@c-rex/constants 0.3.0-build.89 → 0.3.0-build.95

package/dist/index.d.mts

@@ -1406,7 +1406,8 @@ declare const FILES_EXTENSIONS: {
     readonly PDF: "application/pdf";
     readonly HTML: "text/html";
 };
-declare const DEFAULT_COOKIE_LIMIT: number;
+/** Default cookie lifetime: 30 days, in SECONDS (the unit of `maxAge`). */
+declare const DEFAULT_COOKIE_MAX_AGE_SECONDS: number;
 declare const ICONS_BY_FILE_EXTENSION: {
     readonly "application/pdf": "FaFilePdf";
 };
@@ -1416,16 +1417,103 @@ declare const RENDITION_LINK_RELS: {
     readonly VIEW: "view";
     readonly DOWNLOAD: "download";
 };
-declare const CREX_TOKEN_HEADER_KEY = "crex-token";
 /** Scopes that must both be present in the selected Bearer to use ChatMCP. */
 declare const CHAT_MCP_REQUIRED_SCOPES: readonly ["crex.ids.chat.use", "crex.ids.mcp.use"];
 declare const POST_LOGOUT_RETURN_TO_KEY = "crex-post-logout-return-to";
-/** OIDC Back-Channel Logout 1.0 — required `events` member on a valid `logout_token`. */
-declare const BACKCHANNEL_LOGOUT_EVENT_URI = "http://schemas.openid.net/event/backchannel-logout";
-/** Form field name Keycloak POSTs the signed logout_token under. */
-declare const LOGOUT_TOKEN_FORM_KEY = "logout_token";
-/** NextAuth JWT `error` value set when the SSO session was revoked via back-channel logout. */
-declare const SESSION_REVOKED_ERROR = "SessionRevoked";
+/** Env var name: secret that encrypts the session cookie (server-only). */
+declare const CREX_SESSION_SECRET_ENV = "CREX_SESSION_SECRET";
+/**
+ * Encrypted session cookie. The value is split in chunks
+ * (`crex-session.0`, `crex-session.1`, …) because Keycloak tokens exceed the
+ * 4 KB single-cookie limit.
+ */
+declare const SESSION_COOKIE_NAME = "crex-session";
+/** Max characters of the encrypted session per cookie chunk (name/attrs excluded). */
+declare const SESSION_COOKIE_CHUNK_SIZE = 3400;
+/**
+ * Hard cap on the session cookie (3 x 3400 = 10.2 KB). Node and HTTP.sys both
+ * limit the WHOLE request header block to ~16 KB, so a bigger session would
+ * lock the user out with "431 Request Header Fields Too Large" until it
+ * expires. Over budget the session drops its `id_token`, then is refused.
+ */
+declare const SESSION_COOKIE_MAX_CHUNKS = 3;
+declare const SESSION_PAYLOAD_VERSION = 1;
+/** Counts consecutive rejected refreshes; see `evaluateSession`. */
+declare const REFRESH_FAIL_COOKIE_NAME = "crex-refresh-fail";
+/** Consecutive refresh rejections after which the session is destroyed. */
+declare const REFRESH_FAIL_LIMIT = 2;
+/** Short-lived login transaction (PKCE verifier, state, nonce, returnTo). */
+declare const AUTH_TRANSACTION_COOKIE_NAME = "crex-auth-tx";
+declare const AUTH_TRANSACTION_MAX_AGE_SECONDS: number;
+/** The middleware refreshes when the access token expires within this window. */
+declare const SESSION_REFRESH_SKEW_SECONDS = 60;
+/** Read-only consumers reject an access token expiring within this window. */
+declare const ACCESS_TOKEN_MIN_TTL_SECONDS = 5;
+/**
+ * Refresh-token lifetime assumed when the IdP does not report one
+ * (`refresh_expires_in` absent or 0 = no expiry). A rejected refresh still ends
+ * the session earlier.
+ */
+declare const REFRESH_LIFETIME_FALLBACK_SECONDS: number;
+/** Upper bound for a single token-endpoint call made from the middleware. */
+declare const TOKEN_ENDPOINT_TIMEOUT_MS = 5000;
+/**
+ * Timeout for `openid-client` calls (discovery, code exchange, userinfo). Its
+ * 3.5 s default fails cold starts, where the event loop is still busy compiling.
+ */
+declare const OIDC_HTTP_TIMEOUT_MS = 10000;
+/**
+ * Auth route paths. `CALLBACK` keeps NextAuth's path on purpose: it is the
+ * redirect URI already registered on the Keycloak clients.
+ */
+declare const AUTH_ROUTES: {
+    readonly LOGIN: "/api/auth/login";
+    readonly CALLBACK: "/api/auth/callback/crex";
+    readonly LOGOUT: "/api/auth/logout";
+    readonly SESSION: "/api/auth/session";
+    readonly BACKCHANNEL_LOGOUT: "/api/auth/backchannel-logout";
+    readonly ERROR_PAGE: "/auth/error";
+};
+declare const AUTH_QUERY_PARAMS: {
+    readonly RETURN_TO: "returnTo";
+    readonly PROMPT: "prompt";
+    readonly ERROR: "error";
+};
+/** OIDC `prompt` values the app uses. */
+declare const OIDC_PROMPTS: {
+    readonly LOGIN: "login";
+    readonly NONE: "none";
+};
+/** Header the logout POST must carry so a cross-site form cannot trigger it. */
+declare const LOGOUT_REQUEST_HEADER = "x-crex-logout";
+/** `error` codes on the auth error page. Same names NextAuth used (i18n keys stay valid). */
+declare const AUTH_ERROR_CODES: {
+    readonly CONFIGURATION: "Configuration";
+    readonly ACCESS_DENIED: "AccessDenied";
+    readonly OAUTH_SIGNIN: "OAuthSignin";
+    readonly OAUTH_CALLBACK: "OAuthCallback";
+    readonly CALLBACK: "Callback";
+    readonly DEFAULT: "Default";
+};
+/** `error` value on the session projection when the SSO no longer accepts the refresh. */
+declare const SESSION_REFRESH_ERROR = "RefreshAccessTokenError";
+/**
+ * Per-tab guard: a silent (prompt=none) re-auth is attempted at most once per
+ * tab until the session is observed healthy again.
+ */
+declare const SILENT_REAUTH_ATTEMPTED_KEY = "crex-silent-reauth-attempted";
+/**
+ * One-shot marker set right before navigating to the silent re-auth so
+ * `/auth/error` can tell "our silent attempt failed" from a real login failure.
+ */
+declare const SILENT_REAUTH_INFLIGHT_KEY = "crex-silent-reauth-inflight";
+/**
+ * Cookies written by the previous NextAuth-based implementation. They are
+ * large (JWT + bridged access token) and now useless, so the middleware
+ * expires them instead of letting them ride along on every request.
