@rpcbase/auth 0.197.0 → 0.199.0

package/dist/oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["OAuthProviderConfig","issuer","clientId","clientSecret","scope","callbackPath","OAuthProvidersConfig","Record","OAuthProvidersStore","providers","STORE_KEY","Symbol","for","getStore","anyGlobal","globalThis","existing","created","normalizeProviders","result","isSafeRedirectPath","candidate","startsWith","providerIdRaw","value","Object","entries","providerId","trim","Error","undefined","configureOAuthProviders","store","normalized","setOAuthProviders","getOAuthProviderConfig","decodeBase64Url","value","padded","replace","slice","length","Buffer","from","toString","decodeJwtPayload","Record","token","T","parts","split","json","parsed","JSON","parse","OidcWellKnown","issuer","authorization_endpoint","token_endpoint","userinfo_endpoint","jwks_uri","cache","Map","Promise","normalizeIssuer","raw","trim","replace","getOidcWellKnown","issuerRaw","Error","existing","get","loader","url","URL","response","fetch","headers","Accept","ok","body","text","catch","status","json","Partial","authorizationEndpoint","tokenEndpoint","issuerValue","userinfoEndpoint","undefined","jwksUri","set","err","delete","crypto","base64UrlEncode","input","Buffer","toString","replace","generatePkcePair","verifier","randomBytes","challenge","createHash","update","digest","RESERVED_KEYS","Set","isSafeOAuthProviderId","value","providerId","trim","length","has","test","crypto","ApiHandler","Ctx","createProvisionedTenant","models","hashPasswordForStorage","completeAuthSignIn","AuthSessionUser","getOAuthProviderConfig","decodeJwtPayload","getOidcWellKnown","generatePkcePair","isSafeOAuthProviderId","OAUTH_REQUEST_TTL_MS","OAUTH_STATE_COOKIE_NAME","OAuthCtx","OAuthRequestRecord","returnTo","codeVerifier","getQueryString","value","Array","isArray","getCookieValue","ctx","name","header","req","headers","cookie","part","split","rawKey","rest","key","trim","rawValue","join","decodeURIComponent","isSafeRedirectPath","candidate","startsWith","getRequestOrigin","protoHeader","hostHeader","protocol","host","get","resolveCallbackPath","callbackPath","trimmed","readTextBody","Pick","Promise","resolve","reject","body","setEncoding","on","chunk","String","length","Error","getFormPostParams","Record","method","contentType","includes","params","URLSearchParams","result","entries","resolveProviderId","providerIdOverride","provider","RESERVED_AUTH_PARAM_KEYS","Set","normalizeAuthorizationParams","undefined","keyRaw","valueRaw","Object","has","val","keys","OAuthStartResult","success","redirectUrl","error","statusCode","getOAuthStartRedirectUrl","providerId","authorizationParams","origin","isHttps","state","randomBytes","toString","verifier","challenge","safeReturnTo","OAuthRequest","getGlobal","now","Date","create","_id","createdAt","expiresAt","getTime","err","console","warn","res","httpOnly","secure","sameSite","path","maxAge","oidc","issuer","redirectUri","url","URL","authorization_endpoint","searchParams","set","clientId","scope","extraAuthorizationParams","OAuthCallbackResult","type","redirectPath","userId","tenantId","signedInTenants","subject","email","OAUTH_SUCCESS_REDIRECT_PATH","AUTH_ERROR_REDIRECT_BASE","processOAuthCallback","createUserOnFirstSignIn","missingUserRedirectPath","successRedirectPath","bodyParams","code","query","oauthUserRaw","user","stateCookieValue","oauthRequest","OAuthRequestModel","Awaited","ReturnType","findOne","lean","tokenBody","clientSecret","tokenResponse","fetch","token_endpoint","Accept","tokenJson","json","catch","ok","JSON","stringify","status","accessToken","access_token","refreshToken","refresh_token","idToken","id_token","tokenType","token_type","expiresIn","expires_in","Number","expiresInSeconds","isFinite","userInfo","userinfo_endpoint","userInfoResponse","Authorization","idTokenPayload","accessTokenPayload","sub","oauthUser","parse","oauthUserRecord","oauthUserEmail","oauthUserNameRecord","oauthUserNameFirst","firstName","oauthUserNameLast","lastName","oauthUserName","filter","Boolean","resolvedEmail","resolvedName","User","Tenant","all","subjectQueryKey","shouldCreateUser","pathname","search","session","providerCreatedAt","oauthProviders","Map","existingProvider","oauthProviderPayload","rawUserInfo","updatedAt","randomUUID","password","tenants","tenantRoles","save","deleteOne","rollbackError","setFields","updateOne","$set","map","tenantRolesMap","fromEntries","currentTenantId","clearCookie","createOAuthStartHandler","getAuthorizationParams","_payload","resolvedProviderId","providerAuthorizationParams","redirect","createOAuthCallbackHandler","base64UrlEncode","input","Buffer","from","replace","createAppleClientSecret","teamId","keyId","privateKeyPem","teamIdValue","clientIdValue","keyIdValue","privateKeyPemValue","nowSeconds","Math","floor","exp","max","min","alg","kid","typ","payload","iss","iat","aud","signingInput","signature","sign","dsaEncoding"],"sources":["../../src/oauth/config.ts","../../src/oauth/jwt.ts","../../src/oauth/oidc.ts","../../src/oauth/pkce.ts","../../src/oauth/providerId.ts","../../src/oauth/lib.ts"],"sourcesContent":["export type OAuthProviderConfig = {\n  issuer: string\n  clientId: string\n  clientSecret?: string\n  scope: string\n  callbackPath: string\n}\n\ntype OAuthProvidersConfig = Record<string, OAuthProviderConfig>\n\ntype OAuthProvidersStore = {\n  providers: OAuthProvidersConfig\n}\n\nconst STORE_KEY = Symbol.for(\"@rpcbase/auth/oauthProviders\")\n\nconst getStore = (): OAuthProvidersStore => {\n  const anyGlobal = globalThis as unknown as Record<string | symbol, unknown>\n  const existing = anyGlobal[STORE_KEY] as OAuthProvidersStore | undefined\n  if (existing && typeof existing === \"object\" && existing.providers && typeof existing.providers === \"object\") {\n    return existing\n  }\n\n  const created: OAuthProvidersStore = { providers: {} }\n  anyGlobal[STORE_KEY] = created\n  return created\n}\n\nconst normalizeProviders = (providers: Record<string, OAuthProviderConfig>): OAuthProvidersConfig => {\n  const result: OAuthProvidersConfig = {}\n\n  const isSafeRedirectPath = (candidate: string) => {\n    if (!candidate.startsWith(\"/\")) return false\n    if (candidate.startsWith(\"//\")) return false\n    return true\n  }\n\n  for (const [providerIdRaw, value] of Object.entries(providers)) {\n    const providerId = providerIdRaw.trim()\n    if (!providerId) continue\n\n    const issuer = typeof value?.issuer === \"string\" ? value.issuer.trim() : \"\"\n    const clientId = typeof value?.clientId === \"string\" ? value.clientId.trim() : \"\"\n    if (!issuer) throw new Error(`oauth provider \"${providerId}\" missing issuer`)\n    if (!clientId) throw new Error(`oauth provider \"${providerId}\" missing clientId`)\n\n    const clientSecret = typeof value?.clientSecret === \"string\" && value.clientSecret.trim()\n      ? value.clientSecret\n      : undefined\n\n    const scope = typeof value?.scope === \"string\" ? value.scope.trim() : \"\"\n    if (!scope) throw new Error(`oauth provider \"${providerId}\" missing scope`)\n\n    const callbackPath = typeof value?.callbackPath === \"string\"\n      ? value.callbackPath.trim()\n      : \"\"\n    if (!callbackPath) throw new Error(`oauth provider \"${providerId}\" missing callbackPath`)\n    if (!isSafeRedirectPath(callbackPath)) throw new Error(`oauth provider \"${providerId}\" has invalid callbackPath`)\n\n    result[providerId] = {\n      issuer,\n      clientId,\n      clientSecret,\n      scope,\n      callbackPath,\n    }\n  }\n\n  return result\n}\n\nexport const configureOAuthProviders = (providers: Record<string, OAuthProviderConfig>) => {\n  const store = getStore()\n  const normalized = normalizeProviders(providers)\n  store.providers = { ...store.providers, ...normalized }\n}\n\nexport const setOAuthProviders = (providers: Record<string, OAuthProviderConfig>) => {\n  const store = getStore()\n  store.providers = normalizeProviders(providers)\n}\n\nexport const getOAuthProviderConfig = (providerId: string): OAuthProviderConfig | null => {\n  const store = getStore()\n  return store.providers[providerId] ?? null\n}\n","const decodeBase64Url = (value: string) => {\n  const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"===\".slice((value.length + 3) % 4)\n  return Buffer.from(padded, \"base64\").toString(\"utf8\")\n}\n\nexport const decodeJwtPayload = <T = Record<string, unknown>>(token: string): T | null => {\n  const parts = token.split(\".\")\n  if (parts.length < 2) return null\n\n  try {\n    const json = decodeBase64Url(parts[1])\n    const parsed = JSON.parse(json) as T\n    if (!parsed || typeof parsed !== \"object\") return null\n    return parsed\n  } catch {\n    return null\n  }\n}\n\n","export type OidcWellKnown = {\n  issuer: string\n  authorization_endpoint: string\n  token_endpoint: string\n  userinfo_endpoint?: string\n  jwks_uri?: string\n}\n\nconst cache = new Map<string, Promise<OidcWellKnown>>()\n\nconst normalizeIssuer = (raw: string) => raw.trim().replace(/\\/+$/, \"\")\n\nexport const getOidcWellKnown = async (issuerRaw: string): Promise<OidcWellKnown> => {\n  const issuer = normalizeIssuer(issuerRaw)\n  if (!issuer) {\n    throw new Error(\"OIDC issuer is required\")\n  }\n\n  const existing = cache.get(issuer)\n  if (existing) {\n    return existing\n  }\n\n  const loader = (async () => {\n    const url = new URL(\"/.well-known/openid-configuration\", issuer)\n    const response = await fetch(url, { headers: { Accept: \"application/json\" } })\n    if (!response.ok) {\n      const body = await response.text().catch(() => \"\")\n      throw new Error(`Failed to fetch OIDC discovery document: ${response.status} ${body}`)\n    }\n\n    const json = await response.json().catch(() => null) as Partial<OidcWellKnown> | null\n    if (!json || typeof json !== \"object\") {\n      throw new Error(\"Invalid OIDC discovery document\")\n    }\n\n    const authorizationEndpoint = typeof json.authorization_endpoint === \"string\"\n      ? json.authorization_endpoint\n      : \"\"\n    const tokenEndpoint = typeof json.token_endpoint === \"string\"\n      ? json.token_endpoint\n      : \"\"\n    const issuerValue = typeof json.issuer === \"string\" ? json.issuer : issuer\n    const userinfoEndpoint = typeof json.userinfo_endpoint === \"string\" ? json.userinfo_endpoint : undefined\n    const jwksUri = typeof json.jwks_uri === \"string\" ? json.jwks_uri : undefined\n\n    if (!authorizationEndpoint || !tokenEndpoint) {\n      throw new Error(\"OIDC discovery document missing required endpoints\")\n    }\n\n    return {\n      issuer: issuerValue,\n      authorization_endpoint: authorizationEndpoint,\n      token_endpoint: tokenEndpoint,\n      userinfo_endpoint: userinfoEndpoint,\n      jwks_uri: jwksUri,\n    } satisfies OidcWellKnown\n  })()\n\n  cache.set(issuer, loader)\n\n  try {\n    return await loader\n  } catch (err) {\n    cache.delete(issuer)\n    throw err\n  }\n}\n\n","import crypto from \"crypto\"\n\n\nexport const base64UrlEncode = (input: Buffer) => input\n  .toString(\"base64\")\n  .replace(/\\+/g, \"-\")\n  .replace(/\\//g, \"_\")\n  .replace(/=+$/g, \"\")\n\nexport const generatePkcePair = () => {\n  const verifier = base64UrlEncode(crypto.randomBytes(32))\n  const challenge = base64UrlEncode(crypto.createHash(\"sha256\").update(verifier).digest())\n\n  return { verifier, challenge }\n}\n\n","const RESERVED_KEYS = new Set([\"__proto__\", \"prototype\", \"constructor\"])\n\nexport const isSafeOAuthProviderId = (value: string) => {\n  const providerId = value.trim()\n  if (!providerId) return false\n  if (providerId.length > 128) return false\n  if (RESERVED_KEYS.has(providerId)) return false\n  return /^[a-zA-Z0-9_-]+$/.test(providerId)\n}\n\n","import crypto from \"crypto\"\n\nimport { ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { createProvisionedTenant, models } from \"@rpcbase/db\"\nimport { hashPasswordForStorage } from \"@rpcbase/server\"\n\nimport { completeAuthSignIn } from \"../session\"\nimport type { AuthSessionUser } from \"../types\"\nimport { getOAuthProviderConfig } from \"./config\"\nimport { decodeJwtPayload } from \"./jwt\"\nimport { getOidcWellKnown } from \"./oidc\"\nimport { generatePkcePair } from \"./pkce\"\nimport { isSafeOAuthProviderId } from \"./providerId\"\n\n\nconst OAUTH_REQUEST_TTL_MS = 10 * 60 * 1000\nconst OAUTH_STATE_COOKIE_NAME = \"rb_oauth_state\"\ntype OAuthCtx = Ctx<AuthSessionUser>\ntype OAuthRequestRecord = {\n  returnTo?: unknown\n  codeVerifier?: unknown\n}\n\nconst getQueryString = (value: unknown) => {\n  if (typeof value === \"string\") return value\n  if (Array.isArray(value) && typeof value[0] === \"string\") return value[0]\n  return null\n}\n\nconst getCookieValue = (ctx: OAuthCtx, name: string): string | null => {\n  const header = ctx.req.headers?.cookie\n  if (typeof header !== \"string\" || !header) return null\n\n  for (const part of header.split(\";\")) {\n    const [rawKey, ...rest] = part.split(\"=\")\n    const key = rawKey?.trim()\n    if (!key || key !== name) continue\n    const rawValue = rest.join(\"=\").trim()\n    if (!rawValue) return \"\"\n    try {\n      return decodeURIComponent(rawValue)\n    } catch {\n      return rawValue\n    }\n  }\n\n  return null\n}\n\nconst isSafeRedirectPath = (candidate: string) => {\n  if (!candidate.startsWith(\"/\")) return false\n  if (candidate.startsWith(\"//\")) return false\n  return true\n}\n\nconst getRequestOrigin = (ctx: OAuthCtx) => {\n  const protoHeader = ctx.req.headers[\"x-forwarded-proto\"]\n  const hostHeader = ctx.req.headers[\"x-forwarded-host\"]\n\n  const protocol = typeof protoHeader === \"string\"\n    ? protoHeader.split(\",\")[0].trim()\n    : ctx.req.protocol\n\n  const host = typeof hostHeader === \"string\"\n    ? hostHeader.split(\",\")[0].trim()\n    : ctx.req.get(\"host\")\n\n  return protocol && host ? `${protocol}://${host}` : \"\"\n}\n\nconst resolveCallbackPath = (callbackPath: string) => {\n  const trimmed = callbackPath.trim()\n  return trimmed && isSafeRedirectPath(trimmed) ? trimmed : null\n}\n\nconst readTextBody = async (req: Pick<OAuthCtx[\"req\"], \"on\" | \"setEncoding\">) =>\n  await new Promise<string>((resolve, reject) => {\n    let body = \"\"\n    if (typeof req.setEncoding === \"function\") {\n      req.setEncoding(\"utf8\")\n    }\n\n    req.on(\"data\", (chunk) => {\n      body += String(chunk)\n      if (body.length > 32_768) {\n        reject(new Error(\"request_body_too_large\"))\n      }\n    })\n    req.on(\"end\", () => resolve(body))\n    req.on(\"error\", reject)\n  })\n\nconst getFormPostParams = async (ctx: OAuthCtx): Promise<Record<string, string> | null> => {\n  if (ctx.req.method !