@chemmangat/msal-next 4.0.1 → 4.1.0

package/dist/index.js

@@ -1,2 +1,2382 @@
-'use strict';var msalReact=require('@azure/msal-react'),msalBrowser=require('@azure/msal-browser'),react=require('react'),jsxRuntime=require('react/jsx-runtime'),navigation=require('next/navigation'),server=require('next/server');function H(r,e){try{let t=JSON.parse(r);return e(t)?t:(console.warn("[Validation] JSON validation failed"),null)}catch(t){return console.error("[Validation] JSON parse error:",t),null}}function W(r){return typeof r=="object"&&r!==null&&typeof r.homeAccountId=="string"&&r.homeAccountId.length>0&&typeof r.username=="string"&&r.username.length>0&&(r.name===void 0||typeof r.name=="string")}function w(r){return r instanceof Error?r.message.replace(/[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g,"[TOKEN_REDACTED]").replace(/[a-f0-9]{32,}/gi,"[SECRET_REDACTED]").replace(/Bearer\s+[^\s]+/gi,"Bearer [REDACTED]"):"An unexpected error occurred"}function z(r,e){try{let t=new URL(r);return e.some(o=>{let i=new URL(o);return t.origin===i.origin})}catch{return  false}}function ae(r){return /^[a-zA-Z0-9._-]+$/.test(r)}function Ce(r){return Array.isArray(r)&&r.every(ae)}function j(r){if(r.msalConfig)return r.msalConfig;let{clientId:e,tenantId:t,authorityType:o="common",redirectUri:i,postLogoutRedirectUri:a,cacheLocation:g="sessionStorage",storeAuthStateInCookie:u=false,navigateToLoginRequestUrl:l=false,enableLogging:n=false,loggerCallback:h,allowedRedirectUris:f}=r;if(!e)throw new Error("@chemmangat/msal-next: clientId is required");let c=()=>{if(o==="tenant"){if(!t)throw new Error('@chemmangat/msal-next: tenantId is required when authorityType is "tenant"');return `https://login.microsoftonline.com/${t}`}return `https://login.microsoftonline.com/${o}`},s=typeof window<"u"?window.location.origin:"http://localhost:3000",m=i||s;if(f&&f.length>0){if(!z(m,f))throw new Error(`@chemmangat/msal-next: redirectUri "${m}" is not in the allowed list`);let d=a||m;if(!z(d,f))throw new Error(`@chemmangat/msal-next: postLogoutRedirectUri "${d}" is not in the allowed list`)}return {auth:{clientId:e,authority:c(),redirectUri:m,postLogoutRedirectUri:a||m,navigateToLoginRequestUrl:l},cache:{cacheLocation:g,storeAuthStateInCookie:u},system:{loggerOptions:{loggerCallback:h||((d,y,R)=>{if(!(R||!n))switch(d){case msalBrowser.LogLevel.Error:console.error("[MSAL]",y);break;case msalBrowser.LogLevel.Warning:console.warn("[MSAL]",y);break;case msalBrowser.LogLevel.Info:console.info("[MSAL]",y);break;case msalBrowser.LogLevel.Verbose:console.debug("[MSAL]",y);break}}),logLevel:n?msalBrowser.LogLevel.Verbose:msalBrowser.LogLevel.Error}}}}var ce=null;function Ue(){return ce}function J({children:r,loadingComponent:e,onInitialized:t,...o}){let[i,a]=react.useState(null),g=react.useRef(null);return react.useEffect(()=>{if(typeof window>"u"||g.current)return;(async()=>{try{let l=j(o),n=new msalBrowser.PublicClientApplication(l);await n.initialize();try{let c=await n.handleRedirectPromise();c&&(o.enableLogging&&console.log("[MSAL] Redirect authentication successful"),c.account&&n.setActiveAccount(c.account),window.location.hash&&window.history.replaceState(null,"",window.location.pathname+window.location.search));}catch(c){c?.errorCode==="no_token_request_cache_error"?o.enableLogging&&console.log("[MSAL] No pending redirect found (this is normal)"):c?.errorCode==="user_cancelled"?o.enableLogging&&console.log("[MSAL] User cancelled authentication"):console.error("[MSAL] Redirect handling error:",c),window.location.hash&&(window.location.hash.includes("code=")||window.location.hash.includes("error="))&&window.history.replaceState(null,"",window.location.pathname+window.location.search);}let h=n.getAllAccounts();h.length>0&&!n.getActiveAccount()&&n.setActiveAccount(h[0]);let f=o.enableLogging||!1;n.addEventCallback(c=>{if(c.eventType===msalBrowser.EventType.LOGIN_SUCCESS){let s=c.payload;s?.account&&n.setActiveAccount(s.account),f&&console.log("[MSAL] Login successful:",s.account?.username);}if(c.eventType===msalBrowser.EventType.LOGIN_FAILURE&&console.error("[MSAL] Login failed:",c.error),c.eventType===msalBrowser.EventType.LOGOUT_SUCCESS&&(n.setActiveAccount(null),f&&console.log("[MSAL] Logout successful")),c.eventType===msalBrowser.EventType.ACQUIRE_TOKEN_SUCCESS){let s=c.payload;s?.account&&!n.getActiveAccount()&&n.setActiveAccount(s.account);}c.eventType===msalBrowser.EventType.ACQUIRE_TOKEN_FAILURE&&f&&console.error("[MSAL] Token acquisition failed:",c.error);}),g.current=n,ce=n,a(n),t&&t(n);}catch(l){throw console.error("[MSAL] Initialization failed:",l),l}})();},[]),typeof window>"u"?jsxRuntime.jsx(jsxRuntime.Fragment,{children:e||jsxRuntime.jsx("div",{children:"Loading authentication..."})}):i?jsxRuntime.jsx(msalReact.MsalProvider,{instance:i,children:r}):jsxRuntime.jsx(jsxRuntime.Fragment,{children:e||jsxRuntime.jsx("div",{children:"Loading authentication..."})})}var Ne=react.createContext(void 0);function Fe({children:r,protection:e,...t}){return jsxRuntime.jsx(Ne.Provider,{value:e,children:jsxRuntime.jsx(J,{...t,children:r})})}var K=new Map;function A(r=["User.Read"]){let{instance:e,accounts:t,inProgress:o}=msalReact.useMsal(),i=msalReact.useAccount(t[0]||null),a=react.useMemo(()=>t.length>0,[t]),g=react.useCallback(async(c=r)=>{if(o!==msalBrowser.InteractionStatus.None){console.warn("[MSAL] Interaction already in progress");return}try{let s={scopes:c,prompt:"select_account"};await e.loginRedirect(s);}catch(s){if(s?.errorCode==="user_cancelled"){console.log("[MSAL] User cancelled login");return}throw console.error("[MSAL] Login redirect failed:",s),s}},[e,r,o]),u=react.useCallback(async()=>{try{await e.logoutRedirect({account:i||void 0});}catch(c){throw console.error("[MSAL] Logout redirect failed:",c),c}},[e,i]),l=react.useCallback(async(c=r)=>{if(!i)throw new Error("[MSAL] No active account. Please login first.");try{let s={scopes:c,account:i,forceRefresh:!1};return (await e.acquireTokenSilent(s)).accessToken}catch(s){throw console.error("[MSAL] Silent token acquisition failed:",s),s}},[e,i,r]),n=react.useCallback(async(c=r)=>{if(!i)throw new Error("[MSAL] No active account. Please login first.");try{let s={scopes:c,account:i};await e.acquireTokenRedirect(s);}catch(s){throw console.error("[MSAL] Token redirect acquisition failed:",s),s}},[e,i,r]),h=react.useCallback(async(c=r)=>{let s=`${i?.homeAccountId||"anonymous"}-${c.sort().join(",")}`,m=K.get(s);if(m)return m;let p=(async()=>{try{return await l(c)}catch{throw console.warn("[MSAL] Silent token acquisition failed, falling back to redirect"),await n(c),new Error("[MSAL] Redirecting for token acquisition")}finally{K.delete(s);}})();return K.set(s,p),p},[l,n,r,i]),f=react.useCallback(async()=>{e.setActiveAccount(null),await e.clearCache();},[e]);return {account:i,accounts:t,isAuthenticated:a,inProgress:o!==msalBrowser.InteractionStatus.None,loginRedirect:g,logoutRedirect:u,acquireToken:h,acquireTokenSilent:l,acquireTokenRedirect:n,clearSession:f}}function $e({text:r="Sign in with Microsoft",variant:e="dark",size:t="medium",scopes:o,className:i="",style:a,onSuccess:g,onError:u}){let{loginRedirect:l,inProgress:n}=A(),[h,f]=react.useState(false),c=async()=>{f(true);try{await l(o),g?.();}catch(y){u?.(y);}finally{setTimeout(()=>f(false),500);}},s={small:{padding:"8px 16px",fontSize:"14px",height:"36px"},medium:{padding:"10px 20px",fontSize:"15px",height:"41px"},large:{padding:"12px 24px",fontSize:"16px",height:"48px"}},m={dark:{backgroundColor:"#2F2F2F",color:"#FFFFFF",border:"1px solid #8C8C8C"},light:{backgroundColor:"#FFFFFF",color:"#5E5E5E",border:"1px solid #8C8C8C"}},p=n||h,d={display:"inline-flex",alignItems:"center",justifyContent:"center",gap:"12px",fontFamily:'"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',fontWeight:600,borderRadius:"2px",cursor:p?"not-allowed":"pointer",transition:"all 0.2s ease",opacity:p?.6:1,...m[e],...s[t],...a};return jsxRuntime.jsxs("button",{onClick:c,disabled:p,className:i,style:d,"aria-label":r,children:[jsxRuntime.jsx(ze,{}),jsxRuntime.jsx("span",{children:r})]})}function ze(){return jsxRuntime.jsxs("svg",{width:"21",height:"21",viewBox:"0 0 21 21",fill:"none",xmlns:"http://www.w3.org/2000/svg",children:[jsxRuntime.jsx("rect",{width:"10",height:"10",fill:"#F25022"}),jsxRuntime.jsx("rect",{x:"11",width:"10",height:"10",fill:"#7FBA00"}),jsxRuntime.jsx("rect",{y:"11",width:"10",height:"10",fill:"#00A4EF"}),jsxRuntime.jsx("rect",{x:"11",y:"11",width:"10",height:"10",fill:"#FFB900"})]})}function qe({text:r="Sign out",variant:e="dark",size:t="medium",className:o="",style:i,onSuccess:a,onError:g}){let{logoutRedirect:u,inProgress:l}=A(),n=async()=>{try{await u(),a?.();}catch(s){g?.(s);}},h={small:{padding:"8px 16px",fontSize:"14px",height:"36px"},medium:{padding:"10px 20px",fontSize:"15px",height:"41px"},large:{padding:"12px 24px",fontSize:"16px",height:"48px"}},c={display:"inline-flex",alignItems:"center",justifyContent:"center",gap:"12px",fontFamily:'"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',fontWeight:600,borderRadius:"2px",cursor:l?"not-allowed":"pointer",transition:"all 0.2s ease",opacity:l?.6:1,...{dark:{backgroundColor:"#2F2F2F",color:"#FFFFFF",border:"1px solid #8C8C8C"},light:{backgroundColor:"#FFFFFF",color:"#5E5E5E",border:"1px solid #8C8C8C"}}[e],...h[t],...i};return jsxRuntime.jsxs("button",{onClick:n,disabled:l,className:o,style:c,"aria-label":r,children:[jsxRuntime.jsx(Be,{}),jsxRuntime.jsx("span",{children:r})]})}function Be(){return jsxRuntime.jsxs("svg",{width:"21",height:"21",viewBox:"0 0 21 21",fill:"none",xmlns:"http://www.w3.org/2000/svg",children:[jsxRuntime.jsx("rect",{width:"10",height:"10",fill:"#F25022"}),jsxRuntime.jsx("rect",{x:"11",width:"10",height:"10",fill:"#7FBA00"}),jsxRuntime.jsx("rect",{y:"11",width:"10",height:"10",fill:"#00A4EF"}),jsxRuntime.jsx("rect",{x:"11",y:"11",width:"10",height:"10",fill:"#FFB900"})]})}function N(){let{acquireToken:r}=A(),e=react.useCallback(async(u,l={})=>{let{scopes:n=["User.Read"],version:h="v1.0",debug:f=false,...c}=l;try{let s=await r(n),m=`https://graph.microsoft.com/${h}`,p=u.startsWith("http")?u:`${m}${u.startsWith("/")?u:`/${u}`}`;f&&console.log("[GraphAPI] Request:",{url:p,method:c.method||"GET"});let d=await fetch(p,{...c,headers:{Authorization:`Bearer ${s}`,"Content-Type":"application/json",...c.headers}});if(!d.ok){let R=await d.text(),M=`Graph API error (${d.status}): ${R}`;throw new Error(M)}if(d.status===204||d.headers.get("content-length")==="0")return null;let y=await d.json();return f&&console.log("[GraphAPI] Response:",y),y}catch(s){let m=w(s);throw console.error("[GraphAPI] Request failed:",m),new Error(m)}},[r]),t=react.useCallback((u,l={})=>e(u,{...l,method:"GET"}),[e]),o=react.useCallback((u,l,n={})=>e(u,{...n,method:"POST",body:l?JSON.stringify(l):void 0}),[e]),i=react.useCallback((u,l,n={})=>e(u,{...n,method:"PUT",body:l?JSON.stringify(l):void 0}),[e]),a=react.useCallback((u,l,n={})=>e(u,{...n,method:"PATCH",body:l?JSON.stringify(l):void 0}),[e]),g=react.useCallback((u,l={})=>e(u,{...l,method:"DELETE"}),[e]);return {get:t,post:o,put:i,patch:a,delete:g,request:e}}var x=new Map,_e=300*1e3,me=100;function Ve(){if(x.size>me){let r=Array.from(x.entries());r.sort((t,o)=>t[1].timestamp-o[1].timestamp),r.slice(0,x.size-me).forEach(([t])=>{let