@geekapps/auth-nextjs 0.5.1 → 0.7.0

package/dist/actions.js

@@ -4,6 +4,7 @@
 import { cookies as cookies2, headers as headers2 } from "next/headers";
 
 // src/server.ts
+import { createHash, randomBytes } from "crypto";
 import { cookies, headers } from "next/headers";
 import { redirect } from "next/navigation";
 import { NextResponse } from "next/server";

package/dist/actions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/actions.ts","../src/server.ts"],"sourcesContent":["\"use server\";\n\nimport { cookies, headers } from \"next/headers\";\nimport type { ConnectedAccount, Organization, User } from \"./client\";\nimport { GEEKAPPS_AUTH_SERVER_URL } from \"./server\";\n\n// ── cookie helpers (duplicated from server.ts to keep this file self-contained) ──\n\nfunction env(name: string) {\n  const value = process.env[name];\n  return value && value.trim().length > 0 ? value : undefined;\n}\n\nfunction normalizeBaseUrl(url: string) {\n  return url.replace(/\\/$/, \"\");\n}\n\nfunction resolveIssuer() {\n  return normalizeBaseUrl(\n    // Deprecated: kept for backwards compatibility during the auth-server rename.\n    env(\"GEEKAPPS_AUTH_ISSUER\") ?? env(\"GEEKAPPS_AUTH_API_URL\") ?? GEEKAPPS_AUTH_SERVER_URL,\n  );\n}\n\nfunction appendClientCredentials(url: string): string {\n  const clientId = env(\"GEEKAPPS_AUTH_CLIENT_ID\");\n  const clientSecret = env(\"GEEKAPPS_AUTH_CLIENT_SECRET\");\n  if (!clientId || !clientSecret) return url;\n  const u = new URL(url);\n  u.searchParams.set(\"client_id\", clientId);\n  u.searchParams.set(\"client_secret\", clientSecret);\n  return u.toString();\n}\n\nfunction hashClientId(clientId: string): string {\n  let h = 5381;\n  for (let i = 0; i < clientId.length; i++) {\n    h = ((h << 5) + h) ^ (clientId.charCodeAt(i) & 0xff);\n    h = h >>> 0;\n  }\n  return h.toString(16).padStart(8, \"0\");\n}\n\nfunction deriveCookiePrefix(): string {\n  const clientId = env(\"GEEKAPPS_AUTH_CLIENT_ID\") ?? \"\";\n  if (!clientId) return \"gk\";\n  return `gk_${hashClientId(clientId)}`;\n}\n\ntype SlotMeta = { id: string; sid?: string; n?: string; e?: string; p?: string };\n\nfunction decodeMeta(value: string): SlotMeta | null {\n  try {\n    const m = JSON.parse(Buffer.from(value, \"base64url\").toString(\"utf8\")) as SlotMeta;\n    return m.id ? m : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function getCookieNames() {\n  const prefix = deriveCookiePrefix();\n  return {\n    active: `${prefix}_active`,\n    count: `${prefix}_count`,\n    activeOrganizationId: `${prefix}_ao`,\n    slotMeta: (n: number) => `${prefix}_m${n}`,\n    slotAt: (n: number) => `${prefix}_at${n}`,\n    slotRt: (n: number) => `${prefix}_rt${n}`,\n  };\n}\n\nasync function getActiveAccessToken(): Promise<string | null> {\n  // Prefer the token injected by the middleware via request header (same-request refresh)\n  try {\n    const hdrs = await headers();\n    const auth = hdrs.get(\"authorization\");\n    if (auth?.startsWith(\"Bearer \")) return auth.slice(7);\n  } catch {}\n  const cookieStore = await cookies();\n  const cn = await getCookieNames();\n  const raw = cookieStore.get(cn.active)?.value;\n  const activeIdx = raw ? Number.parseInt(raw, 10) : 0;\n  const countRaw = cookieStore.get(cn.count)?.value;\n  const count = countRaw ? Number.parseInt(countRaw, 10) : 0;\n  if (count === 0) return null;\n  const idx = activeIdx >= 1 && activeIdx <= count ? activeIdx : 1;\n  return cookieStore.get(cn.slotAt(idx))?.value ?? null;\n}\n\nasync function getActiveRefreshToken(): Promise<string | null> {\n  const cookieStore = await cookies();\n  const cn = await getCookieNames();\n  const raw = cookieStore.get(cn.active)?.value;\n  const activeIdx = raw ? Number.parseInt(raw, 10) : 0;\n  const countRaw = cookieStore.get(cn.count)?.value;\n  const count = countRaw ? Number.parseInt(countRaw, 10) : 0;\n  if (count === 0) return null;\n  const idx = activeIdx >= 1 && activeIdx <= count ? activeIdx : 1;\n  return cookieStore.get(cn.slotRt(idx))?.value ?? null;\n}\n\nasync function refreshAndSaveTokens(): Promise<string | null> {\n  const refreshToken = await getActiveRefreshToken();\n  const clientId = env(\"GEEKAPPS_AUTH_CLIENT_ID\") ?? \"\";\n  const clientSecret = env(\"GEEKAPPS_AUTH_CLIENT_SECRET\") ?? \"\";\n  if (!refreshToken || !clientId) return null;\n\n  const basicAuth = Buffer.from(`${clientId}:${clientSecret}`).toString(\"base64\");\n  const response = await fetch(`${resolveIssuer()}/auth/token`, {\n    method: \"POST\",\n    headers: {\n      \"content-type\": \"application/x-www-form-urlencoded\",\n      authorization: `Basic ${basicAuth}`,\n    },\n    body: new URLSearchParams({ grant_type: \"refresh_token\", refresh_token: refreshToken }),\n    cache: \"no-store\",\n  });\n\n  if (!response.ok) return null;\n\n  const data = await response.json().catch(() => null) as Record<string, unknown> | null;\n  if (!data) return null;\n\n  const newAccessToken =\n    (data.accessToken ?? data.access_token) as string | undefined;\n  const newRefreshToken =\n    (data.refreshToken ?? data.refresh_token) as string | undefined;\n\n  if (!newAccessToken) return null;\n\n  // Update the active slot cookies\n  const cookieStore = await cookies();\n  const cn = await getCookieNames();\n  const raw = cookieStore.get(cn.active)?.value;\n  const activeIdx = raw ? Number.parseInt(raw, 10) : 1;\n  const opts = {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === \"production\",\n    sameSite: \"lax\" as const,\n    path: \"/\",\n    maxAge: 60 * 60 * 24 * 30,\n  };\n  cookieStore.set(cn.slotAt(activeIdx), newAccessToken, opts);\n  if (newRefreshToken) cookieStore.set(cn.slotRt(activeIdx), newRefreshToken, opts);\n  // Update public token cookie\n  cookieStore.set(`${deriveCookiePrefix()}_tp`, newAccessToken, {\n    httpOnly: false,\n    secure: process.env.NODE_ENV === \"production\",\n    sameSite: \"lax\",\n    path: \"/\",\n    maxAge: 60 * 60 * 24 * 30,\n  });\n\n  return newAccessToken;\n}\n\nasync function authFetch<T>(path: string): Promise<T> {\n  let accessToken = await getActiveAccessToken();\n  if (!accessToken) throw new Error(\"Not authenticated\");\n\n  const issuer = resolveIssuer();\n  const doFetch = (token: string) =>\n    fetch(appendClientCredentials(`${issuer}${path}`), {\n      headers: { authorization: `Bearer ${token}` },\n      cache: \"no-store\",\n    });\n\n  let response = await doFetch(accessToken);\n\n  if (response.status === 401) {\n    const newToken = await refreshAndSaveTokens();\n    if (!newToken) throw new Error(\"Session expired\");\n    response = await doFetch(newToken);\n  }\n\n  if (!response.ok) {\n    const err = await response.json().catch(() => null) as Record<string, unknown> | null;\n    throw new Error((err?.error_description ?? err?.error ?? err?.message ?? `Auth error ${response.status}`) as string);\n  }\n\n  if (response.status === 204) return null as T;\n  return response.json() as Promise<T>;\n}\n\n// ── Exported server actions ────────────────────────────────────────────────────\n\nexport async function getMe(): Promise<{ user: User | null }> {\n  try {\n    const data = await authFetch<{ user: User | null } | User | null>(\"/auth/me\");\n    if (!data) return { user: null };\n    if (typeof data === \"object\" && \"user\" in data) return data as { user: User | null };\n    return { user: data as User | null };\n  } catch {\n    return { user: null };\n  }\n}\n\nexport async function getAccounts(): Promise<{ accounts: ConnectedAccount[] }> {\n  const cookieStore = await cookies();\n  const cn = await getCookieNames();\n  const countRaw = cookieStore.get(cn.count)?.value;\n  const count = countRaw ? Number.parseInt(countRaw, 10) : 0;\n  const activeRaw = cookieStore.get(cn.active)?.value;\n  const activeIdx = activeRaw ? Number.parseInt(activeRaw, 10) : 0;\n\n  const accounts: ConnectedAccount[] = [];\n  for (let i = 1; i <= count; i++) {\n    const at = cookieStore.get(cn.slotAt(i))?.value;\n    if (!at) continue;\n    const meta = decodeMeta(cookieStore.get(cn.slotMeta(i))?.value ?? \"\");\n    if (!meta) continue;\n    accounts.push({\n      id: meta.id,\n      sessionId: meta.sid ?? meta.id,\n      isActive: i === activeIdx,\n      user: {\n        id: meta.id,\n        name: meta.n ?? null,\n        email: meta.e ?? \"\",\n        imageUrl: meta.p ?? null,\n        phone: null,\n      },\n    });\n  }\n\n  return { accounts };\n}\n\nexport async function getOrganizations(): Promise<{ organizations: Organization[]; currentOrgId?: string | null }> {\n  try {\n    const cookieStore = await cookies();\n    const cn = await getCookieNames();\n    const activeOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;\n    const data = await authFetch<Organization[] | { organizations: Organization[] }>(\"/organizations\");\n    const organizations = Array.isArray(data) ? data : (data as { organizations: Organization[] }).organizations;\n    const resolvedOrgId = activeOrgId ?? organizations[0]?.id ?? null;\n    return { organizations, currentOrgId: resolvedOrgId };\n  } catch (err) {\n    console.error(\"[getOrganizations] error:\", err);\n    return { organizations: [] };\n  }\n}\n","import { cookies, headers } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport { NextResponse, type NextRequest } from \"next/server\";\nimport { createRemoteJWKSet, jwtVerify, type JWTPayload } from \"jose\";\n\n/**\n * Fixed URL of the Geekapps Auth Server (OIDC issuer + API). This never\n * changes per-environment, so it is hardcoded rather than read from env.\n */\nexport const GEEKAPPS_AUTH_SERVER_URL = \"https://accounts-api.geekapps.com.br\";\n\nexport type GeekappsAuthConfig = {\n  /**\n   * Auth Server (OIDC) issuer URL. Defaults to GEEKAPPS_AUTH_SERVER_URL and\n   * should not need overriding in normal use.\n   *\n   * Deprecated (still supported as a fallback): GEEKAPPS_AUTH_SERVER_ISSUER,\n   * GEEKAPPS_AUTH_ISSUER, GEEKAPPS_AUTH_SERVER_URL env, GEEKAPPS_AUTH_API_URL\n   */\n  issuer?: string;\n\n  /**\n   * OAuth client id. Optional when GEEKAPPS_AUTH_CLIENT_ID is defined.\n   */\n  clientId?: string;\n\n  /**\n   * OAuth client secret for confidential clients. Optional when\n   * GEEKAPPS_AUTH_CLIENT_SECRET is defined.\n   */\n  clientSecret?: string;\n\n  /**\n   * Callback URL. Optional when GEEKAPPS_AUTH_REDIRECT_URI is defined.\n   * If omitted, it is inferred from the current request origin + basePath/callback.\n   */\n  redirectUri?: string;\n\n  scopes?: string[];\n  basePath?: string;\n  /**\n   * @deprecated cookiePrefix is now auto-derived from clientId.\n   * This field is kept for backwards compatibility but is ignored.\n   */\n  cookiePrefix?: string;\n  secureCookies?: boolean;\n\n  /**\n   * Friendly alias used by apps. Same as afterSignInRedirectTo.\n   */\n  redirectTo?: string;\n\n  afterSignInRedirectTo?: string;\n  afterSignOutRedirectTo?: string;\n};\n\ntype ResolvedGeekappsAuthConfig = GeekappsAuthConfig & {\n  issuer: string;\n  clientId: string;\n  basePath: string;\n  cookiePrefix: string;\n};\n\nexport type SessionTokens = {\n  accessToken: string | null;\n  refreshToken: string | null;\n  idToken: string | null;\n  sessionId: string | null;\n};\n\nexport type StoredAccount = {\n  /** Stable identifier — `sub` from id_token or fallback to sessionId. */\n  id: string;\n  accessToken: string;\n  refreshToken: string | null;\n  idToken: string | null;\n  sessionId: string | null;\n  user: {\n    sub: string;\n    name?: string | null;\n    email?: string | null;\n    picture?: string | null;\n    phone?: string | null;\n  };\n};\n\nexport type ServerAuthApiClient = {\n  get: <T>(path: string) => Promise<T>;\n  post: <T>(path: string, body?: unknown) => Promise<T>;\n  patch: <T>(path: string, body?: unknown) => Promise<T>;\n  put: <T>(path: string, body?: unknown) => Promise<T>;\n  delete: <T>(path: string) => Promise<T>;\n};\n\ntype JsonObject = Record<string, unknown>;\n\ntype TokenLikeResponse = JsonObject & {\n  access_token?: string;\n  accessToken?: string;\n  refresh_token?: string;\n  refreshToken?: string;\n  id_token?: string;\n  idToken?: string;\n  session_id?: string;\n  sessionId?: string;\n  tokens?: {\n    access_token?: string;\n    accessToken?: string;\n    refresh_token?: string;\n    refreshToken?: string;\n    id_token?: string;\n    idToken?: string;\n    session_id?: string;\n    sessionId?: string;\n  };\n};\n\nconst MAX_ACCOUNTS = 8;\n\nfunction normalizeBaseUrl(url: string) {\n  return url.replace(/\\/$/, \"\");\n}\n\nfunction normalizeBasePath(path = \"/api/auth\") {\n  if (!path.startsWith(\"/\")) return `/${path}`;\n  return path.replace(/\\/$/, \"\");\n}\n\nfunction createUrl(baseUrl: string, path: string) {\n  if (/^https?:\\/\\//.test(path)) return path;\n  const normalizedPath = path.startsWith(\"/\") ? path : `/${path}`;\n  return `${normalizeBaseUrl(baseUrl)}${normalizedPath}`;\n}\n\nfunction env(name: string) {\n  const value = process.env[name];\n  return value && value.trim().length > 0 ? value : undefined;\n}\n\nfunction resolveIssuer(input: GeekappsAuthConfig) {\n  return normalizeBaseUrl(\n    input.issuer ??\n      env(\"GEEKAPPS_AUTH_SERVER_ISSUER\") ??\n      env(\"GEEKAPPS_AUTH_SERVER_URL\") ??\n      // Deprecated: kept for backwards compatibility during the auth-server rename.\n      env(\"GEEKAPPS_AUTH_ISSUER\") ??\n      env(\"GEEKAPPS_AUTH_API_URL\") ??\n      GEEKAPPS_AUTH_SERVER_URL,\n  );\n}\n\nfunction resolveClientId(input: GeekappsAuthConfig) {\n  return input.clientId ?? env(\"GEEKAPPS_AUTH_CLIENT_ID\") ?? \"\";\n}\n\nfunction resolveClientSecret(input: GeekappsAuthConfig) {\n  return input.clientSecret ?? env(\"GEEKAPPS_AUTH_CLIENT_SECRET\");\n}\n\nfunction applyClientCredentials(url: URL, config: ResolvedGeekappsAuthConfig) {\n  if (!config.clientId || !config.clientSecret) return;\n  url.searchParams.set(\"client_id\", config.clientId);\n  url.searchParams.set(\"client_secret\", config.clientSecret);\n}\n\nfunction resolveConfiguredRedirectUri(input: GeekappsAuthConfig) {\n  return input.redirectUri ?? env(\"GEEKAPPS_AUTH_REDIRECT_URI\");\n}\n\n/**\n * Derives a short stable 8-char hex hash from a clientId string.\n * Uses a simple djb2-style hash — no crypto dependency needed.\n */\nfunction hashClientId(clientId: string): string {\n  let h = 5381;\n  for (let i = 0; i < clientId.length; i++) {\n    h = ((h << 5) + h) ^ (clientId.charCodeAt(i) & 0xff);\n    h = h >>> 0; // keep unsigned 32-bit\n  }\n  return h.toString(16).padStart(8, \"0\");\n}\n\n/**\n * Auto-derives the cookie prefix from clientId.\n * Format: `gk_{8-char-hash}` — guaranteed unique per OAuth client.\n * Falls back to `gk` when clientId is empty (dev/test environments).\n */\nfunction deriveCookiePrefix(clientId: string): string {\n  if (!clientId) return \"gk\";\n  return `gk_${hashClientId(clientId)}`;\n}\n\nfunction requestOrigin(request: NextRequest) {\n  const configured = env(\"GEEKAPPS_APP_URL\");\n  if (configured) return configured.replace(/\\/$/, \"\");\n\n  throw new Error(\n    \"Cannot determine app origin. Set GEEKAPPS_APP_URL.\",\n  );\n}\n\nfunction resolveRedirectUri(config: ResolvedGeekappsAuthConfig, request: NextRequest) {\n  return config.redirectUri ?? `${requestOrigin(request)}${config.basePath}/callback`;\n}\n\nfunction tokenFromResponse(data: TokenLikeResponse): SessionTokens {\n  return {\n    accessToken: data.accessToken ?? data.access_token ?? data.tokens?.accessToken ?? data.tokens?.access_token ?? null,\n    refreshToken:\n      data.refreshToken ?? data.refresh_token ?? data.tokens?.refreshToken ?? data.tokens?.refresh_token ?? null,\n    idToken: data.idToken ?? data.id_token ?? data.tokens?.idToken ?? data.tokens?.id_token ?? null,\n    sessionId: data.sessionId ?? data.session_id ?? data.tokens?.sessionId ?? data.tokens?.session_id ?? null,\n  };\n}\n\n/** Decode a JWT payload without verifying signature (safe for client-visible claims). */\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split(\".\");\n    if (parts.length < 2) return null;\n    const payload = parts[1];\n    if (!payload) return null;\n    return JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf8\")) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nfunction parseAccountFromJwt(tokens: SessionTokens): StoredAccount | null {\n  if (!tokens.accessToken) return null;\n\n  const jwtToParse = tokens.idToken ?? tokens.accessToken;\n  const payload = decodeJwtPayload(jwtToParse);\n  if (!payload) return null;\n\n  const sub = typeof payload.sub === \"string\" ? payload.sub : null;\n  const id = sub ?? tokens.sessionId;\n  if (!id) return null;\n\n  return {\n    id,\n    accessToken: tokens.accessToken,\n    refreshToken: tokens.refreshToken,\n    idToken: tokens.idToken ?? null,\n    sessionId: tokens.sessionId,\n    user: {\n      sub: id,\n      name: typeof payload.name === \"string\" ? payload.name : null,\n      email: typeof payload.email === \"string\" ? payload.email : null,\n      picture: typeof payload.picture === \"string\" ? payload.picture : null,\n      phone: typeof payload.phone_number === \"string\" ? payload.phone_number : null,\n    },\n  };\n}\n\n/**\n * Cookie name scheme — 3 cookies per slot, each well under 4096 bytes:\n *\n *   {prefix}_m{n}   — metadata blob (base64url JSON): { id, sid?, n?, e?, p? }\n *                     Claims extracted from id_token at login. Never stores tokens.