@multiplatform.one/auth 7.17.0 → 7.19.0

package/dist/cjs/index.cjs

@@ -49,20 +49,20 @@ function deriveRequestOrigin(req) {
     const proto = req.headers.get("x-forwarded-proto") === "https" ? "https" : "http";
     return `${proto}://${forwardedHost}`;
   }
-  const originHeader = req.headers.get("origin");
-  if (originHeader) {
+  for (const candidate of [req.headers.get("origin"), req.url]) {
+    if (!candidate) continue;
     try {
-      const url = new URL(originHeader);
+      const url = new URL(candidate);
       if (isDevHost(url.host)) return url.origin;
     } catch {}
   }
-  try {
-    return new URL(req.url).origin;
-  } catch {
-    return void 0;
-  }
+  return void 0;
 }
 const DEV_LAN_HOST_PATTERNS = ["localhost", "localhost:*", "127.0.0.1", "127.0.0.1:*", "10.*", "192.168.*", "172.*", "*.local", "*.local:*"];
+const accessTokenBodySchema = import_api.getAccessToken.options.body;
+function acceptsAccessTokenBody(body) {
+  return accessTokenBodySchema?.safeParse?.(body).success !== false;
+}
 function createKeycloakSsoPlugin(options) {
   const {
     realm,
@@ -153,10 +153,24 @@ function createKeycloakSsoPlugin(options) {
         // so it is a 200 with no token, as /get-session answers, instead
         // of a 4xx the browser logs. Runs before body validation, so the
         // client's body-shape negotiation never 400s for a visitor either.
+        // A signed-in >=1.7 body (`useAccountCookie`) on a server whose
+        // schema still demands `providerId` gets the Keycloak provider
+        // added, so the negotiation never 400s once signed in either.
         matcher: ctx => ctx.path === "/get-access-token",
         handler: (0, import_api.createAuthMiddleware)(async ctx => {
           const session = await (0, import_api.getSessionFromCtx)(ctx).catch(() => null);
           if (!session) return ctx.json(null);
+          const body = ctx.body;
+          if (body?.useAccountCookie !== true || acceptsAccessTokenBody(body)) return;
+          const legacy = {
+            ...body,
+            providerId: "keycloak"
+          };
+          if (acceptsAccessTokenBody(legacy)) return {
+            context: {
+              body: legacy
+            }
+          };
         })
       }],
       after: [{

package/dist/cjs/index.native.js

@@ -55,20 +55,22 @@ function deriveRequestOrigin(req) {
     var proto = req.headers.get("x-forwarded-proto") === "https" ? "https" : "http";
     return `${proto}://${forwardedHost}`;
   }
-  var originHeader = req.headers.get("origin");
-  if (originHeader) {
+  for (var _i = 0, _iter = [req.headers.get("origin"), req.url]; _i < _iter.length; _i++) {
+    var candidate = _iter[_i];
+    if (!candidate) continue;
     try {
-      var url = new URL(originHeader);
+      var url = new URL(candidate);
       if (isDevHost(url.host)) return url.origin;
     } catch (unused) {}
   }
-  try {
-    return new URL(req.url).origin;
-  } catch (unused) {
-    return void 0;
-  }
+  return void 0;
 }
 var DEV_LAN_HOST_PATTERNS = ["localhost", "localhost:*", "127.0.0.1", "127.0.0.1:*", "10.*", "192.168.*", "172.*", "*.local", "*.local:*"];
+var accessTokenBodySchema = import_api.getAccessToken.options.body;
+function acceptsAccessTokenBody(body) {
+  var _accessTokenBodySchema_safeParse;
+  return (accessTokenBodySchema === null || accessTokenBodySchema === void 0 ? void 0 : (_accessTokenBodySchema_safeParse = accessTokenBodySchema.safeParse) === null || _accessTokenBodySchema_safeParse === void 0 ? void 0 : _accessTokenBodySchema_safeParse.call(accessTokenBodySchema, body).success) !== false;
+}
 function createKeycloakSsoPlugin(options) {
   var {
     realm,
@@ -175,6 +177,9 @@ function createKeycloakSsoPlugin(options) {
         // so it is a 200 with no token, as /get-session answers, instead
         // of a 4xx the browser logs. Runs before body validation, so the
         // client's body-shape negotiation never 400s for a visitor either.
+        // A signed-in >=1.7 body (`useAccountCookie`) on a server whose
+        // schema still demands `providerId` gets the Keycloak provider
+        // added, so the negotiation never 400s once signed in either.
         matcher: function matcher(ctx) {
           return ctx.path === "/get-access-token";
         },
@@ -183,6 +188,17 @@ function createKeycloakSsoPlugin(options) {
             return null;
           });
           if (!session) return ctx.json(null);
+          var body = ctx.body;
+          if ((body === null || body === void 0 ? void 0 : body.useAccountCookie) !== true || acceptsAccessTokenBody(body)) return;
+          var legacy = {
+            ...body,
+            providerId: "keycloak"
+          };
+          if (acceptsAccessTokenBody(legacy)) return {
+            context: {
+              body: legacy
+            }
+          };
         })
       }],
       after: [{

package/dist/cjs/index.native.js.map

@@ -1 +1 @@
-{"version":3,"names":["__defProp","Object","defineProperty","__getOwnPropDesc","getOwnPropertyDescriptor","__getOwnPropNames","getOwnPropertyNames","__hasOwnProp","prototype","hasOwnProperty","__export","target","all","name","get","enumerable","__copyProps","to","from","except","desc","key","call","__toCommonJS","mod","value","index_exports","ACCESS_TOKEN_RETRY_DELAYS_MS","import_accessTokenRefresh2","FAILED_TO_GET_ACCESS_TOKEN","TOKEN_REFRESH_UNAVAILABLE","classifyAccessTokenResponse","createAuth","createAuthRouteHandler","createSessionHelpers","retryWhileTransient","watchDocumentVisible","module","exports","import_async_hooks","require","import_better_auth","import_api","import_cookies","import_plugins","import_expo","import_accessTokenRefresh","requestOriginStorage","AsyncLocalStorage","deriveRequestOrigin","req","isDevHost","isDevHost2","host","DEV_LAN_HOST_PATTERNS","some","pattern","matchesHostPattern","forwardedHost","headers","proto","originHeader","url","URL","origin","unused","createKeycloakSsoPlugin","options","realm","clientId","clientSecret","issuer","baseUrl","publicKeycloakBaseFor","tokenEndpoint","resolveVisitorOrigin","resolveVisitorOrigin2","request","_requestOriginStorage_getStore","getStore","isRefreshDefinitivelyDead","isRefreshDefinitivelyDead2","refreshToken","res","fetch","method","body","URLSearchParams","grant_type","refresh_token","client_id","client_secret","signal","AbortSignal","timeout","ok","status","json","catch","error","signOutSso","createAuthEndpoint","ctx","_resolveVisitorOrigin","_ref","visitorOrigin","searchParams","rawCallback","jsonMode","answer","answer2","redirect","callbackURL","postLogoutRedirect","startsWith","idTokenHint","sessionToken","getSignedCookie","context","authCookies","secret","session","getSessionFromCtx","_ref1","_accounts_find","accounts","internalAdapter","findAccounts","user","id","find","account","providerId","idToken","accountCookie","getAccountCookie","deleteSession","logger","deleteSessionCookie","keycloakBase","endSession","set","toString","endpoints","hooks","before","matcher","path","handler","createAuthMiddleware","after","_ctx_body","returned","isAPIError","code","definitive","APIError","message","warn","Headers","accumulated","responseHeaders","getSetCookie","forEach","cookie","append","runtimeEnv","process","env","arguments","length","_options_plugins","_options_database","_options_sessionMaxAge","_options_keycloak","_options_keycloak1","_options_keycloak2","_options_keycloak3","BASE_URL","ONE_PORT","isProduction","NODE_ENV","keycloakBaseUrl","keycloak","KEYCLOAK_BACKCHANNEL_URL","keycloakRealm","KEYCLOAK_REALM","keycloakClientId","KEYCLOAK_CLIENT_ID","keycloakClientSecret","KEYCLOAK_CLIENT_SECRET","expoPlugin","enableExpo","expo","basePath","keycloakProviderConfig","tokenUrl","userInfoUrl","mapProfileToUser","profile","_profile_email_verified","handle","preferred_username","sub","email","emailVerified","email_verified","keycloakPublicPath","pathname","replace","publicKeycloakBaseFor2","requestOrigin","hostname","keycloakPublicBase","keycloakPublicBase2","base","oauthPlugin","genericOAuth","config","keycloakSsoPlugin","plugins","database","DATABASE_URL","betterAuth","baseURL","SECRET","trustedOrigins","includes","map","cookieCache","enabled","maxAge","sessionMaxAge","strategy","refreshCache","storeStateStrategy","storeAccountCookie","auth","handler2","run","GET","POST","getSession","api","verifyAuth","Response"],"sources":["index.native.js"],"sourcesContent":["\"use strict\";\nvar __defProp = Object.defineProperty;\nvar __getOwnPropDesc = Object.getOwnPropertyDescriptor;\nvar __getOwnPropNames = Object.getOwnPropertyNames;\nvar __hasOwnProp = Object.prototype.hasOwnProperty;\nvar __export = (target, all) => {\n  for (var name in all)\n    __defProp(target, name, { get: all[name], enumerable: true });\n};\nvar __copyProps = (to, from, except, desc) => {\n  if (from && typeof from === \"object\" || typeof from === \"function\") {\n    for (let key of __getOwnPropNames(from))\n      if (!__hasOwnProp.call(to, key) && key !== except)\n        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });\n  }\n  return to;\n};\nvar __toCommonJS = (mod) => __copyProps(__defProp({}, \"__esModule\", { value: true }), mod);\nvar index_exports = {};\n__export(index_exports, {\n  ACCESS_TOKEN_RETRY_DELAYS_MS: () => import_accessTokenRefresh2.ACCESS_TOKEN_RETRY_DELAYS_MS,\n  FAILED_TO_GET_ACCESS_TOKEN: () => import_accessTokenRefresh2.FAILED_TO_GET_ACCESS_TOKEN,\n  TOKEN_REFRESH_UNAVAILABLE: () => import_accessTokenRefresh2.TOKEN_REFRESH_UNAVAILABLE,\n  classifyAccessTokenResponse: () => import_accessTokenRefresh2.classifyAccessTokenResponse,\n  createAuth: () => createAuth,\n  createAuthRouteHandler: () => createAuthRouteHandler,\n  createSessionHelpers: () => createSessionHelpers,\n  retryWhileTransient: () => import_accessTokenRefresh2.retryWhileTransient,\n  watchDocumentVisible: () => import_accessTokenRefresh2.watchDocumentVisible\n});\nmodule.exports = __toCommonJS(index_exports);\nvar import_async_hooks = require(\"async_hooks\");\nvar import_better_auth = require(\"better-auth\");\nvar import_api = require(\"better-auth/api\");\nvar import_cookies = require(\"better-auth/cookies\");\nvar import_plugins = require(\"better-auth/plugins\");\nvar import_expo = require(\"@better-auth/expo\");\nvar import_accessTokenRefresh = require(\"./accessTokenRefresh\");\nvar import_accessTokenRefresh2 = require(\"./accessTokenRefresh\");\nvar requestOriginStorage = new import_async_hooks.AsyncLocalStorage();\nfunction deriveRequestOrigin(req) {\n  var isDevHost = function isDevHost2(host) {\n    return DEV_LAN_HOST_PATTERNS.some(function(pattern) {\n      return (0, import_better_auth.matchesHostPattern)(host, pattern);\n    });\n  };\n  var forwardedHost = req.headers.get(\"x-forwarded-host\");\n  if (forwardedHost && isDevHost(forwardedHost)) {\n    var proto = req.headers.get(\"x-forwarded-proto\") === \"https\" ? \"https\" : \"http\";\n    return `${proto}://${forwardedHost}`;\n  }\n  var originHeader = req.headers.get(\"origin\");\n  if (originHeader) {\n    try {\n      var url = new URL(originHeader);\n      if (isDevHost(url.host)) return url.origin;\n    } catch (unused) {\n    }\n  }\n  try {\n    return new URL(req.url).origin;\n  } catch (unused) {\n    return void 0;\n  }\n}\nvar DEV_LAN_HOST_PATTERNS = [\n  \"localhost\",\n  \"localhost:*\",\n  \"127.0.0.1\",\n  \"127.0.0.1:*\",\n  \"10.*\",\n  \"192.168.*\",\n  \"172.*\",\n  \"*.local\",\n  \"*.local:*\"\n];\nfunction createKeycloakSsoPlugin(options) {\n  var { realm, clientId, clientSecret, issuer, baseUrl, publicKeycloakBaseFor } = options;\n  var tokenEndpoint = `${issuer}/protocol/openid-connect/token`;\n  var resolveVisitorOrigin = function resolveVisitorOrigin2(request) {\n    var _requestOriginStorage_getStore;\n    return (_requestOriginStorage_getStore = requestOriginStorage.getStore()) !== null && _requestOriginStorage_getStore !== void 0 ? _requestOriginStorage_getStore : request ? deriveRequestOrigin(request) : void 0;\n  };\n  var isRefreshDefinitivelyDead = async function isRefreshDefinitivelyDead2(refreshToken) {\n    try {\n      var res = await fetch(tokenEndpoint, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/x-www-form-urlencoded\"\n        },\n        body: new URLSearchParams({\n          grant_type: \"refresh_token\",\n          refresh_token: refreshToken,\n          client_id: clientId,\n          client_secret: clientSecret\n        }),\n        signal: AbortSignal.timeout(5e3)\n      });\n      if (res.ok) return false;\n      if (res.status !== 400 && res.status !== 401) return false;\n      var body = await res.json().catch(function() {\n        return null;\n      });\n      return (body === null || body === void 0 ? void 0 : body.error) === \"invalid_grant\" || (body === null || body === void 0 ? void 0 : body.error) === \"invalid_token\";\n    } catch (unused) {\n      return false;\n    }\n  };\n  var signOutSso = (0, import_api.createAuthEndpoint)(\"/sign-out/sso\", {\n    method: \"GET\"\n  }, async function(ctx) {\n    var _resolveVisitorOrigin, _ref;\n    var visitorOrigin = (_resolveVisitorOrigin = resolveVisitorOrigin(ctx.request)) !== null && _resolveVisitorOrigin !== void 0 ? _resolveVisitorOrigin : baseUrl;\n    var searchParams = ctx.request ? new URL(ctx.request.url).searchParams : void 0;\n    var rawCallback = (_ref = searchParams === null || searchParams === void 0 ? void 0 : searchParams.get(\"callbackURL\")) !== null && _ref !== void 0 ? _ref : null;\n    var jsonMode = (searchParams === null || searchParams === void 0 ? void 0 : searchParams.get(\"mode\")) === \"json\";\n    var answer = function answer2(url, redirect) {\n      if (jsonMode) return ctx.json({\n        redirect,\n        url\n      });\n      throw ctx.redirect(url);\n    };\n    var callbackURL = rawCallback || \"/\";\n    var postLogoutRedirect = callbackURL.startsWith(\"/\") ? `${visitorOrigin}${callbackURL}` : callbackURL;\n    var idTokenHint;\n    var sessionToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);\n    var session = await (0, import_api.getSessionFromCtx)(ctx).catch(function() {\n      return null;\n    });\n    if (session) {\n      var _ref1;\n      var _accounts_find;\n      var accounts = await ctx.context.internalAdapter.findAccounts(session.user.id).catch(function() {\n        return [];\n      });\n      idTokenHint = (_ref1 = (_accounts_find = accounts.find(function(account) {\n        return account.providerId === \"keycloak\";\n      })) === null || _accounts_find === void 0 ? void 0 : _accounts_find.idToken) !== null && _ref1 !