== \"POST\") return null\n\n  const contentType = typeof ctx.req.headers[\"content-type\"] === \"string\" ? ctx.req.headers[\"content-type\"] : \"\"\n  if (!contentType.includes(\"application/x-www-form-urlencoded\")) return null\n\n  const body = await readTextBody(ctx.req)\n  const params = new URLSearchParams(body)\n\n  const result: Record<string, string> = {}\n  for (const [key, value] of params.entries()) {\n    result[key] = value\n  }\n\n  return result\n}\n\nconst resolveProviderId = (ctx: OAuthCtx, providerIdOverride?: string) =>\n  (providerIdOverride ?? String(ctx.req.params?.provider ?? \"\")).trim()\n\nconst RESERVED_AUTH_PARAM_KEYS = new Set([\"__proto__\", \"prototype\", \"constructor\"])\n\nconst normalizeAuthorizationParams = (value: unknown): Record<string, string> | undefined => {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined\n\n  const result: Record<string, string> = {}\n  for (const [keyRaw, valueRaw] of Object.entries(value)) {\n    const key = keyRaw.trim()\n    if (!key) continue\n    if (RESERVED_AUTH_PARAM_KEYS.has(key)) continue\n    const val = typeof valueRaw === \"string\" ? valueRaw.trim() : \"\"\n    if (!val) continue\n    result[key] = val\n  }\n\n  return Object.keys(result).length ? result : undefined\n}\n\nexport type OAuthStartResult =\n  | { success: true; redirectUrl: string }\n  | { success: false; error: string; statusCode: number }\n\nexport const getOAuthStartRedirectUrl = async ({\n  ctx,\n  providerId: providerIdOverride,\n  returnTo,\n  authorizationParams,\n}: {\n  ctx: OAuthCtx\n  providerId?: string\n  returnTo?: string | null\n  authorizationParams?: Record<string, string>\n}): Promise<OAuthStartResult> => {\n  const providerId = resolveProviderId(ctx, providerIdOverride)\n  if (!providerId) {\n    return { success: false, error: \"missing_provider\", statusCode: 400 }\n  }\n\n  if (!isSafeOAuthProviderId(providerId)) {\n    return { success: false, error: \"invalid_provider\", statusCode: 400 }\n  }\n\n  const provider = getOAuthProviderConfig(providerId)\n  if (!provider) {\n    return { success: false, error: \"unknown_provider\", statusCode: 404 }\n  }\n\n  const origin = getRequestOrigin(ctx)\n  if (!origin) {\n    return { success: false, error: \"origin_unavailable\", statusCode: 500 }\n  }\n  const isHttps = origin.startsWith(\"https://\")\n\n  const callbackPath = resolveCallbackPath(provider.callbackPath)\n  if (!callbackPath) {\n    return { success: false, error: \"invalid_callback_path\", statusCode: 500 }\n  }\n\n  const state = crypto.randomBytes(16).toString(\"hex\")\n  const { verifier, challenge } = generatePkcePair()\n\n  const safeReturnTo = typeof returnTo === \"string\" && isSafeRedirectPath(returnTo) ? returnTo : undefined\n\n  try {\n    const OAuthRequest = await models.getGlobal(\"RBOAuthRequest\", ctx)\n    const now = new Date()\n    await OAuthRequest.create({\n      _id: state,\n      providerId,\n      codeVerifier: verifier,\n      returnTo: safeReturnTo,\n      createdAt: now,\n      expiresAt: new Date(now.getTime() + OAUTH_REQUEST_TTL_MS),\n    })\n  } catch (err) {\n    console.warn(\"oauth::failed_to_store_request\", err)\n    return { success: false, error: \"oauth_request_store_failed\", statusCode: 500 }\n  }\n\n  try {\n    ctx.res.cookie(OAUTH_STATE_COOKIE_NAME, `${providerId}:${state}`, {\n      httpOnly: true,\n      secure: isHttps,\n      sameSite: isHttps ? \"none\" : \"lax\",\n      path: callbackPath,\n      maxAge: OAUTH_REQUEST_TTL_MS,\n    })\n  } catch (err) {\n    console.warn(\"oauth::failed_to_set_state_cookie\", err)\n    return { success: false, error: \"oauth_cookie_set_failed\", statusCode: 500 }\n  }\n\n  const oidc = await getOidcWellKnown(provider.issuer)\n  const redirectUri = `${origin}${callbackPath}`\n\n  const url = new URL(oidc.authorization_endpoint)\n  url.searchParams.set(\"client_id\", provider.clientId)\n  url.searchParams.set(\"redirect_uri\", redirectUri)\n  url.searchParams.set(\"response_type\", \"code\")\n  url.searchParams.set(\"scope\", provider.scope)\n  url.searchParams.set(\"state\", state)\n  url.searchParams.set(\"code_challenge\", challenge)\n  url.searchParams.set(\"code_challenge_method\", \"S256\")\n  const extraAuthorizationParams = normalizeAuthorizationParams(authorizationParams)\n  for (const [key, value] of Object.entries(extraAuthorizationParams ?? {})) {\n    if (url.searchParams.has(key)) continue\n    url.searchParams.set(key, value)\n  }\n\n  return { success: true, redirectUrl: url.toString() }\n}\n\nexport type OAuthCallbackResult =\n  | {\n    success: true\n    type: \"signed_in\"\n    redirectPath: string\n    userId: string\n    tenantId: string\n    signedInTenants: string[]\n  }\n  | {\n    success: false\n    type: \"missing_user\"\n    providerId: string\n    subject: string\n    email?: string\n    name?: string\n    redirectPath?: string\n  }\n  | {\n    success: false\n    type: \"error\"\n    error: string\n    redirectPath: string\n  }\n\nconst OAUTH_SUCCESS_REDIRECT_PATH = \"/onboarding\"\nconst AUTH_ERROR_REDIRECT_BASE = \"/auth/sign-in\"\n\nexport const processOAuthCallback = async ({\n  ctx,\n  providerId: providerIdOverride,\n  createUserOnFirstSignIn,\n  missingUserRedirectPath,\n  successRedirectPath,\n}: {\n  ctx: OAuthCtx\n  providerId?: string\n  createUserOnFirstSignIn?: boolean\n  missingUserRedirectPath?: string\n  successRedirectPath?: string\n}): Promise<OAuthCallbackResult> => {\n  const providerId = resolveProviderId(ctx, providerIdOverride)\n  if (!providerId) {\n    return { success: false, type: \"error\", error: \"missing_provider\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=missing_provider` }\n  }\n\n  if (!isSafeOAuthProviderId(providerId)) {\n    return { success: false, type: \"error\", error: \"invalid_provider\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=invalid_provider` }\n  }\n\n  const provider = getOAuthProviderConfig(providerId)\n  if (!provider) {\n    return { success: false, type: \"error\", error: \"unknown_provider\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=unknown_provider` }\n  }\n\n  const origin = getRequestOrigin(ctx)\n  if (!origin) {\n    return { success: false, type: \"error\", error: \"origin_unavailable\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=origin_unavailable` }\n  }\n  const isHttps = origin.startsWith(\"https://\")\n\n  const callbackPath = resolveCallbackPath(provider.callbackPath)\n  if (!callbackPath) {\n    return { success: false, type: \"error\", error: \"invalid_callback_path\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=invalid_callback_path` }\n  }\n\n  const bodyParams = await getFormPostParams(ctx)\n\n  const code = (getQueryString(bodyParams?.code) ?? getQueryString(ctx.req.query?.code))?.trim() ?? \"\"\n  const state = (getQueryString(bodyParams?.state) ?? getQueryString(ctx.req.query?.state))?.trim() ?? \"\"\n  const oauthUserRaw = (getQueryString(bodyParams?.user) ?? getQueryString(ctx.req.query?.user))?.trim() ?? \"\"\n\n  if (!code || !state) {\n    return { success: false, type: \"error\", error: \"missing_code_or_state\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=missing_code_or_state` }\n  }\n\n  const stateCookieValue = getCookieValue(ctx, OAUTH_STATE_COOKIE_NAME)\n  if (stateCookieValue !== `${providerId}:${state}`) {\n    return { success: false, type: \"error\", error: \"invalid_state\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=invalid_state` }\n  }\n\n  let oauthRequest: OAuthRequestRecord | null = null\n  let OAuthRequestModel: Awaited<ReturnType<typeof models.getGlobal>> | null = null\n  try {\n    OAuthRequestModel = await models.getGlobal(\"RBOAuthRequest\", ctx)\n    oauthRequest = await OAuthRequestModel.findOne({ _id: state, providerId }).lean() as OAuthRequestRecord | null\n  } catch (err) {\n    console.warn(\"oauth::failed_to_load_request\", err)\n    return { success: false, type: \"error\", error: \"oauth_request_load_failed\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=oauth_request_load_failed` }\n  }\n\n  if (!oauthRequest) {\n    return { success: false, type: \"error\", error: \"invalid_state\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=invalid_state` }\n  }\n\n  const returnTo = typeof oauthRequest.returnTo === \"string\" ? oauthRequest.returnTo : undefined\n  const codeVerifier = typeof oauthRequest.codeVerifier === \"string\" ? oauthRequest.codeVerifier : \"\"\n  if (!codeVerifier) {\n    return { success: false, type: \"error\", error: \"missing_code_verifier\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=missing_code_verifier` }\n  }\n\n  const oidc = await getOidcWellKnown(provider.issuer)\n  const redirectUri = `${origin}${callbackPath}`\n\n  const tokenBody = new URLSearchParams()\n  tokenBody.set(\"grant_type\", \"authorization_code\")\n  tokenBody.set(\"code\", code)\n  tokenBody.set(\"redirect_uri\", redirectUri)\n  tokenBody.set(\"client_id\", provider.clientId)\n  tokenBody.set(\"code_verifier\", codeVerifier)\n  if (provider.clientSecret) {\n    tokenBody.set(\"client_secret\", provider.clientSecret)\n  }\n\n  const tokenResponse = await fetch(oidc.token_endpoint, {\n    method: \"POST\",\n    headers: {\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n      Accept: \"application/json\",\n    },\n    body: tokenBody.toString(),\n  })\n\n  const tokenJson = await tokenResponse.json().catch(() => null) as Record<string, unknown> | null\n\n  if (!tokenResponse.ok || !tokenJson || typeof tokenJson !== \"object\") {\n    const body = tokenJson ? JSON.stringify(tokenJson) : \"\"\n    console.warn(\"oauth::token_exchange failed\", tokenResponse.status, body)\n    return { success: false, type: \"error\", error: \"token_exchange_failed\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=token_exchange_failed` }\n  }\n\n  const accessToken = typeof tokenJson.access_token === \"string\" ? tokenJson.access_token : \"\"\n  const refreshToken = typeof tokenJson.refresh_token === \"string\" ? tokenJson.refresh_token : undefined\n  const idToken = typeof tokenJson.id_token === \"string\" ? tokenJson.id_token : undefined\n  const scope = typeof tokenJson.scope === \"string\" ? tokenJson.scope : undefined\n  const tokenType = typeof tokenJson.token_type === \"string\" ? tokenJson.token_type : undefined\n  const expiresIn = typeof tokenJson.expires_in === \"number\"\n    ? tokenJson.expires_in\n    : typeof tokenJson.expires_in === \"string\"\n      ? Number(tokenJson.expires_in)\n      : undefined\n  const expiresInSeconds = typeof expiresIn === \"number\" && Number.isFinite(expiresIn) ? expiresIn : null\n  const expiresAt = expiresInSeconds !== null ? new Date(Date.now() + expiresInSeconds * 1000) : undefined\n\n  let userInfo: Record<string, unknown> | null = null\n\n  if (oidc.userinfo_endpoint && accessToken) {\n    const userInfoResponse = await fetch(oidc.userinfo_endpoint, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        Accept: \"application/json\",\n      },\n    })\n\n    if (userInfoResponse.ok) {\n      userInfo = await userInfoResponse.json().catch(() => null) as Record<string, unknown> | null\n    }\n  }\n\n  const idTokenPayload = idToken ? decodeJwtPayload<Record<string, unknown>>(idToken) : null\n  const accessTokenPayload = decodeJwtPayload<Record<string, unknown>>(accessToken)\n\n  const subject = typeof userInfo?.sub === \"string\"\n    ? userInfo.sub\n    : typeof idTokenPayload?.sub === \"string\"\n      ? idTokenPayload.sub\n      : typeof accessTokenPayload?.sub === \"string\"\n        ? accessTokenPayload.sub\n        : \"\"\n\n  if (!subject) {\n    return { success: false, type: \"error\", error: \"missing_subject\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=missing_subject` }\n  }\n\n  const email = typeof userInfo?.email === \"string\"\n    ? userInfo.email\n    : typeof idTokenPayload?.email === \"string\"\n      ? idTokenPayload.email\n      : undefined\n\n  const name = typeof userInfo?.name === \"string\"\n    ? userInfo.name\n    : typeof idTokenPayload?.name === \"string\"\n      ? idTokenPayload.name\n      : undefined\n\n  let oauthUser: unknown = null\n  if (oauthUserRaw) {\n    try {\n      oauthUser = JSON.parse(oauthUserRaw) as unknown\n    } catch {\n      oauthUser = null\n    }\n  }\n  const oauthUserRecord = oauthUser && typeof oauthUser === \"object\"\n    ? (oauthUser as Record<string, unknown>)\n    : null\n  const oauthUserEmail = typeof oauthUserRecord?.email === \"string\" ? oauthUserRecord.email.trim() : \"\"\n  const oauthUserNameRecord = oauthUserRecord?.name && typeof oauthUserRecord.name === \"object\"\n    ? (oauthUserRecord.name as Record<string, unknown>)\n    : null\n  const oauthUserNameFirst = typeof oauthUserNameRecord?.firstName === \"string\" ? oauthUserNameRecord.firstName.trim() : \"\"\n  const oauthUserNameLast = typeof oauthUserNameRecord?.lastName === \"string\" ? oauthUserNameRecord.lastName.trim() : \"\"\n  const oauthUserName = [oauthUserNameFirst, oauthUserNameLast].filter(Boolean).join(\" \").trim()\n\n  const resolvedEmail = email ?? (oauthUserEmail || undefined)\n  const resolvedName = name ?? (oauthUserName || undefined)\n\n  const [User, Tenant] = await Promise.all([\n    models.getGlobal(\"RBUser\", ctx),\n    models.getGlobal(\"RBTenant\", ctx),\n  ])\n\n  const subjectQueryKey = `oauthProviders.