@chemmangat/msal-next 3.0.2 → 3.0.4

package/dist/index.mjs

@@ -1,2 +1,1595 @@
-import {MsalProvider,useMsal,useAccount}from'@azure/msal-react';export{useAccount,useIsAuthenticated,useMsal}from'@azure/msal-react';import {LogLevel,PublicClientApplication,EventType,InteractionStatus}from'@azure/msal-browser';import {useState,useRef,useEffect,useMemo,useCallback,Component}from'react';import {jsx,Fragment,jsxs}from'react/jsx-runtime';import {NextResponse}from'next/server';function B(r,e){try{let t=JSON.parse(r);return e(t)?t:(console.warn("[Validation] JSON validation failed"),null)}catch(t){return console.error("[Validation] JSON parse error:",t),null}}function _(r){return typeof r=="object"&&r!==null&&typeof r.homeAccountId=="string"&&r.homeAccountId.length>0&&typeof r.username=="string"&&r.username.length>0&&(r.name===void 0||typeof r.name=="string")}function S(r){return r instanceof Error?r.message.replace(/[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g,"[TOKEN_REDACTED]").replace(/[a-f0-9]{32,}/gi,"[SECRET_REDACTED]").replace(/Bearer\s+[^\s]+/gi,"Bearer [REDACTED]"):"An unexpected error occurred"}function $(r,e){try{let t=new URL(r);return e.some(o=>{let n=new URL(o);return t.origin===n.origin})}catch{return  false}}function ie(r){return /^[a-zA-Z0-9._-]+$/.test(r)}function Ae(r){return Array.isArray(r)&&r.every(ie)}function H(r){if(r.msalConfig)return r.msalConfig;let{clientId:e,tenantId:t,authorityType:o="common",redirectUri:n,postLogoutRedirectUri:a,cacheLocation:f="sessionStorage",storeAuthStateInCookie:c=false,navigateToLoginRequestUrl:u=true,enableLogging:i=false,loggerCallback:m,allowedRedirectUris:d}=r;if(!e)throw new Error("@chemmangat/msal-next: clientId is required");let p=()=>{if(o==="tenant"){if(!t)throw new Error('@chemmangat/msal-next: tenantId is required when authorityType is "tenant"');return `https://login.microsoftonline.com/${t}`}return `https://login.microsoftonline.com/${o}`},g=typeof window<"u"?window.location.origin:"http://localhost:3000",y=n||g;if(d&&d.length>0){if(!$(y,d))throw new Error(`@chemmangat/msal-next: redirectUri "${y}" is not in the allowed list`);let s=a||y;if(!$(s,d))throw new Error(`@chemmangat/msal-next: postLogoutRedirectUri "${s}" is not in the allowed list`)}return {auth:{clientId:e,authority:p(),redirectUri:y,postLogoutRedirectUri:a||y,navigateToLoginRequestUrl:u},cache:{cacheLocation:f,storeAuthStateInCookie:c},system:{loggerOptions:{loggerCallback:m||((s,l,b)=>{if(!(b||!i))switch(s){case LogLevel.Error:console.error("[MSAL]",l);break;case LogLevel.Warning:console.warn("[MSAL]",l);break;case LogLevel.Info:console.info("[MSAL]",l);break;case LogLevel.Verbose:console.debug("[MSAL]",l);break}}),logLevel:i?LogLevel.Verbose:LogLevel.Error}}}}var ae=null;function Re(){return ae}function V({children:r,loadingComponent:e,onInitialized:t,...o}){let[n,a]=useState(null),f=useRef(null);return useEffect(()=>{if(typeof window>"u"||f.current)return;(async()=>{try{let u=H(o),i=new PublicClientApplication(u);await i.initialize();try{let p=await i.handleRedirectPromise();p&&(o.enableLogging&&console.log("[MSAL] Redirect authentication successful"),p.account&&i.setActiveAccount(p.account));}catch(p){p?.errorCode==="no_token_request_cache_error"?o.enableLogging&&console.log("[MSAL] No pending redirect found (this is normal)"):p?.errorCode==="user_cancelled"?o.enableLogging&&console.log("[MSAL] User cancelled authentication"):console.error("[MSAL] Redirect handling error:",p);}let m=i.getAllAccounts();m.length>0&&!i.getActiveAccount()&&i.setActiveAccount(m[0]);let d=o.enableLogging||!1;i.addEventCallback(p=>{if(p.eventType===EventType.LOGIN_SUCCESS){let g=p.payload;g?.account&&i.setActiveAccount(g.account),d&&console.log("[MSAL] Login successful:",g.account?.username);}if(p.eventType===EventType.LOGIN_FAILURE&&console.error("[MSAL] Login failed:",p.error),p.eventType===EventType.LOGOUT_SUCCESS&&(i.setActiveAccount(null),d&&console.log("[MSAL] Logout successful")),p.eventType===EventType.ACQUIRE_TOKEN_SUCCESS){let g=p.payload;g?.account&&!i.getActiveAccount()&&i.setActiveAccount(g.account);}p.eventType===EventType.ACQUIRE_TOKEN_FAILURE&&d&&console.error("[MSAL] Token acquisition failed:",p.error);}),f.current=i,ae=i,a(i),t&&t(i);}catch(u){throw console.error("[MSAL] Initialization failed:",u),u}})();},[]),typeof window>"u"?jsx(Fragment,{children:e||jsx("div",{children:"Loading authentication..."})}):n?jsx(MsalProvider,{instance:n,children:r}):jsx(Fragment,{children:e||jsx("div",{children:"Loading authentication..."})})}var j=new Map;function A(r=["User.Read"]){let{instance:e,accounts:t,inProgress:o}=useMsal(),n=useAccount(t[0]||null),a=useRef(false),f=useMemo(()=>t.length>0,[t]),c=useCallback(async(s=r)=>{if(o!==InteractionStatus.None){console.warn("[MSAL] Interaction already in progress");return}try{let l={scopes:s,prompt:"select_account"},b=await e.loginPopup(l);b?.account&&e.setActiveAccount(b.account);}catch(l){if(l?.errorCode==="user_cancelled"){console.log("[MSAL] User cancelled login");return}throw console.error("[MSAL] Login popup failed:",l),l}},[e,r,o]),u=useCallback(async(s=r)=>{if(o!==InteractionStatus.None){console.warn("[MSAL] Interaction already in progress");return}try{let l={scopes:s,prompt:"select_account"};await e.loginRedirect(l);}catch(l){if(l?.errorCode==="user_cancelled"){console.log("[MSAL] User cancelled login");return}throw console.error("[MSAL] Login redirect failed:",l),l}},[e,r,o]),i=useCallback(async()=>{try{await e.logoutPopup({account:n||void 0});}catch(s){throw console.error("[MSAL] Logout popup failed:",s),s}},[e,n]),m=useCallback(async()=>{try{await e.logoutRedirect({account:n||void 0});}catch(s){throw console.error("[MSAL] Logout redirect failed:",s),s}},[e,n]),d=useCallback(async(s=r)=>{if(!n)throw new Error("[MSAL] No active account. Please login first.");try{let l={scopes:s,account:n,forceRefresh:!1};return (await e.acquireTokenSilent(l)).accessToken}catch(l){throw console.error("[MSAL] Silent token acquisition failed:",l),l}},[e,n,r]),p=useCallback(async(s=r)=>{if(!n)throw new Error("[MSAL] No active account. Please login first.");if(a.current)throw new Error("[MSAL] Popup already in progress. Please wait.");try{a.current=!0;let l={scopes:s,account:n};return (await e.acquireTokenPopup(l)).accessToken}catch(l){throw console.error("[MSAL] Token popup acquisition failed:",l),l}finally{a.current=false;}},[e,n,r]),g=useCallback(async(s=r)=>{if(!n)throw new Error("[MSAL] No active account. Please login first.");try{let l={scopes:s,account:n};await e.acquireTokenRedirect(l);}catch(l){throw console.error("[MSAL] Token redirect acquisition failed:",l),l}},[e,n,r]),y=useCallback(async(s=r)=>{let l=`${n?.homeAccountId||"anonymous"}-${s.sort().join(",")}`,b=j.get(l);if(b)return b;let w=(async()=>{try{return await d(s)}catch{return console.warn("[MSAL] Silent token acquisition failed, falling back to popup"),await p(s)}finally{j.delete(l);}})();return j.set(l,w),w},[d,p,r,n]),h=useCallback(async()=>{e.setActiveAccount(null),await e.clearCache();},[e]);return {account:n,accounts:t,isAuthenticated:f,inProgress:o!==InteractionStatus.None,loginPopup:c,loginRedirect:u,logoutPopup:i,logoutRedirect:m,acquireToken:y,acquireTokenSilent:d,acquireTokenPopup:p,acquireTokenRedirect:g,clearSession:h}}function Le({text:r="Sign in with Microsoft",variant:e="dark",size:t="medium",useRedirect:o=false,scopes:n,className:a="",style:f,onSuccess:c,onError:u}){let{loginPopup:i,loginRedirect:m,inProgress:d}=A(),p=async()=>{try{o?await m(n):await i(n),c?.();}catch(s){u?.(s);}},g={small:{padding:"8px 16px",fontSize:"14px",height:"36px"},medium:{padding:"10px 20px",fontSize:"15px",height:"41px"},large:{padding:"12px 24px",fontSize:"16px",height:"48px"}},h={display:"inline-flex",alignItems:"center",justifyContent:"center",gap:"12px",fontFamily:'"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',fontWeight:600,borderRadius:"2px",cursor:d?"not-allowed":"pointer",transition:"all 0.2s ease",opacity:d?.6:1,...{dark:{backgroundColor:"#2F2F2F",color:"#FFFFFF",border:"1px solid #8C8C8C"},light:{backgroundColor:"#FFFFFF",color:"#5E5E5E",border:"1px solid #8C8C8C"}}[e],...g[t],...f};return jsxs("button",{onClick:p,disabled:d,className:a,style:h,"aria-label":r,children:[jsx(Me,{}),jsx("span",{children:r})]})}function Me(){return jsxs("svg",{width:"21",height:"21",viewBox:"0 0 21 21",fill:"none",xmlns:"http://www.w3.org/2000/svg",children:[jsx("rect",{width:"10",height:"10",fill:"#F25022"}),jsx("rect",{x:"11",width:"10",height:"10",fill:"#7FBA00"}),jsx("rect",{y:"11",width:"10",height:"10",fill:"#00A4EF"}),jsx("rect",{x:"11",y:"11",width:"10",height:"10",fill:"#FFB900"})]})}function Ue({text:r="Sign out",variant:e="dark",size:t="medium",useRedirect:o=false,className:n="",style:a,onSuccess:f,onError:c}){let{logoutPopup:u,logoutRedirect:i,inProgress:m}=A(),d=async()=>{try{o?await i():await u(),f?.();}catch(h){c?.