== void 0 ? _ref1 : void 0;\n    }\n    if (!idTokenHint) {\n      var accountCookie = await (0, import_cookies.getAccountCookie)(ctx).catch(function() {\n        return null;\n      });\n      if ((accountCookie === null || accountCookie === void 0 ? void 0 : accountCookie.providerId) === \"keycloak\" && accountCookie.idToken) {\n        idTokenHint = accountCookie.idToken;\n      }\n    }\n    if (sessionToken) {\n      await ctx.context.internalAdapter.deleteSession(sessionToken).catch(function(error) {\n        ctx.context.logger.error(\"Failed to delete session during SSO sign-out\", error);\n      });\n    }\n    (0, import_cookies.deleteSessionCookie)(ctx);\n    var keycloakBase = publicKeycloakBaseFor(visitorOrigin);\n    if (!keycloakBase || !session && !idTokenHint && !sessionToken) {\n      return answer(postLogoutRedirect, false);\n    }\n    var endSession = new URL(`${keycloakBase}/realms/${realm}/protocol/openid-connect/logout`);\n    endSession.searchParams.set(\"post_logout_redirect_uri\", postLogoutRedirect);\n    endSession.searchParams.set(\"client_id\", clientId);\n    if (idTokenHint) endSession.searchParams.set(\"id_token_hint\", idTokenHint);\n    return answer(endSession.toString(), true);\n  });\n  return {\n    id: \"keycloak-sso\",\n    endpoints: {\n      signOutSso\n    },\n    hooks: {\n      before: [\n        {\n          // Signed out is the expected answer on every anonymous page load,\n          // so it is a 200 with no token, as /get-session answers, instead\n          // of a 4xx the browser logs. Runs before body validation, so the\n          // client's body-shape negotiation never 400s for a visitor either.\n          matcher: function matcher(ctx) {\n            return ctx.path === \"/get-access-token\";\n          },\n          handler: (0, import_api.createAuthMiddleware)(async function(ctx) {\n            var session = await (0, import_api.getSessionFromCtx)(ctx).catch(function() {\n              return null;\n            });\n            if (!session) return ctx.json(null);\n          })\n        }\n      ],\n      after: [\n        {\n          matcher: function matcher(ctx) {\n            return ctx.path === \"/get-access-token\";\n          },\n          handler: (0, import_api.createAuthMiddleware)(async function(ctx) {\n            var _ctx_body, _accounts_find;\n            var returned = ctx.context.returned;\n            if (!(0, import_api.isAPIError)(returned)) return;\n            var body = returned.body;\n            if ((body === null || body === void 0 ? void 0 : body.code) !== import_accessTokenRefresh.FAILED_TO_GET_ACCESS_TOKEN) return;\n            var providerId = (_ctx_body = ctx.body) === null || _ctx_body === void 0 ? void 0 : _ctx_body.providerId;\n            if (providerId && providerId !== \"keycloak\") return;\n            var session = await (0, import_api.getSessionFromCtx)(ctx).catch(function() {\n              return null;\n            });\n            if (!session) return;\n            var accounts = await ctx.context.internalAdapter.findAccounts(session.user.id).catch(function() {\n              return [];\n            });\n            var refreshToken = (_accounts_find = accounts.find(function(account) {\n              return account.providerId === \"keycloak\";\n            })) === null || _accounts_find === void 0 ? void 0 : _accounts_find.refreshToken;\n            if (!refreshToken) {\n              var accountCookie = await (0, import_cookies.getAccountCookie)(ctx).catch(function() {\n                return null;\n              });\n              if ((accountCookie === null || accountCookie === void 0 ? void 0 : accountCookie.providerId) === \"keycloak\") {\n                refreshToken = accountCookie.refreshToken;\n              }\n            }\n            var definitive = refreshToken ? await isRefreshDefinitivelyDead(refreshToken) : true;\n            if (!definitive) {\n              return new import_api.APIError(\"INTERNAL_SERVER_ERROR\", {\n                message: \"Keycloak token refresh temporarily unavailable\",\n                code: import_accessTokenRefresh.TOKEN_REFRESH_UNAVAILABLE\n              });\n            }\n            ctx.context.logger.warn(\"Keycloak refresh token is dead (invalid_grant); revoking the stale Better Auth session\");\n            var sessionToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);\n            if (sessionToken) {\n              await ctx.context.internalAdapter.deleteSession(sessionToken).catch(function(error) {\n                ctx.context.logger.error(\"Failed to delete stale session\", error);\n              });\n            }\n            (0, import_cookies.deleteSessionCookie)(ctx);\n            var headers = new Headers();\n            var accumulated = ctx.responseHeaders;\n            accumulated === null || accumulated === void 0 ? void 0 : accumulated.getSetCookie().forEach(function(cookie) {\n              headers.append(\"set-cookie\", cookie);\n            });\n            return new import_api.APIError(\"BAD_REQUEST\", {\n              message: (body === null || body === void 0 ? void 0 : body.message) || \"Failed to get a valid access token\",\n              code: import_accessTokenRefresh.FAILED_TO_GET_ACCESS_TOKEN\n            }, headers);\n          })\n        }\n      ]\n    }\n  };\n}\nfunction runtimeEnv() {\n  return typeof process === \"undefined\" ? {} : process.env;\n}\nfunction createAuth() {\n  var options = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};\n  var _options_plugins, _options_database, _options_sessionMaxAge;\n  var _options_keycloak, _options_keycloak1, _options_keycloak2, _options_keycloak3;\n  var env = runtimeEnv();\n  var baseUrl = options.baseUrl || env.BASE_URL || `http://localhost:${env.ONE_PORT || \"3000\"}`;\n  var isProduction = process.env.NODE_ENV === \"production\";\n  var keycloakBaseUrl = ((_options_keycloak = options.keycloak) === null || _options_keycloak === void 0 ? void 0 : _options_keycloak.baseUrl) || env.KEYCLOAK_BACKCHANNEL_URL || `${baseUrl}/auth`;\n  var keycloakRealm = ((_options_keycloak1 = options.keycloak) === null || _options_keycloak1 === void 0 ? void 0 : _options_keycloak1.realm) || env.KEYCLOAK_REALM || \"master\";\n  var issuer = `${keycloakBaseUrl}/realms/${keycloakRealm}`;\n  var keycloakClientId = ((_options_keycloak2 = options.keycloak) === null || _options_keycloak2 === void 0 ? void 0 : _options_keycloak2.clientId) || env.KEYCLOAK_CLIENT_ID || \"\";\n  var keycloakClientSecret = ((_options_keycloak3 = options.keycloak) === null || _options_keycloak3 === void 0 ? void 0 : _options_keycloak3.clientSecret) || env.KEYCLOAK_CLIENT_SECRET || \"\";\n  var expoPlugin = options.enableExpo !== false ? (0, import_expo.expo)() : void 0;\n  var basePath = options.basePath || \"/api/auth\";\n  var keycloakProviderConfig = {\n    ...(0, import_plugins.keycloak)({\n      clientId: keycloakClientId,\n      clientSecret: keycloakClientSecret,\n      issuer\n    }),\n    // Backchannel token/userinfo: `/get-access-token` refresh keeps these\n    // when discovery fails (Keycloak restart), so we don't depend on the\n    // well-known document coming up in the same instant as the token\n    // endpoint. Browser-facing authorize/issuer stay on the public /auth\n    // proxy (getters below).\n    tokenUrl: `${issuer}/protocol/openid-connect/token`,\n    userInfoUrl: `${issuer}/protocol/openid-connect/userinfo`,\n    // Wallet (SIWE-style) users authenticate by signature and have NO email —\n    // Keycloak issues them a username = wallet address and no email claim.\n    // better-auth's genericOAuth callback hard-rejects a user with no email\n    // (\"email_is_missing\"), so synthesize a stable, unique placeholder from the\n    // wallet address / subject. `.wallet` is a non-routable placeholder domain;\n    // the address stays the stable identity.\n    mapProfileToUser: function mapProfileToUser(profile) {\n      var _profile_email_verified;\n      var handle = profile.preferred_username || profile.sub || profile.id || profile.name;\n      var email = profile.email || (handle ? `${handle}@wallet` : void 0);\n      return {\n        ...profile,\n        email,\n        emailVerified: (_profile_email_verified = profile.email_verified) !== null && _profile_email_verified !== void 0 ? _profile_email_verified : true,\n        name: profile.name || handle\n      };\n    }\n  };\n  var keycloakPublicPath = (function() {\n    try {\n      var path = new URL(keycloakBaseUrl).pathname.replace(/\\/+$/, \"\");\n      return path && path !== \"/\" ? path : void 0;\n    } catch (unused) {\n      return void 0;\n    }\n  })();\n  var publicKeycloakBaseFor = function publicKeycloakBaseFor2(requestOrigin) {\n    if (!keycloakPublicPath) return keycloakBaseUrl;\n    try {\n      var url = new URL(baseUrl);\n      if (!isProduction && requestOrigin) {\n        url.hostname = new URL(requestOrigin).hostname;\n      }\n      return `${url.origin}${keycloakPublicPath}`;\n    } catch (unused) {\n      return void 0;\n    }\n  };\n  if (!isProduction) {\n    Object.defineProperty(keycloakProviderConfig, \"redirectURI\", {\n      enumerable: true,\n      get() {\n        var origin = requestOriginStorage.getStore();\n        return origin ? `${origin}${basePath}/oauth2/callback/keycloak` : void 0;\n      }\n    });\n    var keycloakPublicBase = function keycloakPublicBase2() {\n      var origin = requestOriginStorage.getStore();\n      if (!origin || !keycloakPublicPath) return void 0;\n      return publicKeycloakBaseFor(origin);\n    };\n    if (keycloakPublicPath) {\n      Object.defineProperty(keycloakProviderConfig, \"authorizationUrl\", {\n        enumerable: true,\n        get() {\n          var base = keycloakPublicBase();\n          return base ? `${base}/realms/${keycloakRealm}/protocol/openid-connect/auth` : void 0;\n        }\n      });\n      Object.defineProperty(keycloakProviderConfig, \"issuer\", {\n        enumerable: true,\n        get() {\n          var base = keycloakPublicBase();\n          return base ? `${base}/realms/${keycloakRealm}` : void 0;\n        }\n      });\n    }\n  }\n  var oauthPlugin = (0, import_plugins.genericOAuth)({\n    config: [\n      keycloakProviderConfig\n    ]\n  });\n  var keycloakSsoPlugin = createKeycloakSsoPlugin({\n    realm: keycloakRealm,\n    clientId: keycloakClientId,\n    clientSecret: keycloakClientSecret,\n    issuer,\n    baseUrl,\n    publicKeycloakBaseFor\n  });\n  var plugins = [\n    ...expoPlugin ? [\n      expoPlugin\n    ] : [],\n    oauthPlugin,\n    keycloakSsoPlugin,\n    ...(_options_plugins = options.plugins) !== null && _options_plugins !== void 0 ? _options_plugins : []\n  ];\n  var database = (_options_database = options.database) !== null && _options_database !== void 0 ? _options_database : env.DATABASE_URL || void 0;\n  return (0, import_better_auth.betterAuth)({\n    basePath,\n    // Static on purpose: better-auth's dynamic `baseURL` config (allowedHosts)\n    // is not honored by the genericOAuth plugin — it pins redirect URIs at\n    // init time, which turned them relative and bounced callbacks to the\n    // Keycloak host. Dev multi-host support comes from the per-request\n    // redirectURI getter above + the LAN trustedOrigins below instead.\n    baseURL: baseUrl,\n    ...database ? {\n      database\n    } : {},\n    secret: options.secret || env.SECRET || \"\",\n    trustedOrigins: options.trustedOrigins || [\n      baseUrl,\n      keycloakBaseUrl,\n      // In dev, ONE_PORT may differ from BASE_URL; ensure the dev server origin is trusted.\n      ...env.ONE_PORT && !baseUrl.includes(`:${env.ONE_PORT}`) ? [\n        `http://localhost:${env.ONE_PORT}`\n      ] : [],\n      \"multiplatform-one://\",\n      // Expo Go (dev) receives OAuth returns on the exp:// scheme — the app\n      // derives its callbackURL via Linking.createURL, which yields\n      // exp://<host>:<port>/--/ there. Never trusted in production builds.\n      // Dev also trusts private-network origins (see DEV_LAN_HOST_PATTERNS)\n      // so sign-in from a phone / the machine's LAN IP is not rejected.\n      ...isProduction ? [] : [\n        \"exp://\",\n        ...DEV_LAN_HOST_PATTERNS.map(function(host) {\n          return `http://${host}`;\n        })\n      ]\n    ],\n    session: {\n      cookieCache: {\n        enabled: true,\n        maxAge: (_options_sessionMaxAge = options.sessionMaxAge) !== null && _options_sessionMaxAge !== void 0 ? _options_sessionMaxAge : 7 * 24 * 60 * 60,\n        strategy: \"jwe\",\n        refreshCache: true\n      }\n    },\n    account: {\n      storeStateStrategy: \"cookie\",\n      storeAccountCookie: true\n    },\n    plugins\n  });\n}\nfunction createAuthRouteHandler(auth) {\n  var handler = function handler2(req) {\n    var origin = deriveRequestOrigin(req);\n    return origin ? requestOriginStorage.run(origin, function() {\n      return auth.handler(req);\n    }) : auth.handler(req);\n  };\n  return {\n    GET: handler,\n    POST: handler\n  };\n}\nfunction createSessionHelpers(auth) {\n  async function getSession(req) {\n    return auth.api.getSession({\n      headers: req.headers\n    });\n  }\n  async function verifyAuth(req) {\n    var session = await auth.api.getSession({\n      headers: req.headers\n    });\n    if (!session) {\n      throw new Response(\"Unauthorized\", {\n        status: 401\n      });\n    }\n    return session;\n  }\n  return {\n    verifyAuth,\n    getSession\n  };\n}\n//# sourceMappingURL=index.js.map\n"],"mappings":"AAAA,YAAY;;AACZ,IAAIA,SAAS,GAAGC,MAAM,CAACC,cAAc;AACrC,IAAIC,gBAAgB,GAAGF,MAAM,CAACG,wBAAwB;AACtD,IAAIC,iBAAiB,GAAGJ,MAAM,CAACK,mBAAmB;AAClD,IAAIC,YAAY,GAAGN,MAAM,CAACO,SAAS,CAACC,cAAc;AAClD,IAAIC,QAAQ,GAAGA,CAACC,MAAM,EAAEC,GAAG,KAAK;EAC9B,KAAK,IAAIC,IAAI,IAAID,GAAG,EAClBZ,SAAS,CAACW,MAAM,EAAEE,IAAI,EAAE;IAAEC,GAAG,EAAEF,GAAG,CAACC,IAAI,CAAC;IAAEE,UAAU,EAAE;EAAK,CAAC,CAAC;AACjE,CAAC;AACD,IAAIC,WAAW,GAAGA,CAACC,EAAE,EAAEC,IAAI,EAAEC,MAAM,EAAEC,IAAI,KAAK;EAC5C,IAAIF,IAAI,IAAI,OAAOA,IAAI,KAAK,QAAQ,IAAI,OAAOA,IAAI,KAAK,UAAU,EAAE;IAClE,KAAK,IAAIG,GAAG,IAAIhB,iBAAiB,CAACa,IAAI,CAAC,EACrC,IAAI,CAACX,YAAY,CAACe,IAAI,CAACL,EAAE,EAAEI,GAAG,CAAC,IAAIA,GAAG,KAAKF,MAAM,EAC/CnB,SAAS,CAACiB,EAAE,EAAEI,GAAG,EAAE;MAAEP,GAAG,EAAEA,CAAA,KAAMI,IAAI,CAACG,GAAG,CAAC;MAAEN,UAAU,EAAE,EAAEK,IAAI,GAAGjB,gBAAgB,CAACe,IAAI,EAAEG,GAAG,CAAC,CAAC,IAAID,IAAI,CAACL;IAAW,CAAC,CAAC;EACxH;EACA,OAAOE,EAAE;AACX,CAAC;AACD,IAAIM,YAAY,GAAIC,GAAG,IAAKR,WAAW,CAAChB,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE;EAAEyB,KAAK,EAAE;AAAK,CAAC,CAAC,EAAED,GAAG,CAAC;AAC1F,IAAIE,aAAa,GAAG,CAAC,CAAC;AACtBhB,QAAQ,CAACgB,aAAa,EAAE;EACtBC,4BAA4B,EAAEA,CAAA,KAAMC,0BAA0B,CAACD,4BAA4B;EAC3FE,0BAA0B,EAAEA,CAAA,KAAMD,0BAA0B,CAACC,0BAA0B;EACvFC,yBAAyB,EAAEA,CAAA,KAAMF,0BAA0B,CAACE,yBAAyB;EACrFC,2BAA2B,EAAEA,CAAA,KAAMH,0BAA0B,CAACG,2BAA2B;EACzFC,UAAU,EAAEA,CAAA,KAAMA,UAAU;EAC5BC,sBAAsB,EAAEA,CAAA,KAAMA,sBAAsB;EACpDC,oBAAoB,EAAEA,CAAA,KAAMA,oBAAoB;EAChDC,mBAAmB,EAAEA,CAAA,KAAMP,0BAA0B,CAACO,mBAAmB;EACzEC,oBAAoB,EAAEA,CAAA,KAAMR,0BAA0B,CAACQ;AACzD,CAAC,CAAC;AACFC,MAAM,CAACC,OAAO,GAAGf,YAAY,CAACG,aAAa,CAAC;AAC5C,IAAIa,kBAAkB,GAAGC,OAAO,CAAC,aAAa,CAAC;AAC/C,IAAIC,kBAAkB,GAAGD,OAAO,CAAC,aAAa,CAAC;AAC/C,IAAIE,UAAU,GAAGF,OAAO,CAAC,iBAAiB,CAAC;AAC3C,IAAIG,cAAc,GAAGH,OAAO,CAAC,qBAAqB,CAAC;AACnD,IAAII,cAAc,GAAGJ,OAAO,CAAC,qBAAqB,CAAC;AACnD,IAAIK,WAAW,GAAGL,OAAO,CAAC,mBAAmB,CAAC;AAC9C,IAAIM,yBAAyB,GAAGN,OAAO,CAAC,gCAAsB,CAAC;AAC/D,IAAIZ,0BAA0B,GAAGY,OAAO,CAAC,gCAAsB,CAAC;AAChE,IAAIO,oBAAoB,GAAG,IAAIR,kBAAkB,CAACS,iBAAiB,CAAC,CAAC;AACrE,SAASC,mBAAmBA,CAACC,GAAG,EAAE;EAChC,IAAIC,SAAS,GAAG,SAASC,UAAUA,CAACC,IAAI,EAAE;IACxC,OAAOC,qBAAqB,CAACC,IAAI,CAAC,UAASC,OAAO,EAAE;MAClD,OAAO,CAAC,CAAC,EAAEf,kBAAkB,CAACgB,kBAAkB,EAAEJ,IAAI,EAAEG,OAAO,CAAC;IAClE,CAAC,CAAC;EACJ,CAAC;EACD,IAAIE,aAAa,GAAGR,GAAG,CAACS,OAAO,CAAC7C,GAAG,CAAC,kBAAkB,CAAC;EACvD,IAAI4C,aAAa,IAAIP,SAAS,CAACO,aAAa,CAAC,EAAE;IAC7C,IAAIE,KAAK,GAAGV,GAAG,CAACS,OAAO,CAAC7C,GAAG,