+ */
+declare const LEGACY_AUTH_COOKIE_PREFIXES: readonly ["next-auth.", "__Secure-next-auth.", "__Host-next-auth."];
+declare const LEGACY_TOKEN_COOKIE_NAME = "crex-token";
 /** Renderer key registered for GMP start-page tile collections (html-enrichment). */
 declare const GMP_TILES_RENDERER = "GMPTilesRenderer";
 /** Per-tab, user-scoped storage used by the GMP ChatMCP client. */
@@ -1451,6 +1539,10 @@ declare const PULSE_DELIVERY_CHANNELS: {
 };
 /** Query param name the contextual "ask the editorial team" link appends the page context under. */
 declare const CONTEXTUAL_EXTERNAL_LINK_CONTEXT_PARAM = "frage";
+/** Route each app mounts the render-article image proxy at (attaches the IDS Bearer server-side; the browser only sends its session cookie). */
+declare const IMAGE_PROXY_ROUTE = "/api/images";
+/** Query param carrying the absolute IDS image URL on `IMAGE_PROXY_ROUTE`. */
+declare const IMAGE_PROXY_SRC_PARAM = "src";
 declare const WILD_CARD_OPTIONS: {
     readonly BOTH: "BOTH";
     readonly END: "END";
@@ -1479,4 +1571,4 @@ declare const BREAKPOINTS: {
 };
 declare const MARKER_COLORS: string[];
 
-export { ALL, API, ARTICLE_PAGE_LAYOUT, AdministrativeMetadataModelFields, AdministrativeMetadataModelFieldsAll, AuditStateModelFields, AuditStateModelFieldsAll, AuthStateModelFields, AuthStateModelFieldsAll, BACKCHANNEL_LOGOUT_EVENT_URI, BLOG_TYPE_AND_LINK, BREAKPOINTS, CHAT_MCP_REQUIRED_SCOPES, CONTENT_LANGUAGES_COOKIE_NAME, CONTENT_LANG_KEY, CONTEXTUAL_EXTERNAL_LINK_CONTEXT_PARAM, CREX_DEFAULT_LANGUAGE_ENV, CREX_GLOBAL_RESTRICTION_ENV, CREX_TOKEN_HEADER_KEY, CategoryModelFields, CategoryModelFieldsAll, ComponentModelFields, ComponentModelFieldsAll, ContentLifeCycleStatusModelFields, ContentLifeCycleStatusModelFieldsAll, ContentLifeCycleStatusValueModelFields, ContentLifeCycleStatusValueModelFieldsAll, DEFAULT_COOKIE_LIMIT, DEFAULT_ICON, DEFAULT_LANG, DEVICE_OPTIONS, DOCUMENT, DOCUMENTS_TYPE_AND_LINK, DirectoryNodeModelFields, DirectoryNodeModelFieldsAll, DirectoryNodeTypeModelFields, DirectoryNodeTypeModelFieldsAll, DocumentModelFields, DocumentModelFieldsAll, DocumentTypeModelFields, DocumentTypeModelFieldsAll, DocumentationMetadataModelFields, DocumentationMetadataModelFieldsAll, DomainEntityModelFields, DomainEntityModelFieldsAll, EN_LANG, EventModelFields, EventModelFieldsAll, ExternalProductGraphicModelFields, ExternalProductGraphicModelFieldsAll, ExternalProductOntologyModelFields, ExternalProductOntologyModelFieldsAll, FILES_EXTENSIONS, FLAGS_BY_LANG, FRAGMENT, FragmentModelFields, FragmentModelFieldsAll, FunctionalMetadataModelFields, FunctionalMetadataModelFieldsAll, GMP_CHAT_SESSION_SNAPSHOT_VERSION, GMP_CHAT_SESSION_STORAGE_KEY, GMP_TILES_RENDERER, ICONS_BY_FILE_EXTENSION, IdentityDomainModelFields, IdentityDomainModelFieldsAll, IdentityModelFields, IdentityModelFieldsAll, InformationObjectModelFields, InformationObjectModelFieldsAll, InformationSubjectCollectionModelFields, InformationSubjectCollectionModelFieldsAll, InformationSubjectConformityModelFields, InformationSubjectConformityModelFieldsAll, InformationSubjectFormalityModelFields, InformationSubjectFormalityModelFieldsAll, InformationSubjectFunctionalityModelFields, InformationSubjectFunctionalityModelFieldsAll, InformationSubjectModelFields, InformationSubjectModelFieldsAll, InformationSubjectProcessModelFields, InformationSubjectProcessModelFieldsAll, InformationSubjectSafetyModelFields, InformationSubjectSafetyModelFieldsAll, InformationSubjectSafetyWarningMessageModelFields, InformationSubjectSafetyWarningMessageModelFieldsAll, InformationSubjectTechnicalDataModelFields, InformationSubjectTechnicalDataModelFieldsAll, InformationSubjectTechnicalOverviewModelFields, InformationSubjectTechnicalOverviewModelFieldsAll, InformationTypeModelFields, InformationTypeModelFieldsAll, InformationUnitModelFields, InformationUnitModelFieldsAll, LOGOUT_TOKEN_FORM_KEY, LOG_CATEGORIES, LOG_LEVELS, MARKER_COLORS, OPERATOR_OPTIONS, OwlClassModelFields, OwlClassModelFieldsAll, PACKAGE, PERSONALIZATION_MODES, POST_LOGOUT_RETURN_TO_KEY, PULSE_DELIVERY_CHANNELS, PackageModelFields, PackageModelFieldsAll, PartyModelFields, PartyModelFieldsAll, PartyRoleModelFields, PartyRoleModelFieldsAll, PlanningDownTimeModelFields, PlanningDownTimeModelFieldsAll, PlanningMaintenanceIntervalModelFields, PlanningMaintenanceIntervalModelFieldsAll, PlanningSetupTimeModelFields, PlanningSetupTimeModelFieldsAll, PlanningTimeModelFields, PlanningTimeModelFieldsAll, PlanningWorkingTimeModelFields, PlanningWorkingTimeModelFieldsAll, ProductFeatureModelFields, ProductFeatureModelFieldsAll, ProductFunctionModelFields, ProductFunctionModelFieldsAll, ProductLcpAfterUseModelFields, ProductLcpAfterUseModelFieldsAll, ProductLcpDesignAndRealizationModelFields, ProductLcpDesignAndRealizationModelFieldsAll, ProductLcpPuttingToUseModelFields, ProductLcpPuttingToUseModelFieldsAll, ProductLcpUseModelFields, ProductLcpUseModelFieldsAll, ProductLifeCyclePhaseModelFields, ProductLifeCyclePhaseModelFieldsAll, ProductMetadataModelFields, ProductMetadataModelFieldsAll, ProductPropertyModelFields, ProductPropertyModelFieldsAll, ProductVariantModelFields, ProductVariantModelFieldsAll, QualificationModelFields, QualificationModelFieldsAll, QualificationRoleModelFields, QualificationRoleModelFieldsAll, QualificationSkillLevelModelFields, QualificationSkillLevelModelFieldsAll, RENDITION_LINK_RELS, RESULT_TYPES, RESULT_VIEW_STYLES, RenditionModelFields, RenditionModelFieldsAll, RenditionSelectorModelFields, RenditionSelectorModelFieldsAll, SDK_CONFIG_KEY, SEARCH_SETTINGS_COOKIE_NAME, SESSION_REVOKED_ERROR, SupplyConsumableModelFields, SupplyConsumableModelFieldsAll, SupplyHardwareToolModelFields, SupplyHardwareToolModelFieldsAll, SupplyLubricantModelFields, SupplyLubricantModelFieldsAll, SupplyModelFields, SupplyModelFieldsAll, SupplyOperatingModelFields, SupplyOperatingModelFieldsAll, SupplySparePartModelFields, SupplySparePartModelFieldsAll, TOC_SCROLL_HISTORY_STATE_KEY, TOKEN_SOURCES, TOPIC, TOPICS_TYPE_AND_LINK, TopicModelFields, TopicModelFieldsAll, TopicTypeConceptModelFields, TopicTypeConceptModelFieldsAll, TopicTypeFormModelFields, TopicTypeFormModelFieldsAll, TopicTypeLearningModelFields, TopicTypeLearningModelFieldsAll, TopicTypeModelFields, TopicTypeModelFieldsAll, TopicTypeReferenceModelFields, TopicTypeReferenceModelFieldsAll, TopicTypeTaskModelFields, TopicTypeTaskModelFieldsAll, TopicTypeTroubleShootingModelFields, TopicTypeTroubleShootingModelFieldsAll, UI_LANG_KEY, UI_LANG_OPTIONS, UI_PREFERENCES_COOKIE_NAME, VCardCalendarModelFields, VCardCalendarModelFieldsAll, VCardGroupModelFields, VCardGroupModelFieldsAll, VCardImageModelFields, VCardImageModelFieldsAll, VCardIndividualModelFields, VCardIndividualModelFieldsAll, VCardInfoModelFields, VCardInfoModelFieldsAll, VCardLocationModelFields, VCardLocationModelFieldsAll, VCardModelFields, VCardModelFieldsAll, VCardOrganizationModelFields, VCardOrganizationModelFieldsAll, WILD_CARD_OPTIONS };