\n *   {prefix}_at{n}  — access token (httpOnly). ~1-2 KB.\n *   {prefix}_rt{n}  — refresh token (httpOnly). ~1 KB.\n *   {prefix}_active — active slot index (\"1\", \"2\", …)\n *   {prefix}_count  — total stored slots\n *   {prefix}_ao     — active org id for this app\n *   {prefix}_tp     — non-httpOnly copy of active access token for client-side axios\n *\n * id_token is NOT stored in cookies — claims are extracted at login and cached in\n * the metadata cookie. This is the key size saving.\n */\nfunction getCookieNames(prefix: string) {\n  return {\n    active: `${prefix}_active`,\n    count: `${prefix}_count`,\n    activeOrganizationId: `${prefix}_ao`,\n    tokenPub: `${prefix}_tp`,\n    slotMeta: (n: number) => `${prefix}_m${n}`,\n    slotAt: (n: number) => `${prefix}_at${n}`,\n    slotRt: (n: number) => `${prefix}_rt${n}`,\n  };\n}\n\ntype SlotMeta = {\n  id: string;\n  sid?: string;\n  n?: string;\n  e?: string;\n  p?: string;\n};\n\nfunction encodeMeta(account: StoredAccount): string {\n  const m: SlotMeta = { id: account.id };\n  if (account.sessionId) m.sid = account.sessionId;\n  if (account.user.name) m.n = account.user.name;\n  if (account.user.email) m.e = account.user.email;\n  if (account.user.picture) m.p = account.user.picture;\n  return Buffer.from(JSON.stringify(m), \"utf8\").toString(\"base64url\");\n}\n\nfunction decodeMeta(value: string): SlotMeta | null {\n  try {\n    const m = JSON.parse(Buffer.from(value, \"base64url\").toString(\"utf8\")) as SlotMeta;\n    return m.id ? m : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction getCookieOptions(config: ResolvedGeekappsAuthConfig) {\n  return {\n    httpOnly: true,\n    secure: config.secureCookies ?? process.env.NODE_ENV === \"production\",\n    sameSite: \"lax\" as const,\n    path: \"/\",\n  };\n}\n\nasync function readBody(request: NextRequest) {\n  const text = await request.text();\n  if (!text) return undefined;\n  try {\n    return JSON.parse(text);\n  } catch {\n    return text;\n  }\n}\n\nfunction appendSearchParams(url: string, request: NextRequest) {\n  const target = new URL(url);\n  request.nextUrl.searchParams.forEach((value, key) => {\n    target.searchParams.set(key, value);\n  });\n  return target.toString();\n}\n\nfunction routeFromRequest(request: NextRequest, basePath: string) {\n  const pathname = request.nextUrl.pathname;\n  if (!pathname.startsWith(basePath)) return pathname;\n  const route = pathname.slice(basePath.length);\n  return route || \"/\";\n}\n\nfunction isJsonResponse(response: Response) {\n  return response.headers.get(\"content-type\")?.includes(\"application/json\");\n}\n\nasync function responseFromApi(response: Response) {\n  if (response.status === 204) return new NextResponse(null, { status: 204 });\n  const body = isJsonResponse(response) ? await response.json().catch(() => null) : await response.text();\n  return NextResponse.json(body, { status: response.status });\n}\n\nconst _remoteJWKSCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\ntype ServiceTokenCache = { token: string; expiresAt: number };\nconst _serviceTokenCache = new Map<string, ServiceTokenCache>();\n\nasync function fetchServiceToken(issuer: string, clientId: string, clientSecret: string): Promise<string | null> {\n  const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString(\"base64\");\n  try {\n    const res = await fetch(createUrl(issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${credentials}`,\n      },\n      body: \"grant_type=service_account\",\n      cache: \"no-store\",\n    });\n    if (!res.ok) return null;\n    const data = (await res.json()) as { access_token?: string };\n    return data.access_token ?? null;\n  } catch {\n    return null;\n  }\n}\n\nasync function getServiceToken(issuer: string, clientId: string, clientSecret: string): Promise<string | null> {\n  const key = `${issuer}:${clientId}`;\n  const now = Date.now();\n  const cached = _serviceTokenCache.get(key);\n  if (cached && cached.expiresAt - 30_000 > now) return cached.token;\n  const token = await fetchServiceToken(issuer, clientId, clientSecret);\n  if (!token) return null;\n  _serviceTokenCache.set(key, { token, expiresAt: now + 420_000 });\n  return token;\n}\n\ntype ServiceAccountConfig = {\n  issuer?: string;\n  clientId?: string;\n  clientSecret?: string;\n};\n\n/**\n * Returns a service account access token.\n * The issuer is always the Geekapps Auth Server (GEEKAPPS_AUTH_SERVER_URL) —\n * it does not need to be configured. Reads GEEKAPPS_SERVICE_ACCOUNT_CLIENT_ID,\n * GEEKAPPS_SERVICE_ACCOUNT_CLIENT_SECRET by default.\n * Any field can be overridden via the optional config argument.\n * Tokens are cached per client and auto-renewed before expiry (~7 min TTL).\n */\nexport function getServiceAccountToken(override: ServiceAccountConfig = {}): Promise<string | null> {\n  const issuer = normalizeBaseUrl(\n    override.issuer ??\n      // Deprecated: kept for backwards compatibility during the auth-server rename.\n      env(\"GEEKAPPS_AUTH_ISSUER\") ??\n      env(\"GEEKAPPS_AUTH_API_URL\") ??\n      GEEKAPPS_AUTH_SERVER_URL,\n  );\n  const clientId = override.clientId ?? env(\"GEEKAPPS_SERVICE_ACCOUNT_CLIENT_ID\") ?? \"\";\n  const clientSecret = override.clientSecret ?? env(\"GEEKAPPS_SERVICE_ACCOUNT_CLIENT_SECRET\") ?? \"\";\n  if (!clientId || !clientSecret) return Promise.resolve(null);\n  return getServiceToken(issuer, clientId, clientSecret);\n}\n\nfunction getRemoteJWKS(issuer: string) {\n  if (!_remoteJWKSCache.has(issuer)) {\n    _remoteJWKSCache.set(issuer, createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`)));\n  }\n  return _remoteJWKSCache.get(issuer)!;\n}\n\nexport async function verifyToken(\n  token: string,\n  issuer: string,\n): Promise<JWTPayload | null> {\n  try {\n    const { payload } = await jwtVerify(token, getRemoteJWKS(issuer), {\n      algorithms: [\"RS256\"],\n      issuer,\n    });\n    return payload;\n  } catch {\n    return null;\n  }\n}\n\nexport function configureGeekappsAuth(input: GeekappsAuthConfig = {}) {\n  const clientId = resolveClientId(input);\n  const config: ResolvedGeekappsAuthConfig = {\n    ...input,\n    issuer: resolveIssuer(input),\n    clientId,\n    clientSecret: resolveClientSecret(input),\n    redirectUri: resolveConfiguredRedirectUri(input),\n    afterSignInRedirectTo:\n      input.afterSignInRedirectTo ?? input.redirectTo ?? \"/\",\n    basePath: normalizeBasePath(input.basePath),\n    cookiePrefix: deriveCookiePrefix(clientId),\n  };\n\n  const cn = getCookieNames(config.cookiePrefix);\n\n  // ── Slot helpers ──────────────────────────────────────────────────────────\n\n  async function getCount(): Promise<number> {\n    const cookieStore = await cookies();\n    const raw = cookieStore.get(cn.count)?.value;\n    const n = raw ? Number.parseInt(raw, 10) : 0;\n    return Number.isNaN(n) ? 0 : n;\n  }\n\n  async function getActiveIndex(): Promise<number> {\n    const cookieStore = await cookies();\n    const raw = cookieStore.get(cn.active)?.value;\n    if (!raw) return 0;\n    const n = Number.parseInt(raw, 10);\n    return Number.isNaN(n) ? 0 : n;\n  }\n\n  function readSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n  ): StoredAccount | null {\n    const at = cookieStore.get(cn.slotAt(n))?.value;\n    if (!at) return null;\n    const meta = decodeMeta(cookieStore.get(cn.slotMeta(n))?.value ?? \"\");\n    if (!meta) return null;\n    return {\n      id: meta.id,\n      accessToken: at,\n      refreshToken: cookieStore.get(cn.slotRt(n))?.value ?? null,\n      idToken: null, // not stored in cookies; claims are in meta\n      sessionId: meta.sid ?? null,\n      user: {\n        sub: meta.id,\n        name: meta.n ?? null,\n        email: meta.e ?? null,\n        picture: meta.p ?? null,\n      },\n    };\n  }\n\n  function writeSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n    account: StoredAccount,\n  ) {\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    cookieStore.set(cn.slotMeta(n), encodeMeta(account), opts);\n    cookieStore.set(cn.slotAt(n), account.accessToken, opts);\n    if (account.refreshToken) cookieStore.set(cn.slotRt(n), account.refreshToken, opts);\n  }\n\n  function clearSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n  ) {\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n    cookieStore.set(cn.slotMeta(n), \"\", clear);\n    cookieStore.set(cn.slotAt(n), \"\", clear);\n    cookieStore.set(cn.slotRt(n), \"\", clear);\n  }\n\n  // ── Public account helpers ─────────────────────────────────────────────────\n\n  async function getAccountsList(): Promise<StoredAccount[]> {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const accounts: StoredAccount[] = [];\n    for (let i = 1; i <= count; i++) {\n      const slot = readSlot(cookieStore, i);\n      if (slot) accounts.push(slot);\n    }\n    return accounts;\n  }\n\n  async function getActiveAccount(): Promise<StoredAccount | null> {\n    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);\n    if (count === 0) return null;\n    if (activeIdx >= 1 && activeIdx <= count) {\n      const slot = readSlot(cookieStore, activeIdx);\n      if (slot) return slot;\n    }\n    // Fall back to slot 1\n    return readSlot(cookieStore, 1);\n  }\n\n  async function getAccessToken() {\n    // Prefer the token injected by the middleware via request header (same-request refresh)\n    try {\n      const hdrs = await headers();\n      const auth = hdrs.get(\"authorization\");\n      if (auth?.startsWith(\"Bearer \")) return auth.slice(7);\n    } catch {}\n    const active = await getActiveAccount();\n    return active?.accessToken ?? null;\n  }\n\n  async function getRefreshToken() {\n    const active = await getActiveAccount();\n    return active?.refreshToken ?? null;\n  }\n\n  async function getSession(): Promise<SessionTokens | null> {\n    const active = await getActiveAccount();\n    if (!active) return null;\n    return {\n      accessToken: active.accessToken,\n      refreshToken: active.refreshToken,\n      idToken: active.idToken,\n      sessionId: active.sessionId,\n    };\n  }\n\n  async function getUser(): Promise<StoredAccount[\"user\"] | null> {\n    const active = await getActiveAccount();\n    return active?.user ?? null;\n  }\n\n  async function getUserById(userId: string, applicationId?: string): Promise<unknown | null> {\n    const qs = new URLSearchParams({ ...(applicationId ? { applicationId } : {}) });\n    try {\n      return await apiRequest<unknown>(`/users/${userId}?${qs}`);\n    } catch {\n      return null;\n    }\n  }\n\n  async function getOrganizations(): Promise<{ organizations: unknown[]; currentOrgId: string | null }> {\n    const cookieStore = await cookies();\n    const currentOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;\n    try {\n      const data = await apiRequest<unknown[] | { organizations: unknown[] }>(\"/organizations\");\n      const organizations = Array.isArray(data) ? data : (data as { organizations: unknown[] }).organizations;\n      return { organizations, currentOrgId };\n    } catch {\n      return { organizations: [], currentOrgId };\n    }\n  }\n\n  function clearPublicTokenCookie(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n  ) {\n    // Clear legacy _tp cookie if present\n    if (cookieStore.get(cn.tokenPub)?.value) {\n      cookieStore.set(cn.tokenPub, \"\", { httpOnly: false, maxAge: 0, path: \"/\" });\n    }\n  }\n\n  async function saveAccountToList(tokens: SessionTokens) {\n    const account = parseAccountFromJwt(tokens);\n    if (!account) return;\n\n    const cookieStore = await cookies();\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    const count = await getCount();\n\n    // Find existing slot for this account id\n    let targetSlot = 0;\n    for (let i = 1; i <= count; i++) {\n      const existing = readSlot(cookieStore, i);\n      if (existing?.id === account.id) {\n        targetSlot = i;\n        break;\n      }\n    }\n\n    if (targetSlot === 0) {\n      if (count >= MAX_ACCOUNTS) return;\n      targetSlot = count + 1;\n      cookieStore.set(cn.count, String(targetSlot), opts);\n    }\n\n    writeSlot(cookieStore, targetSlot, account);\n    cookieStore.set(cn.active, String(targetSlot), opts);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  // Alias for backwards compat\n  const setSessionCookies = saveAccountToList;\n\n  async function switchAccount(accountId: string): Promise<boolean> {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n\n    for (let i = 1; i <= count; i++) {\n      const slot = readSlot(cookieStore, i);\n      if (slot && (slot.id === accountId || slot.sessionId === accountId)) {\n        cookieStore.set(cn.active, String(i), opts);\n        clearPublicTokenCookie(cookieStore);\n        return true;\n      }\n    }\n    return false;\n  }\n\n  async function removeActiveAccount() {\n    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n\n    if (count === 0) return;\n\n    const remaining: StoredAccount[] = [];\n    for (let i = 1; i <= count; i++) {\n      if (i === activeIdx) continue;\n      const slot = readSlot(cookieStore, i);\n      if (slot) remaining.push(slot);\n    }\n\n    for (let i = 1; i <= count; i++) {\n      clearSlot(cookieStore, i);\n    }\n\n    if (remaining.length === 0) {\n      cookieStore.set(cn.count, \"0\", clear);\n      cookieStore.set(cn.active, \"0\", clear);\n      await clearPublicTokenCookie(cookieStore);\n      return;\n    }\n\n    // Re-compact remaining accounts into slots 1..n\n    for (let i = 0; i < remaining.length; i++) {\n      await writeSlot(cookieStore, i + 1, remaining[i]!);\n    }\n    cookieStore.set(cn.count, String(remaining.length), opts);\n    cookieStore.set(cn.active, \"1\", opts);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  async function clearAllSessionCookies() {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n    for (let i = 1; i <= count; i++) {\n      clearSlot(cookieStore, i);\n    }\n    cookieStore.set(cn.count, \"0\", clear);\n    cookieStore.set(cn.active, \"0\", clear);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  async function tryRefreshTokens(): Promise<string | null> {\n    const refreshToken = await getRefreshToken();\n    if (!refreshToken || !config.clientId) return null;\n\n    const basicAuth = Buffer.from(`${config.clientId}:${config.clientSecret ?? \"\"}`).toString(\"base64\");\n\n    const response = await fetch(createUrl(config.issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${basicAuth}`,\n      },\n      body: new URLSearchParams({\n        grant_type: \"refresh_token\",\n        refresh_token: refreshToken,\n      }),\n      cache: \"no-store\",\n    });\n\n    if (!response.ok) return null;\n\n    const data = (await response.json().catch(() => null)) as TokenLikeResponse | null;\n    if (!data) return null;\n\n    const tokens = tokenFromResponse(data);\n    if (!tokens.accessToken) return null;\n\n    await saveAccountToList(tokens);\n    return tokens.accessToken;\n  }\n\n  async function apiRequest<T>(path: string, init: RequestInit = {}): Promise<T> {\n    const accessToken = await getAccessToken();\n    const requestHeaders = new Headers(init.headers);\n\n    if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n    if (init.body !== undefined && !requestHeaders.has(\"content-type\")) {\n      requestHeaders.set(\"content-type\", \"application/json\");\n    }\n\n    const url = new URL(createUrl(config.issuer, path));\n    applyClientCredentials(url, config);\n\n    const response = await fetch(url, {\n      ...init,\n      headers: requestHeaders,\n      cache: \"no-store\",\n    });\n\n    if (response.status === 401) {\n      const newAccessToken = await tryRefreshTokens();\n      if (newAccessToken) {\n        const retryHeaders = new Headers(init.headers);\n        retryHeaders.set(\"authorization\", `Bearer ${newAccessToken}`);\n        if (init.body !