@rttnd/gau 0.7.4 → 1.0.0

package/README.md

@@ -22,7 +22,7 @@ Check out the [`packages`](https://github.com/Rettend/gau/tree/main/packages) fo
 
 - `example-sveltekit`: SvelteKit + Turso
 - `example-sveltekit-tauri`: SvelteKit + Turso + Tauri (desktop)
-- `example-sveltekit-tauri-mobile`: SvelteKit + Turso + Tauri (mobile and desktop)
+- `example-sveltekit-tauri-mobile`: SvelteKit + Turso + Tauri (mobile and desktop) - **Note:** Mobile support is WIP. See [ANDROID_MOBILE_ANALYSIS.md](./ANDROID_MOBILE_ANALYSIS.md) for details.
 - `example-solidstart`: SolidStart + Turso
 - `example-bun`: Bun.serve
 - `example-elysia`: Elysia

package/dist/chunk-MDLJ5TF4.js

@@ -0,0 +1 @@
+import{createJWTSignatureMessage as e,encodeJWT as t,JWSRegisteredHeaders as r,JWTRegisteredClaims as n,parseJWT as o}from"@oslojs/jwt";import{parse as s,serialize as i}from"cookie";var a={path:"/",sameSite:"lax",secure:!0,httpOnly:!0};function l(e){const t=new Map;if(e){const r=s(e);for(const e in r)t.set(e,r[e])}return t}var c=class{constructor(e,t){this.requestCookies=e,this.defaultOptions=t}#e=[];get(e){return this.requestCookies.get(e)}set(e,t,r){const n={...this.defaultOptions,...r};this.#e.push([e,t,n])}delete(e,t){this.set(e,"",{...t,expires:new Date(0),maxAge:0})}toHeaders(){const e=new Headers;for(const[t,r,n]of this.#e)e.append("Set-Cookie",i(t,r,n));return e}},u="__gau-csrf-token",d="__gau-session-token",f="__gau-session-strategy",h="__gau-linking-token",p="__gau-pkce-code-verifier",g="__gau-callback-uri",w="__gau-provider-options",m=600;function y({adapter:e,providers:t,basePath:r="/api/auth",jwt:n={},session:o={},cookies:s={},onOAuthExchange:i,mapExternalProfile:l,onBeforeLinkAccount:c,onAfterLinkAccount:u,trustHosts:d=[],autoLink:f="verifiedEmail",allowDifferentEmails:h=!0,updateUserInfoOnLink:p=!1,roles:g={},cors:w=!0,profiles:m}){const{algorithm:y="ES256",secret:k,iss:v,aud:A,ttl:S=86400}=n,T={...a,...s},E=o.strategy??"auto";if("ES256"===y&&void 0!==k&&"string"!=typeof k)throw new R("For ES256, the secret option must be a string.");const U=new Map(t.map(e=>[e.id,e])),b=!1!==w&&{allowedOrigins:(!0===w?"all":w.allowedOrigins)??"all",allowCredentials:(!0===w||w.allowCredentials)??!0,allowedHeaders:(!0===w?void 0:w.allowedHeaders)??["Content-Type","Authorization","Cookie"],allowedMethods:(!0===w?void 0:w.allowedMethods)??["GET","POST","OPTIONS"],exposeHeaders:!0===w?void 0:w.exposeHeaders,maxAge:!0===w?void 0:w.maxAge},x=m??{},C={defaultRole:g.defaultRole??"user",resolveOnCreate:g.resolveOnCreate,adminRoles:g.adminRoles??["admin"],adminUserIds:g.adminUserIds??[]};async function H(e,t={}){return N(e,function(e={}){const t={ttl:e.ttl,iss:e.iss??v,aud:e.aud??A,sub:e.sub};if("HS256"===y)return{algorithm:y,secret:e.secret??k,...t};{if(void 0!==e.secret&&"string"!=typeof e.secret)throw new R("For ES256, the secret option must be a string.");const r=e.secret??k;return{algorithm:y,privateKey:e.privateKey,secret:r,...t}}}(t))}async function O(e,t={}){const r=function(e={}){const t={iss:e.iss??v,aud:e.aud??A};if("HS256"===y)return{algorithm:y,secret:e.secret??k,...t};{if(void 0!==e.secret&&"string"!=typeof e.secret)throw new R("For ES256, the secret option must be a string.");const r=e.secret??k;return{algorithm:y,publicKey:e.publicKey,secret:r,...t}}}(t);try{return await B(e,r)}catch{return null}}return{...e,providerMap:U,basePath:r,cookieOptions:T,jwt:{ttl:S},onOAuthExchange:i,mapExternalProfile:l,onBeforeLinkAccount:c,onAfterLinkAccount:u,signJWT:H,verifyJWT:O,createSession:async function(e,t={},r=S){return H({sub:e,...t},{ttl:r})},validateSession:async function(t){const r=await O(t);if(!r)return null;const n=await e.getUserAndAccounts(r.sub);if(!n)return null;const{user:o,accounts:s}=n,i=Boolean(o&&(o.role&&C.adminRoles.includes(o.role)||C.adminUserIds.length>0&&C.adminUserIds.includes(o.id)));return{user:o?{...o,isAdmin:i}:null,session:{id:t,...r},accounts:s}},getAccessToken:async function(t,r){const n=U.get(r);if(!n)return null;const o=(await e.getAccounts(t)).find(e=>e.provider===r);if(!o||!o.accessToken)return null;const s=Math.floor(Date.now()/1e3);if(!("number"==typeof o.expiresAt&&o.expiresAt<=s))return{accessToken:o.accessToken,expiresAt:o.expiresAt??null};if(!o.refreshToken||!n.refreshAccessToken)return null;try{const r=await n.refreshAccessToken(o.refreshToken,{}),s={userId:t,provider:o.provider,providerAccountId:o.providerAccountId,accessToken:r.accessToken??o.accessToken,refreshToken:r.refreshToken??o.refreshToken,expiresAt:r.expiresAt??null,idToken:r.idToken??o.idToken??null,tokenType:r.tokenType??o.tokenType??null,scope:r.scope??o.scope??null};return await(e.updateAccount?.(s)),{accessToken:s.accessToken,expiresAt:s.expiresAt}}catch{return null}},trustHosts:d,autoLink:f,allowDifferentEmails:h,profiles:x,updateUserInfoOnLink:p,sessionStrategy:E,development:!1,roles:C,cors:b}}async function k(e,t){if(e&&"function"==typeof e.onAfterLinkAccount)try{await e.onAfterLinkAccount(t)}catch(e){console.error("onAfterLinkAccount hook error:",e)}}async function v(e,t,r){const n=t.providerMap.get(r);if(!n)return j({error:"Provider not found"},{status:400});const o=new URL(e.url),s=o.searchParams.get("code"),i=o.searchParams.get("state");if(!s||!i)return j({error:"Missing code or state"},{status:400});const a=l(e.headers.get("Cookie")),f=new c(a,t.cookieOptions);let m,y="/";if(i.includes(".")){const[e,t]=i.split(".");m=e;try{y=atob(t??"")||"/"}catch{y="/"}}else m=i;const v=f.get(u);if(!v||v!==m)return j({error:"Invalid CSRF token"},{status:403});const A=f.get(p);if(!A)return j({error:"Missing PKCE code verifier"},{status:400});const S=f.get(g),T=f.get(w);let E;if(T)try{const e=atob(T),t=JSON.parse(e);E=t?.overrides}catch{}const U=f.get(h);U&&f.delete(h);const b=!!U;if(b){if(!await t.validateSession(U)){f.delete(u),f.delete(p),S&&f.delete(g),f.delete(w);const e=V(y);return f.toHeaders().forEach((t,r)=>e.headers.append(r,t)),e}}const{user:x,tokens:C}=await n.validateCallback(s,A,S??void 0,E);{const n=b?await t.validateSession(U):null,o=await async function(e,t){if(!e||"function"!=typeof e.onOAuthExchange)return{handled:!1};try{const r=await e.onOAuthExchange(t);return r&&"object"==typeof r?r:{handled:!1}}catch(e){return console.error("onOAuthExchange hook error:",e),{handled:!1}}}(t,{request:e,providerId:r,state:i,code:s,codeVerifier:A,callbackUri:S,redirectTo:y,cookies:f,providerUser:x,tokens:C,isLinking:b,sessionUserId:n?.user?.id});if(o.handled){f.delete(u),f.delete(p),S&&f.delete(g),f.delete(w);const e=o.response;return f.toHeaders().forEach((t,r)=>e.headers.append(r,t)),e}}const H=await async function(e,t){if(!e||"function"!=typeof e.mapExternalProfile)return t.providerUser;try{const r=await e.mapExternalProfile(t);return r?{...t.providerUser,...r}:t.providerUser}catch(e){return console.error("mapExternalProfile hook error:",e),t.providerUser}}(t,{request:e,providerId:r,providerUser:x,tokens:C,isLinking:b});if(!b&&!0===t.providerMap.get(r)?.linkOnly){f.delete(u),f.delete(p),S&&f.delete(g),f.delete(w);const e=j({error:"Sign-in with this provider is disabled. Please link it to an existing account."},{status:400});return f.toHeaders().forEach((t,r)=>e.headers.append(r,t)),e}let O=null;const I=await t.getUserByAccount(r,H.id);if(b){if(O=(await t.validateSession(U)).user,!O)return j({error:"User not found"},{status:404});if(I&&I.id!==O.id)return j({error:"Account already linked to another user"},{status:409});if(!1===t.allowDifferentEmails){const e=O.email,t=H.email;if(e&&t&&e!==t)return j({error:"Email mismatch between existing account and provider"},{status:400})}if(O){const e={id:O.id};let r=!1;if(t.updateUserInfoOnLink?(H.name&&H.name!==O.name&&(e.name=H.name,r=!0),H.avatar&&H.avatar!==O.image&&(e.image=H.avatar,r=!0)):(!O.name&&H.name&&(e.name=H.name,r=!0),!O.image&&H.avatar&&(e.image=H.avatar,r=!0)),O.email&&H.email&&O.email===H.email&&!0===H.emailVerified&&(!O.emailVerified||t.updateUserInfoOnLink)&&(e.emailVerified=!0,r=!0),r)try{O=await t.updateUser(e)}catch(e){console.error("Failed to update user info on link:",e)}}}else O=I;if(!O){const n=t.autoLink??"verifiedEmail";if(H.email&&("always"===n||"verifiedEmail"===n&&!0===H.emailVerified)){const e=await t.getUserByEmail(H.email);e&&(O=H.emailVerified&&!e.emailVerified?await t.updateUser({id:e.id,emailVerified:!0}):e)}if(!O)try{if(H.email&&!0===H.emailVerified&&!1===t.autoLink){if(await t.getUserByEmail(H.email))return j({error:"An account with this email already exists. Sign in with the existing method or link the provider."},{status:409})}let n;try{n=t.roles.resolveOnCreate?.({providerId:r,profile:H,request:e})}catch(e){console.error("roles.resolveOnCreate threw:",e)}const o=!0===H.emailVerified?H.email:null;O=await t.createUser({name:H.name,email:o,image:H.avatar,emailVerified:H.emailVerified,role:n??t.roles.defaultRole})}catch(e){return console.error("Failed to create user:",e),j({error:"Failed to create user"},{status:500})}}if(O&&H.email){const{email:e,emailVerified:r}=O,{email:n,emailVerified:o}=H,s={id:O.id};let i=!1;if(e||!0!==o?e!==n||!0!==o||r||(s.emailVerified=!0,i=!0):(s.email=n,s.emailVerified=!0,i=!0),i)try{O=await t.updateUser(s)}catch(e){console.error("Failed to update user after sign-in:",e)}}if(I)try{const n=(await t.getAccounts(O.id)).find(e=>e.provider===r&&e.providerAccountId===H.id);if(n&&t.updateAccount){let o,s,i,a;try{o=C.refreshToken()}catch{o=n.refreshToken??null}try{const e=C.accessTokenExpiresAt();e&&(s=Math.floor(e.getTime()/1e3))}catch{s=n.expiresAt??void 0}try{i=C.idToken()}catch{i=n.idToken??null}try{a=C.scopes()?.join(" ")??n.scope??null}catch{a=n.scope??null}await t.updateAccount({userId:O.id,provider:r,providerAccountId:H.id,accessToken:C.accessToken()??n.accessToken??void 0,refreshToken:o,expiresAt:s??n.expiresAt??void 0,tokenType:C.tokenType?.()??n.tokenType??null,scope:a,idToken:i}),await k(t,{request:e,providerId:r,userId:O.id,providerUser:H,tokens:C,action:"update"})}}catch(e){console.error("Failed to update account tokens on sign-in:",e)}else{let n,o,s;try{n=C.refreshToken()}catch{n=null}try{const e=C.accessTokenExpiresAt();e&&(o=Math.floor(e.getTime()/1e3))}catch{}try{s=C.idToken()}catch{s=null}{const n=await async function(e,t){if(!e||"function"!=typeof e.onBeforeLinkAccount)return{allow:!0};try{return await e.onBeforeLinkAccount(t)||{allow:!0}}catch(e){return console.error("onBeforeLinkAccount hook error:",e),{allow:!0}}}(t,{request:e,providerId:r,userId:O.id,providerUser:H,tokens:C});if(!1===n.allow){const e=n.response??j({error:"Linking not allowed"},{status:403});return f.toHeaders().forEach((t,r)=>e.headers.append(r,t)),e}}try{let i;try{i=C.scopes()?.join(" ")??null}catch{i=null}await t.linkAccount({userId:O.id,provider:r,providerAccountId:H.id,accessToken:C.accessToken(),refreshToken:n,expiresAt:o,tokenType:C.tokenType?.()??null,scope:i,idToken:s}),await k(t,{request:e,providerId:r,userId:O.id,providerUser:H,tokens:C,action:"link"})}catch(e){return console.error("Error linking account:",e),j({error:"Failed to link account"},{status:500})}}const L=await t.createSession(O.id),P=new URL(e.url),M=new URL(y,e.url),R="token"===t.sessionStrategy,F="cookie"===t.sessionStrategy,N="http:"!==M.protocol&&"https:"!==M.protocol,B=P.host!==M.host;if(R||!F&&(N||B)){const e=new URL(M);e.hash=`token=${L}`;const t=`<!DOCTYPE html>\n<html lang="en">\n<head>\n  <meta charset="utf-8" />\n  <title>Authentication Complete</title>\n  <style>\n    body {\n      font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";\n      background-color: #09090b;\n      color: #fafafa;\n      display: flex;\n      justify-content: center;\n      align-items: center;\n      height: 100vh;\n      margin: 0;\n      text-align: center;\n    }\n    .card {\n      background-color: #18181b;\n      border: 1px solid #27272a;\n      border-radius: 0.75rem;\n      padding: 2rem;\n      max-width: 320px;\n    }\n    h1 {\n      font-size: 1.25rem;\n      font-weight: 600;\n      margin: 0 0 0.5rem;\n    }\n    p {\n      margin: 0;\n      color: #a1a1aa;\n    }\n  </style>\n  <script>\n    window.onload = function() {\n      const url = ${JSON.stringify(e.toString())};\n      window.location.href = url;\n      setTimeout(window.close, 500);\n    };\n  <\/script>\n</head>\n<body>\n  <div class="card">\n    <h1>Authentication Successful</h1>\n    <p>You can now close this window.</p>\n  </div>\n</body>\n</html>`;f.delete(u),f.delete(p),S&&f.delete(g),f.delete(w);const r=new Response(t,{status:200,headers:{"Content-Type":"text/html; charset=utf-8"}});return f.toHeaders().forEach((e,t)=>{r.headers.append(t,e)}),r}f.set(d,L,{maxAge:t.jwt.ttl,sameSite:t.development?"lax":"none",secure:!t.development}),f.delete(u),f.delete(p),S&&f.delete(g),f.delete(w);let K;if("false"===o.searchParams.get("redirect")){const e=await t.getAccounts(O.id),r=Boolean(O.role&&t.roles.adminRoles.includes(O.role)||t.roles.adminUserIds.includes(O.id));K=j({user:{...O,isAdmin:r,accounts:e}})}else K=V(y);return f.toHeaders().forEach((e,t)=>{K.headers.append(t,e)}),K}function A(e,t){if(!1===t.cors)return!1;const r=t.cors;if("all"===r.allowedOrigins)return!0;if("trust"===r.allowedOrigins){if("all"===t.trustHosts)return!0;try{const r=new URL(e);return t.trustHosts.includes(r.host)||t.trustHosts.includes(r.hostname)}catch{return!1}}if(r.allowedOrigins.includes("*"))return!0;try{const t=new URL(e);return r.allowedOrigins.includes(e)||r.allowedOrigins.includes(t.origin)||r.allowedOrigins.includes(t.host)||r.allowedOrigins.includes(t.hostname)}catch{return r.allowedOrigins.includes(e)}}function S(e,t,r){if(!1===r.cors)return t;const n=e.headers.get("Origin")||e.headers.get("origin");if(!n)return t;if(!A(n,r))return t;const o=r.cors;t.headers.set("Vary","Origin");const s=o.allowCredentials,i="all"!==o.allowedOrigins||s?n:"*";return t.headers.set("Access-Control-Allow-Origin",i),s&&t.headers.set("Access-Control-Allow-Credentials","true"),t.headers.set("Access-Control-Allow-Headers",o.allowedHeaders.join(", ")),t.headers.set("Access-Control-Allow-Methods",o.allowedMethods.join(", ")),o.exposeHeaders?.length&&t.headers.set("Access-Control-Expose-Headers",o.exposeHeaders.join(", ")),t}function T(e,t){if(!1===t.cors)return new Response(null,{status:204});const r=e.headers.get("Origin")||e.headers.get("origin"),n=t.cors,o={};if(r&&A(r,t)){const e=n.allowCredentials,t="all"!==n.allowedOrigins||e?r:"*";o["Access-Control-Allow-Origin"]=t,e&&(o["Access-Control-Allow-Credentials"]="true")}return o["Access-Control-Allow-Headers"]=n.allowedHeaders.join(", "),o["Access-Control-Allow-Methods"]=n.allowedMethods.join(", "),null!=n.maxAge&&(o["Access-Control-Max-Age"]=String(n.maxAge)),n.exposeHeaders?.length&&(o["Access-Control-Expose-Headers"]=n.exposeHeaders.join(", ")),new Response(null,{status:204,headers:o})}import{generateCodeVerifier as E,generateState as U}from"arctic";function b(e,t,r){if("all"===t)return!0;const n=e.headers.get("origin");if(!n)return!1;let o;try{o=new URL(n).host}catch{return!1}if(r){if(o.startsWith("localhost")||o.startsWith("127.0.0.1"))return!0}const s=new URL(e.url),i=s.host;return n===`${s.protocol}//${i}`||t.includes(o)}async function x(e,t,r,n){const o=t.providerMap.get(r);if(!o)return j({error:"Provider not found"},{status:400});const{state:s,codeVerifier:i}={state:U(),codeVerifier:E()},a=new URL(e.url),d=a.searchParams.get("redirectTo"),f=a.searchParams.get("profile"),m=a.searchParams.get("prompt");if(d){let r;try{if(d.startsWith("//"))throw new Error("Protocol-relative URL not allowed");r=new URL(d,a.origin)}catch{return j({error:'Invalid "redirectTo" URL'},{status:400})}const n=r.host,o=n===new URL(e.url).host,s="all"===t.trustHosts||t.trustHosts.includes(n);if(("http:"===r.protocol||"https:"===r.protocol)&&!o&&!s)return j({error:"Untrusted redirect host"},{status:400})}const y=d?`${s}.${btoa(d)}`:s;let k,v,A,S,T=a.searchParams.get("callbackUri");if(!T&&o.requiresRedirectUri&&(T=`${a.origin}${t.basePath}/callback/${r}`),f){const e=(t.profiles?.[r]??{})[f];if(!e)return j({error:`Unknown profile "${f}" for provider "${r}"`},{status:400});e.redirectUri&&(T=e.redirectUri),e.scopes&&(k=e.scopes),e.params&&(v={...e.params??{}});const{tenant:o,prompt:s}=e;if(null==o&&null==s||(A={...A??{},tenant:o,prompt:s}),!n&&!0===e.linkOnly)return j({error:"This profile is link-only. Please link it to an existing account."},{status:400})}if(m&&(v={...v??{},prompt:m}),!n&&!0===o.linkOnly)return j({error:"Sign-in with this provider is disabled. Please link it to an existing account."},{status:400});try{S=await o.getAuthorizationUrl(y,i,{redirectUri:T??void 0,scopes:k,params:v,overrides:A})}catch(e){console.error("Error getting authorization URL:",e),S=null}if(!S)return j({error:"Could not create authorization URL"},{status:500});const b=l(e.headers.get("Cookie")),x=new c(b,t.cookieOptions),C={maxAge:600,sameSite:t.development?"lax":"none",secure:!t.development};x.set(u,s,C),x.set(p,i,C),n?x.set(h,n,C):x.delete(h,{sameSite:t.development?"lax":"none",secure:!t.development}),T&&x.set(g,T,C);const H=JSON.stringify({params:v??{},overrides:A??{}});x.set(w,btoa(H),C);if("false"===a.searchParams.get("redirect")){const e=j({url:S.toString()});return x.toHeaders().forEach((t,r)=>{e.headers.append(r,t)}),e}const O=V(S.toString());return x.toHeaders().forEach((e,t)=>{O.headers.append(t,e)}),O}async function C(e,t,r){const n=new URL(e.url);let o=l(e.headers.get("Cookie")).get(d);if(!o){const t=e.headers.get("Authorization");t?.startsWith("Bearer ")&&(o=t.substring(7))}if(o||(o=n.searchParams.get("token")??void 0),!o)return j({error:"Unauthorized"},{status:401});if(!await t.validateSession(o))return j({error:"Unauthorized"},{status:401});n.searchParams.delete("token");return x(new Request(n.toString(),e),t,r,o)}async function H(e,t,r){let n=l(e.headers.get("Cookie")).get(d);if(!n){const t=e.headers.get("Authorization");t?.startsWith("Bearer ")&&(n=t.substring(7))}if(!n)return j({error:"Unauthorized"},{status:401});const o=await t.validateSession(n);if(!o||!o.user)return j({error:"Unauthorized"},{status:401});const s=o.accounts??[];if(s.length<=1)return j({error:"Cannot unlink the last account"},{status:400});const i=s.find(e=>e.provider===r);if(!i)return j({error:`Provider "${r}" not linked to this account`},{status:400});await t.unlinkAccount(r,i.providerAccountId);if((await t.getAccounts(o.user.id)).length>0&&o.user.email)try{await t.updateUser({id:o.user.id,email:null,emailVerified:!1})}catch(e){console.error("Failed to clear stale email after unlinking:",e)}return j({message:"Account unlinked successfully"})}async function O(e,t,r){return x(e,t,r,null)}async function I(e,t){const r=l(e.headers.get("Cookie")),n=new c(r,t.cookieOptions);n.delete(d,{sameSite:t.development?"lax":"none",secure:!t.development}),n.delete(h,{sameSite:t.development?"lax":"none",secure:!t.development});const o=j({message:"Signed out"});return n.toHeaders().forEach((e,t)=>{o.headers.append(t,e)}),o}async function L(e,t){let r=l(e.headers.get("Cookie")).get(d);if(!r){const t=e.headers.get("Authorization");t?.startsWith("Bearer ")&&(r=t.substring(7))}const n=Array.from(t.providerMap.keys());if(!r)return j({...M,providers:n});try{const e=await t.validateSession(r);return e?j({...e,providers:n}):j({...M,providers:n},{status:401})}catch(e){return console.error("Error validating session:",e),j({error:"Failed to validate session"},{status:500})}}function P(e){const{basePath:t}=e;return async function(r){if("OPTIONS"===r.method)return T(r,e);const n=new URL(r.url);if(!n.pathname.startsWith(t))return S(r,j({error:"Not Found"},{status:404}),e);if("POST"===r.method&&!b(r,e.trustHosts,e.development)){if(e.development){const t=r.headers.get("origin")??"N/A";return S(r,j({error:"Forbidden",message:`Untrusted origin: '${t}'. Add this origin to 'trustHosts' in createAuth() or ensure you are using 'localhost' or '127.0.0.1' for development.