o=x.get(t);o?.data.photo&&URL.revokeObjectURL(o.data.photo),x.delete(t);});}}function Q(){let{isAuthenticated:r,account:e}=A(),t=N(),[o,i]=react.useState(null),[a,g]=react.useState(false),[u,l]=react.useState(null),n=react.useCallback(async()=>{if(!r||!e){i(null);return}let f=e.homeAccountId,c=x.get(f);if(c&&Date.now()-c.timestamp<_e){i(c.data);return}g(true),l(null);try{let s=await t.get("/me",{scopes:["User.Read"]}),m;try{let d=await t.get("/me/photo/$value",{scopes:["User.Read"],headers:{"Content-Type":"image/jpeg"}});d&&(m=URL.createObjectURL(d));}catch{console.debug("[UserProfile] Photo not available");}let p={id:s.id,displayName:s.displayName,givenName:s.givenName,surname:s.surname,userPrincipalName:s.userPrincipalName,mail:s.mail,jobTitle:s.jobTitle,officeLocation:s.officeLocation,mobilePhone:s.mobilePhone,businessPhones:s.businessPhones,photo:m};x.set(f,{data:p,timestamp:Date.now()}),Ve(),i(p);}catch(s){let p=w(s),d=new Error(p);l(d),console.error("[UserProfile] Failed to fetch profile:",p);}finally{g(false);}},[r,e,t]),h=react.useCallback(()=>{if(e){let f=x.get(e.homeAccountId);f?.data.photo&&URL.revokeObjectURL(f.data.photo),x.delete(e.homeAccountId);}o?.photo&&URL.revokeObjectURL(o.photo),i(null);},[e,o]);return react.useEffect(()=>(n(),()=>{o?.photo&&URL.revokeObjectURL(o.photo);}),[n]),react.useEffect(()=>()=>{o?.photo&&URL.revokeObjectURL(o.photo);},[o?.photo]),{profile:o,loading:a,error:u,refetch:n,clearCache:h}}function We({size:r=40,className:e="",style:t,showTooltip:o=true,fallbackImage:i}){let{profile:a,loading:g}=Q(),[u,l]=react.useState(null),[n,h]=react.useState(false);react.useEffect(()=>{a?.photo&&l(a.photo);},[a?.photo]);let f=()=>{if(!a)return "?";let{givenName:m,surname:p,displayName:d}=a;if(m&&p)return `${m[0]}${p[0]}`.toUpperCase();if(d){let y=d.split(" ");return y.length>=2?`${y[0][0]}${y[y.length-1][0]}`.toUpperCase():d.substring(0,2).toUpperCase()}return "?"},c={width:`${r}px`,height:`${r}px`,borderRadius:"50%",display:"inline-flex",alignItems:"center",justifyContent:"center",fontSize:`${r*.4}px`,fontWeight:600,fontFamily:'"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',backgroundColor:"#0078D4",color:"#FFFFFF",overflow:"hidden",userSelect:"none",...t},s=a?.displayName||"User";return g?jsxRuntime.jsx("div",{className:e,style:{...c,backgroundColor:"#E1E1E1"},"aria-label":"Loading user avatar",children:jsxRuntime.jsx("span",{style:{fontSize:`${r*.3}px`},children:"..."})}):u&&!n?jsxRuntime.jsx("div",{className:e,style:c,title:o?s:void 0,"aria-label":`${s} avatar`,children:jsxRuntime.jsx("img",{src:u,alt:s,style:{width:"100%",height:"100%",objectFit:"cover"},onError:()=>{h(true),i&&l(i);}})}):jsxRuntime.jsx("div",{className:e,style:c,title:o?s:void 0,"aria-label":`${s} avatar`,children:f()})}function je({className:r="",style:e,showDetails:t=false,renderLoading:o,renderAuthenticated:i,renderUnauthenticated:a}){let{isAuthenticated:g,inProgress:u,account:l}=A(),n={display:"inline-flex",alignItems:"center",gap:"8px",padding:"8px 12px",borderRadius:"4px",fontFamily:'"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',fontSize:"14px",fontWeight:500,...e};if(u)return o?jsxRuntime.jsx(jsxRuntime.Fragment,{children:o()}):jsxRuntime.jsxs("div",{className:r,style:{...n,backgroundColor:"#FFF4CE",color:"#8A6D3B"},role:"status","aria-live":"polite",children:[jsxRuntime.jsx(X,{color:"#FFA500"}),jsxRuntime.jsx("span",{children:"Loading..."})]});if(g){let h=l?.username||l?.name||"User";return i?jsxRuntime.jsx(jsxRuntime.Fragment,{children:i(h)}):jsxRuntime.jsxs("div",{className:r,style:{...n,backgroundColor:"#D4EDDA",color:"#155724"},role:"status","aria-live":"polite",children:[jsxRuntime.jsx(X,{color:"#28A745"}),jsxRuntime.jsx("span",{children:t?`Authenticated as ${h}`:"Authenticated"})]})}return a?jsxRuntime.jsx(jsxRuntime.Fragment,{children:a()}):jsxRuntime.jsxs("div",{className:r,style:{...n,backgroundColor:"#F8D7DA",color:"#721C24"},role:"status","aria-live":"polite",children:[jsxRuntime.jsx(X,{color:"#DC3545"}),jsxRuntime.jsx("span",{children:"Not authenticated"})]})}function X({color:r}){return jsxRuntime.jsx("svg",{width:"8",height:"8",viewBox:"0 0 8 8",fill:"none",xmlns:"http://www.w3.org/2000/svg",children:jsxRuntime.jsx("circle",{cx:"4",cy:"4",r:"4",fill:r})})}function re({children:r,loadingComponent:e,fallbackComponent:t,scopes:o,onAuthRequired:i}){let{isAuthenticated:a,inProgress:g,loginRedirect:u}=A();return react.useEffect(()=>{!a&&!g&&(i?.(),(async()=>{try{await u(o);}catch(n){console.error("[AuthGuard] Authentication failed:",n);}})());},[a,g,o,u,i]),g?jsxRuntime.jsx(jsxRuntime.Fragment,{children:e||jsxRuntime.jsx("div",{children:"Authenticating..."})}):a?jsxRuntime.jsx(jsxRuntime.Fragment,{children:r}):jsxRuntime.jsx(jsxRuntime.Fragment,{children:t||jsxRuntime.jsx("div",{children:"Redirecting to login..."})})}var ne=class extends react.Component{constructor(t){super(t);this.reset=()=>{this.setState({hasError:false,error:null});};this.state={hasError:false,error:null};}static getDerivedStateFromError(t){return {hasError:true,error:t}}componentDidCatch(t,o){let{onError:i,debug:a}=this.props;a&&(console.error("[ErrorBoundary] Caught error:",t),console.error("[ErrorBoundary] Error info:",o)),i?.(t,o);}render(){let{hasError:t,error:o}=this.state,{children:i,fallback:a}=this.props;return t&&o?a?a(o,this.reset):jsxRuntime.jsxs("div",{style:{padding:"20px",margin:"20px",border:"1px solid #DC3545",borderRadius:"4px",backgroundColor:"#F8D7DA",color:"#721C24",fontFamily:'"Segoe UI", Tahoma, Geneva, Verdana, sans-serif'},children:[jsxRuntime.jsx("h2",{style:{margin:"0 0 10px 0",fontSize:"18px"},children:"Authentication Error"}),jsxRuntime.jsx("p",{style:{margin:"0 0 10px 0"},children:o.message}),jsxRuntime.jsx("button",{onClick:this.reset,style:{padding:"8px 16px",backgroundColor:"#DC3545",color:"#FFFFFF",border:"none",borderRadius:"4px",cursor:"pointer",fontSize:"14px",fontWeight:600},children:"Try Again"})]}):i}};var v=new Map,Xe=300*1e3,Ae=100;function Ye(r){r?v.delete(r):v.clear();}function et(){if(v.size>Ae){let r=Array.from(v.entries());r.sort((t,o)=>t[1].timestamp-o[1].timestamp),r.slice(0,v.size-Ae).forEach(([t])=>v.delete(t));}}function tt(){let{isAuthenticated:r,account:e}=A(),t=N(),[o,i]=react.useState([]),[a,g]=react.useState([]),[u,l]=react.useState(false),[n,h]=react.useState(null),f=react.useCallback(async()=>{if(!r||!e){i([]),g([]);return}let d=e.homeAccountId,y=v.get(d);if(y&&Date.now()-y.timestamp<Xe){i(y.roles),g(y.groups);return}l(true),h(null);try{let M=e.idTokenClaims?.roles||[],$=(await t.get("/me/memberOf",{scopes:["User.Read","Directory.Read.All"]})).value.map(se=>se.id);v.set(d,{roles:M,groups:$,timestamp:Date.now()}),et(),i(M),g($);}catch(R){let V=w(R),$=new Error(V);h($),console.error("[Roles] Failed to fetch roles/groups:",V);let Re=e.idTokenClaims?.roles||[];i(Re);}finally{l(false);}},[r,e,t]),c=react.useCallback(d=>o.includes(d),[o]),s=react.useCallback(d=>a.includes(d),[a]),m=react.useCallback(d=>d.some(y=>o.includes(y)),[o]),p=react.useCallback(d=>d.every(y=>o.includes(y)),[o]);return react.useEffect(()=>(f(),()=>{e&&Ye(e.homeAccountId);}),[f,e]),{roles:o,groups:a,loading:u,error:n,hasRole:c,hasGroup:s,hasAnyRole:m,hasAllRoles:p,refetch:f}}function rt(r,e={}){let{displayName:t,...o}=e,i=a=>jsxRuntime.jsx(re,{...o,children:jsxRuntime.jsx(r,{...a})});return i.displayName=t||`withAuth(${r.displayName||r.name||"Component"})`,i}async function Pe(r,e={}){let{maxRetries:t=3,initialDelay:o=1e3,maxDelay:i=1e4,backoffMultiplier:a=2,debug:g=false}=e,u,l=o;for(let n=0;n<=t;n++)try{return g&&n>0&&console.log(`[TokenRetry] Attempt ${n+1}/${t+1}`),await r()}catch(h){if(u=h,n===t){g&&console.error("[TokenRetry] All retry attempts failed");break}if(!ot(h))throw g&&console.log("[TokenRetry] Non-retryable error, aborting"),h;g&&console.warn(`[TokenRetry] Attempt ${n+1} failed, retrying in ${l}ms...`),await nt(l),l=Math.min(l*a,i);}throw u}function ot(r){let e=r.message.toLowerCase();return !!(e.includes("network")||e.includes("timeout")||e.includes("fetch")||e.includes("connection")||e.includes("500")||e.includes("502")||e.includes("503")||e.includes("429")||e.includes("rate limit")||e.includes("token")&&e.includes("expired"))}function nt(r){return new Promise(e=>setTimeout(e,r))}function it(r,e={}){return (...t)=>Pe(()=>r(...t),e)}var B=class{constructor(e={}){this.logHistory=[];this.performanceTimings=new Map;this.config={enabled:e.enabled??false,prefix:e.prefix??"[MSAL-Next]",showTimestamp:e.showTimestamp??true,level:e.level??"info",enablePerformance:e.enablePerformance??false,enableNetworkLogs:e.enableNetworkLogs??false,maxHistorySize:e.maxHistorySize??100};}shouldLog(e){if(!this.config.enabled)return  false;let t=["error","warn","info","debug"],o=t.indexOf(this.config.level);return t.indexOf(e)<=o}formatMessage(e,t,o){let i=this.config.showTimestamp?`[${new Date().toISOString()}]`:"",a=this.config.prefix,g=`[${e.toUpperCase()}]`,u=`${i} ${a} ${g} ${t}`;return o!==void 0&&(u+=`
-`+JSON.stringify(o,null,2)),u}addToHistory(e,t,o){this.logHistory.length>=this.config.maxHistorySize&&this.logHistory.shift(),this.logHistory.push({timestamp:Date.now(),level:e,message:t,data:o});}error(e,t){this.shouldLog("error")&&(console.error(this.formatMessage("error",e,t)),this.addToHistory("error",e,t));}warn(e,t){this.shouldLog("warn")&&(console.warn(this.formatMessage("warn",e,t)),this.addToHistory("warn",e,t));}info(e,t){this.shouldLog("info")&&(console.info(this.formatMessage("info",e,t)),this.addToHistory("info",e,t));}debug(e,t){this.shouldLog("debug")&&(console.debug(this.formatMessage("debug",e,t)),this.addToHistory("debug",e,t));}group(e){this.config.enabled&&console.group(`${this.config.prefix} ${e}`);}groupEnd(){this.config.enabled&&console.groupEnd();}startTiming(e){this.config.enablePerformance&&(this.performanceTimings.set(e,{operation:e,startTime:performance.now()}),this.debug(`\u23F1\uFE0F Started: ${e}`));}endTiming(e){if(this.config.enablePerformance){let t=this.performanceTimings.get(e);if(t)return t.endTime=performance.now(),t.duration=t.endTime-t.startTime,this.info(`\u23F1\uFE0F Completed: ${e} (${t.duration.toFixed(2)}ms)`),t.duration}}logRequest(e,t,o){this.config.enableNetworkLogs&&this.debug(`\u{1F310} ${e} ${t}`,o);}logResponse(e,t,o,i){if(this.config.enableNetworkLogs){let a=o>=200&&o<300?"\u2705":"\u274C";this.debug(`${a} ${e} ${t} - ${o}`,i);}}getHistory(){return [...this.logHistory]}getPerformanceTimings(){return Array.from(this.performanceTimings.values())}clearHistory(){this.logHistory=[];}clearTimings(){this.performanceTimings.clear();}exportLogs(){return JSON.stringify({config:this.config,history:this.logHistory,performanceTimings:Array.from(this.performanceTimings.values()),exportedAt:new Date().toISOString()},null,2)}downloadLogs(e="msal-next-debug-logs.json"){if(typeof window>"u")return;let t=this.exportLogs(),o=new Blob([t],{type:"application/json"}),i=URL.createObjectURL(o),a=document.createElement("a");a.href=i,a.download=e,a.click(),URL.revokeObjectURL(i);}setEnabled(e){this.config.enabled=e;}setLevel(e){e&&(this.config.level=e);}},O=null;function st(r){return O?r&&(r.enabled!