@strapi/core 0.0.0-next.281b331dc777a6a76694c122f7d1d9bc8c783747 → 0.0.0-next.29273b8e8a9a5aa635e5680190eda01f861431aa

package/dist/services/session-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-manager.js","sources":["../../src/services/session-manager.ts"],"sourcesContent":["import crypto from 'crypto';\nimport jwt from 'jsonwebtoken';\nimport type { VerifyOptions } from 'jsonwebtoken';\nimport type { Database } from '@strapi/database';\nimport { DEFAULT_ALGORITHM } from '../constants';\n\nexport interface SessionProvider {\n  create(session: SessionData): Promise<SessionData>;\n  findBySessionId(sessionId: string): Promise<SessionData | null>;\n  updateBySessionId(sessionId: string, data: Partial<SessionData>): Promise<void>;\n  deleteBySessionId(sessionId: string): Promise<void>;\n  deleteExpired(): Promise<void>;\n  deleteBy(criteria: { userId?: string; origin?: string; deviceId?: string }): Promise<void>;\n}\n\nexport interface SessionData {\n  id?: string;\n  userId: string; // User ID stored as string (key-value store)\n  sessionId: string;\n  deviceId?: string; // Optional for origins that don't need device tracking\n  origin: string;\n  childId?: string | null;\n\n  type?: 'refresh' | 'session';\n  status?: 'active' | 'rotated' | 'revoked';\n  expiresAt: Date;\n  absoluteExpiresAt?: Date | null;\n  createdAt?: Date;\n  updatedAt?: Date;\n}\n\nexport interface RefreshTokenPayload {\n  userId: string;\n  sessionId: string;\n  type: 'refresh';\n  exp: number;\n  iat: number;\n}\n\nexport interface AccessTokenPayload {\n  userId: string;\n  sessionId: string;\n  type: 'access';\n  exp: number;\n  iat: number;\n}\n\nexport type TokenPayload = RefreshTokenPayload | AccessTokenPayload;\n\nexport interface ValidateRefreshTokenResult {\n  isValid: boolean;\n  userId?: string;\n  sessionId?: string;\n  error?:\n    | 'invalid_token'\n    | 'token_expired'\n    | 'session_not_found'\n    | 'session_expired'\n    | 'wrong_token_type';\n}\n\nclass DatabaseSessionProvider implements SessionProvider {\n  private db: Database;\n\n  private contentType: string;\n\n  constructor(db: Database, contentType: string) {\n    this.db = db;\n    this.contentType = contentType;\n  }\n\n  async create(session: SessionData): Promise<SessionData> {\n    const result = await this.db.query(this.contentType).create({\n      data: session,\n    });\n    return result as SessionData;\n  }\n\n  async findBySessionId(sessionId: string): Promise<SessionData | null> {\n    const result = await this.db.query(this.contentType).findOne({\n      where: { sessionId },\n    });\n    return result as SessionData | null;\n  }\n\n  async updateBySessionId(sessionId: string, data: Partial<SessionData>): Promise<void> {\n    await this.db.query(this.contentType).update({ where: { sessionId }, data });\n  }\n\n  async deleteBySessionId(sessionId: string): Promise<void> {\n    await this.db.query(this.contentType).delete({\n      where: { sessionId },\n    });\n  }\n\n  async deleteExpired(): Promise<void> {\n    await this.db.query(this.contentType).deleteMany({\n      where: { absoluteExpiresAt: { $lt: new Date() } },\n    });\n  }\n\n  async deleteBy(criteria: { userId?: string; origin?: string; deviceId?: string }): Promise<void> {\n    await this.db.query(this.contentType).deleteMany({\n      where: {\n        ...(criteria.userId ? { userId: criteria.userId } : {}),\n        ...(criteria.origin ? { origin: criteria.origin } : {}),\n        ...(criteria.deviceId ? { deviceId: criteria.deviceId } : {}),\n      },\n    });\n  }\n}\n\nexport interface SessionManagerConfig {\n  jwtSecret: string;\n  accessTokenLifespan: number;\n  maxRefreshTokenLifespan: number;\n  idleRefreshTokenLifespan: number;\n  maxSessionLifespan: number;\n  idleSessionLifespan: number;\n}\n\nclass OriginSessionManager {\n  constructor(\n    private sessionManager: SessionManager,\n    private origin: string\n  ) {}\n\n  async generateRefreshToken(\n    userId: string,\n    deviceId: string | undefined,\n    options?: { type?: 'refresh' | 'session' }\n  ): Promise<{ token: string; sessionId: string; absoluteExpiresAt: string }> {\n    return this.sessionManager.generateRefreshToken(userId, deviceId, this.origin, options);\n  }\n\n  async generateAccessToken(refreshToken: string): Promise<{ token: string } | { error: string }> {\n    return this.sessionManager.generateAccessToken(refreshToken, this.origin);\n  }\n\n  async rotateRefreshToken(refreshToken: string): Promise<\n    | {\n        token: string;\n        sessionId: string;\n        absoluteExpiresAt: string;\n        type: 'refresh' | 'session';\n      }\n    | { error: string }\n  > {\n    return this.sessionManager.rotateRefreshToken(refreshToken, this.origin);\n  }\n\n  validateAccessToken(\n    token: string\n  ): { isValid: true; payload: AccessTokenPayload } | { isValid: false; payload: null } {\n    return this.sessionManager.validateAccessToken(token, this.origin);\n  }\n\n  async validateRefreshToken(token: string): Promise<ValidateRefreshTokenResult> {\n    return this.sessionManager.validateRefreshToken(token, this.origin);\n  }\n\n  async invalidateRefreshToken(userId: string, deviceId?: string): Promise<void> {\n    return this.sessionManager.invalidateRefreshToken(this.origin, userId, deviceId);\n  }\n\n  /**\n   * Returns true when a session exists and is not expired for this origin.\n   * If the session exists but is expired, it will be deleted as part of this check.\n   */\n  async isSessionActive(sessionId: string): Promise<boolean> {\n    return this.sessionManager.isSessionActive(sessionId, this.origin);\n  }\n}\n\nclass SessionManager {\n  private provider: SessionProvider;\n\n  // Store origin-specific configurations\n  private originConfigs: Map<string, SessionManagerConfig> = new Map();\n\n  // Run expired cleanup only every N calls to avoid extra queries\n  private cleanupInvocationCounter: number = 0;\n\n  private readonly cleanupEveryCalls: number = 50;\n\n  constructor(provider: SessionProvider) {\n    this.provider = provider;\n  }\n\n  /**\n   * Define configuration for a specific origin\n   */\n  defineOrigin(origin: string, config: SessionManagerConfig): void {\n    this.originConfigs.set(origin, config);\n  }\n\n  /**\n   * Check if an origin is defined\n   */\n  hasOrigin(origin: string): boolean {\n    return this.originConfigs.has(origin);\n  }\n\n  /**\n   * Get configuration for a specific origin, throw error if not defined\n   */\n  private getConfigForOrigin(origin: string): SessionManagerConfig {\n    const originConfig = this.originConfigs.get(origin);\n    if (originConfig) {\n      return originConfig;\n    }\n    throw new Error(\n      `SessionManager: Origin '${origin}' is not defined. Please define it using defineOrigin('${origin}', config).`\n    );\n  }\n\n  generateSessionId(): string {\n    return crypto.randomBytes(16).toString('hex');\n  }\n\n  private async maybeCleanupExpired(): Promise<void> {\n    this.cleanupInvocationCounter += 1;\n    if (this.cleanupInvocationCounter >= this.cleanupEveryCalls) {\n      this.cleanupInvocationCounter = 0;\n\n      await this.provider.deleteExpired();\n    }\n  }\n\n  /**\n   * Get the cleanup every calls threshold\n   */\n  get cleanupThreshold(): number {\n    return this.cleanupEveryCalls;\n  }\n\n  async generateRefreshToken(\n    userId: string,\n    deviceId: string | undefined,\n    origin: string,\n    options?: { type?: 'refresh' | 'session' }\n  ): Promise<{ token: string; sessionId: string; absoluteExpiresAt: string }> {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    await this.maybeCleanupExpired();\n\n    const config = this.getConfigForOrigin(origin);\n    const sessionId = this.generateSessionId();\n    const tokenType = options?.type ?? 'refresh';\n    const isRefresh = tokenType === 'refresh';\n\n    const idleLifespan = isRefresh ? config.idleRefreshTokenLifespan : config.idleSessionLifespan;\n\n    const maxLifespan = isRefresh ? config.maxRefreshTokenLifespan : config.maxSessionLifespan;\n\n    const now = Date.now();\n    const expiresAt = new Date(now + idleLifespan * 1000);\n    const absoluteExpiresAt = new Date(now + maxLifespan * 1000);\n\n    // Create the root record first so createdAt can be used for signing.\n    const record = await this.provider.create({\n      userId,\n      sessionId,\n      ...(deviceId && { deviceId }),\n      origin,\n      childId: null,\n      type: tokenType,\n      status: 'active',\n      expiresAt,\n      absoluteExpiresAt,\n    });\n\n    const issuedAtSeconds = Math.floor(new Date(record.createdAt ?? new Date()).getTime() / 1000);\n    const expiresAtSeconds = Math.floor(new Date(record.expiresAt).getTime() / 1000);\n\n    const payload: RefreshTokenPayload = {\n      userId,\n      sessionId,\n      type: 'refresh',\n      iat: issuedAtSeconds,\n      exp: expiresAtSeconds,\n    };\n\n    const token = jwt.sign(payload, config.jwtSecret, {\n      algorithm: DEFAULT_ALGORITHM,\n      noTimestamp: true,\n    });\n\n    return {\n      token,\n      sessionId,\n      absoluteExpiresAt: absoluteExpiresAt.toISOString(),\n    };\n  }\n\n  validateAccessToken(\n    token: string,\n    origin: string\n  ): { isValid: true; payload: AccessTokenPayload } | { isValid: false; payload: null } {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    try {\n      const config = this.getConfigForOrigin(origin);\n      const payload = jwt.verify(token, config.jwtSecret, {\n        algorithms: [DEFAULT_ALGORITHM],\n      }) as TokenPayload;\n\n      // Ensure this is an access token\n      if (!payload || payload.type !== 'access') {\n        return { isValid: false, payload: null };\n      }\n\n      return { isValid: true, payload };\n    } catch (err) {\n      return { isValid: false, payload: null };\n    }\n  }\n\n  async validateRefreshToken(token: string, origin: string): Promise<ValidateRefreshTokenResult> {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    try {\n      const config = this.getConfigForOrigin(origin);\n      const verifyOptions: VerifyOptions = {\n        algorithms: [DEFAULT_ALGORITHM],\n      };\n\n      const payload = jwt.verify(token, config.jwtSecret, verifyOptions) as RefreshTokenPayload;\n\n      if (payload.type !== 'refresh') {\n        return { isValid: false };\n      }\n\n      const session = await this.provider.findBySessionId(payload.sessionId);\n      if (!session) {\n        return { isValid: false };\n      }\n\n      const now = new Date();\n      if (new Date(session.expiresAt) <= now) {\n        return { isValid: false };\n      }\n\n      // Absolute family expiry check\n      if (session.absoluteExpiresAt && new Date(session.absoluteExpiresAt) <= now) {\n        return { isValid: false };\n      }\n\n      // Only 'active' sessions are eligible to create access tokens.\n      if (session.status !== 'active') {\n        return { isValid: false };\n      }\n\n      if (session.userId !== payload.userId) {\n        return { isValid: false };\n      }\n\n      return {\n        isValid: true,\n        userId: payload.userId,\n        sessionId: payload.sessionId,\n      };\n    } catch (error: any) {\n      if (error instanceof jwt.JsonWebTokenError) {\n        return { isValid: false };\n      }\n\n      throw error;\n    }\n  }\n\n  async invalidateRefreshToken(origin: string, userId: string, deviceId?: string): Promise<void> {\n    await this.provider.deleteBy({ userId, origin, deviceId });\n  }\n\n  async generateAccessToken(\n    refreshToken: string,\n    origin: string\n  ): Promise<{ token: string } | { error: string }> {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    const validation = await this.validateRefreshToken(refreshToken, origin);\n\n    if (!validation.isValid) {\n      return { error: 'invalid_refresh_token' };\n    }\n\n    const payload: Omit<AccessTokenPayload, 'iat' | 'exp'> = {\n      userId: String(validation.userId!),\n      sessionId: validation.sessionId!,\n      type: 'access',\n    };\n\n    const config = this.getConfigForOrigin(origin);\n    const token = jwt.sign(payload, config.jwtSecret, {\n      algorithm: DEFAULT_ALGORITHM,\n      expiresIn: config.accessTokenLifespan,\n    });\n\n    return { token };\n  }\n\n  async rotateRefreshToken(\n    refreshToken: string,\n    origin: string\n  ): Promise<\n    | {\n        token: string;\n        sessionId: string;\n        absoluteExpiresAt: string;\n        type: 'refresh' | 'session';\n      }\n    | { error: string }\n  > {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    try {\n      const config = this.getConfigForOrigin(origin);\n      const payload = jwt.verify(refreshToken, config.jwtSecret, {\n        algorithms: [DEFAULT_ALGORITHM],\n      }) as RefreshTokenPayload;\n\n      if (!payload || payload.type !== 'refresh') {\n        return { error: 'invalid_refresh_token' };\n      }\n\n      const current = await this.provider.findBySessionId(payload.sessionId);\n      if (!current) {\n        return { error: 'invalid_refresh_token' };\n      }\n\n      // If parent already has a child, return the same child token\n      if (current.childId) {\n        const child = await this.provider.findBySessionId(current.childId);\n\n        if (child) {\n          const childIat = Math.floor(new Date(child.createdAt ?? new Date()).getTime() / 1000);\n          const childExp = Math.floor(new Date(child.expiresAt).getTime() / 1000);\n\n          const childPayload: RefreshTokenPayload = {\n            userId: child.userId,\n            sessionId: child.sessionId,\n            type: 'refresh',\n            iat: childIat,\n            exp: childExp,\n          };\n\n          const childToken = jwt.sign(childPayload, config.jwtSecret, {\n            algorithm: DEFAULT_ALGORITHM,\n            noTimestamp: true,\n          });\n\n          let absoluteExpiresAt;\n          if (child.absoluteExpiresAt) {\n            absoluteExpiresAt =\n              typeof child.absoluteExpiresAt === 'string'\n                ? child.absoluteExpiresAt\n                : child.absoluteExpiresAt.toISOString();\n          } else {\n            absoluteExpiresAt = new Date(0).toISOString();\n          }\n\n          return {\n            token: childToken,\n            sessionId: child.sessionId,\n            absoluteExpiresAt,\n            type: child.type ?? 'refresh',\n          };\n        }\n      }\n\n      const now = Date.now();\n      const tokenType = current.type ?? 'refresh';\n      const idleLifespan =\n        tokenType === 'refresh' ? config.idleRefreshTokenLifespan : config.idleSessionLifespan;\n\n      // Enforce idle window since creation of the current token\n      if (current.createdAt && now - new Date(current.createdAt).getTime() > idleLifespan * 1000) {\n        return { error: 'idle_window_elapsed' };\n      }\n\n      // Enforce max family window using absoluteExpiresAt\n      const absolute = current.absoluteExpiresAt\n        ? new Date(current.absoluteExpiresAt).getTime()\n        : now;\n      if (absolute <= now) {\n        return { error: 'max_window_elapsed' };\n      }\n\n      // Create child token\n      const childSessionId = this.generateSessionId();\n      const childExpiresAt = new Date(now + idleLifespan * 1000);\n\n      const childRecord = await this.provider.create({\n        userId: current.userId,\n        sessionId: childSessionId,\n        ...(current.deviceId && { deviceId: current.deviceId }),\n        origin: current.origin,\n        childId: null,\n        type: tokenType,\n        status: 'active',\n        expiresAt: childExpiresAt,\n        absoluteExpiresAt: current.absoluteExpiresAt ?? new Date(absolute),\n      });\n\n      const childIat = Math.floor(new Date(childRecord.createdAt ?? new Date()).getTime() / 1000);\n      const childExp = Math.floor(new Date(childRecord.expiresAt).getTime() / 1000);\n      const payloadOut: RefreshTokenPayload = {\n        userId: current.userId,\n        sessionId: childSessionId,\n        type: 'refresh',\n        iat: childIat,\n        exp: childExp,\n      };\n      const childToken = jwt.sign(payloadOut, config.jwtSecret, {\n        algorithm: DEFAULT_ALGORITHM,\n        noTimestamp: true,\n      });\n\n      await this.provider.updateBySessionId(current.sessionId, {\n        status: 'rotated',\n        childId: childSessionId,\n      });\n\n      let absoluteExpiresAt;\n      if (childRecord.absoluteExpiresAt) {\n        absoluteExpiresAt =\n          typeof childRecord.absoluteExpiresAt === 'string'\n            ? childRecord.absoluteExpiresAt\n            : childRecord.absoluteExpiresAt.toISOString();\n      } else {\n        absoluteExpiresAt = new Date(absolute).toISOString();\n      }\n\n      return {\n        token: childToken,\n        sessionId: childSessionId,\n        absoluteExpiresAt,\n        type: tokenType,\n      };\n    } catch {\n      return { error: 'invalid_refresh_token' };\n    }\n  }\n\n  /**\n   * Returns true when a session exists and is not expired.\n   * If the session exists but is expired, it will be deleted as part of this check.\n   */\n  async isSessionActive(sessionId: string, origin: string): Promise<boolean> {\n    const session = await this.provider.findBySessionId(sessionId);\n    if (!session) {\n      return false;\n    }\n\n    if (session.origin !== origin) {\n      return false;\n    }\n\n    if (new Date(session.expiresAt) <= new Date()) {\n      // Clean up expired session eagerly\n      await this.provider.deleteBySessionId(sessionId);\n\n      return false;\n    }\n\n    return true;\n  }\n}\n\nconst createDatabaseProvider = (db: Database, contentType: string): SessionProvider => {\n  return new DatabaseSessionProvider(db, contentType);\n};\n\nconst createSessionManager = ({\n  db,\n}: {\n  db: Database;\n}): SessionManager & ((origin: string) => OriginSessionManager) => {\n  const provider = createDatabaseProvider(db, 'admin::session');\n  const sessionManager = new SessionManager(provider);\n\n  // Add callable functionality\n  const fluentApi = (origin: string): OriginSessionManager => {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n    return new OriginSessionManager(sessionManager, origin);\n  };\n\n  // Attach only the public SessionManagerService API to the callable\n  const api = fluentApi as unknown as any;\n  api.generateSessionId = sessionManager.generateSessionId.bind(sessionManager);\n  api.defineOrigin = sessionManager.defineOrigin.bind(sessionManager);\n  api.hasOrigin = sessionManager.hasOrigin.bind(sessionManager);\n  // Note: isSessionActive is origin-scoped and exposed on OriginSessionManager only\n\n  // Forward the cleanupThreshold getter (used in tests)\n  Object.defineProperty(api, 'cleanupThreshold', {\n    get() {\n      return sessionManager.cleanupThreshold;\n    },\n    enumerable: true,\n  });\n\n  return api as SessionManager & ((origin: string) => OriginSessionManager);\n};\n\nexport { createSessionManager, createDatabaseProvider };\n"],"names":["DatabaseSessionProvider","create","session","result","db","query","contentType","data","findBySessionId","sessionId","findOne","where","updateBySessionId","update","deleteBySessionId","delete","deleteExpired","deleteMany","absoluteExpiresAt","$lt","Date","deleteBy","criteria","userId","origin","deviceId","constructor","OriginSessionManager","generateRefreshToken","options","sessionManager","generateAccessToken","refreshToken","rotateRefreshToken","validateAccessToken","token","validateRefreshToken","invalidateRefreshToken","isSessionActive","SessionManager","defineOrigin","config","originConfigs","set","hasOrigin","has","getConfigForOrigin","originConfig","get","Error","generateSessionId","crypto","randomBytes","toString","maybeCleanupExpired","cleanupInvocationCounter","cleanupEveryCalls","provider","cleanupThreshold","tokenType","type","isRefresh","idleLifespan","idleRefreshTokenLifespan","idleSessionLifespan","maxLifespan","maxRefreshTokenLifespan","maxSessionLifespan","now","expiresAt","record","childId","status","issuedAtSeconds","Math","floor","createdAt","getTime","expiresAtSeconds","payload","iat","exp","jwt","sign","jwtSecret","algorithm","DEFAULT_ALGORITHM","noTimestamp","toISOString","verify","algorithms","isValid","err","verifyOptions","error","JsonWebTokenError","validation","String","expiresIn","accessTokenLifespan","current","child","childIat","childExp","childPayload","childToken","absolute","childSessionId","childExpiresAt","childRecord","payloadOut","Map","createDatabaseProvider","createSessionManager","fluentApi","api","bind","Object","defineProperty","enumerable"],"mappings":";;;;;;AA6DA,MAAMA,uBAAAA,CAAAA;IAUJ,MAAMC,MAAAA,CAAOC,OAAoB,EAAwB;AACvD,QAAA,MAAMC,MAAS,GAAA,MAAM,IAAI,CAACC,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAA,CAAEL,MAAM,CAAC;YAC1DM,IAAML,EAAAA;AACR,SAAA,CAAA;QACA,OAAOC,MAAAA;AACT;IAEA,MAAMK,eAAAA,CAAgBC,SAAiB,EAA+B;AACpE,QAAA,MAAMN,MAAS,GAAA,MAAM,IAAI,CAACC,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAA,CAAEI,OAAO,CAAC;YAC3DC,KAAO,EAAA;AAAEF,gBAAAA;AAAU;AACrB,SAAA,CAAA;QACA,OAAON,MAAAA;AACT;AAEA,IAAA,MAAMS,iBAAkBH,CAAAA,SAAiB,EAAEF,IAA0B,EAAiB;QACpF,MAAM,IAAI,CAACH,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAEO,CAAAA,MAAM,CAAC;YAAEF,KAAO,EAAA;AAAEF,gBAAAA;AAAU,aAAA;AAAGF,YAAAA;AAAK,SAAA,CAAA;AAC5E;IAEA,MAAMO,iBAAAA,CAAkBL,SAAiB,EAAiB;QACxD,MAAM,IAAI,CAACL,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAES,CAAAA,MAAM,CAAC;YAC3CJ,KAAO,EAAA;AAAEF,gBAAAA;AAAU;AACrB,SAAA,CAAA;AACF;AAEA,IAAA,MAAMO,aAA+B,GAAA;QACnC,MAAM,IAAI,CAACZ,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAEW,CAAAA,UAAU,CAAC;YAC/CN,KAAO,EAAA;gBAAEO,iBAAmB,EAAA;AAAEC,oBAAAA,GAAAA,EAAK,IAAIC,IAAAA;AAAO;AAAE;AAClD,SAAA,CAAA;AACF;IAEA,MAAMC,QAAAA,CAASC,QAAiE,EAAiB;QAC/F,MAAM,IAAI,CAAClB,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAEW,CAAAA,UAAU,CAAC;YAC/CN,KAAO,EAAA;gBACL,GAAIW,QAAAA,CAASC,MAAM,GAAG;AAAEA,oBAAAA,MAAAA,EAAQD,SAASC;AAAO,iBAAA,GAAI,EAAE;gBACtD,GAAID,QAAAA,CAASE,MAAM,GAAG;AAAEA,oBAAAA,MAAAA,EAAQF,SAASE;AAAO,iBAAA,GAAI,EAAE;gBACtD,GAAIF,QAAAA,CAASG,QAAQ,GAAG;AAAEA,oBAAAA,QAAAA,EAAUH,SAASG;AAAS,iBAAA,GAAI;AAC5D;AACF,SAAA,CAAA;AACF;IA3CAC,WAAYtB,CAAAA,EAAY,EAAEE,WAAmB,CAAE;QAC7C,IAAI,CAACF,EAAE,GAAGA,EAAAA;QACV,IAAI,CAACE,WAAW,GAAGA,WAAAA;AACrB;AAyCF;AAWA,MAAMqB,oBAAAA,CAAAA;AAMJ,IAAA,MAAMC,qBACJL,MAAc,EACdE,QAA4B,EAC5BI,OAA0C,EACgC;QAC1E,OAAO,IAAI,CAACC,cAAc,CAACF,oBAAoB,CAACL,MAAAA,EAAQE,QAAU,EAAA,IAAI,CAACD,MAAM,EAAEK,OAAAA,CAAAA;AACjF;IAEA,MAAME,mBAAAA,CAAoBC,YAAoB,EAAkD;QAC9F,OAAO,IAAI,CAACF,cAAc,CAACC,mBAAmB,CAACC,YAAAA,EAAc,IAAI,CAACR,MAAM,CAAA;AAC1E;IAEA,MAAMS,kBAAAA,CAAmBD,YAAoB,EAQ3C;QACA,OAAO,IAAI,CAACF,cAAc,CAACG,kBAAkB,CAACD,YAAAA,EAAc,IAAI,CAACR,MAAM,CAAA;AACzE;AAEAU,IAAAA,mBAAAA,CACEC,KAAa,EACuE;QACpF,OAAO,IAAI,CAACL,cAAc,CAACI,mBAAmB,CAACC,KAAAA,EAAO,IAAI,CAACX,MAAM,CAAA;AACnE;IAEA,MAAMY,oBAAAA,CAAqBD,KAAa,EAAuC;QAC7E,OAAO,IAAI,CAACL,cAAc,CAACM,oBAAoB,CAACD,KAAAA,EAAO,IAAI,CAACX,MAAM,CAAA;AACpE;AAEA,IAAA,MAAMa,sBAAuBd,CAAAA,MAAc,EAAEE,QAAiB,EAAiB;QAC7E,OAAO,IAAI,CAACK,cAAc,CAACO,sBAAsB,CAAC,IAAI,CAACb,MAAM,EAAED,MAAQE,EAAAA,QAAAA,CAAAA;AACzE;AAEA;;;MAIA,MAAMa,eAAgB7B,CAAAA,SAAiB,EAAoB;QACzD,OAAO,IAAI,CAACqB,cAAc,CAACQ,eAAe,CAAC7B,SAAAA,EAAW,IAAI,CAACe,MAAM,CAAA;AACnE;AAjDAE,IAAAA,WAAAA,CACE,cAAsC,EAC9BF,MAAc,CACtB;aAFQM,cAAAA,GAAAA,cAAAA;aACAN,MAAAA,GAAAA,MAAAA;AACP;AA+CL;AAEA,MAAMe,cAAAA,CAAAA;AAeJ;;AAEC,MACDC,YAAahB,CAAAA,MAAc,EAAEiB,MAA4B,EAAQ;AAC/D,QAAA,IAAI,CAACC,aAAa,CAACC,GAAG,CAACnB,MAAQiB,EAAAA,MAAAA,CAAAA;AACjC;AAEA;;MAGAG,SAAAA,CAAUpB,MAAc,EAAW;AACjC,QAAA,OAAO,IAAI,CAACkB,aAAa,CAACG,GAAG,CAACrB,MAAAA,CAAAA;AAChC;AAEA;;MAGQsB,kBAAmBtB,CAAAA,MAAc,EAAwB;AAC/D,QAAA,MAAMuB,eAAe,IAAI,CAACL,aAAa,CAACM,GAAG,CAACxB,MAAAA,CAAAA;AAC5C,QAAA,IAAIuB,YAAc,EAAA;YAChB,OAAOA,YAAAA;AACT;QACA,MAAM,IAAIE,KACR,CAAA,CAAC,wBAAwB,EAAEzB,OAAO,uDAAuD,EAAEA,MAAO,CAAA,WAAW,CAAC,CAAA;AAElH;IAEA0B,iBAA4B,GAAA;AAC1B,QAAA,OAAOC,MAAOC,CAAAA,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AACzC;AAEA,IAAA,MAAcC,mBAAqC,GAAA;QACjD,IAAI,CAACC,wBAAwB,IAAI,CAAA;AACjC,QAAA,IAAI,IAAI,CAACA,wBAAwB,IAAI,IAAI,CAACC,iBAAiB,EAAE;YAC3D,IAAI,CAACD,wBAAwB,GAAG,CAAA;AAEhC,YAAA,MAAM,IAAI,CAACE,QAAQ,CAACzC,aAAa,EAAA;AACnC;AACF;AAEA;;AAEC,MACD,IAAI0C,gBAA2B,GAAA;QAC7B,OAAO,IAAI,CAACF,iBAAiB;AAC/B;IAEA,MAAM5B,oBAAAA,CACJL,MAAc,EACdE,QAA4B,EAC5BD,MAAc,EACdK,OAA0C,EACgC;AAC1E,QAAA,IAAI,CAACL,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIyB,KACR,CAAA,6EAAA,CAAA;AAEJ;QAEA,MAAM,IAAI,CAACK,mBAAmB,EAAA;AAE9B,QAAA,MAAMb,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACtB,MAAAA,CAAAA;QACvC,MAAMf,SAAAA,GAAY,IAAI,CAACyC,iBAAiB,EAAA;QACxC,MAAMS,SAAAA,GAAY9B,SAAS+B,IAAQ,IAAA,SAAA;AACnC,QAAA,MAAMC,YAAYF,SAAc,KAAA,SAAA;AAEhC,QAAA,MAAMG,eAAeD,SAAYpB,GAAAA,MAAAA,CAAOsB,wBAAwB,GAAGtB,OAAOuB,mBAAmB;AAE7F,QAAA,MAAMC,cAAcJ,SAAYpB,GAAAA,MAAAA,CAAOyB,uBAAuB,GAAGzB,OAAO0B,kBAAkB;QAE1F,MAAMC,GAAAA,GAAMhD,KAAKgD,GAAG,EAAA;AACpB,QAAA,MAAMC,SAAY,GAAA,IAAIjD,IAAKgD,CAAAA,GAAAA,GAAMN,YAAe,GAAA,IAAA,CAAA;AAChD,QAAA,MAAM5C,iBAAoB,GAAA,IAAIE,IAAKgD,CAAAA,GAAAA,GAAMH,WAAc,GAAA,IAAA,CAAA;;AAGvD,QAAA,MAAMK,SAAS,MAAM,IAAI,CAACb,QAAQ,CAACxD,MAAM,CAAC;AACxCsB,YAAAA,MAAAA;AACAd,YAAAA,SAAAA;AACA,YAAA,GAAIgB,QAAY,IAAA;AAAEA,gBAAAA;aAAU;AAC5BD,YAAAA,MAAAA;YACA+C,OAAS,EAAA,IAAA;YACTX,IAAMD,EAAAA,SAAAA;YACNa,MAAQ,EAAA,QAAA;AACRH,YAAAA,SAAAA;AACAnD,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMuD,eAAkBC,GAAAA,IAAAA,CAAKC,KAAK,CAAC,IAAIvD,IAAAA,CAAKkD,MAAOM,CAAAA,SAAS,IAAI,IAAIxD,IAAQyD,EAAAA,CAAAA,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;QACxF,MAAMC,gBAAAA,GAAmBJ,IAAKC,CAAAA,KAAK,CAAC,IAAIvD,KAAKkD,MAAOD,CAAAA,SAAS,CAAEQ,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;AAE3E,QAAA,MAAME,OAA+B,GAAA;AACnCxD,YAAAA,MAAAA;AACAd,YAAAA,SAAAA;YACAmD,IAAM,EAAA,SAAA;YACNoB,GAAKP,EAAAA,eAAAA;YACLQ,GAAKH,EAAAA;AACP,SAAA;AAEA,QAAA,MAAM3C,QAAQ+C,GAAIC,CAAAA,IAAI,CAACJ,OAAStC,EAAAA,MAAAA,CAAO2C,SAAS,EAAE;YAChDC,SAAWC,EAAAA,2BAAAA;YACXC,WAAa,EAAA;AACf,SAAA,CAAA;QAEA,OAAO;AACLpD,YAAAA,KAAAA;AACA1B,YAAAA,SAAAA;AACAS,YAAAA,iBAAAA,EAAmBA,kBAAkBsE,WAAW;AAClD,SAAA;AACF;IAEAtD,mBACEC,CAAAA,KAAa,EACbX,MAAc,EACsE;AACpF,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIyB,KACR,CAAA,6EAAA,CAAA;AAEJ;QAEA,IAAI;AACF,YAAA,MAAMR,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACtB,MAAAA,CAAAA;AACvC,YAAA,MAAMuD,UAAUG,GAAIO,CAAAA,MAAM,CAACtD,KAAOM,EAAAA,MAAAA,CAAO2C,SAAS,EAAE;gBAClDM,UAAY,EAAA;AAACJ,oBAAAA;AAAkB;AACjC,aAAA,CAAA;;AAGA,YAAA,IAAI,CAACP,OAAAA,IAAWA,OAAQnB,CAAAA,IAAI,KAAK,QAAU,EAAA;gBACzC,OAAO;oBAAE+B,OAAS,EAAA,KAAA;oBAAOZ,OAAS,EAAA;AAAK,iBAAA;AACzC;YAEA,OAAO;gBAAEY,OAAS,EAAA,IAAA;AAAMZ,gBAAAA;AAAQ,aAAA;AAClC,SAAA,CAAE,OAAOa,GAAK,EAAA;YACZ,OAAO;gBAAED,OAAS,EAAA,KAAA;gBAAOZ,OAAS,EAAA;AAAK,aAAA;AACzC;AACF;AAEA,IAAA,MAAM3C,oBAAqBD,CAAAA,KAAa,EAAEX,MAAc,EAAuC;AAC7F,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIyB,KACR,CAAA,6EAAA,CAAA;AAEJ;QAEA,IAAI;AACF,YAAA,MAAMR,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACtB,MAAAA,CAAAA;AACvC,YAAA,MAAMqE,aAA+B,GAAA;gBACnCH,UAAY,EAAA;AAACJ,oBAAAA;AAAkB;AACjC,aAAA;AAEA,YAAA,MAAMP,UAAUG,GAAIO,CAAAA,MAAM,CAACtD,KAAOM,EAAAA,MAAAA,CAAO2C,SAAS,EAAES,aAAAA,CAAAA;YAEpD,IAAId,OAAAA,CAAQnB,IAAI,KAAK,SAAW,EAAA;gBAC9B,OAAO;oBAAE+B,OAAS,EAAA;AAAM,iBAAA;AAC1B;YAEA,MAAMzF,OAAAA,GAAU,MAAM,IAAI,CAACuD,QAAQ,CAACjD,eAAe,CAACuE,OAAAA,CAAQtE,SAAS,CAAA;AACrE,YAAA,IAAI,CAACP,OAAS,EAAA;gBACZ,OAAO;oBAAEyF,OAAS,EAAA;AAAM,iBAAA;AAC1B;AAEA,YAAA,MAAMvB,MAAM,IAAIhD,IAAAA,EAAAA;AAChB,YAAA,IAAI,IAAIA,IAAAA,CAAKlB,OAAQmE,CAAAA,SAAS,KAAKD,GAAK,EAAA;gBACtC,OAAO;oBAAEuB,OAAS,EAAA;AAAM,iBAAA;AAC1B;;YAGA,IAAIzF,OAAAA,CAAQgB,iBAAiB,IAAI,IAAIE,KAAKlB,OAAQgB,CAAAA,iBAAiB,KAAKkD,GAAK,EAAA;gBAC3E,OAAO;oBAAEuB,OAAS,EAAA;AAAM,iBAAA;AAC1B;;YAGA,IAAIzF,OAAAA,CAAQsE,MAAM,KAAK,QAAU,EAAA;gBAC/B,OAAO;oBAAEmB,OAAS,EAAA;AAAM,iBAAA;AAC1B;AAEA,YAAA,IAAIzF,OAAQqB,CAAAA,MAAM,KAAKwD,OAAAA,CAAQxD,MAAM,EAAE;gBACrC,OAAO;oBAAEoE,OAAS,EAAA;AAAM,iBAAA;AAC1B;YAEA,OAAO;gBACLA,OAAS,EAAA,IAAA;AACTpE,gBAAAA,MAAAA,EAAQwD,QAAQxD,MAAM;AACtBd,gBAAAA,SAAAA,EAAWsE,QAAQtE;AACrB,aAAA;AACF,SAAA,CAAE,OAAOqF,KAAY,EAAA;YACnB,IAAIA,KAAAA,YAAiBZ,GAAIa,CAAAA,iBAAiB,EAAE;gBAC1C,OAAO;oBAAEJ,OAAS,EAAA;AAAM,iBAAA;AAC1B;YAEA,MAAMG,KAAAA;AACR;AACF;AAEA,IAAA,MAAMzD,uBAAuBb,MAAc,EAAED,MAAc,EAAEE,QAAiB,EAAiB;AAC7F,QAAA,MAAM,IAAI,CAACgC,QAAQ,CAACpC,QAAQ,CAAC;AAAEE,YAAAA,MAAAA;AAAQC,YAAAA,MAAAA;AAAQC,YAAAA;AAAS,SAAA,CAAA;AAC1D;AAEA,IAAA,MAAMM,mBACJC,CAAAA,YAAoB,EACpBR,MAAc,EACkC;AAChD,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIyB,KACR,CAAA,6EAAA,CAAA;AAEJ;AAEA,QAAA,MAAM+C,aAAa,MAAM,IAAI,CAAC5D,oBAAoB,CAACJ,YAAcR,EAAAA,MAAAA,CAAAA;QAEjE,IAAI,CAACwE,UAAWL,CAAAA,OAAO,EAAE;YACvB,OAAO;gBAAEG,KAAO,EAAA;AAAwB,aAAA;AAC1C;AAEA,QAAA,MAAMf,OAAmD,GAAA;YACvDxD,MAAQ0E,EAAAA,MAAAA,CAAOD,WAAWzE,MAAM,CAAA;AAChCd,YAAAA,SAAAA,EAAWuF,WAAWvF,SAAS;YAC/BmD,IAAM,EAAA;AACR,SAAA;AAEA,QAAA,MAAMnB,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACtB,MAAAA,CAAAA;AACvC,QAAA,MAAMW,QAAQ+C,GAAIC,CAAAA,IAAI,CAACJ,OAAStC,EAAAA,MAAAA,CAAO2C,SAAS,EAAE;YAChDC,SAAWC,EAAAA,2BAAAA;AACXY,YAAAA,SAAAA,EAAWzD,OAAO0D;AACpB,SAAA,CAAA;QAEA,OAAO;AAAEhE,YAAAA;AAAM,SAAA;AACjB;AAEA,IAAA,MAAMF,kBACJD,CAAAA,YAAoB,EACpBR,MAAc,EASd;AACA,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIyB,KACR,CAAA,6EAAA,CAAA;AAEJ;QAEA,IAAI;AACF,YAAA,MAAMR,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACtB,MAAAA,CAAAA;AACvC,YAAA,MAAMuD,UAAUG,GAAIO,CAAAA,MAAM,CAACzD,YAAcS,EAAAA,MAAAA,CAAO2C,SAAS,EAAE;gBACzDM,UAAY,EAAA;AAACJ,oBAAAA;AAAkB;AACjC,aAAA,CAAA;AAEA,YAAA,IAAI,CAACP,OAAAA,IAAWA,OAAQnB,CAAAA,IAAI,KAAK,SAAW,EAAA;gBAC1C,OAAO;oBAAEkC,KAAO,EAAA;AAAwB,iBAAA;AAC1C;YAEA,MAAMM,OAAAA,GAAU,MAAM,IAAI,CAAC3C,QAAQ,CAACjD,eAAe,CAACuE,OAAAA,CAAQtE,SAAS,CAAA;AACrE,YAAA,IAAI,CAAC2F,OAAS,EAAA;gBACZ,OAAO;oBAAEN,KAAO,EAAA;AAAwB,iBAAA;AAC1C;;YAGA,IAAIM,OAAAA,CAAQ7B,OAAO,EAAE;gBACnB,MAAM8B,KAAAA,GAAQ,MAAM,IAAI,CAAC5C,QAAQ,CAACjD,eAAe,CAAC4F,OAAAA,CAAQ7B,OAAO,CAAA;AAEjE,gBAAA,IAAI8B,KAAO,EAAA;AACT,oBAAA,MAAMC,QAAW5B,GAAAA,IAAAA,CAAKC,KAAK,CAAC,IAAIvD,IAAAA,CAAKiF,KAAMzB,CAAAA,SAAS,IAAI,IAAIxD,IAAQyD,EAAAA,CAAAA,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;oBAChF,MAAM0B,QAAAA,GAAW7B,IAAKC,CAAAA,KAAK,CAAC,IAAIvD,KAAKiF,KAAMhC,CAAAA,SAAS,CAAEQ,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;AAElE,oBAAA,MAAM2B,YAAoC,GAAA;AACxCjF,wBAAAA,MAAAA,EAAQ8E,MAAM9E,MAAM;AACpBd,wBAAAA,SAAAA,EAAW4F,MAAM5F,SAAS;wBAC1BmD,IAAM,EAAA,SAAA;wBACNoB,GAAKsB,EAAAA,QAAAA;wBACLrB,GAAKsB,EAAAA;AACP,qBAAA;AAEA,oBAAA,MAAME,aAAavB,GAAIC,CAAAA,IAAI,CAACqB,YAAc/D,EAAAA,MAAAA,CAAO2C,SAAS,EAAE;wBAC1DC,SAAWC,EAAAA,2BAAAA;wBACXC,WAAa,EAAA;AACf,qBAAA,CAAA;oBAEA,IAAIrE,iBAAAA;oBACJ,IAAImF,KAAAA,CAAMnF,iBAAiB,EAAE;wBAC3BA,iBACE,GAAA,OAAOmF,KAAMnF,CAAAA,iBAAiB,KAAK,QAAA,GAC/BmF,KAAMnF,CAAAA,iBAAiB,GACvBmF,KAAAA,CAAMnF,iBAAiB,CAACsE,WAAW,EAAA;qBACpC,MAAA;wBACLtE,iBAAoB,GAAA,IAAIE,IAAK,CAAA,CAAA,CAAA,CAAGoE,WAAW,EAAA;AAC7C;oBAEA,OAAO;wBACLrD,KAAOsE,EAAAA,UAAAA;AACPhG,wBAAAA,SAAAA,EAAW4F,MAAM5F,SAAS;AAC1BS,wBAAAA,iBAAAA;wBACA0C,IAAMyC,EAAAA,KAAAA,CAAMzC,IAAI,IAAI;AACtB,qBAAA;AACF;AACF;YAEA,MAAMQ,GAAAA,GAAMhD,KAAKgD,GAAG,EAAA;YACpB,MAAMT,SAAAA,GAAYyC,OAAQxC,CAAAA,IAAI,IAAI,SAAA;AAClC,YAAA,MAAME,eACJH,SAAc,KAAA,SAAA,GAAYlB,OAAOsB,wBAAwB,GAAGtB,OAAOuB,mBAAmB;;AAGxF,YAAA,IAAIoC,OAAQxB,CAAAA,SAAS,IAAIR,GAAAA,GAAM,IAAIhD,IAAAA,CAAKgF,OAAQxB,CAAAA,SAAS,CAAEC,CAAAA,OAAO,EAAKf,GAAAA,YAAAA,GAAe,IAAM,EAAA;gBAC1F,OAAO;oBAAEgC,KAAO,EAAA;AAAsB,iBAAA;AACxC;;YAGA,MAAMY,QAAAA,GAAWN,OAAQlF,CAAAA,iBAAiB,GACtC,IAAIE,KAAKgF,OAAQlF,CAAAA,iBAAiB,CAAE2D,CAAAA,OAAO,EAC3CT,GAAAA,GAAAA;AACJ,YAAA,IAAIsC,YAAYtC,GAAK,EAAA;gBACnB,OAAO;oBAAE0B,KAAO,EAAA;AAAqB,iBAAA;AACvC;;YAGA,MAAMa,cAAAA,GAAiB,IAAI,CAACzD,iBAAiB,EAAA;AAC7C,YAAA,MAAM0D,cAAiB,GAAA,IAAIxF,IAAKgD,CAAAA,GAAAA,GAAMN,YAAe,GAAA,IAAA,CAAA;AAErD,YAAA,MAAM+C,cAAc,MAAM,IAAI,CAACpD,QAAQ,CAACxD,MAAM,CAAC;AAC7CsB,gBAAAA,MAAAA,EAAQ6E,QAAQ7E,MAAM;gBACtBd,SAAWkG,EAAAA,cAAAA;gBACX,GAAIP,OAAAA,CAAQ3E,QAAQ,IAAI;AAAEA,oBAAAA,QAAAA,EAAU2E,QAAQ3E;iBAAU;AACtDD,gBAAAA,MAAAA,EAAQ4E,QAAQ5E,MAAM;gBACtB+C,OAAS,EAAA,IAAA;gBACTX,IAAMD,EAAAA,SAAAA;gBACNa,MAAQ,EAAA,QAAA;gBACRH,SAAWuC,EAAAA,cAAAA;AACX1F,gBAAAA,iBAAAA,EAAmBkF,OAAQlF,CAAAA,iBAAiB,IAAI,IAAIE,IAAKsF,CAAAA,QAAAA;AAC3D,aAAA,CAAA;AAEA,YAAA,MAAMJ,QAAW5B,GAAAA,IAAAA,CAAKC,KAAK,CAAC,IAAIvD,IAAAA,CAAKyF,WAAYjC,CAAAA,SAAS,IAAI,IAAIxD,IAAQyD,EAAAA,CAAAA,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;YACtF,MAAM0B,QAAAA,GAAW7B,IAAKC,CAAAA,KAAK,CAAC,IAAIvD,KAAKyF,WAAYxC,CAAAA,SAAS,CAAEQ,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;AACxE,YAAA,MAAMiC,UAAkC,GAAA;AACtCvF,gBAAAA,MAAAA,EAAQ6E,QAAQ7E,MAAM;gBACtBd,SAAWkG,EAAAA,cAAAA;gBACX/C,IAAM,EAAA,SAAA;gBACNoB,GAAKsB,EAAAA,QAAAA;gBACLrB,GAAKsB,EAAAA;AACP,aAAA;AACA,YAAA,MAAME,aAAavB,GAAIC,CAAAA,IAAI,CAAC2B,UAAYrE,EAAAA,MAAAA,CAAO2C,SAAS,EAAE;gBACxDC,SAAWC,EAAAA,2BAAAA;gBACXC,WAAa,EAAA;AACf,aAAA,CAAA;YAEA,MAAM,IAAI,CAAC9B,QAAQ,CAAC7C,iBAAiB,CAACwF,OAAAA,CAAQ3F,SAAS,EAAE;gBACvD+D,MAAQ,EAAA,SAAA;gBACRD,OAASoC,EAAAA;AACX,aAAA,CAAA;YAEA,IAAIzF,iBAAAA;YACJ,IAAI2F,WAAAA,CAAY3F,iBAAiB,EAAE;gBACjCA,iBACE,GAAA,OAAO2F,WAAY3F,CAAAA,iBAAiB,KAAK,QAAA,GACrC2F,WAAY3F,CAAAA,iBAAiB,GAC7B2F,WAAAA,CAAY3F,iBAAiB,CAACsE,WAAW,EAAA;aAC1C,MAAA;gBACLtE,iBAAoB,GAAA,IAAIE,IAAKsF,CAAAA,QAAAA,CAAAA,CAAUlB,WAAW,EAAA;AACpD;YAEA,OAAO;gBACLrD,KAAOsE,EAAAA,UAAAA;gBACPhG,SAAWkG,EAAAA,cAAAA;AACXzF,gBAAAA,iBAAAA;gBACA0C,IAAMD,EAAAA;AACR,aAAA;AACF,SAAA,CAAE,OAAM;YACN,OAAO;gBAAEmC,KAAO,EAAA;AAAwB,aAAA;AAC1C;AACF;AAEA;;;AAGC,MACD,MAAMxD,eAAAA,CAAgB7B,SAAiB,EAAEe,MAAc,EAAoB;AACzE,QAAA,MAAMtB,UAAU,MAAM,IAAI,CAACuD,QAAQ,CAACjD,eAAe,CAACC,SAAAA,CAAAA;AACpD,QAAA,IAAI,CAACP,OAAS,EAAA;YACZ,OAAO,KAAA;AACT;QAEA,IAAIA,OAAAA,CAAQsB,MAAM,KAAKA,MAAQ,EAAA;YAC7B,OAAO,KAAA;AACT;AAEA,QAAA,IAAI,IAAIJ,IAAKlB,CAAAA,OAAAA,CAAQmE,SAAS,CAAA,IAAK,IAAIjD,IAAQ,EAAA,EAAA;;AAE7C,YAAA,MAAM,IAAI,CAACqC,QAAQ,CAAC3C,iBAAiB,CAACL,SAAAA,CAAAA;YAEtC,OAAO,KAAA;AACT;QAEA,OAAO,IAAA;AACT;AAlZAiB,IAAAA,WAAAA,CAAY+B,QAAyB,CAAE;;AAP/Bf,QAAAA,IAAAA,CAAAA,aAAAA,GAAmD,IAAIqE,GAAAA,EAAAA;;aAGvDxD,wBAAmC,GAAA,CAAA;aAE1BC,iBAA4B,GAAA,EAAA;QAG3C,IAAI,CAACC,QAAQ,GAAGA,QAAAA;AAClB;AAiZF;AAEMuD,MAAAA,sBAAAA,GAAyB,CAAC5G,EAAcE,EAAAA,WAAAA,GAAAA;IAC5C,OAAO,IAAIN,wBAAwBI,EAAIE,EAAAA,WAAAA,CAAAA;AACzC;AAEA,MAAM2G,oBAAuB,GAAA,CAAC,EAC5B7G,EAAE,EAGH,GAAA;IACC,MAAMqD,QAAAA,GAAWuD,uBAAuB5G,EAAI,EAAA,gBAAA,CAAA;IAC5C,MAAM0B,cAAAA,GAAiB,IAAIS,cAAekB,CAAAA,QAAAA,CAAAA;;AAG1C,IAAA,MAAMyD,YAAY,CAAC1F,MAAAA,GAAAA;AACjB,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIyB,KACR,CAAA,6EAAA,CAAA;AAEJ;QACA,OAAO,IAAItB,qBAAqBG,cAAgBN,EAAAA,MAAAA,CAAAA;AAClD,KAAA;;AAGA,IAAA,MAAM2F,GAAMD,GAAAA,SAAAA;AACZC,IAAAA,GAAAA,CAAIjE,iBAAiB,GAAGpB,cAAAA,CAAeoB,iBAAiB,CAACkE,IAAI,CAACtF,cAAAA,CAAAA;AAC9DqF,IAAAA,GAAAA,CAAI3E,YAAY,GAAGV,cAAAA,CAAeU,YAAY,CAAC4E,IAAI,CAACtF,cAAAA,CAAAA;AACpDqF,IAAAA,GAAAA,CAAIvE,SAAS,GAAGd,cAAAA,CAAec,SAAS,CAACwE,IAAI,CAACtF,cAAAA,CAAAA;;;IAI9CuF,MAAOC,CAAAA,cAAc,CAACH,GAAAA,EAAK,kBAAoB,EAAA;AAC7CnE,QAAAA,GAAAA,CAAAA,GAAAA;AACE,YAAA,OAAOlB,eAAe4B,gBAAgB;AACxC,SAAA;QACA6D,UAAY,EAAA;AACd,KAAA,CAAA;IAEA,OAAOJ,GAAAA;AACT;;;;;"}
+{"version":3,"file":"session-manager.js","sources":["../../src/services/session-manager.ts"],"sourcesContent":["import crypto from 'crypto';\nimport jwt from 'jsonwebtoken';\nimport type { VerifyOptions, Algorithm } from 'jsonwebtoken';\nimport type { Database } from '@strapi/database';\nimport { DEFAULT_ALGORITHM } from '../constants';\n\nexport interface SessionProvider {\n  create(session: SessionData): Promise<SessionData>;\n  findBySessionId(sessionId: string): Promise<SessionData | null>;\n  updateBySessionId(sessionId: string, data: Partial<SessionData>): Promise<void>;\n  deleteBySessionId(sessionId: string): Promise<void>;\n  deleteExpired(): Promise<void>;\n  deleteBy(criteria: { userId?: string; origin?: string; deviceId?: string }): Promise<void>;\n}\n\nexport interface SessionData {\n  id?: string;\n  userId: string; // User ID stored as string (key-value store)\n  sessionId: string;\n  deviceId?: string; // Optional for origins that don't need device tracking\n  origin: string;\n  childId?: string | null;\n\n  type?: 'refresh' | 'session';\n  status?: 'active' | 'rotated' | 'revoked';\n  expiresAt: Date;\n  absoluteExpiresAt?: Date | null;\n  createdAt?: Date;\n  updatedAt?: Date;\n}\n\nexport interface RefreshTokenPayload {\n  userId: string;\n  sessionId: string;\n  type: 'refresh';\n  exp: number;\n  iat: number;\n}\n\nexport interface AccessTokenPayload {\n  userId: string;\n  sessionId: string;\n  type: 'access';\n  exp: number;\n  iat: number;\n}\n\nexport type TokenPayload = RefreshTokenPayload | AccessTokenPayload;\n\nexport interface ValidateRefreshTokenResult {\n  isValid: boolean;\n  userId?: string;\n  sessionId?: string;\n  error?:\n    | 'invalid_token'\n    | 'token_expired'\n    | 'session_not_found'\n    | 'session_expired'\n    | 'wrong_token_type';\n}\n\nclass DatabaseSessionProvider implements SessionProvider {\n  private db: Database;\n\n  private contentType: string;\n\n  constructor(db: Database, contentType: string) {\n    this.db = db;\n    this.contentType = contentType;\n  }\n\n  async create(session: SessionData): Promise<SessionData> {\n    const result = await this.db.query(this.contentType).create({\n      data: session,\n    });\n    return result as SessionData;\n  }\n\n  async findBySessionId(sessionId: string): Promise<SessionData | null> {\n    const result = await this.db.query(this.contentType).findOne({\n      where: { sessionId },\n    });\n    return result as SessionData | null;\n  }\n\n  async updateBySessionId(sessionId: string, data: Partial<SessionData>): Promise<void> {\n    await this.db.query(this.contentType).update({ where: { sessionId }, data });\n  }\n\n  async deleteBySessionId(sessionId: string): Promise<void> {\n    await this.db.query(this.contentType).delete({\n      where: { sessionId },\n    });\n  }\n\n  async deleteExpired(): Promise<void> {\n    await this.db.query(this.contentType).deleteMany({\n      where: { absoluteExpiresAt: { $lt: new Date() } },\n    });\n  }\n\n  async deleteBy(criteria: { userId?: string; origin?: string; deviceId?: string }): Promise<void> {\n    await this.db.query(this.contentType).deleteMany({\n      where: {\n        ...(criteria.userId ? { userId: criteria.userId } : {}),\n        ...(criteria.origin ? { origin: criteria.origin } : {}),\n        ...(criteria.deviceId ? { deviceId: criteria.deviceId } : {}),\n      },\n    });\n  }\n}\n\nexport interface SessionManagerConfig {\n  jwtSecret?: string;\n  accessTokenLifespan: number;\n  maxRefreshTokenLifespan: number;\n  idleRefreshTokenLifespan: number;\n  maxSessionLifespan: number;\n  idleSessionLifespan: number;\n  algorithm?: Algorithm;\n  jwtOptions?: Record<string, unknown>;\n}\n\nclass OriginSessionManager {\n  constructor(\n    private sessionManager: SessionManager,\n    private origin: string\n  ) {}\n\n  async generateRefreshToken(\n    userId: string,\n    deviceId: string | undefined,\n    options?: { type?: 'refresh' | 'session' }\n  ): Promise<{ token: string; sessionId: string; absoluteExpiresAt: string }> {\n    return this.sessionManager.generateRefreshToken(userId, deviceId, this.origin, options);\n  }\n\n  async generateAccessToken(refreshToken: string): Promise<{ token: string } | { error: string }> {\n    return this.sessionManager.generateAccessToken(refreshToken, this.origin);\n  }\n\n  async rotateRefreshToken(refreshToken: string): Promise<\n    | {\n        token: string;\n        sessionId: string;\n        absoluteExpiresAt: string;\n        type: 'refresh' | 'session';\n      }\n    | { error: string }\n  > {\n    return this.sessionManager.rotateRefreshToken(refreshToken, this.origin);\n  }\n\n  validateAccessToken(\n    token: string\n  ): { isValid: true; payload: AccessTokenPayload } | { isValid: false; payload: null } {\n    return this.sessionManager.validateAccessToken(token, this.origin);\n  }\n\n  async validateRefreshToken(token: string): Promise<ValidateRefreshTokenResult> {\n    return this.sessionManager.validateRefreshToken(token, this.origin);\n  }\n\n  async invalidateRefreshToken(userId: string, deviceId?: string): Promise<void> {\n    return this.sessionManager.invalidateRefreshToken(this.origin, userId, deviceId);\n  }\n\n  /**\n   * Returns true when a session exists and is not expired for this origin.\n   * If the session exists but is expired, it will be deleted as part of this check.\n   */\n  async isSessionActive(sessionId: string): Promise<boolean> {\n    return this.sessionManager.isSessionActive(sessionId, this.origin);\n  }\n}\n\nclass SessionManager {\n  private provider: SessionProvider;\n\n  // Store origin-specific configurations\n  private originConfigs: Map<string, SessionManagerConfig> = new Map();\n\n  // Run expired cleanup only every N calls to avoid extra queries\n  private cleanupInvocationCounter: number = 0;\n\n  private readonly cleanupEveryCalls: number = 50;\n\n  constructor(provider: SessionProvider) {\n    this.provider = provider;\n  }\n\n  /**\n   * Define configuration for a specific origin\n   */\n  defineOrigin(origin: string, config: SessionManagerConfig): void {\n    this.originConfigs.set(origin, config);\n  }\n\n  /**\n   * Check if an origin is defined\n   */\n  hasOrigin(origin: string): boolean {\n    return this.originConfigs.has(origin);\n  }\n\n  /**\n   * Get configuration for a specific origin, throw error if not defined\n   */\n  private getConfigForOrigin(origin: string): SessionManagerConfig {\n    const originConfig = this.originConfigs.get(origin);\n    if (originConfig) {\n      return originConfig;\n    }\n    throw new Error(\n      `SessionManager: Origin '${origin}' is not defined. Please define it using defineOrigin('${origin}', config).`\n    );\n  }\n\n  /**\n   * Get the appropriate JWT key based on the algorithm\n   */\n  private getJwtKey(\n    config: SessionManagerConfig,\n    algorithm: Algorithm,\n    operation: 'sign' | 'verify'\n  ): string {\n    const isAsymmetric =\n      algorithm.startsWith('RS') || algorithm.startsWith('ES') || algorithm.startsWith('PS');\n\n    if (isAsymmetric) {\n      // For asymmetric algorithms, check if user has provided proper key configuration\n      if (operation === 'sign') {\n        const privateKey = config.jwtOptions?.privateKey as string;\n        if (privateKey) {\n          return privateKey;\n        }\n        throw new Error(\n          `SessionManager: Private key is required for asymmetric algorithm ${algorithm}. Please configure admin.auth.options.privateKey.`\n        );\n      } else {\n        const publicKey = config.jwtOptions?.publicKey as string;\n        if (publicKey) {\n          return publicKey;\n        }\n        throw new Error(\n          `SessionManager: Public key is required for asymmetric algorithm ${algorithm}. Please configure admin.auth.options.publicKey.`\n        );\n      }\n    } else {\n      if (!config.jwtSecret) {\n        throw new Error(\n          `SessionManager: Secret key is required for symmetric algorithm ${algorithm}`\n        );\n      }\n      return config.jwtSecret;\n    }\n  }\n\n  generateSessionId(): string {\n    return crypto.randomBytes(16).toString('hex');\n  }\n\n  private async maybeCleanupExpired(): Promise<void> {\n    this.cleanupInvocationCounter += 1;\n    if (this.cleanupInvocationCounter >= this.cleanupEveryCalls) {\n      this.cleanupInvocationCounter = 0;\n\n      await this.provider.deleteExpired();\n    }\n  }\n\n  /**\n   * Get the cleanup every calls threshold\n   */\n  get cleanupThreshold(): number {\n    return this.cleanupEveryCalls;\n  }\n\n  async generateRefreshToken(\n    userId: string,\n    deviceId: string | undefined,\n    origin: string,\n    options?: { type?: 'refresh' | 'session' }\n  ): Promise<{ token: string; sessionId: string; absoluteExpiresAt: string }> {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    await this.maybeCleanupExpired();\n\n    const config = this.getConfigForOrigin(origin);\n    const algorithm = config.algorithm || DEFAULT_ALGORITHM;\n    const jwtKey = this.getJwtKey(config, algorithm, 'sign');\n    const sessionId = this.generateSessionId();\n    const tokenType = options?.type ?? 'refresh';\n    const isRefresh = tokenType === 'refresh';\n\n    const idleLifespan = isRefresh ? config.idleRefreshTokenLifespan : config.idleSessionLifespan;\n\n    const maxLifespan = isRefresh ? config.maxRefreshTokenLifespan : config.maxSessionLifespan;\n\n    const now = Date.now();\n    const expiresAt = new Date(now + idleLifespan * 1000);\n    const absoluteExpiresAt = new Date(now + maxLifespan * 1000);\n\n    // Create the root record first so createdAt can be used for signing.