${providerId}.subject`\n  let user = await User.findOne({ [subjectQueryKey]: subject })\n\n  if (!user && resolvedEmail) {\n    user = await User.findOne({ email: resolvedEmail })\n  }\n\n  const shouldCreateUser = createUserOnFirstSignIn ?? true\n  if (!user && !shouldCreateUser) {\n    const redirectPath = missingUserRedirectPath\n\n    const result: OAuthCallbackResult = {\n      success: false,\n      type: \"missing_user\",\n      providerId,\n      subject,\n      email: resolvedEmail,\n      name: resolvedName,\n    }\n\n    if (redirectPath && isSafeRedirectPath(redirectPath)) {\n      const url = new URL(redirectPath, origin)\n      url.searchParams.set(\"oauth_provider\", providerId)\n      if (resolvedEmail) url.searchParams.set(\"email\", resolvedEmail)\n      if (resolvedName) url.searchParams.set(\"name\", resolvedName)\n      result.redirectPath = `${url.pathname}${url.search}`\n    }\n\n    return result\n  }\n\n  if (!ctx.req.session) {\n    return { success: false, type: \"error\", error: \"session_unavailable\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=session_unavailable` }\n  }\n\n  const now = new Date()\n\n  let providerCreatedAt: Date | undefined\n  const oauthProviders = user?.get(\"oauthProviders\") as Map<string, { createdAt?: unknown }> | undefined\n  const existingProvider = oauthProviders?.get(providerId)\n  if (existingProvider?.createdAt instanceof Date) {\n    providerCreatedAt = existingProvider.createdAt\n  }\n\n  const oauthProviderPayload = {\n    subject,\n    email: resolvedEmail,\n    name: resolvedName,\n    accessToken,\n    refreshToken,\n    idToken,\n    scope,\n    tokenType,\n    expiresAt,\n    rawUserInfo: userInfo ?? undefined,\n    createdAt: providerCreatedAt ?? now,\n    updatedAt: now,\n  }\n\n  if (!user) {\n    const tenantId = crypto.randomUUID()\n    const password = await hashPasswordForStorage(crypto.randomBytes(32).toString(\"hex\"))\n\n    user = new User({\n      email: resolvedEmail,\n      name: resolvedName,\n      password,\n      tenants: [tenantId],\n      tenantRoles: {\n        [tenantId]: [\"owner\"],\n      },\n      oauthProviders: {\n        [providerId]: oauthProviderPayload,\n      },\n    })\n\n    await user.save()\n\n    try {\n      await createProvisionedTenant(Tenant, {\n        tenantId,\n        name: resolvedEmail || subject,\n      })\n    } catch (err) {\n      console.error(\"oauth::failed_to_initialize_tenant\", err)\n      try {\n        await User.deleteOne({ _id: user._id })\n      } catch (rollbackError) {\n        console.error(\"oauth::failed_to_rollback_user\", rollbackError)\n      }\n      return {\n        success: false,\n        type: \"error\",\n        error: \"tenant_initialization_failed\",\n        redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=tenant_initialization_failed`,\n      }\n    }\n  } else {\n    const setFields: Record<string, unknown> = {\n      [`oauthProviders.${providerId}`]: oauthProviderPayload,\n    }\n\n    if (!user.email && resolvedEmail) {\n      setFields.email = resolvedEmail\n    }\n\n    if (!user.name && resolvedName) {\n      setFields.name = resolvedName\n    }\n\n    await User.updateOne({ _id: user._id }, { $set: setFields })\n  }\n\n  const signedInTenants = (user.tenants || []).map(String)\n  const tenantId = signedInTenants[0]\n  if (!tenantId) {\n    return {\n      success: false,\n      type: \"error\",\n      error: \"tenant_unavailable\",\n      redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=tenant_unavailable`,\n    }\n  }\n  const tenantRolesMap = user.get(\"tenantRoles\") as Map<string, string[]> | undefined\n  const tenantRoles = tenantRolesMap ? Object.fromEntries(tenantRolesMap.entries()) : undefined\n\n  if (!completeAuthSignIn(ctx, {\n    userId: user._id.toString(),\n    currentTenantId: tenantId,\n    signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],\n    tenantRoles,\n  })) {\n    return {\n      success: false,\n      type: \"error\",\n      error: \"session_unavailable\",\n      redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=session_unavailable`,\n    }\n  }\n\n  try {\n    if (OAuthRequestModel) {\n      await OAuthRequestModel.deleteOne({ _id: state, providerId })\n    }\n  } catch (err) {\n    console.warn(\"oauth::failed_to_delete_request\", err)\n  }\n\n  try {\n    ctx.res.clearCookie(OAUTH_STATE_COOKIE_NAME, {\n      httpOnly: true,\n      secure: isHttps,\n      sameSite: isHttps ? \"none\" : \"lax\",\n      path: callbackPath,\n    })\n  } catch (err) {\n    console.warn(\"oauth::failed_to_clear_state_cookie\", err)\n  }\n\n  const redirectPath = returnTo && isSafeRedirectPath(returnTo)\n    ? returnTo\n    : successRedirectPath && isSafeRedirectPath(successRedirectPath)\n      ? successRedirectPath\n      : OAUTH_SUCCESS_REDIRECT_PATH\n\n  return {\n    success: true,\n    type: \"signed_in\",\n    redirectPath,\n    userId: user._id.toString(),\n    tenantId,\n    signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],\n  }\n}\n\nexport const createOAuthStartHandler = ({\n  providerId,\n  getAuthorizationParams,\n}: {\n  providerId?: string\n  getAuthorizationParams?: (providerId: string) => Record<string, string> | undefined\n} = {}): ApiHandler<unknown, { success: boolean; error?: string }, AuthSessionUser> => async (\n  _payload,\n  ctx,\n) => {\n  const resolvedProviderId = resolveProviderId(ctx, providerId)\n  const providerAuthorizationParams = resolvedProviderId && getAuthorizationParams\n    ? getAuthorizationParams(resolvedProviderId)\n    : undefined\n  const returnTo = getQueryString(ctx.req.query?.returnTo)?.trim()\n  const result = await getOAuthStartRedirectUrl({\n    ctx,\n    providerId: resolvedProviderId,\n    returnTo,\n    authorizationParams: providerAuthorizationParams,\n  })\n\n  if (!result.success) {\n    ctx.res.status(result.statusCode)\n    return { success: false, error: result.error }\n  }\n\n  ctx.res.redirect(result.redirectUrl)\n  return { success: true }\n}\n\nexport const createOAuthCallbackHandler = ({\n  providerId,\n  createUserOnFirstSignIn,\n  missingUserRedirectPath,\n  successRedirectPath,\n}: {\n  providerId?: string\n  createUserOnFirstSignIn?: boolean\n  missingUserRedirectPath?: string\n  successRedirectPath?: string\n} = {}): ApiHandler<unknown, { success: boolean; error?: string }, AuthSessionUser> => async (\n  _payload,\n  ctx,\n) => {\n  const result = await processOAuthCallback({\n    ctx,\n    providerId,\n    createUserOnFirstSignIn,\n    missingUserRedirectPath,\n    successRedirectPath,\n  })\n\n  if (result.type === \"error\") {\n    ctx.res.redirect(result.redirectPath)\n    return { success: false, error: result.error }\n  }\n\n  if (result.type === \"missing_user\") {\n    if (result.redirectPath) {\n      ctx.res.redirect(result.redirectPath)\n    } else {\n      ctx.res.redirect(\"/auth/sign-up\")\n    }\n    return { success: false, error: \"user_not_found\" }\n  }\n\n  ctx.res.redirect(result.redirectPath)\n  return { success: true }\n}\n\nconst base64UrlEncode = (input: Buffer | string) =>\n  Buffer.from(input)\n    .toString(\"base64\")\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/g, \"\")\n\nexport const createAppleClientSecret = ({\n  teamId,\n  clientId,\n  keyId,\n  privateKeyPem,\n  now = new Date(),\n  expiresInSeconds = 10 * 60,\n}: {\n  teamId: string\n  clientId: string\n  keyId: string\n  privateKeyPem: string\n  now?: Date\n  expiresInSeconds?: number\n}) => {\n  const teamIdValue = teamId.trim()\n  const clientIdValue = clientId.trim()\n  const keyIdValue = keyId.trim()\n  const privateKeyPemValue = privateKeyPem.trim()\n\n  if (!teamIdValue) throw new Error(\"teamId is required\")\n  if (!clientIdValue) throw new Error(\"clientId is required\")\n  if (!keyIdValue) throw new Error(\"keyId is required\")\n  if (!privateKeyPemValue) throw new Error(\"privateKeyPem is required\")\n\n  const nowSeconds = Math.floor(now.getTime() / 1000)\n  const expiresIn = Number.isFinite(expiresInSeconds) ? expiresInSeconds : 10 * 60\n  const exp = nowSeconds + Math.max(60, Math.min(expiresIn, 60 * 60 * 24 * 180))\n\n  const header = { alg: \"ES256\", kid: keyIdValue, typ: \"JWT\" }\n  const payload = {\n    iss: teamIdValue,\n    iat: nowSeconds,\n    exp,\n    aud: \"https://appleid.apple.com\",\n    sub: clientIdValue,\n  }\n\n  const signingInput = `${base64UrlEncode(JSON.stringify(header))}.${base64UrlEncode(JSON.stringify(payload))}`\n  const signature = crypto.sign(\"sha256\", Buffer.from(signingInput), {\n    key: privateKeyPemValue,\n    dsaEncoding: \"ieee-p1363\",\n  })\n\n  return `${signingInput}.${base64UrlEncode(signature)}`\n}\n"],"mappings":";;;;;AAcA,IAAMU,YAAYC,OAAOC,IAAI,8BAA8B;AAE3D,IAAMC,iBAAsC;CAC1C,MAAMC,YAAYC;CAClB,MAAMC,WAAWF,UAAUJ;CAC3B,IAAIM,YAAY,OAAOA,aAAa,YAAYA,SAASP,aAAa,OAAOO,SAASP,cAAc,UAClG,OAAOO;CAGT,MAAMC,UAA+B,EAAER,WAAW,CAAC,EAAE;CACrDK,UAAUJ,aAAaO;CACvB,OAAOA;AACT;AAEA,IAAMC,sBAAsBT,cAAyE;CACnG,MAAMU,SAA+B,CAAC;CAEtC,MAAMC,sBAAsBC,cAAsB;EAChD,IAAI,CAACA,UAAUC,WAAW,GAAG,GAAG,OAAO;EACvC,IAAID,UAAUC,WAAW,IAAI,GAAG,OAAO;EACvC,OAAO;CACT;CAEA,KAAK,MAAM,CAACC,eAAeC,UAAUC,OAAOC,QAAQjB,SAAS,GAAG;EAC9D,MAAMkB,aAAaJ,cAAcK,KAAK;EACtC,IAAI,CAACD,YAAY;EAEjB,MAAM1B,SAAS,OAAOuB,OAAOvB,WAAW,WAAWuB,MAAMvB,OAAO2B,KAAK,IAAI;EACzE,MAAM1B,WAAW,OAAOsB,OAAOtB,aAAa,WAAWsB,MAAMtB,SAAS0B,KAAK,IAAI;EAC/E,IAAI,CAAC3B,QAAQ,MAAM,IAAI4B,MAAM,mBAAmBF,WAAU,iBAAkB;EAC5E,IAAI,CAACzB,UAAU,MAAM,IAAI2B,MAAM,mBAAmBF,WAAU,mBAAoB;EAEhF,MAAMxB,eAAe,OAAOqB,OAAOrB,iBAAiB,YAAYqB,MAAMrB,aAAayB,KAAK,IACpFJ,MAAMrB,eACN2B,KAAAA;EAEJ,MAAM1B,QAAQ,OAAOoB,OAAOpB,UAAU,WAAWoB,MAAMpB,MAAMwB,KAAK,IAAI;EACtE,IAAI,CAACxB,OAAO,MAAM,IAAIyB,MAAM,mBAAmBF,WAAU,gBAAiB;EAE1E,MAAMtB,eAAe,OAAOmB,OAAOnB,iBAAiB,WAChDmB,MAAMnB,aAAauB,KAAK,IACxB;EACJ,IAAI,CAACvB,cAAc,MAAM,IAAIwB,MAAM,mBAAmBF,WAAU,uBAAwB;EACxF,IAAI,CAACP,mBAAmBf,YAAY,GAAG,MAAM,IAAIwB,MAAM,mBAAmBF,WAAU,2BAA4B;EAEhHR,OAAOQ,cAAc;GACnB1B;GACAC;GACAC;GACAC;GACAC;EACF;CACF;CAEA,OAAOc;AACT;AAEA,IAAaY,2BAA2BtB,cAAmD;CACzF,MAAMuB,QAAQnB,SAAS;CACvB,MAAMoB,aAAaf,mBAAmBT,SAAS;CAC/CuB,MAAMvB,YAAY;EAAE,GAAGuB,MAAMvB;EAAW,GAAGwB;CAAW;AACxD;AAEA,IAAaC,qBAAqBzB,cAAmD;CACnF,MAAMuB,QAAQnB,SAAS;CACvBmB,MAAMvB,YAAYS,mBAAmBT,SAAS;AAChD;AAEA,IAAa0B,0BAA0BR,eAAmD;CAExF,OADcd,SACPmB,CAAAA,CAAMvB,UAAUkB,eAAe;AACxC;;;ACrFA,IAAMS,mBAAmBC,UAAkB;CACzC,MAAMC,SAASD,MAAME,QAAQ,MAAM,GAAG,CAAC,CAACA,QAAQ,MAAM,GAAG,IAAI,MAAMC,OAAOH,MAAMI,SAAS,KAAK,CAAC;CAC/F,OAAOC,OAAOC,KAAKL,QAAQ,QAAQ,CAAC,CAACM,SAAS,MAAM;AACtD;AAEA,IAAaC,oBAAiDE,UAA4B;CACxF,MAAME,QAAQF,MAAMG,MAAM,GAAG;CAC7B,IAAID,MAAMR,SAAS,GAAG,OAAO;CAE7B,IAAI;EACF,MAAMU,OAAOf,gBAAgBa,MAAM,EAAE;EACrC,MAAMG,SAASC,KAAKC,MAAMH,IAAI;EAC9B,IAAI,CAACC,UAAU,OAAOA,WAAW,UAAU,OAAO;EAClD,OAAOA;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;ACTA,IAAMS,wBAAQ,IAAIC,IAAoC;AAEtD,IAAME,mBAAmBC,QAAgBA,IAAIC,KAAK,CAAC,CAACC,QAAQ,QAAQ,EAAE;AAEtE,IAAaC,mBAAmB,OAAOC,cAA8C;CACnF,MAAMb,SAASQ,gBAAgBK,SAAS;CACxC,IAAI,CAACb,QACH,MAAM,IAAIc,MAAM,yBAAyB;CAG3C,MAAMC,WAAWV,MAAMW,IAAIhB,MAAM;CACjC,IAAIe,UACF,OAAOA;CAGT,MAAME,UAAU,YAAY;EAC1B,MAAMC,MAAM,IAAIC,IAAI,qCAAqCnB,MAAM;EAC/D,MAAMoB,WAAW,MAAMC,MAAMH,KAAK,EAAEI,SAAS,EAAEC,QAAQ,mBAAmB,EAAE,CAAC;EAC7E,IAAI,CAACH,SAASI,IAAI;GAChB,MAAMC,OAAO,MAAML,SAASM,KAAK,CAAC,CAACC,YAAY,EAAE;GACjD,MAAM,IAAIb,MAAM,4CAA4CM,SAASQ,OAAM,GAAIH,MAAM;EACvF;EAEA,MAAMI,OAAO,MAAMT,SAASS,KAAK,CAAC,CAACF,YAAY,IAAI;EACnD,IAAI,CAACE,QAAQ,OAAOA,SAAS,UAC3B,MAAM,IAAIf,MAAM,iCAAiC;EAGnD,MAAMiB,wBAAwB,OAAOF,KAAK5B,2BAA2B,WACjE4B,KAAK5B,yBACL;EACJ,MAAM+B,gBAAgB,OAAOH,KAAK3B,mBAAmB,WACjD2B,KAAK3B,iBACL;EACJ,MAAM+B,cAAc,OAAOJ,KAAK7B,WAAW,WAAW6B,KAAK7B,SAASA;EACpE,MAAMkC,mBAAmB,OAAOL,KAAK1B,sBAAsB,WAAW0B,KAAK1B,oBAAoBgC,KAAAA;EAC/F,MAAMC,UAAU,OAAOP,KAAKzB,aAAa,WAAWyB,KAAKzB,WAAW+B,KAAAA;EAEpE,IAAI,CAACJ,yBAAyB,CAACC,eAC7B,MAAM,IAAIlB,MAAM,oDAAoD;EAGtE,OAAO;GACLd,QAAQiC;GACRhC,wBAAwB8B;GACxB7B,gBAAgB8B;GAChB7B,mBAAmB+B;GACnB9B,UAAUgC;EACZ;CACF,EAAA,CAAG;CAEH/B,MAAMgC,IAAIrC,QAAQiB,MAAM;CAExB,IAAI;EACF,OAAO,MAAMA;CACf,SAASqB,KAAK;EACZjC,MAAMkC,OAAOvC,MAAM;EACnB,MAAMsC;CACR;AACF;;;AChEA,IAAaG,qBAAmBC,UAAkBA,MAC/CE,SAAS,QAAQ,CAAC,CAClBC,QAAQ,OAAO,GAAG,CAAC,CACnBA,QAAQ,OAAO,GAAG,CAAC,CACnBA,QAAQ,QAAQ,EAAE;AAErB,IAAaC,yBAAyB;CACpC,MAAMC,WAAWN,kBAAgBD,OAAOQ,YAAY,EAAE,CAAC;CAGvD,OAAO;EAAED;EAAUE,WAFDR,kBAAgBD,OAAOU,WAAW,QAAQ,CAAC,CAACC,OAAOJ,QAAQ,CAAC,CAACK,OAAO,CAEnEH;CAAU;AAC/B;;;ACdA,IAAMI,gCAAgB,IAAIC,IAAI;CAAC;CAAa;CAAa;AAAa,CAAC;AAEvE,IAAaC,yBAAyBC,UAAkB;CACtD,MAAMC,aAAaD,MAAME,KAAK;CAC9B,IAAI,CAACD,YAAY,OAAO;CACxB,IAAIA,WAAWE,SAAS,KAAK,OAAO;CACpC,IAAIN,cAAcO,IAAIH,UAAU,GAAG,OAAO;CAC1C,OAAO,mBAAmBI,KAAKJ,UAAU;AAC3C;;;ACOA,IAAMkB,uBAAuB,MAAU;AACvC,IAAMC,0BAA0B;AAOhC,IAAMK,kBAAkBC,UAAmB;CACzC,IAAI,OAAOA,UAAU,UAAU,OAAOA;CACtC,IAAIC,MAAMC,QAAQF,KAAK,KAAK,OAAOA,MAAM,OAAO,UAAU,OAAOA,MAAM;CACvE,OAAO;AACT;AAEA,IAAMG,kBAAkBC,KAAeC,SAAgC;CACrE,MAAMC,SAASF,IAAIG,IAAIC,SAASC;CAChC,IAAI,OAAOH,WAAW,YAAY,CAACA,QAAQ,OAAO;CAElD,KAAK,MAAMI,QAAQJ,OAAOK,MAAM,GAAG,GAAG;EACpC,MAAM,CAACC,QAAQ,GAAGC,QAAQH,KAAKC,MAAM,GAAG;EACxC,MAAMG,MAAMF,QAAQG,KAAK;EACzB,IAAI,CAACD,OAAOA,QAAQT,MAAM;EAC1B,MAAMW,WAAWH,KAAKI,KAAK,GAAG,CAAC,CAACF,KAAK;EACrC,IAAI,CAACC,UAAU,OAAO;EACtB,IAAI;GACF,OAAOE,mBAAmBF,QAAQ;EACpC,QAAQ;GACN,OAAOA;EACT;CACF;CAEA,OAAO;AACT;AAEA,IAAMG,sBAAsBC,cAAsB;CAChD,IAAI,CAACA,UAAUC,WAAW,GAAG,GAAG,OAAO;CACvC,IAAID,UAAUC,WAAW,IAAI,GAAG,OAAO;CACvC,OAAO;AACT;AAEA,IAAMC,oBAAoBlB,QAAkB;CAC1C,MAAMmB,cAAcnB,IAAIG,IAAIC,QAAQ;CACpC,MAAMgB,aAAapB,IAAIG,IAAIC,QAAQ;CAEnC,MAAMiB,WAAW,OAAOF,gBAAgB,WACpCA,YAAYZ,MAAM,GAAG,CAAC,CAAC,EAAE,CAACI,KAAK,IAC/BX,IAAIG,IAAIkB;CAEZ,MAAMC,OAAO,OAAOF,eAAe,WAC/BA,WAAWb,MAAM,GAAG,CAAC,CAAC,EAAE,CAACI,KAAK,IAC9BX,IAAIG,IAAIoB,IAAI,MAAM;CAEtB,OAAOF,YAAYC,OAAO,GAAGD,SAAQ,KAAMC,SAAS;AACtD;AAEA,IAAME,uBAAuBC,iBAAyB;CACpD,MAAMC,UAAUD,aAAad,KAAK;CAClC,OAAOe,WAAWX,mBAAmBW,OAAO,IAAIA,UAAU;AAC5D;AAEA,IAAMC,eAAe,OAAOxB,QAC1B,MAAM,IAAI0B,SAAiBC,SAASC,WAAW;CAC7C,IAAIC,OAAO;CACX,IAAI,OAAO7B,