CAAC,mBAAmB,CAAC,KAAK,OAAO,GAAG,OAAO,GAAG,MAAM;IAC/E,OAAO,GAAG8C,KAAK,MAAMF,aAAa,EAAE;EACtC;EACA,IAAIG,YAAY,GAAGX,GAAG,CAACS,OAAO,CAAC7C,GAAG,CAAC,QAAQ,CAAC;EAC5C,IAAI+C,YAAY,EAAE;IAChB,IAAI;MACF,IAAIC,GAAG,GAAG,IAAIC,GAAG,CAACF,YAAY,CAAC;MAC/B,IAAIV,SAAS,CAACW,GAAG,CAACT,IAAI,CAAC,EAAE,OAAOS,GAAG,CAACE,MAAM;IAC5C,CAAC,CAAC,OAAOC,MAAM,EAAE,CACjB;EACF;EACA,IAAI;IACF,OAAO,IAAIF,GAAG,CAACb,GAAG,CAACY,GAAG,CAAC,CAACE,MAAM;EAChC,CAAC,CAAC,OAAOC,MAAM,EAAE;IACf,OAAO,KAAK,CAAC;EACf;AACF;AACA,IAAIX,qBAAqB,GAAG,CAC1B,WAAW,EACX,aAAa,EACb,WAAW,EACX,aAAa,EACb,MAAM,EACN,WAAW,EACX,OAAO,EACP,SAAS,EACT,WAAW,CACZ;AACD,SAASY,uBAAuBA,CAACC,OAAO,EAAE;EACxC,IAAI;IAAEC,KAAK;IAAEC,QAAQ;IAAEC,YAAY;IAAEC,MAAM;IAAEC,OAAO;IAAEC;EAAsB,CAAC,GAAGN,OAAO;EACvF,IAAIO,aAAa,GAAG,GAAGH,MAAM,gCAAgC;EAC7D,IAAII,oBAAoB,GAAG,SAASC,qBAAqBA,CAACC,OAAO,EAAE;IACjE,IAAIC,8BAA8B;IAClC,OAAO,CAACA,8BAA8B,GAAG/B,oBAAoB,CAACgC,QAAQ,CAAC,CAAC,MAAM,IAAI,IAAID,8BAA8B,KAAK,KAAK,CAAC,GAAGA,8BAA8B,GAAGD,OAAO,GAAG5B,mBAAmB,CAAC4B,OAAO,CAAC,GAAG,KAAK,CAAC;EACpN,CAAC;EACD,IAAIG,yBAAyB,GAAG,eAAeC,0BAA0BA,CAACC,YAAY,EAAE;IACtF,IAAI;MACF,IAAIC,GAAG,GAAG,MAAMC,KAAK,CAACV,aAAa,EAAE;QACnCW,MAAM,EAAE,MAAM;QACd1B,OAAO,EAAE;UACP,cAAc,EAAE;QAClB,CAAC;QACD2B,IAAI,EAAE,IAAIC,eAAe,CAAC;UACxBC,UAAU,EAAE,eAAe;UAC3BC,aAAa,EAAEP,YAAY;UAC3BQ,SAAS,EAAErB,QAAQ;UACnBsB,aAAa,EAAErB;QACjB,CAAC,CAAC;QACFsB,MAAM,EAAEC,WAAW,CAACC,OAAO,CAAC,GAAG;MACjC,CAAC,CAAC;MACF,IAAIX,GAAG,CAACY,EAAE,EAAE,OAAO,KAAK;MACxB,IAAIZ,GAAG,CAACa,MAAM,KAAK,GAAG,IAAIb,GAAG,CAACa,MAAM,KAAK,GAAG,EAAE,OAAO,KAAK;MAC1D,IAAIV,IAAI,GAAG,MAAMH,GAAG,CAACc,IAAI,CAAC,CAAC,CAACC,KAAK,CAAC,YAAW;QAC3C,OAAO,IAAI;MACb,CAAC,CAAC;MACF,OAAO,CAACZ,IAAI,KAAK,IAAI,IAAIA,IAAI,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,IAAI,CAACa,KAAK,MAAM,eAAe,IAAI,CAACb,IAAI,KAAK,IAAI,IAAIA,IAAI,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,IAAI,CAACa,KAAK,MAAM,eAAe;IACrK,CAAC,CAAC,OAAOlC,MAAM,EAAE;MACf,OAAO,KAAK;IACd;EACF,CAAC;EACD,IAAImC,UAAU,GAAG,CAAC,CAAC,EAAE1D,UAAU,CAAC2D,kBAAkB,EAAE,eAAe,EAAE;IACnEhB,MAAM,EAAE;EACV,CAAC,EAAE,gBAAeiB,GAAG,EAAE;IACrB,IAAIC,qBAAqB,EAAEC,IAAI;IAC/B,IAAIC,aAAa,GAAG,CAACF,qBAAqB,GAAG5B,oBAAoB,CAAC2B,GAAG,CAACzB,OAAO,CAAC,MAAM,IAAI,IAAI0B,qBAAqB,KAAK,KAAK,CAAC,GAAGA,qBAAqB,GAAG/B,OAAO;IAC9J,IAAIkC,YAAY,GAAGJ,GAAG,CAACzB,OAAO,GAAG,IAAId,GAAG,CAACuC,GAAG,CAACzB,OAAO,CAACf,GAAG,CAAC,CAAC4C,YAAY,GAAG,KAAK,CAAC;IAC/E,IAAIC,WAAW,GAAG,CAACH,IAAI,GAAGE,YAAY,KAAK,IAAI,IAAIA,YAAY,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,YAAY,CAAC5F,GAAG,CAAC,aAAa,CAAC,MAAM,IAAI,IAAI0F,IAAI,KAAK,KAAK,CAAC,GAAGA,IAAI,GAAG,IAAI;IAChK,IAAII,QAAQ,GAAG,CAACF,YAAY,KAAK,IAAI,IAAIA,YAAY,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,YAAY,CAAC5F,GAAG,CAAC,MAAM,CAAC,MAAM,MAAM;IAChH,IAAI+F,MAAM,GAAG,SAASC,OAAOA,CAAChD,GAAG,EAAEiD,QAAQ,EAAE;MAC3C,IAAIH,QAAQ,EAAE,OAAON,GAAG,CAACL,IAAI,CAAC;QAC5Bc,QAAQ;QACRjD;MACF,CAAC,CAAC;MACF,MAAMwC,GAAG,CAACS,QAAQ,CAACjD,GAAG,CAAC;IACzB,CAAC;IACD,IAAIkD,WAAW,GAAGL,WAAW,IAAI,GAAG;IACpC,IAAIM,kBAAkB,GAAGD,WAAW,CAACE,UAAU,CAAC,GAAG,CAAC,GAAG,GAAGT,aAAa,GAAGO,WAAW,EAAE,GAAGA,WAAW;IACrG,IAAIG,WAAW;IACf,IAAIC,YAAY,GAAG,MAAMd,GAAG,CAACe,eAAe,CAACf,GAAG,CAACgB,OAAO,CAACC,WAAW,CAACH,YAAY,CAACvG,IAAI,EAAEyF,GAAG,CAACgB,OAAO,CAACE,MAAM,CAAC;IAC3G,IAAIC,OAAO,GAAG,MAAM,CAAC,CAAC,EAAE/E,UAAU,CAACgF,iBAAiB,EAAEpB,GAAG,CAAC,CAACJ,KAAK,CAAC,YAAW;MAC1E,OAAO,IAAI;IACb,CAAC,CAAC;IACF,IAAIuB,OAAO,EAAE;MACX,IAAIE,KAAK;MACT,IAAIC,cAAc;MAClB,IAAIC,QAAQ,GAAG,MAAMvB,GAAG,CAACgB,OAAO,CAACQ,eAAe,CAACC,YAAY,CAACN,OAAO,CAACO,IAAI,CAACC,EAAE,CAAC,CAAC/B,KAAK,CAAC,YAAW;QAC9F,OAAO,EAAE;MACX,CAAC,CAAC;MACFiB,WAAW,GAAG,CAACQ,KAAK,GAAG,CAACC,cAAc,GAAGC,QAAQ,CAACK,IAAI,CAAC,UAASC,OAAO,EAAE;QACvE,OAAOA,OAAO,CAACC,UAAU,KAAK,UAAU;MAC1C,CAAC,CAAC,MAAM,IAAI,IAAIR,cAAc,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,cAAc,CAACS,OAAO,MAAM,IAAI,IAAIV,KAAK,KAAK,KAAK,CAAC,GAAGA,KAAK,GAAG,KAAK,CAAC;IAC5H;IACA,IAAI,CAACR,WAAW,EAAE;MAChB,IAAImB,aAAa,GAAG,MAAM,CAAC,CAAC,EAAE3F,cAAc,CAAC4F,gBAAgB,EAAEjC,GAAG,CAAC,CAACJ,KAAK,CAAC,YAAW;QACnF,OAAO,IAAI;MACb,CAAC,CAAC;MACF,IAAI,CAACoC,aAAa,KAAK,IAAI,IAAIA,aAAa,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,aAAa,CAACF,UAAU,MAAM,UAAU,IAAIE,aAAa,CAACD,OAAO,EAAE;QACpIlB,WAAW,GAAGmB,aAAa,CAACD,OAAO;MACrC;IACF;IACA,IAAIjB,YAAY,EAAE;MAChB,MAAMd,GAAG,CAACgB,OAAO,CAACQ,eAAe,CAACU,aAAa,CAACpB,YAAY,CAAC,CAAClB,KAAK,CAAC,UAASC,KAAK,EAAE;QAClFG,GAAG,CAACgB,OAAO,CAACmB,MAAM,CAACtC,KAAK,CAAC,8CAA8C,EAAEA,KAAK,CAAC;MACjF,CAAC,CAAC;IACJ;IACA,CAAC,CAAC,EAAExD,cAAc,CAAC+F,mBAAmB,EAAEpC,GAAG,CAAC;IAC5C,IAAIqC,YAAY,GAAGlE,qBAAqB,CAACgC,aAAa,CAAC;IACvD,IAAI,CAACkC,YAAY,IAAI,CAAClB,OAAO,IAAI,CAACN,WAAW,IAAI,CAACC,YAAY,EAAE;MAC9D,OAAOP,MAAM,CAACI,kBAAkB,EAAE,KAAK,CAAC;IAC1C;IACA,IAAI2B,UAAU,GAAG,IAAI7E,GAAG,CAAC,GAAG4E,YAAY,WAAWvE,KAAK,iCAAiC,CAAC;IAC1FwE,UAAU,CAAClC,YAAY,CAACmC,GAAG,CAAC,0BAA0B,EAAE5B,kBAAkB,CAAC;IAC3E2B,UAAU,CAAClC,YAAY,CAACmC,GAAG,CAAC,WAAW,EAAExE,QAAQ,CAAC;IAClD,IAAI8C,WAAW,EAAEyB,UAAU,CAAClC,YAAY,CAACmC,GAAG,CAAC,eAAe,EAAE1B,WAAW,CAAC;IAC1E,OAAON,MAAM,CAAC+B,UAAU,CAACE,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC;EAC5C,CAAC,CAAC;EACF,OAAO;IACLb,EAAE,EAAE,cAAc;IAClBc,SAAS,EAAE;MACT3C;IACF,CAAC;IACD4C,KAAK,EAAE;MACLC,MAAM,EAAE,CACN;QACE;QACA;QACA;QACA;QACAC,OAAO,EAAE,SAASA,OAAOA,CAAC5C,GAAG,EAAE;UAC7B,OAAOA,GAAG,CAAC6C,IAAI,KAAK,mBAAmB;QACzC,CAAC;QACDC,OAAO,EAAE,CAAC,CAAC,EAAE1G,UAAU,CAAC2G,oBAAoB,EAAE,gBAAe/C,GAAG,EAAE;UAChE,IAAImB,OAAO,GAAG,MAAM,CAAC,CAAC,EAAE/E,UAAU,CAACgF,iBAAiB,EAAEpB,GAAG,CAAC,CAACJ,KAAK,CAAC,YAAW;YAC1E,OAAO,IAAI;UACb,CAAC,CAAC;UACF,IAAI,CAACuB,OAAO,EAAE,OAAOnB,GAAG,CAACL,IAAI,CAAC,IAAI,CAAC;QACrC,CAAC;MACH,CAAC,CACF;MACDqD,KAAK,EAAE,CACL;QACEJ,OAAO,EAAE,SAASA,OAAOA,CAAC5C,GAAG,EAAE;UAC7B,OAAOA,GAAG,CAAC6C,IAAI,KAAK,mBAAmB;QACzC,CAAC;QACDC,OAAO,EAAE,CAAC,CAAC,EAAE1G,UAAU,CAAC2G,oBAAoB,EAAE,gBAAe/C,GAAG,EAAE;UAChE,IAAIiD,SAAS,EAAE3B,cAAc;UAC7B,IAAI4B,QAAQ,GAAGlD,GAAG,CAACgB,OAAO,CAACkC,QAAQ;UACnC,IAAI,CAAC,CAAC,CAAC,EAAE9G,UAAU,CAAC+G,UAAU,EAAED,QAAQ,CAAC,EAAE;UAC3C,IAAIlE,IAAI,GAAGkE,QAAQ,CAAClE,IAAI;UACxB,IAAI,CAACA,IAAI,KAAK,IAAI,IAAIA,IAAI,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,IAAI,CAACoE,IAAI,MAAM5G,yBAAyB,CAACjB,0BAA0B,EAAE;UACtH,IAAIuG,UAAU,GAAG,CAACmB,SAAS,GAAGjD,GAAG,CAAChB,IAAI,MAAM,IAAI,IAAIiE,SAAS,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,SAAS,CAACnB,UAAU;UACxG,IAAIA,UAAU,IAAIA,UAAU,KAAK,UAAU,EAAE;UAC7C,IAAIX,OAAO,GAAG,MAAM,CAAC,CAAC,EAAE/E,UAAU,CAACgF,iBAAiB,EAAEpB,GAAG,CAAC,CAACJ,KAAK,CAAC,YAAW;YAC1E,OAAO,IAAI;UACb,CAAC,CAAC;UACF,IAAI,CAACuB,OAAO,EAAE;UACd,IAAII,QAAQ,GAAG,MAAMvB,GAAG,CAACgB,OAAO,CAACQ,eAAe,CAACC,YAAY,CAACN,OAAO,CAACO,IAAI,CAACC,EAAE,CAAC,CAAC/B,KAAK,CAAC,YAAW;YAC9F,OAAO,EAAE;UACX,CAAC,CAAC;UACF,IAAIhB,YAAY,GAAG,CAAC0C,cAAc,GAAGC,QAAQ,CAACK,IAAI,CAAC,UAASC,OAAO,EAAE;YACnE,OAAOA,OAAO,CAACC,UAAU,KAAK,UAAU;UAC1C,CAAC,CAAC,MAAM,IAAI,IAAIR,cAAc,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,cAAc,CAAC1C,YAAY;UAChF,IAAI,CAACA,YAAY,EAAE;YACjB,IAAIoD,aAAa,GAAG,MAAM,CAAC,CAAC,EAAE3F,cAAc,CAAC4F,gBAAgB,EAAEjC,GAAG,CAAC,CAACJ,KAAK,CAAC,YAAW;cACnF,OAAO,IAAI;YACb,CAAC,CAAC;YACF,IAAI,CAACoC,aAAa,KAAK,IAAI,IAAIA,aAAa,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,aAAa,CAACF,UAAU,MAAM,UAAU,EAAE;cAC3GlD,YAAY,GAAGoD,aAAa,CAACpD,YAAY;YAC3C;UACF;UACA,IAAIyE,UAAU,GAAGzE,YAAY,GAAG,MAAMF,yBAAyB,CAACE,YAAY,CAAC,GAAG,IAAI;UACpF,IAAI,CAACyE,UAAU,EAAE;YACf,OAAO,IAAIjH,UAAU,CAACkH,QAAQ,CAAC,uBAAuB,EAAE;cACtDC,OAAO,EAAE,gDAAgD;cACzDH,IAAI,EAAE5G,yBAAyB,CAAChB;YAClC,CAAC,CAAC;UACJ;UACAwE,GAAG,CAACgB,OAAO,CAACmB,MAAM,CAACqB,IAAI,CAAC,wFAAwF,CAAC;UACjH,IAAI1C,YAAY,GAAG,MAAMd,GAAG,CAACe,eAAe,CAACf,GAAG,CAACgB,OAAO,CAACC,WAAW,CAACH,YAAY,CAACvG,IAAI,EAAEyF,GAAG,CAACgB,OAAO,CAACE,MAAM,CAAC;UAC3G,IAAIJ,YAAY,EAAE;YAChB,MAAMd,GAAG,CAACgB,OAAO,CAACQ,eAAe,CAACU,aAAa,CAACpB,YAAY,CAAC,CAAClB,KAAK,CAAC,UAASC,KAAK,EAAE;cAClFG,GAAG,CAACgB,OAAO,CAACmB,MAAM,CAACtC,KAAK,CAAC,gCAAgC,EAAEA,KAAK,CAAC;YACnE,CAAC,CAAC;UACJ;UACA,CAAC,CAAC,EAAExD,cAAc,CAAC+F,mBAAmB,EAAEpC,GAAG,CAAC;UAC5C,IAAI3C,OAAO,GAAG,IAAIoG,OAAO,CAAC,CAAC;UAC3B,IAAIC,WAAW,GAAG1D,GAAG,CAAC2D,eAAe;UACrCD,WAAW,KAAK,IAAI,IAAIA,WAAW,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,WAAW,CAACE,YAAY,CAAC,CAAC,CAACC,OAAO,CAAC,UAASC,MAAM,EAAE;YAC5GzG,OAAO,CAAC0G,MAAM,CAAC,YAAY,EAAED,MAAM,CAAC;UACtC,CAAC,CAAC;UACF,OAAO,IAAI1H,UAAU,CAACkH,QAAQ,CAAC,aAAa,EAAE;YAC5CC,OAAO,EAAE,CAACvE,IAAI,KAAK,IAAI,IAAIA,IAAI,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,IAAI,CAACuE,OAAO,KAAK,oCAAoC;YAC3GH,IAAI,EAAE5G,yBAAyB,CAACjB;UAClC,CAAC,EAAE8B,OAAO,CAAC;QACb,CAAC;MACH,CAAC;IAEL;EACF,CAAC;AACH;AACA,SAAS2G,UAAUA,CAAA,EAAG;EACpB,OAAO,OAAOC,OAAO,KAAK,WAAW,GAAG,CAAC,CAAC,GAAGA,OAAO,CAACC,GAAG;AAC1D;AACA,SAASxI,UAAUA,CAAA,EAAG;EACpB,IAAImC,OAAO,GAAGsG,SAAS,CAACC,MAAM,GAAG,CAAC,IAAID,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,GAAGA,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;EACjF,IAAIE,gBAAgB,EAAEC,iBAAiB,EAAEC,sBAAsB;EAC/D,IAAIC,iBAAiB,EAAEC,kBAAkB,EAAEC,kBAAkB,EAAEC,kBAAkB;EACjF,IAAIT,GAAG,GAAGF,UAAU,CAAC,CAAC;EACtB,IAAI9F,OAAO,GAAGL,OAAO,CAACK,OAAO,IAAIgG,GAAG,CAACU,QAAQ,IAAI,oBAAoBV,GAAG,CAACW,QAAQ,IAAI,MAAM,EAAE;EAC7F,IAAIC,YAAY,GAAGb,OAAO,CAACC,GAAG,CAACa,QAAQ,KAAK,YAAY;EACxD,IAAIC,eAAe,GAAG,CAAC,CAACR,iBAAiB,GAAG3G,OAAO,CAACoH,QAAQ,MAAM,IAAI,IAAIT,iBAAiB,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,iBAAiB,CAACtG,OAAO,KAAKgG,GAAG,CAACgB,wBAAwB,IAAI,GAAGhH,OAAO,OAAO;EACjM,IAAIiH,aAAa,GAAG,CAAC,CAACV,kBAAkB,GAAG5G,OAAO,CAACoH,QAAQ,MAAM,IAAI,IAAIR,kBAAkB,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,kBAAkB,CAAC3G,KAAK,KAAKoG,GAAG,CAACkB,cAAc,IAAI,QAAQ;EAC7K,IAAInH,MAAM,GAAG,GAAG+G,eAAe,WAAWG,aAAa,EAAE;EACzD,IAAIE,gBAAgB,GAAG,CAAC,CAACX,kBAAkB,GAAG7G,OAAO,CAACoH,QAAQ,MAAM,IAAI,IAAIP,kBAAkB,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,kBAAkB,CAAC3G,QAAQ,KAAKmG,GAAG,CAACoB,kBAAkB,IAAI,EAAE;EACjL,IAAIC,oBAAoB,GAAG,CAAC,CAACZ,kBAAkB,GAAG9G,OAAO,CAACoH,QAAQ,MAAM,IAAI,IAAIN,kBAAkB,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,kBAAkB,CAAC3G,YAAY,KAAKkG,GAAG,CAACsB,sBAAsB,IAAI,EAAE;EAC7L,IAAIC,UAAU,GAAG5H,OAAO,CAAC6H,UAAU,KAAK,KAAK,GAAG,CAAC,CAAC,EAAEnJ,WAAW,CAACoJ,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC;EAChF,IAAIC,QAAQ,GAAG/H,OAAO,CAAC+H,QAAQ,IAAI,WAAW;EAC9C,IAAIC,sBAAsB,GAAG;IAC3B,GAAG,CAAC,CAAC,EAAEvJ,cAAc,CAAC2I,QAAQ,EAAE;MAC9BlH,QAAQ,EAAEsH,gBAAgB;MAC1BrH,YAAY,EAAEuH,oBAAoB;MAClCtH;IACF,CAAC,CAAC;IACF;IACA;IACA;IACA;IACA;IACA6H,QAAQ,EAAE,GAAG7H,MAAM,gCAAgC;IACnD8H,WAAW,EAAE,GAAG9H,MAAM,mCAAmC;IACzD;IACA;IACA;IACA;IACA;IACA;IACA+H,gBAAgB,EAAE,SAASA,gBAAgBA,CAACC,OAAO,EAAE;MACnD,IAAIC,uBAAuB;MAC3B,IAAIC,MAAM,GAAGF,OAAO,CAACG,kBAAkB,IAAIH,OAAO,CAACI,GAAG,IAAIJ,OAAO,CAACtE,EAAE,IAAIsE,OAAO,CAAC1L,IAAI;MACpF,IAAI+L,KAAK,GAAGL,OAAO,CAACK,KAAK,KAAKH,MAAM,GAAG,GAAGA,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC;MACnE,OAAO;QACL,GAAGF,OAAO;QACVK,KAAK;QACLC,aAAa,EAAE,CAACL,uBAAuB,GAAGD,OAAO,CAACO,cAAc,MAAM,IAAI,IAAIN,uBAAuB,KAAK,KAAK,CAAC,GAAGA,uBAAuB,GAAG,IAAI;QACjJ3L,IAAI,EAAE0L,OAAO,CAAC1L,IAAI,IAAI4L;MACxB,CAAC;IACH;EACF,CAAC;EACD,IAAIM,kBAAkB,GAAI,YAAW;IACnC,IAAI;MACF,IAAI5D,IAAI,GAAG,IAAIpF,GAAG,CAACuH,eAAe,CAAC,CAAC0B,QAAQ,CAACC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;MAChE,OAAO9D,IAAI,IAAIA,IAAI,KAAK,GAAG,GAAGA,IAAI,GAAG,KAAK,CAAC;IAC7C,CAAC,CAAC,OAAOlF,MAAM,EAAE;MACf,OAAO,KAAK,CAAC;IACf;EACF,CAAC,CAAE,CAAC;EACJ,IAAIQ,qBAAqB,GAAG,SAASyI,sBAAsBA,CAACC,aAAa,EAAE;IACzE,IAAI,CAACJ,kBAAkB,EAAE,OAAOzB,eAAe;IAC/C,IAAI;MACF,IAAIxH,GAAG,GAAG,IAAIC,GAAG,CAACS,OAAO,CAAC;MAC1B,IAAI,CAAC4G,YAAY,IAAI+B,aAAa,EAAE;QAClCrJ,GAAG,CAACsJ,QAAQ,GAAG,IAAIrJ,GAAG,CAACoJ,aAAa,CAAC,CAACC,QAAQ;MAChD;MACA,OAAO,GAAGtJ,GAAG,CAACE,MAAM,GAAG+I,kBAAkB,EAAE;IAC7C,CAAC,CAAC,OAAO9I,MAAM,EAAE;MACf,OAAO,KAAK,CAAC;IACf;EACF,CAAC;EACD,IAAI,CAACmH,YAAY,EAAE;IACjBnL,MAAM,CAACC,cAAc,CAACiM,sBAAsB,EAAE,aAAa,EAAE;MAC3DpL,UAAU,EAAE,IAAI;MAChBD,GAAGA,CAAA,EAAG;QACJ,IAAIkD,MAAM,GAAGjB,oBAAoB,CAACgC,QAAQ,CAAC,CAAC;QAC5C,OAAOf,MAAM,GAAG,GAAGA,MAAM,GAAGkI,QAAQ,2BAA2B,GAAG,KAAK,CAAC;MAC1E;IACF,CAAC,CAAC;IACF,IAAImB,kBAAkB,GAAG,SAASC,mBAAmBA,CAAA,EAAG;MACtD,IAAItJ,MAAM,GAAGjB,oBAAoB,CAACgC,QAAQ,CAAC,CAAC;MAC5C,IAAI,CAACf,MAAM,IAAI,CAAC+I,kBAAkB,EAAE,OAAO,KAAK,CAAC;MACjD,OAAOtI,qBAAqB,CAACT,MAAM,CAAC;IACtC,CAAC;IACD,IAAI+I,kBAAkB,EAAE;MACtB9M,MAAM,CAACC,cAAc,CAACiM,sBAAsB,EAAE,kBAAkB,EAAE;QAChEpL,UAAU,EAAE,IAAI;QAChBD,GAAGA,CAAA,EAAG;UACJ,IAAIyM,IAAI,GAAGF,kBAAkB,CAAC,CAAC;UAC/B,OAAOE,IAAI,GAAG,GAAGA,IAAI,WAAW9B,aAAa,+BAA+B,GAAG,KAAK,CAAC;QACvF;MACF,CAAC,CAAC;MACFxL,MAAM,CAACC,cAAc,CAACiM,sBAAsB,EAAE,QAAQ,EAAE;QACtDpL,UAAU,EAAE,IAAI;QAChBD,GAAGA,CAAA,EAAG;UACJ,IAAIyM,IAAI,GAAGF,kBAAkB,CAAC,CAAC;UAC/B,OAAOE,IAAI,GAAG,GAAGA,IAAI,WAAW9B,aAAa,EAAE,GAAG,KAAK,CAAC;QAC1D;MACF,CAAC,CAAC;IACJ;EACF;EACA,IAAI+B,WAAW,GAAG,CAAC,CAAC,EAAE5K,cAAc,CAAC6K,YAAY,EAAE;IACjDC,MAAM,EAAE,CACNvB,sBAAsB;EAE1B,CAAC,CAAC;EACF,IAAIwB,iBAAiB,GAAGzJ,uBAAuB,CAAC;IAC9CE,KAAK,EAAEqH,aAAa;IACpBpH,QAAQ,EAAEsH,gBAAgB;IAC1BrH,YAAY,EAAEuH,oBAAoB;IAClCtH,MAAM;IACNC,OAAO;IACPC;EACF,CAAC,CAAC;EACF,IAAImJ,OAAO,GAAG,CACZ,IAAG7B,UAAU,GAAG,CACdA,UAAU,CACX,GAAG,EAAE,GACNyB,WAAW,EACXG,iBAAiB,EACjB,IAAG,CAAChD,gBAAgB,GAAGxG,OAAO,CAACyJ,OAAO,MAAM,IAAI,IAAIjD,gBAAgB,KAAK,KAAK,CAAC,GAAGA,gBAAgB,GAAG,EAAE,EACxG;EACD,IAAIkD,QAAQ,GAAG,CAACjD,iBAAiB,GAAGzG,OAAO,CAAC0J,QAAQ,MAAM,IAAI,IAAIjD,iBAAiB,KAAK,KAAK,CAAC,GAAGA,iBAAiB,GAAGJ,GAAG,CAACsD,YAAY,IAAI,KAAK,CAAC;EAC/I,OAAO,CAAC,CAAC,EAAErL,kBAAkB,CAACsL,UAAU,EAAE;IACxC7B,QAAQ;IACR;IACA;IACA;IACA;IACA;IACA8B,OAAO,EAAExJ,OAAO;IAChB,IAAGqJ,QAAQ,GAAG;MACZA;IACF,CAAC,GAAG,CAAC,CAAC;IACNrG,MAAM,EAAErD,OAAO,CAACqD,MAAM,IAAIgD,GAAG,CAACyD,MAAM,IAAI,EAAE;IAC1CC,cAAc,EAAE/J,OAAO,CAAC+J,cAAc,IAAI,CACxC1J,OAAO,EACP8G,eAAe;IACf;IACA,IAAGd,GAAG,CAACW,QAAQ,IAAI,CAAC3G,OAAO,CAAC2J,QAAQ,CAAC,IAAI3D,GAAG,CAACW,QAAQ,EAAE,CAAC,GAAG,CACzD,oBAAoBX,GAAG,CAACW,QAAQ,EAAE,CACnC,GAAG,EAAE,GACN,sBAAsB;IACtB;IACA;IACA;IACA;IACA;IACA,IAAGC,YAAY,GAAG,EAAE,GAAG,CACrB,QAAQ,EACR,GAAG9H,qBAAqB,CAAC8K,GAAG,CAAC,UAAS/K,IAAI,EAAE;MAC1C,OAAO,UAAUA,IAAI,EAAE;IACzB,CAAC,CAAC,CACH,EACF;IACDoE,OAAO,EAAE;MACP4G,WAAW,EAAE;QACXC,OAAO,EAAE,IAAI;QACbC,MAAM,EAAE,CAAC1D,sBAAsB,GAAG1G,OAAO,CAACqK,aAAa,MAAM,IAAI,IAAI3D,sBAAsB,KAAK,KAAK,CAAC,GAAGA,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;QAClJ4D,QAAQ,EAAE,KAAK;QACfC,YAAY,EAAE;MAChB;IACF,CAAC;IACDvG,OAAO,EAAE;MACPwG,kBAAkB,EAAE,QAAQ;MAC5BC,kBAAkB,EAAE;IACtB,CAAC;IACDhB;EACF,CAAC,CAAC;AACJ;AACA,SAAS3L,sBAAsBA,CAAC4M,IAAI,EAAE;EACpC,IAAIzF,OAAO,GAAG,SAAS0F,QAAQA,CAAC5L,GAAG,EAAE;IACnC,IAAIc,MAAM,GAAGf,mBAAmB,CAACC,GAAG,CAAC;IACrC,OAAOc,MAAM,GAAGjB,oBAAoB,CAACgM,GAAG,CAAC/K,MAAM,EAAE,YAAW;MAC1D,OAAO6K,IAAI,CAACzF,OAAO,CAAClG,GAAG,CAAC;IAC1B,CAAC,CAAC,GAAG2L,IAAI,CAACzF,OAAO,CAAClG,GAAG,CAAC;EACxB,CAAC;EACD,OAAO;IACL8L,GAAG,EAAE5F,OAAO;IACZ6F,IAAI,EAAE7F;EACR,CAAC;AACH;AACA,SAASlH,oBAAoBA,CAAC2M,IAAI,EAAE;EAClC,eAAeK,UAAUA,CAAChM,GAAG,EAAE;IAC7B,OAAO2L,IAAI,CAACM,GAAG,CAACD,UAAU,CAAC;MACzBvL,OAAO,EAAET,GAAG,CAACS;IACf,CAAC,CAAC;EACJ;EACA,eAAeyL,UAAUA,CAAClM,GAAG,EAAE;IAC7B,IAAIuE,OAAO,GAAG,MAAMoH,IAAI,CAACM,GAAG,CAACD,UAAU,CAAC;MACtCvL,OAAO,EAAET,GAAG,CAACS;IACf,CAAC,CAAC;IACF,IAAI,CAAC8D,OAAO,EAAE;MACZ,MAAM,IAAI4H,QAAQ,CAAC,cAAc,EAAE;QACjCrJ,MAAM,EAAE;MACV,CAAC,CAAC;IACJ;IACA,OAAOyB,OAAO;EAChB;EACA,OAAO;IACL2H,UAAU;IACVF;EACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"names":["__defProp","Object","defineProperty","__getOwnPropDesc","getOwnPropertyDescriptor","__getOwnPropNames","getOwnPropertyNames","__hasOwnProp","prototype","hasOwnProperty","__export