+export { ACCESS_TOKEN_MIN_TTL_SECONDS, ALL, API, ARTICLE_PAGE_LAYOUT, AUTH_ERROR_CODES, AUTH_QUERY_PARAMS, AUTH_ROUTES, AUTH_TRANSACTION_COOKIE_NAME, AUTH_TRANSACTION_MAX_AGE_SECONDS, AdministrativeMetadataModelFields, AdministrativeMetadataModelFieldsAll, AuditStateModelFields, AuditStateModelFieldsAll, AuthStateModelFields, AuthStateModelFieldsAll, BLOG_TYPE_AND_LINK, BREAKPOINTS, CHAT_MCP_REQUIRED_SCOPES, CONTENT_LANGUAGES_COOKIE_NAME, CONTENT_LANG_KEY, CONTEXTUAL_EXTERNAL_LINK_CONTEXT_PARAM, CREX_DEFAULT_LANGUAGE_ENV, CREX_GLOBAL_RESTRICTION_ENV, CREX_SESSION_SECRET_ENV, CategoryModelFields, CategoryModelFieldsAll, ComponentModelFields, ComponentModelFieldsAll, ContentLifeCycleStatusModelFields, ContentLifeCycleStatusModelFieldsAll, ContentLifeCycleStatusValueModelFields, ContentLifeCycleStatusValueModelFieldsAll, DEFAULT_COOKIE_MAX_AGE_SECONDS, DEFAULT_ICON, DEFAULT_LANG, DEVICE_OPTIONS, DOCUMENT, DOCUMENTS_TYPE_AND_LINK, DirectoryNodeModelFields, DirectoryNodeModelFieldsAll, DirectoryNodeTypeModelFields, DirectoryNodeTypeModelFieldsAll, DocumentModelFields, DocumentModelFieldsAll, DocumentTypeModelFields, DocumentTypeModelFieldsAll, DocumentationMetadataModelFields, DocumentationMetadataModelFieldsAll, DomainEntityModelFields, DomainEntityModelFieldsAll, EN_LANG, EventModelFields, EventModelFieldsAll, ExternalProductGraphicModelFields, ExternalProductGraphicModelFieldsAll, ExternalProductOntologyModelFields, ExternalProductOntologyModelFieldsAll, FILES_EXTENSIONS, FLAGS_BY_LANG, FRAGMENT, FragmentModelFields, FragmentModelFieldsAll, FunctionalMetadataModelFields, FunctionalMetadataModelFieldsAll, GMP_CHAT_SESSION_SNAPSHOT_VERSION, GMP_CHAT_SESSION_STORAGE_KEY, GMP_TILES_RENDERER, ICONS_BY_FILE_EXTENSION, IMAGE_PROXY_ROUTE, IMAGE_PROXY_SRC_PARAM, IdentityDomainModelFields, IdentityDomainModelFieldsAll, IdentityModelFields, IdentityModelFieldsAll, InformationObjectModelFields, InformationObjectModelFieldsAll, InformationSubjectCollectionModelFields, InformationSubjectCollectionModelFieldsAll, InformationSubjectConformityModelFields, InformationSubjectConformityModelFieldsAll, InformationSubjectFormalityModelFields, InformationSubjectFormalityModelFieldsAll, InformationSubjectFunctionalityModelFields, InformationSubjectFunctionalityModelFieldsAll, InformationSubjectModelFields, InformationSubjectModelFieldsAll, InformationSubjectProcessModelFields, InformationSubjectProcessModelFieldsAll, InformationSubjectSafetyModelFields, InformationSubjectSafetyModelFieldsAll, InformationSubjectSafetyWarningMessageModelFields, InformationSubjectSafetyWarningMessageModelFieldsAll, InformationSubjectTechnicalDataModelFields, InformationSubjectTechnicalDataModelFieldsAll, InformationSubjectTechnicalOverviewModelFields, InformationSubjectTechnicalOverviewModelFieldsAll, InformationTypeModelFields, InformationTypeModelFieldsAll, InformationUnitModelFields, InformationUnitModelFieldsAll, LEGACY_AUTH_COOKIE_PREFIXES, LEGACY_TOKEN_COOKIE_NAME, LOGOUT_REQUEST_HEADER, LOG_CATEGORIES, LOG_LEVELS, MARKER_COLORS, OIDC_HTTP_TIMEOUT_MS, OIDC_PROMPTS, OPERATOR_OPTIONS, OwlClassModelFields, OwlClassModelFieldsAll, PACKAGE, PERSONALIZATION_MODES, POST_LOGOUT_RETURN_TO_KEY, PULSE_DELIVERY_CHANNELS, PackageModelFields, PackageModelFieldsAll, PartyModelFields, PartyModelFieldsAll, PartyRoleModelFields, PartyRoleModelFieldsAll, PlanningDownTimeModelFields, PlanningDownTimeModelFieldsAll, PlanningMaintenanceIntervalModelFields, PlanningMaintenanceIntervalModelFieldsAll, PlanningSetupTimeModelFields, PlanningSetupTimeModelFieldsAll, PlanningTimeModelFields, PlanningTimeModelFieldsAll, PlanningWorkingTimeModelFields, PlanningWorkingTimeModelFieldsAll, ProductFeatureModelFields, ProductFeatureModelFieldsAll, ProductFunctionModelFields, ProductFunctionModelFieldsAll, ProductLcpAfterUseModelFields, ProductLcpAfterUseModelFieldsAll, ProductLcpDesignAndRealizationModelFields, ProductLcpDesignAndRealizationModelFieldsAll, ProductLcpPuttingToUseModelFields, ProductLcpPuttingToUseModelFieldsAll, ProductLcpUseModelFields, ProductLcpUseModelFieldsAll, ProductLifeCyclePhaseModelFields, ProductLifeCyclePhaseModelFieldsAll, ProductMetadataModelFields, ProductMetadataModelFieldsAll, ProductPropertyModelFields, ProductPropertyModelFieldsAll, ProductVariantModelFields, ProductVariantModelFieldsAll, QualificationModelFields, QualificationModelFieldsAll, QualificationRoleModelFields, QualificationRoleModelFieldsAll, QualificationSkillLevelModelFields, QualificationSkillLevelModelFieldsAll, REFRESH_FAIL_COOKIE_NAME, REFRESH_FAIL_LIMIT, REFRESH_LIFETIME_FALLBACK_SECONDS, RENDITION_LINK_RELS, RESULT_TYPES, RESULT_VIEW_STYLES, RenditionModelFields, RenditionModelFieldsAll, RenditionSelectorModelFields, RenditionSelectorModelFieldsAll, SDK_CONFIG_KEY, SEARCH_SETTINGS_COOKIE_NAME, SESSION_COOKIE_CHUNK_SIZE, SESSION_COOKIE_MAX_CHUNKS, SESSION_COOKIE_NAME, SESSION_PAYLOAD_VERSION, SESSION_REFRESH_ERROR, SESSION_REFRESH_SKEW_SECONDS, SILENT_REAUTH_ATTEMPTED_KEY, SILENT_REAUTH_INFLIGHT_KEY, SupplyConsumableModelFields, SupplyConsumableModelFieldsAll, SupplyHardwareToolModelFields, SupplyHardwareToolModelFieldsAll, SupplyLubricantModelFields, SupplyLubricantModelFieldsAll, SupplyModelFields, SupplyModelFieldsAll, SupplyOperatingModelFields, SupplyOperatingModelFieldsAll, SupplySparePartModelFields, SupplySparePartModelFieldsAll, TOC_SCROLL_HISTORY_STATE_KEY, TOKEN_ENDPOINT_TIMEOUT_MS, TOKEN_SOURCES, TOPIC, TOPICS_TYPE_AND_LINK, TopicModelFields, TopicModelFieldsAll, TopicTypeConceptModelFields, TopicTypeConceptModelFieldsAll, TopicTypeFormModelFields, TopicTypeFormModelFieldsAll, TopicTypeLearningModelFields, TopicTypeLearningModelFieldsAll, TopicTypeModelFields, TopicTypeModelFieldsAll, TopicTypeReferenceModelFields, TopicTypeReferenceModelFieldsAll, TopicTypeTaskModelFields, TopicTypeTaskModelFieldsAll, TopicTypeTroubleShootingModelFields, TopicTypeTroubleShootingModelFieldsAll, UI_LANG_KEY, UI_LANG_OPTIONS, UI_PREFERENCES_COOKIE_NAME, VCardCalendarModelFields, VCardCalendarModelFieldsAll, VCardGroupModelFields, VCardGroupModelFieldsAll, VCardImageModelFields, VCardImageModelFieldsAll, VCardIndividualModelFields, VCardIndividualModelFieldsAll, VCardInfoModelFields, VCardInfoModelFieldsAll, VCardLocationModelFields, VCardLocationModelFieldsAll, VCardModelFields, VCardModelFieldsAll, VCardOrganizationModelFields, VCardOrganizationModelFieldsAll, WILD_CARD_OPTIONS };

package/dist/index.d.ts

@@ -1406,7 +1406,8 @@ declare const FILES_EXTENSIONS: {
     readonly PDF: "application/pdf";
     readonly HTML: "text/html";
 };
-declare const DEFAULT_COOKIE_LIMIT: number;
+/** Default cookie lifetime: 30 days, in SECONDS (the unit of `maxAge`). */
+declare const DEFAULT_COOKIE_MAX_AGE_SECONDS: number;
 declare const ICONS_BY_FILE_EXTENSION: {
     readonly "application/pdf": "FaFilePdf";
 };
@@ -1416,16 +1417,103 @@ declare const RENDITION_LINK_RELS: {
     readonly VIEW: "view";
     readonly DOWNLOAD: "download";
 };
-declare const CREX_TOKEN_HEADER_KEY = "crex-token";
 /** Scopes that must both be present in the selected Bearer to use ChatMCP. */
 declare const CHAT_MCP_REQUIRED_SCOPES: readonly ["crex.ids.chat.use", "crex.ids.mcp.use"];
 declare const POST_LOGOUT_RETURN_TO_KEY = "crex-post-logout-return-to";
-/** OIDC Back-Channel Logout 1.0 — required `events` member on a valid `logout_token`. */
-declare const BACKCHANNEL_LOGOUT_EVENT_URI = "http://schemas.openid.net/event/backchannel-logout";
-/** Form field name Keycloak POSTs the signed logout_token under. */
-declare const LOGOUT_TOKEN_FORM_KEY = "logout_token";
-/** NextAuth JWT `error` value set when the SSO session was revoked via back-channel logout. */
-declare const SESSION_REVOKED_ERROR = "SessionRevoked";
+/** Env var name: secret that encrypts the session cookie (server-only). */
+declare const CREX_SESSION_SECRET_ENV = "CREX_SESSION_SECRET";
+/**
+ * Encrypted session cookie. The value is split in chunks
+ * (`crex-session.0`, `crex-session.1`, …) because Keycloak tokens exceed the
+ * 4 KB single-cookie limit.
