@netlify/identity 0.3.0-alpha.2 → 0.3.0-alpha.3

package/README.md

@@ -26,7 +26,7 @@ This library wraps `gotrue-js` in the browser and calls the GoTrue HTTP API dire
 - [API](#api)
   - [Functions](#functions) -- `getUser`, `login`, `signup`, `logout`, `oauthLogin`, `handleAuthCallback`, `onAuthChange`, `hydrateSession`, and more
   - [Admin Operations](#admin-operations) -- `admin.listUsers`, `admin.getUser`, `admin.createUser`, `admin.updateUser`, `admin.deleteUser`
-  - [Types](#types) -- `User`, `AuthEvent`, `CallbackResult`, `Settings`, etc.
+  - [Types](#types) -- `User`, `AuthEvent`, `CallbackResult`, `Settings`, `Admin`, `ListUsersOptions`, `CreateUserParams`, etc.
   - [Errors](#errors) -- `AuthError`, `MissingIdentityError`
 - [Framework integration](#framework-integration) -- Next.js, Remix, TanStack Start, Astro, SvelteKit
 - [Guides](#guides)
@@ -312,7 +312,7 @@ export default async (req: Request, context: Context) => {
 #### `admin.listUsers`
 
 ```ts
-admin.listUsers(options?: { page?: number; perPage?: number }): Promise<User[]>
+admin.listUsers(options?: ListUsersOptions): Promise<User[]>
 ```
 
 Lists all users. Pagination options are supported on the server; they are ignored in the browser (gotrue-js does not support pagination for this method).
@@ -332,7 +332,7 @@ Gets a single user by ID.
 #### `admin.createUser`
 
 ```ts
-admin.createUser(params: { email: string; password: string; data?: Record<string, unknown> }): Promise<User>
+admin.createUser(params: CreateUserParams): Promise<User>
 ```
 
 Creates a new user. The user is auto-confirmed. Optional `data` is spread into the request body as additional attributes.
@@ -450,6 +450,43 @@ interface AppMetadata {
 }
 ```
 
+#### `ListUsersOptions`
+
+```ts
+interface ListUsersOptions {
+  page?: number
+  perPage?: number
+}
+```
+
+Pagination options for `admin.listUsers()`. Only used on the server; pagination is ignored in the browser (gotrue-js limitation).
+
+#### `CreateUserParams`
+
+```ts
+interface CreateUserParams {
+  email: string
+  password: string
+  data?: Record<string, unknown>
+}
+```
+
+Parameters for `admin.createUser()`. Optional `data` is spread into the GoTrue request body as top-level attributes (use it to set `app_metadata`, `user_metadata`, `role`, etc.).
+
+#### `Admin`
+
+```ts
+interface Admin {
+  listUsers: (options?: ListUsersOptions) => Promise<User[]>
+  getUser: (userId: string) => Promise<User>
+  createUser: (params: CreateUserParams) => Promise<User>
+  updateUser: (userId: string, attributes: AdminUserUpdates) => Promise<User>
+  deleteUser: (userId: string) => Promise<void>
+}
+```
+
+The type of the `admin` export. Useful for passing the admin namespace as a dependency.
+
 #### `AUTH_EVENTS`
 
 ```ts

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/types.ts","../src/environment.ts","../src/errors.ts","../src/cookies.ts","../src/nextjs.ts","../src/user.ts","../src/config.ts","../src/events.ts","../src/auth.ts","../src/account.ts","../src/admin.ts"],"sourcesContent":["export type { User } from './user.js'\nexport { getUser, isAuthenticated } from './user.js'\nexport { getIdentityConfig, getSettings } from './config.js'\nexport type { AuthCallback, AuthEvent } from './events.js'\nexport { AUTH_EVENTS, onAuthChange } from './events.js'\nexport type { CallbackResult } from './auth.js'\nexport { login, signup, logout, oauthLogin, handleAuthCallback, hydrateSession } from './auth.js'\nexport { AuthError, MissingIdentityError } from './errors.js'\nexport type {\n  AdminUserUpdates,\n  AppMetadata,\n  AuthProvider,\n  IdentityConfig,\n  Settings,\n  UserUpdates,\n  SignupData,\n} from './types.js'\nexport {\n  requestPasswordRecovery,\n  recoverPassword,\n  confirmEmail,\n  acceptInvite,\n  verifyEmailChange,\n  updateUser,\n} from './account.js'\nexport { admin } from './admin.js'\n","export const AUTH_PROVIDERS = ['google', 'github', 'gitlab', 'bitbucket', 'facebook', 'saml', 'email'] as const\nexport type AuthProvider = (typeof AUTH_PROVIDERS)[number]\n\nexport interface AppMetadata {\n  provider: AuthProvider\n  roles?: string[]\n  [key: string]: unknown\n}\n\nexport interface IdentityConfig {\n  url: string\n  token?: string // this is an operator token, only available on the server\n}\n\nexport interface Settings {\n  autoconfirm: boolean\n  disableSignup: boolean\n  providers: Record<AuthProvider, boolean>\n}\n\n/**\n * Fields accepted by {@link updateUser}. All fields are optional.\n * Pass `data` to update user metadata (e.g., `{ data: { full_name: 'New Name' } }`).\n */\nexport interface UserUpdates {\n  email?: string\n  password?: string\n  data?: Record<string, unknown>\n  [key: string]: unknown\n}\n\n/**\n * User metadata passed during signup (e.g., `{ full_name: 'Jane Doe' }`).\n * Stored in the user's `user_metadata` field.\n */\nexport type SignupData = Record<string, unknown>\n\n/** GoTrue OAuth2 token response from the /token endpoint. */\nexport interface TokenResponse {\n  access_token: string\n  token_type: string\n  expires_in: number\n  refresh_token?: string\n}\n\n/**\n * Fields accepted by {@link admin.updateUser}. All fields are optional.\n *\n * Unlike {@link UserUpdates} (used by the self-service `updateUser`), admin updates\n * can set `role`, force-confirm a user, and write to `app_metadata`.\n */\nexport interface AdminUserUpdates {\n  email?: string\n  password?: string\n  role?: string\n  confirm?: boolean\n  app_metadata?: Record<string, unknown>\n  user_metadata?: Record<string, unknown>\n  [key: string]: unknown\n}\n\n/** GoTrue error response body. */\nexport interface GoTrueErrorBody {\n  msg?: string\n  error_description?: string\n}\n\nexport interface NetlifyCookies {\n  get(name: string): string | undefined\n  set(options: {\n    name: string\n    value: string\n    httpOnly: boolean\n    secure: boolean\n    path: string\n    sameSite: string\n  }): void\n  delete(name: string): void\n}\n","import GoTrue from 'gotrue-js'\n\nimport type { IdentityConfig } from './types.js'\nimport { MissingIdentityError } from './errors.js'\n\nexport const IDENTITY_PATH = '/.netlify/identity'\n\nlet goTrueClient: GoTrue | null = null\nlet cachedApiUrl: string | null | undefined\nlet warnedMissingUrl = false\n\nexport const isBrowser = (): boolean => typeof window !== 'undefined' && typeof window.location !== 'undefined'\n\n/**\n * Discovers and caches the GoTrue API URL.\n *\n * Browser: uses `window.location.origin` + IDENTITY_PATH.\n * Server: reads from `globalThis.netlifyIdentityContext`.\n */\nconst discoverApiUrl = (): string | null => {\n  if (cachedApiUrl !== undefined) return cachedApiUrl\n\n  if (isBrowser()) {\n    cachedApiUrl = `${window.location.origin}${IDENTITY_PATH}`\n  } else {\n    const identityContext = getIdentityContext()\n    if (identityContext?.url) {\n      cachedApiUrl = identityContext.url\n    } else if (globalThis.Netlify?.context?.url) {\n      cachedApiUrl = new URL(IDENTITY_PATH, globalThis.Netlify.context.url).href\n    } else if (process.env.URL) {\n      cachedApiUrl = new URL(IDENTITY_PATH, process.env.URL).href\n    }\n  }\n\n  return cachedApiUrl ?? null\n}\n\n/**\n * Returns (and lazily creates) a singleton gotrue-js client.\n * Returns `null` and logs a warning if no identity URL can be discovered.\n */\nexport const getGoTrueClient = (): GoTrue | null => {\n  if (goTrueClient) return goTrueClient\n\n  const apiUrl = discoverApiUrl()\n  if (!apiUrl) {\n    if (!warnedMissingUrl) {\n      console.warn(\n        '@netlify/identity: Could not determine the Identity endpoint URL. ' +\n          'Make sure your site has Netlify Identity enabled, or run your app with `netlify dev`.',\n      )\n      warnedMissingUrl = true\n    }\n    return null\n  }\n\n  goTrueClient = new GoTrue({ APIUrl: apiUrl, setCookie: false })\n  return goTrueClient\n}\n\n/**\n * Returns the singleton gotrue-js client, or throws if Identity is not configured.\n */\nexport const getClient = (): GoTrue => {\n  const client = getGoTrueClient()\n  if (!client) throw new MissingIdentityError()\n  return client\n}\n\n/**\n * Reads the server-side identity context set by the Netlify bootstrap.\n * Returns `null` outside the Netlify serverless environment.\n */\nexport const getIdentityContext = (): IdentityConfig | null => {\n  const identityContext = globalThis.netlifyIdentityContext\n  if (identityContext?.url) {\n    return {\n      url: identityContext.url,\n      token: identityContext.token,\n    }\n  }\n\n  if (globalThis.Netlify?.context?.url) {\n    return { url: new URL(IDENTITY_PATH, globalThis.Netlify.context.url).href }\n  }\n\n  // Fallback: Netlify sets the URL env var on all deployed sites\n  const siteUrl = process.env.URL\n  if (siteUrl) {\n    return { url: new URL(IDENTITY_PATH, siteUrl).href }\n  }\n\n  return null\n}\n\n/** Reset cached state for tests. */\nexport const resetTestGoTrueClient = (): void => {\n  goTrueClient = null\n  cachedApiUrl = undefined\n  warnedMissingUrl = false\n}\n","export class AuthError extends Error {\n  override name = 'AuthError'\n  status?: number\n  declare cause?: unknown\n\n  constructor(message: string, status?: number, options?: { cause?: unknown }) {\n    super(message)\n    this.status = status\n    if (options && 'cause' in options) {\n      this.cause = options.cause\n    }\n  }\n}\n\nexport class MissingIdentityError extends Error {\n  override name = 'MissingIdentityError'\n\n  constructor(message = 'Netlify Identity is not available.') {\n    super(message)\n  }\n}\n","import type { NetlifyCookies } from './types.js'\n\nexport const NF_JWT_COOKIE = 'nf_jwt'\nexport const NF_REFRESH_COOKIE = 'nf_refresh'\n\n/** Reads a cookie value from `document.cookie` by name. Returns `null` if not found. */\nexport const getCookie = (name: string): string | null => {\n  const match = document.cookie.match(new RegExp(`(?:^|; )${name.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')}=([^;]*)`))\n  return match ? decodeURIComponent(match[1]) : null\n}\n\n/** Sets the `nf_jwt` and (optionally) `nf_refresh` auth cookies via the Netlify runtime. */\nexport const setAuthCookies = (cookies: NetlifyCookies, accessToken: string, refreshToken?: string): void => {\n  cookies.set({\n    name: NF_JWT_COOKIE,\n    value: accessToken,\n    httpOnly: false,\n    secure: true,\n    path: '/',\n    sameSite: 'Lax',\n  })\n\n  if (refreshToken) {\n    // httpOnly: false because browser-side hydration (backgroundHydrate, hydrateSession)\n    // reads nf_refresh via document.cookie to bootstrap the gotrue-js session.\n    cookies.set({\n      name: NF_REFRESH_COOKIE,\n      value: refreshToken,\n      httpOnly: false,\n      secure: true,\n      path: '/',\n      sameSite: 'Lax',\n    })\n  }\n}\n\n/** Deletes both auth cookies via the Netlify runtime. */\nexport const deleteAuthCookies = (cookies: NetlifyCookies): void => {\n  cookies.delete(NF_JWT_COOKIE)\n  cookies.delete(NF_REFRESH_COOKIE)\n}\n\n/** Sets auth cookies via document.cookie (browser-side). */\nexport const setBrowserAuthCookies = (accessToken: string, refreshToken?: string): void => {\n  document.cookie = `${NF_JWT_COOKIE}=${encodeURIComponent(accessToken)}; path=/; secure; samesite=lax`\n  if (refreshToken) {\n    document.cookie = `${NF_REFRESH_COOKIE}=${encodeURIComponent(refreshToken)}; path=/; secure; samesite=lax`\n  }\n}\n\n/** Deletes auth cookies via document.cookie (browser-side). */\nexport const deleteBrowserAuthCookies = (): void => {\n  document.cookie = `${NF_JWT_COOKIE}=; path=/; secure; samesite=lax; expires=Thu, 01 Jan 1970 00:00:00 GMT`\n  document.cookie = `${NF_REFRESH_COOKIE}=; path=/; secure; samesite=lax; expires=Thu, 01 Jan 1970 00:00:00 GMT`\n}\n\n/** Reads a cookie from the server-side Netlify runtime. Returns `null` if not available. */\nexport const getServerCookie = (name: string): string | null => {\n  const cookies = globalThis.Netlify?.context?.cookies\n  if (!cookies || typeof cookies.get !== 'function') return null\n  return cookies.get(name) ?? null\n}\n","// Minimal declaration so we can use require() without @types/node\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\ndeclare const require: ((id: string) => any) | undefined\n\n/**\n * Calls `headers()` from `next/headers` if available, to opt Next.js RSC\n * routes into dynamic rendering. Without this, Next.js may statically\n * optimize pages that call functions in this package, caching the build-time result.\n *\n * Re-throws DynamicServerError so Next.js can catch it and switch to\n * dynamic rendering. Silently ignores if not in a Next.js environment.\n */\nlet nextHeadersFn: (() => unknown) | null | undefined\nexport const triggerNextjsDynamic = (): void => {\n  if (nextHeadersFn === null) return\n\n  if (nextHeadersFn === undefined) {\n    try {\n      if (typeof require === 'undefined') {\n        nextHeadersFn = null\n        return\n      }\n      const mod = require('next/headers')\n      nextHeadersFn = mod.headers\n    } catch {\n      nextHeadersFn = null\n      return\n    }\n  }\n\n  const fn = nextHeadersFn\n  if (!fn) return\n\n  try {\n    fn()\n  } catch (e: unknown) {\n    // Re-throw DynamicServerError so Next.js can opt into dynamic rendering.\n    // These errors have a `digest` property containing 'DYNAMIC_SERVER_USAGE'\n    // or a message about bailing out of prerendering.\n    if (e instanceof Error && ('digest' in e || /bail\\s*out.*prerende/i.test(e.message))) {\n      throw e\n    }\n  }\n}\n\n/** Reset cached state and optionally inject a headers function. Test use only. */\nexport const resetNextjsState = (headersFn?: (() => unknown) | null): void => {\n  nextHeadersFn = headersFn === null ? null : (headersFn ?? undefined)\n}\n","import type { UserData } from 'gotrue-js'\nimport { AUTH_PROVIDERS, type AuthProvider } from './types.js'\nimport { getGoTrueClient, getClient, isBrowser } from './environment.js'\nimport { getCookie, getServerCookie, NF_JWT_COOKIE, NF_REFRESH_COOKIE } from './cookies.js'\nimport { triggerNextjsDynamic } from './nextjs.js'\n\nexport interface IdentityUser {\n  sub?: string\n  email?: string\n  exp?: number\n  app_metadata?: Record<string, unknown>\n  user_metadata?: Record<string, unknown>\n  [key: string]: unknown\n}\n\nconst toAuthProvider = (value: unknown): AuthProvider | undefined =>\n  typeof value === 'string' && (AUTH_PROVIDERS as readonly string[]).includes(value)\n    ? (value as AuthProvider)\n    : undefined\n\nexport interface User {\n  id: string\n  email?: string\n  emailVerified?: boolean\n  createdAt?: string\n  updatedAt?: string\n  provider?: AuthProvider\n  name?: string\n  pictureUrl?: string\n  metadata?: Record<string, unknown>\n  rawGoTrueData?: Record<string, unknown>\n}\n\nexport const toUser = (userData: UserData): User => {\n  const userMeta = userData.user_metadata ?? {}\n  const appMeta = userData.app_metadata ?? {}\n  const name = userMeta.full_name || userMeta.name\n  const pictureUrl = userMeta.avatar_url\n\n  return {\n    id: userData.id,\n    email: userData.email,\n    emailVerified: !!userData.confirmed_at,\n    createdAt: userData.created_at,\n    updatedAt: userData.updated_at,\n    provider: toAuthProvider(appMeta.provider),\n    name: typeof name === 'string' ? name : undefined,\n    pictureUrl: typeof pictureUrl === 'string' ? pictureUrl : undefined,\n    metadata: userMeta,\n    rawGoTrueData: { ...userData },\n  }\n}\n\n/**\n * Converts server-side JWT claims into User\n */\nconst claimsToUser = (claims: IdentityUser): User => {\n  const appMeta = claims.app_metadata ?? {}\n  const userMeta = claims.user_metadata ?? {}\n  const name = userMeta.full_name || userMeta.name\n\n  return {\n    id: claims.sub ?? '',\n    email: claims.email,\n    provider: toAuthProvider(appMeta.provider),\n    name: typeof name === 'string' ? name : undefined,\n    metadata: userMeta,\n  }\n}\n\nlet hydrating = false\n\n/**\n * Creates a gotrue-js session from the nf_jwt cookie so that browser-side\n * operations (updateUser, logout, etc.) work after a server-side login.\n * Fire-and-forget: getUser() returns synchronously from the JWT while this\n * runs in the background.\n */\nconst backgroundHydrate = (accessToken: string): void => {\n  if (hydrating) return\n  hydrating = true\n\n  const refreshToken = getCookie(NF_REFRESH_COOKIE) ?? ''\n\n  const decoded = decodeJwtPayload(accessToken)\n  const expiresAt = decoded?.exp ?? Math.floor(Date.now() / 1000) + 3600\n  const expiresIn = Math.max(0, expiresAt - Math.floor(Date.now() / 1000))\n\n  // Defer to the next tick so the synchronous getUser() call completes first,\n  // and gotrue-js's internal currentUser isn't set until after the caller\n  // has received the JWT-decoded result.\n  setTimeout(() => {\n    try {\n      const client = getClient()\n      client\n        .createUser(\n          {\n            access_token: accessToken,\n            token_type: 'bearer',\n            expires_in: expiresIn,\n            expires_at: expiresAt,\n            refresh_token: refreshToken,\n          },\n          true,\n        )\n        .catch(() => {\n          // best-effort: if hydration fails, getUser() still works via cookie decode\n        })\n        .finally(() => {\n          hydrating = false\n        })\n    } catch {\n      hydrating = false\n    }\n  }, 0)\n}\n\n/** Decodes a JWT payload without verifying the signature. */\nexport const decodeJwtPayload = (token: string): IdentityUser | null => {\n  try {\n    const parts = token.split('.')\n    if (parts.length !== 3) return null\n    const payload = atob(parts[1].replace(/-/g, '+').replace(/_/g, '/'))\n    return JSON.parse(payload) as IdentityUser\n  } catch {\n    return null\n  }\n}\n\n/**\n * Returns the currently authenticated user, or `null` if not logged in.\n * Synchronous.\n *\n * In the browser, checks gotrue-js localStorage first. If no localStorage\n * session exists, falls back to decoding the `nf_jwt` cookie (set by\n * server-side login) and kicks off background hydration of the gotrue-js\n * session so that subsequent operations (updateUser, logout, etc.) work.\n *\n * On the server in a Next.js App Router context, calls `headers()` from\n * `next/headers` to opt the route into dynamic rendering. Without this,\n * Next.js may statically cache the page at build time.\n */\nexport const getUser = (): User | null => {\n  if (isBrowser()) {\n    const client = getGoTrueClient()\n    const currentUser = client?.currentUser() ?? null\n\n    if (currentUser) {\n      // If gotrue-js has a localStorage session but the nf_jwt cookie is gone,\n      // the server logged us out. Clear the stale localStorage session.