(h);}},p={small:{padding:"8px 16px",fontSize:"14px",height:"36px"},medium:{padding:"10px 20px",fontSize:"15px",height:"41px"},large:{padding:"12px 24px",fontSize:"16px",height:"48px"}},y={display:"inline-flex",alignItems:"center",justifyContent:"center",gap:"12px",fontFamily:'"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',fontWeight:600,borderRadius:"2px",cursor:m?"not-allowed":"pointer",transition:"all 0.2s ease",opacity:m?.6:1,...{dark:{backgroundColor:"#2F2F2F",color:"#FFFFFF",border:"1px solid #8C8C8C"},light:{backgroundColor:"#FFFFFF",color:"#5E5E5E",border:"1px solid #8C8C8C"}}[e],...p[t],...a};return jsxs("button",{onClick:d,disabled:m,className:n,style:y,"aria-label":r,children:[jsx(ke,{}),jsx("span",{children:r})]})}function ke(){return jsxs("svg",{width:"21",height:"21",viewBox:"0 0 21 21",fill:"none",xmlns:"http://www.w3.org/2000/svg",children:[jsx("rect",{width:"10",height:"10",fill:"#F25022"}),jsx("rect",{x:"11",width:"10",height:"10",fill:"#7FBA00"}),jsx("rect",{y:"11",width:"10",height:"10",fill:"#00A4EF"}),jsx("rect",{x:"11",y:"11",width:"10",height:"10",fill:"#FFB900"})]})}function k(){let{acquireToken:r}=A(),e=useCallback(async(c,u={})=>{let{scopes:i=["User.Read"],version:m="v1.0",debug:d=false,...p}=u;try{let g=await r(i),y=`https://graph.microsoft.com/${m}`,h=c.startsWith("http")?c:`${y}${c.startsWith("/")?c:`/${c}`}`;d&&console.log("[GraphAPI] Request:",{url:h,method:p.method||"GET"});let s=await fetch(h,{...p,headers:{Authorization:`Bearer ${g}`,"Content-Type":"application/json",...p.headers}});if(!s.ok){let b=await s.text(),w=`Graph API error (${s.status}): ${b}`;throw new Error(w)}if(s.status===204||s.headers.get("content-length")==="0")return null;let l=await s.json();return d&&console.log("[GraphAPI] Response:",l),l}catch(g){let y=S(g);throw console.error("[GraphAPI] Request failed:",y),new Error(y)}},[r]),t=useCallback((c,u={})=>e(c,{...u,method:"GET"}),[e]),o=useCallback((c,u,i={})=>e(c,{...i,method:"POST",body:u?JSON.stringify(u):void 0}),[e]),n=useCallback((c,u,i={})=>e(c,{...i,method:"PUT",body:u?JSON.stringify(u):void 0}),[e]),a=useCallback((c,u,i={})=>e(c,{...i,method:"PATCH",body:u?JSON.stringify(u):void 0}),[e]),f=useCallback((c,u={})=>e(c,{...u,method:"DELETE"}),[e]);return {get:t,post:o,put:n,patch:a,delete:f,request:e}}var P=new Map,Fe=300*1e3,de=100;function Ne(){if(P.size>de){let r=Array.from(P.entries());r.sort((t,o)=>t[1].timestamp-o[1].timestamp),r.slice(0,P.size-de).forEach(([t])=>{let o=P.get(t);o?.data.photo&&URL.revokeObjectURL(o.data.photo),P.delete(t);});}}function K(){let{isAuthenticated:r,account:e}=A(),t=k(),[o,n]=useState(null),[a,f]=useState(false),[c,u]=useState(null),i=useCallback(async()=>{if(!r||!e){n(null);return}let d=e.homeAccountId,p=P.get(d);if(p&&Date.now()-p.timestamp<Fe){n(p.data);return}f(true),u(null);try{let g=await t.get("/me",{scopes:["User.Read"]}),y;try{let s=await t.get("/me/photo/$value",{scopes:["User.Read"],headers:{"Content-Type":"image/jpeg"}});s&&(y=URL.createObjectURL(s));}catch{console.debug("[UserProfile] Photo not available");}let h={id:g.id,displayName:g.displayName,givenName:g.givenName,surname:g.surname,userPrincipalName:g.userPrincipalName,mail:g.mail,jobTitle:g.jobTitle,officeLocation:g.officeLocation,mobilePhone:g.mobilePhone,businessPhones:g.businessPhones,photo:y};P.set(d,{data:h,timestamp:Date.now()}),Ne(),n(h);}catch(g){let h=S(g),s=new Error(h);u(s),console.error("[UserProfile] Failed to fetch profile:",h);}finally{f(false);}},[r,e,t]),m=useCallback(()=>{if(e){let d=P.get(e.homeAccountId);d?.data.photo&&URL.revokeObjectURL(d.data.photo),P.delete(e.homeAccountId);}o?.photo&&URL.revokeObjectURL(o.photo),n(null);},[e,o]);return useEffect(()=>(i(),()=>{o?.photo&&URL.revokeObjectURL(o.photo);}),[i]),useEffect(()=>()=>{o?.photo&&URL.revokeObjectURL(o.photo);},[o?.photo]),{profile:o,loading:a,error:c,refetch:i,clearCache:m}}function Oe({size:r=40,className:e="",style:t,showTooltip:o=true,fallbackImage:n}){let{profile:a,loading:f}=K(),[c,u]=useState(null),[i,m]=useState(false);useEffect(()=>{a?.photo&&u(a.photo);},[a?.photo]);let d=()=>{if(!a)return "?";let{givenName:y,surname:h,displayName:s}=a;if(y&&h)return `${y[0]}${h[0]}`.toUpperCase();if(s){let l=s.split(" ");return l.length>=2?`${l[0][0]}${l[l.length-1][0]}`.toUpperCase():s.substring(0,2).toUpperCase()}return "?"},p={width:`${r}px`,height:`${r}px`,borderRadius:"50%",display:"inline-flex",alignItems:"center",justifyContent:"center",fontSize:`${r*.4}px`,fontWeight:600,fontFamily:'"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',backgroundColor:"#0078D4",color:"#FFFFFF",overflow:"hidden",userSelect:"none",...t},g=a?.displayName||"User";return f?jsx("div",{className:e,style:{...p,backgroundColor:"#E1E1E1"},"aria-label":"Loading user avatar",children:jsx("span",{style:{fontSize:`${r*.3}px`},children:"..."})}):c&&!i?jsx("div",{className:e,style:p,title:o?g:void 0,"aria-label":`${g} avatar`,children:jsx("img",{src:c,alt:g,style:{width:"100%",height:"100%",objectFit:"cover"},onError:()=>{m(true),n&&u(n);}})}):jsx("div",{className:e,style:p,title:o?g:void 0,"aria-label":`${g} avatar`,children:d()})}function De({className:r="",style:e,showDetails:t=false,renderLoading:o,renderAuthenticated:n,renderUnauthenticated:a}){let{isAuthenticated:f,inProgress:c,account:u}=A(),i={display:"inline-flex",alignItems:"center",gap:"8px",padding:"8px 12px",borderRadius:"4px",fontFamily:'"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',fontSize:"14px",fontWeight:500,...e};if(c)return o?jsx(Fragment,{children:o()}):jsxs("div",{className:r,style:{...i,backgroundColor:"#FFF4CE",color:"#8A6D3B"},role:"status","aria-live":"polite",children:[jsx(Z,{color:"#FFA500"}),jsx("span",{children:"Loading..."})]});if(f){let m=u?.username||u?.name||"User";return n?jsx(Fragment,{children:n(m)}):jsxs("div",{className:r,style:{...i,backgroundColor:"#D4EDDA",color:"#155724"},role:"status","aria-live":"polite",children:[jsx(Z,{color:"#28A745"}),jsx("span",{children:t?`Authenticated as ${m}`:"Authenticated"})]})}return a?jsx(Fragment,{children:a()}):jsxs("div",{className:r,style:{...i,backgroundColor:"#F8D7DA",color:"#721C24"},role:"status","aria-live":"polite",children:[jsx(Z,{color:"#DC3545"}),jsx("span",{children:"Not authenticated"})]})}function Z({color:r}){return jsx("svg",{width:"8",height:"8",viewBox:"0 0 8 8",fill:"none",xmlns:"http://www.w3.org/2000/svg",children:jsx("circle",{cx:"4",cy:"4",r:"4",fill:r})})}function ee({children:r,loadingComponent:e,fallbackComponent:t,useRedirect:o=true,scopes:n,onAuthRequired:a}){let{isAuthenticated:f,inProgress:c,loginRedirect:u,loginPopup:i}=A();return useEffect(()=>{!f&&!c&&(a?.(),(async()=>{try{o?await u(n):await i(n);}catch(d){console.error("[AuthGuard] Authentication failed:",d);}})());},[f,c,o,n,u,i,a]),c?jsx(Fragment,{children:e||jsx("div",{children:"Authenticating..."})}):f?jsx(Fragment,{children:r}):jsx(Fragment,{children:t||jsx("div",{children:"Redirecting to login..."})})}var te=class extends Component{constructor(t){super(t);this.reset=()=>{this.setState({hasError:false,error:null});};this.state={hasError:false,error:null};}static getDerivedStateFromError(t){return {hasError:true,error:t}}componentDidCatch(t,o){let{onError:n,debug:a}=this.props;a&&(console.error("[ErrorBoundary] Caught error:",t),console.error("[ErrorBoundary] Error info:",o)),n?.(t,o);}render(){let{hasError:t,error:o}=this.state,{children:n,fallback:a}=this.props;return t&&o?a?a(o,this.reset):jsxs("div",{style:{padding:"20px",margin:"20px",border:"1px solid #DC3545",borderRadius:"4px",backgroundColor:"#F8D7DA",color:"#721C24",fontFamily:'"Segoe UI", Tahoma, Geneva, Verdana, sans-serif'},children:[jsx("h2",{style:{margin:"0 0 10px 0",fontSize:"18px"},children:"Authentication Error"}),jsx("p",{style:{margin:"0 0 10px 0"},children:o.message}),jsx("button",{onClick:this.reset,style:{padding:"8px 16px",backgroundColor:"#DC3545",color:"#FFFFFF",border:"none",borderRadius:"4px",cursor:"pointer",fontSize:"14px",fontWeight:600},children:"Try Again"})]}):n}};function ze({children:r,...e}){return jsx(V,{...e,children:r})}var R=new Map,He=300*1e3,fe=100;function Ve(r){r?R.delete(r):R.clear();}function We(){if(R.size>fe){let r=Array.from(R.entries());r.sort((t,o)=>t[1].timestamp-o[1].timestamp),r.slice(0,R.size-fe).forEach(([t])=>R.delete(t));}}function je(){let{isAuthenticated:r,account:e}=A(),t=k(),[o,n]=useState([]),[a,f]=useState([]),[c,u]=useState(false),[i,m]=useState(null),d=useCallback(async()=>{if(!r||!e){n([]),f([]);return}let s=e.homeAccountId,l=R.get(s);if(l&&Date.now()-l.timestamp<He){n(l.roles),f(l.groups);return}u(true),m(null);try{let w=e.idTokenClaims?.roles||[],G=(await t.get("/me/memberOf",{scopes:["User.Read","Directory.Read.All"]})).value.map(ne=>ne.id);R.set(s,{roles:w,groups:G,timestamp:Date.now()}),We(),n(w),f(G);}catch(b){let D=S(b),G=new Error(D);m(G),console.error("[Roles] Failed to fetch roles/groups:",D);let ye=e.idTokenClaims?.roles||[];n(ye);}finally{u(false);}},[r,e,t]),p=useCallback(s=>o.includes(s),[o]),g=useCallback(s=>a.includes(s),[a]),y=useCallback(s=>s.some(l=>o.includes(l)),[o]),h=useCallback(s=>s.every(l=>o.includes(l)),[o]);return useEffect(()=>(d(),()=>{e&&Ve(e.homeAccountId);}),[d,e]),{roles:o,groups:a,loading:c,error:i,hasRole:p,hasGroup:g,hasAnyRole:y,hasAllRoles:h,refetch:d}}function Je(r,e={}){let{displayName:t,...o}=e,n=a=>jsx(ee,{...o,children:jsx(r,{...a})});return n.displayName=t||`withAuth(${r.displayName||r.name||"Component"})`,n}async function me(r,e={}){let{maxRetries:t=3,initialDelay:o=1e3,maxDelay:n=1e4,backoffMultiplier:a=2,debug:f=false}=e,c,u=o;for(let i=0;i<=t;i++)try{return f&&i>0&&console.log(`[TokenRetry] Attempt ${i+1}/${t+1}`),await r()}catch(m){if(c=m,i===t){f&&console.error("[TokenRetry] All retry attempts failed");break}if(!Ke(m))throw f&&console.log("[TokenRetry] Non-retryable error, aborting"),m;f&&console.warn(`[TokenRetry] Attempt ${i+1} failed, retrying in ${u}ms...