return {\n    listPermissions: context.listPermissions,\n    createPermission: context.createPermission,\n    updatePermission: context.updatePermission,\n    deletePermission: context.deletePermission,\n  };\n}\n\nexport function useSessions(): UseSessionsResult {\n  const context = useAuth();\n  return {\n    listUserSessions: context.listUserSessions,\n    revokeUserSession: context.revokeUserSession,\n  };\n}\n\n// ── Service Accounts ─────────────────────────────────────────────────────────\n\nexport type ServiceAccount = {\n  id: string;\n  membershipId: string;\n  organizationId: string;\n  applicationId: string | null;\n  name: string;\n  status: \"active\" | \"inactive\" | \"suspended\";\n  serviceId: string | null;\n  roleAssignment: { role: { id: string; key: string; name: string } } | null;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type ServiceAccountWithSecret = ServiceAccount & { serviceSecret: string };\n\nexport type CreateServiceAccountInput = {\n  organizationId: string;\n  applicationId?: string;\n  name: string;\n  description?: string;\n  roleId?: string;\n};\n\nexport type UseServiceAccountResult = {\n  listServiceAccounts: (params: { organizationId: string; applicationId?: string }) => Promise<ServiceAccount[]>;\n  createServiceAccount: (input: CreateServiceAccountInput) => Promise<ServiceAccountWithSecret>;\n  updateServiceAccountRole: (id: string, roleId: string | null) => Promise<void>;\n  revokeServiceAccount: (id: string) => Promise<void>;\n  rotateServiceAccountSecret: (id: string) => Promise<{ serviceId: string; serviceSecret: string }>;\n  deleteServiceAccount: (id: string) => Promise<void>;\n};\n\nexport function useServiceAccount(): UseServiceAccountResult {\n  const { request } = useAuth();\n\n  const listServiceAccounts = useCallback(\n    (params: { organizationId: string; applicationId?: string }) => {\n      const query = new URLSearchParams({ organizationId: params.organizationId });\n      if (params.applicationId) query.set(\"applicationId\", params.applicationId);\n      return request<ServiceAccount[]>(`/service-accounts?${query.toString()}`);\n    },\n    [request],\n  );\n\n  const createServiceAccount = useCallback(\n    (input: CreateServiceAccountInput) =>\n      request<ServiceAccountWithSecret>(\"/service-accounts\", { method: \"POST\", body: input }),\n    [request],\n  );\n\n  const updateServiceAccountRole = useCallback(\n    async (id: string, roleId: string | null) => {\n      await request<void>(`/service-accounts/${id}`, { method: \"PATCH\", body: { roleId } });\n    },\n    [request],\n  );\n\n  const revokeServiceAccount = useCallback(\n    async (id: string) => {\n      await request<void>(`/service-accounts/${id}/revoke`, { method: \"POST\" });\n    },\n    [request],\n  );\n\n  const rotateServiceAccountSecret = useCallback(\n    (id: string) =>\n      request<{ serviceId: string; serviceSecret: string }>(`/service-accounts/${id}/rotate-secret`, {\n        method: \"POST\",\n      }),\n    [request],\n  );\n\n  const deleteServiceAccount = useCallback(\n    async (id: string) => {\n      await request<null>(`/service-accounts/${id}`, { method: \"DELETE\" });\n    },\n    [request],\n  );\n\n  return {\n    listServiceAccounts,\n    createServiceAccount,\n    updateServiceAccountRole,\n    revokeServiceAccount,\n    rotateServiceAccountSecret,\n    deleteServiceAccount,\n  };\n}\n"],"mappings":";;;AAEA;AAAA,EACE;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA02BE;AA7nBT,SAAS,kBAAkB,UAAkB;AAC3C,SAAO,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;AAC1D;AAEA,SAAS,SAAS,UAAkB,MAAc;AAChD,QAAM,iBAAiB,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AAC7D,SAAO,GAAG,kBAAkB,QAAQ,CAAC,GAAG,cAAc;AACxD;AAEA,eAAe,WAAW,UAAoB;AAC5C,QAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACnD,SACE,MAAM,qBACN,MAAM,SACN,MAAM,WACN,8BAA8B,SAAS,MAAM;AAEjD;AAEA,SAAS,WAAW,MAAc;AAChC,SAAO,SAAS,OAAO,IAAI;AAC7B;AAEA,SAAS,aAAa,OAAkD;AACtE,SAAO,QAAQ,SAAS,OAAO,UAAU,YAAY,oBAAoB,KAAK;AAChF;AAEA,SAAS,uBAAuB,OAAgD;AAC9E,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,aAAa,KAAK,GAAG;AACvB,UAAM,eAAe;AACrB,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOA,eAAe,cACb,MACA,UAA0B,CAAC,GAC3B,WAAW,aACC;AACZ,QAAM,WAAW,MAAM,MAAM,SAAS,UAAU,IAAI,GAAG;AAAA,IACrD,MAAM,QAAQ,SAAS,SAAY,SAAY,KAAK,UAAU,QAAQ,IAAI;AAAA,IAC1E,aAAa;AAAA,IACb,SACE,QAAQ,SAAS,SACb,SACA;AAAA,MACE,gBAAgB;AAAA,IAClB;AAAA,IACN,QAAQ,QAAQ,UAAU;AAAA,EAC5B,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,MAAM,MAAM,WAAW,QAAQ,CAAC;AAAA,EAC5C;AAEA,MAAI,SAAS,WAAW,KAAK;AAC3B,WAAO;AAAA,EACT;AAEA,SAAQ,MAAM,SAAS,KAAK;AAC9B;AAEA,eAAe,uBACb,IACwB;AACxB,MAAI;AACF,WAAO;AAAA,MACL,SAAS;AAAA,MACT,MAAM,MAAM,GAAG;AAAA,IACjB;AAAA,EACF,SAAS,OAAO;AACd,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD;AAAA,EACF;AACF;AAEA,eAAsB,kBACpB,QAQA,SACoC;AACpC,SAAO,uBAAuB,YAAY;AACxC,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,QAAQ;AAAA,MACV;AAAA,MACA,SAAS;AAAA,IACX;AAEA,QAAI,OAAO,cAAc,KAAK,YAAY;AACxC,iBAAW,OAAO,cAAc,KAAK,UAAW;AAAA,IAClD;AAEA,WAAO;AAAA,EACT,CAAC;AACH;AAEA,eAAsB,qBACpB,QASA,SACuC;AACvC,SAAO,uBAAuB,YAAY;AACxC,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,QAAQ;AAAA,MACV;AAAA,MACA,SAAS;AAAA,IACX;AAEA,QAAI,OAAO,YAAY;AACrB,iBAAW,OAAO,UAAU;AAAA,IAC9B;AAEA,WAAO;AAAA,EACT,CAAC;AACH;AAEO,SAAS,iBACd,QACA,SACA;AACA,QAAM,WAAW,SAAS,YAAY;AACtC,QAAM,MAAM,IAAI,IAAI,SAAS,UAAU,eAAe,GAAG,OAAO,SAAS,MAAM;AAE/E,MAAI,QAAQ,aAAa;AACvB,QAAI,aAAa,IAAI,eAAe,OAAO,WAAW;AAAA,EACxD;AAEA,MAAI,QAAQ,YAAY;AACtB,QAAI,aAAa,IAAI,cAAc,OAAO,UAAU;AAAA,EACtD;AAEA,MAAI,QAAQ,qBAAqB;AAC/B,QAAI,aAAa,IAAI,WAAW,OAAO,mBAAmB;AAAA,EAC5D;AAEA,aAAW,IAAI,SAAS,CAAC;AAC3B;AAEA,eAAsB,wBACpB,QAMA,SACqB;AACrB,SAAO;AAAA,IAAuB,MAC5B;AAAA,MACE;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,QAAQ;AAAA,MACV;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAqHA,IAAM,sBAAsB,cAA+C,IAAI;AAExE,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA,WAAW;AAAA,EACX,cAAc;AAAA,EACd,uBAAuB,CAAC;AAAA,EACxB,sBAAsB;AACxB,GAA4C;AAC1C,QAAM,CAAC,MAAM,OAAO,IAAI,SAAsB,WAAW;AACzD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAC/C,QAAM,CAAC,UAAU,WAAW,IAAI,SAA6B,CAAC,CAAC;AAC/D,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,SAAS,IAAI;AAC/D,QAAM,CAAC,eAAe,gBAAgB,IAAI,SAAyB,oBAAoB;AACvF,QAAM,CAAC,cAAc,eAAe,IAAI,SAAwB,mBAAmB;AACnF,QAAM,CAAC,wBAAwB,yBAAyB,IAAI,SAAS,IAAI;AAEzE,QAAM,UAAU;AAAA,IACd,OAAW,MAAc,UAA0B,CAAC,MAAM;AACxD,YAAM,WAAW,MAAM,MAAM,SAAS,UAAU,IAAI,GAAG;AAAA,QACrD,QAAQ,QAAQ,UAAU;AAAA,QAC1B,aAAa;AAAA,QACb,SACE,QAAQ,SAAS,SACb,SACA;AAAA,UACE,gBAAgB;AAAA,QAClB;AAAA,QACN,MAAM,QAAQ,SAAS,SAAY,SAAY,KAAK,UAAU,QAAQ,IAAI;AAAA,MAC5E,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,IAAI,MAAM,MAAM,WAAW,QAAQ,CAAC;AAAA,MAC5C;AAEA,UAAI,SAAS,WAAW,KAAK;AAC3B,eAAO;AAAA,MACT;AAEA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,cAAc,YAAY,YAAY;AAC1C,iBAAa,IAAI;AACjB,QAAI;AACF,YAAM,EAAE,MAAM,EAAE,IAAI,MAAM,QAA+B,KAAK;AAC9D,cAAQ,CAAC;AAAA,IACX,QAAQ;AACN,cAAQ,IAAI;AAAA,IACd,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,kBAAkB,YAAY,YAAY;AAC9C,yBAAqB,IAAI;AACzB,QAAI;AACF,YAAM,EAAE,UAAU,EAAE,IAAI,MAAM;AAAA,QAC5B;AAAA,MACF;AACA,kBAAY,CAAC;AAAA,IACf,QAAQ;AACN,kBAAY,CAAC,CAAC;AAAA,IAChB,UAAE;AACA,2BAAqB,KAAK;AAAA,IAC5B;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,uBAAuB,YAAY,YAAY;AACnD,8BAA0B,IAAI;AAC9B,QAAI;AACF,YAAM,EAAE,eAAe,MAAM,cAAc,iBAAiB,IAC1D,MAAM,QAGH,gBAAgB;AACrB,uBAAiB,IAAI;AACrB,sBAAgB,CAAC,YAAY;AAC3B,YAAI,qBAAqB,OAAW,QAAO,oBAAoB;AAC/D,YAAI,WAAW,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,OAAO,EAAG,QAAO;AAC9D,eAAO,KAAK,CAAC,GAAG,MAAM;AAAA,MACxB,CAAC;AAAA,IACH,QAAQ;AACN,uBAAiB,CAAC,CAAC;AACnB,sBAAgB,IAAI;AAAA,IACtB,UAAE;AACA,gCAA0B,KAAK;AAAA,IACjC;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,YAAU,MAAM;AACd,SAAK,YAAY;AACjB,SAAK,gBAAgB;AACrB,SAAK,qBAAqB;AAAA,EAC5B,GAAG,CAAC,iBAAiB,sBAAsB,WAAW,CAAC;AAEvD,QAAM,aAAa;AAAA,IACjB,MAAM,cAAc,KAAK,CAAC,iBAAiB,aAAa,OAAO,YAAY,KAAK;AAAA,IAChF,CAAC,cAAc,aAAa;AAAA,EAC9B;AAEA,QAAM,gBAAgB;AAAA,IACpB,OAAO,mBAAkC;AACvC,YAAM,QAAQ,yBAAyB;AAAA,QACrC,QAAQ;AAAA,QACR,MAAM,EAAE,eAAe;AAAA,MACzB,CAAC;AACD,sBAAgB,cAAc;AAAA,IAChC;AAAA,IACA,CAAC,OAAO;AAAA,EACV;AAEA,QAAM,SAAS;AAAA,IACb,OAAO,UAAwB;AAC7B,YAAM,UAAU,uBAAuB,KAAK;AAC5C,YAAM,MAAM,IAAI,IAAI,SAAS,UAAU,UAAU,GAAG,OAAO,SAAS,MAAM;AAC1E,UAAI,SAAS,WAAY,KAAI,aAAa,IAAI,cAAc,QAAQ,UAAU;AAC9E,UAAI,SAAS,oBAAqB,KAAI,aAAa,IAAI,WAAW,QAAQ,mBAAmB;AAC7F,UAAI,SAAS,gBAAgB,MAAO,KAAI,aAAa,IAAI,eAAe,OAAO;AAC/E,iBAAW,IAAI,SAAS,CAAC;AAAA,IAC3B;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,SAAS;AAAA,IACb,OAAO,UAAwB;AAC7B,YAAM,UAAU,uBAAuB,KAAK;AAC5C,YAAM,MAAM,IAAI,IAAI,SAAS,UAAU,UAAU,GAAG,OAAO,SAAS,MAAM;AAC1E,UAAI,SAAS,WAAY,KAAI,aAAa,IAAI,cAAc,QAAQ,UAAU;AAC9E,UAAI,SAAS,oBAAqB,KAAI,aAAa,IAAI,WAAW,QAAQ,mBAAmB;AAC7F,UAAI,SAAS,gBAAgB,MAAO,KAAI,aAAa,IAAI,eAAe,OAAO;AAC/E,iBAAW,IAAI,SAAS,CAAC;AAAA,IAC3B;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,aAAa;AAAA,IACjB,OAAO,UAAwB;AAC7B,YAAM,UAAU,uBAAuB,KAAK;AAC5C,YAAM,MAAM,IAAI,IAAI,SAAS,UAAU,cAAc,GAAG,OAAO,SAAS,MAAM;AAC9E,UAAI,SAAS,WAAY,KAAI,aAAa,IAAI,cAAc,QAAQ,UAAU;AAC9E,iBAAW,IAAI,SAAS,CAAC;AAAA,IAC3B;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,UAAU,YAAY,YAAY;AACtC,UAAM,QAAQ,aAAa,EAAE,QAAQ,OAAO,CAAC;AAC7C,YAAQ,IAAI;AACZ,UAAM,gBAAgB;AAAA,EACxB,GAAG,CAAC,iBAAiB,OAAO,CAAC;AAE7B,QAAM,aAAa,YAAY,YAAY;AACzC,UAAM,QAAQ,iBAAiB,EAAE,QAAQ,OAAO,CAAC;AACjD,YAAQ,IAAI;AACZ,gBAAY,CAAC,CAAC;AAAA,EAChB,GAAG,CAAC,OAAO,CAAC;AAEZ,QAAM,gBAAgB;AAAA,IACpB,OAAO,WAAmB,YAA4B;AACpD,YAAM,QAAQ,oBAAoB;AAAA,QAChC,QAAQ;AAAA,QACR,MAAM,EAAE,UAAU;AAAA,MACpB,CAAC;AACD,YAAM,QAAQ,IAAI,CAAC,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,CAAC,CAAC;AAC5E,UAAI,SAAS,WAAY,YAAW,QAAQ,UAAU;AAAA,IACxD;AAAA,IACA,CAAC,iBAAiB,sBAAsB,aAAa,OAAO;AAAA,EAC9D;AAEA,iBAAe,aAAgB,IAA8C;AAC3E,QAAI;AACF,aAAO,EAAE,SAAS,MAAM,MAAM,MAAM,GAAG,EAAE;AAAA,IAC3C,SAAS,OAAO;AACd,aAAO,EAAE,SAAS,OAAO,OAAO,iBAAiB,QAAQ,MAAM,UAAU,mBAAmB;AAAA,IAC9F;AAAA,EACF;AAEA,QAAM,QAAQ;AAAA,IACZ,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,iBAAiB,CAAC,aAAa,SAAS;AAAA,MACxC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,mBAAmB,CAAC,WAClB,aAAa,YAAY;AACvB,cAAM,OAAO,MAAM,QAAuB,mBAAmB,EAAE,QAAQ,QAAQ,MAAM,OAAO,CAAC;AAC7F,cAAM,QAAQ,IAAI,CAAC,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,CAAC,CAAC;AAC5E,YAAI,OAAO,cAAc,KAAK,WAAY,YAAW,OAAO,cAAc,KAAK,UAAW;AAC1F,eAAO;AAAA,MACT,CAAC;AAAA,MACH,sBAAsB,CAAC,WACrB,aAAa,YAAY;AACvB,cAAM,OAAO,MAAM,QAA0B,sBAAsB,EAAE,QAAQ,QAAQ,MAAM,OAAO,CAAC;AACnG,cAAM,QAAQ,IAAI,CAAC,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,CAAC,CAAC;AAC5E,YAAI,OAAO,WAAY,YAAW,OAAO,UAAU;AACnD,eAAO;AAAA,MACT,CAAC;AAAA,MACH,kBAAkB,CAAC,WAAW;AAC5B,cAAM,MAAM,IAAI,IAAI,SAAS,UAAU,eAAe,GAAG,OAAO,SAAS,MAAM;AAC/E,YAAI,QAAQ,YAAa,KAAI,aAAa,IAAI,eAAe,OAAO,WAAW;AAC/E,YAAI,QAAQ,WAAY,KAAI,aAAa,IAAI,cAAc,OAAO,UAAU;AAC5E,YAAI,QAAQ,oBAAqB,KAAI,aAAa,IAAI,WAAW,OAAO,mBAAmB;AAC3F,mBAAW,IAAI,SAAS,CAAC;AAAA,MAC3B;AAAA,MACA,yBAAyB,CAAC,WACxB,aAAa,MAAM,QAAQ,sBAAsB,EAAE,QAAQ,QAAQ,MAAM,OAAO,CAAC,CAAC;AAAA,MACpF;AAAA,MACA;AAAA,MACA,oBAAoB,CAAC,UACnB,aAAa,YAAY;AACvB,cAAM,eAAe,MAAM,QAAsB,kBAAkB,EAAE,QAAQ,QAAQ,MAAM,MAAM,CAAC;AAClG,cAAM,qBAAqB;AAC3B,wBAAgB,aAAa,EAAE;AAC/B,eAAO;AAAA,MACT,CAAC;AAAA,MACH,oBAAoB,CAAC,IAAI,UACvB,aAAa,YAAY;AACvB,cAAM,eAAe,MAAM,QAAsB,kBAAkB,EAAE,IAAI,EAAE,QAAQ,SAAS,MAAM,MAAM,CAAC;AACzG,cAAM,qBAAqB;AAC3B,eAAO;AAAA,MACT,CAAC;AAAA,MACH,oBAAoB,CAAC,OACnB,aAAa,YAAY;AACvB,cAAM,QAAc,kBAAkB,EAAE,IAAI,EAAE,QAAQ,SAAS,CAAC;AAChE,cAAM,qBAAqB;AAC3B,eAAO;AAAA,MACT,CAAC;AAAA,MACH,eAAe,OAAO,YAAY;AAChC,YAAI;AACF,gBAAM,OAAO,MAAM,QAA8B,sBAAsB;AAAA,YACrE,QAAQ;AAAA,YACR,MAAM;AAAA,UACR,CAAC;AACD,iBAAO,KAAK;AAAA,QACd,QAAQ;AACN,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,MACA,WAAW,CAAC,WAAW;AACrB,cAAM,QAAQ,IAAI,gBAAgB;AAClC,YAAI,QAAQ,eAAgB,OAAM,IAAI,kBAAkB,OAAO,cAAc;AAC7E,eAAO,QAAgB,SAAS,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE;AAAA,MAC5E;AAAA,MACA,SAAS,CAAC,OAAO,QAAc,UAAU,EAAE,EAAE;AAAA,MAC7C,YAAY,CAAC,UAAU,aAAa,MAAM,QAAc,UAAU,EAAE,QAAQ,QAAQ,MAAM,MAAM,CAAC,CAAC;AAAA,MAClG,YAAY,CAAC,IAAI,UAAU,aAAa,MAAM,QAAc,UAAU,EAAE,IAAI,EAAE,QAAQ,SAAS,MAAM,MAAM,CAAC,CAAC;AAAA,MAC7G,YAAY,CAAC,OACX,aAAa,YAAY;AACvB,cAAM,QAAc,UAAU,EAAE,IAAI,EAAE,QAAQ,SAAS,CAAC;AACxD,eAAO;AAAA,MACT,CAAC;AAAA,MACH,WAAW,CAAC,WAAW;AACrB,cAAM,QAAQ,IAAI,gBAAgB;AAClC,YAAI,QAAQ,eAAgB,OAAM,IAAI,kBAAkB,OAAO,cAAc;AAC7E,YAAI,QAAQ,cAAe,OAAM,IAAI,iBAAiB,OAAO,aAAa;AAC1E,YAAI,QAAQ,KAAM,OAAM,IAAI,QAAQ,OAAO,IAAI;AAC/C,eAAO,QAAsD,SAAS,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE;AAAA,MAClH;AAAA,MACA,SAAS,CAAC,IAAI,SAAS,QAAc,SAAS,WAAW,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,EAAE;AAAA,MAC3G,YAAY,CAAC,UAAU,aAAa,MAAM,QAAc,UAAU,EAAE,QAAQ,QAAQ,MAAM,MAAM,CAAC,CAAC;AAAA,MAClG,YAAY,CAAC,IAAI,UAAU,aAAa,MAAM,QAAc,iBAAiB,EAAE,IAAI,EAAE,QAAQ,SAAS,MAAM,MAAM,CAAC,CAAC;AAAA,MACpH,YAAY,CAAC,OACX,aAAa,YAAY;AACvB,cAAM,QAAc,iBAAiB,EAAE,IAAI,EAAE,QAAQ,SAAS,CAAC;AAC/D,eAAO;AAAA,MACT,CAAC;AAAA,MACH,iBAAiB,CAAC,WAAW;AAC3B,cAAM,QAAQ,IAAI,gBAAgB;AAClC,YAAI,QAAQ,cAAe,OAAM,IAAI,iBAAiB,OAAO,aAAa;AAC1E,YAAI,QAAQ,OAAQ,OAAM,IAAI,UAAU,OAAO,MAAM;AACrD,eAAO,QAAsB,eAAe,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE;AAAA,MACxF;AAAA,MACA,kBAAkB,CAAC,UACjB,aAAa,MAAM,QAAoB,gBAAgB,EAAE,QAAQ,QAAQ,MAAM,MAAM,CAAC,CAAC;AAAA,MACzF,kBAAkB,CAAC,IAAI,UACrB,aAAa,MAAM,QAAoB,gBAAgB,EAAE,IAAI,EAAE,QAAQ,SAAS,MAAM,MAAM,CAAC,CAAC;AAAA,MAChG,kBAAkB,CAAC,OACjB,aAAa,YAAY;AACvB,cAAM,QAAc,gBAAgB,EAAE,IAAI,EAAE,QAAQ,SAAS,CAAC;AAC9D,eAAO;AAAA,MACT,CAAC;AAAA,MACH,kBAAkB,CAAC,WAAW;AAC5B,cAAM,QAAQ,IAAI,gBAAgB;AAClC,YAAI,QAAQ,OAAQ,OAAM,IAAI,UAAU,OAAO,MAAM;AACrD,YAAI,QAAQ,eAAgB,OAAM,IAAI,kBAAkB,OAAO,cAAc;AAC7E,eAAO,QAAuB,YAAY,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE;AAAA,MACtF;AAAA,MACA,mBAAmB,CAAC,cAClB,aAAa,YAAY;AACvB,cAAM,QAAc,aAAa,SAAS,IAAI,EAAE,QAAQ,SAAS,CAAC;AAClE,eAAO;AAAA,MACT,CAAC;AAAA,IACL;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO,oBAAC,oBAAoB,UAApB,EAA6B,OAAe,UAAS;AAC/D;AAEO,SAAS,UAAoC;AAClD,QAAM,UAAU,WAAW,mBAAmB;AAC9C,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,kDAAkD;AAChF,SAAO;AACT;AAEO,SAAS,SAAuB;AACrC,QAAM,UAAU,QAAQ;AACxB,SAAO;AAAA,IACL,eAAe,QAAQ;AAAA,IACvB,YAAY,QAAQ;AAAA,IACpB,cAAc,QAAQ;AAAA,IACtB,wBAAwB,QAAQ;AAAA,IAChC,sBAAsB,QAAQ;AAAA,IAC9B,eAAe,QAAQ;AAAA,IACvB,oBAAoB,QAAQ;AAAA,IAC5B,oBAAoB,QAAQ;AAAA,IAC5B,oBAAoB,QAAQ;AAAA,IAC5B,eAAe,QAAQ;AAAA,EACzB;AACF;AAEO,SAAS,cAAiC;AAC/C,QAAM,UAAU,QAAQ;AACxB,SAAO;AAAA,IACL,UAAU,QAAQ;AAAA,IAClB,YAAY,QAAQ;AAAA,IACpB,mBAAmB,QAAQ;AAAA,IAC3B,iBAAiB,QAAQ;AAAA,IACzB,eAAe,QAAQ;AAAA,EACzB;AACF;AAEO,SAAS,WAA2B;AACzC,QAAM,UAAU,QAAQ;AACxB,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,SAAS,QAAQ;AAAA,IACjB,YAAY,QAAQ;AAAA,IACpB,YAAY,QAAQ;AAAA,IACpB,YAAY,QAAQ;AAAA,EACtB;AACF;AAEO,SAAS,WAA2B;AACzC,QAAM,UAAU,QAAQ;AACxB,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,SAAS,QAAQ;AAAA,IACjB,YAAY,QAAQ;AAAA,IACpB,YAAY,QAAQ;AAAA,IACpB,YAAY,QAAQ;AAAA,EACtB;AACF;AAEO,SAAS,iBAAuC;AACrD,QAAM,UAAU,QAAQ;AACxB,SAAO;AAAA,IACL,iBAAiB,QAAQ;AAAA,IACzB,kBAAkB,QAAQ;AAAA,IAC1B,kBAAkB,QAAQ;AAAA,IAC1B,kBAAkB,QAAQ;AAAA,EAC5B;AACF;AAEO,SAAS,cAAiC;AAC/C,QAAM,UAAU,QAAQ;AACxB,SAAO;AAAA,IACL,kBAAkB,QAAQ;AAAA,IAC1B,mBAAmB,QAAQ;AAAA,EAC7B;AACF;AAoCO,SAAS,oBAA6C;AAC3D,QAAM,EAAE,QAAQ,IAAI,QAAQ;AAE5B,QAAM,sBAAsB;AAAA,IAC1B,CAAC,WAA+D;AAC9D,YAAM,QAAQ,IAAI,gBAAgB,EAAE,gBAAgB,OAAO,eAAe,CAAC;AAC3E,UAAI,OAAO,cAAe,OAAM,IAAI,iBAAiB,OAAO,aAAa;AACzE,aAAO,QAA0B,qBAAqB,MAAM,SAAS,CAAC,EAAE;AAAA,IAC1E;AAAA,IACA,CAAC,OAAO;AAAA,EACV;AAEA,QAAM,uBAAuB;AAAA,IAC3B,CAAC,UACC,QAAkC,qBAAqB,EAAE,QAAQ,QAAQ,MAAM,MAAM,CAAC;AAAA,IACxF,CAAC,OAAO;AAAA,EACV;AAEA,QAAM,2BAA2B;AAAA,IAC/B,OAAO,IAAY,WAA0B;AAC3C,YAAM,QAAc,qBAAqB,EAAE,IAAI,EAAE,QAAQ,SAAS,MAAM,EAAE,OAAO,EAAE,CAAC;AAAA,IACtF;AAAA,IACA,CAAC,OAAO;AAAA,EACV;AAEA,QAAM,uBAAuB;AAAA,IAC3B,OAAO,OAAe;AACpB,YAAM,QAAc,qBAAqB,EAAE,WAAW,EAAE,QAAQ,OAAO,CAAC;AAAA,IAC1E;AAAA,IACA,CAAC,OAAO;AAAA,EACV;AAEA,QAAM,6BAA6B;AAAA,IACjC,CAAC,OACC,QAAsD,qBAAqB,EAAE,kBAAkB;AAAA,MAC7F,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,CAAC,OAAO;AAAA,EACV;AAEA,QAAM,uBAAuB;AAAA,IAC3B,OAAO,OAAe;AACpB,YAAM,QAAc,qBAAqB,EAAE,IAAI,EAAE,QAAQ,SAAS,CAAC;AAAA,IACrE;AAAA,IACA,CAAC,OAAO;AAAA,EACV;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/server.d.ts

@@ -94,6 +94,7 @@ declare function configureGeekappsAuth(input?: GeekappsAuthConfig): {
     SaveSession: (tokens: SessionTokens) => Promise<void>;
     GetAccessToken: () => Promise<string | null>;
     GetRefreshToken: () => Promise<string | null>;
+    IsAuthenticated: () => Promise<boolean>;
     TryRefreshTokens: () => Promise<string | null>;
     RequireUser: (options?: {
         redirectTo?: string;
@@ -109,5 +110,10 @@ declare function handlers(options?: GeekappsAuthConfig): {
     PATCH: (request: NextRequest) => Promise<NextResponse<any>>;
     DELETE: (request: NextRequest) => Promise<NextResponse<any>>;
 };
+/**
+ * Returns true if the current request has a valid access token in cookies.
