@chemmangat/msal-next 3.1.7 → 3.1.9

package/dist/index.mjs

@@ -1,1566 +1,2 @@
-"use client";
-
-// src/components/MsalAuthProvider.tsx
-import { MsalProvider } from "@azure/msal-react";
-import { PublicClientApplication, EventType } from "@azure/msal-browser";
-import { useEffect, useState, useRef } from "react";
-
-// src/utils/createMsalConfig.ts
-import { LogLevel } from "@azure/msal-browser";
-
-// src/utils/validation.ts
-function safeJsonParse(jsonString, validator) {
-  try {
-    const parsed = JSON.parse(jsonString);
-    if (validator(parsed)) {
-      return parsed;
-    }
-    console.warn("[Validation] JSON validation failed");
-    return null;
-  } catch (error) {
-    console.error("[Validation] JSON parse error:", error);
-    return null;
-  }
-}
-function isValidAccountData(data) {
-  return typeof data === "object" && data !== null && typeof data.homeAccountId === "string" && data.homeAccountId.length > 0 && typeof data.username === "string" && data.username.length > 0 && (data.name === void 0 || typeof data.name === "string");
-}
-function sanitizeError(error) {
-  if (error instanceof Error) {
-    const message = error.message;
-    const sanitized = message.replace(/[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g, "[TOKEN_REDACTED]").replace(/[a-f0-9]{32,}/gi, "[SECRET_REDACTED]").replace(/Bearer\s+[^\s]+/gi, "Bearer [REDACTED]");
-    return sanitized;
-  }
-  return "An unexpected error occurred";
-}
-function isValidRedirectUri(uri, allowedOrigins) {
-  try {
-    const url = new URL(uri);
-    return allowedOrigins.some((allowed) => {
-      const allowedUrl = new URL(allowed);
-      return url.origin === allowedUrl.origin;
-    });
-  } catch {
-    return false;
-  }
-}
-function isValidScope(scope) {
-  return /^[a-zA-Z0-9._-]+$/.test(scope);
-}
-function validateScopes(scopes) {
-  return Array.isArray(scopes) && scopes.every(isValidScope);
-}
-
-// src/utils/createMsalConfig.ts
-function createMsalConfig(config) {
-  if (config.msalConfig) {
-    return config.msalConfig;
-  }
-  const {
-    clientId,
-    tenantId,
-    authorityType = "common",
-    redirectUri,
-    postLogoutRedirectUri,
-    cacheLocation = "sessionStorage",
-    storeAuthStateInCookie = false,
-    navigateToLoginRequestUrl = false,
-    enableLogging = false,
-    loggerCallback,
-    allowedRedirectUris
-  } = config;
-  if (!clientId) {
-    throw new Error("@chemmangat/msal-next: clientId is required");
-  }
-  const getAuthority = () => {
-    if (authorityType === "tenant") {
-      if (!tenantId) {
-        throw new Error('@chemmangat/msal-next: tenantId is required when authorityType is "tenant"');
-      }
-      return `https://login.microsoftonline.com/${tenantId}`;
-    }
-    return `https://login.microsoftonline.com/${authorityType}`;
-  };
-  const defaultRedirectUri = typeof window !== "undefined" ? window.location.origin : "http://localhost:3000";
-  const finalRedirectUri = redirectUri || defaultRedirectUri;
-  if (allowedRedirectUris && allowedRedirectUris.length > 0) {
-    if (!isValidRedirectUri(finalRedirectUri, allowedRedirectUris)) {
-      throw new Error(
-        `@chemmangat/msal-next: redirectUri "${finalRedirectUri}" is not in the allowed list`
-      );
-    }
-    const finalPostLogoutUri = postLogoutRedirectUri || finalRedirectUri;
-    if (!isValidRedirectUri(finalPostLogoutUri, allowedRedirectUris)) {
-      throw new Error(
-        `@chemmangat/msal-next: postLogoutRedirectUri "${finalPostLogoutUri}" is not in the allowed list`
-      );
-    }
-  }
-  const msalConfig = {
-    auth: {
-      clientId,
-      authority: getAuthority(),
-      redirectUri: finalRedirectUri,
-      postLogoutRedirectUri: postLogoutRedirectUri || finalRedirectUri,
-      navigateToLoginRequestUrl
-    },
-    cache: {
-      cacheLocation,
-      storeAuthStateInCookie
-    },
-    system: {
-      loggerOptions: {
-        loggerCallback: loggerCallback || ((level, message, containsPii) => {
-          if (containsPii || !enableLogging) return;
-          switch (level) {
-            case LogLevel.Error:
-              console.error("[MSAL]", message);
-              break;
-            case LogLevel.Warning:
-              console.warn("[MSAL]", message);
-              break;
-            case LogLevel.Info:
-              console.info("[MSAL]", message);
-              break;
-            case LogLevel.Verbose:
-              console.debug("[MSAL]", message);
-              break;
-          }
-        }),
-        logLevel: enableLogging ? LogLevel.Verbose : LogLevel.Error
-      }
-    }
-  };
-  return msalConfig;
-}
-
-// src/components/MsalAuthProvider.tsx
-import { Fragment, jsx } from "react/jsx-runtime";
-var globalMsalInstance = null;
-function getMsalInstance() {
-  return globalMsalInstance;
-}
-function MsalAuthProvider({ children, loadingComponent, onInitialized, ...config }) {
-  const [msalInstance, setMsalInstance] = useState(null);
-  const instanceRef = useRef(null);
-  useEffect(() => {
-    if (typeof window === "undefined") {
-      return;
-    }
-    if (instanceRef.current) {
-      return;
-    }
-    const initializeMsal = async () => {
-      try {
-        const msalConfig = createMsalConfig(config);
-        const instance = new PublicClientApplication(msalConfig);
-        await instance.initialize();
-        try {
-          const response = await instance.handleRedirectPromise();
-          if (response) {
-            if (config.enableLogging) {
-              console.log("[MSAL] Redirect authentication successful");
-            }
-            if (response.account) {
-              instance.setActiveAccount(response.account);
-            }
-            if (window.location.hash) {
-              window.history.replaceState(null, "", window.location.pathname + window.location.search);
-            }
-          }
-        } catch (redirectError) {
-          if (redirectError?.errorCode === "no_token_request_cache_error") {
-            if (config.enableLogging) {
-              console.log("[MSAL] No pending redirect found (this is normal)");
-            }
-          } else if (redirectError?.errorCode === "user_cancelled") {
-            if (config.enableLogging) {
-              console.log("[MSAL] User cancelled authentication");
-            }
-          } else {
-            console.error("[MSAL] Redirect handling error:", redirectError);
-          }
-          if (window.location.hash && (window.location.hash.includes("code=") || window.location.hash.includes("error="))) {
-            window.history.replaceState(null, "", window.location.pathname + window.location.search);
-          }
-        }
-        const accounts = instance.getAllAccounts();
-        if (accounts.length > 0 && !instance.getActiveAccount()) {
-          instance.setActiveAccount(accounts[0]);
-        }
-        const enableLogging = config.enableLogging || false;
-        instance.addEventCallback((event) => {
-          if (event.eventType === EventType.LOGIN_SUCCESS) {
-            const payload = event.payload;
-            if (payload?.account) {
-              instance.setActiveAccount(payload.account);
-            }
-            if (enableLogging) {
-              console.log("[MSAL] Login successful:", payload.account?.username);
-            }
-          }
-          if (event.eventType === EventType.LOGIN_FAILURE) {
-            console.error("[MSAL] Login failed:", event.error);
-          }
-          if (event.eventType === EventType.LOGOUT_SUCCESS) {
-            instance.setActiveAccount(null);
-            if (enableLogging) {
-              console.log("[MSAL] Logout successful");
-            }
-          }
-          if (event.eventType === EventType.ACQUIRE_TOKEN_SUCCESS) {
-            const payload = event.payload;
-            if (payload?.account && !instance.getActiveAccount()) {
-              instance.setActiveAccount(payload.account);
-            }
-          }
-          if (event.eventType === EventType.ACQUIRE_TOKEN_FAILURE) {
-            if (enableLogging) {
-              console.error("[MSAL] Token acquisition failed:", event.error);
-            }
-          }
-        });
-        instanceRef.current = instance;
-        globalMsalInstance = instance;
-        setMsalInstance(instance);
-        if (onInitialized) {
-          onInitialized(instance);
-        }
-      } catch (error) {
-        console.error("[MSAL] Initialization failed:", error);
-        throw error;
-      }
-    };
-    initializeMsal();
-  }, []);
-  if (typeof window === "undefined") {
-    return /* @__PURE__ */ jsx(Fragment, { children: loadingComponent || /* @__PURE__ */ jsx("div", { children: "Loading authentication..." }) });
-  }
-  if (!msalInstance) {
-    return /* @__PURE__ */ jsx(Fragment, { children: loadingComponent || /* @__PURE__ */ jsx("div", { children: "Loading authentication..." }) });
-  }
