@rpcbase/auth 0.182.0 → 0.184.0

package/dist/api/sign-up/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/api/sign-up/handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAO,UAAU,EAAE,MAAM,cAAc,CAAA;AAInD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,KAAK,MAAM,MAAM,SAAS,CAAA;AAGjC,eAAO,MAAM,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,eAAe,EAAE,eAAe,CAmF7F,CAAA;yBAEe,KAAK,GAAG,CAAC,eAAe,CAAC;AAAzC,wBAEC"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/api/sign-up/handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAO,UAAU,EAAE,MAAM,cAAc,CAAA;AAInD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,KAAK,MAAM,MAAM,SAAS,CAAA;AAGjC,eAAO,MAAM,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,eAAe,EAAE,eAAe,CAyF7F,CAAA;yBAEe,KAAK,GAAG,CAAC,eAAe,CAAC;AAAzC,wBAEC"}

package/dist/{handler-BGjAGBrc.js → handler-BerdJCZB.js}

@@ -1,6 +1,6 @@
 import { n as requestSchema, t as ROUTE } from "./sign-up-Di48rzbG.js";
 import crypto from "crypto";
-import { models } from "@rpcbase/db";
+import { createProvisionedTenant, models } from "@rpcbase/db";
 import { hashPasswordForStorage, sendEmail } from "@rpcbase/server";
 //#region src/api/sign-up/handler.ts
 var signUp = async (payload, ctx) => {
@@ -61,12 +61,22 @@ var signUp = async (payload, ctx) => {
 		};
 	}
 	try {
-		await Tenant.create({
+		await createProvisionedTenant(Tenant, {
 			tenantId,
 			name: email
 		});
 	} catch (err) {
-		console.warn("failed to create tenant for user", err);
+		console.error("failed to initialize tenant for user", err);
+		try {
+			await User.deleteOne({ _id: user._id });
+		} catch (rollbackErr) {
+			console.error("failed to roll back user after tenant initialization failure", rollbackErr);
+		}
+		ctx.res.status(500);
+		return {
+			success: false,
+			error: "tenant_initialization_failed"
+		};
 	}
 	console.log("created new user", user._id.toString());
 	return {
@@ -81,4 +91,4 @@ var handler_default = (api) => {
 //#endregion
 export { handler_default as default, signUp };
 
-//# sourceMappingURL=handler-BGjAGBrc.js.map
+//# sourceMappingURL=handler-BerdJCZB.js.map

package/dist/handler-BerdJCZB.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-BerdJCZB.js","names":["crypto","Api","Ctx","ApiHandler","createProvisionedTenant","models","hashPasswordForStorage","sendEmail","AuthSessionUser","SignUp","signUp","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","Tenant","parsed","requestSchema","safeParse","success","res","status","error","email","password","rememberMe","_rememberMe","data","existingUser","findOne","console","log","hashedPassword","tenantId","randomUUID","emailVerificationCode","randomInt","toString","padStart","emailVerificationExpiresAt","Date","now","user","tenants","tenantRoles","save","to","subject","html","text","err","deleteOne","_id","rollbackErr","name","userId","api","post","ROUTE"],"sources":["../src/api/sign-up/handler.ts"],"sourcesContent":["import crypto from \"crypto\"\n\nimport { Api, Ctx, ApiHandler } from \"@rpcbase/api\"\nimport { createProvisionedTenant, models } from \"@rpcbase/db\"\nimport { hashPasswordForStorage, sendEmail } from \"@rpcbase/server\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SignUp from \"./index\"\n\n\nexport const signUp: ApiHandler<SignUp.RequestPayload, SignUp.ResponsePayload, AuthSessionUser> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SignUp.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n  const Tenant = await models.getGlobal(\"RBTenant\", ctx)\n\n  const parsed = SignUp.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  const { email, password, rememberMe: _rememberMe } = parsed.data\n\n  const existingUser = await User.findOne({ email })\n\n  if (existingUser) {\n    console.log(\"user with email already exists\", email)\n    // For security, we don't want to reveal if an email is registered.\n    // But for this implementation, we'll make it simple.\n    ctx.res.status(409)\n    return { success: false, error: \"user_exists\" }\n  }\n\n  const hashedPassword = await hashPasswordForStorage(password)\n\n  const tenantId = crypto.randomUUID()\n\n  const emailVerificationCode = crypto.randomInt(0, 1_000_000).toString().padStart(6, \"0\")\n  const emailVerificationExpiresAt = new Date(Date.now() + 10 * 60 * 1000)\n\n  const user = new User({\n    email,\n    password: hashedPassword,\n    tenants: [tenantId],\n    tenantRoles: {\n      [tenantId]: [\"owner\"],\n    },\n    emailVerificationCode,\n    emailVerificationExpiresAt,\n  })\n  await user.save()\n\n  try {\n    await sendEmail({\n      to: email,\n      subject: `Verify your email: ${emailVerificationCode}`,\n      html: `\n        <p>Welcome to rpcbase!</p>\n        <p>Your verification code is <strong>${emailVerificationCode}</strong>. It expires in 10 minutes.</p>\n        <p>If you didn't request this, you can ignore this message.</p>\n      `,\n      text: `Welcome to rpcbase! Your verification code is ${emailVerificationCode}. It expires in 10 minutes. If you didn't request this, you can ignore this message.`,\n    })\n  } catch (err) {\n    console.error(\"failed to send sign-up email\", err)\n\n    try {\n      await User.deleteOne({ _id: user._id })\n    } catch (rollbackErr) {\n      console.error(\"failed to roll back user after sign-up email failure\", rollbackErr)\n    }\n\n    ctx.res.status(500)\n    return { success: false, error: \"email_delivery_failed\" }\n  }\n\n  try {\n    await createProvisionedTenant(Tenant, {\n      tenantId,\n      name: email,\n    })\n  } catch (err) {\n    console.error(\"failed to initialize tenant for user\", err)\n    try {\n      await User.deleteOne({ _id: user._id })\n    } catch (rollbackErr) {\n      console.error(\"failed to roll back user after tenant initialization failure\", rollbackErr)\n    }\n    ctx.res.status(500)\n    return { success: false, error: \"tenant_initialization_failed\" }\n  }\n\n  console.log(\"created new user\", user._id.toString())\n\n  return { success: true, userId: user._id.toString(), tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(SignUp.ROUTE, signUp)\n}\n"],"mappings":";;;;;AAWA,IAAaU,SAAqF,OAChGG,SACAC,QACoC;CACpC,MAAME,OAAO,MAAMX,OAAOY,UAAU,UAAUH,GAAG;CACjD,MAAMI,SAAS,MAAMb,OAAOY,UAAU,YAAYH,GAAG;CAErD,MAAMK,SAAAA,cAA8BE,UAAUR,OAAO;CAErD,IAAI,CAACM,OAAOG,SAAS;EACnBR,IAAIS,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAGA,MAAM,EAAEC,OAAOC,UAAUC,YAAYC,gBAAgBV,OAAOW;CAI5D,IAAIC,MAFuBf,KAAKgB,QAAQ,EAAEN,MAAM,CAAC,GAE/B;EAChBO,QAAQC,IAAI,kCAAkCR,KAAK;EAGnDZ,IAAIS,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAc;CAChD;CAEA,MAAMU,iBAAiB,MAAM7B,uBAAuBqB,QAAQ;CAE5D,MAAMS,WAAWpC,OAAOqC,WAAW;CAEnC,MAAMC,wBAAwBtC,OAAOuC,UAAU,GAAG,GAAS,CAAC,CAACC,SAAS,CAAC,CAACC,SAAS,GAAG,GAAG;CACvF,MAAMC,6BAA6B,IAAIC,KAAKA,KAAKC,IAAI,IAAI,MAAU,GAAI;CAEvE,MAAMC,OAAO,IAAI7B,KAAK;EACpBU;EACAC,UAAUQ;EACVW,SAAS,CAACV,QAAQ;EAClBW,aAAa,GACVX,WAAW,CAAC,OAAO,EACtB;EACAE;EACAI;CACF,CAAC;CACD,MAAMG,KAAKG,KAAK;CAEhB,IAAI;EACF,MAAMzC,UAAU;GACd0C,IAAIvB;GACJwB,SAAS,sBAAsBZ;GAC/Ba,MAAM;;+CAEmCb,sBAAqB;;;GAG9Dc,MAAM,iDAAiDd,sBAAqB;EAC9E,CAAC;CACH,SAASe,KAAK;EACZpB,QAAQR,MAAM,gCAAgC4B,GAAG;EAEjD,IAAI;GACF,MAAMrC,KAAKsC,UAAU,EAAEC,KAAKV,KAAKU,IAAI,CAAC;EACxC,SAASC,aAAa;GACpBvB,QAAQR,MAAM,wDAAwD+B,WAAW;EACnF;EAEA1C,IAAIS,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAwB;CAC1D;CAEA,IAAI;EACF,MAAMrB,wBAAwBc,QAAQ;GACpCkB;GACAqB,MAAM/B;EACR,CAAC;CACH,SAAS2B,KAAK;EACZpB,QAAQR,MAAM,wCAAwC4B,GAAG;EACzD,IAAI;GACF,MAAMrC,KAAKsC,UAAU,EAAEC,KAAKV,KAAKU,IAAI,CAAC;EACxC,SAASC,aAAa;GACpBvB,QAAQR,MAAM,gEAAgE+B,WAAW;EAC3F;EACA1C,IAAIS,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAA+B;CACjE;CAEAQ,QAAQC,IAAI,oBAAoBW,KAAKU,IAAIf,SAAS,CAAC;CAEnD,OAAO;EAAElB,SAAS;EAAMoC,QAAQb,KAAKU,IAAIf,SAAS;EAAGJ;CAAS;AAChE;AAEA,IAAA,mBAAgBuB,QAA8B;CAC5CA,IAAIC,KAAKnD,OAAcC,MAAM;AAC/B"}

package/dist/oauth/index.js

@@ -1,6 +1,6 @@
 import { n as completeAuthSignIn } from "../session-BQ06Yo3C.js";
 import crypto from "crypto";
-import { models } from "@rpcbase/db";
+import { createProvisionedTenant, models } from "@rpcbase/db";
 import { hashPasswordForStorage } from "@rpcbase/server";
 //#region src/oauth/config.ts
 var STORE_KEY = Symbol.for("@rpcbase/auth/oauthProviders");
@@ -519,12 +519,23 @@ var processOAuthCallback = async ({ ctx, providerId: providerIdOverride, createU
 		});
 		await user.save();
 		try {
-			await Tenant.create({
+			await createProvisionedTenant(Tenant, {
 				tenantId,
 				name: resolvedEmail || subject
 			});
 		} catch (err) {
-			console.warn("oauth::failed_to_create_tenant", err);
+			console.error("oauth::failed_to_initialize_tenant", err);
+			try {
+				await User.deleteOne({ _id: user._id });
+			} catch (rollbackError) {
+				console.error("oauth::failed_to_rollback_user", rollbackError);
+			}
+			return {
+				success: false,
+				type: "error",
+				error: "tenant_initialization_failed",
+				redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=tenant_initialization_failed`
+			};
 		}
 	} else {
 		const setFields = { [`oauthProviders.${providerId}`]: oauthProviderPayload };

package/dist/oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["OAuthProviderConfig","issuer","clientId","clientSecret","scope","callbackPath","OAuthProvidersConfig","Record","OAuthProvidersStore","providers","STORE_KEY","Symbol","for","getStore","anyGlobal","globalThis","existing","created","normalizeProviders","result","isSafeRedirectPath","candidate","startsWith","providerIdRaw","value","Object","entries","providerId","trim","Error","undefined","configureOAuthProviders","store","normalized","setOAuthProviders","getOAuthProviderConfig","decodeBase64Url","value","padded","replace","slice","length","Buffer","from","toString","decodeJwtPayload","Record","token","T","parts","split","json","parsed","JSON","parse","OidcWellKnown","issuer","authorization_endpoint","token_endpoint","userinfo_endpoint","jwks_uri","cache","Map","Promise","normalizeIssuer","raw","trim","replace","getOidcWellKnown","issuerRaw","Error","existing","get","loader","url","URL","response","fetch","headers","Accept","ok","body","text","catch","status","json","Partial","authorizationEndpoint","tokenEndpoint","issuerValue","userinfoEndpoint","undefined","jwksUri","set","err","delete","crypto","base64UrlEncode","input","Buffer","toString","replace","generatePkcePair","verifier","randomBytes","challenge","createHash","update","digest","RESERVED_KEYS","Set","isSafeOAuthProviderId","value","providerId","trim","length","has","test","crypto","ApiHandler","Ctx","models","hashPasswordForStorage","completeAuthSignIn","AuthSessionUser","getOAuthProviderConfig","decodeJwtPayload","getOidcWellKnown","generatePkcePair","isSafeOAuthProviderId","OAUTH_REQUEST_TTL_MS","OAUTH_STATE_COOKIE_NAME","OAuthCtx","OAuthRequestRecord","returnTo","codeVerifier","getQueryString","value","Array","isArray","getCookieValue","ctx","name","header","req","headers","cookie","part","split","rawKey","rest","key","trim","rawValue","join","decodeURIComponent","isSafeRedirectPath","candidate","startsWith","getRequestOrigin","protoHeader","hostHeader","protocol","host","get","resolveCallbackPath","callbackPath","trimmed","readTextBody","Pick","Promise","resolve","reject","body","setEncoding","on","chunk","String","length","Error","getFormPostParams","Record","method","contentType","includes","params","URLSearchParams","result","entries","resolveProviderId","providerIdOverride","provider","RESERVED_AUTH_PARAM_KEYS","Set","normalizeAuthorizationParams","undefined","keyRaw","valueRaw","Object","has","val","keys","OAuthStartResult","success","redirectUrl","error","statusCode","getOAuthStartRedirectUrl","providerId","authorizationParams","origin","isHttps","state","randomBytes","toString","verifier","challenge","safeReturnTo","OAuthRequest","getGlobal","now","Date","create","_id","createdAt","expiresAt","getTime","err","console","warn","res","httpOnly","secure","sameSite","path","maxAge","oidc","issuer","redirectUri","url","URL","authorization_endpoint","searchParams","set","clientId","scope","extraAuthorizationParams","OAuthCallbackResult","type","redirectPath","userId","tenantId","signedInTenants","subject","email","OAUTH_SUCCESS_REDIRECT_PATH","AUTH_ERROR_REDIRECT_BASE","processOAuthCallback","createUserOnFirstSignIn","missingUserRedirectPath","successRedirectPath","bodyParams","code","query","oauthUserRaw","user","stateCookieValue","oauthRequest","OAuthRequestModel","Awaited","ReturnType","findOne","lean","tokenBody","clientSecret","tokenResponse","fetch","token_endpoint","Accept","tokenJson","json","catch","ok","JSON","stringify","status","accessToken","access_token","refreshToken","refresh_token","idToken","id_token","tokenType","token_type","expiresIn","expires_in","Number","expiresInSeconds","isFinite","userInfo","userinfo_endpoint","userInfoResponse","Authorization","idTokenPayload","accessTokenPayload","sub","oauthUser","parse","oauthUserRecord","oauthUserEmail","oauthUserNameRecord","oauthUserNameFirst","firstName","oauthUserNameLast","lastName","oauthUserName","filter","Boolean","resolvedEmail","resolvedName","User","Tenant","all","subjectQueryKey","shouldCreateUser","pathname","search","session","providerCreatedAt","oauthProviders","Map","existingProvider","oauthProviderPayload","rawUserInfo","updatedAt","randomUUID","password","tenants","tenantRoles","save","setFields","updateOne","$set","map","tenantRolesMap","fromEntries","currentTenantId","deleteOne","clearCookie","createOAuthStartHandler","getAuthorizationParams","_payload","resolvedProviderId","providerAuthorizationParams","redirect","createOAuthCallbackHandler","base64UrlEncode","input","Buffer","from","replace","createAppleClientSecret","teamId","keyId","privateKeyPem","teamIdValue","clientIdValue","keyIdValue","privateKeyPemValue","nowSeconds","Math","floor","exp","max","min","alg","kid","typ","payload","iss","iat","aud","signingInput","signature","sign","dsaEncoding"],"sources":["../../src/oauth/config.ts","../../src/oauth/jwt.ts","../../src/oauth/oidc.ts","../../src/oauth/pkce.ts","../../src/oauth/providerId.ts","../../src/oauth/lib.ts"],"sourcesContent":["export type OAuthProviderConfig = {\n  issuer: string\n  clientId: string\n  clientSecret?: string\n  scope: string\n  callbackPath: string\n}\n\ntype OAuthProvidersConfig = Record<string, OAuthProviderConfig>\n\ntype OAuthProvidersStore = {\n  providers: OAuthProvidersConfig\n}\n\nconst STORE_KEY = Symbol.for(\"@rpcbase/auth/oauthProviders\")\n\nconst getStore = (): OAuthProvidersStore => {\n  const anyGlobal = globalThis as unknown as Record<string | symbol, unknown>\n  const existing = anyGlobal[STORE_KEY] as OAuthProvidersStore | undefined\n  if (existing && typeof existing === \"object\" && existing.providers && typeof existing.providers === \"object\") {\n    return existing\n  }\n\n  const created: OAuthProvidersStore = { providers: {} }\n  anyGlobal[STORE_KEY] = created\n  return created\n}\n\nconst normalizeProviders = (providers: Record<string, OAuthProviderConfig>): OAuthProvidersConfig => {\n  const result: OAuthProvidersConfig = {}\n\n  const isSafeRedirectPath = (candidate: string) => {\n    if (!candidate.startsWith(\"/\")) return false\n    if (candidate.startsWith(\"//\")) return false\n    return true\n  }\n\n  for (const [providerIdRaw, value] of Object.entries(providers)) {\n    const providerId = providerIdRaw.trim()\n    if (!providerId) continue\n\n    const issuer = typeof value?.issuer === \"string\" ? value.issuer.trim() : \"\"\n    const clientId = typeof value?.clientId === \"string\" ? value.clientId.trim() : \"\"\n    if (!issuer) throw new Error(`oauth provider \"${providerId}\" missing issuer`)\n    if (!clientId) throw new Error(`oauth provider \"${providerId}\" missing clientId`)\n\n    const clientSecret = typeof value?.clientSecret === \"string\" && value.clientSecret.trim()\n      ? value.clientSecret\n      : undefined\n\n    const scope = typeof value?.scope === \"string\" ? value.scope.trim() : \"\"\n    if (!scope) throw new Error(`oauth provider \"${providerId}\" missing scope`)\n\n    const callbackPath = typeof value?.callbackPath === \"string\"\n      ? value.callbackPath.trim()\n      : \"\"\n    if (!callbackPath) throw new Error(`oauth provider \"${providerId}\" missing callbackPath`)\n    if (!isSafeRedirectPath(callbackPath)) throw new Error(`oauth provider \"${providerId}\" has invalid callbackPath`)\n\n    result[providerId] = {\n      issuer,\n      clientId,\n      clientSecret,\n      scope,\n      callbackPath,\n    }\n  }\n\n  return result\n}\n\nexport const configureOAuthProviders = (providers: Record<string, OAuthProviderConfig>) => {\n  const store = getStore()\n  const normalized = normalizeProviders(providers)\n  store.providers = { ...store.providers, ...normalized }\n}\n\nexport const setOAuthProviders = (providers: Record<string, OAuthProviderConfig>) => {\n  const store = getStore()\n  store.providers = normalizeProviders(providers)\n}\n\nexport const getOAuthProviderConfig = (providerId: string): OAuthProviderConfig | null => {\n  const store = getStore()\n  return store.providers[providerId] ?? null\n}\n","const decodeBase64Url = (value: string) => {\n  const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"===\".slice((value.length + 3) % 4)\n  return Buffer.from(padded, \"base64\").toString(\"utf8\")\n}\n\nexport const decodeJwtPayload = <T = Record<string, unknown>>(token: string): T | null => {\n  const parts = token.split(\".