`},{status:403}),e)}return S(r,j({error:"Forbidden"},{status:403}),e)}const o=n.pathname.substring(t.length).split("/").filter(Boolean),s=o[0];if(!s)return S(r,j({error:"Not Found"},{status:404}),e);let i;i="GET"===r.method?"session"===s?await L(r,e):2===o.length&&"link"===o[0]?await C(r,e,o[1]):2===o.length&&"callback"===o[0]?await v(r,e,o[1]):1===o.length?await O(r,e,s):j({error:"Not Found"},{status:404}):"POST"===r.method?1===o.length&&"signout"===s?await I(r,e):2===o.length&&"unlink"===o[0]?await H(r,e,o[1]):j({error:"Not Found"},{status:404}):j({error:"Method Not Allowed"},{status:405});try{i.headers.set("Cache-Control","no-store, private"),i.headers.set("Pragma","no-cache"),i.headers.set("Expires","0")}catch{}return S(r,i,e)}}var M={user:null,session:null,accounts:null},R=class extends Error{cause;constructor(e,t){super(e),this.name="AuthError",this.cause=t}};function j(e,t={}){const r=new Headers(t.headers);return r.has("Content-Type")||r.set("Content-Type","application/json; charset=utf-8"),new Response(JSON.stringify(e),{...t,headers:r})}function V(e,t=302){return new Response(null,{status:t,headers:{Location:e}})}async function F(e){try{const t=function(e){const t=e.replace(/-/g,"+").replace(/_/g,"/"),r=(4-t.length%4)%4,n=t.padEnd(t.length+r,"=");try{const e=atob(n),t=e.length,r=new Uint8Array(t);for(let n=0;n<t;n++)r[n]=e.charCodeAt(n);return r}catch{throw new R("Invalid base64url string")}}(e),r=await crypto.subtle.importKey("pkcs8",t.slice(),{name:"ECDSA",namedCurve:"P-256"},!0,["sign"]),n=await crypto.subtle.exportKey("jwk",r);delete n.d,n.key_ops=["verify"];return{privateKey:r,publicKey:await crypto.subtle.importKey("jwk",n,{name:"ECDSA",namedCurve:"P-256"},!0,["verify"])}}catch(e){if(e instanceof R)throw e;throw new R("Invalid secret. Must be a base64url-encoded PKCS#8 private key for ES256. Use `bunx gau secret` to generate one.",e)}}async function N(r,n={}){let{algorithm:o="ES256",ttl:s,iss:i,aud:a,sub:l,privateKey:c,secret:u}=n;if("ES256"===o){if(!c){if("string"!=typeof u)throw new R("Missing secret for ES256 signing. It must be a base64url-encoded string.");({privateKey:c}=await F(u))}}else if("HS256"===o&&!u)throw new R("Missing secret for HS256 signing");const d=Math.floor(Date.now()/1e3),f={iat:d,iss:i,aud:a,sub:l,...r};null!=s&&s>0&&(f.exp=d+s);const h="HS256"===o,p=h?"HS256":"ES256",g=JSON.stringify({alg:p,typ:"JWT"}),w=JSON.stringify(f),m=e(g,w);let y;if(h){const e="string"==typeof u?(new TextEncoder).encode(u):u,t=await crypto.subtle.importKey("raw",e,{name:"HMAC",hash:"SHA-256"},!1,["sign"]);y=new Uint8Array(await crypto.subtle.sign("HMAC",t,m))}else y=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},c,m));return t(g,w,y)}async function B(e,t){let{algorithm:s="ES256",publicKey:i,secret:a,iss:l,aud:c}=t;if("ES256"===s&&!i){if("string"!=typeof a)throw new R("Missing secret for ES256 verification. Must be a base64url-encoded string.");({publicKey:i}=await F(a))}if("HS256"===s&&!a)throw new R("Missing secret for HS256 verification");const[u,d,f,h]=o(e),p=new r(u).algorithm();let g=!1;if("HS256"===s){if("HS256"!==p)throw new Error(`JWT algorithm is "${p}", but verifier was configured for "HS256"`);const e="string"==typeof a?(new TextEncoder).encode(a):a,t=await crypto.subtle.importKey("raw",e,{name:"HMAC",hash:"SHA-256"},!1,["sign"]);g=function(e,t){let r=e.length^t.length;const n=Math.max(e.length,t.length);for(let o=0;o<n;o++)r|=(e[o]??0)^(t[o]??0);return 0===r}(new Uint8Array(await crypto.subtle.sign("HMAC",t,h)),new Uint8Array(f))}else{if("ES256"!==p)throw new R(`JWT algorithm is "${p}", but verifier was configured for "ES256"`);const e=new Uint8Array(f);if(g=await crypto.subtle.verify({name:"ECDSA",hash:"SHA-256"},i,e,h),!g&&64===e.length)try{const t=function(e){if(64!==e.length)throw new Error("Invalid raw signature length");let t=e.slice(0,32),r=e.slice(32),n=0;for(;n<t.length-1&&0===t[n];)n++;t=t.slice(n);let o=0;for(;o<r.length-1&&0===r[o];)o++;if(r=r.slice(o),t.length>0&&128&t[0]){const e=new Uint8Array(t.length+1);e[0]=0,e.set(t,1),t=e}if(r.length>0&&128&r[0]){const e=new Uint8Array(r.length+1);e[0]=0,e.set(r,1),r=e}const s=t.length,i=r.length,a=2+s+2+i,l=new Uint8Array(2+a);return l[0]=48,l[1]=a,l[2]=2,l[3]=s,l.set(t,4),l[4+s]=2,l[5+s]=i,l.set(r,6+s),l}(e);g=await crypto.subtle.verify({name:"ECDSA",hash:"SHA-256"},i,t,h)}catch{g=!1}}if(!g)throw new R("Invalid JWT signature");const w=new n(d);if(w.hasExpiration()&&!w.verifyExpiration())throw new R("JWT expired");if(w.hasNotBefore()&&!w.verifyNotBefore())throw new R("JWT not yet valid");if(l&&d.iss!==l)throw new R("Invalid JWT issuer");if(c){const e=Array.isArray(c)?c:[c],t=d.aud?Array.isArray(d.aud)?d.aud:[d.aud]:[];if(!e.some(e=>t.includes(e)))throw new R("Invalid JWT audience")}return d}export{a as DEFAULT_COOKIE_SERIALIZE_OPTIONS,l as parseCookies,c as Cookies,u as CSRF_COOKIE_NAME,d as SESSION_COOKIE_NAME,f as SESSION_STRATEGY_COOKIE_NAME,h as LINKING_TOKEN_COOKIE_NAME,p as PKCE_COOKIE_NAME,g as CALLBACK_URI_COOKIE_NAME,w as PROVIDER_OPTIONS_COOKIE_NAME,m as CSRF_MAX_AGE,N as sign,B as verify,y as createAuth,v as handleCallback,S as applyCors,T as handlePreflight,b as verifyRequestOrigin,C as handleLink,H as handleUnlink,O as handleSignIn,I as handleSignOut,L as handleSession,P as createHandler,M as NULL_SESSION,R as AuthError,j as json,V as redirect};//# sourceMappingURL=chunk-MDLJ5TF4.js.map

package/dist/chunk-MDLJ5TF4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/jwt/jwt.ts","../src/core/cookies.ts","../src/core/createAuth.ts","../src/core/hooks.ts","../src/core/handlers/callback.ts","../src/core/handlers/cors.ts","../src/oauth/utils.ts","../src/core/handlers/utils.ts","../src/core/handlers/link.ts","../src/core/handlers/login.ts","../src/core/handlers/session.ts","../src/core/handler.ts","../src/core/index.ts","../src/jwt/utils.ts"],"sourcesContent":["/// <reference types=\"node\" />\nimport {\n  createJWTSignatureMessage,\n  encodeJWT,\n  JWSRegisteredHeaders,\n  JWTRegisteredClaims,\n  parseJWT,\n} from '@oslojs/jwt'\nimport { AuthError } from '../core/index'\nimport { constantTimeEqual, deriveKeysFromSecret, rawToDer } from './utils'\n\nexport type SupportedAlgorithm = 'ES256' | 'HS256'\n\ninterface CommonSignOptions {\n  /** Time-to-live in seconds (exp claim). If omitted the token will not expire. */\n  ttl?: number\n}\n\nexport type SignOptions\n  = | ({ algorithm?: 'ES256', privateKey?: CryptoKey, secret?: string }\n    & CommonSignOptions & { iss?: string, aud?: string | string[], sub?: string })\n  | ({ algorithm: 'HS256', secret?: string | Uint8Array, privateKey?: never }\n    & CommonSignOptions & { iss?: string, aud?: string | string[], sub?: string })\n\n/**\n * Create a signed JWT.\n * Defaults to ES256 when a privateKey is supplied. Falls back to HS256 when a secret is supplied.\n */\nexport async function sign<T extends Record<string, unknown>>(payload: T, options: SignOptions = {}): Promise<string> {\n  let { algorithm = 'ES256', ttl, iss, aud, sub, privateKey, secret } = options\n\n  if (algorithm === 'ES256') {\n    if (!privateKey) {\n      if (typeof secret !== 'string')\n        throw new AuthError('Missing secret for ES256 signing. It must be a base64url-encoded string.');\n\n      ({ privateKey } = await deriveKeysFromSecret(secret))\n    }\n  }\n  else if (algorithm === 'HS256' && !secret) {\n    throw new AuthError('Missing secret for HS256 signing')\n  }\n\n  const now = Math.floor(Date.now() / 1000)\n\n  const jwtPayload: Record<string, unknown> = { iat: now, iss, aud, sub, ...payload }\n\n  if (ttl != null && ttl > 0)\n    jwtPayload.exp = now + ttl\n\n  const isHS256 = algorithm === 'HS256'\n  const alg: SupportedAlgorithm = isHS256 ? 'HS256' : 'ES256'\n\n  const headerJSON = JSON.stringify({ alg, typ: 'JWT' })\n  const payloadJSON = JSON.stringify(jwtPayload)\n\n  const signatureMessage = createJWTSignatureMessage(headerJSON, payloadJSON)\n\n  let signature: Uint8Array\n\n  if (isHS256) {\n    // HS256 (HMAC-SHA256)\n    const secretBytes = typeof secret === 'string'\n      ? new TextEncoder().encode(secret)\n      : secret\n\n    const cryptoKey = await crypto.subtle.importKey(\n      'raw',\n      secretBytes as BufferSource,\n      { name: 'HMAC', hash: 'SHA-256' },\n      false,\n      ['sign'],\n    )\n\n    signature = new Uint8Array(await crypto.subtle.sign('HMAC', cryptoKey, signatureMessage as BufferSource))\n  }\n  else {\n    // ES256 (ECDSA-SHA256)\n    // Runtimes like Bun's return the raw (r||s) signature directly, not DER-encoded.\n    signature = new Uint8Array(\n      await crypto.subtle.sign(\n        { name: 'ECDSA', hash: 'SHA-256' },\n        privateKey!,\n        signatureMessage as BufferSource,\n      ),\n    )\n  }\n\n  return encodeJWT(headerJSON, payloadJSON, signature)\n}\n\nexport type VerifyOptions\n  = | { algorithm?: 'ES256', publicKey?: CryptoKey, secret?: string, iss?: string, aud?: string | string[] }\n    | { algorithm: 'HS256', secret?: string | Uint8Array, publicKey?: never, iss?: string, aud?: string | string[] }\n\n/**\n * Verify a JWT and return its payload when the signature is valid.\n * The algorithm is inferred from options – ES256 by default.\n * Throws when verification fails or the token is expired.\n */\nexport async function verify<T = Record<string, unknown>>(token: string, options: VerifyOptions): Promise<T> {\n  let { algorithm = 'ES256', publicKey, secret, iss, aud } = options\n\n  if (algorithm === 'ES256') {\n    if (!publicKey) {\n      if (typeof secret !== 'string')\n        throw new AuthError('Missing secret for ES256 verification. Must be a base64url-encoded string.');\n\n      ({ publicKey } = await deriveKeysFromSecret(secret))\n    }\n  }\n\n  if (algorithm === 'HS256' && !secret)\n    throw new AuthError('Missing secret for HS256 verification')\n\n  const [header, payload, signature, signatureMessage] = parseJWT(token)\n\n  const headerParams = new JWSRegisteredHeaders(header)\n  const headerAlg = headerParams.algorithm()\n\n  let validSignature = false\n\n  // HS256 verification path\n  if (algorithm === 'HS256') {\n    if (headerAlg !== 'HS256')\n      throw new Error(`JWT algorithm is \"${headerAlg}\", but verifier was configured for \"HS256\"`)\n\n    const secretBytes = typeof secret === 'string'\n      ? new TextEncoder().encode(secret)\n      : secret\n\n    const cryptoKey = await crypto.subtle.importKey(\n      'raw',\n      secretBytes as BufferSource,\n      { name: 'HMAC', hash: 'SHA-256' },\n      false,\n      ['sign'],\n    )\n\n    const expectedSig = new Uint8Array(await crypto.subtle.sign('HMAC', cryptoKey, signatureMessage as BufferSource))\n    validSignature = constantTimeEqual(expectedSig, new Uint8Array(signature))\n  }\n  // ES256 verification path (default)\n  else {\n    if (headerAlg !== 'ES256')\n      throw new AuthError(`JWT algorithm is \"${headerAlg}\", but verifier was configured for \"ES256\"`)\n\n    const signatureBytes = new Uint8Array(signature)\n\n    // Runtimes like Node.js return DER-encoded signatures. Others (Bun) return raw (r||s).\n    // We try DER first, as it's more common in Node environments.\n    validSignature = await crypto.subtle.verify(\n      { name: 'ECDSA', hash: 'SHA-256' },\n      publicKey!,\n      signatureBytes as BufferSource,\n      signatureMessage as BufferSource,\n    )\n\n    if (!validSignature && signatureBytes.length === 64) {\n      // If DER verification fails and the signature is 64 bytes, it might be a raw signature.\n      // Convert it to DER and try again.\n      try {\n        const derSig = rawToDer(signatureBytes)\n        validSignature = await crypto.subtle.verify(\n          { name: 'ECDSA', hash: 'SHA-256' },\n          publicKey!,\n          derSig as BufferSource,\n          signatureMessage as BufferSource,\n        )\n      }\n      catch {\n        // rawToDer can throw if the signature is not 64 bytes, but we already checked.\n        // This catch is for other unexpected errors.\n        validSignature = false\n      }\n    }\n  }\n\n  if (!validSignature)\n    throw new AuthError('Invalid JWT signature')\n\n  const claims = new JWTRegisteredClaims(payload)\n  if (claims.hasExpiration() && !claims.verifyExpiration())\n    throw new AuthError('JWT expired')\n  if (claims.hasNotBefore() && !claims.verifyNotBefore())\n    throw new AuthError('JWT not yet valid')\n  if (iss && (payload as any).iss !== iss)\n    throw new AuthError('Invalid JWT issuer')\n\n  if (aud) {\n    const expectedAudience = Array.isArray(aud) ? aud : [aud]\n    const tokenAudience = (payload as any).aud\n      ? (Array.isArray((payload as any).aud) ? (payload as any).aud : [(payload as any).aud])\n      : []\n\n    if (!expectedAudience.some(audValue => tokenAudience.includes(audValue)))\n      throw new AuthError('Invalid JWT audience')\n  }\n\n  return payload as T\n}\n","import type { SerializeOptions } from 'cookie'\nimport { parse, serialize } from 'cookie'\n\nexport const DEFAULT_COOKIE_SERIALIZE_OPTIONS: SerializeOptions = {\n  path: '/',\n  sameSite: 'lax',\n  secure: true,\n  httpOnly: true,\n}\n\nexport type Cookie = [string, string, SerializeOptions]\n\nexport function parseCookies(cookieHeader: string | null | undefined): Map<string, string> {\n  const cookies = new Map<string, string>()\n  if (cookieHeader) {\n    const parsed = parse(cookieHeader)\n    for (const name in parsed)\n      cookies.set(name, parsed[name]!)\n  }\n  return cookies\n}\n\nexport class Cookies {\n  #new: Cookie[] = []\n\n  constructor(\n    private readonly requestCookies: Map<string, string>,\n    private readonly defaultOptions: SerializeOptions,\n  ) {}\n\n  get(name: string): string | undefined {\n    return this.requestCookies.get(name)\n  }\n\n  set(name: string, value: string, options?: SerializeOptions): void {\n    const combinedOptions = { ...this.defaultOptions, ...options }\n    this.#new.push([name, value, combinedOptions])\n  }\n\n  delete(name: string, options?: Omit<SerializeOptions, 'expires' | 'maxAge'>): void {\n    this.set(name, '', { ...options, expires: new Date(0), maxAge: 0 })\n  }\n\n  toHeaders(): Headers {\n    const headers = new Headers()\n    for (const [name, value, options] of this.#new)\n      headers.append('Set-Cookie', serialize(name, value, options))\n\n    return headers\n  }\n}\n\nexport const CSRF_COOKIE_NAME = '__gau-csrf-token'\nexport const SESSION_COOKIE_NAME = '__gau-session-token'\nexport const SESSION_STRATEGY_COOKIE_NAME = '__gau-session-strategy'\nexport const LINKING_TOKEN_COOKIE_NAME = '__gau-linking-token'\nexport const PKCE_COOKIE_NAME = '__gau-pkce-code-verifier'\nexport const CALLBACK_URI_COOKIE_NAME = '__gau-callback-uri'\nexport const PROVIDER_OPTIONS_COOKIE_NAME = '__gau-provider-options'\n\nexport const CSRF_MAX_AGE = 60 * 10 // 10 minutes\n","import type { OAuth2Tokens } from 'arctic'\nimport type { SerializeOptions } from 'cookie'\nimport type { SignOptions, VerifyOptions } from '../jwt'\nimport type { AuthUser, OAuthProvider, OAuthProviderConfig, ProviderProfileOverrides } from '../oauth'\nimport type { Cookies } from './cookies'\nimport type { Adapter, GauSession } from './index'\nimport { sign, verify } from '../jwt'\nimport { DEFAULT_COOKIE_SERIALIZE_OPTIONS } from './cookies'\nimport { AuthError } from './index'\n\ntype ProviderId<P> = P extends OAuthProvider<infer T> ? T : never\nexport type ProviderIds<T> = T extends { providerMap: Map<infer K extends string, any> } ? K : string\n\nexport type ProfileName<T, P extends string> = T extends { profiles: infer R }\n  ? P extends keyof R\n    ? keyof R[P]\n    : never\n  : never\n\nexport interface CreateAuthOptions<TProviders extends OAuthProvider[]> {\n  /** The database adapter to use for storing users and accounts. */\n  adapter: Adapter\n  /** Array of OAuth providers to support. */\n  providers: TProviders\n  /** Base path for authentication routes (defaults to '/api/auth'). */\n  basePath?: string\n  /** Session management options */\n  session?: {\n    /** Strategy to use for sessions: 'auto' (default), 'cookie', or 'token'. */\n    strategy?: 'auto' | 'cookie' | 'token'\n  }\n  /** Configuration for JWT signing and verification. */\n  jwt?: {\n    /** Signing algorithm: 'ES256' (default) or 'HS256'. */\n    algorithm?: 'ES256' | 'HS256'\n    /** Secret for HS256 or base64url-encoded private key for ES256 (overrides AUTH_SECRET). */\n    secret?: string\n    /** Issuer claim (iss) for JWTs. */\n    iss?: string\n    /** Audience claim (aud) for JWTs. */\n    aud?: string\n    /** Default time-to-live in seconds for JWTs (defaults to 1 day). */\n    ttl?: number\n  }\n  /** Custom options for session cookies. */\n  cookies?: Partial<SerializeOptions>\n  /**\n   * Hook that fires right after provider.validateCallback() returns tokens,\n   * but before any user lookup/link/create logic. Return { handled: true, response }\n   * to short-circuit the default flow and send a custom response.\n   */\n  onOAuthExchange?: (context: {\n    request: Request\n    providerId: string\n    state: string\n    code: string\n    codeVerifier: string\n    callbackUri?: string | null\n    redirectTo: string\n    cookies: Cookies\n    providerUser: AuthUser\n    tokens: OAuth2Tokens\n    isLinking: boolean\n    sessionUserId?: string\n  }) => Promise<{ handled: true, response: Response } | { handled: false }>\n  /** Map/override the provider's profile right after token exchange. */\n  mapExternalProfile?: (context: {\n    request: Request\n    providerId: string\n    providerUser: AuthUser\n    tokens: OAuth2Tokens\n    isLinking: boolean\n  }) => Promise<AuthUser | Partial<AuthUser> | null | undefined>\n  /** Gate the link action just before persisting an account. */\n  onBeforeLinkAccount?: (context: {\n    request: Request\n    providerId: string\n    userId: string\n    providerUser: AuthUser\n    tokens: OAuth2Tokens\n  }) => Promise<{ allow: true } | { allow: false, response?: Response }>\n  /** Observe or augment after link/update tokens. */\n  onAfterLinkAccount?: (context: {\n    request: Request\n    providerId: string\n    userId: string\n    providerUser: AuthUser\n    tokens: OAuth2Tokens\n    action: 'link' | 'update'\n  }) => Promise<void>\n  /** Trusted hosts for CSRF protection: 'all' or array of hostnames (defaults to []). */\n  trustHosts?: 'all' | string[]\n  /** Account linking behavior: 'verifiedEmail' (default), 'always', or false. */\n  autoLink?: 'verifiedEmail' | 'always' | false\n  /** Allow linking providers whose primary emails differ from the user's current primary email. Defaults to true. */\n  allowDifferentEmails?: boolean\n  /** When linking a new provider, update missing user info (name/image/emailVerified) from provider profile. Defaults to false. */\n  updateUserInfoOnLink?: boolean\n  /** Optional configuration for role-based access control. */\n  roles?: {\n    /** Default role for newly created users. */\n    defaultRole?: string\n    /** Dynamically resolve the role at the moment of user creation. Return undefined to fall back to defaultRole. */\n    resolveOnCreate?: (context: { providerId: string, profile: any, request: Request }) => string | undefined\n    /** Roles that are considered admin-like for helper predicates and `session.user.isAdmin`. */\n    adminRoles?: string[]\n    /** Users that are always treated as admin for helper predicates and `session.user.isAdmin`. */\n    adminUserIds?: string[]\n  }\n  /**\n   * CORS configuration. When true (default): request Origin & allow credentials\n   * When false, CORS headers are not added at all.