IAAI8B,gBAAgB,YAC7B9B,IAAI8B,YAAY,MAAM;CAGxB9B,IAAI+B,GAAG,SAASC,UAAU;EACxBH,QAAQI,OAAOD,KAAK;EACpB,IAAIH,KAAKK,SAAS,OAChBN,uBAAO,IAAIO,MAAM,wBAAwB,CAAC;CAE9C,CAAC;CACDnC,IAAI+B,GAAG,aAAaJ,QAAQE,IAAI,CAAC;CACjC7B,IAAI+B,GAAG,SAASH,MAAM;AACxB,CAAC;AAEH,IAAMQ,oBAAoB,OAAOvC,QAA0D;CACzF,IAAIA,IAAIG,IAAIsC,WAAW,QAAQ,OAAO;CAGtC,IAAI,EADgB,OAAOzC,IAAIG,IAAIC,QAAQ,oBAAoB,WAAWJ,IAAIG,IAAIC,QAAQ,kBAAkB,GAAA,CAC3FuC,SAAS,mCAAmC,GAAG,OAAO;CAEvE,MAAMX,OAAO,MAAML,aAAa3B,IAAIG,GAAG;CACvC,MAAMyC,SAAS,IAAIC,gBAAgBb,IAAI;CAEvC,MAAMc,SAAiC,CAAC;CACxC,KAAK,MAAM,CAACpC,KAAKd,UAAUgD,OAAOG,QAAQ,GACxCD,OAAOpC,OAAOd;CAGhB,OAAOkD;AACT;AAEA,IAAME,qBAAqBhD,KAAeiD,wBACvCA,sBAAsBb,OAAOpC,IAAIG,IAAIyC,QAAQM,YAAY,EAAE,EAAA,CAAGvC,KAAK;AAEtE,IAAMwC,2CAA2B,IAAIC,IAAI;CAAC;CAAa;CAAa;AAAa,CAAC;AAElF,IAAMC,gCAAgCzD,UAAuD;CAC3F,IAAI,CAACA,SAAS,OAAOA,UAAU,YAAYC,MAAMC,QAAQF,KAAK,GAAG,OAAO0D,KAAAA;CAExE,MAAMR,SAAiC,CAAC;CACxC,KAAK,MAAM,CAACS,QAAQC,aAAaC,OAAOV,QAAQnD,KAAK,GAAG;EACtD,MAAMc,MAAM6C,OAAO5C,KAAK;EACxB,IAAI,CAACD,KAAK;EACV,IAAIyC,yBAAyBO,IAAIhD,GAAG,GAAG;EACvC,MAAMiD,MAAM,OAAOH,aAAa,WAAWA,SAAS7C,KAAK,IAAI;EAC7D,IAAI,CAACgD,KAAK;EACVb,OAAOpC,OAAOiD;CAChB;CAEA,OAAOF,OAAOG,KAAKd,MAAM,CAAC,CAACT,SAASS,SAASQ,KAAAA;AAC/C;AAMA,IAAaY,2BAA2B,OAAO,EAC7ClE,KACAmE,YAAYlB,oBACZxD,UACA2E,0BAM+B;CAC/B,MAAMD,aAAanB,kBAAkBhD,KAAKiD,kBAAkB;CAC5D,IAAI,CAACkB,YACH,OAAO;EAAEL,SAAS;EAAOE,OAAO;EAAoBC,YAAY;CAAI;CAGtE,IAAI,CAAC7E,sBAAsB+E,UAAU,GACnC,OAAO;EAAEL,SAAS;EAAOE,OAAO;EAAoBC,YAAY;CAAI;CAGtE,MAAMf,WAAWlE,uBAAuBmF,UAAU;CAClD,IAAI,CAACjB,UACH,OAAO;EAAEY,SAAS;EAAOE,OAAO;EAAoBC,YAAY;CAAI;CAGtE,MAAMI,SAASnD,iBAAiBlB,GAAG;CACnC,IAAI,CAACqE,QACH,OAAO;EAAEP,SAAS;EAAOE,OAAO;EAAsBC,YAAY;CAAI;CAExE,MAAMK,UAAUD,OAAOpD,WAAW,UAAU;CAE5C,MAAMQ,eAAeD,oBAAoB0B,SAASzB,YAAY;CAC9D,IAAI,CAACA,cACH,OAAO;EAAEqC,SAAS;EAAOE,OAAO;EAAyBC,YAAY;CAAI;CAG3E,MAAMM,QAAQ/F,OAAOgG,YAAY,EAAE,CAAC,CAACC,SAAS,KAAK;CACnD,MAAM,EAAEC,UAAUC,cAAcxF,iBAAiB;CAEjD,MAAMyF,eAAe,OAAOnF,aAAa,YAAYsB,mBAAmBtB,QAAQ,IAAIA,WAAW6D,KAAAA;CAE/F,IAAI;EACF,MAAMuB,eAAe,MAAMjG,OAAOkG,UAAU,kBAAkB9E,GAAG;EACjE,MAAM+E,sBAAM,IAAIC,KAAK;EACrB,MAAMH,aAAaI,OAAO;GACxBC,KAAKX;GACLJ;GACAzE,cAAcgF;GACdjF,UAAUmF;GACVO,WAAWJ;GACXK,WAAW,IAAIJ,KAAKD,IAAIM,QAAQ,IAAIhG,oBAAoB;EAC1D,CAAC;CACH,SAASiG,KAAK;EACZC,QAAQC,KAAK,kCAAkCF,GAAG;EAClD,OAAO;GAAExB,SAAS;GAAOE,OAAO;GAA8BC,YAAY;EAAI;CAChF;CAEA,IAAI;EACFjE,IAAIyF,IAAIpF,OAAOf,yBAAyB,GAAG6E,WAAU,GAAII,SAAS;GAChEmB,UAAU;GACVC,QAAQrB;GACRsB,UAAUtB,UAAU,SAAS;GAC7BuB,MAAMpE;GACNqE,QAAQzG;EACV,CAAC;CACH,SAASiG,KAAK;EACZC,QAAQC,KAAK,qCAAqCF,GAAG;EACrD,OAAO;GAAExB,SAAS;GAAOE,OAAO;GAA2BC,YAAY;EAAI;CAC7E;CAEA,MAAM8B,OAAO,MAAM7G,iBAAiBgE,SAAS8C,MAAM;CACnD,MAAMC,cAAc,GAAG5B,SAAS5C;CAEhC,MAAMyE,MAAM,IAAIC,IAAIJ,KAAKK,sBAAsB;CAC/CF,IAAIG,aAAaC,IAAI,aAAapD,SAASqD,QAAQ;CACnDL,IAAIG,aAAaC,IAAI,gBAAgBL,WAAW;CAChDC,IAAIG,aAAaC,IAAI,iBAAiB,MAAM;CAC5CJ,IAAIG,aAAaC,IAAI,SAASpD,SAASsD,KAAK;CAC5CN,IAAIG,aAAaC,IAAI,SAAS/B,KAAK;CACnC2B,IAAIG,aAAaC,IAAI,kBAAkB3B,SAAS;CAChDuB,IAAIG,aAAaC,IAAI,yBAAyB,MAAM;CACpD,MAAMG,2BAA2BpD,6BAA6Be,mBAAmB;CACjF,KAAK,MAAM,CAAC1D,KAAKd,UAAU6D,OAAOV,QAAQ0D,4BAA4B,CAAC,CAAC,GAAG;EACzE,IAAIP,IAAIG,aAAa3C,IAAIhD,GAAG,GAAG;EAC/BwF,IAAIG,aAAaC,IAAI5F,KAAKd,KAAK;CACjC;CAEA,OAAO;EAAEkE,SAAS;EAAMC,aAAamC,IAAIzB,SAAS;CAAE;AACtD;AA2BA,IAAMyC,8BAA8B;AACpC,IAAMC,2BAA2B;AAEjC,IAAaC,uBAAuB,OAAO,EACzCpH,KACAmE,YAAYlB,oBACZoE,yBACAC,yBACAC,0BAOkC;CAClC,MAAMpD,aAAanB,kBAAkBhD,KAAKiD,kBAAkB;CAC5D,IAAI,CAACkB,YACH,OAAO;EAAEL,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAoB4C,cAAc,GAAGO,yBAAwB;CAA0B;CAGxI,IAAI,CAAC/H,sBAAsB+E,UAAU,GACnC,OAAO;EAAEL,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAoB4C,cAAc,GAAGO,yBAAwB;CAA0B;CAGxI,MAAMjE,WAAWlE,uBAAuBmF,UAAU;CAClD,IAAI,CAACjB,UACH,OAAO;EAAEY,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAoB4C,cAAc,GAAGO,yBAAwB;CAA0B;CAGxI,MAAM9C,SAASnD,iBAAiBlB,GAAG;CACnC,IAAI,CAACqE,QACH,OAAO;EAAEP,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAsB4C,cAAc,GAAGO,yBAAwB;CAA4B;CAE5I,MAAM7C,UAAUD,OAAOpD,WAAW,UAAU;CAE5C,MAAMQ,eAAeD,oBAAoB0B,SAASzB,YAAY;CAC9D,IAAI,CAACA,cACH,OAAO;EAAEqC,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAyB4C,cAAc,GAAGO,yBAAwB;CAA+B;CAGlJ,MAAMK,aAAa,MAAMjF,kBAAkBvC,GAAG;CAE9C,MAAMyH,QAAQ9H,eAAe6H,YAAYC,IAAI,KAAK9H,eAAeK,IAAIG,IAAIuH,OAAOD,IAAI,EAAA,EAAI9G,KAAK,KAAK;CAClG,MAAM4D,SAAS5E,eAAe6H,YAAYjD,KAAK,KAAK5E,eAAeK,IAAIG,IAAIuH,OAAOnD,KAAK,EAAA,EAAI5D,KAAK,KAAK;CACrG,MAAMgH,gBAAgBhI,eAAe6H,YAAYI,IAAI,KAAKjI,eAAeK,IAAIG,IAAIuH,OAAOE,IAAI,EAAA,EAAIjH,KAAK,KAAK;CAE1G,IAAI,CAAC8G,QAAQ,CAAClD,OACZ,OAAO;EAAET,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAyB4C,cAAc,GAAGO,yBAAwB;CAA+B;CAIlJ,IADyBpH,eAAeC,KAAKV,uBACzCuI,MAAqB,GAAG1D,WAAU,GAAII,SACxC,OAAO;EAAET,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAiB4C,cAAc,GAAGO,yBAAwB;CAAuB;CAGlI,IAAIW,eAA0C;CAC9C,IAAIC,oBAAyE;CAC7E,IAAI;EACFA,oBAAoB,MAAMnJ,OAAOkG,UAAU,kBAAkB9E,GAAG;EAChE8H,eAAe,MAAMC,kBAAkBG,QAAQ;GAAEhD,KAAKX;GAAOJ;EAAW,CAAC,CAAC,CAACgE,KAAK;CAClF,SAAS7C,KAAK;EACZC,QAAQC,KAAK,iCAAiCF,GAAG;EACjD,OAAO;GAAExB,SAAS;GAAO6C,MAAM;GAAS3C,OAAO;GAA6B4C,cAAc,GAAGO,yBAAwB;EAAmC;CAC1J;CAEA,IAAI,CAACW,cACH,OAAO;EAAEhE,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAiB4C,cAAc,GAAGO,yBAAwB;CAAuB;CAGlI,MAAM1H,WAAW,OAAOqI,aAAarI,aAAa,WAAWqI,aAAarI,WAAW6D,KAAAA;CACrF,MAAM5D,eAAe,OAAOoI,aAAapI,iBAAiB,WAAWoI,aAAapI,eAAe;CACjG,IAAI,CAACA,cACH,OAAO;EAAEoE,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAyB4C,cAAc,GAAGO,yBAAwB;CAA+B;CAGlJ,MAAMpB,OAAO,MAAM7G,iBAAiBgE,SAAS8C,MAAM;CACnD,MAAMC,cAAc,GAAG5B,SAAS5C;CAEhC,MAAM2G,YAAY,IAAIvF,gBAAgB;CACtCuF,UAAU9B,IAAI,cAAc,oBAAoB;CAChD8B,UAAU9B,IAAI,QAAQmB,IAAI;CAC1BW,UAAU9B,IAAI,gBAAgBL,WAAW;CACzCmC,UAAU9B,IAAI,aAAapD,SAASqD,QAAQ;CAC5C6B,UAAU9B,IAAI,iBAAiB5G,YAAY;CAC3C,IAAIwD,SAASmF,cACXD,UAAU9B,IAAI,iBAAiBpD,SAASmF,YAAY;CAGtD,MAAMC,gBAAgB,MAAMC,MAAMxC,KAAKyC,gBAAgB;EACrD/F,QAAQ;EACRrC,SAAS;GACP,gBAAgB;GAChBqI,QAAQ;EACV;EACAzG,MAAMoG,UAAU3D,SAAS;CAC3B,CAAC;CAED,MAAMiE,YAAY,MAAMJ,cAAcK,KAAK,CAAC,CAACC,YAAY,IAAI;CAE7D,IAAI,CAACN,cAAcO,MAAM,CAACH,aAAa,OAAOA,cAAc,UAAU;EACpE,MAAM1G,OAAO0G,YAAYI,KAAKC,UAAUL,SAAS,IAAI;EACrDnD,QAAQC,KAAK,gCAAgC8C,cAAcU,QAAQhH,IAAI;EACvE,OAAO;GAAE8B,SAAS;GAAO6C,MAAM;GAAS3C,OAAO;GAAyB4C,cAAc,GAAGO,yBAAwB;EAA+B;CAClJ;CAEA,MAAM8B,cAAc,OAAOP,UAAUQ,iBAAiB,WAAWR,UAAUQ,eAAe;CAC1F,MAAMC,eAAe,OAAOT,UAAUU,kBAAkB,WAAWV,UAAUU,gBAAgB9F,KAAAA;CAC7F,MAAM+F,UAAU,OAAOX,UAAUY,aAAa,WAAWZ,UAAUY,WAAWhG,KAAAA;CAC9E,MAAMkD,QAAQ,OAAOkC,UAAUlC,UAAU,WAAWkC,UAAUlC,QAAQlD,KAAAA;CACtE,MAAMiG,YAAY,OAAOb,UAAUc,eAAe,WAAWd,UAAUc,aAAalG,KAAAA;CACpF,MAAMmG,YAAY,OAAOf,UAAUgB,eAAe,WAC9ChB,UAAUgB,aACV,OAAOhB,UAAUgB,eAAe,WAC9BC,OAAOjB,UAAUgB,UAAU,IAC3BpG,KAAAA;CACN,MAAMsG,mBAAmB,OAAOH,cAAc,YAAYE,OAAOE,SAASJ,SAAS,IAAIA,YAAY;CACnG,MAAMrE,YAAYwE,qBAAqB,OAAO,IAAI5E,KAAKA,KAAKD,IAAI,IAAI6E,mBAAmB,GAAI,IAAItG,KAAAA;CAE/F,IAAIwG,WAA2C;CAE/C,IAAI/D,KAAKgE,qBAAqBd,aAAa;EACzC,MAAMe,mBAAmB,MAAMzB,MAAMxC,KAAKgE,mBAAmB,EAC3D3J,SAAS;GACP6J,eAAe,UAAUhB;GACzBR,QAAQ;EACV,EACF,CAAC;EAED,IAAIuB,iBAAiBnB,IACnBiB,WAAW,MAAME,iBAAiBrB,KAAK,CAAC,CAACC,YAAY,IAAI;CAE7D;CAEA,MAAMsB,iBAAiBb,UAAUpK,iBAA0CoK,OAAO,IAAI;CACtF,MAAMc,qBAAqBlL,iBAA0CgK,WAAW;CAEhF,MAAMjC,UAAU,OAAO8C,UAAUM,QAAQ,WACrCN,SAASM,MACT,OAAOF,gBAAgBE,QAAQ,WAC7BF,eAAeE,MACf,OAAOD,oBAAoBC,QAAQ,WACjCD,mBAAmBC,MACnB;CAER,IAAI,CAACpD,SACH,OAAO;EAAElD,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAmB4C,cAAc,GAAGO,yBAAwB;CAAyB;CAGtI,MAAMF,QAAQ,OAAO6C,UAAU7C,UAAU,WACrC6C,SAAS7C,QACT,OAAOiD,gBAAgBjD,UAAU,WAC/BiD,eAAejD,QACf3D,KAAAA;CAEN,MAAMrD,OAAO,OAAO6J,UAAU7J,SAAS,WACnC6J,SAAS7J,OACT,OAAOiK,gBAAgBjK,SAAS,WAC9BiK,eAAejK,OACfqD,KAAAA;CAEN,IAAI+G,YAAqB;CACzB,IAAI1C,cACF,IAAI;EACF0C,YAAYvB,KAAKwB,MAAM3C,YAAY;CACrC,QAAQ;EACN0C,YAAY;CACd;CAEF,MAAME,kBAAkBF,aAAa,OAAOA,cAAc,WACrDA,YACD;CACJ,MAAMG,iBAAiB,OAAOD,iBAAiBtD,UAAU,WAAWsD,gBAAgBtD,MAAMtG,KAAK,IAAI;CACnG,MAAM8J,sBAAsBF,iBAAiBtK,QAAQ,OAAOsK,gBAAgBtK,SAAS,WAChFsK,gBAAgBtK,OACjB;CAGJ,MAAM6K,gBAAgB,CAFK,OAAOL,qBAAqBE,cAAc,WAAWF,oBAAoBE,UAAUhK,KAAK,IAAI,IAC7F,OAAO8J,qBAAqBI,aAAa,WAAWJ,oBAAoBI,SAASlK,KAAK,IAAI,EACxD,CAAC,CAACoK,OAAOC,OAAO,CAAC,CAACnK,KAAK,GAAG,CAAC,CAACF,KAAK;CAE7F,MAAMsK,gBAAgBhE,UAAUuD,kBAAkBlH,KAAAA;CAClD,MAAM4H,eAAejL,SAAS6K,iBAAiBxH,KAAAA;CAE/C,MAAM,CAAC6H,MAAMC,UAAU,MAAMvJ,QAAQwJ,IAAI,CACvCzM,OAAOkG,UAAU,UAAU9E,GAAG,GAC9BpB,OAAOkG,UAAU,YAAY9E,GAAG,CAAC,CAClC;CAED,MAAMsL,kBAAkB,kBAAkBnH,WAAU;CACpD,IAAIyD,OAAO,MAAMuD,KAAKjD,QAAQ,GAAGoD,kBAAkBtE,QAAQ,CAAC;CAE5D,IAAI,CAACY,QAAQqD,eACXrD,OAAO,MAAMuD,KAAKjD,QAAQ,EAAEjB,OAAOgE,cAAc,CAAC;CAIpD,IAAI,CAACrD,QAAQ,EADYP,2BAA2B,OACpB;EAC9B,MAAMT,eAAeU;EAErB,MAAMxE,SAA8B;GAClCgB,SAAS;GACT6C,MAAM;GACNxC;GACA6C;GACAC,OAAOgE;GACPhL,MAAMiL;EACR;EAEA,IAAItE,gBAAgB7F,mBAAmB6F,YAAY,GAAG;GACpD,MAAMV,MAAM,IAAIC,IAAIS,cAAcvC,MAAM;GACxC6B,IAAIG,aAAaC,IAAI,kBAAkBnC,UAAU;GACjD,IAAI8G,eAAe/E,IAAIG,aAAaC,IAAI,SAAS2E,aAAa;GAC9D,IAAIC,cAAchF,IAAIG,aAAaC,IAAI,QAAQ4E,YAAY;GAC3DpI,OAAO8D,eAAe,GAAGV,IAAIsF,WAAWtF,IAAIuF;EAC9C;EAEA,OAAO3I;CACT;CAEA,IAAI,CAAC9C,IAAIG,IAAIuL,SACX,OAAO;EAAE5H,SAAS;EAAO6C,MAAM;EAAS3C,OAAO;EAAuB4C,cAAc,GAAGO,yBAAwB;CAA6B;CAG9I,MAAMpC,sBAAM,IAAIC,KAAK;CAErB,IAAI2G;CAEJ,MAAMG,oBADiBlE,MAAMrG,IAAI,gBAAgB,EAAA,EACRA,IAAI4C,UAAU;CACvD,IAAI2H,kBAAkB3G,qBAAqBH,MACzC2G,oBAAoBG,iBAAiB3G;CAGvC,MAAM4G,uBAAuB;EAC3B/E;EACAC,OAAOgE;EACPhL,MAAMiL;EACNjC;EACAE;EACAE;EACA7C;EACA+C;EACAnE;EACA4G,aAAalC,YAAYxG,KAAAA;EACzB6B,WAAWwG,qBAAqB5G;EAChCkH,WAAWlH;CACb;CAEA,IAAI,CAAC6C,MAAM;EACT,MAAMd,WAAWtI,OAAO0N,WAAW;EAGnCtE,OAAO,IAAIuD,KAAK;GACdlE,OAAOgE;GACPhL,MAAMiL;GACNiB,UAAAA,MALqBtN,uBAAuBL,OAAOgG,YAAY,EAAE,CAAC,CAACC,SAAS,KAAK,CAAC;GAMlF2H,SAAS,CAACtF,QAAQ;GAClBuF,aAAa,GACVvF,WAAW,CAAC,OAAO,EACtB;GACA8E,gBAAgB,GACbzH,aAAa4H,qBAChB;EACF,CAAC;EAED,MAAMnE,KAAK0E,KAAK;EAEhB,IAAI;GACF,MAAM3N,wBAAwByM,QAAQ;IACpCtE;IACA7G,MAAMgL,iBAAiBjE;GACzB,CAAC;EACH,SAAS1B,KAAK;GACZC,QAAQvB,MAAM,sCAAsCsB,GAAG;GACvD,IAAI;IACF,MAAM6F,KAAKoB,UAAU,EAAErH,KAAK0C,KAAK1C,IAAI,CAAC;GACxC,SAASsH,eAAe;IACtBjH,QAAQvB,MAAM,kCAAkCwI,aAAa;GAC/D;GACA,OAAO;IACL1I,SAAS;IACT6C,MAAM;IACN3C,OAAO;IACP4C,cAAc,GAAGO,yBAAwB;GAC3C;EACF;CACF,OAAO;EACL,MAAMsF,YAAqC,GACxC,kBAAkBtI,eAAe4H,qBACpC;EAEA,IAAI,CAACnE,KAAKX,SAASgE,eACjBwB,UAAUxF,QAAQgE;EAGpB,IAAI,CAACrD,KAAK3H,QAAQiL,cAChBuB,UAAUxM,OAAOiL;EAGnB,MAAMC,KAAKuB,UAAU,EAAExH,KAAK0C,KAAK1C,IAAI,GAAG,EAAEyH,MAAMF,UAAU,CAAC;CAC7D;CAEA,MAAM1F,mBAAmBa,KAAKwE,WAAW,CAAA,EAAA,CAAIQ,IAAIxK,MAAM;CACvD,MAAM0E,WAAWC,gBAAgB;CACjC,IAAI,CAACD,UACH,OAAO;EACLhD,SAAS;EACT6C,MAAM;EACN3C,OAAO;EACP4C,cAAc,GAAGO,yBAAwB;CAC3C;CAEF,MAAM0F,iBAAiBjF,KAAKrG,IAAI,aAAa;CAC7C,MAAM8K,cAAcQ,iBAAiBpJ,OAAOqJ,YAAYD,eAAe9J,QAAQ,CAAC,IAAIO,KAAAA;CAEpF,IAAI,CAACxE,mBAAmBkB,KAAK;EAC3B6G,QAAQe,KAAK1C,IAAIT,SAAS;EAC1BsI,iBAAiBjG;EACjBC,iBAAiBA,gBAAgB1E,SAAS0E,kBAAkB,CAACD,QAAQ;EACrEuF;CACF,CAAC,GACC,OAAO;EACLvI,SAAS;EACT6C,MAAM;EACN3C,OAAO;EACP4C,cAAc,GAAGO,yBAAwB;CAC3C;CAGF,IAAI;EACF,IAAIY,mBACF,MAAMA,kBAAkBwE,UAAU;GAAErH,KAAKX;GAAOJ;EAAW,CAAC;CAEhE,SAASmB,KAAK;EACZC,QAAQC,KAAK,mCAAmCF,GAAG;CACrD;CAEA,IAAI;EACFtF,IAAIyF,IAAIuH,YAAY1N,yBAAyB;GAC3CoG,UAAU;GACVC,QAAQrB;GACRsB,UAAUtB,UAAU,SAAS;GAC7BuB,MAAMpE;EACR,CAAC;CACH,SAAS6D,KAAK;EACZC,QAAQC,KAAK,uCAAuCF,GAAG;CACzD;CAQA,OAAO;EACLxB,SAAS;EACT6C,MAAM;EACNC,cATmBnH,YAAYsB,mBAAmBtB,QAAQ,IACxDA,WACA8H,uBAAuBxG,mBAAmBwG,mBAAmB,IAC3DA,sBACAL;EAMJL,QAAQe,KAAK1C,IAAIT,SAAS;EAC1BqC;EACAC,iBAAiBA,gBAAgB1E,SAAS0E,kBAAkB,CAACD,QAAQ;CACvE;AACF;AAEA,IAAamG,2BAA2B,EACtC9I,YACA+I,2BAIE,CAAC,MAAkF,OACrFC,UACAnN,QACG;CACH,MAAMoN,qBAAqBpK,kBAAkBhD,KAAKmE,UAAU;CAC5D,MAAMkJ,8BAA8BD,sBAAsBF,yBACtDA,uBAAuBE,kBAAkB,IACzC9J,KAAAA;CACJ,MAAM7D,WAAWE,eAAeK,IAAIG,IAAIuH,OAAOjI,QAAQ,CAAC,EAAEkB,KAAK;CAC/D,MAAMmC,SAAS,MAAMoB,yBAAyB;EAC5ClE;EACAmE,YAAYiJ;EACZ3N;EACA2E,qBAAqBiJ;CACvB,CAAC;CAED,IAAI,CAACvK,OAAOgB,SAAS;EACnB9D,IAAIyF,IAAIuD,OAAOlG,OAAOmB,UAAU;EAChC,OAAO;GAAEH,SAAS;GAAOE,OAAOlB,OAAOkB;EAAM;CAC/C;CAEAhE,IAAIyF,IAAI6H,SAASxK,OAAOiB,WAAW;CACnC,OAAO,EAAED,SAAS,KAAK;AACzB;AAEA,IAAayJ,8BAA8B,EACzCpJ,YACAkD,yBACAC,yBACAC,wBAME,CAAC,MAAkF,OACrF4F,UACAnN,QACG;CACH,MAAM8C,SAAS,MAAMsE,qBAAqB;EACxCpH;EACAmE;EACAkD;EACAC;EACAC;CACF,CAAC;CAED,IAAIzE,OAAO6D,SAAS,SAAS;EAC3B3G,IAAIyF,IAAI6H,SAASxK,OAAO8D,YAAY;EACpC,OAAO;GAAE9C,SAAS;GAAOE,OAAOlB,OAAOkB;EAAM;CAC/C;CAEA,IAAIlB,OAAO6D,SAAS,gBAAgB;EAClC,IAAI7D,OAAO8D,cACT5G,IAAIyF,IAAI6H,SAASxK,OAAO8D,YAAY;OAEpC5G,IAAIyF,IAAI6H,SAAS,eAAe;EAElC,OAAO;GAAExJ,SAAS;GAAOE,OAAO;EAAiB;CACnD;CAEAhE,IAAIyF,IAAI6H,SAASxK,OAAO8D,YAAY;CACpC,OAAO,EAAE9C,SAAS,KAAK;AACzB;AAEA,IAAM0J,mBAAmBC,UACvBC,OAAOC,KAAKF,KAAK,CAAC,CACfhJ,SAAS,QAAQ,CAAC,CAClBmJ,QAAQ,OAAO,GAAG,CAAC,CACnBA,QAAQ,OAAO,GAAG,CAAC,CACnBA,QAAQ,QAAQ,EAAE;AAEvB,IAAaC,2BAA2B,EACtCC,QACAvH,UACAwH,OACAC,eACAjJ,sBAAM,IAAIC,KAAK,GACf4E,mBAAmB,UAQf;CACJ,MAAMqE,cAAcH,OAAOnN,KAAK;CAChC,MAAMuN,gBAAgB3H,SAAS5F,KAAK;CACpC,MAAMwN,aAAaJ,MAAMpN,KAAK;CAC9B,MAAMyN,qBAAqBJ,cAAcrN,KAAK;CAE9C,IAAI,CAACsN,aAAa,MAAM,IAAI3L,MAAM,oBAAoB;CACtD,IAAI,CAAC4L,eAAe,MAAM,IAAI5L,MAAM,sBAAsB;CAC1D,IAAI,CAAC6L,YAAY,MAAM,IAAI7L,MAAM,mBAAmB;CACpD,IAAI,CAAC8L,oBAAoB,MAAM,IAAI9L,MAAM,2BAA2B;CAEpE,MAAM+L,aAAaC,KAAKC,MAAMxJ,IAAIM,QAAQ,IAAI,GAAI;CAElD,MAAMmJ,MAAMH,aAAaC,KAAKG,IAAI,IAAIH,KAAKI,IADzB/E,OAAOE,SAASD,gBAAgB,IAAIA,mBAAmB,KACf,OAAU,KAAK,GAAG,CAAC;CAE7E,MAAM1J,SAAS;EAAEyO,KAAK;EAASC,KAAKT;EAAYU,KAAK;CAAM;CAC3D,MAAMC,UAAU;EACdC,KAAKd;EACLe,KAAKX;EACLG;EACAS,KAAK;EACL7E,KAAK8D;CACP;CAEA,MAAMgB,eAAe,GAAG1B,gBAAgB1E,KAAKC,UAAU7I,MAAM,CAAC,EAAC,GAAIsN,gBAAgB1E,KAAKC,UAAU+F,OAAO,CAAC;CAM1G,OAAO,GAAGI,aAAY,GAAI1B,gBALRhP,OAAO4Q,KAAK,UAAU1B,OAAOC,KAAKuB,YAAY,GAAG;EACjExO,KAAK0N;EACLiB,aAAa;CACf,CAE0CF,CAAS;AACrD"}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/oauth/config.ts","../../src/oauth/jwt.ts","../../src/oauth/oidc.ts","../../src/oauth/pkce.ts","../../src/oauth/providerId.ts","../../src/oauth/lib.ts"],"sourcesContent":["export type OAuthProviderConfig = {\n  issuer: string\n  clientId: string\n  clientSecret?: string\n  scope: string\n  callbackPath: string\n}\n\ntype OAuthProvidersConfig = Record<string, OAuthProviderConfig>\n\ntype OAuthProvidersStore = {\n  providers: OAuthProvidersConfig\n}\n\nconst STORE_KEY = Symbol.for(\"@rpcbase/auth/oauthProviders\")\n\nconst getStore = (): OAuthProvidersStore => {\n  const anyGlobal = globalThis as unknown as Record<string | symbol, unknown>\n  