\")\n  if (parts.length < 2) return null\n\n  try {\n    const json = decodeBase64Url(parts[1])\n    const parsed = JSON.parse(json) as T\n    if (!parsed || typeof parsed !== \"object\") return null\n    return parsed\n  } catch {\n    return null\n  }\n}\n\n","export type OidcWellKnown = {\n  issuer: string\n  authorization_endpoint: string\n  token_endpoint: string\n  userinfo_endpoint?: string\n  jwks_uri?: string\n}\n\nconst cache = new Map<string, Promise<OidcWellKnown>>()\n\nconst normalizeIssuer = (raw: string) => raw.trim().replace(/\\/+$/, \"\")\n\nexport const getOidcWellKnown = async (issuerRaw: string): Promise<OidcWellKnown> => {\n  const issuer = normalizeIssuer(issuerRaw)\n  if (!issuer) {\n    throw new Error(\"OIDC issuer is required\")\n  }\n\n  const existing = cache.get(issuer)\n  if (existing) {\n    return existing\n  }\n\n  const loader = (async () => {\n    const url = new URL(\"/.well-known/openid-configuration\", issuer)\n    const response = await fetch(url, { headers: { Accept: \"application/json\" } })\n    if (!response.ok) {\n      const body = await response.text().catch(() => \"\")\n      throw new Error(`Failed to fetch OIDC discovery document: ${response.status} ${body}`)\n    }\n\n    const json = await response.json().catch(() => null) as Partial<OidcWellKnown> | null\n    if (!json || typeof json !== \"object\") {\n      throw new Error(\"Invalid OIDC discovery document\")\n    }\n\n    const authorizationEndpoint = typeof json.authorization_endpoint === \"string\"\n      ? json.authorization_endpoint\n      : \"\"\n    const tokenEndpoint = typeof json.token_endpoint === \"string\"\n      ? json.token_endpoint\n      : \"\"\n    const issuerValue = typeof json.issuer === \"string\" ? json.issuer : issuer\n    const userinfoEndpoint = typeof json.userinfo_endpoint === \"string\" ? json.userinfo_endpoint : undefined\n    const jwksUri = typeof json.jwks_uri === \"string\" ? json.jwks_uri : undefined\n\n    if (!authorizationEndpoint || !tokenEndpoint) {\n      throw new Error(\"OIDC discovery document missing required endpoints\")\n    }\n\n    return {\n      issuer: issuerValue,\n      authorization_endpoint: authorizationEndpoint,\n      token_endpoint: tokenEndpoint,\n      userinfo_endpoint: userinfoEndpoint,\n      jwks_uri: jwksUri,\n    } satisfies OidcWellKnown\n  })()\n\n  cache.set(issuer, loader)\n\n  try {\n    return await loader\n  } catch (err) {\n    cache.delete(issuer)\n    throw err\n  }\n}\n\n","import crypto from \"crypto\"\n\n\nexport const base64UrlEncode = (input: Buffer) => input\n  .toString(\"base64\")\n  .replace(/\\+/g, \"-\")\n  .replace(/\\//g, \"_\")\n  .replace(/=+$/g, \"\")\n\nexport const generatePkcePair = () => {\n  const verifier = base64UrlEncode(crypto.randomBytes(32))\n  const challenge = base64UrlEncode(crypto.createHash(\"sha256\").update(verifier).digest())\n\n  return { verifier, challenge }\n}\n\n","const RESERVED_KEYS = new Set([\"__proto__\", \"prototype\", \"constructor\"])\n\nexport const isSafeOAuthProviderId = (value: string) => {\n  const providerId = value.trim()\n  if (!providerId) return false\n  if (providerId.length > 128) return false\n  if (RESERVED_KEYS.has(providerId)) return false\n  return /^[a-zA-Z0-9_-]+$/.test(providerId)\n}\n\n","import crypto from \"crypto\"\n\nimport { ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { hashPasswordForStorage } from \"@rpcbase/server\"\n\nimport { completeAuthSignIn } from \"../session\"\nimport type { AuthSessionUser } from \"../types\"\nimport { getOAuthProviderConfig } from \"./config\"\nimport { decodeJwtPayload } from \"./jwt\"\nimport { getOidcWellKnown } from \"./oidc\"\nimport { generatePkcePair } from \"./pkce\"\nimport { isSafeOAuthProviderId } from \"./providerId\"\n\n\nconst OAUTH_REQUEST_TTL_MS = 10 * 60 * 1000\nconst OAUTH_STATE_COOKIE_NAME = \"rb_oauth_state\"\ntype OAuthCtx = Ctx<AuthSessionUser>\ntype OAuthRequestRecord = {\n  returnTo?: unknown\n  codeVerifier?: unknown\n}\n\nconst getQueryString = (value: unknown) => {\n  if (typeof value === \"string\") return value\n  if (Array.isArray(value) && typeof value[0] === \"string\") return value[0]\n  return null\n}\n\nconst getCookieValue = (ctx: OAuthCtx, name: string): string | null => {\n  const header = ctx.req.headers?.cookie\n  if (typeof header !== \"string\" || !header) return null\n\n  for (const part of header.split(\";\")) {\n    const [rawKey, ...rest] = part.split(\"=\")\n    const key = rawKey?.trim()\n    if (!key || key !== name) continue\n    const rawValue = rest.join(\"=\").trim()\n    if (!rawValue) return \"\"\n    try {\n      return decodeURIComponent(rawValue)\n    } catch {\n      return rawValue\n    }\n  }\n\n  return null\n}\n\nconst isSafeRedirectPath = (candidate: string) => {\n  if (!candidate.startsWith(\"/\")) return false\n  if (candidate.startsWith(\"//\")) return false\n  return true\n}\n\nconst getRequestOrigin = (ctx: OAuthCtx) => {\n  const protoHeader = ctx.req.headers[\"x-forwarded-proto\"]\n  const hostHeader = ctx.req.headers[\"x-forwarded-host\"]\n\n  const protocol = typeof protoHeader === \"string\"\n    ? protoHeader.split(\",\")[0].trim()\n    : ctx.req.protocol\n\n  const host = typeof hostHeader === \"string\"\n    ? hostHeader.split(\",\")[0].trim()\n    : ctx.req.get(\"host\")\n\n  return protocol && host ? `${protocol}://${host}` : \"\"\n}\n\nconst resolveCallbackPath = (callbackPath: string) => {\n  const trimmed = callbackPath.trim()\n  return trimmed && isSafeRedirectPath(trimmed) ? trimmed : null\n}\n\nconst readTextBody = async (req: Pick<OAuthCtx[\"req\"], \"on\" | \"setEncoding\">) =>\n  await new Promise<string>((resolve, reject) => {\n    let body = \"\"\n    if (typeof req.setEncoding === \"function\") {\n      req.setEncoding(\"utf8\")\n    }\n\n    req.on(\"data\", (chunk) => {\n      body += String(chunk)\n      if (body.length > 32_768) {\n        reject(new Error(\"request_body_too_large\"))\n      }\n    })\n    req.on(\"end\", () => resolve(body))\n    req.on(\"error\", reject)\n  })\n\nconst getFormPostParams = async (ctx: OAuthCtx): Promise<Record<string, string> | null> => {\n  if (ctx.req.method !== \"POST\") return null\n\n  const contentType = typeof ctx.req.headers[\"content-type\"] === \"string\" ? ctx.req.headers[\"content-type\"] : \"\"\n  if (!contentType.includes(\"application/x-www-form-urlencoded\")) return null\n\n  const body = await readTextBody(ctx.req)\n  const params = new URLSearchParams(body)\n\n  const result: Record<string, string> = {}\n  for (const [key, value] of params.entries()) {\n    result[key] = value\n  }\n\n  return result\n}\n\nconst resolveProviderId = (ctx: OAuthCtx, providerIdOverride?: string) =>\n  (providerIdOverride ?? String(ctx.req.params?.provider ?? \"\")).trim()\n\nconst RESERVED_AUTH_PARAM_KEYS = new Set([\"__proto__\", \"prototype\", \"constructor\"])\n\nconst normalizeAuthorizationParams = (value: unknown): Record<string, string> | undefined => {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined\n\n  const result: Record<string, string> = {}\n  for (const [keyRaw, valueRaw] of Object.entries(value)) {\n    const key = keyRaw.trim()\n    if (!key) continue\n    if (RESERVED_AUTH_PARAM_KEYS.has(key)) continue\n    const val = typeof valueRaw === \"string\" ? valueRaw.trim() : \"\"\n    if (!val) continue\n    result[key] = val\n  }\n\n  return Object.keys(result).length ? result : undefined\n}\n\nexport type OAuthStartResult =\n  | { success: true; redirectUrl: string }\n  | { success: false; error: string; statusCode: number }\n\nexport const getOAuthStartRedirectUrl = async ({\n  ctx,\n  providerId: providerIdOverride,\n  returnTo,\n  authorizationParams,\n}: {\n  ctx: OAuthCtx\n  providerId?: string\n  returnTo?: string | null\n  authorizationParams?: Record<string, string>\n}): Promise<OAuthStartResult> => {\n  const providerId = resolveProviderId(ctx, providerIdOverride)\n  if (!providerId) {\n    return { success: false, error: \"missing_provider\", statusCode: 400 }\n  }\n\n  if (!isSafeOAuthProviderId(providerId)) {\n    return { success: false, error: \"invalid_provider\", statusCode: 400 }\n  }\n\n  const provider = getOAuthProviderConfig(providerId)\n  if (!provider) {\n    return { success: false, error: \"unknown_provider\", statusCode: 404 }\n  }\n\n  const origin = getRequestOrigin(ctx)\n  if (!origin) {\n    return { success: false, error: \"origin_unavailable\", statusCode: 500 }\n  }\n  const isHttps = origin.startsWith(\"https://\")\n\n  const callbackPath = resolveCallbackPath(provider.callbackPath)\n  if (!callbackPath) {\n    return { success: false, error: \"invalid_callback_path\", statusCode: 500 }\n  }\n\n  const state = crypto.randomBytes(16).toString(\"hex\")\n  const { verifier, challenge } = generatePkcePair()\n\n  const safeReturnTo = typeof returnTo === \"string\" && isSafeRedirectPath(returnTo) ? returnTo : undefined\n\n  try {\n    const OAuthRequest = await models.getGlobal(\"RBOAuthRequest\", ctx)\n    const now = new Date()\n    await OAuthRequest.create({\n      _id: state,\n      providerId,\n      codeVerifier: verifier,\n      returnTo: safeReturnTo,\n      createdAt: now,\n      expiresAt: new Date(now.getTime() + OAUTH_REQUEST_TTL_MS),\n    })\n  } catch (err) {\n    console.warn(\"oauth::failed_to_store_request\", err)\n    return { success: false, error: \"oauth_request_store_failed\", statusCode: 500 }\n  }\n\n  try {\n    ctx.res.cookie(OAUTH_STATE_COOKIE_NAME, `${providerId}:${state}`, {\n      httpOnly: true,\n      secure: isHttps,\n      sameSite: isHttps ? \"none\" : \"lax\",\n      path: callbackPath,\n      maxAge: OAUTH_REQUEST_TTL_MS,\n    })\n  } catch (err) {\n    console.warn(\"oauth::failed_to_set_state_cookie\", err)\n    return { success: false, error: \"oauth_cookie_set_failed\", statusCode: 500 }\n  }\n\n  const oidc = await getOidcWellKnown(provider.issuer)\n  const redirectUri = `${origin}${callbackPath}`\n\n  const url = new URL(oidc.authorization_endpoint)\n  url.searchParams.set(\"client_id\", provider.clientId)\n  url.searchParams.set(\"redirect_uri\", redirectUri)\n  url.searchParams.set(\"response_type\", \"code\")\n  url.searchParams.set(\"scope\", provider.scope)\n  url.searchParams.set(\"state\", state)\n  url.searchParams.set(\"code_challenge\", challenge)\n  url.searchParams.set(\"code_challenge_method\", \"S256\")\n  const extraAuthorizationParams = normalizeAuthorizationParams(authorizationParams)\n  for (const [key, value] of Object.entries(extraAuthorizationParams ?? {})) {\n    if (url.searchParams.has(key)) continue\n    url.searchParams.set(key, value)\n  }\n\n  return { success: true, redirectUrl: url.toString() }\n}\n\nexport type OAuthCallbackResult =\n  | {\n    success: true\n    type: \"signed_in\"\n    redirectPath: string\n    userId: string\n    tenantId: string\n    signedInTenants: string[]\n  }\n  | {\n    success: false\n    type: \"missing_user\"\n    providerId: string\n    subject: string\n    email?: string\n    name?: string\n    redirectPath?: string\n  }\n  | {\n    success: false\n    type: \"error\"\n    error: string\n    redirectPath: string\n  }\n\nconst OAUTH_SUCCESS_REDIRECT_PATH = \"/onboarding\"\nconst AUTH_ERROR_REDIRECT_BASE = \"/auth/sign-in\"\n\nexport const processOAuthCallback = async ({\n  ctx,\n  providerId: providerIdOverride,\n  createUserOnFirstSignIn,\n  missingUserRedirectPath,\n  successRedirectPath,\n}: {\n  ctx: OAuthCtx\n  providerId?: string\n  createUserOnFirstSignIn?: boolean\n  missingUserRedirectPath?: string\n  successRedirectPath?: string\n}): Promise<OAuthCallbackResult> => {\n  const providerId = resolveProviderId(ctx, providerIdOverride)\n  if (!providerId) {\n    return { success: false, type: \"error\", error: \"missing_provider\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=missing_provider` }\n  }\n\n  if (!isSafeOAuthProviderId(providerId)) {\n    return { success: false, type: \"error\", error: \"invalid_provider\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=invalid_provider` }\n  }\n\n  const provider = getOAuthProviderConfig(providerId)\n  if (!provider) {\n    return { success: false, type: \"error\", error: \"unknown_provider\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=unknown_provider` }\n  }\n\n  const origin = getRequestOrigin(ctx)\n  if (!origin) {\n    return { success: false, type: \"error\", error: \"origin_unavailable\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=origin_unavailable` }\n  }\n  const isHttps = origin.startsWith(\"https://\")\n\n  const callbackPath = resolveCallbackPath(provider.callbackPath)\n  if (!callbackPath) {\n    return { success: false, type: \"error\", error: \"invalid_callback_path\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=invalid_callback_path` }\n  }\n\n  const bodyParams = await getFormPostParams(ctx)\n\n  const code = (getQueryString(bodyParams?.code) ?? getQueryString(ctx.req.query?.code))?.trim() ?? \"\"\n  const state = (getQueryString(bodyParams?.state) ?? getQueryString(ctx.req.query?.state))?.trim() ?? \"\"\n  const oauthUserRaw = (getQueryString(bodyParams?.user) ?? getQueryString(ctx.req.query?.user))?.trim() ?? \"\"\n\n  if (!code || !state) {\n    return { success: false, type: \"error\", error: \"missing_code_or_state\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=missing_code_or_state` }\n  }\n\n  const stateCookieValue = getCookieValue(ctx, OAUTH_STATE_COOKIE_NAME)\n  if (stateCookieValue !