-  return /* @__PURE__ */ jsx(MsalProvider, { instance: msalInstance, children });
-}
-
-// src/components/MSALProvider.tsx
-import { jsx as jsx2 } from "react/jsx-runtime";
-function MSALProvider({ children, ...props }) {
-  return /* @__PURE__ */ jsx2(MsalAuthProvider, { ...props, children });
-}
-
-// src/hooks/useMsalAuth.ts
-import { useMsal, useAccount } from "@azure/msal-react";
-import { InteractionStatus } from "@azure/msal-browser";
-import { useCallback, useMemo } from "react";
-var pendingTokenRequests = /* @__PURE__ */ new Map();
-function useMsalAuth(defaultScopes = ["User.Read"]) {
-  const { instance, accounts, inProgress } = useMsal();
-  const account = useAccount(accounts[0] || null);
-  const isAuthenticated = useMemo(() => accounts.length > 0, [accounts]);
-  const loginRedirect = useCallback(
-    async (scopes = defaultScopes) => {
-      if (inProgress !== InteractionStatus.None) {
-        console.warn("[MSAL] Interaction already in progress");
-        return;
-      }
-      try {
-        const request = {
-          scopes,
-          prompt: "select_account"
-        };
-        await instance.loginRedirect(request);
-      } catch (error) {
-        if (error?.errorCode === "user_cancelled") {
-          console.log("[MSAL] User cancelled login");
-          return;
-        }
-        console.error("[MSAL] Login redirect failed:", error);
-        throw error;
-      }
-    },
-    [instance, defaultScopes, inProgress]
-  );
-  const logoutRedirect = useCallback(async () => {
-    try {
-      await instance.logoutRedirect({
-        account: account || void 0
-      });
-    } catch (error) {
-      console.error("[MSAL] Logout redirect failed:", error);
-      throw error;
-    }
-  }, [instance, account]);
-  const acquireTokenSilent = useCallback(
-    async (scopes = defaultScopes) => {
-      if (!account) {
-        throw new Error("[MSAL] No active account. Please login first.");
-      }
-      try {
-        const request = {
-          scopes,
-          account,
-          forceRefresh: false
-        };
-        const response = await instance.acquireTokenSilent(request);
-        return response.accessToken;
-      } catch (error) {
-        console.error("[MSAL] Silent token acquisition failed:", error);
-        throw error;
-      }
-    },
-    [instance, account, defaultScopes]
-  );
-  const acquireTokenRedirect = useCallback(
-    async (scopes = defaultScopes) => {
-      if (!account) {
-        throw new Error("[MSAL] No active account. Please login first.");
-      }
-      try {
-        const request = {
-          scopes,
-          account
-        };
-        await instance.acquireTokenRedirect(request);
-      } catch (error) {
-        console.error("[MSAL] Token redirect acquisition failed:", error);
-        throw error;
-      }
-    },
-    [instance, account, defaultScopes]
-  );
-  const acquireToken = useCallback(
-    async (scopes = defaultScopes) => {
-      const requestKey = `${account?.homeAccountId || "anonymous"}-${scopes.sort().join(",")}`;
-      const pendingRequest = pendingTokenRequests.get(requestKey);
-      if (pendingRequest) {
-        return pendingRequest;
-      }
-      const tokenRequest = (async () => {
-        try {
-          return await acquireTokenSilent(scopes);
-        } catch (error) {
-          console.warn("[MSAL] Silent token acquisition failed, falling back to redirect");
-          await acquireTokenRedirect(scopes);
-          throw new Error("[MSAL] Redirecting for token acquisition");
-        } finally {
-          pendingTokenRequests.delete(requestKey);
-        }
-      })();
-      pendingTokenRequests.set(requestKey, tokenRequest);
-      return tokenRequest;
-    },
-    [acquireTokenSilent, acquireTokenRedirect, defaultScopes, account]
-  );
-  const clearSession = useCallback(async () => {
-    instance.setActiveAccount(null);
-    await instance.clearCache();
-  }, [instance]);
-  return {
-    account,
-    accounts,
-    isAuthenticated,
-    inProgress: inProgress !== InteractionStatus.None,
-    loginRedirect,
-    logoutRedirect,
-    acquireToken,
-    acquireTokenSilent,
-    acquireTokenRedirect,
-    clearSession
-  };
-}
-
-// src/components/MicrosoftSignInButton.tsx
-import { useState as useState2 } from "react";
-import { jsx as jsx3, jsxs } from "react/jsx-runtime";
-function MicrosoftSignInButton({
-  text = "Sign in with Microsoft",
-  variant = "dark",
-  size = "medium",
-  scopes,
-  className = "",
-  style,
-  onSuccess,
-  onError
-}) {
-  const { loginRedirect, inProgress } = useMsalAuth();
-  const [isLoading, setIsLoading] = useState2(false);
-  const handleClick = async () => {
-    setIsLoading(true);
-    try {
-      await loginRedirect(scopes);
-      onSuccess?.();
-    } catch (error) {
-      onError?.(error);
-    } finally {
-      setTimeout(() => setIsLoading(false), 500);
-    }
-  };
-  const sizeStyles = {
-    small: {
-      padding: "8px 16px",
-      fontSize: "14px",
-      height: "36px"
-    },
-    medium: {
-      padding: "10px 20px",
-      fontSize: "15px",
-      height: "41px"
-    },
-    large: {
-      padding: "12px 24px",
-      fontSize: "16px",
-      height: "48px"
-    }
-  };
-  const variantStyles = {
-    dark: {
-      backgroundColor: "#2F2F2F",
-      color: "#FFFFFF",
-      border: "1px solid #8C8C8C"
-    },
-    light: {
-      backgroundColor: "#FFFFFF",
-      color: "#5E5E5E",
-      border: "1px solid #8C8C8C"
-    }
-  };
-  const isDisabled = inProgress || isLoading;
-  const baseStyles = {
-    display: "inline-flex",
-    alignItems: "center",
-    justifyContent: "center",
-    gap: "12px",
-    fontFamily: '"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',
-    fontWeight: 600,
-    borderRadius: "2px",
-    cursor: isDisabled ? "not-allowed" : "pointer",
-    transition: "all 0.2s ease",
-    opacity: isDisabled ? 0.6 : 1,
-    ...variantStyles[variant],
-    ...sizeStyles[size],
-    ...style
-  };
-  return /* @__PURE__ */ jsxs(
-    "button",
-    {
-      onClick: handleClick,
-      disabled: isDisabled,
-      className,
-      style: baseStyles,
-      "aria-label": text,
-      children: [
-        /* @__PURE__ */ jsx3(MicrosoftLogo, {}),
-        /* @__PURE__ */ jsx3("span", { children: text })
-      ]
-    }
-  );
-}
-function MicrosoftLogo() {
-  return /* @__PURE__ */ jsxs("svg", { width: "21", height: "21", viewBox: "0 0 21 21", fill: "none", xmlns: "http://www.w3.org/2000/svg", children: [
-    /* @__PURE__ */ jsx3("rect", { width: "10", height: "10", fill: "#F25022" }),
-    /* @__PURE__ */ jsx3("rect", { x: "11", width: "10", height: "10", fill: "#7FBA00" }),
-    /* @__PURE__ */ jsx3("rect", { y: "11", width: "10", height: "10", fill: "#00A4EF" }),
-    /* @__PURE__ */ jsx3("rect", { x: "11", y: "11", width: "10", height: "10", fill: "#FFB900" })
-  ] });
-}
-
-// src/components/SignOutButton.tsx
-import { jsx as jsx4, jsxs as jsxs2 } from "react/jsx-runtime";
-function SignOutButton({
-  text = "Sign out",
-  variant = "dark",
-  size = "medium",
-  className = "",
-  style,
-  onSuccess,
-  onError
-}) {
-  const { logoutRedirect, inProgress } = useMsalAuth();
-  const handleClick = async () => {
-    try {
-      await logoutRedirect();
-      onSuccess?.();
-    } catch (error) {
-      onError?.(error);
-    }
-  };
-  const sizeStyles = {
-    small: {
-      padding: "8px 16px",
-      fontSize: "14px",
-      height: "36px"
-    },
-    medium: {
-      padding: "10px 20px",
-      fontSize: "15px",
-      height: "41px"
-    },
-    large: {
-      padding: "12px 24px",
-      fontSize: "16px",
-      height: "48px"
-    }
-  };
-  const variantStyles = {
-    dark: {
-      backgroundColor: "#2F2F2F",
-      color: "#FFFFFF",
-      border: "1px solid #8C8C8C"
-    },
-    light: {
-      backgroundColor: "#FFFFFF",
-      color: "#5E5E5E",
-      border: "1px solid #8C8C8C"
-    }
-  };
-  const baseStyles = {
-    display: "inline-flex",
-    alignItems: "center",
-    justifyContent: "center",
-    gap: "12px",
-    fontFamily: '"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',
-    fontWeight: 600,
-    borderRadius: "2px",
-    cursor: inProgress ? "not-allowed" : "pointer",
-    transition: "all 0.2s ease",
-    opacity: inProgress ? 0.6 : 1,
-    ...variantStyles[variant],
-    ...sizeStyles[size],
-    ...style
-  };
-  return /* @__PURE__ */ jsxs2(
-    "button",
-    {
-      onClick: handleClick,
-      disabled: inProgress,
-      className,
-      style: baseStyles,
-      "aria-label": text,
-      children: [
-        /* @__PURE__ */ jsx4(MicrosoftLogo2, {}),
-        /* @__PURE__ */ jsx4("span", { children: text })
-      ]
-    }
-  );
-}
-function MicrosoftLogo2() {
-  return /* @__PURE__ */ jsxs2("svg", { width: "21", height: "21", viewBox: "0 0 21 21", fill: "none", xmlns: "http://www.w3.org/2000/svg", children: [