const existing = anyGlobal[STORE_KEY] as OAuthProvidersStore | undefined\n  if (existing && typeof existing === \"object\" && existing.providers && typeof existing.providers === \"object\") {\n    return existing\n  }\n\n  const created: OAuthProvidersStore = { providers: {} }\n  anyGlobal[STORE_KEY] = created\n  return created\n}\n\nconst normalizeProviders = (providers: Record<string, OAuthProviderConfig>): OAuthProvidersConfig => {\n  const result: OAuthProvidersConfig = {}\n\n  const isSafeRedirectPath = (candidate: string) => {\n    if (!candidate.startsWith(\"/\")) return false\n    if (candidate.startsWith(\"//\")) return false\n    return true\n  }\n\n  for (const [providerIdRaw, value] of Object.entries(providers)) {\n    const providerId = providerIdRaw.trim()\n    if (!providerId) continue\n\n    const issuer = typeof value?.issuer === \"string\" ? value.issuer.trim() : \"\"\n    const clientId = typeof value?.clientId === \"string\" ? value.clientId.trim() : \"\"\n    if (!issuer) throw new Error(`oauth provider \"${providerId}\" missing issuer`)\n    if (!clientId) throw new Error(`oauth provider \"${providerId}\" missing clientId`)\n\n    const clientSecret = typeof value?.clientSecret === \"string\" && value.clientSecret.trim()\n      ? value.clientSecret\n      : undefined\n\n    const scope = typeof value?.scope === \"string\" ? value.scope.trim() : \"\"\n    if (!scope) throw new Error(`oauth provider \"${providerId}\" missing scope`)\n\n    const callbackPath = typeof value?.callbackPath === \"string\"\n      ? value.callbackPath.trim()\n      : \"\"\n    if (!callbackPath) throw new Error(`oauth provider \"${providerId}\" missing callbackPath`)\n    if (!isSafeRedirectPath(callbackPath)) throw new Error(`oauth provider \"${providerId}\" has invalid callbackPath`)\n\n    result[providerId] = {\n      issuer,\n      clientId,\n      clientSecret,\n      scope,\n      callbackPath,\n    }\n  }\n\n  return result\n}\n\nexport const configureOAuthProviders = (providers: Record<string, OAuthProviderConfig>) => {\n  const store = getStore()\n  const normalized = normalizeProviders(providers)\n  store.providers = { ...store.providers, ...normalized }\n}\n\nexport const setOAuthProviders = (providers: Record<string, OAuthProviderConfig>) => {\n  const store = getStore()\n  store.providers = normalizeProviders(providers)\n}\n\nexport const getOAuthProviderConfig = (providerId: string): OAuthProviderConfig | null => {\n  const store = getStore()\n  return store.providers[providerId] ?? null\n}\n","const decodeBase64Url = (value: string) => {\n  const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"===\".slice((value.length + 3) % 4)\n  return Buffer.from(padded, \"base64\").toString(\"utf8\")\n}\n\nexport const decodeJwtPayload = <T = Record<string, unknown>>(token: string): T | null => {\n  const parts = token.split(\".\")\n  if (parts.length < 2) return null\n\n  try {\n    const json = decodeBase64Url(parts[1])\n    const parsed = JSON.parse(json) as T\n    if (!parsed || typeof parsed !== \"object\") return null\n    return parsed\n  } catch {\n    return null\n  }\n}\n\n","export type OidcWellKnown = {\n  issuer: string\n  authorization_endpoint: string\n  token_endpoint: string\n  userinfo_endpoint?: string\n  jwks_uri?: string\n}\n\nconst cache = new Map<string, Promise<OidcWellKnown>>()\n\nconst normalizeIssuer = (raw: string) => raw.trim().replace(/\\/+$/, \"\")\n\nexport const getOidcWellKnown = async (issuerRaw: string): Promise<OidcWellKnown> => {\n  const issuer = normalizeIssuer(issuerRaw)\n  if (!issuer) {\n    throw new Error(\"OIDC issuer is required\")\n  }\n\n  const existing = cache.get(issuer)\n  if (existing) {\n    return existing\n  }\n\n  const loader = (async () => {\n    const url = new URL(\"/.well-known/openid-configuration\", issuer)\n    const response = await fetch(url, { headers: { Accept: \"application/json\" } })\n    if (!response.ok) {\n      const body = await response.text().catch(() => \"\")\n      throw new Error(`Failed to fetch OIDC discovery document: ${response.status} ${body}`)\n    }\n\n    const json = await response.json().catch(() => null) as Partial<OidcWellKnown> | null\n    if (!json || typeof json !== \"object\") {\n      throw new Error(\"Invalid OIDC discovery document\")\n    }\n\n    const authorizationEndpoint = typeof json.authorization_endpoint === \"string\"\n      ? json.authorization_endpoint\n      : \"\"\n    const tokenEndpoint = typeof json.token_endpoint === \"string\"\n      ? json.token_endpoint\n      : \"\"\n    const issuerValue = typeof json.issuer === \"string\" ? json.issuer : issuer\n    const userinfoEndpoint = typeof json.userinfo_endpoint === \"string\" ? json.userinfo_endpoint : undefined\n    const jwksUri = typeof json.jwks_uri === \"string\" ? json.jwks_uri : undefined\n\n    if (!authorizationEndpoint || !tokenEndpoint) {\n      throw new Error(\"OIDC discovery document missing required endpoints\")\n    }\n\n    return {\n      issuer: issuerValue,\n      authorization_endpoint: authorizationEndpoint,\n      token_endpoint: tokenEndpoint,\n      userinfo_endpoint: userinfoEndpoint,\n      jwks_uri: jwksUri,\n    } satisfies OidcWellKnown\n  })()\n\n  cache.set(issuer, loader)\n\n  try {\n    return await loader\n  } catch (err) {\n    cache.delete(issuer)\n    throw err\n  }\n}\n\n","import crypto from \"crypto\"\n\n\nexport const base64UrlEncode = (input: Buffer) => input\n  .toString(\"base64\")\n  .replace(/\\+/g, \"-\")\n  .replace(/\\//g, \"_\")\n  .replace(/=+$/g, \"\")\n\nexport const generatePkcePair = () => {\n  const verifier = base64UrlEncode(crypto.randomBytes(32))\n  const challenge = base64UrlEncode(crypto.createHash(\"sha256\").update(verifier).digest())\n\n  return { verifier, challenge }\n}\n\n","const RESERVED_KEYS = new Set([\"__proto__\", \"prototype\", \"constructor\"])\n\nexport const isSafeOAuthProviderId = (value: string) => {\n  const providerId = value.trim()\n  if (!providerId) return false\n  if (providerId.length > 128) return false\n  if (RESERVED_KEYS.has(providerId)) return false\n  return /^[a-zA-Z0-9_-]+$/.test(providerId)\n}\n\n","import crypto from \"crypto\"\n\nimport { ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { createProvisionedTenant, models } from \"@rpcbase/db\"\nimport { hashPasswordForStorage } from \"@rpcbase/server\"\n\nimport { completeAuthSignIn } from \"../session\"\nimport type { AuthSessionUser } from \"../types\"\nimport { getOAuthProviderConfig } from \"./config\"\nimport { decodeJwtPayload } from \"./jwt\"\nimport { getOidcWellKnown } from \"./oidc\"\nimport { generatePkcePair } from \"./pkce\"\nimport { isSafeOAuthProviderId } from \"./providerId\"\n\n\nconst OAUTH_REQUEST_TTL_MS = 10 * 60 * 1000\nconst OAUTH_STATE_COOKIE_NAME = \"rb_oauth_state\"\ntype OAuthCtx = Ctx<AuthSessionUser>\ntype OAuthRequestRecord = {\n  returnTo?: unknown\n  codeVerifier?: unknown\n}\n\nconst getQueryString = (value: unknown) => {\n  if (typeof value === \"string\") return value\n  if (Array.isArray(value) && typeof value[0] === \"string\") return value[0]\n  return null\n}\n\nconst getCookieValue = (ctx: OAuthCtx, name: string): string | null => {\n  const header = ctx.req.headers?.cookie\n  if (typeof header !== \"string\" || !header) return null\n\n  for (const part of header.split(\";\")) {\n    const [rawKey, ...rest] = part.split(\"=\")\n    const key = rawKey?.trim()\n    if (!key || key !== name) continue\n    const rawValue = rest.join(\"=\").trim()\n    if (!rawValue) return \"\"\n    try {\n      return decodeURIComponent(rawValue)\n    } catch {\n      return rawValue\n    }\n  }\n\n  return null\n}\n\nconst isSafeRedirectPath = (candidate: string) => {\n  if (!candidate.startsWith(\"/\")) return false\n  if (candidate.startsWith(\"//\")) return false\n  return true\n}\n\nconst getRequestOrigin = (ctx: OAuthCtx) => {\n  const protoHeader = ctx.req.headers[\"x-forwarded-proto\"]\n  const hostHeader = ctx.req.headers[\"x-forwarded-host\"]\n\n  const protocol = typeof protoHeader === \"string\"\n    ? protoHeader.split(\",\")[0].trim()\n    : ctx.req.protocol\n\n  const host = typeof hostHeader === \"string\"\n    ? hostHeader.split(\",\")[0].trim()\n    : ctx.req.get(\"host\")\n\n  return protocol && host ? `${protocol}://${host}` : \"\"\n}\n\nconst resolveCallbackPath = (callbackPath: string) => {\n  const trimmed = callbackPath.trim()\n  return trimmed && isSafeRedirectPath(trimmed) ? trimmed : null\n}\n\nconst readTextBody = async (req: Pick<OAuthCtx[\"req\"], \"on\" | \"setEncoding\">) =>\n  await new Promise<string>((resolve, reject) => {\n    let body = \"\"\n    if (typeof req.setEncoding === \"function\") {\n      req.setEncoding(\"utf8\")\n    }\n\n    req.on(\"data\", (chunk) => {\n      body += String(chunk)\n      if (body.length > 32_768) {\n        reject(new Error(\"request_body_too_large\"))\n      }\n    })\n    req.on(\"end\", () => resolve(body))\n    req.on(\"error\", reject)\n  })\n\nconst getFormPostParams = async (ctx: OAuthCtx): Promise<Record<string, string> | null> => {\n  if (ctx.req.method !== \"POST\") return null\n\n  const contentType = typeof ctx.req.headers[\"content-type\"] === \"string\" ? ctx.req.headers[\"content-type\"] : \"\"\n  if (!contentType.includes(\"application/x-www-form-urlencoded\")) return null\n\n  const body = await readTextBody(ctx.req)\n  const params = new URLSearchParams(body)\n\n  const result: Record<string, string> = {}\n  for (const [key, value] of params.entries()) {\n    result[key] = value\n  }\n\n  return result\n}\n\nconst resolveProviderId = (ctx: OAuthCtx, providerIdOverride?: string) =>\n  (providerIdOverride ?? String(ctx.req.params?.provider ?? \"\")).trim()\n\nconst RESERVED_AUTH_PARAM_KEYS = new Set([\"__proto__\", \"prototype\", \"constructor\"])\n\nconst normalizeAuthorizationParams = (value: unknown): Record<string, string> | undefined => {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined\n\n  const result: Record<string, string> = {}\n  for (const [keyRaw, valueRaw] of Object.entries(value)) {\n    const key = keyRaw.trim()\n    if (!key) continue\n    if (RESERVED_AUTH_PARAM_KEYS.has(key)) continue\n    const val = typeof valueRaw === \"string\" ? valueRaw.trim() : \"\"\n    if (!val) continue\n    result[key] = val\n  }\n\n  return Object.keys(result).length ? result : undefined\n}\n\nexport type OAuthStartResult =\n  | { success: true; redirectUrl: string }\n  | { success: false; error: string; statusCode: number }\n\nexport const getOAuthStartRedirectUrl = async ({\n  ctx,\n  providerId: providerIdOverride,\n  returnTo,\n  authorizationParams,\n}: {\n  ctx: OAuthCtx\n  providerId?: string\n  returnTo?: string | null\n  authorizationParams?: Record<string, string>\n}): Promise<OAuthStartResult> => {\n  const providerId = resolveProviderId(ctx, providerIdOverride)\n  if (!providerId) {\n    return { success: false, error: \"missing_provider\", statusCode: 400 }\n  }\n\n  if (!isSafeOAuthProviderId(providerId)) {\n    return { success: false, error: \"invalid_provider\", statusCode: 400 }\n  }\n\n  const provider = getOAuthProviderConfig(providerId)\n  if (!provider) {\n    return { success: false, error: \"unknown_provider\", statusCode: 404 }\n  }\n\n  const origin = getRequestOrigin(ctx)\n  if (!origin) {\n    return { success: false, error: \"origin_unavailable\", statusCode: 500 }\n  }\n  const isHttps = origin.startsWith(\"https://\")\n\n  const callbackPath = resolveCallbackPath(provider.callbackPath)\n  if (!callbackPath) {\n    return { success: false, error: \"invalid_callback_path\", statusCode: 500 }\n  }\n\n  const state = crypto.randomBytes(16).toString(\"hex\")\n  const { verifier, challenge } = generatePkcePair()\n\n  const safeReturnTo = typeof returnTo === \"string\" && isSafeRedirectPath(returnTo) ? returnTo : undefined\n\n  try {\n    const OAuthRequest = await models.getGlobal(\"RBOAuthRequest\", ctx)\n    const now = new Date()\n    await OAuthRequest.create({\n      _id: state,\n      providerId,\n      codeVerifier: verifier,\n      returnTo: safeReturnTo,\n      createdAt: now,\n      expiresAt: new Date(now.getTime() + OAUTH_REQUEST_TTL_MS),\n    })\n  } catch (err) {\n    console.warn(\"oauth::failed_to_store_request\", err)\n    return { success: false, error: \"oauth_request_store_failed\", statusCode: 500 }\n  }\n\n  try {\n    ctx.res.cookie(OAUTH_STATE_COOKIE_NAME, `${providerId}:${state}`, {\n      httpOnly: true,\n      secure: isHttps,\n      sameSite: isHttps ? \"none\" : \"lax\",\n      path: callbackPath,\n      maxAge: OAUTH_REQUEST_TTL_MS,\n    })\n  } catch (err) {\n    console.warn(\"oauth::failed_to_set_state_cookie\", err)\n    return { success: false, error: \"oauth_cookie_set_failed\", statusCode: 500 }\n  }\n\n  const oidc = await getOidcWellKnown(provider.issuer)\n  const redirectUri = `${origin}${callbackPath}`\n\n  const url = new URL(oidc.authorization_endpoint)\n  url.searchParams.set(\"client_id\", provider.clientId)\n  url.searchParams.set(\"redirect_uri\", redirectUri)\n  url.searchParams.set(\"response_type\", \"code\")\n  url.searchParams.set(\"scope\", provider.scope)\n  url.searchParams.set(\"state\", state)\n  url.searchParams.set(\"code_challenge\", challenge)\n  url.searchParams.set(\"code_challenge_method\", \"S256\")\n  const extraAuthorizationParams = normalizeAuthorizationParams(authorizationParams)\n  for (const [key, value] of Object.entries(extraAuthorizationParams ?? {})) {\n    if (url.searchParams.has(key)) continue\n    url.searchParams.set(key, value)\n  }\n\n  return { success: true, redirectUrl: url.toString() }\n}\n\nexport type OAuthCallbackResult =\n  | {\n    success: true\n    type: \"signed_in\"\n    redirectPath: string\n    userId: string\n    tenantId: string\n    signedInTenants: string[]\n  }\n  | {\n    success: false\n    type: \"missing_user\"\n    providerId: string\n    subject: string\n    email?: string\n    