==void 0&&O.setEnabled(r.enabled),r.level&&O.setLevel(r.level)):O=new B(r),O}function at(r,e){return new B({...e,prefix:`[MSAL-Next:${r}]`})}function _({children:r,config:e,defaultRedirectTo:t="/login",defaultLoading:o,defaultUnauthorized:i,debug:a=false}){let g=navigation.useRouter(),{isAuthenticated:u,account:l,inProgress:n}=A(),[h,f]=react.useState(true),[c,s]=react.useState(false);return react.useEffect(()=>{async function m(){if(a&&console.log("[ProtectedPage] Checking auth...",{isAuthenticated:u,inProgress:n,config:e}),!n){if(!e.required){s(true),f(false);return}if(!u||!l){a&&console.log("[ProtectedPage] Not authenticated, redirecting...");let p=e.redirectTo||t,d=encodeURIComponent(window.location.pathname+window.location.search);g.push(`${p}?returnUrl=${d}`);return}if(e.roles&&e.roles.length>0){let p=l.idTokenClaims?.roles||[];if(!e.roles.some(y=>p.includes(y))){a&&console.log("[ProtectedPage] Missing required role",{required:e.roles,user:p}),s(false),f(false);return}}if(e.validate)try{if(!await e.validate(l)){a&&console.log("[ProtectedPage] Custom validation failed"),s(!1),f(!1);return}}catch(p){console.error("[ProtectedPage] Validation error:",p),s(false),f(false);return}a&&console.log("[ProtectedPage] Authorization successful"),s(true),f(false);}}m();},[u,l,n,e,g,t,a]),h||n?e.loading?jsxRuntime.jsx(jsxRuntime.Fragment,{children:e.loading}):o?jsxRuntime.jsx(jsxRuntime.Fragment,{children:o}):jsxRuntime.jsx("div",{className:"flex items-center justify-center min-h-screen",children:jsxRuntime.jsx("div",{className:"animate-spin rounded-full h-12 w-12 border-b-2 border-blue-600"})}):c?jsxRuntime.jsx(jsxRuntime.Fragment,{children:r}):e.unauthorized?jsxRuntime.jsx(jsxRuntime.Fragment,{children:e.unauthorized}):i?jsxRuntime.jsx(jsxRuntime.Fragment,{children:i}):jsxRuntime.jsx("div",{className:"flex items-center justify-center min-h-screen",children:jsxRuntime.jsxs("div",{className:"text-center",children:[jsxRuntime.jsx("h1",{className:"text-2xl font-bold text-gray-900 mb-2",children:"Access Denied"}),jsxRuntime.jsx("p",{className:"text-gray-600",children:"You don't have permission to access this page."})]})})}function we(r,e,t){let o=i=>jsxRuntime.jsx(_,{config:e,defaultRedirectTo:t?.defaultRedirectTo,defaultLoading:t?.defaultLoading,defaultUnauthorized:t?.defaultUnauthorized,debug:t?.debug,children:jsxRuntime.jsx(r,{...i})});return o.displayName=`withPageAuth(${r.displayName||r.name||"Component"})`,o}function dt(r={}){let{protectedRoutes:e=[],publicOnlyRoutes:t=[],loginPath:o="/login",redirectAfterLogin:i="/",sessionCookie:a="msal.account",isAuthenticated:g,debug:u=false}=r;return async function(n){let{pathname:h}=n.nextUrl;u&&console.log("[AuthMiddleware] Processing:",h);let f=false;g?f=await g(n):f=!!n.cookies.get(a)?.value,u&&console.log("[AuthMiddleware] Authenticated:",f);let c=e.some(p=>h.startsWith(p)),s=t.some(p=>h.startsWith(p));if(c&&!f){u&&console.log("[AuthMiddleware] Redirecting to login");let p=n.nextUrl.clone();return p.pathname=o,p.searchParams.set("returnUrl",h),server.NextResponse.redirect(p)}if(s&&f){u&&console.log("[AuthMiddleware] Redirecting to home");let p=n.nextUrl.searchParams.get("returnUrl"),d=n.nextUrl.clone();return d.pathname=p||i,d.searchParams.delete("returnUrl"),server.NextResponse.redirect(d)}let m=server.NextResponse.next();if(f){m.headers.set("x-msal-authenticated","true");try{let p=n.cookies.get(a);if(p?.value){let d=H(p.value,W);d?.username&&m.headers.set("x-msal-username",d.username);}}catch{u&&console.warn("[AuthMiddleware] Failed to parse session data");}}return m}}Object.defineProperty(exports,"useAccount",{enumerable:true,get:function(){return msalReact.useAccount}});Object.defineProperty(exports,"useIsAuthenticated",{enumerable:true,get:function(){return msalReact.useIsAuthenticated}});Object.defineProperty(exports,"useMsal",{enumerable:true,get:function(){return msalReact.useMsal}});exports.AuthGuard=re;exports.AuthStatus=je;exports.ErrorBoundary=ne;exports.MSALProvider=Fe;exports.MicrosoftSignInButton=$e;exports.MsalAuthProvider=J;exports.ProtectedPage=_;exports.SignOutButton=qe;exports.UserAvatar=We;exports.createAuthMiddleware=dt;exports.createMsalConfig=j;exports.createRetryWrapper=it;exports.createScopedLogger=at;exports.getDebugLogger=st;exports.getMsalInstance=Ue;exports.isValidAccountData=W;exports.isValidRedirectUri=z;exports.isValidScope=ae;exports.retryWithBackoff=Pe;exports.safeJsonParse=H;exports.sanitizeError=w;exports.useGraphApi=N;exports.useMsalAuth=A;exports.useRoles=tt;exports.useUserProfile=Q;exports.validateScopes=Ce;exports.withAuth=rt;exports.withPageAuth=we;
+"use client";
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client.ts
+var client_exports = {};
+__export(client_exports, {
+  AuthGuard: () => AuthGuard,
+  AuthStatus: () => AuthStatus,
+  ErrorBoundary: () => ErrorBoundary,
+  MSALProvider: () => MSALProvider,
+  MicrosoftSignInButton: () => MicrosoftSignInButton,
+  MsalAuthProvider: () => MsalAuthProvider,
+  MsalError: () => MsalError,
+  ProtectedPage: () => ProtectedPage,
+  SignOutButton: () => SignOutButton,
+  UserAvatar: () => UserAvatar,
+  createAuthMiddleware: () => createAuthMiddleware,
+  createMissingEnvVarError: () => createMissingEnvVarError,
+  createMsalConfig: () => createMsalConfig,
+  createRetryWrapper: () => createRetryWrapper,
+  createScopedLogger: () => createScopedLogger,
+  displayValidationResults: () => displayValidationResults,
+  getDebugLogger: () => getDebugLogger,
+  getMsalInstance: () => getMsalInstance,
+  isValidAccountData: () => isValidAccountData,
+  isValidRedirectUri: () => isValidRedirectUri,
+  isValidScope: () => isValidScope,
+  retryWithBackoff: () => retryWithBackoff,
+  safeJsonParse: () => safeJsonParse,
+  sanitizeError: () => sanitizeError,
+  useAccount: () => import_msal_react3.useAccount,
+  useGraphApi: () => useGraphApi,
+  useIsAuthenticated: () => import_msal_react3.useIsAuthenticated,
+  useMsal: () => import_msal_react3.useMsal,
+  useMsalAuth: () => useMsalAuth,
+  useRoles: () => useRoles,
+  useTokenRefresh: () => useTokenRefresh,
+  useUserProfile: () => useUserProfile,
+  validateConfig: () => validateConfig,
+  validateScopes: () => validateScopes,
+  withAuth: () => withAuth,
+  withPageAuth: () => withPageAuth,
+  wrapMsalError: () => wrapMsalError
+});
+module.exports = __toCommonJS(client_exports);
+
+// src/components/MsalAuthProvider.tsx
+var import_msal_react2 = require("@azure/msal-react");
+var import_msal_browser3 = require("@azure/msal-browser");
+var import_react3 = require("react");
+
+// src/utils/createMsalConfig.ts
+var import_msal_browser = require("@azure/msal-browser");
+
+// src/utils/validation.ts
+function safeJsonParse(jsonString, validator) {
+  try {
+    const parsed = JSON.parse(jsonString);
+    if (validator(parsed)) {
+      return parsed;
+    }
+    console.warn("[Validation] JSON validation failed");
+    return null;
+  } catch (error) {
+    console.error("[Validation] JSON parse error:", error);
+    return null;
+  }
+}
+function isValidAccountData(data) {
+  return typeof data === "object" && data !== null && typeof data.homeAccountId === "string" && data.homeAccountId.length > 0 && typeof data.username === "string" && data.username.length > 0 && (data.name === void 0 || typeof data.name === "string");
+}
+function sanitizeError(error) {
+  if (error instanceof Error) {
+    const message = error.message;
+    const sanitized = message.replace(/[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g, "[TOKEN_REDACTED]").replace(/[a-f0-9]{32,}/gi, "[SECRET_REDACTED]").replace(/Bearer\s+[^\s]+/gi, "Bearer [REDACTED]");
+    return sanitized;
+  }
+  return "An unexpected error occurred";
+}
+function isValidRedirectUri(uri, allowedOrigins) {
+  try {
+    const url = new URL(uri);
+    return allowedOrigins.some((allowed) => {
+      const allowedUrl = new URL(allowed);
+      return url.origin === allowedUrl.origin;
+    });
+  } catch {
+    return false;
+  }
+}
+function isValidScope(scope) {
+  return /^[a-zA-Z0-9._-]+$/.test(scope);
+}
+function validateScopes(scopes) {
+  return Array.isArray(scopes) && scopes.every(isValidScope);
+}
+
+// src/utils/createMsalConfig.ts
+function createMsalConfig(config) {
+  if (config.msalConfig) {
+    return config.msalConfig;
+  }
+  const {
+    clientId,
+    tenantId,
+    authorityType = "common",
+    redirectUri,
+    postLogoutRedirectUri,
+    cacheLocation = "sessionStorage",
+    storeAuthStateInCookie = false,
+    navigateToLoginRequestUrl = false,
+    enableLogging = false,
+    loggerCallback,
+    allowedRedirectUris
+  } = config;
+  if (!clientId) {
+    throw new Error("@chemmangat/msal-next: clientId is required");
+  }
+  const getAuthority = () => {
+    if (authorityType === "tenant") {
+      if (!tenantId) {
+        throw new Error('@chemmangat/msal-next: tenantId is required when authorityType is "tenant"');
+      }
+      return `https://login.microsoftonline.com/${tenantId}`;
+    }
+    return `https://login.microsoftonline.com/${authorityType}`;
+  };
+  const defaultRedirectUri = typeof window !== "undefined" ? window.location.origin : "http://localhost:3000";
+  const finalRedirectUri = redirectUri || defaultRedirectUri;
+  if (allowedRedirectUris && allowedRedirectUris.length > 0) {
+    if (!isValidRedirectUri(finalRedirectUri, allowedRedirectUris)) {
+      throw new Error(
+        `@chemmangat/msal-next: redirectUri "${finalRedirectUri}" is not in the allowed list`
+      );
+    }
+    const finalPostLogoutUri = postLogoutRedirectUri || finalRedirectUri;
+    if (!isValidRedirectUri(finalPostLogoutUri, allowedRedirectUris)) {
+      throw new Error(
+        `@chemmangat/msal-next: postLogoutRedirectUri "${finalPostLogoutUri}" is not in the allowed list`
+      );
+    }
+  }
+  const msalConfig = {
+    auth: {
+      clientId,
+      authority: getAuthority(),
+      redirectUri: finalRedirectUri,
+      postLogoutRedirectUri: postLogoutRedirectUri || finalRedirectUri,
+      navigateToLoginRequestUrl
+    },
+    cache: {
+      cacheLocation,
+      storeAuthStateInCookie
+    },
+    system: {
+      loggerOptions: {
+        loggerCallback: loggerCallback || ((level, message, containsPii) => {
+          if (containsPii || !enableLogging) return;
+          switch (level) {
+            case import_msal_browser.LogLevel.Error:
+              console.error("[MSAL]", message);
+              break;
+            case import_msal_browser.LogLevel.Warning:
+              console.warn("[MSAL]", message);
+              break;
+            case import_msal_browser.LogLevel.Info:
+              console.info("[MSAL]", message);
+              break;
+            case import_msal_browser.LogLevel.Verbose:
+              console.debug("[MSAL]", message);
+              break;
+          }
+        }),
+        logLevel: enableLogging ? import_msal_browser.LogLevel.Verbose : import_msal_browser.LogLevel.Error
+      }
+    }
+  };
+  return msalConfig;
+}
+
+// src/utils/configValidator.ts
+var validationCache = null;
+var hasDisplayedResults = false;
+function validateConfig(config) {
+  if (process.env.NODE_ENV !== "development") {
+    return { valid: true, warnings: [], errors: [] };
+  }
+  if (validationCache) {
+    return validationCache;
+  }
+  const warnings = [];
+  const errors = [];
+  if (!config.clientId) {
+    errors.push({
+      field: "clientId",
+      message: "Client ID is missing",
+      fix: `Add NEXT_PUBLIC_AZURE_AD_CLIENT_ID to your .env.local file.