\n      const jwt = getCookie(NF_JWT_COOKIE)\n      if (!jwt) {\n        try {\n          currentUser.clearSession()\n        } catch {\n          // best-effort cleanup\n        }\n        return null\n      }\n      return toUser(currentUser)\n    }\n\n    const jwt = getCookie(NF_JWT_COOKIE)\n    if (!jwt) return null\n\n    const claims = decodeJwtPayload(jwt)\n    if (!claims) return null\n\n    // Hydrate gotrue-js in the background so browser-side operations\n    // (updateUser, logout, etc.) work after a server-side login.\n    backgroundHydrate(jwt)\n\n    return claimsToUser(claims)\n  }\n\n  // Trigger Next.js dynamic rendering if in a Next.js RSC context\n  triggerNextjsDynamic()\n\n  // Primary path: identity context populated from the X-Nf-Identity-Info request header\n  const identityContext = globalThis.netlifyIdentityContext\n  if (identityContext?.user) {\n    return claimsToUser(identityContext.user)\n  }\n\n  // Fallback: read the nf_jwt cookie directly from the Netlify runtime.\n  const serverJwt = getServerCookie(NF_JWT_COOKIE)\n  if (serverJwt) {\n    const claims = decodeJwtPayload(serverJwt)\n    if (claims) return claimsToUser(claims)\n  }\n\n  return null\n}\n\n/**\n * Returns `true` if a user is currently authenticated.\n */\nexport const isAuthenticated = (): boolean => getUser() !== null\n","import type { AuthProvider, IdentityConfig, Settings } from './types.js'\nimport { getClient, getIdentityContext, IDENTITY_PATH, isBrowser } from './environment.js'\nimport { AuthError } from './errors.js'\n\n/**\n * Returns the identity configuration for the current environment.\n * Browser: always returns `{ url }` derived from `window.location.origin`.\n * Server: returns `{ url, token }` from the identity context, or `null` if unavailable.\n * Never throws.\n */\nexport const getIdentityConfig = (): IdentityConfig | null => {\n  if (isBrowser()) {\n    return { url: `${window.location.origin}${IDENTITY_PATH}` }\n  }\n\n  return getIdentityContext()\n}\n\n/**\n * Fetches your project's Identity settings (enabled providers, autoconfirm, signup disabled).\n *\n * @throws {MissingIdentityError} If Identity is not configured.\n * @throws {AuthError} If the endpoint is unreachable.\n */\nexport const getSettings = async (): Promise<Settings> => {\n  const client = getClient()\n\n  try {\n    const raw = await client.settings()\n    const external: Partial<Record<AuthProvider, boolean>> = raw.external ?? {}\n    return {\n      autoconfirm: raw.autoconfirm,\n      disableSignup: raw.disable_signup,\n      providers: {\n        google: external.google ?? false,\n        github: external.github ?? false,\n        gitlab: external.gitlab ?? false,\n        bitbucket: external.bitbucket ?? false,\n        facebook: external.facebook ?? false,\n        email: external.email ?? false,\n        saml: external.saml ?? false,\n      },\n    }\n  } catch (err) {\n    throw new AuthError(err instanceof Error ? err.message : 'Failed to fetch identity settings', 502, { cause: err })\n  }\n}\n","import { getGoTrueClient, isBrowser } from './environment.js'\nimport { toUser, type User } from './user.js'\n\nexport const AUTH_EVENTS = {\n  LOGIN: 'login',\n  LOGOUT: 'logout',\n  TOKEN_REFRESH: 'token_refresh',\n  USER_UPDATED: 'user_updated',\n  RECOVERY: 'recovery',\n} as const\n\nexport type AuthEvent = (typeof AUTH_EVENTS)[keyof typeof AUTH_EVENTS]\n\nexport type AuthCallback = (event: AuthEvent, user: User | null) => void\n\nconst GOTRUE_STORAGE_KEY = 'gotrue.user'\n\nconst listeners = new Set<AuthCallback>()\n\nexport const emitAuthEvent = (event: AuthEvent, user: User | null): void => {\n  for (const listener of listeners) {\n    try {\n      listener(event, user)\n    } catch {\n      // Prevent one subscriber from breaking others\n    }\n  }\n}\n\nlet storageListenerAttached = false\n\nconst attachStorageListener = (): void => {\n  if (storageListenerAttached || !isBrowser()) return\n  storageListenerAttached = true\n\n  window.addEventListener('storage', (event: StorageEvent) => {\n    if (event.key !== GOTRUE_STORAGE_KEY) return\n\n    if (event.newValue) {\n      const client = getGoTrueClient()\n      const currentUser = client?.currentUser()\n      emitAuthEvent(AUTH_EVENTS.LOGIN, currentUser ? toUser(currentUser) : null)\n    } else {\n      emitAuthEvent(AUTH_EVENTS.LOGOUT, null)\n    }\n  })\n}\n\n/**\n * Subscribes to auth state changes (login, logout, token refresh, user updates,\n * and recovery). Returns an unsubscribe function. No-op on the server.\n *\n * The `'recovery'` event fires when {@link handleAuthCallback} processes a\n * password recovery token. The user is logged in but has not yet set a new\n * password. Redirect them to a password reset form and call\n * `updateUser({ password })` to complete the flow.\n */\nexport const onAuthChange = (callback: AuthCallback): (() => void) => {\n  if (!isBrowser()) {\n    return () => {}\n  }\n\n  listeners.add(callback)\n  attachStorageListener()\n\n  return () => {\n    listeners.delete(callback)\n  }\n}\n","import type { UserData } from 'gotrue-js'\n\nimport type { NetlifyCookies, SignupData, TokenResponse, GoTrueErrorBody } from './types.js'\nimport { toUser, decodeJwtPayload } from './user.js'\n\nimport { getClient, getIdentityContext, isBrowser, IDENTITY_PATH } from './environment.js'\nimport {\n  getCookie,\n  setAuthCookies,\n  deleteAuthCookies,\n  setBrowserAuthCookies,\n  deleteBrowserAuthCookies,\n  NF_JWT_COOKIE,\n  NF_REFRESH_COOKIE,\n} from './cookies.js'\nimport { AuthError } from './errors.js'\nimport { AUTH_EVENTS, emitAuthEvent } from './events.js'\n\nconst getCookies = (): NetlifyCookies => {\n  const cookies = globalThis.Netlify?.context?.cookies\n  if (!cookies) {\n    throw new AuthError('Server-side auth requires Netlify Functions runtime')\n  }\n  return cookies\n}\n\nconst getServerIdentityUrl = (): string => {\n  const ctx = getIdentityContext()\n  if (!ctx?.url) {\n    throw new AuthError('Could not determine the Identity endpoint URL on the server')\n  }\n  return ctx.url\n}\n\n/** Persist the session to localStorage so it survives page reloads. */\nexport const persistSession = true\n\n/**\n * Logs in with email and password. Works in both browser and server contexts.\n *\n * On success, sets `nf_jwt` and `nf_refresh` cookies and returns the authenticated {@link User}.\n * In the browser, also emits a `'login'` event via {@link onAuthChange}.\n *\n * @throws {AuthError} On invalid credentials, network failure, or missing Netlify runtime.\n *\n * @remarks\n * In Next.js server actions, call `redirect()` **after** `login()` returns, not inside a\n * try/catch. Next.js implements `redirect()` by throwing a special error; wrapping it in\n * try/catch will swallow the redirect.\n *\n * @example\n * ```ts\n * // Next.js server action\n * const user = await login(email, password)\n * redirect('/dashboard') // after login, not inside try/catch\n * ```\n */\nexport const login = async (email: string, password: string): Promise<import('./user.js').User> => {\n  if (!isBrowser()) {\n    const identityUrl = getServerIdentityUrl()\n    const cookies = getCookies()\n\n    const body = new URLSearchParams({\n      grant_type: 'password',\n      username: email,\n      password,\n    })\n\n    let res: Response\n    try {\n      res = await fetch(`${identityUrl}/token`, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: body.toString(),\n      })\n    } catch (error) {\n      throw new AuthError((error as Error).message, undefined, { cause: error })\n    }\n\n    if (!res.ok) {\n      const errorBody = (await res.json().catch(() => ({}))) as GoTrueErrorBody\n      throw new AuthError(errorBody.msg || errorBody.error_description || `Login failed (${res.status})`, res.status)\n    }\n\n    const data = (await res.json()) as TokenResponse\n    const accessToken = data.access_token\n\n    let userRes: Response\n    try {\n      userRes = await fetch(`${identityUrl}/user`, {\n        headers: { Authorization: `Bearer ${accessToken}` },\n      })\n    } catch (error) {\n      throw new AuthError((error as Error).message, undefined, { cause: error })\n    }\n\n    if (!userRes.ok) {\n      const errorBody = (await userRes.json().catch(() => ({}))) as GoTrueErrorBody\n      throw new AuthError(errorBody.msg || `Failed to fetch user data (${userRes.status})`, userRes.status)\n    }\n\n    const userData = (await userRes.json()) as UserData\n    const user = toUser(userData)\n\n    setAuthCookies(cookies, accessToken, data.refresh_token)\n\n    return user\n  }\n\n  const client = getClient()\n\n  try {\n    const gotrueUser = await client.login(email, password, persistSession)\n    const jwt = await gotrueUser.jwt()\n    setBrowserAuthCookies(jwt)\n    const user = toUser(gotrueUser)\n    emitAuthEvent(AUTH_EVENTS.LOGIN, user)\n    return user\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Creates a new account. Works in both browser and server contexts.\n *\n * If autoconfirm is enabled in your Identity settings, the user is logged in immediately:\n * cookies are set and a `'login'` event is emitted. If autoconfirm is **disabled** (the default),\n * the user receives a confirmation email and must click the link before they can log in.\n * In that case, no cookies are set and no auth event is emitted.\n *\n * @throws {AuthError} On duplicate email, validation failure, network error, or missing Netlify runtime.\n */\nexport const signup = async (email: string, password: string, data?: SignupData): Promise<import('./user.js').User> => {\n  if (!isBrowser()) {\n    const identityUrl = getServerIdentityUrl()\n    const cookies = getCookies()\n\n    let res: Response\n    try {\n      res = await fetch(`${identityUrl}/signup`, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ email, password, data }),\n      })\n    } catch (error) {\n      throw new AuthError((error as Error).message, undefined, { cause: error })\n    }\n\n    if (!res.ok) {\n      const errorBody = (await res.json().catch(() => ({}))) as GoTrueErrorBody\n      throw new AuthError(errorBody.msg || `Signup failed (${res.status})`, res.status)\n    }\n\n    const responseData = (await res.json()) as UserData & Partial<TokenResponse>\n    const user = toUser(responseData)\n\n    if (responseData.confirmed_at) {\n      const accessToken = responseData.access_token\n      if (accessToken) {\n        setAuthCookies(cookies, accessToken, responseData.refresh_token)\n      }\n    }\n\n    return user\n  }\n\n  const client = getClient()\n\n  try {\n    const response = await client.signup(email, password, data)\n    const user = toUser(response as UserData)\n    if (response.confirmed_at) {\n      const jwt = await (response as { jwt?: () => Promise<string> }).jwt?.()\n      if (jwt) {\n        setBrowserAuthCookies(jwt)\n      }\n      emitAuthEvent(AUTH_EVENTS.LOGIN, user)\n    }\n    return user\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Logs out the current user and clears the session. Works in both browser and server contexts.\n *\n * Always deletes `nf_jwt` and `nf_refresh` cookies, even if the server-side token\n * invalidation request fails. In the browser, emits a `'logout'` event via {@link onAuthChange}.\n *\n * @throws {AuthError} On missing Netlify runtime (server) or logout failure (browser).\n */\nexport const logout = async (): Promise<void> => {\n  if (!isBrowser()) {\n    const identityUrl = getServerIdentityUrl()\n    const cookies = getCookies()\n\n    const jwt = cookies.get(NF_JWT_COOKIE)\n    if (jwt) {\n      try {\n        await fetch(`${identityUrl}/logout`, {\n          method: 'POST',\n          headers: { Authorization: `Bearer ${jwt}` },\n        })\n      } catch {\n        // Best-effort: token invalidation may fail, but we always clear cookies below\n      }\n    }\n\n    deleteAuthCookies(cookies)\n    return\n  }\n\n  const client = getClient()\n\n  try {\n    const currentUser = client.currentUser()\n    if (currentUser) {\n      await currentUser.logout()\n    }\n    deleteBrowserAuthCookies()\n    emitAuthEvent(AUTH_EVENTS.LOGOUT, null)\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Initiates an OAuth login by redirecting to the given provider (e.g., `'google'`, `'github'`).\n * The page navigates away; this function never returns normally. Browser only.\n *\n * After the provider redirects back, call {@link handleAuthCallback} on page load\n * to complete the login and obtain the {@link User}.\n *\n * @throws {AuthError} If called on the server.\n */\nexport const oauthLogin = (provider: string): never => {\n  if (!isBrowser()) {\n    throw new AuthError('oauthLogin() is only available in the browser')\n  }\n  const client = getClient()\n\n  window.location.href = client.loginExternalUrl(provider)\n  throw new AuthError('Redirecting to OAuth provider')\n}\n\nexport interface CallbackResult {\n  type: 'oauth' | 'confirmation' | 'recovery' | 'invite' | 'email_change'\n  user: import('./user.js').User | null\n  token?: string\n}\n\n/**\n * Processes the URL hash after an OAuth redirect, email confirmation, password\n * recovery, invite acceptance, or email change. Call on page load. Browser only.\n * Returns `null` if the hash contains no auth parameters.\n *\n * Call this early in your app's initialization (e.g., in a layout component or\n * root loader), **not** inside a route that requires authentication, because\n * the callback URL must match the page where this function runs.\n *\n * For recovery callbacks (`result.type === 'recovery'`), the user is logged in\n * but has **not** set a new password yet. Your app must check the result type\n * and redirect to a password form that calls `updateUser({ password })`.\n * A `'recovery'` event (not `'login'`) is emitted via {@link onAuthChange}.\n *\n * @throws {AuthError} If the callback token is invalid or the verification request fails.\n */\nexport const handleAuthCallback = async (): Promise<CallbackResult | null> => {\n  if (!isBrowser()) return null\n\n  const hash = window.location.hash.substring(1)\n  if (!hash) return null\n\n  const client = getClient()\n  const params = new URLSearchParams(hash)\n\n  try {\n    const accessToken = params.get('access_token')\n    if (accessToken) return await handleOAuthCallback(client, params, accessToken)\n\n    const confirmationToken = params.get('confirmation_token')\n    if (confirmationToken) return await handleConfirmationCallback(client, confirmationToken)\n\n    const recoveryToken = params.get('recovery_token')\n    if (recoveryToken) return await handleRecoveryCallback(client, recoveryToken)\n\n    const inviteToken = params.get('invite_token')\n    if (inviteToken) return handleInviteCallback(inviteToken)\n\n    const emailChangeToken = params.get('email_change_token')\n    if (emailChangeToken) return await handleEmailChangeCallback(client, emailChangeToken)\n\n    return null\n  } catch (error) {\n    if (error instanceof AuthError) throw error\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\nimport type GoTrue from 'gotrue-js'\n\nconst handleOAuthCallback = async (\n  client: GoTrue,\n  params: URLSearchParams,\n  accessToken: string,\n): Promise<CallbackResult> => {\n  const refreshToken = params.get('refresh_token') ?? ''\n  const gotrueUser = await client.createUser(\n    {\n      access_token: accessToken,\n      token_type: (params.get('token_type') as 'bearer') ?? 'bearer',\n      expires_in: Number(params.get('expires_in')),\n      expires_at: Number(params.get('expires_at')),\n      refresh_token: refreshToken,\n    },\n    persistSession,\n  )\n  setBrowserAuthCookies(accessToken, refreshToken || undefined)\n  const user = toUser(gotrueUser)\n  clearHash()\n  emitAuthEvent(AUTH_EVENTS.LOGIN, user)\n  return { type: 'oauth', user }\n}\n\nconst handleConfirmationCallback = async (client: GoTrue, token: string): Promise<CallbackResult> => {\n  const gotrueUser = await client.confirm(token, persistSession)\n  const jwt = await gotrueUser.jwt()\n  setBrowserAuthCookies(jwt)\n  const user = toUser(gotrueUser)\n  clearHash()\n  emitAuthEvent(AUTH_EVENTS.LOGIN, user)\n  return { type: 'confirmation', user }\n}\n\nconst handleRecoveryCallback = async (client: GoTrue, token: string): Promise<CallbackResult> => {\n  const gotrueUser = await client.recover(token, persistSession)\n  const jwt = await gotrueUser.jwt()\n  setBrowserAuthCookies(jwt)\n  const user = toUser(gotrueUser)\n  clearHash()\n  emitAuthEvent(AUTH_EVENTS.RECOVERY, user)\n  return { type: 'recovery', user }\n}\n\nconst handleInviteCallback = (token: string): CallbackResult => {\n  clearHash()\n  return { type: 'invite', user: null, token }\n}\n\nconst handleEmailChangeCallback = async (client: GoTrue, emailChangeToken: string): Promise<CallbackResult> => {\n  const currentUser = client.currentUser()\n  if (!currentUser) {\n    throw new AuthError('Email change verification requires an active browser session')\n  }\n\n  const jwt = await currentUser.jwt()\n  const identityUrl = `${window.location.origin}${IDENTITY_PATH}`\n\n  const emailChangeRes = await fetch(`${identityUrl}/user`, {\n    method: 'PUT',\n    headers: {\n      'Content-Type': 'application/json',\n      Authorization: `Bearer ${jwt}`,\n    },\n    body: JSON.stringify({ email_change_token: emailChangeToken }),\n  })\n\n  if (!emailChangeRes.ok) {\n    const errorBody = (await emailChangeRes.json().catch(() => ({}))) as GoTrueErrorBody\n    throw new AuthError(\n      errorBody.msg || `Email change verification failed (${emailChangeRes.status})`,\n      emailChangeRes.status,\n    )\n  }\n\n  const emailChangeData = (await emailChangeRes.json()) as UserData\n  const user = toUser(emailChangeData)\n  clearHash()\n  emitAuthEvent(AUTH_EVENTS.USER_UPDATED, user)\n  return { type: 'email_change', user }\n}\n\nconst clearHash = (): void => {\n  history.replaceState(null, '', window.location.pathname + window.location.search)\n}\n\n/**\n * Hydrates the browser-side gotrue-js session from server-set auth cookies.\n * Call this on page load when using server-side login to enable browser\n * account operations (updateUser, verifyEmailChange, etc.).\n *\n * No-op if a browser session already exists or no auth cookies are present.\n * No-op on the server.