-    /* @__PURE__ */ jsx4("rect", { width: "10", height: "10", fill: "#F25022" }),
-    /* @__PURE__ */ jsx4("rect", { x: "11", width: "10", height: "10", fill: "#7FBA00" }),
-    /* @__PURE__ */ jsx4("rect", { y: "11", width: "10", height: "10", fill: "#00A4EF" }),
-    /* @__PURE__ */ jsx4("rect", { x: "11", y: "11", width: "10", height: "10", fill: "#FFB900" })
-  ] });
-}
-
-// src/components/UserAvatar.tsx
-import { useEffect as useEffect3, useState as useState4 } from "react";
-
-// src/hooks/useUserProfile.ts
-import { useState as useState3, useEffect as useEffect2, useCallback as useCallback3 } from "react";
-
-// src/hooks/useGraphApi.ts
-import { useCallback as useCallback2 } from "react";
-function useGraphApi() {
-  const { acquireToken } = useMsalAuth();
-  const request = useCallback2(
-    async (endpoint, options = {}) => {
-      const {
-        scopes = ["User.Read"],
-        version = "v1.0",
-        debug = false,
-        ...fetchOptions
-      } = options;
-      try {
-        const token = await acquireToken(scopes);
-        const baseUrl = `https://graph.microsoft.com/${version}`;
-        const url = endpoint.startsWith("http") ? endpoint : `${baseUrl}${endpoint.startsWith("/") ? endpoint : `/${endpoint}`}`;
-        if (debug) {
-          console.log("[GraphAPI] Request:", { url, method: fetchOptions.method || "GET" });
-        }
-        const response = await fetch(url, {
-          ...fetchOptions,
-          headers: {
-            "Authorization": `Bearer ${token}`,
-            "Content-Type": "application/json",
-            ...fetchOptions.headers
-          }
-        });
-        if (!response.ok) {
-          const errorText = await response.text();
-          const errorMessage = `Graph API error (${response.status}): ${errorText}`;
-          throw new Error(errorMessage);
-        }
-        if (response.status === 204 || response.headers.get("content-length") === "0") {
-          return null;
-        }
-        const data = await response.json();
-        if (debug) {
-          console.log("[GraphAPI] Response:", data);
-        }
-        return data;
-      } catch (error) {
-        const sanitizedMessage = sanitizeError(error);
-        console.error("[GraphAPI] Request failed:", sanitizedMessage);
-        throw new Error(sanitizedMessage);
-      }
-    },
-    [acquireToken]
-  );
-  const get = useCallback2(
-    (endpoint, options = {}) => {
-      return request(endpoint, { ...options, method: "GET" });
-    },
-    [request]
-  );
-  const post = useCallback2(
-    (endpoint, body, options = {}) => {
-      return request(endpoint, {
-        ...options,
-        method: "POST",
-        body: body ? JSON.stringify(body) : void 0
-      });
-    },
-    [request]
-  );
-  const put = useCallback2(
-    (endpoint, body, options = {}) => {
-      return request(endpoint, {
-        ...options,
-        method: "PUT",
-        body: body ? JSON.stringify(body) : void 0
-      });
-    },
-    [request]
-  );
-  const patch = useCallback2(
-    (endpoint, body, options = {}) => {
-      return request(endpoint, {
-        ...options,
-        method: "PATCH",
-        body: body ? JSON.stringify(body) : void 0
-      });
-    },
-    [request]
-  );
-  const deleteRequest = useCallback2(
-    (endpoint, options = {}) => {
-      return request(endpoint, { ...options, method: "DELETE" });
-    },
-    [request]
-  );
-  return {
-    get,
-    post,
-    put,
-    patch,
-    delete: deleteRequest,
-    request
-  };
-}
-
-// src/hooks/useUserProfile.ts
-var profileCache = /* @__PURE__ */ new Map();
-var CACHE_DURATION = 5 * 60 * 1e3;
-var MAX_CACHE_SIZE = 100;
-function enforceCacheLimit() {
-  if (profileCache.size > MAX_CACHE_SIZE) {
-    const entries = Array.from(profileCache.entries());
-    entries.sort((a, b) => a[1].timestamp - b[1].timestamp);
-    const toRemove = entries.slice(0, profileCache.size - MAX_CACHE_SIZE);
-    toRemove.forEach(([key]) => {
-      const cached = profileCache.get(key);
-      if (cached?.data.photo) {
-        URL.revokeObjectURL(cached.data.photo);
-      }
-      profileCache.delete(key);
-    });
-  }
-}
-function useUserProfile() {
-  const { isAuthenticated, account } = useMsalAuth();
-  const graph = useGraphApi();
-  const [profile, setProfile] = useState3(null);
-  const [loading, setLoading] = useState3(false);
-  const [error, setError] = useState3(null);
-  const fetchProfile = useCallback3(async () => {
-    if (!isAuthenticated || !account) {
-      setProfile(null);
-      return;
-    }
-    const cacheKey = account.homeAccountId;
-    const cached = profileCache.get(cacheKey);
-    if (cached && Date.now() - cached.timestamp < CACHE_DURATION) {
-      setProfile(cached.data);
-      return;
-    }
-    setLoading(true);
-    setError(null);
-    try {
-      const userData = await graph.get("/me", {
-        scopes: ["User.Read"]
-      });
-      let photoUrl;
-      try {
-        const photoBlob = await graph.get("/me/photo/$value", {
-          scopes: ["User.Read"],
-          headers: {
-            "Content-Type": "image/jpeg"
-          }
-        });
-        if (photoBlob) {
-          photoUrl = URL.createObjectURL(photoBlob);
-        }
-      } catch (photoError) {
-        console.debug("[UserProfile] Photo not available");
-      }
-      const profileData = {
-        id: userData.id,
-        displayName: userData.displayName,
-        givenName: userData.givenName,
-        surname: userData.surname,
-        userPrincipalName: userData.userPrincipalName,
-        mail: userData.mail,
-        jobTitle: userData.jobTitle,
-        officeLocation: userData.officeLocation,
-        mobilePhone: userData.mobilePhone,
-        businessPhones: userData.businessPhones,
-        photo: photoUrl
-      };
-      profileCache.set(cacheKey, {
-        data: profileData,
-        timestamp: Date.now()
-      });
-      enforceCacheLimit();
-      setProfile(profileData);
-    } catch (err) {
-      const error2 = err;
-      const sanitizedMessage = sanitizeError(error2);
-      const sanitizedError = new Error(sanitizedMessage);
-      setError(sanitizedError);
-      console.error("[UserProfile] Failed to fetch profile:", sanitizedMessage);
-    } finally {
-      setLoading(false);
-    }
-  }, [isAuthenticated, account, graph]);
-  const clearCache = useCallback3(() => {
-    if (account) {
-      const cached = profileCache.get(account.homeAccountId);
-      if (cached?.data.photo) {
-        URL.revokeObjectURL(cached.data.photo);
-      }
-      profileCache.delete(account.homeAccountId);
-    }
-    if (profile?.photo) {
-      URL.revokeObjectURL(profile.photo);
-    }
-    setProfile(null);
-  }, [account, profile]);
-  useEffect2(() => {
-    fetchProfile();
-    return () => {
-      if (profile?.photo) {
-        URL.revokeObjectURL(profile.photo);
-      }
-    };
-  }, [fetchProfile]);
-  useEffect2(() => {
-    return () => {
-      if (profile?.photo) {
-        URL.revokeObjectURL(profile.photo);
-      }
-    };
-  }, [profile?.photo]);
-  return {
-    profile,
-    loading,
-    error,
-    refetch: fetchProfile,
-    clearCache
-  };
-}
-
-// src/components/UserAvatar.tsx
-import { jsx as jsx5 } from "react/jsx-runtime";
-function UserAvatar({
-  size = 40,
-  className = "",
-  style,
-  showTooltip = true,
-  fallbackImage
-}) {
-  const { profile, loading } = useUserProfile();
-  const [photoUrl, setPhotoUrl] = useState4(null);
-  const [photoError, setPhotoError] = useState4(false);
-  useEffect3(() => {
-    if (profile?.photo) {
-      setPhotoUrl(profile.photo);
-    }
-  }, [profile?.photo]);
-  const getInitials = () => {
-    if (!profile) return "?";
-    const { givenName, surname, displayName: displayName2 } = profile;
-    if (givenName && surname) {
-      return `${givenName[0]}${surname[0]}`.toUpperCase();
-    }
-    if (displayName2) {
-      const parts = displayName2.split(" ");
-      if (parts.length >= 2) {
-        return `${parts[0][0]}${parts[parts.length - 1][0]}`.toUpperCase();
-      }
-      return displayName2.substring(0, 2).toUpperCase();
-    }
-    return "?";
-  };
-  const baseStyles = {
-    width: `${size}px`,
-    height: `${size}px`,
-    borderRadius: "50%",
-    display: "inline-flex",
-    alignItems: "center",
-    justifyContent: "center",
-    fontSize: `${size * 0.4}px`,
-    fontWeight: 600,
-    fontFamily: '"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',
-    backgroundColor: "#0078D4",
-    color: "#FFFFFF",
-    overflow: "hidden",
-    userSelect: "none",
-    ...style
-  };
-  const displayName = profile?.displayName || "User";
-  if (loading) {
-    return /* @__PURE__ */ jsx5(
-      "div",
-      {
-        className,
-        style: { ...baseStyles, backgroundColor: "#E1E1E1" },
-        "aria-label": "Loading user avatar",
