@selvajs/supabase-provider 0.14.3 → 0.14.4-beta.0

package/dist/auth/SupabaseAuthProvider.d.ts

@@ -37,6 +37,24 @@ export interface SupabaseAuthProviderConfig {
      * `{ ok: false, reason: 'signup_disabled' }`.
      */
     allowEmailLinkSignup?: boolean;
+    /**
+     * How `verifyToken` validates session JWTs (see the method for the full
+     * rationale):
+     *  - `'hybrid'` (default): verify the JWT LOCALLY via `getClaims()` on every
+     *    request (no network call when the project uses asymmetric signing keys —
+     *    the modern default), and additionally re-check against GoTrue at most
+     *    once per `revalidateMs` per session to catch server-side sign-outs and
+     *    `disabled` flips. Bounds revocation latency to `revalidateMs`.
+     *  - `'strict'`: call `getUser()` on every request (the pre-1b behavior).
+     *    Instant revocation, one network round-trip per request. For operators
+     *    who don't accept any revocation lag.
+     */
+    tokenVerification?: 'hybrid' | 'strict';
+    /**
+     * Recheck window for `'hybrid'` verification, in ms. A verified session is
+     * re-validated against GoTrue at most once per this interval. Default 60s.
+     */
+    revalidateMs?: number;
 }
 export declare class SupabaseAuthProvider implements IAuthProvider {
     readonly name = "Supabase Auth";
@@ -47,9 +65,48 @@ export declare class SupabaseAuthProvider implements IAuthProvider {
     private readonly anon;
     private readonly anonKey;
     private readonly supabaseUrl;
+    private readonly tokenVerification;
+    private readonly revalidateMs;
+    /**
+     * Last time a given session was re-validated against GoTrue (epoch ms),
+     * keyed by the JWT `session_id`. Bounds the hybrid recheck to once per
+     * `revalidateMs` per session. Swept lazily (see `verifyToken`) so a burst of
+     * distinct sessions can't leak memory. Per-process; multi-instance drift is
+     * harmless (each instance rechecks on its own schedule).
+     */
+    private readonly lastRevalidatedAt;
     constructor(config: SupabaseAuthProviderConfig);
     static fromEnv(env: Record<string, string | undefined>): SupabaseAuthProvider;
+    /**
+     * Verify a session JWT and return the user, or null if invalid/disabled.
+     * Runs on EVERY authenticated request, so the fast path avoids a network
+     * round-trip.
+     *
+     * `'hybrid'` (default):
+     *  1. `getClaims(token)` verifies the JWT. With asymmetric signing keys (the
+     *     modern Supabase default) this is LOCAL — the SDK verifies against the
+     *     cached JWKS via Web Crypto, no call to GoTrue. With a legacy symmetric
+     *     HS256 secret the SDK transparently falls back to a network verify, so
+     *     this is correct for both project types without us detecting the scheme
+     *     or hand-rolling JWKS handling (which the Supabase docs warn against —
+     *     it breaks under key rotation).
+     *  2. Local verification can't see a server-side sign-out or a `disabled`
+     *     flip that happened AFTER the token was issued (the claims are a
+     *     snapshot). So we additionally re-check against GoTrue via `getUser`,
+     *     but at most once per `revalidateMs` per session — bounding revocation
+     *     latency to that window while eliminating ~all per-request network
+     *     calls under steady load.
+     *
+     * `'strict'`: `getUser` on every request — instant revocation, one round
+     * trip per request. The pre-1b behavior, for operators who accept no lag.
+     */
     verifyToken(token: string): Promise<AuthUser | null>;
+    /** Full network verify against GoTrue. Also the `'strict'`-mode path. */
+    private verifyViaGetUser;
+    /** Local JWT verification. Returns the claims, or null if invalid/expired. */
+    private getClaimsOrNull;
+    private shouldRevalidate;
+    private markRevalidated;
     getUser(id: string): Promise<AuthUser | null>;
     listUsers(opts?: ListOptions): Promise<Page<AuthUser> | null>;
     createUser(email: string): Promise<AuthUser>;

package/dist/auth/SupabaseAuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SupabaseAuthProvider.d.ts","sourceRoot":"","sources":["../../src/auth/SupabaseAuthProvider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,aAAa,EACb,cAAc,EACd,UAAU,EACV,aAAa,EACb,QAAQ,EAER,oBAAoB,EACpB,WAAW,EACX,IAAI,EACJ,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,0BAA0B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,qBAAa,oBAAqB,YAAW,aAAa;IACzD,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,MAAM,EAAE,0BAA0B;IA4B9C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,oBAAoB;IAuBvE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAWpD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAM7C,SAAS,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAkB7D,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAa5C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAcrD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoBtD,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyB/C;;;;OAIG;YACW,MAAM;IAUpB;;;;OAIG;IACH,OAAO,CAAC,OAAO;IAWf;;;;OAIG;IACH,mBAAmB,IAAI;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;CAG/D"}