+ * Safe to call in Server Components, Server Actions, and Route Handlers.
+ */
+declare function isAuthenticated(options?: GeekappsAuthConfig): Promise<boolean>;
 
-export { type GeekappsAuthConfig, type ServerAuthApiClient, type SessionTokens, type StoredAccount, configureGeekappsAuth, getServiceAccountToken, handlers, verifyToken };
+export { type GeekappsAuthConfig, type ServerAuthApiClient, type SessionTokens, type StoredAccount, configureGeekappsAuth, getServiceAccountToken, handlers, isAuthenticated, verifyToken };

package/dist/server.js

@@ -530,7 +530,12 @@ function configureGeekappsAuth(input = {}) {
     url.searchParams.set("scope", scopes.join(" "));
     url.searchParams.set("state", Buffer.from(JSON.stringify({ redirectTo, mode })).toString("base64url"));
     if (mode === "register") url.searchParams.set("screen_hint", "signup");
-    if (mode === "add-account") url.searchParams.set("prompt", "login");
+    if (mode === "add-account") {
+      url.searchParams.set("prompt", "login");
+    } else {
+      const silentLogin = request.nextUrl.searchParams.get("silentLogin");
+      if (silentLogin === "false") url.searchParams.set("prompt", "login");
+    }
     if (flowId) url.searchParams.set("flow_id", flowId);
     return NextResponse.redirect(url);
   }
@@ -742,6 +747,7 @@ function configureGeekappsAuth(input = {}) {
     SaveSession: saveAccountToList,
     GetAccessToken: getAccessToken,
     GetRefreshToken: getRefreshToken,
+    IsAuthenticated: async () => await getAccessToken() !== null,
     TryRefreshTokens: tryRefreshTokens,
     RequireUser: requireUser,
     CreateAuthApiClient: createApiClient,
@@ -760,10 +766,15 @@ function configureGeekappsAuth(input = {}) {
 function handlers(options) {
   return configureGeekappsAuth(options).handlers;
 }
+async function isAuthenticated(options) {
+  const { GetAccessToken } = configureGeekappsAuth(options);
+  return await GetAccessToken() !== null;
+}
 export {
   configureGeekappsAuth,
   getServiceAccountToken,
   handlers,
+  isAuthenticated,
   verifyToken
 };
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server.ts"],"sourcesContent":["import { cookies, headers } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport { NextResponse, type NextRequest } from \"next/server\";\nimport { createRemoteJWKSet, jwtVerify, type JWTPayload } from \"jose\";\n\nexport type GeekappsAuthConfig = {\n  /**\n   * Auth API/issuer URL. Optional when GEEKAPPS_AUTH_ISSUER or\n   * GEEKAPPS_AUTH_API_URL is defined.\n   */\n  issuer?: string;\n\n  /**\n   * OAuth client id. Optional when GEEKAPPS_AUTH_CLIENT_ID is defined.\n   */\n  clientId?: string;\n\n  /**\n   * OAuth client secret for confidential clients. Optional when\n   * GEEKAPPS_AUTH_CLIENT_SECRET is defined.\n   */\n  clientSecret?: string;\n\n  /**\n   * Callback URL. Optional when GEEKAPPS_AUTH_REDIRECT_URI is defined.\n   * If omitted, it is inferred from the current request origin + basePath/callback.\n   */\n  redirectUri?: string;\n\n  scopes?: string[];\n  basePath?: string;\n  /**\n   * @deprecated cookiePrefix is now auto-derived from clientId.\n   * This field is kept for backwards compatibility but is ignored.\n   */\n  cookiePrefix?: string;\n  secureCookies?: boolean;\n\n  /**\n   * Friendly alias used by apps. Same as afterSignInRedirectTo.\n   */\n  redirectTo?: string;\n\n  afterSignInRedirectTo?: string;\n  afterSignOutRedirectTo?: string;\n};\n\ntype ResolvedGeekappsAuthConfig = GeekappsAuthConfig & {\n  issuer: string;\n  clientId: string;\n  basePath: string;\n  cookiePrefix: string;\n};\n\nexport type SessionTokens = {\n  accessToken: string | null;\n  refreshToken: string | null;\n  idToken: string | null;\n  sessionId: string | null;\n};\n\nexport type StoredAccount = {\n  /** Stable identifier — `sub` from id_token or fallback to sessionId. */\n  id: string;\n  accessToken: string;\n  refreshToken: string | null;\n  idToken: string | null;\n  sessionId: string | null;\n  user: {\n    sub: string;\n    name?: string | null;\n    email?: string | null;\n    picture?: string | null;\n    phone?: string | null;\n  };\n};\n\nexport type ServerAuthApiClient = {\n  get: <T>(path: string) => Promise<T>;\n  post: <T>(path: string, body?: unknown) => Promise<T>;\n  patch: <T>(path: string, body?: unknown) => Promise<T>;\n  put: <T>(path: string, body?: unknown) => Promise<T>;\n  delete: <T>(path: string) => Promise<T>;\n};\n\ntype JsonObject = Record<string, unknown>;\n\ntype TokenLikeResponse = JsonObject & {\n  access_token?: string;\n  accessToken?: string;\n  refresh_token?: string;\n  refreshToken?: string;\n  id_token?: string;\n  idToken?: string;\n  session_id?: string;\n  sessionId?: string;\n  tokens?: {\n    access_token?: string;\n    accessToken?: string;\n    refresh_token?: string;\n    refreshToken?: string;\n    id_token?: string;\n    idToken?: string;\n    session_id?: string;\n    sessionId?: string;\n  };\n};\n\nconst MAX_ACCOUNTS = 8;\n\nfunction normalizeBaseUrl(url: string) {\n  return url.replace(/\\/$/, \"\");\n}\n\nfunction normalizeBasePath(path = \"/api/auth\") {\n  if (!path.startsWith(\"/\")) return `/${path}`;\n  return path.replace(/\\/$/, \"\");\n}\n\nfunction createUrl(baseUrl: string, path: string) {\n  if (/^https?:\\/\\//.test(path)) return path;\n  const normalizedPath = path.startsWith(\"/\") ? path : `/${path}`;\n  return `${normalizeBaseUrl(baseUrl)}${normalizedPath}`;\n}\n\nfunction env(name: string) {\n  const value = process.env[name];\n  return value && value.trim().length > 0 ? value : undefined;\n}\n\nfunction resolveIssuer(input: GeekappsAuthConfig) {\n  return normalizeBaseUrl(\n    input.issuer ??\n      env(\"GEEKAPPS_AUTH_ISSUER\") ??\n      env(\"GEEKAPPS_AUTH_API_URL\") ??\n      \"http://localhost:3020\",\n  );\n}\n\nfunction resolveClientId(input: GeekappsAuthConfig) {\n  return input.clientId ?? env(\"GEEKAPPS_AUTH_CLIENT_ID\") ?? \"\";\n}\n\nfunction resolveClientSecret(input: GeekappsAuthConfig) {\n  return input.clientSecret ?? env(\"GEEKAPPS_AUTH_CLIENT_SECRET\");\n}\n\nfunction applyClientCredentials(url: URL, config: ResolvedGeekappsAuthConfig) {\n  if (!config.clientId || !config.clientSecret) return;\n  url.searchParams.set(\"client_id\", config.clientId);\n  url.searchParams.set(\"client_secret\", config.clientSecret);\n}\n\nfunction resolveConfiguredRedirectUri(input: GeekappsAuthConfig) {\n  return input.redirectUri ?? env(\"GEEKAPPS_AUTH_REDIRECT_URI\");\n}\n\n/**\n * Derives a short stable 8-char hex hash from a clientId string.\n * Uses a simple djb2-style hash — no crypto dependency needed.\n */\nfunction hashClientId(clientId: string): string {\n  let h = 5381;\n  for (let i = 0; i < clientId.length; i++) {\n    h = ((h << 5) + h) ^ (clientId.charCodeAt(i) & 0xff);\n    h = h >>> 0; // keep unsigned 32-bit\n  }\n  return h.toString(16).padStart(8, \"0\");\n}\n\n/**\n * Auto-derives the cookie prefix from clientId.\n * Format: `gk_{8-char-hash}` — guaranteed unique per OAuth client.\n * Falls back to `gk` when clientId is empty (dev/test environments).\n */\nfunction deriveCookiePrefix(clientId: string): string {\n  if (!clientId) return \"gk\";\n  return `gk_${hashClientId(clientId)}`;\n}\n\nfunction requestOrigin(request: NextRequest) {\n  const configured = env(\"GEEKAPPS_APP_URL\");\n  if (configured) return configured.replace(/\\/$/, \"\");\n\n  throw new Error(\n    \"Cannot determine app origin. Set GEEKAPPS_APP_URL.\",\n  );\n}\n\nfunction resolveRedirectUri(config: ResolvedGeekappsAuthConfig, request: NextRequest) {\n  return config.redirectUri ?? `${requestOrigin(request)}${config.basePath}/callback`;\n}\n\nfunction tokenFromResponse(data: TokenLikeResponse): SessionTokens {\n  return {\n    accessToken: data.accessToken ?? data.access_token ?? data.tokens?.accessToken ?? data.tokens?.access_token ?? null,\n    refreshToken:\n      data.refreshToken ?? data.refresh_token ?? data.tokens?.refreshToken ?? data.tokens?.refresh_token ?? null,\n    idToken: data.idToken ?? data.id_token ?? data.tokens?.idToken ?? data.tokens?.id_token ?? null,\n    sessionId: data.sessionId ?? data.session_id ?? data.tokens?.sessionId ?? data.tokens?.session_id ?? null,\n  };\n}\n\n/** Decode a JWT payload without verifying signature (safe for client-visible claims). */\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split(\".\");\n    if (parts.length < 2) return null;\n    const payload = parts[1];\n    if (!payload) return null;\n    return JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf8\")) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nfunction parseAccountFromJwt(tokens: SessionTokens): StoredAccount | null {\n  if (!tokens.accessToken) return null;\n\n  const jwtToParse = tokens.idToken ?? tokens.accessToken;\n  const payload = decodeJwtPayload(jwtToParse);\n  if (!payload) return null;\n\n  const sub = typeof payload.sub === \"string\" ? payload.sub : null;\n  const id = sub ?? tokens.sessionId;\n  if (!id) return null;\n\n  return {\n    id,\n    accessToken: tokens.accessToken,\n    refreshToken: tokens.refreshToken,\n    idToken: tokens.idToken ?? null,\n    sessionId: tokens.sessionId,\n    user: {\n      sub: id,\n      name: typeof payload.name === \"string\" ? payload.name : null,\n      email: typeof payload.email === \"string\" ? payload.email : null,\n      picture: typeof payload.picture === \"string\" ? payload.picture : null,\n      phone: typeof payload.phone_number === \"string\" ? payload.phone_number : null,\n    },\n  };\n}\n\n/**\n * Cookie name scheme — 3 cookies per slot, each well under 4096 bytes:\n *\n *   {prefix}_m{n}   — metadata blob (base64url JSON): { id, sid?, n?, e?, p? }\n *                     Claims extracted from id_token at login. Never stores tokens.\n *   {prefix}_at{n}  — access token (httpOnly). ~1-2 KB.\n *   {prefix}_rt{n}  — refresh token (httpOnly). ~1 KB.\n *   {prefix}_active — active slot index (\"1\", \"2\", …)\n *   {prefix}_count  — total stored slots\n *   {prefix}_ao     — active org id for this app\n *   {prefix}_tp     — non-httpOnly copy of active access token for client-side axios\n *\n * id_token is NOT stored in cookies — claims are extracted at login and cached in\n * the metadata cookie. This is the key size saving.\n */\nfunction getCookieNames(prefix: string) {\n  return {\n    active: `${prefix}_active`,\n    count: `${prefix}_count`,\n    activeOrganizationId: `${prefix}_ao`,\n    tokenPub: `${prefix}_tp`,\n    slotMeta: (n: number) => `${prefix}_m${n}`,\n    slotAt: (n: number) => `${prefix}_at${n}`,\n    slotRt: (n: number) => `${prefix}_rt${n}`,\n  };\n}\n\ntype SlotMeta = {\n  id: string;\n  sid?: string;\n  n?: string;\n  e?: string;\n  p?: string;\n};\n\nfunction encodeMeta(account: StoredAccount): string {\n  const m: SlotMeta = { id: account.id };\n  if (account.sessionId) m.sid = account.sessionId;\n  if (account.user.name) m.n = account.user.name;\n  if (account.user.email) m.e = account.user.email;\n  if (account.user.picture) m.p = account.user.picture;\n  return Buffer.from(JSON.stringify(m), \"utf8\").toString(\"base64url\");\n}\n\nfunction decodeMeta(value: string): SlotMeta | null {\n  try {\n    const m = JSON.parse(Buffer.from(value, \"base64url\").toString(\"utf8\")) as SlotMeta;\n    return m.id ? m : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction getCookieOptions(config: ResolvedGeekappsAuthConfig) {\n  return {\n    httpOnly: true,\n    secure: config.secureCookies ?? process.env.NODE_ENV === \"production\",\n    sameSite: \"lax\" as const,\n    path: \"/\",\n  };\n}\n\nasync function readBody(request: NextRequest) {\n  const text = await request.text();\n  if (!text) return undefined;\n  try {\n    return JSON.parse(text);\n  } catch {\n    return text;\n  }\n}\n\nfunction appendSearchParams(url: string, request: NextRequest) {\n  const target = new URL(url);\n  request.nextUrl.searchParams.forEach((value, key) => {\n    target.searchParams.set(key, value);\n  });\n  return target.toString();\n}\n\nfunction routeFromRequest(request: NextRequest, basePath: string) {\n  const pathname = request.nextUrl.pathname;\n  if (!pathname.startsWith(basePath)) return pathname;\n  const route = pathname.slice(basePath.length);\n  return route || \"/\";\n}\n\nfunction isJsonResponse(response: Response) {\n  return response.headers.get(\"content-type\")?.includes(\"application/json\");\n}\n\nasync function responseFromApi(response: Response) {\n  if (response.status === 204) return new NextResponse(null, { status: 204 });\n  const body = isJsonResponse(response) ? await response.json().catch(() => null) : await response.text();\n  return NextResponse.json(body, { status: response.status });\n}\n\nconst _remoteJWKSCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\ntype ServiceTokenCache = { token: string; expiresAt: number };\nconst _serviceTokenCache = new Map<string, ServiceTokenCache>();\n\nasync function fetchServiceToken(issuer: string, clientId: string, clientSecret: string): Promise<string | null> {\n  const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString(\"base64\");\n  try {\n    const res = await fetch(createUrl(issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${credentials}`,\n      },\n      body: \"grant_type=service_account\",\n      cache: \"no-store\",\n    });\n    if (!res.ok) return null;\n    const data = (await res.json()) as { access_token?: string };\n    return data.access_token ?? null;\n  } catch {\n    return null;\n  }\n}\n\nasync function getServiceToken(issuer: string, clientId: string, clientSecret: string): Promise<string | null> {\n  const key = `${issuer}:${clientId}`;\n  const now = Date.now();\n  const cached = _serviceTokenCache.get(key);\n  if (cached && cached.expiresAt - 30_000 > now) return cached.token;\n  const token = await fetchServiceToken(issuer, clientId, clientSecret);\n  if (!token) return null;\n  _serviceTokenCache.set(key, { token, expiresAt: now + 420_000 });\n  return token;\n}\n\ntype ServiceAccountConfig = {\n  issuer?: string;\n  clientId?: string;\n  clientSecret?: string;\n};\n\n/**\n * Returns a service account access token.\n * Reads GEEKAPPS_AUTH_ISSUER, GEEKAPPS_SERVICE_ACCOUNT_CLIENT_ID,\n * GEEKAPPS_SERVICE_ACCOUNT_CLIENT_SECRET by default.\n * Any field can be overridden via the optional config argument.\n * Tokens are cached per client and auto-renewed before expiry (~7 min TTL).\n */\nexport function getServiceAccountToken(override: ServiceAccountConfig = {}): Promise<string | null> {\n  const issuer = normalizeBaseUrl(\n    override.issuer ??\n      env(\"GEEKAPPS_AUTH_ISSUER\") ??\n      env(\"GEEKAPPS_AUTH_API_URL\") ??\n      \"http://localhost:3020\",\n  );\n  const clientId = override.clientId ?? env(\"GEEKAPPS_SERVICE_ACCOUNT_CLIENT_ID\") ?? \"\";\n  const clientSecret = override.clientSecret ?? env(\"GEEKAPPS_SERVICE_ACCOUNT_CLIENT_SECRET\") ?? \"\";\n  if (!clientId || !clientSecret) return Promise.resolve(null);\n  return getServiceToken(issuer, clientId, clientSecret);\n}\n\nfunction getRemoteJWKS(issuer: string) {\n  if (!_remoteJWKSCache.has(issuer)) {\n    _remoteJWKSCache.set(issuer, createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`)));\n  }\n  return _remoteJWKSCache.get(issuer)!;\n}\n\nexport async function verifyToken(\n  token: string,\n  issuer: string,\n): Promise<JWTPayload | null> {\n  try {\n    const { payload } = await jwtVerify(token, getRemoteJWKS(issuer), {\n      algorithms: [\"RS256\"],\n      issuer,\n    });\n    return payload;\n  } catch {\n    return null;\n  }\n}\n\nexport function configureGeekappsAuth(input: GeekappsAuthConfig = {}) {\n  const clientId = resolveClientId(input);\n  const config: ResolvedGeekappsAuthConfig = {\n    ...input,\n    issuer: resolveIssuer(input),\n    clientId,\n    clientSecret: resolveClientSecret(input),\n    redirectUri: resolveConfiguredRedirectUri(input),\n    afterSignInRedirectTo:\n      input.afterSignInRedirectTo ?? input.redirectTo ?? \"/\",\n    basePath: normalizeBasePath(input.basePath),\n    cookiePrefix: deriveCookiePrefix(clientId),\n  };\n\n  const cn = getCookieNames(config.cookiePrefix);\n\n  // ── Slot helpers ──────────────────────────────────────────────────────────\n\n  async function getCount(): Promise<number> {\n    const cookieStore = await cookies();\n    const raw = cookieStore.get(cn.count)?.value;\n    const n = raw ? Number.parseInt(raw, 10) : 0;\n    return Number.isNaN(n) ? 0 : n;\n  }\n\n  async function getActiveIndex(): Promise<number> {\n    const cookieStore = await cookies();\n    const raw = cookieStore.get(cn.active)?.value;\n    if (!raw) return 0;\n    const n = Number.parseInt(raw, 10);\n    return Number.isNaN(n) ? 