-        children: /* @__PURE__ */ jsx5("span", { style: { fontSize: `${size * 0.3}px` }, children: "..." })
-      }
-    );
-  }
-  if (photoUrl && !photoError) {
-    return /* @__PURE__ */ jsx5(
-      "div",
-      {
-        className,
-        style: baseStyles,
-        title: showTooltip ? displayName : void 0,
-        "aria-label": `${displayName} avatar`,
-        children: /* @__PURE__ */ jsx5(
-          "img",
-          {
-            src: photoUrl,
-            alt: displayName,
-            style: { width: "100%", height: "100%", objectFit: "cover" },
-            onError: () => {
-              setPhotoError(true);
-              if (fallbackImage) {
-                setPhotoUrl(fallbackImage);
-              }
-            }
-          }
-        )
-      }
-    );
-  }
-  return /* @__PURE__ */ jsx5(
-    "div",
-    {
-      className,
-      style: baseStyles,
-      title: showTooltip ? displayName : void 0,
-      "aria-label": `${displayName} avatar`,
-      children: getInitials()
-    }
-  );
-}
-
-// src/components/AuthStatus.tsx
-import { Fragment as Fragment2, jsx as jsx6, jsxs as jsxs3 } from "react/jsx-runtime";
-function AuthStatus({
-  className = "",
-  style,
-  showDetails = false,
-  renderLoading,
-  renderAuthenticated,
-  renderUnauthenticated
-}) {
-  const { isAuthenticated, inProgress, account } = useMsalAuth();
-  const baseStyles = {
-    display: "inline-flex",
-    alignItems: "center",
-    gap: "8px",
-    padding: "8px 12px",
-    borderRadius: "4px",
-    fontFamily: '"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',
-    fontSize: "14px",
-    fontWeight: 500,
-    ...style
-  };
-  if (inProgress) {
-    if (renderLoading) {
-      return /* @__PURE__ */ jsx6(Fragment2, { children: renderLoading() });
-    }
-    return /* @__PURE__ */ jsxs3(
-      "div",
-      {
-        className,
-        style: { ...baseStyles, backgroundColor: "#FFF4CE", color: "#8A6D3B" },
-        role: "status",
-        "aria-live": "polite",
-        children: [
-          /* @__PURE__ */ jsx6(StatusIndicator, { color: "#FFA500" }),
-          /* @__PURE__ */ jsx6("span", { children: "Loading..." })
-        ]
-      }
-    );
-  }
-  if (isAuthenticated) {
-    const username = account?.username || account?.name || "User";
-    if (renderAuthenticated) {
-      return /* @__PURE__ */ jsx6(Fragment2, { children: renderAuthenticated(username) });
-    }
-    return /* @__PURE__ */ jsxs3(
-      "div",
-      {
-        className,
-        style: { ...baseStyles, backgroundColor: "#D4EDDA", color: "#155724" },
-        role: "status",
-        "aria-live": "polite",
-        children: [
-          /* @__PURE__ */ jsx6(StatusIndicator, { color: "#28A745" }),
-          /* @__PURE__ */ jsx6("span", { children: showDetails ? `Authenticated as ${username}` : "Authenticated" })
-        ]
-      }
-    );
-  }
-  if (renderUnauthenticated) {
-    return /* @__PURE__ */ jsx6(Fragment2, { children: renderUnauthenticated() });
-  }
-  return /* @__PURE__ */ jsxs3(
-    "div",
-    {
-      className,
-      style: { ...baseStyles, backgroundColor: "#F8D7DA", color: "#721C24" },
-      role: "status",
-      "aria-live": "polite",
-      children: [
-        /* @__PURE__ */ jsx6(StatusIndicator, { color: "#DC3545" }),
-        /* @__PURE__ */ jsx6("span", { children: "Not authenticated" })
-      ]
-    }
-  );
-}
-function StatusIndicator({ color }) {
-  return /* @__PURE__ */ jsx6("svg", { width: "8", height: "8", viewBox: "0 0 8 8", fill: "none", xmlns: "http://www.w3.org/2000/svg", children: /* @__PURE__ */ jsx6("circle", { cx: "4", cy: "4", r: "4", fill: color }) });
-}
-
-// src/components/AuthGuard.tsx
-import { useEffect as useEffect4 } from "react";
-import { Fragment as Fragment3, jsx as jsx7 } from "react/jsx-runtime";
-function AuthGuard({
-  children,
-  loadingComponent,
-  fallbackComponent,
-  scopes,
-  onAuthRequired
-}) {
-  const { isAuthenticated, inProgress, loginRedirect } = useMsalAuth();
-  useEffect4(() => {
-    if (!isAuthenticated && !inProgress) {
-      onAuthRequired?.();
-      const login = async () => {
-        try {
-          await loginRedirect(scopes);
-        } catch (error) {
-          console.error("[AuthGuard] Authentication failed:", error);
-        }
-      };
-      login();
-    }
-  }, [isAuthenticated, inProgress, scopes, loginRedirect, onAuthRequired]);
-  if (inProgress) {
-    return /* @__PURE__ */ jsx7(Fragment3, { children: loadingComponent || /* @__PURE__ */ jsx7("div", { children: "Authenticating..." }) });
-  }
-  if (!isAuthenticated) {
-    return /* @__PURE__ */ jsx7(Fragment3, { children: fallbackComponent || /* @__PURE__ */ jsx7("div", { children: "Redirecting to login..." }) });
-  }
-  return /* @__PURE__ */ jsx7(Fragment3, { children });
-}
-
-// src/components/ErrorBoundary.tsx
-import { Component } from "react";
-import { jsx as jsx8, jsxs as jsxs4 } from "react/jsx-runtime";
-var ErrorBoundary = class extends Component {
-  constructor(props) {
-    super(props);
-    this.reset = () => {
-      this.setState({
-        hasError: false,
-        error: null
-      });
-    };
-    this.state = {
-      hasError: false,
-      error: null
-    };
-  }
-  static getDerivedStateFromError(error) {
-    return {
-      hasError: true,
-      error
-    };
-  }
-  componentDidCatch(error, errorInfo) {
-    const { onError, debug } = this.props;
-    if (debug) {
-      console.error("[ErrorBoundary] Caught error:", error);
-      console.error("[ErrorBoundary] Error info:", errorInfo);
-    }
-    onError?.(error, errorInfo);
-  }
-  render() {
-    const { hasError, error } = this.state;
-    const { children, fallback } = this.props;
-    if (hasError && error) {
-      if (fallback) {
-        return fallback(error, this.reset);
-      }
-      return /* @__PURE__ */ jsxs4(
-        "div",
-        {
-          style: {
-            padding: "20px",
-            margin: "20px",
-            border: "1px solid #DC3545",
-            borderRadius: "4px",
-            backgroundColor: "#F8D7DA",
-            color: "#721C24",
-            fontFamily: '"Segoe UI", Tahoma, Geneva, Verdana, sans-serif'
-          },
-          children: [
-            /* @__PURE__ */ jsx8("h2", { style: { margin: "0 0 10px 0", fontSize: "18px" }, children: "Authentication Error" }),
-            /* @__PURE__ */ jsx8("p", { style: { margin: "0 0 10px 0" }, children: error.message }),
-            /* @__PURE__ */ jsx8(
-              "button",
-              {
-                onClick: this.reset,
-                style: {
-                  padding: "8px 16px",
-                  backgroundColor: "#DC3545",
-                  color: "#FFFFFF",
-                  border: "none",
-                  borderRadius: "4px",
-                  cursor: "pointer",
-                  fontSize: "14px",
-                  fontWeight: 600
-                },
-                children: "Try Again"
-              }
-            )
-          ]
-        }
-      );
-    }
-    return children;
-  }
-};
-
-// src/hooks/useRoles.ts
-import { useState as useState5, useEffect as useEffect5, useCallback as useCallback4 } from "react";
-var rolesCache = /* @__PURE__ */ new Map();
-var CACHE_DURATION2 = 5 * 60 * 1e3;
-var MAX_CACHE_SIZE2 = 100;
-function clearRolesCache(accountId) {
-  if (accountId) {
-    rolesCache.delete(accountId);
-  } else {
-    rolesCache.clear();
-  }
-}
-function enforceCacheLimit2() {
-  if (rolesCache.size > MAX_CACHE_SIZE2) {
-    const entries = Array.from(rolesCache.entries());
-    entries.sort((a, b) => a[1].timestamp - b[1].timestamp);
-    const toRemove = entries.slice(0, rolesCache.size - MAX_CACHE_SIZE2);
-    toRemove.forEach(([key]) => rolesCache.delete(key));
-  }
-}
-function useRoles() {
-  const { isAuthenticated, account } = useMsalAuth();
-  const graph = useGraphApi();
-  const [roles, setRoles] = useState5([]);
-  const [groups, setGroups] = useState5([]);
-  const [loading, setLoading] = useState5(false);
-  const [error, setError] = useState5(null);
-  const fetchRolesAndGroups = useCallback4(async () => {
-    if (!isAuthenticated || !account) {
-      setRoles([]);
-      setGroups([]);
-      return;
-    }
-    const cacheKey = account.homeAccountId;
-    const cached = rolesCache.get(cacheKey);
-    if (cached && Date.now() - cached.timestamp < CACHE_DURATION2) {
-      setRoles(cached.roles);
-      setGroups(cached.groups);
-      return;
-    }
-    setLoading(true);
-    setError(null);
-    try {
-      const idTokenClaims = account.idTokenClaims;
-      const tokenRoles = idTokenClaims?.roles || [];
-      const groupsResponse = await graph.get("/me/memberOf", {
-        scopes: ["User.Read", "Directory.Read.All"]
-      });
-      const userGroups = groupsResponse.value.map((group) => group.id);
-      rolesCache.set(cacheKey, {
-        roles: tokenRoles,
-        groups: userGroups,
-        timestamp: Date.now()