name?: string\n    redirectPath?: string\n  }\n  | {\n    success: false\n    type: \"error\"\n    error: string\n    redirectPath: string\n  }\n\nconst OAUTH_SUCCESS_REDIRECT_PATH = \"/onboarding\"\nconst AUTH_ERROR_REDIRECT_BASE = \"/auth/sign-in\"\n\nexport const processOAuthCallback = async ({\n  ctx,\n  providerId: providerIdOverride,\n  createUserOnFirstSignIn,\n  missingUserRedirectPath,\n  successRedirectPath,\n}: {\n  ctx: OAuthCtx\n  providerId?: string\n  createUserOnFirstSignIn?: boolean\n  missingUserRedirectPath?: string\n  successRedirectPath?: string\n}): Promise<OAuthCallbackResult> => {\n  const providerId = resolveProviderId(ctx, providerIdOverride)\n  if (!providerId) {\n    return { success: false, type: \"error\", error: \"missing_provider\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=missing_provider` }\n  }\n\n  if (!isSafeOAuthProviderId(providerId)) {\n    return { success: false, type: \"error\", error: \"invalid_provider\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=invalid_provider` }\n  }\n\n  const provider = getOAuthProviderConfig(providerId)\n  if (!provider) {\n    return { success: false, type: \"error\", error: \"unknown_provider\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=unknown_provider` }\n  }\n\n  const origin = getRequestOrigin(ctx)\n  if (!origin) {\n    return { success: false, type: \"error\", error: \"origin_unavailable\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=origin_unavailable` }\n  }\n  const isHttps = origin.startsWith(\"https://\")\n\n  const callbackPath = resolveCallbackPath(provider.callbackPath)\n  if (!callbackPath) {\n    return { success: false, type: \"error\", error: \"invalid_callback_path\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=invalid_callback_path` }\n  }\n\n  const bodyParams = await getFormPostParams(ctx)\n\n  const code = (getQueryString(bodyParams?.code) ?? getQueryString(ctx.req.query?.code))?.trim() ?? \"\"\n  const state = (getQueryString(bodyParams?.state) ?? getQueryString(ctx.req.query?.state))?.trim() ?? \"\"\n  const oauthUserRaw = (getQueryString(bodyParams?.user) ?? getQueryString(ctx.req.query?.user))?.trim() ?? \"\"\n\n  if (!code || !state) {\n    return { success: false, type: \"error\", error: \"missing_code_or_state\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=missing_code_or_state` }\n  }\n\n  const stateCookieValue = getCookieValue(ctx, OAUTH_STATE_COOKIE_NAME)\n  if (stateCookieValue !== `${providerId}:${state}`) {\n    return { success: false, type: \"error\", error: \"invalid_state\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=invalid_state` }\n  }\n\n  let oauthRequest: OAuthRequestRecord | null = null\n  let OAuthRequestModel: Awaited<ReturnType<typeof models.getGlobal>> | null = null\n  try {\n    OAuthRequestModel = await models.getGlobal(\"RBOAuthRequest\", ctx)\n    oauthRequest = await OAuthRequestModel.findOne({ _id: state, providerId }).lean() as OAuthRequestRecord | null\n  } catch (err) {\n    console.warn(\"oauth::failed_to_load_request\", err)\n    return { success: false, type: \"error\", error: \"oauth_request_load_failed\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=oauth_request_load_failed` }\n  }\n\n  if (!oauthRequest) {\n    return { success: false, type: \"error\", error: \"invalid_state\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=invalid_state` }\n  }\n\n  const returnTo = typeof oauthRequest.returnTo === \"string\" ? oauthRequest.returnTo : undefined\n  const codeVerifier = typeof oauthRequest.codeVerifier === \"string\" ? oauthRequest.codeVerifier : \"\"\n  if (!codeVerifier) {\n    return { success: false, type: \"error\", error: \"missing_code_verifier\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=missing_code_verifier` }\n  }\n\n  const oidc = await getOidcWellKnown(provider.issuer)\n  const redirectUri = `${origin}${callbackPath}`\n\n  const tokenBody = new URLSearchParams()\n  tokenBody.set(\"grant_type\", \"authorization_code\")\n  tokenBody.set(\"code\", code)\n  tokenBody.set(\"redirect_uri\", redirectUri)\n  tokenBody.set(\"client_id\", provider.clientId)\n  tokenBody.set(\"code_verifier\", codeVerifier)\n  if (provider.clientSecret) {\n    tokenBody.set(\"client_secret\", provider.clientSecret)\n  }\n\n  const tokenResponse = await fetch(oidc.token_endpoint, {\n    method: \"POST\",\n    headers: {\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n      Accept: \"application/json\",\n    },\n    body: tokenBody.toString(),\n  })\n\n  const tokenJson = await tokenResponse.json().catch(() => null) as Record<string, unknown> | null\n\n  if (!tokenResponse.ok || !tokenJson || typeof tokenJson !== \"object\") {\n    const body = tokenJson ? JSON.stringify(tokenJson) : \"\"\n    console.warn(\"oauth::token_exchange failed\", tokenResponse.status, body)\n    return { success: false, type: \"error\", error: \"token_exchange_failed\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=token_exchange_failed` }\n  }\n\n  const accessToken = typeof tokenJson.access_token === \"string\" ? tokenJson.access_token : \"\"\n  const refreshToken = typeof tokenJson.refresh_token === \"string\" ? tokenJson.refresh_token : undefined\n  const idToken = typeof tokenJson.id_token === \"string\" ? tokenJson.id_token : undefined\n  const scope = typeof tokenJson.scope === \"string\" ? tokenJson.scope : undefined\n  const tokenType = typeof tokenJson.token_type === \"string\" ? tokenJson.token_type : undefined\n  const expiresIn = typeof tokenJson.expires_in === \"number\"\n    ? tokenJson.expires_in\n    : typeof tokenJson.expires_in === \"string\"\n      ? Number(tokenJson.expires_in)\n      : undefined\n  const expiresInSeconds = typeof expiresIn === \"number\" && Number.isFinite(expiresIn) ? expiresIn : null\n  const expiresAt = expiresInSeconds !== null ? new Date(Date.now() + expiresInSeconds * 1000) : undefined\n\n  let userInfo: Record<string, unknown> | null = null\n\n  if (oidc.userinfo_endpoint && accessToken) {\n    const userInfoResponse = await fetch(oidc.userinfo_endpoint, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        Accept: \"application/json\",\n      },\n    })\n\n    if (userInfoResponse.ok) {\n      userInfo = await userInfoResponse.json().catch(() => null) as Record<string, unknown> | null\n    }\n  }\n\n  const idTokenPayload = idToken ? decodeJwtPayload<Record<string, unknown>>(idToken) : null\n  const accessTokenPayload = decodeJwtPayload<Record<string, unknown>>(accessToken)\n\n  const subject = typeof userInfo?.sub === \"string\"\n    ? userInfo.sub\n    : typeof idTokenPayload?.sub === \"string\"\n      ? idTokenPayload.sub\n      : typeof accessTokenPayload?.sub === \"string\"\n        ? accessTokenPayload.sub\n        : \"\"\n\n  if (!subject) {\n    return { success: false, type: \"error\", error: \"missing_subject\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=missing_subject` }\n  }\n\n  const email = typeof userInfo?.email === \"string\"\n    ? userInfo.email\n    : typeof idTokenPayload?.email === \"string\"\n      ? idTokenPayload.email\n      : undefined\n\n  const name = typeof userInfo?.name === \"string\"\n    ? userInfo.name\n    : typeof idTokenPayload?.name === \"string\"\n      ? idTokenPayload.name\n      : undefined\n\n  let oauthUser: unknown = null\n  if (oauthUserRaw) {\n    try {\n      oauthUser = JSON.parse(oauthUserRaw) as unknown\n    } catch {\n      oauthUser = null\n    }\n  }\n  const oauthUserRecord = oauthUser && typeof oauthUser === \"object\"\n    ? (oauthUser as Record<string, unknown>)\n    : null\n  const oauthUserEmail = typeof oauthUserRecord?.email === \"string\" ? oauthUserRecord.email.trim() : \"\"\n  const oauthUserNameRecord = oauthUserRecord?.name && typeof oauthUserRecord.name === \"object\"\n    ? (oauthUserRecord.name as Record<string, unknown>)\n    : null\n  const oauthUserNameFirst = typeof oauthUserNameRecord?.firstName === \"string\" ? oauthUserNameRecord.firstName.trim() : \"\"\n  const oauthUserNameLast = typeof oauthUserNameRecord?.lastName === \"string\" ? oauthUserNameRecord.lastName.trim() : \"\"\n  const oauthUserName = [oauthUserNameFirst, oauthUserNameLast].filter(Boolean).join(\" \").trim()\n\n  const resolvedEmail = email ?? (oauthUserEmail || undefined)\n  const resolvedName = name ?? (oauthUserName || undefined)\n\n  const [User, Tenant] = await Promise.all([\n    models.getGlobal(\"RBUser\", ctx),\n    models.getGlobal(\"RBTenant\", ctx),\n  ])\n\n  const subjectQueryKey = `oauthProviders.${providerId}.subject`\n  let user = await User.findOne({ [subjectQueryKey]: subject })\n\n  if (!user && resolvedEmail) {\n    user = await User.findOne({ email: resolvedEmail })\n  }\n\n  const shouldCreateUser = createUserOnFirstSignIn ?? true\n  if (!user && !shouldCreateUser) {\n    const redirectPath = missingUserRedirectPath\n\n    const result: OAuthCallbackResult = {\n      success: false,\n      type: \"missing_user\",\n      providerId,\n      subject,\n      email: resolvedEmail,\n      name: resolvedName,\n    }\n\n    if (redirectPath && isSafeRedirectPath(redirectPath)) {\n      const url = new URL(redirectPath, origin)\n      url.searchParams.set(\"oauth_provider\", providerId)\n      if (resolvedEmail) url.searchParams.set(\"email\", resolvedEmail)\n      if (resolvedName) url.searchParams.set(\"name\", resolvedName)\n      result.redirectPath = `${url.pathname}${url.search}`\n    }\n\n    return result\n  }\n\n  if (!ctx.req.session) {\n    return { success: false, type: \"error\", error: \"session_unavailable\", redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=session_unavailable` }\n  }\n\n  const now = new Date()\n\n  let providerCreatedAt: Date | undefined\n  const oauthProviders = user?.get(\"oauthProviders\") as Map<string, { createdAt?: unknown }> | undefined\n  const existingProvider = oauthProviders?.get(providerId)\n  if (existingProvider?.createdAt instanceof Date) {\n    providerCreatedAt = existingProvider.createdAt\n  }\n\n  const oauthProviderPayload = {\n    subject,\n    email: resolvedEmail,\n    name: resolvedName,\n    accessToken,\n    refreshToken,\n    idToken,\n    scope,\n    tokenType,\n    expiresAt,\n    rawUserInfo: userInfo ?? undefined,\n    createdAt: providerCreatedAt ?? now,\n    updatedAt: now,\n  }\n\n  if (!user) {\n    const tenantId = crypto.randomUUID()\n    const password = await hashPasswordForStorage(crypto.randomBytes(32).toString(\"hex\"))\n\n    user = new User({\n      email: resolvedEmail,\n      name: resolvedName,\n      password,\n      tenants: [tenantId],\n      tenantRoles: {\n        [tenantId]: [\"owner\"],\n      },\n      oauthProviders: {\n        [providerId]: oauthProviderPayload,\n      },\n    })\n\n    await user.save()\n\n    try {\n      await createProvisionedTenant(Tenant, {\n        tenantId,\n        name: resolvedEmail || subject,\n      })\n    } catch (err) {\n      console.error(\"oauth::failed_to_initialize_tenant\", err)\n      try {\n        await User.deleteOne({ _id: user._id })\n      } catch (rollbackError) {\n        console.error(\"oauth::failed_to_rollback_user\", rollbackError)\n      }\n      return {\n        success: false,\n        type: \"error\",\n        error: \"tenant_initialization_failed\",\n        redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=tenant_initialization_failed`,\n      }\n    }\n  } else {\n    const setFields: Record<string, unknown> = {\n      [`oauthProviders.${providerId}`]: oauthProviderPayload,\n    }\n\n    if (!user.email && resolvedEmail) {\n      setFields.email = resolvedEmail\n    }\n\n    if (!user.name && resolvedName) {\n      setFields.name = resolvedName\n    }\n\n    await User.updateOne({ _id: user._id }, { $set: setFields })\n  }\n\n  const signedInTenants = (user.tenants || []).map(String)\n  const tenantId = signedInTenants[0]\n  if (!tenantId) {\n    return {\n      success: false,\n      type: \"error\",\n      error: \"tenant_unavailable\",\n      redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=tenant_unavailable`,\n    }\n  }\n  const tenantRolesMap = user.get(\"tenantRoles\") as Map<string, string[]> | undefined\n  const tenantRoles = tenantRolesMap ? Object.fromEntries(tenantRolesMap.entries()) : undefined\n\n  if (!completeAuthSignIn(ctx, {\n    userId: user._id.toString(),\n    currentTenantId: tenantId,\n    signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],\n    tenantRoles,\n  })) {\n    return {\n      success: false,\n      type: \"error\",\n      error: \"session_unavailable\",\n      redirectPath: `${AUTH_ERROR_REDIRECT_BASE}?error=session_unavailable`,\n    }\n  }\n\n  try {\n    if (OAuthRequestModel) {\n      await OAuthRequestModel.deleteOne({ _id: state, providerId })\n    }\n  } catch (err) {\n    console.warn(\"oauth::failed_to_delete_request\", err)\n  }\n\n  try {\n    ctx.res.clearCookie(OAUTH_STATE_COOKIE_NAME, {\n      httpOnly: true,\n      secure: isHttps,\n      sameSite: isHttps ? \"none\" : \"lax\",\n      path: callbackPath,\n    })\n  } catch (err) {\n    console.warn(\"oauth::failed_to_clear_state_cookie\", err)\n  }\n\n  const redirectPath = returnTo && isSafeRedirectPath(returnTo)\n    ? returnTo\n    : successRedirectPath && isSafeRedirectPath(successRedirectPath)\n      ? successRedirectPath\n      : OAUTH_SUCCESS_REDIRECT_PATH\n\n  return {\n    success: true,\n    type: \"signed_in\",\n    redirectPath,\n    userId: user._id.toString(),\n    tenantId,\n    signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],\n  }\n}\n\nexport const createOAuthStartHandler = ({\n  providerId,\n  getAuthorizationParams,\n}: {\n  providerId?: string\n  getAuthorizationParams?: (providerId: string) => Record<string, string> | undefined\n} = {}): ApiHandler<unknown, { success: boolean; error?: string }, AuthSessionUser> => async (\n  _payload,\n  ctx,\n) => {\n  const resolvedProviderId = resolveProviderId(ctx, providerId)\n  const