+{"version":3,"file":"SupabaseAuthProvider.d.ts","sourceRoot":"","sources":["../../src/auth/SupabaseAuthProvider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,aAAa,EACb,cAAc,EACd,UAAU,EACV,aAAa,EACb,QAAQ,EAER,oBAAoB,EACpB,WAAW,EACX,IAAI,EACJ,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,0BAA0B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACxC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAYD,qBAAa,oBAAqB,YAAW,aAAa;IACzD,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAsB;IACxD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IAEtC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA6B;gBAEnD,MAAM,EAAE,0BAA0B;IA8B9C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,oBAAoB;IA8B7E;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAsC1D,yEAAyE;YAC3D,gBAAgB;IAO9B,8EAA8E;YAChE,eAAe;IAU7B,OAAO,CAAC,gBAAgB;IAKxB,OAAO,CAAC,eAAe;IAcjB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAM7C,SAAS,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAkB7D,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAa5C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAcrD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoBtD,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyB/C;;;;OAIG;YACW,MAAM;IAUpB;;;;OAIG;IACH,OAAO,CAAC,OAAO;IAWf;;;;OAIG;IACH,mBAAmB,IAAI;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;CAG/D"}

package/dist/auth/SupabaseAuthProvider.js

@@ -1,4 +1,13 @@
 import { createClient } from '@supabase/supabase-js';
+/** Default hybrid recheck window — see `revalidateMs`. */
+const DEFAULT_REVALIDATE_MS = 60_000;
+/** Parse a positive integer env var, or undefined if unset/invalid. */
+function parsePositiveInt(raw) {
+    if (!raw)
+        return undefined;
+    const n = Number.parseInt(raw, 10);
+    return Number.isFinite(n) && n > 0 ? n : undefined;
+}
 export class SupabaseAuthProvider {
     name = 'Supabase Auth';
     passwordAuth;
@@ -8,9 +17,21 @@ export class SupabaseAuthProvider {
     anon;
     anonKey;
     supabaseUrl;
+    tokenVerification;
+    revalidateMs;
+    /**
+     * Last time a given session was re-validated against GoTrue (epoch ms),
+     * keyed by the JWT `session_id`. Bounds the hybrid recheck to once per
+     * `revalidateMs` per session. Swept lazily (see `verifyToken`) so a burst of
+     * distinct sessions can't leak memory. Per-process; multi-instance drift is
+     * harmless (each instance rechecks on its own schedule).
+     */
+    lastRevalidatedAt = new Map();
     constructor(config) {
         this.supabaseUrl = config.supabaseUrl;
         this.anonKey = config.anonKey;
+        this.tokenVerification = config.tokenVerification ?? 'hybrid';
+        this.revalidateMs = config.revalidateMs ?? DEFAULT_REVALIDATE_MS;
         this.admin = createClient(config.supabaseUrl, config.serviceRoleKey, {
             auth: { persistSession: false, autoRefreshToken: false }
         });
@@ -35,6 +56,11 @@ export class SupabaseAuthProvider {
             .split(',')
             .map((p) => p.trim().toLowerCase())
             .filter((p) => p.length > 0);
+        // Local JWT verification is the default (fast; requires asymmetric signing
+        // keys to skip the network — the Supabase default since 2025). Set
+        // SUPABASE_TOKEN_VERIFICATION=strict to force a getUser() per request.
+        const tokenVerification = env.SUPABASE_TOKEN_VERIFICATION === 'strict' ? 'strict' : 'hybrid';
+        const revalidateMs = parsePositiveInt(env.SUPABASE_REVALIDATE_MS);
         return new SupabaseAuthProvider({
             supabaseUrl,
             anonKey,
@@ -43,15 +69,71 @@ export class SupabaseAuthProvider {
             oauthProviders,
             // Default true; set SUPABASE_ALLOW_EMAIL_LINK_SIGNUP=false to lock down
             // to invite-only and reject magic-link signups for new addresses.
-            allowEmailLinkSignup: env.SUPABASE_ALLOW_EMAIL_LINK_SIGNUP !== 'false'
+            allowEmailLinkSignup: env.SUPABASE_ALLOW_EMAIL_LINK_SIGNUP !== 'false',
+            tokenVerification,
+            ...(revalidateMs !== undefined ? { revalidateMs } : {})
         });
     }
+    /**
+     * Verify a session JWT and return the user, or null if invalid/disabled.
+     * Runs on EVERY authenticated request, so the fast path avoids a network
+     * round-trip.
+     *
+     * `'hybrid'` (default):
+     *  1. `getClaims(token)` verifies the JWT. With asymmetric signing keys (the
+     *     modern Supabase default) this is LOCAL — the SDK verifies against the
+     *     cached JWKS via Web Crypto, no call to GoTrue. With a legacy symmetric
+     *     HS256 secret the SDK transparently falls back to a network verify, so
+     *     this is correct for both project types without us detecting the scheme
+     *     or hand-rolling JWKS handling (which the Supabase docs warn against —
+     *     it breaks under key rotation).
+     *  2. Local verification can't see a server-side sign-out or a `disabled`
+     *     flip that happened AFTER the token was issued (the claims are a
+     *     snapshot). So we additionally re-check against GoTrue via `getUser`,
+     *     but at most once per `revalidateMs` per session — bounding revocation
+     *     latency to that window while eliminating ~all per-request network
+     *     calls under steady load.
+     *
+     * `'strict'`: `getUser` on every request — instant revocation, one round
+     * trip per request. The pre-1b behavior, for operators who accept no lag.
+     */
     async verifyToken(token) {
         if (!token)
             return null;
-        // Per-request anon client with the JWT attached. `getUser(token)` also
-        // works, but routing through a scoped client keeps future sub-calls
-        // (profile fetch, etc.) RLS-aware if we ever move them here.