-      });
-      enforceCacheLimit2();
-      setRoles(tokenRoles);
-      setGroups(userGroups);
-    } catch (err) {
-      const error2 = err;
-      const sanitizedMessage = sanitizeError(error2);
-      const sanitizedError = new Error(sanitizedMessage);
-      setError(sanitizedError);
-      console.error("[Roles] Failed to fetch roles/groups:", sanitizedMessage);
-      const idTokenClaims = account.idTokenClaims;
-      const tokenRoles = idTokenClaims?.roles || [];
-      setRoles(tokenRoles);
-    } finally {
-      setLoading(false);
-    }
-  }, [isAuthenticated, account, graph]);
-  const hasRole = useCallback4(
-    (role) => {
-      return roles.includes(role);
-    },
-    [roles]
-  );
-  const hasGroup = useCallback4(
-    (groupId) => {
-      return groups.includes(groupId);
-    },
-    [groups]
-  );
-  const hasAnyRole = useCallback4(
-    (checkRoles) => {
-      return checkRoles.some((role) => roles.includes(role));
-    },
-    [roles]
-  );
-  const hasAllRoles = useCallback4(
-    (checkRoles) => {
-      return checkRoles.every((role) => roles.includes(role));
-    },
-    [roles]
-  );
-  useEffect5(() => {
-    fetchRolesAndGroups();
-    return () => {
-      if (account) {
-        clearRolesCache(account.homeAccountId);
-      }
-    };
-  }, [fetchRolesAndGroups, account]);
-  return {
-    roles,
-    groups,
-    loading,
-    error,
-    hasRole,
-    hasGroup,
-    hasAnyRole,
-    hasAllRoles,
-    refetch: fetchRolesAndGroups
-  };
-}
-
-// src/utils/withAuth.tsx
-import { jsx as jsx9 } from "react/jsx-runtime";
-function withAuth(Component2, options = {}) {
-  const { displayName, ...guardProps } = options;
-  const WrappedComponent = (props) => {
-    return /* @__PURE__ */ jsx9(AuthGuard, { ...guardProps, children: /* @__PURE__ */ jsx9(Component2, { ...props }) });
-  };
-  WrappedComponent.displayName = displayName || `withAuth(${Component2.displayName || Component2.name || "Component"})`;
-  return WrappedComponent;
-}
-
-// src/utils/tokenRetry.ts
-async function retryWithBackoff(fn, config = {}) {
-  const {
-    maxRetries = 3,
-    initialDelay = 1e3,
-    maxDelay = 1e4,
-    backoffMultiplier = 2,
-    debug = false
-  } = config;
-  let lastError;
-  let delay = initialDelay;
-  for (let attempt = 0; attempt <= maxRetries; attempt++) {
-    try {
-      if (debug && attempt > 0) {
-        console.log(`[TokenRetry] Attempt ${attempt + 1}/${maxRetries + 1}`);
-      }
-      return await fn();
-    } catch (error) {
-      lastError = error;
-      if (attempt === maxRetries) {
-        if (debug) {
-          console.error("[TokenRetry] All retry attempts failed");
-        }
-        break;
-      }
-      if (!isRetryableError(error)) {
-        if (debug) {
-          console.log("[TokenRetry] Non-retryable error, aborting");
-        }
-        throw error;
-      }
-      if (debug) {
-        console.warn(`[TokenRetry] Attempt ${attempt + 1} failed, retrying in ${delay}ms...`);
-      }
-      await sleep(delay);
-      delay = Math.min(delay * backoffMultiplier, maxDelay);
-    }
-  }
-  throw lastError;
-}
-function isRetryableError(error) {
-  const message = error.message.toLowerCase();
-  if (message.includes("network") || message.includes("timeout") || message.includes("fetch") || message.includes("connection")) {
-    return true;
-  }
-  if (message.includes("500") || message.includes("502") || message.includes("503")) {
-    return true;
-  }
-  if (message.includes("429") || message.includes("rate limit")) {
-    return true;
-  }
-  if (message.includes("token") && message.includes("expired")) {
-    return true;
-  }
-  return false;
-}
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function createRetryWrapper(fn, config = {}) {
-  return (...args) => {
-    return retryWithBackoff(() => fn(...args), config);
-  };
-}
-
-// src/utils/debugLogger.ts
-var DebugLogger = class {
-  constructor(config = {}) {
-    this.logHistory = [];
-    this.performanceTimings = /* @__PURE__ */ new Map();
-    this.config = {
-      enabled: config.enabled ?? false,
-      prefix: config.prefix ?? "[MSAL-Next]",
-      showTimestamp: config.showTimestamp ?? true,
-      level: config.level ?? "info",
-      enablePerformance: config.enablePerformance ?? false,
-      enableNetworkLogs: config.enableNetworkLogs ?? false,
-      maxHistorySize: config.maxHistorySize ?? 100
-    };
-  }
-  shouldLog(level) {
-    if (!this.config.enabled) return false;
-    const levels = ["error", "warn", "info", "debug"];
-    const currentLevelIndex = levels.indexOf(this.config.level);
-    const messageLevelIndex = levels.indexOf(level);
-    return messageLevelIndex <= currentLevelIndex;
-  }
-  formatMessage(level, message, data) {
-    const timestamp = this.config.showTimestamp ? `[${(/* @__PURE__ */ new Date()).toISOString()}]` : "";
-    const prefix = this.config.prefix;
-    const levelStr = `[${level.toUpperCase()}]`;
-    let formatted = `${timestamp} ${prefix} ${levelStr} ${message}`;
-    if (data !== void 0) {
-      formatted += "\n" + JSON.stringify(data, null, 2);
-    }
-    return formatted;
-  }
-  addToHistory(level, message, data) {
-    if (this.logHistory.length >= this.config.maxHistorySize) {
-      this.logHistory.shift();
-    }
-    this.logHistory.push({
-      timestamp: Date.now(),
-      level,
-      message,
-      data
-    });
-  }
-  error(message, data) {
-    if (this.shouldLog("error")) {
-      console.error(this.formatMessage("error", message, data));
-      this.addToHistory("error", message, data);
-    }
-  }
-  warn(message, data) {
-    if (this.shouldLog("warn")) {
-      console.warn(this.formatMessage("warn", message, data));
-      this.addToHistory("warn", message, data);
-    }
-  }
-  info(message, data) {
-    if (this.shouldLog("info")) {
-      console.info(this.formatMessage("info", message, data));
-      this.addToHistory("info", message, data);
-    }
-  }
-  debug(message, data) {
-    if (this.shouldLog("debug")) {
-      console.debug(this.formatMessage("debug", message, data));
-      this.addToHistory("debug", message, data);
-    }
-  }
-  group(label) {
-    if (this.config.enabled) {
-      console.group(`${this.config.prefix} ${label}`);
-    }
-  }
-  groupEnd() {
-    if (this.config.enabled) {
-      console.groupEnd();
-    }
-  }
-  /**
-   * Start performance timing for an operation
-   */
-  startTiming(operation) {
-    if (this.config.enablePerformance) {
-      this.performanceTimings.set(operation, {
-        operation,
-        startTime: performance.now()
-      });
-      this.debug(`\u23F1\uFE0F Started: ${operation}`);
-    }
-  }
-  /**
-   * End performance timing for an operation
-   */
-  endTiming(operation) {
-    if (this.config.enablePerformance) {
-      const timing = this.performanceTimings.get(operation);
-      if (timing) {
-        timing.endTime = performance.now();
-        timing.duration = timing.endTime - timing.startTime;
-        this.info(`\u23F1\uFE0F Completed: ${operation} (${timing.duration.toFixed(2)}ms)`);
-        return timing.duration;
-      }
-    }
-    return void 0;
-  }
-  /**
-   * Log network request
-   */
-  logRequest(method, url, options) {
-    if (this.config.enableNetworkLogs) {
-      this.debug(`\u{1F310} ${method} ${url}`, options);
-    }
-  }
-  /**
-   * Log network response
-   */
-  logResponse(method, url, status, data) {
-    if (this.config.enableNetworkLogs) {
-      const statusEmoji = status >= 200 && status < 300 ? "\u2705" : "\u274C";
-      this.debug(`${statusEmoji} ${method} ${url} - ${status}`, data);
-    }
-  }
-  /**
-   * Get log history
-   */
-  getHistory() {
-    return [...this.logHistory];
-  }
-  /**
-   * Get performance timings
-   */
-  getPerformanceTimings() {
-    return Array.from(this.performanceTimings.values());
-  }
-  /**
-   * Clear log history
-   */
-  clearHistory() {
-    this.logHistory = [];
-  }
-  /**
-   * Clear performance timings
-   */
-  clearTimings() {
-    this.performanceTimings.clear();
-  }
-  /**
-   * Export logs as JSON
-   */
-  exportLogs() {
-    return JSON.stringify({
-      config: this.config,
-      history: this.logHistory,
-      performanceTimings: Array.from(this.performanceTimings.values()),
-      exportedAt: (/* @__PURE__ */ new Date()).toISOString()
-    }, null, 2);
-  }
-  /**
-   * Download logs as a file
-   */
-  downloadLogs(filename = "msal-next-debug-logs.json") {
-    if (typeof window === "undefined") return;
-    const logs = this.exportLogs();
-    const blob = new Blob([logs], { type: "application/json" });
-    const url = URL.createObjectURL(blob);
-    const a = document.createElement("a");
-    a.href = url;
-    a.download = filename;
-    a.click();
-    URL.revokeObjectURL(url);
-  }
-  setEnabled(enabled) {
-    this.config.enabled = enabled;
-  }
-  setLevel(level) {
-    if (level) {