== undefined && !retryHeaders.has(\"content-type\")) {\n          retryHeaders.set(\"content-type\", \"application/json\");\n        }\n        const retryUrl = new URL(createUrl(config.issuer, path));\n        applyClientCredentials(retryUrl, config);\n        const retryResponse = await fetch(retryUrl, {\n          ...init,\n          headers: retryHeaders,\n          cache: \"no-store\",\n        });\n        if (!retryResponse.ok) {\n          const error = await retryResponse.json().catch(() => null);\n          throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${retryResponse.status}`);\n        }\n        if (retryResponse.status === 204) return null as T;\n        return (await retryResponse.json()) as T;\n      }\n    }\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => null);\n      throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${response.status}`);\n    }\n\n    if (response.status === 204) return null as T;\n    return (await response.json()) as T;\n  }\n\n  function createApiClient(): ServerAuthApiClient {\n    return {\n      get: (path) => apiRequest(path),\n      post: (path, body) => apiRequest(path, { method: \"POST\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      patch: (path, body) => apiRequest(path, { method: \"PATCH\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      put: (path, body) => apiRequest(path, { method: \"PUT\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      delete: (path) => apiRequest(path, { method: \"DELETE\" }),\n    };\n  }\n\n  async function requireUser(options: { redirectTo?: string } = {}) {\n    const accessToken = await getAccessToken();\n    if (!accessToken) {\n      redirect(options.redirectTo ?? \"/\");\n    }\n    return accessToken;\n  }\n\n  function escapeHtml(str: string): string {\n    return str.replace(/&/g, \"&amp;\").replace(/</g, \"&lt;\").replace(/>/g, \"&gt;\").replace(/\"/g, \"&quot;\");\n  }\n\n  function sanitizeRedirectTo(value: string | null | undefined): string {\n    const raw = value ?? \"/\";\n    // Never redirect back into the auth basePath — that would loop or replay a stale code.\n    if (raw.startsWith(config.basePath)) return \"/\";\n    // Only allow relative paths to prevent open-redirect.\n    if (raw.startsWith(\"/\") && !raw.startsWith(\"//\")) return raw;\n    return \"/\";\n  }\n\n  async function createAuthorizeRedirect(request: NextRequest, mode: \"login\" | \"register\" | \"add-account\" | \"google\") {\n    const redirectTo = sanitizeRedirectTo(request.nextUrl.searchParams.get(\"redirectTo\") ?? config.afterSignInRedirectTo);\n    const flowId = request.nextUrl.searchParams.get(\"flow_id\");\n    const url = new URL(createUrl(config.issuer, mode === \"google\" ? \"/auth/google\" : \"/authorize\"));\n\n    if (!config.clientId) {\n      return NextResponse.json(\n        { error: \"missing_client_id\", message: \"Missing GEEKAPPS_AUTH_CLIENT_ID or clientId.\" },\n        { status: 500 },\n      );\n    }\n\n    url.searchParams.set(\"client_id\", config.clientId);\n    url.searchParams.set(\"redirect_uri\", resolveRedirectUri(config, request));\n    url.searchParams.set(\"response_type\", \"code\");\n    const scopes = config.scopes ?? [\"openid\", \"profile\", \"email\"];\n    if (!scopes.includes(\"offline_access\")) scopes.push(\"offline_access\");\n    url.searchParams.set(\"scope\", scopes.join(\" \"));\n    url.searchParams.set(\"state\", Buffer.from(JSON.stringify({ redirectTo, mode })).toString(\"base64url\"));\n    if (mode === \"register\") url.searchParams.set(\"screen_hint\", \"signup\");\n    if (mode === \"add-account\") {\n      // Adding an account always needs a fresh login, regardless of any existing session.\n      url.searchParams.set(\"prompt\", \"login\");\n    } else {\n      // `prompt` (login | select_account | none | consent) is forwarded as-is to\n      // the IDP — see OidcPrompt in client.tsx for what each value does.\n      const prompt = request.nextUrl.searchParams.get(\"prompt\");\n      // Legacy fallback: silentLogin=false is equivalent to prompt=login.\n      const silentLogin = request.nextUrl.searchParams.get(\"silentLogin\");\n      const resolvedPrompt = prompt ?? (silentLogin === \"false\" ? \"login\" : null);\n      if (resolvedPrompt) url.searchParams.set(\"prompt\", resolvedPrompt);\n    }\n    if (flowId) url.searchParams.set(\"flow_id\", flowId);\n\n    return NextResponse.redirect(url);\n  }\n\n  async function exchangeCode(request: NextRequest) {\n    const code = request.nextUrl.searchParams.get(\"code\");\n    const state = request.nextUrl.searchParams.get(\"state\");\n\n    const origin = requestOrigin(request);\n\n    if (!code) {\n      const err = request.nextUrl.searchParams.get(\"error\") ?? \"missing_code\";\n      const desc = request.nextUrl.searchParams.get(\"error_description\") ?? request.nextUrl.searchParams.get(\"error_message\") ?? \"No authorization code received\";\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=${encodeURIComponent(err)}&error_description=${encodeURIComponent(desc)}`, origin));\n    }\n\n    if (!config.clientId) {\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=missing_client_id&error_description=Auth+client+is+not+configured`, origin));\n    }\n\n    const basicAuth = Buffer.from(\n      `${config.clientId}:${config.clientSecret ?? \"\"}`,\n    ).toString(\"base64\");\n\n    const response = await fetch(createUrl(config.issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${basicAuth}`,\n      },\n      body: new URLSearchParams({\n        grant_type: \"authorization_code\",\n        code,\n        redirect_uri: resolveRedirectUri(config, request),\n      }),\n      cache: \"no-store\",\n    });\n\n    const data = (await response.json().catch(() => ({}))) as TokenLikeResponse & { error?: string; error_description?: string };\n    if (!response.ok) {\n      const error = encodeURIComponent((data.error as string | undefined) ?? \"token_exchange_failed\");\n      const desc = encodeURIComponent((data.error_description as string | undefined) ?? `Token exchange failed with status ${response.status}`);\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=${error}&error_description=${desc}`, origin));\n    }\n\n    await saveAccountToList(tokenFromResponse(data));\n\n    let redirectTo = sanitizeRedirectTo(config.afterSignInRedirectTo);\n    if (state) {\n      try {\n        const parsed = JSON.parse(Buffer.from(state, \"base64url\").toString(\"utf8\")) as { redirectTo?: string };\n        redirectTo = sanitizeRedirectTo(parsed.redirectTo);\n      } catch {\n        // ignore malformed state\n      }\n    }\n\n    return NextResponse.redirect(new URL(redirectTo, origin));\n  }\n\n  function mapLocalPathToApiPath(route: string) {\n    if (route === \"/me\") return \"/auth/me\";\n    if (route === \"/accounts/switch\") return \"/auth/accounts/switch\";\n    if (route === \"/organizations/active\") return \"/auth/organizations/active\";\n    if (route === \"/permissions/check\") return \"/auth/permissions/check\";\n    if (route === \"/login/password\") return \"/auth/login/password\";\n    if (route === \"/register/password\") return \"/auth/register/password\";\n    if (route === \"/passwordless/link\") return \"/auth/passwordless/link\";\n    return route;\n  }\n\n  async function handleAccountsLocal(): Promise<NextResponse> {\n    const [accounts, activeIdx] = await Promise.all([getAccountsList(), getActiveIndex()]);\n\n    return NextResponse.json({\n      accounts: accounts.map((a, i) => ({\n        id: a.id,\n        sessionId: a.sessionId ?? a.id,\n        isActive: i + 1 === activeIdx,\n        user: {\n          id: a.user.sub,\n          name: a.user.name ?? null,\n          email: a.user.email ?? null,\n          imageUrl: a.user.picture ?? null,\n          phone: a.user.phone ?? null,\n        },\n      })),\n    });\n  }\n\n  async function handleOrganizationsLocal(): Promise<NextResponse> {\n    const cookieStore = await cookies();\n    const activeOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;\n    try {\n      const data = await apiRequest<unknown[]|{ organizations: unknown[] }>(\"/organizations\");\n      const organizations = Array.isArray(data) ? data : (data as { organizations: unknown[] }).organizations;\n      return NextResponse.json({ organizations, currentOrgId: activeOrgId });\n    } catch {\n      return NextResponse.json({ organizations: [], currentOrgId: activeOrgId });\n    }\n  }\n\n  async function handleSwitchAccountLocal(request: NextRequest): Promise<NextResponse> {\n    const body = await readBody(request);\n    const targetId =\n      body && typeof body === \"object\"\n        ? String(\n            (body as Record<string, unknown>).accountId ??\n            (body as Record<string, unknown>).sessionId ??\n            \"\",\n          )\n        : \"\";\n\n    if (!targetId) {\n      return NextResponse.json({ error: \"accountId required\" }, { status: 400 });\n    }\n\n    const switched = await switchAccount(targetId);\n    if (!switched) {\n      return NextResponse.json({ error: \"Account not found\" }, { status: 404 });\n    }\n\n    return NextResponse.json({ ok: true });\n  }\n\n  async function proxy(request: NextRequest, route: string) {\n    const accessToken = await getAccessToken();\n    const body = [\"GET\", \"HEAD\"].includes(request.method) ? undefined : await readBody(request);\n    const url = new URL(appendSearchParams(createUrl(config.issuer, mapLocalPathToApiPath(route)), request));\n    applyClientCredentials(url, config);\n    const requestHeaders = new Headers();\n\n    if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n    if (body !== undefined) requestHeaders.set(\"content-type\", \"application/json\");\n\n    const response = await fetch(url, {\n      method: request.method,\n      headers: requestHeaders,\n      body: body === undefined ? undefined : typeof body === \"string\" ? body : JSON.stringify(body),\n      cache: \"no-store\",\n    });\n\n    const data = isJsonResponse(response) ? ((await response.json().catch(() => null)) as TokenLikeResponse | null) : null;\n    if (data) {\n      const tokens = tokenFromResponse(data);\n      if (tokens.accessToken || tokens.refreshToken || tokens.idToken || tokens.sessionId) {\n        await saveAccountToList(tokens);\n      }\n      return NextResponse.json(data, { status: response.status });\n    }\n\n    return responseFromApi(response);\n  }\n\n  async function handle(request: NextRequest) {\n    const route = routeFromRequest(request, config.basePath);\n\n    if (request.method === \"GET\" && route === \"/sign-in\") return createAuthorizeRedirect(request, \"login\");\n    if (request.method === \"GET\" && route === \"/sign-up\") return createAuthorizeRedirect(request, \"register\");\n    if (request.method === \"GET\" && route === \"/add-account\") return createAuthorizeRedirect(request, \"add-account\");\n    if (request.method === \"GET\" && route === \"/login/google\") return createAuthorizeRedirect(request, \"google\");\n    if (request.method === \"GET\" && route === \"/callback\") {\n      const error = request.nextUrl.searchParams.get(\"error\");\n      if (error) {\n        const description = request.nextUrl.searchParams.get(\"error_description\") ?? request.nextUrl.searchParams.get(\"error_message\") ?? \"An authentication error occurred.\";\n        return new NextResponse(\n          `<!doctype html><html><head><meta charset=\"utf-8\"><title>Authentication Error</title></head><body style=\"font-family:sans-serif;max-width:480px;margin:80px auto;padding:0 16px\"><h2>Authentication Error</h2><p><strong>${escapeHtml(error)}</strong></p><p>${escapeHtml(description)}</p><a href=\"/\">Go back</a></body></html>`,\n          { status: 400, headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n        );\n      }\n      return exchangeCode(request);\n    }\n    if (request.method === \"GET\" && route === \"/token\") {\n      const accessToken = await getAccessToken();\n      if (!accessToken) return NextResponse.json({ error: \"missing_token\" }, { status: 401 });\n      return NextResponse.json({ accessToken });\n    }\n\n\n    if (request.method === \"GET\" && route === \"/accounts\") return handleAccountsLocal();\n    if (request.method === \"POST\" && route === \"/accounts/switch\") return handleSwitchAccountLocal(request);\n    if (request.method === \"GET\" && route === \"/organizations\") return handleOrganizationsLocal();\n\n    if (request.method === \"POST\" && route === \"/organizations\") {\n      const accessToken = await getAccessToken();\n      const body = (await readBody(request)) as Record<string, unknown> | undefined;\n      if (body && accessToken && !body.applicationId) {\n        const claims = decodeJwtPayload(accessToken);\n        const applicationId =\n          (typeof claims?.application_id === \"string\" ? claims.application_id : null) ??\n          (typeof claims?.client_id === \"string\" ? claims.client_id : null) ??\n          (typeof claims?.applicationId === \"string\" ? claims.applicationId : null);\n        if (applicationId) body.applicationId = applicationId;\n      }\n      const orgUrl = new URL(createUrl(config.issuer, \"/organizations\"));\n      applyClientCredentials(orgUrl, config);\n      const requestHeaders = new Headers();\n      if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n      if (body !== undefined) requestHeaders.set(\"content-type\", \"application/json\");\n      const response = await fetch(orgUrl, {\n        method: \"POST\",\n        headers: requestHeaders,\n        body: JSON.stringify(body),\n        cache: \"no-store\",\n      });\n      return responseFromApi(response);\n    }\n\n    if (request.method === \"POST\" && route === \"/sign-out\") {\n      await apiRequest(\"/auth/sign-out\", { method: \"POST\" }).catch(() => null);\n      await removeActiveAccount();\n      return NextResponse.json({ ok: true });\n    }\n\n    if (request.method === \"POST\" && route === \"/sign-out-all\") {\n      await apiRequest(\"/auth/sign-out-all\", { method: \"POST\" }).catch(() => null);\n      await clearAllSessionCookies();\n      return NextResponse.json({ ok: true });\n    }\n\n    if (request.method === \"POST\" && route === \"/organizations/active\") {\n      const body = await readBody(request);\n      const organizationId =\n        body && typeof body === \"object\" && \"organizationId\" in body\n          ? (body as Record<string, unknown>).organizationId\n          : null;\n      const response = NextResponse.json({ ok: true });\n      if (typeof organizationId === \"string\") {\n        const cookieOpts = {\n          httpOnly: true,\n          sameSite: \"lax\" as const,\n          path: \"/\",\n          secure: process.env.NODE_ENV === \"production\",\n          maxAge: 60 * 60 * 24 * 7,\n        };\n        response.cookies.set(cn.activeOrganizationId, organizationId, cookieOpts);\n      }\n      return response;\n    }\n\n    return proxy(request, route);\n  }\n\n  return {\n    handlers: {\n      GET: handle,\n      POST: handle,\n      PATCH: handle,\n      DELETE: handle,\n    },\n    GetSession: getSession,\n    GetUser: getUser,\n    GetUserById: getUserById,\n    GetOrganizations: getOrganizations,\n    SaveSession: saveAccountToList,\n    GetAccessToken: getAccessToken,\n    GetRefreshToken: getRefreshToken,\n    IsAuthenticated: async () => (await getAccessToken()) !== null,\n    TryRefreshTokens: tryRefreshTokens,\n    RequireUser: requireUser,\n    CreateAuthApiClient: createApiClient,\n    cookiePrefix: config.cookiePrefix,\n    VerifyToken: (token: string) => verifyToken(token, config.issuer),\n    SignInUrl: async (redirectTo?: string) => {\n      const configured = env(\"GEEKAPPS_APP_URL\");\n      if (!configured) throw new Error(\"Cannot determine app origin. Set GEEKAPPS_APP_URL.\");\n      const origin = configured.replace(/\\/$/, \"\");\n      const url = new URL(`${origin}${config.basePath}/sign-in`);\n      if (redirectTo) url.searchParams.set(\"redirectTo\", redirectTo);\n      return url.toString();\n    },\n  };\n}\n\nexport function handlers(options?: GeekappsAuthConfig) {\n  return configureGeekappsAuth(options).handlers;\n}\n\n/**\n * Returns true if the current request has a valid access token in cookies.\n * Safe to call in Server Components, Server Actions, and Route Handlers.\n */\nexport async function isAuthenticated(options?: GeekappsAuthConfig): Promise<boolean> {\n  const { GetAccessToken } = configureGeekappsAuth(options);\n  return (await GetAccessToken()) !