+
+Get it from: Azure Portal \u2192 App registrations \u2192 Your app \u2192 Application (client) ID`
+    });
+  } else if (isPlaceholderValue(config.clientId)) {
+    warnings.push({
+      field: "clientId",
+      message: "Client ID appears to be a placeholder",
+      fix: `Replace the placeholder with your actual Application (client) ID from Azure Portal.
+
+Current value: ${config.clientId}
+Expected format: 12345678-1234-1234-1234-123456789012 (GUID)`
+    });
+  } else if (!isValidGuid(config.clientId)) {
+    warnings.push({
+      field: "clientId",
+      message: "Client ID format is invalid",
+      fix: `Client ID should be a GUID (UUID) format.
+
+Current value: ${config.clientId}
+Expected format: 12345678-1234-1234-1234-123456789012
+
+Get the correct value from: Azure Portal \u2192 App registrations \u2192 Your app`
+    });
+  }
+  if (config.tenantId) {
+    if (isPlaceholderValue(config.tenantId)) {
+      warnings.push({
+        field: "tenantId",
+        message: "Tenant ID appears to be a placeholder",
+        fix: `Replace the placeholder with your actual Directory (tenant) ID from Azure Portal.
+
+Current value: ${config.tenantId}
+Expected format: 87654321-4321-4321-4321-210987654321 (GUID)
+
+Or remove tenantId and use authorityType: 'common' for multi-tenant apps.`
+      });
+    } else if (!isValidGuid(config.tenantId)) {
+      warnings.push({
+        field: "tenantId",
+        message: "Tenant ID format is invalid",
+        fix: `Tenant ID should be a GUID (UUID) format.
+
+Current value: ${config.tenantId}
+Expected format: 87654321-4321-4321-4321-210987654321
+
+Get the correct value from: Azure Portal \u2192 Azure Active Directory \u2192 Properties \u2192 Tenant ID`
+      });
+    }
+  }
+  if (config.redirectUri) {
+    if (isProductionUrl(config.redirectUri) && !config.redirectUri.startsWith("https://")) {
+      errors.push({
+        field: "redirectUri",
+        message: "Production redirect URI must use HTTPS",
+        fix: `Change your redirect URI to use HTTPS in production.
+
+Current value: ${config.redirectUri}
+Should be: ${config.redirectUri.replace("http://", "https://")}
+
+HTTP is only allowed for localhost development.`
+      });
+    }
+    if (!isValidUrl(config.redirectUri)) {
+      errors.push({
+        field: "redirectUri",
+        message: "Redirect URI is not a valid URL",
+        fix: `Provide a valid URL for redirectUri.
+
+Current value: ${config.redirectUri}
+Expected format: https://yourdomain.com or http://localhost:3000`
+      });
+    }
+  }
+  if (config.scopes && config.scopes.length > 0) {
+    const invalidScopes = config.scopes.filter((scope) => !isValidScope2(scope));
+    if (invalidScopes.length > 0) {
+      warnings.push({
+        field: "scopes",
+        message: "Some scopes have invalid format",
+        fix: `Invalid scopes: ${invalidScopes.join(", ")}
+
+Scopes should be in format: "Resource.Permission" (e.g., "User.Read", "Mail.Read")
+
+Common scopes:
+\u2022 User.Read - Read user profile
+\u2022 Mail.Read - Read user mail
+\u2022 Calendars.Read - Read user calendars
+\u2022 Files.Read - Read user files`
+      });
+    }
+  }
+  if (typeof window !== "undefined") {
+    const clientIdFromEnv = process.env.NEXT_PUBLIC_AZURE_AD_CLIENT_ID;
+    const tenantIdFromEnv = process.env.NEXT_PUBLIC_AZURE_AD_TENANT_ID;
+    if (!clientIdFromEnv) {
+      warnings.push({
+        field: "environment",
+        message: "NEXT_PUBLIC_AZURE_AD_CLIENT_ID not found in environment",
+        fix: `Add NEXT_PUBLIC_AZURE_AD_CLIENT_ID to your .env.local file:
+
+NEXT_PUBLIC_AZURE_AD_CLIENT_ID=your-client-id-here
+
+Then restart your development server.`
+      });
+    }
+    if (!tenantIdFromEnv && config.authorityType === "tenant") {
+      warnings.push({
+        field: "environment",
+        message: 'NEXT_PUBLIC_AZURE_AD_TENANT_ID not found but authorityType is "tenant"',
+        fix: `Either:
+1. Add NEXT_PUBLIC_AZURE_AD_TENANT_ID to your .env.local file, OR
+2. Change authorityType to 'common' for multi-tenant support
+
+For single-tenant apps:
+NEXT_PUBLIC_AZURE_AD_TENANT_ID=your-tenant-id-here`
+      });
+    }
+  }
+  const result = {
+    valid: errors.length === 0,
+    warnings,
+    errors
+  };
+  validationCache = result;
+  return result;
+}
+function displayValidationResults(result) {
+  if (hasDisplayedResults || process.env.NODE_ENV !== "development") {
+    return;
+  }
+  hasDisplayedResults = true;
+  if (result.valid && result.warnings.length === 0) {
+    console.log("\u2705 MSAL configuration validated successfully");
+    return;
+  }
+  console.group("\u{1F50D} MSAL Configuration Validation");
+  if (result.errors.length > 0) {
+    console.group("\u274C Errors (must fix)");
+    result.errors.forEach((error) => {
+      console.error(`
+${error.field}:`);
+      console.error(`  ${error.message}`);
+      console.error(`
+  Fix:
+  ${error.fix.split("\n").join("\n  ")}`);
+    });
+    console.groupEnd();
+  }
+  if (result.warnings.length > 0) {
+    console.group("\u26A0\uFE0F  Warnings (should fix)");
+    result.warnings.forEach((warning) => {
+      console.warn(`
+${warning.field}:`);
+      console.warn(`  ${warning.message}`);
+      console.warn(`
+  Fix:
+  ${warning.fix.split("\n").join("\n  ")}`);
+    });
+    console.groupEnd();
+  }
+  console.groupEnd();
+}
+function isPlaceholderValue(value) {
+  const placeholders = [
+    "your-client-id",
+    "your-tenant-id",
+    "your-client-id-here",
+    "your-tenant-id-here",
+    "client-id",
+    "tenant-id",
+    "replace-me",
+    "changeme",
+    "placeholder",
+    "example",
+    "xxx",
+    "000"
+  ];
+  const lowerValue = value.toLowerCase();
+  return placeholders.some((placeholder) => lowerValue.includes(placeholder));
+}
+function isValidGuid(value) {
+  const guidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  return guidRegex.test(value);
+}
+function isProductionUrl(url) {
+  return !url.includes("localhost") && !url.includes("127.0.0.1");
+}
+function isValidUrl(url) {
+  try {
+    new URL(url);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isValidScope2(scope) {
+  return /^([a-zA-Z0-9]+\.[a-zA-Z0-9]+|https?:\/\/.+)$/.test(scope);
+}
+
+// src/errors/MsalError.ts
+var MSAL_ERROR_SOLUTIONS = {
+  // Redirect URI mismatch
+  "AADSTS50011": {
+    message: "Redirect URI mismatch",
+    fix: `Your redirect URI doesn't match what's configured in Azure AD.
+
+Fix:
+1. Go to Azure Portal \u2192 Azure Active Directory \u2192 App registrations
+2. Select your app \u2192 Authentication
+3. Under "Single-page application", add your redirect URI:
+   \u2022 http://localhost:3000 (for development)
+   \u2022 https://yourdomain.com (for production)
+4. Click "Save"
+
+Current redirect URI: ${typeof window !== "undefined" ? window.location.origin : "unknown"}`,
+    docs: "https://learn.microsoft.com/en-us/azure/active-directory/develop/reply-url"
+  },
+  // Consent required
+  "AADSTS65001": {
+    message: "Admin consent required",
+    fix: `Your app requires admin consent for the requested permissions.
+
+Fix:
+1. Go to Azure Portal \u2192 Azure Active Directory \u2192 App registrations
+2. Select your app \u2192 API permissions
+3. Click "Grant admin consent for [Your Organization]"
+4. Confirm the consent
+
+Alternatively, ask your Azure AD administrator to grant consent.`,
+    docs: "https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-admin-consent"
+  },
+  // Invalid client
+  "AADSTS700016": {
+    message: "Invalid client application",
+    fix: `The application ID (client ID) is not found in the directory.
+
+Fix:
+1. Verify your NEXT_PUBLIC_AZURE_AD_CLIENT_ID in .env.local
+2. Ensure the app registration exists in Azure Portal
+3. Check that you're using the correct tenant
+
+Current client ID: Check your environment variables`,
+    docs: "https://learn.microsoft.com/en-us/azure/active-directory/develop/reference-aadsts-error-codes"
+  },
+  // Invalid tenant
+  "AADSTS90002": {
+    message: "Invalid tenant",
+    fix: `The tenant ID is invalid or not found.
+
+Fix:
+1. Verify your NEXT_PUBLIC_AZURE_AD_TENANT_ID in .env.local
+2. Ensure you're using the correct tenant ID (GUID format)
+3. For multi-tenant apps, use authorityType: 'common' instead
+
+Current tenant ID: Check your environment variables`,
+    docs: "https://learn.microsoft.com/en-us/azure/active-directory/develop/msal-national-cloud"
+  },
+  // User cancelled
+  "user_cancelled": {
+    message: "User cancelled authentication",
+    fix: "The user closed the authentication window or cancelled the login process. This is normal user behavior.",
+    docs: void 0
+  },
+  // No token in cache
+  "no_token_request_cache_error": {
+    message: "No cached token request",
+    fix: `This usually happens when the page is refreshed during authentication.
+
+This is normal and will be handled automatically. If the issue persists:
+1. Clear your browser cache and cookies
+2. Try logging in again
+3. Ensure cookies are enabled in your browser`,
+    docs: void 0
+  },
+  // Interaction required
+  "interaction_required": {
+    message: "User interaction required",
+    fix: `The token cannot be acquired silently and requires user interaction.
+
+This is normal behavior. The app will redirect you to sign in.`,
+    docs: void 0
+  },
+  // Consent required
+  "consent_required": {
+    message: "User consent required",
+    fix: `Additional consent is required for the requested permissions.
+
+This is normal behavior. You'll be prompted to grant consent.`,
+    docs: void 0
+  }
+};
+var MsalError = class _MsalError extends Error {
+  constructor(error) {
+    const errorInfo = _MsalError.parseError(error);
+    super(errorInfo.message);
+    this.name = "MsalError";
+    this.code = errorInfo.code;
+    this.fix = errorInfo.fix;
+    this.docs = errorInfo.docs;
+    this.originalError = error;
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _MsalError);
+    }
+  }
+  /**
+   * Parse error and extract actionable information
+   */
+  static parseError(error) {
+    if (error && typeof error === "object") {
+      const err = error;
+      const errorCode = err.errorCode || err.error || err.code;
+      if (errorCode && MSAL_ERROR_SOLUTIONS[errorCode]) {
+        const solution = MSAL_ERROR_SOLUTIONS[errorCode];
+        return {
+          message: solution.message,
+          code: errorCode,
+          fix: solution.fix,
+          docs: solution.docs
+        };
+      }
+      const errorMessage = err.errorMessage || err.message || String(error);
+      for (const [code, solution] of Object.entries(MSAL_ERROR_SOLUTIONS)) {
+        if (errorMessage.includes(code)) {
+          return {
+            message: solution.message,
+            code,
+            fix: solution.fix,
+            docs: solution.docs
+          };
+        }
+      }
+      return {
+        message: errorMessage || "Authentication error occurred",
+        code: errorCode
+      };
+    }
+    return {
+      message: "An unexpected authentication error occurred"
+    };
+  }
+  /**
+   * Format error for console logging with colors (development only)
+   */
+  toConsoleString() {
+    const isDev = process.env.NODE_ENV === "development";
+    if (!isDev) {
+      return this.message;
+    }
+    let output = `
+\u{1F6A8} MSAL Authentication Error
+`;
+    output += `
+Error: ${this.message}
+`;
+    if (this.code) {
+      output += `Code: ${this.code}
+`;
+    }
+    if (this.fix) {
+      output += `
+\u{1F4A1} How to fix:
+${this.fix}
+`;
+    }
+    if (this.docs) {
+      output += `
+\u{1F4DA} Documentation: ${this.docs}
+`;
+    }
+    return output;
+  }
+  /**
+   * Check if error is a user cancellation (not a real error)
+   */
+  isUserCancellation() {
+    return this.code === "user_cancelled";
+  }
+  /**
+   * Check if error requires user interaction
+   */
+  requiresInteraction() {
+    return this.code === "interaction_required" || this.code === "consent_required";
+  }
+};
+function wrapMsalError(error) {
+  if (error instanceof MsalError) {
+    return error;
+  }
+  return new MsalError(error);
+}
+function createMissingEnvVarError(varName) {
+  const error = {
+    errorCode: "missing_env_var",
+    errorMessage: `Missing environment variable: ${varName}`,
+    message: `${varName} not found`
+  };
+  const fix = `Environment variable ${varName} is not set.