\n   * Provide an object to fine-tune behaviour.\n   */\n  cors?: true | false | {\n    /**\n     * Allowed origins.\n     * - 'all' (default) allows any origin (reflected when credentials enabled),\n     * - 'trust' reuses the createAuth trustHosts list\n     * - specify an explicit array of full origins (e.g. https://app.example.com)\n     *   or hostnames (e.g. app.example.com).\n     * When array contains '*', it's treated as 'all'.\n     */\n    allowedOrigins?: 'all' | 'trust' | string[]\n    /** Whether to send Access-Control-Allow-Credentials (defaults to true). */\n    allowCredentials?: boolean\n    /** Allowed headers (defaults to ['Content-Type','Authorization','Cookie']). */\n    allowedHeaders?: string[]\n    /** Allowed methods (defaults to ['GET','POST','OPTIONS']). */\n    allowedMethods?: string[]\n    /** Exposed headers (optional). */\n    exposeHeaders?: string[]\n    /** Preflight max age in seconds (optional). */\n    maxAge?: number\n  }\n  /**\n   * Named, server-defined profiles that group provider specific settings.\n   * Clients can reference a profile by name (e.g. signIn('github', { profile: 'myprofile' })).\n   */\n  profiles?: ProfilesConfig<TProviders>\n}\n\nexport type Auth<TProviders extends OAuthProvider[] = any> = Adapter & {\n  providerMap: Map<ProviderId<TProviders[number]>, TProviders[number]>\n  basePath: string\n  cookieOptions: SerializeOptions\n  jwt: { ttl: number }\n  onOAuthExchange?: CreateAuthOptions<TProviders>['onOAuthExchange']\n  mapExternalProfile?: CreateAuthOptions<TProviders>['mapExternalProfile']\n  onBeforeLinkAccount?: CreateAuthOptions<TProviders>['onBeforeLinkAccount']\n  onAfterLinkAccount?: CreateAuthOptions<TProviders>['onAfterLinkAccount']\n  signJWT: <U extends Record<string, unknown>>(payload: U, customOptions?: Partial<SignOptions>) => Promise<string>\n  verifyJWT: <U = Record<string, unknown>>(token: string, customOptions?: Partial<VerifyOptions>) => Promise<U | null>\n  createSession: (userId: string, data?: Record<string, unknown>, ttl?: number) => Promise<string>\n  validateSession: (token: string) => Promise<GauSession | null>\n  /**\n   * Get a valid access token for a linked provider. If the stored token is expired and a refresh token exists,\n   * this will refresh it using the provider's refreshAccessToken and persist rotated tokens.\n   */\n  getAccessToken: (userId: string, providerId: string) => Promise<{ accessToken: string, expiresAt?: number | null } | null>\n  trustHosts: 'all' | string[]\n  autoLink: 'verifiedEmail' | 'always' | false\n  allowDifferentEmails: boolean\n  updateUserInfoOnLink: boolean\n  sessionStrategy: 'auto' | 'cookie' | 'token'\n  development: boolean\n  roles: {\n    defaultRole: string\n    resolveOnCreate?: (context: { providerId: string, profile: any, request: Request }) => string | undefined\n    adminRoles: string[]\n    adminUserIds: string[]\n  }\n  cors: false | {\n    allowedOrigins: 'all' | 'trust' | string[]\n    allowCredentials: boolean\n    allowedHeaders: string[]\n    allowedMethods: string[]\n    exposeHeaders?: string[]\n    maxAge?: number\n  }\n  profiles: ResolvedProfiles<TProviders>\n}\n\nexport interface ProfileDefinition {\n  scopes?: string[]\n  redirectUri?: string\n  /** When true, this profile can only be linked to an existing session; standalone sign-in is disabled. */\n  linkOnly?: boolean\n  /** Additional provider-specific authorization params. */\n  params?: Record<string, string>\n}\n\ntype ProviderIdOfArray<TProviders extends OAuthProvider[]> = ProviderId<TProviders[number]>\ntype ProviderConfigFor<TProviders extends OAuthProvider[], K extends string>\n  = Extract<TProviders[number], OAuthProvider<K, any>> extends OAuthProvider<any, infer C> ? C : OAuthProviderConfig\n\nexport type ProfilesConfig<TProviders extends OAuthProvider[]> = Partial<{\n  [K in ProviderIdOfArray<TProviders>]: Record<string, ProfileDefinition & ProviderProfileOverrides<ProviderConfigFor<TProviders, K>>>\n}>\nexport type ResolvedProfiles<TProviders extends OAuthProvider[]> = ProfilesConfig<TProviders>\n\nexport function createAuth<const TProviders extends OAuthProvider[]>({\n  adapter,\n  providers,\n  basePath = '/api/auth',\n  jwt: jwtConfig = {},\n  session: sessionConfig = {},\n  cookies: cookieConfig = {},\n  onOAuthExchange,\n  mapExternalProfile,\n  onBeforeLinkAccount,\n  onAfterLinkAccount,\n  trustHosts = [],\n  autoLink = 'verifiedEmail',\n  allowDifferentEmails = true,\n  updateUserInfoOnLink = false,\n  roles: rolesConfig = {},\n  cors = true,\n  profiles: profilesConfig,\n}: CreateAuthOptions<TProviders>): Auth<TProviders> {\n  const { algorithm = 'ES256', secret, iss, aud, ttl: defaultTTL = 3600 * 24 } = jwtConfig\n  const cookieOptions = { ...DEFAULT_COOKIE_SERIALIZE_OPTIONS, ...cookieConfig }\n\n  const sessionStrategy: 'auto' | 'cookie' | 'token' = sessionConfig.strategy ?? 'auto'\n\n  if (algorithm === 'ES256' && secret !== undefined && typeof secret !== 'string')\n    throw new AuthError('For ES256, the secret option must be a string.')\n\n  const providerMap = new Map(providers.map(p => [p.id, p]))\n\n  const resolvedCors: Auth['cors'] = cors === false\n    ? false\n    : {\n        allowedOrigins: (cors === true ? 'all' : cors.allowedOrigins) ?? 'all',\n        allowCredentials: (cors === true ? true : cors.allowCredentials) ?? true,\n        allowedHeaders: (cors === true ? undefined : cors.allowedHeaders) ?? ['Content-Type', 'Authorization', 'Cookie'],\n        allowedMethods: (cors === true ? undefined : cors.allowedMethods) ?? ['GET', 'POST', 'OPTIONS'],\n        exposeHeaders: cors === true ? undefined : cors.exposeHeaders,\n        maxAge: cors === true ? undefined : cors.maxAge,\n      }\n\n  const resolvedProfiles = (profilesConfig ?? {}) as ResolvedProfiles<TProviders>\n  const resolvedRoles = {\n    defaultRole: rolesConfig.defaultRole ?? 'user',\n    resolveOnCreate: rolesConfig.resolveOnCreate,\n    adminRoles: rolesConfig.adminRoles ?? ['admin'],\n    adminUserIds: rolesConfig.adminUserIds ?? [],\n  }\n\n  function buildSignOptions(custom: Partial<SignOptions> = {}): SignOptions {\n    const base = { ttl: custom.ttl, iss: custom.iss ?? iss, aud: custom.aud ?? aud, sub: custom.sub }\n    if (algorithm === 'HS256') {\n      return { algorithm, secret: custom.secret ?? secret, ...base }\n    }\n    else {\n      if (custom.secret !== undefined && typeof custom.secret !== 'string')\n        throw new AuthError('For ES256, the secret option must be a string.')\n      const esSecret = custom.secret ?? secret\n      return { algorithm, privateKey: custom.privateKey, secret: esSecret, ...base }\n    }\n  }\n\n  function buildVerifyOptions(custom: Partial<VerifyOptions> = {}): VerifyOptions {\n    const base = { iss: custom.iss ?? iss, aud: custom.aud ?? aud }\n    if (algorithm === 'HS256') {\n      return { algorithm, secret: custom.secret ?? secret, ...base }\n    }\n    else {\n      if (custom.secret !== undefined && typeof custom.secret !== 'string')\n        throw new AuthError('For ES256, the secret option must be a string.')\n      const esSecret = custom.secret ?? secret\n      return { algorithm, publicKey: custom.publicKey, secret: esSecret, ...base }\n    }\n  }\n\n  async function signJWT<U extends Record<string, unknown>>(payload: U, customOptions: Partial<SignOptions> = {}): Promise<string> {\n    return sign(payload, buildSignOptions(customOptions))\n  }\n\n  async function verifyJWT<U = Record<string, unknown>>(token: string, customOptions: Partial<VerifyOptions> = {}): Promise<U | null> {\n    const options = buildVerifyOptions(customOptions)\n    try {\n      return await verify<U>(token, options)\n    }\n    catch {\n      return null\n    }\n  }\n\n  async function createSession(userId: string, data: Record<string, unknown> = {}, ttl = defaultTTL): Promise<string> {\n    const payload = { sub: userId, ...data }\n    return signJWT(payload, { ttl })\n  }\n\n  async function validateSession(token: string): Promise<GauSession | null> {\n    const payload = await verifyJWT<{ sub: string } & Record<string, unknown>>(token)\n    if (!payload)\n      return null\n\n    const userAndAccounts = await adapter.getUserAndAccounts(payload.sub)\n    if (!userAndAccounts)\n      return null\n\n    const { user, accounts } = userAndAccounts\n    const isAdmin = Boolean(\n      user\n      && (\n        (user.role && resolvedRoles.adminRoles.includes(user.role))\n        || (resolvedRoles.adminUserIds.length > 0 && resolvedRoles.adminUserIds.includes(user.id))\n      ),\n    )\n    const sessionUser = user ? { ...user, isAdmin } : null\n\n    return { user: sessionUser, session: { id: token, ...payload }, accounts }\n  }\n\n  async function getAccessToken(userId: string, providerId: string) {\n    const provider = providerMap.get(providerId)\n    if (!provider)\n      return null\n\n    const accounts = await adapter.getAccounts(userId)\n    const account = accounts.find(a => a.provider === providerId)\n    if (!account || !account.accessToken)\n      return null\n\n    const now = Math.floor(Date.now() / 1000)\n    const isExpired = typeof account.expiresAt === 'number' ? account.expiresAt <= now : false\n\n    if (!isExpired)\n      return { accessToken: account.accessToken, expiresAt: account.expiresAt ?? null }\n\n    if (!account.refreshToken || !provider.refreshAccessToken)\n      return null\n\n    try {\n      const refreshed = await provider.refreshAccessToken(account.refreshToken, {})\n      const updated = {\n        userId,\n        provider: account.provider,\n        providerAccountId: account.providerAccountId,\n        accessToken: refreshed.accessToken ?? account.accessToken,\n        refreshToken: refreshed.refreshToken ?? account.refreshToken,\n        expiresAt: refreshed.expiresAt ?? null,\n        idToken: refreshed.idToken ?? account.idToken ?? null,\n        tokenType: refreshed.tokenType ?? account.tokenType ?? null,\n        scope: refreshed.scope ?? account.scope ?? null,\n      }\n      await adapter.updateAccount?.(updated)\n      return { accessToken: updated.accessToken!, expiresAt: updated.expiresAt }\n    }\n    catch {\n      return null\n    }\n  }\n\n  return {\n    ...adapter,\n    providerMap: providerMap as Map<ProviderId<TProviders[number]>, TProviders[number]>,\n    basePath,\n    cookieOptions,\n    jwt: {\n      ttl: defaultTTL,\n    },\n    onOAuthExchange,\n    mapExternalProfile,\n    onBeforeLinkAccount,\n    onAfterLinkAccount,\n    signJWT,\n    verifyJWT,\n    createSession,\n    validateSession,\n    getAccessToken,\n    trustHosts,\n    autoLink,\n    allowDifferentEmails,\n    profiles: resolvedProfiles,\n    updateUserInfoOnLink,\n    sessionStrategy,\n    development: false,\n    roles: resolvedRoles,\n    cors: resolvedCors,\n  }\n}\n","import type { OAuth2Tokens } from 'arctic'\nimport type { Cookies } from './cookies'\nimport type { Auth } from './createAuth'\n\nexport interface OAuthExchangeContext {\n  request: Request\n  providerId: string\n  state: string\n  code: string\n  codeVerifier: string\n  callbackUri?: string | null\n  redirectTo: string\n  cookies: Cookies\n  providerUser: any\n  tokens: OAuth2Tokens\n  isLinking: boolean\n  sessionUserId?: string\n}\n\nexport type OAuthExchangeResult = { handled: true, response: Response } | { handled: false }\n\nexport async function runOnOAuthExchange(auth: Auth | undefined, ctx: OAuthExchangeContext): Promise<OAuthExchangeResult> {\n  if (!auth || typeof auth.onOAuthExchange !== 'function')\n    return { handled: false }\n  try {\n    const res = await auth.onOAuthExchange(ctx)\n    if (!res || typeof res !== 'object')\n      return { handled: false }\n    return res\n  }\n  catch (e) {\n    console.error('onOAuthExchange hook error:', e)\n    return { handled: false }\n  }\n}\n\nexport interface MapExternalProfileContext {\n  request: Request\n  providerId: string\n  providerUser: any\n  tokens: OAuth2Tokens\n  isLinking: boolean\n}\n\nexport async function maybeMapExternalProfile(auth: Auth | undefined, ctx: MapExternalProfileContext): Promise<any> {\n  if (!auth || typeof auth.mapExternalProfile !== 'function')\n    return ctx.providerUser\n  try {\n    const mapped = await auth.mapExternalProfile(ctx)\n    if (!mapped)\n      return ctx.providerUser\n    return { ...ctx.providerUser, ...mapped }\n  }\n  catch (e) {\n    console.error('mapExternalProfile hook error:', e)\n    return ctx.providerUser\n  }\n}\n\nexport interface BeforeLinkAccountContext {\n  request: Request\n  providerId: string\n  userId: string\n  providerUser: any\n  tokens: OAuth2Tokens\n}\n\nexport async function runOnBeforeLinkAccount(auth: Auth | undefined, ctx: BeforeLinkAccountContext): Promise<{ allow: true } | { allow: false, response?: Response }> {\n  if (!auth || typeof auth.onBeforeLinkAccount !== 'function')\n    return { allow: true }\n  try {\n    const res = await auth.onBeforeLinkAccount(ctx)\n    if (!res)\n      return { allow: true }\n    return res\n  }\n  catch (e) {\n    console.error('onBeforeLinkAccount hook error:', e)\n    return { allow: true }\n  }\n}\n\nexport interface AfterLinkAccountContext extends BeforeLinkAccountContext { action: 'link' | 'update' }\n\nexport async function runOnAfterLinkAccount(auth: Auth | undefined, ctx: AfterLinkAccountContext): Promise<void> {\n  if (!auth || typeof auth.onAfterLinkAccount !== 'function')\n    return\n  try {\n    await auth.onAfterLinkAccount(ctx)\n  }\n  catch (e) {\n    console.error('onAfterLinkAccount hook error:', e)\n  }\n}\n","import type { Auth } from '../createAuth'\nimport type { User } from '../index'\nimport {\n  CALLBACK_URI_COOKIE_NAME,\n  Cookies,\n  CSRF_COOKIE_NAME,\n  LINKING_TOKEN_COOKIE_NAME,\n  parseCookies,\n  PKCE_COOKIE_NAME,\n  PROVIDER_OPTIONS_COOKIE_NAME,\n  SESSION_COOKIE_NAME,\n} from '../cookies'\nimport { maybeMapExternalProfile, runOnAfterLinkAccount, runOnBeforeLinkAccount, runOnOAuthExchange } from '../hooks'\nimport { json, redirect } from '../index'\n\nexport async function handleCallback(request: Request, auth: Auth, providerId: string): Promise<Response> {\n  const provider = auth.providerMap.get(providerId)\n  if (!provider)\n    return json({ error: 'Provider not found' }, { status: 400 })\n\n  const url = new URL(request.url)\n  const code = url.searchParams.get('code')\n  const state = url.searchParams.get('state')\n\n  if (!code || !state)\n    return json({ error: 'Missing code or state' }, { status: 400 })\n\n  const requestCookies = parseCookies(request.headers.get('Cookie'))\n  const cookies = new Cookies(requestCookies, auth.cookieOptions)\n\n  let savedState: string | undefined\n  let redirectTo = '/'\n  if (state.includes('.')) {\n    const [originalSavedState, encodedRedirect] = state.split('.')\n    savedState = originalSavedState\n    try {\n      redirectTo = atob(encodedRedirect ?? '') || '/'\n    }\n    catch {\n      redirectTo = '/'\n    }\n  }\n  else {\n    savedState = state\n  }\n\n  const csrfToken = cookies.get(CSRF_COOKIE_NAME)\n\n  if (!csrfToken || csrfToken !== savedState)\n    return json({ error: 'Invalid CSRF token' }, { status: 403 })\n\n  const codeVerifier = cookies.get(PKCE_COOKIE_NAME)\n  if (!codeVerifier)\n    return json({ error: 'Missing PKCE code verifier' }, { status: 400 })\n\n  const callbackUri = cookies.get(CALLBACK_URI_COOKIE_NAME)\n  const providerOptionsRaw = cookies.get(PROVIDER_OPTIONS_COOKIE_NAME)\n  let providerOverrides: any | undefined\n  if (providerOptionsRaw) {\n    try {\n      const decoded = atob(providerOptionsRaw)\n      const parsed = JSON.parse(decoded)\n      providerOverrides = parsed?.overrides\n    }\n    catch {}\n  }\n  const linkingToken = cookies.get(LINKING_TOKEN_COOKIE_NAME)\n\n  if (linkingToken)\n    cookies.delete(LINKING_TOKEN_COOKIE_NAME)\n\n  const isLinking = !!linkingToken\n\n  if (isLinking) {\n    const session = await auth.validateSession(linkingToken!)\n    if (!session) {\n      cookies.delete(CSRF_COOKIE_NAME)\n      cookies.delete(PKCE_COOKIE_NAME)\n      if (callbackUri)\n        cookies.delete(CALLBACK_URI_COOKIE_NAME)\n      cookies.delete(PROVIDER_OPTIONS_COOKIE_NAME)\n      const response = redirect(redirectTo)\n      cookies.toHeaders().forEach((value, key) => response.headers.append(key, value))\n      return response\n    }\n  }\n\n  const { user: rawProviderUser, tokens } = await provider.validateCallback(code, codeVerifier, callbackUri ?? undefined, providerOverrides)\n\n  {\n    const session = isLinking ? await auth.validateSession(linkingToken!) : null\n    const hookResult = await runOnOAuthExchange(auth, {\n      request,\n      providerId,\n      state,\n      code,\n      codeVerifier,\n      callbackUri,\n      redirectTo,\n      cookies,\n      providerUser: rawProviderUser,\n      tokens,\n      isLinking,\n      sessionUserId: session?.user?.id,\n    })\n    if (hookResult.handled) {\n      cookies.delete(CSRF_COOKIE_NAME)\n      cookies.delete(PKCE_COOKIE_NAME)\n      if (callbackUri)\n        cookies.delete(CALLBACK_URI_COOKIE_NAME)\n      cookies.delete(PROVIDER_OPTIONS_COOKIE_NAME)\n      const response = hookResult.response\n      cookies.toHeaders().forEach((value, key) => response.headers.append(key, value))\n      return response\n    }\n  }\n\n  const providerUser = await maybeMapExternalProfile(auth, {\n    request,\n    providerId,\n    providerUser: rawProviderUser,\n    tokens,\n    isLinking,\n  })\n\n  // Enforce provider-level link-only when not linking (profile-level enforced at redirect time)\n  if (!isLinking && (auth.providerMap.get(providerId)?.linkOnly === true)) {\n    cookies.delete(CSRF_COOKIE_NAME)\n    cookies.delete(PKCE_COOKIE_NAME)\n    if (callbackUri)\n      cookies.delete(CALLBACK_URI_COOKIE_NAME)\n    cookies.delete(PROVIDER_OPTIONS_COOKIE_NAME)\n    const response = json({ error: 'Sign-in with this provider is disabled. Please link it to an existing account.' }, { status: 400 })\n    cookies.toHeaders().forEach((value, key) => response.headers.append(key, value))\n    return response\n  }\n\n  let user: User | null = null\n\n  const userFromAccount = await auth.getUserByAccount(providerId, providerUser.id)\n\n  if (isLinking) {\n    const session = await auth.validateSession(linkingToken)\n    user = session!.user\n\n    if (!user)\n      return json({ error: 'User not found' }, { status: 404 })\n\n    if (userFromAccount && userFromAccount.id !