+        if (this.tokenVerification === 'strict') {
+            return this.verifyViaGetUser(token);
+        }
+        // --- hybrid: local verify first ---
+        const claims = await this.getClaimsOrNull(token);
+        if (!claims)
+            return null;
+        // `disabled` as of token issue. A flip AFTER issue is caught by the
+        // periodic recheck below.
+        if (claims.user_metadata?.disabled === true) {
+            return null;
+        }
+        // Periodic recheck: catch sign-out / disabled since the token was issued.
+        const sessionId = typeof claims.session_id === 'string' ? claims.session_id : claims.sub;
+        if (this.shouldRevalidate(sessionId)) {
+            const fresh = await this.verifyViaGetUser(token);
+            // getUser rejected it (signed out, disabled, revoked) → deny now.
+            if (!fresh) {
+                this.lastRevalidatedAt.delete(sessionId);
+                return null;
+            }
+            this.markRevalidated(sessionId);
+            return fresh;
+        }
+        // Build the user from claims — no network call on this path.
+        return {
+            id: claims.sub,
+            email: typeof claims.email === 'string' ? claims.email : undefined,
+            disabled: false,
+            metadata: claims.user_metadata
+        };
+    }
+    /** Full network verify against GoTrue. Also the `'strict'`-mode path. */
+    async verifyViaGetUser(token) {
         const { data, error } = await this.anon.auth.getUser(token);
         if (error || !data.user)
             return null;
@@ -59,6 +141,36 @@ export class SupabaseAuthProvider {
             return null;
         return this.hydrate(data.user);
     }
+    /** Local JWT verification. Returns the claims, or null if invalid/expired. */
+    async getClaimsOrNull(token) {
+        try {
+            const { data, error } = await this.anon.auth.getClaims(token);
+            if (error || !data)
+                return null;
+            return data.claims;
+        }
+        catch {
+            return null;
+        }
+    }
+    shouldRevalidate(sessionId) {
+        const last = this.lastRevalidatedAt.get(sessionId);
+        return last === undefined || Date.now() - last >= this.revalidateMs;
+    }
+    markRevalidated(sessionId) {
+        const now = Date.now();
+        this.lastRevalidatedAt.set(sessionId, now);
+        // Lazy sweep so a churn of distinct sessions can't grow the map without
+        // bound. Anything older than two windows is definitely stale (it would
+        // revalidate on next use anyway). Cheap: only runs when the map is large.
+        if (this.lastRevalidatedAt.size > 10_000) {
+            const cutoff = now - this.revalidateMs * 2;
+            for (const [id, ts] of this.lastRevalidatedAt) {
+                if (ts < cutoff)
+                    this.lastRevalidatedAt.delete(id);
+            }
+        }
+    }
     async getUser(id) {
         const { data, error } = await this.admin.auth.admin.getUserById(id);
         if (error || !data.user)

package/dist/auth/SupabaseAuthProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"SupabaseAuthProvider.js","sourceRoot":"","sources":["../../src/auth/SupabaseAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAkC,MAAM,uBAAuB,CAAC;AAqDrF,MAAM,OAAO,oBAAoB;IACvB,IAAI,GAAG,eAAe,CAAC;IACvB,YAAY,CAAgB;IAC5B,KAAK,CAAa;IAClB,SAAS,CAAiB;IAElB,KAAK,CAAiB;IACtB,IAAI,CAAiB;IACrB,OAAO,CAAS;IAChB,WAAW,CAAS;IAErC,YAAY,MAAkC;QAC7C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE;YACpE,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE;YAC5D,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,oBAAoB,CAC3C,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,IAAI,EACT,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,EACjD,MAAM,CAAC,gBAAgB,IAAI,KAAK,EAChC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAC5B,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,IAAI,iBAAiB,CACjC,IAAI,CAAC,IAAI,EACT,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAC5B,MAAM,CAAC,cAAc,IAAI,EAAE,CAC3B,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,qBAAqB,CACzC,IAAI,CAAC,IAAI,EACT,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAC5B,MAAM,CAAC,oBAAoB,IAAI,IAAI,CACnC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAuC;QACrD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC;QACrC,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC;QACtC,MAAM,cAAc,GAAG,GAAG,CAAC,yBAAyB,CAAC;QACrD,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC7E,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5F,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC;aACzD,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,IAAI,oBAAoB,CAAC;YAC/B,WAAW;YACX,OAAO;YACP,cAAc;YACd,gBAAgB,EAAE,GAAG,CAAC,2BAA2B,KAAK,MAAM;YAC5D,cAAc;YACd,wEAAwE;YACxE,kEAAkE;YAClE,oBAAoB,EAAE,GAAG,CAAC,gCAAgC,KAAK,OAAO;SACtE,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC9B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,uEAAuE;QACvE,oEAAoE;QACpE,6DAA6D;QAC7D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAkB;QACjC,mEAAmE;QACnE,kDAAkD;QAClD,MAAM,OAAO,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YAC7D,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnD,OAAO;SACP,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