== null;\n}\n"],"mappings":";;;AAEA,SAAS,WAAAA,UAAS,WAAAC,gBAAe;;;ACFjC,SAAS,SAAS,eAAe;AACjC,SAAS,gBAAgB;AACzB,SAAS,oBAAsC;AAC/C,SAAS,oBAAoB,iBAAkC;AAMxD,IAAM,2BAA2B;;;ADDxC,SAAS,IAAI,MAAc;AACzB,QAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,SAAO,SAAS,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AACpD;AAEA,SAAS,iBAAiB,KAAa;AACrC,SAAO,IAAI,QAAQ,OAAO,EAAE;AAC9B;AAEA,SAAS,gBAAgB;AACvB,SAAO;AAAA;AAAA,IAEL,IAAI,sBAAsB,KAAK,IAAI,uBAAuB,KAAK;AAAA,EACjE;AACF;AAEA,SAAS,wBAAwB,KAAqB;AACpD,QAAM,WAAW,IAAI,yBAAyB;AAC9C,QAAM,eAAe,IAAI,6BAA6B;AACtD,MAAI,CAAC,YAAY,CAAC,aAAc,QAAO;AACvC,QAAM,IAAI,IAAI,IAAI,GAAG;AACrB,IAAE,aAAa,IAAI,aAAa,QAAQ;AACxC,IAAE,aAAa,IAAI,iBAAiB,YAAY;AAChD,SAAO,EAAE,SAAS;AACpB;AAEA,SAAS,aAAa,UAA0B;AAC9C,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,SAAM,KAAK,KAAK,IAAM,SAAS,WAAW,CAAC,IAAI;AAC/C,QAAI,MAAM;AAAA,EACZ;AACA,SAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACvC;AAEA,SAAS,qBAA6B;AACpC,QAAM,WAAW,IAAI,yBAAyB,KAAK;AACnD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,MAAM,aAAa,QAAQ,CAAC;AACrC;AAIA,SAAS,WAAW,OAAgC;AAClD,MAAI;AACF,UAAM,IAAI,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM,CAAC;AACrE,WAAO,EAAE,KAAK,IAAI;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB;AAC9B,QAAM,SAAS,mBAAmB;AAClC,SAAO;AAAA,IACL,QAAQ,GAAG,MAAM;AAAA,IACjB,OAAO,GAAG,MAAM;AAAA,IAChB,sBAAsB,GAAG,MAAM;AAAA,IAC/B,UAAU,CAAC,MAAc,GAAG,MAAM,KAAK,CAAC;AAAA,IACxC,QAAQ,CAAC,MAAc,GAAG,MAAM,MAAM,CAAC;AAAA,IACvC,QAAQ,CAAC,MAAc,GAAG,MAAM,MAAM,CAAC;AAAA,EACzC;AACF;AAEA,eAAe,uBAA+C;AAE5D,MAAI;AACF,UAAM,OAAO,MAAMC,SAAQ;AAC3B,UAAM,OAAO,KAAK,IAAI,eAAe;AACrC,QAAI,MAAM,WAAW,SAAS,EAAG,QAAO,KAAK,MAAM,CAAC;AAAA,EACtD,QAAQ;AAAA,EAAC;AACT,QAAM,cAAc,MAAMC,SAAQ;AAClC,QAAM,KAAK,MAAM,eAAe;AAChC,QAAM,MAAM,YAAY,IAAI,GAAG,MAAM,GAAG;AACxC,QAAM,YAAY,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AACnD,QAAM,WAAW,YAAY,IAAI,GAAG,KAAK,GAAG;AAC5C,QAAM,QAAQ,WAAW,OAAO,SAAS,UAAU,EAAE,IAAI;AACzD,MAAI,UAAU,EAAG,QAAO;AACxB,QAAM,MAAM,aAAa,KAAK,aAAa,QAAQ,YAAY;AAC/D,SAAO,YAAY,IAAI,GAAG,OAAO,GAAG,CAAC,GAAG,SAAS;AACnD;AAEA,eAAe,wBAAgD;AAC7D,QAAM,cAAc,MAAMA,SAAQ;AAClC,QAAM,KAAK,MAAM,eAAe;AAChC,QAAM,MAAM,YAAY,IAAI,GAAG,MAAM,GAAG;AACxC,QAAM,YAAY,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AACnD,QAAM,WAAW,YAAY,IAAI,GAAG,KAAK,GAAG;AAC5C,QAAM,QAAQ,WAAW,OAAO,SAAS,UAAU,EAAE,IAAI;AACzD,MAAI,UAAU,EAAG,QAAO;AACxB,QAAM,MAAM,aAAa,KAAK,aAAa,QAAQ,YAAY;AAC/D,SAAO,YAAY,IAAI,GAAG,OAAO,GAAG,CAAC,GAAG,SAAS;AACnD;AAEA,eAAe,uBAA+C;AAC5D,QAAM,eAAe,MAAM,sBAAsB;AACjD,QAAM,WAAW,IAAI,yBAAyB,KAAK;AACnD,QAAM,eAAe,IAAI,6BAA6B,KAAK;AAC3D,MAAI,CAAC,gBAAgB,CAAC,SAAU,QAAO;AAEvC,QAAM,YAAY,OAAO,KAAK,GAAG,QAAQ,IAAI,YAAY,EAAE,EAAE,SAAS,QAAQ;AAC9E,QAAM,WAAW,MAAM,MAAM,GAAG,cAAc,CAAC,eAAe;AAAA,IAC5D,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,eAAe,SAAS,SAAS;AAAA,IACnC;AAAA,IACA,MAAM,IAAI,gBAAgB,EAAE,YAAY,iBAAiB,eAAe,aAAa,CAAC;AAAA,IACtF,OAAO;AAAA,EACT,CAAC;AAED,MAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,QAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACnD,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,iBACH,KAAK,eAAe,KAAK;AAC5B,QAAM,kBACH,KAAK,gBAAgB,KAAK;AAE7B,MAAI,CAAC,eAAgB,QAAO;AAG5B,QAAM,cAAc,MAAMA,SAAQ;AAClC,QAAM,KAAK,MAAM,eAAe;AAChC,QAAM,MAAM,YAAY,IAAI,GAAG,MAAM,GAAG;AACxC,QAAM,YAAY,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AACnD,QAAM,OAAO;AAAA,IACX,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,KAAK,KAAK,KAAK;AAAA,EACzB;AACA,cAAY,IAAI,GAAG,OAAO,SAAS,GAAG,gBAAgB,IAAI;AAC1D,MAAI,gBAAiB,aAAY,IAAI,GAAG,OAAO,SAAS,GAAG,iBAAiB,IAAI;AAEhF,cAAY,IAAI,GAAG,mBAAmB,CAAC,OAAO,gBAAgB;AAAA,IAC5D,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,KAAK,KAAK,KAAK;AAAA,EACzB,CAAC;AAED,SAAO;AACT;AAEA,eAAe,UAAa,MAA0B;AACpD,MAAI,cAAc,MAAM,qBAAqB;AAC7C,MAAI,CAAC,YAAa,OAAM,IAAI,MAAM,mBAAmB;AAErD,QAAM,SAAS,cAAc;AAC7B,QAAM,UAAU,CAAC,UACf,MAAM,wBAAwB,GAAG,MAAM,GAAG,IAAI,EAAE,GAAG;AAAA,IACjD,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,IAC5C,OAAO;AAAA,EACT,CAAC;AAEH,MAAI,WAAW,MAAM,QAAQ,WAAW;AAExC,MAAI,SAAS,WAAW,KAAK;AAC3B,UAAM,WAAW,MAAM,qBAAqB;AAC5C,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,iBAAiB;AAChD,eAAW,MAAM,QAAQ,QAAQ;AAAA,EACnC;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAM,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AAClD,UAAM,IAAI,MAAO,KAAK,qBAAqB,KAAK,SAAS,KAAK,WAAW,cAAc,SAAS,MAAM,EAAa;AAAA,EACrH;AAEA,MAAI,SAAS,WAAW,IAAK,QAAO;AACpC,SAAO,SAAS,KAAK;AACvB;AAIA,eAAsB,QAAwC;AAC5D,MAAI;AACF,UAAM,OAAO,MAAM,UAA+C,UAAU;AAC5E,QAAI,CAAC,KAAM,QAAO,EAAE,MAAM,KAAK;AAC/B,QAAI,OAAO,SAAS,YAAY,UAAU,KAAM,QAAO;AACvD,WAAO,EAAE,MAAM,KAAoB;AAAA,EACrC,QAAQ;AACN,WAAO,EAAE,MAAM,KAAK;AAAA,EACtB;AACF;AAEA,eAAsB,cAAyD;AAC7E,QAAM,cAAc,MAAMA,SAAQ;AAClC,QAAM,KAAK,MAAM,eAAe;AAChC,QAAM,WAAW,YAAY,IAAI,GAAG,KAAK,GAAG;AAC5C,QAAM,QAAQ,WAAW,OAAO,SAAS,UAAU,EAAE,IAAI;AACzD,QAAM,YAAY,YAAY,IAAI,GAAG,MAAM,GAAG;AAC9C,QAAM,YAAY,YAAY,OAAO,SAAS,WAAW,EAAE,IAAI;AAE/D,QAAM,WAA+B,CAAC;AACtC,WAAS,IAAI,GAAG,KAAK,OAAO,KAAK;AAC/B,UAAM,KAAK,YAAY,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG;AAC1C,QAAI,CAAC,GAAI;AACT,UAAM,OAAO,WAAW,YAAY,IAAI,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,EAAE;AACpE,QAAI,CAAC,KAAM;AACX,aAAS,KAAK;AAAA,MACZ,IAAI,KAAK;AAAA,MACT,WAAW,KAAK,OAAO,KAAK;AAAA,MAC5B,UAAU,MAAM;AAAA,MAChB,MAAM;AAAA,QACJ,IAAI,KAAK;AAAA,QACT,MAAM,KAAK,KAAK;AAAA,QAChB,OAAO,KAAK,KAAK;AAAA,QACjB,UAAU,KAAK,KAAK;AAAA,QACpB,OAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,SAAS;AACpB;AAEA,eAAsB,mBAA6F;AACjH,MAAI;AACF,UAAM,cAAc,MAAMA,SAAQ;AAClC,UAAM,KAAK,MAAM,eAAe;AAChC,UAAM,cAAc,YAAY,IAAI,GAAG,oBAAoB,GAAG,SAAS;AACvE,UAAM,OAAO,MAAM,UAA8D,gBAAgB;AACjG,UAAM,gBAAgB,MAAM,QAAQ,IAAI,IAAI,OAAQ,KAA2C;AAC/F,UAAM,gBAAgB,eAAe,cAAc,CAAC,GAAG,MAAM;AAC7D,WAAO,EAAE,eAAe,cAAc,cAAc;AAAA,EACtD,SAAS,KAAK;AACZ,YAAQ,MAAM,6BAA6B,GAAG;AAC9C,WAAO,EAAE,eAAe,CAAC,EAAE;AAAA,EAC7B;AACF;","names":["cookies","headers","headers","cookies"]}
+{"version":3,"sources":["../src/actions.ts","../src/server.ts"],"sourcesContent":["\"use server\";\n\nimport { cookies, headers } from \"next/headers\";\nimport type { ConnectedAccount, Organization, User } from \"./client\";\nimport { GEEKAPPS_AUTH_SERVER_URL } from \"./server\";\n\n// ── cookie helpers (duplicated from server.ts to keep this file self-contained) ──\n\nfunction env(name: string) {\n  const value = process.env[name];\n  return value && value.trim().length > 0 ? value : undefined;\n}\n\nfunction normalizeBaseUrl(url: string) {\n  return url.replace(/\\/$/, \"\");\n}\n\nfunction resolveIssuer() {\n  return normalizeBaseUrl(\n    // Deprecated: kept for backwards compatibility during the auth-server rename.\n    env(\"GEEKAPPS_AUTH_ISSUER\") ?? env(\"GEEKAPPS_AUTH_API_URL\") ?? GEEKAPPS_AUTH_SERVER_URL,\n  );\n}\n\nfunction appendClientCredentials(url: string): string {\n  const clientId = env(\"GEEKAPPS_AUTH_CLIENT_ID\");\n  const clientSecret = env(\"GEEKAPPS_AUTH_CLIENT_SECRET\");\n  if (!clientId || !clientSecret) return url;\n  const u = new URL(url);\n  u.searchParams.set(\"client_id\", clientId);\n  u.searchParams.set(\"client_secret\", clientSecret);\n  return u.toString();\n}\n\nfunction hashClientId(clientId: string): string {\n  let h = 5381;\n  for (let i = 0; i < clientId.length; i++) {\n    h = ((h << 5) + h) ^ (clientId.charCodeAt(i) & 0xff);\n    h = h >>> 0;\n  }\n  return h.toString(16).padStart(8, \"0\");\n}\n\nfunction deriveCookiePrefix(): string {\n  const clientId = env(\"GEEKAPPS_AUTH_CLIENT_ID\") ?? \"\";\n  if (!clientId) return \"gk\";\n  return `gk_${hashClientId(clientId)}`;\n}\n\ntype SlotMeta = { id: string; sid?: string; n?: string; e?: string; p?: string };\n\nfunction decodeMeta(value: string): SlotMeta | null {\n  try {\n    const m = JSON.parse(Buffer.from(value, \"base64url\").toString(\"utf8\")) as SlotMeta;\n    return m.id ? m : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function getCookieNames() {\n  const prefix = deriveCookiePrefix();\n  return {\n    active: `${prefix}_active`,\n    count: `${prefix}_count`,\n    activeOrganizationId: `${prefix}_ao`,\n    slotMeta: (n: number) => `${prefix}_m${n}`,\n    slotAt: (n: number) => `${prefix}_at${n}`,\n    slotRt: (n: number) => `${prefix}_rt${n}`,\n  };\n}\n\nasync function getActiveAccessToken(): Promise<string | null> {\n  // Prefer the token injected by the middleware via request header (same-request refresh)\n  try {\n    const hdrs = await headers();\n    const auth = hdrs.get(\"authorization\");\n    if (auth?.startsWith(\"Bearer \")) return auth.slice(7);\n  } catch {}\n  const cookieStore = await cookies();\n  const cn = await getCookieNames();\n  const raw = cookieStore.get(cn.active)?.value;\n  const activeIdx = raw ? Number.parseInt(raw, 10) : 0;\n  const countRaw = cookieStore.get(cn.count)?.value;\n  const count = countRaw ? Number.parseInt(countRaw, 10) : 0;\n  if (count === 0) return null;\n  const idx = activeIdx >= 1 && activeIdx <= count ? activeIdx : 1;\n  return cookieStore.get(cn.slotAt(idx))?.value ?? null;\n}\n\nasync function getActiveRefreshToken(): Promise<string | null> {\n  const cookieStore = await cookies();\n  const cn = await getCookieNames();\n  const raw = cookieStore.get(cn.active)?.value;\n  const activeIdx = raw ? Number.parseInt(raw, 10) : 0;\n  const countRaw = cookieStore.get(cn.count)?.value;\n  const count = countRaw ? Number.parseInt(countRaw, 10) : 0;\n  if (count === 0) return null;\n  const idx = activeIdx >= 1 && activeIdx <= count ? activeIdx : 1;\n  return cookieStore.get(cn.slotRt(idx))?.value ?? null;\n}\n\nasync function refreshAndSaveTokens(): Promise<string | null> {\n  const refreshToken = await getActiveRefreshToken();\n  const clientId = env(\"GEEKAPPS_AUTH_CLIENT_ID\") ?? \"\";\n  const clientSecret = env(\"GEEKAPPS_AUTH_CLIENT_SECRET\") ?? \"\";\n  if (!refreshToken || !clientId) return null;\n\n  const basicAuth = Buffer.from(`${clientId}:${clientSecret}`).toString(\"base64\");\n  const response = await fetch(`${resolveIssuer()}/auth/token`, {\n    method: \"POST\",\n    headers: {\n      \"content-type\": \"application/x-www-form-urlencoded\",\n      authorization: `Basic ${basicAuth}`,\n    },\n    body: new URLSearchParams({ grant_type: \"refresh_token\", refresh_token: refreshToken }),\n    cache: \"no-store\",\n  });\n\n  if (!response.ok) return null;\n\n  const data = await response.json().catch(() => null) as Record<string, unknown> | null;\n  if (!data) return null;\n\n  const newAccessToken =\n    (data.accessToken ?? data.access_token) as string | undefined;\n  const newRefreshToken =\n    (data.refreshToken ?? data.refresh_token) as string | undefined;\n\n  if (!newAccessToken) return null;\n\n  // Update the active slot cookies\n  const cookieStore = await cookies();\n  const cn = await getCookieNames();\n  const raw = cookieStore.get(cn.active)?.value;\n  const activeIdx = raw ? Number.parseInt(raw, 10) : 1;\n  const opts = {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === \"production\",\n    sameSite: \"lax\" as const,\n    path: \"/\",\n    maxAge: 60 * 60 * 24 * 30,\n  };\n  cookieStore.set(cn.slotAt(activeIdx), newAccessToken, opts);\n  if (newRefreshToken) cookieStore.set(cn.slotRt(activeIdx), newRefreshToken, opts);\n  // Update public token cookie\n  cookieStore.set(`${deriveCookiePrefix()}_tp`, newAccessToken, {\n    httpOnly: false,\n    secure: process.env.NODE_ENV === \"production\",\n    sameSite: \"lax\",\n    path: \"/\",\n    maxAge: 60 * 60 * 24 * 30,\n  });\n\n  return newAccessToken;\n}\n\nasync function authFetch<T>(path: string): Promise<T> {\n  let accessToken = await getActiveAccessToken();\n  if (!accessToken) throw new Error(\"Not authenticated\");\n\n  const issuer = resolveIssuer();\n  const doFetch = (token: string) =>\n    fetch(appendClientCredentials(`${issuer}${path}`), {\n      headers: { authorization: `Bearer ${token}` },\n      cache: \"no-store\",\n    });\n\n  let response = await doFetch(accessToken);\n\n  if (response.status === 401) {\n    const newToken = await refreshAndSaveTokens();\n    if (!newToken) throw new Error(\"Session expired\");\n    response = await doFetch(newToken);\n  }\n\n  if (!response.ok) {\n    const err = await response.json().catch(() => null) as Record<string, unknown> | null;\n    throw new Error((err?.error_description ?? err?.error ?? err?.message ?? `Auth error ${response.status}`) as string);\n  }\n\n  if (response.status === 204) return null as T;\n  return response.json() as Promise<T>;\n}\n\n// ── Exported server actions ────────────────────────────────────────────────────\n\nexport async function getMe(): Promise<{ user: User | null }> {\n  try {\n    const data = await authFetch<{ user: User | null } | User | null>(\"/auth/me\");\n    if (!data) return { user: null };\n    if (typeof data === \"object\" && \"user\" in data) return data as { user: User | null };\n    return { user: data as User | null };\n  } catch {\n    return { user: null };\n  }\n}\n\nexport async function getAccounts(): Promise<{ accounts: ConnectedAccount[] }> {\n  const cookieStore = await cookies();\n  const cn = await getCookieNames();\n  const countRaw = cookieStore.get(cn.count)?.value;\n  const count = countRaw ? Number.parseInt(countRaw, 10) : 0;\n  const activeRaw = cookieStore.get(cn.active)?.value;\n  const activeIdx = activeRaw ? Number.parseInt(activeRaw, 10) : 0;\n\n  const accounts: ConnectedAccount[] = [];\n  for (let i = 1; i <= count; i++) {\n    const at = cookieStore.get(cn.slotAt(i))?.value;\n    if (!at) continue;\n    const meta = decodeMeta(cookieStore.get(cn.slotMeta(i))?.value ?? \"\");\n    if (!meta) continue;\n    accounts.push({\n      id: meta.id,\n      sessionId: meta.sid ?? meta.id,\n      isActive: i === activeIdx,\n      user: {\n        id: meta.id,\n        name: meta.n ?? null,\n        email: meta.e ?? \"\",\n        imageUrl: meta.p ?? null,\n        phone: null,\n      },\n    });\n  }\n\n  return { accounts };\n}\n\nexport async function getOrganizations(): Promise<{ organizations: Organization[]; currentOrgId?: string | null }> {\n  try {\n    const cookieStore = await cookies();\n    const cn = await getCookieNames();\n    const activeOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;\n    const data = await authFetch<Organization[] | { organizations: Organization[] }>(\"/organizations\");\n    const organizations = Array.isArray(data) ? data : (data as { organizations: Organization[] }).organizations;\n    const resolvedOrgId = activeOrgId ?? organizations[0]?.id ?? null;\n    return { organizations, currentOrgId: resolvedOrgId };\n  } catch (err) {\n    console.error(\"[getOrganizations] error:\", err);\n    return { organizations: [] };\n  }\n}\n","import { createHash, randomBytes } from \"node:crypto\";\nimport { cookies, headers } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport { NextResponse, type NextRequest } from \"next/server\";\nimport { createRemoteJWKSet, jwtVerify, type JWTPayload } from \"jose\";\n\n/**\n * Fixed URL of the Geekapps Auth Server (OIDC issuer + API). This never\n * changes per-environment, so it is hardcoded rather than read from env.\n */\nexport const GEEKAPPS_AUTH_SERVER_URL = \"https://accounts-api.geekapps.com.br\";\n\nexport type GeekappsAuthConfig = {\n  /**\n   * Auth Server (OIDC) issuer URL. Defaults to GEEKAPPS_AUTH_SERVER_URL and\n   * should not need overriding in normal use.\n   *\n   * Deprecated (still supported as a fallback): GEEKAPPS_AUTH_SERVER_ISSUER,\n   * GEEKAPPS_AUTH_ISSUER, GEEKAPPS_AUTH_SERVER_URL env, GEEKAPPS_AUTH_API_URL\n   */\n  issuer?: string;\n\n  /**\n   * OAuth client id. Optional when GEEKAPPS_AUTH_CLIENT_ID is defined.\n   */\n  clientId?: string;\n\n  /**\n   * OAuth client secret for confidential clients. Optional when\n   * GEEKAPPS_AUTH_CLIENT_SECRET is defined.\n   */\n  clientSecret?: string;\n\n  /**\n   * Callback URL. Optional when GEEKAPPS_AUTH_REDIRECT_URI is defined.\n   * If omitted, it is inferred from the current request origin + basePath/callback.\n   */\n  redirectUri?: string;\n\n  scopes?: string[];\n  basePath?: string;\n  /**\n   * @deprecated cookiePrefix is now auto-derived from clientId.\n   * This field is kept for backwards compatibility but is ignored.\n   */\n  cookiePrefix?: string;\n  secureCookies?: boolean;\n\n  /**\n   * Friendly alias used by apps. Same as afterSignInRedirectTo.\n   */\n  redirectTo?: string;\n\n  afterSignInRedirectTo?: string;\n  afterSignOutRedirectTo?: string;\n};\n\ntype ResolvedGeekappsAuthConfig = GeekappsAuthConfig & {\n  issuer: string;\n  clientId: string;\n  basePath: string;\n  cookiePrefix: string;\n};\n\nexport type SessionTokens = {\n  accessToken: string | null;\n  refreshToken: string | null;\n  idToken: string | null;\n  sessionId: string | null;\n};\n\nexport type StoredAccount = {\n  /** Stable identifier — `sub` from id_token or fallback to sessionId. */\n  id: string;\n  accessToken: string;\n  refreshToken: string | null;\n  idToken: string | null;\n  sessionId: string | null;\n  user: {\n    sub: string;\n    name?: string | null;\n    email?: string | null;\n    picture?: string | null;\n    phone?: string | null;\n  };\n};\n\nexport type ServerAuthApiClient = {\n  get: <T>(path: string) => Promise<T>;\n  post: <T>(path: string, body?: unknown) => Promise<T>;\n  patch: <T>(path: string, body?: unknown) => Promise<T>;\n  put: <T>(path: string, body?: unknown) => Promise<T>;\n  delete: <T>(path: string) => Promise<T>;\n};\n\ntype JsonObject = Record<string, unknown>;\n\ntype TokenLikeResponse = JsonObject & {\n  access_token?: string;\n  accessToken?: string;\n  refresh_token?: string;\n  refreshToken?: string;\n  id_token?: string;\n  idToken?: string;\n  session_id?: string;\n  sessionId?: string;\n  tokens?: {\n    access_token?: string;\n    accessToken?: string;\n    refresh_token?: string;\n    refreshToken?: string;\n    id_token?: string;\n    idToken?: string;\n    session_id?: string;\n    sessionId?: string;\n  };\n};\n\nconst MAX_ACCOUNTS = 8;\n\nfunction normalizeBaseUrl(url: string) {\n  return url.replace(/\\/$/, \"\");\n}\n\nfunction normalizeBasePath(path = \"/api/auth\") {\n  if (!path.startsWith(\"/\")) return `/${path}`;\n  return path.replace(/\\/$/, \"\");\n}\n\nfunction createUrl(baseUrl: string, path: string) {\n  if (/^https?:\\/\\//.test(path)) return path;\n  const normalizedPath = path.startsWith(\"/\") ? path : `/${path}`;\n  return `${normalizeBaseUrl(baseUrl)}${normalizedPath}`;\n}\n\nfunction env(name: string) {\n  const value = process.env[name];\n  return value && value.trim().length > 0 ? value : undefined;\n}\n\nfunction resolveIssuer(input: GeekappsAuthConfig) {\n  return normalizeBaseUrl(\n    input.issuer ??