0 : n;\n  }\n\n  function readSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n  ): StoredAccount | null {\n    const at = cookieStore.get(cn.slotAt(n))?.value;\n    if (!at) return null;\n    const meta = decodeMeta(cookieStore.get(cn.slotMeta(n))?.value ?? \"\");\n    if (!meta) return null;\n    return {\n      id: meta.id,\n      accessToken: at,\n      refreshToken: cookieStore.get(cn.slotRt(n))?.value ?? null,\n      idToken: null, // not stored in cookies; claims are in meta\n      sessionId: meta.sid ?? null,\n      user: {\n        sub: meta.id,\n        name: meta.n ?? null,\n        email: meta.e ?? null,\n        picture: meta.p ?? null,\n      },\n    };\n  }\n\n  function writeSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n    account: StoredAccount,\n  ) {\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    cookieStore.set(cn.slotMeta(n), encodeMeta(account), opts);\n    cookieStore.set(cn.slotAt(n), account.accessToken, opts);\n    if (account.refreshToken) cookieStore.set(cn.slotRt(n), account.refreshToken, opts);\n  }\n\n  function clearSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n  ) {\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n    cookieStore.set(cn.slotMeta(n), \"\", clear);\n    cookieStore.set(cn.slotAt(n), \"\", clear);\n    cookieStore.set(cn.slotRt(n), \"\", clear);\n  }\n\n  // ── Public account helpers ─────────────────────────────────────────────────\n\n  async function getAccountsList(): Promise<StoredAccount[]> {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const accounts: StoredAccount[] = [];\n    for (let i = 1; i <= count; i++) {\n      const slot = readSlot(cookieStore, i);\n      if (slot) accounts.push(slot);\n    }\n    return accounts;\n  }\n\n  async function getActiveAccount(): Promise<StoredAccount | null> {\n    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);\n    if (count === 0) return null;\n    if (activeIdx >= 1 && activeIdx <= count) {\n      const slot = readSlot(cookieStore, activeIdx);\n      if (slot) return slot;\n    }\n    // Fall back to slot 1\n    return readSlot(cookieStore, 1);\n  }\n\n  async function getAccessToken() {\n    // Prefer the token injected by the middleware via request header (same-request refresh)\n    try {\n      const hdrs = await headers();\n      const auth = hdrs.get(\"authorization\");\n      if (auth?.startsWith(\"Bearer \")) return auth.slice(7);\n    } catch {}\n    const active = await getActiveAccount();\n    return active?.accessToken ?? null;\n  }\n\n  async function getRefreshToken() {\n    const active = await getActiveAccount();\n    return active?.refreshToken ?? null;\n  }\n\n  async function getSession(): Promise<SessionTokens | null> {\n    const active = await getActiveAccount();\n    if (!active) return null;\n    return {\n      accessToken: active.accessToken,\n      refreshToken: active.refreshToken,\n      idToken: active.idToken,\n      sessionId: active.sessionId,\n    };\n  }\n\n  async function getUser(): Promise<StoredAccount[\"user\"] | null> {\n    const active = await getActiveAccount();\n    return active?.user ?? null;\n  }\n\n  async function getOrganizations(): Promise<{ organizations: unknown[]; currentOrgId: string | null }> {\n    const cookieStore = await cookies();\n    const currentOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;\n    try {\n      const data = await apiRequest<unknown[] | { organizations: unknown[] }>(\"/organizations\");\n      const organizations = Array.isArray(data) ? data : (data as { organizations: unknown[] }).organizations;\n      return { organizations, currentOrgId };\n    } catch {\n      return { organizations: [], currentOrgId };\n    }\n  }\n\n  function clearPublicTokenCookie(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n  ) {\n    // Clear legacy _tp cookie if present\n    if (cookieStore.get(cn.tokenPub)?.value) {\n      cookieStore.set(cn.tokenPub, \"\", { httpOnly: false, maxAge: 0, path: \"/\" });\n    }\n  }\n\n  async function saveAccountToList(tokens: SessionTokens) {\n    const account = parseAccountFromJwt(tokens);\n    if (!account) return;\n\n    const cookieStore = await cookies();\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    const count = await getCount();\n\n    // Find existing slot for this account id\n    let targetSlot = 0;\n    for (let i = 1; i <= count; i++) {\n      const existing = readSlot(cookieStore, i);\n      if (existing?.id === account.id) {\n        targetSlot = i;\n        break;\n      }\n    }\n\n    if (targetSlot === 0) {\n      if (count >= MAX_ACCOUNTS) return;\n      targetSlot = count + 1;\n      cookieStore.set(cn.count, String(targetSlot), opts);\n    }\n\n    writeSlot(cookieStore, targetSlot, account);\n    cookieStore.set(cn.active, String(targetSlot), opts);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  // Alias for backwards compat\n  const setSessionCookies = saveAccountToList;\n\n  async function switchAccount(accountId: string): Promise<boolean> {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n\n    for (let i = 1; i <= count; i++) {\n      const slot = readSlot(cookieStore, i);\n      if (slot && (slot.id === accountId || slot.sessionId === accountId)) {\n        cookieStore.set(cn.active, String(i), opts);\n        clearPublicTokenCookie(cookieStore);\n        return true;\n      }\n    }\n    return false;\n  }\n\n  async function removeActiveAccount() {\n    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n\n    if (count === 0) return;\n\n    const remaining: StoredAccount[] = [];\n    for (let i = 1; i <= count; i++) {\n      if (i === activeIdx) continue;\n      const slot = readSlot(cookieStore, i);\n      if (slot) remaining.push(slot);\n    }\n\n    for (let i = 1; i <= count; i++) {\n      clearSlot(cookieStore, i);\n    }\n\n    if (remaining.length === 0) {\n      cookieStore.set(cn.count, \"0\", clear);\n      cookieStore.set(cn.active, \"0\", clear);\n      await clearPublicTokenCookie(cookieStore);\n      return;\n    }\n\n    // Re-compact remaining accounts into slots 1..n\n    for (let i = 0; i < remaining.length; i++) {\n      await writeSlot(cookieStore, i + 1, remaining[i]!);\n    }\n    cookieStore.set(cn.count, String(remaining.length), opts);\n    cookieStore.set(cn.active, \"1\", opts);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  async function clearAllSessionCookies() {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n    for (let i = 1; i <= count; i++) {\n      clearSlot(cookieStore, i);\n    }\n    cookieStore.set(cn.count, \"0\", clear);\n    cookieStore.set(cn.active, \"0\", clear);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  async function tryRefreshTokens(): Promise<string | null> {\n    const refreshToken = await getRefreshToken();\n    if (!refreshToken || !config.clientId) return null;\n\n    const basicAuth = Buffer.from(`${config.clientId}:${config.clientSecret ?? \"\"}`).toString(\"base64\");\n\n    const response = await fetch(createUrl(config.issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${basicAuth}`,\n      },\n      body: new URLSearchParams({\n        grant_type: \"refresh_token\",\n        refresh_token: refreshToken,\n      }),\n      cache: \"no-store\",\n    });\n\n    if (!response.ok) return null;\n\n    const data = (await response.json().catch(() => null)) as TokenLikeResponse | null;\n    if (!data) return null;\n\n    const tokens = tokenFromResponse(data);\n    if (!tokens.accessToken) return null;\n\n    await saveAccountToList(tokens);\n    return tokens.accessToken;\n  }\n\n  async function apiRequest<T>(path: string, init: RequestInit = {}): Promise<T> {\n    const accessToken = await getAccessToken();\n    const requestHeaders = new Headers(init.headers);\n\n    if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n    if (init.body !== undefined && !requestHeaders.has(\"content-type\")) {\n      requestHeaders.set(\"content-type\", \"application/json\");\n    }\n\n    const url = new URL(createUrl(config.issuer, path));\n    applyClientCredentials(url, config);\n\n    const response = await fetch(url, {\n      ...init,\n      headers: requestHeaders,\n      cache: \"no-store\",\n    });\n\n    if (response.status === 401) {\n      const newAccessToken = await tryRefreshTokens();\n      if (newAccessToken) {\n        const retryHeaders = new Headers(init.headers);\n        retryHeaders.set(\"authorization\", `Bearer ${newAccessToken}`);\n        if (init.body !== undefined && !retryHeaders.has(\"content-type\")) {\n          retryHeaders.set(\"content-type\", \"application/json\");\n        }\n        const retryUrl = new URL(createUrl(config.issuer, path));\n        applyClientCredentials(retryUrl, config);\n        const retryResponse = await fetch(retryUrl, {\n          ...init,\n          headers: retryHeaders,\n          cache: \"no-store\",\n        });\n        if (!retryResponse.ok) {\n          const error = await retryResponse.json().catch(() => null);\n          throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${retryResponse.status}`);\n        }\n        if (retryResponse.status === 204) return null as T;\n        return (await retryResponse.json()) as T;\n      }\n    }\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => null);\n      throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${response.status}`);\n    }\n\n    if (response.status === 204) return null as T;\n    return (await response.json()) as T;\n  }\n\n  function createApiClient(): ServerAuthApiClient {\n    return {\n      get: (path) => apiRequest(path),\n      post: (path, body) => apiRequest(path, { method: \"POST\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      patch: (path, body) => apiRequest(path, { method: \"PATCH\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      put: (path, body) => apiRequest(path, { method: \"PUT\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      delete: (path) => apiRequest(path, { method: \"DELETE\" }),\n    };\n  }\n\n  async function requireUser(options: { redirectTo?: string } = {}) {\n    const accessToken = await getAccessToken();\n    if (!accessToken) {\n      redirect(options.redirectTo ?? \"/\");\n    }\n    return accessToken;\n  }\n\n  function escapeHtml(str: string): string {\n    return str.replace(/&/g, \"&amp;\").replace(/</g, \"&lt;\").replace(/>/g, \"&gt;\").replace(/\"/g, \"&quot;\");\n  }\n\n  function sanitizeRedirectTo(value: string | null | undefined): string {\n    const raw = value ?? \"/\";\n    // Never redirect back into the auth basePath — that would loop or replay a stale code.\n    if (raw.startsWith(config.basePath)) return \"/\";\n    // Only allow relative paths to prevent open-redirect.\n    if (raw.startsWith(\"/\") && !raw.startsWith(\"//\")) return raw;\n    return \"/\";\n  }\n\n  async function createAuthorizeRedirect(request: NextRequest, mode: \"login\" | \"register\" | \"add-account\" | \"google\") {\n    const redirectTo = sanitizeRedirectTo(request.nextUrl.searchParams.get(\"redirectTo\") ?? config.afterSignInRedirectTo);\n    const flowId = request.nextUrl.searchParams.get(\"flow_id\");\n    const url = new URL(createUrl(config.issuer, mode === \"google\" ? \"/auth/google\" : \"/authorize\"));\n\n    if (!config.clientId) {\n      return NextResponse.json(\n        { error: \"missing_client_id\", message: \"Missing GEEKAPPS_AUTH_CLIENT_ID or clientId.\" },\n        { status: 500 },\n      );\n    }\n\n    url.searchParams.set(\"client_id\", config.clientId);\n    url.searchParams.set(\"redirect_uri\", resolveRedirectUri(config, request));\n    url.searchParams.set(\"response_type\", \"code\");\n    const scopes = config.scopes ?? [\"openid\", \"profile\", \"email\"];\n    if (!scopes.includes(\"offline_access\")) scopes.push(\"offline_access\");\n    url.searchParams.set(\"scope\", scopes.join(\" \"));\n    url.searchParams.set(\"state\", Buffer.from(JSON.stringify({ redirectTo, mode })).toString(\"base64url\"));\n    if (mode === \"register\") url.searchParams.set(\"screen_hint\", \"signup\");\n    if (mode === \"add-account\") url.searchParams.set(\"prompt\", \"login\");\n    if (flowId) url.searchParams.set(\"flow_id\", flowId);\n\n    return NextResponse.redirect(url);\n  }\n\n  async function exchangeCode(request: NextRequest) {\n    const code = request.nextUrl.searchParams.get(\"code\");\n    const state = request.nextUrl.searchParams.get(\"state\");\n\n    const origin = requestOrigin(request);\n\n    if (!code) {\n      const err = request.nextUrl.searchParams.get(\"error\") ?? \"missing_code\";\n      const desc = request.nextUrl.searchParams.get(\"error_description\") ?? request.nextUrl.searchParams.get(\"error_message\") ?? \"No authorization code received\";\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=${encodeURIComponent(err)}&error_description=${encodeURIComponent(desc)}`, origin));\n    }\n\n    if (!config.clientId) {\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=missing_client_id&error_description=Auth+client+is+not+configured`, origin));\n    }\n\n    const basicAuth = Buffer.from(\n      `${config.clientId}:${config.clientSecret ?? \"\"}`,\n    ).toString(\"base64\");\n\n    const response = await fetch(createUrl(config.issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${basicAuth}`,\n      },\n      body: new URLSearchParams({\n        grant_type: \"authorization_code\",\n        code,\n        redirect_uri: resolveRedirectUri(config, request),\n      }),\n      cache: \"no-store\",\n    });\n\n    const data = (await response.json().catch(() => ({}))) as TokenLikeResponse & { error?: string; error_description?: string };\n    if (!response.ok) {\n      const error = encodeURIComponent((data.error as string | undefined) ?? \"token_exchange_failed\");\n      const desc = encodeURIComponent((data.error_description as string | undefined) ?? `Token exchange failed with status ${response.status}`);\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=${error}&error_description=${desc}`, origin));\n    }\n\n    await saveAccountToList(tokenFromResponse(data));\n\n    let redirectTo = sanitizeRedirectTo(config.afterSignInRedirectTo);\n    if (state) {\n      try {\n        const parsed = JSON.parse(Buffer.from(state, \"base64url\").toString(\"utf8\")) as { redirectTo?: string };\n        redirectTo = sanitizeRedirectTo(parsed.redirectTo);\n      } catch {\n        // ignore malformed state\n      }\n    }\n\n    return NextResponse.redirect(new URL(redirectTo, origin));\n  }\n\n  function mapLocalPathToApiPath(route: string) {\n    if (route === \"/me\") return \"/auth/me\";\n    if (route === \"/accounts/switch\") return \"/auth/accounts/switch\";\n    if (route === \"/organizations/active\") return \"/auth/organizations/active\";\n    if (route === \"/permissions/check\") return \"/auth/permissions/check\";\n    if (route === \"/login/password\") return \"/auth/login/password\";\n    if (route === \"/register/password\") return \"/auth/register/password\";\n    if (route === \"/passwordless/link\") return \"/auth/passwordless/link\";\n    return route;\n  }\n\n  async function handleAccountsLocal(): Promise<NextResponse> {\n    const [accounts, activeIdx] = await Promise.all([getAccountsList(), getActiveIndex()]);\n\n    return NextResponse.json({\n      accounts: accounts.map((a, i) => ({\n        id: a.id,\n        sessionId: a.sessionId ?? a.id,\n        isActive: i + 1 === activeIdx,\n        user: {\n          id: a.user.sub,\n          name: a.user.name ?? null,\n          email: a.user.email ?? null,\n          imageUrl: a.user.picture ?? null,\n          phone: a.user.phone ?? null,\n        },\n      })),\n    });\n  }\n\n  async function handleOrganizationsLocal(): Promise<NextResponse> {\n    const cookieStore = await cookies();\n    const activeOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;\n    try {\n      const data = await apiRequest<unknown[]|{ organizations: unknown[] }>(\"/organizations\");\n      const organizations = Array.isArray(data) ? data : (data as { organizations: unknown[] }).organizations;\n      return NextResponse.json({ organizations, currentOrgId: activeOrgId });\n    } catch {\n      return NextResponse.json({ organizations: [], currentOrgId: activeOrgId });\n    }\n  }\n\n  async function handleSwitchAccountLocal(request: NextRequest): Promise<NextResponse> {\n    const body = await readBody(request);\n    const targetId =\n      body && typeof body === \"object\"\n        ? String(\n            (body as Record<string, unknown>).accountId ??\n            (body as Record<string, unknown>).sessionId ??\n            \"\",\n          )\n        : \"\";\n\n    if (!targetId) {\n      return NextResponse.json({ error: \"accountId required\" }, { status: 400 });\n    }\n\n    const switched = await switchAccount(targetId);\n    if (!switched) {\n      return NextResponse.json({ error: \"Account not found\" }, { status: 404 });\n    }\n\n    return NextResponse.json({ ok: true });\n  }\n\n  async function proxy(request: NextRequest, route: string) {\n    const accessToken = await getAccessToken();\n    const body = [\"GET\", \"HEAD\"].includes(request.method) ? undefined : await readBody(request);\n    const url = new URL(appendSearchParams(createUrl(config.issuer, mapLocalPathToApiPath(route)), request));\n    applyClientCredentials(url, config);\n    const requestHeaders = new Headers();\n\n    if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n    if (body !== undefined) requestHeaders.set(\"content-type\", \"application/json\");\n\n    const response = await fetch(url, {\n      method: request.method,\n      headers: requestHeaders,\n      body: body === undefined ? undefined : typeof body === \"string\" ? body : JSON.stringify(body),\n      cache: \"no-store\",\n    });\n\n    const data = isJsonResponse(response) ? ((await response.json().catch(() => null)) as TokenLikeResponse | null) : null;\n    if (data) {\n      const tokens = tokenFromResponse(data);\n      if (tokens.accessToken || tokens.refreshToken || tokens.idToken || tokens.sessionId) {\n        await saveAccountToList(tokens);\n      }\n      return NextResponse.json(data, { status: response.status });\n    }\n\n    return responseFromApi(response);\n  }\n\n  async function handle(request: NextRequest) {\n    const route = routeFromRequest(request, config.basePath);\n\n    if (request.method === \"GET\" && route === \"/sign-in\") return createAuthorizeRedirect(request, \"login\");\n    if (request.method === \"GET\" && route === \"/sign-up\") return createAuthorizeRedirect(request, \"register\");\n    if (request.method === \"GET\" && route === \"/add-account\") return createAuthorizeRedirect(request, \"add-account\");\n    if (request.method === \"GET\" && route === \"/login/google\") return createAuthorizeRedirect(request, \"google\");\n    if (request.method === \"GET\" && route === \"/callback\") {\n      const error = request.nextUrl.searchParams.get(\"error\");\n      if (error) {\n        const description = request.nextUrl.searchParams.get(\"error_description\") ?? request.nextUrl.searchParams.get(\"error_message\") ?? \"An authentication error occurred.