\n */\nexport const hydrateSession = async (): Promise<import('./user.js').User | null> => {\n  if (!isBrowser()) return null\n\n  const client = getClient()\n  const currentUser = client.currentUser()\n  if (currentUser) return toUser(currentUser)\n\n  const accessToken = getCookie(NF_JWT_COOKIE)\n  if (!accessToken) return null\n\n  const refreshToken = getCookie(NF_REFRESH_COOKIE) ?? ''\n\n  const decoded = decodeJwtPayload(accessToken)\n  const expiresAt = decoded?.exp ?? Math.floor(Date.now() / 1000) + 3600\n  const expiresIn = Math.max(0, expiresAt - Math.floor(Date.now() / 1000))\n\n  const gotrueUser = await client.createUser(\n    {\n      access_token: accessToken,\n      token_type: 'bearer',\n      expires_in: expiresIn,\n      expires_at: expiresAt,\n      refresh_token: refreshToken,\n    },\n    persistSession,\n  )\n\n  const user = toUser(gotrueUser)\n  emitAuthEvent(AUTH_EVENTS.LOGIN, user)\n  return user\n}\n","import type { UserData, User as GoTrueUser } from 'gotrue-js'\n\nimport type { UserUpdates, GoTrueErrorBody } from './types.js'\nimport type { User } from './user.js'\nimport { toUser } from './user.js'\nimport { getClient, isBrowser, IDENTITY_PATH } from './environment.js'\nimport { persistSession, hydrateSession } from './auth.js'\nimport { AUTH_EVENTS, emitAuthEvent } from './events.js'\nimport { AuthError } from './errors.js'\n\n/**\n * Returns the current gotrue-js user, attempting hydration from cookies if\n * no in-memory session exists. Throws if no user can be resolved.\n */\nconst resolveCurrentUser = async (): Promise<GoTrueUser> => {\n  const client = getClient()\n\n  let currentUser = client.currentUser()\n  if (!currentUser && isBrowser()) {\n    try {\n      await hydrateSession()\n    } catch {\n      // hydration failed (e.g. expired cookie, network error) — fall through\n    }\n    currentUser = client.currentUser()\n  }\n  if (!currentUser) throw new AuthError('No user is currently logged in')\n\n  return currentUser\n}\n\n/**\n * Sends a password recovery email to the given address.\n *\n * @throws {AuthError} On network failure or if the request is rejected.\n */\nexport const requestPasswordRecovery = async (email: string): Promise<void> => {\n  const client = getClient()\n\n  try {\n    await client.requestPasswordRecovery(email)\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Redeems a recovery token and sets a new password. Logs the user in on success.\n *\n * @throws {AuthError} If the token is invalid, expired, or the update fails.\n */\nexport const recoverPassword = async (token: string, newPassword: string): Promise<User> => {\n  const client = getClient()\n\n  try {\n    const gotrueUser = await client.recover(token, persistSession)\n    const updatedUser = await gotrueUser.update({ password: newPassword })\n    const user = toUser(updatedUser)\n    emitAuthEvent(AUTH_EVENTS.LOGIN, user)\n    return user\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Confirms an email address using the token from a confirmation email. Logs the user in on success.\n *\n * @throws {AuthError} If the token is invalid or expired.\n */\nexport const confirmEmail = async (token: string): Promise<User> => {\n  const client = getClient()\n\n  try {\n    const gotrueUser = await client.confirm(token, persistSession)\n    const user = toUser(gotrueUser)\n    emitAuthEvent(AUTH_EVENTS.LOGIN, user)\n    return user\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Accepts an invite token and sets a password for the new account. Logs the user in on success.\n *\n * @throws {AuthError} If the token is invalid or expired.\n */\nexport const acceptInvite = async (token: string, password: string): Promise<User> => {\n  const client = getClient()\n\n  try {\n    const gotrueUser = await client.acceptInvite(token, password, persistSession)\n    const user = toUser(gotrueUser)\n    emitAuthEvent(AUTH_EVENTS.LOGIN, user)\n    return user\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Verifies an email change using the token from a verification email.\n * Auto-hydrates from auth cookies if no browser session exists. Browser only.\n *\n * @throws {AuthError} If called on the server, no user is logged in, or the token is invalid.\n */\nexport const verifyEmailChange = async (token: string): Promise<User> => {\n  if (!isBrowser()) throw new AuthError('verifyEmailChange() is only available in the browser')\n\n  const currentUser = await resolveCurrentUser()\n\n  const jwt = await currentUser.jwt()\n  const identityUrl = `${window.location.origin}${IDENTITY_PATH}`\n\n  try {\n    const res = await fetch(`${identityUrl}/user`, {\n      method: 'PUT',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${jwt}`,\n      },\n      body: JSON.stringify({ email_change_token: token }),\n    })\n\n    if (!res.ok) {\n      const errorBody = (await res.json().catch(() => ({}))) as GoTrueErrorBody\n      throw new AuthError(errorBody.msg || `Email change verification failed (${res.status})`, res.status)\n    }\n\n    const userData = (await res.json()) as UserData\n    const user = toUser(userData)\n    emitAuthEvent(AUTH_EVENTS.USER_UPDATED, user)\n    return user\n  } catch (error) {\n    if (error instanceof AuthError) throw error\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Updates the current user's email, password, or user metadata.\n * Auto-hydrates from auth cookies if no browser session exists.\n *\n * @param updates - Fields to update. Pass `email` or `password` to change credentials,\n *   or `data` to update user metadata (e.g., `{ data: { full_name: 'New Name' } }`).\n * @throws {AuthError} If no user is logged in or the update fails.\n */\nexport const updateUser = async (updates: UserUpdates): Promise<User> => {\n  const currentUser = await resolveCurrentUser()\n\n  try {\n    const updatedUser = await currentUser.update(updates)\n    const user = toUser(updatedUser)\n    emitAuthEvent(AUTH_EVENTS.USER_UPDATED, user)\n    return user\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n","import type { UserData } from 'gotrue-js'\n\nimport { isBrowser, getClient, getIdentityContext } from './environment.js'\nimport { AuthError } from './errors.js'\nimport type { AdminUserUpdates, GoTrueErrorBody } from './types.js'\nimport { toUser, type User } from './user.js'\n\n/**\n * Returns the operator token and Identity URL for server-side admin requests.\n * @throws {AuthError} If the Identity endpoint URL or operator token is unavailable.\n */\nconst getAdminAuth = (): { url: string; token: string } => {\n  const ctx = getIdentityContext()\n  if (!ctx?.url) {\n    throw new AuthError('Could not determine the Identity endpoint URL on the server')\n  }\n  if (!ctx.token) {\n    throw new AuthError('Admin operations require an operator token (only available in Netlify Functions)')\n  }\n  return { url: ctx.url, token: ctx.token }\n}\n\n/**\n * Makes an authenticated admin request to GoTrue on the server.\n * @throws {AuthError} If the request fails or GoTrue returns a non-OK status.\n */\nconst adminFetch = async (path: string, options: RequestInit = {}): Promise<Response> => {\n  const { url, token } = getAdminAuth()\n  let res: Response\n  try {\n    res = await fetch(`${url}${path}`, {\n      ...options,\n      headers: {\n        ...options.headers,\n        Authorization: `Bearer ${token}`,\n        'Content-Type': 'application/json',\n      },\n    })\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n  if (!res.ok) {\n    const errorBody = await res.json().catch(() => ({}))\n    throw new AuthError((errorBody as GoTrueErrorBody).msg || `Admin request failed (${res.status})`, res.status)\n  }\n  return res\n}\n\n/** Returns the current user (browser only), throwing if not logged in. */\nconst getAdminUser = () => {\n  const client = getClient()\n  const user = client.currentUser()\n  if (!user) {\n    throw new AuthError('Admin operations require a logged-in user with admin role')\n  }\n  return user\n}\n\n/**\n * Lists all users. Works in both server and browser contexts.\n *\n * **Server:** calls GoTrue `GET /admin/users` with the operator token. Pagination\n * options (`page`, `perPage`) are forwarded as query parameters.\n *\n * **Browser:** calls gotrue-js `user.admin.listUsers()`. The logged-in user must\n * have an admin role. Pagination options are ignored (gotrue-js does not support them).\n *\n * @throws {AuthError} If the operator token is missing (server) or no admin user is logged in (browser).\n */\nconst listUsers = async (options?: { page?: number; perPage?: number }): Promise<User[]> => {\n  if (!isBrowser()) {\n    const params = new URLSearchParams()\n    if (options?.page != null) params.set('page', String(options.page))\n    if (options?.perPage != null) params.set('per_page', String(options.perPage))\n    const query = params.toString()\n    const path = `/admin/users${query ? `?${query}` : ''}`\n\n    const res = await adminFetch(path)\n    const body = (await res.json()) as { users: UserData[] }\n    return body.users.map(toUser)\n  }\n\n  try {\n    const user = getAdminUser()\n    const users = await user.admin.listUsers('')\n    return (users as UserData[]).map(toUser)\n  } catch (error) {\n    if (error instanceof AuthError) throw error\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Gets a single user by ID. Works in both server and browser contexts.\n *\n * **Server:** calls GoTrue `GET /admin/users/:id` with the operator token.\n *\n * **Browser:** calls gotrue-js `user.admin.getUser()`. The logged-in user must\n * have an admin role.\n *\n * @throws {AuthError} If the user is not found, the operator token is missing (server),\n *   or no admin user is logged in (browser).\n */\nconst getUser = async (userId: string): Promise<User> => {\n  if (!isBrowser()) {\n    const res = await adminFetch(`/admin/users/${userId}`)\n    const userData = (await res.json()) as UserData\n    return toUser(userData)\n  }\n\n  try {\n    const user = getAdminUser()\n    const userData = await user.admin.getUser({ id: userId } as UserData)\n    return toUser(userData)\n  } catch (error) {\n    if (error instanceof AuthError) throw error\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Creates a new user. The user is auto-confirmed (no confirmation email is sent).\n * Works in both server and browser contexts.\n *\n * The optional `data` fields are spread as **top-level attributes** in the GoTrue\n * request body (not nested under `user_metadata`). Use this to set `app_metadata`,\n * `user_metadata`, `role`, or any other GoTrue user field at creation time.\n *\n * **Server:** calls GoTrue `POST /admin/users` with the operator token.\n *\n * **Browser:** calls gotrue-js `user.admin.createUser()`. The logged-in user must\n * have an admin role.\n *\n * @throws {AuthError} If the email already exists, the operator token is missing (server),\n *   or no admin user is logged in (browser).\n */\nconst createUser = async (params: {\n  email: string\n  password: string\n  data?: Record<string, unknown>\n}): Promise<User> => {\n  if (!isBrowser()) {\n    const res = await adminFetch('/admin/users', {\n      method: 'POST',\n      body: JSON.stringify({\n        email: params.email,\n        password: params.password,\n        ...params.data,\n        confirm: true,\n      }),\n    })\n    const userData = (await res.json()) as UserData\n    return toUser(userData)\n  }\n\n  try {\n    const user = getAdminUser()\n    const userData = await user.admin.createUser(params.email, params.password, {\n      ...params.data,\n      confirm: true,\n    })\n    return toUser(userData)\n  } catch (error) {\n    if (error instanceof AuthError) throw error\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Updates an existing user by ID. Works in both server and browser contexts.\n *\n * **Server:** calls GoTrue `PUT /admin/users/:id` with the operator token.\n *\n * **Browser:** calls gotrue-js `user.admin.updateUser()`. The logged-in user must\n * have an admin role.\n *\n * @throws {AuthError} If the user is not found, the update fails, the operator token\n *   is missing (server), or no admin user is logged in (browser).\n */\nconst updateUser = async (userId: string, attributes: AdminUserUpdates): Promise<User> => {\n  if (!isBrowser()) {\n    const res = await adminFetch(`/admin/users/${userId}`, {\n      method: 'PUT',\n      body: JSON.stringify(attributes),\n    })\n    const userData = (await res.json()) as UserData\n    return toUser(userData)\n  }\n\n  try {\n    const user = getAdminUser()\n    const userData = await user.admin.updateUser({ id: userId } as UserData, attributes)\n    return toUser(userData)\n  } catch (error) {\n    if (error instanceof AuthError) throw error\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Deletes a user by ID. Works in both server and browser contexts.\n *\n * **Server:** calls GoTrue `DELETE /admin/users/:id` with the operator token.\n *\n * **Browser:** calls gotrue-js `user.admin.deleteUser()`. The logged-in user must\n * have an admin role.\n *\n * @throws {AuthError} If the user is not found, the deletion fails, the operator token\n *   is missing (server), or no admin user is logged in (browser).\n */\nconst deleteUser = async (userId: string): Promise<void> => {\n  if (!isBrowser()) {\n    await adminFetch(`/admin/users/${userId}`, { method: 'DELETE' })\n    return\n  }\n\n  try {\n    const user = getAdminUser()\n    await user.admin.deleteUser({ id: userId } as UserData)\n  } catch (error) {\n    if (error instanceof AuthError) throw error\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/** The admin namespace for user management operations. */\ninterface Admin {\n  /**\n   * Lists all users. Works in both server and browser contexts.\n   *\n   * **Server:** calls GoTrue `GET /admin/users` with the operator token. Pagination\n   * options (`page`, `perPage`) are forwarded as query parameters.\n   *\n   * **Browser:** calls gotrue-js `user.admin.listUsers()`. The logged-in user must\n   * have an admin role. Pagination options are ignored (gotrue-js does not support them).\n   *\n   * @throws {AuthError} If the operator token is missing (server) or no admin user is logged in (browser).\n   */\n  listUsers: (options?: { page?: number; perPage?: number }) => Promise<User[]>\n\n  /**\n   * Gets a single user by ID. Works in both server and browser contexts.\n   *\n   * **Server:** calls GoTrue `GET /admin/users/:id` with the operator token.\n   *\n   * **Browser:** calls gotrue-js `user.admin.getUser()`. The logged-in user must\n   * have an admin role.\n   *\n   * @throws {AuthError} If the user is not found, the operator token is missing (server),\n   *   or no admin user is logged in (browser).\n   */\n  getUser: (userId: string) => Promise<User>\n\n  /**\n   * Creates a new user. The user is auto-confirmed (no confirmation email is sent).\n   * Works in both server and browser contexts.\n   *\n   * The optional `data` fields are spread as **top-level attributes** in the GoTrue\n   * request body (not nested under `user_metadata`). Use this to set `app_metadata`,\n   * `user_metadata`, `role`, or any other GoTrue user field at creation time.\n   *\n   * **Server:** calls GoTrue `POST /admin/users` with the operator token.\n   *\n   * **Browser:** calls gotrue-js `user.admin.createUser()`. The logged-in user must\n   * have an admin role.\n   *\n   * @throws {AuthError} If the email already exists, the operator token is missing (server),\n   *   or no admin user is logged in (browser).\n   */\n  createUser: (params: { email: string; password: string; data?: Record<string, unknown> }) => Promise<User>\n\n  /**\n   * Updates an existing user by ID. Works in both server and browser contexts.\n   *\n   * **Server:** calls GoTrue `PUT /admin/users/:id` with the operator token.\n   *\n   * **Browser:** calls gotrue-js `user.admin.updateUser()`. The logged-in user must\n   * have an admin role.\n   *\n   * @throws {AuthError} If the user is not found, the update fails, the operator token\n   *   is missing (server), or no admin user is logged in (browser).\n   */\n  updateUser: (userId: string, attributes: AdminUserUpdates) => Promise<User>\n\n  /**\n   * Deletes a user by ID. Works in both server and browser contexts.\n   *\n   * **Server:** calls GoTrue `DELETE /admin/users/:id` with the operator token.\n   *\n   * **Browser:** calls gotrue-js `user.admin.deleteUser()`. The logged-in user must\n   * have an admin role.\n   *\n   * @throws {AuthError} If the user is not found, the deletion fails, the operator token\n   *   is missing (server), or no admin user is logged in (browser).