`),await Ze(u),u=Math.min(u*a,n);}throw c}function Ke(r){let e=r.message.toLowerCase();return !!(e.includes("network")||e.includes("timeout")||e.includes("fetch")||e.includes("connection")||e.includes("500")||e.includes("502")||e.includes("503")||e.includes("429")||e.includes("rate limit")||e.includes("token")&&e.includes("expired"))}function Ze(r){return new Promise(e=>setTimeout(e,r))}function Qe(r,e={}){return (...t)=>me(()=>r(...t),e)}var z=class{constructor(e={}){this.logHistory=[];this.performanceTimings=new Map;this.config={enabled:e.enabled??false,prefix:e.prefix??"[MSAL-Next]",showTimestamp:e.showTimestamp??true,level:e.level??"info",enablePerformance:e.enablePerformance??false,enableNetworkLogs:e.enableNetworkLogs??false,maxHistorySize:e.maxHistorySize??100};}shouldLog(e){if(!this.config.enabled)return  false;let t=["error","warn","info","debug"],o=t.indexOf(this.config.level);return t.indexOf(e)<=o}formatMessage(e,t,o){let n=this.config.showTimestamp?`[${new Date().toISOString()}]`:"",a=this.config.prefix,f=`[${e.toUpperCase()}]`,c=`${n} ${a} ${f} ${t}`;return o!==void 0&&(c+=`
-`+JSON.stringify(o,null,2)),c}addToHistory(e,t,o){this.logHistory.length>=this.config.maxHistorySize&&this.logHistory.shift(),this.logHistory.push({timestamp:Date.now(),level:e,message:t,data:o});}error(e,t){this.shouldLog("error")&&(console.error(this.formatMessage("error",e,t)),this.addToHistory("error",e,t));}warn(e,t){this.shouldLog("warn")&&(console.warn(this.formatMessage("warn",e,t)),this.addToHistory("warn",e,t));}info(e,t){this.shouldLog("info")&&(console.info(this.formatMessage("info",e,t)),this.addToHistory("info",e,t));}debug(e,t){this.shouldLog("debug")&&(console.debug(this.formatMessage("debug",e,t)),this.addToHistory("debug",e,t));}group(e){this.config.enabled&&console.group(`${this.config.prefix} ${e}`);}groupEnd(){this.config.enabled&&console.groupEnd();}startTiming(e){this.config.enablePerformance&&(this.performanceTimings.set(e,{operation:e,startTime:performance.now()}),this.debug(`\u23F1\uFE0F Started: ${e}`));}endTiming(e){if(this.config.enablePerformance){let t=this.performanceTimings.get(e);if(t)return t.endTime=performance.now(),t.duration=t.endTime-t.startTime,this.info(`\u23F1\uFE0F Completed: ${e} (${t.duration.toFixed(2)}ms)`),t.duration}}logRequest(e,t,o){this.config.enableNetworkLogs&&this.debug(`\u{1F310} ${e} ${t}`,o);}logResponse(e,t,o,n){if(this.config.enableNetworkLogs){let a=o>=200&&o<300?"\u2705":"\u274C";this.debug(`${a} ${e} ${t} - ${o}`,n);}}getHistory(){return [...this.logHistory]}getPerformanceTimings(){return Array.from(this.performanceTimings.values())}clearHistory(){this.logHistory=[];}clearTimings(){this.performanceTimings.clear();}exportLogs(){return JSON.stringify({config:this.config,history:this.logHistory,performanceTimings:Array.from(this.performanceTimings.values()),exportedAt:new Date().toISOString()},null,2)}downloadLogs(e="msal-next-debug-logs.json"){if(typeof window>"u")return;let t=this.exportLogs(),o=new Blob([t],{type:"application/json"}),n=URL.createObjectURL(o),a=document.createElement("a");a.href=n,a.download=e,a.click(),URL.revokeObjectURL(n);}setEnabled(e){this.config.enabled=e;}setLevel(e){e&&(this.config.level=e);}},O=null;function Xe(r){return O?r&&(r.enabled!==void 0&&O.setEnabled(r.enabled),r.level&&O.setLevel(r.level)):O=new z(r),O}function Ye(r,e){return new z({...e,prefix:`[MSAL-Next:${r}]`})}function er(r={}){let{protectedRoutes:e=[],publicOnlyRoutes:t=[],loginPath:o="/login",redirectAfterLogin:n="/",sessionCookie:a="msal.account",isAuthenticated:f,debug:c=false}=r;return async function(i){let{pathname:m}=i.nextUrl;c&&console.log("[AuthMiddleware] Processing:",m);let d=false;f?d=await f(i):d=!!i.cookies.get(a)?.value,c&&console.log("[AuthMiddleware] Authenticated:",d);let p=e.some(h=>m.startsWith(h)),g=t.some(h=>m.startsWith(h));if(p&&!d){c&&console.log("[AuthMiddleware] Redirecting to login");let h=i.nextUrl.clone();return h.pathname=o,h.searchParams.set("returnUrl",m),NextResponse.redirect(h)}if(g&&d){c&&console.log("[AuthMiddleware] Redirecting to home");let h=i.nextUrl.searchParams.get("returnUrl"),s=i.nextUrl.clone();return s.pathname=h||n,s.searchParams.delete("returnUrl"),NextResponse.redirect(s)}let y=NextResponse.next();if(d){y.headers.set("x-msal-authenticated","true");try{let h=i.cookies.get(a);if(h?.value){let s=B(h.value,_);s?.username&&y.headers.set("x-msal-username",s.username);}}catch{c&&console.warn("[AuthMiddleware] Failed to parse session data");}}return y}}export{ee as AuthGuard,De as AuthStatus,te as ErrorBoundary,Le as MicrosoftSignInButton,V as MsalAuthProvider,ze as Providers,Ue as SignOutButton,Oe as UserAvatar,er as createAuthMiddleware,H as createMsalConfig,Qe as createRetryWrapper,Ye as createScopedLogger,Xe as getDebugLogger,Re as getMsalInstance,_ as isValidAccountData,$ as isValidRedirectUri,ie as isValidScope,me as retryWithBackoff,B as safeJsonParse,S as sanitizeError,k as useGraphApi,A as useMsalAuth,je as useRoles,K as useUserProfile,Ae as validateScopes,Je as withAuth};
+import {
+  isValidAccountData,
+  isValidRedirectUri,
+  isValidScope,
+  safeJsonParse,
+  sanitizeError,
+  validateScopes
+} from "./chunk-AD43IVG7.mjs";
+
+// src/components/MsalAuthProvider.tsx
+import { MsalProvider } from "@azure/msal-react";
+import { PublicClientApplication, EventType } from "@azure/msal-browser";
+import { useEffect, useState, useRef } from "react";
+
+// src/utils/createMsalConfig.ts
+import { LogLevel } from "@azure/msal-browser";
+function createMsalConfig(config) {
+  if (config.msalConfig) {
+    return config.msalConfig;
+  }
+  const {
+    clientId,
+    tenantId,
+    authorityType = "common",
+    redirectUri,
+    postLogoutRedirectUri,
+    cacheLocation = "sessionStorage",
+    storeAuthStateInCookie = false,
+    navigateToLoginRequestUrl = true,
+    enableLogging = false,
+    loggerCallback,
+    allowedRedirectUris
+  } = config;
+  if (!clientId) {
+    throw new Error("@chemmangat/msal-next: clientId is required");
+  }
+  const getAuthority = () => {
+    if (authorityType === "tenant") {
+      if (!tenantId) {
+        throw new Error('@chemmangat/msal-next: tenantId is required when authorityType is "tenant"');
+      }
+      return `https://login.microsoftonline.com/${tenantId}`;
+    }
+    return `https://login.microsoftonline.com/${authorityType}`;
+  };
+  const defaultRedirectUri = typeof window !== "undefined" ? window.location.origin : "http://localhost:3000";
+  const finalRedirectUri = redirectUri || defaultRedirectUri;
+  if (allowedRedirectUris && allowedRedirectUris.length > 0) {
+    if (!isValidRedirectUri(finalRedirectUri, allowedRedirectUris)) {
+      throw new Error(
+        `@chemmangat/msal-next: redirectUri "${finalRedirectUri}" is not in the allowed list`
+      );
+    }
+    const finalPostLogoutUri = postLogoutRedirectUri || finalRedirectUri;
+    if (!isValidRedirectUri(finalPostLogoutUri, allowedRedirectUris)) {
+      throw new Error(
+        `@chemmangat/msal-next: postLogoutRedirectUri "${finalPostLogoutUri}" is not in the allowed list`
+      );
+    }
+  }
+  const msalConfig = {
+    auth: {
+      clientId,
+      authority: getAuthority(),
+      redirectUri: finalRedirectUri,
+      postLogoutRedirectUri: postLogoutRedirectUri || finalRedirectUri,
+      navigateToLoginRequestUrl
+    },
+    cache: {
+      cacheLocation,
+      storeAuthStateInCookie
+    },
+    system: {
+      loggerOptions: {
+        loggerCallback: loggerCallback || ((level, message, containsPii) => {
+          if (containsPii || !enableLogging) return;
+          switch (level) {
+            case LogLevel.Error:
+              console.error("[MSAL]", message);
+              break;
+            case LogLevel.Warning:
+              console.warn("[MSAL]", message);
+              break;
+            case LogLevel.Info:
+              console.info("[MSAL]", message);
+              break;
+            case LogLevel.Verbose:
+              console.debug("[MSAL]", message);
+              break;
+          }
+        }),
+        logLevel: enableLogging ? LogLevel.Verbose : LogLevel.Error
+      }
+    }
+  };
+  return msalConfig;
+}
+
+// src/components/MsalAuthProvider.tsx
+import { Fragment, jsx } from "react/jsx-runtime";
+var globalMsalInstance = null;