+ */
+declare const SESSION_COOKIE_NAME = "crex-session";
+/** Max characters of the encrypted session per cookie chunk (name/attrs excluded). */
+declare const SESSION_COOKIE_CHUNK_SIZE = 3400;
+/**
+ * Hard cap on the session cookie (3 x 3400 = 10.2 KB). Node and HTTP.sys both
+ * limit the WHOLE request header block to ~16 KB, so a bigger session would
+ * lock the user out with "431 Request Header Fields Too Large" until it
+ * expires. Over budget the session drops its `id_token`, then is refused.
+ */
+declare const SESSION_COOKIE_MAX_CHUNKS = 3;
+declare const SESSION_PAYLOAD_VERSION = 1;
+/** Counts consecutive rejected refreshes; see `evaluateSession`. */
+declare const REFRESH_FAIL_COOKIE_NAME = "crex-refresh-fail";
+/** Consecutive refresh rejections after which the session is destroyed. */
+declare const REFRESH_FAIL_LIMIT = 2;
+/** Short-lived login transaction (PKCE verifier, state, nonce, returnTo). */
+declare const AUTH_TRANSACTION_COOKIE_NAME = "crex-auth-tx";
+declare const AUTH_TRANSACTION_MAX_AGE_SECONDS: number;
+/** The middleware refreshes when the access token expires within this window. */
+declare const SESSION_REFRESH_SKEW_SECONDS = 60;
+/** Read-only consumers reject an access token expiring within this window. */
+declare const ACCESS_TOKEN_MIN_TTL_SECONDS = 5;
+/**
+ * Refresh-token lifetime assumed when the IdP does not report one
+ * (`refresh_expires_in` absent or 0 = no expiry). A rejected refresh still ends
+ * the session earlier.
+ */
+declare const REFRESH_LIFETIME_FALLBACK_SECONDS: number;
+/** Upper bound for a single token-endpoint call made from the middleware. */
+declare const TOKEN_ENDPOINT_TIMEOUT_MS = 5000;
+/**
+ * Timeout for `openid-client` calls (discovery, code exchange, userinfo). Its
+ * 3.5 s default fails cold starts, where the event loop is still busy compiling.
+ */
+declare const OIDC_HTTP_TIMEOUT_MS = 10000;
+/**
+ * Auth route paths. `CALLBACK` keeps NextAuth's path on purpose: it is the
+ * redirect URI already registered on the Keycloak clients.
+ */
+declare const AUTH_ROUTES: {
+    readonly LOGIN: "/api/auth/login";
+    readonly CALLBACK: "/api/auth/callback/crex";
+    readonly LOGOUT: "/api/auth/logout";
+    readonly SESSION: "/api/auth/session";
+    readonly BACKCHANNEL_LOGOUT: "/api/auth/backchannel-logout";
+    readonly ERROR_PAGE: "/auth/error";
+};
+declare const AUTH_QUERY_PARAMS: {
+    readonly RETURN_TO: "returnTo";
+    readonly PROMPT: "prompt";
+    readonly ERROR: "error";
+};
+/** OIDC `prompt` values the app uses. */
+declare const OIDC_PROMPTS: {
+    readonly LOGIN: "login";
+    readonly NONE: "none";
+};
+/** Header the logout POST must carry so a cross-site form cannot trigger it. */
+declare const LOGOUT_REQUEST_HEADER = "x-crex-logout";
+/** `error` codes on the auth error page. Same names NextAuth used (i18n keys stay valid). */
+declare const AUTH_ERROR_CODES: {
+    readonly CONFIGURATION: "Configuration";
+    readonly ACCESS_DENIED: "AccessDenied";
+    readonly OAUTH_SIGNIN: "OAuthSignin";
+    readonly OAUTH_CALLBACK: "OAuthCallback";
+    readonly CALLBACK: "Callback";
+    readonly DEFAULT: "Default";
+};
+/** `error` value on the session projection when the SSO no longer accepts the refresh. */
+declare const SESSION_REFRESH_ERROR = "RefreshAccessTokenError";
+/**
+ * Per-tab guard: a silent (prompt=none) re-auth is attempted at most once per
+ * tab until the session is observed healthy again.
+ */
+declare const SILENT_REAUTH_ATTEMPTED_KEY = "crex-silent-reauth-attempted";
+/**
+ * One-shot marker set right before navigating to the silent re-auth so
+ * `/auth/error` can tell "our silent attempt failed" from a real login failure.
+ */
+declare const SILENT_REAUTH_INFLIGHT_KEY = "crex-silent-reauth-inflight";
+/**
+ * Cookies written by the previous NextAuth-based implementation. They are
+ * large (JWT + bridged access token) and now useless, so the middleware
+ * expires them instead of letting them ride along on every request.