\n   */\n  deleteUser: (userId: string) => Promise<void>\n}\n\nexport const admin: Admin = { listUsers, getUser, createUser, updateUser, deleteUser }\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAM,iBAAiB,CAAC,UAAU,UAAU,UAAU,aAAa,YAAY,QAAQ,OAAO;;;ACArG,uBAAmB;;;ACAZ,IAAM,YAAN,cAAwB,MAAM;AAAA,EAKnC,YAAY,SAAiB,QAAiB,SAA+B;AAC3E,UAAM,OAAO;AALf,SAAS,OAAO;AAMd,SAAK,SAAS;AACd,QAAI,WAAW,WAAW,SAAS;AACjC,WAAK,QAAQ,QAAQ;AAAA,IACvB;AAAA,EACF;AACF;AAEO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAG9C,YAAY,UAAU,sCAAsC;AAC1D,UAAM,OAAO;AAHf,SAAS,OAAO;AAAA,EAIhB;AACF;;;ADfO,IAAM,gBAAgB;AAE7B,IAAI,eAA8B;AAClC,IAAI;AACJ,IAAI,mBAAmB;AAEhB,IAAM,YAAY,MAAe,OAAO,WAAW,eAAe,OAAO,OAAO,aAAa;AAQpG,IAAM,iBAAiB,MAAqB;AAC1C,MAAI,iBAAiB,OAAW,QAAO;AAEvC,MAAI,UAAU,GAAG;AACf,mBAAe,GAAG,OAAO,SAAS,MAAM,GAAG,aAAa;AAAA,EAC1D,OAAO;AACL,UAAM,kBAAkB,mBAAmB;AAC3C,QAAI,iBAAiB,KAAK;AACxB,qBAAe,gBAAgB;AAAA,IACjC,WAAW,WAAW,SAAS,SAAS,KAAK;AAC3C,qBAAe,IAAI,IAAI,eAAe,WAAW,QAAQ,QAAQ,GAAG,EAAE;AAAA,IACxE,WAAW,QAAQ,IAAI,KAAK;AAC1B,qBAAe,IAAI,IAAI,eAAe,QAAQ,IAAI,GAAG,EAAE;AAAA,IACzD;AAAA,EACF;AAEA,SAAO,gBAAgB;AACzB;AAMO,IAAM,kBAAkB,MAAqB;AAClD,MAAI,aAAc,QAAO;AAEzB,QAAM,SAAS,eAAe;AAC9B,MAAI,CAAC,QAAQ;AACX,QAAI,CAAC,kBAAkB;AACrB,cAAQ;AAAA,QACN;AAAA,MAEF;AACA,yBAAmB;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,IAAI,iBAAAA,QAAO,EAAE,QAAQ,QAAQ,WAAW,MAAM,CAAC;AAC9D,SAAO;AACT;AAKO,IAAM,YAAY,MAAc;AACrC,QAAM,SAAS,gBAAgB;AAC/B,MAAI,CAAC,OAAQ,OAAM,IAAI,qBAAqB;AAC5C,SAAO;AACT;AAMO,IAAM,qBAAqB,MAA6B;AAC7D,QAAM,kBAAkB,WAAW;AACnC,MAAI,iBAAiB,KAAK;AACxB,WAAO;AAAA,MACL,KAAK,gBAAgB;AAAA,MACrB,OAAO,gBAAgB;AAAA,IACzB;AAAA,EACF;AAEA,MAAI,WAAW,SAAS,SAAS,KAAK;AACpC,WAAO,EAAE,KAAK,IAAI,IAAI,eAAe,WAAW,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAAA,EAC5E;AAGA,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,SAAS;AACX,WAAO,EAAE,KAAK,IAAI,IAAI,eAAe,OAAO,EAAE,KAAK;AAAA,EACrD;AAEA,SAAO;AACT;;;AE5FO,IAAM,gBAAgB;AACtB,IAAM,oBAAoB;AAG1B,IAAM,YAAY,CAAC,SAAgC;AACxD,QAAM,QAAQ,SAAS,OAAO,MAAM,IAAI,OAAO,WAAW,KAAK,QAAQ,uBAAuB,MAAM,CAAC,UAAU,CAAC;AAChH,SAAO,QAAQ,mBAAmB,MAAM,CAAC,CAAC,IAAI;AAChD;AAGO,IAAM,iBAAiB,CAAC,SAAyB,aAAqB,iBAAgC;AAC3G,UAAQ,IAAI;AAAA,IACV,MAAM;AAAA,IACN,OAAO;AAAA,IACP,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,UAAU;AAAA,EACZ,CAAC;AAED,MAAI,cAAc;AAGhB,YAAQ,IAAI;AAAA,MACV,MAAM;AAAA,MACN,OAAO;AAAA,MACP,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACF;AAGO,IAAM,oBAAoB,CAAC,YAAkC;AAClE,UAAQ,OAAO,aAAa;AAC5B,UAAQ,OAAO,iBAAiB;AAClC;AAGO,IAAM,wBAAwB,CAAC,aAAqB,iBAAgC;AACzF,WAAS,SAAS,GAAG,aAAa,IAAI,mBAAmB,WAAW,CAAC;AACrE,MAAI,cAAc;AAChB,aAAS,SAAS,GAAG,iBAAiB,IAAI,mBAAmB,YAAY,CAAC;AAAA,EAC5E;AACF;AAGO,IAAM,2BAA2B,MAAY;AAClD,WAAS,SAAS,GAAG,aAAa;AAClC,WAAS,SAAS,GAAG,iBAAiB;AACxC;AAGO,IAAM,kBAAkB,CAAC,SAAgC;AAC9D,QAAM,UAAU,WAAW,SAAS,SAAS;AAC7C,MAAI,CAAC,WAAW,OAAO,QAAQ,QAAQ,WAAY,QAAO;AAC1D,SAAO,QAAQ,IAAI,IAAI,KAAK;AAC9B;;;ACjDA,IAAI;AACG,IAAM,uBAAuB,MAAY;AAC9C,MAAI,kBAAkB,KAAM;AAE5B,MAAI,kBAAkB,QAAW;AAC/B,QAAI;AACF,UAAI,OAAO,YAAY,aAAa;AAClC,wBAAgB;AAChB;AAAA,MACF;AACA,YAAM,MAAM,QAAQ,cAAc;AAClC,sBAAgB,IAAI;AAAA,IACtB,QAAQ;AACN,sBAAgB;AAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,KAAK;AACX,MAAI,CAAC,GAAI;AAET,MAAI;AACF,OAAG;AAAA,EACL,SAAS,GAAY;AAInB,QAAI,aAAa,UAAU,YAAY,KAAK,wBAAwB,KAAK,EAAE,OAAO,IAAI;AACpF,YAAM;AAAA,IACR;AAAA,EACF;AACF;;;AC5BA,IAAM,iBAAiB,CAAC,UACtB,OAAO,UAAU,YAAa,eAAqC,SAAS,KAAK,IAC5E,QACD;AAeC,IAAM,SAAS,CAAC,aAA6B;AAClD,QAAM,WAAW,SAAS,iBAAiB,CAAC;AAC5C,QAAM,UAAU,SAAS,gBAAgB,CAAC;AAC1C,QAAM,OAAO,SAAS,aAAa,SAAS;AAC5C,QAAM,aAAa,SAAS;AAE5B,SAAO;AAAA,IACL,IAAI,SAAS;AAAA,IACb,OAAO,SAAS;AAAA,IAChB,eAAe,CAAC,CAAC,SAAS;AAAA,IAC1B,WAAW,SAAS;AAAA,IACpB,WAAW,SAAS;AAAA,IACpB,UAAU,eAAe,QAAQ,QAAQ;AAAA,IACzC,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,IACxC,YAAY,OAAO,eAAe,WAAW,aAAa;AAAA,IAC1D,UAAU;AAAA,IACV,eAAe,EAAE,GAAG,SAAS;AAAA,EAC/B;AACF;AAKA,IAAM,eAAe,CAAC,WAA+B;AACnD,QAAM,UAAU,OAAO,gBAAgB,CAAC;AACxC,QAAM,WAAW,OAAO,iBAAiB,CAAC;AAC1C,QAAM,OAAO,SAAS,aAAa,SAAS;AAE5C,SAAO;AAAA,IACL,IAAI,OAAO,OAAO;AAAA,IAClB,OAAO,OAAO;AAAA,IACd,UAAU,eAAe,QAAQ,QAAQ;AAAA,IACzC,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,IACxC,UAAU;AAAA,EACZ;AACF;AAEA,IAAI,YAAY;AAQhB,IAAM,oBAAoB,CAAC,gBAA8B;AACvD,MAAI,UAAW;AACf,cAAY;AAEZ,QAAM,eAAe,UAAU,iBAAiB,KAAK;AAErD,QAAM,UAAU,iBAAiB,WAAW;AAC5C,QAAM,YAAY,SAAS,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAClE,QAAM,YAAY,KAAK,IAAI,GAAG,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,CAAC;AAKvE,aAAW,MAAM;AACf,QAAI;AACF,YAAM,SAAS,UAAU;AACzB,aACG;AAAA,QACC;AAAA,UACE,cAAc;AAAA,UACd,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ,eAAe;AAAA,QACjB;AAAA,QACA;AAAA,MACF,EACC,MAAM,MAAM;AAAA,MAEb,CAAC,EACA,QAAQ,MAAM;AACb,oBAAY;AAAA,MACd,CAAC;AAAA,IACL,QAAQ;AACN,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC;AACN;AAGO,IAAM,mBAAmB,CAAC,UAAuC;AACtE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK,MAAM,CAAC,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,CAAC;AACnE,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAeO,IAAM,UAAU,MAAmB;AACxC,MAAI,UAAU,GAAG;AACf,UAAM,SAAS,gBAAgB;AAC/B,UAAM,cAAc,QAAQ,YAAY,KAAK;AAE7C,QAAI,aAAa;AAGf,YAAMC,OAAM,UAAU,aAAa;AACnC,UAAI,CAACA,MAAK;AACR,YAAI;AACF,sBAAY,aAAa;AAAA,QAC3B,QAAQ;AAAA,QAER;AACA,eAAO;AAAA,MACT;AACA,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,UAAM,MAAM,UAAU,aAAa;AACnC,QAAI,CAAC,IAAK,QAAO;AAEjB,UAAM,SAAS,iBAAiB,GAAG;AACnC,QAAI,CAAC,OAAQ,QAAO;AAIpB,sBAAkB,GAAG;AAErB,WAAO,aAAa,MAAM;AAAA,EAC5B;AAGA,uBAAqB;AAGrB,QAAM,kBAAkB,WAAW;AACnC,MAAI,iBAAiB,MAAM;AACzB,WAAO,aAAa,gBAAgB,IAAI;AAAA,EAC1C;AAGA,QAAM,YAAY,gBAAgB,aAAa;AAC/C,MAAI,WAAW;AACb,UAAM,SAAS,iBAAiB,SAAS;AACzC,QAAI,OAAQ,QAAO,aAAa,MAAM;AAAA,EACxC;AAEA,SAAO;AACT;AAKO,IAAM,kBAAkB,MAAe,QAAQ,MAAM;;;AC3LrD,IAAM,oBAAoB,MAA6B;AAC5D,MAAI,UAAU,GAAG;AACf,WAAO,EAAE,KAAK,GAAG,OAAO,SAAS,MAAM,GAAG,aAAa,GAAG;AAAA,EAC5D;AAEA,SAAO,mBAAmB;AAC5B;AAQO,IAAM,cAAc,YAA+B;AACxD,QAAM,SAAS,UAAU;AAEzB,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,SAAS;AAClC,UAAM,WAAmD,IAAI,YAAY,CAAC;AAC1E,WAAO;AAAA,MACL,aAAa,IAAI;AAAA,MACjB,eAAe,IAAI;AAAA,MACnB,WAAW;AAAA,QACT,QAAQ,SAAS,UAAU;AAAA,QAC3B,QAAQ,SAAS,UAAU;AAAA,QAC3B,QAAQ,SAAS,UAAU;AAAA,QAC3B,WAAW,SAAS,aAAa;AAAA,QACjC,UAAU,SAAS,YAAY;AAAA,QAC/B,OAAO,SAAS,SAAS;AAAA,QACzB,MAAM,SAAS,QAAQ;AAAA,MACzB;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI,UAAU,eAAe,QAAQ,IAAI,UAAU,qCAAqC,KAAK,EAAE,OAAO,IAAI,CAAC;AAAA,EACnH;AACF;;;AC3CO,IAAM,cAAc;AAAA,EACzB,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,eAAe;AAAA,EACf,cAAc;AAAA,EACd,UAAU;AACZ;AAMA,IAAM,qBAAqB;AAE3B,IAAM,YAAY,oBAAI,IAAkB;AAEjC,IAAM,gBAAgB,CAAC,OAAkB,SAA4B;AAC1E,aAAW,YAAY,WAAW;AAChC,QAAI;AACF,eAAS,OAAO,IAAI;AAAA,IACtB,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAEA,IAAI,0BAA0B;AAE9B,IAAM,wBAAwB,MAAY;AACxC,MAAI,2BAA2B,CAAC,UAAU,EAAG;AAC7C,4BAA0B;AAE1B,SAAO,iBAAiB,WAAW,CAAC,UAAwB;AAC1D,QAAI,MAAM,QAAQ,mBAAoB;AAEtC,QAAI,MAAM,UAAU;AAClB,YAAM,SAAS,gBAAgB;AAC/B,YAAM,cAAc,QAAQ,YAAY;AACxC,oBAAc,YAAY,OAAO,cAAc,OAAO,WAAW,IAAI,IAAI;AAAA,IAC3E,OAAO;AACL,oBAAc,YAAY,QAAQ,IAAI;AAAA,IACxC;AAAA,EACF,CAAC;AACH;AAWO,IAAM,eAAe,CAAC,aAAyC;AACpE,MAAI,CAAC,UAAU,GAAG;AAChB,WAAO,MAAM;AAAA,IAAC;AAAA,EAChB;AAEA,YAAU,IAAI,QAAQ;AACtB,wBAAsB;AAEtB,SAAO,MAAM;AACX,cAAU,OAAO,QAAQ;AAAA,EAC3B;AACF;;;AClDA,IAAM,aAAa,MAAsB;AACvC,QAAM,UAAU,WAAW,SAAS,SAAS;AAC7C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,UAAU,qDAAqD;AAAA,EAC3E;AACA,SAAO;AACT;AAEA,IAAM,uBAAuB,MAAc;AACzC,QAAM,MAAM,mBAAmB;AAC/B,MAAI,CAAC,KAAK,KAAK;AACb,UAAM,IAAI,UAAU,6DAA6D;AAAA,EACnF;AACA,SAAO,IAAI;AACb;AAGO,IAAM,iBAAiB;AAsBvB,IAAM,QAAQ,OAAO,OAAe,aAAwD;AACjG,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,cAAc,qBAAqB;AACzC,UAAM,UAAU,WAAW;AAE3B,UAAM,OAAO,IAAI,gBAAgB;AAAA,MAC/B,YAAY;AAAA,MACZ,UAAU;AAAA,MACV;AAAA,IACF,CAAC;AAED,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,GAAG,WAAW,UAAU;AAAA,QACxC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,KAAK,SAAS;AAAA,MACtB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,IAC3E;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,YAAa,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,UAAU,UAAU,OAAO,UAAU,qBAAqB,iBAAiB,IAAI,MAAM,KAAK,IAAI,MAAM;AAAA,IAChH;AAEA,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,UAAM,cAAc,KAAK;AAEzB,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,MAAM,GAAG,WAAW,SAAS;AAAA,QAC3C,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,MACpD,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,IAC3E;AAEA,QAAI,CAAC,QAAQ,IAAI;AACf,YAAM,YAAa,MAAM,QAAQ,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACxD,YAAM,IAAI,UAAU,UAAU,OAAO,8BAA8B,QAAQ,MAAM,KAAK,QAAQ,MAAM;AAAA,IACtG;AAEA,UAAM,WAAY,MAAM,QAAQ,KAAK;AACrC,UAAM,OAAO,OAAO,QAAQ;AAE5B,mBAAe,SAAS,aAAa,KAAK,aAAa;AAEvD,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,UAAU;AAEzB,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,MAAM,OAAO,UAAU,cAAc;AACrE,UAAM,MAAM,MAAM,WAAW,IAAI;AACjC,0BAAsB,GAAG;AACzB,UAAM,OAAO,OAAO,UAAU;AAC9B,kBAAc,YAAY,OAAO,IAAI;AACrC,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAYO,IAAM,SAAS,OAAO,OAAe,UAAkB,SAAyD;AACrH,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,cAAc,qBAAqB;AACzC,UAAM,UAAU,WAAW;AAE3B,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,GAAG,WAAW,WAAW;AAAA,QACzC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,UAAU,KAAK,CAAC;AAAA,MAChD,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,IAC3E;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,YAAa,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,UAAU,UAAU,OAAO,kBAAkB,IAAI,MAAM,KAAK,IAAI,MAAM;AAAA,IAClF;AAEA,UAAM,eAAgB,MAAM,IAAI,KAAK;AACrC,UAAM,OAAO,OAAO,YAAY;AAEhC,QAAI,aAAa,cAAc;AAC7B,YAAM,cAAc,aAAa;AACjC,UAAI,aAAa;AACf,uBAAe,SAAS,aAAa,aAAa,aAAa;AAAA,MACjE;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,UAAU;AAEzB,MAAI;AACF,UAAM,WAAW,MAAM,OAAO,OAAO,OAAO,UAAU,IAAI;AAC1D,UAAM,OAAO,OAAO,QAAoB;AACxC,QAAI,SAAS,cAAc;AACzB,YAAM,MAAM,MAAO,SAA6C,MAAM;AACtE,UAAI,KAAK;AACP,8BAAsB,GAAG;AAAA,MAC3B;AACA,oBAAc,YAAY,OAAO,IAAI;AAAA,IACvC;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAUO,IAAM,SAAS,YAA2B;AAC/C,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,cAAc,qBAAqB;AACzC,UAAM,UAAU,WAAW;AAE3B,UAAM,MAAM,QAAQ,IAAI,aAAa;AACrC,QAAI,KAAK;AACP,UAAI;AACF,cAAM,MAAM,GAAG,WAAW,WAAW;AAAA,UACnC,QAAQ;AAAA,UACR,SAAS,EAAE,eAAe,UAAU,GAAG,GAAG;AAAA,QAC5C,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,sBAAkB,OAAO;AACzB;AAAA,EACF;AAEA,QAAM,SAAS,UAAU;AAEzB,MAAI;AACF,UAAM,cAAc,OAAO,YAAY;AACvC,QAAI,aAAa;AACf,YAAM,YAAY,OAAO;AAAA,IAC3B;AACA,6BAAyB;AACzB,kBAAc,YAAY,QAAQ,IAAI;AAAA,EACxC,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAWO,IAAM,aAAa,CAAC,aAA4B;AACrD,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,IAAI,UAAU,+CAA+C;AAAA,EACrE;AACA,QAAM,SAAS,UAAU;AAEzB,SAAO,SAAS,OAAO,OAAO,iBAAiB,QAAQ;AACvD,QAAM,IAAI,UAAU,+BAA+B;AACrD;AAwBO,IAAM,qBAAqB,YAA4C;AAC5E,MAAI,CAAC,UAAU,EAAG,QAAO;AAEzB,QAAM,OAAO,OAAO,SAAS,KAAK,UAAU,CAAC;AAC7C,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,SAAS,UAAU;AACzB,QAAM,SAAS,IAAI,gBAAgB,IAAI;AAEvC,MAAI;AACF,UAAM,cAAc,OAAO,IAAI,cAAc;AAC7C,QAAI,YAAa,QAAO,MAAM,oBAAoB,QAAQ,QAAQ,WAAW;AAE7E,UAAM,oBAAoB,OAAO,IAAI,oBAAoB;AACzD,QAAI,kBAAmB,QAAO,MAAM,2BAA2B,QAAQ,iBAAiB;AAExF,UAAM,gBAAgB,OAAO,IAAI,gBAAgB;AACjD,QAAI,cAAe,QAAO,MAAM,uBAAuB,QAAQ,aAAa;AAE5E,UAAM,cAAc,OAAO,IAAI,cAAc;AAC7C,QAAI,YAAa,QAAO,qBAAqB,WAAW;AAExD,UAAM,mBAAmB,OAAO,IAAI,oBAAoB;AACxD,QAAI,iBAAkB,QAAO,MAAM,0BAA0B,QAAQ,gBAAgB;AAErF,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,UAAW,OAAM;AACtC,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAIA,IAAM,sBAAsB,OAC1B,QACA,QACA,gBAC4B;AAC5B,QAAM,eAAe,OAAO,IAAI,eAAe,KAAK;AACpD,QAAM,aAAa,MAAM,OAAO;AAAA,IAC9B;AAAA,MACE,cAAc;AAAA,MACd,YAAa,OAAO,IAAI,YAAY,KAAkB;AAAA,MACtD,YAAY,OAAO,OAAO,IAAI,YAAY,CAAC;AAAA,MAC3C,YAAY,OAAO,OAAO,IAAI,YAAY,CAAC;AAAA,MAC3C,eAAe;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACA,wBAAsB,aAAa,gBAAgB,MAAS;AAC5D,QAAM,OAAO,OAAO,UAAU;AAC9B,YAAU;AACV,gBAAc,YAAY,OAAO,IAAI;AACrC,SAAO,EAAE,MAAM,SAAS,KAAK;AAC/B;AAEA,IAAM,6BAA6B,OAAO,QAAgB,UAA2C;AACnG,QAAM,aAAa,MAAM,OAAO,QAAQ,OAAO,cAAc;AAC7D,QAAM,MAAM,MAAM,WAAW,IAAI;AACjC,wBAAsB,GAAG;AACzB,QAAM,OAAO,OAAO,UAAU;AAC9B,YAAU;AACV,gBAAc,YAAY,OAAO,IAAI;AACrC,SAAO,EAAE,MAAM,gBAAgB,KAAK;AACtC;AAEA,IAAM,yBAAyB,OAAO,QAAgB,UAA2C;AAC/F,QAAM,aAAa,MAAM,OAAO,QAAQ,OAAO,cAAc;AAC7D,QAAM,MAAM,MAAM,WAAW,IAAI;AACjC,wBAAsB,GAAG;AACzB,QAAM,OAAO,OAAO,UAAU;AAC9B,YAAU;AACV,gBAAc,YAAY,UAAU,IAAI;AACxC,SAAO,EAAE,MAAM,YAAY,KAAK;AAClC;AAEA,IAAM,uBAAuB,CAAC,UAAkC;AAC9D,YAAU;AACV,SAAO,EAAE,MAAM,UAAU,MAAM,MAAM,MAAM;AAC7C;AAEA,IAAM,4BAA4B,OAAO,QAAgB,qBAAsD;AAC7G,QAAM,cAAc,OAAO,YAAY;AACvC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,UAAU,8DAA8D;AAAA,EACpF;AAEA,QAAM,MAAM,MAAM,YAAY,IAAI;AAClC,QAAM,cAAc,GAAG,OAAO,SAAS,MAAM,GAAG,aAAa;AAE7D,QAAM,iBAAiB,MAAM,MAAM,GAAG,WAAW,SAAS;AAAA,IACxD,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,eAAe,UAAU,GAAG;AAAA,IAC9B;AAAA,IACA,MAAM,KAAK,UAAU,EAAE,oBAAoB,iBAAiB,CAAC;AAAA,EAC/D,CAAC;AAED,MAAI,CAAC,eAAe,IAAI;AACtB,UAAM,YAAa,MAAM,eAAe,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/D,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,qCAAqC,eAAe,MAAM;AAAA,MAC3E,eAAe;AAAA,IACjB;AAAA,EACF;AAEA,QAAM,kBAAmB,MAAM,eAAe,KAAK;AACnD,QAAM,OAAO,OAAO,eAAe;AACnC,YAAU;AACV,gBAAc,YAAY,cAAc,IAAI;AAC5C,SAAO,EAAE,MAAM,gBAAgB,KAAK;AACtC;AAEA,IAAM,YAAY,MAAY;AAC5B,UAAQ,aAAa,MAAM,IAAI,OAAO,SAAS,WAAW,OAAO,SAAS,MAAM;AAClF;AAUO,IAAM,iBAAiB,YAAsD;AAClF,MAAI,CAAC,UAAU,EAAG,QAAO;AAEzB,QAAM,SAAS,UAAU;AACzB,QAAM,cAAc,OAAO,YAAY;AACvC,MAAI,YAAa,QAAO,OAAO,WAAW;AAE1C,QAAM,cAAc,UAAU,aAAa;AAC3C,MAAI,CAAC,YAAa,QAAO;AAEzB,QAAM,eAAe,UAAU,iBAAiB,KAAK;AAErD,QAAM,UAAU,iBAAiB,WAAW;AAC5C,QAAM,YAAY,SAAS,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAClE,QAAM,YAAY,KAAK,IAAI,GAAG,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,CAAC;AAEvE,QAAM,aAAa,MAAM,OAAO;AAAA,IAC9B;AAAA,MACE,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,eAAe;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AAEA,QAAM,OAAO,OAAO,UAAU;AAC9B,gBAAc,YAAY,OAAO,IAAI;AACrC,SAAO;AACT;;;AC5ZA,IAAM,qBAAqB,YAAiC;AAC1D,QAAM,SAAS,UAAU;AAEzB,MAAI,cAAc,OAAO,YAAY;AACrC,MAAI,CAAC,eAAe,UAAU,GAAG;AAC/B,QAAI;AACF,YAAM,eAAe;AAAA,IACvB,QAAQ;AAAA,IAER;AACA,kBAAc,OAAO,YAAY;AAAA,EACnC;AACA,MAAI,CAAC,YAAa,OAAM,IAAI,UAAU,gCAAgC;AAEtE,SAAO;AACT;AAOO,IAAM,0BAA0B,OAAO,UAAiC;AAC7E,QAAM,SAAS,UAAU;AAEzB,MAAI;AACF,UAAM,OAAO,wBAAwB,KAAK;AAAA,EAC5C,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAOO,IAAM,kBAAkB,OAAO,OAAe,gBAAuC;AAC1F,QAAM,SAAS,UAAU;AAEzB,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,QAAQ,OAAO,cAAc;AAC7D,UAAM,cAAc,MAAM,WAAW,OAAO,EAAE,UAAU,YAAY,CAAC;AACrE,UAAM,OAAO,OAAO,WAAW;AAC/B,kBAAc,YAAY,OAAO,IAAI;AACrC,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAOO,IAAM,eAAe,OAAO,UAAiC;AAClE,QAAM,SAAS,UAAU;AAEzB,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,QAAQ,OAAO,cAAc;AAC7D,UAAM,OAAO,OAAO,UAAU;AAC9B,kBAAc,YAAY,OAAO,IAAI;AACrC,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAOO,IAAM,eAAe,OAAO,OAAe,aAAoC;AACpF,QAAM,SAAS,UAAU;AAEzB,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,aAAa,OAAO,UAAU,cAAc;AAC5E,UAAM,OAAO,OAAO,UAAU;AAC9B,kBAAc,YAAY,OAAO,IAAI;AACrC,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAQO,IAAM,oBAAoB,OAAO,UAAiC;AACvE,MAAI,CAAC,UAAU,EAAG,OAAM,IAAI,UAAU,sDAAsD;AAE5F,QAAM,cAAc,MAAM,mBAAmB;AAE7C,QAAM,MAAM,MAAM,YAAY,IAAI;AAClC,QAAM,cAAc,GAAG,OAAO,SAAS,MAAM,GAAG,aAAa;AAE7D,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,WAAW,SAAS;AAAA,MAC7C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,UAAU,GAAG;AAAA,MAC9B;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,oBAAoB,MAAM,CAAC;AAAA,IACpD,CAAC;AAED,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,YAAa,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,UAAU,UAAU,OAAO,qCAAqC,IAAI,MAAM,KAAK,IAAI,MAAM;AAAA,IACrG;AAEA,UAAM,WAAY,MAAM,IAAI,KAAK;AACjC,UAAM,OAAO,OAAO,QAAQ;AAC5B,kBAAc,YAAY,cAAc,IAAI;AAC5C,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,UAAW,OAAM;AACtC,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAUO,IAAM,aAAa,OAAO,YAAwC;AACvE,QAAM,cAAc,MAAM,mBAAmB;AAE7C,MAAI;AACF,UAAM,cAAc,MAAM,YAAY,OAAO,OAAO;AACpD,UAAM,OAAO,OAAO,WAAW;AAC/B,kBAAc,YAAY,cAAc,IAAI;AAC5C,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;;;ACpJA,IAAM,eAAe,MAAsC;AACzD,QAAM,MAAM,mBAAmB;AAC/B,MAAI,CAAC,KAAK,KAAK;AACb,UAAM,IAAI,UAAU,6DAA6D;AAAA,EACnF;AACA,MAAI,CAAC,IAAI,OAAO;AACd,UAAM,IAAI,UAAU,kFAAkF;AAAA,EACxG;AACA,SAAO,EAAE,KAAK,IAAI,KAAK,OAAO,IAAI,MAAM;AAC1C;AAMA,IAAM,aAAa,OAAO,MAAc,UAAuB,CAAC,MAAyB;AACvF,QAAM,EAAE,KAAK,MAAM,IAAI,aAAa;AACpC,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI;AAAA,MACjC,GAAG;AAAA,MACH,SAAS;AAAA,QACP,GAAG,QAAQ;AAAA,QACX,eAAe,UAAU,KAAK;AAAA,QAC9B,gBAAgB;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,YAAY,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACnD,UAAM,IAAI,UAAW,UAA8B,OAAO,yBAAyB,IAAI,MAAM,KAAK,IAAI,MAAM;AAAA,EAC9G;AACA,SAAO;AACT;AAGA,IAAM,eAAe,MAAM;AACzB,QAAM,SAAS,UAAU;AACzB,QAAM,OAAO,OAAO,YAAY;AAChC,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,UAAU,2DAA2D;AAAA,EACjF;AACA,SAAO;AACT;AAaA,IAAM,YAAY,OAAO,YAAmE;AAC1F,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,SAAS,IAAI,gBAAgB;AACnC,QAAI,SAAS,QAAQ,KAAM,QAAO,IAAI,QAAQ,OAAO,QAAQ,IAAI,CAAC;AAClE,QAAI,SAAS,WAAW,KAAM,QAAO,IAAI,YAAY,OAAO,QAAQ,OAAO,CAAC;AAC5E,UAAM,QAAQ,OAAO,SAAS;AAC9B,UAAM,OAAO,eAAe,QAAQ,IAAI,KAAK,KAAK,EAAE;AAEpD,UAAM,MAAM,MAAM,WAAW,IAAI;AACjC,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,WAAO,KAAK,MAAM,IAAI,MAAM;AAAA,EAC9B;AAEA,MAAI;AACF,UAAM,OAAO,aAAa;AAC1B,UAAM,QAAQ,MAAM,KAAK,MAAM,UAAU,EAAE;AAC3C,WAAQ,MAAqB,IAAI,MAAM;AAAA,EACzC,SAAS,OAAO;AACd,QAAI,iBAAiB,UAAW,OAAM;AACtC,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAaA,IAAMC,WAAU,OAAO,WAAkC;AACvD,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,MAAM,MAAM,WAAW,gBAAgB,MAAM,EAAE;AACrD,UAAM,WAAY,MAAM,IAAI,KAAK;AACjC,WAAO,OAAO,QAAQ;AAAA,EACxB;AAEA,MAAI;AACF,UAAM,OAAO,aAAa;AAC1B,UAAM,WAAW,MAAM,KAAK,MAAM,QAAQ,EAAE,IAAI,OAAO,CAAa;AACpE,WAAO,OAAO,QAAQ;AAAA,EACxB,SAAS,OAAO;AACd,QAAI,iBAAiB,UAAW,OAAM;AACtC,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAkBA,IAAM,aAAa,OAAO,WAIL;AACnB,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,MAAM,MAAM,WAAW,gBAAgB;AAAA,MAC3C,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,OAAO;AAAA,QACd,UAAU,OAAO;AAAA,QACjB,GAAG,OAAO;AAAA,QACV,SAAS;AAAA,MACX,CAAC;AAAA,IACH,CAAC;AACD,UAAM,WAAY,MAAM,IAAI,KAAK;AACjC,WAAO,OAAO,QAAQ;AAAA,EACxB;AAEA,MAAI;AACF,UAAM,OAAO,aAAa;AAC1B,UAAM,WAAW,MAAM,KAAK,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU;AAAA,MAC1E,GAAG,OAAO;AAAA,MACV,SAAS;AAAA,IACX,CAAC;AACD,WAAO,OAAO,QAAQ;AAAA,EACxB,SAAS,OAAO;AACd,QAAI,iBAAiB,UAAW,OAAM;AACtC,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAaA,IAAMC,cAAa,OAAO,QAAgB,eAAgD;AACxF,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,MAAM,MAAM,WAAW,gBAAgB,MAAM,IAAI;AAAA,MACrD,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU,UAAU;AAAA,IACjC,CAAC;AACD,UAAM,WAAY,MAAM,IAAI,KAAK;AACjC,WAAO,OAAO,QAAQ;AAAA,EACxB;AAEA,MAAI;AACF,UAAM,OAAO,aAAa;AAC1B,UAAM,WAAW,MAAM,KAAK,MAAM,WAAW,EAAE,IAAI,OAAO,GAAe,UAAU;AACnF,WAAO,OAAO,QAAQ;AAAA,EACxB,SAAS,OAAO;AACd,QAAI,iBAAiB,UAAW,OAAM;AACtC,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAaA,IAAM,aAAa,OAAO,WAAkC;AAC1D,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,WAAW,gBAAgB,MAAM,IAAI,EAAE,QAAQ,SAAS,CAAC;AAC/D;AAAA,EACF;AAEA,MAAI;AACF,UAAM,OAAO,aAAa;AAC1B,UAAM,KAAK,MAAM,WAAW,EAAE,IAAI,OAAO,CAAa;AAAA,EACxD,SAAS,OAAO;AACd,QAAI,iBAAiB,UAAW,OAAM;AACtC,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AA2EO,IAAM,QAAe,EAAE,WAAW,SAAAD,UAAS,YAAY,YAAAC,aAAY,WAAW;","names":["GoTrue","jwt","getUser","updateUser"]}