\";\n        return new NextResponse(\n          `<!doctype html><html><head><meta charset=\"utf-8\"><title>Authentication Error</title></head><body style=\"font-family:sans-serif;max-width:480px;margin:80px auto;padding:0 16px\"><h2>Authentication Error</h2><p><strong>${escapeHtml(error)}</strong></p><p>${escapeHtml(description)}</p><a href=\"/\">Go back</a></body></html>`,\n          { status: 400, headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n        );\n      }\n      return exchangeCode(request);\n    }\n    if (request.method === \"GET\" && route === \"/token\") {\n      const accessToken = await getAccessToken();\n      if (!accessToken) return NextResponse.json({ error: \"missing_token\" }, { status: 401 });\n      return NextResponse.json({ accessToken });\n    }\n\n\n    if (request.method === \"GET\" && route === \"/accounts\") return handleAccountsLocal();\n    if (request.method === \"POST\" && route === \"/accounts/switch\") return handleSwitchAccountLocal(request);\n    if (request.method === \"GET\" && route === \"/organizations\") return handleOrganizationsLocal();\n\n    if (request.method === \"POST\" && route === \"/organizations\") {\n      const accessToken = await getAccessToken();\n      const body = (await readBody(request)) as Record<string, unknown> | undefined;\n      if (body && accessToken && !body.applicationId) {\n        const claims = decodeJwtPayload(accessToken);\n        const applicationId =\n          (typeof claims?.application_id === \"string\" ? claims.application_id : null) ??\n          (typeof claims?.client_id === \"string\" ? claims.client_id : null) ??\n          (typeof claims?.applicationId === \"string\" ? claims.applicationId : null);\n        if (applicationId) body.applicationId = applicationId;\n      }\n      const orgUrl = new URL(createUrl(config.issuer, \"/organizations\"));\n      applyClientCredentials(orgUrl, config);\n      const requestHeaders = new Headers();\n      if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n      if (body !== undefined) requestHeaders.set(\"content-type\", \"application/json\");\n      const response = await fetch(orgUrl, {\n        method: \"POST\",\n        headers: requestHeaders,\n        body: JSON.stringify(body),\n        cache: \"no-store\",\n      });\n      return responseFromApi(response);\n    }\n\n    if (request.method === \"POST\" && route === \"/sign-out\") {\n      await apiRequest(\"/auth/sign-out\", { method: \"POST\" }).catch(() => null);\n      await removeActiveAccount();\n      return NextResponse.json({ ok: true });\n    }\n\n    if (request.method === \"POST\" && route === \"/sign-out-all\") {\n      await apiRequest(\"/auth/sign-out-all\", { method: \"POST\" }).catch(() => null);\n      await clearAllSessionCookies();\n      return NextResponse.json({ ok: true });\n    }\n\n    if (request.method === \"POST\" && route === \"/organizations/active\") {\n      const body = await readBody(request);\n      const organizationId =\n        body && typeof body === \"object\" && \"organizationId\" in body\n          ? (body as Record<string, unknown>).organizationId\n          : null;\n      const response = NextResponse.json({ ok: true });\n      if (typeof organizationId === \"string\") {\n        const cookieOpts = {\n          httpOnly: true,\n          sameSite: \"lax\" as const,\n          path: \"/\",\n          secure: process.env.NODE_ENV === \"production\",\n          maxAge: 60 * 60 * 24 * 7,\n        };\n        response.cookies.set(cn.activeOrganizationId, organizationId, cookieOpts);\n      }\n      return response;\n    }\n\n    return proxy(request, route);\n  }\n\n  return {\n    handlers: {\n      GET: handle,\n      POST: handle,\n      PATCH: handle,\n      DELETE: handle,\n    },\n    GetSession: getSession,\n    GetUser: getUser,\n    GetOrganizations: getOrganizations,\n    SaveSession: saveAccountToList,\n    GetAccessToken: getAccessToken,\n    GetRefreshToken: getRefreshToken,\n    TryRefreshTokens: tryRefreshTokens,\n    RequireUser: requireUser,\n    CreateAuthApiClient: createApiClient,\n    cookiePrefix: config.cookiePrefix,\n    VerifyToken: (token: string) => verifyToken(token, config.issuer),\n    SignInUrl: async (redirectTo?: string) => {\n      const configured = env(\"GEEKAPPS_APP_URL\");\n      if (!configured) throw new Error(\"Cannot determine app origin. Set GEEKAPPS_APP_URL.\");\n      const origin = configured.replace(/\\/$/, \"\");\n      const url = new URL(`${origin}${config.basePath}/sign-in`);\n      if (redirectTo) url.searchParams.set(\"redirectTo\", redirectTo);\n      return url.toString();\n    },\n  };\n}\n\nexport function handlers(options?: GeekappsAuthConfig) {\n  return configureGeekappsAuth(options).handlers;\n}\n"],"mappings":";AAAA,SAAS,SAAS,eAAe;AACjC,SAAS,gBAAgB;AACzB,SAAS,oBAAsC;AAC/C,SAAS,oBAAoB,iBAAkC;AAyG/D,IAAM,eAAe;AAErB,SAAS,iBAAiB,KAAa;AACrC,SAAO,IAAI,QAAQ,OAAO,EAAE;AAC9B;AAEA,SAAS,kBAAkB,OAAO,aAAa;AAC7C,MAAI,CAAC,KAAK,WAAW,GAAG,EAAG,QAAO,IAAI,IAAI;AAC1C,SAAO,KAAK,QAAQ,OAAO,EAAE;AAC/B;AAEA,SAAS,UAAU,SAAiB,MAAc;AAChD,MAAI,eAAe,KAAK,IAAI,EAAG,QAAO;AACtC,QAAM,iBAAiB,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AAC7D,SAAO,GAAG,iBAAiB,OAAO,CAAC,GAAG,cAAc;AACtD;AAEA,SAAS,IAAI,MAAc;AACzB,QAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,SAAO,SAAS,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AACpD;AAEA,SAAS,cAAc,OAA2B;AAChD,SAAO;AAAA,IACL,MAAM,UACJ,IAAI,sBAAsB,KAC1B,IAAI,uBAAuB,KAC3B;AAAA,EACJ;AACF;AAEA,SAAS,gBAAgB,OAA2B;AAClD,SAAO,MAAM,YAAY,IAAI,yBAAyB,KAAK;AAC7D;AAEA,SAAS,oBAAoB,OAA2B;AACtD,SAAO,MAAM,gBAAgB,IAAI,6BAA6B;AAChE;AAEA,SAAS,uBAAuB,KAAU,QAAoC;AAC5E,MAAI,CAAC,OAAO,YAAY,CAAC,OAAO,aAAc;AAC9C,MAAI,aAAa,IAAI,aAAa,OAAO,QAAQ;AACjD,MAAI,aAAa,IAAI,iBAAiB,OAAO,YAAY;AAC3D;AAEA,SAAS,6BAA6B,OAA2B;AAC/D,SAAO,MAAM,eAAe,IAAI,4BAA4B;AAC9D;AAMA,SAAS,aAAa,UAA0B;AAC9C,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,SAAM,KAAK,KAAK,IAAM,SAAS,WAAW,CAAC,IAAI;AAC/C,QAAI,MAAM;AAAA,EACZ;AACA,SAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACvC;AAOA,SAAS,mBAAmB,UAA0B;AACpD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,MAAM,aAAa,QAAQ,CAAC;AACrC;AAEA,SAAS,cAAc,SAAsB;AAC3C,QAAM,aAAa,IAAI,kBAAkB;AACzC,MAAI,WAAY,QAAO,WAAW,QAAQ,OAAO,EAAE;AAEnD,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,QAAoC,SAAsB;AACpF,SAAO,OAAO,eAAe,GAAG,cAAc,OAAO,CAAC,GAAG,OAAO,QAAQ;AAC1E;AAEA,SAAS,kBAAkB,MAAwC;AACjE,SAAO;AAAA,IACL,aAAa,KAAK,eAAe,KAAK,gBAAgB,KAAK,QAAQ,eAAe,KAAK,QAAQ,gBAAgB;AAAA,IAC/G,cACE,KAAK,gBAAgB,KAAK,iBAAiB,KAAK,QAAQ,gBAAgB,KAAK,QAAQ,iBAAiB;AAAA,IACxG,SAAS,KAAK,WAAW,KAAK,YAAY,KAAK,QAAQ,WAAW,KAAK,QAAQ,YAAY;AAAA,IAC3F,WAAW,KAAK,aAAa,KAAK,cAAc,KAAK,QAAQ,aAAa,KAAK,QAAQ,cAAc;AAAA,EACvG;AACF;AAGA,SAAS,iBAAiB,OAA+C;AACvE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,SAAS,EAAG,QAAO;AAC7B,UAAM,UAAU,MAAM,CAAC;AACvB,QAAI,CAAC,QAAS,QAAO;AACrB,WAAO,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,EACtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,QAA6C;AACxE,MAAI,CAAC,OAAO,YAAa,QAAO;AAEhC,QAAM,aAAa,OAAO,WAAW,OAAO;AAC5C,QAAM,UAAU,iBAAiB,UAAU;AAC3C,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAM,KAAK,OAAO,OAAO;AACzB,MAAI,CAAC,GAAI,QAAO;AAEhB,SAAO;AAAA,IACL;AAAA,IACA,aAAa,OAAO;AAAA,IACpB,cAAc,OAAO;AAAA,IACrB,SAAS,OAAO,WAAW;AAAA,IAC3B,WAAW,OAAO;AAAA,IAClB,MAAM;AAAA,MACJ,KAAK;AAAA,MACL,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,MACxD,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,MAC3D,SAAS,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU;AAAA,MACjE,OAAO,OAAO,QAAQ,iBAAiB,WAAW,QAAQ,eAAe;AAAA,IAC3E;AAAA,EACF;AACF;AAiBA,SAAS,eAAe,QAAgB;AACtC,SAAO;AAAA,IACL,QAAQ,GAAG,MAAM;AAAA,IACjB,OAAO,GAAG,MAAM;AAAA,IAChB,sBAAsB,GAAG,MAAM;AAAA,IAC/B,UAAU,GAAG,MAAM;AAAA,IACnB,UAAU,CAAC,MAAc,GAAG,MAAM,KAAK,CAAC;AAAA,IACxC,QAAQ,CAAC,MAAc,GAAG,MAAM,MAAM,CAAC;AAAA,IACvC,QAAQ,CAAC,MAAc,GAAG,MAAM,MAAM,CAAC;AAAA,EACzC;AACF;AAUA,SAAS,WAAW,SAAgC;AAClD,QAAM,IAAc,EAAE,IAAI,QAAQ,GAAG;AACrC,MAAI,QAAQ,UAAW,GAAE,MAAM,QAAQ;AACvC,MAAI,QAAQ,KAAK,KAAM,GAAE,IAAI,QAAQ,KAAK;AAC1C,MAAI,QAAQ,KAAK,MAAO,GAAE,IAAI,QAAQ,KAAK;AAC3C,MAAI,QAAQ,KAAK,QAAS,GAAE,IAAI,QAAQ,KAAK;AAC7C,SAAO,OAAO,KAAK,KAAK,UAAU,CAAC,GAAG,MAAM,EAAE,SAAS,WAAW;AACpE;AAEA,SAAS,WAAW,OAAgC;AAClD,MAAI;AACF,UAAM,IAAI,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM,CAAC;AACrE,WAAO,EAAE,KAAK,IAAI;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,QAAoC;AAC5D,SAAO;AAAA,IACL,UAAU;AAAA,IACV,QAAQ,OAAO,iBAAiB,QAAQ,IAAI,aAAa;AAAA,IACzD,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACF;AAEA,eAAe,SAAS,SAAsB;AAC5C,QAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,KAAa,SAAsB;AAC7D,QAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,UAAQ,QAAQ,aAAa,QAAQ,CAAC,OAAO,QAAQ;AACnD,WAAO,aAAa,IAAI,KAAK,KAAK;AAAA,EACpC,CAAC;AACD,SAAO,OAAO,SAAS;AACzB;AAEA,SAAS,iBAAiB,SAAsB,UAAkB;AAChE,QAAM,WAAW,QAAQ,QAAQ;AACjC,MAAI,CAAC,SAAS,WAAW,QAAQ,EAAG,QAAO;AAC3C,QAAM,QAAQ,SAAS,MAAM,SAAS,MAAM;AAC5C,SAAO,SAAS;AAClB;AAEA,SAAS,eAAe,UAAoB;AAC1C,SAAO,SAAS,QAAQ,IAAI,cAAc,GAAG,SAAS,kBAAkB;AAC1E;AAEA,eAAe,gBAAgB,UAAoB;AACjD,MAAI,SAAS,WAAW,IAAK,QAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAC1E,QAAM,OAAO,eAAe,QAAQ,IAAI,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI,IAAI,MAAM,SAAS,KAAK;AACtG,SAAO,aAAa,KAAK,MAAM,EAAE,QAAQ,SAAS,OAAO,CAAC;AAC5D;AAEA,IAAM,mBAAmB,oBAAI,IAAmD;AAGhF,IAAM,qBAAqB,oBAAI,IAA+B;AAE9D,eAAe,kBAAkB,QAAgB,UAAkB,cAA8C;AAC/G,QAAM,cAAc,OAAO,KAAK,GAAG,QAAQ,IAAI,YAAY,EAAE,EAAE,SAAS,QAAQ;AAChF,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,UAAU,QAAQ,aAAa,GAAG;AAAA,MACxD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,SAAS,WAAW;AAAA,MACrC;AAAA,MACA,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,WAAO,KAAK,gBAAgB;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,gBAAgB,QAAgB,UAAkB,cAA8C;AAC7G,QAAM,MAAM,GAAG,MAAM,IAAI,QAAQ;AACjC,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,SAAS,mBAAmB,IAAI,GAAG;AACzC,MAAI,UAAU,OAAO,YAAY,MAAS,IAAK,QAAO,OAAO;AAC7D,QAAM,QAAQ,MAAM,kBAAkB,QAAQ,UAAU,YAAY;AACpE,MAAI,CAAC,MAAO,QAAO;AACnB,qBAAmB,IAAI,KAAK,EAAE,OAAO,WAAW,MAAM,KAAQ,CAAC;AAC/D,SAAO;AACT;AAeO,SAAS,uBAAuB,WAAiC,CAAC,GAA2B;AAClG,QAAM,SAAS;AAAA,IACb,SAAS,UACP,IAAI,sBAAsB,KAC1B,IAAI,uBAAuB,KAC3B;AAAA,EACJ;AACA,QAAM,WAAW,SAAS,YAAY,IAAI,oCAAoC,KAAK;AACnF,QAAM,eAAe,SAAS,gBAAgB,IAAI,wCAAwC,KAAK;AAC/F,MAAI,CAAC,YAAY,CAAC,aAAc,QAAO,QAAQ,QAAQ,IAAI;AAC3D,SAAO,gBAAgB,QAAQ,UAAU,YAAY;AACvD;AAEA,SAAS,cAAc,QAAgB;AACrC,MAAI,CAAC,iBAAiB,IAAI,MAAM,GAAG;AACjC,qBAAiB,IAAI,QAAQ,mBAAmB,IAAI,IAAI,GAAG,MAAM,wBAAwB,CAAC,CAAC;AAAA,EAC7F;AACA,SAAO,iBAAiB,IAAI,MAAM;AACpC;AAEA,eAAsB,YACpB,OACA,QAC4B;AAC5B,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,cAAc,MAAM,GAAG;AAAA,MAChE,YAAY,CAAC,OAAO;AAAA,MACpB;AAAA,IACF,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,sBAAsB,QAA4B,CAAC,GAAG;AACpE,QAAM,WAAW,gBAAgB,KAAK;AACtC,QAAM,SAAqC;AAAA,IACzC,GAAG;AAAA,IACH,QAAQ,cAAc,KAAK;AAAA,IAC3B;AAAA,IACA,cAAc,oBAAoB,KAAK;AAAA,IACvC,aAAa,6BAA6B,KAAK;AAAA,IAC/C,uBACE,MAAM,yBAAyB,MAAM,cAAc;AAAA,IACrD,UAAU,kBAAkB,MAAM,QAAQ;AAAA,IAC1C,cAAc,mBAAmB,QAAQ;AAAA,EAC3C;AAEA,QAAM,KAAK,eAAe,OAAO,YAAY;AAI7C,iBAAe,WAA4B;AACzC,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,MAAM,YAAY,IAAI,GAAG,KAAK,GAAG;AACvC,UAAM,IAAI,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AAC3C,WAAO,OAAO,MAAM,CAAC,IAAI,IAAI;AAAA,EAC/B;AAEA,iBAAe,iBAAkC;AAC/C,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,MAAM,YAAY,IAAI,GAAG,MAAM,GAAG;AACxC,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,IAAI,OAAO,SAAS,KAAK,EAAE;AACjC,WAAO,OAAO,MAAM,CAAC,IAAI,IAAI;AAAA,EAC/B;AAEA,WAAS,SACP,aACA,GACsB;AACtB,UAAM,KAAK,YAAY,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG;AAC1C,QAAI,CAAC,GAAI,QAAO;AAChB,UAAM,OAAO,WAAW,YAAY,IAAI,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,EAAE;AACpE,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO;AAAA,MACL,IAAI,KAAK;AAAA,MACT,aAAa;AAAA,MACb,cAAc,YAAY,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS;AAAA,MACtD,SAAS;AAAA;AAAA,MACT,WAAW,KAAK,OAAO;AAAA,MACvB,MAAM;AAAA,QACJ,KAAK,KAAK;AAAA,QACV,MAAM,KAAK,KAAK;AAAA,QAChB,OAAO,KAAK,KAAK;AAAA,QACjB,SAAS,KAAK,KAAK;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,WAAS,UACP,aACA,GACA,SACA;AACA,UAAM,OAAO,EAAE,GAAG,iBAAiB,MAAM,GAAG,QAAQ,KAAK,KAAK,KAAK,GAAG;AACtE,gBAAY,IAAI,GAAG,SAAS,CAAC,GAAG,WAAW,OAAO,GAAG,IAAI;AACzD,gBAAY,IAAI,GAAG,OAAO,CAAC,GAAG,QAAQ,aAAa,IAAI;AACvD,QAAI,QAAQ,aAAc,aAAY,IAAI,GAAG,OAAO,CAAC,GAAG,QAAQ,cAAc,IAAI;AAAA,EACpF;AAEA,WAAS,UACP,aACA,GACA;AACA,UAAM,QAAQ,EAAE,GAAG,iBAAiB,MAAM,GAAG,QAAQ,EAAE;AACvD,gBAAY,IAAI,GAAG,SAAS,CAAC,GAAG,IAAI,KAAK;AACzC,gBAAY,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,KAAK;AACvC,gBAAY,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,KAAK;AAAA,EACzC;AAIA,iBAAe,kBAA4C;AACzD,UAAM,CAAC,aAAa,KAAK,IAAI,MAAM,QAAQ,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;AACtE,UAAM,WAA4B,CAAC;AACnC,aAAS,IAAI,GAAG,KAAK,OAAO,KAAK;AAC/B,YAAM,OAAO,SAAS,aAAa,CAAC;AACpC,UAAI,KAAM,UAAS,KAAK,IAAI;AAAA,IAC9B;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,mBAAkD;AAC/D,UAAM,CAAC,aAAa,WAAW,KAAK,IAAI,MAAM,QAAQ,IAAI,CAAC,QAAQ,GAAG,eAAe,GAAG,SAAS,CAAC,CAAC;AACnG,QAAI,UAAU,EAAG,QAAO;AACxB,QAAI,aAAa,KAAK,aAAa,OAAO;AACxC,YAAM,OAAO,SAAS,aAAa,SAAS;AAC5C,UAAI,KAAM,QAAO;AAAA,IACnB;AAEA,WAAO,SAAS,aAAa,CAAC;AAAA,EAChC;AAEA,iBAAe,iBAAiB;AAE9B,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ;AAC3B,YAAM,OAAO,KAAK,IAAI,eAAe;AACrC,UAAI,MAAM,WAAW,SAAS,EAAG,QAAO,KAAK,MAAM,CAAC;AAAA,IACtD,QAAQ;AAAA,IAAC;AACT,UAAM,SAAS,MAAM,iBAAiB;AACtC,WAAO,QAAQ,eAAe;AAAA,EAChC;AAEA,iBAAe,kBAAkB;AAC/B,UAAM,SAAS,MAAM,iBAAiB;AACtC,WAAO,QAAQ,gBAAgB;AAAA,EACjC;AAEA,iBAAe,aAA4C;AACzD,UAAM,SAAS,MAAM,iBAAiB;AACtC,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO;AAAA,MACL,aAAa,OAAO;AAAA,MACpB,cAAc,OAAO;AAAA,MACrB,SAAS,OAAO;AAAA,MAChB,WAAW,OAAO;AAAA,IACpB;AAAA,EACF;AAEA,iBAAe,UAAiD;AAC9D,UAAM,SAAS,MAAM,iBAAiB;AACtC,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAEA,iBAAe,mBAAuF;AACpG,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,eAAe,YAAY,IAAI,GAAG,oBAAoB,GAAG,SAAS;AACxE,QAAI;AACF,YAAM,OAAO,MAAM,WAAqD,gBAAgB;AACxF,YAAM,gBAAgB,MAAM,QAAQ,IAAI,IAAI,OAAQ,KAAsC;AAC1F,aAAO,EAAE,eAAe,aAAa;AAAA,IACvC,QAAQ;AACN,aAAO,EAAE,eAAe,CAAC,GAAG,aAAa;AAAA,IAC3C;AAAA,EACF;AAEA,WAAS,uBACP,aACA;AAEA,QAAI,YAAY,IAAI,GAAG,QAAQ,GAAG,OAAO;AACvC,kBAAY,IAAI,GAAG,UAAU,IAAI,EAAE,UAAU,OAAO,QAAQ,GAAG,MAAM,IAAI,CAAC;AAAA,IAC5E;AAAA,EACF;AAEA,iBAAe,kBAAkB,QAAuB;AACtD,UAAM,UAAU,oBAAoB,MAAM;AAC1C,QAAI,CAAC,QAAS;AAEd,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,OAAO,EAAE,GAAG,iBAAiB,MAAM,GAAG,QAAQ,KAAK,KAAK,KAAK,GAAG;AACtE,UAAM,QAAQ,MAAM,SAAS;AAG7B,QAAI,aAAa;AACjB,aAAS,IAAI,GAAG,KAAK,OAAO,KAAK;AAC/B,YAAM,WAAW,SAAS,aAAa,CAAC;AACxC,UAAI,UAAU,OAAO,QAAQ,IAAI;AAC/B,qBAAa;AACb;AAAA,MACF;AAAA,IACF;AAEA,QAAI,eAAe,GAAG;AACpB,UAAI,SAAS,aAAc;AAC3B,mBAAa,QAAQ;AACrB,kBAAY,IAAI,GAAG,OAAO,OAAO,UAAU,GAAG,IAAI;AAAA,IACpD;AAEA,cAAU,aAAa,YAAY,OAAO;AAC1C,gBAAY,IAAI,GAAG,QAAQ,OAAO,UAAU,GAAG,IAAI;AACnD,2BAAuB,WAAW;AAAA,EACpC;AAGA,QAAM,oBAAoB;AAE1B,iBAAe,cAAc,WAAqC;AAChE,UAAM,CAAC,aAAa,KAAK,IAAI,MAAM,QAAQ,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;AACtE,UAAM,OAAO,EAAE,GAAG,iBAAiB,MAAM,GAAG,QAAQ,KAAK,KAAK,KAAK,GAAG;AAEtE,aAAS,IAAI,GAAG,KAAK,OAAO,KAAK;AAC/B,YAAM,OAAO,SAAS,aAAa,CAAC;AACpC,UAAI,SAAS,KAAK,OAAO,aAAa,KAAK,cAAc,YAAY;AACnE,oBAAY,IAAI,GAAG,QAAQ,OAAO,CAAC,GAAG,IAAI;AAC1C,+BAAuB,WAAW;AAClC,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,sBAAsB;AACnC,UAAM,CAAC,aAAa,WAAW,KAAK,IAAI,MAAM,QAAQ,IAAI,CAAC,QAAQ,GAAG,eAAe,GAAG,SAAS,CAAC,CAAC;AACnG,UAAM,OAAO,EAAE,GAAG,iBAAiB,MAAM,GAAG,QAAQ,KAAK,KAAK,KAAK,GAAG;AACtE,UAAM,QAAQ,EAAE,GAAG,iBAAiB,MAAM,GAAG,QAAQ,EAAE;AAEvD,QAAI,UAAU,EAAG;AAEjB,UAAM,YAA6B,CAAC;AACpC,aAAS,IAAI,GAAG,KAAK,OAAO,KAAK;AAC/B,UAAI,MAAM,UAAW;AACrB,YAAM,OAAO,SAAS,aAAa,CAAC;AACpC,UAAI,KAAM,WAAU,KAAK,IAAI;AAAA,IAC/B;AAEA,aAAS,IAAI,GAAG,KAAK,OAAO,KAAK;AAC/B,gBAAU,aAAa,CAAC;AAAA,IAC1B;AAEA,QAAI,UAAU,WAAW,GAAG;AAC1B,kBAAY,IAAI,GAAG,OAAO,KAAK,KAAK;AACpC,kBAAY,IAAI,GAAG,QAAQ,KAAK,KAAK;AACrC,YAAM,uBAAuB,WAAW;AACxC;AAAA,IACF;AAGA,aAAS,IAAI,GAAG,IAAI,UAAU,QAAQ,KAAK;AACzC,YAAM,UAAU,aAAa,IAAI,GAAG,UAAU,CAAC,CAAE;AAAA,IACnD;AACA,gBAAY,IAAI,GAAG,OAAO,OAAO,UAAU,MAAM,GAAG,IAAI;AACxD,gBAAY,IAAI,GAAG,QAAQ,KAAK,IAAI;AACpC,2BAAuB,WAAW;AAAA,EACpC;AAEA,iBAAe,yBAAyB;AACtC,UAAM,CAAC,aAAa,KAAK,IAAI,MAAM,QAAQ,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;AACtE,UAAM,QAAQ,EAAE,GAAG,iBAAiB,MAAM,GAAG,QAAQ,EAAE;AACvD,aAAS,IAAI,GAAG,KAAK,OAAO,KAAK;AAC/B,gBAAU,aAAa,CAAC;AAAA,IAC1B;AACA,gBAAY,IAAI,GAAG,OAAO,KAAK,KAAK;AACpC,gBAAY,IAAI,GAAG,QAAQ,KAAK,KAAK;AACrC,2BAAuB,WAAW;AAAA,EACpC;AAEA,iBAAe,mBAA2C;AACxD,UAAM,eAAe,MAAM,gBAAgB;AAC3C,QAAI,CAAC,gBAAgB,CAAC,OAAO,SAAU,QAAO;AAE9C,UAAM,YAAY,OAAO,KAAK,GAAG,OAAO,QAAQ,IAAI,OAAO,gBAAgB,EAAE,EAAE,EAAE,SAAS,QAAQ;AAElG,UAAM,WAAW,MAAM,MAAM,UAAU,OAAO,QAAQ,aAAa,GAAG;AAAA,MACpE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,SAAS,SAAS;AAAA,MACnC;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe;AAAA,MACjB,CAAC;AAAA,MACD,OAAO;AAAA,IACT,CAAC;AAED,QAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,UAAM,OAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACpD,QAAI,CAAC,KAAM,QAAO;AAElB,UAAM,SAAS,kBAAkB,IAAI;AACrC,QAAI,CAAC,OAAO,YAAa,QAAO;AAEhC,UAAM,kBAAkB,MAAM;AAC9B,WAAO,OAAO;AAAA,EAChB;AAEA,iBAAe,WAAc,MAAc,OAAoB,CAAC,GAAe;AAC7E,UAAM,cAAc,MAAM,eAAe;AACzC,UAAM,iBAAiB,IAAI,QAAQ,KAAK,OAAO;AAE/C,QAAI,YAAa,gBAAe,IAAI,iBAAiB,UAAU,WAAW,EAAE;AAC5E,QAAI,KAAK,SAAS,UAAa,CAAC,eAAe,IAAI,cAAc,GAAG;AAClE,qBAAe,IAAI,gBAAgB,kBAAkB;AAAA,IACvD;AAEA,UAAM,MAAM,IAAI,IAAI,UAAU,OAAO,QAAQ,IAAI,CAAC;AAClD,2BAAuB,KAAK,MAAM;AAElC,UAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAChC,GAAG;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,IACT,CAAC;AAED,QAAI,SAAS,WAAW,KAAK;AAC3B,YAAM,iBAAiB,MAAM,iBAAiB;AAC9C,UAAI,gBAAgB;AAClB,cAAM,eAAe,IAAI,QAAQ,KAAK,OAAO;AAC7C,qBAAa,IAAI,iBAAiB,UAAU,cAAc,EAAE;AAC5D,YAAI,KAAK,SAAS,UAAa,CAAC,aAAa,IAAI,cAAc,GAAG;AAChE,uBAAa,IAAI,gBAAgB,kBAAkB;AAAA,QACrD;AACA,cAAM,WAAW,IAAI,IAAI,UAAU,OAAO,QAAQ,IAAI,CAAC;AACvD,+BAAuB,UAAU,MAAM;AACvC,cAAM,gBAAgB,MAAM,MAAM,UAAU;AAAA,UAC1C,GAAG;AAAA,UACH,SAAS;AAAA,UACT,OAAO;AAAA,QACT,CAAC;AACD,YAAI,CAAC,cAAc,IAAI;AACrB,gBAAM,QAAQ,MAAM,cAAc,KAAK,EAAE,MAAM,MAAM,IAAI;AACzD,gBAAM,IAAI,MAAM,OAAO,qBAAqB,OAAO,SAAS,OAAO,WAAW,kBAAkB,cAAc,MAAM,EAAE;AAAA,QACxH;AACA,YAAI,cAAc,WAAW,IAAK,QAAO;AACzC,eAAQ,MAAM,cAAc,KAAK;AAAA,MACnC;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACpD,YAAM,IAAI,MAAM,OAAO,qBAAqB,OAAO,SAAS,OAAO,WAAW,kBAAkB,SAAS,MAAM,EAAE;AAAA,IACnH;AAEA,QAAI,SAAS,WAAW,IAAK,QAAO;AACpC,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAEA,WAAS,kBAAuC;AAC9C,WAAO;AAAA,MACL,KAAK,CAAC,SAAS,WAAW,IAAI;AAAA,MAC9B,MAAM,CAAC,MAAM,SAAS,WAAW,MAAM,EAAE,QAAQ,QAAQ,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI,EAAE,CAAC;AAAA,MACtH,OAAO,CAAC,MAAM,SAAS,WAAW,MAAM,EAAE,QAAQ,SAAS,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI,EAAE,CAAC;AAAA,MACxH,KAAK,CAAC,MAAM,SAAS,WAAW,MAAM,EAAE,QAAQ,OAAO,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI,EAAE,CAAC;AAAA,MACpH,QAAQ,CAAC,SAAS,WAAW,MAAM,EAAE,QAAQ,SAAS,CAAC;AAAA,IACzD;AAAA,EACF;AAEA,iBAAe,YAAY,UAAmC,CAAC,GAAG;AAChE,UAAM,cAAc,MAAM,eAAe;AACzC,QAAI,CAAC,aAAa;AAChB,eAAS,QAAQ,cAAc,GAAG;AAAA,IACpC;AACA,WAAO;AAAA,EACT;AAEA,WAAS,WAAW,KAAqB;AACvC,WAAO,IAAI,QAAQ,MAAM,OAAO,EAAE,QAAQ,MAAM,MAAM,EAAE,QAAQ,MAAM,MAAM,EAAE,QAAQ,MAAM,QAAQ;AAAA,EACtG;AAEA,WAAS,mBAAmB,OAA0C;AACpE,UAAM,MAAM,SAAS;AAErB,QAAI,IAAI,WAAW,OAAO,QAAQ,EAAG,QAAO;AAE5C,QAAI,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,WAAW,IAAI,EAAG,QAAO;AACzD,WAAO;AAAA,EACT;AAEA,iBAAe,wBAAwB,SAAsB,MAAuD;AAClH,UAAM,aAAa,mBAAmB,QAAQ,QAAQ,aAAa,IAAI,YAAY,KAAK,OAAO,qBAAqB;AACpH,UAAM,SAAS,QAAQ,QAAQ,aAAa,IAAI,SAAS;AACzD,UAAM,MAAM,IAAI,IAAI,UAAU,OAAO,QAAQ,SAAS,WAAW,iBAAiB,YAAY,CAAC;AAE/F,QAAI,CAAC,OAAO,UAAU;AACpB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,qBAAqB,SAAS,+CAA+C;AAAA,QACtF,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,aAAa,IAAI,aAAa,OAAO,QAAQ;AACjD,QAAI,aAAa,IAAI,gBAAgB,mBAAmB,QAAQ,OAAO,CAAC;AACxE,QAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,UAAM,SAAS,OAAO,UAAU,CAAC,UAAU,WAAW,OAAO;AAC7D,QAAI,CAAC,OAAO,SAAS,gBAAgB,EAAG,QAAO,KAAK,gBAAgB;AACpE,QAAI,aAAa,IAAI,SAAS,OAAO,KAAK,GAAG,CAAC;AAC9C,QAAI,aAAa,IAAI,SAAS,OAAO,KAAK,KAAK,UAAU,EAAE,YAAY,KAAK,CAAC,CAAC,EAAE,SAAS,WAAW,CAAC;AACrG,QAAI,SAAS,WAAY,KAAI,aAAa,IAAI,eAAe,QAAQ;AACrE,QAAI,SAAS,cAAe,KAAI,aAAa,IAAI,UAAU,OAAO;AAClE,QAAI,OAAQ,KAAI,aAAa,IAAI,WAAW,MAAM;AAElD,WAAO,aAAa,SAAS,GAAG;AAAA,EAClC;AAEA,iBAAe,aAAa,SAAsB;AAChD,UAAM,OAAO,QAAQ,QAAQ,aAAa,IAAI,MAAM;AACpD,UAAM,QAAQ,QAAQ,QAAQ,aAAa,IAAI,OAAO;AAEtD,UAAM,SAAS,cAAc,OAAO;AAEpC,QAAI,CAAC,MAAM;AACT,YAAM,MAAM,QAAQ,QAAQ,aAAa,IAAI,OAAO,KAAK;AACzD,YAAM,OAAO,QAAQ,QAAQ,aAAa,IAAI,mBAAmB,KAAK,QAAQ,QAAQ,aAAa,IAAI,eAAe,KAAK;AAC3H,aAAO,aAAa,SAAS,IAAI,IAAI,GAAG,OAAO,QAAQ,mBAAmB,mBAAmB,GAAG,CAAC,sBAAsB,mBAAmB,IAAI,CAAC,IAAI,MAAM,CAAC;AAAA,IAC5J;AAEA,QAAI,CAAC,OAAO,UAAU;AACpB,aAAO,aAAa,SAAS,IAAI,IAAI,GAAG,OAAO,QAAQ,qFAAqF,MAAM,CAAC;AAAA,IACrJ;AAEA,UAAM,YAAY,OAAO;AAAA,MACvB,GAAG,OAAO,QAAQ,IAAI,OAAO,gBAAgB,EAAE;AAAA,IACjD,EAAE,SAAS,QAAQ;AAEnB,UAAM,WAAW,MAAM,MAAM,UAAU,OAAO,QAAQ,aAAa,GAAG;AAAA,MACpE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,SAAS,SAAS;AAAA,MACnC;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ;AAAA,QACA,cAAc,mBAAmB,QAAQ,OAAO;AAAA,MAClD,CAAC;AAAA,MACD,OAAO;AAAA,IACT,CAAC;AAED,UAAM,OAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,mBAAoB,KAAK,SAAgC,uBAAuB;AAC9F,YAAM,OAAO,mBAAoB,KAAK,qBAA4C,qCAAqC,SAAS,MAAM,EAAE;AACxI,aAAO,aAAa,SAAS,IAAI,IAAI,GAAG,OAAO,QAAQ,mBAAmB,KAAK,sBAAsB,IAAI,IAAI,MAAM,CAAC;AAAA,IACtH;AAEA,UAAM,kBAAkB,kBAAkB,IAAI,CAAC;AAE/C,QAAI,aAAa,mBAAmB,OAAO,qBAAqB;AAChE,QAAI,OAAO;AACT,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM,CAAC;AAC1E,qBAAa,mBAAmB,OAAO,UAAU;AAAA,MACnD,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,WAAO,aAAa,SAAS,IAAI,IAAI,YAAY,MAAM,CAAC;AAAA,EAC1D;AAEA,WAAS,sBAAsB,OAAe;AAC5C,QAAI,UAAU,MAAO,QAAO;AAC5B,QAAI,UAAU,mBAAoB,QAAO;AACzC,QAAI,UAAU,wBAAyB,QAAO;AAC9C,QAAI,UAAU,qBAAsB,QAAO;AAC3C,QAAI,UAAU,kBAAmB,QAAO;AACxC,QAAI,UAAU,qBAAsB,QAAO;AAC3C,QAAI,UAAU,qBAAsB,QAAO;AAC3C,WAAO;AAAA,EACT;AAEA,iBAAe,sBAA6C;AAC1D,UAAM,CAAC,UAAU,SAAS,IAAI,MAAM,QAAQ,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC,CAAC;AAErF,WAAO,aAAa,KAAK;AAAA,MACvB,UAAU,SAAS,IAAI,CAAC,GAAG,OAAO;AAAA,QAChC,IAAI,EAAE;AAAA,QACN,WAAW,EAAE,aAAa,EAAE;AAAA,QAC5B,UAAU,IAAI,MAAM;AAAA,QACpB,MAAM;AAAA,UACJ,IAAI,EAAE,KAAK;AAAA,UACX,MAAM,EAAE,KAAK,QAAQ;AAAA,UACrB,OAAO,EAAE,KAAK,SAAS;AAAA,UACvB,UAAU,EAAE,KAAK,WAAW;AAAA,UAC5B,OAAO,EAAE,KAAK,SAAS;AAAA,QACzB;AAAA,MACF,EAAE;AAAA,IACJ,CAAC;AAAA,EACH;AAEA,iBAAe,2BAAkD;AAC/D,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,cAAc,YAAY,IAAI,GAAG,oBAAoB,GAAG,SAAS;AACvE,QAAI;AACF,YAAM,OAAO,MAAM,WAAmD,gBAAgB;AACtF,YAAM,gBAAgB,MAAM,QAAQ,IAAI,IAAI,OAAQ,KAAsC;AAC1F,aAAO,aAAa,KAAK,EAAE,eAAe,cAAc,YAAY,CAAC;AAAA,IACvE,QAAQ;AACN,aAAO,aAAa,KAAK,EAAE,eAAe,CAAC,GAAG,cAAc,YAAY,CAAC;AAAA,IAC3E;AAAA,EACF;AAEA,iBAAe,yBAAyB,SAA6C;AACnF,UAAM,OAAO,MAAM,SAAS,OAAO;AACnC,UAAM,WACJ,QAAQ,OAAO,SAAS,WACpB;AAAA,MACG,KAAiC,aACjC,KAAiC,aAClC;AAAA,IACF,IACA;AAEN,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3E;AAEA,UAAM,WAAW,MAAM,cAAc,QAAQ;AAC7C,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,iBAAe,MAAM,SAAsB,OAAe;AACxD,UAAM,cAAc,MAAM,eAAe;AACzC,UAAM,OAAO,CAAC,OAAO,MAAM,EAAE,SAAS,QAAQ,MAAM,IAAI,SAAY,MAAM,SAAS,OAAO;AAC1F,UAAM,MAAM,IAAI,IAAI,mBAAmB,UAAU,OAAO,QAAQ,sBAAsB,KAAK,CAAC,GAAG,OAAO,CAAC;AACvG,2BAAuB,KAAK,MAAM;AAClC,UAAM,iBAAiB,IAAI,QAAQ;AAEnC,QAAI,YAAa,gBAAe,IAAI,iBAAiB,UAAU,WAAW,EAAE;AAC5E,QAAI,SAAS,OAAW,gBAAe,IAAI,gBAAgB,kBAAkB;AAE7E,UAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAChC,QAAQ,QAAQ;AAAA,MAChB,SAAS;AAAA,MACT,MAAM,SAAS,SAAY,SAAY,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,IAAI;AAAA,MAC5F,OAAO;AAAA,IACT,CAAC;AAED,UAAM,OAAO,eAAe,QAAQ,IAAM,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI,IAAkC;AAClH,QAAI,MAAM;AACR,YAAM,SAAS,kBAAkB,IAAI;AACrC,UAAI,OAAO,eAAe,OAAO,gBAAgB,OAAO,WAAW,OAAO,WAAW;AACnF,cAAM,kBAAkB,MAAM;AAAA,MAChC;AACA,aAAO,aAAa,KAAK,MAAM,EAAE,QAAQ,SAAS,OAAO,CAAC;AAAA,IAC5D;AAEA,WAAO,gBAAgB,QAAQ;AAAA,EACjC;AAEA,iBAAe,OAAO,SAAsB;AAC1C,UAAM,QAAQ,iBAAiB,SAAS,OAAO,QAAQ;AAEvD,QAAI,QAAQ,WAAW,SAAS,UAAU,WAAY,QAAO,wBAAwB,SAAS,OAAO;AACrG,QAAI,QAAQ,WAAW,SAAS,UAAU,WAAY,QAAO,wBAAwB,SAAS,UAAU;AACxG,QAAI,QAAQ,WAAW,SAAS,UAAU,eAAgB,QAAO,wBAAwB,SAAS,aAAa;AAC/G,QAAI,QAAQ,WAAW,SAAS,UAAU,gBAAiB,QAAO,wBAAwB,SAAS,QAAQ;AAC3G,QAAI,QAAQ,WAAW,SAAS,UAAU,aAAa;AACrD,YAAM,QAAQ,QAAQ,QAAQ,aAAa,IAAI,OAAO;AACtD,UAAI,OAAO;AACT,cAAM,cAAc,QAAQ,QAAQ,aAAa,IAAI,mBAAmB,KAAK,QAAQ,QAAQ,aAAa,IAAI,eAAe,KAAK;AAClI,eAAO,IAAI;AAAA,UACT,2NAA2N,WAAW,KAAK,CAAC,mBAAmB,WAAW,WAAW,CAAC;AAAA,UACtR,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,2BAA2B,EAAE;AAAA,QACzE;AAAA,MACF;AACA,aAAO,aAAa,OAAO;AAAA,IAC7B;AACA,QAAI,QAAQ,WAAW,SAAS,UAAU,UAAU;AAClD,YAAM,cAAc,MAAM,eAAe;AACzC,UAAI,CAAC,YAAa,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACtF,aAAO,aAAa,KAAK,EAAE,YAAY,CAAC;AAAA,IAC1C;AAGA,QAAI,QAAQ,WAAW,SAAS,UAAU,YAAa,QAAO,oBAAoB;AAClF,QAAI,QAAQ,WAAW,UAAU,UAAU,mBAAoB,QAAO,yBAAyB,OAAO;AACtG,QAAI,QAAQ,WAAW,SAAS,UAAU,iBAAkB,QAAO,yBAAyB;AAE5F,QAAI,QAAQ,WAAW,UAAU,UAAU,kBAAkB;AAC3D,YAAM,cAAc,MAAM,eAAe;AACzC,YAAM,OAAQ,MAAM,SAAS,OAAO;AACpC,UAAI,QAAQ,eAAe,CAAC,KAAK,eAAe;AAC9C,cAAM,SAAS,iBAAiB,WAAW;AAC3C,cAAM,iBACH,OAAO,QAAQ,mBAAmB,WAAW,OAAO,iBAAiB,UACrE,OAAO,QAAQ,cAAc,WAAW,OAAO,YAAY,UAC3D,OAAO,QAAQ,kBAAkB,WAAW,OAAO,gBAAgB;AACtE,YAAI,cAAe,MAAK,gBAAgB;AAAA,MAC1C;AACA,YAAM,SAAS,IAAI,IAAI,UAAU,OAAO,QAAQ,gBAAgB,CAAC;AACjE,6BAAuB,QAAQ,MAAM;AACrC,YAAM,iBAAiB,IAAI,QAAQ;AACnC,UAAI,YAAa,gBAAe,IAAI,iBAAiB,UAAU,WAAW,EAAE;AAC5E,UAAI,SAAS,OAAW,gBAAe,IAAI,gBAAgB,kBAAkB;AAC7E,YAAM,WAAW,MAAM,MAAM,QAAQ;AAAA,QACnC,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,MAAM,KAAK,UAAU,IAAI;AAAA,QACzB,OAAO;AAAA,MACT,CAAC;AACD,aAAO,gBAAgB,QAAQ;AAAA,IACjC;AAEA,QAAI,QAAQ,WAAW,UAAU,UAAU,aAAa;AACtD,YAAM,WAAW,kBAAkB,EAAE,QAAQ,OAAO,CAAC,EAAE,MAAM,MAAM,IAAI;AACvE,YAAM,oBAAoB;AAC1B,aAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IACvC;AAEA,QAAI,QAAQ,WAAW,UAAU,UAAU,iBAAiB;AAC1D,YAAM,WAAW,sBAAsB,EAAE,QAAQ,OAAO,CAAC,EAAE,MAAM,MAAM,IAAI;AAC3E,YAAM,uBAAuB;AAC7B,aAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IACvC;AAEA,QAAI,QAAQ,WAAW,UAAU,UAAU,yBAAyB;AAClE,YAAM,OAAO,MAAM,SAAS,OAAO;AACnC,YAAM,iBACJ,QAAQ,OAAO,SAAS,YAAY,oBAAoB,OACnD,KAAiC,iBAClC;AACN,YAAM,WAAW,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAC/C,UAAI,OAAO,mBAAmB,UAAU;AACtC,cAAM,aAAa;AAAA,UACjB,UAAU;AAAA,UACV,UAAU;AAAA,UACV,MAAM;AAAA,UACN,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,QAAQ,KAAK,KAAK,KAAK;AAAA,QACzB;AACA,iBAAS,QAAQ,IAAI,GAAG,sBAAsB,gBAAgB,UAAU;AAAA,MAC1E;AACA,aAAO;AAAA,IACT;AAEA,WAAO,MAAM,SAAS,KAAK;AAAA,EAC7B;AAEA,SAAO;AAAA,IACL,UAAU;AAAA,MACR,KAAK;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP,QAAQ;AAAA,IACV;AAAA,IACA,YAAY;AAAA,IACZ,SAAS;AAAA,IACT,kBAAkB;AAAA,IAClB,aAAa;AAAA,IACb,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,kBAAkB;AAAA,IAClB,aAAa;AAAA,IACb,qBAAqB;AAAA,IACrB,cAAc,OAAO;AAAA,IACrB,aAAa,CAAC,UAAkB,YAAY,OAAO,OAAO,MAAM;AAAA,IAChE,WAAW,OAAO,eAAwB;AACxC,YAAM,aAAa,IAAI,kBAAkB;AACzC,UAAI,CAAC,WAAY,OAAM,IAAI,MAAM,oDAAoD;AACrF,YAAM,SAAS,WAAW,QAAQ,OAAO,EAAE;AAC3C,YAAM,MAAM,IAAI,IAAI,GAAG,MAAM,GAAG,OAAO,QAAQ,UAAU;AACzD,UAAI,WAAY,KAAI,aAAa,IAAI,cAAc,UAAU;AAC7D,aAAO,IAAI,SAAS;AAAA,IACtB;AAAA,EACF;AACF;AAEO,SAAS,SAAS,SAA8B;AACrD,SAAO,sBAAsB,OAAO,EAAE;AACxC;","names":[]}
+{"version":3,"sources":["../src/server.ts"],"sourcesContent":["import { cookies, headers } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport { NextResponse, type NextRequest } from \"next/server\";\nimport { createRemoteJWKSet, jwtVerify, type JWTPayload } from \"jose\";\n\nexport type GeekappsAuthConfig = {\n  /**\n   * Auth API/issuer URL. Optional when GEEKAPPS_AUTH_ISSUER or\n   * GEEKAPPS_AUTH_API_URL is defined.\n   */\n  issuer?: string;\n\n  /**\n   * OAuth client id. Optional when GEEKAPPS_AUTH_CLIENT_ID is defined.\n   */\n  clientId?: string;\n\n  /**\n   * OAuth client secret for confidential clients. Optional when\n   * GEEKAPPS_AUTH_CLIENT_SECRET is defined.\n   */\n  clientSecret?: string;\n\n  /**\n   * Callback URL. Optional when GEEKAPPS_AUTH_REDIRECT_URI is defined.\n   * If omitted, it is inferred from the current request origin + basePath/callback.\n   */\n  redirectUri?: string;\n\n  scopes?: string[];\n  basePath?: string;\n  /**\n   * @deprecated cookiePrefix is now auto-derived from clientId.\n   * This field is kept for backwards compatibility but is ignored.\n   */\n  cookiePrefix?: string;\n  secureCookies?: boolean;\n\n  /**\n   * Friendly alias used by apps. Same as afterSignInRedirectTo.\n   */\n  redirectTo?: string;\n\n  afterSignInRedirectTo?: string;\n  afterSignOutRedirectTo?: string;\n};\n\ntype ResolvedGeekappsAuthConfig = GeekappsAuthConfig & {\n  issuer: string;\n  clientId: string;\n  basePath: string;\n  cookiePrefix: string;\n};\n\nexport type SessionTokens = {\n  accessToken: string | null;\n  refreshToken: string | null;\n  idToken: string | null;\n  sessionId: string | null;\n};\n\nexport type StoredAccount = {\n  /** Stable identifier — `sub` from id_token or fallback to sessionId. */\n  id: string;\n  accessToken: string;\n  refreshToken: string | null;\n  idToken: string | null;\n  sessionId: string | null;\n  user: {\n    sub: string;\n    name?: string | null;\n    email?: string | null;\n    picture?: string | null;\n    phone?: string | null;\n  };\n};\n\nexport type ServerAuthApiClient = {\n  get: <T>(path: string) => Promise<T>;\n  post: <T>(path: string, body?: unknown) => Promise<T>;\n  patch: <T>(path: string, body?: unknown) => Promise<T>;\n  put: <T>(path: string, body?: unknown) => Promise<T>;\n  delete: <T>(path: string) => Promise<T>;\n};\n\ntype JsonObject = Record<string, unknown>;\n\ntype TokenLikeResponse = JsonObject & {\n  access_token?: string;\n  accessToken?: string;\n  refresh_token?: string;\n  refreshToken?: string;\n  id_token?: string;\n  idToken?: string;\n  session_id?: string;\n  sessionId?: string;\n  tokens?: {\n    access_token?: string;\n    accessToken?: string;\n    refresh_token?: string;\n    refreshToken?: string;\n    id_token?: string;\n    idToken?: string;\n    session_id?: string;\n    sessionId?: string;\n  };\n};\n\nconst MAX_ACCOUNTS = 8;\n\nfunction normalizeBaseUrl(url: string) {\n  return url.replace(/\\/$/, \"\");\n}\n\nfunction normalizeBasePath(path = \"/api/auth\") {\n  if (!path.startsWith(\"/\")) return `/${path}`;\n  return path.replace(/\\/$/, \"\");\n}\n\nfunction createUrl(baseUrl: string, path: string) {\n  if (/^https?:\\/\\//.test(path)) return path;\n  const normalizedPath = path.startsWith(\"/\") ? path : `/${path}`;\n  return `${normalizeBaseUrl(baseUrl)}${normalizedPath}`;\n}\n\nfunction env(name: string) {\n  const value = process.env[name];\n  return value && value.trim().length > 0 ? value : undefined;\n}\n\nfunction resolveIssuer(input: GeekappsAuthConfig) {\n  return normalizeBaseUrl(\n    input.issuer ??\n      env(\"GEEKAPPS_AUTH_ISSUER\") ??\n      env(\"GEEKAPPS_AUTH_API_URL\") ??\n      \"http://localhost:3020\",\n  );\n}\n\nfunction resolveClientId(input: GeekappsAuthConfig) {\n  return input.clientId ?? env(\"GEEKAPPS_AUTH_CLIENT_ID\") ?? \"\";\n}\n\nfunction resolveClientSecret(input: GeekappsAuthConfig) {\n  return input.clientSecret ?? env(\"GEEKAPPS_AUTH_CLIENT_SECRET\");\n}\n\nfunction applyClientCredentials(url: URL, config: ResolvedGeekappsAuthConfig) {\n  if (!config.clientId || !config.clientSecret) return;\n  url.searchParams.set(\"client_id\", config.clientId);\n  url.searchParams.set(\"client_secret\", config.clientSecret);\n}\n\nfunction resolveConfiguredRedirectUri(input: GeekappsAuthConfig) {\n  return input.redirectUri ?? env(\"GEEKAPPS_AUTH_REDIRECT_URI\");\n}\n\n/**\n * Derives a short stable 8-char hex hash from a clientId string.\n * Uses a simple djb2-style hash — no crypto dependency needed.\n */\nfunction hashClientId(clientId: string): string {\n  let h = 5381;\n  for (let i = 0; i < clientId.length; i++) {\n    h = ((h << 5) + h) ^ (clientId.charCodeAt(i) & 0xff);\n    h = h >>> 0; // keep unsigned 32-bit\n  }\n  return h.toString(16).padStart(8, \"0\");\n}\n\n/**\n * Auto-derives the cookie prefix from clientId.\n * Format: `gk_{8-char-hash}` — guaranteed unique per OAuth client.\n * Falls back to `gk` when clientId is empty (dev/test environments).\n */\nfunction deriveCookiePrefix(clientId: string): string {\n  if (!clientId) return \"gk\";\n  return `gk_${hashClientId(clientId)}`;\n}\n\nfunction requestOrigin(request: NextRequest) {\n  const configured = env(\"GEEKAPPS_APP_URL\");\n  if (configured) return configured.replace(/\\/$/, \"\");\n\n  throw new Error(\n    \"Cannot determine app origin. Set GEEKAPPS_APP_URL.\",\n  );\n}\n\nfunction resolveRedirectUri(config: ResolvedGeekappsAuthConfig, request: NextRequest) {\n  return config.redirectUri ?? `${requestOrigin(request)}${config.basePath}/callback`;\n}\n\nfunction tokenFromResponse(data: TokenLikeResponse): SessionTokens {\n  return {\n    accessToken: data.accessToken ?? data.access_token ?? data.tokens?.accessToken ?? data.tokens?.access_token ?? null,\n    refreshToken:\n      data.refreshToken ?? data.refresh_token ?? data.tokens?.refreshToken ?? data.tokens?.refresh_token ?? null,\n    idToken: data.idToken ?? data.id_token ?? data.tokens?.idToken ?? data.tokens?.id_token ?? null,\n    sessionId: data.sessionId ?? data.session_id ?? data.tokens?.sessionId ?? data.tokens?.session_id ?? null,\n  };\n}\n\n/** Decode a JWT payload without verifying signature (safe for client-visible claims). */\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split(\".\");\n    if (parts.length < 2) return null;\n    const payload = parts[1];\n    if (!payload) return null;\n    return JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf8\")) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nfunction parseAccountFromJwt(tokens: SessionTokens): StoredAccount | null {\n  if (!tokens.accessToken) return null;\n\n  const jwtToParse = tokens.idToken ?? tokens.accessToken;\n  const payload = decodeJwtPayload(jwtToParse);\n  if (!payload) return null;\n\n  const sub = typeof payload.sub === \"string\" ? payload.sub : null;\n  const id = sub ?? tokens.sessionId;\n  if (!id) return null;\n\n  return {\n    id,\n    accessToken: tokens.accessToken,\n    refreshToken: tokens.refreshToken,\n    idToken: tokens.idToken ?? null,\n    sessionId: tokens.sessionId,\n    user: {\n      sub: id,\n      name: typeof payload.name === \"string\" ? payload.name : null,\n      email: typeof payload.email === \"string\" ? payload.email : null,\n      picture: typeof payload.picture === \"string\" ? payload.picture : null,\n      phone: typeof payload.phone_number === \"string\" ? payload.phone_number : null,\n    },\n  };\n}\n\n/**\n * Cookie name scheme — 3 cookies per slot, each well under 4096 bytes:\n *\n *   {prefix}_m{n}   — metadata blob (base64url JSON): { id, sid?, n?, e?, p? }\n *                     Claims extracted from id_token at login. Never stores tokens.\n *   {prefix}_at{n}  — access token (httpOnly). ~1-2 KB.\n *   {prefix}_rt{n}  — refresh token (httpOnly). ~1 KB.\n *   {prefix}_active — active slot index (\"1\", \"2\", …)\n *   {prefix}_count  — total stored slots\n *   {prefix}_ao     — active org id for this app\n *   {prefix}_tp     — non-httpOnly copy of active access token for client-side axios\n *\n * id_token is NOT stored in cookies — claims are extracted at login and cached in\n * the metadata cookie. This is the key size saving.