,kDAAkD;QAClD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa;QAC7B,oEAAoE;QACpE,mEAAmE;QACnE,iEAAiE;QACjE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC9D,KAAK;YACL,aAAa,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QAC1B,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,KAAK,EAAE,CAAC;YACX,gEAAgE;YAChE,mEAAmE;YACnE,MAAM,CAAC,GAAG,KAAyD,CAAC;YACpE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;gBAAE,OAAO,WAAW,CAAC;YAChF,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC3B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,OAAO,WAAW,CAAC;QACrD,qEAAqE;QACrE,+BAA+B;QAC/B,MAAM,cAAc,GAAG;YACtB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;YACtC,QAAQ,EAAE,IAAI;SACd,CAAC;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE;YAChE,aAAa,EAAE,cAAc;SAC7B,CAAC,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,KAAyD,CAAC;YACpE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;gBAAE,OAAO,WAAW,CAAC;YAChF,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC9B,kDAAkD;QAClD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK;aACtC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,eAAe,CAAC;aACvB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;aACjB,WAAW,EAAE,CAAC;QAChB,IAAI,KAAK;YAAE,OAAO;QAElB,IAAI,IAAI,EAAE,aAAa,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,MAAM;gBAAE,OAAO;QACjE,CAAC;QACD,MAAM,IAAI,CAAC,KAAK;aACd,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;aACnD,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACrB,CAAC;IAED,4EAA4E;IAC5E,sDAAsD;IAEtD,+EAA+E;IAC/E,YAAY;IACZ,+EAA+E;IAC/E;;;;OAIG;IACK,KAAK,CAAC,MAAM,CACnB,KAAa,EACb,QAAgB;QAEhB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrF,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACK,OAAO,CAAC,IAAU;QACzB,OAAO;YACN,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;YAC9B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS;YACvC,WAAW,EAAE,IAAI,CAAC,eAAe,IAAI,SAAS;YAC9C,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAC/C,QAAQ,EAAE,IAAI,CAAC,aAAa;SAC5B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,mBAAmB;QAClB,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACjE,CAAC;CACD;AAED,MAAM,oBAAoB;IAEP;IACA;IACA;IAIA;IACA;IARlB,YACkB,KAAqB,EACrB,IAAoB,EACpB,MAG4C,EAC5C,gBAAyB,EACzB,OAAiC;QAPjC,UAAK,GAAL,KAAK,CAAgB;QACrB,SAAI,GAAJ,IAAI,CAAgB;QACpB,WAAM,GAAN,MAAM,CAGsC;QAC5C,qBAAgB,GAAhB,gBAAgB,CAAS;QACzB,YAAO,GAAP,OAAO,CAA0B;IAChD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,QAAgB;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,QAAgB;QAC3D,kEAAkE;QAClE,+CAA+C;QAC/C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC9D,KAAK;YACL,QAAQ;YACR,aAAa,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QACjD,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;CACD;AAED;;;;GAIG;AACH,MAAM,iBAAiB;IAEJ;IACA;IACA;IAHlB,YACkB,IAAoB,EACpB,OAAiC,EACjC,SAA4B;QAF5B,SAAI,GAAJ,IAAI,CAAgB;QACpB,YAAO,GAAP,OAAO,CAA0B;QACjC,cAAS,GAAT,SAAS,CAAmB;IAC3C,CAAC;IAEJ,aAAa;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC7B,QAAkD,EAClD,UAAkB;QAElB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;YAC5D,QAAQ;YACR,OAAO,EAAE,EAAE,UAAU,EAAE,mBAAmB,EAAE,IAAI,EAAE;SAClD,CAAC,CAAC;QACH,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,IAAY;QAKnC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC1E,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SACxC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,YAAoB;QAIxC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7F,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO;YACN,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SACxC,CAAC;IACH,CAAC;CACD;AAED;;;;;;;;;;GAUG;AACH,MAAM,qBAAqB;IAER;IACA;IACA;IAHlB,YACkB,IAAoB,EACpB,OAAiC,EACjC,WAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAgB;QACpB,YAAO,GAAP,OAAO,CAA0B;QACjC,gBAAW,GAAX,WAAW,CAAS;IACnC,CAAC;IAEJ,KAAK,CAAC,aAAa,CAClB,KAAa,EACb,WAAmB;QAInB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YACpD,KAAK;YACL,OAAO,EAAE;gBACR,eAAe,EAAE,WAAW;gBAC5B,gBAAgB,EAAE,IAAI,CAAC,WAAW;aAClC;SACD,CAAC,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAEhC,oEAAoE;QACpE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,MAAM,GAAI,KAA6B,CAAC,MAAM,CAAC;QACrD,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QACpC,IAAI,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAC9C,IACC,IAAI,KAAK,cAAc;YACvB,IAAI,KAAK,iBAAiB;YAC1B,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAChC,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,KAAK,mBAAmB,IAAI,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC/C,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAK3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;QAEnC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACtD,UAAU,EAAE,SAAS;YACrB,IAAI;SACJ,CAAC,CAAC;QACH,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SACxC,CAAC;IACH,CAAC;CACD;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC3B,GAAW;IAEX,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACJ,gBAAgB;QAChB,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACR,iDAAiD;QACjD,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO;QACN,SAAS;QACT,IAAI,EAAE,IAAgE;KACtE,CAAC;AACH,CAAC"}
