@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/server/ssr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssr.js","names":["host","error","tokens"],"sources":["../../src/server/ssr.ts"],"sourcesContent":["import { ConvexHttpClient } from \"convex/browser\";\nimport { makeFunctionReference } from \"convex/server\";\nimport { ConvexError } from \"convex/values\";\nimport { parse, serialize } from \"cookie\";\nimport { jwtDecode } from \"jwt-decode\";\n\nimport type {\n  SignInAction,\n  SignInActionResult,\n  SignOutAction,\n} from \"./runtime\";\nimport { Fx } from \"@robelest/fx\";\nimport { isLocalHost } from \"./utils\";\n\nconst signInActionRef: SignInAction = makeFunctionReference(\"auth:signIn\");\nconst signOutActionRef: SignOutAction = makeFunctionReference(\"auth:signOut\");\n\n/** Cookie lifetime configuration for auth tokens. */\nexport type AuthCookieConfig = {\n  /** Maximum age in seconds, or `null` for session cookies. */\n  maxAge: number | null;\n};\n\n/** Raw cookie values extracted from a request. */\nexport type AuthCookies = {\n  /** The JWT access token, or `null` when absent. */\n  token: string | null;\n  /** The refresh token, or `null` when absent. */\n  refreshToken: string | null;\n  /** The OAuth PKCE verifier, or `null` when absent. */\n  verifier: string | null;\n};\n\n/** A structured cookie ready to be set via any framework's cookie API. */\nexport type AuthCookie = {\n  name: string;\n  value: string;\n  options: {\n    path: string;\n    httpOnly: boolean;\n    secure: boolean;\n    sameSite: \"lax\" | \"strict\" | \"none\";\n    maxAge?: number;\n    expires?: Date;\n  };\n};\n\n/**\n * Options for the SSR auth helper returned by {@link server}.\n */\nexport type ServerOptions = {\n  /** Convex deployment API URL (e.g. `https://your-app.convex.cloud`). */\n  url: string;\n  /**\n   * Accepted JWT issuers for `refresh()` and `verify()`.\n   *\n   * By default, this is derived from `url`. If `url` ends with\n   * `.convex.cloud`, the matching `.convex.site` issuer is also accepted.\n   */\n  acceptedIssuers?: string[];\n  /**\n   * Path the client POSTs auth actions to. Defaults to `\"/api/auth\"`.\n   * Must match the `proxyPath` option on the client.\n   *\n   * @defaultValue \"/api/auth\"\n   */\n  apiRoute?: string;\n  /** Cookie `maxAge` in seconds, or `null` for session cookies. */\n  cookieMaxAge?: number | null;\n  /** Enable verbose debug logging for token refresh and cookie operations. */\n  verbose?: boolean;\n  /**\n   * Optional namespace for auth cookie names.\n   *\n   * Use this to isolate auth cookies between multiple local apps on the same host.\n   * If omitted, a deterministic deployment-scoped namespace is derived from `url`.\n   */\n  cookieNamespace?: string;\n  /**\n   * Control whether `refresh()` handles OAuth `?code=` query parameters.\n   *\n   * - `true` (default): always exchange the code on GET requests with `text/html` accept.\n   * - `false`: never exchange — useful when only the client handles codes.\n   * - A function: called with the `Request` for per-request decisions.\n   *\n   * @defaultValue true\n   */\n  shouldHandleCode?:\n    | ((request: Request) => boolean | Promise<boolean>)\n    | boolean;\n};\n\n/**\n * Result returned from `server().refresh()`.\n *\n * Covers both normal SSR refreshes and OAuth code-exchange redirects.\n */\nexport type RefreshResult =\n  | {\n      /** Code exchange occurred — return the pre-built redirect `Response`. */\n      redirect: true;\n      /** 302 redirect with Set-Cookie headers already serialized. */\n      response: Response;\n    }\n  | {\n      /** No redirect — apply cookies and read the token. */\n      redirect: false;\n      /** Structured cookies to set on the response. */\n      cookies: AuthCookie[];\n      /** JWT for SSR hydration, or `null` if not authenticated. */\n      token: string | null;\n    };\n\nconst TOKEN_COOKIE_BASE_NAME = \"__convexAuthJWT\";\nconst REFRESH_COOKIE_BASE_NAME = \"__convexAuthRefreshToken\";\nconst VERIFIER_COOKIE_BASE_NAME = \"__convexAuthOAuthVerifier\";\nconst DERIVED_COOKIE_NAMESPACE_FALLBACK = \"convexauth\";\n\n/**\n * Derive the cookie names used for auth tokens.\n *\n * On localhost the names are unprefixed; on production hosts they\n * use the `__Host-` prefix for tighter security.\n *\n * @param host - The `Host` header value. Omit to use unprefixed names.\n * @param cookieNamespace - Optional namespace suffix for cookie isolation.\n * @returns An object with `token`, `refreshToken`, and `verifier` cookie names.\n */\nexport function authCookieNames(\n  host?: string,\n  cookieNamespace?: string | null,\n) {\n  const prefix = isLocalHost(host) ? \"\" : \"__Host-\";\n  const namespace = normalizeCookieNamespace(cookieNamespace);\n  const suffix = namespace === null ? \"\" : `_${namespace}`;\n  return {\n    token: `${prefix}${TOKEN_COOKIE_BASE_NAME}${suffix}`,\n    refreshToken: `${prefix}${REFRESH_COOKIE_BASE_NAME}${suffix}`,\n    verifier: `${prefix}${VERIFIER_COOKIE_BASE_NAME}${suffix}`,\n  };\n}\n\n/**\n * Parse auth cookie values from a raw `Cookie` header string.\n *\n * @param cookieHeader - The raw `Cookie` header, or `null`/`undefined`.\n * @param host - The `Host` header, used to determine cookie name prefixes.\n * @param cookieNamespace - Optional namespace suffix for cookie isolation.\n * @returns Parsed {@link AuthCookies} with `token`, `refreshToken`, and `verifier`.\n */\nexport function parseAuthCookies(\n  cookieHeader: string | null | undefined,\n  host?: string,\n  cookieNamespace?: string | null,\n): AuthCookies {\n  const names = authCookieNames(host, cookieNamespace);\n  const parsed = parse(cookieHeader ?? \"\");\n  return {\n    token: parsed[names.token] ?? null,\n    refreshToken: parsed[names.refreshToken] ?? null,\n    verifier: parsed[names.verifier] ?? null,\n  };\n}\n\n/**\n * Serialize auth cookies into `Set-Cookie` header strings.\n *\n * Nulled-out values produce deletion cookies (maxAge 0, expired date).\n *\n * @param cookies - The auth cookie values to serialize.\n * @param host - The `Host` header, used for cookie name prefixes and `Secure` flag.\n * @param config - Cookie lifetime config. Defaults to session cookies.\n * @param cookieNamespace - Optional namespace suffix for cookie isolation.\n * @returns An array of three `Set-Cookie` header strings.\n */\nexport function serializeAuthCookies(\n  cookies: AuthCookies,\n  host?: string,\n  config: AuthCookieConfig = { maxAge: null },\n  cookieNamespace?: string | null,\n) {\n  const names = authCookieNames(host, cookieNamespace);\n  const secure = !isLocalHost(host);\n  const base = {\n    path: \"/\",\n    httpOnly: true,\n    sameSite: \"lax\" as const,\n    secure,\n  };\n  const maxAge = config.maxAge ?? undefined;\n  const serialized = [\n    serialize(names.token, cookies.token ?? \"\", {\n      ...base,\n      maxAge: cookies.token === null ? 0 : maxAge,\n      expires: cookies.token === null ? new Date(0) : undefined,\n    }),\n    serialize(names.refreshToken, cookies.refreshToken ?? \"\", {\n      ...base,\n      maxAge: cookies.refreshToken === null ? 0 : maxAge,\n      expires: cookies.refreshToken === null ? new Date(0) : undefined,\n    }),\n    serialize(names.verifier, cookies.verifier ?? \"\", {\n      ...base,\n      maxAge: cookies.verifier === null ? 0 : maxAge,\n      expires: cookies.verifier === null ? new Date(0) : undefined,\n    }),\n  ];\n  return serialized;\n}\n\n/**\n * Build structured cookie objects for any SSR framework.\n *\n * Use with SvelteKit's `event.cookies.set()`, TanStack Start's `setCookie()`,\n * Next.js's `cookies().set()`, or any other framework cookie API.\n *\n * @param cookies - The auth cookie values to convert.\n * @param host - The `Host` header, used for cookie name prefixes and `Secure`.\n * @param config - Cookie lifetime config. Defaults to session cookies.\n * @param cookieNamespace - Optional namespace suffix for cookie isolation.\n * @returns Structured cookie descriptors ready for framework cookie APIs.\n */\nexport function structuredAuthCookies(\n  cookies: AuthCookies,\n  host?: string,\n  config: AuthCookieConfig = { maxAge: null },\n  cookieNamespace?: string | null,\n): AuthCookie[] {\n  const names = authCookieNames(host, cookieNamespace);\n  const secure = !isLocalHost(host);\n  const base = {\n    path: \"/\" as const,\n    httpOnly: true as const,\n    secure,\n    sameSite: \"lax\" as const,\n  };\n  const maxAge = config.maxAge ?? undefined;\n  const structured: AuthCookie[] = [\n    {\n      name: names.token,\n      value: cookies.token ?? \"\",\n      options: {\n        ...base,\n        maxAge: cookies.token === null ? 0 : maxAge,\n        expires: cookies.token === null ? new Date(0) : undefined,\n      },\n    },\n    {\n      name: names.refreshToken,\n      value: cookies.refreshToken ?? \"\",\n      options: {\n        ...base,\n        maxAge: cookies.refreshToken === null ? 0 : maxAge,\n        expires: cookies.refreshToken === null ? new Date(0) : undefined,\n      },\n    },\n    {\n      name: names.verifier,\n      value: cookies.verifier ?? \"\",\n      options: {\n        ...base,\n        maxAge: cookies.verifier === null ? 0 : maxAge,\n        expires: cookies.verifier === null ? new Date(0) : undefined,\n      },\n    },\n  ];\n\n  return structured;\n}\n\n/**\n * Check whether a request pathname matches the auth proxy route.\n *\n * Handles trailing-slash ambiguity: both `/api/auth` and `/api/auth/`\n * match regardless of how `apiRoute` is configured.\n *\n * @param pathname - The request URL pathname.\n * @param apiRoute - The configured proxy route (e.g. `\"/api/auth\"`).\n * @returns `true` when the pathname matches the proxy route.\n *\n * @see {@link server}\n */\nexport function shouldProxyAuthAction(pathname: string, apiRoute: string) {\n  if (apiRoute.endsWith(\"/\")) {\n    return pathname === apiRoute || pathname === apiRoute.slice(0, -1);\n  }\n  return pathname === apiRoute || pathname === `${apiRoute}/`;\n}\n\nconst REQUIRED_TOKEN_LIFETIME_MS = 60_000;\nconst MINIMUM_REQUIRED_TOKEN_LIFETIME_MS = 10_000;\n\ntype DecodedToken = { exp?: number; iat?: number; iss?: string };\n\nfunction normalizeCookieNamespace(cookieNamespace?: string | null) {\n  if (cookieNamespace === undefined || cookieNamespace === null) {\n    return null;\n  }\n  const normalized = cookieNamespace\n    .trim()\n    .replace(/[^a-zA-Z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\")\n    .toLowerCase();\n  return normalized.length > 0 ? normalized : null;\n}\n\n/**\n * Safely check if a string is a valid URL without throwing.\n */\nfunction canParseUrl(value: string): boolean {\n  try {\n    new URL(value);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction serializeAuthCookie(cookie: AuthCookie): string {\n  const parts = [\n    `${cookie.name}=${cookie.value}`,\n    `Path=${cookie.options.path}`,\n  ];\n  if (cookie.options.httpOnly) parts.push(\"HttpOnly\");\n  if (cookie.options.secure) parts.push(\"Secure\");\n  if (cookie.options.sameSite)\n    parts.push(`SameSite=${cookie.options.sameSite}`);\n  if (cookie.options.maxAge !== undefined)\n    parts.push(`Max-Age=${cookie.options.maxAge}`);\n  if (cookie.options.expires)\n    parts.push(`Expires=${cookie.options.expires.toUTCString()}`);\n  return parts.join(\"; \");\n}\n\nfunction buildRedirectResponse(\n  location: string,\n  cookies: AuthCookie[],\n): Response {\n  const headers = new Headers({ Location: location });\n  for (const cookie of cookies) {\n    headers.append(\"Set-Cookie\", serializeAuthCookie(cookie));\n  }\n  return new Response(null, { status: 302, headers });\n}\n\nfunction deriveCookieNamespaceFromUrl(url: string) {\n  if (!canParseUrl(url)) return DERIVED_COOKIE_NAMESPACE_FALLBACK;\n  const parsed = new URL(url);\n  const raw = `${parsed.hostname}${parsed.pathname}`;\n  return normalizeCookieNamespace(raw) ?? DERIVED_COOKIE_NAMESPACE_FALLBACK;\n}\n\nfunction normalizeIssuer(value: string) {\n  if (!canParseUrl(value)) return value.replace(/\\/+$/, \"\");\n  const parsed = new URL(value);\n  const pathname =\n    parsed.pathname === \"/\" ? \"\" : parsed.pathname.replace(/\\/+$/, \"\");\n  return `${parsed.protocol}//${parsed.host}${pathname}`;\n}\n\nfunction convexSiteIssuerFromCloudUrl(value: string) {\n  if (!canParseUrl(value)) return null;\n  const parsed = new URL(value);\n  if (!parsed.hostname.endsWith(\".convex.cloud\")) {\n    return null;\n  }\n  parsed.hostname =\n    parsed.hostname.slice(0, -\".convex.cloud\".length) + \".convex.site\";\n  return normalizeIssuer(parsed.toString());\n}\n\nfunction defaultAcceptedIssuersForUrl(value: string) {\n  const issuers = [normalizeIssuer(value)];\n  const siteIssuer = convexSiteIssuerFromCloudUrl(value);\n  if (siteIssuer !== null) {\n    issuers.push(siteIssuer);\n  }\n  return issuers;\n}\n\n/**\n * Create an SSR auth helper for server-side frameworks.\n *\n * Handles cookie-based token management, OAuth code exchange,\n * and automatic JWT refresh on page loads. Works with any\n * framework that gives you a `Request` object — SvelteKit,\n * TanStack Start, Remix, Next.js, etc.\n *\n * @param options - SSR configuration (Convex API URL, issuer rules, proxy route, cookie lifetime).\n * @returns An object with `token`, `verify`, `proxy`, and `refresh` methods.\n *\n * @example SvelteKit hooks\n * ```ts\n * // src/hooks.server.ts\n * import { server } from '@robelest/convex-auth/server';\n *\n * const auth = server({ url: CONVEX_URL });\n *\n * export const handle = async ({ event, resolve }) => {\n *   const { cookies, token } = await auth.refresh(event.request);\n *   for (const c of cookies) event.cookies.set(c.name, c.value, c.options);\n *   event.locals.token = token;\n *   return resolve(event);\n * };\n * ```\n *\n * @example Generic proxy endpoint\n * ```ts\n * if (shouldProxyAuthAction(url.pathname, '/api/auth')) {\n *   return auth.proxy(request);\n * }\n * ```\n *\n * @param options - Server-side auth configuration including Convex URL,\n *   accepted issuers, proxy route, and cookie behavior.\n * @returns SSR helpers for reading tokens, refreshing cookies, and proxying\n *   auth actions through an httpOnly-cookie layer.\n *\n * @see {@link shouldProxyAuthAction}\n */\nexport function server(options: ServerOptions) {\n  const convexUrl = options.url;\n  const apiRoute = options.apiRoute ?? \"/api/auth\";\n  const cookieConfig = { maxAge: options.cookieMaxAge ?? null };\n  const verbose = options.verbose ?? false;\n  const cookieNamespace =\n    normalizeCookieNamespace(options.cookieNamespace) ??\n    deriveCookieNamespaceFromUrl(convexUrl);\n  const acceptedIssuers = new Set(\n    (options.acceptedIssuers ?? defaultAcceptedIssuersForUrl(convexUrl))\n      .map(normalizeIssuer)\n      .filter((issuer) => issuer.length > 0),\n  );\n\n  return {\n    /**\n     * Read the JWT from the request cookies without any validation.\n     *\n     * @param request - The incoming HTTP request.\n     * @returns The raw JWT string, or `null` when no token cookie exists.\n     */\n    token(request: Request): string | null {\n      return parseAuthCookies(\n        request.headers.get(\"cookie\"),\n        request.headers.get(\"host\") ?? new URL(request.url).host,\n        cookieNamespace,\n      ).token;\n    },\n\n    /**\n     * Check whether the request carries a non-expired JWT.\n     *\n     * Performs local expiration checking only (no network call).\n     * Use for lightweight auth guards in middleware.\n     *\n     * @param request - The incoming HTTP request.\n     * @returns `true` when a valid, non-expired JWT exists in the cookies.\n     */\n    async verify(request: Request): Promise<boolean> {\n      const token = parseAuthCookies(\n        request.headers.get(\"cookie\"),\n        request.headers.get(\"host\") ?? new URL(request.url).host,\n        cookieNamespace,\n      ).token;\n      if (token === null) {\n        return false;\n      }\n      const decodedToken = await Fx.run(\n        Fx.attempt(\n          async () => jwtDecode<DecodedToken>(token),\n          (decoded) => decoded,\n          () => null,\n        ),\n      );\n      if (decodedToken?.exp === undefined || decodedToken.iss === undefined) {\n        return false;\n      }\n      if (!acceptedIssuers.has(normalizeIssuer(decodedToken.iss))) {\n        return false;\n      }\n      return decodedToken.exp * 1000 > Date.now();\n    },\n\n    /**\n     * Handle a proxied `signIn` or `signOut` POST from the client.\n     *\n     * Validates the route, method, and origin, then forwards the\n     * action to Convex and returns a `Response` with updated\n     * `Set-Cookie` headers. The client never sees the real\n     * refresh token — it stays in httpOnly cookies.\n     *\n     * @param request - The incoming POST request from the client.\n     * @returns A JSON `Response` with auth result and cookie headers.\n     */\n    async proxy(request: Request): Promise<Response> {\n      const requestUrl = new URL(request.url);\n      const requestDispatch = !shouldProxyAuthAction(\n        requestUrl.pathname,\n        apiRoute,\n      )\n        ? { kind: \"invalidRoute\" as const }\n        : request.method !== \"POST\"\n          ? { kind: \"invalidMethod\" as const }\n          : (() => {\n                const originHeader = request.headers.get(\"origin\");\n                if (originHeader === null) {\n                  return false;\n                }\n                const forwardedProtoHeader =\n                  request.headers.get(\"x-forwarded-proto\");\n                const protocol =\n                  forwardedProtoHeader !== null\n                    ? (() => {\n                        const forwardedProto = forwardedProtoHeader\n                          .split(\",\")[0]\n                          ?.trim();\n                        if (\n                          forwardedProto !== undefined &&\n                          forwardedProto.length > 0\n                        ) {\n                          return forwardedProto.endsWith(\":\")\n                            ? forwardedProto\n                            : `${forwardedProto}:`;\n                        }\n                        return new URL(request.url).protocol;\n                      })()\n                    : new URL(request.url).protocol;\n                const requestHost =\n                  request.headers.get(\"host\") ?? new URL(request.url).host;\n                const hostCandidate = `${protocol}//${requestHost}`;\n                const host = canParseUrl(hostCandidate)\n                  ? new URL(hostCandidate).host\n                  : requestHost;\n                if (!canParseUrl(originHeader)) {\n                  return true;\n                }\n                const originUrl = new URL(originHeader);\n                return (\n                  originUrl.host !