+function getMsalInstance() {
+  return globalMsalInstance;
+}
+function MsalAuthProvider({ children, loadingComponent, onInitialized, ...config }) {
+  const [msalInstance, setMsalInstance] = useState(null);
+  const instanceRef = useRef(null);
+  useEffect(() => {
+    if (typeof window === "undefined") {
+      return;
+    }
+    if (instanceRef.current) {
+      return;
+    }
+    const initializeMsal = async () => {
+      try {
+        const msalConfig = createMsalConfig(config);
+        const instance = new PublicClientApplication(msalConfig);
+        await instance.initialize();
+        try {
+          const response = await instance.handleRedirectPromise();
+          if (response) {
+            if (config.enableLogging) {
+              console.log("[MSAL] Redirect authentication successful");
+            }
+            if (response.account) {
+              instance.setActiveAccount(response.account);
+            }
+          }
+        } catch (redirectError) {
+          if (redirectError?.errorCode === "no_token_request_cache_error") {
+            if (config.enableLogging) {
+              console.log("[MSAL] No pending redirect found (this is normal)");
+            }
+          } else if (redirectError?.errorCode === "user_cancelled") {
+            if (config.enableLogging) {
+              console.log("[MSAL] User cancelled authentication");
+            }
+          } else {
+            console.error("[MSAL] Redirect handling error:", redirectError);
+          }
+        }
+        const accounts = instance.getAllAccounts();
+        if (accounts.length > 0 && !instance.getActiveAccount()) {
+          instance.setActiveAccount(accounts[0]);
+        }
+        const enableLogging = config.enableLogging || false;
+        instance.addEventCallback((event) => {
+          if (event.eventType === EventType.LOGIN_SUCCESS) {
+            const payload = event.payload;
+            if (payload?.account) {
+              instance.setActiveAccount(payload.account);
+            }
+            if (enableLogging) {
+              console.log("[MSAL] Login successful:", payload.account?.username);
+            }
+          }
+          if (event.eventType === EventType.LOGIN_FAILURE) {
+            console.error("[MSAL] Login failed:", event.error);
+          }
+          if (event.eventType === EventType.LOGOUT_SUCCESS) {
+            instance.setActiveAccount(null);
+            if (enableLogging) {
+              console.log("[MSAL] Logout successful");
+            }
+          }
+          if (event.eventType === EventType.ACQUIRE_TOKEN_SUCCESS) {
+            const payload = event.payload;
+            if (payload?.account && !instance.getActiveAccount()) {
+              instance.setActiveAccount(payload.account);
+            }
+          }
+          if (event.eventType === EventType.ACQUIRE_TOKEN_FAILURE) {
+            if (enableLogging) {
+              console.error("[MSAL] Token acquisition failed:", event.error);
+            }
+          }
+        });
+        instanceRef.current = instance;
+        globalMsalInstance = instance;
+        setMsalInstance(instance);
+        if (onInitialized) {
+          onInitialized(instance);
+        }
+      } catch (error) {
+        console.error("[MSAL] Initialization failed:", error);
+        throw error;
+      }
+    };
+    initializeMsal();
+  }, []);
+  if (typeof window === "undefined") {
+    return /* @__PURE__ */ jsx(Fragment, { children: loadingComponent || /* @__PURE__ */ jsx("div", { children: "Loading authentication..." }) });
+  }
+  if (!msalInstance) {
+    return /* @__PURE__ */ jsx(Fragment, { children: loadingComponent || /* @__PURE__ */ jsx("div", { children: "Loading authentication..." }) });
+  }
+  return /* @__PURE__ */ jsx(MsalProvider, { instance: msalInstance, children });
+}
+
+// src/components/MSALProvider.tsx
+import { jsx as jsx2 } from "react/jsx-runtime";
+function MSALProvider({ children, ...props }) {
+  return /* @__PURE__ */ jsx2(MsalAuthProvider, { ...props, children });
+}
+
+// src/hooks/useMsalAuth.ts
+import { useMsal, useAccount } from "@azure/msal-react";
+import { InteractionStatus } from "@azure/msal-browser";
+import { useCallback, useMemo, useRef as useRef2 } from "react";
+var pendingTokenRequests = /* @__PURE__ */ new Map();
+function useMsalAuth(defaultScopes = ["User.Read"]) {
+  const { instance, accounts, inProgress } = useMsal();
+  const account = useAccount(accounts[0] || null);
+  const popupInProgressRef = useRef2(false);
+  const isAuthenticated = useMemo(() => accounts.length > 0, [accounts]);
+  const loginPopup = useCallback(
+    async (scopes = defaultScopes) => {
+      if (inProgress !== InteractionStatus.None) {
+        console.warn("[MSAL] Interaction already in progress");
+        return;
+      }
+      try {
+        const request = {
+          scopes,
+          prompt: "select_account"
+        };
+        const response = await instance.loginPopup(request);
+        if (response?.account) {
+          instance.setActiveAccount(response.account);
+        }
+      } catch (error) {
+        if (error?.errorCode === "user_cancelled") {
+          console.log("[MSAL] User cancelled login");
+          return;
+        }
+        console.error("[MSAL] Login popup failed:", error);
+        throw error;
+      }
+    },
+    [instance, defaultScopes, inProgress]
+  );
+  const loginRedirect = useCallback(
+    async (scopes = defaultScopes) => {
+      if (inProgress !== InteractionStatus.None) {
+        console.warn("[MSAL] Interaction already in progress");
+        return;
+      }
+      try {
+        const request = {
+          scopes,
+          prompt: "select_account"
+        };
+        await instance.loginRedirect(request);
+      } catch (error) {
+        if (error?.errorCode === "user_cancelled") {
+          console.log("[MSAL] User cancelled login");
+          return;
+        }
+        console.error("[MSAL] Login redirect failed:", error);
+        throw error;
+      }
+    },
+    [instance, defaultScopes, inProgress]
+  );
+  const logoutPopup = useCallback(async () => {
+    try {
+      await instance.logoutPopup({
+        account: account || void 0
+      });
+    } catch (error) {
+      console.error("[MSAL] Logout popup failed:", error);
+      throw error;
+    }
+  }, [instance, account]);
+  const logoutRedirect = useCallback(async () => {
+    try {
+      await instance.logoutRedirect({
+        account: account || void 0
+      });
+    } catch (error) {
+      console.error("[MSAL] Logout redirect failed:", error);
+      throw error;
+    }
+  }, [instance, account]);
+  const acquireTokenSilent = useCallback(
+    async (scopes = defaultScopes) => {
+      if (!account) {
+        throw new Error("[MSAL] No active account. Please login first.");
+      }
+      try {
+        const request = {
+          scopes,
+          account,
+          forceRefresh: false
+        };
+        const response = await instance.acquireTokenSilent(request);
+        return response.accessToken;
+      } catch (error) {
+        console.error("[MSAL] Silent token acquisition failed:", error);
+        throw error;
+      }
+    },
+    [instance, account, defaultScopes]
+  );
+  const acquireTokenPopup = useCallback(
+    async (scopes = defaultScopes) => {
+      if (!account) {
+        throw new Error("[MSAL] No active account. Please login first.");
+      }
+      if (popupInProgressRef.current) {
+        throw new Error("[MSAL] Popup already in progress. Please wait.");
+      }
+      try {
+        popupInProgressRef.current = true;
+        const request = {
+          scopes,
+          account
+        };
+        const response = await instance.acquireTokenPopup(request);
+        return response.accessToken;
+      } catch (error) {
+        console.error("[MSAL] Token popup acquisition failed:", error);
+        throw error;
+      } finally {
+        popupInProgressRef.current = false;
+      }
+    },
+    [instance, account, defaultScopes]
+  );
+  const acquireTokenRedirect = useCallback(
+    async (scopes = defaultScopes) => {
+      if (!account) {
+        throw new Error("[MSAL] No active account. Please login first.");
+      }
+      try {
+        const request = {
+          scopes,
+          account
+        };
+        await instance.acquireTokenRedirect(request);
+      } catch (error) {
+        console.error("[MSAL] Token redirect acquisition failed:", error);
+        throw error;
+      }
+    },
+    [instance, account, defaultScopes]
+  );
+  const acquireToken = useCallback(
+    async (scopes = defaultScopes) => {
+      const requestKey = `${account?.homeAccountId || "anonymous"}-${scopes.sort().join(",")}`;
+      const pendingRequest = pendingTokenRequests.get(requestKey);
+      if (pendingRequest) {
+        return pendingRequest;
+      }
+      const tokenRequest = (async () => {
+        try {
+          return await acquireTokenSilent(scopes);