\n    const record = await this.provider.create({\n      userId,\n      sessionId,\n      ...(deviceId && { deviceId }),\n      origin,\n      childId: null,\n      type: tokenType,\n      status: 'active',\n      expiresAt,\n      absoluteExpiresAt,\n    });\n\n    const issuedAtSeconds = Math.floor(new Date(record.createdAt ?? new Date()).getTime() / 1000);\n    const expiresAtSeconds = Math.floor(new Date(record.expiresAt).getTime() / 1000);\n\n    const payload: RefreshTokenPayload = {\n      userId,\n      sessionId,\n      type: 'refresh',\n      iat: issuedAtSeconds,\n      exp: expiresAtSeconds,\n    };\n\n    // Filter out conflicting options that are already handled by the payload or used for key selection\n    const jwtOptions = config.jwtOptions || {};\n    const { expiresIn, privateKey, publicKey, ...jwtSignOptions } = jwtOptions;\n\n    const token = jwt.sign(payload, jwtKey, {\n      algorithm,\n      noTimestamp: true,\n      ...jwtSignOptions,\n    });\n\n    return {\n      token,\n      sessionId,\n      absoluteExpiresAt: absoluteExpiresAt.toISOString(),\n    };\n  }\n\n  validateAccessToken(\n    token: string,\n    origin: string\n  ): { isValid: true; payload: AccessTokenPayload } | { isValid: false; payload: null } {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    try {\n      const config = this.getConfigForOrigin(origin);\n      const algorithm = config.algorithm || DEFAULT_ALGORITHM;\n      const jwtKey = this.getJwtKey(config, algorithm, 'verify');\n      const payload = jwt.verify(token, jwtKey, {\n        algorithms: [algorithm],\n        ...config.jwtOptions,\n      }) as TokenPayload;\n\n      // Ensure this is an access token\n      if (!payload || payload.type !== 'access') {\n        return { isValid: false, payload: null };\n      }\n\n      return { isValid: true, payload };\n    } catch (err) {\n      return { isValid: false, payload: null };\n    }\n  }\n\n  async validateRefreshToken(token: string, origin: string): Promise<ValidateRefreshTokenResult> {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    try {\n      const config = this.getConfigForOrigin(origin);\n      const algorithm = config.algorithm || DEFAULT_ALGORITHM;\n      const jwtKey = this.getJwtKey(config, algorithm, 'verify');\n      const verifyOptions: VerifyOptions = {\n        algorithms: [algorithm],\n        ...config.jwtOptions,\n      };\n\n      const payload = jwt.verify(token, jwtKey, verifyOptions) as RefreshTokenPayload;\n\n      if (payload.type !== 'refresh') {\n        return { isValid: false };\n      }\n\n      const session = await this.provider.findBySessionId(payload.sessionId);\n      if (!session) {\n        return { isValid: false };\n      }\n\n      const now = new Date();\n      if (new Date(session.expiresAt) <= now) {\n        return { isValid: false };\n      }\n\n      // Absolute family expiry check\n      if (session.absoluteExpiresAt && new Date(session.absoluteExpiresAt) <= now) {\n        return { isValid: false };\n      }\n\n      // Only 'active' sessions are eligible to create access tokens.\n      if (session.status !== 'active') {\n        return { isValid: false };\n      }\n\n      if (session.userId !== payload.userId) {\n        return { isValid: false };\n      }\n\n      return {\n        isValid: true,\n        userId: payload.userId,\n        sessionId: payload.sessionId,\n      };\n    } catch (error: any) {\n      if (error instanceof jwt.JsonWebTokenError) {\n        return { isValid: false };\n      }\n\n      throw error;\n    }\n  }\n\n  async invalidateRefreshToken(origin: string, userId: string, deviceId?: string): Promise<void> {\n    await this.provider.deleteBy({ userId, origin, deviceId });\n  }\n\n  async generateAccessToken(\n    refreshToken: string,\n    origin: string\n  ): Promise<{ token: string } | { error: string }> {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    const validation = await this.validateRefreshToken(refreshToken, origin);\n\n    if (!validation.isValid) {\n      return { error: 'invalid_refresh_token' };\n    }\n\n    const payload: Omit<AccessTokenPayload, 'iat' | 'exp'> = {\n      userId: String(validation.userId!),\n      sessionId: validation.sessionId!,\n      type: 'access',\n    };\n\n    const config = this.getConfigForOrigin(origin);\n    const algorithm = config.algorithm || DEFAULT_ALGORITHM;\n    const jwtKey = this.getJwtKey(config, algorithm, 'sign');\n    // Filter out conflicting options that are already handled by the payload or used for key selection\n    const jwtOptions = config.jwtOptions || {};\n    const { expiresIn, privateKey, publicKey, ...jwtSignOptions } = jwtOptions;\n\n    const token = jwt.sign(payload, jwtKey, {\n      algorithm,\n      expiresIn: config.accessTokenLifespan,\n      ...jwtSignOptions,\n    });\n\n    return { token };\n  }\n\n  async rotateRefreshToken(\n    refreshToken: string,\n    origin: string\n  ): Promise<\n    | {\n        token: string;\n        sessionId: string;\n        absoluteExpiresAt: string;\n        type: 'refresh' | 'session';\n      }\n    | { error: string }\n  > {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    try {\n      const config = this.getConfigForOrigin(origin);\n      const algorithm = config.algorithm || DEFAULT_ALGORITHM;\n      const jwtKey = this.getJwtKey(config, algorithm, 'verify');\n      const payload = jwt.verify(refreshToken, jwtKey, {\n        algorithms: [algorithm],\n        ...config.jwtOptions,\n      }) as RefreshTokenPayload;\n\n      if (!payload || payload.type !== 'refresh') {\n        return { error: 'invalid_refresh_token' };\n      }\n\n      const current = await this.provider.findBySessionId(payload.sessionId);\n      if (!current) {\n        return { error: 'invalid_refresh_token' };\n      }\n\n      // If parent already has a child, return the same child token\n      if (current.childId) {\n        const child = await this.provider.findBySessionId(current.childId);\n\n        if (child) {\n          const childIat = Math.floor(new Date(child.createdAt ?? new Date()).getTime() / 1000);\n          const childExp = Math.floor(new Date(child.expiresAt).getTime() / 1000);\n\n          const childPayload: RefreshTokenPayload = {\n            userId: child.userId,\n            sessionId: child.sessionId,\n            type: 'refresh',\n            iat: childIat,\n            exp: childExp,\n          };\n\n          // Filter out conflicting options that are already handled by the payload\n          const { expiresIn, ...jwtSignOptions } = config.jwtOptions || {};\n\n          const childToken = jwt.sign(childPayload, jwtKey, {\n            algorithm,\n            noTimestamp: true,\n            ...jwtSignOptions,\n          });\n\n          let absoluteExpiresAt;\n          if (child.absoluteExpiresAt) {\n            absoluteExpiresAt =\n              typeof child.absoluteExpiresAt === 'string'\n                ? child.absoluteExpiresAt\n                : child.absoluteExpiresAt.toISOString();\n          } else {\n            absoluteExpiresAt = new Date(0).toISOString();\n          }\n\n          return {\n            token: childToken,\n            sessionId: child.sessionId,\n            absoluteExpiresAt,\n            type: child.type ?? 'refresh',\n          };\n        }\n      }\n\n      const now = Date.now();\n      const tokenType = current.type ?? 'refresh';\n      const idleLifespan =\n        tokenType === 'refresh' ? config.idleRefreshTokenLifespan : config.idleSessionLifespan;\n\n      // Enforce idle window since creation of the current token\n      if (current.createdAt && now - new Date(current.createdAt).getTime() > idleLifespan * 1000) {\n        return { error: 'idle_window_elapsed' };\n      }\n\n      // Enforce max family window using absoluteExpiresAt\n      const absolute = current.absoluteExpiresAt\n        ? new Date(current.absoluteExpiresAt).getTime()\n        : now;\n      if (absolute <= now) {\n        return { error: 'max_window_elapsed' };\n      }\n\n      // Create child token\n      const childSessionId = this.generateSessionId();\n      const childExpiresAt = new Date(now + idleLifespan * 1000);\n\n      const childRecord = await this.provider.create({\n        userId: current.userId,\n        sessionId: childSessionId,\n        ...(current.deviceId && { deviceId: current.deviceId }),\n        origin: current.origin,\n        childId: null,\n        type: tokenType,\n        status: 'active',\n        expiresAt: childExpiresAt,\n        absoluteExpiresAt: current.absoluteExpiresAt ?? new Date(absolute),\n      });\n\n      const childIat = Math.floor(new Date(childRecord.createdAt ?? new Date()).getTime() / 1000);\n      const childExp = Math.floor(new Date(childRecord.expiresAt).getTime() / 1000);\n      const payloadOut: RefreshTokenPayload = {\n        userId: current.userId,\n        sessionId: childSessionId,\n        type: 'refresh',\n        iat: childIat,\n        exp: childExp,\n      };\n      // Filter out conflicting options that are already handled by the payload\n      const { expiresIn, ...jwtSignOptions } = config.jwtOptions || {};\n\n      const childToken = jwt.sign(payloadOut, jwtKey, {\n        algorithm,\n        noTimestamp: true,\n        ...jwtSignOptions,\n      });\n\n      await this.provider.updateBySessionId(current.sessionId, {\n        status: 'rotated',\n        childId: childSessionId,\n      });\n\n      let absoluteExpiresAt;\n      if (childRecord.absoluteExpiresAt) {\n        absoluteExpiresAt =\n          typeof childRecord.absoluteExpiresAt === 'string'\n            ? childRecord.absoluteExpiresAt\n            : childRecord.absoluteExpiresAt.toISOString();\n      } else {\n        absoluteExpiresAt = new Date(absolute).toISOString();\n      }\n\n      return {\n        token: childToken,\n        sessionId: childSessionId,\n        absoluteExpiresAt,\n        type: tokenType,\n      };\n    } catch {\n      return { error: 'invalid_refresh_token' };\n    }\n  }\n\n  /**\n   * Returns true when a session exists and is not expired.\n   * If the session exists but is expired, it will be deleted as part of this check.\n   */\n  async isSessionActive(sessionId: string, origin: string): Promise<boolean> {\n    const session = await this.provider.findBySessionId(sessionId);\n    if (!session) {\n      return false;\n    }\n\n    if (session.origin !== origin) {\n      return false;\n    }\n\n    if (new Date(session.expiresAt) <= new Date()) {\n      // Clean up expired session eagerly\n      await this.provider.deleteBySessionId(sessionId);\n\n      return false;\n    }\n\n    return true;\n  }\n}\n\nconst createDatabaseProvider = (db: Database, contentType: string): SessionProvider => {\n  return new DatabaseSessionProvider(db, contentType);\n};\n\nconst createSessionManager = ({\n  db,\n}: {\n  db: Database;\n}): SessionManager & ((origin: string) => OriginSessionManager) => {\n  const provider = createDatabaseProvider(db, 'admin::session');\n  const sessionManager = new SessionManager(provider);\n\n  // Add callable functionality\n  const fluentApi = (origin: string): OriginSessionManager => {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n    return new OriginSessionManager(sessionManager, origin);\n  };\n\n  // Attach only the public SessionManagerService API to the callable\n  const api = fluentApi as unknown as any;\n  api.generateSessionId = sessionManager.generateSessionId.bind(sessionManager);\n  api.defineOrigin = sessionManager.defineOrigin.bind(sessionManager);\n  api.hasOrigin = sessionManager.hasOrigin.bind(sessionManager);\n  // Note: isSessionActive is origin-scoped and exposed on OriginSessionManager only\n\n  // Forward the cleanupThreshold getter (used in tests)\n  Object.defineProperty(api, 'cleanupThreshold', {\n    get() {\n      return sessionManager.cleanupThreshold;\n    },\n    enumerable: true,\n  });\n\n  return api as SessionManager & ((origin: string) => OriginSessionManager);\n};\n\nexport { createSessionManager, createDatabaseProvider };\n"],"names":["DatabaseSessionProvider","create","session","result","db","query","contentType","data","findBySessionId","sessionId","findOne","where","updateBySessionId","update","deleteBySessionId","delete","deleteExpired","deleteMany","absoluteExpiresAt","$lt","Date","deleteBy","criteria","userId","origin","deviceId","OriginSessionManager","generateRefreshToken","options","sessionManager","generateAccessToken","refreshToken","rotateRefreshToken","validateAccessToken","token","validateRefreshToken","invalidateRefreshToken","isSessionActive","SessionManager","defineOrigin","config","originConfigs","set","hasOrigin","has","getConfigForOrigin","originConfig","get","Error","algorithm","operation","isAsymmetric","startsWith","privateKey","jwtOptions","publicKey","jwtSecret","generateSessionId","crypto","randomBytes","toString","maybeCleanupExpired","cleanupInvocationCounter","cleanupEveryCalls","provider","cleanupThreshold","DEFAULT_ALGORITHM","jwtKey","getJwtKey","tokenType","type","isRefresh","idleLifespan","idleRefreshTokenLifespan","idleSessionLifespan","maxLifespan","maxRefreshTokenLifespan","maxSessionLifespan","now","expiresAt","record","childId","status","issuedAtSeconds","Math","floor","createdAt","getTime","expiresAtSeconds","payload","iat","exp","expiresIn","jwtSignOptions","jwt","sign","noTimestamp","toISOString","verify","algorithms","isValid","err","verifyOptions","error","JsonWebTokenError","validation","String","accessTokenLifespan","current","child","childIat","childExp","childPayload","childToken","absolute","childSessionId","childExpiresAt","childRecord","payloadOut","Map","createDatabaseProvider","createSessionManager","fluentApi","api","bind","Object","defineProperty","enumerable"],"mappings":";;;;;;AA6DA,MAAMA,uBAAAA,CAAAA;IAUJ,MAAMC,MAAAA,CAAOC,OAAoB,EAAwB;AACvD,QAAA,MAAMC,MAAS,GAAA,MAAM,IAAI,CAACC,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAA,CAAEL,MAAM,CAAC;YAC1DM,IAAML,EAAAA;AACR,SAAA,CAAA;QACA,OAAOC,MAAAA;AACT;IAEA,MAAMK,eAAAA,CAAgBC,SAAiB,EAA+B;AACpE,QAAA,MAAMN,MAAS,GAAA,MAAM,IAAI,CAACC,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAA,CAAEI,OAAO,CAAC;YAC3DC,KAAO,EAAA;AAAEF,gBAAAA;AAAU;AACrB,SAAA,CAAA;QACA,OAAON,MAAAA;AACT;AAEA,IAAA,MAAMS,iBAAkBH,CAAAA,SAAiB,EAAEF,IAA0B,EAAiB;QACpF,MAAM,IAAI,CAACH,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAEO,CAAAA,MAAM,CAAC;YAAEF,KAAO,EAAA;AAAEF,gBAAAA;AAAU,aAAA;AAAGF,YAAAA;AAAK,SAAA,CAAA;AAC5E;IAEA,MAAMO,iBAAAA,CAAkBL,SAAiB,EAAiB;QACxD,MAAM,IAAI,CAACL,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAES,CAAAA,MAAM,CAAC;YAC3CJ,KAAO,EAAA;AAAEF,gBAAAA;AAAU;AACrB,SAAA,CAAA;AACF;AAEA,IAAA,MAAMO,aAA+B,GAAA;QACnC,MAAM,IAAI,CAACZ,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAEW,CAAAA,UAAU,CAAC;YAC/CN,KAAO,EAAA;gBAAEO,iBAAmB,EAAA;AAAEC,oBAAAA,GAAAA,EAAK,IAAIC,IAAAA;AAAO;AAAE;AAClD,SAAA,CAAA;AACF;IAEA,MAAMC,QAAAA,CAASC,QAAiE,EAAiB;QAC/F,MAAM,IAAI,CAAClB,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAEW,CAAAA,UAAU,CAAC;YAC/CN,KAAO,EAAA;gBACL,GAAIW,QAAAA,CAASC,MAAM,GAAG;AAAEA,oBAAAA,MAAAA,EAAQD,SAASC;AAAO,iBAAA,GAAI,EAAE;gBACtD,GAAID,QAAAA,CAASE,MAAM,GAAG;AAAEA,oBAAAA,MAAAA,EAAQF,SAASE;AAAO,iBAAA,GAAI,EAAE;gBACtD,GAAIF,QAAAA,CAASG,QAAQ,GAAG;AAAEA,oBAAAA,QAAAA,EAAUH,SAASG;AAAS,iBAAA,GAAI;AAC5D;AACF,SAAA,CAAA;AACF;IA3CA,WAAYrB,CAAAA,EAAY,EAAEE,WAAmB,CAAE;QAC7C,IAAI,CAACF,EAAE,GAAGA,EAAAA;QACV,IAAI,CAACE,WAAW,GAAGA,WAAAA;AACrB;AAyCF;AAaA,MAAMoB,oBAAAA,CAAAA;AAMJ,IAAA,MAAMC,qBACJJ,MAAc,EACdE,QAA4B,EAC5BG,OAA0C,EACgC;QAC1E,OAAO,IAAI,CAACC,cAAc,CAACF,oBAAoB,CAACJ,MAAAA,EAAQE,QAAU,EAAA,IAAI,CAACD,MAAM,EAAEI,OAAAA,CAAAA;AACjF;IAEA,MAAME,mBAAAA,CAAoBC,YAAoB,EAAkD;QAC9F,OAAO,IAAI,CAACF,cAAc,CAACC,mBAAmB,CAACC,YAAAA,EAAc,IAAI,CAACP,MAAM,CAAA;AAC1E;IAEA,MAAMQ,kBAAAA,CAAmBD,YAAoB,EAQ3C;QACA,OAAO,IAAI,CAACF,cAAc,CAACG,kBAAkB,CAACD,YAAAA,EAAc,IAAI,CAACP,MAAM,CAAA;AACzE;AAEAS,IAAAA,mBAAAA,CACEC,KAAa,EACuE;QACpF,OAAO,IAAI,CAACL,cAAc,CAACI,mBAAmB,CAACC,KAAAA,EAAO,IAAI,CAACV,MAAM,CAAA;AACnE;IAEA,MAAMW,oBAAAA,CAAqBD,KAAa,EAAuC;QAC7E,OAAO,IAAI,CAACL,cAAc,CAACM,oBAAoB,CAACD,KAAAA,EAAO,IAAI,CAACV,MAAM,CAAA;AACpE;AAEA,IAAA,MAAMY,sBAAuBb,CAAAA,MAAc,EAAEE,QAAiB,EAAiB;QAC7E,OAAO,IAAI,CAACI,cAAc,CAACO,sBAAsB,CAAC,IAAI,CAACZ,MAAM,EAAED,MAAQE,EAAAA,QAAAA,CAAAA;AACzE;AAEA;;;MAIA,MAAMY,eAAgB5B,CAAAA,SAAiB,EAAoB;QACzD,OAAO,IAAI,CAACoB,cAAc,CAACQ,eAAe,CAAC5B,SAAAA,EAAW,IAAI,CAACe,MAAM,CAAA;AACnE;AAjDA,IAAA,WAAA,CACE,cAAsC,EAC9BA,MAAc,CACtB;aAFQK,cAAAA,GAAAA,cAAAA;aACAL,MAAAA,GAAAA,MAAAA;AACP;AA+CL;AAEA,MAAMc,cAAAA,CAAAA;AAeJ;;AAEC,MACDC,YAAaf,CAAAA,MAAc,EAAEgB,MAA4B,EAAQ;AAC/D,QAAA,IAAI,CAACC,aAAa,CAACC,GAAG,CAAClB,MAAQgB,EAAAA,MAAAA,CAAAA;AACjC;AAEA;;MAGAG,SAAAA,CAAUnB,MAAc,EAAW;AACjC,QAAA,OAAO,IAAI,CAACiB,aAAa,CAACG,GAAG,CAACpB,MAAAA,CAAAA;AAChC;AAEA;;MAGQqB,kBAAmBrB,CAAAA,MAAc,EAAwB;AAC/D,QAAA,MAAMsB,eAAe,IAAI,CAACL,aAAa,CAACM,GAAG,CAACvB,MAAAA,CAAAA;AAC5C,QAAA,IAAIsB,YAAc,EAAA;YAChB,OAAOA,YAAAA;AACT;QACA,MAAM,IAAIE,KACR,CAAA,CAAC,wBAAwB,EAAExB,OAAO,uDAAuD,EAAEA,MAAO,CAAA,WAAW,CAAC,CAAA;AAElH;AAEA;;AAEC,MACD,SACEgB,CAAAA,MAA4B,EAC5BS,SAAoB,EACpBC,SAA4B,EACpB;QACR,MAAMC,YAAAA,GACJF,SAAUG,CAAAA,UAAU,CAAC,IAAA,CAAA,IAASH,SAAUG,CAAAA,UAAU,CAAC,IAAA,CAAA,IAASH,SAAUG,CAAAA,UAAU,CAAC,IAAA,CAAA;AAEnF,QAAA,IAAID,YAAc,EAAA;;AAEhB,YAAA,IAAID,cAAc,MAAQ,EAAA;gBACxB,MAAMG,UAAAA,GAAab,MAAOc,CAAAA,UAAU,EAAED,UAAAA;AACtC,gBAAA,IAAIA,UAAY,EAAA;oBACd,OAAOA,UAAAA;AACT;AACA,gBAAA,MAAM,IAAIL,KACR,CAAA,CAAC,iEAAiE,EAAEC,SAAAA,CAAU,iDAAiD,CAAC,CAAA;aAE7H,MAAA;gBACL,MAAMM,SAAAA,GAAYf,MAAOc,CAAAA,UAAU,EAAEC,SAAAA;AACrC,gBAAA,IAAIA,SAAW,EAAA;oBACb,OAAOA,SAAAA;AACT;AACA,gBAAA,MAAM,IAAIP,KACR,CAAA,CAAC,gEAAgE,EAAEC,SAAAA,CAAU,gDAAgD,CAAC,CAAA;AAElI;SACK,MAAA;YACL,IAAI,CAACT,MAAOgB,CAAAA,SAAS,EAAE;AACrB,gBAAA,MAAM,IAAIR,KAAAA,CACR,CAAC,+DAA+D,EAAEC,SAAW,CAAA,CAAA,CAAA;AAEjF;AACA,YAAA,OAAOT,OAAOgB,SAAS;AACzB;AACF;IAEAC,iBAA4B,GAAA;AAC1B,QAAA,OAAOC,MAAOC,CAAAA,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AACzC;AAEA,IAAA,MAAcC,mBAAqC,GAAA;QACjD,IAAI,CAACC,wBAAwB,IAAI,CAAA;AACjC,QAAA,IAAI,IAAI,CAACA,wBAAwB,IAAI,IAAI,CAACC,iBAAiB,EAAE;YAC3D,IAAI,CAACD,wBAAwB,GAAG,CAAA;AAEhC,YAAA,MAAM,IAAI,CAACE,QAAQ,CAAChD,aAAa,EAAA;AACnC;AACF;AAEA;;AAEC,MACD,IAAIiD,gBAA2B,GAAA;QAC7B,OAAO,IAAI,CAACF,iBAAiB;AAC/B;IAEA,MAAMpC,oBAAAA,CACJJ,MAAc,EACdE,QAA4B,EAC5BD,MAAc,EACdI,OAA0C,EACgC;AAC1E,QAAA,IAAI,CAACJ,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIwB,KACR,CAAA,6EAAA,CAAA;AAEJ;QAEA,MAAM,IAAI,CAACa,mBAAmB,EAAA;AAE9B,QAAA,MAAMrB,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACrB,MAAAA,CAAAA;QACvC,MAAMyB,SAAAA,GAAYT,MAAOS,CAAAA,SAAS,IAAIiB,2BAAAA;AACtC,QAAA,MAAMC,SAAS,IAAI,CAACC,SAAS,CAAC5B,QAAQS,SAAW,EAAA,MAAA,CAAA;QACjD,MAAMxC,SAAAA,GAAY,IAAI,CAACgD,iBAAiB,EAAA;QACxC,MAAMY,SAAAA,GAAYzC,SAAS0C,IAAQ,IAAA,SAAA;AACnC,QAAA,MAAMC,YAAYF,SAAc,KAAA,SAAA;AAEhC,QAAA,MAAMG,eAAeD,SAAY/B,GAAAA,MAAAA,CAAOiC,wBAAwB,GAAGjC,OAAOkC,mBAAmB;AAE7F,QAAA,MAAMC,cAAcJ,SAAY/B,GAAAA,MAAAA,CAAOoC,uBAAuB,GAAGpC,OAAOqC,kBAAkB;QAE1F,MAAMC,GAAAA,GAAM1D,KAAK0D,GAAG,EAAA;AACpB,QAAA,MAAMC,SAAY,GAAA,IAAI3D,IAAK0D,CAAAA,GAAAA,GAAMN,YAAe,GAAA,IAAA,CAAA;AAChD,QAAA,MAAMtD,iBAAoB,GAAA,IAAIE,IAAK0D,CAAAA,GAAAA,GAAMH,WAAc,GAAA,IAAA,CAAA;;AAGvD,QAAA,MAAMK,SAAS,MAAM,IAAI,CAAChB,QAAQ,CAAC/D,MAAM,CAAC;AACxCsB,YAAAA,MAAAA;AACAd,YAAAA,SAAAA;AACA,YAAA,GAAIgB,QAAY,IAAA;AAAEA,gBAAAA;aAAU;AAC5BD,YAAAA,MAAAA;YACAyD,OAAS,EAAA,IAAA;YACTX,IAAMD,EAAAA,SAAAA;YACNa,MAAQ,EAAA,QAAA;AACRH,YAAAA,SAAAA;AACA7D,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMiE,eAAkBC,GAAAA,IAAAA,CAAKC,KAAK,CAAC,IAAIjE,IAAAA,CAAK4D,MAAOM,CAAAA,SAAS,IAAI,IAAIlE,IAAQmE,EAAAA,CAAAA,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;QACxF,MAAMC,gBAAAA,GAAmBJ,IAAKC,CAAAA,KAAK,CAAC,IAAIjE,KAAK4D,MAAOD,CAAAA,SAAS,CAAEQ,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;AAE3E,QAAA,MAAME,OAA+B,GAAA;AACnClE,YAAAA,MAAAA;AACAd,YAAAA,SAAAA;YACA6D,IAAM,EAAA,SAAA;YACNoB,GAAKP,EAAAA,eAAAA;YACLQ,GAAKH,EAAAA;AACP,SAAA;;AAGA,QAAA,MAAMlC,UAAad,GAAAA,MAAAA,CAAOc,UAAU,IAAI,EAAC;QACzC,MAAM,EAAEsC,SAAS,EAAEvC,UAAU,EAAEE,SAAS,EAAE,GAAGsC,cAAAA,EAAgB,GAAGvC,UAAAA;AAEhE,QAAA,MAAMpB,KAAQ4D,GAAAA,GAAAA,CAAIC,IAAI,CAACN,SAAStB,MAAQ,EAAA;AACtClB,YAAAA,SAAAA;YACA+C,WAAa,EAAA,IAAA;AACb,YAAA,GAAGH;AACL,SAAA,CAAA;QAEA,OAAO;AACL3D,YAAAA,KAAAA;AACAzB,YAAAA,SAAAA;AACAS,YAAAA,iBAAAA,EAAmBA,kBAAkB+E,WAAW;AAClD,SAAA;AACF;IAEAhE,mBACEC,CAAAA,KAAa,EACbV,MAAc,EACsE;AACpF,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIwB,KACR,CAAA,6EAAA,CAAA;AAEJ;QAEA,IAAI;AACF,YAAA,MAAMR,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACrB,MAAAA,CAAAA;YACvC,MAAMyB,SAAAA,GAAYT,MAAOS,CAAAA,SAAS,IAAIiB,2BAAAA;AACtC,YAAA,MAAMC,SAAS,IAAI,CAACC,SAAS,CAAC5B,QAAQS,SAAW,EAAA,QAAA,CAAA;AACjD,YAAA,MAAMwC,OAAUK,GAAAA,GAAAA,CAAII,MAAM,CAAChE,OAAOiC,MAAQ,EAAA;gBACxCgC,UAAY,EAAA;AAAClD,oBAAAA;AAAU,iBAAA;AACvB,gBAAA,GAAGT,OAAOc;AACZ,aAAA,CAAA;;AAGA,YAAA,IAAI,CAACmC,OAAAA,IAAWA,OAAQnB,CAAAA,IAAI,KAAK,QAAU,EAAA;gBACzC,OAAO;oBAAE8B,OAAS,EAAA,KAAA;oBAAOX,OAAS,EAAA;AAAK,iBAAA;AACzC;YAEA,OAAO;gBAAEW,OAAS,EAAA,IAAA;AAAMX,gBAAAA;AAAQ,aAAA;AAClC,SAAA,CAAE,OAAOY,GAAK,EAAA;YACZ,OAAO;gBAAED,OAAS,EAAA,KAAA;gBAAOX,OAAS,EAAA;AAAK,aAAA;AACzC;AACF;AAEA,IAAA,MAAMtD,oBAAqBD,CAAAA,KAAa,EAAEV,MAAc,EAAuC;AAC7F,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIwB,KACR,CAAA,6EAAA,CAAA;AAEJ;QAEA,IAAI;AACF,YAAA,MAAMR,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACrB,MAAAA,CAAAA;YACvC,MAAMyB,SAAAA,GAAYT,MAAOS,CAAAA,SAAS,IAAIiB,2BAAAA;AACtC,YAAA,MAAMC,SAAS,IAAI,CAACC,SAAS,CAAC5B,QAAQS,SAAW,EAAA,QAAA,CAAA;AACjD,YAAA,MAAMqD,aAA+B,GAAA;gBACnCH,UAAY,EAAA;AAAClD,oBAAAA;AAAU,iBAAA;AACvB,gBAAA,GAAGT,OAAOc;AACZ,aAAA;AAEA,YAAA,MAAMmC,OAAUK,GAAAA,GAAAA,CAAII,MAAM,CAAChE,OAAOiC,MAAQmC,EAAAA,aAAAA,CAAAA;YAE1C,IAAIb,OAAAA,CAAQnB,IAAI,KAAK,SAAW,EAAA;gBAC9B,OAAO;oBAAE8B,OAAS,EAAA;AAAM,iBAAA;AAC1B;YAEA,MAAMlG,OAAAA,GAAU,MAAM,IAAI,CAAC8D,QAAQ,CAACxD,eAAe,CAACiF,OAAAA,CAAQhF,SAAS,CAAA;AACrE,YAAA,IAAI,CAACP,OAAS,EAAA;gBACZ,OAAO;oBAAEkG,OAAS,EAAA;AAAM,iBAAA;AAC1B;AAEA,YAAA,MAAMtB,MAAM,IAAI1D,IAAAA,EAAAA;AAChB,YAAA,IAAI,IAAIA,IAAAA,CAAKlB,OAAQ6E,CAAAA,SAAS,KAAKD,GAAK,EAAA;gBACtC,