== host || originUrl.protocol !== protocol\n                );\n              })()\n            ? { kind: \"invalidOrigin\" as const }\n            : { kind: \"valid\" as const };\n\n      const validationErrorResponse = await Fx.run(\n        Fx.match(requestDispatch, requestDispatch.kind, {\n          invalidRoute: () => new Response(\"Invalid route\", { status: 404 }),\n          invalidMethod: () => new Response(\"Invalid method\", { status: 405 }),\n          invalidOrigin: () => new Response(\"Invalid origin\", { status: 403 }),\n          valid: () => null,\n        }),\n      );\n      if (validationErrorResponse !== null) {\n        return validationErrorResponse;\n      }\n\n      const body = await Fx.run(\n        Fx.attempt(\n          async () => {\n            const parsed = await request.json();\n            if (typeof parsed !== \"object\" || parsed === null) {\n              return null;\n            }\n            return parsed as Record<string, unknown>;\n          },\n          (parsed) => parsed,\n          () => null,\n        ),\n      );\n      if (body === null) {\n        return new Response(\"Invalid request body\", { status: 400 });\n      }\n\n      const action = body.action as string;\n      const args =\n        typeof body.args === \"object\" && body.args !== null\n          ? (body.args as Record<string, any>)\n          : {};\n\n      const actionDispatch =\n        action === \"auth:signIn\"\n          ? { action: \"sessionStart\" as const }\n          : action === \"auth:signOut\"\n            ? { action: \"sessionStop\" as const }\n            : null;\n\n      if (actionDispatch === null) {\n        return new Response(\"Invalid action\", { status: 400 });\n      }\n\n      const host = request.headers.get(\"host\") ?? new URL(request.url).host;\n      const currentCookies = parseAuthCookies(\n        request.headers.get(\"cookie\"),\n        host,\n        cookieNamespace,\n      );\n\n      return Fx.run(\n        Fx.match(actionDispatch, actionDispatch.action, {\n          sessionStart: (_) =>\n            Fx.from({\n              ok: async () => {\n                const refreshDispatch =\n                  args.refreshToken === undefined\n                    ? { kind: \"passthrough\" as const }\n                    : currentCookies.refreshToken === null\n                      ? { kind: \"refreshRequestedWithoutCookie\" as const }\n                      : {\n                          kind: \"hydrateRefreshFromCookie\" as const,\n                          refreshToken: currentCookies.refreshToken,\n                        };\n\n                const refreshResponse = await Fx.run(\n                  Fx.match(refreshDispatch, refreshDispatch.kind, {\n                    passthrough: async () => null,\n                    hydrateRefreshFromCookie: async ({ refreshToken }) => {\n                      args.refreshToken = refreshToken;\n                      return null;\n                    },\n                    refreshRequestedWithoutCookie: async () => {\n                      const currentToken = currentCookies.token;\n                      const decodedToken =\n                        currentToken === null\n                          ? null\n                          : await Fx.run(\n                              Fx.attempt(\n                                async () =>\n                                  jwtDecode<DecodedToken>(currentToken),\n                                (decoded) => decoded,\n                                () => null,\n                              ),\n                            );\n                      const tokenDispatch =\n                        currentToken !== null &&\n                        decodedToken?.exp !== undefined &&\n                        decodedToken.iss !== undefined &&\n                        acceptedIssuers.has(\n                          normalizeIssuer(decodedToken.iss),\n                        ) &&\n                        decodedToken.exp * 1000 > Date.now()\n                          ? {\n                              kind: \"validToken\" as const,\n                              token: currentToken,\n                            }\n                          : { kind: \"missingToken\" as const };\n                      return await Fx.run(\n                        Fx.match(tokenDispatch, tokenDispatch.kind, {\n                          validToken: ({ token }) =>\n                            new Response(\n                              JSON.stringify({\n                                tokens: {\n                                  token,\n                                  refreshToken: \"dummy\",\n                                },\n                              }),\n                              {\n                                status: 200,\n                                headers: {\n                                  \"Content-Type\": \"application/json\",\n                                },\n                              },\n                            ),\n                          missingToken: () =>\n                            new Response(JSON.stringify({ tokens: null }), {\n                              status: 200,\n                              headers: {\n                                \"Content-Type\": \"application/json\",\n                              },\n                            }),\n                        }),\n                      );\n                    },\n                  }),\n                );\n                const refreshDecision =\n                  refreshResponse !== null\n                    ? {\n                        kind: \"shortCircuit\" as const,\n                        response: refreshResponse,\n                      }\n                    : { kind: \"continue\" as const };\n                const maybeShortCircuitResponse = await Fx.run(\n                  Fx.match(refreshDecision, refreshDecision.kind, {\n                    shortCircuit: ({ response }) => response,\n                    continue: () => null,\n                  }),\n                );\n                if (maybeShortCircuitResponse !== null) {\n                  return maybeShortCircuitResponse;\n                }\n\n                const client = new ConvexHttpClient(convexUrl);\n                const authDispatch =\n                  args.refreshToken === undefined &&\n                  args.params?.code === undefined &&\n                  currentCookies.token !== null\n                    ? {\n                        kind: \"attachAuth\" as const,\n                        token: currentCookies.token,\n                      }\n                    : { kind: \"skipAuth\" as const };\n                await Fx.run(\n                  Fx.match(authDispatch, authDispatch.kind, {\n                    attachAuth: ({ token }) => {\n                      client.setAuth(token);\n                    },\n                    skipAuth: () => undefined,\n                  }),\n                );\n                return Fx.run(\n                  Fx.from({\n                    ok: () => client.action(signInActionRef, args),\n                    err: (error) => error,\n                  }).pipe(\n                    Fx.fold({\n                      ok: (result: SignInActionResult) =>\n                        Fx.run(\n                          Fx.match(result, result.kind, {\n                            redirect: (redirectResult) => {\n                              const response = new Response(\n                                JSON.stringify({\n                                  kind: \"redirect\",\n                                  redirect: redirectResult.redirect,\n                                  verifier: redirectResult.verifier,\n                                }),\n                                {\n                                  status: 200,\n                                  headers: {\n                                    \"Content-Type\": \"application/json\",\n                                  },\n                                },\n                              );\n                              for (const value of serializeAuthCookies(\n                                {\n                                  ...currentCookies,\n                                  verifier: redirectResult.verifier,\n                                },\n                                host,\n                                cookieConfig,\n                                cookieNamespace,\n                              )) {\n                                response.headers.append(\"Set-Cookie\", value);\n                              }\n                              return Fx.succeed(response);\n                            },\n                            signedIn: (signedInResult) => {\n                              const response = new Response(\n                                JSON.stringify({\n                                  kind: \"signedIn\",\n                                  tokens:\n                                    signedInResult.tokens === null\n                                      ? null\n                                      : {\n                                          token: signedInResult.tokens.token,\n                                          refreshToken: \"dummy\",\n                                        },\n                                }),\n                                {\n                                  status: 200,\n                                  headers: {\n                                    \"Content-Type\": \"application/json\",\n                                  },\n                                },\n                              );\n                              for (const value of serializeAuthCookies(\n                                {\n                                  token: signedInResult.tokens?.token ?? null,\n                                  refreshToken:\n                                    signedInResult.tokens?.refreshToken ?? null,\n                                  verifier: null,\n                                },\n                                host,\n                                cookieConfig,\n                                cookieNamespace,\n                              )) {\n                                response.headers.append(\"Set-Cookie\", value);\n                              }\n                              return Fx.succeed(response);\n                            },\n                            started: (startedResult) =>\n                              Fx.succeed(\n                                new Response(JSON.stringify(startedResult), {\n                                  status: 200,\n                                  headers: {\n                                    \"Content-Type\": \"application/json\",\n                                  },\n                                }),\n                              ),\n                            passkeyOptions: (passkeyOptionsResult) =>\n                              Fx.succeed(\n                                new Response(\n                                  JSON.stringify(passkeyOptionsResult),\n                                  {\n                                    status: 200,\n                                    headers: {\n                                      \"Content-Type\": \"application/json\",\n                                    },\n                                  },\n                                ),\n                              ),\n                            totpRequired: (totpRequiredResult) =>\n                              Fx.succeed(\n                                new Response(\n                                  JSON.stringify(totpRequiredResult),\n                                  {\n                                    status: 200,\n                                    headers: {\n                                      \"Content-Type\": \"application/json\",\n                                    },\n                                  },\n                                ),\n                              ),\n                            totpSetup: (totpSetupResult) =>\n                              Fx.succeed(\n                                new Response(JSON.stringify(totpSetupResult), {\n                                  status: 200,\n                                  headers: {\n                                    \"Content-Type\": \"application/json\",\n                                  },\n                                }),\n                              ),\n                            deviceCode: (deviceCodeResult) =>\n                              Fx.succeed(\n                                new Response(JSON.stringify(deviceCodeResult), {\n                                  status: 200,\n                                  headers: {\n                                    \"Content-Type\": \"application/json\",\n                                  },\n                                }),\n                              ),\n                          }),\n                        ),\n                      err: (error: unknown) => {\n                        const errorBody =\n                          error instanceof ConvexError &&\n                          typeof error.data === \"object\" &&\n                          error.data !== null &&\n                          \"code\" in error.data\n                            ? {\n                                error:\n                                  (error.data as { message?: string })\n                                    .message ?? String(error),\n                                authError: error.data,\n                              }\n                            : {\n                                error:\n                                  error instanceof Error\n                                    ? error.message\n                                    : String(error),\n                              };\n                        const response = new Response(\n                          JSON.stringify(errorBody),\n                          {\n                            status: 400,\n                            headers: {\n                              \"Content-Type\": \"application/json\",\n                            },\n                          },\n                        );\n                        const clearSession =\n                          args.refreshToken !== undefined &&\n                          error instanceof ConvexError &&\n                          typeof error.data === \"object\" &&\n                          error.data !== null &&\n                          (error.data as Record<string, unknown>).code ===\n                            \"INVALID_REFRESH_TOKEN\";\n                        for (const value of serializeAuthCookies(\n                          {\n                            token: clearSession ? null : currentCookies.token,\n                            refreshToken: clearSession\n                              ? null\n                              : currentCookies.refreshToken,\n                            verifier: null,\n                          },\n                          host,\n                          cookieConfig,\n                          cookieNamespace,\n                        )) {\n                          response.headers.append(\"Set-Cookie\", value);\n                        }\n                        return response;\n                      },\n                    }),\n                  ),\n                );\n              },\n              err: (e) => e as never,\n            }),\n          sessionStop: (_) =>\n            Fx.from({\n              ok: async () => {\n                await Fx.run(\n                  Fx.from({\n                    ok: () =>\n                      (() => {\n                        const client = new ConvexHttpClient(convexUrl);\n                        if (currentCookies.token !== null) {\n                          client.setAuth(currentCookies.token);\n                        }\n                        return client.action(signOutActionRef);\n                      })(),\n                    err: (error) => error,\n                  }).pipe(\n                    Fx.recover((error: unknown) => {\n                      console.error(\n                        \"[convex-auth/server] proxy sign-out failed\",\n                        error,\n                      );\n                      const fallbackDispatch =\n                        currentCookies.refreshToken !