-      this.config.level = level;
-    }
-  }
-};
-var globalLogger = null;
-function getDebugLogger(config) {
-  if (!globalLogger) {
-    globalLogger = new DebugLogger(config);
-  } else if (config) {
-    if (config.enabled !== void 0) {
-      globalLogger.setEnabled(config.enabled);
-    }
-    if (config.level) {
-      globalLogger.setLevel(config.level);
-    }
-  }
-  return globalLogger;
-}
-function createScopedLogger(scope, config) {
-  return new DebugLogger({
-    ...config,
-    prefix: `[MSAL-Next:${scope}]`
-  });
-}
-
-// src/middleware/createAuthMiddleware.ts
-import { NextResponse } from "next/server";
-function createAuthMiddleware(config = {}) {
-  const {
-    protectedRoutes = [],
-    publicOnlyRoutes = [],
-    loginPath = "/login",
-    redirectAfterLogin = "/",
-    sessionCookie = "msal.account",
-    isAuthenticated: customAuthCheck,
-    debug = false
-  } = config;
-  return async function authMiddleware(request) {
-    const { pathname } = request.nextUrl;
-    if (debug) {
-      console.log("[AuthMiddleware] Processing:", pathname);
-    }
-    let authenticated = false;
-    if (customAuthCheck) {
-      authenticated = await customAuthCheck(request);
-    } else {
-      const sessionData = request.cookies.get(sessionCookie);
-      authenticated = !!sessionData?.value;
-    }
-    if (debug) {
-      console.log("[AuthMiddleware] Authenticated:", authenticated);
-    }
-    const isProtectedRoute = protectedRoutes.some(
-      (route) => pathname.startsWith(route)
-    );
-    const isPublicOnlyRoute = publicOnlyRoutes.some(
-      (route) => pathname.startsWith(route)
-    );
-    if (isProtectedRoute && !authenticated) {
-      if (debug) {
-        console.log("[AuthMiddleware] Redirecting to login");
-      }
-      const url = request.nextUrl.clone();
-      url.pathname = loginPath;
-      url.searchParams.set("returnUrl", pathname);
-      return NextResponse.redirect(url);
-    }
-    if (isPublicOnlyRoute && authenticated) {
-      if (debug) {
-        console.log("[AuthMiddleware] Redirecting to home");
-      }
-      const returnUrl = request.nextUrl.searchParams.get("returnUrl");
-      const url = request.nextUrl.clone();
-      url.pathname = returnUrl || redirectAfterLogin;
-      url.searchParams.delete("returnUrl");
-      return NextResponse.redirect(url);
-    }
-    const response = NextResponse.next();
-    if (authenticated) {
-      response.headers.set("x-msal-authenticated", "true");
-      try {
-        const sessionData = request.cookies.get(sessionCookie);
-        if (sessionData?.value) {
-          const account = safeJsonParse(sessionData.value, isValidAccountData);
-          if (account?.username) {
-            response.headers.set("x-msal-username", account.username);
-          }
-        }
-      } catch (error) {
-        if (debug) {
-          console.warn("[AuthMiddleware] Failed to parse session data");
-        }
-      }
-    }
-    return response;
-  };
-}
-
-// src/client.ts
-import { useMsal as useMsal2, useIsAuthenticated, useAccount as useAccount2 } from "@azure/msal-react";
-export {
-  AuthGuard,
-  AuthStatus,
-  ErrorBoundary,
-  MSALProvider,
-  MicrosoftSignInButton,
-  MsalAuthProvider,
-  SignOutButton,
-  UserAvatar,
-  createAuthMiddleware,
-  createMsalConfig,
-  createRetryWrapper,
-  createScopedLogger,
-  getDebugLogger,
-  getMsalInstance,
-  isValidAccountData,
-  isValidRedirectUri,
-  isValidScope,
-  retryWithBackoff,
-  safeJsonParse,
-  sanitizeError,
-  useAccount2 as useAccount,
-  useGraphApi,
-  useIsAuthenticated,
-  useMsal2 as useMsal,
-  useMsalAuth,
-  useRoles,
-  useUserProfile,
-  validateScopes,
-  withAuth
-};
+import {MsalProvider,useMsal,useAccount}from'@azure/msal-react';export{useAccount,useIsAuthenticated,useMsal}from'@azure/msal-react';import {LogLevel,PublicClientApplication,EventType,InteractionStatus}from'@azure/msal-browser';import {useState,useRef,useEffect,useMemo,useCallback,Component}from'react';import {jsx,Fragment,jsxs}from'react/jsx-runtime';import {NextResponse}from'next/server';function q(r,e){try{let t=JSON.parse(r);return e(t)?t:(console.warn("[Validation] JSON validation failed"),null)}catch(t){return console.error("[Validation] JSON parse error:",t),null}}function _(r){return typeof r=="object"&&r!==null&&typeof r.homeAccountId=="string"&&r.homeAccountId.length>0&&typeof r.username=="string"&&r.username.length>0&&(r.name===void 0||typeof r.name=="string")}function v(r){return r instanceof Error?r.message.replace(/[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g,"[TOKEN_REDACTED]").replace(/[a-f0-9]{32,}/gi,"[SECRET_REDACTED]").replace(/Bearer\s+[^\s]+/gi,"Bearer [REDACTED]"):"An unexpected error occurred"}function G(r,e){try{let t=new URL(r);return e.some(o=>{let i=new URL(o);return t.origin===i.origin})}catch{return  false}}function ne(r){return /^[a-zA-Z0-9._-]+$/.test(r)}function Ae(r){return Array.isArray(r)&&r.every(ne)}function H(r){if(r.msalConfig)return r.msalConfig;let{clientId:e,tenantId:t,authorityType:o="common",redirectUri:i,postLogoutRedirectUri:a,cacheLocation:p="sessionStorage",storeAuthStateInCookie:u=false,navigateToLoginRequestUrl:c=false,enableLogging:n=false,loggerCallback:h,allowedRedirectUris:g}=r;if(!e)throw new Error("@chemmangat/msal-next: clientId is required");let l=()=>{if(o==="tenant"){if(!t)throw new Error('@chemmangat/msal-next: tenantId is required when authorityType is "tenant"');return `https://login.microsoftonline.com/${t}`}return `https://login.microsoftonline.com/${o}`},s=typeof window<"u"?window.location.origin:"http://localhost:3000",m=i||s;if(g&&g.length>0){if(!G(m,g))throw new Error(`@chemmangat/msal-next: redirectUri "${m}" is not in the allowed list`);let d=a||m;if(!G(d,g))throw new Error(`@chemmangat/msal-next: postLogoutRedirectUri "${d}" is not in the allowed list`)}return {auth:{clientId:e,authority:l(),redirectUri:m,postLogoutRedirectUri:a||m,navigateToLoginRequestUrl:c},cache:{cacheLocation:p,storeAuthStateInCookie:u},system:{loggerOptions:{loggerCallback:h||((d,y,R)=>{if(!(R||!n))switch(d){case LogLevel.Error:console.error("[MSAL]",y);break;case LogLevel.Warning:console.warn("[MSAL]",y);break;case LogLevel.Info:console.info("[MSAL]",y);break;case LogLevel.Verbose:console.debug("[MSAL]",y);break}}),logLevel:n?LogLevel.Verbose:LogLevel.Error}}}}var se=null;function Pe(){return se}function V({children:r,loadingComponent:e,onInitialized:t,...o}){let[i,a]=useState(null),p=useRef(null);return useEffect(()=>{if(typeof window>"u"||p.current)return;(async()=>{try{let c=H(o),n=new PublicClientApplication(c);await n.initialize();try{let l=await n.handleRedirectPromise();l&&(o.enableLogging&&console.log("[MSAL] Redirect authentication successful"),l.account&&n.setActiveAccount(l.account),window.location.hash&&window.history.replaceState(null,"",window.location.pathname+window.location.search));}catch(l){l?.errorCode==="no_token_request_cache_error"?o.enableLogging&&console.log("[MSAL] No pending redirect found (this is normal)"):l?.errorCode==="user_cancelled"?o.enableLogging&&console.log("[MSAL] User cancelled authentication"):console.error("[MSAL] Redirect handling error:",l),window.location.hash&&(window.location.hash.includes("code=")||window.location.hash.includes("error="))&&window.history.replaceState(null,"",window.location.pathname+window.location.search);}let h=n.getAllAccounts();h.length>0&&!n.getActiveAccount()&&n.setActiveAccount(h[0]);let g=o.enableLogging||!1;n.addEventCallback(l=>{if(l.eventType===EventType.LOGIN_SUCCESS){let s=l.payload;s?.account&&n.setActiveAccount(s.account),g&&console.log("[MSAL] Login successful:",s.account?.username);}if(l.eventType===EventType.LOGIN_FAILURE&&console.error("[MSAL] Login failed:",l.error),l.eventType===EventType.LOGOUT_SUCCESS&&(n.setActiveAccount(null),g&&console.log("[MSAL] Logout successful")),l.eventType===EventType.ACQUIRE_TOKEN_SUCCESS){let s=l.payload;s?.account&&!n.getActiveAccount()&&n.setActiveAccount(s.account);}l.eventType===EventType.ACQUIRE_TOKEN_FAILURE&&g&&console.error("[MSAL] Token acquisition failed:",l.error);}),p.current=n,se=n,a(n),t&&t(n);}catch(c){throw console.error("[MSAL] Initialization failed:",c),c}})();},[]),typeof window>"u"?jsx(Fragment,{children:e||jsx("div",{children:"Loading authentication..."})}):i?jsx(MsalProvider,{instance:i,children:r}):jsx(Fragment,{children:e||jsx("div",{children:"Loading authentication..."})})}function Se({children:r,...e}){return jsx(V,{...e,children:r})}var W=new Map;function A(r=["User.Read"]){let{instance:e,accounts:t,inProgress:o}=useMsal(),i=useAccount(t[0]||null),a=useMemo(()=>t.length>0,[t]),p=useCallback(async(l=r)=>{if(o!