+
+Fix:
+1. Copy .env.local.example to .env.local (if it exists)
+2. Add the following to your .env.local file:
+
+   ${varName}=your-value-here
+
+3. Get the value from Azure Portal:
+   \u2022 Go to Azure Active Directory \u2192 App registrations
+   \u2022 Select your app
+   \u2022 Copy the ${varName.includes("CLIENT_ID") ? "Application (client) ID" : "Directory (tenant) ID"}
+
+4. Restart your development server
+
+Note: Environment variables starting with NEXT_PUBLIC_ are exposed to the browser.`;
+  return new MsalError({
+    ...error,
+    fix,
+    docs: "https://nextjs.org/docs/basic-features/environment-variables"
+  });
+}
+
+// src/hooks/useTokenRefresh.ts
+var import_react2 = require("react");
+
+// src/hooks/useMsalAuth.ts
+var import_msal_react = require("@azure/msal-react");
+var import_msal_browser2 = require("@azure/msal-browser");
+var import_react = require("react");
+var pendingTokenRequests = /* @__PURE__ */ new Map();
+function useMsalAuth(defaultScopes = ["User.Read"]) {
+  const { instance, accounts, inProgress } = (0, import_msal_react.useMsal)();
+  const account = (0, import_msal_react.useAccount)(accounts[0] || null);
+  const isAuthenticated = (0, import_react.useMemo)(() => accounts.length > 0, [accounts]);
+  const loginRedirect = (0, import_react.useCallback)(
+    async (scopes = defaultScopes) => {
+      if (inProgress !== import_msal_browser2.InteractionStatus.None) {
+        console.warn("[MSAL] Interaction already in progress");
+        return;
+      }
+      try {
+        const request = {
+          scopes,
+          prompt: "select_account"
+        };
+        await instance.loginRedirect(request);
+      } catch (error) {
+        const msalError = wrapMsalError(error);
+        if (msalError.isUserCancellation()) {
+          console.log("[MSAL] User cancelled login");
+          return;
+        }
+        if (process.env.NODE_ENV === "development") {
+          console.error(msalError.toConsoleString());
+        } else {
+          console.error("[MSAL] Login redirect failed:", msalError.message);
+        }
+        throw msalError;
+      }
+    },
+    [instance, defaultScopes, inProgress]
+  );
+  const logoutRedirect = (0, import_react.useCallback)(async () => {
+    try {
+      await instance.logoutRedirect({
+        account: account || void 0
+      });
+    } catch (error) {
+      const msalError = wrapMsalError(error);
+      if (process.env.NODE_ENV === "development") {
+        console.error(msalError.toConsoleString());
+      } else {
+        console.error("[MSAL] Logout redirect failed:", msalError.message);
+      }
+      throw msalError;
+    }
+  }, [instance, account]);
+  const acquireTokenSilent = (0, import_react.useCallback)(
+    async (scopes = defaultScopes) => {
+      if (!account) {
+        throw new Error("[MSAL] No active account. Please login first.");
+      }
+      try {
+        const request = {
+          scopes,
+          account,
+          forceRefresh: false
+        };
+        const response = await instance.acquireTokenSilent(request);
+        return response.accessToken;
+      } catch (error) {
+        const msalError = wrapMsalError(error);
+        if (process.env.NODE_ENV === "development") {
+          console.error(msalError.toConsoleString());
+        } else {
+          console.error("[MSAL] Silent token acquisition failed:", msalError.message);
+        }
+        throw msalError;
+      }
+    },
+    [instance, account, defaultScopes]
+  );
+  const acquireTokenRedirect = (0, import_react.useCallback)(
+    async (scopes = defaultScopes) => {
+      if (!account) {
+        throw new Error("[MSAL] No active account. Please login first.");
+      }
+      try {
+        const request = {
+          scopes,
+          account
+        };
+        await instance.acquireTokenRedirect(request);
+      } catch (error) {
+        const msalError = wrapMsalError(error);
+        if (process.env.NODE_ENV === "development") {
+          console.error(msalError.toConsoleString());
+        } else {
+          console.error("[MSAL] Token redirect acquisition failed:", msalError.message);
+        }
+        throw msalError;
+      }
+    },
+    [instance, account, defaultScopes]
+  );
+  const acquireToken = (0, import_react.useCallback)(
+    async (scopes = defaultScopes) => {
+      const requestKey = `${account?.homeAccountId || "anonymous"}-${scopes.sort().join(",")}`;
+      const pendingRequest = pendingTokenRequests.get(requestKey);
+      if (pendingRequest) {
+        return pendingRequest;
+      }
+      const tokenRequest = (async () => {
+        try {
+          return await acquireTokenSilent(scopes);
+        } catch (error) {
+          console.warn("[MSAL] Silent token acquisition failed, falling back to redirect");
+          await acquireTokenRedirect(scopes);
+          throw new Error("[MSAL] Redirecting for token acquisition");
+        } finally {
+          pendingTokenRequests.delete(requestKey);
+        }
+      })();
+      pendingTokenRequests.set(requestKey, tokenRequest);
+      return tokenRequest;
+    },
+    [acquireTokenSilent, acquireTokenRedirect, defaultScopes, account]
+  );
+  const clearSession = (0, import_react.useCallback)(async () => {
+    instance.setActiveAccount(null);
+    await instance.clearCache();
+  }, [instance]);
+  return {
+    account,
+    accounts,
+    isAuthenticated,
+    inProgress: inProgress !== import_msal_browser2.InteractionStatus.None,
+    loginRedirect,
+    logoutRedirect,
+    acquireToken,
+    acquireTokenSilent,
+    acquireTokenRedirect,
+    clearSession
+  };
+}
+
+// src/hooks/useTokenRefresh.ts
+function useTokenRefresh(options = {}) {
+  const {
+    enabled = true,
+    refreshBeforeExpiry = 300,
+    // 5 minutes
+    scopes = ["User.Read"],
+    onRefresh,
+    onError
+  } = options;
+  const { isAuthenticated, account, acquireTokenSilent } = useMsalAuth();
+  const intervalRef = (0, import_react2.useRef)(null);
+  const lastRefreshRef = (0, import_react2.useRef)(null);
+  const expiresInRef = (0, import_react2.useRef)(null);
+  const refresh = (0, import_react2.useCallback)(async () => {
+    if (!isAuthenticated || !account) {
+      return;
+    }
+    try {
+      await acquireTokenSilent(scopes);
+      lastRefreshRef.current = /* @__PURE__ */ new Date();
+      const expiresIn = 3600;
+      expiresInRef.current = expiresIn;
+      onRefresh?.(expiresIn);
+    } catch (error) {
+      console.error("[TokenRefresh] Failed to refresh token:", error);
+      onError?.(error);
+    }
+  }, [isAuthenticated, account, acquireTokenSilent, scopes, onRefresh, onError]);
+  (0, import_react2.useEffect)(() => {
+    if (!enabled || !isAuthenticated) {
+      return;
+    }
+    refresh();
+    intervalRef.current = setInterval(() => {
+      if (!expiresInRef.current) {
+        return;
+      }
+      const timeSinceRefresh = lastRefreshRef.current ? (Date.now() - lastRefreshRef.current.getTime()) / 1e3 : 0;
+      const remainingTime = expiresInRef.current - timeSinceRefresh;
+      expiresInRef.current = Math.max(0, remainingTime);
+      if (remainingTime <= refreshBeforeExpiry && remainingTime > 0) {
+        refresh();
+      }
+    }, 6e4);
+    return () => {
+      if (intervalRef.current) {
+        clearInterval(intervalRef.current);
+      }
+    };
+  }, [enabled, isAuthenticated, refreshBeforeExpiry, refresh]);
+  const isExpiringSoon = expiresInRef.current !== null && expiresInRef.current <= refreshBeforeExpiry;
+  return {
+    expiresIn: expiresInRef.current,
+    isExpiringSoon,
+    refresh,
+    lastRefresh: lastRefreshRef.current
+  };
+}
+
+// src/components/TokenRefreshManager.tsx
+function TokenRefreshManager({
+  enabled,
+  refreshBeforeExpiry = 300,
+  scopes = ["User.Read"],
+  enableLogging = false
+}) {
+  useTokenRefresh({
+    enabled,
+    refreshBeforeExpiry,
+    scopes,
+    onRefresh: (expiresIn) => {
+      if (enableLogging) {
+        console.log(`[TokenRefresh] Token refreshed successfully. Expires in ${expiresIn} seconds.`);
+      }
+    },
+    onError: (error) => {
+      if (enableLogging) {
+        console.error("[TokenRefresh] Failed to refresh token:", error);
+      }
+    }
+  });
+  return null;
+}
+
+// src/components/MsalAuthProvider.tsx
+var import_jsx_runtime = require("react/jsx-runtime");
+var globalMsalInstance = null;
+function getMsalInstance() {
+  return globalMsalInstance;
+}
+function MsalAuthProvider({
+  children,
+  loadingComponent,
+  onInitialized,
+  autoRefreshToken = false,
+  refreshBeforeExpiry = 300,
+  ...config
+}) {
+  const [msalInstance, setMsalInstance] = (0, import_react3.useState)(null);
+  const instanceRef = (0, import_react3.useRef)(null);
+  const { scopes = ["User.Read"], enableLogging = false } = config;
+  (0, import_react3.useEffect)(() => {
+    if (typeof window === "undefined") {
+      return;
+    }
+    if (instanceRef.current) {
+      return;
+    }
+    const initializeMsal = async () => {
+      try {
+        if (process.env.NODE_ENV === "development") {
+          const validationResult = validateConfig(config);
+          displayValidationResults(validationResult);
+        }
+        const msalConfig = createMsalConfig(config);
+        const instance = new import_msal_browser3.PublicClientApplication(msalConfig);
+        await instance.initialize();
+        try {
+          const response = await instance.handleRedirectPromise();
+          if (response) {
+            if (config.enableLogging) {
+              console.log("[MSAL] Redirect authentication successful");
+            }
+            if (response.account) {
+              instance.setActiveAccount(response.account);
+            }
+            if (window.location.hash) {
+              window.history.replaceState(null, "", window.location.pathname + window.location.search);
+            }
+          }
+        } catch (redirectError) {
+          const msalError = wrapMsalError(redirectError);
+          if (msalError.code === "no_token_request_cache_error") {
+            if (config.enableLogging) {
+              console.log("[MSAL] No pending redirect found (this is normal)");
+            }
+          } else if (msalError.isUserCancellation()) {
+            if (config.enableLogging) {
+              console.log("[MSAL] User cancelled authentication");
+            }
+          } else {
+            if (process.env.NODE_ENV === "development") {
+              console.error(msalError.toConsoleString());
+            } else {
+              console.error("[MSAL] Redirect handling error:", msalError.message);
+            }
+          }
+          if (window.location.hash && (window.location.hash.includes("code=") || window.location.hash.includes("error="))) {
+            window.history.replaceState(null, "", window.location.pathname + window.location.search);
+          }
+        }
+        const accounts = instance.getAllAccounts();
+        if (accounts.length > 0 && !instance.getActiveAccount()) {
+          instance.setActiveAccount(accounts[0]);
+        }
+        const loggingEnabled = config.enableLogging || false;
+        instance.addEventCallback((event) => {
+          if (event.eventType === import_msal_browser3.EventType.LOGIN_SUCCESS) {
+            const payload = event.payload;
+            if (payload?.account) {
+              instance.setActiveAccount(payload.account);
+            }
+            if (loggingEnabled) {
+              console.log("[MSAL] Login successful:", payload.account?.username);
+            }
+          }
+          if (event.eventType === import_msal_browser3.EventType.LOGIN_FAILURE) {
+            console.error("[MSAL] Login failed:", event.error);
+          }
+          if (event.eventType === import_msal_browser3.EventType.LOGOUT_SUCCESS) {
+            instance.setActiveAccount(null);
+            if (loggingEnabled) {
+              console.log("[MSAL] Logout successful");
+            }
+          }
+          if (event.eventType === import_msal_browser3.EventType.ACQUIRE_TOKEN_SUCCESS) {
+            const payload = event.payload;
+            if (payload?.account && !instance.getActiveAccount()) {
+              instance.setActiveAccount(payload.account);
+            }
+          }
+          if (event.eventType === import_msal_browser3.EventType.ACQUIRE_TOKEN_FAILURE) {
+            if (loggingEnabled) {
+              console.error("[MSAL] Token acquisition failed:", event.error);
+            }
+          }
+        });
+        instanceRef.current = instance;
+        globalMsalInstance = instance;
+        setMsalInstance(instance);
+        if (onInitialized) {
+          onInitialized(instance);
+        }
+      } catch (error) {
+        console.error("[MSAL] Initialization failed:", error);
+        throw error;
+      }
+    };
+    initializeMsal();
+  }, []);
+  if (typeof window === "undefined") {