+        } catch (error) {
+          console.warn("[MSAL] Silent token acquisition failed, falling back to popup");
+          return await acquireTokenPopup(scopes);
+        } finally {
+          pendingTokenRequests.delete(requestKey);
+        }
+      })();
+      pendingTokenRequests.set(requestKey, tokenRequest);
+      return tokenRequest;
+    },
+    [acquireTokenSilent, acquireTokenPopup, defaultScopes, account]
+  );
+  const clearSession = useCallback(async () => {
+    instance.setActiveAccount(null);
+    await instance.clearCache();
+  }, [instance]);
+  return {
+    account,
+    accounts,
+    isAuthenticated,
+    inProgress: inProgress !== InteractionStatus.None,
+    loginPopup,
+    loginRedirect,
+    logoutPopup,
+    logoutRedirect,
+    acquireToken,
+    acquireTokenSilent,
+    acquireTokenPopup,
+    acquireTokenRedirect,
+    clearSession
+  };
+}
+
+// src/components/MicrosoftSignInButton.tsx
+import { jsx as jsx3, jsxs } from "react/jsx-runtime";
+function MicrosoftSignInButton({
+  text = "Sign in with Microsoft",
+  variant = "dark",
+  size = "medium",
+  useRedirect = false,
+  scopes,
+  className = "",
+  style,
+  onSuccess,
+  onError
+}) {
+  const { loginPopup, loginRedirect, inProgress } = useMsalAuth();
+  const handleClick = async () => {
+    try {
+      if (useRedirect) {
+        await loginRedirect(scopes);
+      } else {
+        await loginPopup(scopes);
+      }
+      onSuccess?.();
+    } catch (error) {
+      onError?.(error);
+    }
+  };
+  const sizeStyles = {
+    small: {
+      padding: "8px 16px",
+      fontSize: "14px",
+      height: "36px"
+    },
+    medium: {
+      padding: "10px 20px",
+      fontSize: "15px",
+      height: "41px"
+    },
+    large: {
+      padding: "12px 24px",
+      fontSize: "16px",
+      height: "48px"
+    }
+  };
+  const variantStyles = {
+    dark: {
+      backgroundColor: "#2F2F2F",
+      color: "#FFFFFF",
+      border: "1px solid #8C8C8C"
+    },
+    light: {
+      backgroundColor: "#FFFFFF",
+      color: "#5E5E5E",
+      border: "1px solid #8C8C8C"
+    }
+  };
+  const baseStyles = {
+    display: "inline-flex",
+    alignItems: "center",
+    justifyContent: "center",
+    gap: "12px",
+    fontFamily: '"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',
+    fontWeight: 600,
+    borderRadius: "2px",
+    cursor: inProgress ? "not-allowed" : "pointer",
+    transition: "all 0.2s ease",
+    opacity: inProgress ? 0.6 : 1,
+    ...variantStyles[variant],
+    ...sizeStyles[size],
+    ...style
+  };
+  return /* @__PURE__ */ jsxs(
+    "button",
+    {
+      onClick: handleClick,
+      disabled: inProgress,
+      className,
+      style: baseStyles,
+      "aria-label": text,
+      children: [
+        /* @__PURE__ */ jsx3(MicrosoftLogo, {}),
+        /* @__PURE__ */ jsx3("span", { children: text })
+      ]
+    }
+  );
+}
+function MicrosoftLogo() {
+  return /* @__PURE__ */ jsxs("svg", { width: "21", height: "21", viewBox: "0 0 21 21", fill: "none", xmlns: "http://www.w3.org/2000/svg", children: [
+    /* @__PURE__ */ jsx3("rect", { width: "10", height: "10", fill: "#F25022" }),
+    /* @__PURE__ */ jsx3("rect", { x: "11", width: "10", height: "10", fill: "#7FBA00" }),
+    /* @__PURE__ */ jsx3("rect", { y: "11", width: "10", height: "10", fill: "#00A4EF" }),
+    /* @__PURE__ */ jsx3("rect", { x: "11", y: "11", width: "10", height: "10", fill: "#FFB900" })
+  ] });
+}
+
+// src/components/SignOutButton.tsx
+import { jsx as jsx4, jsxs as jsxs2 } from "react/jsx-runtime";
+function SignOutButton({
+  text = "Sign out",
+  variant = "dark",
+  size = "medium",
+  useRedirect = false,
+  className = "",
+  style,
+  onSuccess,
+  onError
+}) {
+  const { logoutPopup, logoutRedirect, inProgress } = useMsalAuth();
+  const handleClick = async () => {
+    try {
+      if (useRedirect) {
+        await logoutRedirect();
+      } else {
+        await logoutPopup();
+      }
+      onSuccess?.();
+    } catch (error) {
+      onError?.(error);
+    }
+  };
+  const sizeStyles = {
+    small: {
+      padding: "8px 16px",
+      fontSize: "14px",
+      height: "36px"
+    },
+    medium: {
+      padding: "10px 20px",
+      fontSize: "15px",
+      height: "41px"
+    },
+    large: {
+      padding: "12px 24px",
+      fontSize: "16px",
+      height: "48px"
+    }
+  };
+  const variantStyles = {
+    dark: {
+      backgroundColor: "#2F2F2F",
+      color: "#FFFFFF",
+      border: "1px solid #8C8C8C"
+    },
+    light: {
+      backgroundColor: "#FFFFFF",
+      color: "#5E5E5E",
+      border: "1px solid #8C8C8C"
+    }
+  };
+  const baseStyles = {
+    display: "inline-flex",
+    alignItems: "center",
+    justifyContent: "center",
+    gap: "12px",
+    fontFamily: '"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',
+    fontWeight: 600,
+    borderRadius: "2px",
+    cursor: inProgress ? "not-allowed" : "pointer",
+    transition: "all 0.2s ease",
+    opacity: inProgress ? 0.6 : 1,
+    ...variantStyles[variant],
+    ...sizeStyles[size],
+    ...style
+  };
+  return /* @__PURE__ */ jsxs2(
+    "button",
+    {
+      onClick: handleClick,
+      disabled: inProgress,
+      className,
+      style: baseStyles,
+      "aria-label": text,
+      children: [
+        /* @__PURE__ */ jsx4(MicrosoftLogo2, {}),
+        /* @__PURE__ */ jsx4("span", { children: text })
+      ]
+    }
+  );
+}
+function MicrosoftLogo2() {
+  return /* @__PURE__ */ jsxs2("svg", { width: "21", height: "21", viewBox: "0 0 21 21", fill: "none", xmlns: "http://www.w3.org/2000/svg", children: [
+    /* @__PURE__ */ jsx4("rect", { width: "10", height: "10", fill: "#F25022" }),
+    /* @__PURE__ */ jsx4("rect", { x: "11", width: "10", height: "10", fill: "#7FBA00" }),
+    /* @__PURE__ */ jsx4("rect", { y: "11", width: "10", height: "10", fill: "#00A4EF" }),
+    /* @__PURE__ */ jsx4("rect", { x: "11", y: "11", width: "10", height: "10", fill: "#FFB900" })
+  ] });
+}
+
+// src/components/UserAvatar.tsx
+import { useEffect as useEffect3, useState as useState3 } from "react";
+
+// src/hooks/useUserProfile.ts
+import { useState as useState2, useEffect as useEffect2, useCallback as useCallback3 } from "react";
+
+// src/hooks/useGraphApi.ts
+import { useCallback as useCallback2 } from "react";
+function useGraphApi() {
+  const { acquireToken } = useMsalAuth();
+  const request = useCallback2(
+    async (endpoint, options = {}) => {
+      const {
+        scopes = ["User.Read"],
+        version = "v1.0",
+        debug = false,
+        ...fetchOptions
+      } = options;
+      try {
+        const token = await acquireToken(scopes);
+        const baseUrl = `https://graph.microsoft.com/${version}`;
+        const url = endpoint.startsWith("http") ? endpoint : `${baseUrl}${endpoint.startsWith("/") ? endpoint : `/${endpoint}`}`;
+        if (debug) {
+          console.log("[GraphAPI] Request:", { url, method: fetchOptions.method || "GET" });
+        }
+        const response = await fetch(url, {
+          ...fetchOptions,
+          headers: {
+            "Authorization": `Bearer ${token}`,
+            "Content-Type": "application/json",
+            ...fetchOptions.headers
+          }
+        });
+        if (!response.ok) {
+          const errorText = await response.text();
+          const errorMessage = `Graph API error (${response.status}): ${errorText}`;
+          throw new Error(errorMessage);
+        }
+        if (response.status === 204 || response.headers.get("content-length") === "0") {
+          return null;
+        }
+        const data = await response.json();
+        if (debug) {
+          console.log("[GraphAPI] Response:", data);
+        }
+        return data;
+      } catch (error) {
+        const sanitizedMessage = sanitizeError(error);
+        console.error("[GraphAPI] Request failed:", sanitizedMessage);
+        throw new Error(sanitizedMessage);
+      }
+    },
+    [acquireToken]
+  );
+  const get = useCallback2(
+    (endpoint, options = {}) => {
+      return request(endpoint, { ...options, method: "GET" });
+    },
+    [request]
+  );
+  const post = useCallback2(
+    (endpoint, body, options = {}) => {
+      return request(endpoint, {
+        ...options,
+        method: "POST",
+        body: body ? JSON.stringify(body) : void 0
+      });
+    },
+    [request]
+  );
+  const put = useCallback2(
+    (endpoint, body, options = {}) => {
+      return request(endpoint, {
+        ...options,
+        method: "PUT",
+        body: body ? JSON.stringify(body) : void 0
+      });
+    },
+    [request]
+  );
+  const patch = useCallback2(
+    (endpoint, body, options = {}) => {
+      return request(endpoint, {
+        ...options,
+        method: "PATCH",
+        body: body ? JSON.stringify(body) : void 0
+      });
+    },
+    [request]
+  );
+  const deleteRequest = useCallback2(
+    (endpoint, options = {}) => {
+      return request(endpoint, { ...options, method: "DELETE" });
+    },
+    [request]
+  );
+  return {
+    get,
+    post,