","target","all","name","get","enumerable","__copyProps","to","from","except","desc","key","call","__toCommonJS","mod","value","index_exports","ACCESS_TOKEN_RETRY_DELAYS_MS","import_accessTokenRefresh2","FAILED_TO_GET_ACCESS_TOKEN","TOKEN_REFRESH_UNAVAILABLE","classifyAccessTokenResponse","createAuth","createAuthRouteHandler","createSessionHelpers","retryWhileTransient","watchDocumentVisible","module","exports","import_async_hooks","require","import_better_auth","import_api","import_cookies","import_plugins","import_expo","import_accessTokenRefresh","requestOriginStorage","AsyncLocalStorage","deriveRequestOrigin","req","isDevHost","isDevHost2","host","DEV_LAN_HOST_PATTERNS","some","pattern","matchesHostPattern","forwardedHost","headers","proto","_i","_iter","url","length","candidate","URL","origin","unused","accessTokenBodySchema","getAccessToken","options","body","acceptsAccessTokenBody","_accessTokenBodySchema_safeParse","safeParse","success","createKeycloakSsoPlugin","realm","clientId","clientSecret","issuer","baseUrl","publicKeycloakBaseFor","tokenEndpoint","resolveVisitorOrigin","resolveVisitorOrigin2","request","_requestOriginStorage_getStore","getStore","isRefreshDefinitivelyDead","isRefreshDefinitivelyDead2","refreshToken","res","fetch","method","URLSearchParams","grant_type","refresh_token","client_id","client_secret","signal","AbortSignal","timeout","ok","status","json","catch","error","signOutSso","createAuthEndpoint","ctx","_resolveVisitorOrigin","_ref","visitorOrigin","searchParams","rawCallback","jsonMode","answer","answer2","redirect","callbackURL","postLogoutRedirect","startsWith","idTokenHint","sessionToken","getSignedCookie","context","authCookies","secret","session","getSessionFromCtx","_ref1","_accounts_find","accounts","internalAdapter","findAccounts","user","id","find","account","providerId","idToken","accountCookie","getAccountCookie","deleteSession","logger","deleteSessionCookie","keycloakBase","endSession","set","toString","endpoints","hooks","before","matcher","path","handler","createAuthMiddleware","useAccountCookie","legacy","after","_ctx_body","returned","isAPIError","code","definitive","APIError","message","warn","Headers","accumulated","responseHeaders","getSetCookie","forEach","cookie","append","runtimeEnv","process","env","arguments","_options_plugins","_options_database","_options_sessionMaxAge","_options_keycloak","_options_keycloak1","_options_keycloak2","_options_keycloak3","BASE_URL","ONE_PORT","isProduction","NODE_ENV","keycloakBaseUrl","keycloak","KEYCLOAK_BACKCHANNEL_URL","keycloakRealm","KEYCLOAK_REALM","keycloakClientId","KEYCLOAK_CLIENT_ID","keycloakClientSecret","KEYCLOAK_CLIENT_SECRET","expoPlugin","enableExpo","expo","basePath","keycloakProviderConfig","tokenUrl","userInfoUrl","mapProfileToUser","profile","_profile_email_verified","handle","preferred_username","sub","email","emailVerified","email_verified","keycloakPublicPath","pathname","replace","publicKeycloakBaseFor2","requestOrigin","hostname","keycloakPublicBase","keycloakPublicBase2","base","oauthPlugin","genericOAuth","config","keycloakSsoPlugin","plugins","database","DATABASE_URL","betterAuth","baseURL","SECRET","trustedOrigins","includes","map","cookieCache","enabled","maxAge","sessionMaxAge","strategy","refreshCache","storeStateStrategy","storeAccountCookie","auth","handler2","run","GET","POST","getSession","api","verifyAuth","Response"],"sources":["index.native.js"],"sourcesContent":["\"use strict\";\nvar __defProp = Object.defineProperty;\nvar __getOwnPropDesc = Object.getOwnPropertyDescriptor;\nvar __getOwnPropNames = Object.getOwnPropertyNames;\nvar __hasOwnProp = Object.prototype.hasOwnProperty;\nvar __export = (target, all) => {\n  for (var name in all)\n    __defProp(target, name, { get: all[name], enumerable: true });\n};\nvar __copyProps = (to, from, except, desc) => {\n  if (from && typeof from === \"object\" || typeof from === \"function\") {\n    for (let key of __getOwnPropNames(from))\n      if (!__hasOwnProp.call(to, key) && key !== except)\n        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });\n  }\n  return to;\n};\nvar __toCommonJS = (mod) => __copyProps(__defProp({}, \"__esModule\", { value: true }), mod);\nvar index_exports = {};\n__export(index_exports, {\n  ACCESS_TOKEN_RETRY_DELAYS_MS: () => import_accessTokenRefresh2.ACCESS_TOKEN_RETRY_DELAYS_MS,\n  FAILED_TO_GET_ACCESS_TOKEN: () => import_accessTokenRefresh2.FAILED_TO_GET_ACCESS_TOKEN,\n  TOKEN_REFRESH_UNAVAILABLE: () => import_accessTokenRefresh2.TOKEN_REFRESH_UNAVAILABLE,\n  classifyAccessTokenResponse: () => import_accessTokenRefresh2.classifyAccessTokenResponse,\n  createAuth: () => createAuth,\n  createAuthRouteHandler: () => createAuthRouteHandler,\n  createSessionHelpers: () => createSessionHelpers,\n  retryWhileTransient: () => import_accessTokenRefresh2.retryWhileTransient,\n  watchDocumentVisible: () => import_accessTokenRefresh2.watchDocumentVisible\n});\nmodule.exports = __toCommonJS(index_exports);\nvar import_async_hooks = require(\"async_hooks\");\nvar import_better_auth = require(\"better-auth\");\nvar import_api = require(\"better-auth/api\");\nvar import_cookies = require(\"better-auth/cookies\");\nvar import_plugins = require(\"better-auth/plugins\");\nvar import_expo = require(\"@better-auth/expo\");\nvar import_accessTokenRefresh = require(\"./accessTokenRefresh\");\nvar import_accessTokenRefresh2 = require(\"./accessTokenRefresh\");\nvar requestOriginStorage = new import_async_hooks.AsyncLocalStorage();\nfunction deriveRequestOrigin(req) {\n  var isDevHost = function isDevHost2(host) {\n    return DEV_LAN_HOST_PATTERNS.some(function(pattern) {\n      return (0, import_better_auth.matchesHostPattern)(host, pattern);\n    });\n  };\n  var forwardedHost = req.headers.get(\"x-forwarded-host\");\n  if (forwardedHost && isDevHost(forwardedHost)) {\n    var proto = req.headers.get(\"x-forwarded-proto\") === \"https\" ? \"https\" : \"http\";\n    return `${proto}://${forwardedHost}`;\n  }\n  for (var _i = 0, _iter = [\n    req.headers.get(\"origin\"),\n    req.url\n  ]; _i < _iter.length; _i++) {\n    var candidate = _iter[_i];\n    if (!candidate) continue;\n    try {\n      var url = new URL(candidate);\n      if (isDevHost(url.host)) return url.origin;\n    } catch (unused) {\n    }\n  }\n  return void 0;\n}\nvar DEV_LAN_HOST_PATTERNS = [\n  \"localhost\",\n  \"localhost:*\",\n  \"127.0.0.1\",\n  \"127.0.0.1:*\",\n  \"10.*\",\n  \"192.168.*\",\n  \"172.*\",\n  \"*.local\",\n  \"*.local:*\"\n];\nvar accessTokenBodySchema = import_api.getAccessToken.options.body;\nfunction acceptsAccessTokenBody(body) {\n  var _accessTokenBodySchema_safeParse;\n  return (accessTokenBodySchema === null || accessTokenBodySchema === void 0 ? void 0 : (_accessTokenBodySchema_safeParse = accessTokenBodySchema.safeParse) === null || _accessTokenBodySchema_safeParse === void 0 ? void 0 : _accessTokenBodySchema_safeParse.call(accessTokenBodySchema, body).success) !== false;\n}\nfunction createKeycloakSsoPlugin(options) {\n  var { realm, clientId, clientSecret, issuer, baseUrl, publicKeycloakBaseFor } = options;\n  var tokenEndpoint = `${issuer}/protocol/openid-connect/token`;\n  var resolveVisitorOrigin = function resolveVisitorOrigin2(request) {\n    var _requestOriginStorage_getStore;\n    return (_requestOriginStorage_getStore = requestOriginStorage.getStore()) !== null && _requestOriginStorage_getStore !== void 0 ? _requestOriginStorage_getStore : request ? deriveRequestOrigin(request) : void 0;\n  };\n  var isRefreshDefinitivelyDead = async function isRefreshDefinitivelyDead2(refreshToken) {\n    try {\n      var res = await fetch(tokenEndpoint, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/x-www-form-urlencoded\"\n        },\n        body: new URLSearchParams({\n          grant_type: \"refresh_token\",\n          refresh_token: refreshToken,\n          client_id: clientId,\n          client_secret: clientSecret\n        }),\n        signal: AbortSignal.timeout(5e3)\n      });\n      if (res.ok) return false;\n      if (res.status !== 400 && res.status !== 401) return false;\n      var body = await res.json().catch(function() {\n        return null;\n      });\n      return (body === null || body === void 0 ? void 0 : body.error) === \"invalid_grant\" || (body === null || body === void 0 ? void 0 : body.error) === \"invalid_token\";\n    } catch (unused) {\n      return false;\n    }\n  };\n  var signOutSso = (0, import_api.createAuthEndpoint)(\"/sign-out/sso\", {\n    method: \"GET\"\n  }, async function(ctx) {\n    var _resolveVisitorOrigin, _ref;\n    var visitorOrigin = (_resolveVisitorOrigin = resolveVisitorOrigin(ctx.request)) !== null && _resolveVisitorOrigin !== void 0 ? _resolveVisitorOrigin : baseUrl;\n    var searchParams = ctx.request ? new URL(ctx.request.url).searchParams : void 0;\n    var rawCallback = (_ref = searchParams === null || searchParams === void 0 ? void 0 : searchParams.get(\"callbackURL\")) !== null && _ref !== void 0 ? _ref : null;\n    var jsonMode = (searchParams === null || searchParams === void 0 ? void 0 : searchParams.get(\"mode\")) === \"json\";\n    var answer = function answer2(url, redirect) {\n      if (jsonMode) return ctx.json({\n        redirect,\n        url\n      });\n      throw ctx.redirect(url);\n    };\n    var callbackURL = rawCallback || \"/\";\n    var postLogoutRedirect = callbackURL.startsWith(\"/\") ? `${visitorOrigin}${callbackURL}` : callbackURL;\n    var idTokenHint;\n    var sessionToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);\n    var session = await (0, import_api.getSessionFromCtx)(ctx).catch(function() {\n      return null;\n    });\n    if (session) {\n      var _ref1;\n      var _accounts_find;\n      var accounts = await ctx.context.internalAdapter.findAccounts(session.user.id).catch(function() {\n        return [];\n      });\n      idTokenHint = (_ref1 = (_accounts_find = accounts.find(function(account) {\n        return account.providerId === \"keycloak\";\n      })) === null || _accounts_find === void 0 ? void 0 : _accounts_find.idToken) !== null && _ref1 !== void 0 ? _ref1 : void 0;\n    }\n    if (!idTokenHint) {\n      var accountCookie = await (0, import_cookies.getAccountCookie)(ctx).catch(function() {\n        return null;\n      });\n      if ((accountCookie === null || accountCookie === void 0 ? void 0 : accountCookie.providerId) === \"keycloak\" && accountCookie.idToken) {\n        idTokenHint = accountCookie.idToken;\n      }\n    }\n    if (sessionToken) {\n      await ctx.context.internalAdapter.deleteSession(sessionToken).catch(function(error) {\n        ctx.context.logger.error(\"Failed to delete session during SSO sign-out\", error);\n      });\n    }\n    (0, import_cookies.deleteSessionCookie)(ctx);\n    var keycloakBase = publicKeycloakBaseFor(visitorOrigin);\n    if (!keycloakBase || !session && !idTokenHint && !sessionToken) {\n      return answer(postLogoutRedirect, false);\n    }\n    var endSession = new URL(`${keycloakBase}/realms/${realm}/protocol/openid-connect/logout`);\n    endSession.searchParams.set(\"post_logout_redirect_uri\", postLogoutRedirect);\n    endSession.searchParams.set(\"client_id\", clientId);\n    if (idTokenHint) endSession.searchParams.set(\"id_token_hint\", idTokenHint);\n    return answer(endSession.toString(), true);\n  });\n  return {\n    id: \"keycloak-sso\",\n    endpoints: {\n      signOutSso\n    },\n    hooks: {\n      before: [\n        {\n          // Signed out is the expected answer on every anonymous page load,\n          // so it is a 200 with no token, as /get-session answers, instead\n          // of a 4xx the browser logs. Runs before body validation, so the\n          // client's body-shape negotiation never 400s for a visitor either.\n          // A signed-in >=1.7 body (`useAccountCookie`) on a server whose\n          // schema still demands `providerId` gets the Keycloak provider\n          // added, so the negotiation never 400s once signed in either.\n          matcher: function matcher(ctx) {\n            return ctx.path === \"/get-access-token\";\n          },\n          handler: (0, import_api.createAuthMiddleware)(async function(ctx) {\n            var session = await (0, import_api.getSessionFromCtx)(ctx).catch(function() {\n              return null;\n            });\n            if (!session) return ctx.json(null);\n            var body = ctx.body;\n            if ((body === null || body === void 0 ? void 0 : body.useAccountCookie) !== true || acceptsAccessTokenBody(body)) return;\n            var legacy = {\n              ...body,\n              providerId: \"keycloak\"\n            };\n            if (acceptsAccessTokenBody(legacy)) return {\n              context: {\n                body: legacy\n              }\n            };\n          })\n        }\n      ],\n      after: [\n        {\n          matcher: function matcher(ctx) {\n            return ctx.path === \"/get-access-token\";\n          },\n          handler: (0, import_api.createAuthMiddleware)(async function(ctx) {\n            var _ctx_body, _accounts_find;\n            var returned = ctx.context.returned;\n            if (!(0, import_api.isAPIError)(returned)) return;\n            var body = returned.body;\n            if ((body === null || body === void 0 ? void 0 : body.code) !== import_accessTokenRefresh.FAILED_TO_GET_ACCESS_TOKEN) return;\n            var providerId = (_ctx_body = ctx.body) === null || _ctx_body === void 0 ? void 0 : _ctx_body.providerId;\n            if (providerId && providerId !