==InteractionStatus.None){console.warn("[MSAL] Interaction already in progress");return}try{let s={scopes:l,prompt:"select_account"};await e.loginRedirect(s);}catch(s){if(s?.errorCode==="user_cancelled"){console.log("[MSAL] User cancelled login");return}throw console.error("[MSAL] Login redirect failed:",s),s}},[e,r,o]),u=useCallback(async()=>{try{await e.logoutRedirect({account:i||void 0});}catch(l){throw console.error("[MSAL] Logout redirect failed:",l),l}},[e,i]),c=useCallback(async(l=r)=>{if(!i)throw new Error("[MSAL] No active account. Please login first.");try{let s={scopes:l,account:i,forceRefresh:!1};return (await e.acquireTokenSilent(s)).accessToken}catch(s){throw console.error("[MSAL] Silent token acquisition failed:",s),s}},[e,i,r]),n=useCallback(async(l=r)=>{if(!i)throw new Error("[MSAL] No active account. Please login first.");try{let s={scopes:l,account:i};await e.acquireTokenRedirect(s);}catch(s){throw console.error("[MSAL] Token redirect acquisition failed:",s),s}},[e,i,r]),h=useCallback(async(l=r)=>{let s=`${i?.homeAccountId||"anonymous"}-${l.sort().join(",")}`,m=W.get(s);if(m)return m;let f=(async()=>{try{return await c(l)}catch{throw console.warn("[MSAL] Silent token acquisition failed, falling back to redirect"),await n(l),new Error("[MSAL] Redirecting for token acquisition")}finally{W.delete(s);}})();return W.set(s,f),f},[c,n,r,i]),g=useCallback(async()=>{e.setActiveAccount(null),await e.clearCache();},[e]);return {account:i,accounts:t,isAuthenticated:a,inProgress:o!==InteractionStatus.None,loginRedirect:p,logoutRedirect:u,acquireToken:h,acquireTokenSilent:c,acquireTokenRedirect:n,clearSession:g}}function Ue({text:r="Sign in with Microsoft",variant:e="dark",size:t="medium",scopes:o,className:i="",style:a,onSuccess:p,onError:u}){let{loginRedirect:c,inProgress:n}=A(),[h,g]=useState(false),l=async()=>{g(true);try{await c(o),p?.();}catch(y){u?.(y);}finally{setTimeout(()=>g(false),500);}},s={small:{padding:"8px 16px",fontSize:"14px",height:"36px"},medium:{padding:"10px 20px",fontSize:"15px",height:"41px"},large:{padding:"12px 24px",fontSize:"16px",height:"48px"}},m={dark:{backgroundColor:"#2F2F2F",color:"#FFFFFF",border:"1px solid #8C8C8C"},light:{backgroundColor:"#FFFFFF",color:"#5E5E5E",border:"1px solid #8C8C8C"}},f=n||h,d={display:"inline-flex",alignItems:"center",justifyContent:"center",gap:"12px",fontFamily:'"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',fontWeight:600,borderRadius:"2px",cursor:f?"not-allowed":"pointer",transition:"all 0.2s ease",opacity:f?.6:1,...m[e],...s[t],...a};return jsxs("button",{onClick:l,disabled:f,className:i,style:d,"aria-label":r,children:[jsx(ke,{}),jsx("span",{children:r})]})}function ke(){return jsxs("svg",{width:"21",height:"21",viewBox:"0 0 21 21",fill:"none",xmlns:"http://www.w3.org/2000/svg",children:[jsx("rect",{width:"10",height:"10",fill:"#F25022"}),jsx("rect",{x:"11",width:"10",height:"10",fill:"#7FBA00"}),jsx("rect",{y:"11",width:"10",height:"10",fill:"#00A4EF"}),jsx("rect",{x:"11",y:"11",width:"10",height:"10",fill:"#FFB900"})]})}function Fe({text:r="Sign out",variant:e="dark",size:t="medium",className:o="",style:i,onSuccess:a,onError:p}){let{logoutRedirect:u,inProgress:c}=A(),n=async()=>{try{await u(),a?.();}catch(s){p?.(s);}},h={small:{padding:"8px 16px",fontSize:"14px",height:"36px"},medium:{padding:"10px 20px",fontSize:"15px",height:"41px"},large:{padding:"12px 24px",fontSize:"16px",height:"48px"}},l={display:"inline-flex",alignItems:"center",justifyContent:"center",gap:"12px",fontFamily:'"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',fontWeight:600,borderRadius:"2px",cursor:c?"not-allowed":"pointer",transition:"all 0.2s ease",opacity:c?.6:1,...{dark:{backgroundColor:"#2F2F2F",color:"#FFFFFF",border:"1px solid #8C8C8C"},light:{backgroundColor:"#FFFFFF",color:"#5E5E5E",border:"1px solid #8C8C8C"}}[e],...h[t],...i};return jsxs("button",{onClick:n,disabled:c,className:o,style:l,"aria-label":r,children:[jsx(Ne,{}),jsx("span",{children:r})]})}function Ne(){return jsxs("svg",{width:"21",height:"21",viewBox:"0 0 21 21",fill:"none",xmlns:"http://www.w3.org/2000/svg",children:[jsx("rect",{width:"10",height:"10",fill:"#F25022"}),jsx("rect",{x:"11",width:"10",height:"10",fill:"#7FBA00"}),jsx("rect",{y:"11",width:"10",height:"10",fill:"#00A4EF"}),jsx("rect",{x:"11",y:"11",width:"10",height:"10",fill:"#FFB900"})]})}function k(){let{acquireToken:r}=A(),e=useCallback(async(u,c={})=>{let{scopes:n=["User.Read"],version:h="v1.0",debug:g=false,...l}=c;try{let s=await r(n),m=`https://graph.microsoft.com/${h}`,f=u.startsWith("http")?u:`${m}${u.startsWith("/")?u:`/${u}`}`;g&&console.log("[GraphAPI] Request:",{url:f,method:l.method||"GET"});let d=await fetch(f,{...l,headers:{Authorization:`Bearer ${s}`,"Content-Type":"application/json",...l.headers}});if(!d.ok){let R=await d.text(),L=`Graph API error (${d.status}): ${R}`;throw new Error(L)}if(d.status===204||d.headers.get("content-length")==="0")return null;let y=await d.json();return g&&console.log("[GraphAPI] Response:",y),y}catch(s){let m=v(s);throw console.error("[GraphAPI] Request failed:",m),new Error(m)}},[r]),t=useCallback((u,c={})=>e(u,{...c,method:"GET"}),[e]),o=useCallback((u,c,n={})=>e(u,{...n,method:"POST",body:c?JSON.stringify(c):void 0}),[e]),i=useCallback((u,c,n={})=>e(u,{...n,method:"PUT",body:c?JSON.stringify(c):void 0}),[e]),a=useCallback((u,c,n={})=>e(u,{...n,method:"PATCH",body:c?JSON.stringify(c):void 0}),[e]),p=useCallback((u,c={})=>e(u,{...c,method:"DELETE"}),[e]);return {get:t,post:o,put:i,patch:a,delete:p,request:e}}var x=new Map,Ie=300*1e3,pe=100;function Oe(){if(x.size>pe){let r=Array.from(x.entries());r.sort((t,o)=>t[1].timestamp-o[1].timestamp),r.slice(0,x.size-pe).forEach(([t])=>{let o=x.get(t);o?.data.photo&&URL.revokeObjectURL(o.data.photo),x.delete(t);});}}function J(){let{isAuthenticated:r,account:e}=A(),t=k(),[o,i]=useState(null),[a,p]=useState(false),[u,c]=useState(null),n=useCallback(async()=>{if(!r||!e){i(null);return}let g=e.homeAccountId,l=x.get(g);if(l&&Date.now()-l.timestamp<Ie){i(l.data);return}p(true),c(null);try{let s=await t.get("/me",{scopes:["User.Read"]}),m;try{let d=await t.get("/me/photo/$value",{scopes:["User.Read"],headers:{"Content-Type":"image/jpeg"}});d&&(m=URL.createObjectURL(d));}catch{console.debug("[UserProfile] Photo not available");}let f={id:s.id,displayName:s.displayName,givenName:s.givenName,surname:s.surname,userPrincipalName:s.userPrincipalName,mail:s.mail,jobTitle:s.jobTitle,officeLocation:s.officeLocation,mobilePhone:s.mobilePhone,businessPhones:s.businessPhones,photo:m};x.set(g,{data:f,timestamp:Date.now()}),Oe(),i(f);}catch(s){let f=v(s),d=new Error(f);c(d),console.error("[UserProfile] Failed to fetch profile:",f);}finally{p(false);}},[r,e,t]),h=useCallback(()=>{if(e){let g=x.get(e.homeAccountId);g?.data.photo&&URL.revokeObjectURL(g.data.photo),x.delete(e.homeAccountId);}o?.photo&&URL.revokeObjectURL(o.photo),i(null);},[e,o]);return useEffect(()=>(n(),()=>{o?.photo&&URL.revokeObjectURL(o.photo);}),[n]),useEffect(()=>()=>{o?.photo&&URL.revokeObjectURL(o.photo);},[o?.photo]),{profile:o,loading:a,error:u,refetch:n,clearCache:h}}function Ge({size:r=40,className:e="",style:t,showTooltip:o=true,fallbackImage:i}){let{profile:a,loading:p}=J(),[u,c]=useState(null),[n,h]=useState(false);useEffect(()=>{a?.photo&&c(a.photo);},[a?.photo]);let g=()=>{if(!a)return "?";let{givenName:m,surname:f,displayName:d}=a;if(m&&f)return `${m[0]}${f[0]}`.toUpperCase();if(d){let y=d.split(" ");return y.length>=2?`${y[0][0]}${y[y.length-1][0]}`.toUpperCase():d.substring(0,2).toUpperCase()}return "?"},l={width:`${r}px`,height:`${r}px`,borderRadius:"50%",display:"inline-flex",alignItems:"center",justifyContent:"center",fontSize:`${r*.4}px`,fontWeight:600,fontFamily:'"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',backgroundColor:"#0078D4",color:"#FFFFFF",overflow:"hidden",userSelect:"none",...t},s=a?.displayName||"User";return p?jsx("div",{className:e,style:{...l,backgroundColor:"#E1E1E1"},"aria-label":"Loading user avatar",children:jsx("span",{style:{fontSize:`${r*.3}px`},children:"..."})}):u&&!n?jsx("div",{className:e,style:l,title:o?s:void 0,"aria-label":`${s} avatar`,children:jsx("img",{src:u,alt:s,style:{width:"100%",height:"100%",objectFit:"cover"},onError:()=>{h(true),i&&c(i);}})}):jsx("div",{className:e,style:l,title:o?s:void 0,"aria-label":`${s} avatar`,children:g()})}function $e({className:r="",style:e,showDetails:t=false,renderLoading:o,renderAuthenticated:i,renderUnauthenticated:a}){let{isAuthenticated:p,inProgress:u,account:c}=A(),n={display:"inline-flex",alignItems:"center",gap:"8px",padding:"8px 12px",borderRadius:"4px",fontFamily:'"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',fontSize:"14px",fontWeight:500,...e};if(u)return o?jsx(Fragment,{children:o()}):jsxs("div",{className:r,style:{...n,backgroundColor:"#FFF4CE",color:"#8A6D3B"},role:"status","aria-live":"polite",children:[jsx(K,{color:"#FFA500"}),jsx("span",{children:"Loading..."})]});if(p){let h=c?.username||c?.name||"User";return i?jsx(Fragment,{children:i(h)}):jsxs("div",{className:r,style:{...n,backgroundColor:"#D4EDDA",color:"#155724"},role:"status","aria-live":"polite",children:[jsx(K,{color:"#28A745"}),jsx("span",{children:t?