+    put,
+    patch,
+    delete: deleteRequest,
+    request
+  };
+}
+
+// src/hooks/useUserProfile.ts
+var profileCache = /* @__PURE__ */ new Map();
+var CACHE_DURATION = 5 * 60 * 1e3;
+var MAX_CACHE_SIZE = 100;
+function enforceCacheLimit() {
+  if (profileCache.size > MAX_CACHE_SIZE) {
+    const entries = Array.from(profileCache.entries());
+    entries.sort((a, b) => a[1].timestamp - b[1].timestamp);
+    const toRemove = entries.slice(0, profileCache.size - MAX_CACHE_SIZE);
+    toRemove.forEach(([key]) => {
+      const cached = profileCache.get(key);
+      if (cached?.data.photo) {
+        URL.revokeObjectURL(cached.data.photo);
+      }
+      profileCache.delete(key);
+    });
+  }
+}
+function useUserProfile() {
+  const { isAuthenticated, account } = useMsalAuth();
+  const graph = useGraphApi();
+  const [profile, setProfile] = useState2(null);
+  const [loading, setLoading] = useState2(false);
+  const [error, setError] = useState2(null);
+  const fetchProfile = useCallback3(async () => {
+    if (!isAuthenticated || !account) {
+      setProfile(null);
+      return;
+    }
+    const cacheKey = account.homeAccountId;
+    const cached = profileCache.get(cacheKey);
+    if (cached && Date.now() - cached.timestamp < CACHE_DURATION) {
+      setProfile(cached.data);
+      return;
+    }
+    setLoading(true);
+    setError(null);
+    try {
+      const userData = await graph.get("/me", {
+        scopes: ["User.Read"]
+      });
+      let photoUrl;
+      try {
+        const photoBlob = await graph.get("/me/photo/$value", {
+          scopes: ["User.Read"],
+          headers: {
+            "Content-Type": "image/jpeg"
+          }
+        });
+        if (photoBlob) {
+          photoUrl = URL.createObjectURL(photoBlob);
+        }
+      } catch (photoError) {
+        console.debug("[UserProfile] Photo not available");
+      }
+      const profileData = {
+        id: userData.id,
+        displayName: userData.displayName,
+        givenName: userData.givenName,
+        surname: userData.surname,
+        userPrincipalName: userData.userPrincipalName,
+        mail: userData.mail,
+        jobTitle: userData.jobTitle,
+        officeLocation: userData.officeLocation,
+        mobilePhone: userData.mobilePhone,
+        businessPhones: userData.businessPhones,
+        photo: photoUrl
+      };
+      profileCache.set(cacheKey, {
+        data: profileData,
+        timestamp: Date.now()
+      });
+      enforceCacheLimit();
+      setProfile(profileData);
+    } catch (err) {
+      const error2 = err;
+      const sanitizedMessage = sanitizeError(error2);
+      const sanitizedError = new Error(sanitizedMessage);
+      setError(sanitizedError);
+      console.error("[UserProfile] Failed to fetch profile:", sanitizedMessage);
+    } finally {
+      setLoading(false);
+    }
+  }, [isAuthenticated, account, graph]);
+  const clearCache = useCallback3(() => {
+    if (account) {
+      const cached = profileCache.get(account.homeAccountId);
+      if (cached?.data.photo) {
+        URL.revokeObjectURL(cached.data.photo);
+      }
+      profileCache.delete(account.homeAccountId);
+    }
+    if (profile?.photo) {
+      URL.revokeObjectURL(profile.photo);
+    }
+    setProfile(null);
+  }, [account, profile]);
+  useEffect2(() => {
+    fetchProfile();
+    return () => {
+      if (profile?.photo) {
+        URL.revokeObjectURL(profile.photo);
+      }
+    };
+  }, [fetchProfile]);
+  useEffect2(() => {
+    return () => {
+      if (profile?.photo) {
+        URL.revokeObjectURL(profile.photo);
+      }
+    };
+  }, [profile?.photo]);
+  return {
+    profile,
+    loading,
+    error,
+    refetch: fetchProfile,
+    clearCache
+  };
+}
+
+// src/components/UserAvatar.tsx
+import { jsx as jsx5 } from "react/jsx-runtime";
+function UserAvatar({
+  size = 40,
+  className = "",
+  style,
+  showTooltip = true,
+  fallbackImage
+}) {
+  const { profile, loading } = useUserProfile();
+  const [photoUrl, setPhotoUrl] = useState3(null);
+  const [photoError, setPhotoError] = useState3(false);
+  useEffect3(() => {
+    if (profile?.photo) {
+      setPhotoUrl(profile.photo);
+    }
+  }, [profile?.photo]);
+  const getInitials = () => {
+    if (!profile) return "?";
+    const { givenName, surname, displayName: displayName2 } = profile;
+    if (givenName && surname) {
+      return `${givenName[0]}${surname[0]}`.toUpperCase();
+    }
+    if (displayName2) {
+      const parts = displayName2.split(" ");
+      if (parts.length >= 2) {
+        return `${parts[0][0]}${parts[parts.length - 1][0]}`.toUpperCase();
+      }
+      return displayName2.substring(0, 2).toUpperCase();
+    }
+    return "?";
+  };
+  const baseStyles = {
+    width: `${size}px`,
+    height: `${size}px`,
+    borderRadius: "50%",
+    display: "inline-flex",
+    alignItems: "center",
+    justifyContent: "center",
+    fontSize: `${size * 0.4}px`,
+    fontWeight: 600,
+    fontFamily: '"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',
+    backgroundColor: "#0078D4",
+    color: "#FFFFFF",
+    overflow: "hidden",
+    userSelect: "none",
+    ...style
+  };
+  const displayName = profile?.displayName || "User";
+  if (loading) {
+    return /* @__PURE__ */ jsx5(
+      "div",
+      {
+        className,
+        style: { ...baseStyles, backgroundColor: "#E1E1E1" },
+        "aria-label": "Loading user avatar",
+        children: /* @__PURE__ */ jsx5("span", { style: { fontSize: `${size * 0.3}px` }, children: "..." })
+      }
+    );
+  }
+  if (photoUrl && !photoError) {
+    return /* @__PURE__ */ jsx5(
+      "div",
+      {
+        className,
+        style: baseStyles,
+        title: showTooltip ? displayName : void 0,
+        "aria-label": `${displayName} avatar`,
+        children: /* @__PURE__ */ jsx5(
+          "img",
+          {
+            src: photoUrl,
+            alt: displayName,
+            style: { width: "100%", height: "100%", objectFit: "cover" },
+            onError: () => {
+              setPhotoError(true);
+              if (fallbackImage) {
+                setPhotoUrl(fallbackImage);
+              }
+            }
+          }
+        )
+      }
+    );
+  }
+  return /* @__PURE__ */ jsx5(
+    "div",
+    {
+      className,
+      style: baseStyles,
+      title: showTooltip ? displayName : void 0,
+      "aria-label": `${displayName} avatar`,
+      children: getInitials()
+    }
+  );
+}
+
+// src/components/AuthStatus.tsx
+import { Fragment as Fragment2, jsx as jsx6, jsxs as jsxs3 } from "react/jsx-runtime";
+function AuthStatus({
+  className = "",
+  style,
+  showDetails = false,
+  renderLoading,
+  renderAuthenticated,
+  renderUnauthenticated
+}) {
+  const { isAuthenticated, inProgress, account } = useMsalAuth();
+  const baseStyles = {
+    display: "inline-flex",
+    alignItems: "center",
+    gap: "8px",
+    padding: "8px 12px",
+    borderRadius: "4px",
+    fontFamily: '"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',
+    fontSize: "14px",
+    fontWeight: 500,
+    ...style
+  };
+  if (inProgress) {
+    if (renderLoading) {
+      return /* @__PURE__ */ jsx6(Fragment2, { children: renderLoading() });
+    }
+    return /* @__PURE__ */ jsxs3(
+      "div",
+      {
+        className,
+        style: { ...baseStyles, backgroundColor: "#FFF4CE", color: "#8A6D3B" },
+        role: "status",
+        "aria-live": "polite",
+        children: [
+          /* @__PURE__ */ jsx6(StatusIndicator, { color: "#FFA500" }),
+          /* @__PURE__ */ jsx6("span", { children: "Loading..." })
+        ]
+      }
+    );
+  }
+  if (isAuthenticated) {
+    const username = account?.username || account?.name || "User";
+    if (renderAuthenticated) {
+      return /* @__PURE__ */ jsx6(Fragment2, { children: renderAuthenticated(username) });
+    }
+    return /* @__PURE__ */ jsxs3(
+      "div",
+      {
+        className,
+        style: { ...baseStyles, backgroundColor: "#D4EDDA", color: "#155724" },
+        role: "status",
+        "aria-live": "polite",
+        children: [
+          /* @__PURE__ */ jsx6(StatusIndicator, { color: "#28A745" }),
+          /* @__PURE__ */ jsx6("span", { children: showDetails ? `Authenticated as ${username}` : "Authenticated" })
+        ]
+      }
+    );
+  }
+  if (renderUnauthenticated) {
+    return /* @__PURE__ */ jsx6(Fragment2, { children: renderUnauthenticated() });
+  }
+  return /* @__PURE__ */ jsxs3(
+    "div",
+    {
+      className,
+      style: { ...baseStyles, backgroundColor: "#F8D7DA", color: "#721C24" },
+      role: "status",
+      "aria-live": "polite",
+      children: [
+        /* @__PURE__ */ jsx6(StatusIndicator, { color: "#DC3545" }),
+        /* @__PURE__ */ jsx6("span", { children: "Not authenticated" })
+      ]
+    }
+  );
+}
+function StatusIndicator({ color }) {
+  return /* @__PURE__ */ jsx6("svg", { width: "8", height: "8", viewBox: "0 0 8 8", fill: "none", xmlns: "http://www.w3.org/2000/svg", children: /* @__PURE__ */ jsx6("circle", { cx: "4", cy: "4", r: "4", fill: color }) });