OAAO;oBAAEsB,OAAS,EAAA;AAAM,iBAAA;AAC1B;;YAGA,IAAIlG,OAAAA,CAAQgB,iBAAiB,IAAI,IAAIE,KAAKlB,OAAQgB,CAAAA,iBAAiB,KAAK4D,GAAK,EAAA;gBAC3E,OAAO;oBAAEsB,OAAS,EAAA;AAAM,iBAAA;AAC1B;;YAGA,IAAIlG,OAAAA,CAAQgF,MAAM,KAAK,QAAU,EAAA;gBAC/B,OAAO;oBAAEkB,OAAS,EAAA;AAAM,iBAAA;AAC1B;AAEA,YAAA,IAAIlG,OAAQqB,CAAAA,MAAM,KAAKkE,OAAAA,CAAQlE,MAAM,EAAE;gBACrC,OAAO;oBAAE6E,OAAS,EAAA;AAAM,iBAAA;AAC1B;YAEA,OAAO;gBACLA,OAAS,EAAA,IAAA;AACT7E,gBAAAA,MAAAA,EAAQkE,QAAQlE,MAAM;AACtBd,gBAAAA,SAAAA,EAAWgF,QAAQhF;AACrB,aAAA;AACF,SAAA,CAAE,OAAO8F,KAAY,EAAA;YACnB,IAAIA,KAAAA,YAAiBT,GAAIU,CAAAA,iBAAiB,EAAE;gBAC1C,OAAO;oBAAEJ,OAAS,EAAA;AAAM,iBAAA;AAC1B;YAEA,MAAMG,KAAAA;AACR;AACF;AAEA,IAAA,MAAMnE,uBAAuBZ,MAAc,EAAED,MAAc,EAAEE,QAAiB,EAAiB;AAC7F,QAAA,MAAM,IAAI,CAACuC,QAAQ,CAAC3C,QAAQ,CAAC;AAAEE,YAAAA,MAAAA;AAAQC,YAAAA,MAAAA;AAAQC,YAAAA;AAAS,SAAA,CAAA;AAC1D;AAEA,IAAA,MAAMK,mBACJC,CAAAA,YAAoB,EACpBP,MAAc,EACkC;AAChD,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIwB,KACR,CAAA,6EAAA,CAAA;AAEJ;AAEA,QAAA,MAAMyD,aAAa,MAAM,IAAI,CAACtE,oBAAoB,CAACJ,YAAcP,EAAAA,MAAAA,CAAAA;QAEjE,IAAI,CAACiF,UAAWL,CAAAA,OAAO,EAAE;YACvB,OAAO;gBAAEG,KAAO,EAAA;AAAwB,aAAA;AAC1C;AAEA,QAAA,MAAMd,OAAmD,GAAA;YACvDlE,MAAQmF,EAAAA,MAAAA,CAAOD,WAAWlF,MAAM,CAAA;AAChCd,YAAAA,SAAAA,EAAWgG,WAAWhG,SAAS;YAC/B6D,IAAM,EAAA;AACR,SAAA;AAEA,QAAA,MAAM9B,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACrB,MAAAA,CAAAA;QACvC,MAAMyB,SAAAA,GAAYT,MAAOS,CAAAA,SAAS,IAAIiB,2BAAAA;AACtC,QAAA,MAAMC,SAAS,IAAI,CAACC,SAAS,CAAC5B,QAAQS,SAAW,EAAA,MAAA,CAAA;;AAEjD,QAAA,MAAMK,UAAad,GAAAA,MAAAA,CAAOc,UAAU,IAAI,EAAC;QACzC,MAAM,EAAEsC,SAAS,EAAEvC,UAAU,EAAEE,SAAS,EAAE,GAAGsC,cAAAA,EAAgB,GAAGvC,UAAAA;AAEhE,QAAA,MAAMpB,KAAQ4D,GAAAA,GAAAA,CAAIC,IAAI,CAACN,SAAStB,MAAQ,EAAA;AACtClB,YAAAA,SAAAA;AACA2C,YAAAA,SAAAA,EAAWpD,OAAOmE,mBAAmB;AACrC,YAAA,GAAGd;AACL,SAAA,CAAA;QAEA,OAAO;AAAE3D,YAAAA;AAAM,SAAA;AACjB;AAEA,IAAA,MAAMF,kBACJD,CAAAA,YAAoB,EACpBP,MAAc,EASd;AACA,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIwB,KACR,CAAA,6EAAA,CAAA;AAEJ;QAEA,IAAI;AACF,YAAA,MAAMR,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACrB,MAAAA,CAAAA;YACvC,MAAMyB,SAAAA,GAAYT,MAAOS,CAAAA,SAAS,IAAIiB,2BAAAA;AACtC,YAAA,MAAMC,SAAS,IAAI,CAACC,SAAS,CAAC5B,QAAQS,SAAW,EAAA,QAAA,CAAA;AACjD,YAAA,MAAMwC,OAAUK,GAAAA,GAAAA,CAAII,MAAM,CAACnE,cAAcoC,MAAQ,EAAA;gBAC/CgC,UAAY,EAAA;AAAClD,oBAAAA;AAAU,iBAAA;AACvB,gBAAA,GAAGT,OAAOc;AACZ,aAAA,CAAA;AAEA,YAAA,IAAI,CAACmC,OAAAA,IAAWA,OAAQnB,CAAAA,IAAI,KAAK,SAAW,EAAA;gBAC1C,OAAO;oBAAEiC,KAAO,EAAA;AAAwB,iBAAA;AAC1C;YAEA,MAAMK,OAAAA,GAAU,MAAM,IAAI,CAAC5C,QAAQ,CAACxD,eAAe,CAACiF,OAAAA,CAAQhF,SAAS,CAAA;AACrE,YAAA,IAAI,CAACmG,OAAS,EAAA;gBACZ,OAAO;oBAAEL,KAAO,EAAA;AAAwB,iBAAA;AAC1C;;YAGA,IAAIK,OAAAA,CAAQ3B,OAAO,EAAE;gBACnB,MAAM4B,KAAAA,GAAQ,MAAM,IAAI,CAAC7C,QAAQ,CAACxD,eAAe,CAACoG,OAAAA,CAAQ3B,OAAO,CAAA;AAEjE,gBAAA,IAAI4B,KAAO,EAAA;AACT,oBAAA,MAAMC,QAAW1B,GAAAA,IAAAA,CAAKC,KAAK,CAAC,IAAIjE,IAAAA,CAAKyF,KAAMvB,CAAAA,SAAS,IAAI,IAAIlE,IAAQmE,EAAAA,CAAAA,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;oBAChF,MAAMwB,QAAAA,GAAW3B,IAAKC,CAAAA,KAAK,CAAC,IAAIjE,KAAKyF,KAAM9B,CAAAA,SAAS,CAAEQ,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;AAElE,oBAAA,MAAMyB,YAAoC,GAAA;AACxCzF,wBAAAA,MAAAA,EAAQsF,MAAMtF,MAAM;AACpBd,wBAAAA,SAAAA,EAAWoG,MAAMpG,SAAS;wBAC1B6D,IAAM,EAAA,SAAA;wBACNoB,GAAKoB,EAAAA,QAAAA;wBACLnB,GAAKoB,EAAAA;AACP,qBAAA;;oBAGA,MAAM,EAAEnB,SAAS,EAAE,GAAGC,gBAAgB,GAAGrD,MAAAA,CAAOc,UAAU,IAAI,EAAC;AAE/D,oBAAA,MAAM2D,UAAanB,GAAAA,GAAAA,CAAIC,IAAI,CAACiB,cAAc7C,MAAQ,EAAA;AAChDlB,wBAAAA,SAAAA;wBACA+C,WAAa,EAAA,IAAA;AACb,wBAAA,GAAGH;AACL,qBAAA,CAAA;oBAEA,IAAI3E,iBAAAA;oBACJ,IAAI2F,KAAAA,CAAM3F,iBAAiB,EAAE;wBAC3BA,iBACE,GAAA,OAAO2F,KAAM3F,CAAAA,iBAAiB,KAAK,QAAA,GAC/B2F,KAAM3F,CAAAA,iBAAiB,GACvB2F,KAAAA,CAAM3F,iBAAiB,CAAC+E,WAAW,EAAA;qBACpC,MAAA;wBACL/E,iBAAoB,GAAA,IAAIE,IAAK,CAAA,CAAA,CAAA,CAAG6E,WAAW,EAAA;AAC7C;oBAEA,OAAO;wBACL/D,KAAO+E,EAAAA,UAAAA;AACPxG,wBAAAA,SAAAA,EAAWoG,MAAMpG,SAAS;AAC1BS,wBAAAA,iBAAAA;wBACAoD,IAAMuC,EAAAA,KAAAA,CAAMvC,IAAI,IAAI;AACtB,qBAAA;AACF;AACF;YAEA,MAAMQ,GAAAA,GAAM1D,KAAK0D,GAAG,EAAA;YACpB,MAAMT,SAAAA,GAAYuC,OAAQtC,CAAAA,IAAI,IAAI,SAAA;AAClC,YAAA,MAAME,eACJH,SAAc,KAAA,SAAA,GAAY7B,OAAOiC,wBAAwB,GAAGjC,OAAOkC,mBAAmB;;AAGxF,YAAA,IAAIkC,OAAQtB,CAAAA,SAAS,IAAIR,GAAAA,GAAM,IAAI1D,IAAAA,CAAKwF,OAAQtB,CAAAA,SAAS,CAAEC,CAAAA,OAAO,EAAKf,GAAAA,YAAAA,GAAe,IAAM,EAAA;gBAC1F,OAAO;oBAAE+B,KAAO,EAAA;AAAsB,iBAAA;AACxC;;YAGA,MAAMW,QAAAA,GAAWN,OAAQ1F,CAAAA,iBAAiB,GACtC,IAAIE,KAAKwF,OAAQ1F,CAAAA,iBAAiB,CAAEqE,CAAAA,OAAO,EAC3CT,GAAAA,GAAAA;AACJ,YAAA,IAAIoC,YAAYpC,GAAK,EAAA;gBACnB,OAAO;oBAAEyB,KAAO,EAAA;AAAqB,iBAAA;AACvC;;YAGA,MAAMY,cAAAA,GAAiB,IAAI,CAAC1D,iBAAiB,EAAA;AAC7C,YAAA,MAAM2D,cAAiB,GAAA,IAAIhG,IAAK0D,CAAAA,GAAAA,GAAMN,YAAe,GAAA,IAAA,CAAA;AAErD,YAAA,MAAM6C,cAAc,MAAM,IAAI,CAACrD,QAAQ,CAAC/D,MAAM,CAAC;AAC7CsB,gBAAAA,MAAAA,EAAQqF,QAAQrF,MAAM;gBACtBd,SAAW0G,EAAAA,cAAAA;gBACX,GAAIP,OAAAA,CAAQnF,QAAQ,IAAI;AAAEA,oBAAAA,QAAAA,EAAUmF,QAAQnF;iBAAU;AACtDD,gBAAAA,MAAAA,EAAQoF,QAAQpF,MAAM;gBACtByD,OAAS,EAAA,IAAA;gBACTX,IAAMD,EAAAA,SAAAA;gBACNa,MAAQ,EAAA,QAAA;gBACRH,SAAWqC,EAAAA,cAAAA;AACXlG,gBAAAA,iBAAAA,EAAmB0F,OAAQ1F,CAAAA,iBAAiB,IAAI,IAAIE,IAAK8F,CAAAA,QAAAA;AAC3D,aAAA,CAAA;AAEA,YAAA,MAAMJ,QAAW1B,GAAAA,IAAAA,CAAKC,KAAK,CAAC,IAAIjE,IAAAA,CAAKiG,WAAY/B,CAAAA,SAAS,IAAI,IAAIlE,IAAQmE,EAAAA,CAAAA,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;YACtF,MAAMwB,QAAAA,GAAW3B,IAAKC,CAAAA,KAAK,CAAC,IAAIjE,KAAKiG,WAAYtC,CAAAA,SAAS,CAAEQ,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;AACxE,YAAA,MAAM+B,UAAkC,GAAA;AACtC/F,gBAAAA,MAAAA,EAAQqF,QAAQrF,MAAM;gBACtBd,SAAW0G,EAAAA,cAAAA;gBACX7C,IAAM,EAAA,SAAA;gBACNoB,GAAKoB,EAAAA,QAAAA;gBACLnB,GAAKoB,EAAAA;AACP,aAAA;;YAEA,MAAM,EAAEnB,SAAS,EAAE,GAAGC,gBAAgB,GAAGrD,MAAAA,CAAOc,UAAU,IAAI,EAAC;AAE/D,YAAA,MAAM2D,UAAanB,GAAAA,GAAAA,CAAIC,IAAI,CAACuB,YAAYnD,MAAQ,EAAA;AAC9ClB,gBAAAA,SAAAA;gBACA+C,WAAa,EAAA,IAAA;AACb,gBAAA,GAAGH;AACL,aAAA,CAAA;YAEA,MAAM,IAAI,CAAC7B,QAAQ,CAACpD,iBAAiB,CAACgG,OAAAA,CAAQnG,SAAS,EAAE;gBACvDyE,MAAQ,EAAA,SAAA;gBACRD,OAASkC,EAAAA;AACX,aAAA,CAAA;YAEA,IAAIjG,iBAAAA;YACJ,IAAImG,WAAAA,CAAYnG,iBAAiB,EAAE;gBACjCA,iBACE,GAAA,OAAOmG,WAAYnG,CAAAA,iBAAiB,KAAK,QAAA,GACrCmG,WAAYnG,CAAAA,iBAAiB,GAC7BmG,WAAAA,CAAYnG,iBAAiB,CAAC+E,WAAW,EAAA;aAC1C,MAAA;gBACL/E,iBAAoB,GAAA,IAAIE,IAAK8F,CAAAA,QAAAA,CAAAA,CAAUjB,WAAW,EAAA;AACpD;YAEA,OAAO;gBACL/D,KAAO+E,EAAAA,UAAAA;gBACPxG,SAAW0G,EAAAA,cAAAA;AACXjG,gBAAAA,iBAAAA;gBACAoD,IAAMD,EAAAA;AACR,aAAA;AACF,SAAA,CAAE,OAAM;YACN,OAAO;gBAAEkC,KAAO,EAAA;AAAwB,aAAA;AAC1C;AACF;AAEA;;;AAGC,MACD,MAAMlE,eAAAA,CAAgB5B,SAAiB,EAAEe,MAAc,EAAoB;AACzE,QAAA,MAAMtB,UAAU,MAAM,IAAI,CAAC8D,QAAQ,CAACxD,eAAe,CAACC,SAAAA,CAAAA;AACpD,QAAA,IAAI,CAACP,OAAS,EAAA;YACZ,OAAO,KAAA;AACT;QAEA,IAAIA,OAAAA,CAAQsB,MAAM,KAAKA,MAAQ,EAAA;YAC7B,OAAO,KAAA;AACT;AAEA,QAAA,IAAI,IAAIJ,IAAKlB,CAAAA,OAAAA,CAAQ6E,SAAS,CAAA,IAAK,IAAI3D,IAAQ,EAAA,EAAA;;AAE7C,YAAA,MAAM,IAAI,CAAC4C,QAAQ,CAAClD,iBAAiB,CAACL,SAAAA,CAAAA;YAEtC,OAAO,KAAA;AACT;QAEA,OAAO,IAAA;AACT;AAzdA,IAAA,WAAA,CAAYuD,QAAyB,CAAE;;AAP/BvB,QAAAA,IAAAA,CAAAA,aAAAA,GAAmD,IAAI8E,GAAAA,EAAAA;;aAGvDzD,wBAAmC,GAAA,CAAA;aAE1BC,iBAA4B,GAAA,EAAA;QAG3C,IAAI,CAACC,QAAQ,GAAGA,QAAAA;AAClB;AAwdF;AAEMwD,MAAAA,sBAAAA,GAAyB,CAACpH,EAAcE,EAAAA,WAAAA,GAAAA;IAC5C,OAAO,IAAIN,wBAAwBI,EAAIE,EAAAA,WAAAA,CAAAA;AACzC;AAEA,MAAMmH,oBAAuB,GAAA,CAAC,EAC5BrH,EAAE,EAGH,GAAA;IACC,MAAM4D,QAAAA,GAAWwD,uBAAuBpH,EAAI,EAAA,gBAAA,CAAA;IAC5C,MAAMyB,cAAAA,GAAiB,IAAIS,cAAe0B,CAAAA,QAAAA,CAAAA;;AAG1C,IAAA,MAAM0D,YAAY,CAAClG,MAAAA,GAAAA;AACjB,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIwB,KACR,CAAA,6EAAA,CAAA;AAEJ;QACA,OAAO,IAAItB,qBAAqBG,cAAgBL,EAAAA,MAAAA,CAAAA;AAClD,KAAA;;AAGA,IAAA,MAAMmG,GAAMD,GAAAA,SAAAA;AACZC,IAAAA,GAAAA,CAAIlE,iBAAiB,GAAG5B,cAAAA,CAAe4B,iBAAiB,CAACmE,IAAI,CAAC/F,cAAAA,CAAAA;AAC9D8F,IAAAA,GAAAA,CAAIpF,YAAY,GAAGV,cAAAA,CAAeU,YAAY,CAACqF,IAAI,CAAC/F,cAAAA,CAAAA;AACpD8F,IAAAA,GAAAA,CAAIhF,SAAS,GAAGd,cAAAA,CAAec,SAAS,CAACiF,IAAI,CAAC/F,cAAAA,CAAAA;;;IAI9CgG,MAAOC,CAAAA,cAAc,CAACH,GAAAA,EAAK,kBAAoB,EAAA;AAC7C5E,QAAAA,GAAAA,CAAAA,GAAAA;AACE,YAAA,OAAOlB,eAAeoC,gBAAgB;AACxC,SAAA;QACA8D,UAAY,EAAA;AACd,KAAA,CAAA;IAEA,OAAOJ,GAAAA;AACT;;;;;"}

package/dist/services/session-manager.mjs

@@ -111,6 +111,32 @@ class SessionManager {
         }
         throw new Error(`SessionManager: Origin '${origin}' is not defined. Please define it using defineOrigin('${origin}', config).`);
     }
+    /**
+   * Get the appropriate JWT key based on the algorithm
+   */ getJwtKey(config, algorithm, operation) {
+        const isAsymmetric = algorithm.startsWith('RS') || algorithm.startsWith('ES') || algorithm.startsWith('PS');
+        if (isAsymmetric) {
+            // For asymmetric algorithms, check if user has provided proper key configuration
+            if (operation === 'sign') {
+                const privateKey = config.jwtOptions?.privateKey;
+                if (privateKey) {
+                    return privateKey;
+                }
+                throw new Error(`SessionManager: Private key is required for asymmetric algorithm ${algorithm}. Please configure admin.auth.options.privateKey.`);
+            } else {
+                const publicKey = config.jwtOptions?.publicKey;
+                if (publicKey) {
+                    return publicKey;
+                }
+                throw new Error(`SessionManager: Public key is required for asymmetric algorithm ${algorithm}. Please configure admin.auth.options.publicKey.`);
+            }
+        } else {
+            if (!config.jwtSecret) {
+                throw new Error(`SessionManager: Secret key is required for symmetric algorithm ${algorithm}`);
+            }
+            return config.jwtSecret;
+        }
+    }
     generateSessionId() {
         return crypto.randomBytes(16).toString('hex');
     }
@@ -132,6 +158,8 @@ class SessionManager {
         }
         await this.maybeCleanupExpired();
         const config = this.getConfigForOrigin(origin);
+        const algorithm = config.algorithm || DEFAULT_ALGORITHM;
+        const jwtKey = this.getJwtKey(config, algorithm, 'sign');
         const sessionId = this.generateSessionId();
         const tokenType = options?.type ?? 'refresh';
         const isRefresh = tokenType === 'refresh';
@@ -163,9 +191,13 @@ class SessionManager {
             iat: issuedAtSeconds,
             exp: expiresAtSeconds
         };
-        const token = jwt.sign(payload, config.jwtSecret, {
-            algorithm: DEFAULT_ALGORITHM,
-            noTimestamp: true
+        // Filter out conflicting options that are already handled by the payload or used for key selection
+        const jwtOptions = config.jwtOptions || {};
+        const { expiresIn, privateKey, publicKey, ...jwtSignOptions } = jwtOptions;
+        const token = jwt.sign(payload, jwtKey, {
+            algorithm,
+            noTimestamp: true,
+            ...jwtSignOptions
         });
         return {
             token,
@@ -179,10 +211,13 @@ class SessionManager {
         }
         try {
             const config = this.getConfigForOrigin(origin);
-            const payload = jwt.verify(token, config.jwtSecret, {
+            const algorithm = config.algorithm || DEFAULT_ALGORITHM;
+            const jwtKey = this.getJwtKey(config, algorithm, 'verify');
+            const payload = jwt.verify(token, jwtKey, {
                 algorithms: [
-                    DEFAULT_ALGORITHM
-                ]
+                    algorithm
+                ],
+                ...config.jwtOptions
             });
             // Ensure this is an access token
             if (!payload || payload.type !== 'access') {
@@ -208,12 +243,15 @@ class SessionManager {
         }
         try {
             const config = this.getConfigForOrigin(origin);
+            const algorithm = config.algorithm || DEFAULT_ALGORITHM;
+            const jwtKey = this.getJwtKey(config, algorithm, 'verify');
             const verifyOptions = {
                 algorithms: [
-                    DEFAULT_ALGORITHM
-                ]
+                    algorithm
+                ],
+                ...config.jwtOptions
             };
-            const payload = jwt.verify(token, config.jwtSecret, verifyOptions);
+            const payload = jwt.verify(token, jwtKey, verifyOptions);
             if (payload.type !== 'refresh') {
                 return {
                     isValid: false
@@ -285,9 +323,15 @@ class SessionManager {
             type: 'access'
         };
         const config = this.getConfigForOrigin(origin);
-        const token = jwt.sign(payload, config.jwtSecret, {
-            algorithm: DEFAULT_ALGORITHM,
-            expiresIn: config.accessTokenLifespan
+        const algorithm = config.algorithm || DEFAULT_ALGORITHM;
+        const jwtKey = this.getJwtKey(config, algorithm, 'sign');
+        // Filter out conflicting options that are already handled by the payload or used for key selection
+        const jwtOptions = config.jwtOptions || {};
+        const { expiresIn, privateKey, publicKey, ...jwtSignOptions } = jwtOptions;
+        const token = jwt.sign(payload, jwtKey, {
+            algorithm,
+            expiresIn: config.accessTokenLifespan,
+            ...jwtSignOptions
         });
         return {
             token
@@ -299,10 +343,13 @@ class SessionManager {
         }
         try {
             const config = this.getConfigForOrigin(origin);
-            const payload = jwt.verify(refreshToken, config.jwtSecret, {
+            const algorithm = config.algorithm || DEFAULT_ALGORITHM;
+            const jwtKey = this.getJwtKey(config, algorithm, 'verify');
+            const payload = jwt.verify(refreshToken, jwtKey, {
                 algorithms: [
-                    DEFAULT_ALGORITHM
-                ]
+                    algorithm
+                ],
+                ...config.jwtOptions
             });
             if (!payload || payload.type !== 'refresh') {
                 return {
@@ -328,9 +375,12 @@ class SessionManager {
                         iat: childIat,
                         exp: childExp
                     };
-                    const childToken = jwt.sign(childPayload, config.jwtSecret, {
-                        algorithm: DEFAULT_ALGORITHM,
-                        noTimestamp: true
+                    // Filter out conflicting options that are already handled by the payload
+                    const { expiresIn, ...jwtSignOptions } = config.jwtOptions || {};
+                    const childToken = jwt.sign(childPayload, jwtKey, {
+                        algorithm,
+                        noTimestamp: true,
+                        ...jwtSignOptions
                     });
                     let absoluteExpiresAt;
                     if (child.absoluteExpiresAt) {
@@ -387,9 +437,12 @@ class SessionManager {
                 iat: childIat,
                 exp: childExp
             };
-            const childToken = jwt.sign(payloadOut, config.jwtSecret, {
-                algorithm: DEFAULT_ALGORITHM,
-                noTimestamp: true
+            // Filter out conflicting options that are already handled by the payload
+            const { expiresIn, ...jwtSignOptions } = config.jwtOptions || {};
+            const childToken = jwt.sign(payloadOut, jwtKey, {
+                algorithm,
+                noTimestamp: true,
+                ...jwtSignOptions
             });
             await this.provider.updateBySessionId(current.sessionId, {
                 status: 'rotated',

package/dist/services/session-manager.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session-manager.mjs","sources":["../../src/services/session-manager.ts"],"sourcesContent":["import crypto from 'crypto';\nimport jwt from 'jsonwebtoken';\nimport type { VerifyOptions } from 'jsonwebtoken';\nimport type { Database } from '@strapi/database';\nimport { DEFAULT_ALGORITHM } from '../constants';\n\nexport interface SessionProvider {\n  create(session: SessionData): Promise<SessionData>;\n  findBySessionId(sessionId: string): Promise<SessionData | null>;\n  updateBySessionId(sessionId: string, data: Partial<SessionData>): Promise<void>;\n  deleteBySessionId(sessionId: string): Promise<void>;\n  deleteExpired(): Promise<void>;\n  deleteBy(criteria: { userId?: string; origin?: string; deviceId?: string }): Promise<void>;\n}\n\nexport interface SessionData {\n  id?: string;\n  userId: string; // User ID stored as string (key-value store)\n  sessionId: string;\n  deviceId?: string; // Optional for origins that don't need device tracking\n  origin: string;\n  childId?: string | null;\n\n  type?: 'refresh' | 'session';\n  status?: 'active' | 'rotated' | 'revoked';\n  expiresAt: Date;\n  absoluteExpiresAt?: Date | null;\n  createdAt?: Date;\n  updatedAt?: Date;\n}\n\nexport interface RefreshTokenPayload {\n  userId: string;\n  sessionId: string;\n  type: 'refresh';\n  exp: number;\n  iat: number;\n}\n\nexport interface AccessTokenPayload {\n  userId: string;\n  sessionId: string;\n  type: 'access';\n  exp: number;\n  iat: number;\n}\n\nexport type TokenPayload = RefreshTokenPayload | AccessTokenPayload;\n\nexport interface ValidateRefreshTokenResult {\n  isValid: boolean;\n  userId?: string;\n  sessionId?: string;\n  error?:\n    | 'invalid_token'\n    | 'token_expired'\n    | 'session_not_found'\n    | 'session_expired'\n    | 'wrong_token_type';\n}\n\nclass DatabaseSessionProvider implements SessionProvider {\n  private db: Database;\n\n  private contentType: string;\n\n  constructor(db: Database, contentType: string) {\n    this.db = db;\n    this.contentType = contentType;\n  }\n\n  async create(session: SessionData): Promise<SessionData> {\n    const result = await this.db.query(this.contentType).create({\n      data: session,\n    });\n    return result as SessionData;\n  }\n\n  async findBySessionId(sessionId: string): Promise<SessionData | null> {\n    const result = await this.db.query(this.contentType).findOne({\n      where: { sessionId },\n    });\n    return result as SessionData | null;\n  }\n\n  async updateBySessionId(sessionId: string, data: Partial<SessionData>): Promise<void> {\n    await this.db.query(this.contentType).update({ where: { sessionId }, data });\n  }\n\n  async deleteBySessionId(sessionId: string): Promise<void> {\n    await this.db.query(this.contentType).delete({\n      where: { sessionId },\n    });\n  }\n\n  async deleteExpired(): Promise<void> {\n    await this.db.query(this.contentType).deleteMany({\n      where: { absoluteExpiresAt: { $lt: new Date() } },\n    });\n  }\n\n  async deleteBy(criteria: { userId?: string; origin?: string; deviceId?: string }): Promise<void> {\n    await this.db.query(this.contentType).deleteMany({\n      where: {\n        ...(criteria.userId ? { userId: criteria.userId } : {}),\n        ...(criteria.origin ? { origin: criteria.origin } : {}),\n        ...(criteria.deviceId ? { deviceId: criteria.deviceId } : {}),\n      },\n    });\n  }\n}\n\nexport interface SessionManagerConfig {\n  jwtSecret: string;\n  accessTokenLifespan: number;\n  maxRefreshTokenLifespan: number;\n  idleRefreshTokenLifespan: number;\n  maxSessionLifespan: number;\n  idleSessionLifespan: number;\n}\n\nclass OriginSessionManager {\n  constructor(\n    private sessionManager: SessionManager,\n    private origin: string\n  ) {}\n\n  async generateRefreshToken(\n    userId: string,\n    deviceId: string | undefined,\n    options?: { type?: 'refresh' | 'session' }\n  ): Promise<{ token: string; sessionId: string; absoluteExpiresAt: string }> {\n    return this.sessionManager.generateRefreshToken(userId, deviceId, this.origin, options);\n  }\n\n  async generateAccessToken(refreshToken: string): Promise<{ token: string } | { error: string }> {\n    return this.sessionManager.generateAccessToken(refreshToken, this.origin);\n  }\n\n  async rotateRefreshToken(refreshToken: string): Promise<\n    | {\n        token: string;\n        sessionId: string;\n        absoluteExpiresAt: string;\n        type: 'refresh' | 'session';\n      }\n    | { error: string }\n  > {\n    return this.sessionManager.rotateRefreshToken(refreshToken, this.origin);\n  }\n\n  validateAccessToken(\n    token: string\n  ): { isValid: true; payload: AccessTokenPayload } | { isValid: false; payload: null } {\n    return this.sessionManager.validateAccessToken(token, this.origin);\n  }\n\n  async validateRefreshToken(token: string): Promise<ValidateRefreshTokenResult> {\n    return this.sessionManager.validateRefreshToken(token, this.origin);\n  }\n\n  async invalidateRefreshToken(userId: string, deviceId?: string): Promise<void> {\n    return this.sessionManager.invalidateRefreshToken(this.origin, userId, deviceId);\n  }\n\n  /**\n   * Returns true when a session exists and is not expired for this origin.\n   * If the session exists but is expired, it will be deleted as part of this check.\n   */\n  async isSessionActive(sessionId: string): Promise<boolean> {\n    return this.sessionManager.isSessionActive(sessionId, this.origin);\n  }\n}\n\nclass SessionManager {\n  private provider: SessionProvider;\n\n  // Store origin-specific configurations\n  private originConfigs: Map<string, SessionManagerConfig> = new Map();\n\n  // Run expired cleanup only every N calls to avoid extra queries\n  private cleanupInvocationCounter: number = 0;\n\n  private readonly cleanupEveryCalls: number = 50;\n\n  constructor(provider: SessionProvider) {\n    this.provider = provider;\n  }\n\n  /**\n   * Define configuration for a specific origin\n   */\n  defineOrigin(origin: string, config: SessionManagerConfig): void {\n    this.originConfigs.set(origin, config);\n  }\n\n  /**\n   * Check if an origin is defined\n   */\n  hasOrigin(origin: string): boolean {\n    return this.originConfigs.has(origin);\n  }\n\n  /**\n   * Get configuration for a specific origin, throw error if not defined\n   */\n  private getConfigForOrigin(origin: string): SessionManagerConfig {\n    const originConfig = this.originConfigs.get(origin);\n    if (originConfig) {\n      return originConfig;\n    }\n    throw new Error(\n      `SessionManager: Origin '${origin}' is not defined. Please define it using defineOrigin('${origin}', config).