+ */
+declare const LEGACY_AUTH_COOKIE_PREFIXES: readonly ["next-auth.", "__Secure-next-auth.", "__Host-next-auth."];
+declare const LEGACY_TOKEN_COOKIE_NAME = "crex-token";
 /** Renderer key registered for GMP start-page tile collections (html-enrichment). */
 declare const GMP_TILES_RENDERER = "GMPTilesRenderer";
 /** Per-tab, user-scoped storage used by the GMP ChatMCP client. */
@@ -1451,6 +1539,10 @@ declare const PULSE_DELIVERY_CHANNELS: {
 };
 /** Query param name the contextual "ask the editorial team" link appends the page context under. */
 declare const CONTEXTUAL_EXTERNAL_LINK_CONTEXT_PARAM = "frage";
+/** Route each app mounts the render-article image proxy at (attaches the IDS Bearer server-side; the browser only sends its session cookie). */
+declare const IMAGE_PROXY_ROUTE = "/api/images";
+/** Query param carrying the absolute IDS image URL on `IMAGE_PROXY_ROUTE`. */
+declare const IMAGE_PROXY_SRC_PARAM = "src";
 declare const WILD_CARD_OPTIONS: {
     readonly BOTH: "BOTH";
     readonly END: "END";
@@ -1479,4 +1571,4 @@ declare const BREAKPOINTS: {
 };
 declare const MARKER_COLORS: string[];
 
-export { ALL, API, ARTICLE_PAGE_LAYOUT, AdministrativeMetadataModelFields, AdministrativeMetadataModelFieldsAll, AuditStateModelFields, AuditStateModelFieldsAll, AuthStateModelFields, AuthStateModelFieldsAll, BACKCHANNEL_LOGOUT_EVENT_URI, BLOG_TYPE_AND_LINK, BREAKPOINTS, CHAT_MCP_REQUIRED_SCOPES, CONTENT_LANGUAGES_COOKIE_NAME, CONTENT_LANG_KEY, CONTEXTUAL_EXTERNAL_LINK_CONTEXT_PARAM, CREX_DEFAULT_LANGUAGE_ENV, CREX_GLOBAL_RESTRICTION_ENV, CREX_TOKEN_HEADER_KEY, CategoryModelFields, CategoryModelFieldsAll, ComponentModelFields, ComponentModelFieldsAll, ContentLifeCycleStatusModelFields, ContentLifeCycleStatusModelFieldsAll, ContentLifeCycleStatusValueModelFields, ContentLifeCycleStatusValueModelFieldsAll, DEFAULT_COOKIE_LIMIT, DEFAULT_ICON, DEFAULT_LANG, DEVICE_OPTIONS, DOCUMENT, DOCUMENTS_TYPE_AND_LINK, DirectoryNodeModelFields, DirectoryNodeModelFieldsAll, DirectoryNodeTypeModelFields, DirectoryNodeTypeModelFieldsAll, DocumentModelFields, DocumentModelFieldsAll, DocumentTypeModelFields, DocumentTypeModelFieldsAll, DocumentationMetadataModelFields, DocumentationMetadataModelFieldsAll, DomainEntityModelFields, DomainEntityModelFieldsAll, EN_LANG, EventModelFields, EventModelFieldsAll, ExternalProductGraphicModelFields, ExternalProductGraphicModelFieldsAll, ExternalProductOntologyModelFields, ExternalProductOntologyModelFieldsAll, FILES_EXTENSIONS, FLAGS_BY_LANG, FRAGMENT, FragmentModelFields, FragmentModelFieldsAll, FunctionalMetadataModelFields, FunctionalMetadataModelFieldsAll, GMP_CHAT_SESSION_SNAPSHOT_VERSION, GMP_CHAT_SESSION_STORAGE_KEY, GMP_TILES_RENDERER, ICONS_BY_FILE_EXTENSION, IdentityDomainModelFields, IdentityDomainModelFieldsAll, IdentityModelFields, IdentityModelFieldsAll, InformationObjectModelFields, InformationObjectModelFieldsAll, InformationSubjectCollectionModelFields, InformationSubjectCollectionModelFieldsAll, InformationSubjectConformityModelFields, InformationSubjectConformityModelFieldsAll, InformationSubjectFormalityModelFields, InformationSubjectFormalityModelFieldsAll, InformationSubjectFunctionalityModelFields, InformationSubjectFunctionalityModelFieldsAll, InformationSubjectModelFields, InformationSubjectModelFieldsAll, InformationSubjectProcessModelFields, InformationSubjectProcessModelFieldsAll, InformationSubjectSafetyModelFields, InformationSubjectSafetyModelFieldsAll, InformationSubjectSafetyWarningMessageModelFields, InformationSubjectSafetyWarningMessageModelFieldsAll, InformationSubjectTechnicalDataModelFields, InformationSubjectTechnicalDataModelFieldsAll, InformationSubjectTechnicalOverviewModelFields, InformationSubjectTechnicalOverviewModelFieldsAll, InformationTypeModelFields, InformationTypeModelFieldsAll, InformationUnitModelFields, InformationUnitModelFieldsAll, LOGOUT_TOKEN_FORM_KEY, LOG_CATEGORIES, LOG_LEVELS, MARKER_COLORS, OPERATOR_OPTIONS, OwlClassModelFields, OwlClassModelFieldsAll, PACKAGE, PERSONALIZATION_MODES, POST_LOGOUT_RETURN_TO_KEY, PULSE_DELIVERY_CHANNELS, PackageModelFields, PackageModelFieldsAll, PartyModelFields, PartyModelFieldsAll, PartyRoleModelFields, PartyRoleModelFieldsAll, PlanningDownTimeModelFields, PlanningDownTimeModelFieldsAll, PlanningMaintenanceIntervalModelFields, PlanningMaintenanceIntervalModelFieldsAll, PlanningSetupTimeModelFields, PlanningSetupTimeModelFieldsAll, PlanningTimeModelFields, PlanningTimeModelFieldsAll, PlanningWorkingTimeModelFields, PlanningWorkingTimeModelFieldsAll, ProductFeatureModelFields, ProductFeatureModelFieldsAll, ProductFunctionModelFields, ProductFunctionModelFieldsAll, ProductLcpAfterUseModelFields, ProductLcpAfterUseModelFieldsAll, ProductLcpDesignAndRealizationModelFields, ProductLcpDesignAndRealizationModelFieldsAll, ProductLcpPuttingToUseModelFields, ProductLcpPuttingToUseModelFieldsAll, ProductLcpUseModelFields, ProductLcpUseModelFieldsAll, ProductLifeCyclePhaseModelFields, ProductLifeCyclePhaseModelFieldsAll, ProductMetadataModelFields, ProductMetadataModelFieldsAll, ProductPropertyModelFields, ProductPropertyModelFieldsAll, ProductVariantModelFields, ProductVariantModelFieldsAll, QualificationModelFields, QualificationModelFieldsAll, QualificationRoleModelFields, QualificationRoleModelFieldsAll, QualificationSkillLevelModelFields, QualificationSkillLevelModelFieldsAll, RENDITION_LINK_RELS, RESULT_TYPES, RESULT_VIEW_STYLES, RenditionModelFields, RenditionModelFieldsAll, RenditionSelectorModelFields, RenditionSelectorModelFieldsAll, SDK_CONFIG_KEY, SEARCH_SETTINGS_COOKIE_NAME, SESSION_REVOKED_ERROR, SupplyConsumableModelFields, SupplyConsumableModelFieldsAll, SupplyHardwareToolModelFields, SupplyHardwareToolModelFieldsAll, SupplyLubricantModelFields, SupplyLubricantModelFieldsAll, SupplyModelFields, SupplyModelFieldsAll, SupplyOperatingModelFields, SupplyOperatingModelFieldsAll, SupplySparePartModelFields, SupplySparePartModelFieldsAll, TOC_SCROLL_HISTORY_STATE_KEY, TOKEN_SOURCES, TOPIC, TOPICS_TYPE_AND_LINK, TopicModelFields, TopicModelFieldsAll, TopicTypeConceptModelFields, TopicTypeConceptModelFieldsAll, TopicTypeFormModelFields, TopicTypeFormModelFieldsAll, TopicTypeLearningModelFields, TopicTypeLearningModelFieldsAll, TopicTypeModelFields, TopicTypeModelFieldsAll, TopicTypeReferenceModelFields, TopicTypeReferenceModelFieldsAll, TopicTypeTaskModelFields, TopicTypeTaskModelFieldsAll, TopicTypeTroubleShootingModelFields, TopicTypeTroubleShootingModelFieldsAll, UI_LANG_KEY, UI_LANG_OPTIONS, UI_PREFERENCES_COOKIE_NAME, VCardCalendarModelFields, VCardCalendarModelFieldsAll, VCardGroupModelFields, VCardGroupModelFieldsAll, VCardImageModelFields, VCardImageModelFieldsAll, VCardIndividualModelFields, VCardIndividualModelFieldsAll, VCardInfoModelFields, VCardInfoModelFieldsAll, VCardLocationModelFields, VCardLocationModelFieldsAll, VCardModelFields, VCardModelFieldsAll, VCardOrganizationModelFields, VCardOrganizationModelFieldsAll, WILD_CARD_OPTIONS };