== user.id)\n      return json({ error: 'Account already linked to another user' }, { status: 409 })\n\n    if (auth.allowDifferentEmails === false) {\n      const currentEmail = user.email\n      const providerEmail = providerUser.email\n      if (currentEmail && providerEmail && currentEmail !== providerEmail)\n        return json({ error: 'Email mismatch between existing account and provider' }, { status: 400 })\n    }\n\n    if (user) {\n      const update: Partial<User> & { id: string } = { id: user.id }\n      let needsUpdate = false\n\n      if (auth.updateUserInfoOnLink) {\n        if (providerUser.name && providerUser.name !== user.name) {\n          update.name = providerUser.name\n          needsUpdate = true\n        }\n        if (providerUser.avatar && providerUser.avatar !== user.image) {\n          update.image = providerUser.avatar\n          needsUpdate = true\n        }\n      }\n      else {\n        if (!user.name && providerUser.name) {\n          update.name = providerUser.name\n          needsUpdate = true\n        }\n        if (!user.image && providerUser.avatar) {\n          update.image = providerUser.avatar\n          needsUpdate = true\n        }\n      }\n\n      if (\n        user.email\n        && providerUser.email\n        && user.email === providerUser.email\n        && providerUser.emailVerified === true\n        && (!user.emailVerified || auth.updateUserInfoOnLink)\n      ) {\n        update.emailVerified = true\n        needsUpdate = true\n      }\n\n      if (needsUpdate) {\n        try {\n          user = await auth.updateUser(update)\n        }\n        catch (e) {\n          console.error('Failed to update user info on link:', e)\n        }\n      }\n    }\n  }\n  else {\n    user = userFromAccount\n  }\n\n  if (!user) {\n    const autoLink = auth.autoLink ?? 'verifiedEmail'\n    const shouldLinkByEmail = providerUser.email && (\n      (autoLink === 'always')\n      || (autoLink === 'verifiedEmail' && providerUser.emailVerified === true)\n    )\n    if (shouldLinkByEmail) {\n      const existingUser = await auth.getUserByEmail(providerUser.email!)\n      if (existingUser) {\n        // If the email is verified by the new provider, and the existing user's email is not,\n        // update the user's email verification status.\n        if (providerUser.emailVerified && !existingUser.emailVerified) {\n          user = await auth.updateUser({\n            id: existingUser.id,\n            emailVerified: true,\n          })\n        }\n        else {\n          user = existingUser\n        }\n      }\n    }\n    if (!user) {\n      try {\n        if (providerUser.email && providerUser.emailVerified === true && auth.autoLink === false) {\n          const existingWithSameEmail = await auth.getUserByEmail(providerUser.email)\n          if (existingWithSameEmail)\n            return json({ error: 'An account with this email already exists. Sign in with the existing method or link the provider.' }, { status: 409 })\n        }\n\n        let resolvedRole: string | undefined\n        try {\n          resolvedRole = auth.roles.resolveOnCreate?.({ providerId, profile: providerUser, request: request as unknown as Request })\n        }\n        catch (e) {\n          console.error('roles.resolveOnCreate threw:', e)\n        }\n\n        const emailToStore = providerUser.emailVerified === true ? providerUser.email : null\n\n        user = await auth.createUser({\n          name: providerUser.name,\n          email: emailToStore,\n          image: providerUser.avatar,\n          emailVerified: providerUser.emailVerified,\n          role: resolvedRole ?? auth.roles.defaultRole,\n        })\n      }\n      catch (error) {\n        console.error('Failed to create user:', error)\n        return json({ error: 'Failed to create user' }, { status: 500 })\n      }\n    }\n  }\n\n  // self-healing: update user's email if it's missing or unverified and the provider returns a verified email\n  if (user && providerUser.email) {\n    const { email: currentEmail, emailVerified: currentEmailVerified } = user\n    const { email: providerEmail, emailVerified: providerEmailVerified } = providerUser\n\n    const update: Partial<User> & { id: string } = { id: user.id }\n    let needsUpdate = false\n\n    // user has no primary email. promote the provider's email but only if it's verified.\n    if (!currentEmail && providerEmailVerified === true) {\n      update.email = providerEmail\n      update.emailVerified = true\n      needsUpdate = true\n    }\n    // user has an unverified primary email, and the provider confirms this same email is verified.\n    else if (\n      currentEmail === providerEmail\n      && providerEmailVerified === true\n      && !currentEmailVerified\n    ) {\n      update.emailVerified = true\n      needsUpdate = true\n    }\n\n    if (needsUpdate) {\n      try {\n        user = await auth.updateUser(update)\n      }\n      catch (error) {\n        console.error('Failed to update user after sign-in:', error)\n      }\n    }\n  }\n\n  if (!userFromAccount) {\n    // GitHub sometimes doesn't return these which causes arctic to throw an error\n    let refreshToken: string | null\n    try {\n      refreshToken = tokens.refreshToken()\n    }\n    catch {\n      refreshToken = null\n    }\n\n    let expiresAt: number | undefined\n    try {\n      const expiresAtDate = tokens.accessTokenExpiresAt()\n      if (expiresAtDate)\n        expiresAt = Math.floor(expiresAtDate.getTime() / 1000)\n    }\n    catch {\n    }\n\n    let idToken: string | null\n    try {\n      idToken = tokens.idToken()\n    }\n    catch {\n      idToken = null\n    }\n\n    {\n      const pre = await runOnBeforeLinkAccount(auth, {\n        request,\n        providerId,\n        userId: user.id,\n        providerUser,\n        tokens,\n      })\n      if (pre.allow === false) {\n        const response = pre.response ?? json({ error: 'Linking not allowed' }, { status: 403 })\n        cookies.toHeaders().forEach((value, key) => response.headers.append(key, value))\n        return response\n      }\n    }\n\n    try {\n      let scope: string | null\n      try {\n        scope = tokens.scopes()?.join(' ') ?? null\n      }\n      catch {\n        scope = null\n      }\n\n      await auth.linkAccount({\n        userId: user.id,\n        provider: providerId,\n        providerAccountId: providerUser.id,\n        accessToken: tokens.accessToken(),\n        refreshToken,\n        expiresAt,\n        tokenType: tokens.tokenType?.() ?? null,\n        scope,\n        idToken,\n      })\n      await runOnAfterLinkAccount(auth, {\n        request,\n        providerId,\n        userId: user.id,\n        providerUser,\n        tokens,\n        action: 'link',\n      })\n    }\n    catch (error) {\n      console.error('Error linking account:', error)\n      return json({ error: 'Failed to link account' }, { status: 500 })\n    }\n  }\n  else {\n    // Existing account: update stored tokens on sign-in (access/refresh/expires/idToken/etc.)\n    try {\n      const accounts = await auth.getAccounts(user!.id)\n      const existing = accounts.find(a => a.provider === providerId && a.providerAccountId === providerUser.id)\n\n      if (existing && auth.updateAccount) {\n        let refreshToken: string | null\n        try {\n          refreshToken = tokens.refreshToken()\n        }\n        catch {\n          refreshToken = existing.refreshToken ?? null\n        }\n\n        let expiresAt: number | undefined\n        try {\n          const expiresAtDate = tokens.accessTokenExpiresAt()\n          if (expiresAtDate)\n            expiresAt = Math.floor(expiresAtDate.getTime() / 1000)\n        }\n        catch {\n          expiresAt = existing.expiresAt ?? undefined\n        }\n\n        let idToken: string | null\n        try {\n          idToken = tokens.idToken()\n        }\n        catch {\n          idToken = existing.idToken ?? null\n        }\n\n        let scope: string | null\n        try {\n          scope = tokens.scopes()?.join(' ') ?? existing.scope ?? null\n        }\n        catch {\n          scope = existing.scope ?? null\n        }\n\n        await auth.updateAccount({\n          userId: user!.id,\n          provider: providerId,\n          providerAccountId: providerUser.id,\n          accessToken: tokens.accessToken() ?? existing.accessToken ?? undefined,\n          refreshToken,\n          expiresAt: expiresAt ?? existing.expiresAt ?? undefined,\n          tokenType: tokens.tokenType?.() ?? existing.tokenType ?? null,\n          scope,\n          idToken,\n        })\n        await runOnAfterLinkAccount(auth, {\n          request,\n          providerId,\n          userId: user!.id,\n          providerUser,\n          tokens,\n          action: 'update',\n        })\n      }\n    }\n    catch (error) {\n      console.error('Failed to update account tokens on sign-in:', error)\n    }\n  }\n\n  const sessionToken = await auth.createSession(user.id)\n\n  const requestUrl = new URL(request.url)\n  const redirectUrl = new URL(redirectTo, request.url)\n\n  const forceToken = auth.sessionStrategy === 'token'\n  const forceCookie = auth.sessionStrategy === 'cookie'\n\n  const isCustomScheme = redirectUrl.protocol !== 'http:' && redirectUrl.protocol !== 'https:'\n  const isCrossHost = requestUrl.host !== redirectUrl.host\n\n  // For Tauri, we can't set a cookie on a custom protocol or a different host,\n  // so we pass the token in the URL. Additionally, return a small HTML page\n  // that immediately navigates to the deep-link and attempts to close the window,\n  // so the external OAuth tab does not stay open.\n  if (forceToken || (!forceCookie && (isCustomScheme || isCrossHost))) {\n    const destination = new URL(redirectUrl)\n    // Use hash instead of query param for security. The hash is not sent to the server.\n    destination.hash = `token=${sessionToken}`\n\n    const html = `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\" />\n  <title>Authentication Complete</title>\n  <style>\n    body {\n      font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, \"Helvetica Neue\", Arial, \"Noto Sans\", sans-serif, \"Apple Color Emoji\", \"Segoe UI Emoji\", \"Segoe UI Symbol\", \"Noto Color Emoji\";\n      background-color: #09090b;\n      color: #fafafa;\n      display: flex;\n      justify-content: center;\n      align-items: center;\n      height: 100vh;\n      margin: 0;\n      text-align: center;\n    }\n    .card {\n      background-color: #18181b;\n      border: 1px solid #27272a;\n      border-radius: 0.75rem;\n      padding: 2rem;\n      max-width: 320px;\n    }\n    h1 {\n      font-size: 1.25rem;\n      font-weight: 600;\n      margin: 0 0 0.5rem;\n    }\n    p {\n      margin: 0;\n      color: #a1a1aa;\n    }\n  </style>\n  <script>\n    window.onload = function() {\n      const url = ${JSON.stringify(destination.toString())};\n      window.location.href = url;\n      setTimeout(window.close, 500);\n    };\n  </script>\n</head>\n<body>\n  <div class=\"card\">\n    <h1>Authentication Successful</h1>\n    <p>You can now close this window.</p>\n  </div>\n</body>\n</html>`\n\n    // Clear temporary cookies (CSRF/PKCE/Callback URI) so they don't linger\n    cookies.delete(CSRF_COOKIE_NAME)\n    cookies.delete(PKCE_COOKIE_NAME)\n    if (callbackUri)\n      cookies.delete(CALLBACK_URI_COOKIE_NAME)\n    cookies.delete(PROVIDER_OPTIONS_COOKIE_NAME)\n\n    const response = new Response(html, {\n      status: 200,\n      headers: { 'Content-Type': 'text/html; charset=utf-8' },\n    })\n    cookies.toHeaders().forEach((value, key) => {\n      response.headers.append(key, value)\n    })\n    return response\n  }\n\n  cookies.set(SESSION_COOKIE_NAME, sessionToken, {\n    maxAge: auth.jwt.ttl,\n    sameSite: auth.development ? 'lax' : 'none',\n    secure: !auth.development,\n  })\n  cookies.delete(CSRF_COOKIE_NAME)\n  cookies.delete(PKCE_COOKIE_NAME)\n  if (callbackUri)\n    cookies.delete(CALLBACK_URI_COOKIE_NAME)\n  cookies.delete(PROVIDER_OPTIONS_COOKIE_NAME)\n\n  const redirectParam = url.searchParams.get('redirect')\n\n  let response: Response\n  if (redirectParam === 'false') {\n    const accounts = await auth.getAccounts(user.id)\n    const isAdmin = Boolean(\n      (user.role && auth.roles.adminRoles.includes(user.role))\n      || auth.roles.adminUserIds.includes(user.id),\n    )\n    response = json({ user: { ...user, isAdmin, accounts } })\n  }\n  else {\n    response = redirect(redirectTo)\n  }\n\n  cookies.toHeaders().forEach((value, key) => {\n    response.headers.append(key, value)\n  })\n\n  return response\n}\n","import type { Auth } from '../createAuth'\n\nfunction originAllowed(origin: string, auth: Auth): boolean {\n  if (auth.cors === false)\n    return false\n  const cfg = auth.cors\n  if (cfg.allowedOrigins === 'all')\n    return true\n  if (cfg.allowedOrigins === 'trust') {\n    if (auth.trustHosts === 'all')\n      return true\n    try {\n      const u = new URL(origin)\n      return auth.trustHosts.includes(u.host) || auth.trustHosts.includes(u.hostname)\n    }\n    catch {\n      return false\n    }\n  }\n  if (cfg.allowedOrigins.includes('*'))\n    return true\n  try {\n    const u = new URL(origin)\n    return cfg.allowedOrigins.includes(origin) || cfg.allowedOrigins.includes(u.origin) || cfg.allowedOrigins.includes(u.host) || cfg.allowedOrigins.includes(u.hostname)\n  }\n  catch {\n    return cfg.allowedOrigins.includes(origin)\n  }\n}\n\nexport function applyCors(request: Request, response: Response, auth: Auth): Response {\n  if (auth.cors === false)\n    return response\n\n  const origin = request.headers.get('Origin') || request.headers.get('origin')\n  if (!origin)\n    return response\n\n  if (!originAllowed(origin, auth))\n    return response\n\n  const cfg = auth.cors\n  response.headers.set('Vary', 'Origin')\n  const allowCreds = cfg.allowCredentials\n  const allowOriginValue = (cfg.allowedOrigins === 'all' && !allowCreds) ? '*' : origin\n  response.headers.set('Access-Control-Allow-Origin', allowOriginValue)\n  if (allowCreds)\n    response.headers.set('Access-Control-Allow-Credentials', 'true')\n  response.headers.set('Access-Control-Allow-Headers', cfg.allowedHeaders.join(', '))\n  response.headers.set('Access-Control-Allow-Methods', cfg.allowedMethods.join(', '))\n  if (cfg.exposeHeaders?.length)\n    response.headers.set('Access-Control-Expose-Headers', cfg.exposeHeaders.join(', '))\n  return response\n}\n\nexport function handlePreflight(request: Request, auth: Auth): Response {\n  if (auth.cors === false)\n    return new Response(null, { status: 204 })\n\n  const origin = request.headers.get('Origin') || request.headers.get('origin')\n  const cfg = auth.cors\n  const headers: Record<string, string> = {}\n  if (origin && originAllowed(origin, auth)) {\n    const allowCreds = cfg.allowCredentials\n    const allowOriginValue = (cfg.allowedOrigins === 'all' && !allowCreds) ? '*' : origin\n    headers['Access-Control-Allow-Origin'] = allowOriginValue\n    if (allowCreds)\n      headers['Access-Control-Allow-Credentials'] = 'true'\n  }\n  headers['Access-Control-Allow-Headers'] = cfg.allowedHeaders.join(', ')\n  headers['Access-Control-Allow-Methods'] = cfg.allowedMethods.join(', ')\n  if (cfg.maxAge != null)\n    headers['Access-Control-Max-Age'] = String(cfg.maxAge)\n  if (cfg.exposeHeaders?.length)\n    headers['Access-Control-Expose-Headers'] = cfg.exposeHeaders.join(', ')\n  return new Response(null, { status: 204, headers })\n}\n","import { generateCodeVerifier, generateState } from 'arctic'\n\nexport function createOAuthUris() {\n  const state = generateState()\n  const codeVerifier = generateCodeVerifier()\n\n  return {\n    state,\n    codeVerifier,\n  }\n}\n","import type { Auth } from '../createAuth'\nimport { createOAuthUris } from '../../oauth/utils'\nimport {\n  CALLBACK_URI_COOKIE_NAME,\n  Cookies,\n  CSRF_COOKIE_NAME,\n  CSRF_MAX_AGE,\n  LINKING_TOKEN_COOKIE_NAME,\n  parseCookies,\n  PKCE_COOKIE_NAME,\n  PROVIDER_OPTIONS_COOKIE_NAME,\n} from '../cookies'\nimport { json, redirect } from '../index'\n\nexport function verifyRequestOrigin(request: Request, trustHosts: 'all' | string[], development: boolean): boolean {\n  if (trustHosts === 'all')\n    return true\n\n  const origin = request.headers.get('origin')\n\n  if (!origin)\n    return false\n\n  let originHost: string\n  try {\n    originHost = new URL(origin).host\n  }\n  catch {\n    return false\n  }\n\n  if (development) {\n    const isLocal = originHost.startsWith('localhost') || originHost.startsWith('127.0.0.1')\n    if (isLocal)\n      return true\n  }\n\n  const requestUrl = new URL(request.url)\n  const requestHost = requestUrl.host\n  const requestOrigin = `${requestUrl.protocol}//${requestHost}`\n\n  if (origin === requestOrigin)\n    return true\n\n  return trustHosts.includes(originHost)\n}\n\nexport async function prepareOAuthRedirect(\n  request: Request,\n  auth: Auth,\n  providerId: string,\n  linkingToken: string | null,\n): Promise<Response> {\n  const provider = auth.providerMap.get(providerId)\n  if (!provider)\n    return json({ error: 'Provider not found' }, { status: 400 })\n\n  const { state: originalState, codeVerifier } = createOAuthUris()\n  const url = new URL(request.url)\n  const redirectTo = url.searchParams.get('redirectTo')\n  const profileName = url.searchParams.get('profile')\n  const promptParam = url.searchParams.get('prompt')\n\n  if (redirectTo) {\n    let parsedRedirect: URL\n    try {\n      if (redirectTo.startsWith('//'))\n        throw new Error('Protocol-relative URL not allowed')\n      parsedRedirect = new URL(redirectTo, url.origin)\n    }\n    catch {\n      return json({ error: 'Invalid \"redirectTo\" URL' }, { status: 400 })\n    }\n\n    const redirectHost = parsedRedirect.host\n    const currentHost = new URL(request.url).host\n\n    const isSameHost = redirectHost === currentHost\n    const isTrusted = auth.trustHosts === 'all' || auth.trustHosts.includes(redirectHost)\n    const isHttp = parsedRedirect.protocol === 'http:' || parsedRedirect.protocol === 'https:'\n\n    if (isHttp && !isSameHost && !isTrusted)\n      return json({ error: 'Untrusted redirect host' }, { status: 400 })\n  }\n\n  const state = redirectTo ? `${originalState}.${btoa(redirectTo)}` : originalState\n  let callbackUri = url.searchParams.get('callbackUri')\n  if (!callbackUri && provider.requiresRedirectUri)\n    callbackUri = `${url.origin}${auth.basePath}/callback/${providerId}`\n\n  let scopesOverride: string[] | undefined\n  let extraParams: Record<string, string> | undefined\n  let overrides: any | undefined\n  if (profileName) {\n    const providerProfiles = auth.profiles?.