+{"version":3,"file":"SupabaseAuthProvider.js","sourceRoot":"","sources":["../../src/auth/SupabaseAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAkC,MAAM,uBAAuB,CAAC;AAuErF,0DAA0D;AAC1D,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,uEAAuE;AACvE,SAAS,gBAAgB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,MAAM,OAAO,oBAAoB;IACvB,IAAI,GAAG,eAAe,CAAC;IACvB,YAAY,CAAgB;IAC5B,KAAK,CAAa;IAClB,SAAS,CAAiB;IAElB,KAAK,CAAiB;IACtB,IAAI,CAAiB;IACrB,OAAO,CAAS;IAChB,WAAW,CAAS;IACpB,iBAAiB,CAAsB;IACvC,YAAY,CAAS;IAEtC;;;;;;OAMG;IACc,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE/D,YAAY,MAAkC;QAC7C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,CAAC;QAC9D,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,qBAAqB,CAAC;QACjE,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE;YACpE,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE;YAC5D,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,oBAAoB,CAC3C,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,IAAI,EACT,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,EACjD,MAAM,CAAC,gBAAgB,IAAI,KAAK,EAChC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAC5B,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,IAAI,iBAAiB,CACjC,IAAI,CAAC,IAAI,EACT,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAC5B,MAAM,CAAC,cAAc,IAAI,EAAE,CAC3B,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,qBAAqB,CACzC,IAAI,CAAC,IAAI,EACT,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAC5B,MAAM,CAAC,oBAAoB,IAAI,IAAI,CACnC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAuC;QACrD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC;QACrC,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC;QACtC,MAAM,cAAc,GAAG,GAAG,CAAC,yBAAyB,CAAC;QACrD,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC7E,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5F,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC;aACzD,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9B,2EAA2E;QAC3E,mEAAmE;QACnE,uEAAuE;QACvE,MAAM,iBAAiB,GAAG,GAAG,CAAC,2BAA2B,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7F,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAClE,OAAO,IAAI,oBAAoB,CAAC;YAC/B,WAAW;YACX,OAAO;YACP,cAAc;YACd,gBAAgB,EAAE,GAAG,CAAC,2BAA2B,KAAK,MAAM;YAC5D,cAAc;YACd,wEAAwE;YACxE,kEAAkE;YAClE,oBAAoB,EAAE,GAAG,CAAC,gCAAgC,KAAK,OAAO;YACtE,iBAAiB;YACjB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC9B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,IAAI,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAED,qCAAqC;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,oEAAoE;QACpE,0BAA0B;QAC1B,IAAK,MAAM,CAAC,aAAoD,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;YACrF,OAAO,IAAI,CAAC;QACb,CAAC;QAED,0EAA0E;QAC1E,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACzF,IAAI,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACjD,kEAAkE;YAClE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACzC,OAAO,IAAI,CAAC;YACb,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC;QACd,CAAC;QAED,6DAA6D;QAC7D,OAAO;YACN,EAAE,EAAE,MAAM,CAAC,GAAG;YACd,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YAClE,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,MAAM,CAAC,aAAa;SAC9B,CAAC;IACH,CAAC;IAED,yEAAyE;IACjE,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAC3C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,eAAe,CAAC,KAAa;QAC1C,IAAI,CAAC;YACJ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9D,IAAI,KAAK,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAChC,OAAO,IAAI,CAAC,MAAM,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAEO,gBAAgB,CAAC,SAAiB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC;IACrE,CAAC;IAEO,eAAe,CAAC,SAAiB;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC3C,wEAAwE;QACxE,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;YAC3C,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC/C,IAAI,EAAE,GAAG,MAAM;oBAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpD,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAkB;QACjC,mEAAmE;QACnE,kDAAkD;QAClD,MAAM,OAAO,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YAC7D,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnD,OAAO;SACP,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,kDAAkD;QAClD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa;QAC7B,oEAAoE;QACpE,mEAAmE;QACnE,iEAAiE;QACjE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC9D,KAAK;YACL,aAAa,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QAC1B,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,KAAK,EAAE,CAAC;YACX,gEAAgE;YAChE,mEAAmE;YACnE,MAAM,CAAC,GAAG,KAAyD,CAAC;YACpE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;gBAAE,OAAO,WAAW,CAAC;YAChF,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC3B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,OAAO,WAAW,CAAC;QACrD,qEAAqE;QACrE,+BAA+B;QAC/B,MAAM,cAAc,GAAG;YACtB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;YACtC,QAAQ,EAAE,IAAI;SACd,CAAC;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE;YAChE,aAAa,EAAE,cAAc;SAC7B,CAAC,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,KAAyD,CAAC;YACpE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;gBAAE,OAAO,WAAW,CAAC;YAChF,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC9B,kDAAkD;QAClD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK;aACtC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,eAAe,CAAC;aACvB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;aACjB,WAAW,EAAE,CAAC;QAChB,IAAI,KAAK;YAAE,OAAO;QAElB,IAAI,IAAI,EAAE,aAAa,