== null\n                          ? {\n                              kind: \"attemptFallback\" as const,\n                              refreshToken: currentCookies.refreshToken,\n                            }\n                          : { kind: \"skipFallback\" as const };\n                      return Fx.match(fallbackDispatch, fallbackDispatch.kind, {\n                        attemptFallback: ({ refreshToken }) =>\n                          Fx.from({\n                            ok: async () => {\n                              const refreshClient = new ConvexHttpClient(\n                                convexUrl,\n                              );\n                              const refreshed = (await refreshClient.action(\n                                signInActionRef,\n                                {\n                                  refreshToken,\n                                },\n                              )) as SignInActionResult;\n                              const refreshedTokens = await Fx.run(\n                                Fx.match(refreshed, refreshed.kind, {\n                                  signedIn: (signedInResult) =>\n                                    Fx.succeed(signedInResult.tokens),\n                                  redirect: () =>\n                                    Fx.fatal(\n                                      new Error(\n                                        \"Invalid `auth:signIn` result for sign-out fallback refresh\",\n                                      ),\n                                    ),\n                                  started: () =>\n                                    Fx.fatal(\n                                      new Error(\n                                        \"Invalid `auth:signIn` result for sign-out fallback refresh\",\n                                      ),\n                                    ),\n                                  passkeyOptions: () =>\n                                    Fx.fatal(\n                                      new Error(\n                                        \"Invalid `auth:signIn` result for sign-out fallback refresh\",\n                                      ),\n                                    ),\n                                  totpRequired: () =>\n                                    Fx.fatal(\n                                      new Error(\n                                        \"Invalid `auth:signIn` result for sign-out fallback refresh\",\n                                      ),\n                                    ),\n                                  totpSetup: () =>\n                                    Fx.fatal(\n                                      new Error(\n                                        \"Invalid `auth:signIn` result for sign-out fallback refresh\",\n                                      ),\n                                    ),\n                                  deviceCode: () =>\n                                    Fx.fatal(\n                                      new Error(\n                                        \"Invalid `auth:signIn` result for sign-out fallback refresh\",\n                                      ),\n                                    ),\n                                }),\n                              );\n                              const fallbackSignOutDispatch =\n                                refreshedTokens !== null\n                                  ? {\n                                      kind: \"signOutWithRefreshed\" as const,\n                                      token: refreshedTokens.token,\n                                    }\n                                  : { kind: \"skipRefreshedSignOut\" as const };\n                              await Fx.run(\n                                Fx.match(\n                                  fallbackSignOutDispatch,\n                                  fallbackSignOutDispatch.kind,\n                                  {\n                                    signOutWithRefreshed: ({ token }) =>\n                                      Fx.from({\n                                        ok: async () => {\n                                          const client = new ConvexHttpClient(\n                                            convexUrl,\n                                          );\n                                          client.setAuth(token);\n                                          await client.action(signOutActionRef);\n                                        },\n                                        err: (error) => error,\n                                      }),\n                                    skipRefreshedSignOut: () => Fx.succeed(undefined),\n                                  },\n                                ),\n                              );\n                            },\n                            err: (fallbackError) => fallbackError,\n                          }).pipe(\n                            Fx.recover((fallbackError: unknown) => {\n                              console.error(\n                                \"[convex-auth/server] proxy sign-out fallback failed\",\n                                fallbackError,\n                              );\n                              return Fx.succeed(undefined);\n                            }),\n                          ),\n                        skipFallback: () => Fx.succeed(undefined),\n                      });\n                    }),\n                    Fx.map(() => undefined),\n                  ),\n                );\n                const response = new Response(JSON.stringify(null), {\n                  status: 200,\n                  headers: {\n                    \"Content-Type\": \"application/json\",\n                  },\n                });\n                for (const value of serializeAuthCookies(\n                  {\n                    token: null,\n                    refreshToken: null,\n                    verifier: null,\n                  },\n                  host,\n                  cookieConfig,\n                  cookieNamespace,\n                )) {\n                  response.headers.append(\"Set-Cookie\", value);\n                }\n                return response;\n              },\n              err: (e) => e as never,\n            }),\n        }),\n      );\n    },\n\n    /**\n     * Refresh auth tokens on page load.\n     *\n     * Call this in your server hooks/middleware on every request.\n     * It handles three scenarios:\n     *\n     * 1. **OAuth code exchange** — exchanges a `?code=` query param for tokens and returns a redirect URL.\n     * 2. **Token refresh** — refreshes the JWT if it's close to expiry.\n     * 3. **No-op** — returns the existing token when no refresh is needed.\n     *\n     * @param request - The incoming HTTP request.\n     * @returns Structured cookies to set on the response, an optional redirect URL, and the current JWT.\n     */\n    async refresh(request: Request): Promise<RefreshResult> {\n      const host = request.headers.get(\"host\") ?? new URL(request.url).host;\n      const currentCookies = parseAuthCookies(\n        request.headers.get(\"cookie\"),\n        host,\n        cookieNamespace,\n      );\n      const currentToken = currentCookies.token;\n\n      // CORS request — do not mutate auth cookies from cross-origin requests.\n      const originHeader = request.headers.get(\"origin\");\n      const forwardedProtoHeader = request.headers.get(\"x-forwarded-proto\");\n      const protocol =\n        forwardedProtoHeader !== null\n          ? (() => {\n              const forwardedProto = forwardedProtoHeader.split(\",\")[0]?.trim();\n              if (forwardedProto !== undefined && forwardedProto.length > 0) {\n                return forwardedProto.endsWith(\":\")\n                  ? forwardedProto\n                  : `${forwardedProto}:`;\n              }\n              return new URL(request.url).protocol;\n            })()\n          : new URL(request.url).protocol;\n      const requestHost =\n        request.headers.get(\"host\") ?? new URL(request.url).host;\n      const hostCandidate = `${protocol}//${requestHost}`;\n      const normalizedHost = canParseUrl(hostCandidate)\n        ? new URL(hostCandidate).host\n        : requestHost;\n      const originUrl =\n        originHeader !== null && canParseUrl(originHeader)\n          ? new URL(originHeader)\n          : null;\n      const corsRequest =\n        originHeader !== null &&\n        (originUrl === null ||\n          originUrl.host !== normalizedHost ||\n          originUrl.protocol !== protocol);\n      const corsDispatch = corsRequest\n        ? { kind: \"crossOrigin\" as const }\n        : { kind: \"sameOrigin\" as const };\n      const corsRefreshResult = await Fx.run(\n        Fx.match(corsDispatch, corsDispatch.kind, {\n          crossOrigin: () =>\n            ({\n              redirect: false,\n              cookies: [],\n              token: null,\n            }) satisfies RefreshResult,\n          sameOrigin: () => null,\n        }),\n      );\n      if (corsRefreshResult !== null) {\n        return corsRefreshResult;\n      }\n\n      // OAuth code exchange — exchange code for tokens and redirect.\n      const requestUrl = new URL(request.url);\n      const code = requestUrl.searchParams.get(\"code\");\n      const shouldHandleCode =\n        options.shouldHandleCode === undefined\n          ? true\n          : typeof options.shouldHandleCode === \"function\"\n            ? await options.shouldHandleCode(request)\n            : options.shouldHandleCode;\n\n      const codeExchangeDispatch =\n        code !== null &&\n        request.method === \"GET\" &&\n        request.headers.get(\"accept\")?.includes(\"text/html\") &&\n        shouldHandleCode\n          ? { kind: \"exchange\" as const, code }\n          : { kind: \"skip\" as const };\n      const codeExchangeResult = await Fx.run(\n        Fx.match(codeExchangeDispatch, codeExchangeDispatch.kind, {\n          exchange: async ({\n            code: verificationCode,\n          }): Promise<RefreshResult> => {\n            const redirectUrl = new URL(requestUrl.toString());\n            return Fx.run(\n              Fx.from({\n                ok: async () => {\n                  const client = new ConvexHttpClient(convexUrl);\n                  const result = (await client.action(signInActionRef, {\n                    params: { code: verificationCode },\n                    verifier: currentCookies.verifier ?? undefined,\n                  })) as SignInActionResult;\n                  const tokens = await Fx.run(\n                    Fx.match(result, result.kind, {\n                      signedIn: (signedInResult) =>\n                        Fx.succeed(signedInResult.tokens),\n                      redirect: () =>\n                        Fx.fatal(\n                          new Error(\n                            \"Invalid `auth:signIn` result for code exchange\",\n                          ),\n                        ),\n                      started: () =>\n                        Fx.fatal(\n                          new Error(\n                            \"Invalid `auth:signIn` result for code exchange\",\n                          ),\n                        ),\n                      passkeyOptions: () =>\n                        Fx.fatal(\n                          new Error(\n                            \"Invalid `auth:signIn` result for code exchange\",\n                          ),\n                        ),\n                      totpRequired: () =>\n                        Fx.fatal(\n                          new Error(\n                            \"Invalid `auth:signIn` result for code exchange\",\n                          ),\n                        ),\n                      totpSetup: () =>\n                        Fx.fatal(\n                          new Error(\n                            \"Invalid `auth:signIn` result for code exchange\",\n                          ),\n                        ),\n                      deviceCode: () =>\n                        Fx.fatal(\n                          new Error(\n                            \"Invalid `auth:signIn` result for code exchange\",\n                          ),\n                        ),\n                    }),\n                  );\n                  return { kind: \"signedIn\" as const, tokens };\n                },\n                err: (error) => error,\n              }).pipe(\n                Fx.fold({\n                  ok: (result): RefreshResult => {\n                    redirectUrl.searchParams.delete(\"code\");\n                    const cookies = structuredAuthCookies(\n                      {\n                        token: result.tokens?.token ?? null,\n                        refreshToken: result.tokens?.refreshToken ?? null,\n                        verifier: null,\n                      },\n                      host,\n                      cookieConfig,\n                      cookieNamespace,\n                    );\n                    return {\n                      redirect: true,\n                      response: buildRedirectResponse(\n                        redirectUrl.toString(),\n                        cookies,\n                      ),\n                    };\n                  },\n                  err: (error: unknown): RefreshResult => {\n                    console.error(\n                      \"[convex-auth/server] code exchange failed\",\n                      error,\n                    );\n                    const errorCode =\n                      error instanceof ConvexError &&\n                      typeof error.data === \"object\" &&\n                      error.data !== null &&\n                      typeof (error.data as Record<string, unknown>).code ===\n                        \"string\"\n                        ? ((error.data as Record<string, unknown>)\n                            .code as string)\n                        : null;\n                    const terminalCodeExchangeError =\n                      errorCode === \"OAUTH_INVALID_STATE\" ||\n                      errorCode === \"OAUTH_PROVIDER_ERROR\" ||\n                      errorCode === \"OAUTH_MISSING_ID_TOKEN\" ||\n                      errorCode === \"OAUTH_INVALID_PROFILE\" ||\n                      errorCode === \"OAUTH_MISSING_VERIFIER\" ||\n                      errorCode === \"INVALID_VERIFIER\" ||\n                      errorCode === \"INVALID_VERIFICATION_CODE\";\n                    if (!terminalCodeExchangeError) {\n                      return {\n                        redirect: false,\n                        cookies: [],\n                        token: currentCookies.token,\n                      };\n                    }\n                    redirectUrl.searchParams.delete(\"code\");\n                    const cookies = structuredAuthCookies(\n                      {\n                        token: currentCookies.token,\n                        refreshToken: currentCookies.refreshToken,\n                        verifier: null,\n                      },\n                      host,\n                      cookieConfig,\n                      cookieNamespace,\n                    );\n                    return {\n                      redirect: true,\n                      response: buildRedirectResponse(\n                        redirectUrl.toString(),\n                        cookies,\n                      ),\n                    };\n                  },\n                }),\n              ),\n            );\n          },\n          skip: async () => null,\n        }),\n      );\n      const codeExchangeDecision =\n        codeExchangeResult !== null\n          ? { kind: \"done\" as const, result: codeExchangeResult }\n          : { kind: \"continue\" as const };\n      const maybeCodeExchangeResult = await Fx.run(\n        Fx.match(codeExchangeDecision, codeExchangeDecision.kind, {\n          done: ({ result }) => result,\n          continue: () => null,\n        }),\n      );\n      if (maybeCodeExchangeResult !== null) {\n        return maybeCodeExchangeResult;\n      }\n\n      // Normal page load — refresh tokens if needed.\n      const tokens = await Fx.run(\n        Fx.gen(function* () {\n          const { token, refreshToken } = currentCookies;\n\n          const isMalformedRefreshToken =\n            refreshToken !== null &&\n            (refreshToken.trim().length === 0 || refreshToken === \"dummy\");\n          const malformedRefreshTokenDispatch = isMalformedRefreshToken\n            ? { kind: \"malformed\" as const }\n            : { kind: \"ok\" as const };\n          const malformedRefreshTokenResult = yield* Fx.match(\n            malformedRefreshTokenDispatch,\n            malformedRefreshTokenDispatch.kind,\n            {\n              malformed: () => {\n                if (verbose) {\n                  console.debug(\n                    `${new Date().toISOString()} [convex-auth/server] Refresh token cookie malformed, clearing auth cookies`,\n                  );\n                }\n                return null;\n              },\n              ok: () => undefined,\n            },\n          );\n          if (malformedRefreshTokenResult !== undefined) {\n            return malformedRefreshTokenResult;\n          }\n\n          const decodedToken =\n            token === null\n              ? null\n              : yield* Fx.attempt(\n                  async () => jwtDecode<DecodedToken>(token),\n                  (decoded) => decoded,\n                  () => null,\n                );\n          const issuerDispatch =\n            decodedToken?.iss !== undefined &&\n            !acceptedIssuers.has(normalizeIssuer(decodedToken.iss))\n              ? { kind: \"issuerMismatch\" as const }\n              : { kind: \"issuerOk\" as const };\n          const issuerResult = yield* Fx.match(\n            issuerDispatch,\n            issuerDispatch.kind,\n            {\n              issuerMismatch: () => {\n                if (verbose) {\n                  console.debug(\n                    `${new Date().toISOString()} [convex-auth/server] Access token issuer mismatch, clearing auth cookies`,\n                  );\n                }\n                return null;\n              },\n              issuerOk: () => undefined,\n            },\n          );\n          if (issuerResult !