\n      env(\"GEEKAPPS_AUTH_SERVER_ISSUER\") ??\n      env(\"GEEKAPPS_AUTH_SERVER_URL\") ??\n      // Deprecated: kept for backwards compatibility during the auth-server rename.\n      env(\"GEEKAPPS_AUTH_ISSUER\") ??\n      env(\"GEEKAPPS_AUTH_API_URL\") ??\n      GEEKAPPS_AUTH_SERVER_URL,\n  );\n}\n\nfunction resolveClientId(input: GeekappsAuthConfig) {\n  return input.clientId ?? env(\"GEEKAPPS_AUTH_CLIENT_ID\") ?? \"\";\n}\n\nfunction resolveClientSecret(input: GeekappsAuthConfig) {\n  return input.clientSecret ?? env(\"GEEKAPPS_AUTH_CLIENT_SECRET\");\n}\n\nfunction applyClientCredentials(url: URL, config: ResolvedGeekappsAuthConfig) {\n  if (!config.clientId || !config.clientSecret) return;\n  url.searchParams.set(\"client_id\", config.clientId);\n  url.searchParams.set(\"client_secret\", config.clientSecret);\n}\n\nfunction resolveConfiguredRedirectUri(input: GeekappsAuthConfig) {\n  return input.redirectUri ?? env(\"GEEKAPPS_AUTH_REDIRECT_URI\");\n}\n\n/**\n * Derives a short stable 8-char hex hash from a clientId string.\n * Uses a simple djb2-style hash — no crypto dependency needed.\n */\nfunction hashClientId(clientId: string): string {\n  let h = 5381;\n  for (let i = 0; i < clientId.length; i++) {\n    h = ((h << 5) + h) ^ (clientId.charCodeAt(i) & 0xff);\n    h = h >>> 0; // keep unsigned 32-bit\n  }\n  return h.toString(16).padStart(8, \"0\");\n}\n\n/**\n * Auto-derives the cookie prefix from clientId.\n * Format: `gk_{8-char-hash}` — guaranteed unique per OAuth client.\n * Falls back to `gk` when clientId is empty (dev/test environments).\n */\nfunction deriveCookiePrefix(clientId: string): string {\n  if (!clientId) return \"gk\";\n  return `gk_${hashClientId(clientId)}`;\n}\n\n// GEEKAPPS_APP_URL é o override de produção: em prod o app roda atrás de\n// Docker sem proxy setando x-forwarded-host/x-forwarded-proto, então nem o\n// header Host nem request.nextUrl.origin são confiáveis (refletem o host\n// INTERNO do container, não o domínio público real) — por isso, quando\n// configurada, essa env var sempre vence. Sem ela (dev local, onde não está\n// setada no .env), deriva do próprio request — em localhost sem proxy o\n// Host já é localhost:PORTA mesmo, então funciona sem precisar de override.\nfunction requestOrigin(request: NextRequest) {\n  const configured = env(\"GEEKAPPS_APP_URL\");\n  if (configured) return configured.replace(/\\/$/, \"\");\n\n  if (request.nextUrl?.origin) return request.nextUrl.origin;\n\n  throw new Error(\n    \"Cannot determine app origin. Set GEEKAPPS_APP_URL or ensure request.nextUrl is available.\",\n  );\n}\n\nfunction resolveRedirectUri(config: ResolvedGeekappsAuthConfig, request: NextRequest) {\n  return config.redirectUri ?? `${requestOrigin(request)}${config.basePath}/callback`;\n}\n\nfunction tokenFromResponse(data: TokenLikeResponse): SessionTokens {\n  return {\n    accessToken: data.accessToken ?? data.access_token ?? data.tokens?.accessToken ?? data.tokens?.access_token ?? null,\n    refreshToken:\n      data.refreshToken ?? data.refresh_token ?? data.tokens?.refreshToken ?? data.tokens?.refresh_token ?? null,\n    idToken: data.idToken ?? data.id_token ?? data.tokens?.idToken ?? data.tokens?.id_token ?? null,\n    sessionId: data.sessionId ?? data.session_id ?? data.tokens?.sessionId ?? data.tokens?.session_id ?? null,\n  };\n}\n\n/** Decode a JWT payload without verifying signature (safe for client-visible claims). */\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split(\".\");\n    if (parts.length < 2) return null;\n    const payload = parts[1];\n    if (!payload) return null;\n    return JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf8\")) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nfunction parseAccountFromJwt(tokens: SessionTokens): StoredAccount | null {\n  if (!tokens.accessToken) return null;\n\n  const jwtToParse = tokens.idToken ?? tokens.accessToken;\n  const payload = decodeJwtPayload(jwtToParse);\n  if (!payload) return null;\n\n  const sub = typeof payload.sub === \"string\" ? payload.sub : null;\n  const id = sub ?? tokens.sessionId;\n  if (!id) return null;\n\n  return {\n    id,\n    accessToken: tokens.accessToken,\n    refreshToken: tokens.refreshToken,\n    idToken: tokens.idToken ?? null,\n    sessionId: tokens.sessionId,\n    user: {\n      sub: id,\n      name: typeof payload.name === \"string\" ? payload.name : null,\n      email: typeof payload.email === \"string\" ? payload.email : null,\n      picture: typeof payload.picture === \"string\" ? payload.picture : null,\n      phone: typeof payload.phone_number === \"string\" ? payload.phone_number : null,\n    },\n  };\n}\n\n/**\n * Cookie name scheme — 3 cookies per slot, each well under 4096 bytes:\n *\n *   {prefix}_m{n}   — metadata blob (base64url JSON): { id, sid?, n?, e?, p? }\n *                     Claims extracted from id_token at login. Never stores tokens.\n *   {prefix}_at{n}  — access token (httpOnly). ~1-2 KB.\n *   {prefix}_rt{n}  — refresh token (httpOnly). ~1 KB.\n *   {prefix}_active — active slot index (\"1\", \"2\", …)\n *   {prefix}_count  — total stored slots\n *   {prefix}_ao     — active org id for this app\n *   {prefix}_tp     — non-httpOnly copy of active access token for client-side axios\n *\n * id_token is NOT stored in cookies — claims are extracted at login and cached in\n * the metadata cookie. This is the key size saving.\n */\nfunction getCookieNames(prefix: string) {\n  return {\n    active: `${prefix}_active`,\n    count: `${prefix}_count`,\n    activeOrganizationId: `${prefix}_ao`,\n    tokenPub: `${prefix}_tp`,\n    pkceVerifier: `${prefix}_pkce`,\n    slotMeta: (n: number) => `${prefix}_m${n}`,\n    slotAt: (n: number) => `${prefix}_at${n}`,\n    slotRt: (n: number) => `${prefix}_rt${n}`,\n  };\n}\n\nfunction generateCodeVerifier(): string {\n  return randomBytes(64).toString(\"base64url\");\n}\n\nfunction createCodeChallenge(codeVerifier: string): string {\n  return createHash(\"sha256\").update(codeVerifier).digest(\"base64url\");\n}\n\ntype SlotMeta = {\n  id: string;\n  sid?: string;\n  n?: string;\n  e?: string;\n  p?: string;\n};\n\nfunction encodeMeta(account: StoredAccount): string {\n  const m: SlotMeta = { id: account.id };\n  if (account.sessionId) m.sid = account.sessionId;\n  if (account.user.name) m.n = account.user.name;\n  if (account.user.email) m.e = account.user.email;\n  if (account.user.picture) m.p = account.user.picture;\n  return Buffer.from(JSON.stringify(m), \"utf8\").toString(\"base64url\");\n}\n\nfunction decodeMeta(value: string): SlotMeta | null {\n  try {\n    const m = JSON.parse(Buffer.from(value, \"base64url\").toString(\"utf8\")) as SlotMeta;\n    return m.id ? m : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction getCookieOptions(config: ResolvedGeekappsAuthConfig) {\n  return {\n    httpOnly: true,\n    secure: config.secureCookies ?? process.env.NODE_ENV === \"production\",\n    sameSite: \"lax\" as const,\n    path: \"/\",\n  };\n}\n\nasync function readBody(request: NextRequest) {\n  const text = await request.text();\n  if (!text) return undefined;\n  try {\n    return JSON.parse(text);\n  } catch {\n    return text;\n  }\n}\n\nfunction appendSearchParams(url: string, request: NextRequest) {\n  const target = new URL(url);\n  request.nextUrl.searchParams.forEach((value, key) => {\n    target.searchParams.set(key, value);\n  });\n  return target.toString();\n}\n\nfunction routeFromRequest(request: NextRequest, basePath: string) {\n  const pathname = request.nextUrl.pathname;\n  if (!pathname.startsWith(basePath)) return pathname;\n  const route = pathname.slice(basePath.length);\n  return route || \"/\";\n}\n\nfunction isJsonResponse(response: Response) {\n  return response.headers.get(\"content-type\")?.includes(\"application/json\");\n}\n\nasync function responseFromApi(response: Response) {\n  if (response.status === 204) return new NextResponse(null, { status: 204 });\n  const body = isJsonResponse(response) ? await response.json().catch(() => null) : await response.text();\n  return NextResponse.json(body, { status: response.status });\n}\n\nconst _remoteJWKSCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\ntype ServiceTokenCache = { token: string; expiresAt: number };\nconst _serviceTokenCache = new Map<string, ServiceTokenCache>();\n\nasync function fetchServiceToken(issuer: string, clientId: string, clientSecret: string): Promise<string | null> {\n  const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString(\"base64\");\n  try {\n    const res = await fetch(createUrl(issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${credentials}`,\n      },\n      body: \"grant_type=service_account\",\n      cache: \"no-store\",\n    });\n    if (!res.ok) return null;\n    const data = (await res.json()) as { access_token?: string };\n    return data.access_token ?? null;\n  } catch {\n    return null;\n  }\n}\n\nasync function getServiceToken(issuer: string, clientId: string, clientSecret: string): Promise<string | null> {\n  const key = `${issuer}:${clientId}`;\n  const now = Date.now();\n  const cached = _serviceTokenCache.get(key);\n  if (cached && cached.expiresAt - 30_000 > now) return cached.token;\n  const token = await fetchServiceToken(issuer, clientId, clientSecret);\n  if (!token) return null;\n  _serviceTokenCache.set(key, { token, expiresAt: now + 420_000 });\n  return token;\n}\n\ntype ServiceAccountConfig = {\n  issuer?: string;\n  clientId?: string;\n  clientSecret?: string;\n};\n\n/**\n * Returns a service account access token.\n * The issuer is always the Geekapps Auth Server (GEEKAPPS_AUTH_SERVER_URL) —\n * it does not need to be configured. Reads GEEKAPPS_SERVICE_ACCOUNT_CLIENT_ID,\n * GEEKAPPS_SERVICE_ACCOUNT_CLIENT_SECRET by default.\n * Any field can be overridden via the optional config argument.\n * Tokens are cached per client and auto-renewed before expiry (~7 min TTL).\n */\nexport function getServiceAccountToken(override: ServiceAccountConfig = {}): Promise<string | null> {\n  const issuer = normalizeBaseUrl(\n    override.issuer ??\n      // Deprecated: kept for backwards compatibility during the auth-server rename.\n      env(\"GEEKAPPS_AUTH_ISSUER\") ??\n      env(\"GEEKAPPS_AUTH_API_URL\") ??\n      GEEKAPPS_AUTH_SERVER_URL,\n  );\n  const clientId = override.clientId ?? env(\"GEEKAPPS_SERVICE_ACCOUNT_CLIENT_ID\") ?? \"\";\n  const clientSecret = override.clientSecret ?? env(\"GEEKAPPS_SERVICE_ACCOUNT_CLIENT_SECRET\") ?? \"\";\n  if (!clientId || !clientSecret) return Promise.resolve(null);\n  return getServiceToken(issuer, clientId, clientSecret);\n}\n\nfunction getRemoteJWKS(issuer: string) {\n  if (!_remoteJWKSCache.has(issuer)) {\n    _remoteJWKSCache.set(issuer, createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`)));\n  }\n  return _remoteJWKSCache.get(issuer)!;\n}\n\nexport async function verifyToken(\n  token: string,\n  issuer: string,\n): Promise<JWTPayload | null> {\n  try {\n    const { payload } = await jwtVerify(token, getRemoteJWKS(issuer), {\n      algorithms: [\"RS256\"],\n      issuer,\n    });\n    return payload;\n  } catch {\n    return null;\n  }\n}\n\nexport function configureGeekappsAuth(input: GeekappsAuthConfig = {}) {\n  const clientId = resolveClientId(input);\n  const config: ResolvedGeekappsAuthConfig = {\n    ...input,\n    issuer: resolveIssuer(input),\n    clientId,\n    clientSecret: resolveClientSecret(input),\n    redirectUri: resolveConfiguredRedirectUri(input),\n    afterSignInRedirectTo:\n      input.afterSignInRedirectTo ?? input.redirectTo ?? \"/\",\n    basePath: normalizeBasePath(input.basePath),\n    cookiePrefix: deriveCookiePrefix(clientId),\n  };\n\n  const cn = getCookieNames(config.cookiePrefix);\n\n  // ── Slot helpers ──────────────────────────────────────────────────────────\n\n  async function getCount(): Promise<number> {\n    const cookieStore = await cookies();\n    const raw = cookieStore.get(cn.count)?.value;\n    const n = raw ? Number.parseInt(raw, 10) : 0;\n    return Number.isNaN(n) ? 0 : n;\n  }\n\n  async function getActiveIndex(): Promise<number> {\n    const cookieStore = await cookies();\n    const raw = cookieStore.get(cn.active)?.value;\n    if (!raw) return 0;\n    const n = Number.parseInt(raw, 10);\n    return Number.isNaN(n) ? 0 : n;\n  }\n\n  function readSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n  ): StoredAccount | null {\n    const at = cookieStore.get(cn.slotAt(n))?.value;\n    if (!at) return null;\n    const meta = decodeMeta(cookieStore.get(cn.slotMeta(n))?.value ?? \"\");\n    if (!meta) return null;\n    return {\n      id: meta.id,\n      accessToken: at,\n      refreshToken: cookieStore.get(cn.slotRt(n))?.value ?? null,\n      idToken: null, // not stored in cookies; claims are in meta\n      sessionId: meta.sid ?? null,\n      user: {\n        sub: meta.id,\n        name: meta.n ?? null,\n        email: meta.e ?? null,\n        picture: meta.p ?? null,\n      },\n    };\n  }\n\n  function writeSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n    account: StoredAccount,\n  ) {\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    cookieStore.set(cn.slotMeta(n), encodeMeta(account), opts);\n    cookieStore.set(cn.slotAt(n), account.accessToken, opts);\n    if (account.refreshToken) cookieStore.set(cn.slotRt(n), account.refreshToken, opts);\n  }\n\n  function clearSlot(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n    n: number,\n  ) {\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n    cookieStore.set(cn.slotMeta(n), \"\", clear);\n    cookieStore.set(cn.slotAt(n), \"\", clear);\n    cookieStore.set(cn.slotRt(n), \"\", clear);\n  }\n\n  // ── Public account helpers ─────────────────────────────────────────────────\n\n  async function getAccountsList(): Promise<StoredAccount[]> {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const accounts: StoredAccount[] = [];\n    for (let i = 1; i <= count; i++) {\n      const slot = readSlot(cookieStore, i);\n      if (slot) accounts.push(slot);\n    }\n    return accounts;\n  }\n\n  async function getActiveAccount(): Promise<StoredAccount | null> {\n    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);\n    if (count === 0) return null;\n    if (activeIdx >= 1 && activeIdx <= count) {\n      const slot = readSlot(cookieStore, activeIdx);\n      if (slot) return slot;\n    }\n    // Fall back to slot 1\n    return readSlot(cookieStore, 1);\n  }\n\n  async function getAccessToken() {\n    // Prefer the token injected by the middleware via request header (same-request refresh)\n    try {\n      const hdrs = await headers();\n      const auth = hdrs.get(\"authorization\");\n      if (auth?.startsWith(\"Bearer \")) return auth.slice(7);\n    } catch {}\n    const active = await getActiveAccount();\n    return active?.accessToken ?? null;\n  }\n\n  async function getRefreshToken() {\n    const active = await getActiveAccount();\n    return active?.refreshToken ?? null;\n  }\n\n  async function getSession(): Promise<SessionTokens | null> {\n    const active = await getActiveAccount();\n    if (!active) return null;\n    return {\n      accessToken: active.accessToken,\n      refreshToken: active.refreshToken,\n      idToken: active.idToken,\n      sessionId: active.sessionId,\n    };\n  }\n\n  async function getUser(): Promise<StoredAccount[\"user\"] | null> {\n    const active = await getActiveAccount();\n    return active?.user ?? null;\n  }\n\n  async function getUserById(userId: string, applicationId?: string): Promise<unknown | null> {\n    const qs = new URLSearchParams({ ...(applicationId ? { applicationId } : {}) });\n    try {\n      return await apiRequest<unknown>(`/users/${userId}?