providerAuthorizationParams = resolvedProviderId && getAuthorizationParams\n    ? getAuthorizationParams(resolvedProviderId)\n    : undefined\n  const returnTo = getQueryString(ctx.req.query?.returnTo)?.trim()\n  const result = await getOAuthStartRedirectUrl({\n    ctx,\n    providerId: resolvedProviderId,\n    returnTo,\n    authorizationParams: providerAuthorizationParams,\n  })\n\n  if (!result.success) {\n    ctx.res.status(result.statusCode)\n    return { success: false, error: result.error }\n  }\n\n  ctx.res.redirect(result.redirectUrl)\n  return { success: true }\n}\n\nexport const createOAuthCallbackHandler = ({\n  providerId,\n  createUserOnFirstSignIn,\n  missingUserRedirectPath,\n  successRedirectPath,\n}: {\n  providerId?: string\n  createUserOnFirstSignIn?: boolean\n  missingUserRedirectPath?: string\n  successRedirectPath?: string\n} = {}): ApiHandler<unknown, { success: boolean; error?: string }, AuthSessionUser> => async (\n  _payload,\n  ctx,\n) => {\n  const result = await processOAuthCallback({\n    ctx,\n    providerId,\n    createUserOnFirstSignIn,\n    missingUserRedirectPath,\n    successRedirectPath,\n  })\n\n  if (result.type === \"error\") {\n    ctx.res.redirect(result.redirectPath)\n    return { success: false, error: result.error }\n  }\n\n  if (result.type === \"missing_user\") {\n    if (result.redirectPath) {\n      ctx.res.redirect(result.redirectPath)\n    } else {\n      ctx.res.redirect(\"/auth/sign-up\")\n    }\n    return { success: false, error: \"user_not_found\" }\n  }\n\n  ctx.res.redirect(result.redirectPath)\n  return { success: true }\n}\n\nconst base64UrlEncode = (input: Buffer | string) =>\n  Buffer.from(input)\n    .toString(\"base64\")\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/g, \"\")\n\nexport const createAppleClientSecret = ({\n  teamId,\n  clientId,\n  keyId,\n  privateKeyPem,\n  now = new Date(),\n  expiresInSeconds = 10 * 60,\n}: {\n  teamId: string\n  clientId: string\n  keyId: string\n  privateKeyPem: string\n  now?: Date\n  expiresInSeconds?: number\n}) => {\n  const teamIdValue = teamId.trim()\n  const clientIdValue = clientId.trim()\n  const keyIdValue = keyId.trim()\n  const privateKeyPemValue = privateKeyPem.trim()\n\n  if (!teamIdValue) throw new Error(\"teamId is required\")\n  if (!clientIdValue) throw new Error(\"clientId is required\")\n  if (!keyIdValue) throw new Error(\"keyId is required\")\n  if (!privateKeyPemValue) throw new Error(\"privateKeyPem is required\")\n\n  const nowSeconds = Math.floor(now.getTime() / 1000)\n  const expiresIn = Number.isFinite(expiresInSeconds) ? expiresInSeconds : 10 * 60\n  const exp = nowSeconds + Math.max(60, Math.min(expiresIn, 60 * 60 * 24 * 180))\n\n  const header = { alg: \"ES256\", kid: keyIdValue, typ: \"JWT\" }\n  const payload = {\n    iss: teamIdValue,\n    iat: nowSeconds,\n    exp,\n    aud: \"https://appleid.apple.com\",\n    sub: clientIdValue,\n  }\n\n  const signingInput = `${base64UrlEncode(JSON.stringify(header))}.${base64UrlEncode(JSON.stringify(payload))}`\n  const signature = crypto.sign(\"sha256\", Buffer.from(signingInput), {\n    key: privateKeyPemValue,\n    dsaEncoding: \"ieee-p1363\",\n  })\n\n  return `${signingInput}.${base64UrlEncode(signature)}`\n}\n"],"mappings":";;;;;AAcA,IAAM,YAAY,OAAO,IAAI,8BAA8B;AAE3D,IAAM,iBAAsC;CAC1C,MAAM,YAAY;CAClB,MAAM,WAAW,UAAU;CAC3B,IAAI,YAAY,OAAO,aAAa,YAAY,SAAS,aAAa,OAAO,SAAS,cAAc,UAClG,OAAO;CAGT,MAAM,UAA+B,EAAE,WAAW,CAAC,EAAE;CACrD,UAAU,aAAa;CACvB,OAAO;AACT;AAEA,IAAM,sBAAsB,cAAyE;CACnG,MAAM,SAA+B,CAAC;CAEtC,MAAM,sBAAsB,cAAsB;EAChD,IAAI,CAAC,UAAU,WAAW,GAAG,GAAG,OAAO;EACvC,IAAI,UAAU,WAAW,IAAI,GAAG,OAAO;EACvC,OAAO;CACT;CAEA,KAAK,MAAM,CAAC,eAAe,UAAU,OAAO,QAAQ,SAAS,GAAG;EAC9D,MAAM,aAAa,cAAc,KAAK;EACtC,IAAI,CAAC,YAAY;EAEjB,MAAM,SAAS,OAAO,OAAO,WAAW,WAAW,MAAM,OAAO,KAAK,IAAI;EACzE,MAAM,WAAW,OAAO,OAAO,aAAa,WAAW,MAAM,SAAS,KAAK,IAAI;EAC/E,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,mBAAmB,WAAU,iBAAkB;EAC5E,IAAI,CAAC,UAAU,MAAM,IAAI,MAAM,mBAAmB,WAAU,mBAAoB;EAEhF,MAAM,eAAe,OAAO,OAAO,iBAAiB,YAAY,MAAM,aAAa,KAAK,IACpF,MAAM,eACN,KAAA;EAEJ,MAAM,QAAQ,OAAO,OAAO,UAAU,WAAW,MAAM,MAAM,KAAK,IAAI;EACtE,IAAI,CAAC,OAAO,MAAM,IAAI,MAAM,mBAAmB,WAAU,gBAAiB;EAE1E,MAAM,eAAe,OAAO,OAAO,iBAAiB,WAChD,MAAM,aAAa,KAAK,IACxB;EACJ,IAAI,CAAC,cAAc,MAAM,IAAI,MAAM,mBAAmB,WAAU,uBAAwB;EACxF,IAAI,CAAC,mBAAmB,YAAY,GAAG,MAAM,IAAI,MAAM,mBAAmB,WAAU,2BAA4B;EAEhH,OAAO,cAAc;GACnB;GACA;GACA;GACA;GACA;EACF;CACF;CAEA,OAAO;AACT;AAEA,IAAa,2BAA2B,cAAmD;CACzF,MAAM,QAAQ,SAAS;CACvB,MAAM,aAAa,mBAAmB,SAAS;CAC/C,MAAM,YAAY;EAAE,GAAG,MAAM;EAAW,GAAG;CAAW;AACxD;AAEA,IAAa,qBAAqB,cAAmD;CACnF,MAAM,QAAQ,SAAS;CACvB,MAAM,YAAY,mBAAmB,SAAS;AAChD;AAEA,IAAa,0BAA0B,eAAmD;CAExF,OADc,SACP,CAAA,CAAM,UAAU,eAAe;AACxC;;;ACrFA,IAAM,mBAAmB,UAAkB;CACzC,MAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG,IAAI,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC;CAC/F,OAAO,OAAO,KAAK,QAAQ,QAAQ,CAAC,CAAC,SAAS,MAAM;AACtD;AAEA,IAAa,oBAAiD,UAA4B;CACxF,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,IAAI,MAAM,SAAS,GAAG,OAAO;CAE7B,IAAI;EACF,MAAM,OAAO,gBAAgB,MAAM,EAAE;EACrC,MAAM,SAAS,KAAK,MAAM,IAAI;EAC9B,IAAI,CAAC,UAAU,OAAO,WAAW,UAAU,OAAO;EAClD,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;ACTA,IAAM,wBAAQ,IAAI,IAAoC;AAEtD,IAAM,mBAAmB,QAAgB,IAAI,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE;AAEtE,IAAa,mBAAmB,OAAO,cAA8C;CACnF,MAAM,SAAS,gBAAgB,SAAS;CACxC,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,yBAAyB;CAG3C,MAAM,WAAW,MAAM,IAAI,MAAM;CACjC,IAAI,UACF,OAAO;CAGT,MAAM,UAAU,YAAY;EAC1B,MAAM,MAAM,IAAI,IAAI,qCAAqC,MAAM;EAC/D,MAAM,WAAW,MAAM,MAAM,KAAK,EAAE,SAAS,EAAE,QAAQ,mBAAmB,EAAE,CAAC;EAC7E,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;GACjD,MAAM,IAAI,MAAM,4CAA4C,SAAS,OAAM,GAAI,MAAM;EACvF;EAEA,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,IAAI;EACnD,IAAI,CAAC,QAAQ,OAAO,SAAS,UAC3B,MAAM,IAAI,MAAM,iCAAiC;EAGnD,MAAM,wBAAwB,OAAO,KAAK,2BAA2B,WACjE,KAAK,yBACL;EACJ,MAAM,gBAAgB,OAAO,KAAK,mBAAmB,WACjD,KAAK,iBACL;EACJ,MAAM,cAAc,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;EACpE,MAAM,mBAAmB,OAAO,KAAK,sBAAsB,WAAW,KAAK,oBAAoB,KAAA;EAC/F,MAAM,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW,KAAA;EAEpE,IAAI,CAAC,yBAAyB,CAAC,eAC7B,MAAM,IAAI,MAAM,oDAAoD;EAGtE,OAAO;GACL,QAAQ;GACR,wBAAwB;GACxB,gBAAgB;GAChB,mBAAmB;GACnB,UAAU;EACZ;CACF,EAAA,CAAG;CAEH,MAAM,IAAI,QAAQ,MAAM;CAExB,IAAI;EACF,OAAO,MAAM;CACf,SAAS,KAAK;EACZ,MAAM,OAAO,MAAM;EACnB,MAAM;CACR;AACF;;;AChEA,IAAa,qBAAmB,UAAkB,MAC/C,SAAS,QAAQ,CAAC,CAClB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,QAAQ,EAAE;AAErB,IAAa,yBAAyB;CACpC,MAAM,WAAW,kBAAgB,OAAO,YAAY,EAAE,CAAC;CAGvD,OAAO;EAAE;EAAU,WAFD,kBAAgB,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,OAAO,CAEnE;CAAU;AAC/B;;;ACdA,IAAM,gCAAgB,IAAI,IAAI;CAAC;CAAa;CAAa;AAAa,CAAC;AAEvE,IAAa,yBAAyB,UAAkB;CACtD,MAAM,aAAa,MAAM,KAAK;CAC9B,IAAI,CAAC,YAAY,OAAO;CACxB,IAAI,WAAW,SAAS,KAAK,OAAO;CACpC,IAAI,cAAc,IAAI,UAAU,GAAG,OAAO;CAC1C,OAAO,mBAAmB,KAAK,UAAU;AAC3C;;;ACOA,IAAM,uBAAuB;AAC7B,IAAM,0BAA0B;AAOhC,IAAM,kBAAkB,UAAmB;CACzC,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,MAAM,QAAQ,KAAK,KAAK,OAAO,MAAM,OAAO,UAAU,OAAO,MAAM;CACvE,OAAO;AACT;AAEA,IAAM,kBAAkB,KAAe,SAAgC;CACrE,MAAM,SAAS,IAAI,IAAI,SAAS;CAChC,IAAI,OAAO,WAAW,YAAY,CAAC,QAAQ,OAAO;CAElD,KAAK,MAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;EACpC,MAAM,CAAC,QAAQ,GAAG,QAAQ,KAAK,MAAM,GAAG;EACxC,MAAM,MAAM,QAAQ,KAAK;EACzB,IAAI,CAAC,OAAO,QAAQ,MAAM;EAC1B,MAAM,WAAW,KAAK,KAAK,GAAG,CAAC,CAAC,KAAK;EACrC,IAAI,CAAC,UAAU,OAAO;EACtB,IAAI;GACF,OAAO,mBAAmB,QAAQ;EACpC,QAAQ;GACN,OAAO;EACT;CACF;CAEA,OAAO;AACT;AAEA,IAAM,sBAAsB,cAAsB;CAChD,IAAI,CAAC,UAAU,WAAW,GAAG,GAAG,OAAO;CACvC,IAAI,UAAU,WAAW,IAAI,GAAG,OAAO;CACvC,OAAO;AACT;AAEA,IAAM,oBAAoB,QAAkB;CAC1C,MAAM,cAAc,IAAI,IAAI,QAAQ;CACpC,MAAM,aAAa,IAAI,IAAI,QAAQ;CAEnC,MAAM,WAAW,OAAO,gBAAgB,WACpC,YAAY,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,IAC/B,IAAI,IAAI;CAEZ,MAAM,OAAO,OAAO,eAAe,WAC/B,WAAW,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,IAC9B,IAAI,IAAI,IAAI,MAAM;CAEtB,OAAO,YAAY,OAAO,GAAG,SAAQ,KAAM,SAAS;AACtD;AAEA,IAAM,uBAAuB,iBAAyB;CACpD,MAAM,UAAU,aAAa,KAAK;CAClC,OAAO,WAAW,mBAAmB,OAAO,IAAI,UAAU;AAC5D;AAEA,IAAM,eAAe,OAAO,QAC1B,MAAM,IAAI,SAAiB,SAAS,WAAW;CAC7C,IAAI,OAAO;CACX,IAAI,OAAO,IAAI,gBAAgB,YAC7B,IAAI,YAAY,MAAM;CAGxB,IAAI,GAAG,SAAS,UAAU;EACxB,QAAQ,OAAO,KAAK;EACpB,IAAI,KAAK,SAAS,OAChB,uBAAO,IAAI,MAAM,wBAAwB,CAAC;CAE9C,CAAC;CACD,IAAI,GAAG,aAAa,QAAQ,IAAI,CAAC;CACjC,IAAI,GAAG,SAAS,MAAM;AACxB,CAAC;AAEH,IAAM,oBAAoB,OAAO,QAA0D;CACzF,IAAI,IAAI,IAAI,WAAW,QAAQ,OAAO;CAGtC,IAAI,EADgB,OAAO,IAAI,IAAI,QAAQ,oBAAoB,WAAW,IAAI,IAAI,QAAQ,kBAAkB,GAAA,CAC3F,SAAS,mCAAmC,GAAG,OAAO;CAEvE,MAAM,OAAO,MAAM,aAAa,IAAI,GAAG;CACvC,MAAM,SAAS,IAAI,gBAAgB,IAAI;CAEvC,MAAM,SAAiC,CAAC;CACxC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,GACxC,OAAO,OAAO;CAGhB,OAAO;AACT;AAEA,IAAM,qBAAqB,KAAe,wBACvC,sBAAsB,OAAO,IAAI,IAAI,QAAQ,YAAY,EAAE,EAAA,CAAG,KAAK;AAEtE,IAAM,2CAA2B,IAAI,IAAI;CAAC;CAAa;CAAa;AAAa,CAAC;AAElF,IAAM,gCAAgC,UAAuD;CAC3F,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG,OAAO,KAAA;CAExE,MAAM,SAAiC,CAAC;CACxC,KAAK,MAAM,CAAC,QAAQ,aAAa,OAAO,QAAQ,KAAK,GAAG;EACtD,MAAM,MAAM,OAAO,KAAK;EACxB,IAAI,CAAC,KAAK;EACV,IAAI,yBAAyB,IAAI,GAAG,GAAG;EACvC,MAAM,MAAM,OAAO,aAAa,WAAW,SAAS,KAAK,IAAI;EAC7D,IAAI,CAAC,KAAK;EACV,OAAO,OAAO;CAChB;CAEA,OAAO,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS,SAAS,KAAA;AAC/C;AAMA,IAAa,2BAA2B,OAAO,EAC7C,KACA,YAAY,oBACZ,UACA,0BAM+B;CAC/B,MAAM,aAAa,kBAAkB,KAAK,kBAAkB;CAC5D,IAAI,CAAC,YACH,OAAO;EAAE,SAAS;EAAO,OAAO;EAAoB,YAAY;CAAI;CAGtE,IAAI,CAAC,sBAAsB,UAAU,GACnC,OAAO;EAAE,SAAS;EAAO,OAAO;EAAoB,YAAY;CAAI;CAGtE,MAAM,WAAW,uBAAuB,UAAU;CAClD,IAAI,CAAC,UACH,OAAO;EAAE,SAAS;EAAO,OAAO;EAAoB,YAAY;CAAI;CAGtE,MAAM,SAAS,iBAAiB,GAAG;CACnC,IAAI,CAAC,QACH,OAAO;EAAE,SAAS;EAAO,OAAO;EAAsB,YAAY;CAAI;CAExE,MAAM,UAAU,OAAO,WAAW,UAAU;CAE5C,MAAM,eAAe,oBAAoB,SAAS,YAAY;CAC9D,IAAI,CAAC,cACH,OAAO;EAAE,SAAS;EAAO,OAAO;EAAyB,YAAY;CAAI;CAG3E,MAAM,QAAQ,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK;CACnD,MAAM,EAAE,UAAU,cAAc,iBAAiB;CAEjD,MAAM,eAAe,OAAO,aAAa,YAAY,mBAAmB,QAAQ,IAAI,WAAW,KAAA;CAE/F,IAAI;EACF,MAAM,eAAe,MAAM,OAAO,UAAU,kBAAkB,GAAG;EACjE,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,aAAa,OAAO;GACxB,KAAK;GACL;GACA,cAAc;GACd,UAAU;GACV,WAAW;GACX,WAAW,IAAI,KAAK,IAAI,QAAQ,IAAI,oBAAoB;EAC1D,CAAC;CACH,SAAS,KAAK;EACZ,QAAQ,KAAK,kCAAkC,GAAG;EAClD,OAAO;GAAE,SAAS;GAAO,OAAO;GAA8B,YAAY;EAAI;CAChF;CAEA,IAAI;EACF,IAAI,IAAI,OAAO,yBAAyB,GAAG,WAAU,GAAI,SAAS;GAChE,UAAU;GACV,QAAQ;GACR,UAAU,UAAU,SAAS;GAC7B,MAAM;GACN,QAAQ;EACV,CAAC;CACH,SAAS,KAAK;EACZ,QAAQ,KAAK,qCAAqC,GAAG;EACrD,OAAO;GAAE,SAAS;GAAO,OAAO;GAA2B,YAAY;EAAI;CAC7E;CAEA,MAAM,OAAO,MAAM,iBAAiB,SAAS,MAAM;CACnD,MAAM,cAAc,GAAG,SAAS;CAEhC,MAAM,MAAM,IAAI,IAAI,KAAK,sBAAsB;CAC/C,IAAI,aAAa,IAAI,aAAa,SAAS,QAAQ;CACnD,IAAI,aAAa,IAAI,gBAAgB,WAAW;CAChD,IAAI,aAAa,IAAI,iBAAiB,MAAM;CAC5C,IAAI,aAAa,IAAI,SAAS,SAAS,KAAK;CAC5C,IAAI,aAAa,IAAI,SAAS,KAAK;CACnC,IAAI,aAAa,IAAI,kBAAkB,SAAS;CAChD,IAAI,aAAa,IAAI,yBAAyB,MAAM;CACpD,MAAM,2BAA2B,6BAA6B,mBAAmB;CACjF,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,4BAA4B,CAAC,CAAC,GAAG;EACzE,IAAI,IAAI,aAAa,IAAI,GAAG,GAAG;EAC/B,IAAI,aAAa,IAAI,KAAK,KAAK;CACjC;CAEA,OAAO;EAAE,SAAS;EAAM,aAAa,IAAI,SAAS;CAAE;AACtD;AA2BA,IAAM,8BAA8B;AACpC,IAAM,2BAA2B;AAEjC,IAAa,uBAAuB,OAAO,EACzC,KACA,YAAY,oBACZ,yBACA,yBACA,0BAOkC;CAClC,MAAM,aAAa,kBAAkB,KAAK,kBAAkB;CAC5D,IAAI,CAAC,YACH,OAAO;EAAE,SAAS;EAAO,MAAM;EAAS,OAAO;EAAoB,cAAc,GAAG,yBAAwB;CAA0B;CAGxI,IAAI,CAAC,sBAAsB,UAAU,GACnC,OAAO;EAAE,SAAS;EAAO,MAAM;EAAS,OAAO;EAAoB,cAAc,GAAG,yBAAwB;CAA0B;CAGxI,MAAM,WAAW,uBAAuB,UAAU;CAClD,IAAI,CAAC,UACH,OAAO;EAAE,SAAS;EAAO,MAAM;EAAS,OAAO;EAAoB,cAAc,GAAG,yBAAwB;CAA0B;CAGxI,MAAM,SAAS,iBAAiB,GAAG;CACnC,IAAI,CAAC,QACH,OAAO;EAAE,SAAS;EAAO,MAAM;EAAS,OAAO;EAAsB,cAAc,GAAG,yBAAwB;CAA4B;CAE5I,MAAM,UAAU,OAAO,WAAW,UAAU;CAE5C,MAAM,eAAe,oBAAoB,SAAS,YAAY;CAC9D,IAAI,CAAC,cACH,OAAO;EAAE,SAAS;EAAO,MAAM;EAAS,OAAO;EAAyB,cAAc,GAAG,yBAAwB;CAA+B;CAGlJ,MAAM,aAAa,MAAM,kBAAkB,GAAG;CAE9C,MAAM,QAAQ,eAAe,YAAY,IAAI,KAAK,eAAe,IAAI,IAAI,OAAO,IAAI,EAAA,EAAI,KAAK,KAAK;CAClG,MAAM,SAAS,eAAe,YAAY,KAAK,KAAK,eAAe,IAAI,IAAI,OAAO,KAAK,EAAA,EAAI,KAAK,KAAK;CACrG,MAAM,gBAAgB,eAAe,YAAY,IAAI,KAAK,eAAe,IAAI,IAAI,OAAO,IAAI,EAAA,EAAI,KAAK,KAAK;CAE1G,IAAI,CAAC,QAAQ,CAAC,OACZ,OAAO;EAAE,SAAS;EAAO,MAAM;EAAS,OAAO;EAAyB,cAAc,GAAG,yBAAwB;CAA+B;CAIlJ,IADyB,eAAe,KAAK,uBACzC,MAAqB,GAAG,WAAU,GAAI,SACxC,OAAO;EAAE,SAAS;EAAO,MAAM;EAAS,OAAO;EAAiB,cAAc,GAAG,yBAAwB;CAAuB;CAGlI,IAAI,eAA0C;CAC9C,IAAI,oBAAyE;CAC7E,IAAI;EACF,oBAAoB,MAAM,OAAO,UAAU,kBAAkB,GAAG;EAChE,eAAe,MAAM,kBAAkB,QAAQ;GAAE,KAAK;GAAO;EAAW,CAAC,CAAC,CAAC,KAAK;CAClF,SAAS,KAAK;EACZ,QAAQ,KAAK,iCAAiC,GAAG;EACjD,OAAO;GAAE,SAAS;GAAO,MAAM;GAAS,OAAO;GAA6B,cAAc,GAAG,yBAAwB;EAAmC;CAC1J;CAEA,IAAI,CAAC,cACH,OAAO;EAAE,SAAS;EAAO,MAAM;EAAS,OAAO;EAAiB,cAAc,GAAG,yBAAwB;CAAuB;CAGlI,MAAM,WAAW,OAAO,aAAa,aAAa,WAAW,aAAa,WAAW,KAAA;CACrF,MAAM,eAAe,OAAO,aAAa,iBAAiB,WAAW,aAAa,eAAe;CACjG,IAAI,CAAC,cACH,OAAO;EAAE,SAAS;EAAO,MAAM;EAAS,OAAO;EAAyB,cAAc,GAAG,yBAAwB;CAA+B;CAGlJ,MAAM,OAAO,MAAM,iBAAiB,SAAS,MAAM;CACnD,MAAM,cAAc,GAAG,SAAS;CAEhC,MAAM,YAAY,IAAI,gBAAgB;CACtC,UAAU,IAAI,cAAc,oBAAoB;CAChD,UAAU,IAAI,QAAQ,IAAI;CAC1B,UAAU,IAAI,gBAAgB,WAAW;CACzC,UAAU,IAAI,aAAa,SAAS,QAAQ;CAC5C,UAAU,IAAI,iBAAiB,YAAY;CAC3C,IAAI,SAAS,cACX,UAAU,IAAI,iBAAiB,SAAS,YAAY;CAGtD,MAAM,gBAAgB,MAAM,MAAM,KAAK,gBAAgB;EACrD,QAAQ;EACR,SAAS;GACP,gBAAgB;GAChB,QAAQ;EACV;EACA,MAAM,UAAU,SAAS;CAC3B,CAAC;CAED,MAAM,YAAY,MAAM,cAAc,KAAK,CAAC,CAAC,YAAY,IAAI;CAE7D,IAAI,CAAC,cAAc,MAAM,CAAC,aAAa,OAAO,cAAc,UAAU;EACpE,MAAM,OAAO,YAAY,KAAK,UAAU,SAAS,IAAI;EACrD,QAAQ,KAAK,gCAAgC,cAAc,QAAQ,IAAI;EACvE,OAAO;GAAE,SAAS;GAAO,MAAM;GAAS,OAAO;GAAyB,cAAc,GAAG,yBAAwB;EAA+B;CAClJ;CAEA,MAAM,cAAc,OAAO,UAAU,iBAAiB,WAAW,UAAU,eAAe;CAC1F,MAAM,eAAe,OAAO,UAAU,kBAAkB,WAAW,UAAU,gBAAgB,KAAA;CAC7F,MAAM,UAAU,OAAO,UAAU,aAAa,WAAW,UAAU,WAAW,KAAA;CAC9E,MAAM,QAAQ,OAAO,UAAU,UAAU,WAAW,UAAU,QAAQ,KAAA;CACtE,MAAM,YAAY,OAAO,UAAU,eAAe,WAAW,UAAU,aAAa,KAAA;CACpF,MAAM,YAAY,OAAO,UAAU,eAAe,WAC9C,UAAU,aACV,OAAO,UAAU,eAAe,WAC9B,OAAO,UAAU,UAAU,IAC3B,KAAA;CACN,MAAM,mBAAmB,OAAO,cAAc,YAAY,OAAO,SAAS,SAAS,IAAI,YAAY;CACnG,MAAM,YAAY,qBAAqB,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,mBAAmB,GAAI,IAAI,KAAA;CAE/F,IAAI,WAA2C;CAE/C,IAAI,KAAK,qBAAqB,aAAa;EACzC,MAAM,mBAAmB,MAAM,MAAM,KAAK,mBAAmB,EAC3D,SAAS;GACP,eAAe,UAAU;GACzB,QAAQ;EACV,EACF,CAAC;EAED,IAAI,iBAAiB,IACnB,WAAW,MAAM,iBAAiB,KAAK,CAAC,CAAC,YAAY,IAAI;CAE7D;CAEA,MAAM,iBAAiB,UAAU,iBAA0C,OAAO,IAAI;CACtF,MAAM,qBAAqB,iBAA0C,WAAW;CAEhF,MAAM,UAAU,OAAO,UAAU,QAAQ,WACrC,SAAS,MACT,OAAO,gBAAgB,QAAQ,WAC7B,eAAe,MACf,OAAO,oBAAoB,QAAQ,WACjC,mBAAmB,MACnB;CAER,IAAI,CAAC,SACH,OAAO;EAAE,SAAS;EAAO,MAAM;EAAS,OAAO;EAAmB,cAAc,GAAG,yBAAwB;CAAyB;CAGtI,MAAM,QAAQ,OAAO,UAAU,UAAU,WACrC,SAAS,QACT,OAAO,gBAAgB,UAAU,WAC/B,eAAe,QACf,KAAA;CAEN,MAAM,OAAO,OAAO,UAAU,SAAS,WACnC,SAAS,OACT,OAAO,gBAAgB,SAAS,WAC9B,eAAe,OACf,KAAA;CAEN,IAAI,YAAqB;CACzB,IAAI,cACF,IAAI;EACF,YAAY,KAAK,MAAM,YAAY;CACrC,QAAQ;EACN,YAAY;CACd;CAEF,MAAM,kBAAkB,aAAa,OAAO,cAAc,WACrD,YACD;CACJ,MAAM,iBAAiB,OAAO,iBAAiB,UAAU,WAAW,gBAAgB,MAAM,KAAK,IAAI;CACnG,MAAM,sBAAsB,iBAAiB,QAAQ,OAAO,gBAAgB,SAAS,WAChF,gBAAgB,OACjB;CAGJ,MAAM,gBAAgB,CAFK,OAAO,qBAAqB,cAAc,WAAW,oBAAoB,UAAU,KAAK,IAAI,IAC7F,OAAO,qBAAqB,aAAa,WAAW,oBAAoB,SAAS,KAAK,IAAI,EACxD,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK;CAE7F,MAAM,gBAAgB,UAAU,kBAAkB,KAAA;CAClD,MAAM,eAAe,SAAS,iBAAiB,KAAA;CAE/C,MAAM,CAAC,MAAM,UAAU,MAAM,QAAQ,IAAI,CACvC,OAAO,UAAU,UAAU,GAAG,GAC9B,OAAO,UAAU,YAAY,GAAG,CAAC,CAClC;CAED,MAAM,kBAAkB,kBAAkB,WAAU;CACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,GAAG,kBAAkB,QAAQ,CAAC;CAE5D,IAAI,CAAC,QAAQ,eACX,OAAO,MAAM,KAAK,QAAQ,EAAE,OAAO,cAAc,CAAC;CAIpD,IAAI,CAAC,QAAQ,EADY,2BAA2B,OACpB;EAC9B,MAAM,eAAe;EAErB,MAAM,SAA8B;GAClC,SAAS;GACT,MAAM;GACN;GACA;GACA,OAAO;GACP,MAAM;EACR;EAEA,IAAI,gBAAgB,mBAAmB,YAAY,GAAG;GACpD,MAAM,MAAM,IAAI,IAAI,cAAc,MAAM;GACxC,IAAI,aAAa,IAAI,kBAAkB,UAAU;GACjD,IAAI,eAAe,IAAI,aAAa,IAAI,SAAS,aAAa;GAC9D,IAAI,cAAc,IAAI,aAAa,IAAI,QAAQ,YAAY;GAC3D,OAAO,eAAe,GAAG,IAAI,WAAW,IAAI;EAC9C;EAEA,OAAO;CACT;CAEA,IAAI,CAAC,IAAI,IAAI,SACX,OAAO;EAAE,SAAS;EAAO,MAAM;EAAS,OAAO;EAAuB,cAAc,GAAG,yBAAwB;CAA6B;CAG9I,MAAM,sBAAM,IAAI,KAAK;CAErB,IAAI;CAEJ,MAAM,oBADiB,MAAM,IAAI,gBAAgB,EAAA,EACR,IAAI,UAAU;CACvD,IAAI,kBAAkB,qBAAqB,MACzC,oBAAoB,iBAAiB;CAGvC,MAAM,uBAAuB;EAC3B;EACA,OAAO;EACP,MAAM;EACN;EACA;EACA;EACA;EACA;EACA;EACA,aAAa,YAAY,KAAA;EACzB,WAAW,qBAAqB;EAChC,WAAW;CACb;CAEA,IAAI,CAAC,MAAM;EACT,MAAM,WAAW,OAAO,WAAW;EAGnC,OAAO,IAAI,KAAK;GACd,OAAO;GACP,MAAM;GACN,UAAA,MALqB,uBAAuB,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK,CAAC;GAMlF,SAAS,CAAC,QAAQ;GAClB,aAAa,GACV,WAAW,CAAC,OAAO,EACtB;GACA,gBAAgB,GACb,aAAa,qBAChB;EACF,CAAC;EAED,MAAM,KAAK,KAAK;EAEhB,IAAI;GACF,MAAM,wBAAwB,QAAQ;IACpC;IACA,MAAM,iBAAiB;GACzB,CAAC;EACH,SAAS,KAAK;GACZ,QAAQ,MAAM,sCAAsC,GAAG;GACvD,IAAI;IACF,MAAM,KAAK,UAAU,EAAE,KAAK,KAAK,IAAI,CAAC;GACxC,SAAS,eAAe;IACtB,QAAQ,MAAM,kCAAkC,aAAa;GAC/D;GACA,OAAO;IACL,SAAS;IACT,MAAM;IACN,OAAO;IACP,cAAc,GAAG,yBAAwB;GAC3C;EACF;CACF,OAAO;EACL,MAAM,YAAqC,GACxC,kBAAkB,eAAe,qBACpC;EAEA,IAAI,CAAC,KAAK,SAAS,eACjB,UAAU,QAAQ;EAGpB,IAAI,CAAC,KAAK,QAAQ,cAChB,UAAU,OAAO;EAGnB,MAAM,KAAK,UAAU,EAAE,KAAK,KAAK,IAAI,GAAG,EAAE,MAAM,UAAU,CAAC;CAC7D;CAEA,MAAM,mBAAmB,KAAK,WAAW,CAAA,EAAA,CAAI,IAAI,MAAM;CACvD,MAAM,WAAW,gBAAgB;CACjC,IAAI,CAAC,UACH,OAAO;EACL,SAAS;EACT,MAAM;EACN,OAAO;EACP,cAAc,GAAG,yBAAwB;CAC3C;CAEF,MAAM,iBAAiB,KAAK,IAAI,aAAa;CAC7C,MAAM,cAAc,iBAAiB,OAAO,YAAY,eAAe,QAAQ,CAAC,IAAI,KAAA;CAEpF,IAAI,CAAC,mBAAmB,KAAK;EAC3B,QAAQ,KAAK,IAAI,SAAS;EAC1B,iBAAiB;EACjB,iBAAiB,gBAAgB,SAAS,kBAAkB,CAAC,QAAQ;EACrE;CACF,CAAC,GACC,OAAO;EACL,SAAS;EACT,MAAM;EACN,OAAO;EACP,cAAc,GAAG,yBAAwB;CAC3C;CAGF,IAAI;EACF,IAAI,mBACF,MAAM,kBAAkB,UAAU;GAAE,KAAK;GAAO;EAAW,CAAC;CAEhE,SAAS,KAAK;EACZ,QAAQ,KAAK,mCAAmC,GAAG;CACrD;CAEA,IAAI;EACF,IAAI,IAAI,YAAY,yBAAyB;GAC3C,UAAU;GACV,QAAQ;GACR,UAAU,UAAU,SAAS;GAC7B,MAAM;EACR,CAAC;CACH,SAAS,KAAK;EACZ,QAAQ,KAAK,uCAAuC,GAAG;CACzD;CAQA,OAAO;EACL,SAAS;EACT,MAAM;EACN,cATmB,YAAY,mBAAmB,QAAQ,IACxD,WACA,uBAAuB,mBAAmB,mBAAmB,IAC3D,sBACA;EAMJ,QAAQ,KAAK,IAAI,SAAS;EAC1B;EACA,iBAAiB,gBAAgB,SAAS,kBAAkB,CAAC,QAAQ;CACvE;AACF;AAEA,IAAa,2BAA2B,EACtC,YACA,2BAIE,CAAC,MAAkF,OACrF,UACA,QACG;CACH,MAAM,qBAAqB,kBAAkB,KAAK,UAAU;CAC5D,MAAM,8BAA8B,sBAAsB,yBACtD,uBAAuB,kBAAkB,IACzC,KAAA;CACJ,MAAM,WAAW,eAAe,IAAI,IAAI,OAAO,QAAQ,CAAC,EAAE,KAAK;CAC/D,MAAM,SAAS,MAAM,yBAAyB;EAC5C;EACA,YAAY;EACZ;EACA,qBAAqB;CACvB,CAAC;CAED,IAAI,CAAC,OAAO,SAAS;EACnB,IAAI,IAAI,OAAO,OAAO,UAAU;EAChC,OAAO;GAAE,SAAS;GAAO,OAAO,OAAO;EAAM;CAC/C;CAEA,IAAI,IAAI,SAAS,OAAO,WAAW;CACnC,OAAO,EAAE,SAAS,KAAK;AACzB;AAEA,IAAa,8BAA8B,EACzC,YACA,yBACA,yBACA,wBAME,CAAC,MAAkF,OACrF,UACA,QACG;CACH,MAAM,SAAS,MAAM,qBAAqB;EACxC;EACA;EACA;EACA;EACA;CACF,CAAC;CAED,IAAI,OAAO,SAAS,SAAS;EAC3B,IAAI,IAAI,SAAS,OAAO,YAAY;EACpC,OAAO;GAAE,SAAS;GAAO,OAAO,OAAO;EAAM;CAC/C;CAEA,IAAI,OAAO,SAAS,gBAAgB;EAClC,IAAI,OAAO,cACT,IAAI,IAAI,SAAS,OAAO,YAAY;OAEpC,IAAI,IAAI,SAAS,eAAe;EAElC,OAAO;GAAE,SAAS;GAAO,OAAO;EAAiB;CACnD;CAEA,IAAI,IAAI,SAAS,OAAO,YAAY;CACpC,OAAO,EAAE,SAAS,KAAK;AACzB;AAEA,IAAM,mBAAmB,UACvB,OAAO,KAAK,KAAK,CAAC,CACf,SAAS,QAAQ,CAAC,CAClB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,QAAQ,EAAE;AAEvB,IAAa,2BAA2B,EACtC,QACA,UACA,OACA,eACA,sBAAM,IAAI,KAAK,GACf,mBAAmB,UAQf;CACJ,MAAM,cAAc,OAAO,KAAK;CAChC,MAAM,gBAAgB,SAAS,KAAK;CACpC,MAAM,aAAa,MAAM,KAAK;CAC9B,MAAM,qBAAqB,cAAc,KAAK;CAE9C,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,oBAAoB;CACtD,IAAI,CAAC,eAAe,MAAM,IAAI,MAAM,sBAAsB;CAC1D,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,mBAAmB;CACpD,IAAI,CAAC,oBAAoB,MAAM,IAAI,MAAM,2BAA2B;CAEpE,MAAM,aAAa,KAAK,MAAM,IAAI,QAAQ,IAAI,GAAI;CAElD,MAAM,MAAM,aAAa,KAAK,IAAI,IAAI,KAAK,IADzB,OAAO,SAAS,gBAAgB,IAAI,mBAAmB,KACf,OAAkB,CAAC;CAE7E,MAAM,SAAS;EAAE,KAAK;EAAS,KAAK;EAAY,KAAK;CAAM;CAC3D,MAAM,UAAU;EACd,KAAK;EACL,KAAK;EACL;EACA,KAAK;EACL,KAAK;CACP;CAEA,MAAM,eAAe,GAAG,gBAAgB,KAAK,UAAU,MAAM,CAAC,EAAC,GAAI,gBAAgB,KAAK,UAAU,OAAO,CAAC;CAM1G,OAAO,GAAG,aAAY,GAAI,gBALR,OAAO,KAAK,UAAU,OAAO,KAAK,YAAY,GAAG;EACjE,KAAK;EACL,aAAa;CACf,CAE0C,CAAS;AACrD"}

package/dist/routes.js

@@ -1,15 +1,15 @@
 //#region src/routes.ts
 var routes = Object.entries({ .../* #__PURE__ */ Object.assign({
-	"./api/me/handler.ts": () => import("./handler-W_XZ0lnx.js"),
-	"./api/request-password-reset/handler.ts": () => import("./handler-BY6DP3QP.js"),
-	"./api/resend-otp/handler.ts": () => import("./handler-Dw3o3smk.js"),
-	"./api/set-active-account/handler.ts": () => import("./handler-J2FOxq-2.js"),
-	"./api/set-new-password/handler.ts": () => import("./handler-DoyR_l2O.js"),
-	"./api/sign-in/handler.ts": () => import("./handler-DH9FPTNh.js"),
-	"./api/sign-out/handler.ts": () => import("./handler-DQvdRpG2.js"),
-	"./api/sign-up/handler.ts": () => import("./handler-DetFi4-9.js"),
-	"./api/verify-otp/handler.ts": () => import("./handler-DAKI9QOQ.js"),
-	"./api/verify-password-reset-otp/handler.ts": () => import("./handler-DAfIloZR.js")
+	"./api/me/handler.ts": () => import("./handler-BgjYCWF4.js"),
+	"./api/request-password-reset/handler.ts": () => import("./handler-Dbw6BOmj.js"),
+	"./api/resend-otp/handler.ts": () => import("./handler-B1Z9YpER.js"),
+	"./api/set-active-account/handler.ts": () => import("./handler-CF3fSh8e.js"),
+	"./api/set-new-password/handler.ts": () => import("./handler-DgIcxthg.js"),
+	"./api/sign-in/handler.ts": () => import("./handler-D4ui5jV4.js"),
+	"./api/sign-out/handler.ts": () => import("./handler-DBbjgU-f.js"),
+	"./api/sign-up/handler.ts": () => import("./handler-BkZLC8Bg.js"),
+	"./api/verify-otp/handler.ts": () => import("./handler-1Jy7G8dM.js"),
+	"./api/verify-password-reset-otp/handler.ts": () => import("./handler-iT2eSHpE.js")
 }) }).reduce((acc, [path, mod]) => {
 	acc[path.replace("./api/", "@rpcbase/auth/api/")] = mod;
 	return acc;

package/dist/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","names":["routes","Object","entries","import","meta","glob","reduce","Record","acc","path","mod","replace"],"sources":["../src/routes.ts"],"sourcesContent":["export const routes = Object.entries({\n  ...import.meta.glob(\"./api/**/handler.ts\"),\n}).reduce<Record<string, unknown>>((acc, [path, mod]) => {\n  // re-add package name in front of the path so we know which are the framework routes vs app routes\n  acc[path.replace(\"./api/\", \"@rpcbase/auth/api/\")] = mod\n  return acc\n}, {})\n"],"mappings":";AAAA,IAAaA,SAASC,OAAOC,QAAQ,EACnC,GAAGC,uBAAAA,OAAAA;CAAAA,6BAAAA,OAAAA;CAAAA,iDAAAA,OAAAA;CAAAA,qCAAAA,OAAAA;CAAAA,6CAAAA,OAAAA;CAAAA,2CAAAA,OAAAA;CAAAA,kCAAAA,OAAAA;CAAAA,mCAAAA,OAAAA;CAAAA,kCAAAA,OAAAA;CAAAA,qCAAAA,OAAAA;CAAAA,oDAAAA,OAAAA;AAAAA,CAAAA,EACL,CAAC,CAAC,CAACG,QAAiCE,KAAK,CAACC,MAAMC,SAAS;CAEvDF,IAAIC,KAAKE,QAAQ,UAAU,oBAAoB,KAAKD;CACpD,OAAOF;AACT,GAAG,CAAC,CAAC"}
+{"version":3,"file":"routes.js","names":[],"sources":["../src/routes.ts"],"sourcesContent":["export const routes = Object.entries({\n  ...import.meta.glob(\"./api/**/handler.ts\"),\n}).reduce<Record<string, unknown>>((acc, [path, mod]) => {\n  // re-add package name in front of the path so we know which are the framework routes vs app routes\n  acc[path.replace(\"./api/\", \"@rpcbase/auth/api/\")] = mod\n  return acc\n}, {})\n"],"mappings":";AAAA,IAAa,SAAS,OAAO,QAAQ,EACnC,GAAG,uBAAA,OAAA;CAAA,6BAAA,OAAA;CAAA,iDAAA,OAAA;CAAA,qCAAA,OAAA;CAAA,6CAAA,OAAA;CAAA,2CAAA,OAAA;CAAA,kCAAA,OAAA;CAAA,mCAAA,OAAA;CAAA,kCAAA,OAAA;CAAA,qCAAA,OAAA;CAAA,oDAAA,OAAA;AAAA,CAAA,EACL,CAAC,CAAC,CAAC,QAAiC,KAAK,CAAC,MAAM,SAAS;CAEvD,IAAI,KAAK,QAAQ,UAAU,oBAAoB,KAAK;CACpD,OAAO;AACT,GAAG,CAAC,CAAC"}

package/dist/{schemas-BgOpQqUv.js → schemas-CMgO_xn9.js}

@@ -73,7 +73,6 @@ function cached(getter) {
 			Object.defineProperty(this, "value", { value });
 			return value;
 		}
-		throw new Error("cached value already set");
 	} };
 }
 function nullish(input) {
@@ -628,8 +627,10 @@ var $ZodCheckLessThan = /*@__PURE__*/ $constructor("$ZodCheckLessThan", (inst, d
 	inst._zod.onattach.push((inst) => {
 		const bag = inst._zod.bag;
 		const curr = (def.inclusive ? bag.maximum : bag.exclusiveMaximum) ?? Number.POSITIVE_INFINITY;
-		if (def.value < curr) if (def.inclusive) bag.maximum = def.value;
-		else bag.exclusiveMaximum = def.value;
+		if (def.value < curr) {
+			if (def.inclusive) bag.maximum = def.value;
+			else bag.exclusiveMaximum = def.value;
+		}
 	});
 	inst._zod.check = (payload) => {
 		if (def.inclusive ? payload.value <= def.value : payload.value < def.value) return;
@@ -650,8 +651,10 @@ var $ZodCheckGreaterThan = /*@__PURE__*/ $constructor("$ZodCheckGreaterThan", (i
 	inst._zod.onattach.push((inst) => {
 		const bag = inst._zod.bag;
 		const curr = (def.inclusive ? bag.minimum : bag.exclusiveMinimum) ?? Number.NEGATIVE_INFINITY;
-		if (def.value > curr) if (def.inclusive) bag.minimum = def.value;
-		else bag.exclusiveMinimum = def.value;
+		if (def.value > curr) {
+			if (def.inclusive) bag.minimum = def.value;
+			else bag.exclusiveMinimum = def.value;
+		}
 	});
 	inst._zod.check = (payload) => {
 		if (def.inclusive ? payload.value >= def.value : payload.value > def.value) return;
@@ -1553,13 +1556,13 @@ var $ZodObject = /*@__PURE__*/ $constructor("$ZodObject", (inst, def) => {
 		}
 		return propValues;
 	});
-	const isObject$2 = isObject;
+	const isObject$1 = isObject;
 	const catchall = def.catchall;
 	let value;
 	inst._zod.parse = (payload, ctx) => {
 		value ?? (value = _normalized.value);
 		const input = payload.value;
-		if (!isObject$2(input)) {
+		if (!isObject$1(input)) {
 			payload.issues.push({
 				expected: "object",
 				code: "invalid_type",
@@ -1682,7 +1685,7 @@ var $ZodObjectJIT = /*@__PURE__*/ $constructor("$ZodObjectJIT", (inst, def) => {
 		return (payload, ctx) => fn(shape, payload, ctx);
 	};
 	let fastpass;
-	const isObject$1 = isObject;
+	const isObject$2 = isObject;
 	const jit = !globalConfig.jitless;
 	const fastEnabled = jit && allowsEval.value;
 	const catchall = def.catchall;
@@ -1690,7 +1693,7 @@ var $ZodObjectJIT = /*@__PURE__*/ $constructor("$ZodObjectJIT", (inst, def) => {
 	inst._zod.parse = (payload, ctx) => {
 		value ?? (value = _normalized.value);
 		const input = payload.value;
-		if (!isObject$1(input)) {
+		if (!isObject$2(input)) {
 			payload.issues.push({
 				expected: "object",
 				code: "invalid_type",
@@ -2877,8 +2880,10 @@ function finalize(ctx, schema) {
 			defs[seen.defId] = seen.def;
 		}
 	}
-	if (ctx.external) {} else if (Object.keys(defs).length > 0) if (ctx.target === "draft-2020-12") result.$defs = defs;
-	else result.definitions = defs;
+	if (ctx.external) {} else if (Object.keys(defs).length > 0) {
+		if (ctx.target === "draft-2020-12") result.$defs = defs;
+		else result.definitions = defs;
+	}
 	try {
 		const finalized = JSON.parse(JSON.stringify(result));
 		Object.defineProperty(finalized, "~standard", {
@@ -2991,16 +2996,18 @@ var numberProcessor = (schema, ctx, _json, _params) => {
 	const exMin = typeof exclusiveMinimum === "number" && exclusiveMinimum >= (minimum ?? Number.NEGATIVE_INFINITY);
 	const exMax = typeof exclusiveMaximum === "number" && exclusiveMaximum <= (maximum ?? Number.POSITIVE_INFINITY);
 	const legacy = ctx.target === "draft-04" || ctx.target === "openapi-3.0";
-	if (exMin) if (legacy) {
-		json.minimum = exclusiveMinimum;
-		json.exclusiveMinimum = true;
-	} else json.exclusiveMinimum = exclusiveMinimum;
-	else if (typeof minimum === "number") json.minimum = minimum;
-	if (exMax) if (legacy) {
-		json.maximum = exclusiveMaximum;
-		json.exclusiveMaximum = true;
-	} else json.exclusiveMaximum = exclusiveMaximum;
-	else if (typeof maximum === "number") json.maximum = maximum;
+	if (exMin) {
+		if (legacy) {
+			json.minimum = exclusiveMinimum;
+			json.exclusiveMinimum = true;
+		} else json.exclusiveMinimum = exclusiveMinimum;
+	} else if (typeof minimum === "number") json.minimum = minimum;
+	if (exMax) {
+		if (legacy) {
+			json.maximum = exclusiveMaximum;
+			json.exclusiveMaximum = true;
+		} else json.exclusiveMaximum = exclusiveMaximum;
+	} else if (typeof maximum === "number") json.maximum = maximum;
 	if (typeof multipleOf === "number") json.multipleOf = multipleOf;
 };
 var booleanProcessor = (_schema, _ctx, json, _params) => {
@@ -3985,4 +3992,4 @@ function superRefine(fn, params) {
 //#endregion
 export { string as a, object as i, boolean as n, number as r, array as t };
 
-//# sourceMappingURL=schemas-BgOpQqUv.js.map
+//# sourceMappingURL=schemas-CMgO_xn9.js.map