+export { ACCESS_TOKEN_MIN_TTL_SECONDS, ALL, API, ARTICLE_PAGE_LAYOUT, AUTH_ERROR_CODES, AUTH_QUERY_PARAMS, AUTH_ROUTES, AUTH_TRANSACTION_COOKIE_NAME, AUTH_TRANSACTION_MAX_AGE_SECONDS, AdministrativeMetadataModelFields, AdministrativeMetadataModelFieldsAll, AuditStateModelFields, AuditStateModelFieldsAll, AuthStateModelFields, AuthStateModelFieldsAll, BLOG_TYPE_AND_LINK, BREAKPOINTS, CHAT_MCP_REQUIRED_SCOPES, CONTENT_LANGUAGES_COOKIE_NAME, CONTENT_LANG_KEY, CONTEXTUAL_EXTERNAL_LINK_CONTEXT_PARAM, CREX_DEFAULT_LANGUAGE_ENV, CREX_GLOBAL_RESTRICTION_ENV, CREX_SESSION_SECRET_ENV, CategoryModelFields, CategoryModelFieldsAll, ComponentModelFields, ComponentModelFieldsAll, ContentLifeCycleStatusModelFields, ContentLifeCycleStatusModelFieldsAll, ContentLifeCycleStatusValueModelFields, ContentLifeCycleStatusValueModelFieldsAll, DEFAULT_COOKIE_MAX_AGE_SECONDS, DEFAULT_ICON, DEFAULT_LANG, DEVICE_OPTIONS, DOCUMENT, DOCUMENTS_TYPE_AND_LINK, DirectoryNodeModelFields, DirectoryNodeModelFieldsAll, DirectoryNodeTypeModelFields, DirectoryNodeTypeModelFieldsAll, DocumentModelFields, DocumentModelFieldsAll, DocumentTypeModelFields, DocumentTypeModelFieldsAll, DocumentationMetadataModelFields, DocumentationMetadataModelFieldsAll, DomainEntityModelFields, DomainEntityModelFieldsAll, EN_LANG, EventModelFields, EventModelFieldsAll, ExternalProductGraphicModelFields, ExternalProductGraphicModelFieldsAll, ExternalProductOntologyModelFields, ExternalProductOntologyModelFieldsAll, FILES_EXTENSIONS, FLAGS_BY_LANG, FRAGMENT, FragmentModelFields, FragmentModelFieldsAll, FunctionalMetadataModelFields, FunctionalMetadataModelFieldsAll, GMP_CHAT_SESSION_SNAPSHOT_VERSION, GMP_CHAT_SESSION_STORAGE_KEY, GMP_TILES_RENDERER, ICONS_BY_FILE_EXTENSION, IMAGE_PROXY_ROUTE, IMAGE_PROXY_SRC_PARAM, IdentityDomainModelFields, IdentityDomainModelFieldsAll, IdentityModelFields, IdentityModelFieldsAll, InformationObjectModelFields, InformationObjectModelFieldsAll, InformationSubjectCollectionModelFields, InformationSubjectCollectionModelFieldsAll, InformationSubjectConformityModelFields, InformationSubjectConformityModelFieldsAll, InformationSubjectFormalityModelFields, InformationSubjectFormalityModelFieldsAll, InformationSubjectFunctionalityModelFields, InformationSubjectFunctionalityModelFieldsAll, InformationSubjectModelFields, InformationSubjectModelFieldsAll, InformationSubjectProcessModelFields, InformationSubjectProcessModelFieldsAll, InformationSubjectSafetyModelFields, InformationSubjectSafetyModelFieldsAll, InformationSubjectSafetyWarningMessageModelFields, InformationSubjectSafetyWarningMessageModelFieldsAll, InformationSubjectTechnicalDataModelFields, InformationSubjectTechnicalDataModelFieldsAll, InformationSubjectTechnicalOverviewModelFields, InformationSubjectTechnicalOverviewModelFieldsAll, InformationTypeModelFields, InformationTypeModelFieldsAll, InformationUnitModelFields, InformationUnitModelFieldsAll, LEGACY_AUTH_COOKIE_PREFIXES, LEGACY_TOKEN_COOKIE_NAME, LOGOUT_REQUEST_HEADER, LOG_CATEGORIES, LOG_LEVELS, MARKER_COLORS, OIDC_HTTP_TIMEOUT_MS, OIDC_PROMPTS, OPERATOR_OPTIONS, OwlClassModelFields, OwlClassModelFieldsAll, PACKAGE, PERSONALIZATION_MODES, POST_LOGOUT_RETURN_TO_KEY, PULSE_DELIVERY_CHANNELS, PackageModelFields, PackageModelFieldsAll, PartyModelFields, PartyModelFieldsAll, PartyRoleModelFields, PartyRoleModelFieldsAll, PlanningDownTimeModelFields, PlanningDownTimeModelFieldsAll, PlanningMaintenanceIntervalModelFields, PlanningMaintenanceIntervalModelFieldsAll, PlanningSetupTimeModelFields, PlanningSetupTimeModelFieldsAll, PlanningTimeModelFields, PlanningTimeModelFieldsAll, PlanningWorkingTimeModelFields, PlanningWorkingTimeModelFieldsAll, ProductFeatureModelFields, ProductFeatureModelFieldsAll, ProductFunctionModelFields, ProductFunctionModelFieldsAll, ProductLcpAfterUseModelFields, ProductLcpAfterUseModelFieldsAll, ProductLcpDesignAndRealizationModelFields, ProductLcpDesignAndRealizationModelFieldsAll, ProductLcpPuttingToUseModelFields, ProductLcpPuttingToUseModelFieldsAll, ProductLcpUseModelFields, ProductLcpUseModelFieldsAll, ProductLifeCyclePhaseModelFields, ProductLifeCyclePhaseModelFieldsAll, ProductMetadataModelFields, ProductMetadataModelFieldsAll, ProductPropertyModelFields, ProductPropertyModelFieldsAll, ProductVariantModelFields, ProductVariantModelFieldsAll, QualificationModelFields, QualificationModelFieldsAll, QualificationRoleModelFields, QualificationRoleModelFieldsAll, QualificationSkillLevelModelFields, QualificationSkillLevelModelFieldsAll, REFRESH_FAIL_COOKIE_NAME, REFRESH_FAIL_LIMIT, REFRESH_LIFETIME_FALLBACK_SECONDS, RENDITION_LINK_RELS, RESULT_TYPES, RESULT_VIEW_STYLES, RenditionModelFields, RenditionModelFieldsAll, RenditionSelectorModelFields, RenditionSelectorModelFieldsAll, SDK_CONFIG_KEY, SEARCH_SETTINGS_COOKIE_NAME, SESSION_COOKIE_CHUNK_SIZE, SESSION_COOKIE_MAX_CHUNKS, SESSION_COOKIE_NAME, SESSION_PAYLOAD_VERSION, SESSION_REFRESH_ERROR, SESSION_REFRESH_SKEW_SECONDS, SILENT_REAUTH_ATTEMPTED_KEY, SILENT_REAUTH_INFLIGHT_KEY, SupplyConsumableModelFields, SupplyConsumableModelFieldsAll, SupplyHardwareToolModelFields, SupplyHardwareToolModelFieldsAll, SupplyLubricantModelFields, SupplyLubricantModelFieldsAll, SupplyModelFields, SupplyModelFieldsAll, SupplyOperatingModelFields, SupplyOperatingModelFieldsAll, SupplySparePartModelFields, SupplySparePartModelFieldsAll, TOC_SCROLL_HISTORY_STATE_KEY, TOKEN_ENDPOINT_TIMEOUT_MS, TOKEN_SOURCES, TOPIC, TOPICS_TYPE_AND_LINK, TopicModelFields, TopicModelFieldsAll, TopicTypeConceptModelFields, TopicTypeConceptModelFieldsAll, TopicTypeFormModelFields, TopicTypeFormModelFieldsAll, TopicTypeLearningModelFields, TopicTypeLearningModelFieldsAll, TopicTypeModelFields, TopicTypeModelFieldsAll, TopicTypeReferenceModelFields, TopicTypeReferenceModelFieldsAll, TopicTypeTaskModelFields, TopicTypeTaskModelFieldsAll, TopicTypeTroubleShootingModelFields, TopicTypeTroubleShootingModelFieldsAll, UI_LANG_KEY, UI_LANG_OPTIONS, UI_PREFERENCES_COOKIE_NAME, VCardCalendarModelFields, VCardCalendarModelFieldsAll, VCardGroupModelFields, VCardGroupModelFieldsAll, VCardImageModelFields, VCardImageModelFieldsAll, VCardIndividualModelFields, VCardIndividualModelFieldsAll, VCardInfoModelFields, VCardInfoModelFieldsAll, VCardLocationModelFields, VCardLocationModelFieldsAll, VCardModelFields, VCardModelFieldsAll, VCardOrganizationModelFields, VCardOrganizationModelFieldsAll, WILD_CARD_OPTIONS };

package/dist/index.js

@@ -20,16 +20,21 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ACCESS_TOKEN_MIN_TTL_SECONDS: () => ACCESS_TOKEN_MIN_TTL_SECONDS,
   ALL: () => ALL,
   API: () => API,
   ARTICLE_PAGE_LAYOUT: () => ARTICLE_PAGE_LAYOUT,
+  AUTH_ERROR_CODES: () => AUTH_ERROR_CODES,
+  AUTH_QUERY_PARAMS: () => AUTH_QUERY_PARAMS,
+  AUTH_ROUTES: () => AUTH_ROUTES,
+  AUTH_TRANSACTION_COOKIE_NAME: () => AUTH_TRANSACTION_COOKIE_NAME,
+  AUTH_TRANSACTION_MAX_AGE_SECONDS: () => AUTH_TRANSACTION_MAX_AGE_SECONDS,
   AdministrativeMetadataModelFields: () => AdministrativeMetadataModelFields,
   AdministrativeMetadataModelFieldsAll: () => AdministrativeMetadataModelFieldsAll,
   AuditStateModelFields: () => AuditStateModelFields,
   AuditStateModelFieldsAll: () => AuditStateModelFieldsAll,
   AuthStateModelFields: () => AuthStateModelFields,
   AuthStateModelFieldsAll: () => AuthStateModelFieldsAll,
-  BACKCHANNEL_LOGOUT_EVENT_URI: () => BACKCHANNEL_LOGOUT_EVENT_URI,
   BLOG_TYPE_AND_LINK: () => BLOG_TYPE_AND_LINK,
   BREAKPOINTS: () => BREAKPOINTS,
   CHAT_MCP_REQUIRED_SCOPES: () => CHAT_MCP_REQUIRED_SCOPES,
@@ -38,7 +43,7 @@ __export(index_exports, {
   CONTEXTUAL_EXTERNAL_LINK_CONTEXT_PARAM: () => CONTEXTUAL_EXTERNAL_LINK_CONTEXT_PARAM,
   CREX_DEFAULT_LANGUAGE_ENV: () => CREX_DEFAULT_LANGUAGE_ENV,
   CREX_GLOBAL_RESTRICTION_ENV: () => CREX_GLOBAL_RESTRICTION_ENV,
-  CREX_TOKEN_HEADER_KEY: () => CREX_TOKEN_HEADER_KEY,
+  CREX_SESSION_SECRET_ENV: () => CREX_SESSION_SECRET_ENV,
   CategoryModelFields: () => CategoryModelFields,
   CategoryModelFieldsAll: () => CategoryModelFieldsAll,
   ComponentModelFields: () => ComponentModelFields,
@@ -47,7 +52,7 @@ __export(index_exports, {
   ContentLifeCycleStatusModelFieldsAll: () => ContentLifeCycleStatusModelFieldsAll,
   ContentLifeCycleStatusValueModelFields: () => ContentLifeCycleStatusValueModelFields,
   ContentLifeCycleStatusValueModelFieldsAll: () => ContentLifeCycleStatusValueModelFieldsAll,
-  DEFAULT_COOKIE_LIMIT: () => DEFAULT_COOKIE_LIMIT,
+  DEFAULT_COOKIE_MAX_AGE_SECONDS: () => DEFAULT_COOKIE_MAX_AGE_SECONDS,
   DEFAULT_ICON: () => DEFAULT_ICON,
   DEFAULT_LANG: () => DEFAULT_LANG,
   DEVICE_OPTIONS: () => DEVICE_OPTIONS,
@@ -83,6 +88,8 @@ __export(index_exports, {
   GMP_CHAT_SESSION_STORAGE_KEY: () => GMP_CHAT_SESSION_STORAGE_KEY,
   GMP_TILES_RENDERER: () => GMP_TILES_RENDERER,
   ICONS_BY_FILE_EXTENSION: () => ICONS_BY_FILE_EXTENSION,
+  IMAGE_PROXY_ROUTE: () => IMAGE_PROXY_ROUTE,
+  IMAGE_PROXY_SRC_PARAM: () => IMAGE_PROXY_SRC_PARAM,
   IdentityDomainModelFields: () => IdentityDomainModelFields,
   IdentityDomainModelFieldsAll: () => IdentityDomainModelFieldsAll,
   IdentityModelFields: () => IdentityModelFields,
@@ -113,10 +120,14 @@ __export(index_exports, {
   InformationTypeModelFieldsAll: () => InformationTypeModelFieldsAll,
   InformationUnitModelFields: () => InformationUnitModelFields,
   InformationUnitModelFieldsAll: () => InformationUnitModelFieldsAll,
-  LOGOUT_TOKEN_FORM_KEY: () => LOGOUT_TOKEN_FORM_KEY,
+  LEGACY_AUTH_COOKIE_PREFIXES: () => LEGACY_AUTH_COOKIE_PREFIXES,
+  LEGACY_TOKEN_COOKIE_NAME: () => LEGACY_TOKEN_COOKIE_NAME,
+  LOGOUT_REQUEST_HEADER: () => LOGOUT_REQUEST_HEADER,
   LOG_CATEGORIES: () => LOG_CATEGORIES,
   LOG_LEVELS: () => LOG_LEVELS,
   MARKER_COLORS: () => MARKER_COLORS,
+  OIDC_HTTP_TIMEOUT_MS: () => OIDC_HTTP_TIMEOUT_MS,
+  OIDC_PROMPTS: () => OIDC_PROMPTS,
   OPERATOR_OPTIONS: () => OPERATOR_OPTIONS,
   OwlClassModelFields: () => OwlClassModelFields,
   OwlClassModelFieldsAll: () => OwlClassModelFieldsAll,
@@ -166,6 +177,9 @@ __export(index_exports, {
   QualificationRoleModelFieldsAll: () => QualificationRoleModelFieldsAll,
   QualificationSkillLevelModelFields: () => QualificationSkillLevelModelFields,
   QualificationSkillLevelModelFieldsAll: () => QualificationSkillLevelModelFieldsAll,
+  REFRESH_FAIL_COOKIE_NAME: () => REFRESH_FAIL_COOKIE_NAME,
+  REFRESH_FAIL_LIMIT: () => REFRESH_FAIL_LIMIT,
+  REFRESH_LIFETIME_FALLBACK_SECONDS: () => REFRESH_LIFETIME_FALLBACK_SECONDS,
   RENDITION_LINK_RELS: () => RENDITION_LINK_RELS,
   RESULT_TYPES: () => RESULT_TYPES,
   RESULT_VIEW_STYLES: () => RESULT_VIEW_STYLES,
@@ -175,7 +189,14 @@ __export(index_exports, {
   RenditionSelectorModelFieldsAll: () => RenditionSelectorModelFieldsAll,
   SDK_CONFIG_KEY: () => SDK_CONFIG_KEY,
   SEARCH_SETTINGS_COOKIE_NAME: () => SEARCH_SETTINGS_COOKIE_NAME,
-  SESSION_REVOKED_ERROR: () => SESSION_REVOKED_ERROR,
+  SESSION_COOKIE_CHUNK_SIZE: () => SESSION_COOKIE_CHUNK_SIZE,
+  SESSION_COOKIE_MAX_CHUNKS: () => SESSION_COOKIE_MAX_CHUNKS,
+  SESSION_COOKIE_NAME: () => SESSION_COOKIE_NAME,
+  SESSION_PAYLOAD_VERSION: () => SESSION_PAYLOAD_VERSION,
+  SESSION_REFRESH_ERROR: () => SESSION_REFRESH_ERROR,
+  SESSION_REFRESH_SKEW_SECONDS: () => SESSION_REFRESH_SKEW_SECONDS,
+  SILENT_REAUTH_ATTEMPTED_KEY: () => SILENT_REAUTH_ATTEMPTED_KEY,
+  SILENT_REAUTH_INFLIGHT_KEY: () => SILENT_REAUTH_INFLIGHT_KEY,
   SupplyConsumableModelFields: () => SupplyConsumableModelFields,
   SupplyConsumableModelFieldsAll: () => SupplyConsumableModelFieldsAll,