== undefined) {\n            return issuerResult;\n          }\n\n          const tokenState =\n            token === null\n              ? refreshToken === null\n                ? { kind: \"none\" as const }\n                : { kind: \"refreshOnly\" as const, refreshToken }\n              : refreshToken === null\n                ? { kind: \"accessOnly\" as const, token }\n                : { kind: \"both\" as const, token, refreshToken };\n\n          return yield* Fx.match(tokenState, tokenState.kind, {\n            none: () => {\n              if (verbose) {\n                console.debug(\n                  `${new Date().toISOString()} [convex-auth/server] No auth cookies found, skipping refresh`,\n                );\n              }\n              return Fx.succeed(undefined);\n            },\n            refreshOnly: ({ refreshToken: refreshTokenValue }) => {\n              if (verbose) {\n                console.debug(\n                  `${new Date().toISOString()} [convex-auth/server] Access token cookie missing, attempting refresh-token recovery`,\n                );\n              }\n              return Fx.from({\n                ok: async () => {\n                  const client = new ConvexHttpClient(convexUrl);\n                  const result = (await client.action(signInActionRef, {\n                    refreshToken: refreshTokenValue,\n                  })) as SignInActionResult;\n                  const tokens = await Fx.run(\n                    Fx.match(result, result.kind, {\n                      signedIn: (signedInResult) =>\n                        Fx.succeed(signedInResult.tokens),\n                      redirect: () =>\n                        Fx.fatal(\n                          new Error(\n                            \"Invalid `auth:signIn` result for token refresh\",\n                          ),\n                        ),\n                      started: () =>\n                        Fx.fatal(\n                          new Error(\n                            \"Invalid `auth:signIn` result for token refresh\",\n                          ),\n                        ),\n                      passkeyOptions: () =>\n                        Fx.fatal(\n                          new Error(\n                            \"Invalid `auth:signIn` result for token refresh\",\n                          ),\n                        ),\n                      totpRequired: () =>\n                        Fx.fatal(\n                          new Error(\n                            \"Invalid `auth:signIn` result for token refresh\",\n                          ),\n                        ),\n                      totpSetup: () =>\n                        Fx.fatal(\n                          new Error(\n                            \"Invalid `auth:signIn` result for token refresh\",\n                          ),\n                        ),\n                      deviceCode: () =>\n                        Fx.fatal(\n                          new Error(\n                            \"Invalid `auth:signIn` result for token refresh\",\n                          ),\n                        ),\n                    }),\n                  );\n                  if (verbose) {\n                    console.debug(\n                      `${new Date().toISOString()} [convex-auth/server] Refreshed tokens, null=${tokens === null}`,\n                    );\n                  }\n                  return tokens;\n                },\n                err: (error) => error,\n              }).pipe(\n                Fx.recover((error: unknown) => {\n                  console.error(\n                    \"[convex-auth/server] refresh-token exchange failed\",\n                    error,\n                  );\n                  const errorCode =\n                    error instanceof ConvexError &&\n                    typeof error.data === \"object\" &&\n                    error.data !== null &&\n                    typeof (error.data as Record<string, unknown>).code ===\n                      \"string\"\n                      ? ((error.data as Record<string, unknown>).code as string)\n                      : null;\n                  if (errorCode === \"INVALID_REFRESH_TOKEN\") {\n                    if (verbose) {\n                      console.debug(\n                        `${new Date().toISOString()} [convex-auth/server] Refresh token rejected, clearing auth cookies`,\n                      );\n                    }\n                    return Fx.succeed(\n                      null as\n                        | { token: string; refreshToken: string }\n                        | null\n                        | undefined,\n                    );\n                  }\n                  if (verbose) {\n                    console.debug(\n                      `${new Date().toISOString()} [convex-auth/server] Token refresh failed transiently, keeping current cookies`,\n                    );\n                  }\n                  return Fx.succeed(\n                    undefined as\n                      | { token: string; refreshToken: string }\n                      | null\n                      | undefined,\n                  );\n                }),\n              );\n            },\n            accessOnly: () => {\n              const accessOnlyDispatch =\n                decodedToken?.exp !== undefined &&\n                decodedToken.iss !== undefined &&\n                acceptedIssuers.has(normalizeIssuer(decodedToken.iss)) &&\n                decodedToken.exp * 1000 > Date.now()\n                  ? { kind: \"accessValid\" as const }\n                  : { kind: \"accessInvalid\" as const };\n              return Fx.match(accessOnlyDispatch, accessOnlyDispatch.kind, {\n                accessValid: () => {\n                  if (verbose) {\n                    console.debug(\n                      `${new Date().toISOString()} [convex-auth/server] Refresh token cookie missing but access token still valid`,\n                    );\n                  }\n                  return Fx.succeed(undefined);\n                },\n                accessInvalid: () => {\n                  if (verbose) {\n                    console.debug(\n                      `${new Date().toISOString()} [convex-auth/server] Refresh token cookie missing and access token invalid, clearing`,\n                    );\n                  }\n                  return Fx.succeed(null);\n                },\n              });\n            },\n            both: ({ refreshToken: refreshTokenValue }) => {\n              const bothDecodeDispatch:\n                | { kind: \"undecodable\" }\n                | {\n                    kind: \"decoded\";\n                    decodedToken: DecodedToken & {\n                      exp: number;\n                      iat: number;\n                    };\n                  } =\n                decodedToken?.exp === undefined ||\n                decodedToken.iat === undefined\n                  ? { kind: \"undecodable\" as const }\n                  : {\n                      kind: \"decoded\" as const,\n                      decodedToken: decodedToken as DecodedToken & {\n                        exp: number;\n                        iat: number;\n                      },\n                    };\n              return Fx.match(bothDecodeDispatch, bothDecodeDispatch.kind, {\n                undecodable: () => {\n                  if (verbose) {\n                    console.debug(\n                      `${new Date().toISOString()} [convex-auth/server] Failed to decode access token, attempting refresh-token recovery`,\n                    );\n                  }\n                  return Fx.from({\n                    ok: async () => {\n                      const client = new ConvexHttpClient(convexUrl);\n                      const result = (await client.action(signInActionRef, {\n                        refreshToken: refreshTokenValue,\n                      })) as SignInActionResult;\n                      const tokens = await Fx.run(\n                        Fx.match(result, result.kind, {\n                          signedIn: (signedInResult) =>\n                            Fx.succeed(signedInResult.tokens),\n                          redirect: () =>\n                            Fx.fatal(\n                              new Error(\n                                \"Invalid `auth:signIn` result for token refresh\",\n                              ),\n                            ),\n                          started: () =>\n                            Fx.fatal(\n                              new Error(\n                                \"Invalid `auth:signIn` result for token refresh\",\n                              ),\n                            ),\n                          passkeyOptions: () =>\n                            Fx.fatal(\n                              new Error(\n                                \"Invalid `auth:signIn` result for token refresh\",\n                              ),\n                            ),\n                          totpRequired: () =>\n                            Fx.fatal(\n                              new Error(\n                                \"Invalid `auth:signIn` result for token refresh\",\n                              ),\n                            ),\n                          totpSetup: () =>\n                            Fx.fatal(\n                              new Error(\n                                \"Invalid `auth:signIn` result for token refresh\",\n                              ),\n                            ),\n                          deviceCode: () =>\n                            Fx.fatal(\n                              new Error(\n                                \"Invalid `auth:signIn` result for token refresh\",\n                              ),\n                            ),\n                        }),\n                      );\n                      if (verbose) {\n                        console.debug(\n                          `${new Date().toISOString()} [convex-auth/server] Refreshed tokens, null=${tokens === null}`,\n                        );\n                      }\n                      return tokens;\n                    },\n                    err: (error) => error,\n                  }).pipe(\n                    Fx.recover((error: unknown) => {\n                      console.error(\n                        \"[convex-auth/server] refresh-token exchange failed\",\n                        error,\n                      );\n                      const errorCode =\n                        error instanceof ConvexError &&\n                        typeof error.data === \"object\" &&\n                        error.data !== null &&\n                        typeof (error.data as Record<string, unknown>).code ===\n                          \"string\"\n                          ? ((error.data as Record<string, unknown>)\n                              .code as string)\n                          : null;\n                      if (errorCode === \"INVALID_REFRESH_TOKEN\") {\n                        if (verbose) {\n                          console.debug(\n                            `${new Date().toISOString()} [convex-auth/server] Refresh token rejected, clearing auth cookies`,\n                          );\n                        }\n                        return Fx.succeed(\n                          null as\n                            | { token: string; refreshToken: string }\n                            | null\n                            | undefined,\n                        );\n                      }\n                      if (verbose) {\n                        console.debug(\n                          `${new Date().toISOString()} [convex-auth/server] Token refresh failed transiently, keeping current cookies`,\n                        );\n                      }\n                      return Fx.succeed(\n                        undefined as\n                          | { token: string; refreshToken: string }\n                          | null\n                          | undefined,\n                      );\n                    }),\n                  );\n                },\n                decoded: ({ decodedToken: decodedAccessToken }) => {\n                  const totalTokenLifetimeMs =\n                    decodedAccessToken.exp * 1000 -\n                    decodedAccessToken.iat * 1000;\n                  const minimumExpiration =\n                    Date.now() +\n                    Math.min(\n                      REQUIRED_TOKEN_LIFETIME_MS,\n                      Math.max(\n                        MINIMUM_REQUIRED_TOKEN_LIFETIME_MS,\n                        totalTokenLifetimeMs / 10,\n                      ),\n                    );\n                  const expirationDispatch =\n                    decodedAccessToken.exp * 1000 > minimumExpiration\n                      ? { kind: \"skipRefresh\" as const }\n                      : { kind: \"refresh\" as const };\n                  return Fx.match(expirationDispatch, expirationDispatch.kind, {\n                    skipRefresh: () => {\n                      if (verbose) {\n                        console.debug(\n                          `${new Date().toISOString()} [convex-auth/server] Token valid long enough, skipping refresh`,\n                        );\n                      }\n                      return Fx.succeed(undefined);\n                    },\n                    refresh: () =>\n                      Fx.from({\n                        ok: async () => {\n                          const client = new ConvexHttpClient(convexUrl);\n                          const result = (await client.action(signInActionRef, {\n                            refreshToken: refreshTokenValue,\n                          })) as SignInActionResult;\n                          const tokens = await Fx.run(\n                            Fx.match(result, result.kind, {\n                              signedIn: (signedInResult) =>\n                                Fx.succeed(signedInResult.tokens),\n                              redirect: () =>\n                                Fx.fatal(\n                                  new Error(\n                                    \"Invalid `auth:signIn` result for token refresh\",\n                                  ),\n                                ),\n                              started: () =>\n                                Fx.fatal(\n                                  new Error(\n                                    \"Invalid `auth:signIn` result for token refresh\",\n                                  ),\n                                ),\n                              passkeyOptions: () =>\n                                Fx.fatal(\n                                  new Error(\n                                    \"Invalid `auth:signIn` result for token refresh\",\n                                  ),\n                                ),\n                              totpRequired: () =>\n                                Fx.fatal(\n                                  new Error(\n                                    \"Invalid `auth:signIn` result for token refresh\",\n                                  ),\n                                ),\n                              totpSetup: () =>\n                                Fx.fatal(\n                                  new Error(\n                                    \"Invalid `auth:signIn` result for token refresh\",\n                                  ),\n                                ),\n                              deviceCode: () =>\n                                Fx.fatal(\n                                  new Error(\n                                    \"Invalid `auth:signIn` result for token refresh\",\n                                  ),\n                                ),\n                            }),\n                          );\n                          if (verbose) {\n                            console.debug(\n                              `${new Date().toISOString()} [convex-auth/server] Refreshed tokens, null=${tokens === null}`,\n                            );\n                          }\n                          return tokens;\n                        },\n                        err: (error) => error,\n                      }).pipe(\n                        Fx.recover((error: unknown) => {\n                          console.error(\n                            \"[convex-auth/server] refresh-token exchange failed\",\n                            error,\n                          );\n                          const errorCode =\n                            error instanceof ConvexError &&\n                            typeof error.data === \"object\" &&\n                            error.data !== null &&\n                            typeof (error.data as Record<string, unknown>)\n                              .code === \"string\"\n                              ? ((error.data as Record<string, unknown>)\n                                  .code as string)\n                              : null;\n                          if (errorCode === \"INVALID_REFRESH_TOKEN\") {\n                            if (verbose) {\n                              console.debug(\n                                `${new Date().toISOString()} [convex-auth/server] Refresh token rejected, clearing auth cookies`,\n                              );\n                            }\n                            return Fx.succeed(\n                              null as\n                                | { token: string; refreshToken: string }\n                                | null\n                                | undefined,\n                            );\n                          }\n                          if (verbose) {\n                            console.debug(\n                              `${new Date().toISOString()} [convex-auth/server] Token refresh failed transiently, keeping current cookies`,\n                            );\n                          }\n                          return Fx.succeed(\n                            undefined as\n                              | { token: string; refreshToken: string }\n                              | null\n                              | undefined,\n                          );\n                        }),\n                      ),\n                  });\n                },\n              });\n            },\n          });\n        }),\n      );\n      if (tokens === undefined) {\n        return { redirect: false, cookies: [], token: currentToken };\n      }\n\n      return {\n        redirect: false,\n        cookies: structuredAuthCookies(\n          {\n            token: tokens?.token ?? null,\n            refreshToken: tokens?.refreshToken ?? null,\n            verifier: null,\n          },\n          host,\n          cookieConfig,\n          cookieNamespace,\n        ),\n        token: tokens?.token ?? null,\n      };\n    },\n  };\n}\n"],"mappings":";;;;;;;;;AAcA,MAAM,kBAAgC,sBAAsB,cAAc;AAC1E,MAAM,mBAAkC,sBAAsB,eAAe;AAkG7E,MAAM,yBAAyB;AAC/B,MAAM,2BAA2B;AACjC,MAAM,4BAA4B;AAClC,MAAM,oCAAoC;;;;;;;;;;;AAY1C,SAAgB,gBACd,MACA,iBACA;CACA,MAAM,SAAS,YAAY,KAAK,GAAG,KAAK;CACxC,MAAM,YAAY,yBAAyB,gBAAgB;CAC3D,MAAM,SAAS,cAAc,OAAO,KAAK,IAAI;AAC7C,QAAO;EACL,OAAO,GAAG,SAAS,yBAAyB;EAC5C,cAAc,GAAG,SAAS,2BAA2B;EACrD,UAAU,GAAG,SAAS,4BAA4B;EACnD;;;;;;;;;;AAWH,SAAgB,iBACd,cACA,MACA,iBACa;CACb,MAAM,QAAQ,gBAAgB,MAAM,gBAAgB;CACpD,MAAM,SAAS,MAAM,gBAAgB,GAAG;AACxC,QAAO;EACL,OAAO,OAAO,MAAM,UAAU;EAC9B,cAAc,OAAO,MAAM,iBAAiB;EAC5C,UAAU,OAAO,MAAM,aAAa;EACrC;;;;;;;;;;;;;AAcH,SAAgB,qBACd,SACA,MACA,SAA2B,EAAE,QAAQ,MAAM,EAC3C,iBACA;CACA,MAAM,QAAQ,gBAAgB,MAAM,gBAAgB;CAEpD,MAAM,OAAO;EACX,MAAM;EACN,UAAU;EACV,UAAU;EACV,QALa,CAAC,YAAY,KAAK;EAMhC;CACD,MAAM,SAAS,OAAO,UAAU;AAkBhC,QAjBmB;EACjB,UAAU,MAAM,OAAO,QAAQ,SAAS,IAAI;GAC1C,GAAG;GACH,QAAQ,QAAQ,UAAU,OAAO,IAAI;GACrC,SAAS,QAAQ,UAAU,uBAAO,IAAI,KAAK,EAAE,GAAG;GACjD,CAAC;EACF,UAAU,MAAM,cAAc,QAAQ,gBAAgB,IAAI;GACxD,GAAG;GACH,QAAQ,QAAQ,iBAAiB,OAAO,IAAI;GAC5C,SAAS,QAAQ,iBAAiB,uBAAO,IAAI,KAAK,EAAE,GAAG;GACxD,CAAC;EACF,UAAU,MAAM,UAAU,QAAQ,YAAY,IAAI;GAChD,GAAG;GACH,QAAQ,QAAQ,aAAa,OAAO,IAAI;GACxC,SAAS,QAAQ,aAAa,uBAAO,IAAI,KAAK,EAAE,GAAG;GACpD,CAAC;EACH;;;;;;;;;;;;;;AAgBH,SAAgB,sBACd,SACA,MACA,SAA2B,EAAE,QAAQ,MAAM,EAC3C,iBACc;CACd,MAAM,QAAQ,gBAAgB,MAAM,gBAAgB;CAEpD,MAAM,OAAO;EACX,MAAM;EACN,UAAU;EACV,QAJa,CAAC,YAAY,KAAK;EAK/B,UAAU;EACX;CACD,MAAM,SAAS,OAAO,UAAU;AA+BhC,QA9BiC;EAC/B;GACE,MAAM,MAAM;GACZ,OAAO,QAAQ,SAAS;GACxB,SAAS;IACP,GAAG;IACH,QAAQ,QAAQ,UAAU,OAAO,IAAI;IACrC,SAAS,QAAQ,UAAU,uBAAO,IAAI,KAAK,EAAE,GAAG;IACjD;GACF;EACD;GACE,MAAM,MAAM;GACZ,OAAO,QAAQ,gBAAgB;GAC/B,SAAS;IACP,GAAG;IACH,QAAQ,QAAQ,iBAAiB,OAAO,IAAI;IAC5C,SAAS,QAAQ,iBAAiB,uBAAO,IAAI,KAAK,EAAE,GAAG;IACxD;GACF;EACD;GACE,MAAM,MAAM;GACZ,OAAO,QAAQ,YAAY;GAC3B,SAAS;IACP,GAAG;IACH,QAAQ,QAAQ,aAAa,OAAO,IAAI;IACxC,SAAS,QAAQ,aAAa,uBAAO,IAAI,KAAK,EAAE,GAAG;IACpD;GACF;EACF;;;;;;;;;;;;;;AAiBH,SAAgB,sBAAsB,UAAkB,UAAkB;AACxE,KAAI,SAAS,SAAS,IAAI,CACxB,QAAO,aAAa,YAAY,aAAa,SAAS,MAAM,GAAG,GAAG;AAEpE,QAAO,aAAa,YAAY,aAAa,GAAG,SAAS;;AAG3D,MAAM,6BAA6B;AACnC,MAAM,qCAAqC;AAI3C,SAAS,yBAAyB,iBAAiC;AACjE,KAAI,oBAAoB,UAAa,oBAAoB,KACvD,QAAO;CAET,MAAM,aAAa,gBAChB,MAAM,CACN,QAAQ,kBAAkB,IAAI,CAC9B,QAAQ,YAAY,GAAG,CACvB,aAAa;AAChB,QAAO,WAAW,SAAS,IAAI,aAAa;;;;;AAM9C,SAAS,YAAY,OAAwB;AAC3C,KAAI;AACF,MAAI,IAAI,MAAM;AACd,SAAO;SACD;AACN,SAAO;;;AAIX,SAAS,oBAAoB,QAA4B;CACvD,MAAM,QAAQ,CACZ,GAAG,OAAO,KAAK,GAAG,OAAO,SACzB,QAAQ,OAAO,QAAQ,OACxB;AACD,KAAI,OAAO,QAAQ,SAAU,OAAM,KAAK,WAAW;AACnD,KAAI,OAAO,QAAQ,OAAQ,OAAM,KAAK,SAAS;AAC/C,KAAI,OAAO,QAAQ,SACjB,OAAM,KAAK,YAAY,OAAO,QAAQ,WAAW;AACnD,KAAI,OAAO,QAAQ,WAAW,OAC5B,OAAM,KAAK,WAAW,OAAO,QAAQ,SAAS;AAChD,KAAI,OAAO,QAAQ,QACjB,OAAM,KAAK,WAAW,OAAO,QAAQ,QAAQ,aAAa,GAAG;AAC/D,QAAO,MAAM,KAAK,KAAK;;AAGzB,SAAS,sBACP,UACA,SACU;CACV,MAAM,UAAU,IAAI,QAAQ,EAAE,UAAU,UAAU,CAAC;AACnD,MAAK,MAAM,UAAU,QACnB,SAAQ,OAAO,cAAc,oBAAoB,OAAO,CAAC;AAE3D,QAAO,IAAI,SAAS,MAAM;EAAE,QAAQ;EAAK;EAAS,CAAC;;AAGrD,SAAS,6BAA6B,KAAa;AACjD,KAAI,CAAC,YAAY,IAAI,CAAE,QAAO;CAC9B,MAAM,SAAS,IAAI,IAAI,IAAI;AAE3B,QAAO,yBADK,GAAG,OAAO,WAAW,OAAO,WACJ,IAAI;;AAG1C,SAAS,gBAAgB,OAAe;AACtC,KAAI,CAAC,YAAY,MAAM,CAAE,QAAO,MAAM,QAAQ,QAAQ,GAAG;CACzD,MAAM,SAAS,IAAI,IAAI,MAAM;CAC7B,MAAM,WACJ,OAAO,aAAa,MAAM,KAAK,OAAO,SAAS,QAAQ,QAAQ,GAAG;AACpE,QAAO,GAAG,OAAO,SAAS,IAAI,OAAO,OAAO;;AAG9C,SAAS,6BAA6B,OAAe;AACnD,KAAI,CAAC,YAAY,MAAM,CAAE,QAAO;CAChC,MAAM,SAAS,IAAI,IAAI,MAAM;AAC7B,KAAI,CAAC,OAAO,SAAS,SAAS,gBAAgB,CAC5C,QAAO;AAET,QAAO,WACL,OAAO,SAAS,MAAM,GAAG,IAAwB,GAAG;AACtD,QAAO,gBAAgB,OAAO,UAAU,CAAC;;AAG3C,SAAS,6BAA6B,OAAe;CACnD,MAAM,UAAU,CAAC,gBAAgB,MAAM,CAAC;CACxC,MAAM,aAAa,6BAA6B,MAAM;AACtD,KAAI,eAAe,KACjB,SAAQ,KAAK,WAAW;AAE1B,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CT,SAAgB,OAAO,SAAwB;CAC7C,MAAM,YAAY,QAAQ;CAC1B,MAAM,WAAW,QAAQ,YAAY;CACrC,MAAM,eAAe,EAAE,QAAQ,QAAQ,gBAAgB,MAAM;CAC7D,MAAM,UAAU,QAAQ,WAAW;CACnC,MAAM,kBACJ,yBAAyB,QAAQ,gBAAgB,IACjD,6BAA6B,UAAU;CACzC,MAAM,kBAAkB,IAAI,KACzB,QAAQ,mBAAmB,6BAA6B,UAAU,EAChE,IAAI,gBAAgB,CACpB,QAAQ,WAAW,OAAO,SAAS,EAAE,CACzC;AAED,QAAO;EAOL,MAAM,SAAiC;AACrC,UAAO,iBACL,QAAQ,QAAQ,IAAI,SAAS,EAC7B,QAAQ,QAAQ,IAAI,OAAO,IAAI,IAAI,IAAI,QAAQ,IAAI,CAAC,MACpD,gBACD,CAAC;;EAYJ,MAAM,OAAO,SAAoC;GAC/C,MAAM,QAAQ,iBACZ,QAAQ,QAAQ,IAAI,SAAS,EAC7B,QAAQ,QAAQ,IAAI,OAAO,IAAI,IAAI,IAAI,QAAQ,IAAI,CAAC,MACpD,gBACD,CAAC;AACF,OAAI,UAAU,KACZ,QAAO;GAET,MAAM,eAAe,MAAM,GAAG,IAC5B,GAAG,QACD,YAAY,UAAwB,MAAM,GACzC,YAAY,eACP,KACP,CACF;AACD,OAAI,cAAc,QAAQ,UAAa,aAAa,QAAQ,OAC1D,QAAO;AAET,OAAI,CAAC,gBAAgB,IAAI,gBAAgB,aAAa,IAAI,CAAC,CACzD,QAAO;AAET,UAAO,aAAa,MAAM,MAAO,KAAK,KAAK;;EAc7C,MAAM,MAAM,SAAqC;GAE/C,MAAM,kBAAkB,CAAC,sBADN,IAAI,IAAI,QAAQ,IAAI,CAE1B,UACX,SACD,GACG,EAAE,MAAM,gBAAyB,GACjC,QAAQ,WAAW,SACjB,EAAE,MAAM,iBAA0B,UAC3B;IACH,MAAM,eAAe,QAAQ,QAAQ,IAAI,SAAS;AAClD,QAAI,iBAAiB,KACnB,QAAO;IAET,MAAM,uBACJ,QAAQ,QAAQ,IAAI,oBAAoB;IAC1C,MAAM,WACJ,yBAAyB,cACd;KACL,MAAM,iBAAiB,qBACpB,MAAM,IAAI,CAAC,IACV,MAAM;AACV,SACE,mBAAmB,UACnB,eAAe,SAAS,EAExB,QAAO,eAAe,SAAS,IAAI,GAC/B,iBACA,GAAG,eAAe;AAExB,YAAO,IAAI,IAAI,QAAQ,IAAI,CAAC;QAC1B,GACJ,IAAI,IAAI,QAAQ,IAAI,CAAC;IAC3B,MAAM,cACJ,QAAQ,QAAQ,IAAI,OAAO,IAAI,IAAI,IAAI,QAAQ,IAAI,CAAC;IACtD,MAAM,gBAAgB,GAAG,SAAS,IAAI;IACtC,MAAMA,SAAO,YAAY,cAAc,GACnC,IAAI,IAAI,cAAc,CAAC,OACvB;AACJ,QAAI,CAAC,YAAY,aAAa,CAC5B,QAAO;IAET,MAAM,YAAY,IAAI,IAAI,aAAa;AACvC,WACE,UAAU,SAASA,UAAQ,UAAU,aAAa;OAElD,GACJ,EAAE,MAAM,iBAA0B,GAClC,EAAE,MAAM,SAAkB;GAElC,MAAM,0BAA0B,MAAM,GAAG,IACvC,GAAG,MAAM,iBAAiB,gBAAgB,MAAM;IAC9C,oBAAoB,IAAI,SAAS,iBAAiB,EAAE,QAAQ,KAAK,CAAC;IAClE,qBAAqB,IAAI,SAAS,kBAAkB,EAAE,QAAQ,KAAK,CAAC;IACpE,qBAAqB,IAAI,SAAS,kBAAkB,EAAE,QAAQ,KAAK,CAAC;IACpE,aAAa;IACd,CAAC,CACH;AACD,OAAI,4BAA4B,KAC9B,QAAO;GAGT,MAAM,OAAO,MAAM,GAAG,IACpB,GAAG,QACD,YAAY;IACV,MAAM,SAAS,MAAM,QAAQ,MAAM;AACnC,QAAI,OAAO,WAAW,YAAY,WAAW,KAC3C,QAAO;AAET,WAAO;OAER,WAAW,cACN,KACP,CACF;AACD,OAAI,SAAS,KACX,QAAO,IAAI,SAAS,wBAAwB,EAAE,QAAQ,KAAK,CAAC;GAG9D,MAAM,SAAS,KAAK;GACpB,MAAM,OACJ,OAAO,KAAK,SAAS,YAAY,KAAK,SAAS,OAC1C,KAAK,OACN,EAAE;GAER,MAAM,iBACJ,WAAW,gBACP,EAAE,QAAQ,gBAAyB,GACnC,WAAW,iBACT,EAAE,QAAQ,eAAwB,GAClC;AAER,OAAI,mBAAmB,KACrB,QAAO,IAAI,SAAS,kBAAkB,EAAE,QAAQ,KAAK,CAAC;GAGxD,MAAM,OAAO,QAAQ,QAAQ,IAAI,OAAO,IAAI,IAAI,IAAI,QAAQ,IAAI,CAAC;GACjE,MAAM,iBAAiB,iBACrB,QAAQ,QAAQ,IAAI,SAAS,EAC7B,MACA,gBACD;AAED,UAAO,GAAG,IACR,GAAG,MAAM,gBAAgB,eAAe,QAAQ;IAC9C,eAAe,MACb,GAAG,KAAK;KACN,IAAI,YAAY;MACd,MAAM,kBACJ,KAAK,iBAAiB,SAClB,EAAE,MAAM,eAAwB,GAChC,eAAe,iBAAiB,OAC9B,EAAE,MAAM,iCAA0C,GAClD;OACE,MAAM;OACN,cAAc,eAAe;OAC9B;MAET,MAAM,kBAAkB,MAAM,GAAG,IAC/B,GAAG,MAAM,iBAAiB,gBAAgB,MAAM;OAC9C,aAAa,YAAY;OACzB,0BAA0B,OAAO,EAAE,mBAAmB;AACpD,aAAK,eAAe;AACpB,eAAO;;OAET,+BAA+B,YAAY;QACzC,MAAM,eAAe,eAAe;QACpC,MAAM,eACJ,iBAAiB,OACb,OACA,MAAM,GAAG,IACP,GAAG,QACD,YACE,UAAwB,aAAa,GACtC,YAAY,eACP,KACP,CACF;QACP,MAAM,gBACJ,iBAAiB,QACjB,cAAc,QAAQ,UACtB,aAAa,QAAQ,UACrB,gBAAgB,IACd,gBAAgB,aAAa,IAAI,CAClC,IACD,aAAa,MAAM,MAAO,KAAK,KAAK,GAChC;SACE,MAAM;SACN,OAAO;SACR,GACD,EAAE,MAAM,gBAAyB;AACvC,eAAO,MAAM,GAAG,IACd,GAAG,MAAM,eAAe,cAAc,MAAM;SAC1C,aAAa,EAAE,YACb,IAAI,SACF,KAAK,UAAU,EACb,QAAQ;UACN;UACA,cAAc;UACf,EACF,CAAC,EACF;UACE,QAAQ;UACR,SAAS,EACP,gBAAgB,oBACjB;UACF,CACF;SACH,oBACE,IAAI,SAAS,KAAK,UAAU,EAAE,QAAQ,MAAM,CAAC,EAAE;UAC7C,QAAQ;UACR,SAAS,EACP,gBAAgB,oBACjB;UACF,CAAC;SACL,CAAC,CACH;;OAEJ,CAAC,CACH;MACD,MAAM,kBACJ,oBAAoB,OAChB;OACE,MAAM;OACN,UAAU;OACX,GACD,EAAE,MAAM,YAAqB;MACnC,MAAM,4BAA4B,MAAM,GAAG,IACzC,GAAG,MAAM,iBAAiB,gBAAgB,MAAM;OAC9C,eAAe,EAAE,eAAe;OAChC,gBAAgB;OACjB,CAAC,CACH;AACD,UAAI,8BAA8B,KAChC,QAAO;MAGT,MAAM,SAAS,IAAI,iBAAiB,UAAU;MAC9C,MAAM,eACJ,KAAK,iBAAiB,UACtB,KAAK,QAAQ,SAAS,UACtB,eAAe,UAAU,OACrB;OACE,MAAM;OACN,OAAO,eAAe;OACvB,GACD,EAAE,MAAM,YAAqB;AACnC,YAAM,GAAG,IACP,GAAG,MAAM,cAAc,aAAa,MAAM;OACxC,aAAa,EAAE,YAAY;AACzB,eAAO,QAAQ,MAAM;;OAEvB,gBAAgB;OACjB,CAAC,CACH;AACD,aAAO,GAAG,IACR,GAAG,KAAK;OACN,UAAU,OAAO,OAAO,iBAAiB,KAAK;OAC9C,MAAM,UAAU;OACjB,CAAC,CAAC,KACD,GAAG,KAAK;OACN,KAAK,WACH,GAAG,IACD,GAAG,MAAM,QAAQ,OAAO,MAAM;QAC5B,WAAW,mBAAmB;SAC5B,MAAM,WAAW,IAAI,SACnB,KAAK,UAAU;UACb,MAAM;UACN,UAAU,eAAe;UACzB,UAAU,eAAe;UAC1B,CAAC,EACF;UACE,QAAQ;UACR,SAAS,EACP,gBAAgB,oBACjB;UACF,CACF;AACD,cAAK,MAAM,SAAS,qBAClB;UACE,GAAG;UACH,UAAU,eAAe;UAC1B,EACD,MACA,cACA,gBACD,CACC,UAAS,QAAQ,OAAO,cAAc,MAAM;AAE9C,gBAAO,GAAG,QAAQ,SAAS;;QAE7B,WAAW,mBAAmB;SAC5B,MAAM,WAAW,IAAI,SACnB,KAAK,UAAU;UACb,MAAM;UACN,QACE,eAAe,WAAW,OACtB,OACA;WACE,OAAO,eAAe,OAAO;WAC7B,cAAc;WACf;UACR,CAAC,EACF;UACE,QAAQ;UACR,SAAS,EACP,gBAAgB,oBACjB;UACF,CACF;AACD,cAAK,MAAM,SAAS,qBAClB;UACE,OAAO,eAAe,QAAQ,SAAS;UACvC,cACE,eAAe,QAAQ,gBAAgB;UACzC,UAAU;UACX,EACD,MACA,cACA,gBACD,CACC,UAAS,QAAQ,OAAO,cAAc,MAAM;AAE9C,gBAAO,GAAG,QAAQ,SAAS;;QAE7B,UAAU,kBACR,GAAG,QACD,IAAI,SAAS,KAAK,UAAU,cAAc,EAAE;SAC1C,QAAQ;SACR,SAAS,EACP,gBAAgB,oBACjB;SACF,CAAC,CACH;QACH,iBAAiB,yBACf,GAAG,QACD,IAAI,SACF,KAAK,UAAU,qBAAqB,EACpC;SACE,QAAQ;SACR,SAAS,EACP,gBAAgB,oBACjB;SACF,CACF,CACF;QACH,eAAe,uBACb,GAAG,QACD,IAAI,SACF,KAAK,UAAU,mBAAmB,EAClC;SACE,QAAQ;SACR,SAAS,EACP,gBAAgB,oBACjB;SACF,CACF,CACF;QACH,YAAY,oBACV,GAAG,QACD,IAAI,SAAS,KAAK,UAAU,gBAAgB,EAAE;SAC5C,QAAQ;SACR,SAAS,EACP,gBAAgB,oBACjB;SACF,CAAC,CACH;QACH,aAAa,qBACX,GAAG,QACD,IAAI,SAAS,KAAK,UAAU,iBAAiB,EAAE;SAC7C,QAAQ;SACR,SAAS,EACP,gBAAgB,oBACjB;SACF,CAAC,CACH;QACJ,CAAC,CACH;OACH,MAAM,UAAmB;QACvB,MAAM,YACJ,iBAAiB,eACjB,OAAO,MAAM,SAAS,YACtB,MAAM,SAAS,QACf,UAAU,MAAM,OACZ;SACE,OACG,MAAM,KACJ,WAAW,OAAO,MAAM;SAC7B,WAAW,MAAM;SAClB,GACD,EACE,OACE,iBAAiB,QACb,MAAM,UACN,OAAO,MAAM,EACpB;QACP,MAAM,WAAW,IAAI,SACnB,KAAK,UAAU,UAAU,EACzB;SACE,QAAQ;SACR,SAAS,EACP,gBAAgB,oBACjB;SACF,CACF;QACD,MAAM,eACJ,KAAK,iBAAiB,UACtB,iBAAiB,eACjB,OAAO,MAAM,SAAS,YACtB,MAAM,SAAS,QACd,MAAM,KAAiC,SACtC;AACJ,aAAK,MAAM,SAAS,qBAClB;SACE,OAAO,eAAe,OAAO,eAAe;SAC5C,cAAc,eACV,OACA,eAAe;SACnB,UAAU;SACX,EACD,MACA,cACA,gBACD,CACC,UAAS,QAAQ,OAAO,cAAc,MAAM;AAE9C,eAAO;;OAEV,CAAC,CACH,CACF;;KAEH,MAAM,MAAM;KACb,CAAC;IACJ,cAAc,MACZ,GAAG,KAAK;KACN,IAAI,YAAY;AACd,YAAM,GAAG,IACP,GAAG,KAAK;OACN,iBACS;QACL,MAAM,SAAS,IAAI,iBAAiB,UAAU;AAC9C,YAAI,eAAe,UAAU,KAC3B,QAAO,QAAQ,eAAe,MAAM;AAEtC,eAAO,OAAO,OAAO,iBAAiB;WACpC;OACN,MAAM,UAAU;OACjB,CAAC,CAAC,KACD,GAAG,SAAS,UAAmB;AAC7B,eAAQ,MACN,8CACA,MACD;OACD,MAAM,mBACJ,eAAe,iBAAiB,OAC5B;QACE,MAAM;QACN,cAAc,eAAe;QAC9B,GACD,EAAE,MAAM,gBAAyB;AACvC,cAAO,GAAG,MAAM,kBAAkB,iBAAiB,MAAM;QACvD,kBAAkB,EAAE,mBAClB,GAAG,KAAK;SACN,IAAI,YAAY;UAId,MAAM,YAAa,MAHG,IAAI,iBACxB,UACD,CACsC,OACrC,iBACA,EACE,cACD,CACF;UACD,MAAM,kBAAkB,MAAM,GAAG,IAC/B,GAAG,MAAM,WAAW,UAAU,MAAM;WAClC,WAAW,mBACT,GAAG,QAAQ,eAAe,OAAO;WACnC,gBACE,GAAG,sBACD,IAAI,MACF,6DACD,CACF;WACH,eACE,GAAG,sBACD,IAAI,MACF,6DACD,CACF;WACH,sBACE,GAAG,sBACD,IAAI,MACF,6DACD,CACF;WACH,oBACE,GAAG,sBACD,IAAI,MACF,6DACD,CACF;WACH,iBACE,GAAG,sBACD,IAAI,MACF,6DACD,CACF;WACH,kBACE,GAAG,sBACD,IAAI,MACF,6DACD,CACF;WACJ,CAAC,CACH;UACD,MAAM,0BACJ,oBAAoB,OAChB;WACE,MAAM;WACN,OAAO,gBAAgB;WACxB,GACD,EAAE,MAAM,wBAAiC;AAC/C,gBAAM,GAAG,IACP,GAAG,MACD,yBACA,wBAAwB,MACxB;WACE,uBAAuB,EAAE,YACvB,GAAG,KAAK;YACN,IAAI,YAAY;aACd,MAAM,SAAS,IAAI,iBACjB,UACD;AACD,oBAAO,QAAQ,MAAM;AACrB,mBAAM,OAAO,OAAO,iBAAiB;;YAEvC,MAAM,YAAUC;YACjB,CAAC;WACJ,4BAA4B,GAAG,QAAQ,OAAU;WAClD,CACF,CACF;;SAEH,MAAM,kBAAkB;SACzB,CAAC,CAAC,KACD,GAAG,SAAS,kBAA2B;AACrC,iBAAQ,MACN,uDACA,cACD;AACD,gBAAO,GAAG,QAAQ,OAAU;UAC5B,CACH;QACH,oBAAoB,GAAG,QAAQ,OAAU;QAC1C,CAAC;QACF,EACF,GAAG,UAAU,OAAU,CACxB,CACF;MACD,MAAM,WAAW,IAAI,SAAS,KAAK,UAAU,KAAK,EAAE;OAClD,QAAQ;OACR,SAAS,EACP,gBAAgB,oBACjB;OACF,CAAC;AACF,WAAK,MAAM,SAAS,qBAClB;OACE,OAAO;OACP,cAAc;OACd,UAAU;OACX,EACD,MACA,cACA,gBACD,CACC,UAAS,QAAQ,OAAO,cAAc,MAAM;AAE9C,aAAO;;KAET,MAAM,MAAM;KACb,CAAC;IACL,CAAC,CACH;;EAgBH,MAAM,QAAQ,SAA0C;GACtD,MAAM,OAAO,QAAQ,QAAQ,IAAI,OAAO,IAAI,IAAI,IAAI,QAAQ,IAAI,CAAC;GACjE,MAAM,iBAAiB,iBACrB,QAAQ,QAAQ,IAAI,SAAS,EAC7B,MACA,gBACD;GACD,MAAM,eAAe,eAAe;GAGpC,MAAM,eAAe,QAAQ,QAAQ,IAAI,SAAS;GAClD,MAAM,uBAAuB,QAAQ,QAAQ,IAAI,oBAAoB;GACrE,MAAM,WACJ,yBAAyB,cACd;IACL,MAAM,iBAAiB,qBAAqB,MAAM,IAAI,CAAC,IAAI,MAAM;AACjE,QAAI,mBAAmB,UAAa,eAAe,SAAS,EAC1D,QAAO,eAAe,SAAS,IAAI,GAC/B,iBACA,GAAG,eAAe;AAExB,WAAO,IAAI,IAAI,QAAQ,IAAI,CAAC;OAC1B,GACJ,IAAI,IAAI,QAAQ,IAAI,CAAC;GAC3B,MAAM,cACJ,QAAQ,QAAQ,IAAI,OAAO,IAAI,IAAI,IAAI,QAAQ,IAAI,CAAC;GACtD,MAAM,gBAAgB,GAAG,SAAS,IAAI;GACtC,MAAM,iBAAiB,YAAY,cAAc,GAC7C,IAAI,IAAI,cAAc,CAAC,OACvB;GACJ,MAAM,YACJ,iBAAiB,QAAQ,YAAY,aAAa,GAC9C,IAAI,IAAI,aAAa,GACrB;GAMN,MAAM,eAJJ,iBAAiB,SAChB,cAAc,QACb,UAAU,SAAS,kBACnB,UAAU,aAAa,YAEvB,EAAE,MAAM,eAAwB,GAChC,EAAE,MAAM,cAAuB;GACnC,MAAM,oBAAoB,MAAM,GAAG,IACjC,GAAG,MAAM,cAAc,aAAa,MAAM;IACxC,oBACG;KACC,UAAU;KACV,SAAS,EAAE;KACX,OAAO;KACR;IACH,kBAAkB;IACnB,CAAC,CACH;AACD,OAAI,sBAAsB,KACxB,QAAO;GAIT,MAAM,aAAa,IAAI,IAAI,QAAQ,IAAI;GACvC,MAAM,OAAO,WAAW,aAAa,IAAI,OAAO;GAChD,MAAM,mBACJ,QAAQ,qBAAqB,SACzB,OACA,OAAO,QAAQ,qBAAqB,aAClC,MAAM,QAAQ,iBAAiB,QAAQ,GACvC,QAAQ;GAEhB,MAAM,uBACJ,SAAS,QACT,QAAQ,WAAW,SACnB,QAAQ,QAAQ,IAAI,SAAS,EAAE,SAAS,YAAY,IACpD,mBACI;IAAE,MAAM;IAAqB;IAAM,GACnC,EAAE,MAAM,QAAiB;GAC/B,MAAM,qBAAqB,MAAM,GAAG,IAClC,GAAG,MAAM,sBAAsB,qBAAqB,MAAM;IACxD,UAAU,OAAO,EACf,MAAM,uBACsB;KAC5B,MAAM,cAAc,IAAI,IAAI,WAAW,UAAU,CAAC;AAClD,YAAO,GAAG,IACR,GAAG,KAAK;MACN,IAAI,YAAY;OAEd,MAAM,SAAU,MADD,IAAI,iBAAiB,UAAU,CACjB,OAAO,iBAAiB;QACnD,QAAQ,EAAE,MAAM,kBAAkB;QAClC,UAAU,eAAe,YAAY;QACtC,CAAC;AA2CF,cAAO;QAAE,MAAM;QAAqB,QA1CrB,MAAM,GAAG,IACtB,GAAG,MAAM,QAAQ,OAAO,MAAM;SAC5B,WAAW,mBACT,GAAG,QAAQ,eAAe,OAAO;SACnC,gBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;SACH,eACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;SACH,sBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;SACH,oBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;SACH,iBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;SACH,kBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;SACJ,CAAC,CACH;QAC2C;;MAE9C,MAAM,UAAU;MACjB,CAAC,CAAC,KACD,GAAG,KAAK;MACN,KAAK,WAA0B;AAC7B,mBAAY,aAAa,OAAO,OAAO;OACvC,MAAM,UAAU,sBACd;QACE,OAAO,OAAO,QAAQ,SAAS;QAC/B,cAAc,OAAO,QAAQ,gBAAgB;QAC7C,UAAU;QACX,EACD,MACA,cACA,gBACD;AACD,cAAO;QACL,UAAU;QACV,UAAU,sBACR,YAAY,UAAU,EACtB,QACD;QACF;;MAEH,MAAM,UAAkC;AACtC,eAAQ,MACN,6CACA,MACD;OACD,MAAM,YACJ,iBAAiB,eACjB,OAAO,MAAM,SAAS,YACtB,MAAM,SAAS,QACf,OAAQ,MAAM,KAAiC,SAC7C,WACI,MAAM,KACL,OACH;AASN,WAAI,EAPF,cAAc,yBACd,cAAc,0BACd,cAAc,4BACd,cAAc,2BACd,cAAc,4BACd,cAAc,sBACd,cAAc,6BAEd,QAAO;QACL,UAAU;QACV,SAAS,EAAE;QACX,OAAO,eAAe;QACvB;AAEH,mBAAY,aAAa,OAAO,OAAO;OACvC,MAAM,UAAU,sBACd;QACE,OAAO,eAAe;QACtB,cAAc,eAAe;QAC7B,UAAU;QACX,EACD,MACA,cACA,gBACD;AACD,cAAO;QACL,UAAU;QACV,UAAU,sBACR,YAAY,UAAU,EACtB,QACD;QACF;;MAEJ,CAAC,CACH,CACF;;IAEH,MAAM,YAAY;IACnB,CAAC,CACH;GACD,MAAM,uBACJ,uBAAuB,OACnB;IAAE,MAAM;IAAiB,QAAQ;IAAoB,GACrD,EAAE,MAAM,YAAqB;GACnC,MAAM,0BAA0B,MAAM,GAAG,IACvC,GAAG,MAAM,sBAAsB,qBAAqB,MAAM;IACxD,OAAO,EAAE,aAAa;IACtB,gBAAgB;IACjB,CAAC,CACH;AACD,OAAI,4BAA4B,KAC9B,QAAO;GAIT,MAAM,SAAS,MAAM,GAAG,IACtB,GAAG,IAAI,aAAa;IAClB,MAAM,EAAE,OAAO,iBAAiB;IAKhC,MAAM,gCAFJ,iBAAiB,SAChB,aAAa,MAAM,CAAC,WAAW,KAAK,iBAAiB,WAEpD,EAAE,MAAM,aAAsB,GAC9B,EAAE,MAAM,MAAe;IAC3B,MAAM,8BAA8B,OAAO,GAAG,MAC5C,+BACA,8BAA8B,MAC9B;KACE,iBAAiB;AACf,UAAI,QACF,SAAQ,MACN,oBAAG,IAAI,MAAM,EAAC,aAAa,CAAC,6EAC7B;AAEH,aAAO;;KAET,UAAU;KACX,CACF;AACD,QAAI,gCAAgC,OAClC,QAAO;IAGT,MAAM,eACJ,UAAU,OACN,OACA,OAAO,GAAG,QACR,YAAY,UAAwB,MAAM,GACzC,YAAY,eACP,KACP;IACP,MAAM,iBACJ,cAAc,QAAQ,UACtB,CAAC,gBAAgB,IAAI,gBAAgB,aAAa,IAAI,CAAC,GACnD,EAAE,MAAM,kBAA2B,GACnC,EAAE,MAAM,YAAqB;IACnC,MAAM,eAAe,OAAO,GAAG,MAC7B,gBACA,eAAe,MACf;KACE,sBAAsB;AACpB,UAAI,QACF,SAAQ,MACN,oBAAG,IAAI,MAAM,EAAC,aAAa,CAAC,2EAC7B;AAEH,aAAO;;KAET,gBAAgB;KACjB,CACF;AACD,QAAI,iBAAiB,OACnB,QAAO;IAGT,MAAM,aACJ,UAAU,OACN,iBAAiB,OACf,EAAE,MAAM,QAAiB,GACzB;KAAE,MAAM;KAAwB;KAAc,GAChD,iBAAiB,OACf;KAAE,MAAM;KAAuB;KAAO,GACtC;KAAE,MAAM;KAAiB;KAAO;KAAc;AAEtD,WAAO,OAAO,GAAG,MAAM,YAAY,WAAW,MAAM;KAClD,YAAY;AACV,UAAI,QACF,SAAQ,MACN,oBAAG,IAAI,MAAM,EAAC,aAAa,CAAC,+DAC7B;AAEH,aAAO,GAAG,QAAQ,OAAU;;KAE9B,cAAc,EAAE,cAAc,wBAAwB;AACpD,UAAI,QACF,SAAQ,MACN,oBAAG,IAAI,MAAM,EAAC,aAAa,CAAC,sFAC7B;AAEH,aAAO,GAAG,KAAK;OACb,IAAI,YAAY;QAEd,MAAM,SAAU,MADD,IAAI,iBAAiB,UAAU,CACjB,OAAO,iBAAiB,EACnD,cAAc,mBACf,CAAC;QACF,MAAMC,WAAS,MAAM,GAAG,IACtB,GAAG,MAAM,QAAQ,OAAO,MAAM;SAC5B,WAAW,mBACT,GAAG,QAAQ,eAAe,OAAO;SACnC,gBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;SACH,eACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;SACH,sBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;SACH,oBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;SACH,iBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;SACH,kBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;SACJ,CAAC,CACH;AACD,YAAI,QACF,SAAQ,MACN,oBAAG,IAAI,MAAM,EAAC,aAAa,CAAC,+CAA+CA,aAAW,OACvF;AAEH,eAAOA;;OAET,MAAM,UAAU;OACjB,CAAC,CAAC,KACD,GAAG,SAAS,UAAmB;AAC7B,eAAQ,MACN,sDACA,MACD;AASD,YAPE,iBAAiB,eACjB,OAAO,MAAM,SAAS,YACtB,MAAM,SAAS,QACf,OAAQ,MAAM,KAAiC,SAC7C,WACI,MAAM,KAAiC,OACzC,UACY,yBAAyB;AACzC,YAAI,QACF,SAAQ,MACN,oBAAG,IAAI,MAAM,EAAC,aAAa,CAAC,qEAC7B;AAEH,eAAO,GAAG,QACR,KAID;;AAEH,WAAI,QACF,SAAQ,MACN,oBAAG,IAAI,MAAM,EAAC,aAAa,CAAC,iFAC7B;AAEH,cAAO,GAAG,QACR,OAID;QACD,CACH;;KAEH,kBAAkB;MAChB,MAAM,qBACJ,cAAc,QAAQ,UACtB,aAAa,QAAQ,UACrB,gBAAgB,IAAI,gBAAgB,aAAa,IAAI,CAAC,IACtD,aAAa,MAAM,MAAO,KAAK,KAAK,GAChC,EAAE,MAAM,eAAwB,GAChC,EAAE,MAAM,iBAA0B;AACxC,aAAO,GAAG,MAAM,oBAAoB,mBAAmB,MAAM;OAC3D,mBAAmB;AACjB,YAAI,QACF,SAAQ,MACN,oBAAG,IAAI,MAAM,EAAC,aAAa,CAAC,iFAC7B;AAEH,eAAO,GAAG,QAAQ,OAAU;;OAE9B,qBAAqB;AACnB,YAAI,QACF,SAAQ,MACN,oBAAG,IAAI,MAAM,EAAC,aAAa,CAAC,uFAC7B;AAEH,eAAO,GAAG,QAAQ,KAAK;;OAE1B,CAAC;;KAEJ,OAAO,EAAE,cAAc,wBAAwB;MAC7C,MAAM,qBASJ,cAAc,QAAQ,UACtB,aAAa,QAAQ,SACjB,EAAE,MAAM,eAAwB,GAChC;OACE,MAAM;OACQ;OAIf;AACP,aAAO,GAAG,MAAM,oBAAoB,mBAAmB,MAAM;OAC3D,mBAAmB;AACjB,YAAI,QACF,SAAQ,MACN,oBAAG,IAAI,MAAM,EAAC,aAAa,CAAC,wFAC7B;AAEH,eAAO,GAAG,KAAK;SACb,IAAI,YAAY;UAEd,MAAM,SAAU,MADD,IAAI,iBAAiB,UAAU,CACjB,OAAO,iBAAiB,EACnD,cAAc,mBACf,CAAC;UACF,MAAMA,WAAS,MAAM,GAAG,IACtB,GAAG,MAAM,QAAQ,OAAO,MAAM;WAC5B,WAAW,mBACT,GAAG,QAAQ,eAAe,OAAO;WACnC,gBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;WACH,eACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;WACH,sBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;WACH,oBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;WACH,iBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;WACH,kBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;WACJ,CAAC,CACH;AACD,cAAI,QACF,SAAQ,MACN,oBAAG,IAAI,MAAM,EAAC,aAAa,CAAC,+CAA+CA,aAAW,OACvF;AAEH,iBAAOA;;SAET,MAAM,UAAU;SACjB,CAAC,CAAC,KACD,GAAG,SAAS,UAAmB;AAC7B,iBAAQ,MACN,sDACA,MACD;AAUD,cARE,iBAAiB,eACjB,OAAO,MAAM,SAAS,YACtB,MAAM,SAAS,QACf,OAAQ,MAAM,KAAiC,SAC7C,WACI,MAAM,KACL,OACH,UACY,yBAAyB;AACzC,cAAI,QACF,SAAQ,MACN,oBAAG,IAAI,MAAM,EAAC,aAAa,CAAC,qEAC7B;AAEH,iBAAO,GAAG,QACR,KAID;;AAEH,aAAI,QACF,SAAQ,MACN,oBAAG,IAAI,MAAM,EAAC,aAAa,CAAC,iFAC7B;AAEH,gBAAO,GAAG,QACR,OAID;UACD,CACH;;OAEH,UAAU,EAAE,cAAc,yBAAyB;QACjD,MAAM,uBACJ,mBAAmB,MAAM,MACzB,mBAAmB,MAAM;QAC3B,MAAM,oBACJ,KAAK,KAAK,GACV,KAAK,IACH,4BACA,KAAK,IACH,oCACA,uBAAuB,GACxB,CACF;QACH,MAAM,qBACJ,mBAAmB,MAAM,MAAO,oBAC5B,EAAE,MAAM,eAAwB,GAChC,EAAE,MAAM,WAAoB;AAClC,eAAO,GAAG,MAAM,oBAAoB,mBAAmB,MAAM;SAC3D,mBAAmB;AACjB,cAAI,QACF,SAAQ,MACN,oBAAG,IAAI,MAAM,EAAC,aAAa,CAAC,iEAC7B;AAEH,iBAAO,GAAG,QAAQ,OAAU;;SAE9B,eACE,GAAG,KAAK;UACN,IAAI,YAAY;WAEd,MAAM,SAAU,MADD,IAAI,iBAAiB,UAAU,CACjB,OAAO,iBAAiB,EACnD,cAAc,mBACf,CAAC;WACF,MAAMA,WAAS,MAAM,GAAG,IACtB,GAAG,MAAM,QAAQ,OAAO,MAAM;YAC5B,WAAW,mBACT,GAAG,QAAQ,eAAe,OAAO;YACnC,gBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;YACH,eACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;YACH,sBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;YACH,oBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;YACH,iBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;YACH,kBACE,GAAG,sBACD,IAAI,MACF,iDACD,CACF;YACJ,CAAC,CACH;AACD,eAAI,QACF,SAAQ,MACN,oBAAG,IAAI,MAAM,EAAC,aAAa,CAAC,+CAA+CA,aAAW,OACvF;AAEH,kBAAOA;;UAET,MAAM,UAAU;UACjB,CAAC,CAAC,KACD,GAAG,SAAS,UAAmB;AAC7B,kBAAQ,MACN,sDACA,MACD;AAUD,eARE,iBAAiB,eACjB,OAAO,MAAM,SAAS,YACtB,MAAM,SAAS,QACf,OAAQ,MAAM,KACX,SAAS,WACN,MAAM,KACL,OACH,UACY,yBAAyB;AACzC,eAAI,QACF,SAAQ,MACN,oBAAG,IAAI,MAAM,EAAC,aAAa,CAAC,qEAC7B;AAEH,kBAAO,GAAG,QACR,KAID;;AAEH,cAAI,QACF,SAAQ,MACN,oBAAG,IAAI,MAAM,EAAC,aAAa,CAAC,iFAC7B;AAEH,iBAAO,GAAG,QACR,OAID;WACD,CACH;SACJ,CAAC;;OAEL,CAAC;;KAEL,CAAC;KACF,CACH;AACD,OAAI,WAAW,OACb,QAAO;IAAE,UAAU;IAAO,SAAS,EAAE;IAAE,OAAO;IAAc;AAG9D,UAAO;IACL,UAAU;IACV,SAAS,sBACP;KACE,OAAO,QAAQ,SAAS;KACxB,cAAc,QAAQ,gBAAgB;KACtC,UAAU;KACX,EACD,MACA,cACA,gBACD;IACD,OAAO,QAAQ,SAAS;IACzB;;EAEJ"}