`\n    );\n  }\n\n  generateSessionId(): string {\n    return crypto.randomBytes(16).toString('hex');\n  }\n\n  private async maybeCleanupExpired(): Promise<void> {\n    this.cleanupInvocationCounter += 1;\n    if (this.cleanupInvocationCounter >= this.cleanupEveryCalls) {\n      this.cleanupInvocationCounter = 0;\n\n      await this.provider.deleteExpired();\n    }\n  }\n\n  /**\n   * Get the cleanup every calls threshold\n   */\n  get cleanupThreshold(): number {\n    return this.cleanupEveryCalls;\n  }\n\n  async generateRefreshToken(\n    userId: string,\n    deviceId: string | undefined,\n    origin: string,\n    options?: { type?: 'refresh' | 'session' }\n  ): Promise<{ token: string; sessionId: string; absoluteExpiresAt: string }> {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    await this.maybeCleanupExpired();\n\n    const config = this.getConfigForOrigin(origin);\n    const sessionId = this.generateSessionId();\n    const tokenType = options?.type ?? 'refresh';\n    const isRefresh = tokenType === 'refresh';\n\n    const idleLifespan = isRefresh ? config.idleRefreshTokenLifespan : config.idleSessionLifespan;\n\n    const maxLifespan = isRefresh ? config.maxRefreshTokenLifespan : config.maxSessionLifespan;\n\n    const now = Date.now();\n    const expiresAt = new Date(now + idleLifespan * 1000);\n    const absoluteExpiresAt = new Date(now + maxLifespan * 1000);\n\n    // Create the root record first so createdAt can be used for signing.\n    const record = await this.provider.create({\n      userId,\n      sessionId,\n      ...(deviceId && { deviceId }),\n      origin,\n      childId: null,\n      type: tokenType,\n      status: 'active',\n      expiresAt,\n      absoluteExpiresAt,\n    });\n\n    const issuedAtSeconds = Math.floor(new Date(record.createdAt ?? new Date()).getTime() / 1000);\n    const expiresAtSeconds = Math.floor(new Date(record.expiresAt).getTime() / 1000);\n\n    const payload: RefreshTokenPayload = {\n      userId,\n      sessionId,\n      type: 'refresh',\n      iat: issuedAtSeconds,\n      exp: expiresAtSeconds,\n    };\n\n    const token = jwt.sign(payload, config.jwtSecret, {\n      algorithm: DEFAULT_ALGORITHM,\n      noTimestamp: true,\n    });\n\n    return {\n      token,\n      sessionId,\n      absoluteExpiresAt: absoluteExpiresAt.toISOString(),\n    };\n  }\n\n  validateAccessToken(\n    token: string,\n    origin: string\n  ): { isValid: true; payload: AccessTokenPayload } | { isValid: false; payload: null } {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    try {\n      const config = this.getConfigForOrigin(origin);\n      const payload = jwt.verify(token, config.jwtSecret, {\n        algorithms: [DEFAULT_ALGORITHM],\n      }) as TokenPayload;\n\n      // Ensure this is an access token\n      if (!payload || payload.type !== 'access') {\n        return { isValid: false, payload: null };\n      }\n\n      return { isValid: true, payload };\n    } catch (err) {\n      return { isValid: false, payload: null };\n    }\n  }\n\n  async validateRefreshToken(token: string, origin: string): Promise<ValidateRefreshTokenResult> {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    try {\n      const config = this.getConfigForOrigin(origin);\n      const verifyOptions: VerifyOptions = {\n        algorithms: [DEFAULT_ALGORITHM],\n      };\n\n      const payload = jwt.verify(token, config.jwtSecret, verifyOptions) as RefreshTokenPayload;\n\n      if (payload.type !== 'refresh') {\n        return { isValid: false };\n      }\n\n      const session = await this.provider.findBySessionId(payload.sessionId);\n      if (!session) {\n        return { isValid: false };\n      }\n\n      const now = new Date();\n      if (new Date(session.expiresAt) <= now) {\n        return { isValid: false };\n      }\n\n      // Absolute family expiry check\n      if (session.absoluteExpiresAt && new Date(session.absoluteExpiresAt) <= now) {\n        return { isValid: false };\n      }\n\n      // Only 'active' sessions are eligible to create access tokens.\n      if (session.status !== 'active') {\n        return { isValid: false };\n      }\n\n      if (session.userId !== payload.userId) {\n        return { isValid: false };\n      }\n\n      return {\n        isValid: true,\n        userId: payload.userId,\n        sessionId: payload.sessionId,\n      };\n    } catch (error: any) {\n      if (error instanceof jwt.JsonWebTokenError) {\n        return { isValid: false };\n      }\n\n      throw error;\n    }\n  }\n\n  async invalidateRefreshToken(origin: string, userId: string, deviceId?: string): Promise<void> {\n    await this.provider.deleteBy({ userId, origin, deviceId });\n  }\n\n  async generateAccessToken(\n    refreshToken: string,\n    origin: string\n  ): Promise<{ token: string } | { error: string }> {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    const validation = await this.validateRefreshToken(refreshToken, origin);\n\n    if (!validation.isValid) {\n      return { error: 'invalid_refresh_token' };\n    }\n\n    const payload: Omit<AccessTokenPayload, 'iat' | 'exp'> = {\n      userId: String(validation.userId!),\n      sessionId: validation.sessionId!,\n      type: 'access',\n    };\n\n    const config = this.getConfigForOrigin(origin);\n    const token = jwt.sign(payload, config.jwtSecret, {\n      algorithm: DEFAULT_ALGORITHM,\n      expiresIn: config.accessTokenLifespan,\n    });\n\n    return { token };\n  }\n\n  async rotateRefreshToken(\n    refreshToken: string,\n    origin: string\n  ): Promise<\n    | {\n        token: string;\n        sessionId: string;\n        absoluteExpiresAt: string;\n        type: 'refresh' | 'session';\n      }\n    | { error: string }\n  > {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    try {\n      const config = this.getConfigForOrigin(origin);\n      const payload = jwt.verify(refreshToken, config.jwtSecret, {\n        algorithms: [DEFAULT_ALGORITHM],\n      }) as RefreshTokenPayload;\n\n      if (!payload || payload.type !== 'refresh') {\n        return { error: 'invalid_refresh_token' };\n      }\n\n      const current = await this.provider.findBySessionId(payload.sessionId);\n      if (!current) {\n        return { error: 'invalid_refresh_token' };\n      }\n\n      // If parent already has a child, return the same child token\n      if (current.childId) {\n        const child = await this.provider.findBySessionId(current.childId);\n\n        if (child) {\n          const childIat = Math.floor(new Date(child.createdAt ?? new Date()).getTime() / 1000);\n          const childExp = Math.floor(new Date(child.expiresAt).getTime() / 1000);\n\n          const childPayload: RefreshTokenPayload = {\n            userId: child.userId,\n            sessionId: child.sessionId,\n            type: 'refresh',\n            iat: childIat,\n            exp: childExp,\n          };\n\n          const childToken = jwt.sign(childPayload, config.jwtSecret, {\n            algorithm: DEFAULT_ALGORITHM,\n            noTimestamp: true,\n          });\n\n          let absoluteExpiresAt;\n          if (child.absoluteExpiresAt) {\n            absoluteExpiresAt =\n              typeof child.absoluteExpiresAt === 'string'\n                ? child.absoluteExpiresAt\n                : child.absoluteExpiresAt.toISOString();\n          } else {\n            absoluteExpiresAt = new Date(0).toISOString();\n          }\n\n          return {\n            token: childToken,\n            sessionId: child.sessionId,\n            absoluteExpiresAt,\n            type: child.type ?? 'refresh',\n          };\n        }\n      }\n\n      const now = Date.now();\n      const tokenType = current.type ?? 'refresh';\n      const idleLifespan =\n        tokenType === 'refresh' ? config.idleRefreshTokenLifespan : config.idleSessionLifespan;\n\n      // Enforce idle window since creation of the current token\n      if (current.createdAt && now - new Date(current.createdAt).getTime() > idleLifespan * 1000) {\n        return { error: 'idle_window_elapsed' };\n      }\n\n      // Enforce max family window using absoluteExpiresAt\n      const absolute = current.absoluteExpiresAt\n        ? new Date(current.absoluteExpiresAt).getTime()\n        : now;\n      if (absolute <= now) {\n        return { error: 'max_window_elapsed' };\n      }\n\n      // Create child token\n      const childSessionId = this.generateSessionId();\n      const childExpiresAt = new Date(now + idleLifespan * 1000);\n\n      const childRecord = await this.provider.create({\n        userId: current.userId,\n        sessionId: childSessionId,\n        ...(current.deviceId && { deviceId: current.deviceId }),\n        origin: current.origin,\n        childId: null,\n        type: tokenType,\n        status: 'active',\n        expiresAt: childExpiresAt,\n        absoluteExpiresAt: current.absoluteExpiresAt ?? new Date(absolute),\n      });\n\n      const childIat = Math.floor(new Date(childRecord.createdAt ?? new Date()).getTime() / 1000);\n      const childExp = Math.floor(new Date(childRecord.expiresAt).getTime() / 1000);\n      const payloadOut: RefreshTokenPayload = {\n        userId: current.userId,\n        sessionId: childSessionId,\n        type: 'refresh',\n        iat: childIat,\n        exp: childExp,\n      };\n      const childToken = jwt.sign(payloadOut, config.jwtSecret, {\n        algorithm: DEFAULT_ALGORITHM,\n        noTimestamp: true,\n      });\n\n      await this.provider.updateBySessionId(current.sessionId, {\n        status: 'rotated',\n        childId: childSessionId,\n      });\n\n      let absoluteExpiresAt;\n      if (childRecord.absoluteExpiresAt) {\n        absoluteExpiresAt =\n          typeof childRecord.absoluteExpiresAt === 'string'\n            ? childRecord.absoluteExpiresAt\n            : childRecord.absoluteExpiresAt.toISOString();\n      } else {\n        absoluteExpiresAt = new Date(absolute).toISOString();\n      }\n\n      return {\n        token: childToken,\n        sessionId: childSessionId,\n        absoluteExpiresAt,\n        type: tokenType,\n      };\n    } catch {\n      return { error: 'invalid_refresh_token' };\n    }\n  }\n\n  /**\n   * Returns true when a session exists and is not expired.\n   * If the session exists but is expired, it will be deleted as part of this check.\n   */\n  async isSessionActive(sessionId: string, origin: string): Promise<boolean> {\n    const session = await this.provider.findBySessionId(sessionId);\n    if (!session) {\n      return false;\n    }\n\n    if (session.origin !== origin) {\n      return false;\n    }\n\n    if (new Date(session.expiresAt) <= new Date()) {\n      // Clean up expired session eagerly\n      await this.provider.deleteBySessionId(sessionId);\n\n      return false;\n    }\n\n    return true;\n  }\n}\n\nconst createDatabaseProvider = (db: Database, contentType: string): SessionProvider => {\n  return new DatabaseSessionProvider(db, contentType);\n};\n\nconst createSessionManager = ({\n  db,\n}: {\n  db: Database;\n}): SessionManager & ((origin: string) => OriginSessionManager) => {\n  const provider = createDatabaseProvider(db, 'admin::session');\n  const sessionManager = new SessionManager(provider);\n\n  // Add callable functionality\n  const fluentApi = (origin: string): OriginSessionManager => {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n    return new OriginSessionManager(sessionManager, origin);\n  };\n\n  // Attach only the public SessionManagerService API to the callable\n  const api = fluentApi as unknown as any;\n  api.generateSessionId = sessionManager.generateSessionId.bind(sessionManager);\n  api.defineOrigin = sessionManager.defineOrigin.bind(sessionManager);\n  api.hasOrigin = sessionManager.hasOrigin.bind(sessionManager);\n  // Note: isSessionActive is origin-scoped and exposed on OriginSessionManager only\n\n  // Forward the cleanupThreshold getter (used in tests)\n  Object.defineProperty(api, 'cleanupThreshold', {\n    get() {\n      return sessionManager.cleanupThreshold;\n    },\n    enumerable: true,\n  });\n\n  return api as SessionManager & ((origin: string) => OriginSessionManager);\n};\n\nexport { createSessionManager, createDatabaseProvider };\n"],"names":["DatabaseSessionProvider","create","session","result","db","query","contentType","data","findBySessionId","sessionId","findOne","where","updateBySessionId","update","deleteBySessionId","delete","deleteExpired","deleteMany","absoluteExpiresAt","$lt","Date","deleteBy","criteria","userId","origin","deviceId","constructor","OriginSessionManager","generateRefreshToken","options","sessionManager","generateAccessToken","refreshToken","rotateRefreshToken","validateAccessToken","token","validateRefreshToken","invalidateRefreshToken","isSessionActive","SessionManager","defineOrigin","config","originConfigs","set","hasOrigin","has","getConfigForOrigin","originConfig","get","Error","generateSessionId","crypto","randomBytes","toString","maybeCleanupExpired","cleanupInvocationCounter","cleanupEveryCalls","provider","cleanupThreshold","tokenType","type","isRefresh","idleLifespan","idleRefreshTokenLifespan","idleSessionLifespan","maxLifespan","maxRefreshTokenLifespan","maxSessionLifespan","now","expiresAt","record","childId","status","issuedAtSeconds","Math","floor","createdAt","getTime","expiresAtSeconds","payload","iat","exp","jwt","sign","jwtSecret","algorithm","DEFAULT_ALGORITHM","noTimestamp","toISOString","verify","algorithms","isValid","err","verifyOptions","error","JsonWebTokenError","validation","String","expiresIn","accessTokenLifespan","current","child","childIat","childExp","childPayload","childToken","absolute","childSessionId","childExpiresAt","childRecord","payloadOut","Map","createDatabaseProvider","createSessionManager","fluentApi","api","bind","Object","defineProperty","enumerable"],"mappings":";;;;AA6DA,MAAMA,uBAAAA,CAAAA;IAUJ,MAAMC,MAAAA,CAAOC,OAAoB,EAAwB;AACvD,QAAA,MAAMC,MAAS,GAAA,MAAM,IAAI,CAACC,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAA,CAAEL,MAAM,CAAC;YAC1DM,IAAML,EAAAA;AACR,SAAA,CAAA;QACA,OAAOC,MAAAA;AACT;IAEA,MAAMK,eAAAA,CAAgBC,SAAiB,EAA+B;AACpE,QAAA,MAAMN,MAAS,GAAA,MAAM,IAAI,CAACC,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAA,CAAEI,OAAO,CAAC;YAC3DC,KAAO,EAAA;AAAEF,gBAAAA;AAAU;AACrB,SAAA,CAAA;QACA,OAAON,MAAAA;AACT;AAEA,IAAA,MAAMS,iBAAkBH,CAAAA,SAAiB,EAAEF,IAA0B,EAAiB;QACpF,MAAM,IAAI,CAACH,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAEO,CAAAA,MAAM,CAAC;YAAEF,KAAO,EAAA;AAAEF,gBAAAA;AAAU,aAAA;AAAGF,YAAAA;AAAK,SAAA,CAAA;AAC5E;IAEA,MAAMO,iBAAAA,CAAkBL,SAAiB,EAAiB;QACxD,MAAM,IAAI,CAACL,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAES,CAAAA,MAAM,CAAC;YAC3CJ,KAAO,EAAA;AAAEF,gBAAAA;AAAU;AACrB,SAAA,CAAA;AACF;AAEA,IAAA,MAAMO,aAA+B,GAAA;QACnC,MAAM,IAAI,CAACZ,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAEW,CAAAA,UAAU,CAAC;YAC/CN,KAAO,EAAA;gBAAEO,iBAAmB,EAAA;AAAEC,oBAAAA,GAAAA,EAAK,IAAIC,IAAAA;AAAO;AAAE;AAClD,SAAA,CAAA;AACF;IAEA,MAAMC,QAAAA,CAASC,QAAiE,EAAiB;QAC/F,MAAM,IAAI,CAAClB,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAEW,CAAAA,UAAU,CAAC;YAC/CN,KAAO,EAAA;gBACL,GAAIW,QAAAA,CAASC,MAAM,GAAG;AAAEA,oBAAAA,MAAAA,EAAQD,SAASC;AAAO,iBAAA,GAAI,EAAE;gBACtD,GAAID,QAAAA,CAASE,MAAM,GAAG;AAAEA,oBAAAA,MAAAA,EAAQF,SAASE;AAAO,iBAAA,GAAI,EAAE;gBACtD,GAAIF,QAAAA,CAASG,QAAQ,GAAG;AAAEA,oBAAAA,QAAAA,EAAUH,SAASG;AAAS,iBAAA,GAAI;AAC5D;AACF,SAAA,CAAA;AACF;IA3CAC,WAAYtB,CAAAA,EAAY,EAAEE,WAAmB,CAAE;QAC7C,IAAI,CAACF,EAAE,GAAGA,EAAAA;QACV,IAAI,CAACE,WAAW,GAAGA,WAAAA;AACrB;AAyCF;AAWA,MAAMqB,oBAAAA,CAAAA;AAMJ,IAAA,MAAMC,qBACJL,MAAc,EACdE,QAA4B,EAC5BI,OAA0C,EACgC;QAC1E,OAAO,IAAI,CAACC,cAAc,CAACF,oBAAoB,CAACL,MAAAA,EAAQE,QAAU,EAAA,IAAI,CAACD,MAAM,EAAEK,OAAAA,CAAAA;AACjF;IAEA,MAAME,mBAAAA,CAAoBC,YAAoB,EAAkD;QAC9F,OAAO,IAAI,CAACF,cAAc,CAACC,mBAAmB,CAACC,YAAAA,EAAc,IAAI,CAACR,MAAM,CAAA;AAC1E;IAEA,MAAMS,kBAAAA,CAAmBD,YAAoB,EAQ3C;QACA,OAAO,IAAI,CAACF,cAAc,CAACG,kBAAkB,CAACD,YAAAA,EAAc,IAAI,CAACR,MAAM,CAAA;AACzE;AAEAU,IAAAA,mBAAAA,CACEC,KAAa,EACuE;QACpF,OAAO,IAAI,CAACL,cAAc,CAACI,mBAAmB,CAACC,KAAAA,EAAO,IAAI,CAACX,MAAM,CAAA;AACnE;IAEA,MAAMY,oBAAAA,CAAqBD,KAAa,EAAuC;QAC7E,OAAO,IAAI,CAACL,cAAc,CAACM,oBAAoB,CAACD,KAAAA,EAAO,IAAI,CAACX,MAAM,CAAA;AACpE;AAEA,IAAA,MAAMa,sBAAuBd,CAAAA,MAAc,EAAEE,QAAiB,EAAiB;QAC7E,OAAO,IAAI,CAACK,cAAc,CAACO,sBAAsB,CAAC,IAAI,CAACb,MAAM,EAAED,MAAQE,EAAAA,QAAAA,CAAAA;AACzE;AAEA;;;MAIA,MAAMa,eAAgB7B,CAAAA,SAAiB,EAAoB;QACzD,OAAO,IAAI,CAACqB,cAAc,CAACQ,eAAe,CAAC7B,SAAAA,EAAW,IAAI,CAACe,MAAM,CAAA;AACnE;AAjDAE,IAAAA,WAAAA,CACE,cAAsC,EAC9BF,MAAc,CACtB;aAFQM,cAAAA,GAAAA,cAAAA;aACAN,MAAAA,GAAAA,MAAAA;AACP;AA+CL;AAEA,MAAMe,cAAAA,CAAAA;AAeJ;;AAEC,MACDC,YAAahB,CAAAA,MAAc,EAAEiB,MAA4B,EAAQ;AAC/D,QAAA,IAAI,CAACC,aAAa,CAACC,GAAG,CAACnB,MAAQiB,EAAAA,MAAAA,CAAAA;AACjC;AAEA;;MAGAG,SAAAA,CAAUpB,MAAc,EAAW;AACjC,QAAA,OAAO,IAAI,CAACkB,aAAa,CAACG,GAAG,CAACrB,MAAAA,CAAAA;AAChC;AAEA;;MAGQsB,kBAAmBtB,CAAAA,MAAc,EAAwB;AAC/D,QAAA,MAAMuB,eAAe,IAAI,CAACL,aAAa,CAACM,GAAG,CAACxB,MAAAA,CAAAA;AAC5C,QAAA,IAAIuB,YAAc,EAAA;YAChB,OAAOA,YAAAA;AACT;QACA,MAAM,IAAIE,KACR,CAAA,CAAC,wBAAwB,EAAEzB,OAAO,uDAAuD,EAAEA,MAAO,CAAA,WAAW,CAAC,CAAA;AAElH;IAEA0B,iBAA4B,GAAA;AAC1B,QAAA,OAAOC,MAAOC,CAAAA,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AACzC;AAEA,IAAA,MAAcC,mBAAqC,GAAA;QACjD,IAAI,CAACC,wBAAwB,IAAI,CAAA;AACjC,QAAA,IAAI,IAAI,CAACA,wBAAwB,IAAI,IAAI,CAACC,iBAAiB,EAAE;YAC3D,IAAI,CAACD,wBAAwB,GAAG,CAAA;AAEhC,YAAA,MAAM,IAAI,CAACE,QAAQ,CAACzC,aAAa,EAAA;AACnC;AACF;AAEA;;AAEC,MACD,IAAI0C,gBAA2B,GAAA;QAC7B,OAAO,IAAI,CAACF,iBAAiB;AAC/B;IAEA,MAAM5B,oBAAAA,CACJL,MAAc,EACdE,QAA4B,EAC5BD,MAAc,EACdK,OAA0C,EACgC;AAC1E,QAAA,IAAI,CAACL,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIyB,KACR,CAAA,6EAAA,CAAA;AAEJ;QAEA,MAAM,IAAI,CAACK,mBAAmB,EAAA;AAE9B,QAAA,MAAMb,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACtB,MAAAA,CAAAA;QACvC,MAAMf,SAAAA,GAAY,IAAI,CAACyC,iBAAiB,EAAA;QACxC,MAAMS,SAAAA,GAAY9B,SAAS+B,IAAQ,IAAA,SAAA;AACnC,QAAA,MAAMC,YAAYF,SAAc,KAAA,SAAA;AAEhC,QAAA,MAAMG,eAAeD,SAAYpB,GAAAA,MAAAA,CAAOsB,wBAAwB,GAAGtB,OAAOuB,mBAAmB;AAE7F,QAAA,MAAMC,cAAcJ,SAAYpB,GAAAA,MAAAA,CAAOyB,uBAAuB,GAAGzB,OAAO0B,kBAAkB;QAE1F,MAAMC,GAAAA,GAAMhD,KAAKgD,GAAG,EAAA;AACpB,QAAA,MAAMC,SAAY,GAAA,IAAIjD,IAAKgD,CAAAA,GAAAA,GAAMN,YAAe,GAAA,IAAA,CAAA;AAChD,QAAA,MAAM5C,iBAAoB,GAAA,IAAIE,IAAKgD,CAAAA,GAAAA,GAAMH,WAAc,GAAA,IAAA,CAAA;;AAGvD,QAAA,MAAMK,SAAS,MAAM,IAAI,CAACb,QAAQ,CAACxD,MAAM,CAAC;AACxCsB,YAAAA,MAAAA;AACAd,YAAAA,SAAAA;AACA,YAAA,GAAIgB,QAAY,IAAA;AAAEA,gBAAAA;aAAU;AAC5BD,YAAAA,MAAAA;YACA+C,OAAS,EAAA,IAAA;YACTX,IAAMD,EAAAA,SAAAA;YACNa,MAAQ,EAAA,QAAA;AACRH,YAAAA,SAAAA;AACAnD,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMuD,eAAkBC,GAAAA,IAAAA,CAAKC,KAAK,CAAC,IAAIvD,IAAAA,CAAKkD,MAAOM,CAAAA,SAAS,IAAI,IAAIxD,IAAQyD,EAAAA,CAAAA,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;QACxF,MAAMC,gBAAAA,GAAmBJ,IAAKC,CAAAA,KAAK,CAAC,IAAIvD,KAAKkD,MAAOD,CAAAA,SAAS,CAAEQ,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;AAE3E,QAAA,MAAME,OAA+B,GAAA;AACnCxD,YAAAA,MAAAA;AACAd,YAAAA,SAAAA;YACAmD,IAAM,EAAA,SAAA;YACNoB,GAAKP,EAAAA,eAAAA;YACLQ,GAAKH,EAAAA;AACP,SAAA;AAEA,QAAA,MAAM3C,QAAQ+C,GAAIC,CAAAA,IAAI,CAACJ,OAAStC,EAAAA,MAAAA,CAAO2C,SAAS,EAAE;YAChDC,SAAWC,EAAAA,iBAAAA;YACXC,WAAa,EAAA;AACf,SAAA,CAAA;QAEA,OAAO;AACLpD,YAAAA,KAAAA;AACA1B,YAAAA,SAAAA;AACAS,YAAAA,iBAAAA,EAAmBA,kBAAkBsE,WAAW;AAClD,SAAA;AACF;IAEAtD,mBACEC,CAAAA,KAAa,EACbX,MAAc,EACsE;AACpF,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIyB,KACR,CAAA,6EAAA,CAAA;AAEJ;QAEA,IAAI;AACF,YAAA,MAAMR,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACtB,MAAAA,CAAAA;AACvC,YAAA,MAAMuD,UAAUG,GAAIO,CAAAA,MAAM,CAACtD,KAAOM,EAAAA,MAAAA,CAAO2C,SAAS,EAAE;gBAClDM,UAAY,EAAA;AAACJ,oBAAAA;AAAkB;AACjC,aAAA,CAAA;;AAGA,YAAA,IAAI,CAACP,OAAAA,IAAWA,OAAQnB,CAAAA,IAAI,KAAK,QAAU,EAAA;gBACzC,OAAO;oBAAE+B,OAAS,EAAA,KAAA;oBAAOZ,OAAS,EAAA;AAAK,iBAAA;AACzC;YAEA,OAAO;gBAAEY,OAAS,EAAA,IAAA;AAAMZ,gBAAAA;AAAQ,aAAA;AAClC,SAAA,CAAE,OAAOa,GAAK,EAAA;YACZ,OAAO;gBAAED,OAAS,EAAA,KAAA;gBAAOZ,OAAS,EAAA;AAAK,aAAA;AACzC;AACF;AAEA,IAAA,MAAM3C,oBAAqBD,CAAAA,KAAa,EAAEX,MAAc,EAAuC;AAC7F,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIyB,KACR,CAAA,6EAAA,CAAA;AAEJ;QAEA,IAAI;AACF,YAAA,MAAMR,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACtB,MAAAA,CAAAA;AACvC,YAAA,MAAMqE,aAA+B,GAAA;gBACnCH,UAAY,EAAA;AAACJ,oBAAAA;AAAkB;AACjC,aAAA;AAEA,YAAA,MAAMP,UAAUG,GAAIO,CAAAA,MAAM,CAACtD,KAAOM,EAAAA,MAAAA,CAAO2C,SAAS,EAAES,aAAAA,CAAAA;YAEpD,IAAId,OAAAA,CAAQnB,IAAI,KAAK,SAAW,EAAA;gBAC9B,OAAO;oBAAE+B,OAAS,EAAA;AAAM,iBAAA;AAC1B;YAEA,MAAMzF,OAAAA,GAAU,MAAM,IAAI,CAACuD,QAAQ,CAACjD,eAAe,CAACuE,OAAAA,CAAQtE,SAAS,CAAA;AACrE,YAAA,IAAI,CAACP,OAAS,EAAA;gBACZ,OAAO;oBAAEyF,OAAS,EAAA;AAAM,iBAAA;AAC1B;AAEA,YAAA,MAAMvB,MAAM,IAAIhD,IAAAA,EAAAA;AAChB,YAAA,IAAI,IAAIA,IAAAA,CAAKlB,OAAQmE,CAAAA,SAAS,KAAKD,GAAK,EAAA;gBACtC,OAAO;oBAAEuB,OAAS,EAAA;AAAM,iBAAA;AAC1B;;YAGA,IAAIzF,OAAAA,CAAQgB,iBAAiB,IAAI,IAAIE,KAAKlB,OAAQgB,CAAAA,iBAAiB,KAAKkD,GAAK,EAAA;gBAC3E,OAAO;oBAAEuB,OAAS,EAAA;AAAM,iBAAA;AAC1B;;YAGA,IAAIzF,OAAAA,CAAQsE,MAAM,KAAK,QAAU,EAAA;gBAC/B,OAAO;oBAAEmB,OAAS,EAAA;AAAM,iBAAA;AAC1B;AAEA,YAAA,IAAIzF,OAAQqB,CAAAA,MAAM,KAAKwD,OAAAA,CAAQxD,MAAM,EAAE;gBACrC,OAAO;oBAAEoE,OAAS,EAAA;AAAM,iBAAA;AAC1B;YAEA,OAAO;gBACLA,OAAS,EAAA,IAAA;AACTpE,gBAAAA,MAAAA,EAAQwD,QAAQxD,MAAM;AACtBd,gBAAAA,SAAAA,EAAWsE,QAAQtE;AACrB,aAAA;AACF,SAAA,CAAE,OAAOqF,KAAY,EAAA;YACnB,IAAIA,KAAAA,YAAiBZ,GAAIa,CAAAA,iBAAiB,EAAE;gBAC1C,OAAO;oBAAEJ,OAAS,EAAA;AAAM,iBAAA;AAC1B;YAEA,MAAMG,KAAAA;AACR;AACF;AAEA,IAAA,MAAMzD,uBAAuBb,MAAc,EAAED,MAAc,EAAEE,QAAiB,EAAiB;AAC7F,QAAA,MAAM,IAAI,CAACgC,QAAQ,CAACpC,QAAQ,CAAC;AAAEE,YAAAA,MAAAA;AAAQC,YAAAA,MAAAA;AAAQC,YAAAA;AAAS,SAAA,CAAA;AAC1D;AAEA,IAAA,MAAMM,mBACJC,CAAAA,YAAoB,EACpBR,MAAc,EACkC;AAChD,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIyB,KACR,CAAA,6EAAA,CAAA;AAEJ;AAEA,QAAA,MAAM+C,aAAa,MAAM,IAAI,CAAC5D,oBAAoB,CAACJ,YAAcR,EAAAA,MAAAA,CAAAA;QAEjE,IAAI,CAACwE,UAAWL,CAAAA,OAAO,EAAE;YACvB,OAAO;gBAAEG,KAAO,EAAA;AAAwB,aAAA;AAC1C;AAEA,QAAA,MAAMf,OAAmD,GAAA;YACvDxD,MAAQ0E,EAAAA,MAAAA,CAAOD,WAAWzE,MAAM,CAAA;AAChCd,YAAAA,SAAAA,EAAWuF,WAAWvF,SAAS;YAC/BmD,IAAM,EAAA;AACR,SAAA;AAEA,QAAA,MAAMnB,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACtB,MAAAA,CAAAA;AACvC,QAAA,MAAMW,QAAQ+C,GAAIC,CAAAA,IAAI,CAACJ,OAAStC,EAAAA,MAAAA,CAAO2C,SAAS,EAAE;YAChDC,SAAWC,EAAAA,iBAAAA;AACXY,YAAAA,SAAAA,EAAWzD,OAAO0D;AACpB,SAAA,CAAA;QAEA,OAAO;AAAEhE,YAAAA;AAAM,SAAA;AACjB;AAEA,IAAA,MAAMF,kBACJD,CAAAA,YAAoB,EACpBR,MAAc,EASd;AACA,