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,MAAM;gBAAE,OAAO;QACjE,CAAC;QACD,MAAM,IAAI,CAAC,KAAK;aACd,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;aACnD,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACrB,CAAC;IAED,4EAA4E;IAC5E,sDAAsD;IAEtD,+EAA+E;IAC/E,YAAY;IACZ,+EAA+E;IAC/E;;;;OAIG;IACK,KAAK,CAAC,MAAM,CACnB,KAAa,EACb,QAAgB;QAEhB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrF,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACK,OAAO,CAAC,IAAU;QACzB,OAAO;YACN,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;YAC9B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS;YACvC,WAAW,EAAE,IAAI,CAAC,eAAe,IAAI,SAAS;YAC9C,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAC/C,QAAQ,EAAE,IAAI,CAAC,aAAa;SAC5B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,mBAAmB;QAClB,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACjE,CAAC;CACD;AAED,MAAM,oBAAoB;IAEP;IACA;IACA;IAIA;IACA;IARlB,YACkB,KAAqB,EACrB,IAAoB,EACpB,MAG4C,EAC5C,gBAAyB,EACzB,OAAiC;QAPjC,UAAK,GAAL,KAAK,CAAgB;QACrB,SAAI,GAAJ,IAAI,CAAgB;QACpB,WAAM,GAAN,MAAM,CAGsC;QAC5C,qBAAgB,GAAhB,gBAAgB,CAAS;QACzB,YAAO,GAAP,OAAO,CAA0B;IAChD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,QAAgB;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,QAAgB;QAC3D,kEAAkE;QAClE,+CAA+C;QAC/C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC9D,KAAK;YACL,QAAQ;YACR,aAAa,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QACjD,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;CACD;AAED;;;;GAIG;AACH,MAAM,iBAAiB;IAEJ;IACA;IACA;IAHlB,YACkB,IAAoB,EACpB,OAAiC,EACjC,SAA4B;QAF5B,SAAI,GAAJ,IAAI,CAAgB;QACpB,YAAO,GAAP,OAAO,CAA0B;QACjC,cAAS,GAAT,SAAS,CAAmB;IAC3C,CAAC;IAEJ,aAAa;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC7B,QAAkD,EAClD,UAAkB;QAElB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;YAC5D,QAAQ;YACR,OAAO,EAAE,EAAE,UAAU,EAAE,mBAAmB,EAAE,IAAI,EAAE;SAClD,CAAC,CAAC;QACH,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,IAAY;QAKnC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC1E,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SACxC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,YAAoB;QAIxC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7F,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO;YACN,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SACxC,CAAC;IACH,CAAC;CACD;AAED;;;;;;;;;;GAUG;AACH,MAAM,qBAAqB;IAER;IACA;IACA;IAHlB,YACkB,IAAoB,EACpB,OAAiC,EACjC,WAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAgB;QACpB,YAAO,GAAP,OAAO,CAA0B;QACjC,gBAAW,GAAX,WAAW,CAAS;IACnC,CAAC;IAEJ,KAAK,CAAC,aAAa,CAClB,KAAa,EACb,WAAmB;QAInB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YACpD,KAAK;YACL,OAAO,EAAE;gBACR,eAAe,EAAE,WAAW;gBAC5B,gBAAgB,EAAE,IAAI,CAAC,WAAW;aAClC;SACD,CAAC,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAEhC,oEAAoE;QACpE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,MAAM,GAAI,KAA6B,CAAC,MAAM,CAAC;QACrD,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QACpC,IAAI,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAC9C,IACC,IAAI,KAAK,cAAc;YACvB,IAAI,KAAK,iBAAiB;YAC1B,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAChC,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,KAAK,mBAAmB,IAAI,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC/C,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAK3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;QAEnC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACtD,UAAU,EAAE,SAAS;YACrB,IAAI;SACJ,CAAC,CAAC;QACH,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SACxC,CAAC;IACH,CAAC;CACD;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC3B,GAAW;IAEX,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACJ,gBAAgB;QAChB,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACR,iDAAiD;QACjD,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO;QACN,SAAS;QACT,IAAI,EAAE,IAAgE;KACtE,CAAC;AACH,CAAC"}

package/dist/auth/__tests__/token-verification.test.d.ts

@@ -0,0 +1,13 @@
+/**
+ * CI-runnable (no live stack) tests for §1b hybrid token verification. Stubs
+ * the internal anon client's `getClaims` (local JWT verify) and `getUser`
+ * (network GoTrue verify) so we can assert the network-call behavior directly.
+ *
+ * Contract:
+ *  - hybrid (default): verify locally via getClaims on every request; hit
+ *    getUser at most once per `revalidateMs` per session; a getUser rejection
+ *    during that recheck (sign-out / disabled) denies immediately.
+ *  - strict: getUser on every request.
+ */
+export {};
+//# sourceMappingURL=token-verification.test.d.ts.map

package/dist/auth/__tests__/token-verification.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-verification.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/token-verification.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/auth/__tests__/token-verification.test.js

@@ -0,0 +1,135 @@
+/**
+ * CI-runnable (no live stack) tests for §1b hybrid token verification. Stubs
+ * the internal anon client's `getClaims` (local JWT verify) and `getUser`
+ * (network GoTrue verify) so we can assert the network-call behavior directly.
+ *
+ * Contract:
+ *  - hybrid (default): verify locally via getClaims on every request; hit
+ *    getUser at most once per `revalidateMs` per session; a getUser rejection
+ *    during that recheck (sign-out / disabled) denies immediately.