+{"version":3,"sources":["../src/index.ts","../src/types.ts","../src/environment.ts","../src/errors.ts","../src/cookies.ts","../src/nextjs.ts","../src/user.ts","../src/config.ts","../src/events.ts","../src/auth.ts","../src/account.ts","../src/admin.ts"],"sourcesContent":["export type { User } from './user.js'\nexport { getUser, isAuthenticated } from './user.js'\nexport { getIdentityConfig, getSettings } from './config.js'\nexport type { AuthCallback, AuthEvent } from './events.js'\nexport { AUTH_EVENTS, onAuthChange } from './events.js'\nexport type { CallbackResult } from './auth.js'\nexport { login, signup, logout, oauthLogin, handleAuthCallback, hydrateSession } from './auth.js'\nexport { AuthError, MissingIdentityError } from './errors.js'\nexport type {\n  AdminUserUpdates,\n  AppMetadata,\n  AuthProvider,\n  CreateUserParams,\n  IdentityConfig,\n  ListUsersOptions,\n  Settings,\n  UserUpdates,\n  SignupData,\n} from './types.js'\nexport type { Admin } from './admin.js'\nexport {\n  requestPasswordRecovery,\n  recoverPassword,\n  confirmEmail,\n  acceptInvite,\n  verifyEmailChange,\n  updateUser,\n} from './account.js'\nexport { admin } from './admin.js'\n","/** The supported OAuth and authentication providers. */\nexport const AUTH_PROVIDERS = ['google', 'github', 'gitlab', 'bitbucket', 'facebook', 'saml', 'email'] as const\n\n/** A supported authentication provider name (e.g., `'google'`, `'github'`, `'email'`). */\nexport type AuthProvider = (typeof AUTH_PROVIDERS)[number]\n\n/**\n * Provider and role metadata stored in a user's `app_metadata` field.\n * GoTrue sets `provider` automatically on signup; `roles` controls authorization.\n * Additional keys may be present depending on your Identity configuration.\n *\n * @example\n * ```ts\n * const meta: AppMetadata = {\n *   provider: 'github',\n *   roles: ['admin'],\n *   custom_claim: 'value',\n * }\n * ```\n */\nexport interface AppMetadata {\n  provider: AuthProvider\n  roles?: string[]\n  [key: string]: unknown\n}\n\n/**\n * Identity endpoint configuration for the current environment.\n * In the browser, `url` is derived from `window.location.origin`.\n * On the server, `token` is the operator token for admin operations.\n */\nexport interface IdentityConfig {\n  /** The GoTrue API endpoint URL (e.g., `https://example.com/.netlify/identity`). */\n  url: string\n  /** Operator token for server-side admin requests. Only available in Netlify Functions. */\n  token?: string\n}\n\n/**\n * Project-level Identity settings returned by {@link getSettings}.\n * Reflects the configuration in your Netlify dashboard.\n */\nexport interface Settings {\n  /** Whether new signups are auto-confirmed (no confirmation email sent). */\n  autoconfirm: boolean\n  /** Whether new signups are disabled entirely. */\n  disableSignup: boolean\n  /** Map of provider names to whether they are enabled. */\n  providers: Record<AuthProvider, boolean>\n}\n\n/**\n * Fields accepted by {@link updateUser}. All fields are optional.\n * Pass `data` to update user metadata (e.g., `{ data: { full_name: 'New Name' } }`).\n *\n * @example\n * ```ts\n * await updateUser({ data: { full_name: 'Jane Doe' } })\n * await updateUser({ email: 'new@example.com' })\n * await updateUser({ password: 'new-password' })\n * ```\n */\nexport interface UserUpdates {\n  email?: string\n  password?: string\n  data?: Record<string, unknown>\n  [key: string]: unknown\n}\n\n/**\n * User metadata passed during signup (e.g., `{ full_name: 'Jane Doe' }`).\n * Stored in the user's `user_metadata` field.\n */\nexport type SignupData = Record<string, unknown>\n\n/** GoTrue OAuth2 token response from the /token endpoint. */\nexport interface TokenResponse {\n  access_token: string\n  token_type: string\n  expires_in: number\n  refresh_token?: string\n}\n\n/**\n * Fields accepted by {@link admin.updateUser}. All fields are optional.\n *\n * Unlike {@link UserUpdates} (used by the self-service `updateUser`), admin updates\n * can set `role`, force-confirm a user, and write to `app_metadata`.\n *\n * @example\n * ```ts\n * await admin.updateUser(userId, {\n *   role: 'editor',\n *   confirm: true,\n *   app_metadata: { plan: 'pro' },\n * })\n * ```\n */\nexport interface AdminUserUpdates {\n  email?: string\n  password?: string\n  /** The user's role (e.g., `'admin'`, `'editor'`). */\n  role?: string\n  /** Set to `true` to force-confirm the user's email without sending a confirmation email. */\n  confirm?: boolean\n  /** Server-managed metadata. Only writable via admin operations. */\n  app_metadata?: Record<string, unknown>\n  /** User-managed metadata (display name, avatar, preferences, etc.). */\n  user_metadata?: Record<string, unknown>\n  [key: string]: unknown\n}\n\n/** GoTrue error response body. */\nexport interface GoTrueErrorBody {\n  msg?: string\n  error_description?: string\n}\n\n/**\n * Options for {@link admin.listUsers}. Only used on the server;\n * pagination is ignored in the browser (gotrue-js limitation).\n */\nexport interface ListUsersOptions {\n  /** 1-based page number. */\n  page?: number\n  /** Number of users per page. */\n  perPage?: number\n}\n\n/**\n * Parameters for {@link admin.createUser}.\n *\n * The optional `data` fields are spread as top-level attributes in the GoTrue\n * request body (not nested under `user_metadata`). Use this to set `app_metadata`,\n * `user_metadata`, `role`, or other GoTrue user fields at creation time.\n *\n * @example\n * ```ts\n * await admin.createUser({\n *   email: 'jane@example.com',\n *   password: 'secret',\n *   data: { role: 'editor', user_metadata: { full_name: 'Jane Doe' } },\n * })\n * ```\n */\nexport interface CreateUserParams {\n  email: string\n  password: string\n  /** Additional GoTrue user fields spread into the request body. */\n  data?: Record<string, unknown>\n}\n\n/**\n * Cookie interface provided by the Netlify Functions runtime.\n * Used internally for server-side auth cookie management.\n */\nexport interface NetlifyCookies {\n  get(name: string): string | undefined\n  set(options: {\n    name: string\n    value: string\n    httpOnly: boolean\n    secure: boolean\n    path: string\n    sameSite: 'Strict' | 'Lax' | 'None'\n  }): void\n  delete(name: string): void\n}\n","import GoTrue from 'gotrue-js'\n\nimport type { IdentityConfig } from './types.js'\nimport { MissingIdentityError } from './errors.js'\n\nexport const IDENTITY_PATH = '/.netlify/identity'\n\nlet goTrueClient: GoTrue | null = null\nlet cachedApiUrl: string | null | undefined\nlet warnedMissingUrl = false\n\nexport const isBrowser = (): boolean => typeof window !== 'undefined' && typeof window.location !== 'undefined'\n\n/**\n * Discovers and caches the GoTrue API URL.\n *\n * Browser: uses `window.location.origin` + IDENTITY_PATH.\n * Server: reads from `globalThis.netlifyIdentityContext`.\n */\nconst discoverApiUrl = (): string | null => {\n  if (cachedApiUrl !== undefined) return cachedApiUrl\n\n  if (isBrowser()) {\n    cachedApiUrl = `${window.location.origin}${IDENTITY_PATH}`\n  } else {\n    const identityContext = getIdentityContext()\n    if (identityContext?.url) {\n      cachedApiUrl = identityContext.url\n    } else if (globalThis.Netlify?.context?.url) {\n      cachedApiUrl = new URL(IDENTITY_PATH, globalThis.Netlify.context.url).href\n    } else if (process.env.URL) {\n      cachedApiUrl = new URL(IDENTITY_PATH, process.env.URL).href\n    }\n  }\n\n  return cachedApiUrl ?? null\n}\n\n/**\n * Returns (and lazily creates) a singleton gotrue-js client.\n * Returns `null` and logs a warning if no identity URL can be discovered.\n */\nexport const getGoTrueClient = (): GoTrue | null => {\n  if (goTrueClient) return goTrueClient\n\n  const apiUrl = discoverApiUrl()\n  if (!apiUrl) {\n    if (!warnedMissingUrl) {\n      console.warn(\n        '@netlify/identity: Could not determine the Identity endpoint URL. ' +\n          'Make sure your site has Netlify Identity enabled, or run your app with `netlify dev`.',\n      )\n      warnedMissingUrl = true\n    }\n    return null\n  }\n\n  goTrueClient = new GoTrue({ APIUrl: apiUrl, setCookie: false })\n  return goTrueClient\n}\n\n/**\n * Returns the singleton gotrue-js client, or throws if Identity is not configured.\n */\nexport const getClient = (): GoTrue => {\n  const client = getGoTrueClient()\n  if (!client) throw new MissingIdentityError()\n  return client\n}\n\n/**\n * Reads the server-side identity context set by the Netlify bootstrap.\n * Returns `null` outside the Netlify serverless environment.\n */\nexport const getIdentityContext = (): IdentityConfig | null => {\n  const identityContext = globalThis.netlifyIdentityContext\n  if (identityContext?.url) {\n    return {\n      url: identityContext.url,\n      token: identityContext.token,\n    }\n  }\n\n  if (globalThis.Netlify?.context?.url) {\n    return { url: new URL(IDENTITY_PATH, globalThis.Netlify.context.url).href }\n  }\n\n  // Fallback: Netlify sets the URL env var on all deployed sites\n  const siteUrl = process.env.URL\n  if (siteUrl) {\n    return { url: new URL(IDENTITY_PATH, siteUrl).href }\n  }\n\n  return null\n}\n\n/** Reset cached state for tests. */\nexport const resetTestGoTrueClient = (): void => {\n  goTrueClient = null\n  cachedApiUrl = undefined\n  warnedMissingUrl = false\n}\n","/**\n * Thrown by auth operations when something goes wrong: invalid credentials,\n * network failures, missing runtime context, etc.\n *\n * The `status` field contains the HTTP status code from GoTrue when available\n * (e.g., 401 for bad credentials, 422 for validation errors).\n * The `cause` field preserves the original error for debugging.\n *\n * @example\n * ```ts\n * try {\n *   await login(email, password)\n * } catch (error) {\n *   if (error instanceof AuthError) {\n *     console.error(error.message, error.status)\n *   }\n * }\n * ```\n */\nexport class AuthError extends Error {\n  override name = 'AuthError'\n  /** HTTP status code from GoTrue, if the error originated from an API response. */\n  status?: number\n  declare cause?: unknown\n\n  constructor(message: string, status?: number, options?: { cause?: unknown }) {\n    super(message)\n    this.status = status\n    if (options && 'cause' in options) {\n      this.cause = options.cause\n    }\n  }\n}\n\n/**\n * Thrown when a function requires a gotrue-js client but Netlify Identity\n * is not configured (no endpoint URL could be discovered).\n *\n * This typically means the site does not have Identity enabled, or the app\n * is not running via `netlify dev` / deployed on Netlify.\n */\nexport class MissingIdentityError extends Error {\n  override name = 'MissingIdentityError'\n\n  constructor(message = 'Netlify Identity is not available.') {\n    super(message)\n  }\n}\n","import type { NetlifyCookies } from './types.js'\n\nexport const NF_JWT_COOKIE = 'nf_jwt'\nexport const NF_REFRESH_COOKIE = 'nf_refresh'\n\n/** Reads a cookie value from `document.cookie` by name. Returns `null` if not found. */\nexport const getCookie = (name: string): string | null => {\n  const match = document.cookie.match(new RegExp(`(?:^|; )${name.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')}=([^;]*)`))\n  return match ? decodeURIComponent(match[1]) : null\n}\n\n/** Sets the `nf_jwt` and (optionally) `nf_refresh` auth cookies via the Netlify runtime. */\nexport const setAuthCookies = (cookies: NetlifyCookies, accessToken: string, refreshToken?: string): void => {\n  cookies.set({\n    name: NF_JWT_COOKIE,\n    value: accessToken,\n    httpOnly: false,\n    secure: true,\n    path: '/',\n    sameSite: 'Lax',\n  })\n\n  if (refreshToken) {\n    // httpOnly: false because browser-side hydration (backgroundHydrate, hydrateSession)\n    // reads nf_refresh via document.cookie to bootstrap the gotrue-js session.\n    cookies.set({\n      name: NF_REFRESH_COOKIE,\n      value: refreshToken,\n      httpOnly: false,\n      secure: true,\n      path: '/',\n      sameSite: 'Lax',\n    })\n  }\n}\n\n/** Deletes both auth cookies via the Netlify runtime. */\nexport const deleteAuthCookies = (cookies: NetlifyCookies): void => {\n  cookies.delete(NF_JWT_COOKIE)\n  cookies.delete(NF_REFRESH_COOKIE)\n}\n\n/** Sets auth cookies via document.cookie (browser-side). */\nexport const setBrowserAuthCookies = (accessToken: string, refreshToken?: string): void => {\n  document.cookie = `${NF_JWT_COOKIE}=${encodeURIComponent(accessToken)}; path=/; secure; samesite=lax`\n  if (refreshToken) {\n    document.cookie = `${NF_REFRESH_COOKIE}=${encodeURIComponent(refreshToken)}; path=/; secure; samesite=lax`\n  }\n}\n\n/** Deletes auth cookies via document.cookie (browser-side). */\nexport const deleteBrowserAuthCookies = (): void => {\n  document.cookie = `${NF_JWT_COOKIE}=; path=/; secure; samesite=lax; expires=Thu, 01 Jan 1970 00:00:00 GMT`\n  document.cookie = `${NF_REFRESH_COOKIE}=; path=/; secure; samesite=lax; expires=Thu, 01 Jan 1970 00:00:00 GMT`\n}\n\n/** Reads a cookie from the server-side Netlify runtime. Returns `null` if not available. */\nexport const getServerCookie = (name: string): string | null => {\n  const cookies = globalThis.Netlify?.context?.cookies\n  if (!cookies || typeof cookies.get !== 'function') return null\n  return cookies.get(name) ?? null\n}\n","// Minimal declaration so we can use require() without @types/node\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\ndeclare const require: ((id: string) => any) | undefined\n\n/**\n * Calls `headers()` from `next/headers` if available, to opt Next.js RSC\n * routes into dynamic rendering. Without this, Next.js may statically\n * optimize pages that call functions in this package, caching the build-time result.\n *\n * Re-throws DynamicServerError so Next.js can catch it and switch to\n * dynamic rendering. Silently ignores if not in a Next.js environment.\n */\nlet nextHeadersFn: (() => unknown) | null | undefined\nexport const triggerNextjsDynamic = (): void => {\n  if (nextHeadersFn === null) return\n\n  if (nextHeadersFn === undefined) {\n    try {\n      if (typeof require === 'undefined') {\n        nextHeadersFn = null\n        return\n      }\n      const mod = require('next/headers')\n      nextHeadersFn = mod.headers\n    } catch {\n      nextHeadersFn = null\n      return\n    }\n  }\n\n  const fn = nextHeadersFn\n  if (!fn) return\n\n  try {\n    fn()\n  } catch (e: unknown) {\n    // Re-throw DynamicServerError so Next.js can opt into dynamic rendering.\n    // These errors have a `digest` property containing 'DYNAMIC_SERVER_USAGE'\n    // or a message about bailing out of prerendering.\n    if (e instanceof Error && ('digest' in e || /bail\\s*out.*prerende/i.test(e.message))) {\n      throw e\n    }\n  }\n}\n\n/** Reset cached state and optionally inject a headers function. Test use only. */\nexport const resetNextjsState = (headersFn?: (() => unknown) | null): void => {\n  nextHeadersFn = headersFn === null ? null : (headersFn ?? undefined)\n}\n","import type { UserData } from 'gotrue-js'\nimport { AUTH_PROVIDERS, type AuthProvider } from './types.js'\nimport { getGoTrueClient, getClient, isBrowser } from './environment.js'\nimport { getCookie, getServerCookie, NF_JWT_COOKIE, NF_REFRESH_COOKIE } from './cookies.js'\nimport { triggerNextjsDynamic } from './nextjs.js'\n\n/** Decoded JWT claims from the Identity token. Used internally to construct {@link User}. */\nexport interface IdentityUser {\n  sub?: string\n  email?: string\n  exp?: number\n  app_metadata?: Record<string, unknown>\n  user_metadata?: Record<string, unknown>\n  [key: string]: unknown\n}\n\nconst toAuthProvider = (value: unknown): AuthProvider | undefined =>\n  typeof value === 'string' && (AUTH_PROVIDERS as readonly string[]).includes(value)\n    ? (value as AuthProvider)\n    : undefined\n\n/**\n * A normalized user object returned by all auth and admin functions.\n * Provides a consistent shape regardless of whether the user was loaded\n * from gotrue-js, a JWT cookie, or the server-side identity context.\n *\n * @example\n * ```ts\n * const user = getUser()\n * if (user) {\n *   console.log(user.email, user.name, user.provider)\n * }\n * ```\n */\nexport interface User {\n  /** The user's unique identifier (GoTrue UUID). */\n  id: string\n  /** The user's email address. */\n  email?: string\n  /** `true` if the user's email has been confirmed. */\n  emailVerified?: boolean\n  /** ISO 8601 timestamp of when the account was created. */\n  createdAt?: string\n  /** ISO 8601 timestamp of the last account update. */\n  updatedAt?: string\n  /** The authentication provider used to create the account. */\n  provider?: AuthProvider\n  /** Display name from `user_metadata.full_name` or `user_metadata.name`. */\n  name?: string\n  /** Avatar URL from `user_metadata.avatar_url`. */\n  pictureUrl?: string\n  /** The full `user_metadata` object. */\n  metadata?: Record<string, unknown>\n  /** The raw GoTrue user data, for accessing fields not mapped to this interface. */\n  rawGoTrueData?: Record<string, unknown>\n}\n\nexport const toUser = (userData: UserData): User => {\n  const userMeta = userData.user_metadata ?? {}\n  const appMeta = userData.app_metadata ?? {}\n  const name = userMeta.full_name || userMeta.name\n  const pictureUrl = userMeta.avatar_url\n\n  return {\n    id: userData.id,\n    email: userData.email,\n    emailVerified: !!userData.confirmed_at,\n    createdAt: userData.created_at,\n    updatedAt: userData.updated_at,\n    provider: toAuthProvider(appMeta.provider),\n    name: typeof name === 'string' ? name : undefined,\n    pictureUrl: typeof pictureUrl === 'string' ? pictureUrl : undefined,\n    metadata: userMeta,\n    rawGoTrueData: { ...userData },\n  }\n}\n\n/**\n * Converts server-side JWT claims into User\n */\nconst claimsToUser = (claims: IdentityUser): User => {\n  const appMeta = claims.app_metadata ?? {}\n  const userMeta = claims.user_metadata ?? {}\n  const name = userMeta.full_name || userMeta.name\n\n  return {\n    id: claims.sub ?? '',\n    email: claims.email,\n    provider: toAuthProvider(appMeta.provider),\n    name: typeof name === 'string' ? name : undefined,\n    metadata: userMeta,\n  }\n}\n\nlet hydrating = false\n\n/**\n * Creates a gotrue-js session from the nf_jwt cookie so that browser-side\n * operations (updateUser, logout, etc.) work after a server-side login.\n * Fire-and-forget: getUser() returns synchronously from the JWT while this\n * runs in the background.\n */\nconst backgroundHydrate = (accessToken: string): void => {\n  if (hydrating) return\n  hydrating = true\n\n  const refreshToken = getCookie(NF_REFRESH_COOKIE) ?? ''\n\n  const decoded = decodeJwtPayload(accessToken)\n  const expiresAt = decoded?.exp ?? Math.floor(Date.now() / 1000) + 3600\n  const expiresIn = Math.max(0, expiresAt - Math.floor(Date.now() / 1000))\n\n  // Defer to the next tick so the synchronous getUser() call completes first,\n  // and gotrue-js's internal currentUser isn't set until after the caller\n  // has received the JWT-decoded result.\n  setTimeout(() => {\n    try {\n      const client = getClient()\n      client\n        .createUser(\n          {\n            access_token: accessToken,\n            token_type: 'bearer',\n            expires_in: expiresIn,\n            expires_at: expiresAt,\n            refresh_token: refreshToken,\n          },\n          true,\n        )\n        .catch(() => {\n          // best-effort: if hydration fails, getUser() still works via cookie decode\n        })\n        .finally(() => {\n          hydrating = false\n        })\n    } catch {\n      hydrating = false\n    }\n  }, 0)\n}\n\n/** Decodes a JWT payload without verifying the signature. */\nexport const decodeJwtPayload = (token: string): IdentityUser | null => {\n  try {\n    const parts = token.split('.')\n    if (parts.length !== 3) return null\n    const payload = atob(parts[1].replace(/-/g, '+').replace(/_/g, '/'))\n    return JSON.parse(payload) as IdentityUser\n  } catch {\n    return null\n  }\n}\n\n/**\n * Returns the currently authenticated user, or `null` if not logged in.\n * Synchronous.\n *\n * In the browser, checks gotrue-js localStorage first. If no localStorage\n * session exists, falls back to decoding the `nf_jwt` cookie (set by\n * server-side login) and kicks off background hydration of the gotrue-js\n * session so that subsequent operations (updateUser, logout, etc.) work.\n *\n * On the server in a Next.js App Router context, calls `headers()` from\n * `next/headers` to opt the route into dynamic rendering. Without this,\n * Next.js may statically cache the page at build time.\n */\nexport const getUser = (): User | null => {\n  if (isBrowser()) {\n    const client = getGoTrueClient()\n    const currentUser = client?.currentUser() ?? null\n\n    if (currentUser) {\n      // If gotrue-js has a localStorage session but the nf_jwt cookie is gone,\n      // the server logged us out. Clear the stale localStorage session.