oauth.do 0.2.0 → 0.2.1

package/dist/session-hono.d.ts

@@ -0,0 +1,143 @@
+import { Context, Hono, MiddlewareHandler } from 'hono';
+import { SessionData, SessionConfig } from './session.js';
+
+/**
+ * oauth.do/session-hono - Hono middleware for cookie-based session auth
+ *
+ * Provides session-based authentication as an alternative to JWT middleware.
+ * Uses AES-GCM encrypted cookies for secure, stateless sessions.
+ *
+ * @example
+ * ```ts
+ * import { Hono } from 'hono'
+ * import { sessionAuth, requireSession, createOAuthRoutes } from 'oauth.do/hono'
+ *
+ * const app = new Hono()
+ * app.use('*', sessionAuth())
+ * app.route('/auth', createOAuthRoutes({
+ *   workosApiKey: env.WORKOS_API_KEY,
+ *   clientId: env.WORKOS_CLIENT_ID,
+ * }))
+ * ```
+ */
+
+/**
+ * User info extracted from session
+ */
+interface SessionUser {
+    id: string;
+    email?: string;
+    name?: string;
+    organizationId?: string;
+}
+declare module 'hono' {
+    interface ContextVariableMap {
+        session: SessionData | null;
+        sessionUser: SessionUser | null;
+    }
+}
+/**
+ * Options for session auth middleware
+ */
+interface SessionAuthOptions {
+    /** Session configuration (cookie name, secret, etc.) */
+    config?: Partial<SessionConfig>;
+}
+/**
+ * Options for creating OAuth routes
+ */
+interface OAuthRoutesOptions {
+    /** WorkOS API Key */
+    workosApiKey?: string;
+    /** WorkOS Client ID */
+    clientId?: string;
+    /** Session configuration */
+    session?: Partial<SessionConfig>;
+    /** Base URL for OAuth redirects (derived from request if not set) */
+    redirectBaseUrl?: string;
+    /** Path prefix for auth routes (default: '') */
+    pathPrefix?: string;
+    /** Callback after successful login */
+    onLogin?: (session: SessionData, c: Context) => void | Promise<void>;
+    /** Callback after logout */
+    onLogout?: (c: Context) => void | Promise<void>;
+    /** Enable debug logging */
+    debug?: boolean;
+}
+/**
+ * Environment bindings for session auth
+ */
+interface SessionEnv {
+    WORKOS_API_KEY?: string;
+    WORKOS_CLIENT_ID?: string;
+    SESSION_SECRET?: string;
+    SESSION_COOKIE_NAME?: string;
+    SESSION_COOKIE_MAX_AGE?: string;
+    SESSION_COOKIE_SECURE?: string;
+    SESSION_COOKIE_SAME_SITE?: string;
+    AUTH_REDIRECT_BASE_URL?: string;
+    DEBUG?: string;
+}
+/**
+ * Set session cookie with encrypted session data
+ */
+declare function setSessionCookie(c: Context, session: SessionData, config?: SessionConfig): Promise<void>;
+/**
+ * Clear session cookie
+ */
+declare function clearSessionCookie(c: Context, config?: SessionConfig): void;
+/**
+ * Get session from cookie
+ */
+declare function getSessionFromCookie(c: Context, config?: SessionConfig): Promise<SessionData | null>;
+/**
+ * Session auth middleware - populates c.var.session and c.var.sessionUser
+ *
+ * Non-blocking: sets null if no session exists. Use requireSession() for guarded access.
+ *
+ * @example
+ * ```ts
+ * app.use('*', sessionAuth())
+ * app.get('/me', (c) => {
+ *   if (!c.var.session) return c.json({ error: 'Not authenticated' }, 401)
+ *   return c.json(c.var.sessionUser)
+ * })
+ * ```
+ */
+declare function sessionAuth(options?: SessionAuthOptions): MiddlewareHandler;
+/**
+ * Require session middleware - returns 401 if no valid session
+ *
+ * @example
+ * ```ts
+ * app.use('/api/*', requireSession())
+ * ```
+ */
+declare function requireSession(options?: SessionAuthOptions): MiddlewareHandler;
+/**
+ * Create mountable OAuth routes for login, callback, logout, me, and refresh.
+ *
+ * @example
+ * ```ts
+ * import { Hono } from 'hono'
+ * import { createOAuthRoutes } from 'oauth.do/hono'
+ *
+ * const app = new Hono()
+ * app.route('/auth', createOAuthRoutes({
+ *   workosApiKey: env.WORKOS_API_KEY,
+ *   clientId: env.WORKOS_CLIENT_ID,
+ *   session: { secret: env.SESSION_SECRET },
+ * }))
+ * ```
+ *
+ * Routes:
+ * - GET /login - Redirect to WorkOS authorization
+ * - GET /callback - Handle OAuth callback, set session cookie
+ * - GET /logout - Clear cookie, redirect
+ * - POST /logout - Clear cookie, JSON response
+ * - GET /me - Return session user info
+ * - POST /refresh - Refresh access token
+ */
+declare function createOAuthRoutes(options?: OAuthRoutesOptions): Hono;
+
+export { type OAuthRoutesOptions, type SessionAuthOptions, type SessionEnv, type SessionUser, clearSessionCookie, createOAuthRoutes, getSessionFromCookie, requireSession, sessionAuth, setSessionCookie };

package/dist/session-hono.js

@@ -0,0 +1,406 @@
+import { Hono } from 'hono';
+import { setCookie, deleteCookie, getCookie } from 'hono/cookie';
+
+// src/session-hono.ts
+
+// src/session.ts
+var defaultSessionConfig = {
+  cookieName: "session",
+  cookieMaxAge: 60 * 60 * 24 * 7,
+  // 7 days
+  cookieSecure: true,
+  cookieSameSite: "lax",
+  secret: "oauth-do-dev-secret-change-in-production"
+};
+var ALGORITHM = "AES-GCM";
+var IV_LENGTH = 12;
+var TAG_LENGTH = 128;
+async function getEncryptionKey(secret) {
+  const encoder = new TextEncoder();
+  return crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret.padEnd(32, "0").slice(0, 32)),
+    { name: ALGORITHM },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function encodeSession(session, secret) {
+  const key = await getEncryptionKey(secret ?? defaultSessionConfig.secret);
+  const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+  const encoder = new TextEncoder();
+  const data = encoder.encode(JSON.stringify(session));
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: ALGORITHM, iv, tagLength: TAG_LENGTH },
+    key,
+    data
+  );
+  const combined = new Uint8Array(iv.length + ciphertext.byteLength);
+  combined.set(iv, 0);
+  combined.set(new Uint8Array(ciphertext), iv.length);
+  return btoa(String.fromCharCode(...combined));
+}
+async function decodeSession(encoded, secret) {
+  try {
+    const key = await getEncryptionKey(secret ?? defaultSessionConfig.secret);
+    const combined = Uint8Array.from(atob(encoded), (c) => c.charCodeAt(0));
+    const iv = combined.slice(0, IV_LENGTH);
+    const ciphertext = combined.slice(IV_LENGTH);
+    const decrypted = await crypto.subtle.decrypt(
+      { name: ALGORITHM, iv, tagLength: TAG_LENGTH },
+      key,
+      ciphertext
+    );
+    const decoder = new TextDecoder();
+    const parsed = JSON.parse(decoder.decode(decrypted));
+    if (!isValidSessionData(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function isValidSessionData(data) {
+  if (data === null || typeof data !== "object") {
+    return false;
+  }
+  const session = data;
+  if (typeof session.userId !== "string" || session.userId.length === 0) {
+    return false;
+  }
+  if (typeof session.accessToken !== "string" || session.accessToken.length === 0) {
+    return false;
+  }
+  if (session.organizationId !== void 0 && typeof session.organizationId !== "string") {
+    return false;
+  }
+  if (session.email !== void 0 && typeof session.email !== "string") {
+    return false;
+  }
+  if (session.name !== void 0 && typeof session.name !== "string") {
+    return false;
+  }
+  if (session.refreshToken !== void 0 && typeof session.refreshToken !== "string") {
+    return false;
+  }
+  if (session.expiresAt !== void 0 && typeof session.expiresAt !== "number") {
+    return false;
+  }
+  return true;
+}
+function getSessionConfig(env) {
+  const validSameSite = ["strict", "lax", "none"];
+  let cookieSameSite = defaultSessionConfig.cookieSameSite;
+  if (env?.SESSION_COOKIE_SAME_SITE) {