\n */\nfunction getCookieNames(prefix: string) {\n  return {\n    active: `${prefix}_active`,\n    count: `${prefix}_count`,\n    activeOrganizationId: `${prefix}_ao`,\n    tokenPub: `${prefix}_tp`,\n    slotMeta: (n: number) => `${prefix}_m${n}`,\n    slotAt: (n: number) => `${prefix}_at${n}`,\n    slotRt: (n: number) => `${prefix}_rt${n}`,\n  };\n}\n\ntype SlotMeta = {\n  id: string;\n  sid?: string;\n  n?: string;\n  e?: string;\n  p?: string;\n};\n\nfunction encodeMeta(account: StoredAccount): string {\n  const m: SlotMeta = { id: account.id };\n  if (account.sessionId) m.sid = account.sessionId;\n  if (account.user.name) m.n = account.user.name;\n  if (account.user.email) m.e = account.user.email;\n  if (account.user.picture) m.p = account.user.picture;\n  return Buffer.from(JSON.stringify(m), \"utf8\").toString(\"base64url\");\n}\n\nfunction decodeMeta(value: string): SlotMeta | null {\n  try {\n    const m = JSON.parse(Buffer.from(value, \"base64url\").toString(\"utf8\")) as SlotMeta;\n    return m.id ? m : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction getCookieOptions(config: ResolvedGeekappsAuthConfig) {\n  return {\n    httpOnly: true,\n    secure: config.secureCookies ?? process.env.NODE_ENV === \"production\",\n    sameSite: \"lax\" as const,\n    path: \"/\",\n  };\n}\n\nasync function readBody(request: NextRequest) {\n  const text = await request.text();\n  if (!text) return undefined;\n  try {\n    return JSON.parse(text);\n  } catch {\n    return text;\n  }\n}\n\nfunction appendSearchParams(url: string, request: NextRequest) {\n  const target = new URL(url);\n  request.nextUrl.searchParams.forEach((value, key) => {\n    target.searchParams.set(key, value);\n  });\n  return target.toString();\n}\n\nfunction routeFromRequest(request: NextRequest, basePath: string) {\n  const pathname = request.nextUrl.pathname;\n  if (!pathname.startsWith(basePath)) return pathname;\n  const route = pathname.slice(basePath.length);\n  return route || \"/\";\n}\n\nfunction isJsonResponse(response: Response) {\n  return response.headers.get(\"content-type\")?.includes(\"application/json\");\n}\n\nasync function responseFromApi(response: Response) {\n  if (response.status === 204) return new NextResponse(null, { status: 204 });\n  const body = isJsonResponse(response) ? await response.json().catch(() => null) : await response.text();\n  return NextResponse.json(body, { status: response.status });\n}\n\nconst _remoteJWKSCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\ntype ServiceTokenCache = { token: string; expiresAt: number };\nconst _serviceTokenCache = new Map<string, ServiceTokenCache>();\n\nasync function fetchServiceToken(issuer: string, clientId: string, clientSecret: string): Promise<string | null> {\n  const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString(\"base64\");\n  try {\n    const res = await fetch(createUrl(issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${credentials}`,\n      },\n      body: \"grant_type=service_account\",\n      cache: \"no-store\",\n    });\n    if (!res.ok) return null;\n    const data = (await res.json()) as { access_token?: string };\n    return data.access_token ?? null;\n  } catch {\n    return null;\n  }\n}\n\nasync function getServiceToken(issuer: string, clientId: string, clientSecret: string): Promise<string | null> {\n  const key = `${issuer}:${clientId}`;\n  const now = Date.now();\n  const cached = _serviceTokenCache.get(key);\n  if (cached && cached.expiresAt - 30_000 > now) return cached.token;\n  const token = await fetchServiceToken(issuer, clientId, clientSecret);\n  if (!token) return null;\n  _serviceTokenCache.set(key, { token, expiresAt: now + 420_000 });\n  return token;\n}\n\ntype ServiceAccountConfig = {\n  issuer?: string;\n  clientId?: string;\n  clientSecret?: string;\n};\n\n/**\n * Returns a service account access token.\n * Reads GEEKAPPS_AUTH_ISSUER, GEEKAPPS_SERVICE_ACCOUNT_CLIENT_ID,\n * GEEKAPPS_SERVICE_ACCOUNT_CLIENT_SECRET by default.\n * Any field can be overridden via the optional config argument.\n * Tokens are cached per client and auto-renewed before expiry (~7 min TTL).\n */\nexport function getServiceAccountToken(override: ServiceAccountConfig = {}): Promise<string | null> {\n  const issuer = normalizeBaseUrl(\n    override.issuer ??\n      env(\"GEEKAPPS_AUTH_ISSUER\") ??\n      env(\"GEEKAPPS_AUTH_API_URL\") ??\n      \"http://localhost:3020\",\n  );\n  const clientId = override.clientId ?? env(\"GEEKAPPS_SERVICE_ACCOUNT_CLIENT_ID\") ?? \"\";\n  const clientSecret = override.clientSecret ?? env(\"GEEKAPPS_SERVICE_ACCOUNT_CLIENT_SECRET\") ?? \"\";\n  if (!clientId || !clientSecret) return Promise.resolve(null);\n  return getServiceToken(issuer, clientId, clientSecret);\n}\n\nfunction getRemoteJWKS(issuer: string) {\n  if (!_remoteJWKSCache.has(issuer)) {\n    _remoteJWKSCache.set(issuer, createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`)));\n  }\n  return _remoteJWKSCache.get(issuer)!;\n}\n\nexport async function verifyToken(\n  token: string,\n  issuer: string,\n): Promise<JWTPayload | null> {\n  try {\n    const { payload } = await jwtVerify(token, getRemoteJWKS(issuer), {\n      algorithms: [\"RS256\"],\n      issuer,\n    });\n    return payload;\n  } catch {\n    return null;\n  }\n}\n\nexport function configureGeekappsAuth(input: GeekappsAuthConfig = {}) {\n  const clientId = resolveClientId(input);\n  const config: ResolvedGeekappsAuthConfig = {\n    ...input,\n    issuer: resolveIssuer(input),\n    clientId,\n    clientSecret: resolveClientSecret(input),\n    redirectUri: resolveConfiguredRedirectUri(input),\n    afterSignInRedirectTo:\n      input.afterSignInRedirectTo ?? input.redirectTo ?? \"/\",\n    basePath: normalizeBasePath(input.basePath),\n    cookiePrefix: deriveCookiePrefix(clientId),\n  };\n\n  const cn = getCookieNames(config.cookiePrefix);\n\n  // ── Slot helpers ──────────────────────────────────────────────────────────\n\n  async function getCount(): Promise<number> {\n    const cookieStore = await cookies();\n    const raw = cookieStore.get(cn.count)?.value;\n    const n = raw ? Number.parseInt(raw, 10) : 0;\n    return Number.isNaN(n) ? 0 : n;\n  }\n\n  async function getActiveIndex(): Promise<number> {\n    const cookieStore = await cookies();\n    const raw = cookieStore.get(cn.active)?.value;\n    if (!raw) return 0;\n    const n = Number.parseInt(raw, 10);\n    return Number.isNaN(n) ? 0 : n;\n  }\n\n  function readSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n  ): StoredAccount | null {\n    const at = cookieStore.get(cn.slotAt(n))?.value;\n    if (!at) return null;\n    const meta = decodeMeta(cookieStore.get(cn.slotMeta(n))?.value ?? \"\");\n    if (!meta) return null;\n    return {\n      id: meta.id,\n      accessToken: at,\n      refreshToken: cookieStore.get(cn.slotRt(n))?.value ?? null,\n      idToken: null, // not stored in cookies; claims are in meta\n      sessionId: meta.sid ?? null,\n      user: {\n        sub: meta.id,\n        name: meta.n ?? null,\n        email: meta.e ?? null,\n        picture: meta.p ?? null,\n      },\n    };\n  }\n\n  function writeSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n    account: StoredAccount,\n  ) {\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    cookieStore.set(cn.slotMeta(n), encodeMeta(account), opts);\n    cookieStore.set(cn.slotAt(n), account.accessToken, opts);\n    if (account.refreshToken) cookieStore.set(cn.slotRt(n), account.refreshToken, opts);\n  }\n\n  function clearSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n  ) {\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n    cookieStore.set(cn.slotMeta(n), \"\", clear);\n    cookieStore.set(cn.slotAt(n), \"\", clear);\n    cookieStore.set(cn.slotRt(n), \"\", clear);\n  }\n\n  // ── Public account helpers ─────────────────────────────────────────────────\n\n  async function getAccountsList(): Promise<StoredAccount[]> {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const accounts: StoredAccount[] = [];\n    for (let i = 1; i <= count; i++) {\n      const slot = readSlot(cookieStore, i);\n      if (slot) accounts.push(slot);\n    }\n    return accounts;\n  }\n\n  async function getActiveAccount(): Promise<StoredAccount | null> {\n    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);\n    if (count === 0) return null;\n    if (activeIdx >= 1 && activeIdx <= count) {\n      const slot = readSlot(cookieStore, activeIdx);\n      if (slot) return slot;\n    }\n    // Fall back to slot 1\n    return readSlot(cookieStore, 1);\n  }\n\n  async function getAccessToken() {\n    // Prefer the token injected by the middleware via request header (same-request refresh)\n    try {\n      const hdrs = await headers();\n      const auth = hdrs.get(\"authorization\");\n      if (auth?.startsWith(\"Bearer \")) return auth.slice(7);\n    } catch {}\n    const active = await getActiveAccount();\n    return active?.accessToken ?? null;\n  }\n\n  async function getRefreshToken() {\n    const active = await getActiveAccount();\n    return active?.refreshToken ?? null;\n  }\n\n  async function getSession(): Promise<SessionTokens | null> {\n    const active = await getActiveAccount();\n    if (!active) return null;\n    return {\n      accessToken: active.accessToken,\n      refreshToken: active.refreshToken,\n      idToken: active.idToken,\n      sessionId: active.sessionId,\n    };\n  }\n\n  async function getUser(): Promise<StoredAccount[\"user\"] | null> {\n    const active = await getActiveAccount();\n    return active?.user ?? null;\n  }\n\n  async function getOrganizations(): Promise<{ organizations: unknown[]; currentOrgId: string | null }> {\n    const cookieStore = await cookies();\n    const currentOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;\n    try {\n      const data = await apiRequest<unknown[] | { organizations: unknown[] }>(\"/organizations\");\n      const organizations = Array.isArray(data) ? data : (data as { organizations: unknown[] }).organizations;\n      return { organizations, currentOrgId };\n    } catch {\n      return { organizations: [], currentOrgId };\n    }\n  }\n\n  function clearPublicTokenCookie(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n  ) {\n    // Clear legacy _tp cookie if present\n    if (cookieStore.get(cn.tokenPub)?.value) {\n      cookieStore.set(cn.tokenPub, \"\", { httpOnly: false, maxAge: 0, path: \"/\" });\n    }\n  }\n\n  async function saveAccountToList(tokens: SessionTokens) {\n    const account = parseAccountFromJwt(tokens);\n    if (!account) return;\n\n    const cookieStore = await cookies();\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    const count = await getCount();\n\n    // Find existing slot for this account id\n    let targetSlot = 0;\n    for (let i = 1; i <= count; i++) {\n      const existing = readSlot(cookieStore, i);\n      if (existing?.id === account.id) {\n        targetSlot = i;\n        break;\n      }\n    }\n\n    if (targetSlot === 0) {\n      if (count >= MAX_ACCOUNTS) return;\n      targetSlot = count + 1;\n      cookieStore.set(cn.count, String(targetSlot), opts);\n    }\n\n    writeSlot(cookieStore, targetSlot, account);\n    cookieStore.set(cn.active, String(targetSlot), opts);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  // Alias for backwards compat\n  const setSessionCookies = saveAccountToList;\n\n  async function switchAccount(accountId: string): Promise<boolean> {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n\n    for (let i = 1; i <= count; i++) {\n      const slot = readSlot(cookieStore, i);\n      if (slot && (slot.id === accountId || slot.sessionId === accountId)) {\n        cookieStore.set(cn.active, String(i), opts);\n        clearPublicTokenCookie(cookieStore);\n        return true;\n      }\n    }\n    return false;\n  }\n\n  async function removeActiveAccount() {\n    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n\n    if (count === 0) return;\n\n    const remaining: StoredAccount[] = [];\n    for (let i = 1; i <= count; i++) {\n      if (i === activeIdx) continue;\n      const slot = readSlot(cookieStore, i);\n      if (slot) remaining.push(slot);\n    }\n\n    for (let i = 1; i <= count; i++) {\n      clearSlot(cookieStore, i);\n    }\n\n    if (remaining.length === 0) {\n      cookieStore.set(cn.count, \"0\", clear);\n      cookieStore.set(cn.active, \"0\", clear);\n      await clearPublicTokenCookie(cookieStore);\n      return;\n    }\n\n    // Re-compact remaining accounts into slots 1..n\n    for (let i = 0; i < remaining.length; i++) {\n      await writeSlot(cookieStore, i + 1, remaining[i]!);\n    }\n    cookieStore.set(cn.count, String(remaining.length), opts);\n    cookieStore.set(cn.active, \"1\", opts);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  async function clearAllSessionCookies() {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n    for (let i = 1; i <= count; i++) {\n      clearSlot(cookieStore, i);\n    }\n    cookieStore.set(cn.count, \"0\", clear);\n    cookieStore.set(cn.active, \"0\", clear);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  async function tryRefreshTokens(): Promise<string | null> {\n    const refreshToken = await getRefreshToken();\n    if (!refreshToken || !config.clientId) return null;\n\n    const basicAuth = Buffer.from(`${config.clientId}:${config.clientSecret ?? \"\"}`).toString(\"base64\");\n\n    const response = await fetch(createUrl(config.issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${basicAuth}`,\n      },\n      body: new URLSearchParams({\n        grant_type: \"refresh_token\",\n        refresh_token: refreshToken,\n      }),\n      cache: \"no-store\",\n    });\n\n    if (!response.ok) return null;\n\n    const data = (await response.json().catch(() => null)) as TokenLikeResponse | null;\n    if (!data) return null;\n\n    const tokens = tokenFromResponse(data);\n    if (!tokens.accessToken) return null;\n\n    await saveAccountToList(tokens);\n    return tokens.accessToken;\n  }\n\n  async function apiRequest<T>(path: string, init: RequestInit = {}): Promise<T> {\n    const accessToken = await getAccessToken();\n    const requestHeaders = new Headers(init.headers);\n\n    if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n    if (init.body !== undefined && !requestHeaders.has(\"content-type\")) {\n      requestHeaders.set(\"content-type\", \"application/json\");\n    }\n\n    const url = new URL(createUrl(config.issuer, path));\n    applyClientCredentials(url, config);\n\n    const response = await fetch(url, {\n      ...init,\n      headers: requestHeaders,\n      cache: \"no-store\",\n    });\n\n    if (response.status === 401) {\n      const newAccessToken = await tryRefreshTokens();\n      if (newAccessToken) {\n        const retryHeaders = new Headers(init.headers);\n        retryHeaders.set(\"authorization\", `Bearer ${newAccessToken}`);\n        if (init.body !== undefined && !retryHeaders.has(\"content-type\")) {\n          retryHeaders.set(\"content-type\", \"application/json\");\n        }\n        const retryUrl = new URL(createUrl(config.issuer, path));\n        applyClientCredentials(retryUrl, config);\n        const retryResponse = await fetch(retryUrl, {\n          ...init,\n          headers: retryHeaders,\n          cache: \"no-store\",\n        });\n        if (!retryResponse.ok) {\n          const error = await retryResponse.json().catch(() => null);\n          throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${retryResponse.status}`);\n        }\n        if (retryResponse.status === 204) return null as T;\n        return (await retryResponse.json()) as T;\n      }\n    }\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => null);\n      throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${response.status}`);\n    }\n\n    if (response.status === 204) return null as T;\n    return (await response.json()) as T;\n  }\n\n  function createApiClient(): ServerAuthApiClient {\n    return {\n      get: (path) => apiRequest(path),\n      post: (path, body) => apiRequest(path, { method: \"POST\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      patch: (path, body) => apiRequest(path, { method: \"PATCH\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      put: (path, body) => apiRequest(path, { method: \"PUT\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      delete: (path) => apiRequest(path, { method: \"DELETE\" }),\n    };\n  }\n\n  async function requireUser(options: { redirectTo?: string } = {}) {\n    const accessToken = await getAccessToken();\n    if (!accessToken) {\n      redirect(options.redirectTo ?? \"/\");\n    }\n    return accessToken;\n  }\n\n  function escapeHtml(str: string): string {\n    return str.replace(/&/g, \"&amp;\").replace(/</g, \"&lt;\").replace(/>/g, \"&gt;\").replace(/\"/g, \"&quot;\");\n  }\n\n  function sanitizeRedirectTo(value: string | null | undefined): string {\n    const raw = value ?? \"/\";\n    // Never redirect back into the auth basePath — that would loop or replay a stale code.\n    if (raw.startsWith(config.basePath)) return \"/\";\n    // Only allow relative paths to prevent open-redirect.\n    if (raw.startsWith(\"/\") && !raw.startsWith(\"//\")) return raw;\n    return \"/\";\n  }\n\n  async function createAuthorizeRedirect(request: NextRequest, mode: \"login\" | \"register\" | \"add-account\" | \"google\") {\n    const redirectTo = sanitizeRedirectTo(request.nextUrl.searchParams.get(\"redirectTo\") ?? config.afterSignInRedirectTo);\n    const flowId = request.nextUrl.searchParams.get(\"flow_id\");\n    const url = new URL(createUrl(config.issuer, mode === \"google\" ? \"/auth/google\" : \"/authorize\"));\n\n    if (!config.clientId) {\n      return NextResponse.json(\n        { error: \"missing_client_id\", message: \"Missing GEEKAPPS_AUTH_CLIENT_ID or clientId.