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIyB,KACR,CAAA,6EAAA,CAAA;AAEJ;QAEA,IAAI;AACF,YAAA,MAAMR,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACtB,MAAAA,CAAAA;AACvC,YAAA,MAAMuD,UAAUG,GAAIO,CAAAA,MAAM,CAACzD,YAAcS,EAAAA,MAAAA,CAAO2C,SAAS,EAAE;gBACzDM,UAAY,EAAA;AAACJ,oBAAAA;AAAkB;AACjC,aAAA,CAAA;AAEA,YAAA,IAAI,CAACP,OAAAA,IAAWA,OAAQnB,CAAAA,IAAI,KAAK,SAAW,EAAA;gBAC1C,OAAO;oBAAEkC,KAAO,EAAA;AAAwB,iBAAA;AAC1C;YAEA,MAAMM,OAAAA,GAAU,MAAM,IAAI,CAAC3C,QAAQ,CAACjD,eAAe,CAACuE,OAAAA,CAAQtE,SAAS,CAAA;AACrE,YAAA,IAAI,CAAC2F,OAAS,EAAA;gBACZ,OAAO;oBAAEN,KAAO,EAAA;AAAwB,iBAAA;AAC1C;;YAGA,IAAIM,OAAAA,CAAQ7B,OAAO,EAAE;gBACnB,MAAM8B,KAAAA,GAAQ,MAAM,IAAI,CAAC5C,QAAQ,CAACjD,eAAe,CAAC4F,OAAAA,CAAQ7B,OAAO,CAAA;AAEjE,gBAAA,IAAI8B,KAAO,EAAA;AACT,oBAAA,MAAMC,QAAW5B,GAAAA,IAAAA,CAAKC,KAAK,CAAC,IAAIvD,IAAAA,CAAKiF,KAAMzB,CAAAA,SAAS,IAAI,IAAIxD,IAAQyD,EAAAA,CAAAA,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;oBAChF,MAAM0B,QAAAA,GAAW7B,IAAKC,CAAAA,KAAK,CAAC,IAAIvD,KAAKiF,KAAMhC,CAAAA,SAAS,CAAEQ,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;AAElE,oBAAA,MAAM2B,YAAoC,GAAA;AACxCjF,wBAAAA,MAAAA,EAAQ8E,MAAM9E,MAAM;AACpBd,wBAAAA,SAAAA,EAAW4F,MAAM5F,SAAS;wBAC1BmD,IAAM,EAAA,SAAA;wBACNoB,GAAKsB,EAAAA,QAAAA;wBACLrB,GAAKsB,EAAAA;AACP,qBAAA;AAEA,oBAAA,MAAME,aAAavB,GAAIC,CAAAA,IAAI,CAACqB,YAAc/D,EAAAA,MAAAA,CAAO2C,SAAS,EAAE;wBAC1DC,SAAWC,EAAAA,iBAAAA;wBACXC,WAAa,EAAA;AACf,qBAAA,CAAA;oBAEA,IAAIrE,iBAAAA;oBACJ,IAAImF,KAAAA,CAAMnF,iBAAiB,EAAE;wBAC3BA,iBACE,GAAA,OAAOmF,KAAMnF,CAAAA,iBAAiB,KAAK,QAAA,GAC/BmF,KAAMnF,CAAAA,iBAAiB,GACvBmF,KAAAA,CAAMnF,iBAAiB,CAACsE,WAAW,EAAA;qBACpC,MAAA;wBACLtE,iBAAoB,GAAA,IAAIE,IAAK,CAAA,CAAA,CAAA,CAAGoE,WAAW,EAAA;AAC7C;oBAEA,OAAO;wBACLrD,KAAOsE,EAAAA,UAAAA;AACPhG,wBAAAA,SAAAA,EAAW4F,MAAM5F,SAAS;AAC1BS,wBAAAA,iBAAAA;wBACA0C,IAAMyC,EAAAA,KAAAA,CAAMzC,IAAI,IAAI;AACtB,qBAAA;AACF;AACF;YAEA,MAAMQ,GAAAA,GAAMhD,KAAKgD,GAAG,EAAA;YACpB,MAAMT,SAAAA,GAAYyC,OAAQxC,CAAAA,IAAI,IAAI,SAAA;AAClC,YAAA,MAAME,eACJH,SAAc,KAAA,SAAA,GAAYlB,OAAOsB,wBAAwB,GAAGtB,OAAOuB,mBAAmB;;AAGxF,YAAA,IAAIoC,OAAQxB,CAAAA,SAAS,IAAIR,GAAAA,GAAM,IAAIhD,IAAAA,CAAKgF,OAAQxB,CAAAA,SAAS,CAAEC,CAAAA,OAAO,EAAKf,GAAAA,YAAAA,GAAe,IAAM,EAAA;gBAC1F,OAAO;oBAAEgC,KAAO,EAAA;AAAsB,iBAAA;AACxC;;YAGA,MAAMY,QAAAA,GAAWN,OAAQlF,CAAAA,iBAAiB,GACtC,IAAIE,KAAKgF,OAAQlF,CAAAA,iBAAiB,CAAE2D,CAAAA,OAAO,EAC3CT,GAAAA,GAAAA;AACJ,YAAA,IAAIsC,YAAYtC,GAAK,EAAA;gBACnB,OAAO;oBAAE0B,KAAO,EAAA;AAAqB,iBAAA;AACvC;;YAGA,MAAMa,cAAAA,GAAiB,IAAI,CAACzD,iBAAiB,EAAA;AAC7C,YAAA,MAAM0D,cAAiB,GAAA,IAAIxF,IAAKgD,CAAAA,GAAAA,GAAMN,YAAe,GAAA,IAAA,CAAA;AAErD,YAAA,MAAM+C,cAAc,MAAM,IAAI,CAACpD,QAAQ,CAACxD,MAAM,CAAC;AAC7CsB,gBAAAA,MAAAA,EAAQ6E,QAAQ7E,MAAM;gBACtBd,SAAWkG,EAAAA,cAAAA;gBACX,GAAIP,OAAAA,CAAQ3E,QAAQ,IAAI;AAAEA,oBAAAA,QAAAA,EAAU2E,QAAQ3E;iBAAU;AACtDD,gBAAAA,MAAAA,EAAQ4E,QAAQ5E,MAAM;gBACtB+C,OAAS,EAAA,IAAA;gBACTX,IAAMD,EAAAA,SAAAA;gBACNa,MAAQ,EAAA,QAAA;gBACRH,SAAWuC,EAAAA,cAAAA;AACX1F,gBAAAA,iBAAAA,EAAmBkF,OAAQlF,CAAAA,iBAAiB,IAAI,IAAIE,IAAKsF,CAAAA,QAAAA;AAC3D,aAAA,CAAA;AAEA,YAAA,MAAMJ,QAAW5B,GAAAA,IAAAA,CAAKC,KAAK,CAAC,IAAIvD,IAAAA,CAAKyF,WAAYjC,CAAAA,SAAS,IAAI,IAAIxD,IAAQyD,EAAAA,CAAAA,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;YACtF,MAAM0B,QAAAA,GAAW7B,IAAKC,CAAAA,KAAK,CAAC,IAAIvD,KAAKyF,WAAYxC,CAAAA,SAAS,CAAEQ,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;AACxE,YAAA,MAAMiC,UAAkC,GAAA;AACtCvF,gBAAAA,MAAAA,EAAQ6E,QAAQ7E,MAAM;gBACtBd,SAAWkG,EAAAA,cAAAA;gBACX/C,IAAM,EAAA,SAAA;gBACNoB,GAAKsB,EAAAA,QAAAA;gBACLrB,GAAKsB,EAAAA;AACP,aAAA;AACA,YAAA,MAAME,aAAavB,GAAIC,CAAAA,IAAI,CAAC2B,UAAYrE,EAAAA,MAAAA,CAAO2C,SAAS,EAAE;gBACxDC,SAAWC,EAAAA,iBAAAA;gBACXC,WAAa,EAAA;AACf,aAAA,CAAA;YAEA,MAAM,IAAI,CAAC9B,QAAQ,CAAC7C,iBAAiB,CAACwF,OAAAA,CAAQ3F,SAAS,EAAE;gBACvD+D,MAAQ,EAAA,SAAA;gBACRD,OAASoC,EAAAA;AACX,aAAA,CAAA;YAEA,IAAIzF,iBAAAA;YACJ,IAAI2F,WAAAA,CAAY3F,iBAAiB,EAAE;gBACjCA,iBACE,GAAA,OAAO2F,WAAY3F,CAAAA,iBAAiB,KAAK,QAAA,GACrC2F,WAAY3F,CAAAA,iBAAiB,GAC7B2F,WAAAA,CAAY3F,iBAAiB,CAACsE,WAAW,EAAA;aAC1C,MAAA;gBACLtE,iBAAoB,GAAA,IAAIE,IAAKsF,CAAAA,QAAAA,CAAAA,CAAUlB,WAAW,EAAA;AACpD;YAEA,OAAO;gBACLrD,KAAOsE,EAAAA,UAAAA;gBACPhG,SAAWkG,EAAAA,cAAAA;AACXzF,gBAAAA,iBAAAA;gBACA0C,IAAMD,EAAAA;AACR,aAAA;AACF,SAAA,CAAE,OAAM;YACN,OAAO;gBAAEmC,KAAO,EAAA;AAAwB,aAAA;AAC1C;AACF;AAEA;;;AAGC,MACD,MAAMxD,eAAAA,CAAgB7B,SAAiB,EAAEe,MAAc,EAAoB;AACzE,QAAA,MAAMtB,UAAU,MAAM,IAAI,CAACuD,QAAQ,CAACjD,eAAe,CAACC,SAAAA,CAAAA;AACpD,QAAA,IAAI,CAACP,OAAS,EAAA;YACZ,OAAO,KAAA;AACT;QAEA,IAAIA,OAAAA,CAAQsB,MAAM,KAAKA,MAAQ,EAAA;YAC7B,OAAO,KAAA;AACT;AAEA,QAAA,IAAI,IAAIJ,IAAKlB,CAAAA,OAAAA,CAAQmE,SAAS,CAAA,IAAK,IAAIjD,IAAQ,EAAA,EAAA;;AAE7C,YAAA,MAAM,IAAI,CAACqC,QAAQ,CAAC3C,iBAAiB,CAACL,SAAAA,CAAAA;YAEtC,OAAO,KAAA;AACT;QAEA,OAAO,IAAA;AACT;AAlZAiB,IAAAA,WAAAA,CAAY+B,QAAyB,CAAE;;AAP/Bf,QAAAA,IAAAA,CAAAA,aAAAA,GAAmD,IAAIqE,GAAAA,EAAAA;;aAGvDxD,wBAAmC,GAAA,CAAA;aAE1BC,iBAA4B,GAAA,EAAA;QAG3C,IAAI,CAACC,QAAQ,GAAGA,QAAAA;AAClB;AAiZF;AAEMuD,MAAAA,sBAAAA,GAAyB,CAAC5G,EAAcE,EAAAA,WAAAA,GAAAA;IAC5C,OAAO,IAAIN,wBAAwBI,EAAIE,EAAAA,WAAAA,CAAAA;AACzC;AAEA,MAAM2G,oBAAuB,GAAA,CAAC,EAC5B7G,EAAE,EAGH,GAAA;IACC,MAAMqD,QAAAA,GAAWuD,uBAAuB5G,EAAI,EAAA,gBAAA,CAAA;IAC5C,MAAM0B,cAAAA,GAAiB,IAAIS,cAAekB,CAAAA,QAAAA,CAAAA;;AAG1C,IAAA,MAAMyD,YAAY,CAAC1F,MAAAA,GAAAA;AACjB,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIyB,KACR,CAAA,6EAAA,CAAA;AAEJ;QACA,OAAO,IAAItB,qBAAqBG,cAAgBN,EAAAA,MAAAA,CAAAA;AAClD,KAAA;;AAGA,IAAA,MAAM2F,GAAMD,GAAAA,SAAAA;AACZC,IAAAA,GAAAA,CAAIjE,iBAAiB,GAAGpB,cAAAA,CAAeoB,iBAAiB,CAACkE,IAAI,CAACtF,cAAAA,CAAAA;AAC9DqF,IAAAA,GAAAA,CAAI3E,YAAY,GAAGV,cAAAA,CAAeU,YAAY,CAAC4E,IAAI,CAACtF,cAAAA,CAAAA;AACpDqF,IAAAA,GAAAA,CAAIvE,SAAS,GAAGd,cAAAA,CAAec,SAAS,CAACwE,IAAI,CAACtF,cAAAA,CAAAA;;;IAI9CuF,MAAOC,CAAAA,cAAc,CAACH,GAAAA,EAAK,kBAAoB,EAAA;AAC7CnE,QAAAA,GAAAA,CAAAA,GAAAA;AACE,YAAA,OAAOlB,eAAe4B,gBAAgB;AACxC,SAAA;QACA6D,UAAY,EAAA;AACd,KAAA,CAAA;IAEA,OAAOJ,GAAAA;AACT;;;;"}
+{"version":3,"file":"session-manager.mjs","sources":["../../src/services/session-manager.ts"],"sourcesContent":["import crypto from 'crypto';\nimport jwt from 'jsonwebtoken';\nimport type { VerifyOptions, Algorithm } from 'jsonwebtoken';\nimport type { Database } from '@strapi/database';\nimport { DEFAULT_ALGORITHM } from '../constants';\n\nexport interface SessionProvider {\n  create(session: SessionData): Promise<SessionData>;\n  findBySessionId(sessionId: string): Promise<SessionData | null>;\n  updateBySessionId(sessionId: string, data: Partial<SessionData>): Promise<void>;\n  deleteBySessionId(sessionId: string): Promise<void>;\n  deleteExpired(): Promise<void>;\n  deleteBy(criteria: { userId?: string; origin?: string; deviceId?: string }): Promise<void>;\n}\n\nexport interface SessionData {\n  id?: string;\n  userId: string; // User ID stored as string (key-value store)\n  sessionId: string;\n  deviceId?: string; // Optional for origins that don't need device tracking\n  origin: string;\n  childId?: string | null;\n\n  type?: 'refresh' | 'session';\n  status?: 'active' | 'rotated' | 'revoked';\n  expiresAt: Date;\n  absoluteExpiresAt?: Date | null;\n  createdAt?: Date;\n  updatedAt?: Date;\n}\n\nexport interface RefreshTokenPayload {\n  userId: string;\n  sessionId: string;\n  type: 'refresh';\n  exp: number;\n  iat: number;\n}\n\nexport interface AccessTokenPayload {\n  userId: string;\n  sessionId: string;\n  type: 'access';\n  exp: number;\n  iat: number;\n}\n\nexport type TokenPayload = RefreshTokenPayload | AccessTokenPayload;\n\nexport interface ValidateRefreshTokenResult {\n  isValid: boolean;\n  userId?: string;\n  sessionId?: string;\n  error?:\n    | 'invalid_token'\n    | 'token_expired'\n    | 'session_not_found'\n    | 'session_expired'\n    | 'wrong_token_type';\n}\n\nclass DatabaseSessionProvider implements SessionProvider {\n  private db: Database;\n\n  private contentType: string;\n\n  constructor(db: Database, contentType: string) {\n    this.db = db;\n    this.contentType = contentType;\n  }\n\n  async create(session: SessionData): Promise<SessionData> {\n    const result = await this.db.query(this.contentType).create({\n      data: session,\n    });\n    return result as SessionData;\n  }\n\n  async findBySessionId(sessionId: string): Promise<SessionData | null> {\n    const result = await this.db.query(this.contentType).findOne({\n      where: { sessionId },\n    });\n    return result as SessionData | null;\n  }\n\n  async updateBySessionId(sessionId: string, data: Partial<SessionData>): Promise<void> {\n    await this.db.query(this.contentType).update({ where: { sessionId }, data });\n  }\n\n  async deleteBySessionId(sessionId: string): Promise<void> {\n    await this.db.query(this.contentType).delete({\n      where: { sessionId },\n    });\n  }\n\n  async deleteExpired(): Promise<void> {\n    await this.db.query(this.contentType).deleteMany({\n      where: { absoluteExpiresAt: { $lt: new Date() } },\n    });\n  }\n\n  async deleteBy(criteria: { userId?: string; origin?: string; deviceId?: string }): Promise<void> {\n    await this.db.query(this.contentType).deleteMany({\n      where: {\n        ...(criteria.userId ? { userId: criteria.userId } : {}),\n        ...(criteria.origin ? { origin: criteria.origin } : {}),\n        ...(criteria.deviceId ? { deviceId: criteria.deviceId } : {}),\n      },\n    });\n  }\n}\n\nexport interface SessionManagerConfig {\n  jwtSecret?: string;\n  accessTokenLifespan: number;\n  maxRefreshTokenLifespan: number;\n  idleRefreshTokenLifespan: number;\n  maxSessionLifespan: number;\n  idleSessionLifespan: number;\n  algorithm?: Algorithm;\n  jwtOptions?: Record<string, unknown>;\n}\n\nclass OriginSessionManager {\n  constructor(\n    private sessionManager: SessionManager,\n    private origin: string\n  ) {}\n\n  async generateRefreshToken(\n    userId: string,\n    deviceId: string | undefined,\n    options?: { type?: 'refresh' | 'session' }\n  ): Promise<{ token: string; sessionId: string; absoluteExpiresAt: string }> {\n    return this.sessionManager.generateRefreshToken(userId, deviceId, this.origin, options);\n  }\n\n  async generateAccessToken(refreshToken: string): Promise<{ token: string } | { error: string }> {\n    return this.sessionManager.generateAccessToken(refreshToken, this.origin);\n  }\n\n  async rotateRefreshToken(refreshToken: string): Promise<\n    | {\n        token: string;\n        sessionId: string;\n        absoluteExpiresAt: string;\n        type: 'refresh' | 'session';\n      }\n    | { error: string }\n  > {\n    return this.sessionManager.rotateRefreshToken(refreshToken, this.origin);\n  }\n\n  validateAccessToken(\n    token: string\n  ): { isValid: true; payload: AccessTokenPayload } | { isValid: false; payload: null } {\n    return this.sessionManager.validateAccessToken(token, this.origin);\n  }\n\n  async validateRefreshToken(token: string): Promise<ValidateRefreshTokenResult> {\n    return this.sessionManager.validateRefreshToken(token, this.origin);\n  }\n\n  async invalidateRefreshToken(userId: string, deviceId?: string): Promise<void> {\n    return this.sessionManager.invalidateRefreshToken(this.origin, userId, deviceId);\n  }\n\n  /**\n   * Returns true when a session exists and is not expired for this origin.\n   * If the session exists but is expired, it will be deleted as part of this check.\n   */\n  async isSessionActive(sessionId: string): Promise<boolean> {\n    return this.sessionManager.isSessionActive(sessionId, this.origin);\n  }\n}\n\nclass SessionManager {\n  private provider: SessionProvider;\n\n  // Store origin-specific configurations\n  private originConfigs: Map<string, SessionManagerConfig> = new Map();\n\n  // Run expired cleanup only every N calls to avoid extra queries\n  private cleanupInvocationCounter: number = 0;\n\n  private readonly cleanupEveryCalls: number = 50;\n\n  constructor(provider: SessionProvider) {\n    this.provider = provider;\n  }\n\n  /**\n   * Define configuration for a specific origin\n   */\n  defineOrigin(origin: string, config: SessionManagerConfig): void {\n    this.originConfigs.set(origin, config);\n  }\n\n  /**\n   * Check if an origin is defined\n   */\n  hasOrigin(origin: string): boolean {\n    return this.originConfigs.has(origin);\n  }\n\n  /**\n   * Get configuration for a specific origin, throw error if not defined\n   */\n  private getConfigForOrigin(origin: string): SessionManagerConfig {\n    const originConfig = this.originConfigs.get(origin);\n    if (originConfig) {\n      return originConfig;\n    }\n    throw new Error(\n      `SessionManager: Origin '${origin}' is not defined. Please define it using defineOrigin('${origin}', config).`\n    );\n  }\n\n  /**\n   * Get the appropriate JWT key based on the algorithm\n   */\n  private getJwtKey(\n    config: SessionManagerConfig,\n    algorithm: Algorithm,\n    operation: 'sign' | 'verify'\n  ): string {\n    const isAsymmetric =\n      algorithm.startsWith('RS') || algorithm.startsWith('ES') || algorithm.startsWith('PS');\n\n    if (isAsymmetric) {\n      // For asymmetric algorithms, check if user has provided proper key configuration\n      if (operation === 'sign') {\n        const privateKey = config.jwtOptions?.privateKey as string;\n        if (privateKey) {\n          return privateKey;\n        }\n        throw new Error(\n          `SessionManager: Private key is required for asymmetric algorithm ${algorithm}. Please configure admin.auth.options.privateKey.`\n        );\n      } else {\n        const publicKey = config.jwtOptions?.publicKey as string;\n        if (publicKey) {\n          return publicKey;\n        }\n        throw new Error(\n          `SessionManager: Public key is required for asymmetric algorithm ${algorithm}. Please configure admin.auth.options.publicKey.`\n        );\n      }\n    } else {\n      if (!config.jwtSecret) {\n        throw new Error(\n          `SessionManager: Secret key is required for symmetric algorithm ${algorithm}`\n        );\n      }\n      return config.jwtSecret;\n    }\n  }\n\n  generateSessionId(): string {\n    return crypto.randomBytes(16).toString('hex');\n  }\n\n  private async maybeCleanupExpired(): Promise<void> {\n    this.cleanupInvocationCounter += 1;\n    if (this.cleanupInvocationCounter >= this.cleanupEveryCalls) {\n      this.cleanupInvocationCounter = 0;\n\n      await this.provider.deleteExpired();\n    }\n  }\n\n  /**\n   * Get the cleanup every calls threshold\n   */\n  get cleanupThreshold(): number {\n    return this.cleanupEveryCalls;\n  }\n\n  async generateRefreshToken(\n    userId: string,\n    deviceId: string | undefined,\n    origin: string,\n    options?: { type?: 'refresh' | 'session' }\n  ): Promise<{ token: string; sessionId: string; absoluteExpiresAt: string }> {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    await this.maybeCleanupExpired();\n\n    const config = this.getConfigForOrigin(origin);\n    const algorithm = config.algorithm || DEFAULT_ALGORITHM;\n    const jwtKey = this.getJwtKey(config, algorithm, 'sign');\n    const sessionId = this.generateSessionId();\n    const tokenType = options?.type ?? 'refresh';\n    const isRefresh = tokenType === 'refresh';\n\n    const idleLifespan = isRefresh ? config.idleRefreshTokenLifespan : config.idleSessionLifespan;\n\n    const maxLifespan = isRefresh ? config.maxRefreshTokenLifespan : config.maxSessionLifespan;\n\n    const now = Date.now();\n    const expiresAt = new Date(now + idleLifespan * 1000);\n    const absoluteExpiresAt = new Date(now + maxLifespan * 1000);\n\n    // Create the root record first so createdAt can be used for signing.\n    const record = await this.provider.create({\n      userId,\n      sessionId,\n      ...(deviceId && { deviceId }),\n      origin,\n      childId: null,\n      type: tokenType,\n      status: 'active',\n      expiresAt,\n      absoluteExpiresAt,\n    });\n\n    const issuedAtSeconds = Math.floor(new Date(record.createdAt ?? new Date()).getTime() / 1000);\n    const expiresAtSeconds = Math.floor(new Date(record.expiresAt).getTime() / 1000);\n\n    const payload: RefreshTokenPayload = {\n      userId,\n      sessionId,\n      type: 'refresh',\n      iat: issuedAtSeconds,\n      exp: expiresAtSeconds,\n    };\n\n    // Filter out conflicting options that are already handled by the payload or used for key selection\n    const jwtOptions = config.jwtOptions || {};\n    const { expiresIn, privateKey, publicKey, ...jwtSignOptions } = jwtOptions;\n\n    const token = jwt.sign(payload, jwtKey, {\n      algorithm,\n      noTimestamp: true,\n      ...jwtSignOptions,\n    });\n\n    return {\n      token,\n      sessionId,\n      absoluteExpiresAt: absoluteExpiresAt.toISOString(),\n    };\n  }\n\n  validateAccessToken(\n    token: string,\n    origin: string\n  ): { isValid: true; payload: AccessTokenPayload } | { isValid: false; payload: null } {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    try {\n      const config = this.getConfigForOrigin(origin);\n      const algorithm = config.algorithm || DEFAULT_ALGORITHM;\n      const jwtKey = this.getJwtKey(config, algorithm, 'verify');\n      const payload = jwt.verify(token, jwtKey, {\n        algorithms: [algorithm],\n        ...config.jwtOptions,\n      }) as TokenPayload;\n\n      // Ensure this is an access token\n      if (!payload || payload.type !== 'access') {\n        return { isValid: false, payload: null };\n      }\n\n      return { isValid: true, payload };\n    } catch (err) {\n      return { isValid: false, payload: null };\n    }\n  }\n\n  async validateRefreshToken(token: string, origin: string): Promise<ValidateRefreshTokenResult> {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    try {\n      const config = this.getConfigForOrigin(origin);\n      const algorithm = config.algorithm || DEFAULT_ALGORITHM;\n      const jwtKey = this.getJwtKey(config, algorithm, 'verify');\n      const verifyOptions: VerifyOptions = {\n        algorithms: [algorithm],\n        ...config.jwtOptions,\n      };\n\n      const payload = jwt.verify(token, jwtKey, verifyOptions) as RefreshTokenPayload;\n\n      if (payload.type !== 'refresh') {\n        return { isValid: false };\n      }\n\n      const session = await this.provider.findBySessionId(payload.sessionId);\n      if (!session) {\n        return { isValid: false };\n      }\n\n      const now = new Date();\n      if (new Date(session.expiresAt) <= now) {\n        return { isValid: false };\n      }\n\n      // Absolute family expiry check\n      if (session.absoluteExpiresAt && new Date(session.absoluteExpiresAt) <= now) {\n        return { isValid: false };\n      }\n\n      // Only 'active' sessions are eligible to create access tokens.\n      if (session.status !== 'active') {\n        return { isValid: false };\n      }\n\n      if (session.userId !== payload.userId) {\n        return { isValid: false };\n      }\n\n      return {\n        isValid: true,\n        userId: payload.userId,\n        sessionId: payload.sessionId,\n      };\n    } catch (error: any) {\n      if (error instanceof jwt.JsonWebTokenError) {\n        return { isValid: false };\n      }\n\n      throw error;\n    }\n  }\n\n  async invalidateRefreshToken(origin: string, userId: string, deviceId?: string): Promise<void> {\n    await this.provider.deleteBy({ userId, origin, deviceId });\n  }\n\n  async generateAccessToken(\n    refreshToken: string,\n    origin: string\n  ): Promise<{ token: string } | { error: string }> {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    const validation = await this.validateRefreshToken(refreshToken, origin);\n\n    if (!validation.isValid) {\n      return { error: 'invalid_refresh_token' };\n    }\n\n    const payload: Omit<AccessTokenPayload, 'iat' | 'exp'> = {\n      userId: String(validation.userId!),\n      sessionId: validation.sessionId!,\n      type: 'access',\n    };\n\n    const config = this.getConfigForOrigin(origin);\n    const algorithm = config.algorithm || DEFAULT_ALGORITHM;\n    const jwtKey = this.getJwtKey(config, algorithm, 'sign');\n    // Filter out conflicting options that are already handled by the payload or used for key selection\n    const jwtOptions = config.jwtOptions || {};\n    const { expiresIn, privateKey, publicKey, ...jwtSignOptions } = jwtOptions;\n\n    const token = jwt.sign(payload, jwtKey, {\n      algorithm,\n      expiresIn: config.accessTokenLifespan,\n      ...jwtSignOptions,\n    });\n\n    return { token };\n  }\n\n  async rotateRefreshToken(\n    refreshToken: string,\n    origin: string\n  ): Promise<\n    | {\n        token: string;\n        sessionId: string;\n        absoluteExpiresAt: string;\n        type: 'refresh' | 'session';\n      }\n    | { error: string }\n  > {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n\n    try {\n      const config = this.getConfigForOrigin(origin);\n      const algorithm = config.algorithm || DEFAULT_ALGORITHM;\n      const jwtKey = this.getJwtKey(config, algorithm, 'verify');\n      const payload = jwt.verify(refreshToken, jwtKey, {\n        algorithms: [algorithm],\n        ...config.jwtOptions,\n      }) as RefreshTokenPayload;\n\n      if (!payload || payload.type !== 'refresh') {\n        return { error: 'invalid_refresh_token' };\n      }\n\n      const current = await this.provider.findBySessionId(payload.sessionId);\n      if (!current) {\n        return { error: 'invalid_refresh_token' };\n      }\n\n      // If parent already has a child, return the same child token\n      if (current.childId) {\n        const child = await this.provider.findBySessionId(current.childId);\n\n        if (child) {\n          const childIat = Math.floor(new Date(child.createdAt ?? new Date()).getTime() / 1000);\n          const childExp = Math.floor(new Date(child.expiresAt).getTime() / 1000);\n\n          const childPayload: RefreshTokenPayload = {\n            userId: child.userId,\n            sessionId: child.sessionId,\n            type: 'refresh',\n            iat: childIat,\n            exp: childExp,\n          };\n\n          // Filter out conflicting options that are already handled by the payload\n          const { expiresIn, ...jwtSignOptions } = config.jwtOptions || {};\n\n          const childToken = jwt.sign(childPayload, jwtKey, {\n            algorithm,\n            noTimestamp: true,\n            ...jwtSignOptions,\n          });\n\n          let absoluteExpiresAt;\n          if (child.absoluteExpiresAt) {\n            absoluteExpiresAt =\n              typeof child.absoluteExpiresAt === 'string'\n                ? child.absoluteExpiresAt\n                : child.absoluteExpiresAt.toISOString();\n          } else {\n            absoluteExpiresAt = new Date(0).toISOString();\n          }\n\n          return {\n            token: childToken,\n            sessionId: child.sessionId,\n            absoluteExpiresAt,\n            type: child.type ?? 