+    const value = env.SESSION_COOKIE_SAME_SITE;
+    if (validSameSite.includes(value)) {
+      cookieSameSite = value;
+    }
+  }
+  let cookieMaxAge = defaultSessionConfig.cookieMaxAge;
+  if (env?.SESSION_COOKIE_MAX_AGE) {
+    const parsed = parseInt(env.SESSION_COOKIE_MAX_AGE, 10);
+    if (!Number.isNaN(parsed) && parsed > 0) {
+      cookieMaxAge = parsed;
+    }
+  }
+  return {
+    secret: env?.SESSION_SECRET ?? defaultSessionConfig.secret,
+    cookieName: env?.SESSION_COOKIE_NAME ?? defaultSessionConfig.cookieName,
+    cookieMaxAge,
+    cookieSecure: env?.SESSION_COOKIE_SECURE !== "false",
+    cookieSameSite
+  };
+}
+
+// src/session-hono.ts
+async function setSessionCookie(c, session, config = defaultSessionConfig) {
+  const encoded = await encodeSession(session, config.secret);
+  setCookie(c, config.cookieName, encoded, {
+    path: "/",
+    httpOnly: true,
+    secure: config.cookieSecure,
+    sameSite: config.cookieSameSite === "none" ? "None" : config.cookieSameSite === "strict" ? "Strict" : "Lax",
+    maxAge: config.cookieMaxAge
+  });
+}
+function clearSessionCookie(c, config = defaultSessionConfig) {
+  deleteCookie(c, config.cookieName, { path: "/" });
+}
+async function getSessionFromCookie(c, config = defaultSessionConfig) {
+  const encoded = getCookie(c, config.cookieName);
+  if (!encoded) return null;
+  return decodeSession(encoded, config.secret);
+}
+function sessionAuth(options = {}) {
+  return async (c, next) => {
+    const env = c.env ?? {};
+    const config = { ...getSessionConfig(env), ...options.config };
+    const session = await getSessionFromCookie(c, config);
+    c.set("session", session);
+    c.set("sessionUser", session ? {
+      id: session.userId,
+      email: session.email,
+      name: session.name,
+      organizationId: session.organizationId
+    } : null);
+    await next();
+  };
+}
+function requireSession(options = {}) {
+  return async (c, next) => {
+    const env = c.env ?? {};
+    const config = { ...getSessionConfig(env), ...options.config };
+    const session = await getSessionFromCookie(c, config);
+    if (!session) {
+      return c.json({ error: "Unauthorized", message: "Authentication required" }, 401);
+    }
+    if (session.expiresAt && Date.now() >= session.expiresAt) {
+      clearSessionCookie(c, config);
+      return c.json({ error: "Unauthorized", message: "Session expired" }, 401);
+    }
+    c.set("session", session);
+    c.set("sessionUser", {
+      id: session.userId,
+      email: session.email,
+      name: session.name,
+      organizationId: session.organizationId
+    });
+    await next();
+  };
+}
+function createWorkOSClient(apiKey) {
+  const baseUrl = "https://api.workos.com";
+  return {
+    getAuthorizationUrl(options) {
+      const params = new URLSearchParams({
+        client_id: options.clientId,
+        redirect_uri: options.redirectUri,
+        response_type: "code",
+        ...options.state && { state: options.state },
+        ...options.provider && { provider: options.provider }
+      });
+      return `https://api.workos.com/sso/authorize?${params.toString()}`;
+    },
+    async authenticateWithCode(options) {
+      const response = await fetch(`${baseUrl}/user_management/authenticate`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          "Authorization": `Bearer ${apiKey}`
+        },
+        body: new URLSearchParams({
+          grant_type: "authorization_code",
+          client_id: options.clientId,
+          code: options.code,
+          redirect_uri: options.redirectUri
+        }).toString()
+      });
+      if (!response.ok) {
+        const error = await response.text();
+        throw new Error(`WorkOS authentication failed: ${response.status} - ${error}`);
+      }
+      return response.json();
+    },
+    async refreshToken(options) {
+      const response = await fetch(`${baseUrl}/user_management/authenticate`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          "Authorization": `Bearer ${apiKey}`
+        },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          client_id: options.clientId,
+          refresh_token: options.refreshToken
+        }).toString()
+      });
+      if (!response.ok) {
+        const error = await response.text();
+        throw new Error(`Token refresh failed: ${response.status} - ${error}`);
+      }
+      return response.json();
+    }
+  };
+}
+function createOAuthRoutes(options = {}) {
+  const app = new Hono();
+  app.use("*", async (c, next) => {
+    await next();
+    const contentType = c.res.headers.get("content-type");
+    if (contentType?.includes("application/json") && !contentType.includes("charset")) {
+      c.res.headers.set("content-type", "application/json; charset=utf-8");
+    }
+  });
+  app.get("/login", (c) => {
+    const env = c.env ?? {};
+    const apiKey = options.workosApiKey ?? env.WORKOS_API_KEY;
+    const clientId = options.clientId ?? env.WORKOS_CLIENT_ID;
+    if (!apiKey) {
+      return c.json({ error: "Server configuration error", message: "WORKOS_API_KEY not configured" }, 500);
+    }
+    if (!clientId) {
+      return c.json({ error: "Server configuration error", message: "WORKOS_CLIENT_ID not configured" }, 500);
+    }
+    const workos = createWorkOSClient(apiKey);
+    const url = new URL(c.req.url);
+    const baseUrl = options.redirectBaseUrl ?? env.AUTH_REDIRECT_BASE_URL ?? `${url.protocol}//${url.host}`;
+    const intendedRedirect = c.req.query("redirect_uri") || "/";
+    const provider = c.req.query("provider");
+    const state = btoa(JSON.stringify({ redirect: intendedRedirect }));
+    const authUrl = workos.getAuthorizationUrl({
+      clientId,
+      redirectUri: `${baseUrl}/auth/callback`,
+      state,
+      provider
+    });
+    return c.redirect(authUrl);
+  });
+  app.get("/callback", async (c) => {
+    const env = c.env ?? {};
+    const apiKey = options.workosApiKey ?? env.WORKOS_API_KEY;
+    const clientId = options.clientId ?? env.WORKOS_CLIENT_ID;
+    const sessionConfig = { ...getSessionConfig(env), ...options.session };
+    const debug = options.debug ?? env.DEBUG === "true";
+    if (!apiKey) {
+      return c.json({ error: "Server configuration error", message: "WORKOS_API_KEY not configured" }, 500);
+    }
+    if (!clientId) {
+      return c.json({ error: "Server configuration error", message: "WORKOS_CLIENT_ID not configured" }, 500);
+    }
+    const code = c.req.query("code");
+    const state = c.req.query("state");
+    const error = c.req.query("error");
+    const errorDescription = c.req.query("error_description");
+    if (error) {
+      if (debug) console.error("[Auth] OAuth error:", error, errorDescription);
+      return c.json({ error: "Authentication failed", message: errorDescription || error }, 400);
+    }
+    if (!code) {
+      return c.json({ error: "Missing authorization code" }, 400);
+    }
+    const workos = createWorkOSClient(apiKey);
+    const url = new URL(c.req.url);
+    const baseUrl = options.redirectBaseUrl ?? env.AUTH_REDIRECT_BASE_URL ?? `${url.protocol}//${url.host}`;
+    try {
+      const result = await workos.authenticateWithCode({
+        clientId,
+        code,
+        redirectUri: `${baseUrl}/auth/callback`
+      });
+      const session = {
+        userId: result.user.id,
+        organizationId: result.user.organization_id,
+        email: result.user.email,
+        name: [result.user.first_name, result.user.last_name].filter(Boolean).join(" ") || void 0,