${qs}`);\n    } catch {\n      return null;\n    }\n  }\n\n  async function getOrganizations(): Promise<{ organizations: unknown[]; currentOrgId: string | null }> {\n    const cookieStore = await cookies();\n    const currentOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;\n    try {\n      const data = await apiRequest<unknown[] | { organizations: unknown[] }>(\"/organizations\");\n      const organizations = Array.isArray(data) ? data : (data as { organizations: unknown[] }).organizations;\n      return { organizations, currentOrgId };\n    } catch {\n      return { organizations: [], currentOrgId };\n    }\n  }\n\n  function clearPublicTokenCookie(\n    cookieStore: Awaited<ReturnType<typeof cookies>>,\n  ) {\n    // Clear legacy _tp cookie if present\n    if (cookieStore.get(cn.tokenPub)?.value) {\n      cookieStore.set(cn.tokenPub, \"\", { httpOnly: false, maxAge: 0, path: \"/\" });\n    }\n  }\n\n  async function saveAccountToList(tokens: SessionTokens) {\n    const account = parseAccountFromJwt(tokens);\n    if (!account) return;\n\n    const cookieStore = await cookies();\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    const count = await getCount();\n\n    // Find existing slot for this account id\n    let targetSlot = 0;\n    for (let i = 1; i <= count; i++) {\n      const existing = readSlot(cookieStore, i);\n      if (existing?.id === account.id) {\n        targetSlot = i;\n        break;\n      }\n    }\n\n    if (targetSlot === 0) {\n      if (count >= MAX_ACCOUNTS) return;\n      targetSlot = count + 1;\n      cookieStore.set(cn.count, String(targetSlot), opts);\n    }\n\n    writeSlot(cookieStore, targetSlot, account);\n    cookieStore.set(cn.active, String(targetSlot), opts);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  // Alias for backwards compat\n  const setSessionCookies = saveAccountToList;\n\n  async function switchAccount(accountId: string): Promise<boolean> {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n\n    for (let i = 1; i <= count; i++) {\n      const slot = readSlot(cookieStore, i);\n      if (slot && (slot.id === accountId || slot.sessionId === accountId)) {\n        cookieStore.set(cn.active, String(i), opts);\n        clearPublicTokenCookie(cookieStore);\n        return true;\n      }\n    }\n    return false;\n  }\n\n  async function removeActiveAccount() {\n    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);\n    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n\n    if (count === 0) return;\n\n    const remaining: StoredAccount[] = [];\n    for (let i = 1; i <= count; i++) {\n      if (i === activeIdx) continue;\n      const slot = readSlot(cookieStore, i);\n      if (slot) remaining.push(slot);\n    }\n\n    for (let i = 1; i <= count; i++) {\n      clearSlot(cookieStore, i);\n    }\n\n    if (remaining.length === 0) {\n      cookieStore.set(cn.count, \"0\", clear);\n      cookieStore.set(cn.active, \"0\", clear);\n      await clearPublicTokenCookie(cookieStore);\n      return;\n    }\n\n    // Re-compact remaining accounts into slots 1..n\n    for (let i = 0; i < remaining.length; i++) {\n      await writeSlot(cookieStore, i + 1, remaining[i]!);\n    }\n    cookieStore.set(cn.count, String(remaining.length), opts);\n    cookieStore.set(cn.active, \"1\", opts);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  async function clearAllSessionCookies() {\n    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);\n    const clear = { ...getCookieOptions(config), maxAge: 0 };\n    for (let i = 1; i <= count; i++) {\n      clearSlot(cookieStore, i);\n    }\n    cookieStore.set(cn.count, \"0\", clear);\n    cookieStore.set(cn.active, \"0\", clear);\n    clearPublicTokenCookie(cookieStore);\n  }\n\n  async function tryRefreshTokens(): Promise<string | null> {\n    const refreshToken = await getRefreshToken();\n    if (!refreshToken || !config.clientId) return null;\n\n    const basicAuth = Buffer.from(`${config.clientId}:${config.clientSecret ?? \"\"}`).toString(\"base64\");\n\n    const response = await fetch(createUrl(config.issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${basicAuth}`,\n      },\n      body: new URLSearchParams({\n        grant_type: \"refresh_token\",\n        refresh_token: refreshToken,\n      }),\n      cache: \"no-store\",\n    });\n\n    if (!response.ok) return null;\n\n    const data = (await response.json().catch(() => null)) as TokenLikeResponse | null;\n    if (!data) return null;\n\n    const tokens = tokenFromResponse(data);\n    if (!tokens.accessToken) return null;\n\n    await saveAccountToList(tokens);\n    return tokens.accessToken;\n  }\n\n  async function apiRequest<T>(path: string, init: RequestInit = {}): Promise<T> {\n    const accessToken = await getAccessToken();\n    const requestHeaders = new Headers(init.headers);\n\n    if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n    if (init.body !== undefined && !requestHeaders.has(\"content-type\")) {\n      requestHeaders.set(\"content-type\", \"application/json\");\n    }\n\n    const url = new URL(createUrl(config.issuer, path));\n    applyClientCredentials(url, config);\n\n    const response = await fetch(url, {\n      ...init,\n      headers: requestHeaders,\n      cache: \"no-store\",\n    });\n\n    if (response.status === 401) {\n      const newAccessToken = await tryRefreshTokens();\n      if (newAccessToken) {\n        const retryHeaders = new Headers(init.headers);\n        retryHeaders.set(\"authorization\", `Bearer ${newAccessToken}`);\n        if (init.body !== undefined && !retryHeaders.has(\"content-type\")) {\n          retryHeaders.set(\"content-type\", \"application/json\");\n        }\n        const retryUrl = new URL(createUrl(config.issuer, path));\n        applyClientCredentials(retryUrl, config);\n        const retryResponse = await fetch(retryUrl, {\n          ...init,\n          headers: retryHeaders,\n          cache: \"no-store\",\n        });\n        if (!retryResponse.ok) {\n          const error = await retryResponse.json().catch(() => null);\n          throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${retryResponse.status}`);\n        }\n        if (retryResponse.status === 204) return null as T;\n        return (await retryResponse.json()) as T;\n      }\n    }\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => null);\n      throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${response.status}`);\n    }\n\n    if (response.status === 204) return null as T;\n    return (await response.json()) as T;\n  }\n\n  function createApiClient(): ServerAuthApiClient {\n    return {\n      get: (path) => apiRequest(path),\n      post: (path, body) => apiRequest(path, { method: \"POST\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      patch: (path, body) => apiRequest(path, { method: \"PATCH\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      put: (path, body) => apiRequest(path, { method: \"PUT\", body: body === undefined ? undefined : JSON.stringify(body) }),\n      delete: (path) => apiRequest(path, { method: \"DELETE\" }),\n    };\n  }\n\n  async function requireUser(options: { redirectTo?: string } = {}) {\n    const accessToken = await getAccessToken();\n    if (!accessToken) {\n      redirect(options.redirectTo ?? \"/\");\n    }\n    return accessToken;\n  }\n\n  function escapeHtml(str: string): string {\n    return str.replace(/&/g, \"&amp;\").replace(/</g, \"&lt;\").replace(/>/g, \"&gt;\").replace(/\"/g, \"&quot;\");\n  }\n\n  function sanitizeRedirectTo(value: string | null | undefined): string {\n    const raw = value ?? \"/\";\n    // Never redirect back into the auth basePath — that would loop or replay a stale code.\n    if (raw.startsWith(config.basePath)) return \"/\";\n    // Only allow relative paths to prevent open-redirect.\n    if (raw.startsWith(\"/\") && !raw.startsWith(\"//\")) return raw;\n    return \"/\";\n  }\n\n  async function createAuthorizeRedirect(request: NextRequest, mode: \"login\" | \"register\" | \"add-account\" | \"google\") {\n    const redirectTo = sanitizeRedirectTo(request.nextUrl.searchParams.get(\"redirectTo\") ?? config.afterSignInRedirectTo);\n    const flowId = request.nextUrl.searchParams.get(\"flow_id\");\n    const url = new URL(createUrl(config.issuer, mode === \"google\" ? \"/auth/google\" : \"/authorize\"));\n\n    if (!config.clientId) {\n      return NextResponse.json(\n        { error: \"missing_client_id\", message: \"Missing GEEKAPPS_AUTH_CLIENT_ID or clientId.\" },\n        { status: 500 },\n      );\n    }\n\n    url.searchParams.set(\"client_id\", config.clientId);\n    url.searchParams.set(\"redirect_uri\", resolveRedirectUri(config, request));\n    url.searchParams.set(\"response_type\", \"code\");\n    const scopes = config.scopes ?? [\"openid\", \"profile\", \"email\"];\n    if (!scopes.includes(\"offline_access\")) scopes.push(\"offline_access\");\n    url.searchParams.set(\"scope\", scopes.join(\" \"));\n    url.searchParams.set(\"state\", Buffer.from(JSON.stringify({ redirectTo, mode })).toString(\"base64url\"));\n    if (mode === \"register\") url.searchParams.set(\"screen_hint\", \"signup\");\n    if (mode === \"add-account\") {\n      // Adding an account always needs a fresh login, regardless of any existing session.\n      url.searchParams.set(\"prompt\", \"login\");\n    } else {\n      // `prompt` (login | select_account | none | consent) is forwarded as-is to\n      // the IDP — see OidcPrompt in client.tsx for what each value does.\n      const prompt = request.nextUrl.searchParams.get(\"prompt\");\n      // Legacy fallback: silentLogin=false is equivalent to prompt=login.\n      const silentLogin = request.nextUrl.searchParams.get(\"silentLogin\");\n      const resolvedPrompt = prompt ?? (silentLogin === \"false\" ? \"login\" : null);\n      if (resolvedPrompt) url.searchParams.set(\"prompt\", resolvedPrompt);\n    }\n    if (flowId) url.searchParams.set(\"flow_id\", flowId);\n\n    const codeVerifier = generateCodeVerifier();\n    url.searchParams.set(\"code_challenge\", createCodeChallenge(codeVerifier));\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n    const response = NextResponse.redirect(url);\n    const cn = getCookieNames(config.cookiePrefix);\n    response.cookies.set(cn.pkceVerifier, codeVerifier, {\n      ...getCookieOptions(config),\n      maxAge: 60 * 10,\n    });\n    return response;\n  }\n\n  async function exchangeCode(request: NextRequest) {\n    const code = request.nextUrl.searchParams.get(\"code\");\n    const state = request.nextUrl.searchParams.get(\"state\");\n\n    const origin = requestOrigin(request);\n\n    if (!code) {\n      const err = request.nextUrl.searchParams.get(\"error\") ?? \"missing_code\";\n      const desc = request.nextUrl.searchParams.get(\"error_description\") ?? request.nextUrl.searchParams.get(\"error_message\") ?? \"No authorization code received\";\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=${encodeURIComponent(err)}&error_description=${encodeURIComponent(desc)}`, origin));\n    }\n\n    if (!config.clientId) {\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=missing_client_id&error_description=Auth+client+is+not+configured`, origin));\n    }\n\n    const basicAuth = Buffer.from(\n      `${config.clientId}:${config.clientSecret ?? \"\"}`,\n    ).toString(\"base64\");\n\n    const cn = getCookieNames(config.cookiePrefix);\n    const cookieStore = await cookies();\n    const codeVerifier = cookieStore.get(cn.pkceVerifier)?.value;\n    cookieStore.set(cn.pkceVerifier, \"\", { ...getCookieOptions(config), maxAge: 0 });\n\n    const tokenBody = new URLSearchParams({\n      grant_type: \"authorization_code\",\n      code,\n      redirect_uri: resolveRedirectUri(config, request),\n    });\n    if (codeVerifier) tokenBody.set(\"code_verifier\", codeVerifier);\n\n    const response = await fetch(createUrl(config.issuer, \"/auth/token\"), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        authorization: `Basic ${basicAuth}`,\n      },\n      body: tokenBody,\n      cache: \"no-store\",\n    });\n\n    const data = (await response.json().catch(() => ({}))) as TokenLikeResponse & { error?: string; error_description?: string };\n    if (!response.ok) {\n      const error = encodeURIComponent((data.error as string | undefined) ?? \"token_exchange_failed\");\n      const desc = encodeURIComponent((data.error_description as string | undefined) ?? `Token exchange failed with status ${response.status}`);\n      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=${error}&error_description=${desc}`, origin));\n    }\n\n    await saveAccountToList(tokenFromResponse(data));\n\n    let redirectTo = sanitizeRedirectTo(config.afterSignInRedirectTo);\n    if (state) {\n      try {\n        const parsed = JSON.parse(Buffer.from(state, \"base64url\").toString(\"utf8\")) as { redirectTo?: string };\n        redirectTo = sanitizeRedirectTo(parsed.redirectTo);\n      } catch {\n        // ignore malformed state\n      }\n    }\n\n    return NextResponse.redirect(new URL(redirectTo, origin));\n  }\n\n  function mapLocalPathToApiPath(route: string) {\n    if (route === \"/me\") return \"/auth/me\";\n    if (route === \"/accounts/switch\") return \"/auth/accounts/switch\";\n    if (route === \"/organizations/active\") return \"/auth/organizations/active\";\n    if (route === \"/permissions/check\") return \"/auth/permissions/check\";\n    if (route === \"/login/password\") return \"/auth/login/password\";\n    if (route === \"/register/password\") return \"/auth/register/password\";\n    if (route === \"/passwordless/link\") return \"/auth/passwordless/link\";\n    return route;\n  }\n\n  async function handleAccountsLocal(): Promise<NextResponse> {\n    const [accounts, activeIdx] = await Promise.all([getAccountsList(), getActiveIndex()]);\n\n    return NextResponse.json({\n      accounts: accounts.map((a, i) => ({\n        id: a.id,\n        sessionId: a.sessionId ?? a.id,\n        isActive: i + 1 === activeIdx,\n        user: {\n          id: a.user.sub,\n          name: a.user.name ?? null,\n          email: a.user.email ?? null,\n          imageUrl: a.user.picture ?? null,\n          phone: a.user.phone ?? null,\n        },\n      })),\n    });\n  }\n\n  async function handleOrganizationsLocal(): Promise<NextResponse> {\n    const cookieStore = await cookies();\n    const activeOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;\n    try {\n      const data = await apiRequest<unknown[]|{ organizations: unknown[] }>(\"/organizations\");\n      const organizations = Array.isArray(data) ? data : (data as { organizations: unknown[] }).organizations;\n      return NextResponse.json({ organizations, currentOrgId: activeOrgId });\n    } catch {\n      return NextResponse.json({ organizations: [], currentOrgId: activeOrgId });\n    }\n  }\n\n  async function handleSwitchAccountLocal(request: NextRequest): Promise<NextResponse> {\n    const body = await readBody(request);\n    const targetId =\n      body && typeof body === \"object\"\n        ? String(\n            (body as Record<string, unknown>).accountId ??\n            (body as Record<string, unknown>).sessionId ??\n            \"\",\n          )\n        : \"\";\n\n    if (!targetId) {\n      return NextResponse.json({ error: \"accountId required\" }, { status: 400 });\n    }\n\n    const switched = await switchAccount(targetId);\n    if (!switched) {\n      return NextResponse.json({ error: \"Account not found\" }, { status: 404 });\n    }\n\n    return NextResponse.json({ ok: true });\n  }\n\n  async function proxy(request: NextRequest, route: string) {\n    const accessToken = await getAccessToken();\n    const body = [\"GET\", \"HEAD\"].includes(request.method) ? undefined : await readBody(request);\n    const url = new URL(appendSearchParams(createUrl(config.issuer, mapLocalPathToApiPath(route)), request));\n    applyClientCredentials(url, config);\n    const requestHeaders = new Headers();\n\n    if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n    if (body !== undefined) requestHeaders.set(\"content-type\", \"application/json\");\n\n    const response = await fetch(url, {\n      method: request.method,\n      headers: requestHeaders,\n      body: body === undefined ? undefined : typeof body === \"string\" ? body : JSON.stringify(body),\n      cache: \"no-store\",\n    });\n\n    const data = isJsonResponse(response) ? ((await response.json().catch(() => null)) as TokenLikeResponse | null) : null;\n    if (data) {\n      const tokens = tokenFromResponse(data);\n      if (tokens.accessToken || tokens.refreshToken || tokens.idToken || tokens.sessionId) {\n        await saveAccountToList(tokens);\n      }\n      return NextResponse.json(data, { status: response.status });\n    }\n\n    return responseFromApi(response);\n  }\n\n  async function handle(request: NextRequest) {\n    const route = routeFromRequest(request, config.basePath);\n\n    if (request.method === \"GET\" && route === \"/sign-in\") return createAuthorizeRedirect(request, \"login\");\n    if (request.method === \"GET\" && route === \"/sign-up\") return createAuthorizeRedirect(request, \"register\");\n    if (request.method === \"GET\" && route === \"/add-account\") return createAuthorizeRedirect(request, \"add-account\");\n    if (request.method === \"GET\" && route === \"/login/google\") return createAuthorizeRedirect(request, \"google\");\n    if (request.method === \"GET\" && route === \"/callback\") {\n      const error = request.nextUrl.searchParams.get(\"error\");\n      if (error) {\n        const description = request.nextUrl.searchParams.get(\"error_description\") ?? request.nextUrl.searchParams.get(\"error_message\") ?? \"An authentication error occurred.