+ *  - strict: getUser on every request.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { SupabaseAuthProvider } from '../SupabaseAuthProvider.js';
+const URL = 'https://example.supabase.co';
+const ANON = 'anon-key';
+const SERVICE = 'service-key';
+/** Reach into the provider's private anon client and replace its auth surface. */
+function stubAnonAuth(provider) {
+    const stub = { getClaims: vi.fn(), getUser: vi.fn() };
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    provider.anon.auth.getClaims = stub.getClaims;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    provider.anon.auth.getUser = stub.getUser;
+    return stub;
+}
+function okClaims(overrides = {}) {
+    return {
+        data: {
+            claims: {
+                sub: 'user-1',
+                session_id: 'sess-1',
+                email: 'u@example.com',
+                exp: Math.floor(Date.now() / 1000) + 3600,
+                ...overrides
+            },
+            header: {},
+            signature: new Uint8Array()
+        },
+        error: null
+    };
+}
+function okUser() {
+    return {
+        data: { user: { id: 'user-1', email: 'u@example.com', user_metadata: {} } },
+        error: null
+    };
+}
+describe('SupabaseAuthProvider — hybrid token verification', () => {
+    beforeEach(() => vi.restoreAllMocks());
+    it('verifies locally via getClaims and rechecks getUser once per window', async () => {
+        const provider = new SupabaseAuthProvider({
+            supabaseUrl: URL,
+            anonKey: ANON,
+            serviceRoleKey: SERVICE,
+            revalidateMs: 60_000
+        });
+        const stub = stubAnonAuth(provider);
+        stub.getClaims.mockResolvedValue(okClaims());
+        stub.getUser.mockResolvedValue(okUser());
+        // First call: local verify + one recheck (never seen this session).
+        const a = await provider.verifyToken('tok');
+        expect(a?.id).toBe('user-1');
+        expect(stub.getClaims).toHaveBeenCalledTimes(1);
+        expect(stub.getUser).toHaveBeenCalledTimes(1);
+        // Subsequent calls within the window: local only, NO more getUser.
+        await provider.verifyToken('tok');
+        await provider.verifyToken('tok');
+        expect(stub.getClaims).toHaveBeenCalledTimes(3);
+        expect(stub.getUser).toHaveBeenCalledTimes(1); // still just the first
+    });
+    it('denies immediately when the periodic getUser recheck rejects (signed out / revoked)', async () => {
+        const provider = new SupabaseAuthProvider({
+            supabaseUrl: URL,
+            anonKey: ANON,
+            serviceRoleKey: SERVICE
+        });
+        const stub = stubAnonAuth(provider);
+        stub.getClaims.mockResolvedValue(okClaims());
+        stub.getUser.mockResolvedValue({ data: { user: null }, error: { message: 'signed out' } });
+        const result = await provider.verifyToken('tok');
+        expect(result).toBeNull();
+    });
+    it('denies when the claims already mark the user disabled (no getUser needed)', async () => {
+        const provider = new SupabaseAuthProvider({
+            supabaseUrl: URL,
+            anonKey: ANON,
+            serviceRoleKey: SERVICE
+        });
+        const stub = stubAnonAuth(provider);
+        stub.getClaims.mockResolvedValue(okClaims({ user_metadata: { disabled: true } }));
+        const result = await provider.verifyToken('tok');
+        expect(result).toBeNull();
+        expect(stub.getUser).not.toHaveBeenCalled();
+    });
+    it('denies when getClaims fails (bad signature / expired)', async () => {
+        const provider = new SupabaseAuthProvider({
+            supabaseUrl: URL,
+            anonKey: ANON,
+            serviceRoleKey: SERVICE
+        });
+        const stub = stubAnonAuth(provider);
+        stub.getClaims.mockResolvedValue({ data: null, error: { message: 'invalid JWT' } });
+        expect(await provider.verifyToken('tok')).toBeNull();
+        expect(stub.getUser).not.toHaveBeenCalled();
+    });
+    it('returns null for an empty token without any network call', async () => {
+        const provider = new SupabaseAuthProvider({
+            supabaseUrl: URL,
+            anonKey: ANON,
+            serviceRoleKey: SERVICE
+        });
+        const stub = stubAnonAuth(provider);
+        expect(await provider.verifyToken('')).toBeNull();
+        expect(stub.getClaims).not.toHaveBeenCalled();
+        expect(stub.getUser).not.toHaveBeenCalled();
+    });
+});
+describe('SupabaseAuthProvider — strict token verification', () => {
+    beforeEach(() => vi.restoreAllMocks());
+    it('calls getUser on every request and never getClaims', async () => {
+        const provider = new SupabaseAuthProvider({
+            supabaseUrl: URL,
+            anonKey: ANON,
+            serviceRoleKey: SERVICE,
+            tokenVerification: 'strict'
+        });
+        const stub = stubAnonAuth(provider);
+        stub.getUser.mockResolvedValue(okUser());
+        await provider.verifyToken('tok');
+        await provider.verifyToken('tok');
+        expect(stub.getUser).toHaveBeenCalledTimes(2);
+        expect(stub.getClaims).not.toHaveBeenCalled();
+    });
+});
+//# sourceMappingURL=token-verification.test.js.map