+        accessToken: result.access_token,
+        refreshToken: result.refresh_token,
+        expiresAt: result.expires_in ? Date.now() + result.expires_in * 1e3 : void 0
+      };
+      await setSessionCookie(c, session, sessionConfig);
+      await options.onLogin?.(session, c);
+      let redirectTo = "/";
+      if (state) {
+        try {
+          const stateData = JSON.parse(atob(state));
+          redirectTo = stateData.redirect || "/";
+        } catch {
+        }
+      }
+      if (!redirectTo.startsWith("/")) {
+        redirectTo = "/";
+      }
+      return c.redirect(redirectTo);
+    } catch (err) {
+      if (debug) console.error("[Auth] OAuth callback error:", err);
+      return c.json({
+        error: "Authentication failed",
+        message: err instanceof Error ? err.message : "Unknown error"
+      }, 500);
+    }
+  });
+  app.get("/logout", async (c) => {
+    const env = c.env ?? {};
+    const sessionConfig = { ...getSessionConfig(env), ...options.session };
+    clearSessionCookie(c, sessionConfig);
+    await options.onLogout?.(c);
+    const redirectTo = c.req.query("redirect_uri") || "/";
+    if (!redirectTo.startsWith("/")) {
+      return c.redirect("/");
+    }
+    return c.redirect(redirectTo);
+  });
+  app.post("/logout", async (c) => {
+    const env = c.env ?? {};
+    const sessionConfig = { ...getSessionConfig(env), ...options.session };
+    clearSessionCookie(c, sessionConfig);
+    await options.onLogout?.(c);
+    return c.json({ success: true, message: "Logged out successfully" });
+  });
+  app.get("/me", async (c) => {
+    const env = c.env ?? {};
+    const sessionConfig = { ...getSessionConfig(env), ...options.session };
+    const session = await getSessionFromCookie(c, sessionConfig);
+    if (!session) {
+      return c.json({ error: "Unauthorized", message: "Not authenticated" }, 401);
+    }
+    if (session.expiresAt && Date.now() >= session.expiresAt) {
+      clearSessionCookie(c, sessionConfig);
+      return c.json({ error: "Unauthorized", message: "Session expired" }, 401);
+    }
+    return c.json({
+      id: session.userId,
+      email: session.email,
+      name: session.name,
+      organizationId: session.organizationId
+    });
+  });
+  app.post("/refresh", async (c) => {
+    const env = c.env ?? {};
+    const apiKey = options.workosApiKey ?? env.WORKOS_API_KEY;
+    const clientId = options.clientId ?? env.WORKOS_CLIENT_ID;
+    const sessionConfig = { ...getSessionConfig(env), ...options.session };
+    const debug = options.debug ?? env.DEBUG === "true";
+    if (!apiKey) {
+      return c.json({ error: "Server configuration error", message: "WORKOS_API_KEY not configured" }, 500);
+    }
+    if (!clientId) {
+      return c.json({ error: "Server configuration error", message: "WORKOS_CLIENT_ID not configured" }, 500);
+    }
+    const session = await getSessionFromCookie(c, sessionConfig);
+    if (!session) {
+      return c.json({ error: "Unauthorized", message: "Not authenticated" }, 401);
+    }
+    if (!session.refreshToken) {
+      return c.json({ error: "Cannot refresh", message: "No refresh token available" }, 400);
+    }
+    const workos = createWorkOSClient(apiKey);
+    try {
+      const result = await workos.refreshToken({
+        clientId,
+        refreshToken: session.refreshToken
+      });
+      const updatedSession = {
+        ...session,
+        accessToken: result.access_token,
+        refreshToken: result.refresh_token || session.refreshToken,
+        expiresAt: result.expires_in ? Date.now() + result.expires_in * 1e3 : void 0
+      };
+      await setSessionCookie(c, updatedSession, sessionConfig);
+      return c.json({ success: true, expiresAt: updatedSession.expiresAt });
+    } catch (err) {
+      if (debug) console.error("[Auth] Token refresh error:", err);
+      clearSessionCookie(c, sessionConfig);
+      return c.json({
+        error: "Refresh failed",
+        message: err instanceof Error ? err.message : "Unknown error"
+      }, 401);
+    }
+  });
+  return app;
+}
+
+export { clearSessionCookie, createOAuthRoutes, getSessionFromCookie, requireSession, sessionAuth, setSessionCookie };
+//# sourceMappingURL=session-hono.js.map
+//# sourceMappingURL=session-hono.js.map

package/dist/session-hono.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/session.ts","../src/session-hono.ts"],"names":[],"mappings":";;;;;;AAsDO,IAAM,oBAAA,GAAsC;AAAA,EACjD,UAAA,EAAY,SAAA;AAAA,EACZ,YAAA,EAAc,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,CAAA;AAAA;AAAA,EAC7B,YAAA,EAAc,IAAA;AAAA,EACd,cAAA,EAAgB,KAAA;AAAA,EAChB,MAAA,EAAQ;AACV,CAAA;AAMA,IAAM,SAAA,GAAY,SAAA;AAClB,IAAM,SAAA,GAAY,EAAA;AAClB,IAAM,UAAA,GAAa,GAAA;AAKnB,eAAe,iBAAiB,MAAA,EAAoC;AAClE,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,OAAO,OAAO,MAAA,CAAO,SAAA;AAAA,IACnB,KAAA;AAAA,IACA,OAAA,CAAQ,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,EAAA,EAAI,GAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAAA,IAClD,EAAE,MAAM,SAAA,EAAU;AAAA,IAClB,KAAA;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,GACvB;AACF;AAUA,eAAsB,aAAA,CAAc,SAAsB,MAAA,EAAkC;AAC1F,EAAA,MAAM,GAAA,GAAM,MAAM,gBAAA,CAAiB,MAAA,IAAU,qBAAqB,MAAM,CAAA;AACxE,EAAA,MAAM,KAAK,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,SAAS,CAAC,CAAA;AAC3D,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,OAAO,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAEnD,EAAA,MAAM,UAAA,GAAa,MAAM,MAAA,CAAO,MAAA,CAAO,OAAA;AAAA,IACrC,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAI,WAAW,UAAA,EAAW;AAAA,IAC7C,GAAA;AAAA,IACA;AAAA,GACF;AAGA,EAAA,MAAM,WAAW,IAAI,UAAA,CAAW,EAAA,CAAG,MAAA,GAAS,WAAW,UAAU,CAAA;AACjE,EAAA,QAAA,CAAS,GAAA,CAAI,IAAI,CAAC,CAAA;AAClB,EAAA,QAAA,CAAS,IAAI,IAAI,UAAA,CAAW,UAAU,CAAA,EAAG,GAAG,MAAM,CAAA;AAElD,EAAA,OAAO,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa,GAAG,QAAQ,CAAC,CAAA;AAC9C;AAUA,eAAsB,aAAA,CAAc,SAAiB,MAAA,EAA8C;AACjG,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,gBAAA,CAAiB,MAAA,IAAU,qBAAqB,MAAM,CAAA;AACxE,IAAA,MAAM,QAAA,GAAW,UAAA,CAAW,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAC,CAAA;AAEtE,IAAA,MAAM,EAAA,GAAK,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA;AACtC,IAAA,MAAM,UAAA,GAAa,QAAA,CAAS,KAAA,CAAM,SAAS,CAAA;AAE3C,IAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,MAAA,CAAO,OAAA;AAAA,MACpC,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAI,WAAW,UAAA,EAAW;AAAA,MAC7C,GAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,IAAA,MAAM,SAAkB,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAC,CAAA;AAE5D,IAAA,IAAI,CAAC,kBAAA,CAAmB,MAAM,CAAA,EAAG;AAC/B,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAKO,SAAS,mBAAmB,IAAA,EAAoC;AACrE,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AAC7C,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAU,IAAA;AAGhB,EAAA,IAAI,OAAO,OAAA,CAAQ,MAAA,KAAW,YAAY,OAAA,CAAQ,MAAA,CAAO,WAAW,CAAA,EAAG;AACrE,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,OAAA,CAAQ,WAAA,KAAgB,YAAY,OAAA,CAAQ,WAAA,CAAY,WAAW,CAAA,EAAG;AAC/E,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,IAAI,QAAQ,cAAA,KAAmB,MAAA,IAAa,OAAO,OAAA,CAAQ,mBAAmB,QAAA,EAAU;AACtF,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAQ,KAAA,KAAU,MAAA,IAAa,OAAO,OAAA,CAAQ,UAAU,QAAA,EAAU;AACpE,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAQ,IAAA,KAAS,MAAA,IAAa,OAAO,OAAA,CAAQ,SAAS,QAAA,EAAU;AAClE,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAQ,YAAA,KAAiB,MAAA,IAAa,OAAO,OAAA,CAAQ,iBAAiB,QAAA,EAAU;AAClF,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAQ,SAAA,KAAc,MAAA,IAAa,OAAO,OAAA,CAAQ,cAAc,QAAA,EAAU;AAC5E,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA;AACT;AAYO,SAAS,iBAAiB,GAAA,EAAyD;AACxF,EAAA,MAAM,aAAA,GAAgB,CAAC,QAAA,EAAU,KAAA,EAAO,MAAM,CAAA;AAE9C,EAAA,IAAI,iBAAkD,oBAAA,CAAqB,cAAA;AAC3E,EAAA,IAAI,KAAK,wBAAA,EAA0B;AACjC,IAAA,MAAM,QAAQ,GAAA,CAAI,wBAAA;AAClB,IAAA,IAAI,aAAA,CAAc,QAAA,CAAS,KAAqC,CAAA,EAAG;AACjE,MAAA,cAAA,GAAiB,KAAA;AAAA,IACnB;AAAA,EACF;AAEA,EAAA,IAAI,eAAe,oBAAA,CAAqB,YAAA;AACxC,EAAA,IAAI,KAAK,sBAAA,EAAwB;AAC/B,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,GAAA,CAAI,sBAAA,EAAwB,EAAE,CAAA;AACtD,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,MAAM,CAAA,IAAK,SAAS,CAAA,EAAG;AACvC,MAAA,YAAA,GAAe,MAAA;AAAA,IACjB;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,GAAA,EAAK,cAAA,IAAkB,oBAAA,CAAqB,MAAA;AAAA,IACpD,UAAA,EAAY,GAAA,EAAK,mBAAA,IAAuB,oBAAA,CAAqB,UAAA;AAAA,IAC7D,YAAA;AAAA,IACA,YAAA,EAAc,KAAK,qBAAA,KAA0B,OAAA;AAAA,IAC7C;AAAA,GACF;AACF;;;ACzHA,eAAsB,gBAAA,CACpB,CAAA,EACA,OAAA,EACA,MAAA,GAAwB,oBAAA,EACT;AACf,EAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,OAAA,EAAS,OAAO,MAAM,CAAA;AAC1D,EAAA,SAAA,CAAU,CAAA,EAAG,MAAA,CAAO,UAAA,EAAY,OAAA,EAAS;AAAA,IACvC,IAAA,EAAM,GAAA;AAAA,IACN,QAAA,EAAU,IAAA;AAAA,IACV,QAAQ,MAAA,CAAO,YAAA;AAAA,IACf,QAAA,EAAU,OAAO,cAAA,KAAmB,MAAA,GAAS,SAAS,MAAA,CAAO,cAAA,KAAmB,WAAW,QAAA,GAAW,KAAA;AAAA,IACtG,QAAQ,MAAA,CAAO;AAAA,GAChB,CAAA;AACH;AAKO,SAAS,kBAAA,CAAmB,CAAA,EAAY,MAAA,GAAwB,oBAAA,EAA4B;AACjG,EAAA,YAAA,CAAa,GAAG,MAAA,CAAO,UAAA,EAAY,EAAE,IAAA,EAAM,KAAK,CAAA;AAClD;AAKA,eAAsB,oBAAA,CACpB,CAAA,EACA,MAAA,GAAwB,oBAAA,EACK;AAC7B,EAAA,MAAM,OAAA,GAAU,SAAA,CAAU,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA;AAC9C,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,OAAO,aAAA,CAAc,OAAA,EAAS,MAAA,CAAO,MAAM,CAAA;AAC7C;AAoBO,SAAS,WAAA,CAAY,OAAA,GAA8B,EAAC,EAAsB;AAC/E,EAAA,OAAO,OAAO,GAAG,IAAA,KAAS;AACxB,IAAA,MAAM,GAAA,GAAO,CAAA,CAAE,GAAA,IAAO,EAAC;AACvB,IAAA,MAAM,MAAA,GAAS,EAAE,GAAG,gBAAA,CAAiB,GAAyC,CAAA,EAAG,GAAG,QAAQ,MAAA,EAAO;AAEnG,IAAA,MAAM,OAAA,GAAU,MAAM,oBAAA,CAAqB,CAAA,EAAG,MAAM,CAAA;AAEpD,IAAA,CAAA,CAAE,GAAA,CAAI,WAAW,OAAO,CAAA;AACxB,IAAA,CAAA,CAAE,GAAA,CAAI,eAAe,OAAA,GAAU;AAAA,MAC7B,IAAI,OAAA,CAAQ,MAAA;AAAA,MACZ,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,gBAAgB,OAAA,CAAQ;AAAA,QACtB,IAAI,CAAA;AAER,IAAA,MAAM,IAAA,EAAK;AAAA,EACb,CAAA;AACF;AAUO,SAAS,cAAA,CAAe,OAAA,GAA8B,EAAC,EAAsB;AAClF,EAAA,OAAO,OAAO,GAAG,IAAA,KAAS;AACxB,IAAA,MAAM,GAAA,GAAO,CAAA,CAAE,GAAA,IAAO,EAAC;AACvB,IAAA,MAAM,MAAA,GAAS,EAAE,GAAG,gBAAA,CAAiB,GAAyC,CAAA,EAAG,GAAG,QAAQ,MAAA,EAAO;AAEnG,IAAA,MAAM,OAAA,GAAU,MAAM,oBAAA,CAAqB,CAAA,EAAG,MAAM,CAAA;AAEpD,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,gBAAgB,OAAA,EAAS,yBAAA,IAA6B,GAAG,CAAA;AAAA,IAClF;AAGA,IAAA,IAAI,QAAQ,SAAA,IAAa,IAAA,CAAK,GAAA,EAAI,IAAK,QAAQ,SAAA,EAAW;AACxD,MAAA,kBAAA,CAAmB,GAAG,MAAM,CAAA;AAC5B,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,gBAAgB,OAAA,EAAS,iBAAA,IAAqB,GAAG,CAAA;AAAA,IAC1E;AAEA,IAAA,CAAA,CAAE,GAAA,CAAI,WAAW,OAAO,CAAA;AACxB,IAAA,CAAA,CAAE,IAAI,aAAA,EAAe;AAAA,MACnB,IAAI,OAAA,CAAQ,MAAA;AAAA,MACZ,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,gBAAgB,OAAA,CAAQ;AAAA,KACzB,CAAA;AAED,IAAA,MAAM,IAAA,EAAK;AAAA,EACb,CAAA;AACF;AASA,SAAS,mBAAmB,MAAA,EAAgB;AAC1C,EAAA,MAAM,OAAA,GAAU,wBAAA;AAEhB,EAAA,OAAO;AAAA,IACL,oBAAoB,OAAA,EAKT;AACT,MAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,QACjC,WAAW,OAAA,CAAQ,QAAA;AAAA,QACnB,cAAc,OAAA,CAAQ,WAAA;AAAA,QACtB,aAAA,EAAe,MAAA;AAAA,QACf,GAAI,OAAA,CAAQ,KAAA,IAAS,EAAE,KAAA,EAAO,QAAQ,KAAA,EAAM;AAAA,QAC5C,GAAI,OAAA,CAAQ,QAAA,IAAY,EAAE,QAAA,EAAU,QAAQ,QAAA;AAAS,OACtD,CAAA;AACD,MAAA,OAAO,CAAA,qCAAA,EAAwC,MAAA,CAAO,QAAA,EAAU,CAAA,CAAA;AAAA,IAClE,CAAA;AAAA,IAEA,MAAM,qBAAqB,OAAA,EAexB;AACD,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA,6BAAA,CAAA,EAAiC;AAAA,QACtE,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mCAAA;AAAA,UAChB,eAAA,EAAiB,UAAU,MAAM,CAAA;AAAA,SACnC;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,UACxB,UAAA,EAAY,oBAAA;AAAA,UACZ,WAAW,OAAA,CAAQ,QAAA;AAAA,UACnB,MAAM,OAAA,CAAQ,IAAA;AAAA,UACd,cAAc,OAAA,CAAQ;AAAA,SACvB,EAAE,QAAA;AAAS,OACb,CAAA;AAED,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,KAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,SAAS,MAAM,CAAA,GAAA,EAAM,KAAK,CAAA,CAAE,CAAA;AAAA,MAC/E;AAEA,MAAA,OAAO,SAAS,IAAA,EAAK;AAAA,IACvB,CAAA;AAAA,IAEA,MAAM,aAAa,OAAA,EAOhB;AACD,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA,6BAAA,CAAA,EAAiC;AAAA,QACtE,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mCAAA;AAAA,UAChB,eAAA,EAAiB,UAAU,MAAM,CAAA;AAAA,SACnC;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,UACxB,UAAA,EAAY,eAAA;AAAA,UACZ,WAAW,OAAA,CAAQ,QAAA;AAAA,UACnB,eAAe,OAAA,CAAQ;AAAA,SACxB,EAAE,QAAA;AAAS,OACb,CAAA;AAED,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,KAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,SAAS,MAAM,CAAA,GAAA,EAAM,KAAK,CAAA,CAAE,CAAA;AAAA,MACvE;AAEA,MAAA,OAAO,SAAS,IAAA,EAAK;AAAA,IACvB;AAAA,GACF;AACF;AA8BO,SAAS,iBAAA,CAAkB,OAAA,GAA8B,EAAC,EAAS;AACxE,EAAA,MAAM,GAAA,GAAM,IAAI,IAAA,EAAK;AAGrB,EAAA,GAAA,CAAI,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA,EAAG,IAAA,KAAS;AAC9B,IAAA,MAAM,IAAA,EAAK;AACX,IAAA,MAAM,WAAA,GAAc,CAAA,CAAE,GAAA,CAAI,OAAA,CAAQ,IAAI,cAAc,CAAA;AACpD,IAAA,IAAI,WAAA,EAAa,SAAS,kBAAkB,CAAA,IAAK,CAAC,WAAA,CAAY,QAAA,CAAS,SAAS,CAAA,EAAG;AACjF,MAAA,CAAA,CAAE,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAA,EAAgB,iCAAiC,CAAA;AAAA,IACrE;AAAA,EACF,CAAC,CAAA;AAKD,EAAA,GAAA,CAAI,GAAA,CAAI,QAAA,EAAU,CAAC,CAAA,KAAM;AACvB,IAAA,MAAM,GAAA,GAAO,CAAA,CAAE,GAAA,IAAO,EAAC;AACvB,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,YAAA,IAAgB,GAAA,CAAI,cAAA;AAC3C,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAY,GAAA,CAAI,gBAAA;AAEzC,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,8BAA8B,OAAA,EAAS,+BAAA,IAAmC,GAAG,CAAA;AAAA,IACtG;AACA,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,8BAA8B,OAAA,EAAS,iCAAA,IAAqC,GAAG,CAAA;AAAA,IACxG;AAEA,IAAA,MAAM,MAAA,GAAS,mBAAmB,MAAM,CAAA;AACxC,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,CAAE,IAAI,GAAG,CAAA;AAC7B,IAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,eAAA,IAAmB,GAAA,CAAI,sBAAA,IAA0B,GAAG,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,IAAI,CAAA,CAAA;AAErG,IAAA,MAAM,gBAAA,GAAmB,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,cAAc,CAAA,IAAK,GAAA;AACxD,IAAA,MAAM,QAAA,GAAW,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,UAAU,CAAA;AACvC,IAAA,MAAM,KAAA,GAAQ,KAAK,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,gBAAA,EAAkB,CAAC,CAAA;AAEjE,IAAA,MAAM,OAAA,GAAU,OAAO,mBAAA,CAAoB;AAAA,MACzC,QAAA;AAAA,MACA,WAAA,EAAa,GAAG,OAAO,CAAA,cAAA,CAAA;AAAA,MACvB,KAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,OAAO,CAAA,CAAE,SAAS,OAAO,CAAA;AAAA,EAC3B,CAAC,CAAA;AAKD,EAAA,GAAA,CAAI,GAAA,CAAI,WAAA,EAAa,OAAO,CAAA,KAAM;AAChC,IAAA,MAAM,GAAA,GAAO,CAAA,CAAE,GAAA,IAAO,EAAC;AACvB,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,YAAA,IAAgB,GAAA,CAAI,cAAA;AAC3C,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAY,GAAA,CAAI,gBAAA;AACzC,IAAA,MAAM,aAAA,GAAgB,EAAE,GAAG,gBAAA,CAAiB,GAAyC,CAAA,EAAG,GAAG,QAAQ,OAAA,EAAQ;AAC3G,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,GAAA,CAAI,KAAA,KAAU,MAAA;AAE7C,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,8BAA8B,OAAA,EAAS,+BAAA,IAAmC,GAAG,CAAA;AAAA,IACtG;AACA,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,8BAA8B,OAAA,EAAS,iCAAA,IAAqC,GAAG,CAAA;AAAA,IACxG;AAEA,IAAA,MAAM,IAAA,GAAO,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AAC/B,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA;AACjC,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA;AACjC,IAAA,MAAM,gBAAA,GAAmB,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,mBAAmB,CAAA;AAExD,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,qBAAA,EAAuB,OAAO,gBAAgB,CAAA;AACvE,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,yBAAyB,OAAA,EAAS,gBAAA,IAAoB,KAAA,EAAM,EAAG,GAAG,CAAA;AAAA,IAC3F;AAEA,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,4BAAA,IAAgC,GAAG,CAAA;AAAA,IAC5D;AAEA,IAAA,MAAM,MAAA,GAAS,mBAAmB,MAAM,CAAA;AACxC,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,CAAE,IAAI,GAAG,CAAA;AAC7B,IAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,eAAA,IAAmB,GAAA,CAAI,sBAAA,IAA0B,GAAG,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,IAAI,CAAA,CAAA;AAErG,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,oBAAA,CAAqB;AAAA,QAC/C,QAAA;AAAA,QACA,IAAA;AAAA,QACA,WAAA,EAAa,GAAG,OAAO,CAAA,cAAA;AAAA,OACxB,CAAA;AAED,MAAA,MAAM,OAAA,GAAuB;AAAA,QAC3B,MAAA,EAAQ,OAAO,IAAA,CAAK,EAAA;AAAA,QACpB,cAAA,EAAgB,OAAO,IAAA,CAAK,eAAA;AAAA,QAC5B,KAAA,EAAO,OAAO,IAAA,CAAK,KAAA;AAAA,QACnB,IAAA,EAAM,CAAC,MAAA,CAAO,IAAA,CAAK,YAAY,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,IAAK,KAAA,CAAA;AAAA,QACnF,aAAa,MAAA,CAAO,YAAA;AAAA,QACpB,cAAc,MAAA,CAAO,aAAA;AAAA,QACrB,SAAA,EAAW,OAAO,UAAA,GAAa,IAAA,CAAK,KAAI,GAAI,MAAA,CAAO,aAAa,GAAA,GAAO,KAAA;AAAA,OACzE;AAEA,MAAA,MAAM,gBAAA,CAAiB,CAAA,EAAG,OAAA,EAAS,aAAa,CAAA;AAChD,MAAA,MAAM,OAAA,CAAQ,OAAA,GAAU,OAAA,EAAS,CAAC,CAAA;AAElC,MAAA,IAAI,UAAA,GAAa,GAAA;AACjB,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,IAAI;AACF,UAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,KAAK,CAAC,CAAA;AACxC,UAAA,UAAA,GAAa,UAAU,QAAA,IAAY,GAAA;AAAA,QACrC,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAGA,MAAA,IAAI,CAAC,UAAA,CAAW,UAAA,CAAW,GAAG,CAAA,EAAG;AAC/B,QAAA,UAAA,GAAa,GAAA;AAAA,MACf;AAEA,MAAA,OAAO,CAAA,CAAE,SAAS,UAAU,CAAA;AAAA,IAC9B,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,8BAAA,EAAgC,GAAG,CAAA;AAC5D,MAAA,OAAO,EAAE,IAAA,CAAK;AAAA,QACZ,KAAA,EAAO,uBAAA;AAAA,QACP,OAAA,EAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU;AAAA,SAC7C,GAAG,CAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA;AAKD,EAAA,GAAA,CAAI,GAAA,CAAI,SAAA,EAAW,OAAO,CAAA,KAAM;AAC9B,IAAA,MAAM,GAAA,GAAO,CAAA,CAAE,GAAA,IAAO,EAAC;AACvB,IAAA,MAAM,aAAA,GAAgB,EAAE,GAAG,gBAAA,CAAiB,GAAyC,CAAA,EAAG,GAAG,QAAQ,OAAA,EAAQ;AAE3G,IAAA,kBAAA,CAAmB,GAAG,aAAa,CAAA;AACnC,IAAA,MAAM,OAAA,CAAQ,WAAW,CAAC,CAAA;AAE1B,IAAA,MAAM,UAAA,GAAa,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,cAAc,CAAA,IAAK,GAAA;AAClD,IAAA,IAAI,CAAC,UAAA,CAAW,UAAA,CAAW,GAAG,CAAA,EAAG;AAC/B,MAAA,OAAO,CAAA,CAAE,SAAS,GAAG,CAAA;AAAA,IACvB;AACA,IAAA,OAAO,CAAA,CAAE,SAAS,UAAU,CAAA;AAAA,EAC9B,CAAC,CAAA;AAKD,EAAA,GAAA,CAAI,IAAA,CAAK,SAAA,EAAW,OAAO,CAAA,KAAM;AAC/B,IAAA,MAAM,GAAA,GAAO,CAAA,CAAE,GAAA,IAAO,EAAC;AACvB,IAAA,MAAM,aAAA,GAAgB,EAAE,GAAG,gBAAA,CAAiB,GAAyC,CAAA,EAAG,GAAG,QAAQ,OAAA,EAAQ;AAE3G,IAAA,kBAAA,CAAmB,GAAG,aAAa,CAAA;AACnC,IAAA,MAAM,OAAA,CAAQ,WAAW,CAAC,CAAA;AAE1B,IAAA,OAAO,EAAE,IAAA,CAAK,EAAE,SAAS,IAAA,EAAM,OAAA,EAAS,2BAA2B,CAAA;AAAA,EACrE,CAAC,CAAA;AAKD,EAAA,GAAA,CAAI,GAAA,CAAI,KAAA,EAAO,OAAO,CAAA,KAAM;AAC1B,IAAA,MAAM,GAAA,GAAO,CAAA,CAAE,GAAA,IAAO,EAAC;AACvB,IAAA,MAAM,aAAA,GAAgB,EAAE,GAAG,gBAAA,CAAiB,GAAyC,CAAA,EAAG,GAAG,QAAQ,OAAA,EAAQ;AAE3G,IAAA,MAAM,OAAA,GAAU,MAAM,oBAAA,CAAqB,CAAA,EAAG,aAAa,CAAA;AAE3D,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,gBAAgB,OAAA,EAAS,mBAAA,IAAuB,GAAG,CAAA;AAAA,IAC5E;AAEA,IAAA,IAAI,QAAQ,SAAA,IAAa,IAAA,CAAK,GAAA,EAAI,IAAK,QAAQ,SAAA,EAAW;AACxD,MAAA,kBAAA,CAAmB,GAAG,aAAa,CAAA;AACnC,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,gBAAgB,OAAA,EAAS,iBAAA,IAAqB,GAAG,CAAA;AAAA,IAC1E;AAEA,IAAA,OAAO,EAAE,IAAA,CAAK;AAAA,MACZ,IAAI,OAAA,CAAQ,MAAA;AAAA,MACZ,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,gBAAgB,OAAA,CAAQ;AAAA,KACzB,CAAA;AAAA,EACH,CAAC,CAAA;AAKD,EAAA,GAAA,CAAI,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA,KAAM;AAChC,IAAA,MAAM,GAAA,GAAO,CAAA,CAAE,GAAA,IAAO,EAAC;AACvB,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,YAAA,IAAgB,GAAA,CAAI,cAAA;AAC3C,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAY,GAAA,CAAI,gBAAA;AACzC,IAAA,MAAM,aAAA,GAAgB,EAAE,GAAG,gBAAA,CAAiB,GAAyC,CAAA,EAAG,GAAG,QAAQ,OAAA,EAAQ;AAC3G,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,GAAA,CAAI,KAAA,KAAU,MAAA;AAE7C,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,8BAA8B,OAAA,EAAS,+BAAA,IAAmC,GAAG,CAAA;AAAA,IACtG;AACA,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,8BAA8B,OAAA,EAAS,iCAAA,IAAqC,GAAG,CAAA;AAAA,IACxG;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,oBAAA,CAAqB,CAAA,EAAG,aAAa,CAAA;AAE3D,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,gBAAgB,OAAA,EAAS,mBAAA,IAAuB,GAAG,CAAA;AAAA,IAC5E;AAEA,IAAA,IAAI,CAAC,QAAQ,YAAA,EAAc;AACzB,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,kBAAkB,OAAA,EAAS,4BAAA,IAAgC,GAAG,CAAA;AAAA,IACvF;AAEA,IAAA,MAAM,MAAA,GAAS,mBAAmB,MAAM,CAAA;AAExC,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,YAAA,CAAa;AAAA,QACvC,QAAA;AAAA,QACA,cAAc,OAAA,CAAQ;AAAA,OACvB,CAAA;AAED,MAAA,MAAM,cAAA,GAA8B;AAAA,QAClC,GAAG,OAAA;AAAA,QACH,aAAa,MAAA,CAAO,YAAA;AAAA,QACpB,YAAA,EAAc,MAAA,CAAO,aAAA,IAAiB,OAAA,CAAQ,YAAA;AAAA,QAC9C,SAAA,EAAW,OAAO,UAAA,GAAa,IAAA,CAAK,KAAI,GAAI,MAAA,CAAO,aAAa,GAAA,GAAO,KAAA;AAAA,OACzE;AAEA,MAAA,MAAM,gBAAA,CAAiB,CAAA,EAAG,cAAA,EAAgB,aAAa,CAAA;AAEvD,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,OAAA,EAAS,MAAM,SAAA,EAAW,cAAA,CAAe,WAAW,CAAA;AAAA,IACtE,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,6BAAA,EAA+B,GAAG,CAAA;AAC3D,MAAA,kBAAA,CAAmB,GAAG,aAAa,CAAA;AACnC,MAAA,OAAO,EAAE,IAAA,CAAK;AAAA,QACZ,KAAA,EAAO,gBAAA;AAAA,QACP,OAAA,EAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU;AAAA,SAC7C,GAAG,CAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA;AAED,EAAA,OAAO,GAAA;AACT","file":"session-hono.js","sourcesContent":["/**\n * oauth.do/session - Cookie-based session management with AES-GCM encryption\n *\n * Secure session encoding/decoding using Web Crypto API.\n * Zero dependencies - works in all environments that support Web Crypto.\n *\n * @example\n * ```ts\n * import { encodeSession, decodeSession } from 'oauth.do/session'\n *\n * const session = { userId: 'user_123', accessToken: 'tok_abc' }\n * const encoded = await encodeSession(session, 'my-secret-key')\n * const decoded = await decodeSession(encoded, 'my-secret-key')\n * ```\n */\n\n// ─────────────────────────────────────────────────────────────────\n// Types\n// ─────────────────────────────────────────────────────────────────\n\n/**\n * Session data stored in encrypted cookie\n */\nexport interface SessionData {\n  userId: string\n  organizationId?: string\n  email?: string\n  name?: string\n  accessToken: string\n  refreshToken?: string\n  expiresAt?: number\n  /** Extensible: apps can add custom fields */\n  [key: string]: unknown\n}\n\n/**\n * Configuration for session management\n */\nexport interface SessionConfig {\n  /** Cookie name (default: 'session') */\n  cookieName: string\n  /** Cookie max age in seconds (default: 604800 = 7 days) */\n  cookieMaxAge: number\n  /** Cookie secure flag (default: true) */\n  cookieSecure: boolean\n  /** Cookie SameSite attribute (default: 'lax') */\n  cookieSameSite: 'strict' | 'lax' | 'none'\n  /** Encryption secret (required in production) */\n  secret: string\n}\n\n/**\n * Default session configuration\n */\nexport const defaultSessionConfig: SessionConfig = {\n  cookieName: 'session',\n  cookieMaxAge: 60 * 60 * 24 * 7, // 7 days\n  cookieSecure: true,\n  cookieSameSite: 'lax',\n  secret: 'oauth-do-dev-secret-change-in-production',\n}\n\n// ─────────────────────────────────────────────────────────────────\n// AES-GCM Encryption\n// ─────────────────────────────────────────────────────────────────\n\nconst ALGORITHM = 'AES-GCM'\nconst IV_LENGTH = 12\nconst TAG_LENGTH = 128\n\n/**\n * Derive an AES-GCM encryption key from a secret string\n */\nasync function getEncryptionKey(secret: string): Promise<CryptoKey> {\n  const encoder = new TextEncoder()\n  return crypto.subtle.importKey(\n    'raw',\n    encoder.encode(secret.padEnd(32, '0').slice(0, 32)),\n    { name: ALGORITHM },\n    false,\n    ['encrypt', 'decrypt']\n  )\n}\n\n/**\n * Encode session data with AES-GCM encryption.