== `${providerId}:${state}`) {\n    return { success: false, type: \"error\", error: \"invalid_state\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=invalid_state` }\n  }\n\n  let oauthRequest: OAuthRequestRecord | null = null\n  let OAuthRequestModel: Awaited<ReturnType<typeof models.getGlobal>> | null = null\n  try {\n    OAuthRequestModel = await models.getGlobal(\"RBOAuthRequest\", ctx)\n    oauthRequest = await OAuthRequestModel.findOne({ _id: state, providerId }).lean() as OAuthRequestRecord | null\n  } catch (err) {\n    console.warn(\"oauth::failed_to_load_request\", err)\n    return { success: false, type: \"error\", error: \"oauth_request_load_failed\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=oauth_request_load_failed` }\n  }\n\n  if (!oauthRequest) {\n    return { success: false, type: \"error\", error: \"invalid_state\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=invalid_state` }\n  }\n\n  const returnTo = typeof oauthRequest.returnTo === \"string\" ? oauthRequest.returnTo : undefined\n  const codeVerifier = typeof oauthRequest.codeVerifier === \"string\" ? oauthRequest.codeVerifier : \"\"\n  if (!codeVerifier) {\n    return { success: false, type: \"error\", error: \"missing_code_verifier\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=missing_code_verifier` }\n  }\n\n  const oidc = await getOidcWellKnown(provider.issuer)\n  const redirectUri = `${origin}${callbackPath}`\n\n  const tokenBody = new URLSearchParams()\n  tokenBody.set(\"grant_type\", \"authorization_code\")\n  tokenBody.set(\"code\", code)\n  tokenBody.set(\"redirect_uri\", redirectUri)\n  tokenBody.set(\"client_id\", provider.clientId)\n  tokenBody.set(\"code_verifier\", codeVerifier)\n  if (provider.clientSecret) {\n    tokenBody.set(\"client_secret\", provider.clientSecret)\n  }\n\n  const tokenResponse = await fetch(oidc.token_endpoint, {\n    method: \"POST\",\n    headers: {\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n      Accept: \"application/json\",\n    },\n    body: tokenBody.toString(),\n  })\n\n  const tokenJson = await tokenResponse.json().catch(() => null) as Record<string, unknown> | null\n\n  if (!tokenResponse.ok || !tokenJson || typeof tokenJson !== \"object\") {\n    const body = tokenJson ? JSON.stringify(tokenJson) : \"\"\n    console.warn(\"oauth::token_exchange failed\", tokenResponse.status, body)\n    return { success: false, type: \"error\", error: \"token_exchange_failed\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=token_exchange_failed` }\n  }\n\n  const accessToken = typeof tokenJson.access_token === \"string\" ? tokenJson.access_token : \"\"\n  const refreshToken = typeof tokenJson.refresh_token === \"string\" ? tokenJson.refresh_token : undefined\n  const idToken = typeof tokenJson.id_token === \"string\" ? tokenJson.id_token : undefined\n  const scope = typeof tokenJson.scope === \"string\" ? tokenJson.scope : undefined\n  const tokenType = typeof tokenJson.token_type === \"string\" ? tokenJson.token_type : undefined\n  const expiresIn = typeof tokenJson.expires_in === \"number\"\n    ? tokenJson.expires_in\n    : typeof tokenJson.expires_in === \"string\"\n      ? Number(tokenJson.expires_in)\n      : undefined\n  const expiresInSeconds = typeof expiresIn === \"number\" && Number.isFinite(expiresIn) ? expiresIn : null\n  const expiresAt = expiresInSeconds !== null ? new Date(Date.now() + expiresInSeconds * 1000) : undefined\n\n  let userInfo: Record<string, unknown> | null = null\n\n  if (oidc.userinfo_endpoint && accessToken) {\n    const userInfoResponse = await fetch(oidc.userinfo_endpoint, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        Accept: \"application/json\",\n      },\n    })\n\n    if (userInfoResponse.ok) {\n      userInfo = await userInfoResponse.json().catch(() => null) as Record<string, unknown> | null\n    }\n  }\n\n  const idTokenPayload = idToken ? decodeJwtPayload<Record<string, unknown>>(idToken) : null\n  const accessTokenPayload = decodeJwtPayload<Record<string, unknown>>(accessToken)\n\n  const subject = typeof userInfo?.sub === \"string\"\n    ? userInfo.sub\n    : typeof idTokenPayload?.sub === \"string\"\n      ? idTokenPayload.sub\n      : typeof accessTokenPayload?.sub === \"string\"\n        ? accessTokenPayload.sub\n        : \"\"\n\n  if (!subject) {\n    return { success: false, type: \"error\", error: \"missing_subject\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=missing_subject` }\n  }\n\n  const email = typeof userInfo?.email === \"string\"\n    ? userInfo.email\n    : typeof idTokenPayload?.email === \"string\"\n      ? idTokenPayload.email\n      : undefined\n\n  const name = typeof userInfo?.name === \"string\"\n    ? userInfo.name\n    : typeof idTokenPayload?.name === \"string\"\n      ? idTokenPayload.name\n      : undefined\n\n  let oauthUser: unknown = null\n  if (oauthUserRaw) {\n    try {\n      oauthUser = JSON.parse(oauthUserRaw) as unknown\n    } catch {\n      oauthUser = null\n    }\n  }\n  const oauthUserRecord = oauthUser && typeof oauthUser === \"object\"\n    ? (oauthUser as Record<string, unknown>)\n    : null\n  const oauthUserEmail = typeof oauthUserRecord?.email === \"string\" ? oauthUserRecord.email.trim() : \"\"\n  const oauthUserNameRecord = oauthUserRecord?.name && typeof oauthUserRecord.name === \"object\"\n    ? (oauthUserRecord.name as Record<string, unknown>)\n    : null\n  const oauthUserNameFirst = typeof oauthUserNameRecord?.firstName === \"string\" ? oauthUserNameRecord.firstName.trim() : \"\"\n  const oauthUserNameLast = typeof oauthUserNameRecord?.lastName === \"string\" ? oauthUserNameRecord.lastName.trim() : \"\"\n  const oauthUserName = [oauthUserNameFirst, oauthUserNameLast].filter(Boolean).join(\" \").trim()\n\n  const resolvedEmail = email ?? (oauthUserEmail || undefined)\n  const resolvedName = name ?? (oauthUserName || undefined)\n\n  const [User, Tenant] = await Promise.all([\n    models.getGlobal(\"RBUser\", ctx),\n    models.getGlobal(\"RBTenant\", ctx),\n  ])\n\n  const subjectQueryKey = `oauthProviders.${providerId}.subject`\n  let user = await User.findOne({ [subjectQueryKey]: subject })\n\n  if (!user && resolvedEmail) {\n    user = await User.findOne({ email: resolvedEmail })\n  }\n\n  const shouldCreateUser = createUserOnFirstSignIn ?? true\n  if (!user && !shouldCreateUser) {\n    const redirectPath = missingUserRedirectPath\n\n    const result: OAuthCallbackResult = {\n      success: false,\n      type: \"missing_user\",\n      providerId,\n      subject,\n      email: resolvedEmail,\n      name: resolvedName,\n    }\n\n    if (redirectPath && isSafeRedirectPath(redirectPath)) {\n      const url = new URL(redirectPath, origin)\n      url.searchParams.set(\"oauth_provider\", providerId)\n      if (resolvedEmail) url.searchParams.set(\"email\", resolvedEmail)\n      if (resolvedName) url.searchParams.set(\"name\", resolvedName)\n      result.redirectPath = `${url.pathname}${url.search}`\n    }\n\n    return result\n  }\n\n  if (!ctx.req.session) {\n    return { success: false, type: \"error\", error: \"session_unavailable\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=session_unavailable` }\n  }\n\n  const now = new Date()\n\n  let providerCreatedAt: Date | undefined\n  const oauthProviders = user?.get(\"oauthProviders\") as Map<string, { createdAt?: unknown }> | undefined\n  const existingProvider = oauthProviders?.get(providerId)\n  if (existingProvider?.createdAt instanceof Date) {\n    providerCreatedAt = existingProvider.createdAt\n  }\n\n  const oauthProviderPayload = {\n    subject,\n    email: resolvedEmail,\n    name: resolvedName,\n    accessToken,\n    refreshToken,\n    idToken,\n    scope,\n    tokenType,\n    expiresAt,\n    rawUserInfo: userInfo ?? undefined,\n    createdAt: providerCreatedAt ?? now,\n    updatedAt: now,\n  }\n\n  if (!user) {\n    const tenantId = crypto.randomUUID()\n    const password = await hashPasswordForStorage(crypto.randomBytes(32).toString(\"hex\"))\n\n    user = new User({\n      email: resolvedEmail,\n      name: resolvedName,\n      password,\n      tenants: [tenantId],\n      tenantRoles: {\n        [tenantId]: [\"owner\"],\n      },\n      oauthProviders: {\n        [providerId]: oauthProviderPayload,\n      },\n    })\n\n    await user.save()\n\n    try {\n      await Tenant.create({\n        tenantId,\n        name: resolvedEmail || subject,\n      })\n    } catch (err) {\n      console.warn(\"oauth::failed_to_create_tenant\", err)\n    }\n  } else {\n    const setFields: Record<string, unknown> = {\n      [`oauthProviders.${providerId}`]: oauthProviderPayload,\n    }\n\n    if (!user.email && resolvedEmail) {\n      setFields.email = resolvedEmail\n    }\n\n    if (!user.name && resolvedName) {\n      setFields.name = resolvedName\n    }\n\n    await User.updateOne({ _id: user._id }, { $set: setFields })\n  }\n\n  const signedInTenants = (user.tenants || []).map(String)\n  const tenantId = signedInTenants[0]\n  if (!tenantId) {\n    return {\n      success: false,\n      type: \"error\",\n      error: \"tenant_unavailable\",\n      redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=tenant_unavailable`,\n    }\n  }\n  const tenantRolesMap = user.get(\"tenantRoles\") as Map<string, string[]> | undefined\n  const tenantRoles = tenantRolesMap ? Object.fromEntries(tenantRolesMap.entries()) : undefined\n\n  if (!completeAuthSignIn(ctx, {\n    userId: user._id.toString(),\n    currentTenantId: tenantId,\n    signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],\n    tenantRoles,\n  })) {\n    return {\n      success: false,\n      type: \"error\",\n      error: \"session_unavailable\",\n      redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=session_unavailable`,\n    }\n  }\n\n  try {\n    if (OAuthRequestModel) {\n      await OAuthRequestModel.deleteOne({ _id: state, providerId })\n    }\n  } catch (err) {\n    console.warn(\"oauth::failed_to_delete_request\", err)\n  }\n\n  try {\n    ctx.res.clearCookie(OAUTH_STATE_COOKIE_NAME, {\n      httpOnly: true,\n      secure: isHttps,\n      sameSite: isHttps ? \"none\" : \"lax\",\n      path: callbackPath,\n    })\n  } catch (err) {\n    console.warn(\"oauth::failed_to_clear_state_cookie\", err)\n  }\n\n  const redirectPath = returnTo && isSafeRedirectPath(returnTo)\n    ? returnTo\n    : successRedirectPath && isSafeRedirectPath(successRedirectPath)\n      ? successRedirectPath\n      : OAUTH_SUCCESS_REDIRECT_PATH\n\n  return {\n    success: true,\n    type: \"signed_in\",\n    redirectPath,\n    userId: user._id.toString(),\n    tenantId,\n    signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],\n  }\n}\n\nexport const createOAuthStartHandler = ({\n  providerId,\n  getAuthorizationParams,\n}: {\n  providerId?: string\n  getAuthorizationParams?: (providerId: string) => Record<string, string> | undefined\n} = {}): ApiHandler<unknown, { success: boolean; error?: string }, AuthSessionUser> => async (\n  _payload,\n  ctx,\n) => {\n  const resolvedProviderId = resolveProviderId(ctx, providerId)\n  const providerAuthorizationParams = resolvedProviderId && getAuthorizationParams\n    ? getAuthorizationParams(resolvedProviderId)\n    : undefined\n  const returnTo = getQueryString(ctx.req.query?.returnTo)?.trim()\n  const result = await getOAuthStartRedirectUrl({\n    ctx,\n    providerId: resolvedProviderId,\n    returnTo,\n    authorizationParams: providerAuthorizationParams,\n  })\n\n  if (!result.success) {\n    ctx.res.status(result.statusCode)\n    return { success: false, error: result.error }\n  }\n\n  ctx.res.redirect(result.redirectUrl)\n  return { success: true }\n}\n\nexport const createOAuthCallbackHandler = ({\n  providerId,\n  createUserOnFirstSignIn,\n  missingUserRedirectPath,\n  successRedirectPath,\n}: {\n  providerId?: string\n  createUserOnFirstSignIn?: boolean\n  missingUserRedirectPath?: string\n  successRedirectPath?: string\n} = {}): ApiHandler<unknown, { success: boolean; error?: string }, AuthSessionUser> => async (\n  _payload,\n  ctx,\n) => {\n  const result = await processOAuthCallback({\n    ctx,\n    providerId,\n    createUserOnFirstSignIn,\n    missingUserRedirectPath,\n    successRedirectPath,\n  })\n\n  if (result.type === \"error\") {\n    ctx.res.redirect(result.redirectPath)\n    return { success: false, error: result.error }\n  }\n\n  if (result.type === \"missing_user\") {\n    if (result.redirectPath) {\n      ctx.res.redirect(result.redirectPath)\n    } else {\n      ctx.res.redirect(\"/auth/sign-up\")\n    }\n    return { success: false, error: \"user_not_found\" }\n  }\n\n  ctx.res.redirect(result.redirectPath)\n  return { success: true }\n}\n\nconst base64UrlEncode = (input: Buffer | string) =>\n  Buffer.from(input)\n    .toString(\"base64\")\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/g, \"\")\n\nexport const createAppleClientSecret = ({\n  teamId,\n  clientId,\n  keyId,\n  privateKeyPem,\n  now = new Date(),\n  expiresInSeconds = 10 * 60,\n}: {\n  teamId: string\n  clientId: string\n  keyId: string\n  privateKeyPem: string\n  now?: Date\n  expiresInSeconds?: number\n}) => {\n  const teamIdValue = teamId.trim()\n  const clientIdValue = clientId.trim()\n  const keyIdValue = keyId.trim()\n  const privateKeyPemValue = privateKeyPem.trim()\n\n  if (!teamIdValue) throw new Error(\"teamId is required\")\n  if (!clientIdValue) throw new Error(\"clientId is required\")\n  if (!keyIdValue) throw new Error(\"keyId is required\")\n  if (!privateKeyPemValue) throw new Error(\"privateKeyPem is required\")\n\n  const nowSeconds = Math.floor(now.getTime() / 1000)\n  const expiresIn = Number.isFinite(expiresInSeconds) ? expiresInSeconds : 10 * 60\n  const exp = nowSeconds + Math.max(60, Math.min(expiresIn, 60 * 60 * 24 * 180))\n\n  const header = { alg: \"ES256\", kid: keyIdValue, typ: \"JWT\" }\n  const payload = {\n    iss: teamIdValue,\n    iat: nowSeconds,\n    exp,\n    aud: \"https://appleid.apple.com\",\n    sub: clientIdValue,\n  }\n\n  const signingInput = `${base64UrlEncode(JSON.stringify(header))}.${base64UrlEncode(JSON.stringify(payload))}`\n  const signature = crypto.sign(\"sha256\", Buffer.from(signingInput), {\n    key: privateKeyPemValue,\n    dsaEncoding: \"ieee-p1363\",\n  })\n\n  return `${signingInput}.${base64UrlEncode(signature)}`\n}\n"],"mappings":";;;;;AAcA,IAAMU,YAAYC,OAAOC,IAAI,8BAA8B;AAE3D,IAAMC,iBAAsC;CAC1C,MAAMC,YAAYC;CAClB,MAAMC,WAAWF,UAAUJ;CAC3B,IAAIM,YAAY,OAAOA,aAAa,YAAYA,SAASP,aAAa,OAAOO,SAASP,cAAc,UAClG,OAAOO;CAGT,MAAMC,UAA+B,EAAER,WAAW,CAAC,EAAE;CACrDK,UAAUJ,aAAaO;CACvB,OAAOA;AACT;AAEA,IAAMC,sBAAsBT,cAAyE;CACnG,MAAMU,SAA+B,CAAC;CAEtC,MAAMC,sBAAsBC,cAAsB;EAChD,IAAI,CAACA,UAAUC,WAAW,GAAG,GAAG,OAAO;EACvC,IAAID,UAAUC,WAAW,IAAI,GAAG,OAAO;EACvC,OAAO;CACT;CAEA,KAAK,MAAM,CAACC,eAAeC,UAAUC,OAAOC,QAAQjB,SAAS,GAAG;EAC9D,MAAMkB,aAAaJ,cAAcK,KAAK;EACtC,IAAI,CAACD,YAAY;EAEjB,MAAM1B,SAAS,OAAOuB,OAAOvB,WAAW,WAAWuB,MAAMvB,OAAO2B,KAAK,IAAI;EACzE,MAAM1B,WAAW,OAAOsB,OAAOtB,aAAa,WAAWsB,MAAMtB,SAAS0B,KAAK,IAAI;EAC/E,IAAI,CAAC3B,QAAQ,MAAM,IAAI4B,MAAM,mBAAmBF,WAAU,iBAAkB;EAC5E,IAAI,CAACzB,UAAU,MAAM,IAAI2B,MAAM,mBAAmBF,WAAU,mBAAoB;EAEhF,MAAMxB,eAAe,OAAOqB,OAAOrB,iBAAiB,YAAYqB,MAAMrB,aAAayB,KAAK,IACpFJ,MAAMrB,eACN2B,KAAAA;EAEJ,MAAM1B,QAAQ,OAAOoB,OAAOpB,UAAU,WAAWoB,MAAMpB,MAAMwB,KAAK,IAAI;EACtE,IAAI,CAACxB,OAAO,MAAM,IAAIyB,MAAM,mBAAmBF,WAAU,gBAAiB;EAE1E,MAAMtB,eAAe,OAAOmB,OAAOnB,iBAAiB,WAChDmB,MAAMnB,aAAauB,KAAK,IACxB;EACJ,IAAI,CAACvB,cAAc,MAAM,IAAIwB,MAAM,mBAAmBF,WAAU,uBAAwB;EACxF,IAAI,CAACP,mBAAmBf,YAAY,GAAG,MAAM,IAAIwB,MAAM,mBAAmBF,WAAU,2BAA4B;EAEhHR,OAAOQ,cAAc;GACnB1B;GACAC;GACAC;GACAC;GACAC;EACF;CACF;CAEA,OAAOc;AACT;AAEA,IAAaY,2BAA2BtB,cAAmD;CACzF,MAAMuB,QAAQnB,SAAS;CACvB,MAAMoB,aAAaf,mBAAmBT,SAAS;CAC/CuB,MAAMvB,YAAY;EAAE,GAAGuB,MAAMvB;EAAW,GAAGwB;CAAW;AACxD;AAEA,IAAaC,qBAAqBzB,cAAmD;CACnF,MAAMuB,QAAQnB,SAAS;CACvBmB,MAAMvB,YAAYS,mBAAmBT,SAAS;AAChD;AAEA,IAAa0B,0BAA0BR,eAAmD;CAExF,OADcd,SACPmB,CAAAA,CAAMvB,UAAUkB,eAAe;AACxC;;;ACrFA,IAAMS,mBAAmBC,UAAkB;CACzC,MAAMC,SAASD,MAAME,QAAQ,MAAM,GAAG,CAAC,CAACA,QAAQ,MAAM,GAAG,IAAI,MAAMC,OAAOH,MAAMI,SAAS,KAAK,CAAC;CAC/F,OAAOC,OAAOC,KAAKL,QAAQ,QAAQ,CAAC,CAACM,SAAS,MAAM;AACtD;AAEA,IAAaC,oBAAiDE,UAA4B;CACxF,MAAME,QAAQF,MAAMG,MAAM,GAAG;CAC7B,IAAID,MAAMR,SAAS,GAAG,OAAO;CAE7B,IAAI;EACF,MAAMU,OAAOf,gBAAgBa,MAAM,EAAE;EACrC,MAAMG,SAASC,KAAKC,MAAMH,IAAI;EAC9B,IAAI,CAACC,UAAU,OAAOA,WAAW,UAAU,OAAO;EAClD,OAAOA;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;ACTA,IAAMS,wBAAQ,IAAIC,IAAoC;AAEtD,IAAME,mBAAmBC,QAAgBA,IAAIC,KAAK,CAAC,CAACC,QAAQ,QAAQ,EAAE;AAEtE,IAAaC,mBAAmB,OAAOC,cAA8C;CACnF,MAAMb,SAASQ,gBAAgBK,SAAS;CACxC,IAAI,CAACb,QACH,MAAM,IAAIc,MAAM,yBAAyB;CAG3C,MAAMC,WAAWV,MAAMW,IAAIhB,MAAM;CACjC,IAAIe,UACF,OAAOA;CAGT,MAAME,UAAU,YAAY;EAC1B,MAAMC,MAAM,IAAIC,IAAI,qCAAqCnB,MAAM;EAC/D,MAAMoB,WAAW,MAAMC,MAAMH,KAAK,EAAEI,SAAS,EAAEC,QAAQ,mBAAmB,EAAE,CAAC;EAC7E,IAAI,CAACH,SAASI,IAAI;GAChB,MAAMC,OAAO,MAAML,SAASM,KAAK,CAAC,CAACC,YAAY,EAAE;GACjD,MAAM,IAAIb,MAAM,4CAA4CM,SAASQ,OAAM,GAAIH,MAAM;EACvF;EAEA,MAAMI,OAAO,MAAMT,SAASS,KAAK,CAAC,CAACF,YAAY,IAAI;EACnD,IAAI,CAACE,QAAQ,OAAOA,SAAS,UAC3B,MAAM,IAAIf,MAAM,iCAAiC;EAGnD,MAAMiB,wBAAwB,OAAOF,KAAK5B,2BAA2B,WACjE4B,KAAK5B,yBACL;EACJ,MAAM+B,gBAAgB,OAAOH,KAAK3B,mBAAmB,WACjD2B,KAAK3B,iBACL;EACJ,MAAM+B,cAAc,OAAOJ,KAAK7B,WAAW,WAAW6B,KAAK7B,SAASA;EACpE,MAAMkC,mBAAmB,OAAOL,KAAK1B,sBAAsB,WAAW0B,KAAK1B,oBAAoBgC,KAAAA;EAC/F,MAAMC,UAAU,OAAOP,KAAKzB,aAAa,WAAWyB,KAAKzB,WAAW+B,KAAAA;EAEpE,IAAI,CAACJ,yBAAyB,CAACC,eAC7B,MAAM,IAAIlB,MAAM,oDAAoD;EAGtE,OAAO;GACLd,QAAQiC;GACRhC,wBAAwB8B;GACxB7B,gBAAgB8B;GAChB7B,mBAAmB+B;GACnB9B,UAAUgC;EACZ;CACF,EAAA,CAAG;CAEH/B,MAAMgC,IAAIrC,QAAQiB,MAAM;CAExB,IAAI;EACF,OAAO,MAAMA;CACf,SAASqB,KAAK;EACZjC,MAAMkC,OAAOvC,MAAM;EACnB,MAAMsC;CACR;AACF;;;AChEA,IAAaG,qBAAmBC,UAAkBA,MAC/CE,SAAS,QAAQ,CAAC,CAClBC,QAAQ,OAAO,GAAG,CAAC,CACnBA,QAAQ,OAAO,GAAG,CAAC,CACnBA,QAAQ,QAAQ,EAAE;AAErB,IAAaC,yBAAyB;CACpC,MAAMC,WAAWN,kBAAgBD,OAAOQ,YAAY,EAAE,CAAC;CAGvD,OAAO;EAAED;EAAUE,WAFDR,kBAAgBD,OAAOU,WAAW,QAAQ,CAAC,CAACC,OAAOJ,QAAQ,CAAC,CAACK,OAAO,CAEnEH;CAAU;AAC/B;;;ACdA,IAAMI,gCAAgB,IAAIC,IAAI;CAAC;CAAa;CAAa;AAAa,CAAC;AAEvE,IAAaC,yBAAyBC,UAAkB;CACtD,MAAMC,aAAaD,MAAME,KAAK;CAC9B,IAAI,CAACD,YAAY,OAAO;CACxB,IAAIA,WAAWE,SAAS,KAAK,OAAO;CACpC,IAAIN,cAAcO,IAAIH,UAAU,GAAG,OAAO;CAC1C,OAAO,mBAAmBI,KAAKJ,UAAU;AAC3C;;;ACOA,IAAMiB,uBAAuB,MAAU;AACvC,IAAMC,0BAA0B;AAOhC,IAAMK,kBAAkBC,UAAmB;CACzC,IAAI,OAAOA,UAAU,UAAU,OAAOA;CACtC,IAAIC,MAAMC,QAAQF,KAAK,KAAK,OAAOA,MAAM,OAAO,UAAU,OAAOA,MAAM;CACvE,OAAO;AACT;AAEA,IAAMG,kBAAkBC,KAAeC,SAAgC;CACrE,MAAMC,SAASF,IAAIG,IAAIC,SAASC;CAChC,IAAI,OAAOH,WAAW,YAAY,CAACA,QAAQ,OAAO;CAElD,KAAK,MAAMI,QAAQJ,OAAOK,MAAM,GAAG,GAAG;EACpC,MAAM,CAACC,QAAQ,GAAGC,QAAQH,KAAKC,MAAM,GAAG;EACxC,MAAMG,MAAMF,QAAQG,KAAK;EACzB,IAAI,CAACD,OAAOA,QAAQT,MAAM;EAC1B,MAAMW,WAAWH,KAAKI,KAAK,GAAG,CAAC,CAACF,KAAK;EACrC,IAAI,CAACC,UAAU,OAAO;EACtB,IAAI;GACF,OAAOE,mBAAmBF,QAAQ;EACpC,QAAQ;GACN,OAAOA;EACT;CACF;CAEA,OAAO;AACT;AAEA,IAAMG,sBAAsBC,cAAsB;CAChD,IAAI,CAACA,UAAUC,WAAW,GAAG,GAAG,OAAO;CACvC,IAAID,UAAUC,WAAW,IAAI,GAAG,OAAO;CACvC,OAAO;AACT;AAEA,IAAMC,oBAAoBlB,QAAkB;CAC1C,MAAMmB,cAAcnB,IAAIG,IAAIC,QAAQ;CACpC,MAAMgB,aAAapB,IAAIG,IAAIC,QAAQ;CAEnC,MAAMiB,WAAW,OAAOF,gBAAgB,WACpCA,YAAYZ,MAAM,GAAG,CAAC,CAAC,EAAE,CAACI,KAAK,IAC/BX,IAAIG,IAAIkB;CAEZ,MAAMC,OAAO,OAAOF,eAAe,WAC/BA,WAAWb,MAAM,GAAG,CAAC,CAAC,EAAE,CAACI,KAAK,IAC9BX,IAAIG,IAAIoB,IAAI,MAAM;CAEtB,OAAOF,YAAYC,OAAO,GAAGD,SAAQ,KAAMC,SAAS;AACtD;AAEA,IAAME,uBAAuBC,iBAAyB;CACpD,MAAMC,UAAUD,aAAad,KAAK;CAClC,OAAOe,WAAWX,mBAAmBW,OAAO,IAAIA,UAAU;AAC5D;AAEA,IAAMC,eAAe,OAAOxB,QAC1B,MAAM,IAAI0B,SAAiBC,SAASC,WAAW;CAC7C,IAAIC,OAAO;CACX,IAAI,OAAO7B,IAAI8B,gBAAgB,YAC7B9B,IAAI8B,YAAY,MAAM;CAGxB9B,IAAI+B,GAAG,SAASC,UAAU;EACxBH,QAAQI,OAAOD,KAAK;EACpB,IAAIH,KAAKK,SAAS,OAChBN,uBAAO,IAAIO,MAAM,wBAAwB,CAAC;CAE9C,CAAC;CACDnC,IAAI+B,GAAG,aAAaJ,QAAQE,IAAI,CAAC;CACjC7B,IAAI+B,GAAG,SAASH,MAAM;AACxB,CAAC;AAEH,IAAMQ,oBAAoB,OAAOvC,QAA0D;CACzF,IAAIA,IAAIG,IAAIsC,WAAW,QAAQ,OAAO;CAGtC,IAAI,EADgB,OAAOzC,IAAIG,IAAIC,QAAQ,oBAAoB,WAAWJ,IAAIG,IAAIC,QAAQ,kBAAkB,GAAA,CAC3FuC,SAAS,mCAAmC,GAAG,OAAO;CAEvE,MAAMX,OAAO,MAAML,aAAa3B,IAAIG,GAAG;CACvC,MAAMyC,SAAS,IAAIC,gBAAgBb,IAAI;CAEvC,MAAMc,SAAiC,CAAC;CACxC,KAAK,MAAM,CAACpC,KAAKd,UAAUgD,OAAOG,QAAQ,GACxCD,OAAOpC,OAAOd;CAGhB,OAAOkD;AACT;AAEA,IAAME,qBAAqBhD,KAAeiD,wBACvCA,sBAAsBb,OAAOpC,IAAIG,IAAIyC,QAAQM,YAAY,EAAE,EAAA,CAAGvC,KAAK;AAEtE,IAAMwC,2CAA2B,IAAIC,IAAI;CAAC;CAAa;CAAa;AAAa,CAAC;AAElF,IAAMC,gCAAgCzD,UAAuD;CAC3F,IAAI,CAACA,SAAS,OAAOA,UAAU,YAAYC,MAAMC,QAAQF,KAAK,GAAG,OAAO0D,KAAAA;CAExE,MAAMR,SAAiC,CAAC;CACxC,KAAK,MAAM,CAACS,QAAQC,aAAaC,OAAOV,QAAQnD,KAAK,GAAG;EACtD,MAAMc,MAAM6C,OAAO5C,KAAK;EACxB,IAAI,CAACD,KAAK;EACV,IAAIyC,yBAAyBO,IAAIhD,GAAG,GAAG;EACvC,MAAMiD,MAAM,OAAOH,aAAa,WAAWA,SAAS7C,KAAK,IAAI;EAC7D,IAAI,CAACgD,KAAK;EACVb,OAAOpC,OAAOiD;CAChB;CAEA,OAAOF,OAAOG,KAAKd,MAAM,CAAC,CAACT,SAASS,SAASQ,KAAAA;AAC/C;AAMA,IAAaY,2BAA2B,OAAO,EAC7ClE,KACAmE,YAAYlB,oBACZxD,UACA2E,0BAM+B;CAC/B,MAAMD,aAAanB,kBAAkBhD,KAAKiD,kBAAkB;CAC5D,IAAI,CAACkB,YACH,OAAO;EAAEL,SAAS;EAAOE,OAAO;EAAoBC,YAAY;CAAI;CAGtE,IAAI,CAAC7E,sBAAsB+E,UAAU,GACnC,OAAO;EAAEL,SAAS;EAAOE,OAAO;EAAoBC,YAAY;CAAI;CAGtE,MAAMf,WAAWlE,uBAAuBmF,UAAU;CAClD,IAAI,CAACjB,UACH,OAAO;EAAEY,SAAS;EAAOE,OAAO;EAAoBC,YAAY;CAAI;CAGtE,MAAMI,SAASnD,iBAAiBlB,GAAG;CACnC,IAAI,CAACqE,QACH,OAAO;EAAEP,SAAS;EAAOE,OAAO;EAAsBC,YAAY;CAAI;CAExE,MAAMK,UAAUD,OAAOpD,WAAW,UAAU;CAE5C,MAAMQ,eAAeD,oBAAoB0B,SAASzB,YAAY;CAC9D,IAAI,CAACA,cACH,OAAO;EAAEqC,SAAS;EAAOE,OAAO;EAAyBC,YAAY;CAAI;CAG3E,MAAMM,QAAQ9F,OAAO+F,YAAY,EAAE,CAAC,CAACC,SAAS,KAAK;CACnD,MAAM,EAAEC,UAAUC,cAAcxF,iBAAiB;CAEjD,MAAMyF,eAAe,OAAOnF,aAAa,YAAYsB,mBAAmBtB,QAAQ,IAAIA,WAAW6D,KAAAA;CAE/F,IAAI;EACF,MAAMuB,eAAe,MAAMjG,OAAOkG,UAAU,kBAAkB9E,GAAG;EACjE,MAAM+E,sBAAM,IAAIC,KAAK;EACrB,MAAMH,aAAaI,OAAO;GACxBC,KAAKX;GACLJ;GACAzE,cAAcgF;GACdjF,UAAUmF;GACVO,WAAWJ;GACXK,WAAW,IAAIJ,KAAKD,IAAIM,QAAQ,IAAIhG,oBAAoB;EAC1D,CAAC;CACH,SAASiG,KAAK;EACZC,QAAQC,KAAK,kCAAkCF,GAAG;EAClD,OAAO;GAAExB,SAAS;GAAOE,OAAO;GAA8BC,YAAY;EAAI;CAChF;CAEA,IAAI;EACFjE,IAAIyF,IAAIpF,OAAOf,yBAAyB,GAAG6E,WAAU,GAAII,SAAS;GAChEmB,UAAU;GACVC,QAAQrB;GACRsB,UAAUtB,UAAU,SAAS;GAC7BuB,MAAMpE;GACNqE,QAAQzG;EACV,CAAC;CACH,SAASiG,KAAK;EACZC,QAAQC,KAAK,qCAAqCF,GAAG;EACrD,OAAO;GAAExB,SAAS;GAAOE,OAAO;GAA2BC,YAAY;EAAI;CAC7E;CAEA,MAAM8B,OAAO,MAAM7G,iBAAiBgE,SAAS8C,MAAM;CACnD,MAAMC,cAAc,GAAG5B,SAAS5C;CAEhC,MAAMyE,MAAM,IAAIC,IAAIJ,KAAKK,sBAAsB;CAC/CF,IAAIG,aAAaC,IAAI,aAAapD,SAASqD,QAAQ;CACnDL,IAAIG,aAAaC,IAAI,gBAAgBL,WAAW;CAChDC,IAAIG,aAAaC,IAAI,iBAAiB,MAAM;CAC5CJ,IAAIG,aAAaC,IAAI,SAASpD,SAASsD,KAAK;CAC5CN,IAAIG,aAAaC,IAAI,SAAS/B,KAAK;CACnC2B,IAAIG,aAAaC,IAAI,kBAAkB3B,SAAS;CAChDuB,IAAIG,aAAaC,IAAI,yBAAyB,MAAM;CACpD,MAAMG,2BAA2BpD,6BAA6Be,mBAAmB;CACjF,KAAK,MAAM,CAAC1D,KAAKd,UAAU6D,OAAOV,QAAQ0D,4BAA4B,CAAC,CAAC,GAAG;EACzE,IAAIP,IAAIG,aAAa3C,IAAIhD,GAAG,GAAG;EAC/BwF,IAAIG,aAAaC,IAAI5F,KAAKd,KAAK;CACjC;CAEA,OAAO;EAAEkE,SAAS;EAAMC,aAAamC,IAAIzB,SAAS;CAAE;AACtD;AA2BA,IAAMyC,8BAA8B;AACpC,IAAMC,2BAA2B;AAEjC,IAAaC,uBAAuB,OAAO,EACzCpH,KACAmE,YAAYlB,oBACZoE,yBACAC,yBACAC,0BAOkC;CAClC,MAAMpD,aAAanB,kBAAkBhD,KAAKiD,kBAAkB;CAC5D,IAAI,CAACkB,YACH,OAAO;EAAEL,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAoB4C,cAAc,GAAGO,yBAAwB;CAA0B;CAGxI,IAAI,CAAC/H,sBAAsB+E,UAAU,GACnC,OAAO;EAAEL,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAoB4C,cAAc,GAAGO,yBAAwB;CAA0B;CAGxI,MAAMjE,WAAWlE,uBAAuBmF,UAAU;CAClD,IAAI,CAACjB,UACH,OAAO;EAAEY,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAoB4C,cAAc,GAAGO,yBAAwB;CAA0B;CAGxI,MAAM9C,SAASnD,iBAAiBlB,GAAG;CACnC,IAAI,CAACqE,QACH,OAAO;EAAEP,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAsB4C,cAAc,GAAGO,yBAAwB;CAA4B;CAE5I,MAAM7C,UAAUD,OAAOpD,WAAW,UAAU;CAE5C,MAAMQ,eAAeD,oBAAoB0B,SAASzB,YAAY;CAC9D,IAAI,CAACA,cACH,OAAO;EAAEqC,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAyB4C,cAAc,GAAGO,yBAAwB;CAA+B;CAGlJ,MAAMK,aAAa,MAAMjF,kBAAkBvC,GAAG;CAE9C,MAAMyH,QAAQ9H,eAAe6H,YAAYC,IAAI,KAAK9H,eAAeK,IAAIG,IAAIuH,OAAOD,IAAI,EAAA,EAAI9G,KAAK,KAAK;CAClG,MAAM4D,SAAS5E,eAAe6H,YAAYjD,KAAK,KAAK5E,eAAeK,IAAIG,IAAIuH,OAAOnD,KAAK,EAAA,EAAI5D,KAAK,KAAK;CACrG,MAAMgH,gBAAgBhI,eAAe6H,YAAYI,IAAI,KAAKjI,eAAeK,IAAIG,IAAIuH,OAAOE,IAAI,EAAA,EAAIjH,KAAK,KAAK;CAE1G,IAAI,CAAC8G,QAAQ,CAAClD,OACZ,OAAO;EAAET,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAyB4C,cAAc,GAAGO,yBAAwB;CAA+B;CAIlJ,IADyBpH,eAAeC,KAAKV,uBACzCuI,MAAqB,GAAG1D,WAAU,GAAII,SACxC,OAAO;EAAET,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAiB4C,cAAc,GAAGO,yBAAwB;CAAuB;CAGlI,IAAIW,eAA0C;CAC9C,IAAIC,oBAAyE;CAC7E,IAAI;EACFA,oBAAoB,MAAMnJ,OAAOkG,UAAU,kBAAkB9E,GAAG;EAChE8H,eAAe,MAAMC,kBAAkBG,QAAQ;GAAEhD,KAAKX;GAAOJ;EAAW,CAAC,CAAC,CAACgE,KAAK;CAClF,SAAS7C,KAAK;EACZC,QAAQC,KAAK,iCAAiCF,GAAG;EACjD,OAAO;GAAExB,SAAS;GAAO6C,MAAM;GAAS3C,OAAO;GAA6B4C,cAAc,GAAGO,yBAAwB;EAAmC;CAC1J;CAEA,IAAI,CAACW,cACH,OAAO;EAAEhE,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAiB4C,cAAc,GAAGO,yBAAwB;CAAuB;CAGlI,MAAM1H,WAAW,OAAOqI,aAAarI,aAAa,WAAWqI,aAAarI,WAAW6D,KAAAA;CACrF,MAAM5D,eAAe,OAAOoI,aAAapI,iBAAiB,WAAWoI,aAAapI,eAAe;CACjG,IAAI,CAACA,cACH,OAAO;EAAEoE,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAyB4C,cAAc,GAAGO,yBAAwB;CAA+B;CAGlJ,MAAMpB,OAAO,MAAM7G,iBAAiBgE,SAAS8C,MAAM;CACnD,MAAMC,cAAc,GAAG5B,SAAS5C;CAEhC,MAAM2G,YAAY,IAAIvF,gBAAgB;CACtCuF,UAAU9B,IAAI,cAAc,oBAAoB;CAChD8B,UAAU9B,IAAI,QAAQmB,IAAI;CAC1BW,UAAU9B,IAAI,gBAAgBL,WAAW;CACzCmC,UAAU9B,IAAI,aAAapD,SAASqD,QAAQ;CAC5C6B,UAAU9B,IAAI,iBAAiB5G,YAAY;CAC3C,IAAIwD,SAASmF,cACXD,UAAU9B,IAAI,iBAAiBpD,SAASmF,YAAY;CAGtD,MAAMC,gBAAgB,MAAMC,MAAMxC,KAAKyC,gBAAgB;EACrD/F,QAAQ;EACRrC,SAAS;GACP,gBAAgB;GAChBqI,QAAQ;EACV;EACAzG,MAAMoG,UAAU3D,SAAS;CAC3B,CAAC;CAED,MAAMiE,YAAY,MAAMJ,cAAcK,KAAK,CAAC,CAACC,YAAY,IAAI;CAE7D,IAAI,CAACN,cAAcO,MAAM,CAACH,aAAa,OAAOA,cAAc,UAAU;EACpE,MAAM1G,OAAO0G,YAAYI,KAAKC,UAAUL,SAAS,IAAI;EACrDnD,QAAQC,KAAK,gCAAgC8C,cAAcU,QAAQhH,IAAI;EACvE,OAAO;GAAE8B,SAAS;GAAO6C,MAAM;GAAS3C,OAAO;GAAyB4C,cAAc,GAAGO,yBAAwB;EAA+B;CAClJ;CAEA,MAAM8B,cAAc,OAAOP,UAAUQ,iBAAiB,WAAWR,UAAUQ,eAAe;CAC1F,MAAMC,eAAe,OAAOT,UAAUU,kBAAkB,WAAWV,UAAUU,gBAAgB9F,KAAAA;CAC7F,MAAM+F,UAAU,OAAOX,UAAUY,aAAa,WAAWZ,UAAUY,WAAWhG,KAAAA;CAC9E,MAAMkD,QAAQ,OAAOkC,UAAUlC,UAAU,WAAWkC,UAAUlC,QAAQlD,KAAAA;CACtE,MAAMiG,YAAY,OAAOb,UAAUc,eAAe,WAAWd,UAAUc,aAAalG,KAAAA;CACpF,MAAMmG,YAAY,OAAOf,UAAUgB,eAAe,WAC9ChB,UAAUgB,aACV,OAAOhB,UAAUgB,eAAe,WAC9BC,OAAOjB,UAAUgB,UAAU,IAC3BpG,KAAAA;CACN,MAAMsG,mBAAmB,OAAOH,cAAc,YAAYE,OAAOE,SAASJ,SAAS,IAAIA,YAAY;CACnG,MAAMrE,YAAYwE,qBAAqB,OAAO,IAAI5E,KAAKA,KAAKD,IAAI,IAAI6E,mBAAmB,GAAI,IAAItG,KAAAA;CAE/F,IAAIwG,WAA2C;CAE/C,IAAI/D,KAAKgE,qBAAqBd,aAAa;EACzC,MAAMe,mBAAmB,MAAMzB,MAAMxC,KAAKgE,mBAAmB,EAC3D3J,SAAS;GACP6J,eAAe,UAAUhB;GACzBR,QAAQ;EACV,EACF,CAAC;EAED,IAAIuB,iBAAiBnB,IACnBiB,WAAW,MAAME,iBAAiBrB,KAAK,CAAC,CAACC,YAAY,IAAI;CAE7D;CAEA,MAAMsB,iBAAiBb,UAAUpK,iBAA0CoK,OAAO,IAAI;CACtF,MAAMc,qBAAqBlL,iBAA0CgK,WAAW;CAEhF,MAAMjC,UAAU,OAAO8C,UAAUM,QAAQ,WACrCN,SAASM,MACT,OAAOF,gBAAgBE,QAAQ,WAC7BF,eAAeE,MACf,OAAOD,oBAAoBC,QAAQ,WACjCD,mBAAmBC,MACnB;CAER,IAAI,CAACpD,SACH,OAAO;EAAElD,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAmB4C,cAAc,GAAGO,yBAAwB;CAAyB;CAGtI,MAAMF,QAAQ,OAAO6C,UAAU7C,UAAU,WACrC6C,SAAS7C,QACT,OAAOiD,gBAAgBjD,UAAU,WAC/BiD,eAAejD,QACf3D,KAAAA;CAEN,MAAMrD,OAAO,OAAO6J,UAAU7J,SAAS,WACnC6J,SAAS7J,OACT,OAAOiK,gBAAgBjK,SAAS,WAC9BiK,eAAejK,OACfqD,KAAAA;CAEN,IAAI+G,YAAqB;CACzB,IAAI1C,cACF,IAAI;EACF0C,YAAYvB,KAAKwB,MAAM3C,YAAY;CACrC,QAAQ;EACN0C,YAAY;CACd;CAEF,MAAME,kBAAkBF,aAAa,OAAOA,cAAc,WACrDA,YACD;CACJ,MAAMG,iBAAiB,OAAOD,iBAAiBtD,UAAU,WAAWsD,gBAAgBtD,MAAMtG,KAAK,IAAI;CACnG,MAAM8J,sBAAsBF,iBAAiBtK,QAAQ,OAAOsK,gBAAgBtK,SAAS,WAChFsK,gBAAgBtK,OACjB;CAGJ,MAAM6K,gBAAgB,CAFK,OAAOL,qBAAqBE,cAAc,WAAWF,oBAAoBE,UAAUhK,KAAK,IAAI,IAC7F,OAAO8J,qBAAqBI,aAAa,WAAWJ,oBAAoBI,SAASlK,KAAK,IAAI,EACxD,CAAC,CAACoK,OAAOC,OAAO,CAAC,CAACnK,KAAK,GAAG,CAAC,CAACF,KAAK;CAE7F,MAAMsK,gBAAgBhE,UAAUuD,kBAAkBlH,KAAAA;CAClD,MAAM4H,eAAejL,SAAS6K,iBAAiBxH,KAAAA;CAE/C,MAAM,CAAC6H,MAAMC,UAAU,MAAMvJ,QAAQwJ,IAAI,CACvCzM,OAAOkG,UAAU,UAAU9E,GAAG,GAC9BpB,OAAOkG,UAAU,YAAY9E,GAAG,CAAC,CAClC;CAED,MAAMsL,kBAAkB,kBAAkBnH,WAAU;CACpD,IAAIyD,OAAO,MAAMuD,KAAKjD,QAAQ,GAAGoD,kBAAkBtE,QAAQ,CAAC;CAE5D,IAAI,CAACY,QAAQqD,eACXrD,OAAO,MAAMuD,KAAKjD,QAAQ,EAAEjB,OAAOgE,cAAc,CAAC;CAIpD,IAAI,CAACrD,QAAQ,EADYP,2BAA2B,OACpB;EAC9B,MAAMT,eAAeU;EAErB,MAAMxE,SAA8B;GAClCgB,SAAS;GACT6C,MAAM;GACNxC;GACA6C;GACAC,OAAOgE;GACPhL,MAAMiL;EACR;EAEA,IAAItE,gBAAgB7F,mBAAmB6F,YAAY,GAAG;GACpD,MAAMV,MAAM,IAAIC,IAAIS,cAAcvC,MAAM;GACxC6B,IAAIG,aAAaC,IAAI,kBAAkBnC,UAAU;GACjD,IAAI8G,eAAe/E,IAAIG,aAAaC,IAAI,SAAS2E,aAAa;GAC9D,IAAIC,cAAchF,IAAIG,aAAaC,IAAI,QAAQ4E,YAAY;GAC3DpI,OAAO8D,eAAe,GAAGV,IAAIsF,WAAWtF,IAAIuF;EAC9C;EAEA,OAAO3I;CACT;CAEA,IAAI,CAAC9C,IAAIG,IAAIuL,SACX,OAAO;EAAE5H,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAuB4C,cAAc,GAAGO,yBAAwB;CAA6B;CAG9I,MAAMpC,sBAAM,IAAIC,KAAK;CAErB,IAAI2G;CAEJ,MAAMG,oBADiBlE,MAAMrG,IAAI,gBAAgB,EAAA,EACRA,IAAI4C,UAAU;CACvD,IAAI2H,kBAAkB3G,qBAAqBH,MACzC2G,oBAAoBG,iBAAiB3G;CAGvC,MAAM4G,uBAAuB;EAC3B/E;EACAC,OAAOgE;EACPhL,MAAMiL;EACNjC;EACAE;EACAE;EACA7C;EACA+C;EACAnE;EACA4G,aAAalC,YAAYxG,KAAAA;EACzB6B,WAAWwG,qBAAqB5G;EAChCkH,WAAWlH;CACb;CAEA,IAAI,CAAC6C,MAAM;EACT,MAAMd,WAAWrI,OAAOyN,WAAW;EAGnCtE,OAAO,IAAIuD,KAAK;GACdlE,OAAOgE;GACPhL,MAAMiL;GACNiB,UAAAA,MALqBtN,uBAAuBJ,OAAO+F,YAAY,EAAE,CAAC,CAACC,SAAS,KAAK,CAAC;GAMlF2H,SAAS,CAACtF,QAAQ;GAClBuF,aAAa,GACVvF,WAAW,CAAC,OAAO,EACtB;GACA8E,gBAAgB,GACbzH,aAAa4H,qBAChB;EACF,CAAC;EAED,MAAMnE,KAAK0E,KAAK;EAEhB,IAAI;GACF,MAAMlB,OAAOnG,OAAO;IAClB6B;IACA7G,MAAMgL,iBAAiBjE;GACzB,CAAC;EACH,SAAS1B,KAAK;GACZC,QAAQC,KAAK,kCAAkCF,GAAG;EACpD;CACF,OAAO;EACL,MAAMiH,YAAqC,GACxC,kBAAkBpI,eAAe4H,qBACpC;EAEA,IAAI,CAACnE,KAAKX,SAASgE,eACjBsB,UAAUtF,QAAQgE;EAGpB,IAAI,CAACrD,KAAK3H,QAAQiL,cAChBqB,UAAUtM,OAAOiL;EAGnB,MAAMC,KAAKqB,UAAU,EAAEtH,KAAK0C,KAAK1C,IAAI,GAAG,EAAEuH,MAAMF,UAAU,CAAC;CAC7D;CAEA,MAAMxF,mBAAmBa,KAAKwE,WAAW,CAAA,EAAA,CAAIM,IAAItK,MAAM;CACvD,MAAM0E,WAAWC,gBAAgB;CACjC,IAAI,CAACD,UACH,OAAO;EACLhD,SAAS;EACT6C,MAAM;EACN3C,OAAO;EACP4C,cAAc,GAAGO,yBAAwB;CAC3C;CAEF,MAAMwF,iBAAiB/E,KAAKrG,IAAI,aAAa;CAC7C,MAAM8K,cAAcM,iBAAiBlJ,OAAOmJ,YAAYD,eAAe5J,QAAQ,CAAC,IAAIO,KAAAA;CAEpF,IAAI,CAACxE,mBAAmBkB,KAAK;EAC3B6G,QAAQe,KAAK1C,IAAIT,SAAS;EAC1BoI,iBAAiB/F;EACjBC,iBAAiBA,gBAAgB1E,SAAS0E,kBAAkB,CAACD,QAAQ;EACrEuF;CACF,CAAC,GACC,OAAO;EACLvI,SAAS;EACT6C,MAAM;EACN3C,OAAO;EACP4C,cAAc,GAAGO,yBAAwB;CAC3C;CAGF,IAAI;EACF,IAAIY,mBACF,MAAMA,kBAAkB+E,UAAU;GAAE5H,KAAKX;GAAOJ;EAAW,CAAC;CAEhE,SAASmB,KAAK;EACZC,QAAQC,KAAK,mCAAmCF,GAAG;CACrD;CAEA,IAAI;EACFtF,IAAIyF,IAAIsH,YAAYzN,yBAAyB;GAC3CoG,UAAU;GACVC,QAAQrB;GACRsB,UAAUtB,UAAU,SAAS;GAC7BuB,MAAMpE;EACR,CAAC;CACH,SAAS6D,KAAK;EACZC,QAAQC,KAAK,uCAAuCF,GAAG;CACzD;CAQA,OAAO;EACLxB,SAAS;EACT6C,MAAM;EACNC,cATmBnH,YAAYsB,mBAAmBtB,QAAQ,IACxDA,WACA8H,uBAAuBxG,mBAAmBwG,mBAAmB,IAC3DA,sBACAL;EAMJL,QAAQe,KAAK1C,IAAIT,SAAS;EAC1BqC;EACAC,iBAAiBA,gBAAgB1E,SAAS0E,kBAAkB,CAACD,QAAQ;CACvE;AACF;AAEA,IAAakG,2BAA2B,EACtC7I,YACA8I,2BAIE,CAAC,MAAkF,OACrFC,UACAlN,QACG;CACH,MAAMmN,qBAAqBnK,kBAAkBhD,KAAKmE,UAAU;CAC5D,MAAMiJ,8BAA8BD,sBAAsBF,yBACtDA,uBAAuBE,kBAAkB,IACzC7J,KAAAA;CACJ,MAAM7D,WAAWE,eAAeK,IAAIG,IAAIuH,OAAOjI,QAAQ,CAAC,EAAEkB,KAAK;CAC/D,MAAMmC,SAAS,MAAMoB,yBAAyB;EAC5ClE;EACAmE,YAAYgJ;EACZ1N;EACA2E,qBAAqBgJ;CACvB,CAAC;CAED,IAAI,CAACtK,OAAOgB,SAAS;EACnB9D,IAAIyF,IAAIuD,OAAOlG,OAAOmB,UAAU;EAChC,OAAO;GAAEH,SAAS;GAAOE,OAAOlB,OAAOkB;EAAM;CAC/C;CAEAhE,IAAIyF,IAAI4H,SAASvK,OAAOiB,WAAW;CACnC,OAAO,EAAED,SAAS,KAAK;AACzB;AAEA,IAAawJ,8BAA8B,EACzCnJ,YACAkD,yBACAC,yBACAC,wBAME,CAAC,MAAkF,OACrF2F,UACAlN,QACG;CACH,MAAM8C,SAAS,MAAMsE,qBAAqB;EACxCpH;EACAmE;EACAkD;EACAC;EACAC;CACF,CAAC;CAED,IAAIzE,OAAO6D,SAAS,SAAS;EAC3B3G,IAAIyF,IAAI4H,SAASvK,OAAO8D,YAAY;EACpC,OAAO;GAAE9C,SAAS;GAAOE,OAAOlB,OAAOkB;EAAM;CAC/C;CAEA,IAAIlB,OAAO6D,SAAS,gBAAgB;EAClC,IAAI7D,OAAO8D,cACT5G,IAAIyF,IAAI4H,SAASvK,OAAO8D,YAAY;OAEpC5G,IAAIyF,IAAI4H,SAAS,eAAe;EAElC,OAAO;GAAEvJ,SAAS;GAAOE,OAAO;EAAiB;CACnD;CAEAhE,IAAIyF,IAAI4H,SAASvK,OAAO8D,YAAY;CACpC,OAAO,EAAE9C,SAAS,KAAK;AACzB;AAEA,IAAMyJ,mBAAmBC,UACvBC,OAAOC,KAAKF,KAAK,CAAC,CACf/I,SAAS,QAAQ,CAAC,CAClBkJ,QAAQ,OAAO,GAAG,CAAC,CACnBA,QAAQ,OAAO,GAAG,CAAC,CACnBA,QAAQ,QAAQ,EAAE;AAEvB,IAAaC,2BAA2B,EACtCC,QACAtH,UACAuH,OACAC,eACAhJ,sBAAM,IAAIC,KAAK,GACf4E,mBAAmB,UAQf;CACJ,MAAMoE,cAAcH,OAAOlN,KAAK;CAChC,MAAMsN,gBAAgB1H,SAAS5F,KAAK;CACpC,MAAMuN,aAAaJ,MAAMnN,KAAK;CAC9B,MAAMwN,qBAAqBJ,cAAcpN,KAAK;CAE9C,IAAI,CAACqN,aAAa,MAAM,IAAI1L,MAAM,oBAAoB;CACtD,IAAI,CAAC2L,eAAe,MAAM,IAAI3L,MAAM,sBAAsB;CAC1D,IAAI,CAAC4L,YAAY,MAAM,IAAI5L,MAAM,mBAAmB;CACpD,IAAI,CAAC6L,oBAAoB,MAAM,IAAI7L,MAAM,2BAA2B;CAEpE,MAAM8L,aAAaC,KAAKC,MAAMvJ,IAAIM,QAAQ,IAAI,GAAI;CAElD,MAAMkJ,MAAMH,aAAaC,KAAKG,IAAI,IAAIH,KAAKI,IADzB9E,OAAOE,SAASD,gBAAgB,IAAIA,mBAAmB,KACf,OAAU,KAAK,GAAG,CAAC;CAE7E,MAAM1J,SAAS;EAAEwO,KAAK;EAASC,KAAKT;EAAYU,KAAK;CAAM;CAC3D,MAAMC,UAAU;EACdC,KAAKd;EACLe,KAAKX;EACLG;EACAS,KAAK;EACL5E,KAAK6D;CACP;CAEA,MAAMgB,eAAe,GAAG1B,gBAAgBzE,KAAKC,UAAU7I,MAAM,CAAC,EAAC,GAAIqN,gBAAgBzE,KAAKC,UAAU8F,OAAO,CAAC;CAM1G,OAAO,GAAGI,aAAY,GAAI1B,gBALR9O,OAAO0Q,KAAK,UAAU1B,OAAOC,KAAKuB,YAAY,GAAG;EACjEvO,KAAKyN;EACLiB,aAAa;CACf,CAE0CF,CAAS;AACrD"}