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children: loadingComponent || /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { children: "Loading authentication..." }) });
+  }
+  if (!msalInstance) {
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children: loadingComponent || /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { children: "Loading authentication..." }) });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_msal_react2.MsalProvider, { instance: msalInstance, children: [
+    autoRefreshToken && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+      TokenRefreshManager,
+      {
+        enabled: autoRefreshToken,
+        refreshBeforeExpiry,
+        scopes,
+        enableLogging
+      }
+    ),
+    children
+  ] });
+}
+
+// src/components/MSALProvider.tsx
+var import_react4 = require("react");
+var import_jsx_runtime2 = require("react/jsx-runtime");
+var ProtectionConfigContext = (0, import_react4.createContext)(void 0);
+function MSALProvider({ children, protection, ...props }) {
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(ProtectionConfigContext.Provider, { value: protection, children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(MsalAuthProvider, { ...props, children }) });
+}
+
+// src/components/MicrosoftSignInButton.tsx
+var import_react5 = require("react");
+var import_jsx_runtime3 = require("react/jsx-runtime");
+function MicrosoftSignInButton({
+  text = "Sign in with Microsoft",
+  variant = "dark",
+  size = "medium",
+  scopes,
+  className = "",
+  style,
+  onSuccess,
+  onError
+}) {
+  const { loginRedirect, inProgress, isAuthenticated } = useMsalAuth();
+  const [isLoading, setIsLoading] = (0, import_react5.useState)(false);
+  const timeoutRef = (0, import_react5.useRef)(null);
+  (0, import_react5.useEffect)(() => {
+    return () => {
+      if (timeoutRef.current) {
+        clearTimeout(timeoutRef.current);
+      }
+    };
+  }, []);
+  (0, import_react5.useEffect)(() => {
+    if (isAuthenticated && isLoading) {
+      setIsLoading(false);
+    }
+  }, [isAuthenticated, isLoading]);
+  const handleClick = async () => {
+    if (inProgress || isLoading || isAuthenticated) {
+      return;
+    }
+    setIsLoading(true);
+    try {
+      await loginRedirect(scopes);
+      onSuccess?.();
+    } catch (error) {
+      onError?.(error);
+      setIsLoading(false);
+    }
+    timeoutRef.current = setTimeout(() => {
+      setIsLoading(false);
+    }, 3e3);
+  };
+  const sizeStyles = {
+    small: {
+      padding: "8px 16px",
+      fontSize: "14px",
+      height: "36px"
+    },
+    medium: {
+      padding: "10px 20px",
+      fontSize: "15px",
+      height: "41px"
+    },
+    large: {
+      padding: "12px 24px",
+      fontSize: "16px",
+      height: "48px"
+    }
+  };
+  const variantStyles = {
+    dark: {
+      backgroundColor: "#2F2F2F",
+      color: "#FFFFFF",
+      border: "1px solid #8C8C8C"
+    },
+    light: {
+      backgroundColor: "#FFFFFF",
+      color: "#5E5E5E",
+      border: "1px solid #8C8C8C"
+    }
+  };
+  const isDisabled = inProgress || isLoading;
+  const baseStyles = {
+    display: "inline-flex",
+    alignItems: "center",
+    justifyContent: "center",
+    gap: "12px",
+    fontFamily: '"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',
+    fontWeight: 600,
+    borderRadius: "2px",
+    cursor: isDisabled ? "not-allowed" : "pointer",
+    transition: "all 0.2s ease",
+    opacity: isDisabled ? 0.6 : 1,
+    ...variantStyles[variant],
+    ...sizeStyles[size],
+    ...style
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(
+    "button",
+    {
+      onClick: handleClick,
+      disabled: isDisabled,
+      className,
+      style: baseStyles,
+      "aria-label": text,
+      children: [
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(MicrosoftLogo, {}),
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { children: text })
+      ]
+    }
+  );
+}
+function MicrosoftLogo() {
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("svg", { width: "21", height: "21", viewBox: "0 0 21 21", fill: "none", xmlns: "http://www.w3.org/2000/svg", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("rect", { width: "10", height: "10", fill: "#F25022" }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("rect", { x: "11", width: "10", height: "10", fill: "#7FBA00" }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("rect", { y: "11", width: "10", height: "10", fill: "#00A4EF" }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("rect", { x: "11", y: "11", width: "10", height: "10", fill: "#FFB900" })
+  ] });
+}
+
+// src/components/SignOutButton.tsx
+var import_jsx_runtime4 = require("react/jsx-runtime");
+function SignOutButton({
+  text = "Sign out",
+  variant = "dark",
+  size = "medium",
+  className = "",
+  style,
+  onSuccess,
+  onError
+}) {
+  const { logoutRedirect, inProgress } = useMsalAuth();
+  const handleClick = async () => {
+    try {
+      await logoutRedirect();
+      onSuccess?.();
+    } catch (error) {
+      onError?.(error);
+    }
+  };
+  const sizeStyles = {
+    small: {
+      padding: "8px 16px",
+      fontSize: "14px",
+      height: "36px"
+    },
+    medium: {
+      padding: "10px 20px",
+      fontSize: "15px",
+      height: "41px"
+    },
+    large: {
+      padding: "12px 24px",
+      fontSize: "16px",
+      height: "48px"
+    }
+  };
+  const variantStyles = {
+    dark: {
+      backgroundColor: "#2F2F2F",
+      color: "#FFFFFF",
+      border: "1px solid #8C8C8C"
+    },
+    light: {
+      backgroundColor: "#FFFFFF",
+      color: "#5E5E5E",
+      border: "1px solid #8C8C8C"
+    }
+  };
+  const baseStyles = {
+    display: "inline-flex",
+    alignItems: "center",
+    justifyContent: "center",
+    gap: "12px",
+    fontFamily: '"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',
+    fontWeight: 600,
+    borderRadius: "2px",
+    cursor: inProgress ? "not-allowed" : "pointer",
+    transition: "all 0.2s ease",
+    opacity: inProgress ? 0.6 : 1,
+    ...variantStyles[variant],
+    ...sizeStyles[size],
+    ...style
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)(
+    "button",
+    {
+      onClick: handleClick,
+      disabled: inProgress,
+      className,
+      style: baseStyles,
+      "aria-label": text,
+      children: [
+        /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(MicrosoftLogo2, {}),
+        /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { children: text })
+      ]
+    }
+  );
+}
+function MicrosoftLogo2() {
+  return /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("svg", { width: "21", height: "21", viewBox: "0 0 21 21", fill: "none", xmlns: "http://www.w3.org/2000/svg", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("rect", { width: "10", height: "10", fill: "#F25022" }),
+    /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("rect", { x: "11", width: "10", height: "10", fill: "#7FBA00" }),
+    /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("rect", { y: "11", width: "10", height: "10", fill: "#00A4EF" }),
+    /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("rect", { x: "11", y: "11", width: "10", height: "10", fill: "#FFB900" })
+  ] });
+}
+
+// src/components/UserAvatar.tsx
+var import_react8 = require("react");
+
+// src/hooks/useUserProfile.ts
+var import_react7 = require("react");
+
+// src/hooks/useGraphApi.ts
+var import_react6 = require("react");
+function useGraphApi() {
+  const { acquireToken } = useMsalAuth();
+  const request = (0, import_react6.useCallback)(
+    async (endpoint, options = {}) => {
+      const {
+        scopes = ["User.Read"],
+        version = "v1.0",
+        debug = false,
+        ...fetchOptions
+      } = options;
+      try {
+        const token = await acquireToken(scopes);
+        const baseUrl = `https://graph.microsoft.com/${version}`;
+        const url = endpoint.startsWith("http") ? endpoint : `${baseUrl}${endpoint.startsWith("/") ? endpoint : `/${endpoint}`}`;
+        if (debug) {
+          console.log("[GraphAPI] Request:", { url, method: fetchOptions.method || "GET" });
+        }
+        const response = await fetch(url, {
+          ...fetchOptions,
+          headers: {
+            "Authorization": `Bearer ${token}`,
+            "Content-Type": "application/json",
+            ...fetchOptions.headers
+          }
+        });
+        if (!response.ok) {
+          const errorText = await response.text();
+          const errorMessage = `Graph API error (${response.status}): ${errorText}`;
+          throw new Error(errorMessage);
+        }
+        if (response.status === 204 || response.headers.get("content-length") === "0") {
+          return null;
+        }
+        const data = await response.json();
+        if (debug) {
+          console.log("[GraphAPI] Response:", data);
+        }
+        return data;
+      } catch (error) {
+        const sanitizedMessage = sanitizeError(error);
+        console.error("[GraphAPI] Request failed:", sanitizedMessage);
+        throw new Error(sanitizedMessage);
+      }
+    },
+    [acquireToken]
+  );
+  const get = (0, import_react6.useCallback)(
+    (endpoint, options = {}) => {
+      return request(endpoint, { ...options, method: "GET" });
+    },
+    [request]
+  );
+  const post = (0, import_react6.useCallback)(
+    (endpoint, body, options = {}) => {
+      return request(endpoint, {
+        ...options,
+        method: "POST",
+        body: body ? JSON.stringify(body) : void 0
+      });
+    },
+    [request]
+  );
+  const put = (0, import_react6.useCallback)(
+    (endpoint, body, options = {}) => {
+      return request(endpoint, {
+        ...options,
+        method: "PUT",
+        body: body ? JSON.stringify(body) : void 0
+      });
+    },
+    [request]
+  );
+  const patch = (0, import_react6.useCallback)(
+    (endpoint, body, options = {}) => {
+      return request(endpoint, {
+        ...options,
+        method: "PATCH",
+        body: body ? JSON.stringify(body) : void 0
+      });
+    },
+    [request]
+  );
+  const deleteRequest = (0, import_react6.useCallback)(
+    (endpoint, options = {}) => {
+      return request(endpoint, { ...options, method: "DELETE" });
+    },
+    [request]
+  );
+  return {
+    get,
+    post,
+    put,
+    patch,
+    delete: deleteRequest,
+    request
+  };
+}
+
+// src/hooks/useUserProfile.ts
+var profileCache = /* @__PURE__ */ new Map();
+var CACHE_DURATION = 5 * 60 * 1e3;
+var MAX_CACHE_SIZE = 100;
+function enforceCacheLimit() {
+  if (profileCache.size > MAX_CACHE_SIZE) {
+    const entries = Array.from(profileCache.entries());
+    entries.sort((a, b) => a[1].timestamp - b[1].timestamp);
+    const toRemove = entries.slice(0, profileCache.size - MAX_CACHE_SIZE);
+    toRemove.forEach(([key]) => {
+      const cached = profileCache.get(key);
+      if (cached?.data.photo) {
+        URL.revokeObjectURL(cached.data.photo);
+      }
+      profileCache.delete(key);
+    });
+  }
+}
+function useUserProfile() {
+  const { isAuthenticated, account } = useMsalAuth();
+  const graph = useGraphApi();
+  const [profile, setProfile] = (0, import_react7.useState)(null);
+  const [loading, setLoading] = (0, import_react7.useState)(false);
+  const [error, setError] = (0, import_react7.useState)(null);
+  const fetchProfile = (0, import_react7.useCallback)(async () => {
+    if (!isAuthenticated || !account) {
+      setProfile(null);
+      return;
+    }
+    const cacheKey = account.homeAccountId;
+    const cached = profileCache.get(cacheKey);
+    if (cached && Date.now() - cached.timestamp < CACHE_DURATION) {
+      setProfile(cached.data);
+      return;
+    }
+    setLoading(true);
+    setError(null);
+    try {
+      const userData = await graph.get("/me", {
+        scopes: ["User.Read"]
+      });
+      let photoUrl;
+      try {
+        const photoBlob = await graph.get("/me/photo/$value", {
+          scopes: ["User.Read"],
+          headers: {
+            "Content-Type": "image/jpeg"
+          }
+        });
+        if (photoBlob) {
+          photoUrl = URL.createObjectURL(photoBlob);
+        }
+      } catch (photoError) {
+        console.debug("[UserProfile] Photo not available");
+      }
+      const profileData = {
+        id: userData.id,
+        displayName: userData.displayName,
+        givenName: userData.givenName,
+        surname: userData.surname,
+        userPrincipalName: userData.userPrincipalName,
+        mail: userData.mail,
+        jobTitle: userData.jobTitle,
+        department: userData.department,
+        companyName: userData.companyName,
+        officeLocation: userData.officeLocation,
+        mobilePhone: userData.mobilePhone,
+        businessPhones: userData.businessPhones,
+        preferredLanguage: userData.preferredLanguage,
+        employeeId: userData.employeeId,