\n * Format: base64(IV || ciphertext || auth tag)\n *\n * @param session - Session data to encrypt\n * @param secret - Encryption secret (min 16 chars recommended)\n * @returns Base64-encoded encrypted session string\n */\nexport async function encodeSession(session: SessionData, secret?: string): Promise<string> {\n  const key = await getEncryptionKey(secret ?? defaultSessionConfig.secret)\n  const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH))\n  const encoder = new TextEncoder()\n  const data = encoder.encode(JSON.stringify(session))\n\n  const ciphertext = await crypto.subtle.encrypt(\n    { name: ALGORITHM, iv, tagLength: TAG_LENGTH },\n    key,\n    data\n  )\n\n  // Combine IV + ciphertext (ciphertext includes auth tag)\n  const combined = new Uint8Array(iv.length + ciphertext.byteLength)\n  combined.set(iv, 0)\n  combined.set(new Uint8Array(ciphertext), iv.length)\n\n  return btoa(String.fromCharCode(...combined))\n}\n\n/**\n * Decode session data with AES-GCM decryption.\n * Returns null if decryption fails or data is invalid.\n *\n * @param encoded - Base64-encoded encrypted session string\n * @param secret - Encryption secret (must match the one used for encoding)\n * @returns Decoded session data or null\n */\nexport async function decodeSession(encoded: string, secret?: string): Promise<SessionData | null> {\n  try {\n    const key = await getEncryptionKey(secret ?? defaultSessionConfig.secret)\n    const combined = Uint8Array.from(atob(encoded), (c) => c.charCodeAt(0))\n\n    const iv = combined.slice(0, IV_LENGTH)\n    const ciphertext = combined.slice(IV_LENGTH)\n\n    const decrypted = await crypto.subtle.decrypt(\n      { name: ALGORITHM, iv, tagLength: TAG_LENGTH },\n      key,\n      ciphertext\n    )\n\n    const decoder = new TextDecoder()\n    const parsed: unknown = JSON.parse(decoder.decode(decrypted))\n\n    if (!isValidSessionData(parsed)) {\n      return null\n    }\n\n    return parsed\n  } catch {\n    return null\n  }\n}\n\n/**\n * Validate that session data has the required structure\n */\nexport function isValidSessionData(data: unknown): data is SessionData {\n  if (data === null || typeof data !== 'object') {\n    return false\n  }\n\n  const session = data as Record<string, unknown>\n\n  // Required fields\n  if (typeof session.userId !== 'string' || session.userId.length === 0) {\n    return false\n  }\n  if (typeof session.accessToken !== 'string' || session.accessToken.length === 0) {\n    return false\n  }\n\n  // Optional fields type validation\n  if (session.organizationId !== undefined && typeof session.organizationId !== 'string') {\n    return false\n  }\n  if (session.email !== undefined && typeof session.email !== 'string') {\n    return false\n  }\n  if (session.name !== undefined && typeof session.name !== 'string') {\n    return false\n  }\n  if (session.refreshToken !== undefined && typeof session.refreshToken !== 'string') {\n    return false\n  }\n  if (session.expiresAt !== undefined && typeof session.expiresAt !== 'number') {\n    return false\n  }\n\n  return true\n}\n\n/**\n * Get session config from environment variables with defaults.\n *\n * Environment variables:\n * - SESSION_SECRET: Encryption secret\n * - SESSION_COOKIE_NAME: Cookie name\n * - SESSION_COOKIE_MAX_AGE: Cookie max age in seconds\n * - SESSION_COOKIE_SECURE: 'true' or 'false'\n * - SESSION_COOKIE_SAME_SITE: 'strict', 'lax', or 'none'\n */\nexport function getSessionConfig(env?: Record<string, string | undefined>): SessionConfig {\n  const validSameSite = ['strict', 'lax', 'none'] as const\n\n  let cookieSameSite: SessionConfig['cookieSameSite'] = defaultSessionConfig.cookieSameSite\n  if (env?.SESSION_COOKIE_SAME_SITE) {\n    const value = env.SESSION_COOKIE_SAME_SITE\n    if (validSameSite.includes(value as typeof validSameSite[number])) {\n      cookieSameSite = value as SessionConfig['cookieSameSite']\n    }\n  }\n\n  let cookieMaxAge = defaultSessionConfig.cookieMaxAge\n  if (env?.SESSION_COOKIE_MAX_AGE) {\n    const parsed = parseInt(env.SESSION_COOKIE_MAX_AGE, 10)\n    if (!Number.isNaN(parsed) && parsed > 0) {\n      cookieMaxAge = parsed\n    }\n  }\n\n  return {\n    secret: env?.SESSION_SECRET ?? defaultSessionConfig.secret,\n    cookieName: env?.SESSION_COOKIE_NAME ?? defaultSessionConfig.cookieName,\n    cookieMaxAge,\n    cookieSecure: env?.SESSION_COOKIE_SECURE !== 'false',\n    cookieSameSite,\n  }\n}\n","/**\n * oauth.do/session-hono - Hono middleware for cookie-based session auth\n *\n * Provides session-based authentication as an alternative to JWT middleware.\n * Uses AES-GCM encrypted cookies for secure, stateless sessions.\n *\n * @example\n * ```ts\n * import { Hono } from 'hono'\n * import { sessionAuth, requireSession, createOAuthRoutes } from 'oauth.do/hono'\n *\n * const app = new Hono()\n * app.use('*', sessionAuth())\n * app.route('/auth', createOAuthRoutes({\n *   workosApiKey: env.WORKOS_API_KEY,\n *   clientId: env.WORKOS_CLIENT_ID,\n * }))\n * ```\n */\n\nimport type { Context, MiddlewareHandler } from 'hono'\nimport { Hono } from 'hono'\nimport { getCookie, setCookie, deleteCookie } from 'hono/cookie'\nimport type { SessionData, SessionConfig } from './session'\nimport { encodeSession, decodeSession, defaultSessionConfig, getSessionConfig } from './session'\n\n// ─────────────────────────────────────────────────────────────────\n// Types\n// ─────────────────────────────────────────────────────────────────\n\n/**\n * User info extracted from session\n */\nexport interface SessionUser {\n  id: string\n  email?: string\n  name?: string\n  organizationId?: string\n}\n\n// Extend Hono context with session variables\ndeclare module 'hono' {\n  interface ContextVariableMap {\n    session: SessionData | null\n    sessionUser: SessionUser | null\n  }\n}\n\n/**\n * Options for session auth middleware\n */\nexport interface SessionAuthOptions {\n  /** Session configuration (cookie name, secret, etc.) */\n  config?: Partial<SessionConfig>\n}\n\n/**\n * Options for creating OAuth routes\n */\nexport interface OAuthRoutesOptions {\n  /** WorkOS API Key */\n  workosApiKey?: string\n  /** WorkOS Client ID */\n  clientId?: string\n  /** Session configuration */\n  session?: Partial<SessionConfig>\n  /** Base URL for OAuth redirects (derived from request if not set) */\n  redirectBaseUrl?: string\n  /** Path prefix for auth routes (default: '') */\n  pathPrefix?: string\n  /** Callback after successful login */\n  onLogin?: (session: SessionData, c: Context) => void | Promise<void>\n  /** Callback after logout */\n  onLogout?: (c: Context) => void | Promise<void>\n  /** Enable debug logging */\n  debug?: boolean\n}\n\n/**\n * Environment bindings for session auth\n */\nexport interface SessionEnv {\n  WORKOS_API_KEY?: string\n  WORKOS_CLIENT_ID?: string\n  SESSION_SECRET?: string\n  SESSION_COOKIE_NAME?: string\n  SESSION_COOKIE_MAX_AGE?: string\n  SESSION_COOKIE_SECURE?: string\n  SESSION_COOKIE_SAME_SITE?: string\n  AUTH_REDIRECT_BASE_URL?: string\n  DEBUG?: string\n}\n\n// ─────────────────────────────────────────────────────────────────\n// Cookie Helpers\n// ─────────────────────────────────────────────────────────────────\n\n/**\n * Set session cookie with encrypted session data\n */\nexport async function setSessionCookie(\n  c: Context,\n  session: SessionData,\n  config: SessionConfig = defaultSessionConfig\n): Promise<void> {\n  const encoded = await encodeSession(session, config.secret)\n  setCookie(c, config.cookieName, encoded, {\n    path: '/',\n    httpOnly: true,\n    secure: config.cookieSecure,\n    sameSite: config.cookieSameSite === 'none' ? 