   SupplyHardwareToolModelFields: () => SupplyHardwareToolModelFields,
@@ -189,6 +210,7 @@ __export(index_exports, {
   SupplySparePartModelFields: () => SupplySparePartModelFields,
   SupplySparePartModelFieldsAll: () => SupplySparePartModelFieldsAll,
   TOC_SCROLL_HISTORY_STATE_KEY: () => TOC_SCROLL_HISTORY_STATE_KEY,
+  TOKEN_ENDPOINT_TIMEOUT_MS: () => TOKEN_ENDPOINT_TIMEOUT_MS,
   TOKEN_SOURCES: () => TOKEN_SOURCES,
   TOPIC: () => TOPIC,
   TOPICS_TYPE_AND_LINK: () => TOPICS_TYPE_AND_LINK,
@@ -1645,7 +1667,7 @@ var FILES_EXTENSIONS = {
   PDF: "application/pdf",
   HTML: "text/html"
 };
-var DEFAULT_COOKIE_LIMIT = 30 * 24 * 60 * 60 * 1e3;
+var DEFAULT_COOKIE_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
 var ICONS_BY_FILE_EXTENSION = {
   "application/pdf": "FaFilePdf"
 };
@@ -1654,15 +1676,60 @@ var RENDITION_LINK_RELS = {
   VIEW: "view",
   DOWNLOAD: "download"
 };
-var CREX_TOKEN_HEADER_KEY = "crex-token";
 var CHAT_MCP_REQUIRED_SCOPES = [
   "crex.ids.chat.use",
   "crex.ids.mcp.use"
 ];
 var POST_LOGOUT_RETURN_TO_KEY = "crex-post-logout-return-to";
-var BACKCHANNEL_LOGOUT_EVENT_URI = "http://schemas.openid.net/event/backchannel-logout";
-var LOGOUT_TOKEN_FORM_KEY = "logout_token";
-var SESSION_REVOKED_ERROR = "SessionRevoked";
+var CREX_SESSION_SECRET_ENV = "CREX_SESSION_SECRET";
+var SESSION_COOKIE_NAME = "crex-session";
+var SESSION_COOKIE_CHUNK_SIZE = 3400;
+var SESSION_COOKIE_MAX_CHUNKS = 3;
+var SESSION_PAYLOAD_VERSION = 1;
+var REFRESH_FAIL_COOKIE_NAME = "crex-refresh-fail";
+var REFRESH_FAIL_LIMIT = 2;
+var AUTH_TRANSACTION_COOKIE_NAME = "crex-auth-tx";
+var AUTH_TRANSACTION_MAX_AGE_SECONDS = 10 * 60;
+var SESSION_REFRESH_SKEW_SECONDS = 60;
+var ACCESS_TOKEN_MIN_TTL_SECONDS = 5;
+var REFRESH_LIFETIME_FALLBACK_SECONDS = 30 * 24 * 60 * 60;
+var TOKEN_ENDPOINT_TIMEOUT_MS = 5e3;
+var OIDC_HTTP_TIMEOUT_MS = 1e4;
+var AUTH_ROUTES = {
+  LOGIN: "/api/auth/login",
+  CALLBACK: "/api/auth/callback/crex",
+  LOGOUT: "/api/auth/logout",
+  SESSION: "/api/auth/session",
+  BACKCHANNEL_LOGOUT: "/api/auth/backchannel-logout",
+  ERROR_PAGE: "/auth/error"
+};
+var AUTH_QUERY_PARAMS = {
+  RETURN_TO: "returnTo",
+  PROMPT: "prompt",
+  ERROR: "error"
+};
+var OIDC_PROMPTS = {
+  LOGIN: "login",
+  NONE: "none"
+};
+var LOGOUT_REQUEST_HEADER = "x-crex-logout";
+var AUTH_ERROR_CODES = {
+  CONFIGURATION: "Configuration",
+  ACCESS_DENIED: "AccessDenied",
+  OAUTH_SIGNIN: "OAuthSignin",
+  OAUTH_CALLBACK: "OAuthCallback",
+  CALLBACK: "Callback",
+  DEFAULT: "Default"
+};
+var SESSION_REFRESH_ERROR = "RefreshAccessTokenError";
+var SILENT_REAUTH_ATTEMPTED_KEY = "crex-silent-reauth-attempted";
+var SILENT_REAUTH_INFLIGHT_KEY = "crex-silent-reauth-inflight";
+var LEGACY_AUTH_COOKIE_PREFIXES = [
+  "next-auth.",
+  "__Secure-next-auth.",
+  "__Host-next-auth."
+];
+var LEGACY_TOKEN_COOKIE_NAME = "crex-token";
 var GMP_TILES_RENDERER = "GMPTilesRenderer";
 var GMP_CHAT_SESSION_STORAGE_KEY = "c-rex-gmp-chat-session-v1";
 var GMP_CHAT_SESSION_SNAPSHOT_VERSION = 1;
@@ -1681,6 +1748,8 @@ var PULSE_DELIVERY_CHANNELS = {
   EMAIL: "email"
 };
 var CONTEXTUAL_EXTERNAL_LINK_CONTEXT_PARAM = "frage";
+var IMAGE_PROXY_ROUTE = "/api/images";
+var IMAGE_PROXY_SRC_PARAM = "src";
 var WILD_CARD_OPTIONS = {
   BOTH: "BOTH",
   END: "END",
@@ -1726,16 +1795,21 @@ var MARKER_COLORS = [
 ];
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ACCESS_TOKEN_MIN_TTL_SECONDS,
   ALL,
   API,
   ARTICLE_PAGE_LAYOUT,
+  AUTH_ERROR_CODES,
+  AUTH_QUERY_PARAMS,
+  AUTH_ROUTES,
+  AUTH_TRANSACTION_COOKIE_NAME,
+  AUTH_TRANSACTION_MAX_AGE_SECONDS,
   AdministrativeMetadataModelFields,
   AdministrativeMetadataModelFieldsAll,
   AuditStateModelFields,
   AuditStateModelFieldsAll,
   AuthStateModelFields,
   AuthStateModelFieldsAll,
-  BACKCHANNEL_LOGOUT_EVENT_URI,
   BLOG_TYPE_AND_LINK,
   BREAKPOINTS,
   CHAT_MCP_REQUIRED_SCOPES,
@@ -1744,7 +1818,7 @@ var MARKER_COLORS = [
   CONTEXTUAL_EXTERNAL_LINK_CONTEXT_PARAM,
   CREX_DEFAULT_LANGUAGE_ENV,
   CREX_GLOBAL_RESTRICTION_ENV,
-  CREX_TOKEN_HEADER_KEY,
+  CREX_SESSION_SECRET_ENV,
   CategoryModelFields,
   CategoryModelFieldsAll,
   ComponentModelFields,
@@ -1753,7 +1827,7 @@ var MARKER_COLORS = [
   ContentLifeCycleStatusModelFieldsAll,
   ContentLifeCycleStatusValueModelFields,
   ContentLifeCycleStatusValueModelFieldsAll,
-  DEFAULT_COOKIE_LIMIT,
+  DEFAULT_COOKIE_MAX_AGE_SECONDS,
   DEFAULT_ICON,
   DEFAULT_LANG,
   DEVICE_OPTIONS,
@@ -1789,6 +1863,8 @@ var MARKER_COLORS = [
   GMP_CHAT_SESSION_STORAGE_KEY,
   GMP_TILES_RENDERER,
   ICONS_BY_FILE_EXTENSION,
+  IMAGE_PROXY_ROUTE,
+  IMAGE_PROXY_SRC_PARAM,
   IdentityDomainModelFields,
   IdentityDomainModelFieldsAll,
   IdentityModelFields,
@@ -1819,10 +1895,14 @@ var MARKER_COLORS = [
   InformationTypeModelFieldsAll,
   InformationUnitModelFields,
   InformationUnitModelFieldsAll,
-  LOGOUT_TOKEN_FORM_KEY,
+  LEGACY_AUTH_COOKIE_PREFIXES,
+  LEGACY_TOKEN_COOKIE_NAME,
+  LOGOUT_REQUEST_HEADER,
   LOG_CATEGORIES,
   LOG_LEVELS,
   MARKER_COLORS,
+  OIDC_HTTP_TIMEOUT_MS,
+  OIDC_PROMPTS,
   OPERATOR_OPTIONS,
   OwlClassModelFields,
   OwlClassModelFieldsAll,
@@ -1872,6 +1952,9 @@ var MARKER_COLORS = [
   QualificationRoleModelFieldsAll,
   QualificationSkillLevelModelFields,
   QualificationSkillLevelModelFieldsAll,
+  REFRESH_FAIL_COOKIE_NAME,
+  REFRESH_FAIL_LIMIT,
+  REFRESH_LIFETIME_FALLBACK_SECONDS,
   RENDITION_LINK_RELS,
   RESULT_TYPES,
   RESULT_VIEW_STYLES,
@@ -1881,7 +1964,14 @@ var MARKER_COLORS = [
   RenditionSelectorModelFieldsAll,
   SDK_CONFIG_KEY,
   SEARCH_SETTINGS_COOKIE_NAME,
-  SESSION_REVOKED_ERROR,
+  SESSION_COOKIE_CHUNK_SIZE,
+  SESSION_COOKIE_MAX_CHUNKS,
+  SESSION_COOKIE_NAME,
+  SESSION_PAYLOAD_VERSION,
+  SESSION_REFRESH_ERROR,
+  SESSION_REFRESH_SKEW_SECONDS,
+  SILENT_REAUTH_ATTEMPTED_KEY,
+  SILENT_REAUTH_INFLIGHT_KEY,
   SupplyConsumableModelFields,
   SupplyConsumableModelFieldsAll,
   SupplyHardwareToolModelFields,
@@ -1895,6 +1985,7 @@ var MARKER_COLORS = [
   SupplySparePartModelFields,
   SupplySparePartModelFieldsAll,
   TOC_SCROLL_HISTORY_STATE_KEY,
+  TOKEN_ENDPOINT_TIMEOUT_MS,
   TOKEN_SOURCES,
   TOPIC,
   TOPICS_TYPE_AND_LINK,