package/dist/server/templates.d.ts

@@ -1,21 +1 @@
-//#region src/server/templates.d.ts
-/**
- * Default email templates generated by the Auth library.
- *
- * These are used when the library sends emails on behalf of the developer
- * (for example magic links). The developer provides the transport via
- * `email.send`; the library provides the content.
- *
- * @module
- */
-/**
- * Default magic link email template.
- *
- * Clean, minimal design that works across email clients.
- * Used by the auto-registered `email` provider when `email` is
- * configured in the Auth constructor.
- */
-declare function defaultMagicLinkEmail(url: string, host: string): string;
-//#endregion
-export { defaultMagicLinkEmail };
-//# sourceMappingURL=templates.d.ts.map
+export { };

package/dist/server/templates.js

@@ -13,8 +13,9 @@
 *
 * Clean, minimal design that works across email clients.
 * Used by the auto-registered `email` provider when `email` is
-* configured in the Auth constructor.
+* configured in `createAuth(...)`.
 */
+/** @internal */
 function defaultMagicLinkEmail(url, host) {
 	const escapedHost = host.replace(/[&<>"']/g, (c) => ({
 		"&": "&amp;",

package/dist/server/templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"templates.js","names":[],"sources":["../../src/server/templates.ts"],"sourcesContent":["/**\n * Default email templates generated by the Auth library.\n *\n * These are used when the library sends emails on behalf of the developer\n * (for example magic links). The developer provides the transport via\n * `email.send`; the library provides the content.\n *\n * @module\n */\n\n/**\n * Default magic link email template.\n *\n * Clean, minimal design that works across email clients.\n * Used by the auto-registered `email` provider when `email` is\n * configured in the Auth constructor.\n */\nexport function defaultMagicLinkEmail(url: string, host: string): string {\n  const escapedHost = host.replace(/[&<>\"']/g, (c) =>\n    ({ \"&\": \"&amp;\", \"<\": \"&lt;\", \">\": \"&gt;\", '\"': \"&quot;\", \"'\": \"&#39;\" })[c]!,\n  );\n\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\" />\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n  <title>Sign in to ${escapedHost}</title>\n</head>\n<body style=\"margin:0;padding:0;background-color:#f9fafb;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;\">\n  <table role=\"presentation\" width=\"100%\" cellpadding=\"0\" cellspacing=\"0\" style=\"background-color:#f9fafb;padding:40px 16px;\">\n    <tr>\n      <td align=\"center\">\n        <table role=\"presentation\" width=\"480\" cellpadding=\"0\" cellspacing=\"0\" style=\"background-color:#ffffff;border:1px solid #e5e7eb;border-radius:8px;overflow:hidden;\">\n          <tr>\n            <td style=\"padding:32px 32px 0 32px;text-align:center;\">\n              <h1 style=\"margin:0 0 8px 0;font-size:20px;font-weight:600;color:#111827;line-height:1.3;\">\n                Sign in to ${escapedHost}\n              </h1>\n            </td>\n          </tr>\n          <tr>\n            <td style=\"padding:24px 32px;\">\n              <p style=\"margin:0 0 24px 0;font-size:15px;line-height:1.6;color:#4b5563;text-align:center;\">\n                Click the button below to sign in. This link will expire shortly.\n              </p>\n              <table role=\"presentation\" width=\"100%\" cellpadding=\"0\" cellspacing=\"0\">\n                <tr>\n                  <td align=\"center\" style=\"padding:0 0 24px 0;\">\n                    <a href=\"${url}\" target=\"_blank\" style=\"display:inline-block;background-color:#111827;color:#ffffff;font-size:15px;font-weight:600;text-decoration:none;padding:12px 32px;border-radius:6px;line-height:1;\">\n                      Sign in\n                    </a>\n                  </td>\n                </tr>\n              </table>\n              <p style=\"margin:0 0 12px 0;font-size:13px;line-height:1.6;color:#9ca3af;\">\n                If the button doesn't work, copy and paste this URL into your browser:\n              </p>\n              <p style=\"margin:0;font-size:13px;line-height:1.5;color:#6b7280;word-break:break-all;\">\n                ${url}\n              </p>\n            </td>\n          </tr>\n          <tr>\n            <td style=\"padding:20px 32px;border-top:1px solid #e5e7eb;\">\n              <p style=\"margin:0;font-size:12px;line-height:1.5;color:#9ca3af;text-align:center;\">\n                If you didn't request this email, you can safely ignore it.\n              </p>\n            </td>\n          </tr>\n        </table>\n      </td>\n    </tr>\n  </table>\n</body>\n</html>`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,SAAgB,sBAAsB,KAAa,MAAsB;CACvE,MAAM,cAAc,KAAK,QAAQ,aAAa,OAC3C;EAAE,KAAK;EAAS,KAAK;EAAQ,KAAK;EAAQ,MAAK;EAAU,KAAK;EAAS,EAAE,GAC3E;AAED,QAAO;;;;;sBAKa,YAAY;;;;;;;;;;6BAUL,YAAY;;;;;;;;;;;;+BAYV,IAAI;;;;;;;;;;kBAUjB,IAAI"}
+{"version":3,"file":"templates.js","names":[],"sources":["../../src/server/templates.ts"],"sourcesContent":["/**\n * Default email templates generated by the Auth library.\n *\n * These are used when the library sends emails on behalf of the developer\n * (for example magic links). The developer provides the transport via\n * `email.send`; the library provides the content.\n *\n * @module\n */\n\n/**\n * Default magic link email template.\n *\n * Clean, minimal design that works across email clients.\n * Used by the auto-registered `email` provider when `email` is\n * configured in `createAuth(...)`.\n */\n/** @internal */\nexport function defaultMagicLinkEmail(url: string, host: string): string {\n  const escapedHost = host.replace(\n    /[&<>\"']/g,\n    (c) =>\n      ({ \"&\": \"&amp;\", \"<\": \"&lt;\", \">\": \"&gt;\", '\"': \"&quot;\", \"'\": \"&#39;\" })[\n        c\n      ]!,\n  );\n\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\" />\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n  <title>Sign in to ${escapedHost}</title>\n</head>\n<body style=\"margin:0;padding:0;background-color:#f9fafb;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;\">\n  <table role=\"presentation\" width=\"100%\" cellpadding=\"0\" cellspacing=\"0\" style=\"background-color:#f9fafb;padding:40px 16px;\">\n    <tr>\n      <td align=\"center\">\n        <table role=\"presentation\" width=\"480\" cellpadding=\"0\" cellspacing=\"0\" style=\"background-color:#ffffff;border:1px solid #e5e7eb;border-radius:8px;overflow:hidden;\">\n          <tr>\n            <td style=\"padding:32px 32px 0 32px;text-align:center;\">\n              <h1 style=\"margin:0 0 8px 0;font-size:20px;font-weight:600;color:#111827;line-height:1.3;\">\n                Sign in to ${escapedHost}\n              </h1>\n            </td>\n          </tr>\n          <tr>\n            <td style=\"padding:24px 32px;\">\n              <p style=\"margin:0 0 24px 0;font-size:15px;line-height:1.6;color:#4b5563;text-align:center;\">\n                Click the button below to sign in. This link will expire shortly.\n              </p>\n              <table role=\"presentation\" width=\"100%\" cellpadding=\"0\" cellspacing=\"0\">\n                <tr>\n                  <td align=\"center\" style=\"padding:0 0 24px 0;\">\n                    <a href=\"${url}\" target=\"_blank\" style=\"display:inline-block;background-color:#111827;color:#ffffff;font-size:15px;font-weight:600;text-decoration:none;padding:12px 32px;border-radius:6px;line-height:1;\">\n                      Sign in\n                    </a>\n                  </td>\n                </tr>\n              </table>\n              <p style=\"margin:0 0 12px 0;font-size:13px;line-height:1.6;color:#9ca3af;\">\n                If the button doesn't work, copy and paste this URL into your browser:\n              </p>\n              <p style=\"margin:0;font-size:13px;line-height:1.5;color:#6b7280;word-break:break-all;\">\n                ${url}\n              </p>\n            </td>\n          </tr>\n          <tr>\n            <td style=\"padding:20px 32px;border-top:1px solid #e5e7eb;\">\n              <p style=\"margin:0;font-size:12px;line-height:1.5;color:#9ca3af;text-align:center;\">\n                If you didn't request this email, you can safely ignore it.\n              </p>\n            </td>\n          </tr>\n        </table>\n      </td>\n    </tr>\n  </table>\n</body>\n</html>`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkBA,SAAgB,sBAAsB,KAAa,MAAsB;CACvE,MAAM,cAAc,KAAK,QACvB,aACC,OACE;EAAE,KAAK;EAAS,KAAK;EAAQ,KAAK;EAAQ,MAAK;EAAU,KAAK;EAAS,EACtE,GAEL;AAED,QAAO;;;;;sBAKa,YAAY;;;;;;;;;;6BAUL,YAAY;;;;;;;;;;;;+BAYV,IAAI;;;;;;;;;;kBAUjB,IAAI"}