+{"version":3,"file":"index.js","names":["OAuthProviderConfig","issuer","clientId","clientSecret","scope","callbackPath","OAuthProvidersConfig","Record","OAuthProvidersStore","providers","STORE_KEY","Symbol","for","getStore","anyGlobal","globalThis","existing","created","normalizeProviders","result","isSafeRedirectPath","candidate","startsWith","providerIdRaw","value","Object","entries","providerId","trim","Error","undefined","configureOAuthProviders","store","normalized","setOAuthProviders","getOAuthProviderConfig","decodeBase64Url","value","padded","replace","slice","length","Buffer","from","toString","decodeJwtPayload","Record","token","T","parts","split","json","parsed","JSON","parse","OidcWellKnown","issuer","authorization_endpoint","token_endpoint","userinfo_endpoint","jwks_uri","cache","Map","Promise","normalizeIssuer","raw","trim","replace","getOidcWellKnown","issuerRaw","Error","existing","get","loader","url","URL","response","fetch","headers","Accept","ok","body","text","catch","status","json","Partial","authorizationEndpoint","tokenEndpoint","issuerValue","userinfoEndpoint","undefined","jwksUri","set","err","delete","crypto","base64UrlEncode","input","Buffer","toString","replace","generatePkcePair","verifier","randomBytes","challenge","createHash","update","digest","RESERVED_KEYS","Set","isSafeOAuthProviderId","value","providerId","trim","length","has","test","crypto","ApiHandler","Ctx","createProvisionedTenant","models","hashPasswordForStorage","completeAuthSignIn","AuthSessionUser","getOAuthProviderConfig","decodeJwtPayload","getOidcWellKnown","generatePkcePair","isSafeOAuthProviderId","OAUTH_REQUEST_TTL_MS","OAUTH_STATE_COOKIE_NAME","OAuthCtx","OAuthRequestRecord","returnTo","codeVerifier","getQueryString","value","Array","isArray","getCookieValue","ctx","name","header","req","headers","cookie","part","split","rawKey","rest","key","trim","rawValue","join","decodeURIComponent","isSafeRedirectPath","candidate","startsWith","getRequestOrigin","protoHeader","hostHeader","protocol","host","get","resolveCallbackPath","callbackPath","trimmed","readTextBody","Pick","Promise","resolve","reject","body","setEncoding","on","chunk","String","length","Error","getFormPostParams","Record","method","contentType","includes","params","URLSearchParams","result","entries","resolveProviderId","providerIdOverride","provider","RESERVED_AUTH_PARAM_KEYS","Set","normalizeAuthorizationParams","undefined","keyRaw","valueRaw","Object","has","val","keys","OAuthStartResult","success","redirectUrl","error","statusCode","getOAuthStartRedirectUrl","providerId","authorizationParams","origin","isHttps","state","randomBytes","toString","verifier","challenge","safeReturnTo","OAuthRequest","getGlobal","now","Date","create","_id","createdAt","expiresAt","getTime","err","console","warn","res","httpOnly","secure","sameSite","path","maxAge","oidc","issuer","redirectUri","url","URL","authorization_endpoint","searchParams","set","clientId","scope","extraAuthorizationParams","OAuthCallbackResult","type","redirectPath","userId","tenantId","signedInTenants","subject","email","OAUTH_SUCCESS_REDIRECT_PATH","AUTH_ERROR_REDIRECT_BASE","processOAuthCallback","createUserOnFirstSignIn","missingUserRedirectPath","successRedirectPath","bodyParams","code","query","oauthUserRaw","user","stateCookieValue","oauthRequest","OAuthRequestModel","Awaited","ReturnType","findOne","lean","tokenBody","clientSecret","tokenResponse","fetch","token_endpoint","Accept","tokenJson","json","catch","ok","JSON","stringify","status","accessToken","access_token","refreshToken","refresh_token","idToken","id_token","tokenType","token_type","expiresIn","expires_in","Number","expiresInSeconds","isFinite","userInfo","userinfo_endpoint","userInfoResponse","Authorization","idTokenPayload","accessTokenPayload","sub","oauthUser","parse","oauthUserRecord","oauthUserEmail","oauthUserNameRecord","oauthUserNameFirst","firstName","oauthUserNameLast","lastName","oauthUserName","filter","Boolean","resolvedEmail","resolvedName","User","Tenant","all","subjectQueryKey","shouldCreateUser","pathname","search","session","providerCreatedAt","oauthProviders","Map","existingProvider","oauthProviderPayload","rawUserInfo","updatedAt","randomUUID","password","tenants","tenantRoles","save","deleteOne","rollbackError","setFields","updateOne","$set","map","tenantRolesMap","fromEntries","currentTenantId","clearCookie","createOAuthStartHandler","getAuthorizationParams","_payload","resolvedProviderId","providerAuthorizationParams","redirect","createOAuthCallbackHandler","base64UrlEncode","input","Buffer","from","replace","createAppleClientSecret","teamId","keyId","privateKeyPem","teamIdValue","clientIdValue","keyIdValue","privateKeyPemValue","nowSeconds","Math","floor","exp","max","min","alg","kid","typ","payload","iss","iat","aud","signingInput","signature","sign","dsaEncoding"],"sources":["../../src/oauth/config.ts","../../src/oauth/jwt.ts","../../src/oauth/oidc.ts","../../src/oauth/pkce.ts","../../src/oauth/providerId.ts","../../src/oauth/lib.ts"],"sourcesContent":["export type OAuthProviderConfig = {\n  issuer: string\n  clientId: string\n  clientSecret?: string\n  scope: string\n  callbackPath: string\n}\n\ntype OAuthProvidersConfig = Record<string, OAuthProviderConfig>\n\ntype OAuthProvidersStore = {\n  providers: OAuthProvidersConfig\n}\n\nconst STORE_KEY = Symbol.for(\"@rpcbase/auth/oauthProviders\")\n\nconst getStore = (): OAuthProvidersStore => {\n  const anyGlobal = globalThis as unknown as Record<string | symbol, unknown>\n  const existing = anyGlobal[STORE_KEY] as OAuthProvidersStore | undefined\n  if (existing && typeof existing === \"object\" && existing.providers && typeof existing.providers === \"object\") {\n    return existing\n  }\n\n  const created: OAuthProvidersStore = { providers: {} }\n  anyGlobal[STORE_KEY] = created\n  return created\n}\n\nconst normalizeProviders = (providers: Record<string, OAuthProviderConfig>): OAuthProvidersConfig => {\n  const result: OAuthProvidersConfig = {}\n\n  const isSafeRedirectPath = (candidate: string) => {\n    if (!candidate.startsWith(\"/\")) return false\n    if (candidate.startsWith(\"//\")) return false\n    return true\n  }\n\n  for (const [providerIdRaw, value] of Object.entries(providers)) {\n    const providerId = providerIdRaw.trim()\n    if (!providerId) continue\n\n    const issuer = typeof value?.issuer === \"string\" ? value.issuer.trim() : \"\"\n    const clientId = typeof value?.clientId === \"string\" ? value.clientId.trim() : \"\"\n    if (!issuer) throw new Error(`oauth provider \"${providerId}\" missing issuer`)\n    if (!clientId) throw new Error(`oauth provider \"${providerId}\" missing clientId`)\n\n    const clientSecret = typeof value?.clientSecret === \"string\" && value.clientSecret.trim()\n      ? value.clientSecret\n      : undefined\n\n    const scope = typeof value?.scope === \"string\" ? value.scope.trim() : \"\"\n    if (!scope) throw new Error(`oauth provider \"${providerId}\" missing scope`)\n\n    const callbackPath = typeof value?.callbackPath === \"string\"\n      ? value.callbackPath.trim()\n      : \"\"\n    if (!callbackPath) throw new Error(`oauth provider \"${providerId}\" missing callbackPath`)\n    if (!isSafeRedirectPath(callbackPath)) throw new Error(`oauth provider \"${providerId}\" has invalid callbackPath`)\n\n    result[providerId] = {\n      issuer,\n      clientId,\n      clientSecret,\n      scope,\n      callbackPath,\n    }\n  }\n\n  return result\n}\n\nexport const configureOAuthProviders = (providers: Record<string, OAuthProviderConfig>) => {\n  const store = getStore()\n  const normalized = normalizeProviders(providers)\n  store.providers = { ...store.providers, ...normalized }\n}\n\nexport const setOAuthProviders = (providers: Record<string, OAuthProviderConfig>) => {\n  const store = getStore()\n  store.providers = normalizeProviders(providers)\n}\n\nexport const getOAuthProviderConfig = (providerId: string): OAuthProviderConfig | null => {\n  const store = getStore()\n  return store.providers[providerId] ?? null\n}\n","const decodeBase64Url = (value: string) => {\n  const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"===\".slice((value.length + 3) % 4)\n  return Buffer.from(padded, \"base64\").toString(\"utf8\")\n}\n\nexport const decodeJwtPayload = <T = Record<string, unknown>>(token: string): T | null => {\n  const parts = token.split(\".\")\n  if (parts.length < 2) return null\n\n  try {\n    const json = decodeBase64Url(parts[1])\n    const parsed = JSON.parse(json) as T\n    if (!parsed || typeof parsed !== \"object\") return null\n    return parsed\n  } catch {\n    return null\n  }\n}\n\n","export type OidcWellKnown = {\n  issuer: string\n  authorization_endpoint: string\n  token_endpoint: string\n  userinfo_endpoint?: string\n  jwks_uri?: string\n}\n\nconst cache = new Map<string, Promise<OidcWellKnown>>()\n\nconst normalizeIssuer = (raw: string) => raw.trim().replace(/\\/+$/, \"\")\n\nexport const getOidcWellKnown = async (issuerRaw: string): Promise<OidcWellKnown> => {\n  const issuer = normalizeIssuer(issuerRaw)\n  if (!issuer) {\n    throw new Error(\"OIDC issuer is required\")\n  }\n\n  const existing = cache.get(issuer)\n  if (existing) {\n    return existing\n  }\n\n  const loader = (async () => {\n    const url = new URL(\"/.well-known/openid-configuration\", issuer)\n    const response = await fetch(url, { headers: { Accept: \"application/json\" } })\n    if (!response.ok) {\n      const body = await response.text().catch(() => \"\")\n      throw new Error(`Failed to fetch OIDC discovery document: ${response.status} ${body}`)\n    }\n\n    const json = await response.json().catch(() => null) as Partial<OidcWellKnown> | null\n    if (!json || typeof json !== \"object\") {\n      throw new Error(\"Invalid OIDC discovery document\")\n    }\n\n    const authorizationEndpoint = typeof json.authorization_endpoint === \"string\"\n      ? json.authorization_endpoint\n      : \"\"\n    const tokenEndpoint = typeof json.token_endpoint === \"string\"\n      ? json.token_endpoint\n      : \"\"\n    const issuerValue = typeof json.issuer === \"string\" ? json.issuer : issuer\n    const userinfoEndpoint = typeof json.userinfo_endpoint === \"string\" ? json.userinfo_endpoint : undefined\n    const jwksUri = typeof json.jwks_uri === \"string\" ? json.jwks_uri : undefined\n\n    if (!authorizationEndpoint || !tokenEndpoint) {\n      throw new Error(\"OIDC discovery document missing required endpoints\")\n    }\n\n    return {\n      issuer: issuerValue,\n      authorization_endpoint: authorizationEndpoint,\n      token_endpoint: tokenEndpoint,\n      userinfo_endpoint: userinfoEndpoint,\n      jwks_uri: jwksUri,\n    } satisfies OidcWellKnown\n  })()\n\n  cache.set(issuer, loader)\n\n  try {\n    return await loader\n  } catch (err) {\n    cache.delete(issuer)\n    throw err\n  }\n}\n\n","import crypto from \"crypto\"\n\n\nexport const base64UrlEncode = (input: Buffer) => input\n  .toString(\"base64\")\n  .replace(/\\+/g, \"-\")\n  .replace(/\\//g, \"_\")\n  .replace(/=+$/g, \"\")\n\nexport const generatePkcePair = () => {\n  const verifier = base64UrlEncode(crypto.randomBytes(32))\n  const challenge = base64UrlEncode(crypto.createHash(\"sha256\").update(verifier).digest())\n\n  return { verifier, challenge }\n}\n\n","const RESERVED_KEYS = new Set([\"__proto__\", \"prototype\", \"constructor\"])\n\nexport const isSafeOAuthProviderId = (value: string) => {\n  const providerId = value.trim()\n  if (!providerId) return false\n  if (providerId.length > 128) return false\n  if (RESERVED_KEYS.has(providerId)) return false\n  return /^[a-zA-Z0-9_-]+$/.test(providerId)\n}\n\n","import crypto from \"crypto\"\n\nimport { ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { createProvisionedTenant, models } from \"@rpcbase/db\"\nimport { hashPasswordForStorage } from \"@rpcbase/server\"\n\nimport { completeAuthSignIn } from \"../session\"\nimport type { AuthSessionUser } from \"../types\"\nimport { getOAuthProviderConfig } from \"./config\"\nimport { decodeJwtPayload } from \"./jwt\"\nimport { getOidcWellKnown } from \"./oidc\"\nimport { generatePkcePair } from \"./pkce\"\nimport { isSafeOAuthProviderId } from \"./providerId\"\n\n\nconst OAUTH_REQUEST_TTL_MS = 10 * 60 * 1000\nconst OAUTH_STATE_COOKIE_NAME = \"rb_oauth_state\"\ntype OAuthCtx = Ctx<AuthSessionUser>\ntype OAuthRequestRecord = {\n  returnTo?: unknown\n  codeVerifier?: unknown\n}\n\nconst getQueryString = (value: unknown) => {\n  if (typeof value === \"string\") return value\n  if (Array.isArray(value) && typeof value[0] === \"string\") return value[0]\n  return null\n}\n\nconst getCookieValue = (ctx: OAuthCtx, name: string): string | null => {\n  const header = ctx.req.headers?.cookie\n  if (typeof header !== \"string\" || !header) return null\n\n  for (const part of header.split(\";\")) {\n    const [rawKey, ...rest] = part.split(\"=\")\n    const key = rawKey?.trim()\n    if (!key || key !== name) continue\n    const rawValue = rest.join(\"=\").trim()\n    if (!rawValue) return \"\"\n    try {\n      return decodeURIComponent(rawValue)\n    } catch {\n      return rawValue\n    }\n  }\n\n  return null\n}\n\nconst isSafeRedirectPath = (candidate: string) => {\n  if (!candidate.startsWith(\"/\")) return false\n  if (candidate.startsWith(\"//\")) return false\n  return true\n}\n\nconst getRequestOrigin = (ctx: OAuthCtx) => {\n  const protoHeader = ctx.req.headers[\"x-forwarded-proto\"]\n  const hostHeader = ctx.req.headers[\"x-forwarded-host\"]\n\n  const protocol = typeof protoHeader === \"string\"\n    ? protoHeader.split(\",\")[0].trim()\n    : ctx.req.protocol\n\n  const host = typeof hostHeader === \"string\"\n    ? hostHeader.split(\",\")[0].trim()\n    : ctx.req.get(\"host\")\n\n  return protocol && host ? `${protocol}://${host}` : \"\"\n}\n\nconst resolveCallbackPath = (callbackPath: string) => {\n  const trimmed = callbackPath.trim()\n  return trimmed && isSafeRedirectPath(trimmed) ? trimmed : null\n}\n\nconst readTextBody = async (req: Pick<OAuthCtx[\"req\"], \"on\" | \"setEncoding\">) =>\n  await new Promise<string>((resolve, reject) => {\n    let body = \"\"\n    if (typeof req.setEncoding === \"function\") {\n      req.setEncoding(\"utf8\")\n    }\n\n    req.on(\"data\", (chunk) => {\n      body += String(chunk)\n      if (body.length > 32_768) {\n        reject(new Error(\"request_body_too_large\"))\n      }\n    })\n    req.on(\"end\", () => resolve(body))\n    req.on(\"error\", reject)\n  })\n\nconst getFormPostParams = async (ctx: OAuthCtx): Promise<Record<string, string> | null> => {\n  if (ctx.req.method !