\n      const jwt = getCookie(NF_JWT_COOKIE)\n      if (!jwt) {\n        try {\n          currentUser.clearSession()\n        } catch {\n          // best-effort cleanup\n        }\n        return null\n      }\n      return toUser(currentUser)\n    }\n\n    const jwt = getCookie(NF_JWT_COOKIE)\n    if (!jwt) return null\n\n    const claims = decodeJwtPayload(jwt)\n    if (!claims) return null\n\n    // Hydrate gotrue-js in the background so browser-side operations\n    // (updateUser, logout, etc.) work after a server-side login.\n    backgroundHydrate(jwt)\n\n    return claimsToUser(claims)\n  }\n\n  // Trigger Next.js dynamic rendering if in a Next.js RSC context\n  triggerNextjsDynamic()\n\n  // Primary path: identity context populated from the X-Nf-Identity-Info request header\n  const identityContext = globalThis.netlifyIdentityContext\n  if (identityContext?.user) {\n    return claimsToUser(identityContext.user)\n  }\n\n  // Fallback: read the nf_jwt cookie directly from the Netlify runtime.\n  const serverJwt = getServerCookie(NF_JWT_COOKIE)\n  if (serverJwt) {\n    const claims = decodeJwtPayload(serverJwt)\n    if (claims) return claimsToUser(claims)\n  }\n\n  return null\n}\n\n/**\n * Returns `true` if a user is currently authenticated.\n */\nexport const isAuthenticated = (): boolean => getUser() !== null\n","import type { AuthProvider, IdentityConfig, Settings } from './types.js'\nimport { getClient, getIdentityContext, IDENTITY_PATH, isBrowser } from './environment.js'\nimport { AuthError } from './errors.js'\n\n/**\n * Returns the identity configuration for the current environment.\n * Browser: always returns `{ url }` derived from `window.location.origin`.\n * Server: returns `{ url, token }` from the identity context, or `null` if unavailable.\n * Never throws.\n */\nexport const getIdentityConfig = (): IdentityConfig | null => {\n  if (isBrowser()) {\n    return { url: `${window.location.origin}${IDENTITY_PATH}` }\n  }\n\n  return getIdentityContext()\n}\n\n/**\n * Fetches your project's Identity settings (enabled providers, autoconfirm, signup disabled).\n *\n * @throws {MissingIdentityError} If Identity is not configured.\n * @throws {AuthError} If the endpoint is unreachable.\n */\nexport const getSettings = async (): Promise<Settings> => {\n  const client = getClient()\n\n  try {\n    const raw = await client.settings()\n    const external: Partial<Record<AuthProvider, boolean>> = raw.external ?? {}\n    return {\n      autoconfirm: raw.autoconfirm,\n      disableSignup: raw.disable_signup,\n      providers: {\n        google: external.google ?? false,\n        github: external.github ?? false,\n        gitlab: external.gitlab ?? false,\n        bitbucket: external.bitbucket ?? false,\n        facebook: external.facebook ?? false,\n        email: external.email ?? false,\n        saml: external.saml ?? false,\n      },\n    }\n  } catch (err) {\n    throw new AuthError(err instanceof Error ? err.message : 'Failed to fetch identity settings', 502, { cause: err })\n  }\n}\n","import { getGoTrueClient, isBrowser } from './environment.js'\nimport { toUser, type User } from './user.js'\n\n/**\n * Constants for the auth events emitted by the library.\n * Use these instead of string literals when comparing event types.\n *\n * @example\n * ```ts\n * onAuthChange((event, user) => {\n *   if (event === AUTH_EVENTS.LOGIN) console.log('Logged in:', user)\n *   if (event === AUTH_EVENTS.RECOVERY) redirect('/reset-password')\n * })\n * ```\n */\nexport const AUTH_EVENTS = {\n  LOGIN: 'login',\n  LOGOUT: 'logout',\n  TOKEN_REFRESH: 'token_refresh',\n  USER_UPDATED: 'user_updated',\n  RECOVERY: 'recovery',\n} as const\n\n/**\n * Union of all auth event names: `'login' | 'logout' | 'token_refresh' | 'user_updated' | 'recovery'`.\n * Passed as the first argument to {@link AuthCallback} subscribers.\n */\nexport type AuthEvent = (typeof AUTH_EVENTS)[keyof typeof AUTH_EVENTS]\n\n/**\n * Callback function signature for {@link onAuthChange} subscribers.\n * `user` is `null` on logout events.\n */\nexport type AuthCallback = (event: AuthEvent, user: User | null) => void\n\nconst GOTRUE_STORAGE_KEY = 'gotrue.user'\n\nconst listeners = new Set<AuthCallback>()\n\nexport const emitAuthEvent = (event: AuthEvent, user: User | null): void => {\n  for (const listener of listeners) {\n    try {\n      listener(event, user)\n    } catch {\n      // Prevent one subscriber from breaking others\n    }\n  }\n}\n\nlet storageListenerAttached = false\n\nconst attachStorageListener = (): void => {\n  if (storageListenerAttached || !isBrowser()) return\n  storageListenerAttached = true\n\n  window.addEventListener('storage', (event: StorageEvent) => {\n    if (event.key !== GOTRUE_STORAGE_KEY) return\n\n    if (event.newValue) {\n      const client = getGoTrueClient()\n      const currentUser = client?.currentUser()\n      emitAuthEvent(AUTH_EVENTS.LOGIN, currentUser ? toUser(currentUser) : null)\n    } else {\n      emitAuthEvent(AUTH_EVENTS.LOGOUT, null)\n    }\n  })\n}\n\n/**\n * Subscribes to auth state changes (login, logout, token refresh, user updates,\n * and recovery). Returns an unsubscribe function. No-op on the server.\n *\n * The `'recovery'` event fires when {@link handleAuthCallback} processes a\n * password recovery token. The user is logged in but has not yet set a new\n * password. Redirect them to a password reset form and call\n * `updateUser({ password })` to complete the flow.\n */\nexport const onAuthChange = (callback: AuthCallback): (() => void) => {\n  if (!isBrowser()) {\n    return () => {}\n  }\n\n  listeners.add(callback)\n  attachStorageListener()\n\n  return () => {\n    listeners.delete(callback)\n  }\n}\n","import type { UserData } from 'gotrue-js'\n\nimport type { NetlifyCookies, SignupData, TokenResponse, GoTrueErrorBody } from './types.js'\nimport { toUser, decodeJwtPayload } from './user.js'\n\nimport { getClient, getIdentityContext, isBrowser, IDENTITY_PATH } from './environment.js'\nimport {\n  getCookie,\n  setAuthCookies,\n  deleteAuthCookies,\n  setBrowserAuthCookies,\n  deleteBrowserAuthCookies,\n  NF_JWT_COOKIE,\n  NF_REFRESH_COOKIE,\n} from './cookies.js'\nimport { AuthError } from './errors.js'\nimport { AUTH_EVENTS, emitAuthEvent } from './events.js'\n\nconst getCookies = (): NetlifyCookies => {\n  const cookies = globalThis.Netlify?.context?.cookies\n  if (!cookies) {\n    throw new AuthError('Server-side auth requires Netlify Functions runtime')\n  }\n  return cookies\n}\n\nconst getServerIdentityUrl = (): string => {\n  const ctx = getIdentityContext()\n  if (!ctx?.url) {\n    throw new AuthError('Could not determine the Identity endpoint URL on the server')\n  }\n  return ctx.url\n}\n\n/** Persist the session to localStorage so it survives page reloads. */\nexport const persistSession = true\n\n/**\n * Logs in with email and password. Works in both browser and server contexts.\n *\n * On success, sets `nf_jwt` and `nf_refresh` cookies and returns the authenticated {@link User}.\n * In the browser, also emits a `'login'` event via {@link onAuthChange}.\n *\n * @throws {AuthError} On invalid credentials, network failure, or missing Netlify runtime.\n *\n * @remarks\n * In Next.js server actions, call `redirect()` **after** `login()` returns, not inside a\n * try/catch. Next.js implements `redirect()` by throwing a special error; wrapping it in\n * try/catch will swallow the redirect.\n *\n * @example\n * ```ts\n * // Next.js server action\n * const user = await login(email, password)\n * redirect('/dashboard') // after login, not inside try/catch\n * ```\n */\nexport const login = async (email: string, password: string): Promise<import('./user.js').User> => {\n  if (!isBrowser()) {\n    const identityUrl = getServerIdentityUrl()\n    const cookies = getCookies()\n\n    const body = new URLSearchParams({\n      grant_type: 'password',\n      username: email,\n      password,\n    })\n\n    let res: Response\n    try {\n      res = await fetch(`${identityUrl}/token`, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: body.toString(),\n      })\n    } catch (error) {\n      throw new AuthError((error as Error).message, undefined, { cause: error })\n    }\n\n    if (!res.ok) {\n      const errorBody = (await res.json().catch(() => ({}))) as GoTrueErrorBody\n      throw new AuthError(errorBody.msg || errorBody.error_description || `Login failed (${res.status})`, res.status)\n    }\n\n    const data = (await res.json()) as TokenResponse\n    const accessToken = data.access_token\n\n    let userRes: Response\n    try {\n      userRes = await fetch(`${identityUrl}/user`, {\n        headers: { Authorization: `Bearer ${accessToken}` },\n      })\n    } catch (error) {\n      throw new AuthError((error as Error).message, undefined, { cause: error })\n    }\n\n    if (!userRes.ok) {\n      const errorBody = (await userRes.json().catch(() => ({}))) as GoTrueErrorBody\n      throw new AuthError(errorBody.msg || `Failed to fetch user data (${userRes.status})`, userRes.status)\n    }\n\n    const userData = (await userRes.json()) as UserData\n    const user = toUser(userData)\n\n    setAuthCookies(cookies, accessToken, data.refresh_token)\n\n    return user\n  }\n\n  const client = getClient()\n\n  try {\n    const gotrueUser = await client.login(email, password, persistSession)\n    const jwt = await gotrueUser.jwt()\n    setBrowserAuthCookies(jwt)\n    const user = toUser(gotrueUser)\n    emitAuthEvent(AUTH_EVENTS.LOGIN, user)\n    return user\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Creates a new account. Works in both browser and server contexts.\n *\n * If autoconfirm is enabled in your Identity settings, the user is logged in immediately:\n * cookies are set and a `'login'` event is emitted. If autoconfirm is **disabled** (the default),\n * the user receives a confirmation email and must click the link before they can log in.\n * In that case, no cookies are set and no auth event is emitted.\n *\n * @throws {AuthError} On duplicate email, validation failure, network error, or missing Netlify runtime.\n */\nexport const signup = async (email: string, password: string, data?: SignupData): Promise<import('./user.js').User> => {\n  if (!isBrowser()) {\n    const identityUrl = getServerIdentityUrl()\n    const cookies = getCookies()\n\n    let res: Response\n    try {\n      res = await fetch(`${identityUrl}/signup`, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ email, password, data }),\n      })\n    } catch (error) {\n      throw new AuthError((error as Error).message, undefined, { cause: error })\n    }\n\n    if (!res.ok) {\n      const errorBody = (await res.json().catch(() => ({}))) as GoTrueErrorBody\n      throw new AuthError(errorBody.msg || `Signup failed (${res.status})`, res.status)\n    }\n\n    const responseData = (await res.json()) as UserData & Partial<TokenResponse>\n    const user = toUser(responseData)\n\n    if (responseData.confirmed_at) {\n      const accessToken = responseData.access_token\n      if (accessToken) {\n        setAuthCookies(cookies, accessToken, responseData.refresh_token)\n      }\n    }\n\n    return user\n  }\n\n  const client = getClient()\n\n  try {\n    const response = await client.signup(email, password, data)\n    const user = toUser(response as UserData)\n    if (response.confirmed_at) {\n      const jwt = await (response as { jwt?: () => Promise<string> }).jwt?.()\n      if (jwt) {\n        setBrowserAuthCookies(jwt)\n      }\n      emitAuthEvent(AUTH_EVENTS.LOGIN, user)\n    }\n    return user\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Logs out the current user and clears the session. Works in both browser and server contexts.\n *\n * Always deletes `nf_jwt` and `nf_refresh` cookies, even if the server-side token\n * invalidation request fails. In the browser, emits a `'logout'` event via {@link onAuthChange}.\n *\n * @throws {AuthError} On missing Netlify runtime (server) or logout failure (browser).\n */\nexport const logout = async (): Promise<void> => {\n  if (!isBrowser()) {\n    const identityUrl = getServerIdentityUrl()\n    const cookies = getCookies()\n\n    const jwt = cookies.get(NF_JWT_COOKIE)\n    if (jwt) {\n      try {\n        await fetch(`${identityUrl}/logout`, {\n          method: 'POST',\n          headers: { Authorization: `Bearer ${jwt}` },\n        })\n      } catch {\n        // Best-effort: token invalidation may fail, but we always clear cookies below\n      }\n    }\n\n    deleteAuthCookies(cookies)\n    return\n  }\n\n  const client = getClient()\n\n  try {\n    const currentUser = client.currentUser()\n    if (currentUser) {\n      await currentUser.logout()\n    }\n    deleteBrowserAuthCookies()\n    emitAuthEvent(AUTH_EVENTS.LOGOUT, null)\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Initiates an OAuth login by redirecting to the given provider (e.g., `'google'`, `'github'`).\n * The page navigates away; this function never returns normally. Browser only.\n *\n * After the provider redirects back, call {@link handleAuthCallback} on page load\n * to complete the login and obtain the {@link User}.\n *\n * @throws {AuthError} If called on the server.\n */\nexport const oauthLogin = (provider: string): never => {\n  if (!isBrowser()) {\n    throw new AuthError('oauthLogin() is only available in the browser')\n  }\n  const client = getClient()\n\n  window.location.href = client.loginExternalUrl(provider)\n  throw new AuthError('Redirecting to OAuth provider')\n}\n\n/**\n * Result returned by {@link handleAuthCallback} after processing a URL hash.\n *\n * - `'oauth'`: OAuth provider redirect completed. `user` is the authenticated user.\n * - `'confirmation'`: Email confirmed via token. `user` is the confirmed user.\n * - `'recovery'`: Password recovery token redeemed. `user` is logged in but must set a new password.\n * - `'invite'`: Invite token found. `user` is `null`; `token` contains the invite token for {@link acceptInvite}.\n * - `'email_change'`: Email change verified. `user` reflects the updated email.\n *\n * @example\n * ```ts\n * const result = await handleAuthCallback()\n * if (result?.type === 'recovery') {\n *   redirect('/reset-password')\n * } else if (result?.type === 'invite') {\n *   redirect(`/join?token=${result.token}`)\n * }\n * ```\n */\nexport interface CallbackResult {\n  /** The type of auth callback that was processed. */\n  type: 'oauth' | 'confirmation' | 'recovery' | 'invite' | 'email_change'\n  /** The authenticated user, or `null` for invite callbacks. */\n  user: import('./user.js').User | null\n  /** The invite token, only present when `type` is `'invite'`. */\n  token?: string\n}\n\n/**\n * Processes the URL hash after an OAuth redirect, email confirmation, password\n * recovery, invite acceptance, or email change. Call on page load. Browser only.\n * Returns `null` if the hash contains no auth parameters.\n *\n * Call this early in your app's initialization (e.g., in a layout component or\n * root loader), **not** inside a route that requires authentication, because\n * the callback URL must match the page where this function runs.\n *\n * For recovery callbacks (`result.type === 'recovery'`), the user is logged in\n * but has **not** set a new password yet. Your app must check the result type\n * and redirect to a password form that calls `updateUser({ password })`.\n * A `'recovery'` event (not `'login'`) is emitted via {@link onAuthChange}.\n *\n * @throws {AuthError} If the callback token is invalid or the verification request fails.\n */\nexport const handleAuthCallback = async (): Promise<CallbackResult | null> => {\n  if (!isBrowser()) return null\n\n  const hash = window.location.hash.substring(1)\n  if (!hash) return null\n\n  const client = getClient()\n  const params = new URLSearchParams(hash)\n\n  try {\n    const accessToken = params.get('access_token')\n    if (accessToken) return await handleOAuthCallback(client, params, accessToken)\n\n    const confirmationToken = params.get('confirmation_token')\n    if (confirmationToken) return await handleConfirmationCallback(client, confirmationToken)\n\n    const recoveryToken = params.get('recovery_token')\n    if (recoveryToken) return await handleRecoveryCallback(client, recoveryToken)\n\n    const inviteToken = params.get('invite_token')\n    if (inviteToken) return handleInviteCallback(inviteToken)\n\n    const emailChangeToken = params.get('email_change_token')\n    if (emailChangeToken) return await handleEmailChangeCallback(client, emailChangeToken)\n\n    return null\n  } catch (error) {\n    if (error instanceof AuthError) throw error\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\nimport type GoTrue from 'gotrue-js'\n\nconst handleOAuthCallback = async (\n  client: GoTrue,\n  params: URLSearchParams,\n  accessToken: string,\n): Promise<CallbackResult> => {\n  const refreshToken = params.get('refresh_token') ?? ''\n  const gotrueUser = await client.createUser(\n    {\n      access_token: accessToken,\n      token_type: (params.get('token_type') as 'bearer') ?? 'bearer',\n      expires_in: Number(params.get('expires_in')),\n      expires_at: Number(params.get('expires_at')),\n      refresh_token: refreshToken,\n    },\n    persistSession,\n  )\n  setBrowserAuthCookies(accessToken, refreshToken || undefined)\n  const user = toUser(gotrueUser)\n  clearHash()\n  emitAuthEvent(AUTH_EVENTS.LOGIN, user)\n  return { type: 'oauth', user }\n}\n\nconst handleConfirmationCallback = async (client: GoTrue, token: string): Promise<CallbackResult> => {\n  const gotrueUser = await client.confirm(token, persistSession)\n  const jwt = await gotrueUser.jwt()\n  setBrowserAuthCookies(jwt)\n  const user = toUser(gotrueUser)\n  clearHash()\n  emitAuthEvent(AUTH_EVENTS.LOGIN, user)\n  return { type: 'confirmation', user }\n}\n\nconst handleRecoveryCallback = async (client: GoTrue, token: string): Promise<CallbackResult> => {\n  const gotrueUser = await client.recover(token, persistSession)\n  const jwt = await gotrueUser.jwt()\n  setBrowserAuthCookies(jwt)\n  const user = toUser(gotrueUser)\n  clearHash()\n  emitAuthEvent(AUTH_EVENTS.RECOVERY, user)\n  return { type: 'recovery', user }\n}\n\nconst handleInviteCallback = (token: string): CallbackResult => {\n  clearHash()\n  return { type: 'invite', user: null, token }\n}\n\nconst handleEmailChangeCallback = async (client: GoTrue, emailChangeToken: string): Promise<CallbackResult> => {\n  const currentUser = client.currentUser()\n  if (!currentUser) {\n    throw new AuthError('Email change verification requires an active browser session')\n  }\n\n  const jwt = await currentUser.jwt()\n  const identityUrl = `${window.location.origin}${IDENTITY_PATH}`\n\n  const emailChangeRes = await fetch(`${identityUrl}/user`, {\n    method: 'PUT',\n    headers: {\n      'Content-Type': 'application/json',\n      Authorization: `Bearer ${jwt}`,\n    },\n    body: JSON.stringify({ email_change_token: emailChangeToken }),\n  })\n\n  if (!emailChangeRes.ok) {\n    const errorBody = (await emailChangeRes.json().catch(() => ({}))) as GoTrueErrorBody\n    throw new AuthError(\n      errorBody.msg || `Email change verification failed (${emailChangeRes.status})`,\n      emailChangeRes.status,\n    )\n  }\n\n  const emailChangeData = (await emailChangeRes.json()) as UserData\n  const user = toUser(emailChangeData)\n  clearHash()\n  emitAuthEvent(AUTH_EVENTS.USER_UPDATED, user)\n  return { type: 'email_change', user }\n}\n\nconst clearHash = (): void => {\n  history.replaceState(null, '', window.location.pathname + window.location.search)\n}\n\n/**\n * Hydrates the browser-side gotrue-js session from server-set auth cookies.