[providerId] ?? {}\n    const selected = providerProfiles[profileName]\n    if (!selected)\n      return json({ error: `Unknown profile \"${profileName}\" for provider \"${providerId}\"` }, { status: 400 })\n    if (selected.redirectUri)\n      callbackUri = selected.redirectUri\n    if (selected.scopes)\n      scopesOverride = selected.scopes\n    if (selected.params)\n      extraParams = { ...(selected.params ?? {}) }\n    const { tenant, prompt } = selected as any\n    if (tenant != null || prompt != null)\n      overrides = { ...(overrides ?? {}), tenant, prompt }\n    if (!linkingToken && selected.linkOnly === true)\n      return json({ error: 'This profile is link-only. Please link it to an existing account.' }, { status: 400 })\n  }\n\n  if (promptParam)\n    extraParams = { ...(extraParams ?? {}), prompt: promptParam }\n\n  if (!linkingToken && (provider.linkOnly === true))\n    return json({ error: 'Sign-in with this provider is disabled. Please link it to an existing account.' }, { status: 400 })\n\n  let authUrl: URL | null\n  try {\n    authUrl = await provider.getAuthorizationUrl(state, codeVerifier, {\n      redirectUri: callbackUri ?? undefined,\n      scopes: scopesOverride,\n      params: extraParams,\n      overrides,\n    })\n  }\n  catch (error) {\n    console.error('Error getting authorization URL:', error)\n    authUrl = null\n  }\n\n  if (!authUrl)\n    return json({ error: 'Could not create authorization URL' }, { status: 500 })\n\n  const requestCookies = parseCookies(request.headers.get('Cookie'))\n  const cookies = new Cookies(requestCookies, auth.cookieOptions)\n\n  const temporaryCookieOptions = {\n    maxAge: CSRF_MAX_AGE,\n    sameSite: auth.development ? 'lax' : 'none',\n    secure: !auth.development,\n  } as const\n\n  cookies.set(CSRF_COOKIE_NAME, originalState, temporaryCookieOptions)\n  cookies.set(PKCE_COOKIE_NAME, codeVerifier, temporaryCookieOptions)\n  if (linkingToken) {\n    cookies.set(LINKING_TOKEN_COOKIE_NAME, linkingToken, temporaryCookieOptions)\n  }\n  else {\n    cookies.delete(LINKING_TOKEN_COOKIE_NAME, {\n      sameSite: auth.development ? 'lax' : 'none',\n      secure: !auth.development,\n    })\n  }\n\n  if (callbackUri)\n    cookies.set(CALLBACK_URI_COOKIE_NAME, callbackUri, temporaryCookieOptions)\n\n  const serializedOptions = JSON.stringify({ params: extraParams ?? {}, overrides: overrides ?? {} })\n  cookies.set(PROVIDER_OPTIONS_COOKIE_NAME, btoa(serializedOptions), temporaryCookieOptions)\n\n  const redirectParam = url.searchParams.get('redirect')\n\n  if (redirectParam === 'false') {\n    const response = json({ url: authUrl.toString() })\n    cookies.toHeaders().forEach((value, key) => {\n      response.headers.append(key, value)\n    })\n    return response\n  }\n\n  const response = redirect(authUrl.toString())\n  cookies.toHeaders().forEach((value, key) => {\n    response.headers.append(key, value)\n  })\n\n  return response\n}\n","import type { Auth } from '../createAuth'\nimport { parseCookies, SESSION_COOKIE_NAME } from '../cookies'\nimport { json } from '../index'\nimport { prepareOAuthRedirect } from './utils'\n\nexport async function handleLink(request: Request, auth: Auth, providerId: string): Promise<Response> {\n  const url = new URL(request.url)\n  const requestCookies = parseCookies(request.headers.get('Cookie'))\n  let sessionToken = requestCookies.get(SESSION_COOKIE_NAME)\n\n  if (!sessionToken) {\n    const authHeader = request.headers.get('Authorization')\n    if (authHeader?.startsWith('Bearer '))\n      sessionToken = authHeader.substring(7)\n  }\n\n  if (!sessionToken)\n    sessionToken = url.searchParams.get('token') ?? undefined\n\n  if (!sessionToken)\n    return json({ error: 'Unauthorized' }, { status: 401 })\n\n  const session = await auth.validateSession(sessionToken)\n  if (!session)\n    return json({ error: 'Unauthorized' }, { status: 401 })\n\n  url.searchParams.delete('token')\n  const cleanRequest = new Request(url.toString(), request as Request)\n\n  return prepareOAuthRedirect(cleanRequest, auth, providerId, sessionToken)\n}\n\nexport async function handleUnlink(request: Request, auth: Auth, providerId: string): Promise<Response> {\n  const requestCookies = parseCookies(request.headers.get('Cookie'))\n  let sessionToken = requestCookies.get(SESSION_COOKIE_NAME)\n\n  if (!sessionToken) {\n    const authHeader = request.headers.get('Authorization')\n    if (authHeader?.startsWith('Bearer '))\n      sessionToken = authHeader.substring(7)\n  }\n\n  if (!sessionToken)\n    return json({ error: 'Unauthorized' }, { status: 401 })\n\n  const session = await auth.validateSession(sessionToken)\n  if (!session || !session.user)\n    return json({ error: 'Unauthorized' }, { status: 401 })\n\n  const accounts = session.accounts ?? []\n\n  if (accounts.length <= 1)\n    return json({ error: 'Cannot unlink the last account' }, { status: 400 })\n\n  const accountToUnlink = accounts.find(a => a.provider === providerId)\n  if (!accountToUnlink)\n    return json({ error: `Provider \"${providerId}\" not linked to this account` }, { status: 400 })\n\n  await auth.unlinkAccount(providerId, accountToUnlink.providerAccountId)\n\n  const remainingAccounts = await auth.getAccounts(session.user.id)\n\n  // if there are remaining accounts, we need to potentially update the user's primary info\n  // TODO: for now we just clear the email\n  if (remainingAccounts.length > 0 && session.user.email) {\n    try {\n      await auth.updateUser({\n        id: session.user.id,\n        email: null,\n        emailVerified: false,\n      })\n    }\n    catch (error) {\n      console.error('Failed to clear stale email after unlinking:', error)\n    }\n  }\n\n  return json({ message: 'Account unlinked successfully' })\n}\n","import type { Auth } from '../createAuth'\nimport { Cookies, LINKING_TOKEN_COOKIE_NAME, parseCookies, SESSION_COOKIE_NAME } from '../cookies'\n\nimport { json } from '../index'\nimport { prepareOAuthRedirect } from './utils'\n\nexport async function handleSignIn(request: Request, auth: Auth, providerId: string): Promise<Response> {\n  return prepareOAuthRedirect(request, auth, providerId, null)\n}\n\nexport async function handleSignOut(request: Request, auth: Auth): Promise<Response> {\n  const requestCookies = parseCookies(request.headers.get('Cookie'))\n  const cookies = new Cookies(requestCookies, auth.cookieOptions)\n  cookies.delete(SESSION_COOKIE_NAME, {\n    sameSite: auth.development ? 'lax' : 'none',\n    secure: !auth.development,\n  })\n  cookies.delete(LINKING_TOKEN_COOKIE_NAME, {\n    sameSite: auth.development ? 'lax' : 'none',\n    secure: !auth.development,\n  })\n\n  const response = json({ message: 'Signed out' })\n  cookies.toHeaders().forEach((value, key) => {\n    response.headers.append(key, value)\n  })\n\n  return response\n}\n","import type { Auth } from '../createAuth'\nimport { parseCookies, SESSION_COOKIE_NAME } from '../cookies'\nimport { json, NULL_SESSION } from '../index'\n\nexport async function handleSession(request: Request, auth: Auth): Promise<Response> {\n  const rawCookieHeader = request.headers.get('Cookie')\n  const requestCookies = parseCookies(rawCookieHeader)\n  let sessionToken = requestCookies.get(SESSION_COOKIE_NAME)\n\n  if (!sessionToken) {\n    const authHeader = request.headers.get('Authorization')\n    if (authHeader?.startsWith('Bearer '))\n      sessionToken = authHeader.substring(7)\n  }\n\n  const providers = Array.from(auth.providerMap.keys())\n\n  if (!sessionToken)\n    return json({ ...NULL_SESSION, providers })\n\n  try {\n    const sessionData = await auth.validateSession(sessionToken)\n\n    if (!sessionData)\n      return json({ ...NULL_SESSION, providers }, { status: 401 })\n\n    return json({ ...sessionData, providers })\n  }\n  catch (error) {\n    console.error('Error validating session:', error)\n    return json({ error: 'Failed to validate session' }, { status: 500 })\n  }\n}\n","import type { Auth } from './createAuth'\nimport {\n  applyCors,\n  handleCallback,\n  handleLink,\n  handlePreflight,\n  handleSession,\n  handleSignIn,\n  handleSignOut,\n  handleUnlink,\n  verifyRequestOrigin,\n} from './handlers'\nimport { json } from './index'\n\nexport function createHandler(auth: Auth): (request: Request) => Promise<Response> {\n  const { basePath } = auth\n\n  return async function (request: Request): Promise<Response> {\n    // Handle preflight requests early\n    if (request.method === 'OPTIONS')\n      return handlePreflight(request, auth)\n\n    const url = new URL(request.url)\n    if (!url.pathname.startsWith(basePath))\n      return applyCors(request, json({ error: 'Not Found' }, { status: 404 }), auth)\n\n    if (request.method === 'POST' && !verifyRequestOrigin(request, auth.trustHosts, auth.development)) {\n      if (auth.development) {\n        const origin = request.headers.get('origin') ?? 'N/A'\n        const message = `Untrusted origin: '${origin}'. Add this origin to 'trustHosts' in createAuth() or ensure you are using 'localhost' or '127.0.0.1' for development.`\n        return applyCors(request, json({ error: 'Forbidden', message }, { status: 403 }), auth)\n      }\n      return applyCors(request, json({ error: 'Forbidden' }, { status: 403 }), auth)\n    }\n\n    const path = url.pathname.substring(basePath.length)\n    const parts = path.split('/').filter(Boolean)\n    const action = parts[0]\n\n    if (!action)\n      return applyCors(request, json({ error: 'Not Found' }, { status: 404 }), auth)\n\n    let response: Response\n\n    if (request.method === 'GET') {\n      if (action === 'session')\n        response = await handleSession(request, auth)\n      else if (parts.length === 2 && parts[0] === 'link')\n        response = await handleLink(request, auth, parts[1] as string)\n      else if (parts.length === 2 && parts[0] === 'callback')\n        response = await handleCallback(request, auth, parts[1] as string)\n      else if (parts.length === 1)\n        response = await handleSignIn(request, auth, action)\n      else\n        response = json({ error: 'Not Found' }, { status: 404 })\n    }\n    else if (request.method === 'POST') {\n      if (parts.length === 1 && action === 'signout')\n        response = await handleSignOut(request, auth)\n      else if (parts.length === 2 && parts[0] === 'unlink')\n        response = await handleUnlink(request, auth, parts[1] as string)\n      else\n        response = json({ error: 'Not Found' }, { status: 404 })\n    }\n    else {\n      response = json({ error: 'Method Not Allowed' }, { status: 405 })\n    }\n\n    try {\n      response.headers.set('Cache-Control', 'no-store, private')\n      response.headers.set('Pragma', 'no-cache')\n      response.headers.set('Expires', '0')\n    }\n    catch {}\n\n    return applyCors(request, response, auth)\n  }\n}\n","export interface User {\n  id: string\n  name?: string | null\n  email?: string | null\n  emailVerified?: boolean | null\n  image?: string | null\n  role?: string | null\n  isAdmin?: boolean\n}\n\nexport interface Session {\n  id: string\n  sub: string\n  [key: string]: unknown\n}\n\nexport interface GauSession<TProviders extends string = string> {\n  user: User | null\n  session: Session | null\n  accounts?: Account[] | null\n  providers?: TProviders[]\n}\n\nexport const NULL_SESSION = {\n  user: null,\n  session: null,\n  accounts: null,\n} as const\n\nexport interface NewUser extends Omit<User, 'id' | 'accounts' | 'isAdmin'> {\n  id?: string\n}\n\nexport interface Account {\n  userId: string\n  provider: string\n  providerAccountId: string\n  type?: string // e.g. \"oauth\"\n  accessToken?: string | null\n  refreshToken?: string | null\n  expiresAt?: number | null // epoch seconds\n  idToken?: string | null\n  scope?: string | null\n  tokenType?: string | null\n  sessionState?: string | null\n}\n\nexport interface NewAccount extends Account {}\n\nexport interface Adapter {\n  getUser: (id: string) => Promise<User | null>\n  getUserByEmail: (email: string) => Promise<User | null>\n  getUserByAccount: (provider: string, providerAccountId: string) => Promise<User | null>\n  getAccounts: (userId: string) => Promise<Account[]>\n  getUserAndAccounts: (userId: string) => Promise<{ user: User, accounts: Account[] } | null>\n  createUser: (data: NewUser) => Promise<User>\n  linkAccount: (data: NewAccount) => Promise<void>\n  unlinkAccount: (provider: string, providerAccountId: string) => Promise<void>\n  updateAccount?: (data: Partial<Account> & { userId: string, provider: string, providerAccountId: string }) => Promise<void>\n  updateUser: (data: Partial<User> & { id: string }) => Promise<User>\n  deleteUser: (id: string) => Promise<void>\n}\n\nexport class AuthError extends Error {\n  override readonly cause?: unknown\n  constructor(message: string, cause?: unknown) {\n    super(message)\n    this.name = 'AuthError'\n    this.cause = cause\n  }\n}\n\nexport function json<T>(data: T, init: ResponseInit = {}): Response {\n  const headers = new Headers(init.headers)\n  if (!headers.has('Content-Type'))\n    headers.set('Content-Type', 'application/json; charset=utf-8')\n  return new Response(JSON.stringify(data), { ...init, headers })\n}\n\nexport function redirect(url: string, status: 302 | 303 = 302): Response {\n  return new Response(null, {\n    status,\n    headers: {\n      Location: url,\n    },\n  })\n}\n\nexport * from './cookies'\nexport * from './createAuth'\nexport * from './handler'\n","import { AuthError } from '../core/index'\n\nexport function constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  let diff = a.length ^ b.length\n  const len = Math.max(a.length, b.length)\n  for (let i = 0; i < len; i++)\n    diff |= (a[i] ?? 0) ^ (b[i] ?? 0)\n\n  return diff === 0\n}\n\nfunction base64UrlToArray(base64Url: string): Uint8Array {\n  const base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/')\n  const padLength = (4 - (base64.length % 4)) % 4\n  const padded = base64.padEnd(base64.length + padLength, '=')\n  try {\n    const binary_string = atob(padded)\n    const len = binary_string.length\n    const bytes = new Uint8Array(len)\n    for (let i = 0; i < len; i++)\n      bytes[i] = binary_string.charCodeAt(i)\n\n    return bytes\n  }\n  catch {\n    throw new AuthError('Invalid base64url string')\n  }\n}\n\nexport async function deriveKeysFromSecret(secret: string): Promise<{ privateKey: CryptoKey, publicKey: CryptoKey }> {\n  try {\n    const secretBytes = base64UrlToArray(secret)\n    const privateKey = await crypto.subtle.importKey(\n      'pkcs8',\n      secretBytes.slice(),\n      { name: 'ECDSA', namedCurve: 'P-256' },\n      true,\n      ['sign'],\n    )\n\n    const jwk = await crypto.subtle.exportKey('jwk', privateKey)\n    delete jwk.d\n    jwk.key_ops = ['verify']\n\n    const publicKey = await crypto.subtle.importKey(\n      'jwk',\n      jwk,\n      { name: 'ECDSA', namedCurve: 'P-256' },\n      true,\n      ['verify'],\n    )\n    return { privateKey, publicKey }\n  }\n  catch (error) {\n    if (error instanceof AuthError)\n      throw error\n    throw new AuthError('Invalid secret. Must be a base64url-encoded PKCS#8 private key for ES256. Use `bunx gau secret` to generate one.', error)\n  }\n}\n\n/**\n * Convert JWS raw signature (r || s) to DER-encoded format for WebCrypto.\n */\nexport function rawToDer(raw: Uint8Array): Uint8Array {\n  if (raw.length !== 64)\n    throw new Error('Invalid raw signature length')\n\n  let r = raw.slice(0, 32)\n  let s = raw.slice(32)\n\n  let rOffset = 0\n  while (rOffset < r.length - 1 && r[rOffset] === 0) rOffset++\n  r = r.slice(rOffset)\n\n  let sOffset = 0\n  while (sOffset < s.length - 1 && s[sOffset] === 0) sOffset++\n  s = s.slice(sOffset)\n\n  if (r.length > 0 && r[0]! & 0x80) {\n    const rPadded = new Uint8Array(r.length + 1)\n    rPadded[0] = 0\n    rPadded.set(r, 1)\n    r = rPadded\n  }\n  if (s.length > 0 && s[0]! & 0x80) {\n    const sPadded = new Uint8Array(s.length + 1)\n    sPadded[0] = 0\n    sPadded.set(s, 1)\n    s = sPadded\n  }\n\n  const rLength = r.length\n  const sLength = s.length\n  const totalLength = 2 + rLength + 2 + sLength\n\n  const der = new Uint8Array(2 + totalLength)\n  der[0] = 0x30 // SEQUENCE\n  der[1] = totalLength\n  der[2] = 0x02 // INTEGER\n  der[3] = rLength\n  der.set(r, 4)\n  der[4 + rLength] = 0x02 // INTEGER\n  der[5 + rLength] = sLength\n  der.set(s, 6 + rLength)\n\n  return