== \"POST\") return null\n\n  const contentType = typeof ctx.req.headers[\"content-type\"] === \"string\" ? ctx.req.headers[\"content-type\"] : \"\"\n  if (!contentType.includes(\"application/x-www-form-urlencoded\")) return null\n\n  const body = await readTextBody(ctx.req)\n  const params = new URLSearchParams(body)\n\n  const result: Record<string, string> = {}\n  for (const [key, value] of params.entries()) {\n    result[key] = value\n  }\n\n  return result\n}\n\nconst resolveProviderId = (ctx: OAuthCtx, providerIdOverride?: string) =>\n  (providerIdOverride ?? String(ctx.req.params?.provider ?? \"\")).trim()\n\nconst RESERVED_AUTH_PARAM_KEYS = new Set([\"__proto__\", \"prototype\", \"constructor\"])\n\nconst normalizeAuthorizationParams = (value: unknown): Record<string, string> | undefined => {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined\n\n  const result: Record<string, string> = {}\n  for (const [keyRaw, valueRaw] of Object.entries(value)) {\n    const key = keyRaw.trim()\n    if (!key) continue\n    if (RESERVED_AUTH_PARAM_KEYS.has(key)) continue\n    const val = typeof valueRaw === \"string\" ? valueRaw.trim() : \"\"\n    if (!val) continue\n    result[key] = val\n  }\n\n  return Object.keys(result).length ? result : undefined\n}\n\nexport type OAuthStartResult =\n  | { success: true; redirectUrl: string }\n  | { success: false; error: string; statusCode: number }\n\nexport const getOAuthStartRedirectUrl = async ({\n  ctx,\n  providerId: providerIdOverride,\n  returnTo,\n  authorizationParams,\n}: {\n  ctx: OAuthCtx\n  providerId?: string\n  returnTo?: string | null\n  authorizationParams?: Record<string, string>\n}): Promise<OAuthStartResult> => {\n  const providerId = resolveProviderId(ctx, providerIdOverride)\n  if (!providerId) {\n    return { success: false, error: \"missing_provider\", statusCode: 400 }\n  }\n\n  if (!isSafeOAuthProviderId(providerId)) {\n    return { success: false, error: \"invalid_provider\", statusCode: 400 }\n  }\n\n  const provider = getOAuthProviderConfig(providerId)\n  if (!provider) {\n    return { success: false, error: \"unknown_provider\", statusCode: 404 }\n  }\n\n  const origin = getRequestOrigin(ctx)\n  if (!origin) {\n    return { success: false, error: \"origin_unavailable\", statusCode: 500 }\n  }\n  const isHttps = origin.startsWith(\"https://\")\n\n  const callbackPath = resolveCallbackPath(provider.callbackPath)\n  if (!callbackPath) {\n    return { success: false, error: \"invalid_callback_path\", statusCode: 500 }\n  }\n\n  const state = crypto.randomBytes(16).toString(\"hex\")\n  const { verifier, challenge } = generatePkcePair()\n\n  const safeReturnTo = typeof returnTo === \"string\" && isSafeRedirectPath(returnTo) ? returnTo : undefined\n\n  try {\n    const OAuthRequest = await models.getGlobal(\"RBOAuthRequest\", ctx)\n    const now = new Date()\n    await OAuthRequest.create({\n      _id: state,\n      providerId,\n      codeVerifier: verifier,\n      returnTo: safeReturnTo,\n      createdAt: now,\n      expiresAt: new Date(now.getTime() + OAUTH_REQUEST_TTL_MS),\n    })\n  } catch (err) {\n    console.warn(\"oauth::failed_to_store_request\", err)\n    return { success: false, error: \"oauth_request_store_failed\", statusCode: 500 }\n  }\n\n  try {\n    ctx.res.cookie(OAUTH_STATE_COOKIE_NAME, `${providerId}:${state}`, {\n      httpOnly: true,\n      secure: isHttps,\n      sameSite: isHttps ? \"none\" : \"lax\",\n      path: callbackPath,\n      maxAge: OAUTH_REQUEST_TTL_MS,\n    })\n  } catch (err) {\n    console.warn(\"oauth::failed_to_set_state_cookie\", err)\n    return { success: false, error: \"oauth_cookie_set_failed\", statusCode: 500 }\n  }\n\n  const oidc = await getOidcWellKnown(provider.issuer)\n  const redirectUri = `${origin}${callbackPath}`\n\n  const url = new URL(oidc.authorization_endpoint)\n  url.searchParams.set(\"client_id\", provider.clientId)\n  url.searchParams.set(\"redirect_uri\", redirectUri)\n  url.searchParams.set(\"response_type\", \"code\")\n  url.searchParams.set(\"scope\", provider.scope)\n  url.searchParams.set(\"state\", state)\n  url.searchParams.set(\"code_challenge\", challenge)\n  url.searchParams.set(\"code_challenge_method\", \"S256\")\n  const extraAuthorizationParams = normalizeAuthorizationParams(authorizationParams)\n  for (const [key, value] of Object.entries(extraAuthorizationParams ?? {})) {\n    if (url.searchParams.has(key)) continue\n    url.searchParams.set(key, value)\n  }\n\n  return { success: true, redirectUrl: url.toString() }\n}\n\nexport type OAuthCallbackResult =\n  | {\n    success: true\n    type: \"signed_in\"\n    redirectPath: string\n    userId: string\n    tenantId: string\n    signedInTenants: string[]\n  }\n  | {\n    success: false\n    type: \"missing_user\"\n    providerId: string\n    subject: string\n    email?: string\n    name?: string\n    redirectPath?: string\n  }\n  | {\n    success: false\n    type: \"error\"\n    error: string\n    redirectPath: string\n  }\n\nconst OAUTH_SUCCESS_REDIRECT_PATH = \"/onboarding\"\nconst AUTH_ERROR_REDIRECT_BASE = \"/auth/sign-in\"\n\nexport const processOAuthCallback = async ({\n  ctx,\n  providerId: providerIdOverride,\n  createUserOnFirstSignIn,\n  missingUserRedirectPath,\n  successRedirectPath,\n}: {\n  ctx: OAuthCtx\n  providerId?: string\n  createUserOnFirstSignIn?: boolean\n  missingUserRedirectPath?: string\n  successRedirectPath?: string\n}): Promise<OAuthCallbackResult> => {\n  const providerId = resolveProviderId(ctx, providerIdOverride)\n  if (!providerId) {\n    return { success: false, type: \"error\", error: \"missing_provider\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=missing_provider` }\n  }\n\n  if (!isSafeOAuthProviderId(providerId)) {\n    return { success: false, type: \"error\", error: \"invalid_provider\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=invalid_provider` }\n  }\n\n  const provider = getOAuthProviderConfig(providerId)\n  if (!provider) {\n    return { success: false, type: \"error\", error: \"unknown_provider\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=unknown_provider` }\n  }\n\n  const origin = getRequestOrigin(ctx)\n  if (!origin) {\n    return { success: false, type: \"error\", error: \"origin_unavailable\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=origin_unavailable` }\n  }\n  const isHttps = origin.startsWith(\"https://\")\n\n  const callbackPath = resolveCallbackPath(provider.callbackPath)\n  if (!callbackPath) {\n    return { success: false, type: \"error\", error: \"invalid_callback_path\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=invalid_callback_path` }\n  }\n\n  const bodyParams = await getFormPostParams(ctx)\n\n  const code = (getQueryString(bodyParams?.code) ?? getQueryString(ctx.req.query?.code))?.trim() ?? \"\"\n  const state = (getQueryString(bodyParams?.state) ?? getQueryString(ctx.req.query?.state))?.trim() ?? \"\"\n  const oauthUserRaw = (getQueryString(bodyParams?.user) ?? getQueryString(ctx.req.query?.user))?.trim() ?? \"\"\n\n  if (!code || !state) {\n    return { success: false, type: \"error\", error: \"missing_code_or_state\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=missing_code_or_state` }\n  }\n\n  const stateCookieValue = getCookieValue(ctx, OAUTH_STATE_COOKIE_NAME)\n  if (stateCookieValue !== `${providerId}:${state}`) {\n    return { success: false, type: \"error\", error: \"invalid_state\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=invalid_state` }\n  }\n\n  let oauthRequest: OAuthRequestRecord | null = null\n  let OAuthRequestModel: Awaited<ReturnType<typeof models.getGlobal>> | null = null\n  try {\n    OAuthRequestModel = await models.getGlobal(\"RBOAuthRequest\", ctx)\n    oauthRequest = await OAuthRequestModel.findOne({ _id: state, providerId }).lean() as OAuthRequestRecord | null\n  } catch (err) {\n    console.warn(\"oauth::failed_to_load_request\", err)\n    return { success: false, type: \"error\", error: \"oauth_request_load_failed\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=oauth_request_load_failed` }\n  }\n\n  if (!oauthRequest) {\n    return { success: false, type: \"error\", error: \"invalid_state\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=invalid_state` }\n  }\n\n  const returnTo = typeof oauthRequest.returnTo === \"string\" ? oauthRequest.returnTo : undefined\n  const codeVerifier = typeof oauthRequest.codeVerifier === \"string\" ? oauthRequest.codeVerifier : \"\"\n  if (!codeVerifier) {\n    return { success: false, type: \"error\", error: \"missing_code_verifier\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=missing_code_verifier` }\n  }\n\n  const oidc = await getOidcWellKnown(provider.issuer)\n  const redirectUri = `${origin}${callbackPath}`\n\n  const tokenBody = new URLSearchParams()\n  tokenBody.set(\"grant_type\", \"authorization_code\")\n  tokenBody.set(\"code\", code)\n  tokenBody.set(\"redirect_uri\", redirectUri)\n  tokenBody.set(\"client_id\", provider.clientId)\n  tokenBody.set(\"code_verifier\", codeVerifier)\n  if (provider.clientSecret) {\n    tokenBody.set(\"client_secret\", provider.clientSecret)\n  }\n\n  const tokenResponse = await fetch(oidc.token_endpoint, {\n    method: \"POST\",\n    headers: {\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n      Accept: \"application/json\",\n    },\n    body: tokenBody.toString(),\n  })\n\n  const tokenJson = await tokenResponse.json().catch(() => null) as Record<string, unknown> | null\n\n  if (!tokenResponse.ok || !tokenJson || typeof tokenJson !== \"object\") {\n    const body = tokenJson ? JSON.stringify(tokenJson) : \"\"\n    console.warn(\"oauth::token_exchange failed\", tokenResponse.status, body)\n    return { success: false, type: \"error\", error: \"token_exchange_failed\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=token_exchange_failed` }\n  }\n\n  const accessToken = typeof tokenJson.access_token === \"string\" ? tokenJson.access_token : \"\"\n  const refreshToken = typeof tokenJson.refresh_token === \"string\" ? tokenJson.refresh_token : undefined\n  const idToken = typeof tokenJson.id_token === \"string\" ? tokenJson.id_token : undefined\n  const scope = typeof tokenJson.scope === \"string\" ? tokenJson.scope : undefined\n  const tokenType = typeof tokenJson.token_type === \"string\" ? tokenJson.token_type : undefined\n  const expiresIn = typeof tokenJson.expires_in === \"number\"\n    ? tokenJson.expires_in\n    : typeof tokenJson.expires_in === \"string\"\n      ? Number(tokenJson.expires_in)\n      : undefined\n  const expiresInSeconds = typeof expiresIn === \"number\" && Number.isFinite(expiresIn) ? expiresIn : null\n  const expiresAt = expiresInSeconds !== null ? new Date(Date.now() + expiresInSeconds * 1000) : undefined\n\n  let userInfo: Record<string, unknown> | null = null\n\n  if (oidc.userinfo_endpoint && accessToken) {\n    const userInfoResponse = await fetch(oidc.userinfo_endpoint, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        Accept: \"application/json\",\n      },\n    })\n\n    if (userInfoResponse.ok) {\n      userInfo = await userInfoResponse.json().catch(() => null) as Record<string, unknown> | null\n    }\n  }\n\n  const idTokenPayload = idToken ? decodeJwtPayload<Record<string, unknown>>(idToken) : null\n  const accessTokenPayload = decodeJwtPayload<Record<string, unknown>>(accessToken)\n\n  const subject = typeof userInfo?.sub === \"string\"\n    ? userInfo.sub\n    : typeof idTokenPayload?.sub === \"string\"\n      ? idTokenPayload.sub\n      : typeof accessTokenPayload?.sub === \"string\"\n        ? accessTokenPayload.sub\n        : \"\"\n\n  if (!subject) {\n    return { success: false, type: \"error\", error: \"missing_subject\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=missing_subject` }\n  }\n\n  const email = typeof userInfo?.email === \"string\"\n    ? userInfo.email\n    : typeof idTokenPayload?.email === \"string\"\n      ? idTokenPayload.email\n      : undefined\n\n  const name = typeof userInfo?.name === \"string\"\n    ? userInfo.name\n    : typeof idTokenPayload?.name === \"string\"\n      ? idTokenPayload.name\n      : undefined\n\n  let oauthUser: unknown = null\n  if (oauthUserRaw) {\n    try {\n      oauthUser = JSON.parse(oauthUserRaw) as unknown\n    } catch {\n      oauthUser = null\n    }\n  }\n  const oauthUserRecord = oauthUser && typeof oauthUser === \"object\"\n    ? (oauthUser as Record<string, unknown>)\n    : null\n  const oauthUserEmail = typeof oauthUserRecord?.email === \"string\" ? oauthUserRecord.email.trim() : \"\"\n  const oauthUserNameRecord = oauthUserRecord?.name && typeof oauthUserRecord.name === \"object\"\n    ? (oauthUserRecord.name as Record<string, unknown>)\n    : null\n  const oauthUserNameFirst = typeof oauthUserNameRecord?.firstName === \"string\" ? oauthUserNameRecord.firstName.trim() : \"\"\n  const oauthUserNameLast = typeof oauthUserNameRecord?.lastName === \"string\" ? oauthUserNameRecord.lastName.trim() : \"\"\n  const oauthUserName = [oauthUserNameFirst, oauthUserNameLast].filter(Boolean).join(\" \").trim()\n\n  const resolvedEmail = email ?? (oauthUserEmail || undefined)\n  const resolvedName = name ?? (oauthUserName || undefined)\n\n  const [User, Tenant] = await Promise.all([\n    models.getGlobal(\"RBUser\", ctx),\n    models.getGlobal(\"RBTenant\", ctx),\n  ])\n\n  const subjectQueryKey = `oauthProviders.${providerId}.subject`\n  let user = await User.findOne({ [subjectQueryKey]: subject })\n\n  if (!user && resolvedEmail) {\n    user = await User.findOne({ email: resolvedEmail })\n  }\n\n  const shouldCreateUser = createUserOnFirstSignIn ?? true\n  if (!user && !shouldCreateUser) {\n    const redirectPath = missingUserRedirectPath\n\n    const result: OAuthCallbackResult = {\n      success: false,\n      type: \"missing_user\",\n      providerId,\n      subject,\n      email: resolvedEmail,\n      name: resolvedName,\n    }\n\n    if (redirectPath && isSafeRedirectPath(redirectPath)) {\n      const url = new URL(redirectPath, origin)\n      url.searchParams.set(\"oauth_provider\", providerId)\n      if (resolvedEmail) url.searchParams.set(\"email\", resolvedEmail)\n      if (resolvedName) url.searchParams.set(\"name\", resolvedName)\n      result.redirectPath = `${url.pathname}${url.search}`\n    }\n\n    return result\n  }\n\n  if (!ctx.req.session) {\n    return { success: false, type: \"error\", error: \"session_unavailable\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=session_unavailable` }\n  }\n\n  const now = new Date()\n\n  let providerCreatedAt: Date | undefined\n  const oauthProviders = user?.get(\"oauthProviders\") as Map<string, { createdAt?: unknown }> | undefined\n  const existingProvider = oauthProviders?.get(providerId)\n  if (existingProvider?.createdAt instanceof Date) {\n    providerCreatedAt = existingProvider.createdAt\n  }\n\n  const oauthProviderPayload = {\n    subject,\n    email: resolvedEmail,\n    name: resolvedName,\n    accessToken,\n    refreshToken,\n    idToken,\n    scope,\n    tokenType,\n    expiresAt,\n    rawUserInfo: userInfo ?? undefined,\n    createdAt: providerCreatedAt ?? now,\n    updatedAt: now,\n  }\n\n  if (!user) {\n    const tenantId = crypto.randomUUID()\n    const password = await hashPasswordForStorage(crypto.randomBytes(32).toString(\"hex\"))\n\n    user = new User({\n      email: resolvedEmail,\n      name: resolvedName,\n      password,\n      tenants: [tenantId],\n      tenantRoles: {\n        [tenantId]: [\"owner\"],\n      },\n      oauthProviders: {\n        [providerId]: oauthProviderPayload,\n      },\n    })\n\n    await user.save()\n\n    try {\n      await createProvisionedTenant(Tenant, {\n        tenantId,\n        name: resolvedEmail || subject,\n      })\n    } catch (err) {\n      console.error(\"oauth::failed_to_initialize_tenant\", err)\n      try {\n        await User.deleteOne({ _id: user._id })\n      } catch (rollbackError) {\n        console.error(\"oauth::failed_to_rollback_user\", rollbackError)\n      }\n      return {\n        success: false,\n        type: \"error\",\n        error: \"tenant_initialization_failed\",\n        redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=tenant_initialization_failed`,\n      }\n    }\n  } else {\n    const setFields: Record<string, unknown> = {\n      [`oauthProviders.