\n * Call this on page load when using server-side login to enable browser\n * account operations (updateUser, verifyEmailChange, etc.).\n *\n * No-op if a browser session already exists or no auth cookies are present.\n * No-op on the server.\n */\nexport const hydrateSession = async (): Promise<import('./user.js').User | null> => {\n  if (!isBrowser()) return null\n\n  const client = getClient()\n  const currentUser = client.currentUser()\n  if (currentUser) return toUser(currentUser)\n\n  const accessToken = getCookie(NF_JWT_COOKIE)\n  if (!accessToken) return null\n\n  const refreshToken = getCookie(NF_REFRESH_COOKIE) ?? ''\n\n  const decoded = decodeJwtPayload(accessToken)\n  const expiresAt = decoded?.exp ?? Math.floor(Date.now() / 1000) + 3600\n  const expiresIn = Math.max(0, expiresAt - Math.floor(Date.now() / 1000))\n\n  const gotrueUser = await client.createUser(\n    {\n      access_token: accessToken,\n      token_type: 'bearer',\n      expires_in: expiresIn,\n      expires_at: expiresAt,\n      refresh_token: refreshToken,\n    },\n    persistSession,\n  )\n\n  const user = toUser(gotrueUser)\n  emitAuthEvent(AUTH_EVENTS.LOGIN, user)\n  return user\n}\n","import type { UserData, User as GoTrueUser } from 'gotrue-js'\n\nimport type { UserUpdates, GoTrueErrorBody } from './types.js'\nimport type { User } from './user.js'\nimport { toUser } from './user.js'\nimport { getClient, isBrowser, IDENTITY_PATH } from './environment.js'\nimport { persistSession, hydrateSession } from './auth.js'\nimport { AUTH_EVENTS, emitAuthEvent } from './events.js'\nimport { AuthError } from './errors.js'\n\n/**\n * Returns the current gotrue-js user, attempting hydration from cookies if\n * no in-memory session exists. Throws if no user can be resolved.\n */\nconst resolveCurrentUser = async (): Promise<GoTrueUser> => {\n  const client = getClient()\n\n  let currentUser = client.currentUser()\n  if (!currentUser && isBrowser()) {\n    try {\n      await hydrateSession()\n    } catch {\n      // hydration failed (e.g. expired cookie, network error) — fall through\n    }\n    currentUser = client.currentUser()\n  }\n  if (!currentUser) throw new AuthError('No user is currently logged in')\n\n  return currentUser\n}\n\n/**\n * Sends a password recovery email to the given address.\n *\n * @throws {AuthError} On network failure or if the request is rejected.\n */\nexport const requestPasswordRecovery = async (email: string): Promise<void> => {\n  const client = getClient()\n\n  try {\n    await client.requestPasswordRecovery(email)\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Redeems a recovery token and sets a new password. Logs the user in on success.\n *\n * @throws {AuthError} If the token is invalid, expired, or the update fails.\n */\nexport const recoverPassword = async (token: string, newPassword: string): Promise<User> => {\n  const client = getClient()\n\n  try {\n    const gotrueUser = await client.recover(token, persistSession)\n    const updatedUser = await gotrueUser.update({ password: newPassword })\n    const user = toUser(updatedUser)\n    emitAuthEvent(AUTH_EVENTS.LOGIN, user)\n    return user\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Confirms an email address using the token from a confirmation email. Logs the user in on success.\n *\n * @throws {AuthError} If the token is invalid or expired.\n */\nexport const confirmEmail = async (token: string): Promise<User> => {\n  const client = getClient()\n\n  try {\n    const gotrueUser = await client.confirm(token, persistSession)\n    const user = toUser(gotrueUser)\n    emitAuthEvent(AUTH_EVENTS.LOGIN, user)\n    return user\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Accepts an invite token and sets a password for the new account. Logs the user in on success.\n *\n * @throws {AuthError} If the token is invalid or expired.\n */\nexport const acceptInvite = async (token: string, password: string): Promise<User> => {\n  const client = getClient()\n\n  try {\n    const gotrueUser = await client.acceptInvite(token, password, persistSession)\n    const user = toUser(gotrueUser)\n    emitAuthEvent(AUTH_EVENTS.LOGIN, user)\n    return user\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Verifies an email change using the token from a verification email.\n * Auto-hydrates from auth cookies if no browser session exists. Browser only.\n *\n * @throws {AuthError} If called on the server, no user is logged in, or the token is invalid.\n */\nexport const verifyEmailChange = async (token: string): Promise<User> => {\n  if (!isBrowser()) throw new AuthError('verifyEmailChange() is only available in the browser')\n\n  const currentUser = await resolveCurrentUser()\n\n  const jwt = await currentUser.jwt()\n  const identityUrl = `${window.location.origin}${IDENTITY_PATH}`\n\n  try {\n    const res = await fetch(`${identityUrl}/user`, {\n      method: 'PUT',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${jwt}`,\n      },\n      body: JSON.stringify({ email_change_token: token }),\n    })\n\n    if (!res.ok) {\n      const errorBody = (await res.json().catch(() => ({}))) as GoTrueErrorBody\n      throw new AuthError(errorBody.msg || `Email change verification failed (${res.status})`, res.status)\n    }\n\n    const userData = (await res.json()) as UserData\n    const user = toUser(userData)\n    emitAuthEvent(AUTH_EVENTS.USER_UPDATED, user)\n    return user\n  } catch (error) {\n    if (error instanceof AuthError) throw error\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Updates the current user's email, password, or user metadata.\n * Auto-hydrates from auth cookies if no browser session exists.\n *\n * @param updates - Fields to update. Pass `email` or `password` to change credentials,\n *   or `data` to update user metadata (e.g., `{ data: { full_name: 'New Name' } }`).\n * @throws {AuthError} If no user is logged in or the update fails.\n */\nexport const updateUser = async (updates: UserUpdates): Promise<User> => {\n  const currentUser = await resolveCurrentUser()\n\n  try {\n    const updatedUser = await currentUser.update(updates)\n    const user = toUser(updatedUser)\n    emitAuthEvent(AUTH_EVENTS.USER_UPDATED, user)\n    return user\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n","import type { UserData } from 'gotrue-js'\n\nimport { isBrowser, getClient, getIdentityContext } from './environment.js'\nimport { AuthError } from './errors.js'\nimport type { AdminUserUpdates, CreateUserParams, GoTrueErrorBody, ListUsersOptions } from './types.js'\nimport { toUser, type User } from './user.js'\n\n/**\n * Returns the operator token and Identity URL for server-side admin requests.\n * @throws {AuthError} If the Identity endpoint URL or operator token is unavailable.\n */\nconst getAdminAuth = (): { url: string; token: string } => {\n  const ctx = getIdentityContext()\n  if (!ctx?.url) {\n    throw new AuthError('Could not determine the Identity endpoint URL on the server')\n  }\n  if (!ctx.token) {\n    throw new AuthError('Admin operations require an operator token (only available in Netlify Functions)')\n  }\n  return { url: ctx.url, token: ctx.token }\n}\n\n/**\n * Makes an authenticated admin request to GoTrue on the server.\n * @throws {AuthError} If the request fails or GoTrue returns a non-OK status.\n */\nconst adminFetch = async (path: string, options: RequestInit = {}): Promise<Response> => {\n  const { url, token } = getAdminAuth()\n  let res: Response\n  try {\n    res = await fetch(`${url}${path}`, {\n      ...options,\n      headers: {\n        ...options.headers,\n        Authorization: `Bearer ${token}`,\n        'Content-Type': 'application/json',\n      },\n    })\n  } catch (error) {\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n  if (!res.ok) {\n    const errorBody = await res.json().catch(() => ({}))\n    throw new AuthError((errorBody as GoTrueErrorBody).msg || `Admin request failed (${res.status})`, res.status)\n  }\n  return res\n}\n\n/** Returns the current user (browser only), throwing if not logged in. */\nconst getAdminUser = () => {\n  const client = getClient()\n  const user = client.currentUser()\n  if (!user) {\n    throw new AuthError('Admin operations require a logged-in user with admin role')\n  }\n  return user\n}\n\n/**\n * Lists all users. Works in both server and browser contexts.\n *\n * **Server:** calls GoTrue `GET /admin/users` with the operator token. Pagination\n * options (`page`, `perPage`) are forwarded as query parameters.\n *\n * **Browser:** calls gotrue-js `user.admin.listUsers()`. The logged-in user must\n * have an admin role. Pagination options are ignored (gotrue-js does not support them).\n *\n * @throws {AuthError} If the operator token is missing (server) or no admin user is logged in (browser).\n */\nconst listUsers = async (options?: ListUsersOptions): Promise<User[]> => {\n  if (!isBrowser()) {\n    const params = new URLSearchParams()\n    if (options?.page != null) params.set('page', String(options.page))\n    if (options?.perPage != null) params.set('per_page', String(options.perPage))\n    const query = params.toString()\n    const path = `/admin/users${query ? `?${query}` : ''}`\n\n    const res = await adminFetch(path)\n    const body = (await res.json()) as { users: UserData[] }\n    return body.users.map(toUser)\n  }\n\n  try {\n    const user = getAdminUser()\n    const users = await user.admin.listUsers('')\n    return (users as UserData[]).map(toUser)\n  } catch (error) {\n    if (error instanceof AuthError) throw error\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Gets a single user by ID. Works in both server and browser contexts.\n *\n * **Server:** calls GoTrue `GET /admin/users/:id` with the operator token.\n *\n * **Browser:** calls gotrue-js `user.admin.getUser()`. The logged-in user must\n * have an admin role.\n *\n * @throws {AuthError} If the user is not found, the operator token is missing (server),\n *   or no admin user is logged in (browser).\n */\nconst getUser = async (userId: string): Promise<User> => {\n  if (!isBrowser()) {\n    const res = await adminFetch(`/admin/users/${userId}`)\n    const userData = (await res.json()) as UserData\n    return toUser(userData)\n  }\n\n  try {\n    const user = getAdminUser()\n    const userData = await user.admin.getUser({ id: userId } as UserData)\n    return toUser(userData)\n  } catch (error) {\n    if (error instanceof AuthError) throw error\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Creates a new user. The user is auto-confirmed (no confirmation email is sent).\n * Works in both server and browser contexts.\n *\n * The optional `data` fields are spread as **top-level attributes** in the GoTrue\n * request body (not nested under `user_metadata`). Use this to set `app_metadata`,\n * `user_metadata`, `role`, or any other GoTrue user field at creation time.\n *\n * **Server:** calls GoTrue `POST /admin/users` with the operator token.\n *\n * **Browser:** calls gotrue-js `user.admin.createUser()`. The logged-in user must\n * have an admin role.\n *\n * @throws {AuthError} If the email already exists, the operator token is missing (server),\n *   or no admin user is logged in (browser).\n */\nconst createUser = async (params: CreateUserParams): Promise<User> => {\n  if (!isBrowser()) {\n    const res = await adminFetch('/admin/users', {\n      method: 'POST',\n      body: JSON.stringify({\n        email: params.email,\n        password: params.password,\n        ...params.data,\n        confirm: true,\n      }),\n    })\n    const userData = (await res.json()) as UserData\n    return toUser(userData)\n  }\n\n  try {\n    const user = getAdminUser()\n    const userData = await user.admin.createUser(params.email, params.password, {\n      ...params.data,\n      confirm: true,\n    })\n    return toUser(userData)\n  } catch (error) {\n    if (error instanceof AuthError) throw error\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Updates an existing user by ID. Works in both server and browser contexts.\n *\n * **Server:** calls GoTrue `PUT /admin/users/:id` with the operator token.\n *\n * **Browser:** calls gotrue-js `user.admin.updateUser()`. The logged-in user must\n * have an admin role.\n *\n * @throws {AuthError} If the user is not found, the update fails, the operator token\n *   is missing (server), or no admin user is logged in (browser).\n */\nconst updateUser = async (userId: string, attributes: AdminUserUpdates): Promise<User> => {\n  if (!isBrowser()) {\n    const res = await adminFetch(`/admin/users/${userId}`, {\n      method: 'PUT',\n      body: JSON.stringify(attributes),\n    })\n    const userData = (await res.json()) as UserData\n    return toUser(userData)\n  }\n\n  try {\n    const user = getAdminUser()\n    const userData = await user.admin.updateUser({ id: userId } as UserData, attributes)\n    return toUser(userData)\n  } catch (error) {\n    if (error instanceof AuthError) throw error\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * Deletes a user by ID. Works in both server and browser contexts.\n *\n * **Server:** calls GoTrue `DELETE /admin/users/:id` with the operator token.\n *\n * **Browser:** calls gotrue-js `user.admin.deleteUser()`. The logged-in user must\n * have an admin role.\n *\n * @throws {AuthError} If the user is not found, the deletion fails, the operator token\n *   is missing (server), or no admin user is logged in (browser).\n */\nconst deleteUser = async (userId: string): Promise<void> => {\n  if (!isBrowser()) {\n    await adminFetch(`/admin/users/${userId}`, { method: 'DELETE' })\n    return\n  }\n\n  try {\n    const user = getAdminUser()\n    await user.admin.deleteUser({ id: userId } as UserData)\n  } catch (error) {\n    if (error instanceof AuthError) throw error\n    throw new AuthError((error as Error).message, undefined, { cause: error })\n  }\n}\n\n/**\n * The admin namespace for privileged user management operations.\n * All methods work in both server and browser contexts.\n *\n * **Server:** uses the operator token (automatically available in Netlify Functions).\n * **Browser:** requires a logged-in user with an admin role.\n */\nexport interface Admin {\n  /**\n   * Lists all users. Works in both server and browser contexts.\n   *\n   * **Server:** calls GoTrue `GET /admin/users` with the operator token. Pagination\n   * options (`page`, `perPage`) are forwarded as query parameters.\n   *\n   * **Browser:** calls gotrue-js `user.admin.listUsers()`. The logged-in user must\n   * have an admin role. Pagination options are ignored (gotrue-js does not support them).\n   *\n   * @throws {AuthError} If the operator token is missing (server) or no admin user is logged in (browser).\n   */\n  listUsers: (options?: ListUsersOptions) => Promise<User[]>\n\n  /**\n   * Gets a single user by ID. Works in both server and browser contexts.\n   *\n   * **Server:** calls GoTrue `GET /admin/users/:id` with the operator token.\n   *\n   * **Browser:** calls gotrue-js `user.admin.getUser()`. The logged-in user must\n   * have an admin role.\n   *\n   * @throws {AuthError} If the user is not found, the operator token is missing (server),\n   *   or no admin user is logged in (browser).\n   */\n  getUser: (userId: string) => Promise<User>\n\n  /**\n   * Creates a new user. The user is auto-confirmed (no confirmation email is sent).\n   * Works in both server and browser contexts.\n   *\n   * The optional `data` fields are spread as **top-level attributes** in the GoTrue\n   * request body (not nested under `user_metadata`). Use this to set `app_metadata`,\n   * `user_metadata`, `role`, or any other GoTrue user field at creation time.\n   *\n   * **Server:** calls GoTrue `POST /admin/users` with the operator token.\n   *\n   * **Browser:** calls gotrue-js `user.admin.createUser()`. The logged-in user must\n   * have an admin role.\n   *\n   * @throws {AuthError} If the email already exists, the operator token is missing (server),\n   *   or no admin user is logged in (browser).\n   */\n  createUser: (params: CreateUserParams) => Promise<User>\n\n  /**\n   * Updates an existing user by ID. Works in both server and browser contexts.\n   *\n   * **Server:** calls GoTrue `PUT /admin/users/:id` with the operator token.\n   *\n   * **Browser:** calls gotrue-js `user.admin.updateUser()`. The logged-in user must\n   * have an admin role.\n   *\n   * @throws {AuthError} If the user is not found, the update fails, the operator token\n   *   is missing (server), or no admin user is logged in (browser).\n   */\n  updateUser: (userId: string, attributes: AdminUserUpdates) => Promise<User>\n\n  /**\n   * Deletes a user by ID. Works in both server and browser contexts.\n   *\n   * **Server:** calls GoTrue `DELETE /admin/users/:id` with the operator token.\n   *\n   * **Browser:** calls gotrue-js `user.admin.deleteUser()`. The logged-in user must\n   * have an admin role.\n   *\n   * @throws {AuthError} If the user is not found, the deletion fails, the operator token\n   *   is missing (server), or no admin user is logged in (browser).