`Authenticated as ${h}`:"Authenticated"})]})}return a?jsx(Fragment,{children:a()}):jsxs("div",{className:r,style:{...n,backgroundColor:"#F8D7DA",color:"#721C24"},role:"status","aria-live":"polite",children:[jsx(K,{color:"#DC3545"}),jsx("span",{children:"Not authenticated"})]})}function K({color:r}){return jsx("svg",{width:"8",height:"8",viewBox:"0 0 8 8",fill:"none",xmlns:"http://www.w3.org/2000/svg",children:jsx("circle",{cx:"4",cy:"4",r:"4",fill:r})})}function Y({children:r,loadingComponent:e,fallbackComponent:t,scopes:o,onAuthRequired:i}){let{isAuthenticated:a,inProgress:p,loginRedirect:u}=A();return useEffect(()=>{!a&&!p&&(i?.(),(async()=>{try{await u(o);}catch(n){console.error("[AuthGuard] Authentication failed:",n);}})());},[a,p,o,u,i]),p?jsx(Fragment,{children:e||jsx("div",{children:"Authenticating..."})}):a?jsx(Fragment,{children:r}):jsx(Fragment,{children:t||jsx("div",{children:"Redirecting to login..."})})}var re=class extends Component{constructor(t){super(t);this.reset=()=>{this.setState({hasError:false,error:null});};this.state={hasError:false,error:null};}static getDerivedStateFromError(t){return {hasError:true,error:t}}componentDidCatch(t,o){let{onError:i,debug:a}=this.props;a&&(console.error("[ErrorBoundary] Caught error:",t),console.error("[ErrorBoundary] Error info:",o)),i?.(t,o);}render(){let{hasError:t,error:o}=this.state,{children:i,fallback:a}=this.props;return t&&o?a?a(o,this.reset):jsxs("div",{style:{padding:"20px",margin:"20px",border:"1px solid #DC3545",borderRadius:"4px",backgroundColor:"#F8D7DA",color:"#721C24",fontFamily:'"Segoe UI", Tahoma, Geneva, Verdana, sans-serif'},children:[jsx("h2",{style:{margin:"0 0 10px 0",fontSize:"18px"},children:"Authentication Error"}),jsx("p",{style:{margin:"0 0 10px 0"},children:o.message}),jsx("button",{onClick:this.reset,style:{padding:"8px 16px",backgroundColor:"#DC3545",color:"#FFFFFF",border:"none",borderRadius:"4px",cursor:"pointer",fontSize:"14px",fontWeight:600},children:"Try Again"})]}):i}};var w=new Map,He=300*1e3,fe=100;function Ve(r){r?w.delete(r):w.clear();}function We(){if(w.size>fe){let r=Array.from(w.entries());r.sort((t,o)=>t[1].timestamp-o[1].timestamp),r.slice(0,w.size-fe).forEach(([t])=>w.delete(t));}}function je(){let{isAuthenticated:r,account:e}=A(),t=k(),[o,i]=useState([]),[a,p]=useState([]),[u,c]=useState(false),[n,h]=useState(null),g=useCallback(async()=>{if(!r||!e){i([]),p([]);return}let d=e.homeAccountId,y=w.get(d);if(y&&Date.now()-y.timestamp<He){i(y.roles),p(y.groups);return}c(true),h(null);try{let L=e.idTokenClaims?.roles||[],D=(await t.get("/me/memberOf",{scopes:["User.Read","Directory.Read.All"]})).value.map(oe=>oe.id);w.set(d,{roles:L,groups:D,timestamp:Date.now()}),We(),i(L),p(D);}catch(R){let B=v(R),D=new Error(B);h(D),console.error("[Roles] Failed to fetch roles/groups:",B);let ye=e.idTokenClaims?.roles||[];i(ye);}finally{c(false);}},[r,e,t]),l=useCallback(d=>o.includes(d),[o]),s=useCallback(d=>a.includes(d),[a]),m=useCallback(d=>d.some(y=>o.includes(y)),[o]),f=useCallback(d=>d.every(y=>o.includes(y)),[o]);return useEffect(()=>(g(),()=>{e&&Ve(e.homeAccountId);}),[g,e]),{roles:o,groups:a,loading:u,error:n,hasRole:l,hasGroup:s,hasAnyRole:m,hasAllRoles:f,refetch:g}}function Je(r,e={}){let{displayName:t,...o}=e,i=a=>jsx(Y,{...o,children:jsx(r,{...a})});return i.displayName=t||`withAuth(${r.displayName||r.name||"Component"})`,i}async function me(r,e={}){let{maxRetries:t=3,initialDelay:o=1e3,maxDelay:i=1e4,backoffMultiplier:a=2,debug:p=false}=e,u,c=o;for(let n=0;n<=t;n++)try{return p&&n>0&&console.log(`[TokenRetry] Attempt ${n+1}/${t+1}`),await r()}catch(h){if(u=h,n===t){p&&console.error("[TokenRetry] All retry attempts failed");break}if(!Ke(h))throw p&&console.log("[TokenRetry] Non-retryable error, aborting"),h;p&&console.warn(`[TokenRetry] Attempt ${n+1} failed, retrying in ${c}ms...`),await Ze(c),c=Math.min(c*a,i);}throw u}function Ke(r){let e=r.message.toLowerCase();return !!(e.includes("network")||e.includes("timeout")||e.includes("fetch")||e.includes("connection")||e.includes("500")||e.includes("502")||e.includes("503")||e.includes("429")||e.includes("rate limit")||e.includes("token")&&e.includes("expired"))}function Ze(r){return new Promise(e=>setTimeout(e,r))}function Qe(r,e={}){return (...t)=>me(()=>r(...t),e)}var z=class{constructor(e={}){this.logHistory=[];this.performanceTimings=new Map;this.config={enabled:e.enabled??false,prefix:e.prefix??"[MSAL-Next]",showTimestamp:e.showTimestamp??true,level:e.level??"info",enablePerformance:e.enablePerformance??false,enableNetworkLogs:e.enableNetworkLogs??false,maxHistorySize:e.maxHistorySize??100};}shouldLog(e){if(!this.config.enabled)return  false;let t=["error","warn","info","debug"],o=t.indexOf(this.config.level);return t.indexOf(e)<=o}formatMessage(e,t,o){let i=this.config.showTimestamp?`[${new Date().toISOString()}]`:"",a=this.config.prefix,p=`[${e.toUpperCase()}]`,u=`${i} ${a} ${p} ${t}`;return o!==void 0&&(u+=`
+`+JSON.stringify(o,null,2)),u}addToHistory(e,t,o){this.logHistory.length>=this.config.maxHistorySize&&this.logHistory.shift(),this.logHistory.push({timestamp:Date.now(),level:e,message:t,data:o});}error(e,t){this.shouldLog("error")&&(console.error(this.formatMessage("error",e,t)),this.addToHistory("error",e,t));}warn(e,t){this.shouldLog("warn")&&(console.warn(this.formatMessage("warn",e,t)),this.addToHistory("warn",e,t));}info(e,t){this.shouldLog("info")&&(console.info(this.formatMessage("info",e,t)),this.addToHistory("info",e,t));}debug(e,t){this.shouldLog("debug")&&(console.debug(this.formatMessage("debug",e,t)),this.addToHistory("debug",e,t));}group(e){this.config.enabled&&console.group(`${this.config.prefix} ${e}`);}groupEnd(){this.config.enabled&&console.groupEnd();}startTiming(e){this.config.enablePerformance&&(this.performanceTimings.set(e,{operation:e,startTime:performance.now()}),this.debug(`\u23F1\uFE0F Started: ${e}`));}endTiming(e){if(this.config.enablePerformance){let t=this.performanceTimings.get(e);if(t)return t.endTime=performance.now(),t.duration=t.endTime-t.startTime,this.info(`\u23F1\uFE0F Completed: ${e} (${t.duration.toFixed(2)}ms)`),t.duration}}logRequest(e,t,o){this.config.enableNetworkLogs&&this.debug(`\u{1F310} ${e} ${t}`,o);}logResponse(e,t,o,i){if(this.config.enableNetworkLogs){let a=o>=200&&o<300?"\u2705":"\u274C";this.debug(`${a} ${e} ${t} - ${o}`,i);}}getHistory(){return [...this.logHistory]}getPerformanceTimings(){return Array.from(this.performanceTimings.values())}clearHistory(){this.logHistory=[];}clearTimings(){this.performanceTimings.clear();}exportLogs(){return JSON.stringify({config:this.config,history:this.logHistory,performanceTimings:Array.from(this.performanceTimings.values()),exportedAt:new Date().toISOString()},null,2)}downloadLogs(e="msal-next-debug-logs.json"){if(typeof window>"u")return;let t=this.exportLogs(),o=new Blob([t],{type:"application/json"}),i=URL.createObjectURL(o),a=document.createElement("a");a.href=i,a.download=e,a.click(),URL.revokeObjectURL(i);}setEnabled(e){this.config.enabled=e;}setLevel(e){e&&(this.config.level=e);}},O=null;function Xe(r){return O?r&&(r.enabled!==void 0&&O.setEnabled(r.enabled),r.level&&O.setLevel(r.level)):O=new z(r),O}function Ye(r,e){return new z({...e,prefix:`[MSAL-Next:${r}]`})}function er(r={}){let{protectedRoutes:e=[],publicOnlyRoutes:t=[],loginPath:o="/login",redirectAfterLogin:i="/",sessionCookie:a="msal.account",isAuthenticated:p,debug:u=false}=r;return async function(n){let{pathname:h}=n.nextUrl;u&&console.log("[AuthMiddleware] Processing:",h);let g=false;p?g=await p(n):g=!!n.cookies.get(a)?.value,u&&console.log("[AuthMiddleware] Authenticated:",g);let l=e.some(f=>h.startsWith(f)),s=t.some(f=>h.startsWith(f));if(l&&!g){u&&console.log("[AuthMiddleware] Redirecting to login");let f=n.nextUrl.clone();return f.pathname=o,f.searchParams.set("returnUrl",h),NextResponse.redirect(f)}if(s&&g){u&&console.log("[AuthMiddleware] Redirecting to home");let f=n.nextUrl.searchParams.get("returnUrl"),d=n.nextUrl.clone();return d.pathname=f||i,d.searchParams.delete("returnUrl"),NextResponse.redirect(d)}let m=NextResponse.next();if(g){m.headers.set("x-msal-authenticated","true");try{let f=n.cookies.get(a);if(f?.value){let d=q(f.value,_);d?.username&&m.headers.set("x-msal-username",d.username);}}catch{u&&console.warn("[AuthMiddleware] Failed to parse session data");}}return m}}export{Y as AuthGuard,$e as AuthStatus,re as ErrorBoundary,Se as MSALProvider,Ue as MicrosoftSignInButton,V as MsalAuthProvider,Fe as SignOutButton,Ge as UserAvatar,er as createAuthMiddleware,H as createMsalConfig,Qe as createRetryWrapper,Ye as createScopedLogger,Xe as getDebugLogger,Pe as getMsalInstance,_ as isValidAccountData,G as isValidRedirectUri,ne as isValidScope,me as retryWithBackoff,q as safeJsonParse,v as sanitizeError,k as useGraphApi,A as useMsalAuth,je as useRoles,J as useUserProfile,Ae as validateScopes,Je as withAuth};