+}
+
+// src/components/AuthGuard.tsx
+import { useEffect as useEffect4 } from "react";
+import { Fragment as Fragment3, jsx as jsx7 } from "react/jsx-runtime";
+function AuthGuard({
+  children,
+  loadingComponent,
+  fallbackComponent,
+  useRedirect = true,
+  scopes,
+  onAuthRequired
+}) {
+  const { isAuthenticated, inProgress, loginRedirect, loginPopup } = useMsalAuth();
+  useEffect4(() => {
+    if (!isAuthenticated && !inProgress) {
+      onAuthRequired?.();
+      const login = async () => {
+        try {
+          if (useRedirect) {
+            await loginRedirect(scopes);
+          } else {
+            await loginPopup(scopes);
+          }
+        } catch (error) {
+          console.error("[AuthGuard] Authentication failed:", error);
+        }
+      };
+      login();
+    }
+  }, [isAuthenticated, inProgress, useRedirect, scopes, loginRedirect, loginPopup, onAuthRequired]);
+  if (inProgress) {
+    return /* @__PURE__ */ jsx7(Fragment3, { children: loadingComponent || /* @__PURE__ */ jsx7("div", { children: "Authenticating..." }) });
+  }
+  if (!isAuthenticated) {
+    return /* @__PURE__ */ jsx7(Fragment3, { children: fallbackComponent || /* @__PURE__ */ jsx7("div", { children: "Redirecting to login..." }) });
+  }
+  return /* @__PURE__ */ jsx7(Fragment3, { children });
+}
+
+// src/components/ErrorBoundary.tsx
+import { Component } from "react";
+import { jsx as jsx8, jsxs as jsxs4 } from "react/jsx-runtime";
+var ErrorBoundary = class extends Component {
+  constructor(props) {
+    super(props);
+    this.reset = () => {
+      this.setState({
+        hasError: false,
+        error: null
+      });
+    };
+    this.state = {
+      hasError: false,
+      error: null
+    };
+  }
+  static getDerivedStateFromError(error) {
+    return {
+      hasError: true,
+      error
+    };
+  }
+  componentDidCatch(error, errorInfo) {
+    const { onError, debug } = this.props;
+    if (debug) {
+      console.error("[ErrorBoundary] Caught error:", error);
+      console.error("[ErrorBoundary] Error info:", errorInfo);
+    }
+    onError?.(error, errorInfo);
+  }
+  render() {
+    const { hasError, error } = this.state;
+    const { children, fallback } = this.props;
+    if (hasError && error) {
+      if (fallback) {
+        return fallback(error, this.reset);
+      }
+      return /* @__PURE__ */ jsxs4(
+        "div",
+        {
+          style: {
+            padding: "20px",
+            margin: "20px",
+            border: "1px solid #DC3545",
+            borderRadius: "4px",
+            backgroundColor: "#F8D7DA",
+            color: "#721C24",
+            fontFamily: '"Segoe UI", Tahoma, Geneva, Verdana, sans-serif'
+          },
+          children: [
+            /* @__PURE__ */ jsx8("h2", { style: { margin: "0 0 10px 0", fontSize: "18px" }, children: "Authentication Error" }),
+            /* @__PURE__ */ jsx8("p", { style: { margin: "0 0 10px 0" }, children: error.message }),
+            /* @__PURE__ */ jsx8(
+              "button",
+              {
+                onClick: this.reset,
+                style: {
+                  padding: "8px 16px",
+                  backgroundColor: "#DC3545",
+                  color: "#FFFFFF",
+                  border: "none",
+                  borderRadius: "4px",
+                  cursor: "pointer",
+                  fontSize: "14px",
+                  fontWeight: 600
+                },
+                children: "Try Again"
+              }
+            )
+          ]
+        }
+      );
+    }
+    return children;
+  }
+};
+
+// src/hooks/useRoles.ts
+import { useState as useState4, useEffect as useEffect5, useCallback as useCallback4 } from "react";
+var rolesCache = /* @__PURE__ */ new Map();
+var CACHE_DURATION2 = 5 * 60 * 1e3;
+var MAX_CACHE_SIZE2 = 100;
+function clearRolesCache(accountId) {
+  if (accountId) {
+    rolesCache.delete(accountId);
+  } else {
+    rolesCache.clear();
+  }
+}
+function enforceCacheLimit2() {
+  if (rolesCache.size > MAX_CACHE_SIZE2) {
+    const entries = Array.from(rolesCache.entries());
+    entries.sort((a, b) => a[1].timestamp - b[1].timestamp);
+    const toRemove = entries.slice(0, rolesCache.size - MAX_CACHE_SIZE2);
+    toRemove.forEach(([key]) => rolesCache.delete(key));
+  }
+}
+function useRoles() {
+  const { isAuthenticated, account } = useMsalAuth();
+  const graph = useGraphApi();
+  const [roles, setRoles] = useState4([]);
+  const [groups, setGroups] = useState4([]);
+  const [loading, setLoading] = useState4(false);
+  const [error, setError] = useState4(null);
+  const fetchRolesAndGroups = useCallback4(async () => {
+    if (!isAuthenticated || !account) {
+      setRoles([]);
+      setGroups([]);
+      return;
+    }
+    const cacheKey = account.homeAccountId;
+    const cached = rolesCache.get(cacheKey);
+    if (cached && Date.now() - cached.timestamp < CACHE_DURATION2) {
+      setRoles(cached.roles);
+      setGroups(cached.groups);
+      return;
+    }
+    setLoading(true);
+    setError(null);
+    try {
+      const idTokenClaims = account.idTokenClaims;
+      const tokenRoles = idTokenClaims?.roles || [];
+      const groupsResponse = await graph.get("/me/memberOf", {
+        scopes: ["User.Read", "Directory.Read.All"]
+      });
+      const userGroups = groupsResponse.value.map((group) => group.id);
+      rolesCache.set(cacheKey, {
+        roles: tokenRoles,
+        groups: userGroups,
+        timestamp: Date.now()
+      });
+      enforceCacheLimit2();
+      setRoles(tokenRoles);
+      setGroups(userGroups);
+    } catch (err) {
+      const error2 = err;
+      const sanitizedMessage = sanitizeError(error2);
+      const sanitizedError = new Error(sanitizedMessage);
+      setError(sanitizedError);
+      console.error("[Roles] Failed to fetch roles/groups:", sanitizedMessage);
+      const idTokenClaims = account.idTokenClaims;
+      const tokenRoles = idTokenClaims?.roles || [];
+      setRoles(tokenRoles);
+    } finally {
+      setLoading(false);
+    }
+  }, [isAuthenticated, account, graph]);
+  const hasRole = useCallback4(
+    (role) => {
+      return roles.includes(role);
+    },
+    [roles]
+  );
+  const hasGroup = useCallback4(
+    (groupId) => {
+      return groups.includes(groupId);
+    },
+    [groups]
+  );
+  const hasAnyRole = useCallback4(
+    (checkRoles) => {
+      return checkRoles.some((role) => roles.includes(role));
+    },
+    [roles]
+  );
+  const hasAllRoles = useCallback4(
+    (checkRoles) => {
+      return checkRoles.every((role) => roles.includes(role));
+    },
+    [roles]
+  );
+  useEffect5(() => {
+    fetchRolesAndGroups();
+    return () => {
+      if (account) {
+        clearRolesCache(account.homeAccountId);
+      }
+    };
+  }, [fetchRolesAndGroups, account]);
+  return {
+    roles,
+    groups,
+    loading,
+    error,
+    hasRole,
+    hasGroup,
+    hasAnyRole,
+    hasAllRoles,
+    refetch: fetchRolesAndGroups
+  };
+}
+
+// src/utils/withAuth.tsx
+import { jsx as jsx9 } from "react/jsx-runtime";
+function withAuth(Component2, options = {}) {
+  const { displayName, ...guardProps } = options;
+  const WrappedComponent = (props) => {
+    return /* @__PURE__ */ jsx9(AuthGuard, { ...guardProps, children: /* @__PURE__ */ jsx9(Component2, { ...props }) });
+  };
+  WrappedComponent.displayName = displayName || `withAuth(${Component2.displayName || Component2.name || "Component"})`;
+  return WrappedComponent;
+}
+
+// src/utils/tokenRetry.ts
+async function retryWithBackoff(fn, config = {}) {
+  const {
+    maxRetries = 3,
+    initialDelay = 1e3,
+    maxDelay = 1e4,
+    backoffMultiplier = 2,
+    debug = false
+  } = config;
+  let lastError;
+  let delay = initialDelay;
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    try {
+      if (debug && attempt > 0) {
+        console.log(`[TokenRetry] Attempt ${attempt + 1}/${maxRetries + 1}`);
+      }
+      return await fn();
+    } catch (error) {
+      lastError = error;
+      if (attempt === maxRetries) {
+        if (debug) {
+          console.error("[TokenRetry] All retry attempts failed");
+        }
+        break;
+      }
+      if (!isRetryableError(error)) {
+        if (debug) {
+          console.log("[TokenRetry] Non-retryable error, aborting");
+        }
+        throw error;
+      }
+      if (debug) {
+        console.warn(`[TokenRetry] Attempt ${attempt + 1} failed, retrying in ${delay}ms...`);
+      }
+      await sleep(delay);
+      delay = Math.min(delay * backoffMultiplier, maxDelay);
+    }
+  }
+  throw lastError;
+}
+function isRetryableError(error) {
+  const message = error.message.toLowerCase();
+  if (message.includes("network") || message.includes("timeout") || message.includes("fetch") || message.includes("connection")) {
+    return true;
+  }
+  if (message.includes("500") || message.includes("502") || message.includes("503")) {
+    return true;
+  }
+  if (message.includes("429") || message.includes("rate limit")) {