\n   */\n  deleteUser: (userId: string) => Promise<void>\n}\n\nexport const admin: Admin = { listUsers, getUser, createUser, updateUser, deleteUser }\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACCO,IAAM,iBAAiB,CAAC,UAAU,UAAU,UAAU,aAAa,YAAY,QAAQ,OAAO;;;ACDrG,uBAAmB;;;ACmBZ,IAAM,YAAN,cAAwB,MAAM;AAAA,EAMnC,YAAY,SAAiB,QAAiB,SAA+B;AAC3E,UAAM,OAAO;AANf,SAAS,OAAO;AAOd,SAAK,SAAS;AACd,QAAI,WAAW,WAAW,SAAS;AACjC,WAAK,QAAQ,QAAQ;AAAA,IACvB;AAAA,EACF;AACF;AASO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAG9C,YAAY,UAAU,sCAAsC;AAC1D,UAAM,OAAO;AAHf,SAAS,OAAO;AAAA,EAIhB;AACF;;;AD1CO,IAAM,gBAAgB;AAE7B,IAAI,eAA8B;AAClC,IAAI;AACJ,IAAI,mBAAmB;AAEhB,IAAM,YAAY,MAAe,OAAO,WAAW,eAAe,OAAO,OAAO,aAAa;AAQpG,IAAM,iBAAiB,MAAqB;AAC1C,MAAI,iBAAiB,OAAW,QAAO;AAEvC,MAAI,UAAU,GAAG;AACf,mBAAe,GAAG,OAAO,SAAS,MAAM,GAAG,aAAa;AAAA,EAC1D,OAAO;AACL,UAAM,kBAAkB,mBAAmB;AAC3C,QAAI,iBAAiB,KAAK;AACxB,qBAAe,gBAAgB;AAAA,IACjC,WAAW,WAAW,SAAS,SAAS,KAAK;AAC3C,qBAAe,IAAI,IAAI,eAAe,WAAW,QAAQ,QAAQ,GAAG,EAAE;AAAA,IACxE,WAAW,QAAQ,IAAI,KAAK;AAC1B,qBAAe,IAAI,IAAI,eAAe,QAAQ,IAAI,GAAG,EAAE;AAAA,IACzD;AAAA,EACF;AAEA,SAAO,gBAAgB;AACzB;AAMO,IAAM,kBAAkB,MAAqB;AAClD,MAAI,aAAc,QAAO;AAEzB,QAAM,SAAS,eAAe;AAC9B,MAAI,CAAC,QAAQ;AACX,QAAI,CAAC,kBAAkB;AACrB,cAAQ;AAAA,QACN;AAAA,MAEF;AACA,yBAAmB;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,IAAI,iBAAAA,QAAO,EAAE,QAAQ,QAAQ,WAAW,MAAM,CAAC;AAC9D,SAAO;AACT;AAKO,IAAM,YAAY,MAAc;AACrC,QAAM,SAAS,gBAAgB;AAC/B,MAAI,CAAC,OAAQ,OAAM,IAAI,qBAAqB;AAC5C,SAAO;AACT;AAMO,IAAM,qBAAqB,MAA6B;AAC7D,QAAM,kBAAkB,WAAW;AACnC,MAAI,iBAAiB,KAAK;AACxB,WAAO;AAAA,MACL,KAAK,gBAAgB;AAAA,MACrB,OAAO,gBAAgB;AAAA,IACzB;AAAA,EACF;AAEA,MAAI,WAAW,SAAS,SAAS,KAAK;AACpC,WAAO,EAAE,KAAK,IAAI,IAAI,eAAe,WAAW,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAAA,EAC5E;AAGA,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,SAAS;AACX,WAAO,EAAE,KAAK,IAAI,IAAI,eAAe,OAAO,EAAE,KAAK;AAAA,EACrD;AAEA,SAAO;AACT;;;AE5FO,IAAM,gBAAgB;AACtB,IAAM,oBAAoB;AAG1B,IAAM,YAAY,CAAC,SAAgC;AACxD,QAAM,QAAQ,SAAS,OAAO,MAAM,IAAI,OAAO,WAAW,KAAK,QAAQ,uBAAuB,MAAM,CAAC,UAAU,CAAC;AAChH,SAAO,QAAQ,mBAAmB,MAAM,CAAC,CAAC,IAAI;AAChD;AAGO,IAAM,iBAAiB,CAAC,SAAyB,aAAqB,iBAAgC;AAC3G,UAAQ,IAAI;AAAA,IACV,MAAM;AAAA,IACN,OAAO;AAAA,IACP,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,UAAU;AAAA,EACZ,CAAC;AAED,MAAI,cAAc;AAGhB,YAAQ,IAAI;AAAA,MACV,MAAM;AAAA,MACN,OAAO;AAAA,MACP,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACF;AAGO,IAAM,oBAAoB,CAAC,YAAkC;AAClE,UAAQ,OAAO,aAAa;AAC5B,UAAQ,OAAO,iBAAiB;AAClC;AAGO,IAAM,wBAAwB,CAAC,aAAqB,iBAAgC;AACzF,WAAS,SAAS,GAAG,aAAa,IAAI,mBAAmB,WAAW,CAAC;AACrE,MAAI,cAAc;AAChB,aAAS,SAAS,GAAG,iBAAiB,IAAI,mBAAmB,YAAY,CAAC;AAAA,EAC5E;AACF;AAGO,IAAM,2BAA2B,MAAY;AAClD,WAAS,SAAS,GAAG,aAAa;AAClC,WAAS,SAAS,GAAG,iBAAiB;AACxC;AAGO,IAAM,kBAAkB,CAAC,SAAgC;AAC9D,QAAM,UAAU,WAAW,SAAS,SAAS;AAC7C,MAAI,CAAC,WAAW,OAAO,QAAQ,QAAQ,WAAY,QAAO;AAC1D,SAAO,QAAQ,IAAI,IAAI,KAAK;AAC9B;;;ACjDA,IAAI;AACG,IAAM,uBAAuB,MAAY;AAC9C,MAAI,kBAAkB,KAAM;AAE5B,MAAI,kBAAkB,QAAW;AAC/B,QAAI;AACF,UAAI,OAAO,YAAY,aAAa;AAClC,wBAAgB;AAChB;AAAA,MACF;AACA,YAAM,MAAM,QAAQ,cAAc;AAClC,sBAAgB,IAAI;AAAA,IACtB,QAAQ;AACN,sBAAgB;AAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,KAAK;AACX,MAAI,CAAC,GAAI;AAET,MAAI;AACF,OAAG;AAAA,EACL,SAAS,GAAY;AAInB,QAAI,aAAa,UAAU,YAAY,KAAK,wBAAwB,KAAK,EAAE,OAAO,IAAI;AACpF,YAAM;AAAA,IACR;AAAA,EACF;AACF;;;AC3BA,IAAM,iBAAiB,CAAC,UACtB,OAAO,UAAU,YAAa,eAAqC,SAAS,KAAK,IAC5E,QACD;AAsCC,IAAM,SAAS,CAAC,aAA6B;AAClD,QAAM,WAAW,SAAS,iBAAiB,CAAC;AAC5C,QAAM,UAAU,SAAS,gBAAgB,CAAC;AAC1C,QAAM,OAAO,SAAS,aAAa,SAAS;AAC5C,QAAM,aAAa,SAAS;AAE5B,SAAO;AAAA,IACL,IAAI,SAAS;AAAA,IACb,OAAO,SAAS;AAAA,IAChB,eAAe,CAAC,CAAC,SAAS;AAAA,IAC1B,WAAW,SAAS;AAAA,IACpB,WAAW,SAAS;AAAA,IACpB,UAAU,eAAe,QAAQ,QAAQ;AAAA,IACzC,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,IACxC,YAAY,OAAO,eAAe,WAAW,aAAa;AAAA,IAC1D,UAAU;AAAA,IACV,eAAe,EAAE,GAAG,SAAS;AAAA,EAC/B;AACF;AAKA,IAAM,eAAe,CAAC,WAA+B;AACnD,QAAM,UAAU,OAAO,gBAAgB,CAAC;AACxC,QAAM,WAAW,OAAO,iBAAiB,CAAC;AAC1C,QAAM,OAAO,SAAS,aAAa,SAAS;AAE5C,SAAO;AAAA,IACL,IAAI,OAAO,OAAO;AAAA,IAClB,OAAO,OAAO;AAAA,IACd,UAAU,eAAe,QAAQ,QAAQ;AAAA,IACzC,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,IACxC,UAAU;AAAA,EACZ;AACF;AAEA,IAAI,YAAY;AAQhB,IAAM,oBAAoB,CAAC,gBAA8B;AACvD,MAAI,UAAW;AACf,cAAY;AAEZ,QAAM,eAAe,UAAU,iBAAiB,KAAK;AAErD,QAAM,UAAU,iBAAiB,WAAW;AAC5C,QAAM,YAAY,SAAS,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAClE,QAAM,YAAY,KAAK,IAAI,GAAG,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,CAAC;AAKvE,aAAW,MAAM;AACf,QAAI;AACF,YAAM,SAAS,UAAU;AACzB,aACG;AAAA,QACC;AAAA,UACE,cAAc;AAAA,UACd,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ,eAAe;AAAA,QACjB;AAAA,QACA;AAAA,MACF,EACC,MAAM,MAAM;AAAA,MAEb,CAAC,EACA,QAAQ,MAAM;AACb,oBAAY;AAAA,MACd,CAAC;AAAA,IACL,QAAQ;AACN,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC;AACN;AAGO,IAAM,mBAAmB,CAAC,UAAuC;AACtE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK,MAAM,CAAC,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,CAAC;AACnE,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAeO,IAAM,UAAU,MAAmB;AACxC,MAAI,UAAU,GAAG;AACf,UAAM,SAAS,gBAAgB;AAC/B,UAAM,cAAc,QAAQ,YAAY,KAAK;AAE7C,QAAI,aAAa;AAGf,YAAMC,OAAM,UAAU,aAAa;AACnC,UAAI,CAACA,MAAK;AACR,YAAI;AACF,sBAAY,aAAa;AAAA,QAC3B,QAAQ;AAAA,QAER;AACA,eAAO;AAAA,MACT;AACA,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,UAAM,MAAM,UAAU,aAAa;AACnC,QAAI,CAAC,IAAK,QAAO;AAEjB,UAAM,SAAS,iBAAiB,GAAG;AACnC,QAAI,CAAC,OAAQ,QAAO;AAIpB,sBAAkB,GAAG;AAErB,WAAO,aAAa,MAAM;AAAA,EAC5B;AAGA,uBAAqB;AAGrB,QAAM,kBAAkB,WAAW;AACnC,MAAI,iBAAiB,MAAM;AACzB,WAAO,aAAa,gBAAgB,IAAI;AAAA,EAC1C;AAGA,QAAM,YAAY,gBAAgB,aAAa;AAC/C,MAAI,WAAW;AACb,UAAM,SAAS,iBAAiB,SAAS;AACzC,QAAI,OAAQ,QAAO,aAAa,MAAM;AAAA,EACxC;AAEA,SAAO;AACT;AAKO,IAAM,kBAAkB,MAAe,QAAQ,MAAM;;;ACnNrD,IAAM,oBAAoB,MAA6B;AAC5D,MAAI,UAAU,GAAG;AACf,WAAO,EAAE,KAAK,GAAG,OAAO,SAAS,MAAM,GAAG,aAAa,GAAG;AAAA,EAC5D;AAEA,SAAO,mBAAmB;AAC5B;AAQO,IAAM,cAAc,YAA+B;AACxD,QAAM,SAAS,UAAU;AAEzB,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,SAAS;AAClC,UAAM,WAAmD,IAAI,YAAY,CAAC;AAC1E,WAAO;AAAA,MACL,aAAa,IAAI;AAAA,MACjB,eAAe,IAAI;AAAA,MACnB,WAAW;AAAA,QACT,QAAQ,SAAS,UAAU;AAAA,QAC3B,QAAQ,SAAS,UAAU;AAAA,QAC3B,QAAQ,SAAS,UAAU;AAAA,QAC3B,WAAW,SAAS,aAAa;AAAA,QACjC,UAAU,SAAS,YAAY;AAAA,QAC/B,OAAO,SAAS,SAAS;AAAA,QACzB,MAAM,SAAS,QAAQ;AAAA,MACzB;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI,UAAU,eAAe,QAAQ,IAAI,UAAU,qCAAqC,KAAK,EAAE,OAAO,IAAI,CAAC;AAAA,EACnH;AACF;;;AC/BO,IAAM,cAAc;AAAA,EACzB,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,eAAe;AAAA,EACf,cAAc;AAAA,EACd,UAAU;AACZ;AAcA,IAAM,qBAAqB;AAE3B,IAAM,YAAY,oBAAI,IAAkB;AAEjC,IAAM,gBAAgB,CAAC,OAAkB,SAA4B;AAC1E,aAAW,YAAY,WAAW;AAChC,QAAI;AACF,eAAS,OAAO,IAAI;AAAA,IACtB,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAEA,IAAI,0BAA0B;AAE9B,IAAM,wBAAwB,MAAY;AACxC,MAAI,2BAA2B,CAAC,UAAU,EAAG;AAC7C,4BAA0B;AAE1B,SAAO,iBAAiB,WAAW,CAAC,UAAwB;AAC1D,QAAI,MAAM,QAAQ,mBAAoB;AAEtC,QAAI,MAAM,UAAU;AAClB,YAAM,SAAS,gBAAgB;AAC/B,YAAM,cAAc,QAAQ,YAAY;AACxC,oBAAc,YAAY,OAAO,cAAc,OAAO,WAAW,IAAI,IAAI;AAAA,IAC3E,OAAO;AACL,oBAAc,YAAY,QAAQ,IAAI;AAAA,IACxC;AAAA,EACF,CAAC;AACH;AAWO,IAAM,eAAe,CAAC,aAAyC;AACpE,MAAI,CAAC,UAAU,GAAG;AAChB,WAAO,MAAM;AAAA,IAAC;AAAA,EAChB;AAEA,YAAU,IAAI,QAAQ;AACtB,wBAAsB;AAEtB,SAAO,MAAM;AACX,cAAU,OAAO,QAAQ;AAAA,EAC3B;AACF;;;ACtEA,IAAM,aAAa,MAAsB;AACvC,QAAM,UAAU,WAAW,SAAS,SAAS;AAC7C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,UAAU,qDAAqD;AAAA,EAC3E;AACA,SAAO;AACT;AAEA,IAAM,uBAAuB,MAAc;AACzC,QAAM,MAAM,mBAAmB;AAC/B,MAAI,CAAC,KAAK,KAAK;AACb,UAAM,IAAI,UAAU,6DAA6D;AAAA,EACnF;AACA,SAAO,IAAI;AACb;AAGO,IAAM,iBAAiB;AAsBvB,IAAM,QAAQ,OAAO,OAAe,aAAwD;AACjG,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,cAAc,qBAAqB;AACzC,UAAM,UAAU,WAAW;AAE3B,UAAM,OAAO,IAAI,gBAAgB;AAAA,MAC/B,YAAY;AAAA,MACZ,UAAU;AAAA,MACV;AAAA,IACF,CAAC;AAED,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,GAAG,WAAW,UAAU;AAAA,QACxC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,KAAK,SAAS;AAAA,MACtB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,IAC3E;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,YAAa,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,UAAU,UAAU,OAAO,UAAU,qBAAqB,iBAAiB,IAAI,MAAM,KAAK,IAAI,MAAM;AAAA,IAChH;AAEA,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,UAAM,cAAc,KAAK;AAEzB,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,MAAM,GAAG,WAAW,SAAS;AAAA,QAC3C,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,MACpD,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,IAC3E;AAEA,QAAI,CAAC,QAAQ,IAAI;AACf,YAAM,YAAa,MAAM,QAAQ,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACxD,YAAM,IAAI,UAAU,UAAU,OAAO,8BAA8B,QAAQ,MAAM,KAAK,QAAQ,MAAM;AAAA,IACtG;AAEA,UAAM,WAAY,MAAM,QAAQ,KAAK;AACrC,UAAM,OAAO,OAAO,QAAQ;AAE5B,mBAAe,SAAS,aAAa,KAAK,aAAa;AAEvD,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,UAAU;AAEzB,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,MAAM,OAAO,UAAU,cAAc;AACrE,UAAM,MAAM,MAAM,WAAW,IAAI;AACjC,0BAAsB,GAAG;AACzB,UAAM,OAAO,OAAO,UAAU;AAC9B,kBAAc,YAAY,OAAO,IAAI;AACrC,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAYO,IAAM,SAAS,OAAO,OAAe,UAAkB,SAAyD;AACrH,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,cAAc,qBAAqB;AACzC,UAAM,UAAU,WAAW;AAE3B,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,GAAG,WAAW,WAAW;AAAA,QACzC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,UAAU,KAAK,CAAC;AAAA,MAChD,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,IAC3E;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,YAAa,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,UAAU,UAAU,OAAO,kBAAkB,IAAI,MAAM,KAAK,IAAI,MAAM;AAAA,IAClF;AAEA,UAAM,eAAgB,MAAM,IAAI,KAAK;AACrC,UAAM,OAAO,OAAO,YAAY;AAEhC,QAAI,aAAa,cAAc;AAC7B,YAAM,cAAc,aAAa;AACjC,UAAI,aAAa;AACf,uBAAe,SAAS,aAAa,aAAa,aAAa;AAAA,MACjE;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,UAAU;AAEzB,MAAI;AACF,UAAM,WAAW,MAAM,OAAO,OAAO,OAAO,UAAU,IAAI;AAC1D,UAAM,OAAO,OAAO,QAAoB;AACxC,QAAI,SAAS,cAAc;AACzB,YAAM,MAAM,MAAO,SAA6C,MAAM;AACtE,UAAI,KAAK;AACP,8BAAsB,GAAG;AAAA,MAC3B;AACA,oBAAc,YAAY,OAAO,IAAI;AAAA,IACvC;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAUO,IAAM,SAAS,YAA2B;AAC/C,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,cAAc,qBAAqB;AACzC,UAAM,UAAU,WAAW;AAE3B,UAAM,MAAM,QAAQ,IAAI,aAAa;AACrC,QAAI,KAAK;AACP,UAAI;AACF,cAAM,MAAM,GAAG,WAAW,WAAW;AAAA,UACnC,QAAQ;AAAA,UACR,SAAS,EAAE,eAAe,UAAU,GAAG,GAAG;AAAA,QAC5C,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,sBAAkB,OAAO;AACzB;AAAA,EACF;AAEA,QAAM,SAAS,UAAU;AAEzB,MAAI;AACF,UAAM,cAAc,OAAO,YAAY;AACvC,QAAI,aAAa;AACf,YAAM,YAAY,OAAO;AAAA,IAC3B;AACA,6BAAyB;AACzB,kBAAc,YAAY,QAAQ,IAAI;AAAA,EACxC,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAWO,IAAM,aAAa,CAAC,aAA4B;AACrD,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,IAAI,UAAU,+CAA+C;AAAA,EACrE;AACA,QAAM,SAAS,UAAU;AAEzB,SAAO,SAAS,OAAO,OAAO,iBAAiB,QAAQ;AACvD,QAAM,IAAI,UAAU,+BAA+B;AACrD;AA8CO,IAAM,qBAAqB,YAA4C;AAC5E,MAAI,CAAC,UAAU,EAAG,QAAO;AAEzB,QAAM,OAAO,OAAO,SAAS,KAAK,UAAU,CAAC;AAC7C,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,SAAS,UAAU;AACzB,QAAM,SAAS,IAAI,gBAAgB,IAAI;AAEvC,MAAI;AACF,UAAM,cAAc,OAAO,IAAI,cAAc;AAC7C,QAAI,YAAa,QAAO,MAAM,oBAAoB,QAAQ,QAAQ,WAAW;AAE7E,UAAM,oBAAoB,OAAO,IAAI,oBAAoB;AACzD,QAAI,kBAAmB,QAAO,MAAM,2BAA2B,QAAQ,iBAAiB;AAExF,UAAM,gBAAgB,OAAO,IAAI,gBAAgB;AACjD,QAAI,cAAe,QAAO,MAAM,uBAAuB,QAAQ,aAAa;AAE5E,UAAM,cAAc,OAAO,IAAI,cAAc;AAC7C,QAAI,YAAa,QAAO,qBAAqB,WAAW;AAExD,UAAM,mBAAmB,OAAO,IAAI,oBAAoB;AACxD,QAAI,iBAAkB,QAAO,MAAM,0BAA0B,QAAQ,gBAAgB;AAErF,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,UAAW,OAAM;AACtC,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAIA,IAAM,sBAAsB,OAC1B,QACA,QACA,gBAC4B;AAC5B,QAAM,eAAe,OAAO,IAAI,eAAe,KAAK;AACpD,QAAM,aAAa,MAAM,OAAO;AAAA,IAC9B;AAAA,MACE,cAAc;AAAA,MACd,YAAa,OAAO,IAAI,YAAY,KAAkB;AAAA,MACtD,YAAY,OAAO,OAAO,IAAI,YAAY,CAAC;AAAA,MAC3C,YAAY,OAAO,OAAO,IAAI,YAAY,CAAC;AAAA,MAC3C,eAAe;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACA,wBAAsB,aAAa,gBAAgB,MAAS;AAC5D,QAAM,OAAO,OAAO,UAAU;AAC9B,YAAU;AACV,gBAAc,YAAY,OAAO,IAAI;AACrC,SAAO,EAAE,MAAM,SAAS,KAAK;AAC/B;AAEA,IAAM,6BAA6B,OAAO,QAAgB,UAA2C;AACnG,QAAM,aAAa,MAAM,OAAO,QAAQ,OAAO,cAAc;AAC7D,QAAM,MAAM,MAAM,WAAW,IAAI;AACjC,wBAAsB,GAAG;AACzB,QAAM,OAAO,OAAO,UAAU;AAC9B,YAAU;AACV,gBAAc,YAAY,OAAO,IAAI;AACrC,SAAO,EAAE,MAAM,gBAAgB,KAAK;AACtC;AAEA,IAAM,yBAAyB,OAAO,QAAgB,UAA2C;AAC/F,QAAM,aAAa,MAAM,OAAO,QAAQ,OAAO,cAAc;AAC7D,QAAM,MAAM,MAAM,WAAW,IAAI;AACjC,wBAAsB,GAAG;AACzB,QAAM,OAAO,OAAO,UAAU;AAC9B,YAAU;AACV,gBAAc,YAAY,UAAU,IAAI;AACxC,SAAO,EAAE,MAAM,YAAY,KAAK;AAClC;AAEA,IAAM,uBAAuB,CAAC,UAAkC;AAC9D,YAAU;AACV,SAAO,EAAE,MAAM,UAAU,MAAM,MAAM,MAAM;AAC7C;AAEA,IAAM,4BAA4B,OAAO,QAAgB,qBAAsD;AAC7G,QAAM,cAAc,OAAO,YAAY;AACvC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,UAAU,8DAA8D;AAAA,EACpF;AAEA,QAAM,MAAM,MAAM,YAAY,IAAI;AAClC,QAAM,cAAc,GAAG,OAAO,SAAS,MAAM,GAAG,aAAa;AAE7D,QAAM,iBAAiB,MAAM,MAAM,GAAG,WAAW,SAAS;AAAA,IACxD,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,eAAe,UAAU,GAAG;AAAA,IAC9B;AAAA,IACA,MAAM,KAAK,UAAU,EAAE,oBAAoB,iBAAiB,CAAC;AAAA,EAC/D,CAAC;AAED,MAAI,CAAC,eAAe,IAAI;AACtB,UAAM,YAAa,MAAM,eAAe,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/D,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,qCAAqC,eAAe,MAAM;AAAA,MAC3E,eAAe;AAAA,IACjB;AAAA,EACF;AAEA,QAAM,kBAAmB,MAAM,eAAe,KAAK;AACnD,QAAM,OAAO,OAAO,eAAe;AACnC,YAAU;AACV,gBAAc,YAAY,cAAc,IAAI;AAC5C,SAAO,EAAE,MAAM,gBAAgB,KAAK;AACtC;AAEA,IAAM,YAAY,MAAY;AAC5B,UAAQ,aAAa,MAAM,IAAI,OAAO,SAAS,WAAW,OAAO,SAAS,MAAM;AAClF;AAUO,IAAM,iBAAiB,YAAsD;AAClF,MAAI,CAAC,UAAU,EAAG,QAAO;AAEzB,QAAM,SAAS,UAAU;AACzB,QAAM,cAAc,OAAO,YAAY;AACvC,MAAI,YAAa,QAAO,OAAO,WAAW;AAE1C,QAAM,cAAc,UAAU,aAAa;AAC3C,MAAI,CAAC,YAAa,QAAO;AAEzB,QAAM,eAAe,UAAU,iBAAiB,KAAK;AAErD,QAAM,UAAU,iBAAiB,WAAW;AAC5C,QAAM,YAAY,SAAS,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAClE,QAAM,YAAY,KAAK,IAAI,GAAG,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,CAAC;AAEvE,QAAM,aAAa,MAAM,OAAO;AAAA,IAC9B;AAAA,MACE,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,eAAe;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AAEA,QAAM,OAAO,OAAO,UAAU;AAC9B,gBAAc,YAAY,OAAO,IAAI;AACrC,SAAO;AACT;;;AClbA,IAAM,qBAAqB,YAAiC;AAC1D,QAAM,SAAS,UAAU;AAEzB,MAAI,cAAc,OAAO,YAAY;AACrC,MAAI,CAAC,eAAe,UAAU,GAAG;AAC/B,QAAI;AACF,YAAM,eAAe;AAAA,IACvB,QAAQ;AAAA,IAER;AACA,kBAAc,OAAO,YAAY;AAAA,EACnC;AACA,MAAI,CAAC,YAAa,OAAM,IAAI,UAAU,gCAAgC;AAEtE,SAAO;AACT;AAOO,IAAM,0BAA0B,OAAO,UAAiC;AAC7E,QAAM,SAAS,UAAU;AAEzB,MAAI;AACF,UAAM,OAAO,wBAAwB,KAAK;AAAA,EAC5C,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAOO,IAAM,kBAAkB,OAAO,OAAe,gBAAuC;AAC1F,QAAM,SAAS,UAAU;AAEzB,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,QAAQ,OAAO,cAAc;AAC7D,UAAM,cAAc,MAAM,WAAW,OAAO,EAAE,UAAU,YAAY,CAAC;AACrE,UAAM,OAAO,OAAO,WAAW;AAC/B,kBAAc,YAAY,OAAO,IAAI;AACrC,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAOO,IAAM,eAAe,OAAO,UAAiC;AAClE,QAAM,SAAS,UAAU;AAEzB,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,QAAQ,OAAO,cAAc;AAC7D,UAAM,OAAO,OAAO,UAAU;AAC9B,kBAAc,YAAY,OAAO,IAAI;AACrC,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAOO,IAAM,eAAe,OAAO,OAAe,aAAoC;AACpF,QAAM,SAAS,UAAU;AAEzB,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,aAAa,OAAO,UAAU,cAAc;AAC5E,UAAM,OAAO,OAAO,UAAU;AAC9B,kBAAc,YAAY,OAAO,IAAI;AACrC,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAQO,IAAM,oBAAoB,OAAO,UAAiC;AACvE,MAAI,CAAC,UAAU,EAAG,OAAM,IAAI,UAAU,sDAAsD;AAE5F,QAAM,cAAc,MAAM,mBAAmB;AAE7C,QAAM,MAAM,MAAM,YAAY,IAAI;AAClC,QAAM,cAAc,GAAG,OAAO,SAAS,MAAM,GAAG,aAAa;AAE7D,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,WAAW,SAAS;AAAA,MAC7C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,UAAU,GAAG;AAAA,MAC9B;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,oBAAoB,MAAM,CAAC;AAAA,IACpD,CAAC;AAED,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,YAAa,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,UAAU,UAAU,OAAO,qCAAqC,IAAI,MAAM,KAAK,IAAI,MAAM;AAAA,IACrG;AAEA,UAAM,WAAY,MAAM,IAAI,KAAK;AACjC,UAAM,OAAO,OAAO,QAAQ;AAC5B,kBAAc,YAAY,cAAc,IAAI;AAC5C,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,UAAW,OAAM;AACtC,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAUO,IAAM,aAAa,OAAO,YAAwC;AACvE,QAAM,cAAc,MAAM,mBAAmB;AAE7C,MAAI;AACF,UAAM,cAAc,MAAM,YAAY,OAAO,OAAO;AACpD,UAAM,OAAO,OAAO,WAAW;AAC/B,kBAAc,YAAY,cAAc,IAAI;AAC5C,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;;;ACpJA,IAAM,eAAe,MAAsC;AACzD,QAAM,MAAM,mBAAmB;AAC/B,MAAI,CAAC,KAAK,KAAK;AACb,UAAM,IAAI,UAAU,6DAA6D;AAAA,EACnF;AACA,MAAI,CAAC,IAAI,OAAO;AACd,UAAM,IAAI,UAAU,kFAAkF;AAAA,EACxG;AACA,SAAO,EAAE,KAAK,IAAI,KAAK,OAAO,IAAI,MAAM;AAC1C;AAMA,IAAM,aAAa,OAAO,MAAc,UAAuB,CAAC,MAAyB;AACvF,QAAM,EAAE,KAAK,MAAM,IAAI,aAAa;AACpC,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI;AAAA,MACjC,GAAG;AAAA,MACH,SAAS;AAAA,QACP,GAAG,QAAQ;AAAA,QACX,eAAe,UAAU,KAAK;AAAA,QAC9B,gBAAgB;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,YAAY,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACnD,UAAM,IAAI,UAAW,UAA8B,OAAO,yBAAyB,IAAI,MAAM,KAAK,IAAI,MAAM;AAAA,EAC9G;AACA,SAAO;AACT;AAGA,IAAM,eAAe,MAAM;AACzB,QAAM,SAAS,UAAU;AACzB,QAAM,OAAO,OAAO,YAAY;AAChC,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,UAAU,2DAA2D;AAAA,EACjF;AACA,SAAO;AACT;AAaA,IAAM,YAAY,OAAO,YAAgD;AACvE,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,SAAS,IAAI,gBAAgB;AACnC,QAAI,SAAS,QAAQ,KAAM,QAAO,IAAI,QAAQ,OAAO,QAAQ,IAAI,CAAC;AAClE,QAAI,SAAS,WAAW,KAAM,QAAO,IAAI,YAAY,OAAO,QAAQ,OAAO,CAAC;AAC5E,UAAM,QAAQ,OAAO,SAAS;AAC9B,UAAM,OAAO,eAAe,QAAQ,IAAI,KAAK,KAAK,EAAE;AAEpD,UAAM,MAAM,MAAM,WAAW,IAAI;AACjC,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,WAAO,KAAK,MAAM,IAAI,MAAM;AAAA,EAC9B;AAEA,MAAI;AACF,UAAM,OAAO,aAAa;AAC1B,UAAM,QAAQ,MAAM,KAAK,MAAM,UAAU,EAAE;AAC3C,WAAQ,MAAqB,IAAI,MAAM;AAAA,EACzC,SAAS,OAAO;AACd,QAAI,iBAAiB,UAAW,OAAM;AACtC,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAaA,IAAMC,WAAU,OAAO,WAAkC;AACvD,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,MAAM,MAAM,WAAW,gBAAgB,MAAM,EAAE;AACrD,UAAM,WAAY,MAAM,IAAI,KAAK;AACjC,WAAO,OAAO,QAAQ;AAAA,EACxB;AAEA,MAAI;AACF,UAAM,OAAO,aAAa;AAC1B,UAAM,WAAW,MAAM,KAAK,MAAM,QAAQ,EAAE,IAAI,OAAO,CAAa;AACpE,WAAO,OAAO,QAAQ;AAAA,EACxB,SAAS,OAAO;AACd,QAAI,iBAAiB,UAAW,OAAM;AACtC,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAkBA,IAAM,aAAa,OAAO,WAA4C;AACpE,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,MAAM,MAAM,WAAW,gBAAgB;AAAA,MAC3C,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,OAAO;AAAA,QACd,UAAU,OAAO;AAAA,QACjB,GAAG,OAAO;AAAA,QACV,SAAS;AAAA,MACX,CAAC;AAAA,IACH,CAAC;AACD,UAAM,WAAY,MAAM,IAAI,KAAK;AACjC,WAAO,OAAO,QAAQ;AAAA,EACxB;AAEA,MAAI;AACF,UAAM,OAAO,aAAa;AAC1B,UAAM,WAAW,MAAM,KAAK,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU;AAAA,MAC1E,GAAG,OAAO;AAAA,MACV,SAAS;AAAA,IACX,CAAC;AACD,WAAO,OAAO,QAAQ;AAAA,EACxB,SAAS,OAAO;AACd,QAAI,iBAAiB,UAAW,OAAM;AACtC,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAaA,IAAMC,cAAa,OAAO,QAAgB,eAAgD;AACxF,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,MAAM,MAAM,WAAW,gBAAgB,MAAM,IAAI;AAAA,MACrD,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU,UAAU;AAAA,IACjC,CAAC;AACD,UAAM,WAAY,MAAM,IAAI,KAAK;AACjC,WAAO,OAAO,QAAQ;AAAA,EACxB;AAEA,MAAI;AACF,UAAM,OAAO,aAAa;AAC1B,UAAM,WAAW,MAAM,KAAK,MAAM,WAAW,EAAE,IAAI,OAAO,GAAe,UAAU;AACnF,WAAO,OAAO,QAAQ;AAAA,EACxB,SAAS,OAAO;AACd,QAAI,iBAAiB,UAAW,OAAM;AACtC,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAaA,IAAM,aAAa,OAAO,WAAkC;AAC1D,MAAI,CAAC,UAAU,GAAG;AAChB,UAAM,WAAW,gBAAgB,MAAM,IAAI,EAAE,QAAQ,SAAS,CAAC;AAC/D;AAAA,EACF;AAEA,MAAI;AACF,UAAM,OAAO,aAAa;AAC1B,UAAM,KAAK,MAAM,WAAW,EAAE,IAAI,OAAO,CAAa;AAAA,EACxD,SAAS,OAAO;AACd,QAAI,iBAAiB,UAAW,OAAM;AACtC,UAAM,IAAI,UAAW,MAAgB,SAAS,QAAW,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3E;AACF;AAiFO,IAAM,QAAe,EAAE,WAAW,SAAAD,UAAS,YAAY,YAAAC,aAAY,WAAW;","names":["GoTrue","jwt","getUser","updateUser"]}