${providerId}`]: oauthProviderPayload,\n    }\n\n    if (!user.email && resolvedEmail) {\n      setFields.email = resolvedEmail\n    }\n\n    if (!user.name && resolvedName) {\n      setFields.name = resolvedName\n    }\n\n    await User.updateOne({ _id: user._id }, { $set: setFields })\n  }\n\n  const signedInTenants = (user.tenants || []).map(String)\n  const tenantId = signedInTenants[0]\n  if (!tenantId) {\n    return {\n      success: false,\n      type: \"error\",\n      error: \"tenant_unavailable\",\n      redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=tenant_unavailable`,\n    }\n  }\n  const tenantRolesMap = user.get(\"tenantRoles\") as Map<string, string[]> | undefined\n  const tenantRoles = tenantRolesMap ? Object.fromEntries(tenantRolesMap.entries()) : undefined\n\n  if (!completeAuthSignIn(ctx, {\n    userId: user._id.toString(),\n    currentTenantId: tenantId,\n    signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],\n    tenantRoles,\n  })) {\n    return {\n      success: false,\n      type: \"error\",\n      error: \"session_unavailable\",\n      redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=session_unavailable`,\n    }\n  }\n\n  try {\n    if (OAuthRequestModel) {\n      await OAuthRequestModel.deleteOne({ _id: state, providerId })\n    }\n  } catch (err) {\n    console.warn(\"oauth::failed_to_delete_request\", err)\n  }\n\n  try {\n    ctx.res.clearCookie(OAUTH_STATE_COOKIE_NAME, {\n      httpOnly: true,\n      secure: isHttps,\n      sameSite: isHttps ? \"none\" : \"lax\",\n      path: callbackPath,\n    })\n  } catch (err) {\n    console.warn(\"oauth::failed_to_clear_state_cookie\", err)\n  }\n\n  const redirectPath = returnTo && isSafeRedirectPath(returnTo)\n    ? returnTo\n    : successRedirectPath && isSafeRedirectPath(successRedirectPath)\n      ? successRedirectPath\n      : OAUTH_SUCCESS_REDIRECT_PATH\n\n  return {\n    success: true,\n    type: \"signed_in\",\n    redirectPath,\n    userId: user._id.toString(),\n    tenantId,\n    signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],\n  }\n}\n\nexport const createOAuthStartHandler = ({\n  providerId,\n  getAuthorizationParams,\n}: {\n  providerId?: string\n  getAuthorizationParams?: (providerId: string) => Record<string, string> | undefined\n} = {}): ApiHandler<unknown, { success: boolean; error?: string }, AuthSessionUser> => async (\n  _payload,\n  ctx,\n) => {\n  const resolvedProviderId = resolveProviderId(ctx, providerId)\n  const providerAuthorizationParams = resolvedProviderId && getAuthorizationParams\n    ? getAuthorizationParams(resolvedProviderId)\n    : undefined\n  const returnTo = getQueryString(ctx.req.query?.returnTo)?.trim()\n  const result = await getOAuthStartRedirectUrl({\n    ctx,\n    providerId: resolvedProviderId,\n    returnTo,\n    authorizationParams: providerAuthorizationParams,\n  })\n\n  if (!result.success) {\n    ctx.res.status(result.statusCode)\n    return { success: false, error: result.error }\n  }\n\n  ctx.res.redirect(result.redirectUrl)\n  return { success: true }\n}\n\nexport const createOAuthCallbackHandler = ({\n  providerId,\n  createUserOnFirstSignIn,\n  missingUserRedirectPath,\n  successRedirectPath,\n}: {\n  providerId?: string\n  createUserOnFirstSignIn?: boolean\n  missingUserRedirectPath?: string\n  successRedirectPath?: string\n} = {}): ApiHandler<unknown, { success: boolean; error?: string }, AuthSessionUser> => async (\n  _payload,\n  ctx,\n) => {\n  const result = await processOAuthCallback({\n    ctx,\n    providerId,\n    createUserOnFirstSignIn,\n    missingUserRedirectPath,\n    successRedirectPath,\n  })\n\n  if (result.type === \"error\") {\n    ctx.res.redirect(result.redirectPath)\n    return { success: false, error: result.error }\n  }\n\n  if (result.type === \"missing_user\") {\n    if (result.redirectPath) {\n      ctx.res.redirect(result.redirectPath)\n    } else {\n      ctx.res.redirect(\"/auth/sign-up\")\n    }\n    return { success: false, error: \"user_not_found\" }\n  }\n\n  ctx.res.redirect(result.redirectPath)\n  return { success: true }\n}\n\nconst base64UrlEncode = (input: Buffer | string) =>\n  Buffer.from(input)\n    .toString(\"base64\")\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/g, \"\")\n\nexport const createAppleClientSecret = ({\n  teamId,\n  clientId,\n  keyId,\n  privateKeyPem,\n  now = new Date(),\n  expiresInSeconds = 10 * 60,\n}: {\n  teamId: string\n  clientId: string\n  keyId: string\n  privateKeyPem: string\n  now?: Date\n  expiresInSeconds?: number\n}) => {\n  const teamIdValue = teamId.trim()\n  const clientIdValue = clientId.trim()\n  const keyIdValue = keyId.trim()\n  const privateKeyPemValue = privateKeyPem.trim()\n\n  if (!teamIdValue) throw new Error(\"teamId is required\")\n  if (!clientIdValue) throw new Error(\"clientId is required\")\n  if (!keyIdValue) throw new Error(\"keyId is required\")\n  if (!privateKeyPemValue) throw new Error(\"privateKeyPem is required\")\n\n  const nowSeconds = Math.floor(now.getTime() / 1000)\n  const expiresIn = Number.isFinite(expiresInSeconds) ? expiresInSeconds : 10 * 60\n  const exp = nowSeconds + Math.max(60, Math.min(expiresIn, 60 * 60 * 24 * 180))\n\n  const header = { alg: \"ES256\", kid: keyIdValue, typ: \"JWT\" }\n  const payload = {\n    iss: teamIdValue,\n    iat: nowSeconds,\n    exp,\n    aud: \"https://appleid.apple.com\",\n    sub: clientIdValue,\n  }\n\n  const signingInput = `${base64UrlEncode(JSON.stringify(header))}.${base64UrlEncode(JSON.stringify(payload))}`\n  const signature = crypto.sign(\"sha256\", Buffer.from(signingInput), {\n    key: privateKeyPemValue,\n    dsaEncoding: \"ieee-p1363\",\n  })\n\n  return `${signingInput}.${base64UrlEncode(signature)}`\n}\n"],"mappings":";;;;;AAcA,IAAMU,YAAYC,OAAOC,IAAI,8BAA8B;AAE3D,IAAMC,iBAAsC;CAC1C,MAAMC,YAAYC;CAClB,MAAMC,WAAWF,UAAUJ;CAC3B,IAAIM,YAAY,OAAOA,aAAa,YAAYA,SAASP,aAAa,OAAOO,SAASP,cAAc,UAClG,OAAOO;CAGT,MAAMC,UAA+B,EAAER,WAAW,CAAC,EAAE;CACrDK,UAAUJ,aAAaO;CACvB,OAAOA;AACT;AAEA,IAAMC,sBAAsBT,cAAyE;CACnG,MAAMU,SAA+B,CAAC;CAEtC,MAAMC,sBAAsBC,cAAsB;EAChD,IAAI,CAACA,UAAUC,WAAW,GAAG,GAAG,OAAO;EACvC,IAAID,UAAUC,WAAW,IAAI,GAAG,OAAO;EACvC,OAAO;CACT;CAEA,KAAK,MAAM,CAACC,eAAeC,UAAUC,OAAOC,QAAQjB,SAAS,GAAG;EAC9D,MAAMkB,aAAaJ,cAAcK,KAAK;EACtC,IAAI,CAACD,YAAY;EAEjB,MAAM1B,SAAS,OAAOuB,OAAOvB,WAAW,WAAWuB,MAAMvB,OAAO2B,KAAK,IAAI;EACzE,MAAM1B,WAAW,OAAOsB,OAAOtB,aAAa,WAAWsB,MAAMtB,SAAS0B,KAAK,IAAI;EAC/E,IAAI,CAAC3B,QAAQ,MAAM,IAAI4B,MAAM,mBAAmBF,WAAU,iBAAkB;EAC5E,IAAI,CAACzB,UAAU,MAAM,IAAI2B,MAAM,mBAAmBF,WAAU,mBAAoB;EAEhF,MAAMxB,eAAe,OAAOqB,OAAOrB,iBAAiB,YAAYqB,MAAMrB,aAAayB,KAAK,IACpFJ,MAAMrB,eACN2B,KAAAA;EAEJ,MAAM1B,QAAQ,OAAOoB,OAAOpB,UAAU,WAAWoB,MAAMpB,MAAMwB,KAAK,IAAI;EACtE,IAAI,CAACxB,OAAO,MAAM,IAAIyB,MAAM,mBAAmBF,WAAU,gBAAiB;EAE1E,MAAMtB,eAAe,OAAOmB,OAAOnB,iBAAiB,WAChDmB,MAAMnB,aAAauB,KAAK,IACxB;EACJ,IAAI,CAACvB,cAAc,MAAM,IAAIwB,MAAM,mBAAmBF,WAAU,uBAAwB;EACxF,IAAI,CAACP,mBAAmBf,YAAY,GAAG,MAAM,IAAIwB,MAAM,mBAAmBF,WAAU,2BAA4B;EAEhHR,OAAOQ,cAAc;GACnB1B;GACAC;GACAC;GACAC;GACAC;EACF;CACF;CAEA,OAAOc;AACT;AAEA,IAAaY,2BAA2BtB,cAAmD;CACzF,MAAMuB,QAAQnB,SAAS;CACvB,MAAMoB,aAAaf,mBAAmBT,SAAS;CAC/CuB,MAAMvB,YAAY;EAAE,GAAGuB,MAAMvB;EAAW,GAAGwB;CAAW;AACxD;AAEA,IAAaC,qBAAqBzB,cAAmD;CACnF,MAAMuB,QAAQnB,SAAS;CACvBmB,MAAMvB,YAAYS,mBAAmBT,SAAS;AAChD;AAEA,IAAa0B,0BAA0BR,eAAmD;CAExF,OADcd,SACPmB,CAAAA,CAAMvB,UAAUkB,eAAe;AACxC;;;ACrFA,IAAMS,mBAAmBC,UAAkB;CACzC,MAAMC,SAASD,MAAME,QAAQ,MAAM,GAAG,CAAC,CAACA,QAAQ,MAAM,GAAG,IAAI,MAAMC,OAAOH,MAAMI,SAAS,KAAK,CAAC;CAC/F,OAAOC,OAAOC,KAAKL,QAAQ,QAAQ,CAAC,CAACM,SAAS,MAAM;AACtD;AAEA,IAAaC,oBAAiDE,UAA4B;CACxF,MAAME,QAAQF,MAAMG,MAAM,GAAG;CAC7B,IAAID,MAAMR,SAAS,GAAG,OAAO;CAE7B,IAAI;EACF,MAAMU,OAAOf,gBAAgBa,MAAM,EAAE;EACrC,MAAMG,SAASC,KAAKC,MAAMH,IAAI;EAC9B,IAAI,CAACC,UAAU,OAAOA,WAAW,UAAU,OAAO;EAClD,OAAOA;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;ACTA,IAAMS,wBAAQ,IAAIC,IAAoC;AAEtD,IAAME,mBAAmBC,QAAgBA,IAAIC,KAAK,CAAC,CAACC,QAAQ,QAAQ,EAAE;AAEtE,IAAaC,mBAAmB,OAAOC,cAA8C;CACnF,MAAMb,SAASQ,gBAAgBK,SAAS;CACxC,IAAI,CAACb,QACH,MAAM,IAAIc,MAAM,yBAAyB;CAG3C,MAAMC,WAAWV,MAAMW,IAAIhB,MAAM;CACjC,IAAIe,UACF,OAAOA;CAGT,MAAME,UAAU,YAAY;EAC1B,MAAMC,MAAM,IAAIC,IAAI,qCAAqCnB,MAAM;EAC/D,MAAMoB,WAAW,MAAMC,MAAMH,KAAK,EAAEI,SAAS,EAAEC,QAAQ,mBAAmB,EAAE,CAAC;EAC7E,IAAI,CAACH,SAASI,IAAI;GAChB,MAAMC,OAAO,MAAML,SAASM,KAAK,CAAC,CAACC,YAAY,EAAE;GACjD,MAAM,IAAIb,MAAM,4CAA4CM,SAASQ,OAAM,GAAIH,MAAM;EACvF;EAEA,MAAMI,OAAO,MAAMT,SAASS,KAAK,CAAC,CAACF,YAAY,IAAI;EACnD,IAAI,CAACE,QAAQ,OAAOA,SAAS,UAC3B,MAAM,IAAIf,MAAM,iCAAiC;EAGnD,MAAMiB,wBAAwB,OAAOF,KAAK5B,2BAA2B,WACjE4B,KAAK5B,yBACL;EACJ,MAAM+B,gBAAgB,OAAOH,KAAK3B,mBAAmB,WACjD2B,KAAK3B,iBACL;EACJ,MAAM+B,cAAc,OAAOJ,KAAK7B,WAAW,WAAW6B,KAAK7B,SAASA;EACpE,MAAMkC,mBAAmB,OAAOL,KAAK1B,sBAAsB,WAAW0B,KAAK1B,oBAAoBgC,KAAAA;EAC/F,MAAMC,UAAU,OAAOP,KAAKzB,aAAa,WAAWyB,KAAKzB,WAAW+B,KAAAA;EAEpE,IAAI,CAACJ,yBAAyB,CAACC,eAC7B,MAAM,IAAIlB,MAAM,oDAAoD;EAGtE,OAAO;GACLd,QAAQiC;GACRhC,wBAAwB8B;GACxB7B,gBAAgB8B;GAChB7B,mBAAmB+B;GACnB9B,UAAUgC;EACZ;CACF,EAAA,CAAG;CAEH/B,MAAMgC,IAAIrC,QAAQiB,MAAM;CAExB,IAAI;EACF,OAAO,MAAMA;CACf,SAASqB,KAAK;EACZjC,MAAMkC,OAAOvC,MAAM;EACnB,MAAMsC;CACR;AACF;;;AChEA,IAAaG,qBAAmBC,UAAkBA,MAC/CE,SAAS,QAAQ,CAAC,CAClBC,QAAQ,OAAO,GAAG,CAAC,CACnBA,QAAQ,OAAO,GAAG,CAAC,CACnBA,QAAQ,QAAQ,EAAE;AAErB,IAAaC,yBAAyB;CACpC,MAAMC,WAAWN,kBAAgBD,OAAOQ,YAAY,EAAE,CAAC;CAGvD,OAAO;EAAED;EAAUE,WAFDR,kBAAgBD,OAAOU,WAAW,QAAQ,CAAC,CAACC,OAAOJ,QAAQ,CAAC,CAACK,OAAO,CAEnEH;CAAU;AAC/B;;;ACdA,IAAMI,gCAAgB,IAAIC,IAAI;CAAC;CAAa;CAAa;AAAa,CAAC;AAEvE,IAAaC,yBAAyBC,UAAkB;CACtD,MAAMC,aAAaD,MAAME,KAAK;CAC9B,IAAI,CAACD,YAAY,OAAO;CACxB,IAAIA,WAAWE,SAAS,KAAK,OAAO;CACpC,IAAIN,cAAcO,IAAIH,UAAU,GAAG,OAAO;CAC1C,OAAO,mBAAmBI,KAAKJ,UAAU;AAC3C;;;ACOA,IAAMkB,uBAAuB,MAAU;AACvC,IAAMC,0BAA0B;AAOhC,IAAMK,kBAAkBC,UAAmB;CACzC,IAAI,OAAOA,UAAU,UAAU,OAAOA;CACtC,IAAIC,MAAMC,QAAQF,KAAK,KAAK,OAAOA,MAAM,OAAO,UAAU,OAAOA,MAAM;CACvE,OAAO;AACT;AAEA,IAAMG,kBAAkBC,KAAeC,SAAgC;CACrE,MAAMC,SAASF,IAAIG,IAAIC,SAASC;CAChC,IAAI,OAAOH,WAAW,YAAY,CAACA,QAAQ,OAAO;CAElD,KAAK,MAAMI,QAAQJ,OAAOK,MAAM,GAAG,GAAG;EACpC,MAAM,CAACC,QAAQ,GAAGC,QAAQH,KAAKC,MAAM,GAAG;EACxC,MAAMG,MAAMF,QAAQG,KAAK;EACzB,IAAI,CAACD,OAAOA,QAAQT,MAAM;EAC1B,MAAMW,WAAWH,KAAKI,KAAK,GAAG,CAAC,CAACF,KAAK;EACrC,IAAI,CAACC,UAAU,OAAO;EACtB,IAAI;GACF,OAAOE,mBAAmBF,QAAQ;EACpC,QAAQ;GACN,OAAOA;EACT;CACF;CAEA,OAAO;AACT;AAEA,IAAMG,sBAAsBC,cAAsB;CAChD,IAAI,CAACA,UAAUC,WAAW,GAAG,GAAG,OAAO;CACvC,IAAID,UAAUC,WAAW,IAAI,GAAG,OAAO;CACvC,OAAO;AACT;AAEA,IAAMC,oBAAoBlB,QAAkB;CAC1C,MAAMmB,cAAcnB,IAAIG,IAAIC,QAAQ;CACpC,MAAMgB,aAAapB,IAAIG,IAAIC,QAAQ;CAEnC,MAAMiB,WAAW,OAAOF,gBAAgB,WACpCA,YAAYZ,MAAM,GAAG,CAAC,CAAC,EAAE,CAACI,KAAK,IAC/BX,IAAIG,IAAIkB;CAEZ,MAAMC,OAAO,OAAOF,eAAe,WAC/BA,WAAWb,MAAM,GAAG,CAAC,CAAC,EAAE,CAACI,KAAK,IAC9BX,IAAIG,IAAIoB,IAAI,MAAM;CAEtB,OAAOF,YAAYC,OAAO,GAAGD,SAAQ,KAAMC,SAAS;AACtD;AAEA,IAAME,uBAAuBC,iBAAyB;CACpD,MAAMC,UAAUD,aAAad,KAAK;CAClC,OAAOe,WAAWX,mBAAmBW,OAAO,IAAIA,UAAU;AAC5D;AAEA,IAAMC,eAAe,OAAOxB,QAC1B,MAAM,IAAI0B,SAAiBC,SAASC,WAAW;CAC7C,IAAIC,OAAO;CACX,IAAI,OAAO7B,IAAI8B,gBAAgB,YAC7B9B,IAAI8B,YAAY,MAAM;CAGxB9B,IAAI+B,GAAG,SAASC,UAAU;EACxBH,QAAQI,OAAOD,KAAK;EACpB,IAAIH,KAAKK,SAAS,OAChBN,uBAAO,IAAIO,MAAM,wBAAwB,CAAC;CAE9C,CAAC;CACDnC,IAAI+B,GAAG,aAAaJ,QAAQE,IAAI,CAAC;CACjC7B,IAAI+B,GAAG,SAASH,MAAM;AACxB,CAAC;AAEH,IAAMQ,oBAAoB,OAAOvC,QAA0D;CACzF,IAAIA,IAAIG,IAAIsC,WAAW,QAAQ,OAAO;CAGtC,IAAI,EADgB,OAAOzC,IAAIG,IAAIC,QAAQ,oBAAoB,WAAWJ,IAAIG,IAAIC,QAAQ,kBAAkB,GAAA,CAC3FuC,SAAS,mCAAmC,GAAG,OAAO;CAEvE,MAAMX,OAAO,MAAML,aAAa3B,IAAIG,GAAG;CACvC,MAAMyC,SAAS,IAAIC,gBAAgBb,IAAI;CAEvC,MAAMc,SAAiC,CAAC;CACxC,KAAK,MAAM,CAACpC,KAAKd,UAAUgD,OAAOG,QAAQ,GACxCD,OAAOpC,OAAOd;CAGhB,OAAOkD;AACT;AAEA,IAAME,qBAAqBhD,KAAeiD,wBACvCA,sBAAsBb,OAAOpC,IAAIG,IAAIyC,QAAQM,YAAY,EAAE,EAAA,CAAGvC,KAAK;AAEtE,IAAMwC,2CAA2B,IAAIC,IAAI;CAAC;CAAa;CAAa;AAAa,CAAC;AAElF,IAAMC,gCAAgCzD,UAAuD;CAC3F,IAAI,CAACA,SAAS,OAAOA,UAAU,YAAYC,MAAMC,QAAQF,KAAK,GAAG,OAAO0D,KAAAA;CAExE,MAAMR,SAAiC,CAAC;CACxC,KAAK,MAAM,CAACS,QAAQC,aAAaC,OAAOV,QAAQnD,KAAK,GAAG;EACtD,MAAMc,MAAM6C,OAAO5C,KAAK;EACxB,IAAI,CAACD,KAAK;EACV,IAAIyC,yBAAyBO,IAAIhD,GAAG,GAAG;EACvC,MAAMiD,MAAM,OAAOH,aAAa,WAAWA,SAAS7C,KAAK,IAAI;EAC7D,IAAI,CAACgD,KAAK;EACVb,OAAOpC,OAAOiD;CAChB;CAEA,OAAOF,OAAOG,KAAKd,MAAM,CAAC,CAACT,SAASS,SAASQ,KAAAA;AAC/C;AAMA,IAAaY,2BAA2B,OAAO,EAC7ClE,KACAmE,YAAYlB,oBACZxD,UACA2E,0BAM+B;CAC/B,MAAMD,aAAanB,kBAAkBhD,KAAKiD,kBAAkB;CAC5D,IAAI,CAACkB,YACH,OAAO;EAAEL,SAAS;EAAOE,OAAO;EAAoBC,YAAY;CAAI;CAGtE,IAAI,CAAC7E,sBAAsB+E,UAAU,GACnC,OAAO;EAAEL,SAAS;EAAOE,OAAO;EAAoBC,YAAY;CAAI;CAGtE,MAAMf,WAAWlE,uBAAuBmF,UAAU;CAClD,IAAI,CAACjB,UACH,OAAO;EAAEY,SAAS;EAAOE,OAAO;EAAoBC,YAAY;CAAI;CAGtE,MAAMI,SAASnD,iBAAiBlB,GAAG;CACnC,IAAI,CAACqE,QACH,OAAO;EAAEP,SAAS;EAAOE,OAAO;EAAsBC,YAAY;CAAI;CAExE,MAAMK,UAAUD,OAAOpD,WAAW,UAAU;CAE5C,MAAMQ,eAAeD,oBAAoB0B,SAASzB,YAAY;CAC9D,IAAI,CAACA,cACH,OAAO;EAAEqC,SAAS;EAAOE,OAAO;EAAyBC,YAAY;CAAI;CAG3E,MAAMM,QAAQ/F,OAAOgG,YAAY,EAAE,CAAC,CAACC,SAAS,KAAK;CACnD,MAAM,EAAEC,UAAUC,cAAcxF,iBAAiB;CAEjD,MAAMyF,eAAe,OAAOnF,aAAa,YAAYsB,mBAAmBtB,QAAQ,IAAIA,WAAW6D,KAAAA;CAE/F,IAAI;EACF,MAAMuB,eAAe,MAAMjG,OAAOkG,UAAU,kBAAkB9E,GAAG;EACjE,MAAM+E,sBAAM,IAAIC,KAAK;EACrB,MAAMH,aAAaI,OAAO;GACxBC,KAAKX;GACLJ;GACAzE,cAAcgF;GACdjF,UAAUmF;GACVO,WAAWJ;GACXK,WAAW,IAAIJ,KAAKD,IAAIM,QAAQ,IAAIhG,oBAAoB;EAC1D,CAAC;CACH,SAASiG,KAAK;EACZC,QAAQC,KAAK,kCAAkCF,GAAG;EAClD,OAAO;GAAExB,SAAS;GAAOE,OAAO;GAA8BC,YAAY;EAAI;CAChF;CAEA,IAAI;EACFjE,IAAIyF,IAAIpF,OAAOf,yBAAyB,GAAG6E,WAAU,GAAII,SAAS;GAChEmB,UAAU;GACVC,QAAQrB;GACRsB,UAAUtB,UAAU,SAAS;GAC7BuB,MAAMpE;GACNqE,QAAQzG;EACV,CAAC;CACH,SAASiG,KAAK;EACZC,QAAQC,KAAK,qCAAqCF,GAAG;EACrD,OAAO;GAAExB,SAAS;GAAOE,OAAO;GAA2BC,YAAY;EAAI;CAC7E;CAEA,MAAM8B,OAAO,MAAM7G,iBAAiBgE,SAAS8C,MAAM;CACnD,MAAMC,cAAc,GAAG5B,SAAS5C;CAEhC,MAAMyE,MAAM,IAAIC,IAAIJ,KAAKK,sBAAsB;CAC/CF,IAAIG,aAAaC,IAAI,aAAapD,SAASqD,QAAQ;CACnDL,IAAIG,aAAaC,IAAI,gBAAgBL,WAAW;CAChDC,IAAIG,aAAaC,IAAI,iBAAiB,MAAM;CAC5CJ,IAAIG,aAAaC,IAAI,SAASpD,SAASsD,KAAK;CAC5CN,IAAIG,aAAaC,IAAI,SAAS/B,KAAK;CACnC2B,IAAIG,aAAaC,IAAI,kBAAkB3B,SAAS;CAChDuB,IAAIG,aAAaC,IAAI,yBAAyB,MAAM;CACpD,MAAMG,2BAA2BpD,6BAA6Be,mBAAmB;CACjF,KAAK,MAAM,CAAC1D,KAAKd,UAAU6D,OAAOV,QAAQ0D,4BAA4B,CAAC,CAAC,GAAG;EACzE,IAAIP,IAAIG,aAAa3C,IAAIhD,GAAG,GAAG;EAC/BwF,IAAIG,aAAaC,IAAI5F,KAAKd,KAAK;CACjC;CAEA,OAAO;EAAEkE,SAAS;EAAMC,aAAamC,IAAIzB,SAAS;CAAE;AACtD;AA2BA,IAAMyC,8BAA8B;AACpC,IAAMC,2BAA2B;AAEjC,IAAaC,uBAAuB,OAAO,EACzCpH,KACAmE,YAAYlB,oBACZoE,yBACAC,yBACAC,0BAOkC;CAClC,MAAMpD,aAAanB,kBAAkBhD,KAAKiD,kBAAkB;CAC5D,IAAI,CAACkB,YACH,OAAO;EAAEL,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAoB4C,cAAc,GAAGO,yBAAwB;CAA0B;CAGxI,IAAI,CAAC/H,sBAAsB+E,UAAU,GACnC,OAAO;EAAEL,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAoB4C,cAAc,GAAGO,yBAAwB;CAA0B;CAGxI,MAAMjE,WAAWlE,uBAAuBmF,UAAU;CAClD,IAAI,CAACjB,UACH,OAAO;EAAEY,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAoB4C,cAAc,GAAGO,yBAAwB;CAA0B;CAGxI,MAAM9C,SAASnD,iBAAiBlB,GAAG;CACnC,IAAI,CAACqE,QACH,OAAO;EAAEP,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAsB4C,cAAc,GAAGO,yBAAwB;CAA4B;CAE5I,MAAM7C,UAAUD,OAAOpD,WAAW,UAAU;CAE5C,MAAMQ,eAAeD,oBAAoB0B,SAASzB,YAAY;CAC9D,IAAI,CAACA,cACH,OAAO;EAAEqC,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAyB4C,cAAc,GAAGO,yBAAwB;CAA+B;CAGlJ,MAAMK,aAAa,MAAMjF,kBAAkBvC,GAAG;CAE9C,MAAMyH,QAAQ9H,eAAe6H,YAAYC,IAAI,KAAK9H,eAAeK,IAAIG,IAAIuH,OAAOD,IAAI,EAAA,EAAI9G,KAAK,KAAK;CAClG,MAAM4D,SAAS5E,eAAe6H,YAAYjD,KAAK,KAAK5E,eAAeK,IAAIG,IAAIuH,OAAOnD,KAAK,EAAA,EAAI5D,KAAK,KAAK;CACrG,MAAMgH,gBAAgBhI,eAAe6H,YAAYI,IAAI,KAAKjI,eAAeK,IAAIG,IAAIuH,OAAOE,IAAI,EAAA,EAAIjH,KAAK,KAAK;CAE1G,IAAI,CAAC8G,QAAQ,CAAClD,OACZ,OAAO;EAAET,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAyB4C,cAAc,GAAGO,yBAAwB;CAA+B;CAIlJ,IADyBpH,eAAeC,KAAKV,uBACzCuI,MAAqB,GAAG1D,WAAU,GAAII,SACxC,OAAO;EAAET,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAiB4C,cAAc,GAAGO,yBAAwB;CAAuB;CAGlI,IAAIW,eAA0C;CAC9C,IAAIC,oBAAyE;CAC7E,IAAI;EACFA,oBAAoB,MAAMnJ,OAAOkG,UAAU,kBAAkB9E,GAAG;EAChE8H,eAAe,MAAMC,kBAAkBG,QAAQ;GAAEhD,KAAKX;GAAOJ;EAAW,CAAC,CAAC,CAACgE,KAAK;CAClF,SAAS7C,KAAK;EACZC,QAAQC,KAAK,iCAAiCF,GAAG;EACjD,OAAO;GAAExB,SAAS;GAAO6C,MAAM;GAAS3C,OAAO;GAA6B4C,cAAc,GAAGO,yBAAwB;EAAmC;CAC1J;CAEA,IAAI,CAACW,cACH,OAAO;EAAEhE,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAiB4C,cAAc,GAAGO,yBAAwB;CAAuB;CAGlI,MAAM1H,WAAW,OAAOqI,aAAarI,aAAa,WAAWqI,aAAarI,WAAW6D,KAAAA;CACrF,MAAM5D,eAAe,OAAOoI,aAAapI,iBAAiB,WAAWoI,aAAapI,eAAe;CACjG,IAAI,CAACA,cACH,OAAO;EAAEoE,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAyB4C,cAAc,GAAGO,yBAAwB;CAA+B;CAGlJ,MAAMpB,OAAO,MAAM7G,iBAAiBgE,SAAS8C,MAAM;CACnD,MAAMC,cAAc,GAAG5B,SAAS5C;CAEhC,MAAM2G,YAAY,IAAIvF,gBAAgB;CACtCuF,UAAU9B,IAAI,cAAc,oBAAoB;CAChD8B,UAAU9B,IAAI,QAAQmB,IAAI;CAC1BW,UAAU9B,IAAI,gBAAgBL,WAAW;CACzCmC,UAAU9B,IAAI,aAAapD,SAASqD,QAAQ;CAC5C6B,UAAU9B,IAAI,iBAAiB5G,YAAY;CAC3C,IAAIwD,SAASmF,cACXD,UAAU9B,IAAI,iBAAiBpD,SAASmF,YAAY;CAGtD,MAAMC,gBAAgB,MAAMC,MAAMxC,KAAKyC,gBAAgB;EACrD/F,QAAQ;EACRrC,SAAS;GACP,gBAAgB;GAChBqI,QAAQ;EACV;EACAzG,MAAMoG,UAAU3D,SAAS;CAC3B,CAAC;CAED,MAAMiE,YAAY,MAAMJ,cAAcK,KAAK,CAAC,CAACC,YAAY,IAAI;CAE7D,IAAI,CAACN,cAAcO,MAAM,CAACH,aAAa,OAAOA,cAAc,UAAU;EACpE,MAAM1G,OAAO0G,YAAYI,KAAKC,UAAUL,SAAS,IAAI;EACrDnD,QAAQC,KAAK,gCAAgC8C,cAAcU,QAAQhH,IAAI;EACvE,OAAO;GAAE8B,SAAS;GAAO6C,MAAM;GAAS3C,OAAO;GAAyB4C,cAAc,GAAGO,yBAAwB;EAA+B;CAClJ;CAEA,MAAM8B,cAAc,OAAOP,UAAUQ,iBAAiB,WAAWR,UAAUQ,eAAe;CAC1F,MAAMC,eAAe,OAAOT,UAAUU,kBAAkB,WAAWV,UAAUU,gBAAgB9F,KAAAA;CAC7F,MAAM+F,UAAU,OAAOX,UAAUY,aAAa,WAAWZ,UAAUY,WAAWhG,KAAAA;CAC9E,MAAMkD,QAAQ,OAAOkC,UAAUlC,UAAU,WAAWkC,UAAUlC,QAAQlD,KAAAA;CACtE,MAAMiG,YAAY,OAAOb,UAAUc,eAAe,WAAWd,UAAUc,aAAalG,KAAAA;CACpF,MAAMmG,YAAY,OAAOf,UAAUgB,eAAe,WAC9ChB,UAAUgB,aACV,OAAOhB,UAAUgB,eAAe,WAC9BC,OAAOjB,UAAUgB,UAAU,IAC3BpG,KAAAA;CACN,MAAMsG,mBAAmB,OAAOH,cAAc,YAAYE,OAAOE,SAASJ,SAAS,IAAIA,YAAY;CACnG,MAAMrE,YAAYwE,qBAAqB,OAAO,IAAI5E,KAAKA,KAAKD,IAAI,IAAI6E,mBAAmB,GAAI,IAAItG,KAAAA;CAE/F,IAAIwG,WAA2C;CAE/C,IAAI/D,KAAKgE,qBAAqBd,aAAa;EACzC,MAAMe,mBAAmB,MAAMzB,MAAMxC,KAAKgE,mBAAmB,EAC3D3J,SAAS;GACP6J,eAAe,UAAUhB;GACzBR,QAAQ;EACV,EACF,CAAC;EAED,IAAIuB,iBAAiBnB,IACnBiB,WAAW,MAAME,iBAAiBrB,KAAK,CAAC,CAACC,YAAY,IAAI;CAE7D;CAEA,MAAMsB,iBAAiBb,UAAUpK,iBAA0CoK,OAAO,IAAI;CACtF,MAAMc,qBAAqBlL,iBAA0CgK,WAAW;CAEhF,MAAMjC,UAAU,OAAO8C,UAAUM,QAAQ,WACrCN,SAASM,MACT,OAAOF,gBAAgBE,QAAQ,WAC7BF,eAAeE,MACf,OAAOD,oBAAoBC,QAAQ,WACjCD,mBAAmBC,MACnB;CAER,IAAI,CAACpD,SACH,OAAO;EAAElD,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAmB4C,cAAc,GAAGO,yBAAwB;CAAyB;CAGtI,MAAMF,QAAQ,OAAO6C,UAAU7C,UAAU,WACrC6C,SAAS7C,QACT,OAAOiD,gBAAgBjD,UAAU,WAC/BiD,eAAejD,QACf3D,KAAAA;CAEN,MAAMrD,OAAO,OAAO6J,UAAU7J,SAAS,WACnC6J,SAAS7J,OACT,OAAOiK,gBAAgBjK,SAAS,WAC9BiK,eAAejK,OACfqD,KAAAA;CAEN,IAAI+G,YAAqB;CACzB,IAAI1C,cACF,IAAI;EACF0C,YAAYvB,KAAKwB,MAAM3C,YAAY;CACrC,QAAQ;EACN0C,YAAY;CACd;CAEF,MAAME,kBAAkBF,aAAa,OAAOA,cAAc,WACrDA,YACD;CACJ,MAAMG,iBAAiB,OAAOD,iBAAiBtD,UAAU,WAAWsD,gBAAgBtD,MAAMtG,KAAK,IAAI;CACnG,MAAM8J,sBAAsBF,iBAAiBtK,QAAQ,OAAOsK,gBAAgBtK,SAAS,WAChFsK,gBAAgBtK,OACjB;CAGJ,MAAM6K,gBAAgB,CAFK,OAAOL,qBAAqBE,cAAc,WAAWF,oBAAoBE,UAAUhK,KAAK,IAAI,IAC7F,OAAO8J,qBAAqBI,aAAa,WAAWJ,oBAAoBI,SAASlK,KAAK,IAAI,EACxD,CAAC,CAACoK,OAAOC,OAAO,CAAC,CAACnK,KAAK,GAAG,CAAC,CAACF,KAAK;CAE7F,MAAMsK,gBAAgBhE,UAAUuD,kBAAkBlH,KAAAA;CAClD,MAAM4H,eAAejL,SAAS6K,iBAAiBxH,KAAAA;CAE/C,MAAM,CAAC6H,MAAMC,UAAU,MAAMvJ,QAAQwJ,IAAI,CACvCzM,OAAOkG,UAAU,UAAU9E,GAAG,GAC9BpB,OAAOkG,UAAU,YAAY9E,GAAG,CAAC,CAClC;CAED,MAAMsL,kBAAkB,kBAAkBnH,WAAU;CACpD,IAAIyD,OAAO,MAAMuD,KAAKjD,QAAQ,GAAGoD,kBAAkBtE,QAAQ,CAAC;CAE5D,IAAI,CAACY,QAAQqD,eACXrD,OAAO,MAAMuD,KAAKjD,QAAQ,EAAEjB,OAAOgE,cAAc,CAAC;CAIpD,IAAI,CAACrD,QAAQ,EADYP,2BAA2B,OACpB;EAC9B,MAAMT,eAAeU;EAErB,MAAMxE,SAA8B;GAClCgB,SAAS;GACT6C,MAAM;GACNxC;GACA6C;GACAC,OAAOgE;GACPhL,MAAMiL;EACR;EAEA,IAAItE,gBAAgB7F,mBAAmB6F,YAAY,GAAG;GACpD,MAAMV,MAAM,IAAIC,IAAIS,cAAcvC,MAAM;GACxC6B,IAAIG,aAAaC,IAAI,kBAAkBnC,UAAU;GACjD,IAAI8G,eAAe/E,IAAIG,aAAaC,IAAI,SAAS2E,aAAa;GAC9D,IAAIC,cAAchF,IAAIG,aAAaC,IAAI,QAAQ4E,YAAY;GAC3DpI,OAAO8D,eAAe,GAAGV,IAAIsF,WAAWtF,IAAIuF;EAC9C;EAEA,OAAO3I;CACT;CAEA,IAAI,CAAC9C,IAAIG,IAAIuL,SACX,OAAO;EAAE5H,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAuB4C,cAAc,GAAGO,yBAAwB;CAA6B;CAG9I,MAAMpC,sBAAM,IAAIC,KAAK;CAErB,IAAI2G;CAEJ,MAAMG,oBADiBlE,MAAMrG,IAAI,gBAAgB,EAAA,EACRA,IAAI4C,UAAU;CACvD,IAAI2H,kBAAkB3G,qBAAqBH,MACzC2G,oBAAoBG,iBAAiB3G;CAGvC,MAAM4G,uBAAuB;EAC3B/E;EACAC,OAAOgE;EACPhL,MAAMiL;EACNjC;EACAE;EACAE;EACA7C;EACA+C;EACAnE;EACA4G,aAAalC,YAAYxG,KAAAA;EACzB6B,WAAWwG,qBAAqB5G;EAChCkH,WAAWlH;CACb;CAEA,IAAI,CAAC6C,MAAM;EACT,MAAMd,WAAWtI,OAAO0N,WAAW;EAGnCtE,OAAO,IAAIuD,KAAK;GACdlE,OAAOgE;GACPhL,MAAMiL;GACNiB,UAAAA,MALqBtN,uBAAuBL,OAAOgG,YAAY,EAAE,CAAC,CAACC,SAAS,KAAK,CAAC;GAMlF2H,SAAS,CAACtF,QAAQ;GAClBuF,aAAa,GACVvF,WAAW,CAAC,OAAO,EACtB;GACA8E,gBAAgB,GACbzH,aAAa4H,qBAChB;EACF,CAAC;EAED,MAAMnE,KAAK0E,KAAK;EAEhB,IAAI;GACF,MAAM3N,wBAAwByM,QAAQ;IACpCtE;IACA7G,MAAMgL,iBAAiBjE;GACzB,CAAC;EACH,SAAS1B,KAAK;GACZC,QAAQvB,MAAM,sCAAsCsB,GAAG;GACvD,IAAI;IACF,MAAM6F,KAAKoB,UAAU,EAAErH,KAAK0C,KAAK1C,IAAI,CAAC;GACxC,SAASsH,eAAe;IACtBjH,QAAQvB,MAAM,kCAAkCwI,aAAa;GAC/D;GACA,OAAO;IACL1I,SAAS;IACT6C,MAAM;IACN3C,OAAO;IACP4C,cAAc,GAAGO,yBAAwB;GAC3C;EACF;CACF,OAAO;EACL,MAAMsF,YAAqC,GACxC,kBAAkBtI,eAAe4H,qBACpC;EAEA,IAAI,CAACnE,KAAKX,SAASgE,eACjBwB,UAAUxF,QAAQgE;EAGpB,IAAI,CAACrD,KAAK3H,QAAQiL,cAChBuB,UAAUxM,OAAOiL;EAGnB,MAAMC,KAAKuB,UAAU,EAAExH,KAAK0C,KAAK1C,IAAI,GAAG,EAAEyH,MAAMF,UAAU,CAAC;CAC7D;CAEA,MAAM1F,mBAAmBa,KAAKwE,WAAW,CAAA,EAAA,CAAIQ,IAAIxK,MAAM;CACvD,MAAM0E,WAAWC,gBAAgB;CACjC,IAAI,CAACD,UACH,OAAO;EACLhD,SAAS;EACT6C,MAAM;EACN3C,OAAO;EACP4C,cAAc,GAAGO,yBAAwB;CAC3C;CAEF,MAAM0F,iBAAiBjF,KAAKrG,IAAI,aAAa;CAC7C,MAAM8K,cAAcQ,iBAAiBpJ,OAAOqJ,YAAYD,eAAe9J,QAAQ,CAAC,IAAIO,KAAAA;CAEpF,IAAI,CAACxE,mBAAmBkB,KAAK;EAC3B6G,QAAQe,KAAK1C,IAAIT,SAAS;EAC1BsI,iBAAiBjG;EACjBC,iBAAiBA,gBAAgB1E,SAAS0E,kBAAkB,CAACD,QAAQ;EACrEuF;CACF,CAAC,GACC,OAAO;EACLvI,SAAS;EACT6C,MAAM;EACN3C,OAAO;EACP4C,cAAc,GAAGO,yBAAwB;CAC3C;CAGF,IAAI;EACF,IAAIY,mBACF,MAAMA,kBAAkBwE,UAAU;GAAErH,KAAKX;GAAOJ;EAAW,CAAC;CAEhE,SAASmB,KAAK;EACZC,QAAQC,KAAK,mCAAmCF,GAAG;CACrD;CAEA,IAAI;EACFtF,IAAIyF,IAAIuH,YAAY1N,yBAAyB;GAC3CoG,UAAU;GACVC,QAAQrB;GACRsB,UAAUtB,UAAU,SAAS;GAC7BuB,MAAMpE;EACR,CAAC;CACH,SAAS6D,KAAK;EACZC,QAAQC,KAAK,uCAAuCF,GAAG;CACzD;CAQA,OAAO;EACLxB,SAAS;EACT6C,MAAM;EACNC,cATmBnH,YAAYsB,mBAAmBtB,QAAQ,IACxDA,WACA8H,uBAAuBxG,mBAAmBwG,mBAAmB,IAC3DA,sBACAL;EAMJL,QAAQe,KAAK1C,IAAIT,SAAS;EAC1BqC;EACAC,iBAAiBA,gBAAgB1E,SAAS0E,kBAAkB,CAACD,QAAQ;CACvE;AACF;AAEA,IAAamG,2BAA2B,EACtC9I,YACA+I,2BAIE,CAAC,MAAkF,OACrFC,UACAnN,QACG;CACH,MAAMoN,qBAAqBpK,kBAAkBhD,KAAKmE,UAAU;CAC5D,MAAMkJ,8BAA8BD,sBAAsBF,yBACtDA,uBAAuBE,kBAAkB,IACzC9J,KAAAA;CACJ,MAAM7D,WAAWE,eAAeK,IAAIG,IAAIuH,OAAOjI,QAAQ,CAAC,EAAEkB,KAAK;CAC/D,MAAMmC,SAAS,MAAMoB,yBAAyB;EAC5ClE;EACAmE,YAAYiJ;EACZ3N;EACA2E,qBAAqBiJ;CACvB,CAAC;CAED,IAAI,CAACvK,OAAOgB,SAAS;EACnB9D,IAAIyF,IAAIuD,OAAOlG,OAAOmB,UAAU;EAChC,OAAO;GAAEH,SAAS;GAAOE,OAAOlB,OAAOkB;EAAM;CAC/C;CAEAhE,IAAIyF,IAAI6H,SAASxK,OAAOiB,WAAW;CACnC,OAAO,EAAED,SAAS,KAAK;AACzB;AAEA,IAAayJ,8BAA8B,EACzCpJ,YACAkD,yBACAC,yBACAC,wBAME,CAAC,MAAkF,OACrF4F,UACAnN,QACG;CACH,MAAM8C,SAAS,MAAMsE,qBAAqB;EACxCpH;EACAmE;EACAkD;EACAC;EACAC;CACF,CAAC;CAED,IAAIzE,OAAO6D,SAAS,SAAS;EAC3B3G,IAAIyF,IAAI6H,SAASxK,OAAO8D,YAAY;EACpC,OAAO;GAAE9C,SAAS;GAAOE,OAAOlB,OAAOkB;EAAM;CAC/C;CAEA,IAAIlB,OAAO6D,SAAS,gBAAgB;EAClC,IAAI7D,OAAO8D,cACT5G,IAAIyF,IAAI6H,SAASxK,OAAO8D,YAAY;OAEpC5G,IAAIyF,IAAI6H,SAAS,eAAe;EAElC,OAAO;GAAExJ,SAAS;GAAOE,OAAO;EAAiB;CACnD;CAEAhE,IAAIyF,IAAI6H,SAASxK,OAAO8D,YAAY;CACpC,OAAO,EAAE9C,SAAS,KAAK;AACzB;AAEA,IAAM0J,mBAAmBC,UACvBC,OAAOC,KAAKF,KAAK,CAAC,CACfhJ,SAAS,QAAQ,CAAC,CAClBmJ,QAAQ,OAAO,GAAG,CAAC,CACnBA,QAAQ,OAAO,GAAG,CAAC,CACnBA,QAAQ,QAAQ,EAAE;AAEvB,IAAaC,2BAA2B,EACtCC,QACAvH,UACAwH,OACAC,eACAjJ,sBAAM,IAAIC,KAAK,GACf4E,mBAAmB,UAQf;CACJ,MAAMqE,cAAcH,OAAOnN,KAAK;CAChC,MAAMuN,gBAAgB3H,SAAS5F,KAAK;CACpC,MAAMwN,aAAaJ,MAAMpN,KAAK;CAC9B,MAAMyN,qBAAqBJ,cAAcrN,KAAK;CAE9C,IAAI,CAACsN,aAAa,MAAM,IAAI3L,MAAM,oBAAoB;CACtD,IAAI,CAAC4L,eAAe,MAAM,IAAI5L,MAAM,sBAAsB;CAC1D,IAAI,CAAC6L,YAAY,MAAM,IAAI7L,MAAM,mBAAmB;CACpD,IAAI,CAAC8L,oBAAoB,MAAM,IAAI9L,MAAM,2BAA2B;CAEpE,MAAM+L,aAAaC,KAAKC,MAAMxJ,IAAIM,QAAQ,IAAI,GAAI;CAElD,MAAMmJ,MAAMH,aAAaC,KAAKG,IAAI,IAAIH,KAAKI,IADzB/E,OAAOE,SAASD,gBAAgB,IAAIA,mBAAmB,KACf,OAAU,KAAK,GAAG,CAAC;CAE7E,MAAM1J,SAAS;EAAEyO,KAAK;EAASC,KAAKT;EAAYU,KAAK;CAAM;CAC3D,MAAMC,UAAU;EACdC,KAAKd;EACLe,KAAKX;EACLG;EACAS,KAAK;EACL7E,KAAK8D;CACP;CAEA,MAAMgB,eAAe,GAAG1B,gBAAgB1E,KAAKC,UAAU7I,MAAM,CAAC,EAAC,GAAIsN,gBAAgB1E,KAAKC,UAAU+F,OAAO,CAAC;CAM1G,OAAO,GAAGI,aAAY,GAAI1B,gBALRhP,OAAO4Q,KAAK,UAAU1B,OAAOC,KAAKuB,YAAY,GAAG;EACjExO,KAAK0N;EACLiB,aAAa;CACf,CAE0CF,CAAS;AACrD"}

package/dist/oauth/lib.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lib.d.ts","sourceRoot":"","sources":["../../src/oauth/lib.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAK9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAU/C,KAAK,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC,CAAA;AAiHpC,MAAM,MAAM,gBAAgB,GACxB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD,eAAO,MAAM,wBAAwB,GAAU,yEAK5C;IACD,GAAG,EAAE,QAAQ,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC7C,KAAG,OAAO,CAAC,gBAAgB,CA8E3B,CAAA;AAED,MAAM,MAAM,mBAAmB,GAC3B;IACA,OAAO,EAAE,IAAI,CAAA;IACb,IAAI,EAAE,WAAW,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B,GACC;IACA,OAAO,EAAE,KAAK,CAAA;IACd,IAAI,EAAE,cAAc,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GACC;IACA,OAAO,EAAE,KAAK,CAAA;IACd,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;CACrB,CAAA;AAKH,eAAO,MAAM,oBAAoB,GAAU,iHAMxC;IACD,GAAG,EAAE,QAAQ,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B,KAAG,OAAO,CAAC,mBAAmB,CA+U9B,CAAA;AAED,eAAO,MAAM,uBAAuB,GAAI,0CAGrC;IACD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,sBAAsB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;CAC/E,KAAG,UAAU,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,eAAe,CAuBjF,CAAA;AAED,eAAO,MAAM,0BAA0B,GAAI,yFAKxC;IACD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACxB,KAAG,UAAU,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,eAAe,CA4BjF,CAAA;AASD,eAAO,MAAM,uBAAuB,GAAI,oEAOrC;IACD,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,GAAG,CAAC,EAAE,IAAI,CAAA;IACV,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B,WA+BA,CAAA"}
+{"version":3,"file":"lib.d.ts","sourceRoot":"","sources":["../../src/oauth/lib.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAK9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAU/C,KAAK,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC,CAAA;AAiHpC,MAAM,MAAM,gBAAgB,GACxB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD,eAAO,MAAM,wBAAwB,GAAU,yEAK5C;IACD,GAAG,EAAE,QAAQ,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC7C,KAAG,OAAO,CAAC,gBAAgB,CA8E3B,CAAA;AAED,MAAM,MAAM,mBAAmB,GAC3B;IACA,OAAO,EAAE,IAAI,CAAA;IACb,IAAI,EAAE,WAAW,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B,GACC;IACA,OAAO,EAAE,KAAK,CAAA;IACd,IAAI,EAAE,cAAc,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GACC;IACA,OAAO,EAAE,KAAK,CAAA;IACd,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;CACrB,CAAA;AAKH,eAAO,MAAM,oBAAoB,GAAU,iHAMxC;IACD,GAAG,EAAE,QAAQ,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B,KAAG,OAAO,CAAC,mBAAmB,CA0V9B,CAAA;AAED,eAAO,MAAM,uBAAuB,GAAI,0CAGrC;IACD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,sBAAsB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;CAC/E,KAAG,UAAU,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,eAAe,CAuBjF,CAAA;AAED,eAAO,MAAM,0BAA0B,GAAI,yFAKxC;IACD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACxB,KAAG,UAAU,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,eAAe,CA4BjF,CAAA;AASD,eAAO,MAAM,uBAAuB,GAAI,oEAOrC;IACD,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,GAAG,CAAC,EAAE,IAAI,CAAA;IACV,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B,WA+BA,CAAA"}

package/dist/routes.js

@@ -7,7 +7,7 @@ var routes = Object.entries({ .../* #__PURE__ */ Object.assign({
 	"./api/set-new-password/handler.ts": () => import("./handler-DoyR_l2O.js"),
 	"./api/sign-in/handler.ts": () => import("./handler-DH9FPTNh.js"),
 	"./api/sign-out/handler.ts": () => import("./handler-DQvdRpG2.js"),
-	"./api/sign-up/handler.ts": () => import("./handler-BGjAGBrc.js"),
+	"./api/sign-up/handler.ts": () => import("./handler-BerdJCZB.js"),
 	"./api/verify-otp/handler.ts": () => import("./handler-DAKI9QOQ.js"),
 	"./api/verify-password-reset-otp/handler.ts": () => import("./handler-DAfIloZR.js")
 }) }).reduce((acc, [path, mod]) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rpcbase/auth",
-  "version": "0.182.0",
+  "version": "0.184.0",
   "type": "module",
   "files": [
     "dist",

package/dist/handler-BGjAGBrc.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"handler-BGjAGBrc.js","names":["crypto","Api","Ctx","ApiHandler","models","hashPasswordForStorage","sendEmail","AuthSessionUser","SignUp","signUp","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","Tenant","parsed","requestSchema","safeParse","success","res","status","error","email","password","rememberMe","_rememberMe","data","existingUser","findOne","console","log","hashedPassword","tenantId","randomUUID","emailVerificationCode","randomInt","toString","padStart","emailVerificationExpiresAt","Date","now","user","tenants","tenantRoles","save","to","subject","html","text","err","deleteOne","_id","rollbackErr","create","name","warn","userId","api","post","ROUTE"],"sources":["../src/api/sign-up/handler.ts"],"sourcesContent":["import crypto from \"crypto\"\n\nimport { Api, Ctx, ApiHandler } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { hashPasswordForStorage, sendEmail } from \"@rpcbase/server\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SignUp from \"./index\"\n\n\nexport const signUp: ApiHandler<SignUp.RequestPayload, SignUp.ResponsePayload, AuthSessionUser> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SignUp.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n  const Tenant = await models.getGlobal(\"RBTenant\", ctx)\n\n  const parsed = SignUp.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  const { email, password, rememberMe: _rememberMe } = parsed.data\n\n  const existingUser = await User.findOne({ email })\n\n  if (existingUser) {\n    console.log(\"user with email already exists\", email)\n    // For security, we don't want to reveal if an email is registered.\n    // But for this implementation, we'll make it simple.\n    ctx.res.status(409)\n    return { success: false, error: \"user_exists\" }\n  }\n\n  const hashedPassword = await hashPasswordForStorage(password)\n\n  const tenantId = crypto.randomUUID()\n\n  const emailVerificationCode = crypto.randomInt(0, 1_000_000).toString().padStart(6, \"0\")\n  const emailVerificationExpiresAt = new Date(Date.now() + 10 * 60 * 1000)\n\n  const user = new User({\n    email,\n    password: hashedPassword,\n    tenants: [tenantId],\n    tenantRoles: {\n      [tenantId]: [\"owner\"],\n    },\n    emailVerificationCode,\n    emailVerificationExpiresAt,\n  })\n  await user.save()\n\n  try {\n    await sendEmail({\n      to: email,\n      subject: `Verify your email: ${emailVerificationCode}`,\n      html: `\n        <p>Welcome to rpcbase!</p>\n        <p>Your verification code is <strong>${emailVerificationCode}</strong>. It expires in 10 minutes.</p>\n        <p>If you didn't request this, you can ignore this message.</p>\n      `,\n      text: `Welcome to rpcbase! Your verification code is ${emailVerificationCode}. It expires in 10 minutes. If you didn't request this, you can ignore this message.`,\n    })\n  } catch (err) {\n    console.error(\"failed to send sign-up email\", err)\n\n    try {\n      await User.deleteOne({ _id: user._id })\n    } catch (rollbackErr) {\n      console.error(\"failed to roll back user after sign-up email failure\", rollbackErr)\n    }\n\n    ctx.res.status(500)\n    return { success: false, error: \"email_delivery_failed\" }\n  }\n\n  try {\n    await Tenant.create({\n      tenantId,\n      name: email,\n    })\n  } catch (err) {\n    // best-effort tenant creation; log and continue\n    console.warn(\"failed to create tenant for user\", err)\n  }\n\n  console.log(\"created new user\", user._id.toString())\n\n  return { success: true, userId: user._id.toString(), tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(SignUp.ROUTE, signUp)\n}\n"],"mappings":";;;;;AAWA,IAAaS,SAAqF,OAChGG,SACAC,QACoC;CACpC,MAAME,OAAO,MAAMX,OAAOY,UAAU,UAAUH,GAAG;CACjD,MAAMI,SAAS,MAAMb,OAAOY,UAAU,YAAYH,GAAG;CAErD,MAAMK,SAAAA,cAA8BE,UAAUR,OAAO;CAErD,IAAI,CAACM,OAAOG,SAAS;EACnBR,IAAIS,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAGA,MAAM,EAAEC,OAAOC,UAAUC,YAAYC,gBAAgBV,OAAOW;CAI5D,IAAIC,MAFuBf,KAAKgB,QAAQ,EAAEN,MAAM,CAAC,GAE/B;EAChBO,QAAQC,IAAI,kCAAkCR,KAAK;EAGnDZ,IAAIS,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAc;CAChD;CAEA,MAAMU,iBAAiB,MAAM7B,uBAAuBqB,QAAQ;CAE5D,MAAMS,WAAWnC,OAAOoC,WAAW;CAEnC,MAAMC,wBAAwBrC,OAAOsC,UAAU,GAAG,GAAS,CAAC,CAACC,SAAS,CAAC,CAACC,SAAS,GAAG,GAAG;CACvF,MAAMC,6BAA6B,IAAIC,KAAKA,KAAKC,IAAI,IAAI,MAAU,GAAI;CAEvE,MAAMC,OAAO,IAAI7B,KAAK;EACpBU;EACAC,UAAUQ;EACVW,SAAS,CAACV,QAAQ;EAClBW,aAAa,GACVX,WAAW,CAAC,OAAO,EACtB;EACAE;EACAI;CACF,CAAC;CACD,MAAMG,KAAKG,KAAK;CAEhB,IAAI;EACF,MAAMzC,UAAU;GACd0C,IAAIvB;GACJwB,SAAS,sBAAsBZ;GAC/Ba,MAAM;;+CAEmCb,sBAAqB;;;GAG9Dc,MAAM,iDAAiDd,sBAAqB;EAC9E,CAAC;CACH,SAASe,KAAK;EACZpB,QAAQR,MAAM,gCAAgC4B,GAAG;EAEjD,IAAI;GACF,MAAMrC,KAAKsC,UAAU,EAAEC,KAAKV,KAAKU,IAAI,CAAC;EACxC,SAASC,aAAa;GACpBvB,QAAQR,MAAM,wDAAwD+B,WAAW;EACnF;EAEA1C,IAAIS,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAwB;CAC1D;CAEA,IAAI;EACF,MAAMP,OAAOuC,OAAO;GAClBrB;GACAsB,MAAMhC;EACR,CAAC;CACH,SAAS2B,KAAK;EAEZpB,QAAQ0B,KAAK,oCAAoCN,GAAG;CACtD;CAEApB,QAAQC,IAAI,oBAAoBW,KAAKU,IAAIf,SAAS,CAAC;CAEnD,OAAO;EAAElB,SAAS;EAAMsC,QAAQf,KAAKU,IAAIf,SAAS;EAAGJ;CAAS;AAChE;AAEA,IAAA,mBAAgByB,QAA8B;CAC5CA,IAAIC,KAAKrD,OAAcC,MAAM;AAC/B"}