\";\n        return new NextResponse(\n          `<!doctype html><html><head><meta charset=\"utf-8\"><title>Authentication Error</title></head><body style=\"font-family:sans-serif;max-width:480px;margin:80px auto;padding:0 16px\"><h2>Authentication Error</h2><p><strong>${escapeHtml(error)}</strong></p><p>${escapeHtml(description)}</p><a href=\"/\">Go back</a></body></html>`,\n          { status: 400, headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n        );\n      }\n      return exchangeCode(request);\n    }\n    if (request.method === \"GET\" && route === \"/token\") {\n      const accessToken = await getAccessToken();\n      if (!accessToken) return NextResponse.json({ error: \"missing_token\" }, { status: 401 });\n      return NextResponse.json({ accessToken });\n    }\n\n\n    if (request.method === \"GET\" && route === \"/accounts\") return handleAccountsLocal();\n    if (request.method === \"POST\" && route === \"/accounts/switch\") return handleSwitchAccountLocal(request);\n    if (request.method === \"GET\" && route === \"/organizations\") return handleOrganizationsLocal();\n\n    if (request.method === \"POST\" && route === \"/organizations\") {\n      const accessToken = await getAccessToken();\n      const body = (await readBody(request)) as Record<string, unknown> | undefined;\n      if (body && accessToken && !body.applicationId) {\n        const claims = decodeJwtPayload(accessToken);\n        const applicationId =\n          (typeof claims?.application_id === \"string\" ? claims.application_id : null) ??\n          (typeof claims?.client_id === \"string\" ? claims.client_id : null) ??\n          (typeof claims?.applicationId === \"string\" ? claims.applicationId : null);\n        if (applicationId) body.applicationId = applicationId;\n      }\n      const orgUrl = new URL(createUrl(config.issuer, \"/organizations\"));\n      applyClientCredentials(orgUrl, config);\n      const requestHeaders = new Headers();\n      if (accessToken) requestHeaders.set(\"authorization\", `Bearer ${accessToken}`);\n      if (body !== undefined) requestHeaders.set(\"content-type\", \"application/json\");\n      const response = await fetch(orgUrl, {\n        method: \"POST\",\n        headers: requestHeaders,\n        body: JSON.stringify(body),\n        cache: \"no-store\",\n      });\n      return responseFromApi(response);\n    }\n\n    if (request.method === \"POST\" && route === \"/sign-out\") {\n      await apiRequest(\"/auth/sign-out\", { method: \"POST\" }).catch(() => null);\n      await removeActiveAccount();\n      return NextResponse.json({ ok: true });\n    }\n\n    if (request.method === \"POST\" && route === \"/sign-out-all\") {\n      await apiRequest(\"/auth/sign-out-all\", { method: \"POST\" }).catch(() => null);\n      await clearAllSessionCookies();\n      return NextResponse.json({ ok: true });\n    }\n\n    if (request.method === \"POST\" && route === \"/organizations/active\") {\n      const body = await readBody(request);\n      const organizationId =\n        body && typeof body === \"object\" && \"organizationId\" in body\n          ? (body as Record<string, unknown>).organizationId\n          : null;\n      const response = NextResponse.json({ ok: true });\n      if (typeof organizationId === \"string\") {\n        const cookieOpts = {\n          httpOnly: true,\n          sameSite: \"lax\" as const,\n          path: \"/\",\n          secure: process.env.NODE_ENV === \"production\",\n          maxAge: 60 * 60 * 24 * 7,\n        };\n        response.cookies.set(cn.activeOrganizationId, organizationId, cookieOpts);\n      }\n      return response;\n    }\n\n    return proxy(request, route);\n  }\n\n  return {\n    handlers: {\n      GET: handle,\n      POST: handle,\n      PATCH: handle,\n      DELETE: handle,\n    },\n    GetSession: getSession,\n    GetUser: getUser,\n    GetUserById: getUserById,\n    GetOrganizations: getOrganizations,\n    SaveSession: saveAccountToList,\n    GetAccessToken: getAccessToken,\n    GetRefreshToken: getRefreshToken,\n    IsAuthenticated: async () => (await getAccessToken()) !== null,\n    TryRefreshTokens: tryRefreshTokens,\n    RequireUser: requireUser,\n    CreateAuthApiClient: createApiClient,\n    cookiePrefix: config.cookiePrefix,\n    VerifyToken: (token: string) => verifyToken(token, config.issuer),\n    SignInUrl: async (redirectTo?: string) => {\n      const configured = env(\"GEEKAPPS_APP_URL\");\n      if (!configured) throw new Error(\"Cannot determine app origin. Set GEEKAPPS_APP_URL.\");\n      const origin = configured.replace(/\\/$/, \"\");\n      const url = new URL(`${origin}${config.basePath}/sign-in`);\n      if (redirectTo) url.searchParams.set(\"redirectTo\", redirectTo);\n      return url.toString();\n    },\n  };\n}\n\nexport function handlers(options?: GeekappsAuthConfig) {\n  return configureGeekappsAuth(options).handlers;\n}\n\n/**\n * Returns true if the current request has a valid access token in cookies.\n * Safe to call in Server Components, Server Actions, and Route Handlers.\n */\nexport async function isAuthenticated(options?: GeekappsAuthConfig): Promise<boolean> {\n  const { GetAccessToken } = configureGeekappsAuth(options);\n  return (await GetAccessToken()) !== null;\n}\n"],"mappings":";;;AAEA,SAAS,WAAAA,UAAS,WAAAC,gBAAe;;;ACFjC,SAAS,YAAY,mBAAmB;AACxC,SAAS,SAAS,eAAe;AACjC,SAAS,gBAAgB;AACzB,SAAS,oBAAsC;AAC/C,SAAS,oBAAoB,iBAAkC;AAMxD,IAAM,2BAA2B;;;ADFxC,SAAS,IAAI,MAAc;AACzB,QAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,SAAO,SAAS,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AACpD;AAEA,SAAS,iBAAiB,KAAa;AACrC,SAAO,IAAI,QAAQ,OAAO,EAAE;AAC9B;AAEA,SAAS,gBAAgB;AACvB,SAAO;AAAA;AAAA,IAEL,IAAI,sBAAsB,KAAK,IAAI,uBAAuB,KAAK;AAAA,EACjE;AACF;AAEA,SAAS,wBAAwB,KAAqB;AACpD,QAAM,WAAW,IAAI,yBAAyB;AAC9C,QAAM,eAAe,IAAI,6BAA6B;AACtD,MAAI,CAAC,YAAY,CAAC,aAAc,QAAO;AACvC,QAAM,IAAI,IAAI,IAAI,GAAG;AACrB,IAAE,aAAa,IAAI,aAAa,QAAQ;AACxC,IAAE,aAAa,IAAI,iBAAiB,YAAY;AAChD,SAAO,EAAE,SAAS;AACpB;AAEA,SAAS,aAAa,UAA0B;AAC9C,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,SAAM,KAAK,KAAK,IAAM,SAAS,WAAW,CAAC,IAAI;AAC/C,QAAI,MAAM;AAAA,EACZ;AACA,SAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACvC;AAEA,SAAS,qBAA6B;AACpC,QAAM,WAAW,IAAI,yBAAyB,KAAK;AACnD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,MAAM,aAAa,QAAQ,CAAC;AACrC;AAIA,SAAS,WAAW,OAAgC;AAClD,MAAI;AACF,UAAM,IAAI,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM,CAAC;AACrE,WAAO,EAAE,KAAK,IAAI;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB;AAC9B,QAAM,SAAS,mBAAmB;AAClC,SAAO;AAAA,IACL,QAAQ,GAAG,MAAM;AAAA,IACjB,OAAO,GAAG,MAAM;AAAA,IAChB,sBAAsB,GAAG,MAAM;AAAA,IAC/B,UAAU,CAAC,MAAc,GAAG,MAAM,KAAK,CAAC;AAAA,IACxC,QAAQ,CAAC,MAAc,GAAG,MAAM,MAAM,CAAC;AAAA,IACvC,QAAQ,CAAC,MAAc,GAAG,MAAM,MAAM,CAAC;AAAA,EACzC;AACF;AAEA,eAAe,uBAA+C;AAE5D,MAAI;AACF,UAAM,OAAO,MAAMC,SAAQ;AAC3B,UAAM,OAAO,KAAK,IAAI,eAAe;AACrC,QAAI,MAAM,WAAW,SAAS,EAAG,QAAO,KAAK,MAAM,CAAC;AAAA,EACtD,QAAQ;AAAA,EAAC;AACT,QAAM,cAAc,MAAMC,SAAQ;AAClC,QAAM,KAAK,MAAM,eAAe;AAChC,QAAM,MAAM,YAAY,IAAI,GAAG,MAAM,GAAG;AACxC,QAAM,YAAY,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AACnD,QAAM,WAAW,YAAY,IAAI,GAAG,KAAK,GAAG;AAC5C,QAAM,QAAQ,WAAW,OAAO,SAAS,UAAU,EAAE,IAAI;AACzD,MAAI,UAAU,EAAG,QAAO;AACxB,QAAM,MAAM,aAAa,KAAK,aAAa,QAAQ,YAAY;AAC/D,SAAO,YAAY,IAAI,GAAG,OAAO,GAAG,CAAC,GAAG,SAAS;AACnD;AAEA,eAAe,wBAAgD;AAC7D,QAAM,cAAc,MAAMA,SAAQ;AAClC,QAAM,KAAK,MAAM,eAAe;AAChC,QAAM,MAAM,YAAY,IAAI,GAAG,MAAM,GAAG;AACxC,QAAM,YAAY,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AACnD,QAAM,WAAW,YAAY,IAAI,GAAG,KAAK,GAAG;AAC5C,QAAM,QAAQ,WAAW,OAAO,SAAS,UAAU,EAAE,IAAI;AACzD,MAAI,UAAU,EAAG,QAAO;AACxB,QAAM,MAAM,aAAa,KAAK,aAAa,QAAQ,YAAY;AAC/D,SAAO,YAAY,IAAI,GAAG,OAAO,GAAG,CAAC,GAAG,SAAS;AACnD;AAEA,eAAe,uBAA+C;AAC5D,QAAM,eAAe,MAAM,sBAAsB;AACjD,QAAM,WAAW,IAAI,yBAAyB,KAAK;AACnD,QAAM,eAAe,IAAI,6BAA6B,KAAK;AAC3D,MAAI,CAAC,gBAAgB,CAAC,SAAU,QAAO;AAEvC,QAAM,YAAY,OAAO,KAAK,GAAG,QAAQ,IAAI,YAAY,EAAE,EAAE,SAAS,QAAQ;AAC9E,QAAM,WAAW,MAAM,MAAM,GAAG,cAAc,CAAC,eAAe;AAAA,IAC5D,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,eAAe,SAAS,SAAS;AAAA,IACnC;AAAA,IACA,MAAM,IAAI,gBAAgB,EAAE,YAAY,iBAAiB,eAAe,aAAa,CAAC;AAAA,IACtF,OAAO;AAAA,EACT,CAAC;AAED,MAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,QAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACnD,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,iBACH,KAAK,eAAe,KAAK;AAC5B,QAAM,kBACH,KAAK,gBAAgB,KAAK;AAE7B,MAAI,CAAC,eAAgB,QAAO;AAG5B,QAAM,cAAc,MAAMA,SAAQ;AAClC,QAAM,KAAK,MAAM,eAAe;AAChC,QAAM,MAAM,YAAY,IAAI,GAAG,MAAM,GAAG;AACxC,QAAM,YAAY,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AACnD,QAAM,OAAO;AAAA,IACX,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,KAAK,KAAK,KAAK;AAAA,EACzB;AACA,cAAY,IAAI,GAAG,OAAO,SAAS,GAAG,gBAAgB,IAAI;AAC1D,MAAI,gBAAiB,aAAY,IAAI,GAAG,OAAO,SAAS,GAAG,iBAAiB,IAAI;AAEhF,cAAY,IAAI,GAAG,mBAAmB,CAAC,OAAO,gBAAgB;AAAA,IAC5D,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,KAAK,KAAK,KAAK;AAAA,EACzB,CAAC;AAED,SAAO;AACT;AAEA,eAAe,UAAa,MAA0B;AACpD,MAAI,cAAc,MAAM,qBAAqB;AAC7C,MAAI,CAAC,YAAa,OAAM,IAAI,MAAM,mBAAmB;AAErD,QAAM,SAAS,cAAc;AAC7B,QAAM,UAAU,CAAC,UACf,MAAM,wBAAwB,GAAG,MAAM,GAAG,IAAI,EAAE,GAAG;AAAA,IACjD,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,IAC5C,OAAO;AAAA,EACT,CAAC;AAEH,MAAI,WAAW,MAAM,QAAQ,WAAW;AAExC,MAAI,SAAS,WAAW,KAAK;AAC3B,UAAM,WAAW,MAAM,qBAAqB;AAC5C,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,iBAAiB;AAChD,eAAW,MAAM,QAAQ,QAAQ;AAAA,EACnC;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAM,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AAClD,UAAM,IAAI,MAAO,KAAK,qBAAqB,KAAK,SAAS,KAAK,WAAW,cAAc,SAAS,MAAM,EAAa;AAAA,EACrH;AAEA,MAAI,SAAS,WAAW,IAAK,QAAO;AACpC,SAAO,SAAS,KAAK;AACvB;AAIA,eAAsB,QAAwC;AAC5D,MAAI;AACF,UAAM,OAAO,MAAM,UAA+C,UAAU;AAC5E,QAAI,CAAC,KAAM,QAAO,EAAE,MAAM,KAAK;AAC/B,QAAI,OAAO,SAAS,YAAY,UAAU,KAAM,QAAO;AACvD,WAAO,EAAE,MAAM,KAAoB;AAAA,EACrC,QAAQ;AACN,WAAO,EAAE,MAAM,KAAK;AAAA,EACtB;AACF;AAEA,eAAsB,cAAyD;AAC7E,QAAM,cAAc,MAAMA,SAAQ;AAClC,QAAM,KAAK,MAAM,eAAe;AAChC,QAAM,WAAW,YAAY,IAAI,GAAG,KAAK,GAAG;AAC5C,QAAM,QAAQ,WAAW,OAAO,SAAS,UAAU,EAAE,IAAI;AACzD,QAAM,YAAY,YAAY,IAAI,GAAG,MAAM,GAAG;AAC9C,QAAM,YAAY,YAAY,OAAO,SAAS,WAAW,EAAE,IAAI;AAE/D,QAAM,WAA+B,CAAC;AACtC,WAAS,IAAI,GAAG,KAAK,OAAO,KAAK;AAC/B,UAAM,KAAK,YAAY,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG;AAC1C,QAAI,CAAC,GAAI;AACT,UAAM,OAAO,WAAW,YAAY,IAAI,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,EAAE;AACpE,QAAI,CAAC,KAAM;AACX,aAAS,KAAK;AAAA,MACZ,IAAI,KAAK;AAAA,MACT,WAAW,KAAK,OAAO,KAAK;AAAA,MAC5B,UAAU,MAAM;AAAA,MAChB,MAAM;AAAA,QACJ,IAAI,KAAK;AAAA,QACT,MAAM,KAAK,KAAK;AAAA,QAChB,OAAO,KAAK,KAAK;AAAA,QACjB,UAAU,KAAK,KAAK;AAAA,QACpB,OAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,SAAS;AACpB;AAEA,eAAsB,mBAA6F;AACjH,MAAI;AACF,UAAM,cAAc,MAAMA,SAAQ;AAClC,UAAM,KAAK,MAAM,eAAe;AAChC,UAAM,cAAc,YAAY,IAAI,GAAG,oBAAoB,GAAG,SAAS;AACvE,UAAM,OAAO,MAAM,UAA8D,gBAAgB;AACjG,UAAM,gBAAgB,MAAM,QAAQ,IAAI,IAAI,OAAQ,KAA2C;AAC/F,UAAM,gBAAgB,eAAe,cAAc,CAAC,GAAG,MAAM;AAC7D,WAAO,EAAE,eAAe,cAAc,cAAc;AAAA,EACtD,SAAS,KAAK;AACZ,YAAQ,MAAM,6BAA6B,GAAG;AAC9C,WAAO,EAAE,eAAe,CAAC,EAAE;AAAA,EAC7B;AACF;","names":["cookies","headers","headers","cookies"]}

package/dist/cli/generate-connections.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/cli/generate-connections.js

@@ -0,0 +1,163 @@
+#!/usr/bin/env node
+
+// src/cli/generate-connections.ts
+import { writeFileSync } from "fs";
+import { basename, resolve } from "path";
+var DEFAULT_ISSUER = "https://accounts-api.geekapps.com.br";
+function env(name) {
+  const value = process.env[name];
+  return value && value.trim().length > 0 ? value : void 0;
+}
+function fail(message) {
+  console.error(`
+\u2717 ${message}
+`);
+  process.exit(1);
+}
+function toIdentifier(raw, fallback) {
+  const cleaned = raw.normalize("NFD").replace(/[̀-ͯ]/g, "").replace(/[^a-zA-Z0-9]+/g, " ").trim();
+  if (!cleaned) return fallback;
+  const [first, ...rest] = cleaned.split(" ");
+  const name = first.toLowerCase() + rest.map((w) => w[0].toUpperCase() + w.slice(1).toLowerCase()).join("");
+  return /^[0-9]/.test(name) ? `app${name[0].toUpperCase()}${name.slice(1)}` : name;
+}
+function actionIdentifier(key, appPrefix) {
+  const withoutPrefix = key.startsWith(`${appPrefix}.`) ? key.slice(appPrefix.length + 1) : key;
+  return toIdentifier(withoutPrefix, "action");
+}
+function quoteKey(key) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : JSON.stringify(key);
+}
+function toTypeScript(schema, indent) {
+  if (!schema) return "unknown";
+  switch (schema.type) {
+    case "string":
+      return schema.enum?.length ? schema.enum.map((v) => JSON.stringify(v)).join(" | ") : "string";
+    case "number":
+    case "integer":
+      return "number";
+    case "boolean":
+      return "boolean";
+    case "array":
+      return `Array<${toTypeScript(schema.items, indent)}>`;
+    case "object": {
+      const entries = Object.entries(schema.properties ?? {});
+      if (entries.length === 0) {
+        return schema.additionalProperties === false ? "Record<string, never>" : "Record<string, unknown>";
+      }
+      const required = new Set(schema.required ?? []);
+      const inner = `${indent}  `;
+      const lines = entries.map(([name, prop]) => {
+        const doc = prop.description ? `${inner}/** ${prop.description} */
+` : "";
+        const optional = required.has(name) ? "" : "?";
+        return `${doc}${inner}${quoteKey(name)}${optional}: ${toTypeScript(prop, inner)};`;
+      });
+      return `{
+${lines.join("\n")}
+${indent}}`;
+    }
+  }
+}
+async function main() {
+  const issuer = (env("GEEKAPPS_AUTH_SERVER_ISSUER") ?? env("GEEKAPPS_AUTH_SERVER_URL") ?? DEFAULT_ISSUER).replace(/\/$/, "");
+  const clientId = env("GEEKAPPS_AUTH_CLIENT_ID");
+  const clientSecret = env("GEEKAPPS_AUTH_CLIENT_SECRET");
+  if (!clientId || !clientSecret) {
+    fail(
+      "GEEKAPPS_AUTH_CLIENT_ID e GEEKAPPS_AUTH_CLIENT_SECRET precisam estar definidos \u2014 o gerador busca as conex\xF5es desta app com essas credenciais."
+    );
+  }
+  const outArg = process.argv.indexOf("--out");
+  const outPath = resolve(
+    process.cwd(),
+    outArg !== -1 && process.argv[outArg + 1] ? process.argv[outArg + 1] : "geekapps-connections.ts"
+  );
+  const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString("base64");
+  const response = await fetch(`${issuer}/connections/catalog`, {
+    headers: { authorization: `Basic ${credentials}` }
+  }).catch((error) => fail(`nao consegui falar com o auth-server em ${issuer}: ${error.message}`));
+  if (!response.ok) {
+    const detail = await response.text().catch(() => "");
+    fail(`auth-server respondeu ${response.status} ao listar as conexoes. ${detail}`);
+  }
+  const connections = await response.json();
+  const active = connections.filter((c) => c.status === "active");
+  if (active.length === 0) {
+    console.warn(
+      "\n! Nenhuma conexao ativa encontrada para esta app. O arquivo sera gerado vazio \u2014 peca ao admin para aprovar uma conexao no dashboard."
+    );
+  }
+  const typeBlocks = [];
+  const interfaceEntries = [];
+  const registryEntries = [];
+  const usedNames = /* @__PURE__ */ new Map();
+  for (const connection of active) {
+    const base = toIdentifier(connection.targetApp.name, "app");
+    const seen = usedNames.get(base) ?? 0;
+    usedNames.set(base, seen + 1);
+    const appName = seen === 0 ? base : `${base}${seen + 1}`;
+    const granted = connection.actions.filter((a) => connection.scopes.includes(a.key));
+    const methods = [];
+    const actionMap = [];
+    for (const action of granted) {
+      const name = actionIdentifier(action.key, base);
+      const payload = toTypeScript(action.payloadSchema, "    ");
+      const result = toTypeScript(action.responseSchema, "    ");
+      const arg = action.payloadSchema ? `payload: ${payload}` : "payload?: unknown";
+      methods.push(
+        `  /**
+   * ${action.label}
+   *
+   * \`${action.method} ${action.path}\` \u2014 ${action.key}
+   */
+  ${name}(${arg}): Promise<${result}>;`
+      );
+      actionMap.push(`      ${quoteKey(name)}: ${JSON.stringify(action.key)},`);
+    }
+    const typeName = `${appName[0].toUpperCase()}${appName.slice(1)}Connection`;
+    typeBlocks.push(
+      `/** ${connection.targetApp.name} \u2014 ${granted.length} acao(oes) liberada(s) nesta conexao. */
+export interface ${typeName} {
+${methods.join("\n\n") || "  // nenhuma acao liberada"}
+}`
+    );
+    interfaceEntries.push(`    ${quoteKey(appName)}: ${typeName};`);
+    registryEntries.push(
+      `  ${quoteKey(appName)}: {
+    appId: ${JSON.stringify(connection.targetAppId)},
+    actions: {
+${actionMap.join("\n")}
+    },
+  },`
+    );
+    console.log(`\u2713 ${connection.targetApp.name} \u2192 ${appName} (${granted.length} acoes)`);
+  }
+  const file = `// Gerado por \`npx geekapps-connections\`. Nao edite a mao.
+// Rode de novo quando uma conexao for aprovada ou as acoes da app alvo mudarem.