'refresh',\n          };\n        }\n      }\n\n      const now = Date.now();\n      const tokenType = current.type ?? 'refresh';\n      const idleLifespan =\n        tokenType === 'refresh' ? config.idleRefreshTokenLifespan : config.idleSessionLifespan;\n\n      // Enforce idle window since creation of the current token\n      if (current.createdAt && now - new Date(current.createdAt).getTime() > idleLifespan * 1000) {\n        return { error: 'idle_window_elapsed' };\n      }\n\n      // Enforce max family window using absoluteExpiresAt\n      const absolute = current.absoluteExpiresAt\n        ? new Date(current.absoluteExpiresAt).getTime()\n        : now;\n      if (absolute <= now) {\n        return { error: 'max_window_elapsed' };\n      }\n\n      // Create child token\n      const childSessionId = this.generateSessionId();\n      const childExpiresAt = new Date(now + idleLifespan * 1000);\n\n      const childRecord = await this.provider.create({\n        userId: current.userId,\n        sessionId: childSessionId,\n        ...(current.deviceId && { deviceId: current.deviceId }),\n        origin: current.origin,\n        childId: null,\n        type: tokenType,\n        status: 'active',\n        expiresAt: childExpiresAt,\n        absoluteExpiresAt: current.absoluteExpiresAt ?? new Date(absolute),\n      });\n\n      const childIat = Math.floor(new Date(childRecord.createdAt ?? new Date()).getTime() / 1000);\n      const childExp = Math.floor(new Date(childRecord.expiresAt).getTime() / 1000);\n      const payloadOut: RefreshTokenPayload = {\n        userId: current.userId,\n        sessionId: childSessionId,\n        type: 'refresh',\n        iat: childIat,\n        exp: childExp,\n      };\n      // Filter out conflicting options that are already handled by the payload\n      const { expiresIn, ...jwtSignOptions } = config.jwtOptions || {};\n\n      const childToken = jwt.sign(payloadOut, jwtKey, {\n        algorithm,\n        noTimestamp: true,\n        ...jwtSignOptions,\n      });\n\n      await this.provider.updateBySessionId(current.sessionId, {\n        status: 'rotated',\n        childId: childSessionId,\n      });\n\n      let absoluteExpiresAt;\n      if (childRecord.absoluteExpiresAt) {\n        absoluteExpiresAt =\n          typeof childRecord.absoluteExpiresAt === 'string'\n            ? childRecord.absoluteExpiresAt\n            : childRecord.absoluteExpiresAt.toISOString();\n      } else {\n        absoluteExpiresAt = new Date(absolute).toISOString();\n      }\n\n      return {\n        token: childToken,\n        sessionId: childSessionId,\n        absoluteExpiresAt,\n        type: tokenType,\n      };\n    } catch {\n      return { error: 'invalid_refresh_token' };\n    }\n  }\n\n  /**\n   * Returns true when a session exists and is not expired.\n   * If the session exists but is expired, it will be deleted as part of this check.\n   */\n  async isSessionActive(sessionId: string, origin: string): Promise<boolean> {\n    const session = await this.provider.findBySessionId(sessionId);\n    if (!session) {\n      return false;\n    }\n\n    if (session.origin !== origin) {\n      return false;\n    }\n\n    if (new Date(session.expiresAt) <= new Date()) {\n      // Clean up expired session eagerly\n      await this.provider.deleteBySessionId(sessionId);\n\n      return false;\n    }\n\n    return true;\n  }\n}\n\nconst createDatabaseProvider = (db: Database, contentType: string): SessionProvider => {\n  return new DatabaseSessionProvider(db, contentType);\n};\n\nconst createSessionManager = ({\n  db,\n}: {\n  db: Database;\n}): SessionManager & ((origin: string) => OriginSessionManager) => {\n  const provider = createDatabaseProvider(db, 'admin::session');\n  const sessionManager = new SessionManager(provider);\n\n  // Add callable functionality\n  const fluentApi = (origin: string): OriginSessionManager => {\n    if (!origin || typeof origin !== 'string') {\n      throw new Error(\n        'SessionManager: Origin parameter is required and must be a non-empty string'\n      );\n    }\n    return new OriginSessionManager(sessionManager, origin);\n  };\n\n  // Attach only the public SessionManagerService API to the callable\n  const api = fluentApi as unknown as any;\n  api.generateSessionId = sessionManager.generateSessionId.bind(sessionManager);\n  api.defineOrigin = sessionManager.defineOrigin.bind(sessionManager);\n  api.hasOrigin = sessionManager.hasOrigin.bind(sessionManager);\n  // Note: isSessionActive is origin-scoped and exposed on OriginSessionManager only\n\n  // Forward the cleanupThreshold getter (used in tests)\n  Object.defineProperty(api, 'cleanupThreshold', {\n    get() {\n      return sessionManager.cleanupThreshold;\n    },\n    enumerable: true,\n  });\n\n  return api as SessionManager & ((origin: string) => OriginSessionManager);\n};\n\nexport { createSessionManager, createDatabaseProvider };\n"],"names":["DatabaseSessionProvider","create","session","result","db","query","contentType","data","findBySessionId","sessionId","findOne","where","updateBySessionId","update","deleteBySessionId","delete","deleteExpired","deleteMany","absoluteExpiresAt","$lt","Date","deleteBy","criteria","userId","origin","deviceId","OriginSessionManager","generateRefreshToken","options","sessionManager","generateAccessToken","refreshToken","rotateRefreshToken","validateAccessToken","token","validateRefreshToken","invalidateRefreshToken","isSessionActive","SessionManager","defineOrigin","config","originConfigs","set","hasOrigin","has","getConfigForOrigin","originConfig","get","Error","algorithm","operation","isAsymmetric","startsWith","privateKey","jwtOptions","publicKey","jwtSecret","generateSessionId","crypto","randomBytes","toString","maybeCleanupExpired","cleanupInvocationCounter","cleanupEveryCalls","provider","cleanupThreshold","DEFAULT_ALGORITHM","jwtKey","getJwtKey","tokenType","type","isRefresh","idleLifespan","idleRefreshTokenLifespan","idleSessionLifespan","maxLifespan","maxRefreshTokenLifespan","maxSessionLifespan","now","expiresAt","record","childId","status","issuedAtSeconds","Math","floor","createdAt","getTime","expiresAtSeconds","payload","iat","exp","expiresIn","jwtSignOptions","jwt","sign","noTimestamp","toISOString","verify","algorithms","isValid","err","verifyOptions","error","JsonWebTokenError","validation","String","accessTokenLifespan","current","child","childIat","childExp","childPayload","childToken","absolute","childSessionId","childExpiresAt","childRecord","payloadOut","Map","createDatabaseProvider","createSessionManager","fluentApi","api","bind","Object","defineProperty","enumerable"],"mappings":";;;;AA6DA,MAAMA,uBAAAA,CAAAA;IAUJ,MAAMC,MAAAA,CAAOC,OAAoB,EAAwB;AACvD,QAAA,MAAMC,MAAS,GAAA,MAAM,IAAI,CAACC,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAA,CAAEL,MAAM,CAAC;YAC1DM,IAAML,EAAAA;AACR,SAAA,CAAA;QACA,OAAOC,MAAAA;AACT;IAEA,MAAMK,eAAAA,CAAgBC,SAAiB,EAA+B;AACpE,QAAA,MAAMN,MAAS,GAAA,MAAM,IAAI,CAACC,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAA,CAAEI,OAAO,CAAC;YAC3DC,KAAO,EAAA;AAAEF,gBAAAA;AAAU;AACrB,SAAA,CAAA;QACA,OAAON,MAAAA;AACT;AAEA,IAAA,MAAMS,iBAAkBH,CAAAA,SAAiB,EAAEF,IAA0B,EAAiB;QACpF,MAAM,IAAI,CAACH,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAEO,CAAAA,MAAM,CAAC;YAAEF,KAAO,EAAA;AAAEF,gBAAAA;AAAU,aAAA;AAAGF,YAAAA;AAAK,SAAA,CAAA;AAC5E;IAEA,MAAMO,iBAAAA,CAAkBL,SAAiB,EAAiB;QACxD,MAAM,IAAI,CAACL,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAES,CAAAA,MAAM,CAAC;YAC3CJ,KAAO,EAAA;AAAEF,gBAAAA;AAAU;AACrB,SAAA,CAAA;AACF;AAEA,IAAA,MAAMO,aAA+B,GAAA;QACnC,MAAM,IAAI,CAACZ,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAEW,CAAAA,UAAU,CAAC;YAC/CN,KAAO,EAAA;gBAAEO,iBAAmB,EAAA;AAAEC,oBAAAA,GAAAA,EAAK,IAAIC,IAAAA;AAAO;AAAE;AAClD,SAAA,CAAA;AACF;IAEA,MAAMC,QAAAA,CAASC,QAAiE,EAAiB;QAC/F,MAAM,IAAI,CAAClB,EAAE,CAACC,KAAK,CAAC,IAAI,CAACC,WAAW,CAAEW,CAAAA,UAAU,CAAC;YAC/CN,KAAO,EAAA;gBACL,GAAIW,QAAAA,CAASC,MAAM,GAAG;AAAEA,oBAAAA,MAAAA,EAAQD,SAASC;AAAO,iBAAA,GAAI,EAAE;gBACtD,GAAID,QAAAA,CAASE,MAAM,GAAG;AAAEA,oBAAAA,MAAAA,EAAQF,SAASE;AAAO,iBAAA,GAAI,EAAE;gBACtD,GAAIF,QAAAA,CAASG,QAAQ,GAAG;AAAEA,oBAAAA,QAAAA,EAAUH,SAASG;AAAS,iBAAA,GAAI;AAC5D;AACF,SAAA,CAAA;AACF;IA3CA,WAAYrB,CAAAA,EAAY,EAAEE,WAAmB,CAAE;QAC7C,IAAI,CAACF,EAAE,GAAGA,EAAAA;QACV,IAAI,CAACE,WAAW,GAAGA,WAAAA;AACrB;AAyCF;AAaA,MAAMoB,oBAAAA,CAAAA;AAMJ,IAAA,MAAMC,qBACJJ,MAAc,EACdE,QAA4B,EAC5BG,OAA0C,EACgC;QAC1E,OAAO,IAAI,CAACC,cAAc,CAACF,oBAAoB,CAACJ,MAAAA,EAAQE,QAAU,EAAA,IAAI,CAACD,MAAM,EAAEI,OAAAA,CAAAA;AACjF;IAEA,MAAME,mBAAAA,CAAoBC,YAAoB,EAAkD;QAC9F,OAAO,IAAI,CAACF,cAAc,CAACC,mBAAmB,CAACC,YAAAA,EAAc,IAAI,CAACP,MAAM,CAAA;AAC1E;IAEA,MAAMQ,kBAAAA,CAAmBD,YAAoB,EAQ3C;QACA,OAAO,IAAI,CAACF,cAAc,CAACG,kBAAkB,CAACD,YAAAA,EAAc,IAAI,CAACP,MAAM,CAAA;AACzE;AAEAS,IAAAA,mBAAAA,CACEC,KAAa,EACuE;QACpF,OAAO,IAAI,CAACL,cAAc,CAACI,mBAAmB,CAACC,KAAAA,EAAO,IAAI,CAACV,MAAM,CAAA;AACnE;IAEA,MAAMW,oBAAAA,CAAqBD,KAAa,EAAuC;QAC7E,OAAO,IAAI,CAACL,cAAc,CAACM,oBAAoB,CAACD,KAAAA,EAAO,IAAI,CAACV,MAAM,CAAA;AACpE;AAEA,IAAA,MAAMY,sBAAuBb,CAAAA,MAAc,EAAEE,QAAiB,EAAiB;QAC7E,OAAO,IAAI,CAACI,cAAc,CAACO,sBAAsB,CAAC,IAAI,CAACZ,MAAM,EAAED,MAAQE,EAAAA,QAAAA,CAAAA;AACzE;AAEA;;;MAIA,MAAMY,eAAgB5B,CAAAA,SAAiB,EAAoB;QACzD,OAAO,IAAI,CAACoB,cAAc,CAACQ,eAAe,CAAC5B,SAAAA,EAAW,IAAI,CAACe,MAAM,CAAA;AACnE;AAjDA,IAAA,WAAA,CACE,cAAsC,EAC9BA,MAAc,CACtB;aAFQK,cAAAA,GAAAA,cAAAA;aACAL,MAAAA,GAAAA,MAAAA;AACP;AA+CL;AAEA,MAAMc,cAAAA,CAAAA;AAeJ;;AAEC,MACDC,YAAaf,CAAAA,MAAc,EAAEgB,MAA4B,EAAQ;AAC/D,QAAA,IAAI,CAACC,aAAa,CAACC,GAAG,CAAClB,MAAQgB,EAAAA,MAAAA,CAAAA;AACjC;AAEA;;MAGAG,SAAAA,CAAUnB,MAAc,EAAW;AACjC,QAAA,OAAO,IAAI,CAACiB,aAAa,CAACG,GAAG,CAACpB,MAAAA,CAAAA;AAChC;AAEA;;MAGQqB,kBAAmBrB,CAAAA,MAAc,EAAwB;AAC/D,QAAA,MAAMsB,eAAe,IAAI,CAACL,aAAa,CAACM,GAAG,CAACvB,MAAAA,CAAAA;AAC5C,QAAA,IAAIsB,YAAc,EAAA;YAChB,OAAOA,YAAAA;AACT;QACA,MAAM,IAAIE,KACR,CAAA,CAAC,wBAAwB,EAAExB,OAAO,uDAAuD,EAAEA,MAAO,CAAA,WAAW,CAAC,CAAA;AAElH;AAEA;;AAEC,MACD,SACEgB,CAAAA,MAA4B,EAC5BS,SAAoB,EACpBC,SAA4B,EACpB;QACR,MAAMC,YAAAA,GACJF,SAAUG,CAAAA,UAAU,CAAC,IAAA,CAAA,IAASH,SAAUG,CAAAA,UAAU,CAAC,IAAA,CAAA,IAASH,SAAUG,CAAAA,UAAU,CAAC,IAAA,CAAA;AAEnF,QAAA,IAAID,YAAc,EAAA;;AAEhB,YAAA,IAAID,cAAc,MAAQ,EAAA;gBACxB,MAAMG,UAAAA,GAAab,MAAOc,CAAAA,UAAU,EAAED,UAAAA;AACtC,gBAAA,IAAIA,UAAY,EAAA;oBACd,OAAOA,UAAAA;AACT;AACA,gBAAA,MAAM,IAAIL,KACR,CAAA,CAAC,iEAAiE,EAAEC,SAAAA,CAAU,iDAAiD,CAAC,CAAA;aAE7H,MAAA;gBACL,MAAMM,SAAAA,GAAYf,MAAOc,CAAAA,UAAU,EAAEC,SAAAA;AACrC,gBAAA,IAAIA,SAAW,EAAA;oBACb,OAAOA,SAAAA;AACT;AACA,gBAAA,MAAM,IAAIP,KACR,CAAA,CAAC,gEAAgE,EAAEC,SAAAA,CAAU,gDAAgD,CAAC,CAAA;AAElI;SACK,MAAA;YACL,IAAI,CAACT,MAAOgB,CAAAA,SAAS,EAAE;AACrB,gBAAA,MAAM,IAAIR,KAAAA,CACR,CAAC,+DAA+D,EAAEC,SAAW,CAAA,CAAA,CAAA;AAEjF;AACA,YAAA,OAAOT,OAAOgB,SAAS;AACzB;AACF;IAEAC,iBAA4B,GAAA;AAC1B,QAAA,OAAOC,MAAOC,CAAAA,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AACzC;AAEA,IAAA,MAAcC,mBAAqC,GAAA;QACjD,IAAI,CAACC,wBAAwB,IAAI,CAAA;AACjC,QAAA,IAAI,IAAI,CAACA,wBAAwB,IAAI,IAAI,CAACC,iBAAiB,EAAE;YAC3D,IAAI,CAACD,wBAAwB,GAAG,CAAA;AAEhC,YAAA,MAAM,IAAI,CAACE,QAAQ,CAAChD,aAAa,EAAA;AACnC;AACF;AAEA;;AAEC,MACD,IAAIiD,gBAA2B,GAAA;QAC7B,OAAO,IAAI,CAACF,iBAAiB;AAC/B;IAEA,MAAMpC,oBAAAA,CACJJ,MAAc,EACdE,QAA4B,EAC5BD,MAAc,EACdI,OAA0C,EACgC;AAC1E,QAAA,IAAI,CAACJ,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIwB,KACR,CAAA,6EAAA,CAAA;AAEJ;QAEA,MAAM,IAAI,CAACa,mBAAmB,EAAA;AAE9B,QAAA,MAAMrB,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACrB,MAAAA,CAAAA;QACvC,MAAMyB,SAAAA,GAAYT,MAAOS,CAAAA,SAAS,IAAIiB,iBAAAA;AACtC,QAAA,MAAMC,SAAS,IAAI,CAACC,SAAS,CAAC5B,QAAQS,SAAW,EAAA,MAAA,CAAA;QACjD,MAAMxC,SAAAA,GAAY,IAAI,CAACgD,iBAAiB,EAAA;QACxC,MAAMY,SAAAA,GAAYzC,SAAS0C,IAAQ,IAAA,SAAA;AACnC,QAAA,MAAMC,YAAYF,SAAc,KAAA,SAAA;AAEhC,QAAA,MAAMG,eAAeD,SAAY/B,GAAAA,MAAAA,CAAOiC,wBAAwB,GAAGjC,OAAOkC,mBAAmB;AAE7F,QAAA,MAAMC,cAAcJ,SAAY/B,GAAAA,MAAAA,CAAOoC,uBAAuB,GAAGpC,OAAOqC,kBAAkB;QAE1F,MAAMC,GAAAA,GAAM1D,KAAK0D,GAAG,EAAA;AACpB,QAAA,MAAMC,SAAY,GAAA,IAAI3D,IAAK0D,CAAAA,GAAAA,GAAMN,YAAe,GAAA,IAAA,CAAA;AAChD,QAAA,MAAMtD,iBAAoB,GAAA,IAAIE,IAAK0D,CAAAA,GAAAA,GAAMH,WAAc,GAAA,IAAA,CAAA;;AAGvD,QAAA,MAAMK,SAAS,MAAM,IAAI,CAAChB,QAAQ,CAAC/D,MAAM,CAAC;AACxCsB,YAAAA,MAAAA;AACAd,YAAAA,SAAAA;AACA,YAAA,GAAIgB,QAAY,IAAA;AAAEA,gBAAAA;aAAU;AAC5BD,YAAAA,MAAAA;YACAyD,OAAS,EAAA,IAAA;YACTX,IAAMD,EAAAA,SAAAA;YACNa,MAAQ,EAAA,QAAA;AACRH,YAAAA,SAAAA;AACA7D,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMiE,eAAkBC,GAAAA,IAAAA,CAAKC,KAAK,CAAC,IAAIjE,IAAAA,CAAK4D,MAAOM,CAAAA,SAAS,IAAI,IAAIlE,IAAQmE,EAAAA,CAAAA,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;QACxF,MAAMC,gBAAAA,GAAmBJ,IAAKC,CAAAA,KAAK,CAAC,IAAIjE,KAAK4D,MAAOD,CAAAA,SAAS,CAAEQ,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;AAE3E,QAAA,MAAME,OAA+B,GAAA;AACnClE,YAAAA,MAAAA;AACAd,YAAAA,SAAAA;YACA6D,IAAM,EAAA,SAAA;YACNoB,GAAKP,EAAAA,eAAAA;YACLQ,GAAKH,EAAAA;AACP,SAAA;;AAGA,QAAA,MAAMlC,UAAad,GAAAA,MAAAA,CAAOc,UAAU,IAAI,EAAC;QACzC,MAAM,EAAEsC,SAAS,EAAEvC,UAAU,EAAEE,SAAS,EAAE,GAAGsC,cAAAA,EAAgB,GAAGvC,UAAAA;AAEhE,QAAA,MAAMpB,KAAQ4D,GAAAA,GAAAA,CAAIC,IAAI,CAACN,SAAStB,MAAQ,EAAA;AACtClB,YAAAA,SAAAA;YACA+C,WAAa,EAAA,IAAA;AACb,YAAA,GAAGH;AACL,SAAA,CAAA;QAEA,OAAO;AACL3D,YAAAA,KAAAA;AACAzB,YAAAA,SAAAA;AACAS,YAAAA,iBAAAA,EAAmBA,kBAAkB+E,WAAW;AAClD,SAAA;AACF;IAEAhE,mBACEC,CAAAA,KAAa,EACbV,MAAc,EACsE;AACpF,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIwB,KACR,CAAA,6EAAA,CAAA;AAEJ;QAEA,IAAI;AACF,YAAA,MAAMR,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACrB,MAAAA,CAAAA;YACvC,MAAMyB,SAAAA,GAAYT,MAAOS,CAAAA,SAAS,IAAIiB,iBAAAA;AACtC,YAAA,MAAMC,SAAS,IAAI,CAACC,SAAS,CAAC5B,QAAQS,SAAW,EAAA,QAAA,CAAA;AACjD,YAAA,MAAMwC,OAAUK,GAAAA,GAAAA,CAAII,MAAM,CAAChE,OAAOiC,MAAQ,EAAA;gBACxCgC,UAAY,EAAA;AAAClD,oBAAAA;AAAU,iBAAA;AACvB,gBAAA,GAAGT,OAAOc;AACZ,aAAA,CAAA;;AAGA,YAAA,IAAI,CAACmC,OAAAA,IAAWA,OAAQnB,CAAAA,IAAI,KAAK,QAAU,EAAA;gBACzC,OAAO;oBAAE8B,OAAS,EAAA,KAAA;oBAAOX,OAAS,EAAA;AAAK,iBAAA;AACzC;YAEA,OAAO;gBAAEW,OAAS,EAAA,IAAA;AAAMX,gBAAAA;AAAQ,aAAA;AAClC,SAAA,CAAE,OAAOY,GAAK,EAAA;YACZ,OAAO;gBAAED,OAAS,EAAA,KAAA;gBAAOX,OAAS,EAAA;AAAK,aAAA;AACzC;AACF;AAEA,IAAA,MAAMtD,oBAAqBD,CAAAA,KAAa,EAAEV,MAAc,EAAuC;AAC7F,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIwB,KACR,CAAA,6EAAA,CAAA;AAEJ;QAEA,IAAI;AACF,YAAA,MAAMR,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACrB,MAAAA,CAAAA;YACvC,MAAMyB,SAAAA,GAAYT,MAAOS,CAAAA,SAAS,IAAIiB,iBAAAA;AACtC,YAAA,MAAMC,SAAS,IAAI,CAACC,SAAS,CAAC5B,QAAQS,SAAW,EAAA,QAAA,CAAA;AACjD,YAAA,MAAMqD,aAA+B,GAAA;gBACnCH,UAAY,EAAA;AAAClD,oBAAAA;AAAU,iBAAA;AACvB,gBAAA,GAAGT,OAAOc;AACZ,aAAA;AAEA,YAAA,MAAMmC,OAAUK,GAAAA,GAAAA,CAAII,MAAM,CAAChE,OAAOiC,MAAQmC,EAAAA,aAAAA,CAAAA;YAE1C,IAAIb,OAAAA,CAAQnB,IAAI,KAAK,SAAW,EAAA;gBAC9B,OAAO;oBAAE8B,OAAS,EAAA;AAAM,iBAAA;AAC1B;YAEA,MAAMlG,OAAAA,GAAU,MAAM,IAAI,CAAC8D,QAAQ,CAACxD,eAAe,CAACiF,OAAAA,CAAQhF,SAAS,CAAA;AACrE,YAAA,IAAI,CAACP,OAAS,EAAA;gBACZ,OAAO;oBAAEkG,OAAS,EAAA;AAAM,iBAAA;AAC1B;AAEA,YAAA,MAAMtB,MAAM,IAAI1D,IAAAA,EAAAA;AAChB,YAAA,IAAI,IAAIA,IAAAA,CAAKlB,OAAQ6E,CAAAA,SAAS,KAAKD,GAAK,EAAA;gBACtC,OAAO;oBAAEsB,OAAS,EAAA;AAAM,iBAAA;AAC1B;;YAGA,IAAIlG,OAAAA,CAAQgB,iBAAiB,IAAI,IAAIE,KAAKlB,OAAQgB,CAAAA,iBAAiB,KAAK4D,GAAK,EAAA;gBAC3E,OAAO;oBAAEsB,OAAS,EAAA;AAAM,iBAAA;AAC1B;;YAGA,IAAIlG,OAAAA,CAAQgF,MAAM,KAAK,QAAU,EAAA;gBAC/B,OAAO;oBAAEkB,OAAS,EAAA;AAAM,iBAAA;AAC1B;AAEA,YAAA,IAAIlG,OAAQqB,CAAAA,MAAM,KAAKkE,OAAAA,CAAQlE,MAAM,EAAE;gBACrC,OAAO;oBAAE6E,OAAS,EAAA;AAAM,iBAAA;AAC1B;YAEA,OAAO;gBACLA,OAAS,EAAA,IAAA;AACT7E,gBAAAA,MAAAA,EAAQkE,QAAQlE,MAAM;AACtBd,gBAAAA,SAAAA,EAAWgF,QAAQhF;AACrB,aAAA;AACF,SAAA,CAAE,OAAO8F,KAAY,EAAA;YACnB,IAAIA,KAAAA,YAAiBT,GAAIU,CAAAA,iBAAiB,EAAE;gBAC1C,OAAO;oBAAEJ,OAAS,EAAA;AAAM,iBAAA;AAC1B;YAEA,MAAMG,KAAAA;AACR;AACF;AAEA,IAAA,MAAMnE,uBAAuBZ,MAAc,EAAED,MAAc,EAAEE,QAAiB,EAAiB;AAC7F,QAAA,MAAM,IAAI,CAACuC,QAAQ,CAAC3C,QAAQ,CAAC;AAAEE,YAAAA,MAAAA;AAAQC,YAAAA,MAAAA;AAAQC,YAAAA;AAAS,SAAA,CAAA;AAC1D;AAEA,IAAA,MAAMK,mBACJC,CAAAA,YAAoB,EACpBP,MAAc,EACkC;AAChD,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIwB,KACR,CAAA,6EAAA,CAAA;AAEJ;AAEA,QAAA,MAAMyD,aAAa,MAAM,IAAI,CAACtE,oBAAoB,CAACJ,YAAcP,EAAAA,MAAAA,CAAAA;QAEjE,IAAI,CAACiF,UAAWL,CAAAA,OAAO,EAAE;YACvB,OAAO;gBAAEG,KAAO,EAAA;AAAwB,aAAA;AAC1C;AAEA,QAAA,MAAMd,OAAmD,GAAA;YACvDlE,MAAQmF,EAAAA,MAAAA,CAAOD,WAAWlF,MAAM,CAAA;AAChCd,YAAAA,SAAAA,EAAWgG,WAAWhG,SAAS;YAC/B6D,IAAM,EAAA;AACR,SAAA;AAEA,QAAA,MAAM9B,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACrB,MAAAA,CAAAA;QACvC,MAAMyB,SAAAA,GAAYT,MAAOS,CAAAA,SAAS,IAAIiB,iBAAAA;AACtC,QAAA,MAAMC,SAAS,IAAI,CAACC,SAAS,CAAC5B,QAAQS,SAAW,EAAA,MAAA,CAAA;;AAEjD,QAAA,MAAMK,UAAad,GAAAA,MAAAA,CAAOc,UAAU,IAAI,EAAC;QACzC,MAAM,EAAEsC,SAAS,EAAEvC,UAAU,EAAEE,SAAS,EAAE,GAAGsC,cAAAA,EAAgB,GAAGvC,UAAAA;AAEhE,QAAA,MAAMpB,KAAQ4D,GAAAA,GAAAA,CAAIC,IAAI,CAACN,SAAStB,MAAQ,EAAA;AACtClB,YAAAA,SAAAA;AACA2C,YAAAA,SAAAA,EAAWpD,OAAOmE,mBAAmB;AACrC,YAAA,GAAGd;AACL,SAAA,CAAA;QAEA,OAAO;AAAE3D,YAAAA;AAAM,SAAA;AACjB;AAEA,IAAA,MAAMF,kBACJD,CAAAA,YAAoB,EACpBP,MAAc,EASd;AACA,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIwB,KACR,CAAA,6EAAA,CAAA;AAEJ;QAEA,IAAI;AACF,YAAA,MAAMR,MAAS,GAAA,IAAI,CAACK,kBAAkB,CAACrB,MAAAA,CAAAA;YACvC,MAAMyB,SAAAA,GAAYT,MAAOS,CAAAA,SAAS,IAAIiB,iBAAAA;AACtC,YAAA,MAAMC,SAAS,IAAI,CAACC,SAAS,CAAC5B,QAAQS,SAAW,EAAA,QAAA,CAAA;AACjD,YAAA,MAAMwC,OAAUK,GAAAA,GAAAA,CAAII,MAAM,CAACnE,cAAcoC,MAAQ,EAAA;gBAC/CgC,UAAY,EAAA;AAAClD,oBAAAA;AAAU,iBAAA;AACvB,gBAAA,GAAGT,OAAOc;AACZ,aAAA,CAAA;AAEA,YAAA,IAAI,CAACmC,OAAAA,IAAWA,OAAQnB,CAAAA,IAAI,KAAK,SAAW,EAAA;gBAC1C,OAAO;oBAAEiC,KAAO,EAAA;AAAwB,iBAAA;AAC1C;YAEA,MAAMK,OAAAA,GAAU,MAAM,IAAI,CAAC5C,QAAQ,CAACxD,eAAe,CAACiF,OAAAA,CAAQhF,SAAS,CAAA;AACrE,YAAA,IAAI,CAACmG,OAAS,EAAA;gBACZ,OAAO;oBAAEL,KAAO,EAAA;AAAwB,iBAAA;AAC1C;;YAGA,IAAIK,OAAAA,CAAQ3B,OAAO,EAAE;gBACnB,MAAM4B,KAAAA,GAAQ,MAAM,IAAI,CAAC7C,QAAQ,CAACxD,eAAe,CAACoG,OAAAA,CAAQ3B,OAAO,CAAA;AAEjE,gBAAA,IAAI4B,KAAO,EAAA;AACT,oBAAA,MAAMC,QAAW1B,GAAAA,IAAAA,CAAKC,KAAK,CAAC,IAAIjE,IAAAA,CAAKyF,KAAMvB,CAAAA,SAAS,IAAI,IAAIlE,IAAQmE,EAAAA,CAAAA,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;oBAChF,MAAMwB,QAAAA,GAAW3B,IAAKC,CAAAA,KAAK,CAAC,IAAIjE,KAAKyF,KAAM9B,CAAAA,SAAS,CAAEQ,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;AAElE,oBAAA,MAAMyB,YAAoC,GAAA;AACxCzF,wBAAAA,MAAAA,EAAQsF,MAAMtF,MAAM;AACpBd,wBAAAA,SAAAA,EAAWoG,MAAMpG,SAAS;wBAC1B6D,IAAM,EAAA,SAAA;wBACNoB,GAAKoB,EAAAA,QAAAA;wBACLnB,GAAKoB,EAAAA;AACP,qBAAA;;oBAGA,MAAM,EAAEnB,SAAS,EAAE,GAAGC,gBAAgB,GAAGrD,MAAAA,CAAOc,UAAU,IAAI,EAAC;AAE/D,oBAAA,MAAM2D,UAAanB,GAAAA,GAAAA,CAAIC,IAAI,CAACiB,cAAc7C,MAAQ,EAAA;AAChDlB,wBAAAA,SAAAA;wBACA+C,WAAa,EAAA,IAAA;AACb,wBAAA,GAAGH;AACL,qBAAA,CAAA;oBAEA,IAAI3E,iBAAAA;oBACJ,IAAI2F,KAAAA,CAAM3F,iBAAiB,EAAE;wBAC3BA,iBACE,GAAA,OAAO2F,KAAM3F,CAAAA,iBAAiB,KAAK,QAAA,GAC/B2F,KAAM3F,CAAAA,iBAAiB,GACvB2F,KAAAA,CAAM3F,iBAAiB,CAAC+E,WAAW,EAAA;qBACpC,MAAA;wBACL/E,iBAAoB,GAAA,IAAIE,IAAK,CAAA,CAAA,CAAA,CAAG6E,WAAW,EAAA;AAC7C;oBAEA,OAAO;wBACL/D,KAAO+E,EAAAA,UAAAA;AACPxG,wBAAAA,SAAAA,EAAWoG,MAAMpG,SAAS;AAC1BS,wBAAAA,iBAAAA;wBACAoD,IAAMuC,EAAAA,KAAAA,CAAMvC,IAAI,IAAI;AACtB,qBAAA;AACF;AACF;YAEA,MAAMQ,GAAAA,GAAM1D,KAAK0D,GAAG,EAAA;YACpB,MAAMT,SAAAA,GAAYuC,OAAQtC,CAAAA,IAAI,IAAI,SAAA;AAClC,YAAA,MAAME,eACJH,SAAc,KAAA,SAAA,GAAY7B,OAAOiC,wBAAwB,GAAGjC,OAAOkC,mBAAmB;;AAGxF,YAAA,IAAIkC,OAAQtB,CAAAA,SAAS,IAAIR,GAAAA,GAAM,IAAI1D,IAAAA,CAAKwF,OAAQtB,CAAAA,SAAS,CAAEC,CAAAA,OAAO,EAAKf,GAAAA,YAAAA,GAAe,IAAM,EAAA;gBAC1F,OAAO;oBAAE+B,KAAO,EAAA;AAAsB,iBAAA;AACxC;;YAGA,MAAMW,QAAAA,GAAWN,OAAQ1F,CAAAA,iBAAiB,GACtC,IAAIE,KAAKwF,OAAQ1F,CAAAA,iBAAiB,CAAEqE,CAAAA,OAAO,EAC3CT,GAAAA,GAAAA;AACJ,YAAA,IAAIoC,YAAYpC,GAAK,EAAA;gBACnB,OAAO;oBAAEyB,KAAO,EAAA;AAAqB,iBAAA;AACvC;;YAGA,MAAMY,cAAAA,GAAiB,IAAI,CAAC1D,iBAAiB,EAAA;AAC7C,YAAA,MAAM2D,cAAiB,GAAA,IAAIhG,IAAK0D,CAAAA,GAAAA,GAAMN,YAAe,GAAA,IAAA,CAAA;AAErD,YAAA,MAAM6C,cAAc,MAAM,IAAI,CAACrD,QAAQ,CAAC/D,MAAM,CAAC;AAC7CsB,gBAAAA,MAAAA,EAAQqF,QAAQrF,MAAM;gBACtBd,SAAW0G,EAAAA,cAAAA;gBACX,GAAIP,OAAAA,CAAQnF,QAAQ,IAAI;AAAEA,oBAAAA,QAAAA,EAAUmF,QAAQnF;iBAAU;AACtDD,gBAAAA,MAAAA,EAAQoF,QAAQpF,MAAM;gBACtByD,OAAS,EAAA,IAAA;gBACTX,IAAMD,EAAAA,SAAAA;gBACNa,MAAQ,EAAA,QAAA;gBACRH,SAAWqC,EAAAA,cAAAA;AACXlG,gBAAAA,iBAAAA,EAAmB0F,OAAQ1F,CAAAA,iBAAiB,IAAI,IAAIE,IAAK8F,CAAAA,QAAAA;AAC3D,aAAA,CAAA;AAEA,YAAA,MAAMJ,QAAW1B,GAAAA,IAAAA,CAAKC,KAAK,CAAC,IAAIjE,IAAAA,CAAKiG,WAAY/B,CAAAA,SAAS,IAAI,IAAIlE,IAAQmE,EAAAA,CAAAA,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;YACtF,MAAMwB,QAAAA,GAAW3B,IAAKC,CAAAA,KAAK,CAAC,IAAIjE,KAAKiG,WAAYtC,CAAAA,SAAS,CAAEQ,CAAAA,OAAO,EAAK,GAAA,IAAA,CAAA;AACxE,YAAA,MAAM+B,UAAkC,GAAA;AACtC/F,gBAAAA,MAAAA,EAAQqF,QAAQrF,MAAM;gBACtBd,SAAW0G,EAAAA,cAAAA;gBACX7C,IAAM,EAAA,SAAA;gBACNoB,GAAKoB,EAAAA,QAAAA;gBACLnB,GAAKoB,EAAAA;AACP,aAAA;;YAEA,MAAM,EAAEnB,SAAS,EAAE,GAAGC,gBAAgB,GAAGrD,MAAAA,CAAOc,UAAU,IAAI,EAAC;AAE/D,YAAA,MAAM2D,UAAanB,GAAAA,GAAAA,CAAIC,IAAI,CAACuB,YAAYnD,MAAQ,EAAA;AAC9ClB,gBAAAA,SAAAA;gBACA+C,WAAa,EAAA,IAAA;AACb,gBAAA,GAAGH;AACL,aAAA,CAAA;YAEA,MAAM,IAAI,CAAC7B,QAAQ,CAACpD,iBAAiB,CAACgG,OAAAA,CAAQnG,SAAS,EAAE;gBACvDyE,MAAQ,EAAA,SAAA;gBACRD,OAASkC,EAAAA;AACX,aAAA,CAAA;YAEA,IAAIjG,iBAAAA;YACJ,IAAImG,WAAAA,CAAYnG,iBAAiB,EAAE;gBACjCA,iBACE,GAAA,OAAOmG,WAAYnG,CAAAA,iBAAiB,KAAK,QAAA,GACrCmG,WAAYnG,CAAAA,iBAAiB,GAC7BmG,WAAAA,CAAYnG,iBAAiB,CAAC+E,WAAW,EAAA;aAC1C,MAAA;gBACL/E,iBAAoB,GAAA,IAAIE,IAAK8F,CAAAA,QAAAA,CAAAA,CAAUjB,WAAW,EAAA;AACpD;YAEA,OAAO;gBACL/D,KAAO+E,EAAAA,UAAAA;gBACPxG,SAAW0G,EAAAA,cAAAA;AACXjG,gBAAAA,iBAAAA;gBACAoD,IAAMD,EAAAA;AACR,aAAA;AACF,SAAA,CAAE,OAAM;YACN,OAAO;gBAAEkC,KAAO,EAAA;AAAwB,aAAA;AAC1C;AACF;AAEA;;;AAGC,MACD,MAAMlE,eAAAA,CAAgB5B,SAAiB,EAAEe,MAAc,EAAoB;AACzE,QAAA,MAAMtB,UAAU,MAAM,IAAI,CAAC8D,QAAQ,CAACxD,eAAe,CAACC,SAAAA,CAAAA;AACpD,QAAA,IAAI,CAACP,OAAS,EAAA;YACZ,OAAO,KAAA;AACT;QAEA,IAAIA,OAAAA,CAAQsB,MAAM,KAAKA,MAAQ,EAAA;YAC7B,OAAO,KAAA;AACT;AAEA,QAAA,IAAI,IAAIJ,IAAKlB,CAAAA,OAAAA,CAAQ6E,SAAS,CAAA,IAAK,IAAI3D,IAAQ,EAAA,EAAA;;AAE7C,YAAA,MAAM,IAAI,CAAC4C,QAAQ,CAAClD,iBAAiB,CAACL,SAAAA,CAAAA;YAEtC,OAAO,KAAA;AACT;QAEA,OAAO,IAAA;AACT;AAzdA,IAAA,WAAA,CAAYuD,QAAyB,CAAE;;AAP/BvB,QAAAA,IAAAA,CAAAA,aAAAA,GAAmD,IAAI8E,GAAAA,EAAAA;;aAGvDzD,wBAAmC,GAAA,CAAA;aAE1BC,iBAA4B,GAAA,EAAA;QAG3C,IAAI,CAACC,QAAQ,GAAGA,QAAAA;AAClB;AAwdF;AAEMwD,MAAAA,sBAAAA,GAAyB,CAACpH,EAAcE,EAAAA,WAAAA,GAAAA;IAC5C,OAAO,IAAIN,wBAAwBI,EAAIE,EAAAA,WAAAA,CAAAA;AACzC;AAEA,MAAMmH,oBAAuB,GAAA,CAAC,EAC5BrH,EAAE,EAGH,GAAA;IACC,MAAM4D,QAAAA,GAAWwD,uBAAuBpH,EAAI,EAAA,gBAAA,CAAA;IAC5C,MAAMyB,cAAAA,GAAiB,IAAIS,cAAe0B,CAAAA,QAAAA,CAAAA;;AAG1C,IAAA,MAAM0D,YAAY,CAAClG,MAAAA,GAAAA;AACjB,QAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAU,EAAA;AACzC,YAAA,MAAM,IAAIwB,KACR,CAAA,6EAAA,CAAA;AAEJ;QACA,OAAO,IAAItB,qBAAqBG,cAAgBL,EAAAA,MAAAA,CAAAA;AAClD,KAAA;;AAGA,IAAA,MAAMmG,GAAMD,GAAAA,SAAAA;AACZC,IAAAA,GAAAA,CAAIlE,iBAAiB,GAAG5B,cAAAA,CAAe4B,iBAAiB,CAACmE,IAAI,CAAC/F,cAAAA,CAAAA;AAC9D8F,IAAAA,GAAAA,CAAIpF,YAAY,GAAGV,cAAAA,CAAeU,YAAY,CAACqF,IAAI,CAAC/F,cAAAA,CAAAA;AACpD8F,IAAAA,GAAAA,CAAIhF,SAAS,GAAGd,cAAAA,CAAec,SAAS,CAACiF,IAAI,CAAC/F,cAAAA,CAAAA;;;IAI9CgG,MAAOC,CAAAA,cAAc,CAACH,GAAAA,EAAK,kBAAoB,EAAA;AAC7C5E,QAAAA,GAAAA,CAAAA,GAAAA;AACE,YAAA,OAAOlB,eAAeoC,gBAAgB;AACxC,SAAA;QACA8D,UAAY,EAAA;AACd,KAAA,CAAA;IAEA,OAAOJ,GAAAA;AACT;;;;"}