'None' : config.cookieSameSite === 'strict' ? 'Strict' : 'Lax',\n    maxAge: config.cookieMaxAge,\n  })\n}\n\n/**\n * Clear session cookie\n */\nexport function clearSessionCookie(c: Context, config: SessionConfig = defaultSessionConfig): void {\n  deleteCookie(c, config.cookieName, { path: '/' })\n}\n\n/**\n * Get session from cookie\n */\nexport async function getSessionFromCookie(\n  c: Context,\n  config: SessionConfig = defaultSessionConfig\n): Promise<SessionData | null> {\n  const encoded = getCookie(c, config.cookieName)\n  if (!encoded) return null\n  return decodeSession(encoded, config.secret)\n}\n\n// ─────────────────────────────────────────────────────────────────\n// Middleware\n// ─────────────────────────────────────────────────────────────────\n\n/**\n * Session auth middleware - populates c.var.session and c.var.sessionUser\n *\n * Non-blocking: sets null if no session exists. Use requireSession() for guarded access.\n *\n * @example\n * ```ts\n * app.use('*', sessionAuth())\n * app.get('/me', (c) => {\n *   if (!c.var.session) return c.json({ error: 'Not authenticated' }, 401)\n *   return c.json(c.var.sessionUser)\n * })\n * ```\n */\nexport function sessionAuth(options: SessionAuthOptions = {}): MiddlewareHandler {\n  return async (c, next) => {\n    const env = (c.env ?? {}) as SessionEnv\n    const config = { ...getSessionConfig(env as Record<string, string | undefined>), ...options.config }\n\n    const session = await getSessionFromCookie(c, config)\n\n    c.set('session', session)\n    c.set('sessionUser', session ? {\n      id: session.userId,\n      email: session.email,\n      name: session.name,\n      organizationId: session.organizationId,\n    } : null)\n\n    await next()\n  }\n}\n\n/**\n * Require session middleware - returns 401 if no valid session\n *\n * @example\n * ```ts\n * app.use('/api/*', requireSession())\n * ```\n */\nexport function requireSession(options: SessionAuthOptions = {}): MiddlewareHandler {\n  return async (c, next) => {\n    const env = (c.env ?? {}) as SessionEnv\n    const config = { ...getSessionConfig(env as Record<string, string | undefined>), ...options.config }\n\n    const session = await getSessionFromCookie(c, config)\n\n    if (!session) {\n      return c.json({ error: 'Unauthorized', message: 'Authentication required' }, 401)\n    }\n\n    // Check expiration\n    if (session.expiresAt && Date.now() >= session.expiresAt) {\n      clearSessionCookie(c, config)\n      return c.json({ error: 'Unauthorized', message: 'Session expired' }, 401)\n    }\n\n    c.set('session', session)\n    c.set('sessionUser', {\n      id: session.userId,\n      email: session.email,\n      name: session.name,\n      organizationId: session.organizationId,\n    })\n\n    await next()\n  }\n}\n\n// ─────────────────────────────────────────────────────────────────\n// WorkOS Client\n// ─────────────────────────────────────────────────────────────────\n\n/**\n * Create a lightweight WorkOS client (fetch-based, no SDK dependency)\n */\nfunction createWorkOSClient(apiKey: string) {\n  const baseUrl = 'https://api.workos.com'\n\n  return {\n    getAuthorizationUrl(options: {\n      clientId: string\n      redirectUri: string\n      state?: string\n      provider?: string\n    }): string {\n      const params = new URLSearchParams({\n        client_id: options.clientId,\n        redirect_uri: options.redirectUri,\n        response_type: 'code',\n        ...(options.state && { state: options.state }),\n        ...(options.provider && { provider: options.provider }),\n      })\n      return `https://api.workos.com/sso/authorize?${params.toString()}`\n    },\n\n    async authenticateWithCode(options: {\n      clientId: string\n      code: string\n      redirectUri: string\n    }): Promise<{\n      access_token: string\n      refresh_token?: string\n      expires_in?: number\n      user: {\n        id: string\n        email: string\n        first_name?: string\n        last_name?: string\n        organization_id?: string\n      }\n    }> {\n      const response = await fetch(`${baseUrl}/user_management/authenticate`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n          'Authorization': `Bearer ${apiKey}`,\n        },\n        body: new URLSearchParams({\n          grant_type: 'authorization_code',\n          client_id: options.clientId,\n          code: options.code,\n          redirect_uri: options.redirectUri,\n        }).toString(),\n      })\n\n      if (!response.ok) {\n        const error = await response.text()\n        throw new Error(`WorkOS authentication failed: ${response.status} - ${error}`)\n      }\n\n      return response.json()\n    },\n\n    async refreshToken(options: {\n      clientId: string\n      refreshToken: string\n    }): Promise<{\n      access_token: string\n      refresh_token?: string\n      expires_in?: number\n    }> {\n      const response = await fetch(`${baseUrl}/user_management/authenticate`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n          'Authorization': `Bearer ${apiKey}`,\n        },\n        body: new URLSearchParams({\n          grant_type: 'refresh_token',\n          client_id: options.clientId,\n          refresh_token: options.refreshToken,\n        }).toString(),\n      })\n\n      if (!response.ok) {\n        const error = await response.text()\n        throw new Error(`Token refresh failed: ${response.status} - ${error}`)\n      }\n\n      return response.json()\n    },\n  }\n}\n\n// ─────────────────────────────────────────────────────────────────\n// OAuth Routes Factory\n// ─────────────────────────────────────────────────────────────────\n\n/**\n * Create mountable OAuth routes for login, callback, logout, me, and refresh.