+    return true;
+  }
+  if (message.includes("token") && message.includes("expired")) {
+    return true;
+  }
+  return false;
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function createRetryWrapper(fn, config = {}) {
+  return (...args) => {
+    return retryWithBackoff(() => fn(...args), config);
+  };
+}
+
+// src/utils/debugLogger.ts
+var DebugLogger = class {
+  constructor(config = {}) {
+    this.logHistory = [];
+    this.performanceTimings = /* @__PURE__ */ new Map();
+    this.config = {
+      enabled: config.enabled ?? false,
+      prefix: config.prefix ?? "[MSAL-Next]",
+      showTimestamp: config.showTimestamp ?? true,
+      level: config.level ?? "info",
+      enablePerformance: config.enablePerformance ?? false,
+      enableNetworkLogs: config.enableNetworkLogs ?? false,
+      maxHistorySize: config.maxHistorySize ?? 100
+    };
+  }
+  shouldLog(level) {
+    if (!this.config.enabled) return false;
+    const levels = ["error", "warn", "info", "debug"];
+    const currentLevelIndex = levels.indexOf(this.config.level);
+    const messageLevelIndex = levels.indexOf(level);
+    return messageLevelIndex <= currentLevelIndex;
+  }
+  formatMessage(level, message, data) {
+    const timestamp = this.config.showTimestamp ? `[${(/* @__PURE__ */ new Date()).toISOString()}]` : "";
+    const prefix = this.config.prefix;
+    const levelStr = `[${level.toUpperCase()}]`;
+    let formatted = `${timestamp} ${prefix} ${levelStr} ${message}`;
+    if (data !== void 0) {
+      formatted += "\n" + JSON.stringify(data, null, 2);
+    }
+    return formatted;
+  }
+  addToHistory(level, message, data) {
+    if (this.logHistory.length >= this.config.maxHistorySize) {
+      this.logHistory.shift();
+    }
+    this.logHistory.push({
+      timestamp: Date.now(),
+      level,
+      message,
+      data
+    });
+  }
+  error(message, data) {
+    if (this.shouldLog("error")) {
+      console.error(this.formatMessage("error", message, data));
+      this.addToHistory("error", message, data);
+    }
+  }
+  warn(message, data) {
+    if (this.shouldLog("warn")) {
+      console.warn(this.formatMessage("warn", message, data));
+      this.addToHistory("warn", message, data);
+    }
+  }
+  info(message, data) {
+    if (this.shouldLog("info")) {
+      console.info(this.formatMessage("info", message, data));
+      this.addToHistory("info", message, data);
+    }
+  }
+  debug(message, data) {
+    if (this.shouldLog("debug")) {
+      console.debug(this.formatMessage("debug", message, data));
+      this.addToHistory("debug", message, data);
+    }
+  }
+  group(label) {
+    if (this.config.enabled) {
+      console.group(`${this.config.prefix} ${label}`);
+    }
+  }
+  groupEnd() {
+    if (this.config.enabled) {
+      console.groupEnd();
+    }
+  }
+  /**
+   * Start performance timing for an operation
+   */
+  startTiming(operation) {
+    if (this.config.enablePerformance) {
+      this.performanceTimings.set(operation, {
+        operation,
+        startTime: performance.now()
+      });
+      this.debug(`\u23F1\uFE0F Started: ${operation}`);
+    }
+  }
+  /**
+   * End performance timing for an operation
+   */
+  endTiming(operation) {
+    if (this.config.enablePerformance) {
+      const timing = this.performanceTimings.get(operation);
+      if (timing) {
+        timing.endTime = performance.now();
+        timing.duration = timing.endTime - timing.startTime;
+        this.info(`\u23F1\uFE0F Completed: ${operation} (${timing.duration.toFixed(2)}ms)`);
+        return timing.duration;
+      }
+    }
+    return void 0;
+  }
+  /**
+   * Log network request
+   */
+  logRequest(method, url, options) {
+    if (this.config.enableNetworkLogs) {
+      this.debug(`\u{1F310} ${method} ${url}`, options);
+    }
+  }
+  /**
+   * Log network response
+   */
+  logResponse(method, url, status, data) {
+    if (this.config.enableNetworkLogs) {
+      const statusEmoji = status >= 200 && status < 300 ? "\u2705" : "\u274C";
+      this.debug(`${statusEmoji} ${method} ${url} - ${status}`, data);
+    }
+  }
+  /**
+   * Get log history
+   */
+  getHistory() {
+    return [...this.logHistory];
+  }
+  /**
+   * Get performance timings
+   */
+  getPerformanceTimings() {
+    return Array.from(this.performanceTimings.values());
+  }
+  /**
+   * Clear log history
+   */
+  clearHistory() {
+    this.logHistory = [];
+  }
+  /**
+   * Clear performance timings
+   */
+  clearTimings() {
+    this.performanceTimings.clear();
+  }
+  /**
+   * Export logs as JSON
+   */
+  exportLogs() {
+    return JSON.stringify({
+      config: this.config,
+      history: this.logHistory,
+      performanceTimings: Array.from(this.performanceTimings.values()),
+      exportedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }, null, 2);
+  }
+  /**
+   * Download logs as a file
+   */
+  downloadLogs(filename = "msal-next-debug-logs.json") {
+    if (typeof window === "undefined") return;
+    const logs = this.exportLogs();
+    const blob = new Blob([logs], { type: "application/json" });
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement("a");
+    a.href = url;
+    a.download = filename;
+    a.click();
+    URL.revokeObjectURL(url);
+  }
+  setEnabled(enabled) {
+    this.config.enabled = enabled;
+  }
+  setLevel(level) {
+    if (level) {
+      this.config.level = level;
+    }
+  }
+};
+var globalLogger = null;
+function getDebugLogger(config) {
+  if (!globalLogger) {
+    globalLogger = new DebugLogger(config);
+  } else if (config) {
+    if (config.enabled !== void 0) {
+      globalLogger.setEnabled(config.enabled);
+    }
+    if (config.level) {
+      globalLogger.setLevel(config.level);
+    }
+  }
+  return globalLogger;
+}
+function createScopedLogger(scope, config) {
+  return new DebugLogger({
+    ...config,
+    prefix: `[MSAL-Next:${scope}]`
+  });
+}
+
+// src/middleware/createAuthMiddleware.ts
+import { NextResponse } from "next/server";
+function createAuthMiddleware(config = {}) {
+  const {
+    protectedRoutes = [],
+    publicOnlyRoutes = [],
+    loginPath = "/login",
+    redirectAfterLogin = "/",
+    sessionCookie = "msal.account",
+    isAuthenticated: customAuthCheck,
+    debug = false
+  } = config;
+  return async function authMiddleware(request) {
+    const { pathname } = request.nextUrl;
+    if (debug) {
+      console.log("[AuthMiddleware] Processing:", pathname);
+    }
+    let authenticated = false;
+    if (customAuthCheck) {
+      authenticated = await customAuthCheck(request);
+    } else {
+      const sessionData = request.cookies.get(sessionCookie);
+      authenticated = !!sessionData?.value;
+    }
+    if (debug) {
+      console.log("[AuthMiddleware] Authenticated:", authenticated);
+    }
+    const isProtectedRoute = protectedRoutes.some(
+      (route) => pathname.startsWith(route)
+    );
+    const isPublicOnlyRoute = publicOnlyRoutes.some(
+      (route) => pathname.startsWith(route)
+    );
+    if (isProtectedRoute && !authenticated) {
+      if (debug) {
+        console.log("[AuthMiddleware] Redirecting to login");
+      }
+      const url = request.nextUrl.clone();
+      url.pathname = loginPath;
+      url.searchParams.set("returnUrl", pathname);
+      return NextResponse.redirect(url);
+    }
+    if (isPublicOnlyRoute && authenticated) {
+      if (debug) {
+        console.log("[AuthMiddleware] Redirecting to home");
+      }
+      const returnUrl = request.nextUrl.searchParams.get("returnUrl");
+      const url = request.nextUrl.clone();
+      url.pathname = returnUrl || redirectAfterLogin;
+      url.searchParams.delete("returnUrl");
+      return NextResponse.redirect(url);
+    }
+    const response = NextResponse.next();
+    if (authenticated) {
+      response.headers.set("x-msal-authenticated", "true");
+      try {
+        const sessionData = request.cookies.get(sessionCookie);
+        if (sessionData?.value) {
+          const account = safeJsonParse(sessionData.value, isValidAccountData);
+          if (account?.username) {
+            response.headers.set("x-msal-username", account.username);
+          }
+        }
+      } catch (error) {
+        if (debug) {
+          console.warn("[AuthMiddleware] Failed to parse session data");
+        }
+      }
+    }
+    return response;
+  };
+}
+
+// src/client.ts
+import { useMsal as useMsal2, useIsAuthenticated, useAccount as useAccount2 } from "@azure/msal-react";
+export {
+  AuthGuard,
+  AuthStatus,
+  ErrorBoundary,
+  MSALProvider,
+  MicrosoftSignInButton,
+  MsalAuthProvider,
+  SignOutButton,
+  UserAvatar,
+  createAuthMiddleware,
+  createMsalConfig,
+  createRetryWrapper,
+  createScopedLogger,
+  getDebugLogger,
+  getMsalInstance,
+  isValidAccountData,
+  isValidRedirectUri,
+  isValidScope,
+  retryWithBackoff,
+  safeJsonParse,
+  sanitizeError,
+  useAccount2 as useAccount,
+  useGraphApi,
+  useIsAuthenticated,
+  useMsal2 as useMsal,
+  useMsalAuth,
+  useRoles,
+  useUserProfile,
+  validateScopes,
+  withAuth
+};