der\n}\n"],"mappings":";AACA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACNP,SAAS,OAAO,iBAAiB;AAE1B,IAAM,mCAAqD;AAAA,EAChE,MAAM;AAAA,EACN,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,UAAU;AACZ;AAIO,SAAS,aAAa,cAA8D;AACzF,QAAM,UAAU,oBAAI,IAAoB;AACxC,MAAI,cAAc;AAChB,UAAM,SAAS,MAAM,YAAY;AACjC,eAAW,QAAQ;AACjB,cAAQ,IAAI,MAAM,OAAO,IAAI,CAAE;AAAA,EACnC;AACA,SAAO;AACT;AAEO,IAAM,UAAN,MAAc;AAAA,EAGnB,YACmB,gBACA,gBACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EALH,OAAiB,CAAC;AAAA,EAOlB,IAAI,MAAkC;AACpC,WAAO,KAAK,eAAe,IAAI,IAAI;AAAA,EACrC;AAAA,EAEA,IAAI,MAAc,OAAe,SAAkC;AACjE,UAAM,kBAAkB,EAAE,GAAG,KAAK,gBAAgB,GAAG,QAAQ;AAC7D,SAAK,KAAK,KAAK,CAAC,MAAM,OAAO,eAAe,CAAC;AAAA,EAC/C;AAAA,EAEA,OAAO,MAAc,SAA8D;AACjF,SAAK,IAAI,MAAM,IAAI,EAAE,GAAG,SAAS,SAAS,oBAAI,KAAK,CAAC,GAAG,QAAQ,EAAE,CAAC;AAAA,EACpE;AAAA,EAEA,YAAqB;AACnB,UAAM,UAAU,IAAI,QAAQ;AAC5B,eAAW,CAAC,MAAM,OAAO,OAAO,KAAK,KAAK;AACxC,cAAQ,OAAO,cAAc,UAAU,MAAM,OAAO,OAAO,CAAC;AAE9D,WAAO;AAAA,EACT;AACF;AAEO,IAAM,mBAAmB;AACzB,IAAM,sBAAsB;AAC5B,IAAM,+BAA+B;AACrC,IAAM,4BAA4B;AAClC,IAAM,mBAAmB;AACzB,IAAM,2BAA2B;AACjC,IAAM,+BAA+B;AAErC,IAAM,eAAe,KAAK;;;AC6I1B,SAAS,WAAqD;AAAA,EACnE;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX,KAAK,YAAY,CAAC;AAAA,EAClB,SAAS,gBAAgB,CAAC;AAAA,EAC1B,SAAS,eAAe,CAAC;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,aAAa,CAAC;AAAA,EACd,WAAW;AAAA,EACX,uBAAuB;AAAA,EACvB,uBAAuB;AAAA,EACvB,OAAO,cAAc,CAAC;AAAA,EACtB,OAAO;AAAA,EACP,UAAU;AACZ,GAAoD;AAClD,QAAM,EAAE,YAAY,SAAS,QAAQ,KAAK,KAAK,KAAK,aAAa,OAAO,GAAG,IAAI;AAC/E,QAAM,gBAAgB,EAAE,GAAG,kCAAkC,GAAG,aAAa;AAE7E,QAAM,kBAA+C,cAAc,YAAY;AAE/E,MAAI,cAAc,WAAW,WAAW,UAAa,OAAO,WAAW;AACrE,UAAM,IAAI,UAAU,gDAAgD;AAEtE,QAAM,cAAc,IAAI,IAAI,UAAU,IAAI,OAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAEzD,QAAM,eAA6B,SAAS,QACxC,QACA;AAAA,IACE,iBAAiB,SAAS,OAAO,QAAQ,KAAK,mBAAmB;AAAA,IACjE,mBAAmB,SAAS,OAAO,OAAO,KAAK,qBAAqB;AAAA,IACpE,iBAAiB,SAAS,OAAO,SAAY,KAAK,mBAAmB,CAAC,gBAAgB,iBAAiB,QAAQ;AAAA,IAC/G,iBAAiB,SAAS,OAAO,SAAY,KAAK,mBAAmB,CAAC,OAAO,QAAQ,SAAS;AAAA,IAC9F,eAAe,SAAS,OAAO,SAAY,KAAK;AAAA,IAChD,QAAQ,SAAS,OAAO,SAAY,KAAK;AAAA,EAC3C;AAEJ,QAAM,mBAAoB,kBAAkB,CAAC;AAC7C,QAAM,gBAAgB;AAAA,IACpB,aAAa,YAAY,eAAe;AAAA,IACxC,iBAAiB,YAAY;AAAA,IAC7B,YAAY,YAAY,cAAc,CAAC,OAAO;AAAA,IAC9C,cAAc,YAAY,gBAAgB,CAAC;AAAA,EAC7C;AAEA,WAAS,iBAAiB,SAA+B,CAAC,GAAgB;AACxE,UAAM,OAAO,EAAE,KAAK,OAAO,KAAK,KAAK,OAAO,OAAO,KAAK,KAAK,OAAO,OAAO,KAAK,KAAK,OAAO,IAAI;AAChG,QAAI,cAAc,SAAS;AACzB,aAAO,EAAE,WAAW,QAAQ,OAAO,UAAU,QAAQ,GAAG,KAAK;AAAA,IAC/D,OACK;AACH,UAAI,OAAO,WAAW,UAAa,OAAO,OAAO,WAAW;AAC1D,cAAM,IAAI,UAAU,gDAAgD;AACtE,YAAM,WAAW,OAAO,UAAU;AAClC,aAAO,EAAE,WAAW,YAAY,OAAO,YAAY,QAAQ,UAAU,GAAG,KAAK;AAAA,IAC/E;AAAA,EACF;AAEA,WAAS,mBAAmB,SAAiC,CAAC,GAAkB;AAC9E,UAAM,OAAO,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,OAAO,OAAO,IAAI;AAC9D,QAAI,cAAc,SAAS;AACzB,aAAO,EAAE,WAAW,QAAQ,OAAO,UAAU,QAAQ,GAAG,KAAK;AAAA,IAC/D,OACK;AACH,UAAI,OAAO,WAAW,UAAa,OAAO,OAAO,WAAW;AAC1D,cAAM,IAAI,UAAU,gDAAgD;AACtE,YAAM,WAAW,OAAO,UAAU;AAClC,aAAO,EAAE,WAAW,WAAW,OAAO,WAAW,QAAQ,UAAU,GAAG,KAAK;AAAA,IAC7E;AAAA,EACF;AAEA,iBAAe,QAA2C,SAAY,gBAAsC,CAAC,GAAoB;AAC/H,WAAO,KAAK,SAAS,iBAAiB,aAAa,CAAC;AAAA,EACtD;AAEA,iBAAe,UAAuC,OAAe,gBAAwC,CAAC,GAAsB;AAClI,UAAM,UAAU,mBAAmB,aAAa;AAChD,QAAI;AACF,aAAO,MAAM,OAAU,OAAO,OAAO;AAAA,IACvC,QACM;AACJ,aAAO;AAAA,IACT;AAAA,EACF;AAEA,iBAAe,cAAc,QAAgB,OAAgC,CAAC,GAAG,MAAM,YAA6B;AAClH,UAAM,UAAU,EAAE,KAAK,QAAQ,GAAG,KAAK;AACvC,WAAO,QAAQ,SAAS,EAAE,IAAI,CAAC;AAAA,EACjC;AAEA,iBAAe,gBAAgB,OAA2C;AACxE,UAAM,UAAU,MAAM,UAAqD,KAAK;AAChF,QAAI,CAAC;AACH,aAAO;AAET,UAAM,kBAAkB,MAAM,QAAQ,mBAAmB,QAAQ,GAAG;AACpE,QAAI,CAAC;AACH,aAAO;AAET,UAAM,EAAE,MAAM,SAAS,IAAI;AAC3B,UAAM,UAAU;AAAA,MACd,SAEG,KAAK,QAAQ,cAAc,WAAW,SAAS,KAAK,IAAI,KACrD,cAAc,aAAa,SAAS,KAAK,cAAc,aAAa,SAAS,KAAK,EAAE;AAAA,IAE5F;AACA,UAAM,cAAc,OAAO,EAAE,GAAG,MAAM,QAAQ,IAAI;AAElD,WAAO,EAAE,MAAM,aAAa,SAAS,EAAE,IAAI,OAAO,GAAG,QAAQ,GAAG,SAAS;AAAA,EAC3E;AAEA,iBAAe,eAAe,QAAgB,YAAoB;AAChE,UAAM,WAAW,YAAY,IAAI,UAAU;AAC3C,QAAI,CAAC;AACH,aAAO;AAET,UAAM,WAAW,MAAM,QAAQ,YAAY,MAAM;AACjD,UAAM,UAAU,SAAS,KAAK,OAAK,EAAE,aAAa,UAAU;AAC5D,QAAI,CAAC,WAAW,CAAC,QAAQ;AACvB,aAAO;AAET,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,UAAM,YAAY,OAAO,QAAQ,cAAc,WAAW,QAAQ,aAAa,MAAM;AAErF,QAAI,CAAC;AACH,aAAO,EAAE,aAAa,QAAQ,aAAa,WAAW,QAAQ,aAAa,KAAK;AAElF,QAAI,CAAC,QAAQ,gBAAgB,CAAC,SAAS;AACrC,aAAO;AAET,QAAI;AACF,YAAM,YAAY,MAAM,SAAS,mBAAmB,QAAQ,cAAc,CAAC,CAAC;AAC5E,YAAM,UAAU;AAAA,QACd;AAAA,QACA,UAAU,QAAQ;AAAA,QAClB,mBAAmB,QAAQ;AAAA,QAC3B,aAAa,UAAU,eAAe,QAAQ;AAAA,QAC9C,cAAc,UAAU,gBAAgB,QAAQ;AAAA,QAChD,WAAW,UAAU,aAAa;AAAA,QAClC,SAAS,UAAU,WAAW,QAAQ,WAAW;AAAA,QACjD,WAAW,UAAU,aAAa,QAAQ,aAAa;AAAA,QACvD,OAAO,UAAU,SAAS,QAAQ,SAAS;AAAA,MAC7C;AACA,YAAM,QAAQ,gBAAgB,OAAO;AACrC,aAAO,EAAE,aAAa,QAAQ,aAAc,WAAW,QAAQ,UAAU;AAAA,IAC3E,QACM;AACJ,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,MACH,KAAK;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,OAAO;AAAA,IACP,MAAM;AAAA,EACR;AACF;;;AC1WA,eAAsB,mBAAmB,MAAwB,KAAyD;AACxH,MAAI,CAAC,QAAQ,OAAO,KAAK,oBAAoB;AAC3C,WAAO,EAAE,SAAS,MAAM;AAC1B,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,gBAAgB,GAAG;AAC1C,QAAI,CAAC,OAAO,OAAO,QAAQ;AACzB,aAAO,EAAE,SAAS,MAAM;AAC1B,WAAO;AAAA,EACT,SACO,GAAG;AACR,YAAQ,MAAM,+BAA+B,CAAC;AAC9C,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACF;AAUA,eAAsB,wBAAwB,MAAwB,KAA8C;AAClH,MAAI,CAAC,QAAQ,OAAO,KAAK,uBAAuB;AAC9C,WAAO,IAAI;AACb,MAAI;AACF,UAAM,SAAS,MAAM,KAAK,mBAAmB,GAAG;AAChD,QAAI,CAAC;AACH,aAAO,IAAI;AACb,WAAO,EAAE,GAAG,IAAI,cAAc,GAAG,OAAO;AAAA,EAC1C,SACO,GAAG;AACR,YAAQ,MAAM,kCAAkC,CAAC;AACjD,WAAO,IAAI;AAAA,EACb;AACF;AAUA,eAAsB,uBAAuB,MAAwB,KAAiG;AACpK,MAAI,CAAC,QAAQ,OAAO,KAAK,wBAAwB;AAC/C,WAAO,EAAE,OAAO,KAAK;AACvB,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,oBAAoB,GAAG;AAC9C,QAAI,CAAC;AACH,aAAO,EAAE,OAAO,KAAK;AACvB,WAAO;AAAA,EACT,SACO,GAAG;AACR,YAAQ,MAAM,mCAAmC,CAAC;AAClD,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AACF;AAIA,eAAsB,sBAAsB,MAAwB,KAA6C;AAC/G,MAAI,CAAC,QAAQ,OAAO,KAAK,uBAAuB;AAC9C;AACF,MAAI;AACF,UAAM,KAAK,mBAAmB,GAAG;AAAA,EACnC,SACO,GAAG;AACR,YAAQ,MAAM,kCAAkC,CAAC;AAAA,EACnD;AACF;;;AC9EA,eAAsB,eAAe,SAAkB,MAAY,YAAuC;AACxG,QAAM,WAAW,KAAK,YAAY,IAAI,UAAU;AAChD,MAAI,CAAC;AACH,WAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9D,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,QAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAE1C,MAAI,CAAC,QAAQ,CAAC;AACZ,WAAO,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEjE,QAAM,iBAAiB,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AACjE,QAAM,UAAU,IAAI,QAAQ,gBAAgB,KAAK,aAAa;AAE9D,MAAI;AACJ,MAAI,aAAa;AACjB,MAAI,MAAM,SAAS,GAAG,GAAG;AACvB,UAAM,CAAC,oBAAoB,eAAe,IAAI,MAAM,MAAM,GAAG;AAC7D,iBAAa;AACb,QAAI;AACF,mBAAa,KAAK,mBAAmB,EAAE,KAAK;AAAA,IAC9C,QACM;AACJ,mBAAa;AAAA,IACf;AAAA,EACF,OACK;AACH,iBAAa;AAAA,EACf;AAEA,QAAM,YAAY,QAAQ,IAAI,gBAAgB;AAE9C,MAAI,CAAC,aAAa,cAAc;AAC9B,WAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9D,QAAM,eAAe,QAAQ,IAAI,gBAAgB;AACjD,MAAI,CAAC;AACH,WAAO,KAAK,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEtE,QAAM,cAAc,QAAQ,IAAI,wBAAwB;AACxD,QAAM,qBAAqB,QAAQ,IAAI,4BAA4B;AACnE,MAAI;AACJ,MAAI,oBAAoB;AACtB,QAAI;AACF,YAAM,UAAU,KAAK,kBAAkB;AACvC,YAAM,SAAS,KAAK,MAAM,OAAO;AACjC,0BAAoB,QAAQ;AAAA,IAC9B,QACM;AAAA,IAAC;AAAA,EACT;AACA,QAAM,eAAe,QAAQ,IAAI,yBAAyB;AAE1D,MAAI;AACF,YAAQ,OAAO,yBAAyB;AAE1C,QAAM,YAAY,CAAC,CAAC;AAEpB,MAAI,WAAW;AACb,UAAM,UAAU,MAAM,KAAK,gBAAgB,YAAa;AACxD,QAAI,CAAC,SAAS;AACZ,cAAQ,OAAO,gBAAgB;AAC/B,cAAQ,OAAO,gBAAgB;AAC/B,UAAI;AACF,gBAAQ,OAAO,wBAAwB;AACzC,cAAQ,OAAO,4BAA4B;AAC3C,YAAMA,YAAW,SAAS,UAAU;AACpC,cAAQ,UAAU,EAAE,QAAQ,CAAC,OAAO,QAAQA,UAAS,QAAQ,OAAO,KAAK,KAAK,CAAC;AAC/E,aAAOA;AAAA,IACT;AAAA,EACF;AAEA,QAAM,EAAE,MAAM,iBAAiB,OAAO,IAAI,MAAM,SAAS,iBAAiB,MAAM,cAAc,eAAe,QAAW,iBAAiB;AAEzI;AACE,UAAM,UAAU,YAAY,MAAM,KAAK,gBAAgB,YAAa,IAAI;AACxE,UAAM,aAAa,MAAM,mBAAmB,MAAM;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA;AAAA,MACA,eAAe,SAAS,MAAM;AAAA,IAChC,CAAC;AACD,QAAI,WAAW,SAAS;AACtB,cAAQ,OAAO,gBAAgB;AAC/B,cAAQ,OAAO,gBAAgB;AAC/B,UAAI;AACF,gBAAQ,OAAO,wBAAwB;AACzC,cAAQ,OAAO,4BAA4B;AAC3C,YAAMA,YAAW,WAAW;AAC5B,cAAQ,UAAU,EAAE,QAAQ,CAAC,OAAO,QAAQA,UAAS,QAAQ,OAAO,KAAK,KAAK,CAAC;AAC/E,aAAOA;AAAA,IACT;AAAA,EACF;AAEA,QAAM,eAAe,MAAM,wBAAwB,MAAM;AAAA,IACvD;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd;AAAA,IACA;AAAA,EACF,CAAC;AAGD,MAAI,CAAC,aAAc,KAAK,YAAY,IAAI,UAAU,GAAG,aAAa,MAAO;AACvE,YAAQ,OAAO,gBAAgB;AAC/B,YAAQ,OAAO,gBAAgB;AAC/B,QAAI;AACF,cAAQ,OAAO,wBAAwB;AACzC,YAAQ,OAAO,4BAA4B;AAC3C,UAAMA,YAAW,KAAK,EAAE,OAAO,iFAAiF,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAQ,UAAU,EAAE,QAAQ,CAAC,OAAO,QAAQA,UAAS,QAAQ,OAAO,KAAK,KAAK,CAAC;AAC/E,WAAOA;AAAA,EACT;AAEA,MAAI,OAAoB;AAExB,QAAM,kBAAkB,MAAM,KAAK,iBAAiB,YAAY,aAAa,EAAE;AAE/E,MAAI,WAAW;AACb,UAAM,UAAU,MAAM,KAAK,gBAAgB,YAAY;AACvD,WAAO,QAAS;AAEhB,QAAI,CAAC;AACH,aAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE1D,QAAI,mBAAmB,gBAAgB,OAAO,KAAK;AACjD,aAAO,KAAK,EAAE,OAAO,yCAAyC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,QAAI,KAAK,yBAAyB,OAAO;AACvC,YAAM,eAAe,KAAK;AAC1B,YAAM,gBAAgB,aAAa;AACnC,UAAI,gBAAgB,iBAAiB,iBAAiB;AACpD,eAAO,KAAK,EAAE,OAAO,uDAAuD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClG;AAEA,QAAI,MAAM;AACR,YAAM,SAAyC,EAAE,IAAI,KAAK,GAAG;AAC7D,UAAI,cAAc;AAElB,UAAI,KAAK,sBAAsB;AAC7B,YAAI,aAAa,QAAQ,aAAa,SAAS,KAAK,MAAM;AACxD,iBAAO,OAAO,aAAa;AAC3B,wBAAc;AAAA,QAChB;AACA,YAAI,aAAa,UAAU,aAAa,WAAW,KAAK,OAAO;AAC7D,iBAAO,QAAQ,aAAa;AAC5B,wBAAc;AAAA,QAChB;AAAA,MACF,OACK;AACH,YAAI,CAAC,KAAK,QAAQ,aAAa,MAAM;AACnC,iBAAO,OAAO,aAAa;AAC3B,wBAAc;AAAA,QAChB;AACA,YAAI,CAAC,KAAK,SAAS,aAAa,QAAQ;AACtC,iBAAO,QAAQ,aAAa;AAC5B,wBAAc;AAAA,QAChB;AAAA,MACF;AAEA,UACE,KAAK,SACF,aAAa,SACb,KAAK,UAAU,aAAa,SAC5B,aAAa,kBAAkB,SAC9B,CAAC,KAAK,iBAAiB,KAAK,uBAChC;AACA,eAAO,gBAAgB;AACvB,sBAAc;AAAA,MAChB;AAEA,UAAI,aAAa;AACf,YAAI;AACF,iBAAO,MAAM,KAAK,WAAW,MAAM;AAAA,QACrC,SACO,GAAG;AACR,kBAAQ,MAAM,uCAAuC,CAAC;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AAAA,EACF,OACK;AACH,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,MAAM;AACT,UAAM,WAAW,KAAK,YAAY;AAClC,UAAM,oBAAoB,aAAa,UACpC,aAAa,YACV,aAAa,mBAAmB,aAAa,kBAAkB;AAErE,QAAI,mBAAmB;AACrB,YAAM,eAAe,MAAM,KAAK,eAAe,aAAa,KAAM;AAClE,UAAI,cAAc;AAGhB,YAAI,aAAa,iBAAiB,CAAC,aAAa,eAAe;AAC7D,iBAAO,MAAM,KAAK,WAAW;AAAA,YAC3B,IAAI,aAAa;AAAA,YACjB,eAAe;AAAA,UACjB,CAAC;AAAA,QACH,OACK;AACH,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,MAAM;AACT,UAAI;AACF,YAAI,aAAa,SAAS,aAAa,kBAAkB,QAAQ,KAAK,aAAa,OAAO;AACxF,gBAAM,wBAAwB,MAAM,KAAK,eAAe,aAAa,KAAK;AAC1E,cAAI;AACF,mBAAO,KAAK,EAAE,OAAO,oGAAoG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QAC/I;AAEA,YAAI;AACJ,YAAI;AACF,yBAAe,KAAK,MAAM,kBAAkB,EAAE,YAAY,SAAS,cAAc,QAAuC,CAAC;AAAA,QAC3H,SACO,GAAG;AACR,kBAAQ,MAAM,gCAAgC,CAAC;AAAA,QACjD;AAEA,cAAM,eAAe,aAAa,kBAAkB,OAAO,aAAa,QAAQ;AAEhF,eAAO,MAAM,KAAK,WAAW;AAAA,UAC3B,MAAM,aAAa;AAAA,UACnB,OAAO;AAAA,UACP,OAAO,aAAa;AAAA,UACpB,eAAe,aAAa;AAAA,UAC5B,MAAM,gBAAgB,KAAK,MAAM;AAAA,QACnC,CAAC;AAAA,MACH,SACO,OAAO;AACZ,gBAAQ,MAAM,0BAA0B,KAAK;AAC7C,eAAO,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AAGA,MAAI,QAAQ,aAAa,OAAO;AAC9B,UAAM,EAAE,OAAO,cAAc,eAAe,qBAAqB,IAAI;AACrE,UAAM,EAAE,OAAO,eAAe,eAAe,sBAAsB,IAAI;AAEvE,UAAM,SAAyC,EAAE,IAAI,KAAK,GAAG;AAC7D,QAAI,cAAc;AAGlB,QAAI,CAAC,gBAAgB,0BAA0B,MAAM;AACnD,aAAO,QAAQ;AACf,aAAO,gBAAgB;AACvB,oBAAc;AAAA,IAChB,WAGE,iBAAiB,iBACd,0BAA0B,QAC1B,CAAC,sBACJ;AACA,aAAO,gBAAgB;AACvB,oBAAc;AAAA,IAChB;AAEA,QAAI,aAAa;AACf,UAAI;AACF,eAAO,MAAM,KAAK,WAAW,MAAM;AAAA,MACrC,SACO,OAAO;AACZ,gBAAQ,MAAM,wCAAwC,KAAK;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,iBAAiB;AAEpB,QAAI;AACJ,QAAI;AACF,qBAAe,OAAO,aAAa;AAAA,IACrC,QACM;AACJ,qBAAe;AAAA,IACjB;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,gBAAgB,OAAO,qBAAqB;AAClD,UAAI;AACF,oBAAY,KAAK,MAAM,cAAc,QAAQ,IAAI,GAAI;AAAA,IACzD,QACM;AAAA,IACN;AAEA,QAAI;AACJ,QAAI;AACF,gBAAU,OAAO,QAAQ;AAAA,IAC3B,QACM;AACJ,gBAAU;AAAA,IACZ;AAEA;AACE,YAAM,MAAM,MAAM,uBAAuB,MAAM;AAAA,QAC7C;AAAA,QACA;AAAA,QACA,QAAQ,KAAK;AAAA,QACb;AAAA,QACA;AAAA,MACF,CAAC;AACD,UAAI,IAAI,UAAU,OAAO;AACvB,cAAMA,YAAW,IAAI,YAAY,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvF,gBAAQ,UAAU,EAAE,QAAQ,CAAC,OAAO,QAAQA,UAAS,QAAQ,OAAO,KAAK,KAAK,CAAC;AAC/E,eAAOA;AAAA,MACT;AAAA,IACF;AAEA,QAAI;AACF,UAAI;AACJ,UAAI;AACF,gBAAQ,OAAO,OAAO,GAAG,KAAK,GAAG,KAAK;AAAA,MACxC,QACM;AACJ,gBAAQ;AAAA,MACV;AAEA,YAAM,KAAK,YAAY;AAAA,QACrB,QAAQ,KAAK;AAAA,QACb,UAAU;AAAA,QACV,mBAAmB,aAAa;AAAA,QAChC,aAAa,OAAO,YAAY;AAAA,QAChC;AAAA,QACA;AAAA,QACA,WAAW,OAAO,YAAY,KAAK;AAAA,QACnC;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,sBAAsB,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,QACA,QAAQ,KAAK;AAAA,QACb;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,MACV,CAAC;AAAA,IACH,SACO,OAAO;AACZ,cAAQ,MAAM,0BAA0B,KAAK;AAC7C,aAAO,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AAAA,EACF,OACK;AAEH,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,YAAY,KAAM,EAAE;AAChD,YAAM,WAAW,SAAS,KAAK,OAAK,EAAE,aAAa,cAAc,EAAE,sBAAsB,aAAa,EAAE;AAExG,UAAI,YAAY,KAAK,eAAe;AAClC,YAAI;AACJ,YAAI;AACF,yBAAe,OAAO,aAAa;AAAA,QACrC,QACM;AACJ,yBAAe,SAAS,gBAAgB;AAAA,QAC1C;AAEA,YAAI;AACJ,YAAI;AACF,gBAAM,gBAAgB,OAAO,qBAAqB;AAClD,cAAI;AACF,wBAAY,KAAK,MAAM,cAAc,QAAQ,IAAI,GAAI;AAAA,QACzD,QACM;AACJ,sBAAY,SAAS,aAAa;AAAA,QACpC;AAEA,YAAI;AACJ,YAAI;AACF,oBAAU,OAAO,QAAQ;AAAA,QAC3B,QACM;AACJ,oBAAU,SAAS,WAAW;AAAA,QAChC;AAEA,YAAI;AACJ,YAAI;AACF,kBAAQ,OAAO,OAAO,GAAG,KAAK,GAAG,KAAK,SAAS,SAAS;AAAA,QAC1D,QACM;AACJ,kBAAQ,SAAS,SAAS;AAAA,QAC5B;AAEA,cAAM,KAAK,cAAc;AAAA,UACvB,QAAQ,KAAM;AAAA,UACd,UAAU;AAAA,UACV,mBAAmB,aAAa;AAAA,UAChC,aAAa,OAAO,YAAY,KAAK,SAAS,eAAe;AAAA,UAC7D;AAAA,UACA,WAAW,aAAa,SAAS,aAAa;AAAA,UAC9C,WAAW,OAAO,YAAY,KAAK,SAAS,aAAa;AAAA,UACzD;AAAA,UACA;AAAA,QACF,CAAC;AACD,cAAM,sBAAsB,MAAM;AAAA,UAChC;AAAA,UACA;AAAA,UACA,QAAQ,KAAM;AAAA,UACd;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF,SACO,OAAO;AACZ,cAAQ,MAAM,+CAA+C,KAAK;AAAA,IACpE;AAAA,EACF;AAEA,QAAM,eAAe,MAAM,KAAK,cAAc,KAAK,EAAE;AAErD,QAAM,aAAa,IAAI,IAAI,QAAQ,GAAG;AACtC,QAAM,cAAc,IAAI,IAAI,YAAY,QAAQ,GAAG;AAEnD,QAAM,aAAa,KAAK,oBAAoB;AAC5C,QAAM,cAAc,KAAK,oBAAoB;AAE7C,QAAM,iBAAiB,YAAY,aAAa,WAAW,YAAY,aAAa;AACpF,QAAM,cAAc,WAAW,SAAS,YAAY;AAMpD,MAAI,cAAe,CAAC,gBAAgB,kBAAkB,cAAe;AACnE,UAAM,cAAc,IAAI,IAAI,WAAW;AAEvC,gBAAY,OAAO,SAAS,YAAY;AAExC,UAAM,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAoCG,KAAK,UAAU,YAAY,SAAS,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAetD,YAAQ,OAAO,gBAAgB;AAC/B,YAAQ,OAAO,gBAAgB;AAC/B,QAAI;AACF,cAAQ,OAAO,wBAAwB;AACzC,YAAQ,OAAO,4BAA4B;AAE3C,UAAMA,YAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,2BAA2B;AAAA,IACxD,CAAC;AACD,YAAQ,UAAU,EAAE,QAAQ,CAAC,OAAO,QAAQ;AAC1C,MAAAA,UAAS,QAAQ,OAAO,KAAK,KAAK;AAAA,IACpC,CAAC;AACD,WAAOA;AAAA,EACT;AAEA,UAAQ,IAAI,qBAAqB,cAAc;AAAA,IAC7C,QAAQ,KAAK,IAAI;AAAA,IACjB,UAAU,KAAK,cAAc,QAAQ;AAAA,IACrC,QAAQ,CAAC,KAAK;AAAA,EAChB,CAAC;AACD,UAAQ,OAAO,gBAAgB;AAC/B,UAAQ,OAAO,gBAAgB;AAC/B,MAAI;AACF,YAAQ,OAAO,wBAAwB;AACzC,UAAQ,OAAO,4BAA4B;AAE3C,QAAM,gBAAgB,IAAI,aAAa,IAAI,UAAU;AAErD,MAAI;AACJ,MAAI,kBAAkB,SAAS;AAC7B,UAAM,WAAW,MAAM,KAAK,YAAY,KAAK,EAAE;AAC/C,UAAM,UAAU;AAAA,MACb,KAAK,QAAQ,KAAK,MAAM,WAAW,SAAS,KAAK,IAAI,KACnD,KAAK,MAAM,aAAa,SAAS,KAAK,EAAE;AAAA,IAC7C;AACA,eAAW,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,SAAS,EAAE,CAAC;AAAA,EAC1D,OACK;AACH,eAAW,SAAS,UAAU;AAAA,EAChC;AAEA,UAAQ,UAAU,EAAE,QAAQ,CAAC,OAAO,QAAQ;AAC1C,aAAS,QAAQ,OAAO,KAAK,KAAK;AAAA,EACpC,CAAC;AAED,SAAO;AACT;;;AC5iBA,SAAS,cAAc,QAAgB,MAAqB;AAC1D,MAAI,KAAK,SAAS;AAChB,WAAO;AACT,QAAM,MAAM,KAAK;AACjB,MAAI,IAAI,mBAAmB;AACzB,WAAO;AACT,MAAI,IAAI,mBAAmB,SAAS;AAClC,QAAI,KAAK,eAAe;AACtB,aAAO;AACT,QAAI;AACF,YAAM,IAAI,IAAI,IAAI,MAAM;AACxB,aAAO,KAAK,WAAW,SAAS,EAAE,IAAI,KAAK,KAAK,WAAW,SAAS,EAAE,QAAQ;AAAA,IAChF,QACM;AACJ,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,IAAI,eAAe,SAAS,GAAG;AACjC,WAAO;AACT,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,MAAM;AACxB,WAAO,IAAI,eAAe,SAAS,MAAM,KAAK,IAAI,eAAe,SAAS,EAAE,MAAM,KAAK,IAAI,eAAe,SAAS,EAAE,IAAI,KAAK,IAAI,eAAe,SAAS,EAAE,QAAQ;AAAA,EACtK,QACM;AACJ,WAAO,IAAI,eAAe,SAAS,MAAM;AAAA,EAC3C;AACF;AAEO,SAAS,UAAU,SAAkB,UAAoB,MAAsB;AACpF,MAAI,KAAK,SAAS;AAChB,WAAO;AAET,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ,KAAK,QAAQ,QAAQ,IAAI,QAAQ;AAC5E,MAAI,CAAC;AACH,WAAO;AAET,MAAI,CAAC,cAAc,QAAQ,IAAI;AAC7B,WAAO;AAET,QAAM,MAAM,KAAK;AACjB,WAAS,QAAQ,IAAI,QAAQ,QAAQ;AACrC,QAAM,aAAa,IAAI;AACvB,QAAM,mBAAoB,IAAI,mBAAmB,SAAS,CAAC,aAAc,MAAM;AAC/E,WAAS,QAAQ,IAAI,+BAA+B,gBAAgB;AACpE,MAAI;AACF,aAAS,QAAQ,IAAI,oCAAoC,MAAM;AACjE,WAAS,QAAQ,IAAI,gCAAgC,IAAI,eAAe,KAAK,IAAI,CAAC;AAClF,WAAS,QAAQ,IAAI,gCAAgC,IAAI,eAAe,KAAK,IAAI,CAAC;AAClF,MAAI,IAAI,eAAe;AACrB,aAAS,QAAQ,IAAI,iCAAiC,IAAI,cAAc,KAAK,IAAI,CAAC;AACpF,SAAO;AACT;AAEO,SAAS,gBAAgB,SAAkB,MAAsB;AACtE,MAAI,KAAK,SAAS;AAChB,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAE3C,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ,KAAK,QAAQ,QAAQ,IAAI,QAAQ;AAC5E,QAAM,MAAM,KAAK;AACjB,QAAM,UAAkC,CAAC;AACzC,MAAI,UAAU,cAAc,QAAQ,IAAI,GAAG;AACzC,UAAM,aAAa,IAAI;AACvB,UAAM,mBAAoB,IAAI,mBAAmB,SAAS,CAAC,aAAc,MAAM;AAC/E,YAAQ,6BAA6B,IAAI;AACzC,QAAI;AACF,cAAQ,kCAAkC,IAAI;AAAA,EAClD;AACA,UAAQ,8BAA8B,IAAI,IAAI,eAAe,KAAK,IAAI;AACtE,UAAQ,8BAA8B,IAAI,IAAI,eAAe,KAAK,IAAI;AACtE,MAAI,IAAI,UAAU;AAChB,YAAQ,wBAAwB,IAAI,OAAO,IAAI,MAAM;AACvD,MAAI,IAAI,eAAe;AACrB,YAAQ,+BAA+B,IAAI,IAAI,cAAc,KAAK,IAAI;AACxE,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AACpD;;;AC5EA,SAAS,sBAAsB,qBAAqB;AAE7C,SAAS,kBAAkB;AAChC,QAAM,QAAQ,cAAc;AAC5B,QAAM,eAAe,qBAAqB;AAE1C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;;;ACIO,SAAS,oBAAoB,SAAkB,YAA8B,aAA+B;AACjH,MAAI,eAAe;AACjB,WAAO;AAET,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAE3C,MAAI,CAAC;AACH,WAAO;AAET,MAAI;AACJ,MAAI;AACF,iBAAa,IAAI,IAAI,MAAM,EAAE;AAAA,EAC/B,QACM;AACJ,WAAO;AAAA,EACT;AAEA,MAAI,aAAa;AACf,UAAM,UAAU,WAAW,WAAW,WAAW,KAAK,WAAW,WAAW,WAAW;AACvF,QAAI;AACF,aAAO;AAAA,EACX;AAEA,QAAM,aAAa,IAAI,IAAI,QAAQ,GAAG;AACtC,QAAM,cAAc,WAAW;AAC/B,QAAM,gBAAgB,GAAG,WAAW,QAAQ,KAAK,WAAW;AAE5D,MAAI,WAAW;AACb,WAAO;AAET,SAAO,WAAW,SAAS,UAAU;AACvC;AAEA,eAAsB,qBACpB,SACA,MACA,YACA,cACmB;AACnB,QAAM,WAAW,KAAK,YAAY,IAAI,UAAU;AAChD,MAAI,CAAC;AACH,WAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9D,QAAM,EAAE,OAAO,eAAe,aAAa,IAAI,gBAAgB;AAC/D,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,aAAa,IAAI,aAAa,IAAI,YAAY;AACpD,QAAM,cAAc,IAAI,aAAa,IAAI,SAAS;AAClD,QAAM,cAAc,IAAI,aAAa,IAAI,QAAQ;AAEjD,MAAI,YAAY;AACd,QAAI;AACJ,QAAI;AACF,UAAI,WAAW,WAAW,IAAI;AAC5B,cAAM,IAAI,MAAM,mCAAmC;AACrD,uBAAiB,IAAI,IAAI,YAAY,IAAI,MAAM;AAAA,IACjD,QACM;AACJ,aAAO,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpE;AAEA,UAAM,eAAe,eAAe;AACpC,UAAM,cAAc,IAAI,IAAI,QAAQ,GAAG,EAAE;AAEzC,UAAM,aAAa,iBAAiB;AACpC,UAAM,YAAY,KAAK,eAAe,SAAS,KAAK,WAAW,SAAS,YAAY;AACpF,UAAM,SAAS,eAAe,aAAa,WAAW,eAAe,aAAa;AAElF,QAAI,UAAU,CAAC,cAAc,CAAC;AAC5B,aAAO,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,QAAQ,aAAa,GAAG,aAAa,IAAI,KAAK,UAAU,CAAC,KAAK;AACpE,MAAI,cAAc,IAAI,aAAa,IAAI,aAAa;AACpD,MAAI,CAAC,eAAe,SAAS;AAC3B,kBAAc,GAAG,IAAI,MAAM,GAAG,KAAK,QAAQ,aAAa,UAAU;AAEpE,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI,aAAa;AACf,UAAM,mBAAmB,KAAK,WAAW,UAAU,KAAK,CAAC;AACzD,UAAM,WAAW,iBAAiB,WAAW;AAC7C,QAAI,CAAC;AACH,aAAO,KAAK,EAAE,OAAO,oBAAoB,WAAW,mBAAmB,UAAU,IAAI,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzG,QAAI,SAAS;AACX,oBAAc,SAAS;AACzB,QAAI,SAAS;AACX,uBAAiB,SAAS;AAC5B,QAAI,SAAS;AACX,oBAAc,EAAE,GAAI,SAAS,UAAU,CAAC,EAAG;AAC7C,UAAM,EAAE,QAAQ,OAAO,IAAI;AAC3B,QAAI,UAAU,QAAQ,UAAU;AAC9B,kBAAY,EAAE,GAAI,aAAa,CAAC,GAAI,QAAQ,OAAO;AACrD,QAAI,CAAC,gBAAgB,SAAS,aAAa;AACzC,aAAO,KAAK,EAAE,OAAO,oEAAoE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/G;AAEA,MAAI;AACF,kBAAc,EAAE,GAAI,eAAe,CAAC,GAAI,QAAQ,YAAY;AAE9D,MAAI,CAAC,gBAAiB,SAAS,aAAa;AAC1C,WAAO,KAAK,EAAE,OAAO,iFAAiF,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE1H,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,SAAS,oBAAoB,OAAO,cAAc;AAAA,MAChE,aAAa,eAAe;AAAA,MAC5B,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH,SACO,OAAO;AACZ,YAAQ,MAAM,oCAAoC,KAAK;AACvD,cAAU;AAAA,EACZ;AAEA,MAAI,CAAC;AACH,WAAO,KAAK,EAAE,OAAO,qCAAqC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,iBAAiB,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AACjE,QAAM,UAAU,IAAI,QAAQ,gBAAgB,KAAK,aAAa;AAE9D,QAAM,yBAAyB;AAAA,IAC7B,QAAQ;AAAA,IACR,UAAU,KAAK,cAAc,QAAQ;AAAA,IACrC,QAAQ,CAAC,KAAK;AAAA,EAChB;AAEA,UAAQ,IAAI,kBAAkB,eAAe,sBAAsB;AACnE,UAAQ,IAAI,kBAAkB,cAAc,sBAAsB;AAClE,MAAI,cAAc;AAChB,YAAQ,IAAI,2BAA2B,cAAc,sBAAsB;AAAA,EAC7E,OACK;AACH,YAAQ,OAAO,2BAA2B;AAAA,MACxC,UAAU,KAAK,cAAc,QAAQ;AAAA,MACrC,QAAQ,CAAC,KAAK;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,MAAI;AACF,YAAQ,IAAI,0BAA0B,aAAa,sBAAsB;AAE3E,QAAM,oBAAoB,KAAK,UAAU,EAAE,QAAQ,eAAe,CAAC,GAAG,WAAW,aAAa,CAAC,EAAE,CAAC;AAClG,UAAQ,IAAI,8BAA8B,KAAK,iBAAiB,GAAG,sBAAsB;AAEzF,QAAM,gBAAgB,IAAI,aAAa,IAAI,UAAU;AAErD,MAAI,kBAAkB,SAAS;AAC7B,UAAMC,YAAW,KAAK,EAAE,KAAK,QAAQ,SAAS,EAAE,CAAC;AACjD,YAAQ,UAAU,EAAE,QAAQ,CAAC,OAAO,QAAQ;AAC1C,MAAAA,UAAS,QAAQ,OAAO,KAAK,KAAK;AAAA,IACpC,CAAC;AACD,WAAOA;AAAA,EACT;AAEA,QAAM,WAAW,SAAS,QAAQ,SAAS,CAAC;AAC5C,UAAQ,UAAU,EAAE,QAAQ,CAAC,OAAO,QAAQ;AAC1C,aAAS,QAAQ,OAAO,KAAK,KAAK;AAAA,EACpC,CAAC;AAED,SAAO;AACT;;;AC5KA,eAAsB,WAAW,SAAkB,MAAY,YAAuC;AACpG,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,iBAAiB,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AACjE,MAAI,eAAe,eAAe,IAAI,mBAAmB;AAEzD,MAAI,CAAC,cAAc;AACjB,UAAM,aAAa,QAAQ,QAAQ,IAAI,eAAe;AACtD,QAAI,YAAY,WAAW,SAAS;AAClC,qBAAe,WAAW,UAAU,CAAC;AAAA,EACzC;AAEA,MAAI,CAAC;AACH,mBAAe,IAAI,aAAa,IAAI,OAAO,KAAK;AAElD,MAAI,CAAC;AACH,WAAO,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAExD,QAAM,UAAU,MAAM,KAAK,gBAAgB,YAAY;AACvD,MAAI,CAAC;AACH,WAAO,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAExD,MAAI,aAAa,OAAO,OAAO;AAC/B,QAAM,eAAe,IAAI,QAAQ,IAAI,SAAS,GAAG,OAAkB;AAEnE,SAAO,qBAAqB,cAAc,MAAM,YAAY,YAAY;AAC1E;AAEA,eAAsB,aAAa,SAAkB,MAAY,YAAuC;AACtG,QAAM,iBAAiB,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AACjE,MAAI,eAAe,eAAe,IAAI,mBAAmB;AAEzD,MAAI,CAAC,cAAc;AACjB,UAAM,aAAa,QAAQ,QAAQ,IAAI,eAAe;AACtD,QAAI,YAAY,WAAW,SAAS;AAClC,qBAAe,WAAW,UAAU,CAAC;AAAA,EACzC;AAEA,MAAI,CAAC;AACH,WAAO,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAExD,QAAM,UAAU,MAAM,KAAK,gBAAgB,YAAY;AACvD,MAAI,CAAC,WAAW,CAAC,QAAQ;AACvB,WAAO,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAExD,QAAM,WAAW,QAAQ,YAAY,CAAC;AAEtC,MAAI,SAAS,UAAU;AACrB,WAAO,KAAK,EAAE,OAAO,iCAAiC