package/dist/services/webhook-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-runner.js","sources":["../../src/services/webhook-runner.ts"],"sourcesContent":["/**\n * The event hub is Strapi's event control center.\n */\n\nimport createdDebugger from 'debug';\nimport _ from 'lodash';\nimport type { Logger } from '@strapi/logger';\n\nimport type { Modules } from '@strapi/types';\nimport WorkerQueue from './worker-queue';\nimport type { EventHub } from './event-hub';\nimport type { Fetch } from '../utils/fetch';\n\ntype Webhook = Modules.WebhookStore.Webhook;\n\ninterface Config {\n  defaultHeaders: Record<string, string>;\n}\n\ninterface ConstructorParameters {\n  eventHub: EventHub;\n  logger: Logger;\n  configuration?: Record<string, unknown>;\n  fetch: Fetch;\n}\n\ninterface Event {\n  event: string;\n  info: Record<string, unknown>;\n}\n\ntype Listener = (info: Record<string, unknown>) => Promise<void>;\n\nconst debug = createdDebugger('strapi:webhook');\n\nconst defaultConfiguration: Config = {\n  defaultHeaders: {},\n};\n\nclass WebhookRunner {\n  private eventHub: EventHub;\n\n  private logger: Logger;\n\n  private config: Config;\n\n  private webhooksMap: Map<string, Webhook[]> = new Map();\n\n  private listeners: Map<string, Listener> = new Map();\n\n  private queue: WorkerQueue<Event, void>;\n\n  private fetch: Fetch;\n\n  constructor({ eventHub, logger, configuration = {}, fetch }: ConstructorParameters) {\n    debug('Initialized webhook runner');\n    this.eventHub = eventHub;\n    this.logger = logger;\n    this.fetch = fetch;\n\n    if (typeof configuration !== 'object') {\n      throw new Error(\n        'Invalid configuration provided to the webhookRunner.\\nCheck your server.json -> webhooks configuration'\n      );\n    }\n\n    this.config = _.merge(defaultConfiguration, configuration);\n\n    this.queue = new WorkerQueue({ logger, concurrency: 5 });\n\n    this.queue.subscribe(this.executeListener.bind(this));\n  }\n\n  deleteListener(event: string) {\n    debug(`Deleting listener for event '${event}'`);\n\n    const fn = this.listeners.get(event);\n\n    if (fn !== undefined) {\n      this.eventHub.off(event, fn);\n      this.listeners.delete(event);\n    }\n  }\n\n  createListener(event: string) {\n    debug(`Creating listener for event '${event}'`);\n    if (this.listeners.has(event)) {\n      this.logger.error(\n        `The webhook runner is already listening for the event '${event}'. Did you mean to call .register() ?`\n      );\n    }\n\n    const listen = async (info: Event['info']) => {\n      this.queue.enqueue({ event, info });\n    };\n\n    this.listeners.set(event, listen);\n    this.eventHub.on(event, listen);\n  }\n\n  async executeListener({ event, info }: Event) {\n    debug(`Executing webhook for event '${event}'`);\n    const webhooks = this.webhooksMap.get(event) || [];\n    const activeWebhooks = webhooks.filter((webhook) => webhook.isEnabled === true);\n\n    for (const webhook of activeWebhooks) {\n      await this.run(webhook, event, info).catch((error: unknown) => {\n        this.logger.error('Error running webhook');\n        this.logger.error(error);\n      });\n    }\n  }\n\n  run(webhook: Webhook, event: string, info = {}) {\n    const { url, headers } = webhook;\n\n    return this.fetch(url, {\n      method: 'post',\n      body: JSON.stringify({\n        event,\n        createdAt: new Date(),\n        ...info,\n      }),\n      headers: {\n        ...this.config.defaultHeaders,\n        ...headers,\n        'X-Strapi-Event': event,\n        'Content-Type': 'application/json',\n      },\n      signal: AbortSignal.timeout(10000),\n    })\n      .then(async (res) => {\n        if (res.ok) {\n          return {\n            statusCode: res.status,\n          };\n        }\n\n        return {\n          statusCode: res.status,\n          message: await res.text(),\n        };\n      })\n      .catch((err) => {\n        return {\n          statusCode: 500,\n          message: err.message,\n        };\n      });\n  }\n\n  add(webhook: Webhook) {\n    debug(`Registering webhook '${webhook.id}'`);\n    const { events } = webhook;\n\n    events.forEach((event) => {\n      if (this.webhooksMap.has(event)) {\n        this.webhooksMap.get(event)?.push(webhook);\n      } else {\n        this.webhooksMap.set(event, [webhook]);\n        this.createListener(event);\n      }\n    });\n  }\n\n  update(webhook: Webhook) {\n    debug(`Refreshing webhook '${webhook.id}'`);\n    this.remove(webhook);\n    this.add(webhook);\n  }\n\n  remove(webhook: Webhook) {\n    debug(`Unregistering webhook '${webhook.id}'`);\n\n    this.webhooksMap.forEach((webhooks, event) => {\n      const filteredWebhooks = webhooks.filter((value) => value.id !== webhook.id);\n\n      // Cleanup hanging listeners\n      if (filteredWebhooks.length === 0) {\n        this.webhooksMap.delete(event);\n        this.deleteListener(event);\n      } else {\n        this.webhooksMap.set(event, filteredWebhooks);\n      }\n    });\n  }\n}\n\n/**\n * Expose a factory function instead of the class\n */\nexport default function createWebhookRunner(opts: ConstructorParameters): WebhookRunner {\n  return new WebhookRunner(opts);\n}\n\nexport type { WebhookRunner };\n"],"names":["debug","createdDebugger","defaultConfiguration","defaultHeaders","WebhookRunner","deleteListener","event","fn","listeners","get","undefined","eventHub","off","delete","createListener","has","logger","error","listen","info","queue","enqueue","set","on","executeListener","webhooks","webhooksMap","activeWebhooks","filter","webhook","isEnabled","run","catch","url","headers","fetch","method","body","JSON","stringify","createdAt","Date","config","signal","AbortSignal","timeout","then","res","ok","statusCode","status","message","text","err","add","id","events","forEach","push","update","remove","filteredWebhooks","value","length","constructor","configuration","Map","Error","_","merge","WorkerQueue","concurrency","subscribe","bind","createWebhookRunner","opts"],"mappings":";;;;;;AAiCA,MAAMA,QAAQC,cAAgB,CAAA,gBAAA,CAAA;AAE9B,MAAMC,oBAA+B,GAAA;AACnCC,IAAAA,cAAAA,EAAgB;AAClB,CAAA;AAEA,MAAMC,aAAAA,CAAAA;AAkCJC,IAAAA,cAAAA,CAAeC,KAAa,EAAE;AAC5BN,QAAAA,KAAAA,CAAM,CAAC,6BAA6B,EAAEM,KAAAA,CAAM,CAAC,CAAC,CAAA;AAE9C,QAAA,MAAMC,KAAK,IAAI,CAACC,SAAS,CAACC,GAAG,CAACH,KAAAA,CAAAA;AAE9B,QAAA,IAAIC,OAAOG,SAAW,EAAA;AACpB,YAAA,IAAI,CAACC,QAAQ,CAACC,GAAG,CAACN,KAAOC,EAAAA,EAAAA,CAAAA;AACzB,YAAA,IAAI,CAACC,SAAS,CAACK,MAAM,CAACP,KAAAA,CAAAA;AACxB;AACF;AAEAQ,IAAAA,cAAAA,CAAeR,KAAa,EAAE;AAC5BN,QAAAA,KAAAA,CAAM,CAAC,6BAA6B,EAAEM,KAAAA,CAAM,CAAC,CAAC,CAAA;AAC9C,QAAA,IAAI,IAAI,CAACE,SAAS,CAACO,GAAG,CAACT,KAAQ,CAAA,EAAA;YAC7B,IAAI,CAACU,MAAM,CAACC,KAAK,CACf,CAAC,uDAAuD,EAAEX,KAAM,CAAA,qCAAqC,CAAC,CAAA;AAE1G;AAEA,QAAA,MAAMY,SAAS,OAAOC,IAAAA,GAAAA;AACpB,YAAA,IAAI,CAACC,KAAK,CAACC,OAAO,CAAC;AAAEf,gBAAAA,KAAAA;AAAOa,gBAAAA;AAAK,aAAA,CAAA;AACnC,SAAA;AAEA,QAAA,IAAI,CAACX,SAAS,CAACc,GAAG,CAAChB,KAAOY,EAAAA,MAAAA,CAAAA;AAC1B,QAAA,IAAI,CAACP,QAAQ,CAACY,EAAE,CAACjB,KAAOY,EAAAA,MAAAA,CAAAA;AAC1B;AAEA,IAAA,MAAMM,gBAAgB,EAAElB,KAAK,EAAEa,IAAI,EAAS,EAAE;AAC5CnB,QAAAA,KAAAA,CAAM,CAAC,6BAA6B,EAAEM,KAAAA,CAAM,CAAC,CAAC,CAAA;QAC9C,MAAMmB,QAAAA,GAAW,IAAI,CAACC,WAAW,CAACjB,GAAG,CAACH,UAAU,EAAE;QAClD,MAAMqB,cAAAA,GAAiBF,SAASG,MAAM,CAAC,CAACC,OAAYA,GAAAA,OAAAA,CAAQC,SAAS,KAAK,IAAA,CAAA;QAE1E,KAAK,MAAMD,WAAWF,cAAgB,CAAA;YACpC,MAAM,IAAI,CAACI,GAAG,CAACF,SAASvB,KAAOa,EAAAA,IAAAA,CAAAA,CAAMa,KAAK,CAAC,CAACf,KAAAA,GAAAA;AAC1C,gBAAA,IAAI,CAACD,MAAM,CAACC,KAAK,CAAC,uBAAA,CAAA;AAClB,gBAAA,IAAI,CAACD,MAAM,CAACC,KAAK,CAACA,KAAAA,CAAAA;AACpB,aAAA,CAAA;AACF;AACF;AAEAc,IAAAA,GAAAA,CAAIF,OAAgB,EAAEvB,KAAa,EAAEa,IAAO,GAAA,EAAE,EAAE;AAC9C,QAAA,MAAM,EAAEc,GAAG,EAAEC,OAAO,EAAE,GAAGL,OAAAA;AAEzB,QAAA,OAAO,IAAI,CAACM,KAAK,CAACF,GAAK,EAAA;YACrBG,MAAQ,EAAA,MAAA;YACRC,IAAMC,EAAAA,IAAAA,CAAKC,SAAS,CAAC;AACnBjC,gBAAAA,KAAAA;AACAkC,gBAAAA,SAAAA,EAAW,IAAIC,IAAAA,EAAAA;AACf,gBAAA,GAAGtB;AACL,aAAA,CAAA;YACAe,OAAS,EAAA;AACP,gBAAA,GAAG,IAAI,CAACQ,MAAM,CAACvC,cAAc;AAC7B,gBAAA,GAAG+B,OAAO;gBACV,gBAAkB5B,EAAAA,KAAAA;gBAClB,cAAgB,EAAA;AAClB,aAAA;YACAqC,MAAQC,EAAAA,WAAAA,CAAYC,OAAO,CAAC,KAAA;SAE3BC,CAAAA,CAAAA,IAAI,CAAC,OAAOC,GAAAA,GAAAA;YACX,IAAIA,GAAAA,CAAIC,EAAE,EAAE;gBACV,OAAO;AACLC,oBAAAA,UAAAA,EAAYF,IAAIG;AAClB,iBAAA;AACF;YAEA,OAAO;AACLD,gBAAAA,UAAAA,EAAYF,IAAIG,MAAM;gBACtBC,OAAS,EAAA,MAAMJ,IAAIK,IAAI;AACzB,aAAA;SAEDpB,CAAAA,CAAAA,KAAK,CAAC,CAACqB,GAAAA,GAAAA;YACN,OAAO;gBACLJ,UAAY,EAAA,GAAA;AACZE,gBAAAA,OAAAA,EAASE,IAAIF;AACf,aAAA;AACF,SAAA,CAAA;AACJ;AAEAG,IAAAA,GAAAA,CAAIzB,OAAgB,EAAE;AACpB7B,QAAAA,KAAAA,CAAM,CAAC,qBAAqB,EAAE6B,QAAQ0B,EAAE,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,EAAEC,MAAM,EAAE,GAAG3B,OAAAA;QAEnB2B,MAAOC,CAAAA,OAAO,CAAC,CAACnD,KAAAA,GAAAA;AACd,YAAA,IAAI,IAAI,CAACoB,WAAW,CAACX,GAAG,CAACT,KAAQ,CAAA,EAAA;AAC/B,gBAAA,IAAI,CAACoB,WAAW,CAACjB,GAAG,CAACH,QAAQoD,IAAK7B,CAAAA,OAAAA,CAAAA;aAC7B,MAAA;AACL,gBAAA,IAAI,CAACH,WAAW,CAACJ,GAAG,CAAChB,KAAO,EAAA;AAACuB,oBAAAA;AAAQ,iBAAA,CAAA;gBACrC,IAAI,CAACf,cAAc,CAACR,KAAAA,CAAAA;AACtB;AACF,SAAA,CAAA;AACF;AAEAqD,IAAAA,MAAAA,CAAO9B,OAAgB,EAAE;AACvB7B,QAAAA,KAAAA,CAAM,CAAC,oBAAoB,EAAE6B,QAAQ0B,EAAE,CAAC,CAAC,CAAC,CAAA;QAC1C,IAAI,CAACK,MAAM,CAAC/B,OAAAA,CAAAA;QACZ,IAAI,CAACyB,GAAG,CAACzB,OAAAA,CAAAA;AACX;AAEA+B,IAAAA,MAAAA,CAAO/B,OAAgB,EAAE;AACvB7B,QAAAA,KAAAA,CAAM,CAAC,uBAAuB,EAAE6B,QAAQ0B,EAAE,CAAC,CAAC,CAAC,CAAA;AAE7C,QAAA,IAAI,CAAC7B,WAAW,CAAC+B,OAAO,CAAC,CAAChC,QAAUnB,EAAAA,KAAAA,GAAAA;YAClC,MAAMuD,gBAAAA,GAAmBpC,QAASG,CAAAA,MAAM,CAAC,CAACkC,QAAUA,KAAMP,CAAAA,EAAE,KAAK1B,OAAAA,CAAQ0B,EAAE,CAAA;;YAG3E,IAAIM,gBAAAA,CAAiBE,MAAM,KAAK,CAAG,EAAA;AACjC,gBAAA,IAAI,CAACrC,WAAW,CAACb,MAAM,CAACP,KAAAA,CAAAA;gBACxB,IAAI,CAACD,cAAc,CAACC,KAAAA,CAAAA;aACf,MAAA;AACL,gBAAA,IAAI,CAACoB,WAAW,CAACJ,GAAG,CAAChB,KAAOuD,EAAAA,gBAAAA,CAAAA;AAC9B;AACF,SAAA,CAAA;AACF;IAnIAG,WAAY,CAAA,EAAErD,QAAQ,EAAEK,MAAM,EAAEiD,aAAgB,GAAA,EAAE,EAAE9B,KAAK,EAAyB,CAAE;AAR5ET,QAAAA,IAAAA,CAAAA,WAAAA,GAAsC,IAAIwC,GAAAA,EAAAA;AAE1C1D,QAAAA,IAAAA,CAAAA,SAAAA,GAAmC,IAAI0D,GAAAA,EAAAA;QAO7ClE,KAAM,CAAA,4BAAA,CAAA;QACN,IAAI,CAACW,QAAQ,GAAGA,QAAAA;QAChB,IAAI,CAACK,MAAM,GAAGA,MAAAA;QACd,IAAI,CAACmB,KAAK,GAAGA,KAAAA;QAEb,IAAI,OAAO8B,kBAAkB,QAAU,EAAA;AACrC,YAAA,MAAM,IAAIE,KACR,CAAA,wGAAA,CAAA;AAEJ;AAEA,QAAA,IAAI,CAACzB,MAAM,GAAG0B,CAAEC,CAAAA,KAAK,CAACnE,oBAAsB+D,EAAAA,aAAAA,CAAAA;AAE5C,QAAA,IAAI,CAAC7C,KAAK,GAAG,IAAIkD,WAAY,CAAA;AAAEtD,YAAAA,MAAAA;YAAQuD,WAAa,EAAA;AAAE,SAAA,CAAA;QAEtD,IAAI,CAACnD,KAAK,CAACoD,SAAS,CAAC,IAAI,CAAChD,eAAe,CAACiD,IAAI,CAAC,IAAI,CAAA,CAAA;AACrD;AAmHF;AAEA;;IAGe,SAASC,mBAAAA,CAAoBC,IAA2B,EAAA;AACrE,IAAA,OAAO,IAAIvE,aAAcuE,CAAAA,IAAAA,CAAAA;AAC3B;;;;"}
+{"version":3,"file":"webhook-runner.js","sources":["../../src/services/webhook-runner.ts"],"sourcesContent":["/**\n * The event hub is Strapi's event control center.\n */\n\nimport createdDebugger from 'debug';\nimport _ from 'lodash';\nimport type { Logger } from '@strapi/logger';\n\nimport type { Modules } from '@strapi/types';\nimport WorkerQueue from './worker-queue';\nimport type { EventHub } from './event-hub';\nimport type { Fetch } from '../utils/fetch';\n\ntype Webhook = Modules.WebhookStore.Webhook;\n\ninterface Config {\n  defaultHeaders: Record<string, string>;\n}\n\ninterface ConstructorParameters {\n  eventHub: EventHub;\n  logger: Logger;\n  configuration?: Record<string, unknown>;\n  fetch: Fetch;\n}\n\ninterface Event {\n  event: string;\n  info: Record<string, unknown>;\n}\n\ntype Listener = (info: Record<string, unknown>) => Promise<void>;\n\nconst debug = createdDebugger('strapi:webhook');\n\nconst defaultConfiguration: Config = {\n  defaultHeaders: {},\n};\n\nclass WebhookRunner {\n  private eventHub: EventHub;\n\n  private logger: Logger;\n\n  private config: Config;\n\n  private webhooksMap: Map<string, Webhook[]> = new Map();\n\n  private listeners: Map<string, Listener> = new Map();\n\n  private queue: WorkerQueue<Event, void>;\n\n  private fetch: Fetch;\n\n  constructor({ eventHub, logger, configuration = {}, fetch }: ConstructorParameters) {\n    debug('Initialized webhook runner');\n    this.eventHub = eventHub;\n    this.logger = logger;\n    this.fetch = fetch;\n\n    if (typeof configuration !== 'object') {\n      throw new Error(\n        'Invalid configuration provided to the webhookRunner.\\nCheck your server.json -> webhooks configuration'\n      );\n    }\n\n    this.config = _.merge(defaultConfiguration, configuration);\n\n    this.queue = new WorkerQueue({ logger, concurrency: 5 });\n\n    this.queue.subscribe(this.executeListener.bind(this));\n  }\n\n  deleteListener(event: string) {\n    debug(`Deleting listener for event '${event}'`);\n\n    const fn = this.listeners.get(event);\n\n    if (fn !== undefined) {\n      this.eventHub.off(event, fn);\n      this.listeners.delete(event);\n    }\n  }\n\n  createListener(event: string) {\n    debug(`Creating listener for event '${event}'`);\n    if (this.listeners.has(event)) {\n      this.logger.error(\n        `The webhook runner is already listening for the event '${event}'. Did you mean to call .register() ?`\n      );\n    }\n\n    const listen = async (info: Event['info']) => {\n      this.queue.enqueue({ event, info });\n    };\n\n    this.listeners.set(event, listen);\n    this.eventHub.on(event, listen);\n  }\n\n  async executeListener({ event, info }: Event) {\n    debug(`Executing webhook for event '${event}'`);\n    const webhooks = this.webhooksMap.get(event) || [];\n    const activeWebhooks = webhooks.filter((webhook) => webhook.isEnabled === true);\n\n    for (const webhook of activeWebhooks) {\n      await this.run(webhook, event, info).catch((error: unknown) => {\n        this.logger.error('Error running webhook');\n        this.logger.error(error);\n      });\n    }\n  }\n\n  run(webhook: Webhook, event: string, info = {}) {\n    const { url, headers } = webhook;\n\n    return this.fetch(url, {\n      method: 'post',\n      body: JSON.stringify({\n        event,\n        createdAt: new Date(),\n        ...info,\n      }),\n      headers: {\n        ...this.config.defaultHeaders,\n        ...headers,\n        'X-Strapi-Event': event,\n        'Content-Type': 'application/json',\n      },\n      signal: AbortSignal.timeout(10000),\n    })\n      .then(async (res) => {\n        if (res.ok) {\n          return {\n            statusCode: res.status,\n          };\n        }\n\n        return {\n          statusCode: res.status,\n          message: await res.text(),\n        };\n      })\n      .catch((err) => {\n        return {\n          statusCode: 500,\n          message: err.message,\n        };\n      });\n  }\n\n  add(webhook: Webhook) {\n    debug(`Registering webhook '${webhook.id}'`);\n    const { events } = webhook;\n\n    events.forEach((event) => {\n      if (this.webhooksMap.has(event)) {\n        this.webhooksMap.get(event)?.push(webhook);\n      } else {\n        this.webhooksMap.set(event, [webhook]);\n        this.createListener(event);\n      }\n    });\n  }\n\n  update(webhook: Webhook) {\n    debug(`Refreshing webhook '${webhook.id}'`);\n    this.remove(webhook);\n    this.add(webhook);\n  }\n\n  remove(webhook: Webhook) {\n    debug(`Unregistering webhook '${webhook.id}'`);\n\n    this.webhooksMap.forEach((webhooks, event) => {\n      const filteredWebhooks = webhooks.filter((value) => value.id !== webhook.id);\n\n      // Cleanup hanging listeners\n      if (filteredWebhooks.length === 0) {\n        this.webhooksMap.delete(event);\n        this.deleteListener(event);\n      } else {\n        this.webhooksMap.set(event, filteredWebhooks);\n      }\n    });\n  }\n}\n\n/**\n * Expose a factory function instead of the class\n */\nexport default function createWebhookRunner(opts: ConstructorParameters): WebhookRunner {\n  return new WebhookRunner(opts);\n}\n\nexport type { WebhookRunner };\n"],"names":["debug","createdDebugger","defaultConfiguration","defaultHeaders","WebhookRunner","deleteListener","event","fn","listeners","get","undefined","eventHub","off","delete","createListener","has","logger","error","listen","info","queue","enqueue","set","on","executeListener","webhooks","webhooksMap","activeWebhooks","filter","webhook","isEnabled","run","catch","url","headers","fetch","method","body","JSON","stringify","createdAt","Date","config","signal","AbortSignal","timeout","then","res","ok","statusCode","status","message","text","err","add","id","events","forEach","push","update","remove","filteredWebhooks","value","length","configuration","Map","Error","_","merge","WorkerQueue","concurrency","subscribe","bind","createWebhookRunner","opts"],"mappings":";;;;;;AAiCA,MAAMA,QAAQC,cAAgB,CAAA,gBAAA,CAAA;AAE9B,MAAMC,oBAA+B,GAAA;AACnCC,IAAAA,cAAAA,EAAgB;AAClB,CAAA;AAEA,MAAMC,aAAAA,CAAAA;AAkCJC,IAAAA,cAAAA,CAAeC,KAAa,EAAE;AAC5BN,QAAAA,KAAAA,CAAM,CAAC,6BAA6B,EAAEM,KAAAA,CAAM,CAAC,CAAC,CAAA;AAE9C,QAAA,MAAMC,KAAK,IAAI,CAACC,SAAS,CAACC,GAAG,CAACH,KAAAA,CAAAA;AAE9B,QAAA,IAAIC,OAAOG,SAAW,EAAA;AACpB,YAAA,IAAI,CAACC,QAAQ,CAACC,GAAG,CAACN,KAAOC,EAAAA,EAAAA,CAAAA;AACzB,YAAA,IAAI,CAACC,SAAS,CAACK,MAAM,CAACP,KAAAA,CAAAA;AACxB;AACF;AAEAQ,IAAAA,cAAAA,CAAeR,KAAa,EAAE;AAC5BN,QAAAA,KAAAA,CAAM,CAAC,6BAA6B,EAAEM,KAAAA,CAAM,CAAC,CAAC,CAAA;AAC9C,QAAA,IAAI,IAAI,CAACE,SAAS,CAACO,GAAG,CAACT,KAAQ,CAAA,EAAA;YAC7B,IAAI,CAACU,MAAM,CAACC,KAAK,CACf,CAAC,uDAAuD,EAAEX,KAAM,CAAA,qCAAqC,CAAC,CAAA;AAE1G;AAEA,QAAA,MAAMY,SAAS,OAAOC,IAAAA,GAAAA;AACpB,YAAA,IAAI,CAACC,KAAK,CAACC,OAAO,CAAC;AAAEf,gBAAAA,KAAAA;AAAOa,gBAAAA;AAAK,aAAA,CAAA;AACnC,SAAA;AAEA,QAAA,IAAI,CAACX,SAAS,CAACc,GAAG,CAAChB,KAAOY,EAAAA,MAAAA,CAAAA;AAC1B,QAAA,IAAI,CAACP,QAAQ,CAACY,EAAE,CAACjB,KAAOY,EAAAA,MAAAA,CAAAA;AAC1B;AAEA,IAAA,MAAMM,gBAAgB,EAAElB,KAAK,EAAEa,IAAI,EAAS,EAAE;AAC5CnB,QAAAA,KAAAA,CAAM,CAAC,6BAA6B,EAAEM,KAAAA,CAAM,CAAC,CAAC,CAAA;QAC9C,MAAMmB,QAAAA,GAAW,IAAI,CAACC,WAAW,CAACjB,GAAG,CAACH,UAAU,EAAE;QAClD,MAAMqB,cAAAA,GAAiBF,SAASG,MAAM,CAAC,CAACC,OAAYA,GAAAA,OAAAA,CAAQC,SAAS,KAAK,IAAA,CAAA;QAE1E,KAAK,MAAMD,WAAWF,cAAgB,CAAA;YACpC,MAAM,IAAI,CAACI,GAAG,CAACF,SAASvB,KAAOa,EAAAA,IAAAA,CAAAA,CAAMa,KAAK,CAAC,CAACf,KAAAA,GAAAA;AAC1C,gBAAA,IAAI,CAACD,MAAM,CAACC,KAAK,CAAC,uBAAA,CAAA;AAClB,gBAAA,IAAI,CAACD,MAAM,CAACC,KAAK,CAACA,KAAAA,CAAAA;AACpB,aAAA,CAAA;AACF;AACF;AAEAc,IAAAA,GAAAA,CAAIF,OAAgB,EAAEvB,KAAa,EAAEa,IAAO,GAAA,EAAE,EAAE;AAC9C,QAAA,MAAM,EAAEc,GAAG,EAAEC,OAAO,EAAE,GAAGL,OAAAA;AAEzB,QAAA,OAAO,IAAI,CAACM,KAAK,CAACF,GAAK,EAAA;YACrBG,MAAQ,EAAA,MAAA;YACRC,IAAMC,EAAAA,IAAAA,CAAKC,SAAS,CAAC;AACnBjC,gBAAAA,KAAAA;AACAkC,gBAAAA,SAAAA,EAAW,IAAIC,IAAAA,EAAAA;AACf,gBAAA,GAAGtB;AACL,aAAA,CAAA;YACAe,OAAS,EAAA;AACP,gBAAA,GAAG,IAAI,CAACQ,MAAM,CAACvC,cAAc;AAC7B,gBAAA,GAAG+B,OAAO;gBACV,gBAAkB5B,EAAAA,KAAAA;gBAClB,cAAgB,EAAA;AAClB,aAAA;YACAqC,MAAQC,EAAAA,WAAAA,CAAYC,OAAO,CAAC,KAAA;SAE3BC,CAAAA,CAAAA,IAAI,CAAC,OAAOC,GAAAA,GAAAA;YACX,IAAIA,GAAAA,CAAIC,EAAE,EAAE;gBACV,OAAO;AACLC,oBAAAA,UAAAA,EAAYF,IAAIG;AAClB,iBAAA;AACF;YAEA,OAAO;AACLD,gBAAAA,UAAAA,EAAYF,IAAIG,MAAM;gBACtBC,OAAS,EAAA,MAAMJ,IAAIK,IAAI;AACzB,aAAA;SAEDpB,CAAAA,CAAAA,KAAK,CAAC,CAACqB,GAAAA,GAAAA;YACN,OAAO;gBACLJ,UAAY,EAAA,GAAA;AACZE,gBAAAA,OAAAA,EAASE,IAAIF;AACf,aAAA;AACF,SAAA,CAAA;AACJ;AAEAG,IAAAA,GAAAA,CAAIzB,OAAgB,EAAE;AACpB7B,QAAAA,KAAAA,CAAM,CAAC,qBAAqB,EAAE6B,QAAQ0B,EAAE,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,EAAEC,MAAM,EAAE,GAAG3B,OAAAA;QAEnB2B,MAAOC,CAAAA,OAAO,CAAC,CAACnD,KAAAA,GAAAA;AACd,YAAA,IAAI,IAAI,CAACoB,WAAW,CAACX,GAAG,CAACT,KAAQ,CAAA,EAAA;AAC/B,gBAAA,IAAI,CAACoB,WAAW,CAACjB,GAAG,CAACH,QAAQoD,IAAK7B,CAAAA,OAAAA,CAAAA;aAC7B,MAAA;AACL,gBAAA,IAAI,CAACH,WAAW,CAACJ,GAAG,CAAChB,KAAO,EAAA;AAACuB,oBAAAA;AAAQ,iBAAA,CAAA;gBACrC,IAAI,CAACf,cAAc,CAACR,KAAAA,CAAAA;AACtB;AACF,SAAA,CAAA;AACF;AAEAqD,IAAAA,MAAAA,CAAO9B,OAAgB,EAAE;AACvB7B,QAAAA,KAAAA,CAAM,CAAC,oBAAoB,EAAE6B,QAAQ0B,EAAE,CAAC,CAAC,CAAC,CAAA;QAC1C,IAAI,CAACK,MAAM,CAAC/B,OAAAA,CAAAA;QACZ,IAAI,CAACyB,GAAG,CAACzB,OAAAA,CAAAA;AACX;AAEA+B,IAAAA,MAAAA,CAAO/B,OAAgB,EAAE;AACvB7B,QAAAA,KAAAA,CAAM,CAAC,uBAAuB,EAAE6B,QAAQ0B,EAAE,CAAC,CAAC,CAAC,CAAA;AAE7C,QAAA,IAAI,CAAC7B,WAAW,CAAC+B,OAAO,CAAC,CAAChC,QAAUnB,EAAAA,KAAAA,GAAAA;YAClC,MAAMuD,gBAAAA,GAAmBpC,QAASG,CAAAA,MAAM,CAAC,CAACkC,QAAUA,KAAMP,CAAAA,EAAE,KAAK1B,OAAAA,CAAQ0B,EAAE,CAAA;;YAG3E,IAAIM,gBAAAA,CAAiBE,MAAM,KAAK,CAAG,EAAA;AACjC,gBAAA,IAAI,CAACrC,WAAW,CAACb,MAAM,CAACP,KAAAA,CAAAA;gBACxB,IAAI,CAACD,cAAc,CAACC,KAAAA,CAAAA;aACf,MAAA;AACL,gBAAA,IAAI,CAACoB,WAAW,CAACJ,GAAG,CAAChB,KAAOuD,EAAAA,gBAAAA,CAAAA;AAC9B;AACF,SAAA,CAAA;AACF;IAnIA,WAAY,CAAA,EAAElD,QAAQ,EAAEK,MAAM,EAAEgD,aAAgB,GAAA,EAAE,EAAE7B,KAAK,EAAyB,CAAE;AAR5ET,QAAAA,IAAAA,CAAAA,WAAAA,GAAsC,IAAIuC,GAAAA,EAAAA;AAE1CzD,QAAAA,IAAAA,CAAAA,SAAAA,GAAmC,IAAIyD,GAAAA,EAAAA;QAO7CjE,KAAM,CAAA,4BAAA,CAAA;QACN,IAAI,CAACW,QAAQ,GAAGA,QAAAA;QAChB,IAAI,CAACK,MAAM,GAAGA,MAAAA;QACd,IAAI,CAACmB,KAAK,GAAGA,KAAAA;QAEb,IAAI,OAAO6B,kBAAkB,QAAU,EAAA;AACrC,YAAA,MAAM,IAAIE,KACR,CAAA,wGAAA,CAAA;AAEJ;AAEA,QAAA,IAAI,CAACxB,MAAM,GAAGyB,CAAEC,CAAAA,KAAK,CAAClE,oBAAsB8D,EAAAA,aAAAA,CAAAA;AAE5C,QAAA,IAAI,CAAC5C,KAAK,GAAG,IAAIiD,WAAY,CAAA;AAAErD,YAAAA,MAAAA;YAAQsD,WAAa,EAAA;AAAE,SAAA,CAAA;QAEtD,IAAI,CAAClD,KAAK,CAACmD,SAAS,CAAC,IAAI,CAAC/C,eAAe,CAACgD,IAAI,CAAC,IAAI,CAAA,CAAA;AACrD;AAmHF;AAEA;;IAGe,SAASC,mBAAAA,CAAoBC,IAA2B,EAAA;AACrE,IAAA,OAAO,IAAItE,aAAcsE,CAAAA,IAAAA,CAAAA;AAC3B;;;;"}