+// Gerado em ${(/* @__PURE__ */ new Date()).toISOString()}
+
+import { registerConnections } from "@geekapps/auth-nextjs/connections";
+
+${typeBlocks.join("\n\n")}
+
+declare module "@geekapps/auth-nextjs/connections" {
+  interface GeekappsConnections {
+${interfaceEntries.join("\n")}
+  }
+}
+
+registerConnections({
+${registryEntries.join("\n")}
+});
+`;
+  writeFileSync(outPath, file, "utf-8");
+  console.log(`
+\u2192 ${outPath}
+`);
+  console.log("Importe o arquivo uma vez no boot da app (ex: instrumentation.ts ou o layout raiz):");
+  console.log(`  import "./${basename(outPath)}";
+`);
+}
+main().catch((error) => fail(error.message));
+//# sourceMappingURL=generate-connections.js.map

package/dist/cli/generate-connections.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/cli/generate-connections.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * `npx geekapps-connections` — gera o catálogo tipado de App Connections.\n *\n * Busca no auth-server as conexões ativas em que esta app é a consumidora,\n * junto das ações liberadas em cada uma, e escreve UM arquivo .ts contendo:\n *   - os tipos de payload/retorno de cada ação (a partir dos JSON Schemas que\n *     a app alvo declarou);\n *   - a interface GeekappsConnections, por declaration merging;\n *   - o registry runtime (nome amigável → client_id / AppAction.key).\n *\n * O arquivo é gerado, não editado à mão: rode de novo quando o admin aprovar\n * uma conexão nova ou a app alvo mudar suas ações.\n */\n\nimport { writeFileSync } from \"node:fs\";\nimport { basename, resolve } from \"node:path\";\n\ntype JsonSchema =\n  | { type: \"string\"; enum?: string[]; description?: string }\n  | { type: \"number\" | \"integer\" | \"boolean\"; description?: string }\n  | { type: \"array\"; items: JsonSchema; description?: string }\n  | {\n      type: \"object\";\n      properties?: Record<string, JsonSchema>;\n      required?: string[];\n      additionalProperties?: boolean;\n      description?: string;\n    };\n\ntype RemoteAction = {\n  key: string;\n  label: string;\n  method: string;\n  path: string;\n  payloadSchema: JsonSchema | null;\n  responseSchema: JsonSchema | null;\n};\n\ntype RemoteConnection = {\n  targetAppId: string;\n  targetApp: { name: string };\n  status: string;\n  scopes: string[];\n  actions: RemoteAction[];\n};\n\nconst DEFAULT_ISSUER = \"https://accounts-api.geekapps.com.br\";\n\nfunction env(name: string) {\n  const value = process.env[name];\n  return value && value.trim().length > 0 ? value : undefined;\n}\n\nfunction fail(message: string): never {\n  console.error(`\\n✗ ${message}\\n`);\n  process.exit(1);\n}\n\n/** `Billing App` / `billing-api` → `billingApp` / `billingApi`. */\nfunction toIdentifier(raw: string, fallback: string) {\n  const cleaned = raw\n    .normalize(\"NFD\")\n    .replace(/[̀-ͯ]/g, \"\")\n    .replace(/[^a-zA-Z0-9]+/g, \" \")\n    .trim();\n  if (!cleaned) return fallback;\n\n  const [first, ...rest] = cleaned.split(\" \");\n  const name = first.toLowerCase() + rest.map((w) => w[0].toUpperCase() + w.slice(1).toLowerCase()).join(\"\");\n  return /^[0-9]/.test(name) ? `app${name[0].toUpperCase()}${name.slice(1)}` : name;\n}\n\n/**\n * `billing.charges.create` → `chargesCreate`. O prefixo da app (convenção das\n * AppAction.key) sai fora porque o nome já vem qualificado pela app na cadeia:\n * `billing.chargesCreate`, não `billing.billingChargesCreate`.\n */\nfunction actionIdentifier(key: string, appPrefix: string) {\n  const withoutPrefix = key.startsWith(`${appPrefix}.`) ? key.slice(appPrefix.length + 1) : key;\n  return toIdentifier(withoutPrefix, \"action\");\n}\n\nfunction quoteKey(key: string) {\n  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : JSON.stringify(key);\n}\n\n/** JSON Schema → tipo TypeScript. Espelha o subset aceito em app-action-schema.ts. */\nfunction toTypeScript(schema: JsonSchema | null, indent: string): string {\n  if (!schema) return \"unknown\";\n\n  switch (schema.type) {\n    case \"string\":\n      return schema.enum?.length ? schema.enum.map((v) => JSON.stringify(v)).join(\" | \") : \"string\";\n    case \"number\":\n    case \"integer\":\n      return \"number\";\n    case \"boolean\":\n      return \"boolean\";\n    case \"array\":\n      return `Array<${toTypeScript(schema.items, indent)}>`;\n    case \"object\": {\n      const entries = Object.entries(schema.properties ?? {});\n      if (entries.length === 0) {\n        return schema.additionalProperties === false ? \"Record<string, never>\" : \"Record<string, unknown>\";\n      }\n      const required = new Set(schema.required ?? []);\n      const inner = `${indent}  `;\n      const lines = entries.map(([name, prop]) => {\n        const doc = prop.description ? `${inner}/** ${prop.description} */\\n` : \"\";\n        const optional = required.has(name) ? \"\" : \"?\";\n        return `${doc}${inner}${quoteKey(name)}${optional}: ${toTypeScript(prop, inner)};`;\n      });\n      return `{\\n${lines.join(\"\\n\")}\\n${indent}}`;\n    }\n  }\n}\n\nasync function main() {\n  const issuer = (\n    env(\"GEEKAPPS_AUTH_SERVER_ISSUER\") ??\n    env(\"GEEKAPPS_AUTH_SERVER_URL\") ??\n    DEFAULT_ISSUER\n  ).replace(/\\/$/, \"\");\n  const clientId = env(\"GEEKAPPS_AUTH_CLIENT_ID\");\n  const clientSecret = env(\"GEEKAPPS_AUTH_CLIENT_SECRET\");\n\n  if (!clientId || !clientSecret) {\n    fail(\n      \"GEEKAPPS_AUTH_CLIENT_ID e GEEKAPPS_AUTH_CLIENT_SECRET precisam estar definidos — o gerador busca as conexões desta app com essas credenciais.\",\n    );\n  }\n\n  const outArg = process.argv.indexOf(\"--out\");\n  const outPath = resolve(\n    process.cwd(),\n    outArg !== -1 && process.argv[outArg + 1] ? process.argv[outArg + 1] : \"geekapps-connections.ts\",\n  );\n\n  const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString(\"base64\");\n  const response = await fetch(`${issuer}/connections/catalog`, {\n    headers: { authorization: `Basic ${credentials}` },\n  }).catch((error) => fail(`nao consegui falar com o auth-server em ${issuer}: ${(error as Error).message}`));\n\n  if (!response.ok) {\n    const detail = await response.text().catch(() => \"\");\n    fail(`auth-server respondeu ${response.status} ao listar as conexoes. ${detail}`);\n  }\n\n  const connections = (await response.json()) as RemoteConnection[];\n  const active = connections.filter((c) => c.status === \"active\");\n\n  if (active.length === 0) {\n    console.warn(\n      \"\\n! Nenhuma conexao ativa encontrada para esta app. O arquivo sera gerado vazio — peca ao admin para aprovar uma conexao no dashboard.\",\n    );\n  }\n\n  const typeBlocks: string[] = [];\n  const interfaceEntries: string[] = [];\n  const registryEntries: string[] = [];\n  const usedNames = new Map<string, number>();\n\n  for (const connection of active) {\n    const base = toIdentifier(connection.targetApp.name, \"app\");\n    // Dois apps podem ter nomes que colapsam no mesmo identificador; sufixa\n    // para nao gerar propriedades duplicadas na interface.\n    const seen = usedNames.get(base) ?? 0;\n    usedNames.set(base, seen + 1);\n    const appName = seen === 0 ? base : `${base}${seen + 1}`;\n\n    // So as acoes efetivamente liberadas na aprovacao da conexao entram no\n    // catalogo — o que o SDK oferece e o que de fato vai passar no proxy.\n    const granted = connection.actions.filter((a) => connection.scopes.includes(a.key));\n\n    const methods: string[] = [];\n    const actionMap: string[] = [];\n\n    for (const action of granted) {\n      const name = actionIdentifier(action.key, base);\n      const payload = toTypeScript(action.payloadSchema, \"    \");\n      const result = toTypeScript(action.responseSchema, \"    \");\n      const arg = action.payloadSchema ? `payload: ${payload}` : \"payload?: unknown\";\n\n      methods.push(\n        `  /**\\n   * ${action.label}\\n   *\\n   * \\`${action.method} ${action.path}\\` — ${action.key}\\n   */\\n  ${name}(${arg}): Promise<${result}>;`,\n      );\n      actionMap.push(`      ${quoteKey(name)}: ${JSON.stringify(action.key)},`);\n    }\n\n    const typeName = `${appName[0].toUpperCase()}${appName.slice(1)}Connection`;\n    typeBlocks.push(\n      `/** ${connection.targetApp.name} — ${granted.length} acao(oes) liberada(s) nesta conexao. */\\nexport interface ${typeName} {\\n${methods.join(\"\\n\\n\") || \"  // nenhuma acao liberada\"}\\n}`,\n    );\n    interfaceEntries.push(`    ${quoteKey(appName)}: ${typeName};`);\n    registryEntries.push(\n      `  ${quoteKey(appName)}: {\\n    appId: ${JSON.stringify(connection.targetAppId)},\\n    actions: {\\n${actionMap.join(\"\\n\")}\\n    },\\n  },`,\n    );\n\n    console.log(`✓ ${connection.targetApp.name} → ${appName} (${granted.length} acoes)`);\n  }\n\n  const file = `// Gerado por \\`npx geekapps-connections\\`. Nao edite a mao.\n// Rode de novo quando uma conexao for aprovada ou as acoes da app alvo mudarem.\n// Gerado em ${new Date().toISOString()}\n\nimport { registerConnections } from \"@geekapps/auth-nextjs/connections\";\n\n${typeBlocks.join(\"\\n\\n\")}\n\ndeclare module \"@geekapps/auth-nextjs/connections\" {\n  interface GeekappsConnections {\n${interfaceEntries.join(\"\\n\")}\n  }\n}\n\nregisterConnections({\n${registryEntries.join(\"\\n\")}\n});\n`;\n\n  writeFileSync(outPath, file, \"utf-8\");\n  console.log(`\\n→ ${outPath}\\n`);\n  console.log(\"Importe o arquivo uma vez no boot da app (ex: instrumentation.ts ou o layout raiz):\");\n  console.log(`  import \"./${basename(outPath)}\";\\n`);\n}\n\nmain().catch((error) => fail((error as Error).message));\n"],"mappings":";;;AAeA,SAAS,qBAAqB;AAC9B,SAAS,UAAU,eAAe;AA+BlC,IAAM,iBAAiB;AAEvB,SAAS,IAAI,MAAc;AACzB,QAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,SAAO,SAAS,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AACpD;AAEA,SAAS,KAAK,SAAwB;AACpC,UAAQ,MAAM;AAAA,SAAO,OAAO;AAAA,CAAI;AAChC,UAAQ,KAAK,CAAC;AAChB;AAGA,SAAS,aAAa,KAAa,UAAkB;AACnD,QAAM,UAAU,IACb,UAAU,KAAK,EACf,QAAQ,UAAU,EAAE,EACpB,QAAQ,kBAAkB,GAAG,EAC7B,KAAK;AACR,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,CAAC,OAAO,GAAG,IAAI,IAAI,QAAQ,MAAM,GAAG;AAC1C,QAAM,OAAO,MAAM,YAAY,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,YAAY,IAAI,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE;AACzG,SAAO,SAAS,KAAK,IAAI,IAAI,MAAM,KAAK,CAAC,EAAE,YAAY,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,KAAK;AAC/E;AAOA,SAAS,iBAAiB,KAAa,WAAmB;AACxD,QAAM,gBAAgB,IAAI,WAAW,GAAG,SAAS,GAAG,IAAI,IAAI,MAAM,UAAU,SAAS,CAAC,IAAI;AAC1F,SAAO,aAAa,eAAe,QAAQ;AAC7C;AAEA,SAAS,SAAS,KAAa;AAC7B,SAAO,6BAA6B,KAAK,GAAG,IAAI,MAAM,KAAK,UAAU,GAAG;AAC1E;AAGA,SAAS,aAAa,QAA2B,QAAwB;AACvE,MAAI,CAAC,OAAQ,QAAO;AAEpB,UAAQ,OAAO,MAAM;AAAA,IACnB,KAAK;AACH,aAAO,OAAO,MAAM,SAAS,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI;AAAA,IACvF,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,SAAS,aAAa,OAAO,OAAO,MAAM,CAAC;AAAA,IACpD,KAAK,UAAU;AACb,YAAM,UAAU,OAAO,QAAQ,OAAO,cAAc,CAAC,CAAC;AACtD,UAAI,QAAQ,WAAW,GAAG;AACxB,eAAO,OAAO,yBAAyB,QAAQ,0BAA0B;AAAA,MAC3E;AACA,YAAM,WAAW,IAAI,IAAI,OAAO,YAAY,CAAC,CAAC;AAC9C,YAAM,QAAQ,GAAG,MAAM;AACvB,YAAM,QAAQ,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM;AAC1C,cAAM,MAAM,KAAK,cAAc,GAAG,KAAK,OAAO,KAAK,WAAW;AAAA,IAAU;AACxE,cAAM,WAAW,SAAS,IAAI,IAAI,IAAI,KAAK;AAC3C,eAAO,GAAG,GAAG,GAAG,KAAK,GAAG,SAAS,IAAI,CAAC,GAAG,QAAQ,KAAK,aAAa,MAAM,KAAK,CAAC;AAAA,MACjF,CAAC;AACD,aAAO;AAAA,EAAM,MAAM,KAAK,IAAI,CAAC;AAAA,EAAK,MAAM;AAAA,IAC1C;AAAA,EACF;AACF;AAEA,eAAe,OAAO;AACpB,QAAM,UACJ,IAAI,6BAA6B,KACjC,IAAI,0BAA0B,KAC9B,gBACA,QAAQ,OAAO,EAAE;AACnB,QAAM,WAAW,IAAI,yBAAyB;AAC9C,QAAM,eAAe,IAAI,6BAA6B;AAEtD,MAAI,CAAC,YAAY,CAAC,cAAc;AAC9B;AAAA,MACE;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,QAAQ,KAAK,QAAQ,OAAO;AAC3C,QAAM,UAAU;AAAA,IACd,QAAQ,IAAI;AAAA,IACZ,WAAW,MAAM,QAAQ,KAAK,SAAS,CAAC,IAAI,QAAQ,KAAK,SAAS,CAAC,IAAI;AAAA,EACzE;AAEA,QAAM,cAAc,OAAO,KAAK,GAAG,QAAQ,IAAI,YAAY,EAAE,EAAE,SAAS,QAAQ;AAChF,QAAM,WAAW,MAAM,MAAM,GAAG,MAAM,wBAAwB;AAAA,IAC5D,SAAS,EAAE,eAAe,SAAS,WAAW,GAAG;AAAA,EACnD,CAAC,EAAE,MAAM,CAAC,UAAU,KAAK,2CAA2C,MAAM,KAAM,MAAgB,OAAO,EAAE,CAAC;AAE1G,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,SAAS,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACnD,SAAK,yBAAyB,SAAS,MAAM,2BAA2B,MAAM,EAAE;AAAA,EAClF;AAEA,QAAM,cAAe,MAAM,SAAS,KAAK;AACzC,QAAM,SAAS,YAAY,OAAO,CAAC,MAAM,EAAE,WAAW,QAAQ;AAE9D,MAAI,OAAO,WAAW,GAAG;AACvB,YAAQ;AAAA,MACN;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAuB,CAAC;AAC9B,QAAM,mBAA6B,CAAC;AACpC,QAAM,kBAA4B,CAAC;AACnC,QAAM,YAAY,oBAAI,IAAoB;AAE1C,aAAW,cAAc,QAAQ;AAC/B,UAAM,OAAO,aAAa,WAAW,UAAU,MAAM,KAAK;AAG1D,UAAM,OAAO,UAAU,IAAI,IAAI,KAAK;AACpC,cAAU,IAAI,MAAM,OAAO,CAAC;AAC5B,UAAM,UAAU,SAAS,IAAI,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC;AAItD,UAAM,UAAU,WAAW,QAAQ,OAAO,CAAC,MAAM,WAAW,OAAO,SAAS,EAAE,GAAG,CAAC;AAElF,UAAM,UAAoB,CAAC;AAC3B,UAAM,YAAsB,CAAC;AAE7B,eAAW,UAAU,SAAS;AAC5B,YAAM,OAAO,iBAAiB,OAAO,KAAK,IAAI;AAC9C,YAAM,UAAU,aAAa,OAAO,eAAe,MAAM;AACzD,YAAM,SAAS,aAAa,OAAO,gBAAgB,MAAM;AACzD,YAAM,MAAM,OAAO,gBAAgB,YAAY,OAAO,KAAK;AAE3D,cAAQ;AAAA,QACN;AAAA,OAAe,OAAO,KAAK;AAAA;AAAA,SAAkB,OAAO,MAAM,IAAI,OAAO,IAAI,aAAQ,OAAO,GAAG;AAAA;AAAA,IAAc,IAAI,IAAI,GAAG,cAAc,MAAM;AAAA,MAC1I;AACA,gBAAU,KAAK,SAAS,SAAS,IAAI,CAAC,KAAK,KAAK,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,IAC1E;AAEA,UAAM,WAAW,GAAG,QAAQ,CAAC,EAAE,YAAY,CAAC,GAAG,QAAQ,MAAM,CAAC,CAAC;AAC/D,eAAW;AAAA,MACT,OAAO,WAAW,UAAU,IAAI,WAAM,QAAQ,MAAM;AAAA,mBAA8D,QAAQ;AAAA,EAAO,QAAQ,KAAK,MAAM,KAAK,4BAA4B;AAAA;AAAA,IACvL;AACA,qBAAiB,KAAK,OAAO,SAAS,OAAO,CAAC,KAAK,QAAQ,GAAG;AAC9D,oBAAgB;AAAA,MACd,KAAK,SAAS,OAAO,CAAC;AAAA,aAAmB,KAAK,UAAU,WAAW,WAAW,CAAC;AAAA;AAAA,EAAsB,UAAU,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,IAC3H;AAEA,YAAQ,IAAI,UAAK,WAAW,UAAU,IAAI,WAAM,OAAO,KAAK,QAAQ,MAAM,SAAS;AAAA,EACrF;AAEA,QAAM,OAAO;AAAA;AAAA,gBAEA,oBAAI,KAAK,GAAE,YAAY,CAAC;AAAA;AAAA;AAAA;AAAA,EAIrC,WAAW,KAAK,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,EAIvB,iBAAiB,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3B,gBAAgB,KAAK,IAAI,CAAC;AAAA;AAAA;AAI1B,gBAAc,SAAS,MAAM,OAAO;AACpC,UAAQ,IAAI;AAAA,SAAO,OAAO;AAAA,CAAI;AAC9B,UAAQ,IAAI,qFAAqF;AACjG,UAAQ,IAAI,eAAe,SAAS,OAAO,CAAC;AAAA,CAAM;AACpD;AAEA,KAAK,EAAE,MAAM,CAAC,UAAU,KAAM,MAAgB,OAAO,CAAC;","names":[]}

package/dist/connections.d.ts

@@ -0,0 +1,65 @@
+/**
+ * App Connections — chamar ações de negócio de OUTRA Application.
+ *
+ * Uma conexão liga esta app (X) a uma app alvo (Y) e é aprovada UMA VEZ pelo
+ * admin, que escolhe no consent as ações liberadas e a identidade dentro do Y
+ * sob a qual elas rodam. Por isso a chamada aqui não leva usuário nenhum:
+ * venha ela de um request com sessão, de um cron ou de um webhook, chega no Y
+ * sempre com a mesma identidade e as mesmas permissões.
+ *
+ * Nada aqui fala com a API do Y diretamente: tudo passa pelo proxy do
+ * auth-server, que valida a conexão e injeta a credencial. Esta app nunca vê
+ * essa credencial — é esse o ponto do proxy.
+ *
+ * O catálogo tipado (`GeekappsConnections`) vem do arquivo gerado por
+ * `npx geekapps-connections`.
+ */
+type AppConnectionsConfig = {
+    issuer?: string;
+    /** client_id/secret desta app (a consumidora, X). */
+    clientId?: string;
+    clientSecret?: string;
+};
+/**
+ * Preenchida por declaration merging no arquivo gerado
+ * (`geekapps-connections.d.ts`). Vazia aqui de propósito: o SDK não sabe
+ * quais apps existem — quem sabe é o auth-server, no momento da geração.
+ */
+interface GeekappsConnections {
+}
+/** Erro de uma chamada de proxy — carrega o status HTTP para dar pra tratar. */
+declare class AppConnectionError extends Error {
+    readonly status: number;
+    readonly code: string | undefined;
+    readonly body: unknown;
+    constructor(message: string, status: number, code: string | undefined, body: unknown);
+}
+/**
+ * A chamada crua do proxy, para quando não há catálogo gerado. `targetAppId` é
+ * o client_id da app alvo e `actionKey` é a AppAction.key — o mesmo valor que
+ * aparece como scope no consent.
+ */
+declare function callAppConnection<T = unknown>(params: {
+    targetAppId: string;
+    actionKey: string;
+    payload?: unknown;
+    config?: AppConnectionsConfig;
+}): Promise<T>;
+/**
+ * Registry preenchido pelo arquivo gerado via `registerConnections()`. Mapeia
+ * o nome amigável da app (`billing`) para o client_id real, e o nome da ação
+ * (`createCharge`) para a AppAction.key (`billing.charges.create`).
+ */
+type ConnectionRegistryEntry = {
+    appId: string;
+    actions: Record<string, string>;
+};
+/** Chamado pelo arquivo gerado. Não edite à mão — ele é reescrito a cada geração. */
+declare function registerConnections(entries: Record<string, ConnectionRegistryEntry>): void;
+type AppConnectionsClient = GeekappsConnections;
+/** Cliente com config explícita — para quem não usa as env vars padrão. */
+declare function createAppConnections(config?: AppConnectionsConfig): AppConnectionsClient;
+/** Cliente padrão, lendo GEEKAPPS_AUTH_CLIENT_ID / _SECRET do ambiente. */
+declare const appConnections: AppConnectionsClient;
+
+export { AppConnectionError, type AppConnectionsClient, type AppConnectionsConfig, type GeekappsConnections, appConnections, callAppConnection, createAppConnections, registerConnections };