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE1E,QAAM,kBAAkB,SAAS,KAAK,OAAK,EAAE,aAAa,UAAU;AACpE,MAAI,CAAC;AACH,WAAO,KAAK,EAAE,OAAO,aAAa,UAAU,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE/F,QAAM,KAAK,cAAc,YAAY,gBAAgB,iBAAiB;AAEtE,QAAM,oBAAoB,MAAM,KAAK,YAAY,QAAQ,KAAK,EAAE;AAIhE,MAAI,kBAAkB,SAAS,KAAK,QAAQ,KAAK,OAAO;AACtD,QAAI;AACF,YAAM,KAAK,WAAW;AAAA,QACpB,IAAI,QAAQ,KAAK;AAAA,QACjB,OAAO;AAAA,QACP,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,SACO,OAAO;AACZ,cAAQ,MAAM,gDAAgD,KAAK;AAAA,IACrE;AAAA,EACF;AAEA,SAAO,KAAK,EAAE,SAAS,gCAAgC,CAAC;AAC1D;;;ACxEA,eAAsB,aAAa,SAAkB,MAAY,YAAuC;AACtG,SAAO,qBAAqB,SAAS,MAAM,YAAY,IAAI;AAC7D;AAEA,eAAsB,cAAc,SAAkB,MAA+B;AACnF,QAAM,iBAAiB,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AACjE,QAAM,UAAU,IAAI,QAAQ,gBAAgB,KAAK,aAAa;AAC9D,UAAQ,OAAO,qBAAqB;AAAA,IAClC,UAAU,KAAK,cAAc,QAAQ;AAAA,IACrC,QAAQ,CAAC,KAAK;AAAA,EAChB,CAAC;AACD,UAAQ,OAAO,2BAA2B;AAAA,IACxC,UAAU,KAAK,cAAc,QAAQ;AAAA,IACrC,QAAQ,CAAC,KAAK;AAAA,EAChB,CAAC;AAED,QAAM,WAAW,KAAK,EAAE,SAAS,aAAa,CAAC;AAC/C,UAAQ,UAAU,EAAE,QAAQ,CAAC,OAAO,QAAQ;AAC1C,aAAS,QAAQ,OAAO,KAAK,KAAK;AAAA,EACpC,CAAC;AAED,SAAO;AACT;;;ACxBA,eAAsB,cAAc,SAAkB,MAA+B;AACnF,QAAM,kBAAkB,QAAQ,QAAQ,IAAI,QAAQ;AACpD,QAAM,iBAAiB,aAAa,eAAe;AACnD,MAAI,eAAe,eAAe,IAAI,mBAAmB;AAEzD,MAAI,CAAC,cAAc;AACjB,UAAM,aAAa,QAAQ,QAAQ,IAAI,eAAe;AACtD,QAAI,YAAY,WAAW,SAAS;AAClC,qBAAe,WAAW,UAAU,CAAC;AAAA,EACzC;AAEA,QAAM,YAAY,MAAM,KAAK,KAAK,YAAY,KAAK,CAAC;AAEpD,MAAI,CAAC;AACH,WAAO,KAAK,EAAE,GAAG,cAAc,UAAU,CAAC;AAE5C,MAAI;AACF,UAAM,cAAc,MAAM,KAAK,gBAAgB,YAAY;AAE3D,QAAI,CAAC;AACH,aAAO,KAAK,EAAE,GAAG,cAAc,UAAU,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE7D,WAAO,KAAK,EAAE,GAAG,aAAa,UAAU,CAAC;AAAA,EAC3C,SACO,OAAO;AACZ,YAAQ,MAAM,6BAA6B,KAAK;AAChD,WAAO,KAAK,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AACF;;;AClBO,SAAS,cAAc,MAAqD;AACjF,QAAM,EAAE,SAAS,IAAI;AAErB,SAAO,eAAgB,SAAqC;AAE1D,QAAI,QAAQ,WAAW;AACrB,aAAO,gBAAgB,SAAS,IAAI;AAEtC,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAI,CAAC,IAAI,SAAS,WAAW,QAAQ;AACnC,aAAO,UAAU,SAAS,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC,GAAG,IAAI;AAE/E,QAAI,QAAQ,WAAW,UAAU,CAAC,oBAAoB,SAAS,KAAK,YAAY,KAAK,WAAW,GAAG;AACjG,UAAI,KAAK,aAAa;AACpB,cAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AAChD,cAAM,UAAU,sBAAsB,MAAM;AAC5C,eAAO,UAAU,SAAS,KAAK,EAAE,OAAO,aAAa,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC,GAAG,IAAI;AAAA,MACxF;AACA,aAAO,UAAU,SAAS,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC,GAAG,IAAI;AAAA,IAC/E;AAEA,UAAM,OAAO,IAAI,SAAS,UAAU,SAAS,MAAM;AACnD,UAAM,QAAQ,KAAK,MAAM,GAAG,EAAE,OAAO,OAAO;AAC5C,UAAM,SAAS,MAAM,CAAC;AAEtB,QAAI,CAAC;AACH,aAAO,UAAU,SAAS,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC,GAAG,IAAI;AAE/E,QAAI;AAEJ,QAAI,QAAQ,WAAW,OAAO;AAC5B,UAAI,WAAW;AACb,mBAAW,MAAM,cAAc,SAAS,IAAI;AAAA,eACrC,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AAC1C,mBAAW,MAAM,WAAW,SAAS,MAAM,MAAM,CAAC,CAAW;AAAA,eACtD,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AAC1C,mBAAW,MAAM,eAAe,SAAS,MAAM,MAAM,CAAC,CAAW;AAAA,eAC1D,MAAM,WAAW;AACxB,mBAAW,MAAM,aAAa,SAAS,MAAM,MAAM;AAAA;AAEnD,mBAAW,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D,WACS,QAAQ,WAAW,QAAQ;AAClC,UAAI,MAAM,WAAW,KAAK,WAAW;AACnC,mBAAW,MAAM,cAAc,SAAS,IAAI;AAAA,eACrC,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AAC1C,mBAAW,MAAM,aAAa,SAAS,MAAM,MAAM,CAAC,CAAW;AAAA;AAE/D,mBAAW,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D,OACK;AACH,iBAAW,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AAEA,QAAI;AACF,eAAS,QAAQ,IAAI,iBAAiB,mBAAmB;AACzD,eAAS,QAAQ,IAAI,UAAU,UAAU;AACzC,eAAS,QAAQ,IAAI,WAAW,GAAG;AAAA,IACrC,QACM;AAAA,IAAC;AAEP,WAAO,UAAU,SAAS,UAAU,IAAI;AAAA,EAC1C;AACF;;;ACtDO,IAAM,eAAe;AAAA,EAC1B,MAAM;AAAA,EACN,SAAS;AAAA,EACT,UAAU;AACZ;AAoCO,IAAM,YAAN,cAAwB,MAAM;AAAA,EACjB;AAAA,EAClB,YAAY,SAAiB,OAAiB;AAC5C,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,QAAQ;AAAA,EACf;AACF;AAEO,SAAS,KAAQ,MAAS,OAAqB,CAAC,GAAa;AAClE,QAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,MAAI,CAAC,QAAQ,IAAI,cAAc;AAC7B,YAAQ,IAAI,gBAAgB,iCAAiC;AAC/D,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC;AAChE;AAEO,SAAS,SAAS,KAAa,SAAoB,KAAe;AACvE,SAAO,IAAI,SAAS,MAAM;AAAA,IACxB;AAAA,IACA,SAAS;AAAA,MACP,UAAU;AAAA,IACZ;AAAA,EACF,CAAC;AACH;;;ACpFO,SAAS,kBAAkB,GAAe,GAAwB;AACvE,MAAI,OAAO,EAAE,SAAS,EAAE;AACxB,QAAM,MAAM,KAAK,IAAI,EAAE,QAAQ,EAAE,MAAM;AACvC,WAAS,IAAI,GAAG,IAAI,KAAK;AACvB,aAAS,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC,KAAK;AAEjC,SAAO,SAAS;AAClB;AAEA,SAAS,iBAAiB,WAA+B;AACvD,QAAM,SAAS,UAAU,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC7D,QAAM,aAAa,IAAK,OAAO,SAAS,KAAM;AAC9C,QAAM,SAAS,OAAO,OAAO,OAAO,SAAS,WAAW,GAAG;AAC3D,MAAI;AACF,UAAM,gBAAgB,KAAK,MAAM;AACjC,UAAM,MAAM,cAAc;AAC1B,UAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,aAAS,IAAI,GAAG,IAAI,KAAK;AACvB,YAAM,CAAC,IAAI,cAAc,WAAW,CAAC;AAEvC,WAAO;AAAA,EACT,QACM;AACJ,UAAM,IAAI,UAAU,0BAA0B;AAAA,EAChD;AACF;AAEA,eAAsB,qBAAqB,QAA0E;AACnH,MAAI;AACF,UAAM,cAAc,iBAAiB,MAAM;AAC3C,UAAM,aAAa,MAAM,OAAO,OAAO;AAAA,MACrC;AAAA,MACA,YAAY,MAAM;AAAA,MAClB,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,MACrC;AAAA,MACA,CAAC,MAAM;AAAA,IACT;AAEA,UAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,UAAU;AAC3D,WAAO,IAAI;AACX,QAAI,UAAU,CAAC,QAAQ;AAEvB,UAAM,YAAY,MAAM,OAAO,OAAO;AAAA,MACpC;AAAA,MACA;AAAA,MACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,MACrC;AAAA,MACA,CAAC,QAAQ;AAAA,IACX;AACA,WAAO,EAAE,YAAY,UAAU;AAAA,EACjC,SACO,OAAO;AACZ,QAAI,iBAAiB;AACnB,YAAM;AACR,UAAM,IAAI,UAAU,oHAAoH,KAAK;AAAA,EAC/I;AACF;AAKO,SAAS,SAAS,KAA6B;AACpD,MAAI,IAAI,WAAW;AACjB,UAAM,IAAI,MAAM,8BAA8B;AAEhD,MAAI,IAAI,IAAI,MAAM,GAAG,EAAE;AACvB,MAAI,IAAI,IAAI,MAAM,EAAE;AAEpB,MAAI,UAAU;AACd,SAAO,UAAU,EAAE,SAAS,KAAK,EAAE,OAAO,MAAM,EAAG;AACnD,MAAI,EAAE,MAAM,OAAO;AAEnB,MAAI,UAAU;AACd,SAAO,UAAU,EAAE,SAAS,KAAK,EAAE,OAAO,MAAM,EAAG;AACnD,MAAI,EAAE,MAAM,OAAO;AAEnB,MAAI,EAAE,SAAS,KAAK,EAAE,CAAC,IAAK,KAAM;AAChC,UAAM,UAAU,IAAI,WAAW,EAAE,SAAS,CAAC;AAC3C,YAAQ,CAAC,IAAI;AACb,YAAQ,IAAI,GAAG,CAAC;AAChB,QAAI;AAAA,EACN;AACA,MAAI,EAAE,SAAS,KAAK,EAAE,CAAC,IAAK,KAAM;AAChC,UAAM,UAAU,IAAI,WAAW,EAAE,SAAS,CAAC;AAC3C,YAAQ,CAAC,IAAI;AACb,YAAQ,IAAI,GAAG,CAAC;AAChB,QAAI;AAAA,EACN;AAEA,QAAM,UAAU,EAAE;AAClB,QAAM,UAAU,EAAE;AAClB,QAAM,cAAc,IAAI,UAAU,IAAI;AAEtC,QAAM,MAAM,IAAI,WAAW,IAAI,WAAW;AAC1C,MAAI,CAAC,IAAI;AACT,MAAI,CAAC,IAAI;AACT,MAAI,CAAC,IAAI;AACT,MAAI,CAAC,IAAI;AACT,MAAI,IAAI,GAAG,CAAC;AACZ,MAAI,IAAI,OAAO,IAAI;AACnB,MAAI,IAAI,OAAO,IAAI;AACnB,MAAI,IAAI,GAAG,IAAI,OAAO;AAEtB,SAAO;AACT;;;Ab9EA,eAAsB,KAAwC,SAAY,UAAuB,CAAC,GAAoB;AACpH,MAAI,EAAE,YAAY,SAAS,KAAK,KAAK,KAAK,KAAK,YAAY,OAAO,IAAI;AAEtE,MAAI,cAAc,SAAS;AACzB,QAAI,CAAC,YAAY;AACf,UAAI,OAAO,WAAW;AACpB,cAAM,IAAI,UAAU,0EAA0E;AAEhG,OAAC,EAAE,WAAW,IAAI,MAAM,qBAAqB,MAAM;AAAA,IACrD;AAAA,EACF,WACS,cAAc,WAAW,CAAC,QAAQ;AACzC,UAAM,IAAI,UAAU,kCAAkC;AAAA,EACxD;AAEA,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAExC,QAAM,aAAsC,EAAE,KAAK,KAAK,KAAK,KAAK,KAAK,GAAG,QAAQ;AAElF,MAAI,OAAO,QAAQ,MAAM;AACvB,eAAW,MAAM,MAAM;AAEzB,QAAM,UAAU,cAAc;AAC9B,QAAM,MAA0B,UAAU,UAAU;AAEpD,QAAM,aAAa,KAAK,UAAU,EAAE,KAAK,KAAK,MAAM,CAAC;AACrD,QAAM,cAAc,KAAK,UAAU,UAAU;AAE7C,QAAM,mBAAmB,0BAA0B,YAAY,WAAW;AAE1E,MAAI;AAEJ,MAAI,SAAS;AAEX,UAAM,cAAc,OAAO,WAAW,WAClC,IAAI,YAAY,EAAE,OAAO,MAAM,IAC/B;AAEJ,UAAM,YAAY,MAAM,OAAO,OAAO;AAAA,MACpC;AAAA,MACA;AAAA,MACA,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,MAChC;AAAA,MACA,CAAC,MAAM;AAAA,IACT;AAEA,gBAAY,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,WAAW,gBAAgC,CAAC;AAAA,EAC1G,OACK;AAGH,gBAAY,IAAI;AAAA,MACd,MAAM,OAAO,OAAO;AAAA,QAClB,EAAE,MAAM,SAAS,MAAM,UAAU;AAAA,QACjC;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,UAAU,YAAY,aAAa,SAAS;AACrD;AAWA,eAAsB,OAAoC,OAAe,SAAoC;AAC3G,MAAI,EAAE,YAAY,SAAS,WAAW,QAAQ,KAAK,IAAI,IAAI;AAE3D,MAAI,cAAc,SAAS;AACzB,QAAI,CAAC,WAAW;AACd,UAAI,OAAO,WAAW;AACpB,cAAM,IAAI,UAAU,4EAA4E;AAElG,OAAC,EAAE,UAAU,IAAI,MAAM,qBAAqB,MAAM;AAAA,IACpD;AAAA,EACF;AAEA,MAAI,cAAc,WAAW,CAAC;AAC5B,UAAM,IAAI,UAAU,uCAAuC;AAE7D,QAAM,CAAC,QAAQ,SAAS,WAAW,gBAAgB,IAAI,SAAS,KAAK;AAErE,QAAM,eAAe,IAAI,qBAAqB,MAAM;AACpD,QAAM,YAAY,aAAa,UAAU;AAEzC,MAAI,iBAAiB;AAGrB,MAAI,cAAc,SAAS;AACzB,QAAI,cAAc;AAChB,YAAM,IAAI,MAAM,qBAAqB,SAAS,4CAA4C;AAE5F,UAAM,cAAc,OAAO,WAAW,WAClC,IAAI,YAAY,EAAE,OAAO,MAAM,IAC/B;AAEJ,UAAM,YAAY,MAAM,OAAO,OAAO;AAAA,MACpC;AAAA,MACA;AAAA,MACA,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,MAChC;AAAA,MACA,CAAC,MAAM;AAAA,IACT;AAEA,UAAM,cAAc,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,WAAW,gBAAgC,CAAC;AAChH,qBAAiB,kBAAkB,aAAa,IAAI,WAAW,SAAS,CAAC;AAAA,EAC3E,OAEK;AACH,QAAI,cAAc;AAChB,YAAM,IAAI,UAAU,qBAAqB,SAAS,4CAA4C;AAEhG,UAAM,iBAAiB,IAAI,WAAW,SAAS;AAI/C,qBAAiB,MAAM,OAAO,OAAO;AAAA,MACnC,EAAE,MAAM,SAAS,MAAM,UAAU;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,kBAAkB,eAAe,WAAW,IAAI;AAGnD,UAAI;AACF,cAAM,SAAS,SAAS,cAAc;AACtC,yBAAiB,MAAM,OAAO,OAAO;AAAA,UACnC,EAAE,MAAM,SAAS,MAAM,UAAU;AAAA,UACjC;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF,QACM;AAGJ,yBAAiB;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC;AACH,UAAM,IAAI,UAAU,uBAAuB;AAE7C,QAAM,SAAS,IAAI,oBAAoB,OAAO;AAC9C,MAAI,OAAO,cAAc,KAAK,CAAC,OAAO,iBAAiB;AACrD,UAAM,IAAI,UAAU,aAAa;AACnC,MAAI,OAAO,aAAa,KAAK,CAAC,OAAO,gBAAgB;AACnD,UAAM,IAAI,UAAU,mBAAmB;AACzC,MAAI,OAAQ,QAAgB,QAAQ;AAClC,UAAM,IAAI,UAAU,oBAAoB;AAE1C,MAAI,KAAK;AACP,UAAM,mBAAmB,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,GAAG;AACxD,UAAM,gBAAiB,QAAgB,MAClC,MAAM,QAAS,QAAgB,GAAG,IAAK,QAAgB,MAAM,CAAE,QAAgB,GAAG,IACnF,CAAC;AAEL,QAAI,CAAC,iBAAiB,KAAK,cAAY,cAAc,SAAS,QAAQ,CAAC;AACrE,YAAM,IAAI,UAAU,sBAAsB;AAAA,EAC9C;AAEA,SAAO;AACT;","names":["response","response"]}

package/dist/chunk-SQSCTWSP.js

@@ -0,0 +1 @@
+import{BROWSER as t}from"esm-env";import{BROWSER as n}from"esm-env";function e(t){if(n)try{localStorage.setItem("gau-token",t),document.cookie=`__gau-session-token=${t}; path=/; max-age=31536000; samesite=lax; secure`}catch{}}function r(){return n?localStorage.getItem("gau-token"):null}function o(){if(n)try{localStorage.removeItem("gau-token"),document.cookie="__gau-session-token=; path=/; max-age=0"}catch{}}function i(){return t&&"__TAURI_INTERNALS__"in globalThis}async function a(n,e,r="gau",o,a){if(!i())return;const{openUrl:c}=await import("@tauri-apps/plugin-opener");let u;u=o||`${r}://oauth/callback`;const s=new URLSearchParams;s.set("redirectTo",u),a&&s.set("profile",String(a));const l=`${function(n){try{return new URL(n).toString().replace(/\/$/,"")}catch{if(t&&"undefined"!=typeof window)try{return new URL(n,window.location.origin).toString().replace(/\/$/,"")}catch{return n}return n}}(e)}/${n}?${s.toString()}`;await c(l)}async function c(t){if(!i())return;const{listen:n}=await import("@tauri-apps/api/event");try{return await n("deep-link",async n=>{await t(n.payload)})}catch(t){console.error(t)}}function u(n,e,r,o){const i=new URL(n),a=function(n){try{return new URL(n).origin}catch{if(t&&"undefined"!=typeof window)try{return new URL(n,window.location.origin).origin}catch{return null}return null}}(e);if(i.protocol!==`${r}:`&&(!a||i.origin!==a))return;const c=new URLSearchParams(i.hash.substring(1)).get("token");c&&o(c)}async function s(n,e,o="gau",a,c){if(!i())return;const{openUrl:u}=await import("@tauri-apps/plugin-opener");let s;s=a||`${o}://oauth/callback`;const l=r();if(!l)return void console.error("No session token found, cannot link account.");const f=new URLSearchParams;f.set("redirectTo",s),f.set("token",l),c&&f.set("profile",String(c));const p=`${(()=>{try{return new URL(e).toString().replace(/\/$/,"")}catch{if(t&&"undefined"!=typeof window)try{return new URL(e,window.location.origin).toString().replace(/\/$/,"")}catch{return e}return e}})()}/link/${n}?${f.toString()}`;await u(p)}async function l(t,n,e){if(!i())return;return await c(async r=>{u(r,t,n,e)})}export{e as storeSessionToken,r as getSessionToken,o as clearSessionToken,i as isTauri,a as signInWithTauri,c as setupTauriListener,u as handleTauriDeepLink,s as linkAccountWithTauri,l as startAuthBridge};//# sourceMappingURL=chunk-SQSCTWSP.js.map

package/dist/chunk-SQSCTWSP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/runtimes/tauri/index.ts","../src/client/token.ts"],"sourcesContent":["import type { ProfileName, ProviderIds } from '../../core'\nimport { BROWSER } from 'esm-env'\nimport { getSessionToken } from '../../client/token'\n\nexport function isTauri(): boolean {\n  return BROWSER && '__TAURI_INTERNALS__' in globalThis\n}\n\nfunction resolveOrigin(baseUrl: string): string | null {\n  try {\n    return new URL(baseUrl).origin\n  }\n  catch {\n    if (BROWSER && typeof window !== 'undefined') {\n      try {\n        return new URL(baseUrl, window.location.origin).origin\n      }\n      catch {\n        return null\n      }\n    }\n    return null\n  }\n}\n\nexport async function signInWithTauri<const TAuth = unknown, P extends ProviderIds<TAuth> = ProviderIds<TAuth>, PR extends (ProfileName<TAuth, P> | string) | undefined = undefined>(\n  provider: P,\n  baseUrl: string,\n  scheme: string = 'gau',\n  redirectOverride?: string,\n  profile?: PR,\n) {\n  if (!isTauri())\n    return\n\n  const { openUrl } = await import('@tauri-apps/plugin-opener')\n\n  function resolveAbsoluteBase(base: string): string {\n    try {\n      const u = new URL(base)\n      return u.toString().replace(/\\/$/, '')\n    }\n    catch {\n      if (BROWSER && typeof window !== 'undefined') {\n        try {\n          const u = new URL(base, window.location.origin)\n          return u.toString().replace(/\\/$/, '')\n        }\n        catch {\n          return base\n        }\n      }\n      return base\n    }\n  }\n\n  let redirectTo: string\n\n  if (redirectOverride)\n    redirectTo = redirectOverride\n  else\n    redirectTo = `${scheme}://oauth/callback`\n\n  const params = new URLSearchParams()\n  params.set('redirectTo', redirectTo)\n  if (profile)\n    params.set('profile', String(profile))\n  const resolvedBase = resolveAbsoluteBase(baseUrl)\n  const authUrl = `${resolvedBase}/${provider}?${params.toString()}`\n  await openUrl(authUrl)\n}\n\nexport async function setupTauriListener(\n  handler: (url: string) => Promise<void>,\n): Promise<(() => void) | void> {\n  if (!isTauri())\n    return\n\n  const { listen } = await import('@tauri-apps/api/event')\n  try {\n    const unlisten = await listen<string>('deep-link', async (event) => {\n      await handler(event.payload)\n    })\n    return unlisten\n  }\n  catch (err) {\n    console.error(err)\n  }\n}\n\nexport function handleTauriDeepLink(url: string, baseUrl: string, scheme: string, onToken: (token: string) => void) {\n  const parsed = new URL(url)\n  const baseOrigin = resolveOrigin(baseUrl)\n  if (parsed.protocol !== `${scheme}:` && (!baseOrigin || parsed.origin !== baseOrigin))\n    return\n\n  const params = new URLSearchParams(parsed.hash.substring(1))\n  const token = params.get('token')\n  if (token)\n    onToken(token)\n}\n\nexport async function linkAccountWithTauri<const TAuth = unknown, P extends ProviderIds<TAuth> = ProviderIds<TAuth>, PR extends (ProfileName<TAuth, P> | string) | undefined = undefined>(\n  provider: P,\n  baseUrl: string,\n  scheme: string = 'gau',\n  redirectOverride?: string,\n  profile?: PR,\n) {\n  if (!isTauri())\n    return\n\n  const { openUrl } = await import('@tauri-apps/plugin-opener')\n\n  let redirectTo: string\n\n  if (redirectOverride)\n    redirectTo = redirectOverride\n  else\n    redirectTo = `${scheme}://oauth/callback`\n\n  const token = getSessionToken()\n  if (!token) {\n    console.error('No session token found, cannot link account.')\n    return\n  }\n\n  const params = new URLSearchParams()\n  params.set('redirectTo', redirectTo)\n  params.set('token', token)\n  if (profile)\n    params.set('profile', String(profile))\n  const resolvedBase = (() => {\n    try {\n      const u = new URL(baseUrl)\n      return u.toString().replace(/\\/$/, '')\n    }\n    catch {\n      if (BROWSER && typeof window !== 'undefined') {\n        try {\n          const u = new URL(baseUrl, window.location.origin)\n          return u.toString().replace(/\\/$/, '')\n        }\n        catch {\n          return baseUrl\n        }\n      }\n      return baseUrl\n    }\n  })()\n  const linkUrl = `${resolvedBase}/link/${provider}?${params.toString()}`\n  await openUrl(linkUrl)\n}\n\nexport async function startAuthBridge(\n  baseUrl: string,\n  scheme: string,\n  onToken: (token: string) => Promise<void> | void,\n): Promise<(() => void) | void> {\n  if (!isTauri())\n    return\n\n  const unlisten = await setupTauriListener(async (url) => {\n    handleTauriDeepLink(url, baseUrl, scheme, onToken)\n  })\n  return unlisten\n}\n","import { BROWSER } from 'esm-env'\n\nexport function storeSessionToken(token: string) {\n  if (!BROWSER)\n    return\n  try {\n    localStorage.setItem('gau-token', token)\n    document.cookie = `__gau-session-token=${token}; path=/; max-age=31536000; samesite=lax; secure`\n  }\n  catch {}\n}\n\nexport function getSessionToken(): string | null {\n  if (!BROWSER)\n    return null\n  return localStorage.getItem('gau-token')\n}\n\nexport function clearSessionToken() {\n  if (!BROWSER)\n    return\n  try {\n    localStorage.removeItem('gau-token')\n    document.cookie = `__gau-session-token=; path=/; max-age=0`\n  }\n  catch {}\n}\n"],"mappings":";AACA,SAAS,WAAAA,gBAAe;;;ACDxB,SAAS,eAAe;AAEjB,SAAS,kBAAkB,OAAe;AAC/C,MAAI,CAAC;AACH;AACF,MAAI;AACF,iBAAa,QAAQ,aAAa,KAAK;AACvC,aAAS,SAAS,uBAAuB,KAAK;AAAA,EAChD,QACM;AAAA,EAAC;AACT;AAEO,SAAS,kBAAiC;AAC/C,MAAI,CAAC;AACH,WAAO;AACT,SAAO,aAAa,QAAQ,WAAW;AACzC;AAEO,SAAS,oBAAoB;AAClC,MAAI,CAAC;AACH;AACF,MAAI;AACF,iBAAa,WAAW,WAAW;AACnC,aAAS,SAAS;AAAA,EACpB,QACM;AAAA,EAAC;AACT;;;ADtBO,SAAS,UAAmB;AACjC,SAAOC,YAAW,yBAAyB;AAC7C;AAEA,SAAS,cAAc,SAAgC;AACrD,MAAI;AACF,WAAO,IAAI,IAAI,OAAO,EAAE;AAAA,EAC1B,QACM;AACJ,QAAIA,YAAW,OAAO,WAAW,aAAa;AAC5C,UAAI;AACF,eAAO,IAAI,IAAI,SAAS,OAAO,SAAS,MAAM,EAAE;AAAA,MAClD,QACM;AACJ,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,gBACpB,UACA,SACA,SAAiB,OACjB,kBACA,SACA;AACA,MAAI,CAAC,QAAQ;AACX;AAEF,QAAM,EAAE,QAAQ,IAAI,MAAM,OAAO,2BAA2B;AAE5D,WAAS,oBAAoB,MAAsB;AACjD,QAAI;AACF,YAAM,IAAI,IAAI,IAAI,IAAI;AACtB,aAAO,EAAE,SAAS,EAAE,QAAQ,OAAO,EAAE;AAAA,IACvC,QACM;AACJ,UAAIA,YAAW,OAAO,WAAW,aAAa;AAC5C,YAAI;AACF,gBAAM,IAAI,IAAI,IAAI,MAAM,OAAO,SAAS,MAAM;AAC9C,iBAAO,EAAE,SAAS,EAAE,QAAQ,OAAO,EAAE;AAAA,QACvC,QACM;AACJ,iBAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI;AAEJ,MAAI;AACF,iBAAa;AAAA;AAEb,iBAAa,GAAG,MAAM;AAExB,QAAM,SAAS,IAAI,gBAAgB;AACnC,SAAO,IAAI,cAAc,UAAU;AACnC,MAAI;AACF,WAAO,IAAI,WAAW,OAAO,OAAO,CAAC;AACvC,QAAM,eAAe,oBAAoB,OAAO;AAChD,QAAM,UAAU,GAAG,YAAY,IAAI,QAAQ,IAAI,OAAO,SAAS,CAAC;AAChE,QAAM,QAAQ,OAAO;AACvB;AAEA,eAAsB,mBACpB,SAC8B;AAC9B,MAAI,CAAC,QAAQ;AACX;AAEF,QAAM,EAAE,OAAO,IAAI,MAAM,OAAO,uBAAuB;AACvD,MAAI;AACF,UAAM,WAAW,MAAM,OAAe,aAAa,OAAO,UAAU;AAClE,YAAM,QAAQ,MAAM,OAAO;AAAA,IAC7B,CAAC;AACD,WAAO;AAAA,EACT,SACO,KAAK;AACV,YAAQ,MAAM,GAAG;AAAA,EACnB;AACF;AAEO,SAAS,oBAAoB,KAAa,SAAiB,QAAgB,SAAkC;AAClH,QAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,QAAM,aAAa,cAAc,OAAO;AACxC,MAAI,OAAO,aAAa,GAAG,MAAM,QAAQ,CAAC,cAAc,OAAO,WAAW;AACxE;AAEF,QAAM,SAAS,IAAI,gBAAgB,OAAO,KAAK,UAAU,CAAC,CAAC;AAC3D,QAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,MAAI;AACF,YAAQ,KAAK;AACjB;AAEA,eAAsB,qBACpB,UACA,SACA,SAAiB,OACjB,kBACA,SACA;AACA,MAAI,CAAC,QAAQ;AACX;AAEF,QAAM,EAAE,QAAQ,IAAI,MAAM,OAAO,2BAA2B;AAE5D,MAAI;AAEJ,MAAI;AACF,iBAAa;AAAA;AAEb,iBAAa,GAAG,MAAM;AAExB,QAAM,QAAQ,gBAAgB;AAC9B,MAAI,CAAC,OAAO;AACV,YAAQ,MAAM,8CAA8C;AAC5D;AAAA,EACF;AAEA,QAAM,SAAS,IAAI,gBAAgB;AACnC,SAAO,IAAI,cAAc,UAAU;AACnC,SAAO,IAAI,SAAS,KAAK;AACzB,MAAI;AACF,WAAO,IAAI,WAAW,OAAO,OAAO,CAAC;AACvC,QAAM,gBAAgB,MAAM;AAC1B,QAAI;AACF,YAAM,IAAI,IAAI,IAAI,OAAO;AACzB,aAAO,EAAE,SAAS,EAAE,QAAQ,OAAO,EAAE;AAAA,IACvC,QACM;AACJ,UAAIA,YAAW,OAAO,WAAW,aAAa;AAC5C,YAAI;AACF,gBAAM,IAAI,IAAI,IAAI,SAAS,OAAO,SAAS,MAAM;AACjD,iBAAO,EAAE,SAAS,EAAE,QAAQ,OAAO,EAAE;AAAA,QACvC,QACM;AACJ,iBAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF,GAAG;AACH,QAAM,UAAU,GAAG,YAAY,SAAS,QAAQ,IAAI,OAAO,SAAS,CAAC;AACrE,QAAM,QAAQ,OAAO;AACvB;AAEA,eAAsB,gBACpB,SACA,QACA,SAC8B;AAC9B,MAAI,CAAC,QAAQ;AACX;AAEF,QAAM,WAAW,MAAM,mBAAmB,OAAO,QAAQ;AACvD,wBAAoB,KAAK,SAAS,QAAQ,OAAO;AAAA,EACnD,CAAC;AACD,SAAO;AACT;","names":["BROWSER","BROWSER"]}