+        employeeHireDate: userData.employeeHireDate,
+        employeeType: userData.employeeType,
+        country: userData.country,
+        city: userData.city,
+        state: userData.state,
+        streetAddress: userData.streetAddress,
+        postalCode: userData.postalCode,
+        usageLocation: userData.usageLocation,
+        manager: userData.manager,
+        aboutMe: userData.aboutMe,
+        birthday: userData.birthday,
+        interests: userData.interests,
+        skills: userData.skills,
+        schools: userData.schools,
+        pastProjects: userData.pastProjects,
+        responsibilities: userData.responsibilities,
+        mySite: userData.mySite,
+        faxNumber: userData.faxNumber,
+        accountEnabled: userData.accountEnabled,
+        ageGroup: userData.ageGroup,
+        userType: userData.userType,
+        photo: photoUrl,
+        ...userData
+        // Include any additional fields from the API
+      };
+      profileCache.set(cacheKey, {
+        data: profileData,
+        timestamp: Date.now()
+      });
+      enforceCacheLimit();
+      setProfile(profileData);
+    } catch (err) {
+      const error2 = err;
+      const sanitizedMessage = sanitizeError(error2);
+      const sanitizedError = new Error(sanitizedMessage);
+      setError(sanitizedError);
+      console.error("[UserProfile] Failed to fetch profile:", sanitizedMessage);
+    } finally {
+      setLoading(false);
+    }
+  }, [isAuthenticated, account, graph]);
+  const clearCache = (0, import_react7.useCallback)(() => {
+    if (account) {
+      const cached = profileCache.get(account.homeAccountId);
+      if (cached?.data.photo) {
+        URL.revokeObjectURL(cached.data.photo);
+      }
+      profileCache.delete(account.homeAccountId);
+    }
+    if (profile?.photo) {
+      URL.revokeObjectURL(profile.photo);
+    }
+    setProfile(null);
+  }, [account, profile]);
+  (0, import_react7.useEffect)(() => {
+    fetchProfile();
+    return () => {
+      if (profile?.photo) {
+        URL.revokeObjectURL(profile.photo);
+      }
+    };
+  }, [fetchProfile]);
+  (0, import_react7.useEffect)(() => {
+    return () => {
+      if (profile?.photo) {
+        URL.revokeObjectURL(profile.photo);
+      }
+    };
+  }, [profile?.photo]);
+  return {
+    profile,
+    loading,
+    error,
+    refetch: fetchProfile,
+    clearCache
+  };
+}
+
+// src/components/UserAvatar.tsx
+var import_jsx_runtime5 = require("react/jsx-runtime");
+function UserAvatar({
+  size = 40,
+  className = "",
+  style,
+  showTooltip = true,
+  fallbackImage
+}) {
+  const { profile, loading } = useUserProfile();
+  const [photoUrl, setPhotoUrl] = (0, import_react8.useState)(null);
+  const [photoError, setPhotoError] = (0, import_react8.useState)(false);
+  (0, import_react8.useEffect)(() => {
+    if (profile?.photo) {
+      setPhotoUrl(profile.photo);
+    }
+  }, [profile?.photo]);
+  const getInitials = () => {
+    if (!profile) return "?";
+    const { givenName, surname, displayName: displayName2 } = profile;
+    if (givenName && surname) {
+      return `${givenName[0]}${surname[0]}`.toUpperCase();
+    }
+    if (displayName2) {
+      const parts = displayName2.split(" ");
+      if (parts.length >= 2) {
+        return `${parts[0][0]}${parts[parts.length - 1][0]}`.toUpperCase();
+      }
+      return displayName2.substring(0, 2).toUpperCase();
+    }
+    return "?";
+  };
+  const baseStyles = {
+    width: `${size}px`,
+    height: `${size}px`,
+    borderRadius: "50%",
+    display: "inline-flex",
+    alignItems: "center",
+    justifyContent: "center",
+    fontSize: `${size * 0.4}px`,
+    fontWeight: 600,
+    fontFamily: '"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',
+    backgroundColor: "#0078D4",
+    color: "#FFFFFF",
+    overflow: "hidden",
+    userSelect: "none",
+    ...style
+  };
+  const displayName = profile?.displayName || "User";
+  if (loading) {
+    return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
+      "div",
+      {
+        className,
+        style: { ...baseStyles, backgroundColor: "#E1E1E1" },
+        "aria-label": "Loading user avatar",
+        children: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("span", { style: { fontSize: `${size * 0.3}px` }, children: "..." })
+      }
+    );
+  }
+  if (photoUrl && !photoError) {
+    return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
+      "div",
+      {
+        className,
+        style: baseStyles,
+        title: showTooltip ? displayName : void 0,
+        "aria-label": `${displayName} avatar`,
+        children: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
+          "img",
+          {
+            src: photoUrl,
+            alt: displayName,
+            style: { width: "100%", height: "100%", objectFit: "cover" },
+            onError: () => {
+              setPhotoError(true);
+              if (fallbackImage) {
+                setPhotoUrl(fallbackImage);
+              }
+            }
+          }
+        )
+      }
+    );
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
+    "div",
+    {
+      className,
+      style: baseStyles,
+      title: showTooltip ? displayName : void 0,
+      "aria-label": `${displayName} avatar`,
+      children: getInitials()
+    }
+  );
+}
+
+// src/components/AuthStatus.tsx
+var import_jsx_runtime6 = require("react/jsx-runtime");
+function AuthStatus({
+  className = "",
+  style,
+  showDetails = false,
+  renderLoading,
+  renderAuthenticated,
+  renderUnauthenticated
+}) {
+  const { isAuthenticated, inProgress, account } = useMsalAuth();
+  const baseStyles = {
+    display: "inline-flex",
+    alignItems: "center",
+    gap: "8px",
+    padding: "8px 12px",
+    borderRadius: "4px",
+    fontFamily: '"Segoe UI", Tahoma, Geneva, Verdana, sans-serif',
+    fontSize: "14px",
+    fontWeight: 500,
+    ...style
+  };
+  if (inProgress) {
+    if (renderLoading) {
+      return /* @__PURE__ */ (0, import_jsx_runtime6.jsx)(import_jsx_runtime6.Fragment, { children: renderLoading() });
+    }
+    return /* @__PURE__ */ (0, import_jsx_runtime6.jsxs)(
+      "div",
+      {
+        className,
+        style: { ...baseStyles, backgroundColor: "#FFF4CE", color: "#8A6D3B" },
+        role: "status",
+        "aria-live": "polite",
+        children: [
+          /* @__PURE__ */ (0, import_jsx_runtime6.jsx)(StatusIndicator, { color: "#FFA500" }),
+          /* @__PURE__ */ (0, import_jsx_runtime6.jsx)("span", { children: "Loading..." })
+        ]
+      }
+    );
+  }
+  if (isAuthenticated) {
+    const username = account?.username || account?.name || "User";
+    if (renderAuthenticated) {
+      return /* @__PURE__ */ (0, import_jsx_runtime6.jsx)(import_jsx_runtime6.Fragment, { children: renderAuthenticated(username) });
+    }
+    return /* @__PURE__ */ (0, import_jsx_runtime6.jsxs)(
+      "div",
+      {
+        className,
+        style: { ...baseStyles, backgroundColor: "#D4EDDA", color: "#155724" },
+        role: "status",
+        "aria-live": "polite",
+        children: [
+          /* @__PURE__ */ (0, import_jsx_runtime6.jsx)(StatusIndicator, { color: "#28A745" }),
+          /* @__PURE__ */ (0, import_jsx_runtime6.jsx)("span", { children: showDetails ? `Authenticated as ${username}` : "Authenticated" })
+        ]
+      }
+    );
+  }
+  if (renderUnauthenticated) {
+    return /* @__PURE__ */ (0, import_jsx_runtime6.jsx)(import_jsx_runtime6.Fragment, { children: renderUnauthenticated() });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime6.jsxs)(
+    "div",
+    {
+      className,
+      style: { ...baseStyles, backgroundColor: "#F8D7DA", color: "#721C24" },
+      role: "status",
+      "aria-live": "polite",
+      children: [
+        /* @__PURE__ */ (0, import_jsx_runtime6.jsx)(StatusIndicator, { color: "#DC3545" }),
+        /* @__PURE__ */ (0, import_jsx_runtime6.jsx)("span", { children: "Not authenticated" })
+      ]
+    }
+  );
+}
+function StatusIndicator({ color }) {
+  return /* @__PURE__ */ (0, import_jsx_runtime6.jsx)("svg", { width: "8", height: "8", viewBox: "0 0 8 8", fill: "none", xmlns: "http://www.w3.org/2000/svg", children: /* @__PURE__ */ (0, import_jsx_runtime6.jsx)("circle", { cx: "4", cy: "4", r: "4", fill: color }) });
+}
+
+// src/components/AuthGuard.tsx
+var import_react9 = require("react");
+var import_jsx_runtime7 = require("react/jsx-runtime");
+function AuthGuard({
+  children,
+  loadingComponent,
+  fallbackComponent,
+  scopes,
+  onAuthRequired
+}) {
+  const { isAuthenticated, inProgress, loginRedirect } = useMsalAuth();
+  (0, import_react9.useEffect)(() => {
+    if (!isAuthenticated && !inProgress) {
+      onAuthRequired?.();
+      const login = async () => {
+        try {
+          await loginRedirect(scopes);
+        } catch (error) {
+          console.error("[AuthGuard] Authentication failed:", error);
+        }
+      };
+      login();
+    }
+  }, [isAuthenticated, inProgress, scopes, loginRedirect, onAuthRequired]);
+  if (inProgress) {
+    return /* @__PURE__ */ (0, import_jsx_runtime7.jsx)(import_jsx_runtime7.Fragment, { children: loadingComponent || /* @__PURE__ */ (0, import_jsx_runtime7.jsx)("div", { children: "Authenticating..." }) });
+  }
+  if (!isAuthenticated) {
+    return /* @__PURE__ */ (0, import_jsx_runtime7.jsx)(import_jsx_runtime7.Fragment, { children: fallbackComponent || /* @__PURE__ */ (0, import_jsx_runtime7.jsx)("div", { children: "Redirecting to login..." }) });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime7.jsx)(import_jsx_runtime7.Fragment, { children });
+}
+
+// src/components/ErrorBoundary.tsx
+var import_react10 = require("react");
+var import_jsx_runtime8 = require("react/jsx-runtime");
+var ErrorBoundary = class extends import_react10.Component {
+  constructor(props) {
+    super(props);
+    this.reset = () => {
+      this.setState({
+        hasError: false,
+        error: null
+      });
+    };
+    this.state = {
+      hasError: false,
+      error: null
+    };
+  }
+  static getDerivedStateFromError(error) {
+    return {
+      hasError: true,
+      error
+    };
+  }
+  componentDidCatch(error, errorInfo) {
+    const { onError, debug } = this.props;
+    if (debug) {
+      console.error("[ErrorBoundary] Caught error:", error);
+      console.error("[ErrorBoundary] Error info:", errorInfo);
+    }
+    onError?.(error, errorInfo);
+  }
+  render() {
+    const { hasError, error } = this.state;
+    const { children, fallback } = this.props;
+    if (hasError && error) {
+      if (fallback) {
+        return fallback(error, this.reset);
+      }
+      return /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)(
+        "div",
+        {
+          style: {
+            padding: "20px",
+            margin: "20px",
+            border: "1px solid #DC3545",
+            borderRadius: "4px",
+            backgroundColor: "#F8D7DA",
+            color: "#721C24",
+            fontFamily: '"Segoe UI", Tahoma, Geneva, Verdana, sans-serif'
+          },
+          children: [
+            /* @__PURE__ */ (0, import_jsx_runtime8.jsx)("h2", { style: { margin: "0 0 10px 0", fontSize: "18px" }, children: "Authentication Error" }),
+            /* @__PURE__ */ (0, import_jsx_runtime8.jsx)("p", { style: { margin: "0 0 10px 0" }, children: error.message }),
+            /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(
+              "button",
+              {
+                onClick: this.reset,
+                style: {
+                  padding: "8px 16px",
+                  backgroundColor: "#DC3545",
+                  color: "#FFFFFF",
+                  border: "none",
+                  borderRadius: "4px",
+                  cursor: "pointer",
+                  fontSize: "14px",
+                  fontWeight: 600
+                },
+                children: "Try Again"
+              }
+            )
+          ]
+        }
+      );
+    }
+    return children;
+  }
+};
+
+// src/hooks/useRoles.ts
+var import_react11 = require("react");
+var rolesCache = /* @__PURE__ */ new Map();
+var CACHE_DURATION2 = 5 * 60 * 1e3;
+var MAX_CACHE_SIZE2 = 100;
+function clearRolesCache(accountId) {
+  if (accountId) {
+    rolesCache.delete(accountId);
+  } else {
+    rolesCache.clear();
+  }
+}
+function enforceCacheLimit2() {
+  if (rolesCache.size > MAX_CACHE_SIZE2) {
+    const entries = Array.from(rolesCache.entries());
+    entries.sort((a, b) => a[1].timestamp - b[1].timestamp);
+    const toRemove = entries.slice(0, rolesCache.size - MAX_CACHE_SIZE2);
+    toRemove.forEach(([key]) => rolesCache.delete(key));
+  }
+}
+function useRoles() {
+  const { isAuthenticated, account } = useMsalAuth();
+  const graph = useGraphApi();
+  const [roles, setRoles] = (0, import_react11.useState)([]);
+  const [groups, setGroups] = (0, import_react11.useState)([]);
+  const [loading, setLoading] = (0, import_react11.useState)(false);