\" },\n        { status: 500 },\n      );\n    }\n\n    url.searchParams.set(\"client_id\", config.clientId);\n    url.searchParams.set(\"redirect_uri\", resolveRedirectUri(config, request));\n    url.searchParams.set(\"response_type\", \"code\");\n    const scopes = config.scopes ?? [\"openid\", \"profile\", \"email\"];\n    if (!scopes.includes(\"offline_access\")) scopes.push(\"offline_access\");\n    url.searchParams.set(\"scope\", scopes.join(\" \"));\n    url.searchParams.set(\"state\", Buffer.from(JSON.stringify({ redirectTo, mode })).toString(\"base64url\"));\n    if (mode === \"register\") url.searchParams.set(\"screen_hint\", \"signup\");\n    if (mode === \"add-account\") {\n      url.searchParams.set(\"prompt\", \"login\");\n    } else {\n      // silentLogin=false forces the IDP to show the login screen even if a session exists.\n      // Default (omitted or true) lets the IDP reuse an existing session silently.\n      const silentLogin = request.nextUrl.searchParams.get(\"silentLogin\");\n      if (silentLogin === \"false\") url.searchParams.set(\"prompt\", \"login\");\n    }\n    if (flowId) url.searchParams.set(\"flow_id\", flowId);\n\n    return NextResponse.redirect(url);\n  }\n\n  async function exchangeCode(request: NextRequest) {\n    const code = request.nextUrl.searchParams.get(\"code\");\n    const state = request.nextUrl.searchParams.get(\"state\");\n\n    const origin = requestOrigin(request);\n\n    if (!code) {\n      const err = request.nextUrl.searchParams.get(\"error\") ?? \"missing_code\";\n      const desc = request.nextUrl.searchParams.get(\"error_description\") ?? request.nextUrl.searchParams.get(\"error_message\") ?? \"No authorization code received\";\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=${encodeURIComponent(err)}&error_description=${encodeURIComponent(desc)}`, origin));\n    }\n\n    if (!config.clientId) {\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=missing_client_id&error_description=Auth+client+is+not+configured`, origin));\n    }\n\n    const basicAuth = Buffer.from(\n      `${config.clientId}:${config.clientSecret ?? \"\"}`,\n    ).toString(\"base64\");\n\n    const response = await fetch(createUrl(config.issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${basicAuth}`,\n      },\n      body: new URLSearchParams({\n        grant_type: \"authorization_code\",\n        code,\n        redirect_uri: resolveRedirectUri(config, request),\n      }),\n      cache: \"no-store\",\n    });\n\n    const data = (await response.json().catch(() => ({}))) as TokenLikeResponse & { error?: string; error_description?: string };\n    if (!response.ok) {\n      const error = encodeURIComponent((data.error as string | undefined) ?? \"token_exchange_failed\");\n      const desc = encodeURIComponent((data.error_description as string | undefined) ?? `Token exchange failed with status ${response.status}`);\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=${error}&error_description=${desc}`, origin));\n    }\n\n    await saveAccountToList(tokenFromResponse(data));\n\n    let redirectTo = sanitizeRedirectTo(config.afterSignInRedirectTo);\n    if (state) {\n      try {\n        const parsed = JSON.parse(Buffer.from(state, \"base64url\").toString(\"utf8\")) as { redirectTo?: string };\n        redirectTo = sanitizeRedirectTo(parsed.redirectTo);\n      } catch {\n        // ignore malformed state\n      }\n    }\n\n    return NextResponse.redirect(new URL(redirectTo, origin));\n  }\n\n  function mapLocalPathToApiPath(route: string) {\n    if (route === \"/me\") return \"/auth/me\";\n    if (route === \"/accounts/switch\") return \"/auth/accounts/switch\";\n    if (route === \"/organizations/active\") return \"/auth/organizations/active\";\n    if (route === \"/permissions/check\") return \"/auth/permissions/check\";\n    if (route === \"/login/password\") return \"/auth/login/password\";\n    if (route === \"/register/password\") return \"/auth/register/password\";\n    if (route === \"/passwordless/link\") return \"/auth/passwordless/link\";\n    return route;\n  }\n\n  async function handleAccountsLocal(): Promise<NextResponse> {\n    const [accounts, activeIdx] = await Promise.all([getAccountsList(), getActiveIndex()]);\n\n    return NextResponse.json({\n      accounts: accounts.map((a, i) => ({\n        id: a.id,\n        sessionId: a.sessionId ?? a.id,\n        isActive: i + 1 === activeIdx,\n        user: {\n          id: a.user.sub,\n          name: a.user.name ?? null,\n          email: a.user.email ?? null,\n          imageUrl: a.user.picture ?? null,\n          phone: a.user.phone ?? null,\n        },\n      })),\n    });\n  }\n\n  async function handleOrganizationsLocal(): Promise<NextResponse> {\n    const cookieStore = await cookies();\n    const activeOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;\n    try {\n      const data = await apiRequest<unknown[]|{ organizations: unknown[] }>(\"/organizations\");\n      const organizations = Array.isArray(data) ? data : (data as { organizations: unknown[] }).organizations;\n      return NextResponse.json({ organizations, currentOrgId: activeOrgId });\n    } catch {\n      return NextResponse.json({ organizations: [], currentOrgId: activeOrgId });\n    }\n  }\n\n  async function handleSwitchAccountLocal(request: NextRequest): Promise<NextResponse> {\n    const body = await readBody(request);\n    const targetId =\n      body && typeof body === \"object\"\n        ? String(\n            (body as Record<string, unknown>).accountId ??\n            (body as Record<string, unknown>).sessionId ??\n            \"\",\n          )\n        : \"\";\n\n    if (!targetId) {\n      return NextResponse.json({ error: \"accountId required\" }, { status: 400 });\n    }\n\n    const switched = await switchAccount(targetId);\n    if (!switched) {\n      return NextResponse.json({ error: \"Account not found\" }, { status: 404 });\n    }\n\n    return NextResponse.json({ ok: true });\n  }\n\n  async function proxy(request: NextRequest, route: string) {\n    const accessToken = await getAccessToken();\n    const body = [\"GET\", \"HEAD\"].includes(request.method) ? undefined : await readBody(request);\n    const url = new URL(appendSearchParams(createUrl(config.issuer, mapLocalPathToApiPath(route)), request));\n    applyClientCredentials(url, config);\n    const requestHeaders = new Headers();\n\n    if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n    if (body !== undefined) requestHeaders.set(\"content-type\", \"application/json\");\n\n    const response = await fetch(url, {\n      method: request.method,\n      headers: requestHeaders,\n      body: body === undefined ? undefined : typeof body === \"string\" ? body : JSON.stringify(body),\n      cache: \"no-store\",\n    });\n\n    const data = isJsonResponse(response) ? ((await response.json().catch(() => null)) as TokenLikeResponse | null) : null;\n    if (data) {\n      const tokens = tokenFromResponse(data);\n      if (tokens.accessToken || tokens.refreshToken || tokens.idToken || tokens.sessionId) {\n        await saveAccountToList(tokens);\n      }\n      return NextResponse.json(data, { status: response.status });\n    }\n\n    return responseFromApi(response);\n  }\n\n  async function handle(request: NextRequest) {\n    const route = routeFromRequest(request, config.basePath);\n\n    if (request.method === \"GET\" && route === \"/sign-in\") return createAuthorizeRedirect(request, \"login\");\n    if (request.method === \"GET\" && route === \"/sign-up\") return createAuthorizeRedirect(request, \"register\");\n    if (request.method === \"GET\" && route === \"/add-account\") return createAuthorizeRedirect(request, \"add-account\");\n    if (request.method === \"GET\" && route === \"/login/google\") return createAuthorizeRedirect(request, \"google\");\n    if (request.method === \"GET\" && route === \"/callback\") {\n      const error = request.nextUrl.searchParams.get(\"error\");\n      if (error) {\n        const description = request.nextUrl.searchParams.get(\"error_description\") ?? request.nextUrl.searchParams.get(\"error_message\") ?? \"An authentication error occurred.\";\n        return new NextResponse(\n          `<!doctype html><html><head><meta charset=\"utf-8\"><title>Authentication Error</title></head><body style=\"font-family:sans-serif;max-width:480px;margin:80px auto;padding:0 16px\"><h2>Authentication Error</h2><p><strong>${escapeHtml(error)}</strong></p><p>${escapeHtml(description)}</p><a href=\"/\">Go back</a></body></html>`,\n          { status: 400, headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n        );\n      }\n      return exchangeCode(request);\n    }\n    if (request.method === \"GET\" && route === \"/token\") {\n      const accessToken = await getAccessToken();\n      if (!accessToken) return NextResponse.json({ error: \"missing_token\" }, { status: 401 });\n      return NextResponse.json({ accessToken });\n    }\n\n\n    if (request.method === \"GET\" && route === \"/accounts\") return handleAccountsLocal();\n    if (request.method === \"POST\" && route === \"/accounts/switch\") return handleSwitchAccountLocal(request);\n    if (request.method === \"GET\" && route === \"/organizations\") return handleOrganizationsLocal();\n\n    if (request.method === \"POST\" && route === \"/organizations\") {\n      const accessToken = await getAccessToken();\n      const body = (await readBody(request)) as Record<string, unknown> | undefined;\n      if (body && accessToken && !body.applicationId) {\n        const claims = decodeJwtPayload(accessToken);\n        const applicationId =\n          (typeof claims?.application_id === \"string\" ? claims.application_id : null) ??\n          (typeof claims?.client_id === \"string\" ? claims.client_id : null) ??\n          (typeof claims?.applicationId === \"string\" ? claims.applicationId : null);\n        if (applicationId) body.applicationId = applicationId;\n      }\n      const orgUrl = new URL(createUrl(config.issuer, \"/organizations\"));\n      applyClientCredentials(orgUrl, config);\n      const requestHeaders = new Headers();\n      if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n      if (body !== undefined) requestHeaders.set(\"content-type\", \"application/json\");\n      const response = await fetch(orgUrl, {\n        method: \"POST\",\n        headers: requestHeaders,\n        body: JSON.stringify(body),\n        cache: \"no-store\",\n      });\n      return responseFromApi(response);\n    }\n\n    if (request.method === \"POST\" && route === \"/sign-out\") {\n      await apiRequest(\"/auth/sign-out\", { method: \"POST\" }).catch(() => null);\n      await removeActiveAccount();\n      return NextResponse.json({ ok: true });\n    }\n\n    if (request.method === \"POST\" && route === \"/sign-out-all\") {\n      await apiRequest(\"/auth/sign-out-all\", { method: \"POST\" }).catch(() => null);\n      await clearAllSessionCookies();\n      return NextResponse.json({ ok: true });\n    }\n\n    if (request.method === \"POST\" && route === \"/organizations/active\") {\n      const body = await readBody(request);\n      const organizationId =\n        body && typeof body === \"object\" && \"organizationId\" in body\n          ? (body as Record<string, unknown>).organizationId\n          : null;\n      const response = NextResponse.json({ ok: true });\n      if (typeof organizationId === \"string\") {\n        const cookieOpts = {\n          httpOnly: true,\n          sameSite: \"lax\" as const,\n          path: \"/\",\n          secure: process.env.NODE_ENV === \"production\",\n          maxAge: 60 * 60 * 24 * 7,\n        };\n        response.cookies.set(cn.activeOrganizationId, organizationId, cookieOpts);\n      }\n      return response;\n    }\n\n    return proxy(request, route);\n  }\n\n  return {\n    handlers: {\n      GET: handle,\n      POST: handle,\n      PATCH: handle,\n      DELETE: handle,\n    },\n    GetSession: getSession,\n    GetUser: getUser,\n    GetOrganizations: getOrganizations,\n    SaveSession: saveAccountToList,\n    GetAccessToken: getAccessToken,\n    GetRefreshToken: getRefreshToken,\n    IsAuthenticated: async () => (await getAccessToken()) !== null,\n    TryRefreshTokens: tryRefreshTokens,\n    RequireUser: requireUser,\n    CreateAuthApiClient: createApiClient,\n    cookiePrefix: config.cookiePrefix,\n    VerifyToken: (token: string) => verifyToken(token, config.issuer),\n    SignInUrl: async (redirectTo?: string) => {\n      const configured = env(\"GEEKAPPS_APP_URL\");\n      if (!configured) throw new Error(\"Cannot determine app origin. Set GEEKAPPS_APP_URL.\");\n      const origin = configured.replace(/\\/$/, \"\");\n      const url = new URL(`${origin}${config.basePath}/sign-in`);\n      if (redirectTo) url.searchParams.set(\"redirectTo\", redirectTo);\n      return url.toString();\n    },\n  };\n}\n\nexport function handlers(options?: GeekappsAuthConfig) {\n  return configureGeekappsAuth(options).handlers;\n}\n\n/**\n * Returns true if the current request has a valid access token in cookies.\n * Safe to call in Server Components, Server Actions, and Route Handlers.\n */\nexport async function isAuthenticated(options?: GeekappsAuthConfig): Promise<boolean> {\n  const { GetAccessToken } = configureGeekappsAuth(options);\n  return (await GetAccessToken()) !== null;\n}\n"],"mappings":";AAAA,SAAS,SAAS,eAAe;AACjC,SAAS,gBAAgB;AACzB,SAAS,oBAAsC;AAC/C,SAAS,oBAAoB,iBAAkC;AAyG/D,IAAM,eAAe;AAErB,SAAS,iBAAiB,KAAa;AACrC,SAAO,IAAI,QAAQ,OAAO,EAAE;AAC9B;AAEA,SAAS,kBAAkB,OAAO,aAAa;AAC7C,MAAI,CAAC,KAAK,WAAW,GAAG,EAAG,QAAO,IAAI,IAAI;AAC1C,SAAO,KAAK,QAAQ,OAAO,EAAE;AAC/B;AAEA,SAAS,UAAU,SAAiB,MAAc;AAChD,MAAI,eAAe,KAAK,IAAI,EAAG,QAAO;AACtC,QAAM,iBAAiB,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AAC7D,SAAO,GAAG,iBAAiB,OAAO,CAAC,GAAG,cAAc;AACtD;AAEA,SAAS,IAAI,MAAc;AACzB,QAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,SAAO,SAAS,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AACpD;AAEA,SAAS,cAAc,OAA2B;AAChD,SAAO;AAAA,IACL,MAAM,UACJ,IAAI,sBAAsB,KAC1B,IAAI,uBAAuB,KAC3B;AAAA,EACJ;AACF;AAEA,SAAS,gBAAgB,OAA2B;AAClD,SAAO,MAAM,YAAY,IAAI,yBAAyB,KAAK;AAC7D;AAEA,SAAS,oBAAoB,OAA2B;AACtD,SAAO,MAAM,gBAAgB,IAAI,6BAA6B;AAChE;AAEA,SAAS,uBAAuB,KAAU,QAAoC;AAC5E,MAAI,CAAC,OAAO,YAAY,CAAC,OAAO,aAAc;AAC9C,MAAI,aAAa,IAAI,aAAa,OAAO,QAAQ;AACjD,MAAI,aAAa,IAAI,iBAAiB,OAAO,YAAY;AAC3D;AAEA,SAAS,6BAA6B,OAA2B;AAC/D,SAAO,MAAM,eAAe,IAAI,4BAA4B;AAC9D;AAMA,SAAS,aAAa,UAA0B;AAC9C,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,SAAM,KAAK,KAAK,IAAM,SAAS,WAAW,CAAC,IAAI;AAC/C,QAAI,MAAM;AAAA,EACZ;AACA,SAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACvC;AAOA,SAAS,mBAAmB,UAA0B;AACpD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,MAAM,aAAa,QAAQ,CAAC;AACrC;AAEA,SAAS,cAAc,SAAsB;AAC3C,QAAM,aAAa,IAAI,kBAAkB;AACzC,MAAI,WAAY,QAAO,WAAW,QAAQ,OAAO,EAAE;AAEnD,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,QAAoC,SAAsB;AACpF,SAAO,OAAO,eAAe,GAAG,cAAc,OAAO,CAAC,GAAG,OAAO,QAAQ;AAC1E;AAEA,SAAS,kBAAkB,MAAwC;AACjE,SAAO;AAAA,IACL,aAAa,KAAK,eAAe,KAAK,gBAAgB,KAAK,QAAQ,eAAe,KAAK,QAAQ,gBAAgB;AAAA,IAC/G,cACE,KAAK,gBAAgB,KAAK,iBAAiB,KAAK,QAAQ,gBAAgB,KAAK,QAAQ,iBAAiB;AAAA,IACxG,SAAS,KAAK,WAAW,KAAK,YAAY,KAAK,QAAQ,WAAW,KAAK,QAAQ,YAAY;AAAA,IAC3F,WAAW,KAAK,aAAa,KAAK,cAAc,KAAK,QAAQ,aAAa,KAAK,QAAQ,cAAc;AAAA,EACvG;AACF;AAGA,SAAS,iBAAiB,OAA+C;AACvE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,SAAS,EAAG,QAAO;AAC7B,UAAM,UAAU,MAAM,CAAC;AACvB,QAAI,CAAC,QAAS,QAAO;AACrB,WAAO,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,EACtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,QAA6C;AACxE,MAAI,CAAC,OAAO,YAAa,QAAO;AAEhC,QAAM,aAAa,OAAO,WAAW,OAAO;AAC5C,QAAM,UAAU,iBAAiB,UAAU;AAC3C,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAM,KAAK,OAAO,OAAO;AACzB,MAAI,CAAC,GAAI,QAAO;AAEhB,SAAO;AAAA,IACL;AAAA,IACA,aAAa,OAAO;AAAA,IACpB,cAAc,OAAO;AAAA,IACrB,SAAS,OAAO,WAAW;AAAA,IAC3B,WAAW,OAAO;AAAA,IAClB,MAAM;AAAA,MACJ,KAAK;AAAA,MACL,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,MACxD,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,MAC3D,SAAS,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU;AAAA,MACjE,OAAO,OAAO,QAAQ,iBAAiB,WAAW,QAAQ,eAAe;AAAA,IAC3E;AAAA,EACF;AACF;AAiBA,SAAS,eAAe,QAAgB;AACtC,SAAO;AAAA,IACL,QAAQ,GAAG,MAAM;AAAA,IACjB,OAAO,GAAG,MAAM;AAAA,IAChB,sBAAsB,GAAG,MAAM;AAAA,IAC/B,UAAU,GAAG,MAAM;AAAA,IACnB,UAAU,CAAC,MAAc,GAAG,MAAM,KAAK,CAAC;AAAA,IACxC,QAAQ,CAAC,MAAc,GAAG,MAAM,MAAM,CAAC;AAAA,IACvC,QAAQ,CAAC,MAAc,GAAG,MAAM,MAAM,CAAC;AAAA,EACzC;AACF;AAUA,SAAS,WAAW,SAAgC;AAClD,QAAM,IAAc,EAAE,IAAI,QAAQ,GAAG;AACrC,MAAI,QAAQ,UAAW,GAAE,MAAM,QAAQ;AACvC,MAAI,QAAQ,KAAK,KAAM,GAAE,IAAI,QAAQ,KAAK;AAC1C,MAAI,QAAQ,KAAK,MAAO,GAAE,IAAI,QAAQ,KAAK;AAC3C,MAAI,QAAQ,KAAK,QAAS,GAAE,IAAI,QAAQ,KAAK;AAC7C,SAAO,OAAO,KAAK,KAAK,UAAU,CAAC,GAAG,MAAM,EAAE,SAAS,WAAW;AACpE;AAEA,SAAS,WAAW,OAAgC;AAClD,MAAI;AACF,UAAM,IAAI,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM,CAAC;AACrE,WAAO,EAAE,KAAK,IAAI;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,QAAoC;AAC5D,SAAO;AAAA,IACL,UAAU;AAAA,IACV,QAAQ,OAAO,iBAAiB,QAAQ,IAAI,aAAa;AAAA,IACzD,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACF;AAEA,eAAe,SAAS,SAAsB;AAC5C,QAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,KAAa,SAAsB;AAC7D,QAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,UAAQ,QAAQ,aAAa,QAAQ,CAAC,OAAO,QAAQ;AACnD,WAAO,aAAa,IAAI,KAAK,KAAK;AAAA,EACpC,CAAC;AACD,SAAO,OAAO,SAAS;AACzB;AAEA,SAAS,iBAAiB,SAAsB,UAAkB;AAChE,QAAM,WAAW,QAAQ,QAAQ;AACjC,MAAI,CAAC,SAAS,WAAW,QAAQ,EAAG,QAAO;AAC3C,QAAM,QAAQ,SAAS,MAAM,SAAS,MAAM;AAC5C,SAAO,SAAS;AAClB;AAEA,SAAS,eAAe,UAAoB;AAC1C,SAAO,SAAS,QAAQ,IAAI,cAAc,GAAG,SAAS,kBAAkB;AAC1E;AAEA,eAAe,gBAAgB,UAAoB;AACjD,MAAI,SAAS,WAAW,IAAK,QAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAC1E,QAAM,OAAO,eAAe,QAAQ,IAAI,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI,IAAI,MAAM,SAAS,KAAK;AACtG,SAAO,aAAa,KAAK,MAAM,EAAE,QAAQ,SAAS,OAAO,CAAC;AAC5D;AAEA,IAAM,mBAAmB,oBAAI,IAAmD;AAGhF,IAAM,qBAAqB,oBAAI,IAA+B;AAE9D,eAAe,kBAAkB,QAAgB,UAAkB,cAA8C;AAC/G,QAAM,cAAc,OAAO,KAAK,GAAG,QAAQ,IAAI,YAAY,EAAE,EAAE,SAAS,QAAQ;AAChF,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,UAAU,QAAQ,aAAa,GAAG;AAAA,MACxD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,SAAS,WAAW;AAAA,MACrC;AAAA,MACA,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,WAAO,KAAK,gBAAgB;