package/dist/src/client/solid/index.jsx

@@ -53,24 +53,51 @@ import { BROWSER as BROWSER2 } from "esm-env";
 function isTauri() {
   return BROWSER2 && "__TAURI_INTERNALS__" in globalThis;
 }
+function resolveOrigin(baseUrl) {
+  try {
+    return new URL(baseUrl).origin;
+  } catch {
+    if (BROWSER2 && typeof window !== "undefined") {
+      try {
+        return new URL(baseUrl, window.location.origin).origin;
+      } catch {
+        return null;
+      }
+    }
+    return null;
+  }
+}
 async function signInWithTauri(provider, baseUrl, scheme = "gau", redirectOverride, profile) {
   if (!isTauri())
     return;
-  const { platform } = await import("@tauri-apps/plugin-os");
   const { openUrl } = await import("@tauri-apps/plugin-opener");
-  const currentPlatform = platform();
+  function resolveAbsoluteBase(base) {
+    try {
+      const u = new URL(base);
+      return u.toString().replace(/\/$/, "");
+    } catch {
+      if (BROWSER2 && typeof window !== "undefined") {
+        try {
+          const u = new URL(base, window.location.origin);
+          return u.toString().replace(/\/$/, "");
+        } catch {
+          return base;
+        }
+      }
+      return base;
+    }
+  }
   let redirectTo;
   if (redirectOverride)
     redirectTo = redirectOverride;
-  else if (currentPlatform === "android" || currentPlatform === "ios")
-    redirectTo = new URL(baseUrl).origin;
   else
     redirectTo = `${scheme}://oauth/callback`;
   const params = new URLSearchParams();
   params.set("redirectTo", redirectTo);
   if (profile)
     params.set("profile", String(profile));
-  const authUrl = `${baseUrl}/${provider}?${params.toString()}`;
+  const resolvedBase = resolveAbsoluteBase(baseUrl);
+  const authUrl = `${resolvedBase}/${provider}?${params.toString()}`;
   await openUrl(authUrl);
 }
 async function setupTauriListener(handler) {
@@ -88,7 +115,8 @@ async function setupTauriListener(handler) {
 }
 function handleTauriDeepLink(url, baseUrl, scheme, onToken) {
   const parsed = new URL(url);
-  if (parsed.protocol !== `${scheme}:` && parsed.origin !== new URL(baseUrl).origin)
+  const baseOrigin = resolveOrigin(baseUrl);
+  if (parsed.protocol !== `${scheme}:` && (!baseOrigin || parsed.origin !== baseOrigin))
     return;
   const params = new URLSearchParams(parsed.hash.substring(1));
   const token = params.get("token");
@@ -98,14 +126,10 @@ function handleTauriDeepLink(url, baseUrl, scheme, onToken) {
 async function linkAccountWithTauri(provider, baseUrl, scheme = "gau", redirectOverride, profile) {
   if (!isTauri())
     return;
-  const { platform } = await import("@tauri-apps/plugin-os");
   const { openUrl } = await import("@tauri-apps/plugin-opener");
-  const currentPlatform = platform();
   let redirectTo;
   if (redirectOverride)
     redirectTo = redirectOverride;
-  else if (currentPlatform === "android" || currentPlatform === "ios")
-    redirectTo = new URL(baseUrl).origin;
   else
     redirectTo = `${scheme}://oauth/callback`;
   const token = getSessionToken();
@@ -118,7 +142,23 @@ async function linkAccountWithTauri(provider, baseUrl, scheme = "gau", redirectO
   params.set("token", token);
   if (profile)
     params.set("profile", String(profile));
-  const linkUrl = `${baseUrl}/link/${provider}?${params.toString()}`;
+  const resolvedBase = (() => {
+    try {
+      const u = new URL(baseUrl);
+      return u.toString().replace(/\/$/, "");
+    } catch {
+      if (BROWSER2 && typeof window !== "undefined") {
+        try {
+          const u = new URL(baseUrl, window.location.origin);
+          return u.toString().replace(/\/$/, "");
+        } catch {
+          return baseUrl;
+        }
+      }
+      return baseUrl;
+    }
+  })();
+  const linkUrl = `${resolvedBase}/link/${provider}?${params.toString()}`;
   await openUrl(linkUrl);
 }
 async function startAuthBridge(baseUrl, scheme, onToken) {

package/dist/src/client/svelte/index.svelte.js

@@ -1 +1 @@
-var t=Object.defineProperty,n=Object.getOwnPropertyNames,e=(t,e)=>function(){return t&&(e=(0,t[n(t)[0]])(t=0)),e};import{BROWSER as i}from"esm-env";function r(){return i?localStorage.getItem("gau-token"):null}var o=e({"src/client/token.ts"(){}}),a={};((n,e)=>{for(var i in e)t(n,i,{get:e[i],enumerable:!0})})(a,{handleTauriDeepLink:()=>f,isTauri:()=>c,linkAccountWithTauri:()=>d,setupTauriListener:()=>l,signInWithTauri:()=>u,startAuthBridge:()=>w});import{BROWSER as s}from"esm-env";function c(){return s&&"__TAURI_INTERNALS__"in globalThis}async function u(t,n,e="gau",i,r){if(!c())return;const{platform:o}=await import("@tauri-apps/plugin-os"),{openUrl:a}=await import("@tauri-apps/plugin-opener"),s=o();let u;u=i||("android"===s||"ios"===s?new URL(n).origin:`${e}://oauth/callback`);const l=new URLSearchParams;l.set("redirectTo",u),r&&l.set("profile",String(r));const f=`${n}/${t}?${l.toString()}`;await a(f)}async function l(t){if(!c())return;const{listen:n}=await import("@tauri-apps/api/event");try{return await n("deep-link",async n=>{await t(n.payload)})}catch(t){console.error(t)}}function f(t,n,e,i){const r=new URL(t);if(r.protocol!==`${e}:`&&r.origin!==new URL(n).origin)return;const o=new URLSearchParams(r.hash.substring(1)).get("token");o&&i(o)}async function d(t,n,e="gau",i,o){if(!c())return;const{platform:a}=await import("@tauri-apps/plugin-os"),{openUrl:s}=await import("@tauri-apps/plugin-opener"),u=a();let l;l=i||("android"===u||"ios"===u?new URL(n).origin:`${e}://oauth/callback`);const f=r();if(!f)return void console.error("No session token found, cannot link account.");const d=new URLSearchParams;d.set("redirectTo",l),d.set("token",f),o&&d.set("profile",String(o));const w=`${n}/link/${t}?${d.toString()}`;await s(w)}async function w(t,n,e){if(!c())return;return await l(async i=>{f(i,t,n,e)})}var p=e({"src/runtimes/tauri/index.ts"(){o()}});import{replaceState as h}from"$app/navigation";import{BROWSER as g}from"esm-env";import{getContext as m,onMount as y,setContext as k}from"svelte";import{parse as T,serialize as S}from"cookie";import{createJWTSignatureMessage as v,encodeJWT as A,JWSRegisteredHeaders as P,JWTRegisteredClaims as R,parseJWT as b}from"@oslojs/jwt";import{generateCodeVerifier as U,generateState as L}from"arctic";var O={user:null,session:null,accounts:null};function I(t){const n=new URLSearchParams;for(const[e,i]of Object.entries(t))null!=i&&""!==i&&n.set(e,String(i));const e=n.toString();return e?`?${e}`:""}function _({baseUrl:t,scheme:n="gau"}){let e={user:null,session:null,accounts:null,providers:[]};const o=new Set;async function s(){const n=r(),e=n?{Authorization:`Bearer ${n}`}:void 0,i=await fetch(`${t}/session`,n?{headers:e}:{credentials:"include"}),o=i.headers.get("content-type");return o?.includes("application/json")?await i.json():{user:null,session:null,accounts:null,providers:[]}}async function u(){const t=await s();return e=t,(()=>{for(const t of o)t(e)})(),t}async function l(t){try{!function(t){if(i)try{localStorage.setItem("gau-token",t),document.cookie=`__gau-session-token=${t}; path=/; max-age=31536000; samesite=lax; secure`}catch{}}(t)}finally{await u()}}function f(n,e){const i=I({redirectTo:e.redirectTo,profile:null!=e.profile?String(e.profile):void 0,redirect:e.redirect});return`${t}/link/${n}${i}`}return{get session(){return e},fetchSession:s,refreshSession:u,applySessionToken:l,handleRedirectCallback:async function(t){if("undefined"==typeof window)return!1;if("#_=_"===window.location.hash){const n=window.location.pathname+window.location.search;return t?t(n):window.history.replaceState(null,"",n),!1}const n=window.location.hash?.substring(1)??"";if(!n)return!1;const e=new URLSearchParams(n).get("token");if(!e)return!1;await l(e);const i=window.location.pathname+window.location.search;return t?t(i):window.history.replaceState(null,"",i),!0},onSessionChange:function(t){return o.add(t),()=>o.delete(t)},signIn:async function(e,i){const r=function(n,e){const i=I({redirectTo:e?.redirectTo,profile:null!=e?.profile?String(e.profile):void 0});return`${t}/${n}${i}`}(e,i);if(c()){const{signInWithTauri:r}=await Promise.resolve().then(()=>(p(),a));await r(e,t,n,i?.redirectTo,i?.profile)}return r},linkAccount:async function(e,i){if(c()){const{linkAccountWithTauri:r}=await Promise.resolve().then(()=>(p(),a));return await r(e,t,n,i?.redirectTo,i?.profile),f(e,{redirectTo:i?.redirectTo,profile:i?.profile,redirect:"false"})}const o=f(e,{redirectTo:i?.redirectTo,profile:i?.profile,redirect:"false"}),s=r(),u=s?{headers:{Authorization:`Bearer ${s}`}}:{credentials:"include"},l=await fetch(o,u);if(l.redirected)return l.url;try{const t=await l.json();if(t?.url)return t.url}catch{}return o},unlinkAccount:async function(n){const e=r(),i=e?{headers:{Authorization:`Bearer ${e}`}}:{credentials:"include"};return!!(await fetch(`${t}/unlink/${n}`,{method:"POST",...i})).ok&&(await u(),!0)},signOut:async function(){!function(){if(i)try{localStorage.removeItem("gau-token"),document.cookie="__gau-session-token=; path=/; max-age=0"}catch{}}();const n=r(),e=n?{Authorization:`Bearer ${n}`}:void 0;await fetch(`${t}/signout`,n?{method:"POST",headers:e}:{method:"POST",credentials:"include"}),await u()},startTauriBridge:async function(){if(!c())return;const{startAuthBridge:e}=await Promise.resolve().then(()=>(p(),a));return await e(t,n,async t=>{await l(t)})}}}p(),p(),o();var B=Symbol("gau-auth");function j({baseUrl:t="/api/auth",scheme:n="gau",redirectTo:e}={}){const i=_({baseUrl:t}),r=async()=>g?i.refreshSession():{...O,providers:[]};let o=$state({...O,providers:[]}),s=$state(!0);y(()=>{if(!g)return;let e;(async()=>{await i.handleRedirectCallback(async t=>async function(t){try{h(t,{})}catch{g&&window.history.replaceState(null,"",t)}}(t))||(o=await r()),s=!1})();let u=!1;return c()?((async()=>{const{startAuthBridge:s}=await Promise.resolve().then(()=>(p(),a)),c=await s(t,n,async t=>{await i.applySessionToken(t),o=await r()});u?c?.():e=c})(),()=>{u=!0,e?.()}):void 0});k(B,{get session(){return o},get isLoading(){return s},signIn:async function(r,{redirectTo:o,profile:s}={}){const u=c();let l=o??e;if(u){const{signInWithTauri:e}=await Promise.resolve().then(()=>(p(),a));return void await e(r,t,n,l,s)}!l&&g&&(l=window.location.origin);const f=await i.signIn(r,{redirectTo:l,profile:s});g&&(window.location.href=f)},linkAccount:async function(r,{redirectTo:o,profile:s}={}){if(c()){const{linkAccountWithTauri:e}=await Promise.resolve().then(()=>(p(),a));return void await e(r,t,n,o,s)}let u=o??e;!u&&g&&(u=window.location.href);const l=await i.linkAccount(r,{redirectTo:u,profile:s});g&&(window.location.href=l)},unlinkAccount:async function(t){await i.unlinkAccount(t)?o=await r():console.error("Failed to unlink account")},signOut:async function(){await i.signOut(),o=await r()},refresh:async()=>{o=await r()}})}function W(){const t=m(B);if(!t)throw new Error("useAuth must be used within an AuthProvider");return t}export{j as createSvelteAuth,W as useAuth};//# sourceMappingURL=index.svelte.js.map
+var t=Object.defineProperty,n=Object.getOwnPropertyNames,e=(t,e)=>function(){return t&&(e=(0,t[n(t)[0]])(t=0)),e};import{BROWSER as r}from"esm-env";function i(){return r?localStorage.getItem("gau-token"):null}var o=e({"src/client/token.ts"(){}}),a={};((n,e)=>{for(var r in e)t(n,r,{get:e[r],enumerable:!0})})(a,{handleTauriDeepLink:()=>f,isTauri:()=>s,linkAccountWithTauri:()=>d,setupTauriListener:()=>l,signInWithTauri:()=>u,startAuthBridge:()=>w});import{BROWSER as c}from"esm-env";function s(){return c&&"__TAURI_INTERNALS__"in globalThis}async function u(t,n,e="gau",r,i){if(!s())return;const{openUrl:o}=await import("@tauri-apps/plugin-opener");let a;a=r||`${e}://oauth/callback`;const u=new URLSearchParams;u.set("redirectTo",a),i&&u.set("profile",String(i));const l=`${function(t){try{return new URL(t).toString().replace(/\/$/,"")}catch{if(c&&"undefined"!=typeof window)try{return new URL(t,window.location.origin).toString().replace(/\/$/,"")}catch{return t}return t}}(n)}/${t}?${u.toString()}`;await o(l)}async function l(t){if(!s())return;const{listen:n}=await import("@tauri-apps/api/event");try{return await n("deep-link",async n=>{await t(n.payload)})}catch(t){console.error(t)}}function f(t,n,e,r){const i=new URL(t),o=function(t){try{return new URL(t).origin}catch{if(c&&"undefined"!=typeof window)try{return new URL(t,window.location.origin).origin}catch{return null}return null}}(n);if(i.protocol!==`${e}:`&&(!o||i.origin!==o))return;const a=new URLSearchParams(i.hash.substring(1)).get("token");a&&r(a)}async function d(t,n,e="gau",r,o){if(!s())return;const{openUrl:a}=await import("@tauri-apps/plugin-opener");let u;u=r||`${e}://oauth/callback`;const l=i();if(!l)return void console.error("No session token found, cannot link account.");const f=new URLSearchParams;f.set("redirectTo",u),f.set("token",l),o&&f.set("profile",String(o));const d=`${(()=>{try{return new URL(n).toString().replace(/\/$/,"")}catch{if(c&&"undefined"!=typeof window)try{return new URL(n,window.location.origin).toString().replace(/\/$/,"")}catch{return n}return n}})()}/link/${t}?${f.toString()}`;await a(d)}async function w(t,n,e){if(!s())return;return await l(async r=>{f(r,t,n,e)})}var h=e({"src/runtimes/tauri/index.ts"(){o()}});import{replaceState as p}from"$app/navigation";import{BROWSER as g}from"esm-env";import{getContext as m,onMount as y,setContext as S}from"svelte";import{parse as k,serialize as T}from"cookie";import{createJWTSignatureMessage as v,encodeJWT as A,JWSRegisteredHeaders as R,JWTRegisteredClaims as U,parseJWT as P}from"@oslojs/jwt";import{generateCodeVerifier as b,generateState as L}from"arctic";var O={user:null,session:null,accounts:null};function I(t){const n=new URLSearchParams;for(const[e,r]of Object.entries(t))null!=r&&""!==r&&n.set(e,String(r));const e=n.toString();return e?`?${e}`:""}function _({baseUrl:t,scheme:n="gau"}){let e={user:null,session:null,accounts:null,providers:[]};const o=new Set;async function c(){const n=i(),e=n?{Authorization:`Bearer ${n}`}:void 0,r=await fetch(`${t}/session`,n?{headers:e}:{credentials:"include"}),o=r.headers.get("content-type");return o?.includes("application/json")?await r.json():{user:null,session:null,accounts:null,providers:[]}}async function u(){const t=await c();return e=t,(()=>{for(const t of o)t(e)})(),t}async function l(t){try{!function(t){if(r)try{localStorage.setItem("gau-token",t),document.cookie=`__gau-session-token=${t}; path=/; max-age=31536000; samesite=lax; secure`}catch{}}(t)}finally{await u()}}function f(n,e){const r=I({redirectTo:e.redirectTo,profile:null!=e.profile?String(e.profile):void 0,redirect:e.redirect});return`${t}/link/${n}${r}`}return{get session(){return e},fetchSession:c,refreshSession:u,applySessionToken:l,handleRedirectCallback:async function(t){if("undefined"==typeof window)return!1;if("#_=_"===window.location.hash){const n=window.location.pathname+window.location.search;return t?t(n):window.history.replaceState(null,"",n),!1}const n=window.location.hash?.substring(1)??"";if(!n)return!1;const e=new URLSearchParams(n).get("token");if(!e)return!1;await l(e);const r=window.location.pathname+window.location.search;return t?t(r):window.history.replaceState(null,"",r),!0},onSessionChange:function(t){return o.add(t),()=>o.delete(t)},signIn:async function(e,r){const i=function(n,e){const r=I({redirectTo:e?.redirectTo,profile:null!=e?.profile?String(e.profile):void 0});return`${t}/${n}${r}`}(e,r);if(s()){const{signInWithTauri:i}=await Promise.resolve().then(()=>(h(),a));await i(e,t,n,r?.redirectTo,r?.profile)}return i},linkAccount:async function(e,r){if(s()){const{linkAccountWithTauri:i}=await Promise.resolve().then(()=>(h(),a));return await i(e,t,n,r?.redirectTo,r?.profile),f(e,{redirectTo:r?.redirectTo,profile:r?.profile,redirect:"false"})}const o=f(e,{redirectTo:r?.redirectTo,profile:r?.profile,redirect:"false"}),c=i(),u=c?{headers:{Authorization:`Bearer ${c}`}}:{credentials:"include"},l=await fetch(o,u);if(l.redirected)return l.url;try{const t=await l.json();if(t?.url)return t.url}catch{}return o},unlinkAccount:async function(n){const e=i(),r=e?{headers:{Authorization:`Bearer ${e}`}}:{credentials:"include"};return!!(await fetch(`${t}/unlink/${n}`,{method:"POST",...r})).ok&&(await u(),!0)},signOut:async function(){!function(){if(r)try{localStorage.removeItem("gau-token"),document.cookie="__gau-session-token=; path=/; max-age=0"}catch{}}();const n=i(),e=n?{Authorization:`Bearer ${n}`}:void 0;await fetch(`${t}/signout`,n?{method:"POST",headers:e}:{method:"POST",credentials:"include"}),await u()},startTauriBridge:async function(){if(!s())return;const{startAuthBridge:e}=await Promise.resolve().then(()=>(h(),a));return await e(t,n,async t=>{await l(t)})}}}h(),h(),o();var B=Symbol("gau-auth");function j({baseUrl:t="/api/auth",scheme:n="gau",redirectTo:e}={}){const r=_({baseUrl:t}),i=async()=>g?r.refreshSession():{...O,providers:[]};let o=$state({...O,providers:[]}),c=$state(!0);y(()=>{if(!g)return;let e;(async()=>{await r.handleRedirectCallback(async t=>async function(t){try{p(t,{})}catch{g&&window.history.replaceState(null,"",t)}}(t))||(o=await i()),c=!1})();let u=!1;return s()?((async()=>{const{startAuthBridge:c}=await Promise.resolve().then(()=>(h(),a)),s=await c(t,n,async t=>{await r.applySessionToken(t),o=await i()});u?s?.():e=s})(),()=>{u=!0,e?.()}):void 0});S(B,{get session(){return o},get isLoading(){return c},signIn:async function(i,{redirectTo:o,profile:c}={}){const u=s();let l=o??e;if(u){const{signInWithTauri:e}=await Promise.resolve().then(()=>(h(),a));return void await e(i,t,n,l,c)}!l&&g&&(l=window.location.origin);const f=await r.signIn(i,{redirectTo:l,profile:c});g&&(window.location.href=f)},linkAccount:async function(i,{redirectTo:o,profile:c}={}){if(s()){const{linkAccountWithTauri:e}=await Promise.resolve().then(()=>(h(),a));return void await e(i,t,n,o,c)}let u=o??e;!u&&g&&(u=window.location.href);const l=await r.linkAccount(i,{redirectTo:u,profile:c});g&&(window.location.href=l)},unlinkAccount:async function(t){await r.unlinkAccount(t)?o=await i():console.error("Failed to unlink account")},signOut:async function(){await r.signOut(),o=await i()},refresh:async()=>{o=await i()}})}function W(){const t=m(B);if(!t)throw new Error("useAuth must be used within an AuthProvider");return t}export{j as createSvelteAuth,W as useAuth};//# sourceMappingURL=index.svelte.js.map