package/dist/auth/__tests__/token-verification.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-verification.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/token-verification.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,MAAM,GAAG,GAAG,6BAA6B,CAAC;AAC1C,MAAM,IAAI,GAAG,UAAU,CAAC;AACxB,MAAM,OAAO,GAAG,aAAa,CAAC;AAO9B,kFAAkF;AAClF,SAAS,YAAY,CAAC,QAA8B;IACnD,MAAM,IAAI,GAAa,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;IAChE,8DAA8D;IAC7D,QAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACvD,8DAA8D;IAC7D,QAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IACnD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,YAAqC,EAAE;IACxD,OAAO;QACN,IAAI,EAAE;YACL,MAAM,EAAE;gBACP,GAAG,EAAE,QAAQ;gBACb,UAAU,EAAE,QAAQ;gBACpB,KAAK,EAAE,eAAe;gBACtB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;gBACzC,GAAG,SAAS;aACZ;YACD,MAAM,EAAE,EAAE;YACV,SAAS,EAAE,IAAI,UAAU,EAAE;SAC3B;QACD,KAAK,EAAE,IAAI;KACX,CAAC;AACH,CAAC;AAED,SAAS,MAAM;IACd,OAAO;QACN,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE;QAC3E,KAAK,EAAE,IAAI;KACX,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IACjE,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IAEvC,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;YACvB,YAAY,EAAE,MAAM;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;QAEzC,oEAAoE;QACpE,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE9C,mEAAmE;QACnE,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAE3F,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAElF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAEpF,MAAM,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IACjE,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IAEvC,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;YACvB,iBAAiB,EAAE,QAAQ;SAC3B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;QAEzC,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/data/SupabaseComputeServerStore.d.ts

@@ -1,4 +1,4 @@
-import { type IComputeServerStore, type ComputeConfig, type ComputeServerConfig, type RequestContext } from '@selvajs/platform';
+import { type IComputeServerStore, type ComputeConfig, type ComputeServerConfig, type RequestContext, type SecretVerificationReport } from '@selvajs/platform';
 import type { ClientBundle } from './client.js';
 /**
  * Compute-server config backed by three tables:
@@ -16,11 +16,43 @@ import type { ClientBundle } from './client.js';
  */
 export declare class SupabaseComputeServerStore implements IComputeServerStore {
     private readonly clients;
-    constructor(clients: ClientBundle);
+    private readonly secretKey?;
+    /**
+     * `secretKey` (from `SELVA_AT_REST_KEY`) encrypts `api_key` before it is
+     * written to `compute_servers.api_key` and decrypts it on read, so the
+     * Rhino.Compute credential never sits in the DB as plaintext — matching the
+     * local provider's on-disk envelope. Optional only for legacy construction
+     * paths (tests that never touch apiKeys); a store built without a key throws
+     * if asked to write or read a secret. Wire it via `SupabaseDataProvider`.
+     */
+    constructor(clients: ClientBundle, secretKey?: Buffer | undefined);
     getConfig(ctx: RequestContext): Promise<ComputeConfig>;
     savePlatformServers(ctx: RequestContext, servers: ComputeServerConfig[], defaultServerId: string | undefined): Promise<void>;
     saveOrgServers(ctx: RequestContext, orgId: string, servers: ComputeServerConfig[], defaultServerId?: string | null): Promise<void>;
     setOrgDefault(ctx: RequestContext, orgId: string, serverId: string | null): Promise<void>;
     deleteByOrg(ctx: RequestContext, orgId: string): Promise<void>;
+    /**
+     * Encrypt a server's `apiKey` before it is written to the DB. Idempotent —
+     * an already-enveloped value is passed through, so a round-trip (read →
+     * save) never double-encrypts. Throws if the store was built without a key
+     * but a real secret needs writing, so we never silently persist plaintext.
+     */
+    private encryptServerApiKey;
+    /**
+     * Decrypt a row's `api_key` on read. Tolerant, mirroring the local provider:
+     * a row whose ciphertext can't be authenticated under the current key is
+     * returned with `api_key: null` and a warning logged, so the page keeps
+     * rendering (solves against that server fail later at Rhino.Compute). A
+     * plaintext value that predates encryption is passed through unchanged and
+     * surfaced by `verifySecrets()` — never silently dropped.
+     */
+    private decryptRowApiKey;
+    /**
+     * Boot-time integrity check over every `compute_servers` row. Uses the
+     * service client (no request context at boot) to read raw ciphertext, then
+     * attempts to decrypt each `api_key`. Does NOT throw — returns a structured
+     * report for boot health to drive `/api/health`.
+     */
+    verifySecrets(): Promise<SecretVerificationReport>;
 }
 //# sourceMappingURL=SupabaseComputeServerStore.d.ts.map

package/dist/data/SupabaseComputeServerStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SupabaseComputeServerStore.d.ts","sourceRoot":"","sources":["../../src/data/SupabaseComputeServerStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;;;;;;;;;GAaG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,YAAY;IAE5C,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAyCtD,mBAAmB,CACxB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,mBAAmB,EAAE,EAC9B,eAAe,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,IAAI,CAAC;IAiCV,cAAc,CACnB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,EAAE,EAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAC7B,OAAO,CAAC,IAAI,CAAC;IAgCV,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBzF,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA0BpE"}
+{"version":3,"file":"SupabaseComputeServerStore.d.ts","sourceRoot":"","sources":["../../src/data/SupabaseComputeServerStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAEnB,KAAK,wBAAwB,EAC7B,MAAM,mBAAmB,CAAC;AAI3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAWhD;;;;;;;;;;;;;GAaG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IAUpE,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAV5B;;;;;;;OAOG;gBAEe,OAAO,EAAE,YAAY,EACrB,SAAS,CAAC,EAAE,MAAM,YAAA;IAG9B,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA2CtD,mBAAmB,CACxB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,mBAAmB,EAAE,EAC9B,eAAe,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,IAAI,CAAC;IAiCV,cAAc,CACnB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,EAAE,EAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAC7B,OAAO,CAAC,IAAI,CAAC;IAgCV,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBzF,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BpE;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IAgCxB;;;;;OAKG;IACG,aAAa,IAAI,OAAO,CAAC,wBAAwB,CAAC;CA0CxD"}