== \"keycloak\") return;\n            var session = await (0, import_api.getSessionFromCtx)(ctx).catch(function() {\n              return null;\n            });\n            if (!session) return;\n            var accounts = await ctx.context.internalAdapter.findAccounts(session.user.id).catch(function() {\n              return [];\n            });\n            var refreshToken = (_accounts_find = accounts.find(function(account) {\n              return account.providerId === \"keycloak\";\n            })) === null || _accounts_find === void 0 ? void 0 : _accounts_find.refreshToken;\n            if (!refreshToken) {\n              var accountCookie = await (0, import_cookies.getAccountCookie)(ctx).catch(function() {\n                return null;\n              });\n              if ((accountCookie === null || accountCookie === void 0 ? void 0 : accountCookie.providerId) === \"keycloak\") {\n                refreshToken = accountCookie.refreshToken;\n              }\n            }\n            var definitive = refreshToken ? await isRefreshDefinitivelyDead(refreshToken) : true;\n            if (!definitive) {\n              return new import_api.APIError(\"INTERNAL_SERVER_ERROR\", {\n                message: \"Keycloak token refresh temporarily unavailable\",\n                code: import_accessTokenRefresh.TOKEN_REFRESH_UNAVAILABLE\n              });\n            }\n            ctx.context.logger.warn(\"Keycloak refresh token is dead (invalid_grant); revoking the stale Better Auth session\");\n            var sessionToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);\n            if (sessionToken) {\n              await ctx.context.internalAdapter.deleteSession(sessionToken).catch(function(error) {\n                ctx.context.logger.error(\"Failed to delete stale session\", error);\n              });\n            }\n            (0, import_cookies.deleteSessionCookie)(ctx);\n            var headers = new Headers();\n            var accumulated = ctx.responseHeaders;\n            accumulated === null || accumulated === void 0 ? void 0 : accumulated.getSetCookie().forEach(function(cookie) {\n              headers.append(\"set-cookie\", cookie);\n            });\n            return new import_api.APIError(\"BAD_REQUEST\", {\n              message: (body === null || body === void 0 ? void 0 : body.message) || \"Failed to get a valid access token\",\n              code: import_accessTokenRefresh.FAILED_TO_GET_ACCESS_TOKEN\n            }, headers);\n          })\n        }\n      ]\n    }\n  };\n}\nfunction runtimeEnv() {\n  return typeof process === \"undefined\" ? {} : process.env;\n}\nfunction createAuth() {\n  var options = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};\n  var _options_plugins, _options_database, _options_sessionMaxAge;\n  var _options_keycloak, _options_keycloak1, _options_keycloak2, _options_keycloak3;\n  var env = runtimeEnv();\n  var baseUrl = options.baseUrl || env.BASE_URL || `http://localhost:${env.ONE_PORT || \"3000\"}`;\n  var isProduction = process.env.NODE_ENV === \"production\";\n  var keycloakBaseUrl = ((_options_keycloak = options.keycloak) === null || _options_keycloak === void 0 ? void 0 : _options_keycloak.baseUrl) || env.KEYCLOAK_BACKCHANNEL_URL || `${baseUrl}/auth`;\n  var keycloakRealm = ((_options_keycloak1 = options.keycloak) === null || _options_keycloak1 === void 0 ? void 0 : _options_keycloak1.realm) || env.KEYCLOAK_REALM || \"master\";\n  var issuer = `${keycloakBaseUrl}/realms/${keycloakRealm}`;\n  var keycloakClientId = ((_options_keycloak2 = options.keycloak) === null || _options_keycloak2 === void 0 ? void 0 : _options_keycloak2.clientId) || env.KEYCLOAK_CLIENT_ID || \"\";\n  var keycloakClientSecret = ((_options_keycloak3 = options.keycloak) === null || _options_keycloak3 === void 0 ? void 0 : _options_keycloak3.clientSecret) || env.KEYCLOAK_CLIENT_SECRET || \"\";\n  var expoPlugin = options.enableExpo !== false ? (0, import_expo.expo)() : void 0;\n  var basePath = options.basePath || \"/api/auth\";\n  var keycloakProviderConfig = {\n    ...(0, import_plugins.keycloak)({\n      clientId: keycloakClientId,\n      clientSecret: keycloakClientSecret,\n      issuer\n    }),\n    // Backchannel token/userinfo: `/get-access-token` refresh keeps these\n    // when discovery fails (Keycloak restart), so we don't depend on the\n    // well-known document coming up in the same instant as the token\n    // endpoint. Browser-facing authorize/issuer stay on the public /auth\n    // proxy (getters below).\n    tokenUrl: `${issuer}/protocol/openid-connect/token`,\n    userInfoUrl: `${issuer}/protocol/openid-connect/userinfo`,\n    // Wallet (SIWE-style) users authenticate by signature and have NO email —\n    // Keycloak issues them a username = wallet address and no email claim.\n    // better-auth's genericOAuth callback hard-rejects a user with no email\n    // (\"email_is_missing\"), so synthesize a stable, unique placeholder from the\n    // wallet address / subject. `.wallet` is a non-routable placeholder domain;\n    // the address stays the stable identity.\n    mapProfileToUser: function mapProfileToUser(profile) {\n      var _profile_email_verified;\n      var handle = profile.preferred_username || profile.sub || profile.id || profile.name;\n      var email = profile.email || (handle ? `${handle}@wallet` : void 0);\n      return {\n        ...profile,\n        email,\n        emailVerified: (_profile_email_verified = profile.email_verified) !== null && _profile_email_verified !== void 0 ? _profile_email_verified : true,\n        name: profile.name || handle\n      };\n    }\n  };\n  var keycloakPublicPath = (function() {\n    try {\n      var path = new URL(keycloakBaseUrl).pathname.replace(/\\/+$/, \"\");\n      return path && path !== \"/\" ? path : void 0;\n    } catch (unused) {\n      return void 0;\n    }\n  })();\n  var publicKeycloakBaseFor = function publicKeycloakBaseFor2(requestOrigin) {\n    if (!keycloakPublicPath) return keycloakBaseUrl;\n    try {\n      var url = new URL(baseUrl);\n      if (!isProduction && requestOrigin) {\n        url.hostname = new URL(requestOrigin).hostname;\n      }\n      return `${url.origin}${keycloakPublicPath}`;\n    } catch (unused) {\n      return void 0;\n    }\n  };\n  if (!isProduction) {\n    Object.defineProperty(keycloakProviderConfig, \"redirectURI\", {\n      enumerable: true,\n      get() {\n        var origin = requestOriginStorage.getStore();\n        return origin ? `${origin}${basePath}/oauth2/callback/keycloak` : void 0;\n      }\n    });\n    var keycloakPublicBase = function keycloakPublicBase2() {\n      var origin = requestOriginStorage.getStore();\n      if (!origin || !keycloakPublicPath) return void 0;\n      return publicKeycloakBaseFor(origin);\n    };\n    if (keycloakPublicPath) {\n      Object.defineProperty(keycloakProviderConfig, \"authorizationUrl\", {\n        enumerable: true,\n        get() {\n          var base = keycloakPublicBase();\n          return base ? `${base}/realms/${keycloakRealm}/protocol/openid-connect/auth` : void 0;\n        }\n      });\n      Object.defineProperty(keycloakProviderConfig, \"issuer\", {\n        enumerable: true,\n        get() {\n          var base = keycloakPublicBase();\n          return base ? `${base}/realms/${keycloakRealm}` : void 0;\n        }\n      });\n    }\n  }\n  var oauthPlugin = (0, import_plugins.genericOAuth)({\n    config: [\n      keycloakProviderConfig\n    ]\n  });\n  var keycloakSsoPlugin = createKeycloakSsoPlugin({\n    realm: keycloakRealm,\n    clientId: keycloakClientId,\n    clientSecret: keycloakClientSecret,\n    issuer,\n    baseUrl,\n    publicKeycloakBaseFor\n  });\n  var plugins = [\n    ...expoPlugin ? [\n      expoPlugin\n    ] : [],\n    oauthPlugin,\n    keycloakSsoPlugin,\n    ...(_options_plugins = options.plugins) !== null && _options_plugins !== void 0 ? _options_plugins : []\n  ];\n  var database = (_options_database = options.database) !== null && _options_database !== void 0 ? _options_database : env.DATABASE_URL || void 0;\n  return (0, import_better_auth.betterAuth)({\n    basePath,\n    // Static on purpose: better-auth's dynamic `baseURL` config (allowedHosts)\n    // is not honored by the genericOAuth plugin — it pins redirect URIs at\n    // init time, which turned them relative and bounced callbacks to the\n    // Keycloak host. Dev multi-host support comes from the per-request\n    // redirectURI getter above + the LAN trustedOrigins below instead.\n    baseURL: baseUrl,\n    ...database ? {\n      database\n    } : {},\n    secret: options.secret || env.SECRET || \"\",\n    trustedOrigins: options.trustedOrigins || [\n      baseUrl,\n      keycloakBaseUrl,\n      // In dev, ONE_PORT may differ from BASE_URL; ensure the dev server origin is trusted.\n      ...env.ONE_PORT && !baseUrl.includes(`:${env.ONE_PORT}`) ? [\n        `http://localhost:${env.ONE_PORT}`\n      ] : [],\n      \"multiplatform-one://\",\n      // Expo Go (dev) receives OAuth returns on the exp:// scheme — the app\n      // derives its callbackURL via Linking.createURL, which yields\n      // exp://<host>:<port>/--/ there. Never trusted in production builds.\n      // Dev also trusts private-network origins (see DEV_LAN_HOST_PATTERNS)\n      // so sign-in from a phone / the machine's LAN IP is not rejected.\n      ...isProduction ? [] : [\n        \"exp://\",\n        ...DEV_LAN_HOST_PATTERNS.map(function(host) {\n          return `http://${host}`;\n        })\n      ]\n    ],\n    session: {\n      cookieCache: {\n        enabled: true,\n        maxAge: (_options_sessionMaxAge = options.sessionMaxAge) !== null && _options_sessionMaxAge !== void 0 ? _options_sessionMaxAge : 7 * 24 * 60 * 60,\n        strategy: \"jwe\",\n        refreshCache: true\n      }\n    },\n    account: {\n      storeStateStrategy: \"cookie\",\n      storeAccountCookie: true\n    },\n    plugins\n  });\n}\nfunction createAuthRouteHandler(auth) {\n  var handler = function handler2(req) {\n    var origin = deriveRequestOrigin(req);\n    return origin ? requestOriginStorage.run(origin, function() {\n      return auth.handler(req);\n    }) : auth.handler(req);\n  };\n  return {\n    GET: handler,\n    POST: handler\n  };\n}\nfunction createSessionHelpers(auth) {\n  async function getSession(req) {\n    return auth.api.getSession({\n      headers: req.headers\n    });\n  }\n  async function verifyAuth(req) {\n    var session = await auth.api.getSession({\n      headers: req.headers\n    });\n    if (!session) {\n      throw new Response(\"Unauthorized\", {\n        status: 401\n      });\n    }\n    return session;\n  }\n  return {\n    verifyAuth,\n    getSession\n  };\n}\n//# sourceMappingURL=index.js.map\n"],"mappings":"AAAA,YAAY;;AACZ,IAAIA,SAAS,GAAGC,MAAM,CAACC,cAAc;AACrC,IAAIC,gBAAgB,GAAGF,MAAM,CAACG,wBAAwB;AACtD,IAAIC,iBAAiB,GAAGJ,MAAM,CAACK,mBAAmB;AAClD,IAAIC,YAAY,GAAGN,MAAM,CAACO,SAAS,CAACC,cAAc;AAClD,IAAIC,QAAQ,GAAGA,CAACC,MAAM,EAAEC,GAAG,KAAK;EAC9B,KAAK,IAAIC,IAAI,IAAID,GAAG,EAClBZ,SAAS,CAACW,MAAM,EAAEE,IAAI,EAAE;IAAEC,GAAG,EAAEF,GAAG,CAACC,IAAI,CAAC;IAAEE,UAAU,EAAE;EAAK,CAAC,CAAC;AACjE,CAAC;AACD,IAAIC,WAAW,GAAGA,CAACC,EAAE,EAAEC,IAAI,EAAEC,MAAM,EAAEC,IAAI,KAAK;EAC5C,IAAIF,IAAI,IAAI,OAAOA,IAAI,KAAK,QAAQ,IAAI,OAAOA,IAAI,KAAK,UAAU,EAAE;IAClE,KAAK,IAAIG,GAAG,IAAIhB,iBAAiB,CAACa,IAAI,CAAC,EACrC,IAAI,CAACX,YAAY,CAACe,IAAI,CAACL,EAAE,EAAEI,GAAG,CAAC,IAAIA,GAAG,KAAKF,MAAM,EAC/CnB,SAAS,CAACiB,EAAE,EAAEI,GAAG,EAAE;MAAEP,GAAG,EAAEA,CAAA,KAAMI,IAAI,CAACG,GAAG,CAAC;MAAEN,UAAU,EAAE,EAAEK,IAAI,GAAGjB,gBAAgB,CAACe,IAAI,EAAEG,GAAG,CAAC,CAAC,IAAID,IAAI,CAACL;IAAW,CAAC,CAAC;EACxH;EACA,OAAOE,EAAE;AACX,CAAC;AACD,IAAIM,YAAY,GAAIC,GAAG,IAAKR,WAAW,CAAChB,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE;EAAEyB,KAAK,EAAE;AAAK,CAAC,CAAC,EAAED,GAAG,CAAC;AAC1F,IAAIE,aAAa,GAAG,CAAC,CAAC;AACtBhB,QAAQ,CAACgB,aAAa,EAAE;EACtBC,4BAA4B,EAAEA,CAAA,KAAMC,0BAA0B,CAACD,4BAA4B;EAC3FE,0BAA0B,EAAEA,CAAA,KAAMD,0BAA0B,CAACC,0BAA0B;EACvFC,yBAAyB,EAAEA,CAAA,KAAMF,0BAA0B,CAACE,yBAAyB;EACrFC,2BAA2B,EAAEA,CAAA,KAAMH,0BAA0B,CAACG,2BAA2B;EACzFC,UAAU,EAAEA,CAAA,KAAMA,UAAU;EAC5BC,sBAAsB,EAAEA,CAAA,KAAMA,sBAAsB;EACpDC,oBAAoB,EAAEA,CAAA,KAAMA,oBAAoB;EAChDC,mBAAmB,EAAEA,CAAA,KAAMP,0BAA0B,CAACO,mBAAmB;EACzEC,oBAAoB,EAAEA,CAAA,KAAMR,0BAA0B,CAACQ;AACzD,CAAC,CAAC;AACFC,MAAM,CAACC,OAAO,GAAGf,YAAY,CAACG,aAAa,CAAC;AAC5C,IAAIa,kBAAkB,GAAGC,OAAO,CAAC,aAAa,CAAC;AAC/C,IAAIC,kBAAkB,GAAGD,OAAO,CAAC,aAAa,CAAC;AAC/C,IAAIE,UAAU,GAAGF,OAAO,CAAC,iBAAiB,CAAC;AAC3C,IAAIG,cAAc,GAAGH,OAAO,CAAC,qBAAqB,CAAC;AACnD,IAAII,cAAc,GAAGJ,OAAO,CAAC,qBAAqB,CAAC;AACnD,IAAIK,WAAW,GAAGL,OAAO,CAAC,mBAAmB,CAAC;AAC9C,IAAIM,yBAAyB,GAAGN,OAAO,CAAC,gCAAsB,CAAC;AAC/D,IAAIZ,0BAA0B,GAAGY,OAAO,CAAC,gCAAsB,CAAC;AAChE,IAAIO,oBAAoB,GAAG,IAAIR,kBAAkB,CAACS,iBAAiB,CAAC,CAAC;AACrE,SAASC,mBAAmBA,CAACC,GAAG,EAAE;EAChC,IAAIC,SAAS,GAAG,SAASC,UAAUA,CAACC,IAAI,EAAE;IACxC,OAAOC,qBAAqB,CAACC,IAAI,CAAC,UAASC,OAAO,EAAE;MAClD,OAAO,CAAC,CAAC,EAAEf,kBAAkB,CAACgB,kBAAkB,EAAEJ,IAAI,EAAEG,OAAO,CAAC;IAClE,CAAC,CAAC;EACJ,CAAC;EACD,IAAIE,aAAa,GAAGR,GAAG,CAACS,OAAO,CAAC7C,GAAG,CAAC,kBAAkB,CAAC;EACvD,IAAI4C,aAAa,IAAIP,SAAS,CAACO,aAAa,CAAC,EAAE;IAC7C,IAAIE,KAAK,GAAGV,GAAG,CAACS,OAAO,CAAC7C,GAAG,CAAC,mBAAmB,CAAC,KAAK,OAAO,GAAG,OAAO,GAAG,MAAM;IAC/E,OAAO,GAAG8C,KAAK,MAAMF,aAAa,EAAE;EACtC;EACA,KAAK,IAAIG,EAAE,GAAG,CAAC,EAAEC,KAAK,GAAG,CACvBZ,GAAG,CAACS,OAAO,CAAC7C,GAAG,CAAC,QAAQ,CAAC,EACzBoC,GAAG,CAACa,GAAG,CACR,EAAEF,EAAE,GAAGC,KAAK,CAACE,MAAM,EAAEH,EAAE,EAAE,EAAE;IAC1B,IAAII,SAAS,GAAGH,KAAK,CAACD,EAAE,CAAC;IACzB,IAAI,CAACI,SAAS,EAAE;IAChB,IAAI;MACF,IAAIF,GAAG,GAAG,IAAIG,GAAG,CAACD,SAAS,CAAC;MAC5B,IAAId,SAAS,CAACY,GAAG,CAACV,IAAI,CAAC,EAAE,OAAOU,GAAG,CAACI,MAAM;IAC5C,CAAC,CAAC,OAAOC,MAAM,EAAE,CACjB;EACF;EACA,OAAO,KAAK,CAAC;AACf;AACA,IAAId,qBAAqB,GAAG,CAC1B,WAAW,EACX,aAAa,EACb,WAAW,EACX,aAAa,EACb,MAAM,EACN,WAAW,EACX,OAAO,EACP,SAAS,EACT,WAAW,CACZ;AACD,IAAIe,qBAAqB,GAAG3B,UAAU,CAAC4B,cAAc,CAACC,OAAO,CAACC,IAAI;AAClE,SAASC,sBAAsBA,CAACD,IAAI,EAAE;EACpC,IAAIE,gCAAgC;EACpC,OAAO,CAACL,qBAAqB,KAAK,IAAI,IAAIA,qBAAqB,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAACK,gCAAgC,GAAGL,qBAAqB,CAACM,SAAS,MAAM,IAAI,IAAID,gCAAgC,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,gCAAgC,CAACpD,IAAI,CAAC+C,qBAAqB,EAAEG,IAAI,CAAC,CAACI,OAAO,MAAM,KAAK;AACrT;AACA,SAASC,uBAAuBA,CAACN,OAAO,EAAE;EACxC,IAAI;IAAEO,KAAK;IAAEC,QAAQ;IAAEC,YAAY;IAAEC,MAAM;IAAEC,OAAO;IAAEC;EAAsB,CAAC,GAAGZ,OAAO;EACvF,IAAIa,aAAa,GAAG,GAAGH,MAAM,gCAAgC;EAC7D,IAAII,oBAAoB,GAAG,SAASC,qBAAqBA,CAACC,OAAO,EAAE;IACjE,IAAIC,8BAA8B;IAClC,OAAO,CAACA,8BAA8B,GAAGzC,oBAAoB,CAAC0C,QAAQ,CAAC,CAAC,MAAM,IAAI,IAAID,8BAA8B,KAAK,KAAK,CAAC,GAAGA,8BAA8B,GAAGD,OAAO,GAAGtC,mBAAmB,CAACsC,OAAO,CAAC,GAAG,KAAK,CAAC;EACpN,CAAC;EACD,IAAIG,yBAAyB,GAAG,eAAeC,0BAA0BA,CAACC,YAAY,EAAE;IACtF,IAAI;MACF,IAAIC,GAAG,GAAG,MAAMC,KAAK,CAACV,aAAa,EAAE;QACnCW,MAAM,EAAE,MAAM;QACdpC,OAAO,EAAE;UACP,cAAc,EAAE;QAClB,CAAC;QACDa,IAAI,EAAE,IAAIwB,eAAe,CAAC;UACxBC,UAAU,EAAE,eAAe;UAC3BC,aAAa,EAAEN,YAAY;UAC3BO,SAAS,EAAEpB,QAAQ;UACnBqB,aAAa,EAAEpB;QACjB,CAAC,CAAC;QACFqB,MAAM,EAAEC,WAAW,CAACC,OAAO,CAAC,GAAG;MACjC,CAAC,CAAC;MACF,IAAIV,GAAG,CAACW,EAAE,EAAE,OAAO,KAAK;MACxB,IAAIX,GAAG,CAACY,MAAM,KAAK,GAAG,IAAIZ,GAAG,CAACY,MAAM,KAAK,GAAG,EAAE,OAAO,KAAK;MAC1D,IAAIjC,IAAI,GAAG,MAAMqB,GAAG,CAACa,IAAI,CAAC,CAAC,CAACC,KAAK,CAAC,YAAW;QAC3C,OAAO,IAAI;MACb,CAAC,CAAC;MACF,OAAO,CAACnC,IAAI,KAAK,IAAI,IAAIA,IAAI,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,IAAI,CAACoC,KAAK,MAAM,eAAe,IAAI,CAACpC,IAAI,KAAK,IAAI,IAAIA,IAAI,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,IAAI,CAACoC,KAAK,MAAM,eAAe;IACrK,CAAC,CAAC,OAAOxC,MAAM,EAAE;MACf,OAAO,KAAK;IACd;EACF,CAAC;EACD,IAAIyC,UAAU,GAAG,CAAC,CAAC,EAAEnE,UAAU,CAACoE,kBAAkB,EAAE,eAAe,EAAE;IACnEf,MAAM,EAAE;EACV,CAAC,EAAE,gBAAegB,GAAG,EAAE;IACrB,IAAIC,qBAAqB,EAAEC,IAAI;IAC/B,IAAIC,aAAa,GAAG,CAACF,qBAAqB,GAAG3B,oBAAoB,CAAC0B,GAAG,CAACxB,OAAO,CAAC,MAAM,IAAI,IAAIyB,qBAAqB,KAAK,KAAK,CAAC,GAAGA,qBAAqB,GAAG9B,OAAO;IAC9J,IAAIiC,YAAY,GAAGJ,GAAG,CAACxB,OAAO,GAAG,IAAIrB,GAAG,CAAC6C,GAAG,CAACxB,OAAO,CAACxB,GAAG,CAAC,CAACoD,YAAY,GAAG,KAAK,CAAC;IAC/E,IAAIC,WAAW,GAAG,CAACH,IAAI,GAAGE,YAAY,KAAK,IAAI,IAAIA,YAAY,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,YAAY,CAACrG,GAAG,CAAC,aAAa,CAAC,MAAM,IAAI,IAAImG,IAAI,KAAK,KAAK,CAAC,GAAGA,IAAI,GAAG,IAAI;IAChK,IAAII,QAAQ,GAAG,CAACF,YAAY,KAAK,IAAI,IAAIA,YAAY,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,YAAY,CAACrG,GAAG,CAAC,MAAM,CAAC,MAAM,MAAM;IAChH,IAAIwG,MAAM,GAAG,SAASC,OAAOA,CAACxD,GAAG,EAAEyD,QAAQ,EAAE;MAC3C,IAAIH,QAAQ,EAAE,OAAON,GAAG,CAACL,IAAI,CAAC;QAC5Bc,QAAQ;QACRzD;MACF,CAAC,CAAC;MACF,MAAMgD,GAAG,CAACS,QAAQ,CAACzD,GAAG,CAAC;IACzB,CAAC;IACD,IAAI0D,WAAW,GAAGL,WAAW,IAAI,GAAG;IACpC,IAAIM,kBAAkB,GAAGD,WAAW,CAACE,UAAU,CAAC,GAAG,CAAC,GAAG,GAAGT,aAAa,GAAGO,WAAW,EAAE,GAAGA,WAAW;IACrG,IAAIG,WAAW;IACf,IAAIC,YAAY,GAAG,MAAMd,GAAG,CAACe,eAAe,CAACf,GAAG,CAACgB,OAAO,CAACC,WAAW,CAACH,YAAY,CAAChH,IAAI,EAAEkG,GAAG,CAACgB,OAAO,CAACE,MAAM,CAAC;IAC3G,IAAIC,OAAO,GAAG,MAAM,CAAC,CAAC,EAAExF,UAAU,CAACyF,iBAAiB,EAAEpB,GAAG,CAAC,CAACJ,KAAK,CAAC,YAAW;MAC1E,OAAO,IAAI;IACb,CAAC,CAAC;IACF,IAAIuB,OAAO,EAAE;MACX,IAAIE,KAAK;MACT,IAAIC,cAAc;MAClB,IAAIC,QAAQ,GAAG,MAAMvB,GAAG,CAACgB,OAAO,CAACQ,eAAe,CAACC,YAAY,CAACN,OAAO,CAACO,IAAI,CAACC,EAAE,CAAC,CAAC/B,KAAK,CAAC,YAAW;QAC9F,OAAO,EAAE;MACX,CAAC,CAAC;MACFiB,WAAW,GAAG,CAACQ,KAAK,GAAG,CAACC,cAAc,GAAGC,QAAQ,CAACK,IAAI,CAAC,UAASC,OAAO,EAAE;QACvE,OAAOA,OAAO,CAACC,UAAU,KAAK,UAAU;MAC1C,CAAC,CAAC,MAAM,IAAI,IAAIR,cAAc,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,cAAc,CAACS,OAAO,MAAM,IAAI,IAAIV,KAAK,KAAK,KAAK,CAAC,GAAGA,KAAK,GAAG,KAAK,CAAC;IAC5H;IACA,IAAI,CAACR,WAAW,EAAE;MAChB,IAAImB,aAAa,GAAG,MAAM,CAAC,CAAC,EAAEpG,cAAc,CAACqG,gBAAgB,EAAEjC,GAAG,CAAC,CAACJ,KAAK,CAAC,YAAW;QACnF,OAAO,IAAI;MACb,CAAC,CAAC;MACF,IAAI,CAACoC,aAAa,KAAK,IAAI,IAAIA,aAAa,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,aAAa,CAACF,UAAU,MAAM,UAAU,IAAIE,aAAa,CAACD,OAAO,EAAE;QACpIlB,WAAW,GAAGmB,aAAa,CAACD,OAAO;MACrC;IACF;IACA,IAAIjB,YAAY,EAAE;MAChB,MAAMd,GAAG,CAACgB,OAAO,CAACQ,eAAe,CAACU,aAAa,CAACpB,YAAY,CAAC,CAAClB,KAAK,CAAC,UAASC,KAAK,EAAE;QAClFG,GAAG,CAACgB,OAAO,CAACmB,MAAM,CAACtC,KAAK,CAAC,8CAA8C,EAAEA,KAAK,CAAC;MACjF,CAAC,CAAC;IACJ;IACA,CAAC,CAAC,EAAEjE,cAAc,CAACwG,mBAAmB,EAAEpC,GAAG,CAAC;IAC5C,IAAIqC,YAAY,GAAGjE,qBAAqB,CAAC+B,aAAa,CAAC;IACvD,IAAI,CAACkC,YAAY,IAAI,CAAClB,OAAO,IAAI,CAACN,WAAW,IAAI,CAACC,YAAY,EAAE;MAC9D,OAAOP,MAAM,CAACI,kBAAkB,EAAE,KAAK,CAAC;IAC1C;IACA,IAAI2B,UAAU,GAAG,IAAInF,GAAG,CAAC,GAAGkF,YAAY,WAAWtE,KAAK,iCAAiC,CAAC;IAC1FuE,UAAU,CAAClC,YAAY,CAACmC,GAAG,CAAC,0BAA0B,EAAE5B,kBAAkB,CAAC;IAC3E2B,UAAU,CAAClC,YAAY,CAACmC,GAAG,CAAC,WAAW,EAAEvE,QAAQ,CAAC;IAClD,IAAI6C,WAAW,EAAEyB,UAAU,CAAClC,YAAY,CAACmC,GAAG,CAAC,eAAe,EAAE1B,WAAW,CAAC;IAC1E,OAAON,MAAM,CAAC+B,UAAU,CAACE,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC;EAC5C,CAAC,CAAC;EACF,OAAO;IACLb,EAAE,EAAE,cAAc;IAClBc,SAAS,EAAE;MACT3C;IACF,CAAC;IACD4C,KAAK,EAAE;MACLC,MAAM,EAAE,CACN;QACE;QACA;QACA;QACA;QACA;QACA;QACA;QACAC,OAAO,EAAE,SAASA,OAAOA,CAAC5C,GAAG,EAAE;UAC7B,OAAOA,GAAG,CAAC6C,IAAI,KAAK,mBAAmB;QACzC,CAAC;QACDC,OAAO,EAAE,CAAC,CAAC,EAAEnH,UAAU,CAACoH,oBAAoB,EAAE,gBAAe/C,GAAG,EAAE;UAChE,IAAImB,OAAO,GAAG,MAAM,CAAC,CAAC,EAAExF,UAAU,CAACyF,iBAAiB,EAAEpB,GAAG,CAAC,CAACJ,KAAK,CAAC,YAAW;YAC1E,OAAO,IAAI;UACb,CAAC,CAAC;UACF,IAAI,CAACuB,OAAO,EAAE,OAAOnB,GAAG,CAACL,IAAI,CAAC,IAAI,CAAC;UACnC,IAAIlC,IAAI,GAAGuC,GAAG,CAACvC,IAAI;UACnB,IAAI,CAACA,IAAI,KAAK,IAAI,IAAIA,IAAI,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,IAAI,CAACuF,gBAAgB,MAAM,IAAI,IAAItF,sBAAsB,CAACD,IAAI,CAAC,EAAE;UAClH,IAAIwF,MAAM,GAAG;YACX,GAAGxF,IAAI;YACPqE,UAAU,EAAE;UACd,CAAC;UACD,IAAIpE,sBAAsB,CAACuF,MAAM,CAAC,EAAE,OAAO;YACzCjC,OAAO,EAAE;cACPvD,IAAI,EAAEwF;YACR;UACF,CAAC;QACH,CAAC;MACH,CAAC,CACF;MACDC,KAAK,EAAE,CACL;QACEN,OAAO,EAAE,SAASA,OAAOA,CAAC5C,GAAG,EAAE;UAC7B,OAAOA,GAAG,CAAC6C,IAAI,KAAK,mBAAmB;QACzC,CAAC;QACDC,OAAO,EAAE,CAAC,CAAC,EAAEnH,UAAU,CAACoH,oBAAoB,EAAE,gBAAe/C,GAAG,EAAE;UAChE,IAAImD,SAAS,EAAE7B,cAAc;UAC7B,IAAI8B,QAAQ,GAAGpD,GAAG,CAACgB,OAAO,CAACoC,QAAQ;UACnC,IAAI,CAAC,CAAC,CAAC,EAAEzH,UAAU,CAAC0H,UAAU,EAAED,QAAQ,CAAC,EAAE;UAC3C,IAAI3F,IAAI,GAAG2F,QAAQ,CAAC3F,IAAI;UACxB,IAAI,CAACA,IAAI,KAAK,IAAI,IAAIA,IAAI,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,IAAI,CAAC6F,IAAI,MAAMvH,yBAAyB,CAACjB,0BAA0B,EAAE;UACtH,IAAIgH,UAAU,GAAG,CAACqB,SAAS,GAAGnD,GAAG,CAACvC,IAAI,MAAM,IAAI,IAAI0F,SAAS,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,SAAS,CAACrB,UAAU;UACxG,IAAIA,UAAU,IAAIA,UAAU,KAAK,UAAU,EAAE;UAC7C,IAAIX,OAAO,GAAG,MAAM,CAAC,CAAC,EAAExF,UAAU,CAACyF,iBAAiB,EAAEpB,GAAG,CAAC,CAACJ,KAAK,CAAC,YAAW;YAC1E,OAAO,IAAI;UACb,CAAC,CAAC;UACF,IAAI,CAACuB,OAAO,EAAE;UACd,IAAII,QAAQ,GAAG,MAAMvB,GAAG,CAACgB,OAAO,CAACQ,eAAe,CAACC,YAAY,CAACN,OAAO,CAACO,IAAI,CAACC,EAAE,CAAC,CAAC/B,KAAK,CAAC,YAAW;YAC9F,OAAO,EAAE;UACX,CAAC,CAAC;UACF,IAAIf,YAAY,GAAG,CAACyC,cAAc,GAAGC,QAAQ,CAACK,IAAI,CAAC,UAASC,OAAO,EAAE;YACnE,OAAOA,OAAO,CAACC,UAAU,KAAK,UAAU;UAC1C,CAAC,CAAC,MAAM,IAAI,IAAIR,cAAc,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,cAAc,CAACzC,YAAY;UAChF,IAAI,CAACA,YAAY,EAAE;YACjB,IAAImD,aAAa,GAAG,MAAM,CAAC,CAAC,EAAEpG,cAAc,CAACqG,gBAAgB,EAAEjC,GAAG,CAAC,CAACJ,KAAK,CAAC,YAAW;cACnF,OAAO,IAAI;YACb,CAAC,CAAC;YACF,IAAI,CAACoC,aAAa,KAAK,IAAI,IAAIA,aAAa,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,aAAa,CAACF,UAAU,MAAM,UAAU,EAAE;cAC3GjD,YAAY,GAAGmD,aAAa,CAACnD,YAAY;YAC3C;UACF;UACA,IAAI0E,UAAU,GAAG1E,YAAY,GAAG,MAAMF,yBAAyB,CAACE,YAAY,CAAC,GAAG,IAAI;UACpF,IAAI,CAAC0E,UAAU,EAAE;YACf,OAAO,IAAI5H,UAAU,CAAC6H,QAAQ,CAAC,uBAAuB,EAAE;cACtDC,OAAO,EAAE,gDAAgD;cACzDH,IAAI,EAAEvH,yBAAyB,CAAChB;YAClC,CAAC,CAAC;UACJ;UACAiF,GAAG,CAACgB,OAAO,CAACmB,MAAM,CAACuB,IAAI,CAAC,wFAAwF,CAAC;UACjH,IAAI5C,YAAY,GAAG,MAAMd,GAAG,CAACe,eAAe,CAACf,GAAG,CAACgB,OAAO,CAACC,WAAW,CAACH,YAAY,CAAChH,IAAI,EAAEkG,GAAG,CAACgB,OAAO,CAACE,MAAM,CAAC;UAC3G,IAAIJ,YAAY,EAAE;YAChB,MAAMd,GAAG,CAACgB,OAAO,CAACQ,eAAe,CAACU,aAAa,CAACpB,YAAY,CAAC,CAAClB,KAAK,CAAC,UAASC,KAAK,EAAE;cAClFG,GAAG,CAACgB,OAAO,CAACmB,MAAM,CAACtC,KAAK,CAAC,gCAAgC,EAAEA,KAAK,CAAC;YACnE,CAAC,CAAC;UACJ;UACA,CAAC,CAAC,EAAEjE,cAAc,CAACwG,mBAAmB,EAAEpC,GAAG,CAAC;UAC5C,IAAIpD,OAAO,GAAG,IAAI+G,OAAO,CAAC,CAAC;UAC3B,IAAIC,WAAW,GAAG5D,GAAG,CAAC6D,eAAe;UACrCD,WAAW,KAAK,IAAI,IAAIA,WAAW,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,WAAW,CAACE,YAAY,CAAC,CAAC,CAACC,OAAO,CAAC,UAASC,MAAM,EAAE;YAC5GpH,OAAO,CAACqH,MAAM,CAAC,YAAY,EAAED,MAAM,CAAC;UACtC,CAAC,CAAC;UACF,OAAO,IAAIrI,UAAU,CAAC6H,QAAQ,CAAC,aAAa,EAAE;YAC5CC,OAAO,EAAE,CAAChG,IAAI,KAAK,IAAI,IAAIA,IAAI,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,IAAI,CAACgG,OAAO,KAAK,oCAAoC;YAC3GH,IAAI,EAAEvH,yBAAyB,CAACjB;UAClC,CAAC,EAAE8B,OAAO,CAAC;QACb,CAAC;MACH,CAAC;IAEL;EACF,CAAC;AACH;AACA,SAASsH,UAAUA,CAAA,EAAG;EACpB,OAAO,OAAOC,OAAO,KAAK,WAAW,GAAG,CAAC,CAAC,GAAGA,OAAO,CAACC,GAAG;AAC1D;AACA,SAASnJ,UAAUA,CAAA,EAAG;EACpB,IAAIuC,OAAO,GAAG6G,SAAS,CAACpH,MAAM,GAAG,CAAC,IAAIoH,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,GAAGA,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;EACjF,IAAIC,gBAAgB,EAAEC,iBAAiB,EAAEC,sBAAsB;EAC/D,IAAIC,iBAAiB,EAAEC,kBAAkB,EAAEC,kBAAkB,EAAEC,kBAAkB;EACjF,IAAIR,GAAG,GAAGF,UAAU,CAAC,CAAC;EACtB,IAAI/F,OAAO,GAAGX,OAAO,CAACW,OAAO,IAAIiG,GAAG,CAACS,QAAQ,IAAI,oBAAoBT,GAAG,CAACU,QAAQ,IAAI,MAAM,EAAE;EAC7F,IAAIC,YAAY,GAAGZ,OAAO,CAACC,GAAG,CAACY,QAAQ,KAAK,YAAY;EACxD,IAAIC,eAAe,GAAG,CAAC,CAACR,iBAAiB,GAAGjH,OAAO,CAAC0H,QAAQ,MAAM,IAAI,IAAIT,iBAAiB,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,iBAAiB,CAACtG,OAAO,KAAKiG,GAAG,CAACe,wBAAwB,IAAI,GAAGhH,OAAO,OAAO;EACjM,IAAIiH,aAAa,GAAG,CAAC,CAACV,kBAAkB,GAAGlH,OAAO,CAAC0H,QAAQ,MAAM,IAAI,IAAIR,kBAAkB,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,kBAAkB,CAAC3G,KAAK,KAAKqG,GAAG,CAACiB,cAAc,IAAI,QAAQ;EAC7K,IAAInH,MAAM,GAAG,GAAG+G,eAAe,WAAWG,aAAa,EAAE;EACzD,IAAIE,gBAAgB,GAAG,CAAC,CAACX,kBAAkB,GAAGnH,OAAO,CAAC0H,QAAQ,MAAM,IAAI,IAAIP,kBAAkB,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,kBAAkB,CAAC3G,QAAQ,KAAKoG,GAAG,CAACmB,kBAAkB,IAAI,EAAE;EACjL,IAAIC,oBAAoB,GAAG,CAAC,CAACZ,kBAAkB,GAAGpH,OAAO,CAAC0H,QAAQ,MAAM,IAAI,IAAIN,kBAAkB,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,kBAAkB,CAAC3G,YAAY,KAAKmG,GAAG,CAACqB,sBAAsB,IAAI,EAAE;EAC7L,IAAIC,UAAU,GAAGlI,OAAO,CAACmI,UAAU,KAAK,KAAK,GAAG,CAAC,CAAC,EAAE7J,WAAW,CAAC8J,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC;EAChF,IAAIC,QAAQ,GAAGrI,OAAO,CAACqI,QAAQ,IAAI,WAAW;EAC9C,IAAIC,sBAAsB,GAAG;IAC3B,GAAG,CAAC,CAAC,EAAEjK,cAAc,CAACqJ,QAAQ,EAAE;MAC9BlH,QAAQ,EAAEsH,gBAAgB;MAC1BrH,YAAY,EAAEuH,oBAAoB;MAClCtH;IACF,CAAC,CAAC;IACF;IACA;IACA;IACA;IACA;IACA6H,QAAQ,EAAE,GAAG7H,MAAM,gCAAgC;IACnD8H,WAAW,EAAE,GAAG9H,MAAM,mCAAmC;IACzD;IACA;IACA;IACA;IACA;IACA;IACA+H,gBAAgB,EAAE,SAASA,gBAAgBA,CAACC,OAAO,EAAE;MACnD,IAAIC,uBAAuB;MAC3B,IAAIC,MAAM,GAAGF,OAAO,CAACG,kBAAkB,IAAIH,OAAO,CAACI,GAAG,IAAIJ,OAAO,CAACvE,EAAE,IAAIuE,OAAO,CAACpM,IAAI;MACpF,IAAIyM,KAAK,GAAGL,OAAO,CAACK,KAAK,KAAKH,MAAM,GAAG,GAAGA,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC;MACnE,OAAO;QACL,GAAGF,OAAO;QACVK,KAAK;QACLC,aAAa,EAAE,CAACL,uBAAuB,GAAGD,OAAO,CAACO,cAAc,MAAM,IAAI,IAAIN,uBAAuB,KAAK,KAAK,CAAC,GAAGA,uBAAuB,GAAG,IAAI;QACjJrM,IAAI,EAAEoM,OAAO,CAACpM,IAAI,IAAIsM;MACxB,CAAC;IACH;EACF,CAAC;EACD,IAAIM,kBAAkB,GAAI,YAAW;IACnC,IAAI;MACF,IAAI7D,IAAI,GAAG,IAAI1F,GAAG,CAAC8H,eAAe,CAAC,CAAC0B,QAAQ,CAACC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;MAChE,OAAO/D,IAAI,IAAIA,IAAI,KAAK,GAAG,GAAGA,IAAI,GAAG,KAAK,CAAC;IAC7C,CAAC,CAAC,OAAOxF,MAAM,EAAE;MACf,OAAO,KAAK,CAAC;IACf;EACF,CAAC,CAAE,CAAC;EACJ,IAAIe,qBAAqB,GAAG,SAASyI,sBAAsBA,CAACC,aAAa,EAAE;IACzE,IAAI,CAACJ,kBAAkB,EAAE,OAAOzB,eAAe;IAC/C,IAAI;MACF,IAAIjI,GAAG,GAAG,IAAIG,GAAG,CAACgB,OAAO,CAAC;MAC1B,IAAI,CAAC4G,YAAY,IAAI+B,aAAa,EAAE;QAClC9J,GAAG,CAAC+J,QAAQ,GAAG,IAAI5J,GAAG,CAAC2J,aAAa,CAAC,CAACC,QAAQ;MAChD;MACA,OAAO,GAAG/J,GAAG,CAACI,MAAM,GAAGsJ,kBAAkB,EAAE;IAC7C,CAAC,CAAC,OAAOrJ,MAAM,EAAE;MACf,OAAO,KAAK,CAAC;IACf;EACF,CAAC;EACD,IAAI,CAAC0H,YAAY,EAAE;IACjB7L,MAAM,CAACC,cAAc,CAAC2M,sBAAsB,EAAE,aAAa,EAAE;MAC3D9L,UAAU,EAAE,IAAI;MAChBD,GAAGA,CAAA,EAAG;QACJ,IAAIqD,MAAM,GAAGpB,oBAAoB,CAAC0C,QAAQ,CAAC,CAAC;QAC5C,OAAOtB,MAAM,GAAG,GAAGA,MAAM,GAAGyI,QAAQ,2BAA2B,GAAG,KAAK,CAAC;MAC1E;IACF,CAAC,CAAC;IACF,IAAImB,kBAAkB,GAAG,SAASC,mBAAmBA,CAAA,EAAG;MACtD,IAAI7J,MAAM,GAAGpB,oBAAoB,CAAC0C,QAAQ,CAAC,CAAC;MAC5C,IAAI,CAACtB,MAAM,IAAI,CAACsJ,kBAAkB,EAAE,OAAO,KAAK,CAAC;MACjD,OAAOtI,qBAAqB,CAAChB,MAAM,CAAC;IACtC,CAAC;IACD,IAAIsJ,kBAAkB,EAAE;MACtBxN,MAAM,CAACC,cAAc,CAAC2M,sBAAsB,EAAE,kBAAkB,EAAE;QAChE9L,UAAU,EAAE,IAAI;QAChBD,GAAGA,CAAA,EAAG;UACJ,IAAImN,IAAI,GAAGF,kBAAkB,CAAC,CAAC;UAC/B,OAAOE,IAAI,GAAG,GAAGA,IAAI,WAAW9B,aAAa,+BAA+B,GAAG,KAAK,CAAC;QACvF;MACF,CAAC,CAAC;MACFlM,MAAM,CAACC,cAAc,CAAC2M,sBAAsB,EAAE,QAAQ,EAAE;QACtD9L,UAAU,EAAE,IAAI;QAChBD,GAAGA,CAAA,EAAG;UACJ,IAAImN,IAAI,GAAGF,kBAAkB,CAAC,CAAC;UAC/B,OAAOE,IAAI,GAAG,GAAGA,IAAI,WAAW9B,aAAa,EAAE,GAAG,KAAK,CAAC;QAC1D;MACF,CAAC,CAAC;IACJ;EACF;EACA,IAAI+B,WAAW,GAAG,CAAC,CAAC,EAAEtL,cAAc,CAACuL,YAAY,EAAE;IACjDC,MAAM,EAAE,CACNvB,sBAAsB;EAE1B,CAAC,CAAC;EACF,IAAIwB,iBAAiB,GAAGxJ,uBAAuB,CAAC;IAC9CC,KAAK,EAAEqH,aAAa;IACpBpH,QAAQ,EAAEsH,gBAAgB;IAC1BrH,YAAY,EAAEuH,oBAAoB;IAClCtH,MAAM;IACNC,OAAO;IACPC;EACF,CAAC,CAAC;EACF,IAAImJ,OAAO,GAAG,CACZ,IAAG7B,UAAU,GAAG,CACdA,UAAU,CACX,GAAG,EAAE,GACNyB,WAAW,EACXG,iBAAiB,EACjB,IAAG,CAAChD,gBAAgB,GAAG9G,OAAO,CAAC+J,OAAO,MAAM,IAAI,IAAIjD,gBAAgB,KAAK,KAAK,CAAC,GAAGA,gBAAgB,GAAG,EAAE,EACxG;EACD,IAAIkD,QAAQ,GAAG,CAACjD,iBAAiB,GAAG/G,OAAO,CAACgK,QAAQ,MAAM,IAAI,IAAIjD,iBAAiB,KAAK,KAAK,CAAC,GAAGA,iBAAiB,GAAGH,GAAG,CAACqD,YAAY,IAAI,KAAK,CAAC;EAC/I,OAAO,CAAC,CAAC,EAAE/L,kBAAkB,CAACgM,UAAU,EAAE;IACxC7B,QAAQ;IACR;IACA;IACA;IACA;IACA;IACA8B,OAAO,EAAExJ,OAAO;IAChB,IAAGqJ,QAAQ,GAAG;MACZA;IACF,CAAC,GAAG,CAAC,CAAC;IACNtG,MAAM,EAAE1D,OAAO,CAAC0D,MAAM,IAAIkD,GAAG,CAACwD,MAAM,IAAI,EAAE;IAC1CC,cAAc,EAAErK,OAAO,CAACqK,cAAc,IAAI,CACxC1J,OAAO,EACP8G,eAAe;IACf;IACA,IAAGb,GAAG,CAACU,QAAQ,IAAI,CAAC3G,OAAO,CAAC2J,QAAQ,CAAC,IAAI1D,GAAG,CAACU,QAAQ,EAAE,CAAC,GAAG,CACzD,oBAAoBV,GAAG,CAACU,QAAQ,EAAE,CACnC,GAAG,EAAE,GACN,sBAAsB;IACtB;IACA;IACA;IACA;IACA;IACA,IAAGC,YAAY,GAAG,EAAE,GAAG,CACrB,QAAQ,EACR,GAAGxI,qBAAqB,CAACwL,GAAG,CAAC,UAASzL,IAAI,EAAE;MAC1C,OAAO,UAAUA,IAAI,EAAE;IACzB,CAAC,CAAC,CACH,EACF;IACD6E,OAAO,EAAE;MACP6G,WAAW,EAAE;QACXC,OAAO,EAAE,IAAI;QACbC,MAAM,EAAE,CAAC1D,sBAAsB,GAAGhH,OAAO,CAAC2K,aAAa,MAAM,IAAI,IAAI3D,sBAAsB,KAAK,KAAK,CAAC,GAAGA,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;QAClJ4D,QAAQ,EAAE,KAAK;QACfC,YAAY,EAAE;MAChB;IACF,CAAC;IACDxG,OAAO,EAAE;MACPyG,kBAAkB,EAAE,QAAQ;MAC5BC,kBAAkB,EAAE;IACtB,CAAC;IACDhB;EACF,CAAC,CAAC;AACJ;AACA,SAASrM,sBAAsBA,CAACsN,IAAI,EAAE;EACpC,IAAI1F,OAAO,GAAG,SAAS2F,QAAQA,CAACtM,GAAG,EAAE;IACnC,IAAIiB,MAAM,GAAGlB,mBAAmB,CAACC,GAAG,CAAC;IACrC,OAAOiB,MAAM,GAAGpB,oBAAoB,CAAC0M,GAAG,CAACtL,MAAM,EAAE,YAAW;MAC1D,OAAOoL,IAAI,CAAC1F,OAAO,CAAC3G,GAAG,CAAC;IAC1B,CAAC,CAAC,GAAGqM,IAAI,CAAC1F,OAAO,CAAC3G,GAAG,CAAC;EACxB,CAAC;EACD,OAAO;IACLwM,GAAG,EAAE7F,OAAO;IACZ8F,IAAI,EAAE9F;EACR,CAAC;AACH;AACA,SAAS3H,oBAAoBA,CAACqN,IAAI,EAAE;EAClC,eAAeK,UAAUA,CAAC1M,GAAG,EAAE;IAC7B,OAAOqM,IAAI,CAACM,GAAG,CAACD,UAAU,CAAC;MACzBjM,OAAO,EAAET,GAAG,CAACS;IACf,CAAC,CAAC;EACJ;EACA,eAAemM,UAAUA,CAAC5M,GAAG,EAAE;IAC7B,IAAIgF,OAAO,GAAG,MAAMqH,IAAI,CAACM,GAAG,CAACD,UAAU,CAAC;MACtCjM,OAAO,EAAET,GAAG,CAACS;IACf,CAAC,CAAC;IACF,IAAI,CAACuE,OAAO,EAAE;MACZ,MAAM,IAAI6H,QAAQ,CAAC,cAAc,EAAE;QACjCtJ,MAAM,EAAE;MACV,CAAC,CAAC;IACJ;IACA,OAAOyB,OAAO;EAChB;EACA,OAAO;IACL4H,UAAU;IACVF;EACF,CAAC;AACH","ignoreList":[]}

package/dist/esm/index.mjs

@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { betterAuth, matchesHostPattern } from "better-auth";
-import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, isAPIError } from "better-auth/api";
+import { APIError, createAuthEndpoint, createAuthMiddleware, getAccessToken, getSessionFromCtx, isAPIError } from "better-auth/api";
 import { deleteSessionCookie, getAccountCookie } from "better-auth/cookies";
 import { genericOAuth, keycloak } from "better-auth/plugins";
 import { expo } from "@better-auth/expo";
@@ -14,20 +14,20 @@ function deriveRequestOrigin(req) {
     const proto = req.headers.get("x-forwarded-proto") === "https" ? "https" : "http";
     return `${proto}://${forwardedHost}`;
   }
-  const originHeader = req.headers.get("origin");
-  if (originHeader) {
+  for (const candidate of [req.headers.get("origin"), req.url]) {
+    if (!candidate) continue;
     try {
-      const url = new URL(originHeader);
+      const url = new URL(candidate);
       if (isDevHost(url.host)) return url.origin;
     } catch {}
   }
-  try {
-    return new URL(req.url).origin;
-  } catch {
-    return void 0;
-  }
+  return void 0;
 }
 const DEV_LAN_HOST_PATTERNS = ["localhost", "localhost:*", "127.0.0.1", "127.0.0.1:*", "10.*", "192.168.*", "172.*", "*.local", "*.local:*"];
+const accessTokenBodySchema = getAccessToken.options.body;
+function acceptsAccessTokenBody(body) {
+  return accessTokenBodySchema?.safeParse?.(body).success !== false;
+}
 function createKeycloakSsoPlugin(options) {
   const {
     realm,
@@ -118,10 +118,24 @@ function createKeycloakSsoPlugin(options) {
         // so it is a 200 with no token, as /get-session answers, instead
         // of a 4xx the browser logs. Runs before body validation, so the
         // client's body-shape negotiation never 400s for a visitor either.
+        // A signed-in >=1.7 body (`useAccountCookie`) on a server whose
+        // schema still demands `providerId` gets the Keycloak provider
+        // added, so the negotiation never 400s once signed in either.
         matcher: ctx => ctx.path === "/get-access-token",
         handler: createAuthMiddleware(async ctx => {
           const session = await getSessionFromCtx(ctx).catch(() => null);
           if (!session) return ctx.json(null);
+          const body = ctx.body;
+          if (body?.useAccountCookie !== true || acceptsAccessTokenBody(body)) return;
+          const legacy = {
+            ...body,
+            providerId: "keycloak"
+          };
+          if (acceptsAccessTokenBody(legacy)) return {
+            context: {
+              body: legacy
+            }
+          };
         })
       }],
       after: [{

package/dist/esm/index.mjs.map

@@ -1 +1 @@