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,gBAAgB,QAAgB,UAAkB,cAA8C;AAC7G,QAAM,MAAM,GAAG,MAAM,IAAI,QAAQ;AACjC,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,SAAS,mBAAmB,IAAI,GAAG;AACzC,MAAI,UAAU,OAAO,YAAY,MAAS,IAAK,QAAO,OAAO;AAC7D,QAAM,QAAQ,MAAM,kBAAkB,QAAQ,UAAU,YAAY;AACpE,MAAI,CAAC,MAAO,QAAO;AACnB,qBAAmB,IAAI,KAAK,EAAE,OAAO,WAAW,MAAM,KAAQ,CAAC;AAC/D,SAAO;AACT;AAeO,SAAS,uBAAuB,WAAiC,CAAC,GAA2B;AAClG,QAAM,SAAS;AAAA,IACb,SAAS,UACP,IAAI,sBAAsB,KAC1B,IAAI,uBAAuB,KAC3B;AAAA,EACJ;AACA,QAAM,WAAW,SAAS,YAAY,IAAI,oCAAoC,KAAK;AACnF,QAAM,eAAe,SAAS,gBAAgB,IAAI,wCAAwC,KAAK;AAC/F,MAAI,CAAC,YAAY,CAAC,aAAc,QAAO,QAAQ,QAAQ,IAAI;AAC3D,SAAO,gBAAgB,QAAQ,UAAU,YAAY;AACvD;AAEA,SAAS,cAAc,QAAgB;AACrC,MAAI,CAAC,iBAAiB,IAAI,MAAM,GAAG;AACjC,qBAAiB,IAAI,QAAQ,mBAAmB,IAAI,IAAI,GAAG,MAAM,wBAAwB,CAAC,CAAC;AAAA,EAC7F;AACA,SAAO,iBAAiB,IAAI,MAAM;AACpC;AAEA,eAAsB,YACpB,OACA,QAC4B;AAC5B,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,cAAc,MAAM,GAAG;AAAA,MAChE,YAAY,CAAC,OAAO;AAAA,MACpB;AAAA,IACF,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,sBAAsB,QAA4B,CAAC,GAAG;AACpE,QAAM,WAAW,gBAAgB,KAAK;AACtC,QAAM,SAAqC;AAAA,IACzC,GAAG;AAAA,IACH,QAAQ,cAAc,KAAK;AAAA,IAC3B;AAAA,IACA,cAAc,oBAAoB,KAAK;AAAA,IACvC,aAAa,6BAA6B,KAAK;AAAA,IAC/C,uBACE,MAAM,yBAAyB,MAAM,cAAc;AAAA,IACrD,UAAU,kBAAkB,MAAM,QAAQ;AAAA,IAC1C,cAAc,mBAAmB,QAAQ;AAAA,EAC3C;AAEA,QAAM,KAAK,eAAe,OAAO,YAAY;AAI7C,iBAAe,WAA4B;AACzC,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,MAAM,YAAY,IAAI,GAAG,KAAK,GAAG;AACvC,UAAM,IAAI,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AAC3C,WAAO,OAAO,MAAM,CAAC,IAAI,IAAI;AAAA,EAC/B;AAEA,iBAAe,iBAAkC;AAC/C,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,MAAM,YAAY,IAAI,GAAG,MAAM,GAAG;AACxC,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,IAAI,OAAO,SAAS,KAAK,EAAE;AACjC,WAAO,OAAO,MAAM,CAAC,IAAI,IAAI;AAAA,EAC/B;AAEA,WAAS,SACP,aACA,GACsB;AACtB,UAAM,KAAK,YAAY,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG;AAC1C,QAAI,CAAC,GAAI,QAAO;AAChB,UAAM,OAAO,WAAW,YAAY,IAAI,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,EAAE;AACpE,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO;AAAA,MACL,IAAI,KAAK;AAAA,MACT,aAAa;AAAA,MACb,cAAc,YAAY,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS;AAAA,MACtD,SAAS;AAAA;AAAA,MACT,WAAW,KAAK,OAAO;AAAA,MACvB,MAAM;AAAA,QACJ,KAAK,KAAK;AAAA,QACV,MAAM,KAAK,KAAK;AAAA,QAChB,OAAO,KAAK,KAAK;AAAA,QACjB,SAAS,KAAK,KAAK;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,WAAS,UACP,aACA,GACA,SACA;AACA,UAAM,OAAO,EAAE,GAAG,iBAAiB,MAAM,GAAG,QAAQ,KAAK,KAAK,KAAK,GAAG;AACtE,gBAAY,IAAI,GAAG,SAAS,CAAC,GAAG,WAAW,OAAO,GAAG,IAAI;AACzD,gBAAY,IAAI,GAAG,OAAO,CAAC,GAAG,QAAQ,aAAa,IAAI;AACvD,QAAI,QAAQ,aAAc,aAAY,IAAI,GAAG,OAAO,CAAC,GAAG,QAAQ,cAAc,IAAI;AAAA,EACpF;AAEA,WAAS,UACP,aACA,GACA;AACA,UAAM,QAAQ,EAAE,GAAG,iBAAiB,MAAM,GAAG,QAAQ,EAAE;AACvD,gBAAY,IAAI,GAAG,SAAS,CAAC,GAAG,IAAI,KAAK;AACzC,gBAAY,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,KAAK;AACvC,gBAAY,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,KAAK;AAAA,EACzC;AAIA,iBAAe,kBAA4C;AACzD,UAAM,CAAC,aAAa,KAAK,IAAI,MAAM,QAAQ,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;AACtE,UAAM,WAA4B,CAAC;AACnC,aAAS,IAAI,GAAG,KAAK,OAAO,KAAK;AAC/B,YAAM,OAAO,SAAS,aAAa,CAAC;AACpC,UAAI,KAAM,UAAS,KAAK,IAAI;AAAA,IAC9B;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,mBAAkD;AAC/D,UAAM,CAAC,aAAa,WAAW,KAAK,IAAI,MAAM,QAAQ,IAAI,CAAC,QAAQ,GAAG,eAAe,GAAG,SAAS,CAAC,CAAC;AACnG,QAAI,UAAU,EAAG,QAAO;AACxB,QAAI,aAAa,KAAK,aAAa,OAAO;AACxC,YAAM,OAAO,SAAS,aAAa,SAAS;AAC5C,UAAI,KAAM,QAAO;AAAA,IACnB;AAEA,WAAO,SAAS,aAAa,CAAC;AAAA,EAChC;AAEA,iBAAe,iBAAiB;AAE9B,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ;AAC3B,YAAM,OAAO,KAAK,IAAI,eAAe;AACrC,UAAI,MAAM,WAAW,SAAS,EAAG,QAAO,KAAK,MAAM,CAAC;AAAA,IACtD,QAAQ;AAAA,IAAC;AACT,UAAM,SAAS,MAAM,iBAAiB;AACtC,WAAO,QAAQ,eAAe;AAAA,EAChC;AAEA,iBAAe,kBAAkB;AAC/B,UAAM,SAAS,MAAM,iBAAiB;AACtC,WAAO,QAAQ,gBAAgB;AAAA,EACjC;AAEA,iBAAe,aAA4C;AACzD,UAAM,SAAS,MAAM,iBAAiB;AACtC,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO;AAAA,MACL,aAAa,OAAO;AAAA,MACpB,cAAc,OAAO;AAAA,MACrB,SAAS,OAAO;AAAA,MAChB,WAAW,OAAO;AAAA,IACpB;AAAA,EACF;AAEA,iBAAe,UAAiD;AAC9D,UAAM,SAAS,MAAM,iBAAiB;AACtC,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAEA,iBAAe,mBAAuF;AACpG,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,eAAe,YAAY,IAAI,GAAG,oBAAoB,GAAG,SAAS;AACxE,QAAI;AACF,YAAM,OAAO,MAAM,WAAqD,gBAAgB;AACxF,YAAM,gBAAgB,MAAM,QAAQ,IAAI,IAAI,OAAQ,KAAsC;AAC1F,aAAO,EAAE,eAAe,aAAa;AAAA,IACvC,QAAQ;AACN,aAAO,EAAE,eAAe,CAAC,GAAG,aAAa;AAAA,IAC3C;AAAA,EACF;AAEA,WAAS,uBACP,aACA;AAEA,QAAI,YAAY,IAAI,GAAG,QAAQ,GAAG,OAAO;AACvC,kBAAY,IAAI,GAAG,UAAU,IAAI,EAAE,UAAU,OAAO,QAAQ,GAAG,MAAM,IAAI,CAAC;AAAA,IAC5E;AAAA,EACF;AAEA,iBAAe,kBAAkB,QAAuB;AACtD,UAAM,UAAU,oBAAoB,MAAM;AAC1C,QAAI,CAAC,QAAS;AAEd,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,OAAO,EAAE,GAAG,iBAAiB,MAAM,GAAG,QAAQ,KAAK,KAAK,KAAK,GAAG;AACtE,UAAM,QAAQ,MAAM,SAAS;AAG7B,QAAI,aAAa;AACjB,aAAS,IAAI,GAAG,KAAK,OAAO,KAAK;AAC/B,YAAM,WAAW,SAAS,aAAa,CAAC;AACxC,UAAI,UAAU,OAAO,QAAQ,IAAI;AAC/B,qBAAa;AACb;AAAA,MACF;AAAA,IACF;AAEA,QAAI,eAAe,GAAG;AACpB,UAAI,SAAS,aAAc;AAC3B,mBAAa,QAAQ;AACrB,kBAAY,IAAI,GAAG,OAAO,OAAO,UAAU,GAAG,IAAI;AAAA,IACpD;AAEA,cAAU,aAAa,YAAY,OAAO;AAC1C,gBAAY,IAAI,GAAG,QAAQ,OAAO,UAAU,GAAG,IAAI;AACnD,2BAAuB,WAAW;AAAA,EACpC;AAGA,QAAM,oBAAoB;AAE1B,iBAAe,cAAc,WAAqC;AAChE,UAAM,CAAC,aAAa,KAAK,IAAI,MAAM,QAAQ,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;AACtE,UAAM,OAAO,EAAE,GAAG,iBAAiB,MAAM,GAAG,QAAQ,KAAK,KAAK,KAAK,GAAG;AAEtE,aAAS,IAAI,GAAG,KAAK,OAAO,KAAK;AAC/B,YAAM,OAAO,SAAS,aAAa,CAAC;AACpC,UAAI,SAAS,KAAK,OAAO,aAAa,KAAK,cAAc,YAAY;AACnE,oBAAY,IAAI,GAAG,QAAQ,OAAO,CAAC,GAAG,IAAI;AAC1C,+BAAuB,WAAW;AAClC,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,sBAAsB;AACnC,UAAM,CAAC,aAAa,WAAW,KAAK,IAAI,MAAM,QAAQ,IAAI,CAAC,QAAQ,GAAG,eAAe,GAAG,SAAS,CAAC,CAAC;AACnG,UAAM,OAAO,EAAE,GAAG,iBAAiB,MAAM,GAAG,QAAQ,KAAK,KAAK,KAAK,GAAG;AACtE,UAAM,QAAQ,EAAE,GAAG,iBAAiB,MAAM,GAAG,QAAQ,EAAE;AAEvD,QAAI,UAAU,EAAG;AAEjB,UAAM,YAA6B,CAAC;AACpC,aAAS,IAAI,GAAG,KAAK,OAAO,KAAK;AAC/B,UAAI,MAAM,UAAW;AACrB,YAAM,OAAO,SAAS,aAAa,CAAC;AACpC,UAAI,KAAM,WAAU,KAAK,IAAI;AAAA,IAC/B;AAEA,aAAS,IAAI,GAAG,KAAK,OAAO,KAAK;AAC/B,gBAAU,aAAa,CAAC;AAAA,IAC1B;AAEA,QAAI,UAAU,WAAW,GAAG;AAC1B,kBAAY,IAAI,GAAG,OAAO,KAAK,KAAK;AACpC,kBAAY,IAAI,GAAG,QAAQ,KAAK,KAAK;AACrC,YAAM,uBAAuB,WAAW;AACxC;AAAA,IACF;AAGA,aAAS,IAAI,GAAG,IAAI,UAAU,QAAQ,KAAK;AACzC,YAAM,UAAU,aAAa,IAAI,GAAG,UAAU,CAAC,CAAE;AAAA,IACnD;AACA,gBAAY,IAAI,GAAG,OAAO,OAAO,UAAU,MAAM,GAAG,IAAI;AACxD,gBAAY,IAAI,GAAG,QAAQ,KAAK,IAAI;AACpC,2BAAuB,WAAW;AAAA,EACpC;AAEA,iBAAe,yBAAyB;AACtC,UAAM,CAAC,aAAa,KAAK,IAAI,MAAM,QAAQ,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;AACtE,UAAM,QAAQ,EAAE,GAAG,iBAAiB,MAAM,GAAG,QAAQ,EAAE;AACvD,aAAS,IAAI,GAAG,KAAK,OAAO,KAAK;AAC/B,gBAAU,aAAa,CAAC;AAAA,IAC1B;AACA,gBAAY,IAAI,GAAG,OAAO,KAAK,KAAK;AACpC,gBAAY,IAAI,GAAG,QAAQ,KAAK,KAAK;AACrC,2BAAuB,WAAW;AAAA,EACpC;AAEA,iBAAe,mBAA2C;AACxD,UAAM,eAAe,MAAM,gBAAgB;AAC3C,QAAI,CAAC,gBAAgB,CAAC,OAAO,SAAU,QAAO;AAE9C,UAAM,YAAY,OAAO,KAAK,GAAG,OAAO,QAAQ,IAAI,OAAO,gBAAgB,EAAE,EAAE,EAAE,SAAS,QAAQ;AAElG,UAAM,WAAW,MAAM,MAAM,UAAU,OAAO,QAAQ,aAAa,GAAG;AAAA,MACpE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,SAAS,SAAS;AAAA,MACnC;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe;AAAA,MACjB,CAAC;AAAA,MACD,OAAO;AAAA,IACT,CAAC;AAED,QAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,UAAM,OAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACpD,QAAI,CAAC,KAAM,QAAO;AAElB,UAAM,SAAS,kBAAkB,IAAI;AACrC,QAAI,CAAC,OAAO,YAAa,QAAO;AAEhC,UAAM,kBAAkB,MAAM;AAC9B,WAAO,OAAO;AAAA,EAChB;AAEA,iBAAe,WAAc,MAAc,OAAoB,CAAC,GAAe;AAC7E,UAAM,cAAc,MAAM,eAAe;AACzC,UAAM,iBAAiB,IAAI,QAAQ,KAAK,OAAO;AAE/C,QAAI,YAAa,gBAAe,IAAI,iBAAiB,UAAU,WAAW,EAAE;AAC5E,QAAI,KAAK,SAAS,UAAa,CAAC,eAAe,IAAI,cAAc,GAAG;AAClE,qBAAe,IAAI,gBAAgB,kBAAkB;AAAA,IACvD;AAEA,UAAM,MAAM,IAAI,IAAI,UAAU,OAAO,QAAQ,IAAI,CAAC;AAClD,2BAAuB,KAAK,MAAM;AAElC,UAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAChC,GAAG;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,IACT,CAAC;AAED,QAAI,SAAS,WAAW,KAAK;AAC3B,YAAM,iBAAiB,MAAM,iBAAiB;AAC9C,UAAI,gBAAgB;AAClB,cAAM,eAAe,IAAI,QAAQ,KAAK,OAAO;AAC7C,qBAAa,IAAI,iBAAiB,UAAU,cAAc,EAAE;AAC5D,YAAI,KAAK,SAAS,UAAa,CAAC,aAAa,IAAI,cAAc,GAAG;AAChE,uBAAa,IAAI,gBAAgB,kBAAkB;AAAA,QACrD;AACA,cAAM,WAAW,IAAI,IAAI,UAAU,OAAO,QAAQ,IAAI,CAAC;AACvD,+BAAuB,UAAU,MAAM;AACvC,cAAM,gBAAgB,MAAM,MAAM,UAAU;AAAA,UAC1C,GAAG;AAAA,UACH,SAAS;AAAA,UACT,OAAO;AAAA,QACT,CAAC;AACD,YAAI,CAAC,cAAc,IAAI;AACrB,gBAAM,QAAQ,MAAM,cAAc,KAAK,EAAE,MAAM,MAAM,IAAI;AACzD,gBAAM,IAAI,MAAM,OAAO,qBAAqB,OAAO,SAAS,OAAO,WAAW,kBAAkB,cAAc,MAAM,EAAE;AAAA,QACxH;AACA,YAAI,cAAc,WAAW,IAAK,QAAO;AACzC,eAAQ,MAAM,cAAc,KAAK;AAAA,MACnC;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACpD,YAAM,IAAI,MAAM,OAAO,qBAAqB,OAAO,SAAS,OAAO,WAAW,kBAAkB,SAAS,MAAM,EAAE;AAAA,IACnH;AAEA,QAAI,SAAS,WAAW,IAAK,QAAO;AACpC,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAEA,WAAS,kBAAuC;AAC9C,WAAO;AAAA,MACL,KAAK,CAAC,SAAS,WAAW,IAAI;AAAA,MAC9B,MAAM,CAAC,MAAM,SAAS,WAAW,MAAM,EAAE,QAAQ,QAAQ,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI,EAAE,CAAC;AAAA,MACtH,OAAO,CAAC,MAAM,SAAS,WAAW,MAAM,EAAE,QAAQ,SAAS,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI,EAAE,CAAC;AAAA,MACxH,KAAK,CAAC,MAAM,SAAS,WAAW,MAAM,EAAE,QAAQ,OAAO,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI,EAAE,CAAC;AAAA,MACpH,QAAQ,CAAC,SAAS,WAAW,MAAM,EAAE,QAAQ,SAAS,CAAC;AAAA,IACzD;AAAA,EACF;AAEA,iBAAe,YAAY,UAAmC,CAAC,GAAG;AAChE,UAAM,cAAc,MAAM,eAAe;AACzC,QAAI,CAAC,aAAa;AAChB,eAAS,QAAQ,cAAc,GAAG;AAAA,IACpC;AACA,WAAO;AAAA,EACT;AAEA,WAAS,WAAW,KAAqB;AACvC,WAAO,IAAI,QAAQ,MAAM,OAAO,EAAE,QAAQ,MAAM,MAAM,EAAE,QAAQ,MAAM,MAAM,EAAE,QAAQ,MAAM,QAAQ;AAAA,EACtG;AAEA,WAAS,mBAAmB,OAA0C;AACpE,UAAM,MAAM,SAAS;AAErB,QAAI,IAAI,WAAW,OAAO,QAAQ,EAAG,QAAO;AAE5C,QAAI,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,WAAW,IAAI,EAAG,QAAO;AACzD,WAAO;AAAA,EACT;AAEA,iBAAe,wBAAwB,SAAsB,MAAuD;AAClH,UAAM,aAAa,mBAAmB,QAAQ,QAAQ,aAAa,IAAI,YAAY,KAAK,OAAO,qBAAqB;AACpH,UAAM,SAAS,QAAQ,QAAQ,aAAa,IAAI,SAAS;AACzD,UAAM,MAAM,IAAI,IAAI,UAAU,OAAO,QAAQ,SAAS,WAAW,iBAAiB,YAAY,CAAC;AAE/F,QAAI,CAAC,OAAO,UAAU;AACpB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,qBAAqB,SAAS,+CAA+C;AAAA,QACtF,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,aAAa,IAAI,aAAa,OAAO,QAAQ;AACjD,QAAI,aAAa,IAAI,gBAAgB,mBAAmB,QAAQ,OAAO,CAAC;AACxE,QAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,UAAM,SAAS,OAAO,UAAU,CAAC,UAAU,WAAW,OAAO;AAC7D,QAAI,CAAC,OAAO,SAAS,gBAAgB,EAAG,QAAO,KAAK,gBAAgB;AACpE,QAAI,aAAa,IAAI,SAAS,OAAO,KAAK,GAAG,CAAC;AAC9C,QAAI,aAAa,IAAI,SAAS,OAAO,KAAK,KAAK,UAAU,EAAE,YAAY,KAAK,CAAC,CAAC,EAAE,SAAS,WAAW,CAAC;AACrG,QAAI,SAAS,WAAY,KAAI,aAAa,IAAI,eAAe,QAAQ;AACrE,QAAI,SAAS,eAAe;AAC1B,UAAI,aAAa,IAAI,UAAU,OAAO;AAAA,IACxC,OAAO;AAGL,YAAM,cAAc,QAAQ,QAAQ,aAAa,IAAI,aAAa;AAClE,UAAI,gBAAgB,QAAS,KAAI,aAAa,IAAI,UAAU,OAAO;AAAA,IACrE;AACA,QAAI,OAAQ,KAAI,aAAa,IAAI,WAAW,MAAM;AAElD,WAAO,aAAa,SAAS,GAAG;AAAA,EAClC;AAEA,iBAAe,aAAa,SAAsB;AAChD,UAAM,OAAO,QAAQ,QAAQ,aAAa,IAAI,MAAM;AACpD,UAAM,QAAQ,QAAQ,QAAQ,aAAa,IAAI,OAAO;AAEtD,UAAM,SAAS,cAAc,OAAO;AAEpC,QAAI,CAAC,MAAM;AACT,YAAM,MAAM,QAAQ,QAAQ,aAAa,IAAI,OAAO,KAAK;AACzD,YAAM,OAAO,QAAQ,QAAQ,aAAa,IAAI,mBAAmB,KAAK,QAAQ,QAAQ,aAAa,IAAI,eAAe,KAAK;AAC3H,aAAO,aAAa,SAAS,IAAI,IAAI,GAAG,OAAO,QAAQ,mBAAmB,mBAAmB,GAAG,CAAC,sBAAsB,mBAAmB,IAAI,CAAC,IAAI,MAAM,CAAC;AAAA,IAC5J;AAEA,QAAI,CAAC,OAAO,UAAU;AACpB,aAAO,aAAa,SAAS,IAAI,IAAI,GAAG,OAAO,QAAQ,qFAAqF,MAAM,CAAC;AAAA,IACrJ;AAEA,UAAM,YAAY,OAAO;AAAA,MACvB,GAAG,OAAO,QAAQ,IAAI,OAAO,gBAAgB,EAAE;AAAA,IACjD,EAAE,SAAS,QAAQ;AAEnB,UAAM,WAAW,MAAM,MAAM,UAAU,OAAO,QAAQ,aAAa,GAAG;AAAA,MACpE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,SAAS,SAAS;AAAA,MACnC;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ;AAAA,QACA,cAAc,mBAAmB,QAAQ,OAAO;AAAA,MAClD,CAAC;AAAA,MACD,OAAO;AAAA,IACT,CAAC;AAED,UAAM,OAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,mBAAoB,KAAK,SAAgC,uBAAuB;AAC9F,YAAM,OAAO,mBAAoB,KAAK,qBAA4C,qCAAqC,SAAS,MAAM,EAAE;AACxI,aAAO,aAAa,SAAS,IAAI,IAAI,GAAG,OAAO,QAAQ,mBAAmB,KAAK,sBAAsB,IAAI,IAAI,MAAM,CAAC;AAAA,IACtH;AAEA,UAAM,kBAAkB,kBAAkB,IAAI,CAAC;AAE/C,QAAI,aAAa,mBAAmB,OAAO,qBAAqB;AAChE,QAAI,OAAO;AACT,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM,CAAC;AAC1E,qBAAa,mBAAmB,OAAO,UAAU;AAAA,MACnD,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,WAAO,aAAa,SAAS,IAAI,IAAI,YAAY,MAAM,CAAC;AAAA,EAC1D;AAEA,WAAS,sBAAsB,OAAe;AAC5C,QAAI,UAAU,MAAO,QAAO;AAC5B,QAAI,UAAU,mBAAoB,QAAO;AACzC,QAAI,UAAU,wBAAyB,QAAO;AAC9C,QAAI,UAAU,qBAAsB,QAAO;AAC3C,QAAI,UAAU,kBAAmB,QAAO;AACxC,QAAI,UAAU,qBAAsB,QAAO;AAC3C,QAAI,UAAU,qBAAsB,QAAO;AAC3C,WAAO;AAAA,EACT;AAEA,iBAAe,sBAA6C;AAC1D,UAAM,CAAC,UAAU,SAAS,IAAI,MAAM,QAAQ,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC,CAAC;AAErF,WAAO,aAAa,KAAK;AAAA,MACvB,UAAU,SAAS,IAAI,CAAC,GAAG,OAAO;AAAA,QAChC,IAAI,EAAE;AAAA,QACN,WAAW,EAAE,aAAa,EAAE;AAAA,QAC5B,UAAU,IAAI,MAAM;AAAA,QACpB,MAAM;AAAA,UACJ,IAAI,EAAE,KAAK;AAAA,UACX,MAAM,EAAE,KAAK,QAAQ;AAAA,UACrB,OAAO,EAAE,KAAK,SAAS;AAAA,UACvB,UAAU,EAAE,KAAK,WAAW;AAAA,UAC5B,OAAO,EAAE,KAAK,SAAS;AAAA,QACzB;AAAA,MACF,EAAE;AAAA,IACJ,CAAC;AAAA,EACH;AAEA,iBAAe,2BAAkD;AAC/D,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,cAAc,YAAY,IAAI,GAAG,oBAAoB,GAAG,SAAS;AACvE,QAAI;AACF,YAAM,OAAO,MAAM,WAAmD,gBAAgB;AACtF,YAAM,gBAAgB,MAAM,QAAQ,IAAI,IAAI,OAAQ,KAAsC;AAC1F,aAAO,aAAa,KAAK,EAAE,eAAe,cAAc,YAAY,CAAC;AAAA,IACvE,QAAQ;AACN,aAAO,aAAa,KAAK,EAAE,eAAe,CAAC,GAAG,cAAc,YAAY,CAAC;AAAA,IAC3E;AAAA,EACF;AAEA,iBAAe,yBAAyB,SAA6C;AACnF,UAAM,OAAO,MAAM,SAAS,OAAO;AACnC,UAAM,WACJ,QAAQ,OAAO,SAAS,WACpB;AAAA,MACG,KAAiC,aACjC,KAAiC,aAClC;AAAA,IACF,IACA;AAEN,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3E;AAEA,UAAM,WAAW,MAAM,cAAc,QAAQ;AAC7C,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,iBAAe,MAAM,SAAsB,OAAe;AACxD,UAAM,cAAc,MAAM,eAAe;AACzC,UAAM,OAAO,CAAC,OAAO,MAAM,EAAE,SAAS,QAAQ,MAAM,IAAI,SAAY,MAAM,SAAS,OAAO;AAC1F,UAAM,MAAM,IAAI,IAAI,mBAAmB,UAAU,OAAO,QAAQ,sBAAsB,KAAK,CAAC,GAAG,OAAO,CAAC;AACvG,2BAAuB,KAAK,MAAM;AAClC,UAAM,iBAAiB,IAAI,QAAQ;AAEnC,QAAI,YAAa,gBAAe,IAAI,iBAAiB,UAAU,WAAW,EAAE;AAC5E,QAAI,SAAS,OAAW,gBAAe,IAAI,gBAAgB,kBAAkB;AAE7E,UAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAChC,QAAQ,QAAQ;AAAA,MAChB,SAAS;AAAA,MACT,MAAM,SAAS,SAAY,SAAY,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,IAAI;AAAA,MAC5F,OAAO;AAAA,IACT,CAAC;AAED,UAAM,OAAO,eAAe,QAAQ,IAAM,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI,IAAkC;AAClH,QAAI,MAAM;AACR,YAAM,SAAS,kBAAkB,IAAI;AACrC,UAAI,OAAO,eAAe,OAAO,gBAAgB,OAAO,WAAW,OAAO,WAAW;AACnF,cAAM,kBAAkB,MAAM;AAAA,MAChC;AACA,aAAO,aAAa,KAAK,MAAM,EAAE,QAAQ,SAAS,OAAO,CAAC;AAAA,IAC5D;AAEA,WAAO,gBAAgB,QAAQ;AAAA,EACjC;AAEA,iBAAe,OAAO,SAAsB;AAC1C,UAAM,QAAQ,iBAAiB,SAAS,OAAO,QAAQ;AAEvD,QAAI,QAAQ,WAAW,SAAS,UAAU,WAAY,QAAO,wBAAwB,SAAS,OAAO;AACrG,QAAI,QAAQ,WAAW,SAAS,UAAU,WAAY,QAAO,wBAAwB,SAAS,UAAU;AACxG,QAAI,QAAQ,WAAW,SAAS,UAAU,eAAgB,QAAO,wBAAwB,SAAS,aAAa;AAC/G,QAAI,QAAQ,WAAW,SAAS,UAAU,gBAAiB,QAAO,wBAAwB,SAAS,QAAQ;AAC3G,QAAI,QAAQ,WAAW,SAAS,UAAU,aAAa;AACrD,YAAM,QAAQ,QAAQ,QAAQ,aAAa,IAAI,OAAO;AACtD,UAAI,OAAO;AACT,cAAM,cAAc,QAAQ,QAAQ,aAAa,IAAI,mBAAmB,KAAK,QAAQ,QAAQ,aAAa,IAAI,eAAe,KAAK;AAClI,eAAO,IAAI;AAAA,UACT,2NAA2N,WAAW,KAAK,CAAC,mBAAmB,WAAW,WAAW,CAAC;AAAA,UACtR,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,2BAA2B,EAAE;AAAA,QACzE;AAAA,MACF;AACA,aAAO,aAAa,OAAO;AAAA,IAC7B;AACA,QAAI,QAAQ,WAAW,SAAS,UAAU,UAAU;AAClD,YAAM,cAAc,MAAM,eAAe;AACzC,UAAI,CAAC,YAAa,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACtF,aAAO,aAAa,KAAK,EAAE,YAAY,CAAC;AAAA,IAC1C;AAGA,QAAI,QAAQ,WAAW,SAAS,UAAU,YAAa,QAAO,oBAAoB;AAClF,QAAI,QAAQ,WAAW,UAAU,UAAU,mBAAoB,QAAO,yBAAyB,OAAO;AACtG,QAAI,QAAQ,WAAW,SAAS,UAAU,iBAAkB,QAAO,yBAAyB;AAE5F,QAAI,QAAQ,WAAW,UAAU,UAAU,kBAAkB;AAC3D,YAAM,cAAc,MAAM,eAAe;AACzC,YAAM,OAAQ,MAAM,SAAS,OAAO;AACpC,UAAI,QAAQ,eAAe,CAAC,KAAK,eAAe;AAC9C,cAAM,SAAS,iBAAiB,WAAW;AAC3C,cAAM,iBACH,OAAO,QAAQ,mBAAmB,WAAW,OAAO,iBAAiB,UACrE,OAAO,QAAQ,cAAc,WAAW,OAAO,YAAY,UAC3D,OAAO,QAAQ,kBAAkB,WAAW,OAAO,gBAAgB;AACtE,YAAI,cAAe,MAAK,gBAAgB;AAAA,MAC1C;AACA,YAAM,SAAS,IAAI,IAAI,UAAU,OAAO,QAAQ,gBAAgB,CAAC;AACjE,6BAAuB,QAAQ,MAAM;AACrC,YAAM,iBAAiB,IAAI,QAAQ;AACnC,UAAI,YAAa,gBAAe,IAAI,iBAAiB,UAAU,WAAW,EAAE;AAC5E,UAAI,SAAS,OAAW,gBAAe,IAAI,gBAAgB,kBAAkB;AAC7E,YAAM,WAAW,MAAM,MAAM,QAAQ;AAAA,QACnC,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,MAAM,KAAK,UAAU,IAAI;AAAA,QACzB,OAAO;AAAA,MACT,CAAC;AACD,aAAO,gBAAgB,QAAQ;AAAA,IACjC;AAEA,QAAI,QAAQ,WAAW,UAAU,UAAU,aAAa;AACtD,YAAM,WAAW,kBAAkB,EAAE,QAAQ,OAAO,CAAC,EAAE,MAAM,MAAM,IAAI;AACvE,YAAM,oBAAoB;AAC1B,aAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IACvC;AAEA,QAAI,QAAQ,WAAW,UAAU,UAAU,iBAAiB;AAC1D,YAAM,WAAW,sBAAsB,EAAE,QAAQ,OAAO,CAAC,EAAE,MAAM,MAAM,IAAI;AAC3E,YAAM,uBAAuB;AAC7B,aAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IACvC;AAEA,QAAI,QAAQ,WAAW,UAAU,UAAU,yBAAyB;AAClE,YAAM,OAAO,MAAM,SAAS,OAAO;AACnC,YAAM,iBACJ,QAAQ,OAAO,SAAS,YAAY,oBAAoB,OACnD,KAAiC,iBAClC;AACN,YAAM,WAAW,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAC/C,UAAI,OAAO,mBAAmB,UAAU;AACtC,cAAM,aAAa;AAAA,UACjB,UAAU;AAAA,UACV,UAAU;AAAA,UACV,MAAM;AAAA,UACN,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,QAAQ,KAAK,KAAK,KAAK;AAAA,QACzB;AACA,iBAAS,QAAQ,IAAI,GAAG,sBAAsB,gBAAgB,UAAU;AAAA,MAC1E;AACA,aAAO;AAAA,IACT;AAEA,WAAO,MAAM,SAAS,KAAK;AAAA,EAC7B;AAEA,SAAO;AAAA,IACL,UAAU;AAAA,MACR,KAAK;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP,QAAQ;AAAA,IACV;AAAA,IACA,YAAY;AAAA,IACZ,SAAS;AAAA,IACT,kBAAkB;AAAA,IAClB,aAAa;AAAA,IACb,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,iBAAiB,YAAa,MAAM,eAAe,MAAO;AAAA,IAC1D,kBAAkB;AAAA,IAClB,aAAa;AAAA,IACb,qBAAqB;AAAA,IACrB,cAAc,OAAO;AAAA,IACrB,aAAa,CAAC,UAAkB,YAAY,OAAO,OAAO,MAAM;AAAA,IAChE,WAAW,OAAO,eAAwB;AACxC,YAAM,aAAa,IAAI,kBAAkB;AACzC,UAAI,CAAC,WAAY,OAAM,IAAI,MAAM,oDAAoD;AACrF,YAAM,SAAS,WAAW,QAAQ,OAAO,EAAE;AAC3C,YAAM,MAAM,IAAI,IAAI,GAAG,MAAM,GAAG,OAAO,QAAQ,UAAU;AACzD,UAAI,WAAY,KAAI,aAAa,IAAI,cAAc,UAAU;AAC7D,aAAO,IAAI,SAAS;AAAA,IACtB;AAAA,EACF;AACF;AAEO,SAAS,SAAS,SAA8B;AACrD,SAAO,sBAAsB,OAAO,EAAE;AACxC;AAMA,eAAsB,gBAAgB,SAAgD;AACpF,QAAM,EAAE,eAAe,IAAI,sBAAsB,OAAO;AACxD,SAAQ,MAAM,eAAe,MAAO;AACtC;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geekapps/auth-nextjs",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "type": "module",
   "sideEffects": false,
   "types": "/dist",