\n *\n * @example\n * ```ts\n * import { Hono } from 'hono'\n * import { createOAuthRoutes } from 'oauth.do/hono'\n *\n * const app = new Hono()\n * app.route('/auth', createOAuthRoutes({\n *   workosApiKey: env.WORKOS_API_KEY,\n *   clientId: env.WORKOS_CLIENT_ID,\n *   session: { secret: env.SESSION_SECRET },\n * }))\n * ```\n *\n * Routes:\n * - GET /login - Redirect to WorkOS authorization\n * - GET /callback - Handle OAuth callback, set session cookie\n * - GET /logout - Clear cookie, redirect\n * - POST /logout - Clear cookie, JSON response\n * - GET /me - Return session user info\n * - POST /refresh - Refresh access token\n */\nexport function createOAuthRoutes(options: OAuthRoutesOptions = {}): Hono {\n  const app = new Hono()\n\n  // UTF-8 charset middleware\n  app.use('*', async (c, next) => {\n    await next()\n    const contentType = c.res.headers.get('content-type')\n    if (contentType?.includes('application/json') && !contentType.includes('charset')) {\n      c.res.headers.set('content-type', 'application/json; charset=utf-8')\n    }\n  })\n\n  /**\n   * GET /login - Redirect to WorkOS authorization\n   */\n  app.get('/login', (c) => {\n    const env = (c.env ?? {}) as SessionEnv\n    const apiKey = options.workosApiKey ?? env.WORKOS_API_KEY\n    const clientId = options.clientId ?? env.WORKOS_CLIENT_ID\n\n    if (!apiKey) {\n      return c.json({ error: 'Server configuration error', message: 'WORKOS_API_KEY not configured' }, 500)\n    }\n    if (!clientId) {\n      return c.json({ error: 'Server configuration error', message: 'WORKOS_CLIENT_ID not configured' }, 500)\n    }\n\n    const workos = createWorkOSClient(apiKey)\n    const url = new URL(c.req.url)\n    const baseUrl = options.redirectBaseUrl ?? env.AUTH_REDIRECT_BASE_URL ?? `${url.protocol}//${url.host}`\n\n    const intendedRedirect = c.req.query('redirect_uri') || '/'\n    const provider = c.req.query('provider')\n    const state = btoa(JSON.stringify({ redirect: intendedRedirect }))\n\n    const authUrl = workos.getAuthorizationUrl({\n      clientId,\n      redirectUri: `${baseUrl}/auth/callback`,\n      state,\n      provider,\n    })\n\n    return c.redirect(authUrl)\n  })\n\n  /**\n   * GET /callback - Handle OAuth callback\n   */\n  app.get('/callback', async (c) => {\n    const env = (c.env ?? {}) as SessionEnv\n    const apiKey = options.workosApiKey ?? env.WORKOS_API_KEY\n    const clientId = options.clientId ?? env.WORKOS_CLIENT_ID\n    const sessionConfig = { ...getSessionConfig(env as Record<string, string | undefined>), ...options.session }\n    const debug = options.debug ?? env.DEBUG === 'true'\n\n    if (!apiKey) {\n      return c.json({ error: 'Server configuration error', message: 'WORKOS_API_KEY not configured' }, 500)\n    }\n    if (!clientId) {\n      return c.json({ error: 'Server configuration error', message: 'WORKOS_CLIENT_ID not configured' }, 500)\n    }\n\n    const code = c.req.query('code')\n    const state = c.req.query('state')\n    const error = c.req.query('error')\n    const errorDescription = c.req.query('error_description')\n\n    if (error) {\n      if (debug) console.error('[Auth] OAuth error:', error, errorDescription)\n      return c.json({ error: 'Authentication failed', message: errorDescription || error }, 400)\n    }\n\n    if (!code) {\n      return c.json({ error: 'Missing authorization code' }, 400)\n    }\n\n    const workos = createWorkOSClient(apiKey)\n    const url = new URL(c.req.url)\n    const baseUrl = options.redirectBaseUrl ?? env.AUTH_REDIRECT_BASE_URL ?? `${url.protocol}//${url.host}`\n\n    try {\n      const result = await workos.authenticateWithCode({\n        clientId,\n        code,\n        redirectUri: `${baseUrl}/auth/callback`,\n      })\n\n      const session: SessionData = {\n        userId: result.user.id,\n        organizationId: result.user.organization_id,\n        email: result.user.email,\n        name: [result.user.first_name, result.user.last_name].filter(Boolean).join(' ') || undefined,\n        accessToken: result.access_token,\n        refreshToken: result.refresh_token,\n        expiresAt: result.expires_in ? Date.now() + result.expires_in * 1000 : undefined,\n      }\n\n      await setSessionCookie(c, session, sessionConfig)\n      await options.onLogin?.(session, c)\n\n      let redirectTo = '/'\n      if (state) {\n        try {\n          const stateData = JSON.parse(atob(state))\n          redirectTo = stateData.redirect || '/'\n        } catch {\n          // Invalid state, use default\n        }\n      }\n\n      // Prevent open redirects\n      if (!redirectTo.startsWith('/')) {\n        redirectTo = '/'\n      }\n\n      return c.redirect(redirectTo)\n    } catch (err) {\n      if (debug) console.error('[Auth] OAuth callback error:', err)\n      return c.json({\n        error: 'Authentication failed',\n        message: err instanceof Error ? err.message : 'Unknown error',\n      }, 500)\n    }\n  })\n\n  /**\n   * GET /logout - Clear session and redirect\n   */\n  app.get('/logout', async (c) => {\n    const env = (c.env ?? {}) as SessionEnv\n    const sessionConfig = { ...getSessionConfig(env as Record<string, string | undefined>), ...options.session }\n\n    clearSessionCookie(c, sessionConfig)\n    await options.onLogout?.(c)\n\n    const redirectTo = c.req.query('redirect_uri') || '/'\n    if (!redirectTo.startsWith('/')) {\n      return c.redirect('/')\n    }\n    return c.redirect(redirectTo)\n  })\n\n  /**\n   * POST /logout - JSON response logout\n   */\n  app.post('/logout', async (c) => {\n    const env = (c.env ?? {}) as SessionEnv\n    const sessionConfig = { ...getSessionConfig(env as Record<string, string | undefined>), ...options.session }\n\n    clearSessionCookie(c, sessionConfig)\n    await options.onLogout?.(c)\n\n    return c.json({ success: true, message: 'Logged out successfully' })\n  })\n\n  /**\n   * GET /me - Return session user info\n   */\n  app.get('/me', async (c) => {\n    const env = (c.env ?? {}) as SessionEnv\n    const sessionConfig = { ...getSessionConfig(env as Record<string, string | undefined>), ...options.session }\n\n    const session = await getSessionFromCookie(c, sessionConfig)\n\n    if (!session) {\n      return c.json({ error: 'Unauthorized', message: 'Not authenticated' }, 401)\n    }\n\n    if (session.expiresAt && Date.now() >= session.expiresAt) {\n      clearSessionCookie(c, sessionConfig)\n      return c.json({ error: 'Unauthorized', message: 'Session expired' }, 401)\n    }\n\n    return c.json({\n      id: session.userId,\n      email: session.email,\n      name: session.name,\n      organizationId: session.organizationId,\n    })\n  })\n\n  /**\n   * POST /refresh - Refresh access token\n   */\n  app.post('/refresh', async (c) => {\n    const env = (c.env ?? {}) as SessionEnv\n    const apiKey = options.workosApiKey ?? env.WORKOS_API_KEY\n    const clientId = options.clientId ?? env.WORKOS_CLIENT_ID\n    const sessionConfig = { ...getSessionConfig(env as Record<string, string | undefined>), ...options.session }\n    const debug = options.debug ?? env.DEBUG === 'true'\n\n    if (!apiKey) {\n      return c.json({ error: 'Server configuration error', message: 'WORKOS_API_KEY not configured' }, 500)\n    }\n    if (!clientId) {\n      return c.json({ error: 'Server configuration error', message: 'WORKOS_CLIENT_ID not configured' }, 500)\n    }\n\n    const session = await getSessionFromCookie(c, sessionConfig)\n\n    if (!session) {\n      return c.json({ error: 'Unauthorized', message: 'Not authenticated' }, 401)\n    }\n\n    if (!session.refreshToken) {\n      return c.json({ error: 'Cannot refresh', message: 'No refresh token available' }, 400)\n    }\n\n    const workos = createWorkOSClient(apiKey)\n\n    try {\n      const result = await workos.refreshToken({\n        clientId,\n        refreshToken: session.refreshToken,\n      })\n\n      const updatedSession: SessionData = {\n        ...session,\n        accessToken: result.access_token,\n        refreshToken: result.refresh_token || session.refreshToken,\n        expiresAt: result.expires_in ? Date.now() + result.expires_in * 1000 : undefined,\n      }\n\n      await setSessionCookie(c, updatedSession, sessionConfig)\n\n      return c.json({ success: true, expiresAt: updatedSession.expiresAt })\n    } catch (err) {\n      if (debug) console.error('[Auth] Token refresh error:', err)\n      clearSessionCookie(c, sessionConfig)\n      return c.json({\n        error: 'Refresh failed',\n        message: err instanceof Error ? err.message : 'Unknown error',\n      }, 401)\n    }\n  })\n\n  return app\n}\n"]}