-{"version":3,"names":["AsyncLocalStorage","betterAuth","matchesHostPattern","APIError","createAuthEndpoint","createAuthMiddleware","getSessionFromCtx","isAPIError","deleteSessionCookie","getAccountCookie","genericOAuth","keycloak","expo","FAILED_TO_GET_ACCESS_TOKEN","TOKEN_REFRESH_UNAVAILABLE","ACCESS_TOKEN_RETRY_DELAYS_MS","FAILED_TO_GET_ACCESS_TOKEN2","TOKEN_REFRESH_UNAVAILABLE2","classifyAccessTokenResponse","retryWhileTransient","watchDocumentVisible","requestOriginStorage","deriveRequestOrigin","req","isDevHost","host","DEV_LAN_HOST_PATTERNS","some","pattern","forwardedHost","headers","get","proto","originHeader","url","URL","origin","createKeycloakSsoPlugin","options","realm","clientId","clientSecret","issuer","baseUrl","publicKeycloakBaseFor","tokenEndpoint","resolveVisitorOrigin","request","getStore","isRefreshDefinitivelyDead","refreshToken","res","fetch","method","body","URLSearchParams","grant_type","refresh_token","client_id","client_secret","signal","AbortSignal","timeout","ok","status","json","catch","error","signOutSso","ctx","visitorOrigin","searchParams","rawCallback","jsonMode","answer","redirect","callbackURL","postLogoutRedirect","startsWith","idTokenHint","sessionToken","getSignedCookie","context","authCookies","name","secret","session","accounts","internalAdapter","findAccounts","user","id","find","account","providerId","idToken","accountCookie","deleteSession","logger","keycloakBase","endSession","set","toString","endpoints","hooks","before","matcher","path","handler","after","returned","code","definitive","message","warn","Headers","accumulated","responseHeaders","getSetCookie","forEach","cookie","append","runtimeEnv","process","env","createAuth","BASE_URL","ONE_PORT","isProduction","NODE_ENV","keycloakBaseUrl","KEYCLOAK_BACKCHANNEL_URL","keycloakRealm","KEYCLOAK_REALM","keycloakClientId","KEYCLOAK_CLIENT_ID","keycloakClientSecret","KEYCLOAK_CLIENT_SECRET","expoPlugin","enableExpo","basePath","keycloakProviderConfig","tokenUrl","userInfoUrl","mapProfileToUser","profile","handle","preferred_username","sub","email","emailVerified","email_verified","keycloakPublicPath","pathname","replace","requestOrigin","hostname","Object","defineProperty","enumerable","keycloakPublicBase","base","oauthPlugin","config","keycloakSsoPlugin","plugins","database","DATABASE_URL","baseURL","SECRET","trustedOrigins","includes","map","cookieCache","enabled","maxAge","sessionMaxAge","strategy","refreshCache","storeStateStrategy","storeAccountCookie","createAuthRouteHandler","auth","run","GET","POST","createSessionHelpers","getSession","api","verifyAuth","Response"],"sources":["../../src/index.ts"],"sourcesContent":[null],"mappings":"AAgBA,SAASA,iBAAA,QAAyB;AAClC,SAASC,UAAA,EAAYC,kBAAA,QAA0B;AAE/C,SACEC,QAAA,EACAC,kBAAA,EACAC,oBAAA,EACAC,iBAAA,EACAC,UAAA,QACK;AACP,SAASC,mBAAA,EAAqBC,gBAAA,QAAwB;AACtD,SAASC,YAAA,EAAcC,QAAA,QAAgB;AACvC,SAASC,IAAA,QAAY;AACrB,SAASC,0BAAA,EAA4BC,yBAAA,QAAiC;AAEtE,SACEC,4BAAA,EACAF,0BAAA,IAAAG,2BAAA,EACAF,yBAAA,IAAAG,0BAAA,EACAC,2BAAA,EACAC,mBAAA,EACAC,oBAAA,QACK;AAYP,MAAMC,oBAAA,GAAuB,IAAIrB,iBAAA,CAA0B;AAW3D,SAASsB,oBAAoBC,GAAA,EAAkC;EAC7D,MAAMC,SAAA,GAAaC,IAAA,IACjBC,qBAAA,CAAsBC,IAAA,CAAMC,OAAA,IAAY1B,kBAAA,CAAmBuB,IAAA,EAAMG,OAAO,CAAC;EAE3E,MAAMC,aAAA,GAAgBN,GAAA,CAAIO,OAAA,CAAQC,GAAA,CAAI,kBAAkB;EACxD,IAAIF,aAAA,IAAiBL,SAAA,CAAUK,aAAa,GAAG;IAC7C,MAAMG,KAAA,GAAQT,GAAA,CAAIO,OAAA,CAAQC,GAAA,CAAI,mBAAmB,MAAM,UAAU,UAAU;IAC3E,OAAO,GAAGC,KAAK,MAAMH,aAAa;EACpC;EAEA,MAAMI,YAAA,GAAeV,GAAA,CAAIO,OAAA,CAAQC,GAAA,CAAI,QAAQ;EAC7C,IAAIE,YAAA,EAAc;IAChB,IAAI;MACF,MAAMC,GAAA,GAAM,IAAIC,GAAA,CAAIF,YAAY;MAChC,IAAIT,SAAA,CAAUU,GAAA,CAAIT,IAAI,GAAG,OAAOS,GAAA,CAAIE,MAAA;IACtC,QAAQ,CAER;EACF;EAEA,IAAI;IACF,OAAO,IAAID,GAAA,CAAIZ,GAAA,CAAIW,GAAG,EAAEE,MAAA;EAC1B,QAAQ;IACN,OAAO;EACT;AACF;AAqDA,MAAMV,qBAAA,GAAwB,CAC5B,aACA,eACA,aACA,eACA,QACA,aACA,SACA,WACA,YACF;AAsDA,SAASW,wBAAwBC,OAAA,EAAmC;EAClE,MAAM;IAAEC,KAAA;IAAOC,QAAA;IAAUC,YAAA;IAAcC,MAAA;IAAQC,OAAA;IAASC;EAAsB,IAAIN,OAAA;EAClF,MAAMO,aAAA,GAAgB,GAAGH,MAAM;EAG/B,MAAMI,oBAAA,GAAwBC,OAAA,IAC5B1B,oBAAA,CAAqB2B,QAAA,CAAS,MAAMD,OAAA,GAAUzB,mBAAA,CAAoByB,OAAO,IAAI;EAQ/E,MAAME,yBAAA,GAA4B,MAAOC,YAAA,IAA2C;IAClF,IAAI;MACF,MAAMC,GAAA,GAAM,MAAMC,KAAA,CAAMP,aAAA,EAAe;QACrCQ,MAAA,EAAQ;QACRvB,OAAA,EAAS;UAAE,gBAAgB;QAAoC;QAC/DwB,IAAA,EAAM,IAAIC,eAAA,CAAgB;UACxBC,UAAA,EAAY;UACZC,aAAA,EAAeP,YAAA;UACfQ,SAAA,EAAWlB,QAAA;UACXmB,aAAA,EAAelB;QACjB,CAAC;QACDmB,MAAA,EAAQC,WAAA,CAAYC,OAAA,CAAQ,GAAI;MAClC,CAAC;MACD,IAAIX,GAAA,CAAIY,EAAA,EAAI,OAAO;MACnB,IAAIZ,GAAA,CAAIa,MAAA,KAAW,OAAOb,GAAA,CAAIa,MAAA,KAAW,KAAK,OAAO;MACrD,MAAMV,IAAA,GAAQ,MAAMH,GAAA,CAAIc,IAAA,CAAK,EAAEC,KAAA,CAAM,MAAM,IAAI;MAC/C,OAAOZ,IAAA,EAAMa,KAAA,KAAU,mBAAmBb,IAAA,EAAMa,KAAA,KAAU;IAC5D,QAAQ;MACN,OAAO;IACT;EACF;EAEA,MAAMC,UAAA,GAAahE,kBAAA,CAAmB,iBAAiB;IAAEiD,MAAA,EAAQ;EAAM,GAAG,MAAOgB,GAAA,IAAQ;IACvF,MAAMC,aAAA,GAAgBxB,oBAAA,CAAqBuB,GAAA,CAAItB,OAAO,KAAKJ,OAAA;IAC3D,MAAM4B,YAAA,GAAeF,GAAA,CAAItB,OAAA,GAAU,IAAIZ,GAAA,CAAIkC,GAAA,CAAItB,OAAA,CAAQb,GAAG,EAAEqC,YAAA,GAAe;IAC3E,MAAMC,WAAA,GAAcD,YAAA,EAAcxC,GAAA,CAAI,aAAa,KAAK;IAExD,MAAM0C,QAAA,GAAWF,YAAA,EAAcxC,GAAA,CAAI,MAAM,MAAM;IAC/C,MAAM2C,MAAA,GAASA,CAACxC,GAAA,EAAayC,QAAA,KAAsB;MACjD,IAAIF,QAAA,EAAU,OAAOJ,GAAA,CAAIJ,IAAA,CAAK;QAAEU,QAAA;QAAUzC;MAAI,CAAC;MAC/C,MAAMmC,GAAA,CAAIM,QAAA,CAASzC,GAAG;IACxB;IACA,MAAM0C,WAAA,GAAcJ,WAAA,IAAe;IAGnC,MAAMK,kBAAA,GAAqBD,WAAA,CAAYE,UAAA,CAAW,GAAG,IACjD,GAAGR,aAAa,GAAGM,WAAW,KAC9BA,WAAA;IAOJ,IAAIG,WAAA;IACJ,MAAMC,YAAA,GAAe,MAAMX,GAAA,CAAIY,eAAA,CAC7BZ,GAAA,CAAIa,OAAA,CAAQC,WAAA,CAAYH,YAAA,CAAaI,IAAA,EACrCf,GAAA,CAAIa,OAAA,CAAQG,MACd;IACA,MAAMC,OAAA,GAAU,MAAMhF,iBAAA,CAAkB+D,GAAG,EAAEH,KAAA,CAAM,MAAM,IAAI;IAC7D,IAAIoB,OAAA,EAAS;MACX,MAAMC,QAAA,GAAY,MAAMlB,GAAA,CAAIa,OAAA,CAAQM,eAAA,CACjCC,YAAA,CAAaH,OAAA,CAAQI,IAAA,CAAKC,EAAE,EAC5BzB,KAAA,CAAM,MAAM,EAAE;MACjBa,WAAA,GACEQ,QAAA,CAASK,IAAA,CAAMC,OAAA,IAAYA,OAAA,CAAQC,UAAA,KAAe,UAAU,GAAGC,OAAA,IAAW;IAC9E;IACA,IAAI,CAAChB,WAAA,EAAa;MAChB,MAAMiB,aAAA,GAAiB,MAAMvF,gBAAA,CAAiB4D,GAAG,EAAEH,KAAA,CACjD,MAAM,IACR;MACA,IAAI8B,aAAA,EAAeF,UAAA,KAAe,cAAcE,aAAA,CAAcD,OAAA,EAAS;QACrEhB,WAAA,GAAciB,aAAA,CAAcD,OAAA;MAC9B;IACF;IAEA,IAAIf,YAAA,EAAc;MAChB,MAAMX,GAAA,CAAIa,OAAA,CAAQM,eAAA,CAAgBS,aAAA,CAAcjB,YAAY,EAAEd,KAAA,CAAOC,KAAA,IAAmB;QACtFE,GAAA,CAAIa,OAAA,CAAQgB,MAAA,CAAO/B,KAAA,CAAM,gDAAgDA,KAAK;MAChF,CAAC;IACH;IACA3D,mBAAA,CAAoB6D,GAAG;IAOvB,MAAM8B,YAAA,GAAevD,qBAAA,CAAsB0B,aAAa;IACxD,IAAI,CAAC6B,YAAA,IAAiB,CAACb,OAAA,IAAW,CAACP,WAAA,IAAe,CAACC,YAAA,EAAe;MAChE,OAAON,MAAA,CAAOG,kBAAA,EAAoB,KAAK;IACzC;IAEA,MAAMuB,UAAA,GAAa,IAAIjE,GAAA,CAAI,GAAGgE,YAAY,WAAW5D,KAAK,iCAAiC;IAC3F6D,UAAA,CAAW7B,YAAA,CAAa8B,GAAA,CAAI,4BAA4BxB,kBAAkB;IAC1EuB,UAAA,CAAW7B,YAAA,CAAa8B,GAAA,CAAI,aAAa7D,QAAQ;IACjD,IAAIuC,WAAA,EAAaqB,UAAA,CAAW7B,YAAA,CAAa8B,GAAA,CAAI,iBAAiBtB,WAAW;IACzE,OAAOL,MAAA,CAAO0B,UAAA,CAAWE,QAAA,CAAS,GAAG,IAAI;EAC3C,CAAC;EAED,OAAO;IACLX,EAAA,EAAI;IACJY,SAAA,EAAW;MACTnC;IACF;IACAoC,KAAA,EAAO;MACLC,MAAA,EAAQ,CACN;QAAA;QAAA;QAAA;QAAA;QAKEC,OAAA,EAAUrC,GAAA,IAAQA,GAAA,CAAIsC,IAAA,KAAS;QAC/BC,OAAA,EAASvG,oBAAA,CAAqB,MAAOgE,GAAA,IAAQ;UAC3C,MAAMiB,OAAA,GAAU,MAAMhF,iBAAA,CAAkB+D,GAAG,EAAEH,KAAA,CAAM,MAAM,IAAI;UAC7D,IAAI,CAACoB,OAAA,EAAS,OAAOjB,GAAA,CAAIJ,IAAA,CAAK,IAAI;QACpC,CAAC;MACH,EACF;MACA4C,KAAA,EAAO,CACL;QACEH,OAAA,EAAUrC,GAAA,IAAQA,GAAA,CAAIsC,IAAA,KAAS;QAC/BC,OAAA,EAASvG,oBAAA,CAAqB,MAAOgE,GAAA,IAAQ;UAC3C,MAAMyC,QAAA,GAAWzC,GAAA,CAAIa,OAAA,CAAQ4B,QAAA;UAC7B,IAAI,CAACvG,UAAA,CAAWuG,QAAQ,GAAG;UAC3B,MAAMxD,IAAA,GAAOwD,QAAA,CAASxD,IAAA;UACtB,IAAIA,IAAA,EAAMyD,IAAA,KAASlG,0BAAA,EAA4B;UAC/C,MAAMiF,UAAA,GAAczB,GAAA,CAAIf,IAAA,EAA8CwC,UAAA;UACtE,IAAIA,UAAA,IAAcA,UAAA,KAAe,YAAY;UAE7C,MAAMR,OAAA,GAAU,MAAMhF,iBAAA,CAAkB+D,GAAG,EAAEH,KAAA,CAAM,MAAM,IAAI;UAC7D,IAAI,CAACoB,OAAA,EAAS;UAKd,MAAMC,QAAA,GAAY,MAAMlB,GAAA,CAAIa,OAAA,CAAQM,eAAA,CACjCC,YAAA,CAAaH,OAAA,CAAQI,IAAA,CAAKC,EAAE,EAC5BzB,KAAA,CAAM,MAAM,EAAE;UACjB,IAAIhB,YAAA,GAAeqC,QAAA,CAASK,IAAA,CACzBC,OAAA,IAAYA,OAAA,CAAQC,UAAA,KAAe,UACtC,GAAG5C,YAAA;UACH,IAAI,CAACA,YAAA,EAAc;YACjB,MAAM8C,aAAA,GAAiB,MAAMvF,gBAAA,CAAiB4D,GAAG,EAAEH,KAAA,CACjD,MAAM,IACR;YACA,IAAI8B,aAAA,EAAeF,UAAA,KAAe,YAAY;cAC5C5C,YAAA,GAAe8C,aAAA,CAAc9C,YAAA;YAC/B;UACF;UACA,MAAM8D,UAAA,GAAa9D,YAAA,GAAe,MAAMD,yBAAA,CAA0BC,YAAY,IAAI;UAClF,IAAI,CAAC8D,UAAA,EAAY;YAIf,OAAO,IAAI7G,QAAA,CAAS,yBAAyB;cAC3C8G,OAAA,EAAS;cACTF,IAAA,EAAMjG;YACR,CAAC;UACH;UAEAuD,GAAA,CAAIa,OAAA,CAAQgB,MAAA,CAAOgB,IAAA,CACjB,wFACF;UACA,MAAMlC,YAAA,GAAe,MAAMX,GAAA,CAAIY,eAAA,CAC7BZ,GAAA,CAAIa,OAAA,CAAQC,WAAA,CAAYH,YAAA,CAAaI,IAAA,EACrCf,GAAA,CAAIa,OAAA,CAAQG,MACd;UACA,IAAIL,YAAA,EAAc;YAChB,MAAMX,GAAA,CAAIa,OAAA,CAAQM,eAAA,CACfS,aAAA,CAAcjB,YAAY,EAC1Bd,KAAA,CAAOC,KAAA,IAAmB;cACzBE,GAAA,CAAIa,OAAA,CAAQgB,MAAA,CAAO/B,KAAA,CAAM,kCAAkCA,KAAK;YAClE,CAAC;UACL;UACA3D,mBAAA,CAAoB6D,GAAG;UAKvB,MAAMvC,OAAA,GAAU,IAAIqF,OAAA,CAAQ;UAC5B,MAAMC,WAAA,GAAe/C,GAAA,CAAiDgD,eAAA;UACtED,WAAA,EAAaE,YAAA,CAAa,EAAEC,OAAA,CAASC,MAAA,IAAW;YAC9C1F,OAAA,CAAQ2F,MAAA,CAAO,cAAcD,MAAM;UACrC,CAAC;UACD,OAAO,IAAIrH,QAAA,CACT,eACA;YACE8G,OAAA,EAAS3D,IAAA,EAAM2D,OAAA,IAAW;YAC1BF,IAAA,EAAMlG;UACR,GACAiB,OACF;QACF,CAAC;MACH;IAEJ;EACF;AACF;AAEA,SAAS4F,WAAA,EAAiD;EACxD,OAAO,OAAOC,OAAA,KAAY,cAAc,CAAC,IAAIA,OAAA,CAAQC,GAAA;AACvD;AAWO,SAASC,WAAWvF,OAAA,GAA6B,CAAC,GAAG;EAC1D,MAAMsF,GAAA,GAAMF,UAAA,CAAW;EACvB,MAAM/E,OAAA,GAAUL,OAAA,CAAQK,OAAA,IAAWiF,GAAA,CAAIE,QAAA,IAAY,oBAAoBF,GAAA,CAAIG,QAAA,IAAY,MAAM;EAC7F,MAAMC,YAAA,GAAeL,OAAA,CAAQC,GAAA,CAAIK,QAAA,KAAa;EAI9C,MAAMC,eAAA,GACJ5F,OAAA,CAAQ3B,QAAA,EAAUgC,OAAA,IAAWiF,GAAA,CAAIO,wBAAA,IAA4B,GAAGxF,OAAO;EACzE,MAAMyF,aAAA,GAAgB9F,OAAA,CAAQ3B,QAAA,EAAU4B,KAAA,IAASqF,GAAA,CAAIS,cAAA,IAAkB;EACvE,MAAM3F,MAAA,GAAS,GAAGwF,eAAe,WAAWE,aAAa;EAEzD,MAAME,gBAAA,GAAmBhG,OAAA,CAAQ3B,QAAA,EAAU6B,QAAA,IAAYoF,GAAA,CAAIW,kBAAA,IAAsB;EACjF,MAAMC,oBAAA,GAAuBlG,OAAA,CAAQ3B,QAAA,EAAU8B,YAAA,IAAgBmF,GAAA,CAAIa,sBAAA,IAA0B;EAE7F,MAAMC,UAAA,GAAapG,OAAA,CAAQqG,UAAA,KAAe,QAAQ/H,IAAA,CAAK,IAAI;EAE3D,MAAMgI,QAAA,GAAWtG,OAAA,CAAQsG,QAAA,IAAY;EAErC,MAAMC,sBAAA,GAAyB;IAC7B,GAAGlI,QAAA,CAAS;MACV6B,QAAA,EAAU8F,gBAAA;MACV7F,YAAA,EAAc+F,oBAAA;MACd9F;IACF,CAAC;IAAA;IAAA;IAAA;IAAA;IAAA;IAMDoG,QAAA,EAAU,GAAGpG,MAAM;IACnBqG,WAAA,EAAa,GAAGrG,MAAM;IAAA;IAAA;IAAA;IAAA;IAAA;IAAA;IAOtBsG,gBAAA,EAAmBC,OAAA,IAAiC;MAClD,MAAMC,MAAA,GAASD,OAAA,CAAQE,kBAAA,IAAsBF,OAAA,CAAQG,GAAA,IAAOH,OAAA,CAAQtD,EAAA,IAAMsD,OAAA,CAAQ7D,IAAA;MAClF,MAAMiE,KAAA,GAAQJ,OAAA,CAAQI,KAAA,KAAUH,MAAA,GAAS,GAAGA,MAAM,YAAY;MAC9D,OAAO;QACL,GAAGD,OAAA;QACHI,KAAA;QACAC,aAAA,EAAeL,OAAA,CAAQM,cAAA,IAAkB;QACzCnE,IAAA,EAAM6D,OAAA,CAAQ7D,IAAA,IAAQ8D;MACxB;IACF;EACF;EAGA,MAAMM,kBAAA,IAAsB,MAAM;IAChC,IAAI;MACF,MAAM7C,IAAA,GAAO,IAAIxE,GAAA,CAAI+F,eAAe,EAAEuB,QAAA,CAASC,OAAA,CAAQ,QAAQ,EAAE;MACjE,OAAO/C,IAAA,IAAQA,IAAA,KAAS,MAAMA,IAAA,GAAO;IACvC,QAAQ;MACN,OAAO;IACT;EACF,GAAG;EASH,MAAM/D,qBAAA,GAAyB+G,aAAA,IAA+C;IAC5E,IAAI,CAACH,kBAAA,EAAoB,OAAOtB,eAAA;IAChC,IAAI;MACF,MAAMhG,GAAA,GAAM,IAAIC,GAAA,CAAIQ,OAAO;MAC3B,IAAI,CAACqF,YAAA,IAAgB2B,aAAA,EAAe;QAClCzH,GAAA,CAAI0H,QAAA,GAAW,IAAIzH,GAAA,CAAIwH,aAAa,EAAEC,QAAA;MACxC;MACA,OAAO,GAAG1H,GAAA,CAAIE,MAAM,GAAGoH,kBAAkB;IAC3C,QAAQ;MACN,OAAO;IACT;EACF;EAEA,IAAI,CAACxB,YAAA,EAAc;IAQjB6B,MAAA,CAAOC,cAAA,CAAejB,sBAAA,EAAwB,eAAe;MAC3DkB,UAAA,EAAY;MACZhI,IAAA,EAAM;QACJ,MAAMK,MAAA,GAASf,oBAAA,CAAqB2B,QAAA,CAAS;QAC7C,OAAOZ,MAAA,GAAS,GAAGA,MAAM,GAAGwG,QAAQ,8BAA8B;MACpE;IACF,CAAC;IAsBD,MAAMoB,kBAAA,GAAqBA,CAAA,KAA0B;MACnD,MAAM5H,MAAA,GAASf,oBAAA,CAAqB2B,QAAA,CAAS;MAC7C,IAAI,CAACZ,MAAA,IAAU,CAACoH,kBAAA,EAAoB,OAAO;MAC3C,OAAO5G,qBAAA,CAAsBR,MAAM;IACrC;IACA,IAAIoH,kBAAA,EAAoB;MACtBK,MAAA,CAAOC,cAAA,CAAejB,sBAAA,EAAwB,oBAAoB;QAChEkB,UAAA,EAAY;QACZhI,IAAA,EAAM;UACJ,MAAMkI,IAAA,GAAOD,kBAAA,CAAmB;UAChC,OAAOC,IAAA,GAAO,GAAGA,IAAI,WAAW7B,aAAa,kCAAkC;QACjF;MACF,CAAC;MAQDyB,MAAA,CAAOC,cAAA,CAAejB,sBAAA,EAAwB,UAAU;QACtDkB,UAAA,EAAY;QACZhI,IAAA,EAAM;UACJ,MAAMkI,IAAA,GAAOD,kBAAA,CAAmB;UAChC,OAAOC,IAAA,GAAO,GAAGA,IAAI,WAAW7B,aAAa,KAAK;QACpD;MACF,CAAC;IACH;EACF;EAIA,MAAM8B,WAAA,GAAcxJ,YAAA,CAAa;IAC/ByJ,MAAA,EAAQ,CAACtB,sBAA8E;EACzF,CAAC;EAED,MAAMuB,iBAAA,GAAoB/H,uBAAA,CAAwB;IAChDE,KAAA,EAAO6F,aAAA;IACP5F,QAAA,EAAU8F,gBAAA;IACV7F,YAAA,EAAc+F,oBAAA;IACd9F,MAAA;IACAC,OAAA;IACAC;EACF,CAAC;EAED,MAAMyH,OAAA,GAAiB,CACrB,IAAI3B,UAAA,GAAa,CAACA,UAAU,IAAI,EAAC,GACjCwB,WAAA,EACAE,iBAAA,EACA,IAAI9H,OAAA,CAAQ+H,OAAA,IAAW,EAAC,EAC1B;EAIA,MAAMC,QAAA,GAAWhI,OAAA,CAAQgI,QAAA,KAAa1C,GAAA,CAAI2C,YAAA,IAAgB;EAE1D,OAAOtK,UAAA,CAAW;IAChB2I,QAAA;IAAA;IAAA;IAAA;IAAA;IAAA;IAMA4B,OAAA,EAAS7H,OAAA;IACT,IAAI2H,QAAA,GAAW;MAAEA;IAAS,IAAI,CAAC;IAC/BjF,MAAA,EAAQ/C,OAAA,CAAQ+C,MAAA,IAAUuC,GAAA,CAAI6C,MAAA,IAAU;IACxCC,cAAA,EAAgBpI,OAAA,CAAQoI,cAAA,IAAkB,CACxC/H,OAAA,EACAuF,eAAA;IAAA;IAEA,IAAIN,GAAA,CAAIG,QAAA,IAAY,CAACpF,OAAA,CAAQgI,QAAA,CAAS,IAAI/C,GAAA,CAAIG,QAAQ,EAAE,IACpD,CAAC,oBAAoBH,GAAA,CAAIG,QAAQ,EAAE,IACnC,EAAC,GACL;IAAA;IAAA;IAAA;IAAA;IAAA;IAMA,IAAIC,YAAA,GAAe,EAAC,GAAI,CAAC,UAAU,GAAGtG,qBAAA,CAAsBkJ,GAAA,CAAKnJ,IAAA,IAAS,UAAUA,IAAI,EAAE,CAAC,GAC7F;IACA6D,OAAA,EAAS;MACPuF,WAAA,EAAa;QACXC,OAAA,EAAS;QACTC,MAAA,EAAQzI,OAAA,CAAQ0I,aAAA,IAAiB,IAAI,KAAK,KAAK;QAC/CC,QAAA,EAAU;QACVC,YAAA,EAAc;MAChB;IACF;IACArF,OAAA,EAAS;MACPsF,kBAAA,EAAoB;MACpBC,kBAAA,EAAoB;IACtB;IACAf;EACF,CAAC;AACH;AAmBO,SAASgB,uBAAuBC,IAAA,EAAgB;EAKrD,MAAM1E,OAAA,GAAWrF,GAAA,IAAiB;IAChC,MAAMa,MAAA,GAASd,mBAAA,CAAoBC,GAAG;IACtC,OAAOa,MAAA,GAASf,oBAAA,CAAqBkK,GAAA,CAAInJ,MAAA,EAAQ,MAAMkJ,IAAA,CAAK1E,OAAA,CAAQrF,GAAG,CAAC,IAAI+J,IAAA,CAAK1E,OAAA,CAAQrF,GAAG;EAC9F;EACA,OAAO;IAAEiK,GAAA,EAAK5E,OAAA;IAAS6E,IAAA,EAAM7E;EAAQ;AACvC;AASO,SAAS8E,qBAAqBJ,IAAA,EAAgB;EAEnD,eAAeK,WAAWpK,GAAA,EAAc;IACtC,OAAO+J,IAAA,CAAKM,GAAA,CAAID,UAAA,CAAW;MAAE7J,OAAA,EAASP,GAAA,CAAIO;IAAQ,CAAC;EACrD;EAGA,eAAe+J,WAAWtK,GAAA,EAAc;IACtC,MAAM+D,OAAA,GAAU,MAAMgG,IAAA,CAAKM,GAAA,CAAID,UAAA,CAAW;MAAE7J,OAAA,EAASP,GAAA,CAAIO;IAAQ,CAAC;IAClE,IAAI,CAACwD,OAAA,EAAS;MACZ,MAAM,IAAIwG,QAAA,CAAS,gBAAgB;QAAE9H,MAAA,EAAQ;MAAI,CAAC;IACpD;IACA,OAAOsB,OAAA;EACT;EAEA,OAAO;IAAEuG,UAAA;IAAYF;EAAW;AAClC","ignoreList":[]}