package/dist/server/tokens.d.ts

@@ -0,0 +1 @@
+export { };

package/dist/server/tokens.js

@@ -0,0 +1,17 @@
+import { TOKEN_SUB_CLAIM_DIVIDER, generateRandomString, requireEnv } from "./utils.js";
+import { SignJWT, importPKCS8 } from "jose";
+
+//#region src/server/tokens.ts
+const DEFAULT_JWT_DURATION_MS = 1e3 * 60 * 60;
+const TOKEN_JTI_LENGTH = 24;
+const TOKEN_JTI_ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+/** @internal */
+async function generateToken(args, config) {
+	const privateKey = await importPKCS8(requireEnv("JWT_PRIVATE_KEY"), "RS256");
+	const expirationTime = new Date(Date.now() + (config.jwt?.durationMs ?? DEFAULT_JWT_DURATION_MS));
+	return await new SignJWT({ sub: args.userId + TOKEN_SUB_CLAIM_DIVIDER + args.sessionId }).setProtectedHeader({ alg: "RS256" }).setIssuedAt().setJti(generateRandomString(TOKEN_JTI_LENGTH, TOKEN_JTI_ALPHABET)).setIssuer(requireEnv("CONVEX_SITE_URL")).setAudience("convex").setExpirationTime(expirationTime).sign(privateKey);
+}
+
+//#endregion
+export { generateToken };
+//# sourceMappingURL=tokens.js.map

package/dist/server/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","names":[],"sources":["../../src/server/tokens.ts"],"sourcesContent":["import { GenericId } from \"convex/values\";\nimport { SignJWT, importPKCS8 } from \"jose\";\n\nimport { ConvexAuthConfig } from \"./types\";\nimport { generateRandomString, TOKEN_SUB_CLAIM_DIVIDER } from \"./utils\";\nimport { requireEnv } from \"./utils\";\n\nconst DEFAULT_JWT_DURATION_MS = 1000 * 60 * 60; // 1 hour\nconst TOKEN_JTI_LENGTH = 24;\nconst TOKEN_JTI_ALPHABET =\n  \"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789\";\n\n/** @internal */\nexport async function generateToken(\n  args: {\n    userId: GenericId<\"User\">;\n    sessionId: GenericId<\"Session\">;\n  },\n  config: ConvexAuthConfig,\n) {\n  const privateKey = await importPKCS8(requireEnv(\"JWT_PRIVATE_KEY\"), \"RS256\");\n  const expirationTime = new Date(\n    Date.now() + (config.jwt?.durationMs ?? DEFAULT_JWT_DURATION_MS),\n  );\n  return await new SignJWT({\n    sub: args.userId + TOKEN_SUB_CLAIM_DIVIDER + args.sessionId,\n  })\n    .setProtectedHeader({ alg: \"RS256\" })\n    .setIssuedAt()\n    .setJti(generateRandomString(TOKEN_JTI_LENGTH, TOKEN_JTI_ALPHABET))\n    .setIssuer(requireEnv(\"CONVEX_SITE_URL\"))\n    .setAudience(\"convex\")\n    .setExpirationTime(expirationTime)\n    .sign(privateKey);\n}\n"],"mappings":";;;;AAOA,MAAM,0BAA0B,MAAO,KAAK;AAC5C,MAAM,mBAAmB;AACzB,MAAM,qBACJ;;AAGF,eAAsB,cACpB,MAIA,QACA;CACA,MAAM,aAAa,MAAM,YAAY,WAAW,kBAAkB,EAAE,QAAQ;CAC5E,MAAM,iBAAiB,IAAI,KACzB,KAAK,KAAK,IAAI,OAAO,KAAK,cAAc,yBACzC;AACD,QAAO,MAAM,IAAI,QAAQ,EACvB,KAAK,KAAK,SAAS,0BAA0B,KAAK,WACnD,CAAC,CACC,mBAAmB,EAAE,KAAK,SAAS,CAAC,CACpC,aAAa,CACb,OAAO,qBAAqB,kBAAkB,mBAAmB,CAAC,CAClE,UAAU,WAAW,kBAAkB,CAAC,CACxC,YAAY,SAAS,CACrB,kBAAkB,eAAe,CACjC,KAAK,WAAW"}

package/dist/server/totp.d.ts

@@ -0,0 +1 @@
+export { };

package/dist/server/totp.js

@@ -0,0 +1,148 @@
+import { AuthError } from "./authError.js";
+import { userIdFromIdentitySubject } from "./identity.js";
+import { callVerifierSignature } from "./mutations/signature.js";
+import { callSignIn } from "./mutations/signin.js";
+import { callVerifier } from "./mutations/verifier.js";
+import { mutateTotpInsert, mutateTotpMarkVerified, mutateTotpUpdateLastUsed, mutateVerifierDelete, queryTotpById, queryTotpVerifiedByUserId, queryUserById, queryVerifierById } from "./types.js";
+import { Fx } from "@robelest/fx";
+import { encodeBase32LowerCaseNoPadding } from "@oslojs/encoding";
+import { createTOTPKeyURI, verifyTOTPWithGracePeriod } from "@oslojs/otp";
+
+//#region src/server/totp.ts
+/**
+* Server-side TOTP ceremony logic for two-factor authentication.
+*
+* Handles the three phases of the TOTP flow:
+* 1. setup   — generate a TOTP secret and `otpauth://` URI for enrollment
+* 2. confirm — verify the first code from the authenticator app
+* 3. verify  — verify a TOTP code during sign-in (2FA challenge)
+*/
+const TOTP_FLOWS = [
+	"setup",
+	"confirm",
+	"verify"
+];
+const resolveTotpFlowFx = (params) => {
+	const flow = params.flow;
+	return typeof flow === "string" && TOTP_FLOWS.includes(flow) ? Fx.succeed(flow) : Fx.fail(new AuthError("TOTP_MISSING_FLOW", "Missing `flow` parameter. Expected one of: setup, confirm, verify"));
+};
+const requireTotpVerifierFx = (verifier) => verifier != null ? Fx.succeed(verifier) : Fx.fail(new AuthError("TOTP_MISSING_VERIFIER"));
+const requireTotpCodeFx = (params) => typeof params.code === "string" ? Fx.succeed(params.code) : Fx.fail(new AuthError("TOTP_MISSING_CODE"));
+const requireTotpIdFx = (params) => typeof params.totpId === "string" ? Fx.succeed(params.totpId) : Fx.fail(new AuthError("TOTP_MISSING_ID"));
+const resolveTotpDispatchFx = (params, verifier) => resolveTotpFlowFx(params).pipe(Fx.chain((flow) => Fx.match({ flow }).on("flow", {
+	setup: () => Fx.succeed({
+		flow: "setup",
+		params
+	}),
+	confirm: () => Fx.gen(function* () {
+		const resolvedVerifier = yield* requireTotpVerifierFx(verifier);
+		return {
+			flow: "confirm",
+			code: yield* requireTotpCodeFx(params),
+			totpId: yield* requireTotpIdFx(params),
+			verifier: resolvedVerifier
+		};
+	}),
+	verify: () => Fx.gen(function* () {
+		const resolvedVerifier = yield* requireTotpVerifierFx(verifier);
+		return {
+			flow: "verify",
+			code: yield* requireTotpCodeFx(params),
+			verifier: resolvedVerifier
+		};
+	})
+})));
+/** @internal */
+const handleTotp = (ctx, provider, args) => {
+	return resolveTotpDispatchFx(args.params ?? {}, args.verifier).pipe(Fx.chain((dispatch) => Fx.match(dispatch).on("flow", {
+		setup: ({ params }) => Fx.from({
+			ok: () => ctx.auth.getUserIdentity(),
+			err: (e) => new AuthError("INTERNAL_ERROR", String(e))
+		}).pipe(Fx.chain((identity) => identity === null ? Fx.fail(new AuthError("TOTP_AUTH_REQUIRED")) : Fx.succeed(userIdFromIdentitySubject(identity.subject))), Fx.chain((userId) => Fx.from({
+			ok: async () => {
+				const secret = new Uint8Array(20);
+				crypto.getRandomValues(secret);
+				let accountName = params.accountName;
+				if (!accountName) accountName = (await queryUserById(ctx, userId))?.email ?? "user";
+				const uri = createTOTPKeyURI(provider.options.issuer, accountName, secret, provider.options.period, provider.options.digits);
+				const base32Secret = encodeBase32LowerCaseNoPadding(secret);
+				const verifier = await callVerifier(ctx);
+				await callVerifierSignature(ctx, {
+					verifier,
+					signature: JSON.stringify({
+						secret: Array.from(secret),
+						userId,
+						digits: provider.options.digits,
+						period: provider.options.period
+					})
+				});
+				return {
+					kind: "totpSetup",
+					uri,
+					secret: base32Secret,
+					verifier,
+					totpId: await mutateTotpInsert(ctx, {
+						userId,
+						secret: secret.buffer.slice(secret.byteOffset, secret.byteOffset + secret.byteLength),
+						digits: provider.options.digits,
+						period: provider.options.period,
+						verified: false,
+						name: typeof params.name === "string" ? params.name : void 0,
+						createdAt: Date.now()
+					})
+				};
+			},
+			err: (e) => new AuthError("INTERNAL_ERROR", `TOTP setup failed: ${String(e)}`)
+		}))),
+		confirm: ({ code, totpId, verifier }) => Fx.from({
+			ok: () => ctx.auth.getUserIdentity(),
+			err: (e) => new AuthError("INTERNAL_ERROR", String(e))
+		}).pipe(Fx.chain((identity) => identity === null ? Fx.fail(new AuthError("TOTP_AUTH_REQUIRED")) : Fx.succeed(userIdFromIdentitySubject(identity.subject))), Fx.chain((userId) => Fx.from({
+			ok: () => queryTotpById(ctx, totpId),
+			err: () => new AuthError("TOTP_NOT_FOUND")
+		}).pipe(Fx.chain((doc) => doc === null ? Fx.fail(new AuthError("TOTP_NOT_FOUND")) : Fx.succeed(doc)), Fx.chain((totpDoc) => totpDoc.verified ? Fx.fail(new AuthError("TOTP_ALREADY_VERIFIED")) : Fx.succeed(totpDoc))).pipe(Fx.chain((totpDoc) => verifyTOTPWithGracePeriod(new Uint8Array(totpDoc.secret), provider.options.period, provider.options.digits, code, 30) ? Fx.succeed(totpDoc) : Fx.fail(new AuthError("TOTP_INVALID_CODE")))).pipe(Fx.chain((_totpDoc) => Fx.from({
+			ok: async () => {
+				await mutateTotpMarkVerified(ctx, totpId, Date.now());
+				await mutateVerifierDelete(ctx, verifier);
+				return callSignIn(ctx, {
+					userId,
+					generateTokens: true
+				});
+			},
+			err: (e) => new AuthError("INTERNAL_ERROR", String(e))
+		}))).pipe(Fx.map((signInResult) => ({
+			kind: "signedIn",
+			signedIn: signInResult
+		}))))),
+		verify: ({ code, verifier }) => Fx.from({
+			ok: () => queryVerifierById(ctx, verifier),
+			err: () => new AuthError("TOTP_INVALID_VERIFIER")
+		}).pipe(Fx.chain((doc) => doc === null ? Fx.fail(new AuthError("TOTP_INVALID_VERIFIER")) : Fx.succeed(doc)), Fx.map((doc) => {
+			return {
+				userId: JSON.parse(doc.signature).userId,
+				code,
+				verifier
+			};
+		}), Fx.chain(({ userId, code: code$1, verifier: verifier$1 }) => Fx.from({
+			ok: () => queryTotpVerifiedByUserId(ctx, userId),
+			err: () => new AuthError("TOTP_NO_ENROLLMENT")
+		}).pipe(Fx.chain((totpDoc) => totpDoc === null ? Fx.fail(new AuthError("TOTP_NO_ENROLLMENT")) : Fx.succeed(totpDoc)), Fx.chain((totpDoc) => verifyTOTPWithGracePeriod(new Uint8Array(totpDoc.secret), totpDoc.period, totpDoc.digits, code$1, 30) ? Fx.succeed(totpDoc) : Fx.fail(new AuthError("TOTP_INVALID_CODE"))), Fx.chain((totpDoc) => Fx.from({
+			ok: async () => {
+				await mutateTotpUpdateLastUsed(ctx, totpDoc._id, Date.now());
+				await mutateVerifierDelete(ctx, verifier$1);
+				return callSignIn(ctx, {
+					userId,
+					generateTokens: true
+				});
+			},
+			err: (e) => new AuthError("INTERNAL_ERROR", String(e))
+		})), Fx.map((signInResult) => ({
+			kind: "signedIn",
+			signedIn: signInResult
+		})))))
+	})));
+};
+
+//#endregion
+export { handleTotp };
+//# sourceMappingURL=totp.js.map

package/dist/server/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","names":["code","verifier"],"sources":["../../src/server/totp.ts"],"sourcesContent":["/**\n * Server-side TOTP ceremony logic for two-factor authentication.\n *\n * Handles the three phases of the TOTP flow:\n * 1. setup   — generate a TOTP secret and `otpauth://` URI for enrollment\n * 2. confirm — verify the first code from the authenticator app\n * 3. verify  — verify a TOTP code during sign-in (2FA challenge)\n */\n\nimport { encodeBase32LowerCaseNoPadding } from \"@oslojs/encoding\";\nimport { verifyTOTPWithGracePeriod, createTOTPKeyURI } from \"@oslojs/otp\";\nimport type { Fx as FxType } from \"@robelest/fx\";\n\nimport { Fx } from \"@robelest/fx\";\n\nimport { AuthError } from \"./authError\";\nimport { userIdFromIdentitySubject } from \"./identity\";\nimport { callSignIn, callVerifier } from \"./mutations/index\";\nimport { callVerifierSignature } from \"./mutations/signature\";\nimport { TotpProviderConfig, GenericActionCtxWithAuthConfig } from \"./types\";\nimport {\n  AuthDataModel,\n  SessionInfo,\n  queryUserById,\n  queryTotpById,\n  queryTotpVerifiedByUserId,\n  queryVerifierById,\n  mutateTotpInsert,\n  mutateTotpMarkVerified,\n  mutateTotpUpdateLastUsed,\n  mutateVerifierDelete,\n} from \"./types\";\n\ntype EnrichedActionCtx = GenericActionCtxWithAuthConfig<AuthDataModel>;\n\n// ============================================================================\n// Setup flow\n// ============================================================================\n\n// ============================================================================\n// Confirm flow\n// ============================================================================\n\n// ============================================================================\n// Verify flow (2FA during sign-in)\n// ============================================================================\n\n// ============================================================================\n// Main dispatch\n// ============================================================================\n\ntype TotpResult =\n  | { kind: \"signedIn\"; signedIn: SessionInfo | null }\n  | {\n      kind: \"totpSetup\";\n      uri: string;\n      secret: string;\n      verifier: string;\n      totpId: string;\n    };\n\nconst TOTP_FLOWS = [\"setup\", \"confirm\", \"verify\"] as const;\n\ntype TotpFlow = (typeof TOTP_FLOWS)[number];\n\ntype TotpDispatch =\n  | { flow: \"setup\"; params: Record<string, unknown> }\n  | { flow: \"confirm\"; code: string; totpId: string; verifier: string }\n  | { flow: \"verify\"; code: string; verifier: string };\n\nconst resolveTotpFlowFx = (\n  params: Record<string, unknown>,\n): FxType<TotpFlow, AuthError> => {\n  const flow = params.flow;\n  return typeof flow === \"string\" && TOTP_FLOWS.includes(flow as never)\n    ? Fx.succeed(flow as TotpFlow)\n    : Fx.fail(\n        new AuthError(\n          \"TOTP_MISSING_FLOW\",\n          \"Missing `flow` parameter. Expected one of: setup, confirm, verify\",\n        ),\n      );\n};\n\nconst requireTotpVerifierFx = (\n  verifier: string | undefined,\n): FxType<string, AuthError> =>\n  verifier != null\n    ? Fx.succeed(verifier)\n    : Fx.fail(new AuthError(\"TOTP_MISSING_VERIFIER\"));\n\nconst requireTotpCodeFx = (\n  params: Record<string, unknown>,\n): FxType<string, AuthError> =>\n  typeof params.code === \"string\"\n    ? Fx.succeed(params.code)\n    : Fx.fail(new AuthError(\"TOTP_MISSING_CODE\"));\n\nconst requireTotpIdFx = (\n  params: Record<string, unknown>,\n): FxType<string, AuthError> =>\n  typeof params.totpId === \"string\"\n    ? Fx.succeed(params.totpId)\n    : Fx.fail(new AuthError(\"TOTP_MISSING_ID\"));\n\nconst resolveTotpDispatchFx = (\n  params: Record<string, unknown>,\n  verifier: string | undefined,\n): FxType<TotpDispatch, AuthError> =>\n  resolveTotpFlowFx(params).pipe(\n    Fx.chain((flow) =>\n      Fx.match({ flow }).on(\"flow\", {\n        setup: () => Fx.succeed({ flow: \"setup\" as const, params }),\n        confirm: () =>\n          Fx.gen(function* () {\n            const resolvedVerifier = yield* requireTotpVerifierFx(verifier);\n            const code = yield* requireTotpCodeFx(params);\n            const totpId = yield* requireTotpIdFx(params);\n            return {\n              flow: \"confirm\" as const,\n              code,\n              totpId,\n              verifier: resolvedVerifier,\n            };\n          }),\n        verify: () =>\n          Fx.gen(function* () {\n            const resolvedVerifier = yield* requireTotpVerifierFx(verifier);\n            const code = yield* requireTotpCodeFx(params);\n            return {\n              flow: \"verify\" as const,\n              code,\n              verifier: resolvedVerifier,\n            };\n          }),\n      }),\n    ),\n  );\n\n/** @internal */\nexport const handleTotp = (\n  ctx: EnrichedActionCtx,\n  provider: TotpProviderConfig,\n  args: { params?: Record<string, any>; verifier?: string },\n): FxType<TotpResult, AuthError> => {\n  const params = (args.params ?? {}) as Record<string, unknown>;\n\n  return resolveTotpDispatchFx(params, args.verifier).pipe(\n    Fx.chain((dispatch) =>\n      Fx.match(dispatch).on(\"flow\", {\n        setup: ({ params }) =>\n          Fx.from({\n            ok: () => ctx.auth.getUserIdentity(),\n            err: (e) => new AuthError(\"INTERNAL_ERROR\", String(e)),\n          }).pipe(\n            Fx.chain((identity) =>\n              identity === null\n                ? Fx.fail(new AuthError(\"TOTP_AUTH_REQUIRED\"))\n                : Fx.succeed(userIdFromIdentitySubject(identity.subject)),\n            ),\n            Fx.chain((userId) =>\n              Fx.from({\n                ok: async () => {\n                  const secret = new Uint8Array(20);\n                  crypto.getRandomValues(secret);\n\n                  let accountName: string = params.accountName as string;\n                  if (!accountName) {\n                    const user = await queryUserById(ctx, userId);\n                    accountName = user?.email ?? \"user\";\n                  }\n\n                  const uri = createTOTPKeyURI(\n                    provider.options.issuer,\n                    accountName,\n                    secret,\n                    provider.options.period,\n                    provider.options.digits,\n                  );\n                  const base32Secret = encodeBase32LowerCaseNoPadding(secret);\n\n                  const verifier = await callVerifier(ctx);\n                  await callVerifierSignature(ctx, {\n                    verifier,\n                    signature: JSON.stringify({\n                      secret: Array.from(secret),\n                      userId,\n                      digits: provider.options.digits,\n                      period: provider.options.period,\n                    }),\n                  });\n\n                  const totpId = await mutateTotpInsert(ctx, {\n                    userId,\n                    secret: secret.buffer.slice(\n                      secret.byteOffset,\n                      secret.byteOffset + secret.byteLength,\n                    ),\n                    digits: provider.options.digits,\n                    period: provider.options.period,\n                    verified: false,\n                    name:\n                      typeof params.name === \"string\" ? params.name : undefined,\n                    createdAt: Date.now(),\n                  });\n\n                  return {\n                    kind: \"totpSetup\" as const,\n                    uri,\n                    secret: base32Secret,\n                    verifier,\n                    totpId,\n                  };\n                },\n                err: (e) =>\n                  new AuthError(\n                    \"INTERNAL_ERROR\",\n                    `TOTP setup failed: ${String(e)}`,\n                  ),\n              }),\n            ),\n          ),\n        confirm: ({ code, totpId, verifier }) =>\n          Fx.from({\n            ok: () => ctx.auth.getUserIdentity(),\n            err: (e) => new AuthError(\"INTERNAL_ERROR\", String(e)),\n          }).pipe(\n            Fx.chain((identity) =>\n              identity === null\n                ? Fx.fail(new AuthError(\"TOTP_AUTH_REQUIRED\"))\n                : Fx.succeed(userIdFromIdentitySubject(identity.subject)),\n            ),\n            Fx.chain((userId) =>\n              Fx.from({\n                ok: () => queryTotpById(ctx, totpId),\n                err: () => new AuthError(\"TOTP_NOT_FOUND\"),\n              })\n                .pipe(\n                  Fx.chain((doc) =>\n                    doc === null\n                      ? Fx.fail(new AuthError(\"TOTP_NOT_FOUND\"))\n                      : Fx.succeed(doc),\n                  ),\n                  Fx.chain((totpDoc) =>\n                    totpDoc.verified\n                      ? Fx.fail(new AuthError(\"TOTP_ALREADY_VERIFIED\"))\n                      : Fx.succeed(totpDoc),\n                  ),\n                )\n                .pipe(\n                  Fx.chain((totpDoc) =>\n                    verifyTOTPWithGracePeriod(\n                      new Uint8Array(totpDoc.secret),\n                      provider.options.period,\n                      provider.options.digits,\n                      code,\n                      30,\n                    )\n                      ? Fx.succeed(totpDoc)\n                      : Fx.fail(new AuthError(\"TOTP_INVALID_CODE\")),\n                  ),\n                )\n                .pipe(\n                  Fx.chain((_totpDoc) =>\n                    Fx.from({\n                      ok: async () => {\n                        await mutateTotpMarkVerified(ctx, totpId, Date.now());\n                        await mutateVerifierDelete(ctx, verifier);\n                        return callSignIn(ctx, {\n                          userId,\n                          generateTokens: true,\n                        });\n                      },\n                      err: (e) => new AuthError(\"INTERNAL_ERROR\", String(e)),\n                    }),\n                  ),\n                )\n                .pipe(\n                  Fx.map((signInResult) => ({\n                    kind: \"signedIn\" as const,\n                    signedIn: signInResult,\n                  })),\n                ),\n            ),\n          ),\n        verify: ({ code, verifier }) =>\n          Fx.from({\n            ok: () => queryVerifierById(ctx, verifier),\n            err: () => new AuthError(\"TOTP_INVALID_VERIFIER\"),\n          }).pipe(\n            Fx.chain((doc) =>\n              doc === null\n                ? Fx.fail(new AuthError(\"TOTP_INVALID_VERIFIER\"))\n                : Fx.succeed(doc),\n            ),\n            Fx.map((doc) => {\n              const data = JSON.parse(doc.signature!);\n              return { userId: data.userId as string, code, verifier };\n            }),\n            Fx.chain(({ userId, code, verifier }) =>\n              Fx.from({\n                ok: () => queryTotpVerifiedByUserId(ctx, userId),\n                err: () => new AuthError(\"TOTP_NO_ENROLLMENT\"),\n              }).pipe(\n                Fx.chain((totpDoc) =>\n                  totpDoc === null\n                    ? Fx.fail(new AuthError(\"TOTP_NO_ENROLLMENT\"))\n                    : Fx.succeed(totpDoc),\n                ),\n                Fx.chain((totpDoc) =>\n                  verifyTOTPWithGracePeriod(\n                    new Uint8Array(totpDoc.secret),\n                    totpDoc.period,\n                    totpDoc.digits,\n                    code,\n                    30,\n                  )\n                    ? Fx.succeed(totpDoc)\n                    : Fx.fail(new AuthError(\"TOTP_INVALID_CODE\")),\n                ),\n                Fx.chain((totpDoc) =>\n                  Fx.from({\n                    ok: async () => {\n                      await mutateTotpUpdateLastUsed(\n                        ctx,\n                        totpDoc._id,\n                        Date.now(),\n                      );\n                      await mutateVerifierDelete(ctx, verifier);\n                      return callSignIn(ctx, { userId, generateTokens: true });\n                    },\n                    err: (e) => new AuthError(\"INTERNAL_ERROR\", String(e)),\n                  }),\n                ),\n                Fx.map((signInResult) => ({\n                  kind: \"signedIn\" as const,\n                  signedIn: signInResult,\n                })),\n              ),\n            ),\n          ),\n      }),\n    ),\n  );\n};\n\n// ============================================================================\n// Helpers\n// ============================================================================\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA6DA,MAAM,aAAa;CAAC;CAAS;CAAW;CAAS;AASjD,MAAM,qBACJ,WACgC;CAChC,MAAM,OAAO,OAAO;AACpB,QAAO,OAAO,SAAS,YAAY,WAAW,SAAS,KAAc,GACjE,GAAG,QAAQ,KAAiB,GAC5B,GAAG,KACD,IAAI,UACF,qBACA,oEACD,CACF;;AAGP,MAAM,yBACJ,aAEA,YAAY,OACR,GAAG,QAAQ,SAAS,GACpB,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC;AAErD,MAAM,qBACJ,WAEA,OAAO,OAAO,SAAS,WACnB,GAAG,QAAQ,OAAO,KAAK,GACvB,GAAG,KAAK,IAAI,UAAU,oBAAoB,CAAC;AAEjD,MAAM,mBACJ,WAEA,OAAO,OAAO,WAAW,WACrB,GAAG,QAAQ,OAAO,OAAO,GACzB,GAAG,KAAK,IAAI,UAAU,kBAAkB,CAAC;AAE/C,MAAM,yBACJ,QACA,aAEA,kBAAkB,OAAO,CAAC,KACxB,GAAG,OAAO,SACR,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ;CAC5B,aAAa,GAAG,QAAQ;EAAE,MAAM;EAAkB;EAAQ,CAAC;CAC3D,eACE,GAAG,IAAI,aAAa;EAClB,MAAM,mBAAmB,OAAO,sBAAsB,SAAS;AAG/D,SAAO;GACL,MAAM;GACN,MAJW,OAAO,kBAAkB,OAAO;GAK3C,QAJa,OAAO,gBAAgB,OAAO;GAK3C,UAAU;GACX;GACD;CACJ,cACE,GAAG,IAAI,aAAa;EAClB,MAAM,mBAAmB,OAAO,sBAAsB,SAAS;AAE/D,SAAO;GACL,MAAM;GACN,MAHW,OAAO,kBAAkB,OAAO;GAI3C,UAAU;GACX;GACD;CACL,CAAC,CACH,CACF;;AAGH,MAAa,cACX,KACA,UACA,SACkC;AAGlC,QAAO,sBAFS,KAAK,UAAU,EAAE,EAEI,KAAK,SAAS,CAAC,KAClD,GAAG,OAAO,aACR,GAAG,MAAM,SAAS,CAAC,GAAG,QAAQ;EAC5B,QAAQ,EAAE,aACR,GAAG,KAAK;GACN,UAAU,IAAI,KAAK,iBAAiB;GACpC,MAAM,MAAM,IAAI,UAAU,kBAAkB,OAAO,EAAE,CAAC;GACvD,CAAC,CAAC,KACD,GAAG,OAAO,aACR,aAAa,OACT,GAAG,KAAK,IAAI,UAAU,qBAAqB,CAAC,GAC5C,GAAG,QAAQ,0BAA0B,SAAS,QAAQ,CAAC,CAC5D,EACD,GAAG,OAAO,WACR,GAAG,KAAK;GACN,IAAI,YAAY;IACd,MAAM,SAAS,IAAI,WAAW,GAAG;AACjC,WAAO,gBAAgB,OAAO;IAE9B,IAAI,cAAsB,OAAO;AACjC,QAAI,CAAC,YAEH,gBADa,MAAM,cAAc,KAAK,OAAO,GACzB,SAAS;IAG/B,MAAM,MAAM,iBACV,SAAS,QAAQ,QACjB,aACA,QACA,SAAS,QAAQ,QACjB,SAAS,QAAQ,OAClB;IACD,MAAM,eAAe,+BAA+B,OAAO;IAE3D,MAAM,WAAW,MAAM,aAAa,IAAI;AACxC,UAAM,sBAAsB,KAAK;KAC/B;KACA,WAAW,KAAK,UAAU;MACxB,QAAQ,MAAM,KAAK,OAAO;MAC1B;MACA,QAAQ,SAAS,QAAQ;MACzB,QAAQ,SAAS,QAAQ;MAC1B,CAAC;KACH,CAAC;AAgBF,WAAO;KACL,MAAM;KACN;KACA,QAAQ;KACR;KACA,QAnBa,MAAM,iBAAiB,KAAK;MACzC;MACA,QAAQ,OAAO,OAAO,MACpB,OAAO,YACP,OAAO,aAAa,OAAO,WAC5B;MACD,QAAQ,SAAS,QAAQ;MACzB,QAAQ,SAAS,QAAQ;MACzB,UAAU;MACV,MACE,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;MAClD,WAAW,KAAK,KAAK;MACtB,CAAC;KAQD;;GAEH,MAAM,MACJ,IAAI,UACF,kBACA,sBAAsB,OAAO,EAAE,GAChC;GACJ,CAAC,CACH,CACF;EACH,UAAU,EAAE,MAAM,QAAQ,eACxB,GAAG,KAAK;GACN,UAAU,IAAI,KAAK,iBAAiB;GACpC,MAAM,MAAM,IAAI,UAAU,kBAAkB,OAAO,EAAE,CAAC;GACvD,CAAC,CAAC,KACD,GAAG,OAAO,aACR,aAAa,OACT,GAAG,KAAK,IAAI,UAAU,qBAAqB,CAAC,GAC5C,GAAG,QAAQ,0BAA0B,SAAS,QAAQ,CAAC,CAC5D,EACD,GAAG,OAAO,WACR,GAAG,KAAK;GACN,UAAU,cAAc,KAAK,OAAO;GACpC,WAAW,IAAI,UAAU,iBAAiB;GAC3C,CAAC,CACC,KACC,GAAG,OAAO,QACR,QAAQ,OACJ,GAAG,KAAK,IAAI,UAAU,iBAAiB,CAAC,GACxC,GAAG,QAAQ,IAAI,CACpB,EACD,GAAG,OAAO,YACR,QAAQ,WACJ,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,QAAQ,QAAQ,CACxB,CACF,CACA,KACC,GAAG,OAAO,YACR,0BACE,IAAI,WAAW,QAAQ,OAAO,EAC9B,SAAS,QAAQ,QACjB,SAAS,QAAQ,QACjB,MACA,GACD,GACG,GAAG,QAAQ,QAAQ,GACnB,GAAG,KAAK,IAAI,UAAU,oBAAoB,CAAC,CAChD,CACF,CACA,KACC,GAAG,OAAO,aACR,GAAG,KAAK;GACN,IAAI,YAAY;AACd,UAAM,uBAAuB,KAAK,QAAQ,KAAK,KAAK,CAAC;AACrD,UAAM,qBAAqB,KAAK,SAAS;AACzC,WAAO,WAAW,KAAK;KACrB;KACA,gBAAgB;KACjB,CAAC;;GAEJ,MAAM,MAAM,IAAI,UAAU,kBAAkB,OAAO,EAAE,CAAC;GACvD,CAAC,CACH,CACF,CACA,KACC,GAAG,KAAK,kBAAkB;GACxB,MAAM;GACN,UAAU;GACX,EAAE,CACJ,CACJ,CACF;EACH,SAAS,EAAE,MAAM,eACf,GAAG,KAAK;GACN,UAAU,kBAAkB,KAAK,SAAS;GAC1C,WAAW,IAAI,UAAU,wBAAwB;GAClD,CAAC,CAAC,KACD,GAAG,OAAO,QACR,QAAQ,OACJ,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,QAAQ,IAAI,CACpB,EACD,GAAG,KAAK,QAAQ;AAEd,UAAO;IAAE,QADI,KAAK,MAAM,IAAI,UAAW,CACjB;IAAkB;IAAM;IAAU;IACxD,EACF,GAAG,OAAO,EAAE,QAAQ,cAAM,2BACxB,GAAG,KAAK;GACN,UAAU,0BAA0B,KAAK,OAAO;GAChD,WAAW,IAAI,UAAU,qBAAqB;GAC/C,CAAC,CAAC,KACD,GAAG,OAAO,YACR,YAAY,OACR,GAAG,KAAK,IAAI,UAAU,qBAAqB,CAAC,GAC5C,GAAG,QAAQ,QAAQ,CACxB,EACD,GAAG,OAAO,YACR,0BACE,IAAI,WAAW,QAAQ,OAAO,EAC9B,QAAQ,QACR,QAAQ,QACRA,QACA,GACD,GACG,GAAG,QAAQ,QAAQ,GACnB,GAAG,KAAK,IAAI,UAAU,oBAAoB,CAAC,CAChD,EACD,GAAG,OAAO,YACR,GAAG,KAAK;GACN,IAAI,YAAY;AACd,UAAM,yBACJ,KACA,QAAQ,KACR,KAAK,KAAK,CACX;AACD,UAAM,qBAAqB,KAAKC,WAAS;AACzC,WAAO,WAAW,KAAK;KAAE;KAAQ,gBAAgB;KAAM,CAAC;;GAE1D,MAAM,MAAM,IAAI,UAAU,kBAAkB,OAAO,EAAE,CAAC;GACvD,CAAC,CACH,EACD,GAAG,KAAK,kBAAkB;GACxB,MAAM;GACN,UAAU;GACX,EAAE,CACJ,CACF,CACF;EACJ,CAAC,CACH,CACF"}