+{"version":3,"names":["AsyncLocalStorage","betterAuth","matchesHostPattern","APIError","createAuthEndpoint","createAuthMiddleware","getAccessToken","getSessionFromCtx","isAPIError","deleteSessionCookie","getAccountCookie","genericOAuth","keycloak","expo","FAILED_TO_GET_ACCESS_TOKEN","TOKEN_REFRESH_UNAVAILABLE","ACCESS_TOKEN_RETRY_DELAYS_MS","FAILED_TO_GET_ACCESS_TOKEN2","TOKEN_REFRESH_UNAVAILABLE2","classifyAccessTokenResponse","retryWhileTransient","watchDocumentVisible","requestOriginStorage","deriveRequestOrigin","req","isDevHost","host","DEV_LAN_HOST_PATTERNS","some","pattern","forwardedHost","headers","get","proto","candidate","url","URL","origin","accessTokenBodySchema","options","body","acceptsAccessTokenBody","safeParse","success","createKeycloakSsoPlugin","realm","clientId","clientSecret","issuer","baseUrl","publicKeycloakBaseFor","tokenEndpoint","resolveVisitorOrigin","request","getStore","isRefreshDefinitivelyDead","refreshToken","res","fetch","method","URLSearchParams","grant_type","refresh_token","client_id","client_secret","signal","AbortSignal","timeout","ok","status","json","catch","error","signOutSso","ctx","visitorOrigin","searchParams","rawCallback","jsonMode","answer","redirect","callbackURL","postLogoutRedirect","startsWith","idTokenHint","sessionToken","getSignedCookie","context","authCookies","name","secret","session","accounts","internalAdapter","findAccounts","user","id","find","account","providerId","idToken","accountCookie","deleteSession","logger","keycloakBase","endSession","set","toString","endpoints","hooks","before","matcher","path","handler","useAccountCookie","legacy","after","returned","code","definitive","message","warn","Headers","accumulated","responseHeaders","getSetCookie","forEach","cookie","append","runtimeEnv","process","env","createAuth","BASE_URL","ONE_PORT","isProduction","NODE_ENV","keycloakBaseUrl","KEYCLOAK_BACKCHANNEL_URL","keycloakRealm","KEYCLOAK_REALM","keycloakClientId","KEYCLOAK_CLIENT_ID","keycloakClientSecret","KEYCLOAK_CLIENT_SECRET","expoPlugin","enableExpo","basePath","keycloakProviderConfig","tokenUrl","userInfoUrl","mapProfileToUser","profile","handle","preferred_username","sub","email","emailVerified","email_verified","keycloakPublicPath","pathname","replace","requestOrigin","hostname","Object","defineProperty","enumerable","keycloakPublicBase","base","oauthPlugin","config","keycloakSsoPlugin","plugins","database","DATABASE_URL","baseURL","SECRET","trustedOrigins","includes","map","cookieCache","enabled","maxAge","sessionMaxAge","strategy","refreshCache","storeStateStrategy","storeAccountCookie","createAuthRouteHandler","auth","run","GET","POST","createSessionHelpers","getSession","api","verifyAuth","Response"],"sources":["../../src/index.ts"],"sourcesContent":[null],"mappings":"AAgBA,SAASA,iBAAA,QAAyB;AAClC,SAASC,UAAA,EAAYC,kBAAA,QAA0B;AAE/C,SACEC,QAAA,EACAC,kBAAA,EACAC,oBAAA,EACAC,cAAA,EACAC,iBAAA,EACAC,UAAA,QACK;AACP,SAASC,mBAAA,EAAqBC,gBAAA,QAAwB;AACtD,SAASC,YAAA,EAAcC,QAAA,QAAgB;AACvC,SAASC,IAAA,QAAY;AACrB,SAASC,0BAAA,EAA4BC,yBAAA,QAAiC;AAEtE,SACEC,4BAAA,EACAF,0BAAA,IAAAG,2BAAA,EACAF,yBAAA,IAAAG,0BAAA,EACAC,2BAAA,EACAC,mBAAA,EACAC,oBAAA,QACK;AAYP,MAAMC,oBAAA,GAAuB,IAAItB,iBAAA,CAA0B;AAY3D,SAASuB,oBAAoBC,GAAA,EAAkC;EAC7D,MAAMC,SAAA,GAAaC,IAAA,IACjBC,qBAAA,CAAsBC,IAAA,CAAMC,OAAA,IAAY3B,kBAAA,CAAmBwB,IAAA,EAAMG,OAAO,CAAC;EAE3E,MAAMC,aAAA,GAAgBN,GAAA,CAAIO,OAAA,CAAQC,GAAA,CAAI,kBAAkB;EACxD,IAAIF,aAAA,IAAiBL,SAAA,CAAUK,aAAa,GAAG;IAC7C,MAAMG,KAAA,GAAQT,GAAA,CAAIO,OAAA,CAAQC,GAAA,CAAI,mBAAmB,MAAM,UAAU,UAAU;IAC3E,OAAO,GAAGC,KAAK,MAAMH,aAAa;EACpC;EAEA,WAAWI,SAAA,IAAa,CAACV,GAAA,CAAIO,OAAA,CAAQC,GAAA,CAAI,QAAQ,GAAGR,GAAA,CAAIW,GAAG,GAAG;IAC5D,IAAI,CAACD,SAAA,EAAW;IAChB,IAAI;MACF,MAAMC,GAAA,GAAM,IAAIC,GAAA,CAAIF,SAAS;MAC7B,IAAIT,SAAA,CAAUU,GAAA,CAAIT,IAAI,GAAG,OAAOS,GAAA,CAAIE,MAAA;IACtC,QAAQ,CAER;EACF;EACA,OAAO;AACT;AAqDA,MAAMV,qBAAA,GAAwB,CAC5B,aACA,eACA,aACA,eACA,QACA,aACA,SACA,WACA,YACF;AAmBA,MAAMW,qBAAA,GAAwBhC,cAAA,CAAeiC,OAAA,CAAQC,IAAA;AAKrD,SAASC,uBAAuBD,IAAA,EAAwB;EACtD,OAAOF,qBAAA,EAAuBI,SAAA,GAAYF,IAAI,EAAEG,OAAA,KAAY;AAC9D;AAqCA,SAASC,wBAAwBL,OAAA,EAAmC;EAClE,MAAM;IAAEM,KAAA;IAAOC,QAAA;IAAUC,YAAA;IAAcC,MAAA;IAAQC,OAAA;IAASC;EAAsB,IAAIX,OAAA;EAClF,MAAMY,aAAA,GAAgB,GAAGH,MAAM;EAG/B,MAAMI,oBAAA,GAAwBC,OAAA,IAC5B/B,oBAAA,CAAqBgC,QAAA,CAAS,MAAMD,OAAA,GAAU9B,mBAAA,CAAoB8B,OAAO,IAAI;EAQ/E,MAAME,yBAAA,GAA4B,MAAOC,YAAA,IAA2C;IAClF,IAAI;MACF,MAAMC,GAAA,GAAM,MAAMC,KAAA,CAAMP,aAAA,EAAe;QACrCQ,MAAA,EAAQ;QACR5B,OAAA,EAAS;UAAE,gBAAgB;QAAoC;QAC/DS,IAAA,EAAM,IAAIoB,eAAA,CAAgB;UACxBC,UAAA,EAAY;UACZC,aAAA,EAAeN,YAAA;UACfO,SAAA,EAAWjB,QAAA;UACXkB,aAAA,EAAejB;QACjB,CAAC;QACDkB,MAAA,EAAQC,WAAA,CAAYC,OAAA,CAAQ,GAAI;MAClC,CAAC;MACD,IAAIV,GAAA,CAAIW,EAAA,EAAI,OAAO;MACnB,IAAIX,GAAA,CAAIY,MAAA,KAAW,OAAOZ,GAAA,CAAIY,MAAA,KAAW,KAAK,OAAO;MACrD,MAAM7B,IAAA,GAAQ,MAAMiB,GAAA,CAAIa,IAAA,CAAK,EAAEC,KAAA,CAAM,MAAM,IAAI;MAC/C,OAAO/B,IAAA,EAAMgC,KAAA,KAAU,mBAAmBhC,IAAA,EAAMgC,KAAA,KAAU;IAC5D,QAAQ;MACN,OAAO;IACT;EACF;EAEA,MAAMC,UAAA,GAAarE,kBAAA,CAAmB,iBAAiB;IAAEuD,MAAA,EAAQ;EAAM,GAAG,MAAOe,GAAA,IAAQ;IACvF,MAAMC,aAAA,GAAgBvB,oBAAA,CAAqBsB,GAAA,CAAIrB,OAAO,KAAKJ,OAAA;IAC3D,MAAM2B,YAAA,GAAeF,GAAA,CAAIrB,OAAA,GAAU,IAAIjB,GAAA,CAAIsC,GAAA,CAAIrB,OAAA,CAAQlB,GAAG,EAAEyC,YAAA,GAAe;IAC3E,MAAMC,WAAA,GAAcD,YAAA,EAAc5C,GAAA,CAAI,aAAa,KAAK;IAExD,MAAM8C,QAAA,GAAWF,YAAA,EAAc5C,GAAA,CAAI,MAAM,MAAM;IAC/C,MAAM+C,MAAA,GAASA,CAAC5C,GAAA,EAAa6C,QAAA,KAAsB;MACjD,IAAIF,QAAA,EAAU,OAAOJ,GAAA,CAAIJ,IAAA,CAAK;QAAEU,QAAA;QAAU7C;MAAI,CAAC;MAC/C,MAAMuC,GAAA,CAAIM,QAAA,CAAS7C,GAAG;IACxB;IACA,MAAM8C,WAAA,GAAcJ,WAAA,IAAe;IAGnC,MAAMK,kBAAA,GAAqBD,WAAA,CAAYE,UAAA,CAAW,GAAG,IACjD,GAAGR,aAAa,GAAGM,WAAW,KAC9BA,WAAA;IAOJ,IAAIG,WAAA;IACJ,MAAMC,YAAA,GAAe,MAAMX,GAAA,CAAIY,eAAA,CAC7BZ,GAAA,CAAIa,OAAA,CAAQC,WAAA,CAAYH,YAAA,CAAaI,IAAA,EACrCf,GAAA,CAAIa,OAAA,CAAQG,MACd;IACA,MAAMC,OAAA,GAAU,MAAMpF,iBAAA,CAAkBmE,GAAG,EAAEH,KAAA,CAAM,MAAM,IAAI;IAC7D,IAAIoB,OAAA,EAAS;MACX,MAAMC,QAAA,GAAY,MAAMlB,GAAA,CAAIa,OAAA,CAAQM,eAAA,CACjCC,YAAA,CAAaH,OAAA,CAAQI,IAAA,CAAKC,EAAE,EAC5BzB,KAAA,CAAM,MAAM,EAAE;MACjBa,WAAA,GACEQ,QAAA,CAASK,IAAA,CAAMC,OAAA,IAAYA,OAAA,CAAQC,UAAA,KAAe,UAAU,GAAGC,OAAA,IAAW;IAC9E;IACA,IAAI,CAAChB,WAAA,EAAa;MAChB,MAAMiB,aAAA,GAAiB,MAAM3F,gBAAA,CAAiBgE,GAAG,EAAEH,KAAA,CACjD,MAAM,IACR;MACA,IAAI8B,aAAA,EAAeF,UAAA,KAAe,cAAcE,aAAA,CAAcD,OAAA,EAAS;QACrEhB,WAAA,GAAciB,aAAA,CAAcD,OAAA;MAC9B;IACF;IAEA,IAAIf,YAAA,EAAc;MAChB,MAAMX,GAAA,CAAIa,OAAA,CAAQM,eAAA,CAAgBS,aAAA,CAAcjB,YAAY,EAAEd,KAAA,CAAOC,KAAA,IAAmB;QACtFE,GAAA,CAAIa,OAAA,CAAQgB,MAAA,CAAO/B,KAAA,CAAM,gDAAgDA,KAAK;MAChF,CAAC;IACH;IACA/D,mBAAA,CAAoBiE,GAAG;IAOvB,MAAM8B,YAAA,GAAetD,qBAAA,CAAsByB,aAAa;IACxD,IAAI,CAAC6B,YAAA,IAAiB,CAACb,OAAA,IAAW,CAACP,WAAA,IAAe,CAACC,YAAA,EAAe;MAChE,OAAON,MAAA,CAAOG,kBAAA,EAAoB,KAAK;IACzC;IAEA,MAAMuB,UAAA,GAAa,IAAIrE,GAAA,CAAI,GAAGoE,YAAY,WAAW3D,KAAK,iCAAiC;IAC3F4D,UAAA,CAAW7B,YAAA,CAAa8B,GAAA,CAAI,4BAA4BxB,kBAAkB;IAC1EuB,UAAA,CAAW7B,YAAA,CAAa8B,GAAA,CAAI,aAAa5D,QAAQ;IACjD,IAAIsC,WAAA,EAAaqB,UAAA,CAAW7B,YAAA,CAAa8B,GAAA,CAAI,iBAAiBtB,WAAW;IACzE,OAAOL,MAAA,CAAO0B,UAAA,CAAWE,QAAA,CAAS,GAAG,IAAI;EAC3C,CAAC;EAED,OAAO;IACLX,EAAA,EAAI;IACJY,SAAA,EAAW;MACTnC;IACF;IACAoC,KAAA,EAAO;MACLC,MAAA,EAAQ,CACN;QAAA;QAAA;QAAA;QAAA;QAAA;QAAA;QAAA;QAQEC,OAAA,EAAUrC,GAAA,IAAQA,GAAA,CAAIsC,IAAA,KAAS;QAC/BC,OAAA,EAAS5G,oBAAA,CAAqB,MAAOqE,GAAA,IAAQ;UAC3C,MAAMiB,OAAA,GAAU,MAAMpF,iBAAA,CAAkBmE,GAAG,EAAEH,KAAA,CAAM,MAAM,IAAI;UAC7D,IAAI,CAACoB,OAAA,EAAS,OAAOjB,GAAA,CAAIJ,IAAA,CAAK,IAAI;UAClC,MAAM9B,IAAA,GAAOkC,GAAA,CAAIlC,IAAA;UACjB,IAAIA,IAAA,EAAM0E,gBAAA,KAAqB,QAAQzE,sBAAA,CAAuBD,IAAI,GAAG;UACrE,MAAM2E,MAAA,GAAS;YAAE,GAAG3E,IAAA;YAAM2D,UAAA,EAAY;UAAW;UACjD,IAAI1D,sBAAA,CAAuB0E,MAAM,GAAG,OAAO;YAAE5B,OAAA,EAAS;cAAE/C,IAAA,EAAM2E;YAAO;UAAE;QACzE,CAAC;MACH,EACF;MACAC,KAAA,EAAO,CACL;QACEL,OAAA,EAAUrC,GAAA,IAAQA,GAAA,CAAIsC,IAAA,KAAS;QAC/BC,OAAA,EAAS5G,oBAAA,CAAqB,MAAOqE,GAAA,IAAQ;UAC3C,MAAM2C,QAAA,GAAW3C,GAAA,CAAIa,OAAA,CAAQ8B,QAAA;UAC7B,IAAI,CAAC7G,UAAA,CAAW6G,QAAQ,GAAG;UAC3B,MAAM7E,IAAA,GAAO6E,QAAA,CAAS7E,IAAA;UACtB,IAAIA,IAAA,EAAM8E,IAAA,KAASxG,0BAAA,EAA4B;UAC/C,MAAMqF,UAAA,GAAczB,GAAA,CAAIlC,IAAA,EAA8C2D,UAAA;UACtE,IAAIA,UAAA,IAAcA,UAAA,KAAe,YAAY;UAE7C,MAAMR,OAAA,GAAU,MAAMpF,iBAAA,CAAkBmE,GAAG,EAAEH,KAAA,CAAM,MAAM,IAAI;UAC7D,IAAI,CAACoB,OAAA,EAAS;UAKd,MAAMC,QAAA,GAAY,MAAMlB,GAAA,CAAIa,OAAA,CAAQM,eAAA,CACjCC,YAAA,CAAaH,OAAA,CAAQI,IAAA,CAAKC,EAAE,EAC5BzB,KAAA,CAAM,MAAM,EAAE;UACjB,IAAIf,YAAA,GAAeoC,QAAA,CAASK,IAAA,CACzBC,OAAA,IAAYA,OAAA,CAAQC,UAAA,KAAe,UACtC,GAAG3C,YAAA;UACH,IAAI,CAACA,YAAA,EAAc;YACjB,MAAM6C,aAAA,GAAiB,MAAM3F,gBAAA,CAAiBgE,GAAG,EAAEH,KAAA,CACjD,MAAM,IACR;YACA,IAAI8B,aAAA,EAAeF,UAAA,KAAe,YAAY;cAC5C3C,YAAA,GAAe6C,aAAA,CAAc7C,YAAA;YAC/B;UACF;UACA,MAAM+D,UAAA,GAAa/D,YAAA,GAAe,MAAMD,yBAAA,CAA0BC,YAAY,IAAI;UAClF,IAAI,CAAC+D,UAAA,EAAY;YAIf,OAAO,IAAIpH,QAAA,CAAS,yBAAyB;cAC3CqH,OAAA,EAAS;cACTF,IAAA,EAAMvG;YACR,CAAC;UACH;UAEA2D,GAAA,CAAIa,OAAA,CAAQgB,MAAA,CAAOkB,IAAA,CACjB,wFACF;UACA,MAAMpC,YAAA,GAAe,MAAMX,GAAA,CAAIY,eAAA,CAC7BZ,GAAA,CAAIa,OAAA,CAAQC,WAAA,CAAYH,YAAA,CAAaI,IAAA,EACrCf,GAAA,CAAIa,OAAA,CAAQG,MACd;UACA,IAAIL,YAAA,EAAc;YAChB,MAAMX,GAAA,CAAIa,OAAA,CAAQM,eAAA,CACfS,aAAA,CAAcjB,YAAY,EAC1Bd,KAAA,CAAOC,KAAA,IAAmB;cACzBE,GAAA,CAAIa,OAAA,CAAQgB,MAAA,CAAO/B,KAAA,CAAM,kCAAkCA,KAAK;YAClE,CAAC;UACL;UACA/D,mBAAA,CAAoBiE,GAAG;UAKvB,MAAM3C,OAAA,GAAU,IAAI2F,OAAA,CAAQ;UAC5B,MAAMC,WAAA,GAAejD,GAAA,CAAiDkD,eAAA;UACtED,WAAA,EAAaE,YAAA,CAAa,EAAEC,OAAA,CAASC,MAAA,IAAW;YAC9ChG,OAAA,CAAQiG,MAAA,CAAO,cAAcD,MAAM;UACrC,CAAC;UACD,OAAO,IAAI5H,QAAA,CACT,eACA;YACEqH,OAAA,EAAShF,IAAA,EAAMgF,OAAA,IAAW;YAC1BF,IAAA,EAAMxG;UACR,GACAiB,OACF;QACF,CAAC;MACH;IAEJ;EACF;AACF;AAEA,SAASkG,WAAA,EAAiD;EACxD,OAAO,OAAOC,OAAA,KAAY,cAAc,CAAC,IAAIA,OAAA,CAAQC,GAAA;AACvD;AAWO,SAASC,WAAW7F,OAAA,GAA6B,CAAC,GAAG;EAC1D,MAAM4F,GAAA,GAAMF,UAAA,CAAW;EACvB,MAAMhF,OAAA,GAAUV,OAAA,CAAQU,OAAA,IAAWkF,GAAA,CAAIE,QAAA,IAAY,oBAAoBF,GAAA,CAAIG,QAAA,IAAY,MAAM;EAC7F,MAAMC,YAAA,GAAeL,OAAA,CAAQC,GAAA,CAAIK,QAAA,KAAa;EAI9C,MAAMC,eAAA,GACJlG,OAAA,CAAQ3B,QAAA,EAAUqC,OAAA,IAAWkF,GAAA,CAAIO,wBAAA,IAA4B,GAAGzF,OAAO;EACzE,MAAM0F,aAAA,GAAgBpG,OAAA,CAAQ3B,QAAA,EAAUiC,KAAA,IAASsF,GAAA,CAAIS,cAAA,IAAkB;EACvE,MAAM5F,MAAA,GAAS,GAAGyF,eAAe,WAAWE,aAAa;EAEzD,MAAME,gBAAA,GAAmBtG,OAAA,CAAQ3B,QAAA,EAAUkC,QAAA,IAAYqF,GAAA,CAAIW,kBAAA,IAAsB;EACjF,MAAMC,oBAAA,GAAuBxG,OAAA,CAAQ3B,QAAA,EAAUmC,YAAA,IAAgBoF,GAAA,CAAIa,sBAAA,IAA0B;EAE7F,MAAMC,UAAA,GAAa1G,OAAA,CAAQ2G,UAAA,KAAe,QAAQrI,IAAA,CAAK,IAAI;EAE3D,MAAMsI,QAAA,GAAW5G,OAAA,CAAQ4G,QAAA,IAAY;EAErC,MAAMC,sBAAA,GAAyB;IAC7B,GAAGxI,QAAA,CAAS;MACVkC,QAAA,EAAU+F,gBAAA;MACV9F,YAAA,EAAcgG,oBAAA;MACd/F;IACF,CAAC;IAAA;IAAA;IAAA;IAAA;IAAA;IAMDqG,QAAA,EAAU,GAAGrG,MAAM;IACnBsG,WAAA,EAAa,GAAGtG,MAAM;IAAA;IAAA;IAAA;IAAA;IAAA;IAAA;IAOtBuG,gBAAA,EAAmBC,OAAA,IAAiC;MAClD,MAAMC,MAAA,GAASD,OAAA,CAAQE,kBAAA,IAAsBF,OAAA,CAAQG,GAAA,IAAOH,OAAA,CAAQxD,EAAA,IAAMwD,OAAA,CAAQ/D,IAAA;MAClF,MAAMmE,KAAA,GAAQJ,OAAA,CAAQI,KAAA,KAAUH,MAAA,GAAS,GAAGA,MAAM,YAAY;MAC9D,OAAO;QACL,GAAGD,OAAA;QACHI,KAAA;QACAC,aAAA,EAAeL,OAAA,CAAQM,cAAA,IAAkB;QACzCrE,IAAA,EAAM+D,OAAA,CAAQ/D,IAAA,IAAQgE;MACxB;IACF;EACF;EAGA,MAAMM,kBAAA,IAAsB,MAAM;IAChC,IAAI;MACF,MAAM/C,IAAA,GAAO,IAAI5E,GAAA,CAAIqG,eAAe,EAAEuB,QAAA,CAASC,OAAA,CAAQ,QAAQ,EAAE;MACjE,OAAOjD,IAAA,IAAQA,IAAA,KAAS,MAAMA,IAAA,GAAO;IACvC,QAAQ;MACN,OAAO;IACT;EACF,GAAG;EASH,MAAM9D,qBAAA,GAAyBgH,aAAA,IAA+C;IAC5E,IAAI,CAACH,kBAAA,EAAoB,OAAOtB,eAAA;IAChC,IAAI;MACF,MAAMtG,GAAA,GAAM,IAAIC,GAAA,CAAIa,OAAO;MAC3B,IAAI,CAACsF,YAAA,IAAgB2B,aAAA,EAAe;QAClC/H,GAAA,CAAIgI,QAAA,GAAW,IAAI/H,GAAA,CAAI8H,aAAa,EAAEC,QAAA;MACxC;MACA,OAAO,GAAGhI,GAAA,CAAIE,MAAM,GAAG0H,kBAAkB;IAC3C,QAAQ;MACN,OAAO;IACT;EACF;EAEA,IAAI,CAACxB,YAAA,EAAc;IAQjB6B,MAAA,CAAOC,cAAA,CAAejB,sBAAA,EAAwB,eAAe;MAC3DkB,UAAA,EAAY;MACZtI,IAAA,EAAM;QACJ,MAAMK,MAAA,GAASf,oBAAA,CAAqBgC,QAAA,CAAS;QAC7C,OAAOjB,MAAA,GAAS,GAAGA,MAAM,GAAG8G,QAAQ,8BAA8B;MACpE;IACF,CAAC;IAsBD,MAAMoB,kBAAA,GAAqBA,CAAA,KAA0B;MACnD,MAAMlI,MAAA,GAASf,oBAAA,CAAqBgC,QAAA,CAAS;MAC7C,IAAI,CAACjB,MAAA,IAAU,CAAC0H,kBAAA,EAAoB,OAAO;MAC3C,OAAO7G,qBAAA,CAAsBb,MAAM;IACrC;IACA,IAAI0H,kBAAA,EAAoB;MACtBK,MAAA,CAAOC,cAAA,CAAejB,sBAAA,EAAwB,oBAAoB;QAChEkB,UAAA,EAAY;QACZtI,IAAA,EAAM;UACJ,MAAMwI,IAAA,GAAOD,kBAAA,CAAmB;UAChC,OAAOC,IAAA,GAAO,GAAGA,IAAI,WAAW7B,aAAa,kCAAkC;QACjF;MACF,CAAC;MAQDyB,MAAA,CAAOC,cAAA,CAAejB,sBAAA,EAAwB,UAAU;QACtDkB,UAAA,EAAY;QACZtI,IAAA,EAAM;UACJ,MAAMwI,IAAA,GAAOD,kBAAA,CAAmB;UAChC,OAAOC,IAAA,GAAO,GAAGA,IAAI,WAAW7B,aAAa,KAAK;QACpD;MACF,CAAC;IACH;EACF;EAIA,MAAM8B,WAAA,GAAc9J,YAAA,CAAa;IAC/B+J,MAAA,EAAQ,CAACtB,sBAA8E;EACzF,CAAC;EAED,MAAMuB,iBAAA,GAAoB/H,uBAAA,CAAwB;IAChDC,KAAA,EAAO8F,aAAA;IACP7F,QAAA,EAAU+F,gBAAA;IACV9F,YAAA,EAAcgG,oBAAA;IACd/F,MAAA;IACAC,OAAA;IACAC;EACF,CAAC;EAED,MAAM0H,OAAA,GAAiB,CACrB,IAAI3B,UAAA,GAAa,CAACA,UAAU,IAAI,EAAC,GACjCwB,WAAA,EACAE,iBAAA,EACA,IAAIpI,OAAA,CAAQqI,OAAA,IAAW,EAAC,EAC1B;EAIA,MAAMC,QAAA,GAAWtI,OAAA,CAAQsI,QAAA,KAAa1C,GAAA,CAAI2C,YAAA,IAAgB;EAE1D,OAAO7K,UAAA,CAAW;IAChBkJ,QAAA;IAAA;IAAA;IAAA;IAAA;IAAA;IAMA4B,OAAA,EAAS9H,OAAA;IACT,IAAI4H,QAAA,GAAW;MAAEA;IAAS,IAAI,CAAC;IAC/BnF,MAAA,EAAQnD,OAAA,CAAQmD,MAAA,IAAUyC,GAAA,CAAI6C,MAAA,IAAU;IACxCC,cAAA,EAAgB1I,OAAA,CAAQ0I,cAAA,IAAkB,CACxChI,OAAA,EACAwF,eAAA;IAAA;IAEA,IAAIN,GAAA,CAAIG,QAAA,IAAY,CAACrF,OAAA,CAAQiI,QAAA,CAAS,IAAI/C,GAAA,CAAIG,QAAQ,EAAE,IACpD,CAAC,oBAAoBH,GAAA,CAAIG,QAAQ,EAAE,IACnC,EAAC,GACL;IAAA;IAAA;IAAA;IAAA;IAAA;IAMA,IAAIC,YAAA,GAAe,EAAC,GAAI,CAAC,UAAU,GAAG5G,qBAAA,CAAsBwJ,GAAA,CAAKzJ,IAAA,IAAS,UAAUA,IAAI,EAAE,CAAC,GAC7F;IACAiE,OAAA,EAAS;MACPyF,WAAA,EAAa;QACXC,OAAA,EAAS;QACTC,MAAA,EAAQ/I,OAAA,CAAQgJ,aAAA,IAAiB,IAAI,KAAK,KAAK;QAC/CC,QAAA,EAAU;QACVC,YAAA,EAAc;MAChB;IACF;IACAvF,OAAA,EAAS;MACPwF,kBAAA,EAAoB;MACpBC,kBAAA,EAAoB;IACtB;IACAf;EACF,CAAC;AACH;AAmBO,SAASgB,uBAAuBC,IAAA,EAAgB;EAKrD,MAAM5E,OAAA,GAAWzF,GAAA,IAAiB;IAChC,MAAMa,MAAA,GAASd,mBAAA,CAAoBC,GAAG;IACtC,OAAOa,MAAA,GAASf,oBAAA,CAAqBwK,GAAA,CAAIzJ,MAAA,EAAQ,MAAMwJ,IAAA,CAAK5E,OAAA,CAAQzF,GAAG,CAAC,IAAIqK,IAAA,CAAK5E,OAAA,CAAQzF,GAAG;EAC9F;EACA,OAAO;IAAEuK,GAAA,EAAK9E,OAAA;IAAS+E,IAAA,EAAM/E;EAAQ;AACvC;AASO,SAASgF,qBAAqBJ,IAAA,EAAgB;EAEnD,eAAeK,WAAW1K,GAAA,EAAc;IACtC,OAAOqK,IAAA,CAAKM,GAAA,CAAID,UAAA,CAAW;MAAEnK,OAAA,EAASP,GAAA,CAAIO;IAAQ,CAAC;EACrD;EAGA,eAAeqK,WAAW5K,GAAA,EAAc;IACtC,MAAMmE,OAAA,GAAU,MAAMkG,IAAA,CAAKM,GAAA,CAAID,UAAA,CAAW;MAAEnK,OAAA,EAASP,GAAA,CAAIO;IAAQ,CAAC;IAClE,IAAI,CAAC4D,OAAA,EAAS;MACZ,MAAM,IAAI0G,QAAA,CAAS,gBAAgB;QAAEhI,MAAA,EAAQ;MAAI,CAAC;IACpD;IACA,OAAOsB,OAAA;EACT;EAEA,OAAO;IAAEyG,UAAA;IAAYF;EAAW;AAClC","ignoreList":[]}

package/dist/esm/index.native.js

@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from "async_hooks";
 import { betterAuth, matchesHostPattern } from "better-auth";
-import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, isAPIError } from "better-auth/api";
+import { APIError, createAuthEndpoint, createAuthMiddleware, getAccessToken, getSessionFromCtx, isAPIError } from "better-auth/api";
 import { deleteSessionCookie, getAccountCookie } from "better-auth/cookies";
 import { genericOAuth, keycloak } from "better-auth/plugins";
 import { expo } from "@better-auth/expo";
@@ -18,20 +18,22 @@ function deriveRequestOrigin(req) {
     var proto = req.headers.get("x-forwarded-proto") === "https" ? "https" : "http";
     return `${proto}://${forwardedHost}`;
   }
-  var originHeader = req.headers.get("origin");
-  if (originHeader) {
+  for (var _i = 0, _iter = [req.headers.get("origin"), req.url]; _i < _iter.length; _i++) {
+    var candidate = _iter[_i];
+    if (!candidate) continue;
     try {
-      var url = new URL(originHeader);
+      var url = new URL(candidate);
       if (isDevHost(url.host)) return url.origin;
     } catch (unused) {}
   }
-  try {
-    return new URL(req.url).origin;
-  } catch (unused) {
-    return void 0;
-  }
+  return void 0;
 }
 var DEV_LAN_HOST_PATTERNS = ["localhost", "localhost:*", "127.0.0.1", "127.0.0.1:*", "10.*", "192.168.*", "172.*", "*.local", "*.local:*"];
+var accessTokenBodySchema = getAccessToken.options.body;
+function acceptsAccessTokenBody(body) {
+  var _accessTokenBodySchema_safeParse;
+  return (accessTokenBodySchema === null || accessTokenBodySchema === void 0 ? void 0 : (_accessTokenBodySchema_safeParse = accessTokenBodySchema.safeParse) === null || _accessTokenBodySchema_safeParse === void 0 ? void 0 : _accessTokenBodySchema_safeParse.call(accessTokenBodySchema, body).success) !== false;
+}
 function createKeycloakSsoPlugin(options) {
   var {
     realm,
@@ -138,6 +140,9 @@ function createKeycloakSsoPlugin(options) {
         // so it is a 200 with no token, as /get-session answers, instead
         // of a 4xx the browser logs. Runs before body validation, so the
         // client's body-shape negotiation never 400s for a visitor either.
+        // A signed-in >=1.7 body (`useAccountCookie`) on a server whose
+        // schema still demands `providerId` gets the Keycloak provider
+        // added, so the negotiation never 400s once signed in either.
         matcher: function matcher(ctx) {
           return ctx.path === "/get-access-token";
         },
@@ -146,6 +151,17 @@ function createKeycloakSsoPlugin(options) {
             return null;
           });
           if (!session) return ctx.json(null);
+          var body = ctx.body;
+          if ((body === null || body === void 0 ? void 0 : body.useAccountCookie) !== true || acceptsAccessTokenBody(body)) return;
+          var legacy = {
+            ...body,
+            providerId: "keycloak"
+          };
+          if (acceptsAccessTokenBody(legacy)) return {
+            context: {
+              body: legacy
+            }
+          };
         })
       }],
       after: [{