+  const [error, setError] = (0, import_react11.useState)(null);
+  const fetchRolesAndGroups = (0, import_react11.useCallback)(async () => {
+    if (!isAuthenticated || !account) {
+      setRoles([]);
+      setGroups([]);
+      return;
+    }
+    const cacheKey = account.homeAccountId;
+    const cached = rolesCache.get(cacheKey);
+    if (cached && Date.now() - cached.timestamp < CACHE_DURATION2) {
+      setRoles(cached.roles);
+      setGroups(cached.groups);
+      return;
+    }
+    setLoading(true);
+    setError(null);
+    try {
+      const idTokenClaims = account.idTokenClaims;
+      const tokenRoles = idTokenClaims?.roles || [];
+      const groupsResponse = await graph.get("/me/memberOf", {
+        scopes: ["User.Read", "Directory.Read.All"]
+      });
+      const userGroups = groupsResponse.value.map((group) => group.id);
+      rolesCache.set(cacheKey, {
+        roles: tokenRoles,
+        groups: userGroups,
+        timestamp: Date.now()
+      });
+      enforceCacheLimit2();
+      setRoles(tokenRoles);
+      setGroups(userGroups);
+    } catch (err) {
+      const error2 = err;
+      const sanitizedMessage = sanitizeError(error2);
+      const sanitizedError = new Error(sanitizedMessage);
+      setError(sanitizedError);
+      console.error("[Roles] Failed to fetch roles/groups:", sanitizedMessage);
+      const idTokenClaims = account.idTokenClaims;
+      const tokenRoles = idTokenClaims?.roles || [];
+      setRoles(tokenRoles);
+    } finally {
+      setLoading(false);
+    }
+  }, [isAuthenticated, account, graph]);
+  const hasRole = (0, import_react11.useCallback)(
+    (role) => {
+      return roles.includes(role);
+    },
+    [roles]
+  );
+  const hasGroup = (0, import_react11.useCallback)(
+    (groupId) => {
+      return groups.includes(groupId);
+    },
+    [groups]
+  );
+  const hasAnyRole = (0, import_react11.useCallback)(
+    (checkRoles) => {
+      return checkRoles.some((role) => roles.includes(role));
+    },
+    [roles]
+  );
+  const hasAllRoles = (0, import_react11.useCallback)(
+    (checkRoles) => {
+      return checkRoles.every((role) => roles.includes(role));
+    },
+    [roles]
+  );
+  (0, import_react11.useEffect)(() => {
+    fetchRolesAndGroups();
+    return () => {
+      if (account) {
+        clearRolesCache(account.homeAccountId);
+      }
+    };
+  }, [fetchRolesAndGroups, account]);
+  return {
+    roles,
+    groups,
+    loading,
+    error,
+    hasRole,
+    hasGroup,
+    hasAnyRole,
+    hasAllRoles,
+    refetch: fetchRolesAndGroups
+  };
+}
+
+// src/utils/withAuth.tsx
+var import_jsx_runtime9 = require("react/jsx-runtime");
+function withAuth(Component2, options = {}) {
+  const { displayName, ...guardProps } = options;
+  const WrappedComponent = (props) => {
+    return /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(AuthGuard, { ...guardProps, children: /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Component2, { ...props }) });
+  };
+  WrappedComponent.displayName = displayName || `withAuth(${Component2.displayName || Component2.name || "Component"})`;
+  return WrappedComponent;
+}
+
+// src/utils/tokenRetry.ts
+async function retryWithBackoff(fn, config = {}) {
+  const {
+    maxRetries = 3,
+    initialDelay = 1e3,
+    maxDelay = 1e4,
+    backoffMultiplier = 2,
+    debug = false
+  } = config;
+  let lastError;
+  let delay = initialDelay;
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    try {
+      if (debug && attempt > 0) {
+        console.log(`[TokenRetry] Attempt ${attempt + 1}/${maxRetries + 1}`);
+      }
+      return await fn();
+    } catch (error) {
+      lastError = error;
+      if (attempt === maxRetries) {
+        if (debug) {
+          console.error("[TokenRetry] All retry attempts failed");
+        }
+        break;
+      }
+      if (!isRetryableError(error)) {
+        if (debug) {
+          console.log("[TokenRetry] Non-retryable error, aborting");
+        }
+        throw error;
+      }
+      if (debug) {
+        console.warn(`[TokenRetry] Attempt ${attempt + 1} failed, retrying in ${delay}ms...`);
+      }
+      await sleep(delay);
+      delay = Math.min(delay * backoffMultiplier, maxDelay);
+    }
+  }
+  throw lastError;
+}
+function isRetryableError(error) {
+  const message = error.message.toLowerCase();
+  if (message.includes("network") || message.includes("timeout") || message.includes("fetch") || message.includes("connection")) {
+    return true;
+  }
+  if (message.includes("500") || message.includes("502") || message.includes("503")) {
+    return true;
+  }
+  if (message.includes("429") || message.includes("rate limit")) {
+    return true;
+  }
+  if (message.includes("token") && message.includes("expired")) {
+    return true;
+  }
+  return false;
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function createRetryWrapper(fn, config = {}) {
+  return (...args) => {
+    return retryWithBackoff(() => fn(...args), config);
+  };
+}
+
+// src/utils/debugLogger.ts
+var DebugLogger = class {
+  constructor(config = {}) {
+    this.logHistory = [];
+    this.performanceTimings = /* @__PURE__ */ new Map();
+    this.config = {
+      enabled: config.enabled ?? false,
+      prefix: config.prefix ?? "[MSAL-Next]",
+      showTimestamp: config.showTimestamp ?? true,
+      level: config.level ?? "info",
+      enablePerformance: config.enablePerformance ?? false,
+      enableNetworkLogs: config.enableNetworkLogs ?? false,
+      maxHistorySize: config.maxHistorySize ?? 100
+    };
+  }
+  shouldLog(level) {
+    if (!this.config.enabled) return false;
+    const levels = ["error", "warn", "info", "debug"];
+    const currentLevelIndex = levels.indexOf(this.config.level);
+    const messageLevelIndex = levels.indexOf(level);
+    return messageLevelIndex <= currentLevelIndex;
+  }
+  formatMessage(level, message, data) {
+    const timestamp = this.config.showTimestamp ? `[${(/* @__PURE__ */ new Date()).toISOString()}]` : "";
+    const prefix = this.config.prefix;
+    const levelStr = `[${level.toUpperCase()}]`;
+    let formatted = `${timestamp} ${prefix} ${levelStr} ${message}`;
+    if (data !== void 0) {
+      formatted += "\n" + JSON.stringify(data, null, 2);
+    }
+    return formatted;
+  }
+  addToHistory(level, message, data) {
+    if (this.logHistory.length >= this.config.maxHistorySize) {
+      this.logHistory.shift();
+    }
+    this.logHistory.push({
+      timestamp: Date.now(),
+      level,
+      message,
+      data
+    });
+  }
+  error(message, data) {
+    if (this.shouldLog("error")) {
+      console.error(this.formatMessage("error", message, data));
+      this.addToHistory("error", message, data);
+    }
+  }
+  warn(message, data) {
+    if (this.shouldLog("warn")) {
+      console.warn(this.formatMessage("warn", message, data));
+      this.addToHistory("warn", message, data);
+    }
+  }
+  info(message, data) {
+    if (this.shouldLog("info")) {
+      console.info(this.formatMessage("info", message, data));
+      this.addToHistory("info", message, data);
+    }
+  }
+  debug(message, data) {
+    if (this.shouldLog("debug")) {
+      console.debug(this.formatMessage("debug", message, data));
+      this.addToHistory("debug", message, data);
+    }
+  }
+  group(label) {
+    if (this.config.enabled) {
+      console.group(`${this.config.prefix} ${label}`);
+    }
+  }
+  groupEnd() {
+    if (this.config.enabled) {
+      console.groupEnd();
+    }
+  }
+  /**
+   * Start performance timing for an operation
+   */
+  startTiming(operation) {
+    if (this.config.enablePerformance) {
+      this.performanceTimings.set(operation, {
+        operation,
+        startTime: performance.now()
+      });
+      this.debug(`\u23F1\uFE0F Started: ${operation}`);
+    }
+  }
+  /**
+   * End performance timing for an operation
+   */
+  endTiming(operation) {
+    if (this.config.enablePerformance) {
+      const timing = this.performanceTimings.get(operation);
+      if (timing) {
+        timing.endTime = performance.now();
+        timing.duration = timing.endTime - timing.startTime;
+        this.info(`\u23F1\uFE0F Completed: ${operation} (${timing.duration.toFixed(2)}ms)`);
+        return timing.duration;
+      }
+    }
+    return void 0;
+  }
+  /**
+   * Log network request
+   */
+  logRequest(method, url, options) {
+    if (this.config.enableNetworkLogs) {
+      this.debug(`\u{1F310} ${method} ${url}`, options);
+    }
+  }
+  /**
+   * Log network response
+   */
+  logResponse(method, url, status, data) {
+    if (this.config.enableNetworkLogs) {
+      const statusEmoji = status >= 200 && status < 300 ? "\u2705" : "\u274C";
+      this.debug(`${statusEmoji} ${method} ${url} - ${status}`, data);
+    }
+  }
+  /**
+   * Get log history
+   */
+  getHistory() {
+    return [...this.logHistory];
+  }
+  /**
+   * Get performance timings
+   */
+  getPerformanceTimings() {
+    return Array.from(this.performanceTimings.values());
+  }
+  /**
+   * Clear log history
+   */
+  clearHistory() {
+    this.logHistory = [];
+  }
+  /**
+   * Clear performance timings
+   */
+  clearTimings() {
+    this.performanceTimings.clear();
+  }
+  /**
+   * Export logs as JSON
+   */
+  exportLogs() {
+    return JSON.stringify({
+      config: this.config,
+      history: this.logHistory,
+      performanceTimings: Array.from(this.performanceTimings.values()),
+      exportedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }, null, 2);
+  }
+  /**
+   * Download logs as a file
+   */
+  downloadLogs(filename = "msal-next-debug-logs.json") {
+    if (typeof window === "undefined") return;
+    const logs = this.exportLogs();
+    const blob = new Blob([logs], { type: "application/json" });
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement("a");
+    a.href = url;
+    a.download = filename;
+    a.click();
+    URL.revokeObjectURL(url);
+  }
+  setEnabled(enabled) {
+    this.config.enabled = enabled;
+  }
+  setLevel(level) {
+    if (level) {
+      this.config.level = level;
+    }
+  }
+};
+var globalLogger = null;
+function getDebugLogger(config) {
+  if (!globalLogger) {
+    globalLogger = new DebugLogger(config);
+  } else if (config) {
+    if (config.enabled !== void 0) {
+      globalLogger.setEnabled(config.enabled);
+    }
+    if (config.level) {
+      globalLogger.setLevel(config.level);
+    }
+  }
+  return globalLogger;
+}
+function createScopedLogger(scope, config) {
+  return new DebugLogger({
+    ...config,
+    prefix: `[MSAL-Next:${scope}]`
+  });
+}
+
+// src/protection/ProtectedPage.tsx
+var import_react12 = require("react");
+var import_navigation = require("next/navigation");
+var import_jsx_runtime10 = require("react/jsx-runtime");
+function ProtectedPage({
+  children,
+  config,
+  defaultRedirectTo = "/login",
+  defaultLoading,
+  defaultUnauthorized,
+  debug = false
+}) {
+  const router = (0, import_navigation.useRouter)();
+  const { isAuthenticated, account, inProgress } = useMsalAuth();
+  const [isValidating, setIsValidating] = (0, import_react12.useState)(true);
+  const [isAuthorized, setIsAuthorized] = (0, import_react12.useState)(false);
+  (0, import_react12.useEffect)(() => {
+    async function checkAuth() {
+      if (debug) {
+        console.log("[ProtectedPage] Checking auth...", {
+          isAuthenticated,
+          inProgress,
+          config
+        });
+      }
+      if (inProgress) {
+        return;
+      }
+      if (!config.required) {
+        setIsAuthorized(true);
+        setIsValidating(false);
+        return;
+      }
+      if (!isAuthenticated || !account) {
+        if (debug) {
+          console.log("[ProtectedPage] Not authenticated, redirecting...");
+        }
+        const redirectPath = config.redirectTo || defaultRedirectTo;
+        const returnUrl = encodeURIComponent(window.location.pathname + window.location.search);
+        router.push(`${redirectPath}?returnUrl=${returnUrl}`);
+        return;
+      }
+      if (config.roles && config.roles.length > 0) {
+        const userRoles = account.idTokenClaims?.roles || [];
+        const hasRequiredRole = config.roles.some((role) => userRoles.includes(role));
+        if (!hasRequiredRole) {
+          if (debug) {
+            console.log("[ProtectedPage] Missing required role", {
+              required: config.roles,
+              user: userRoles
+            });
+          }
+          setIsAuthorized(false);
+          setIsValidating(false);
+          return;
+        }
+      }
+      if (config.validate) {
+        try {
+          const isValid = await config.validate(account);
+          if (!isValid) {
+            if (debug) {
+              console.log("[ProtectedPage] Custom validation failed");
+            }
+            setIsAuthorized(false);
+            setIsValidating(false);
+            return;
+          }
+        } catch (error) {
+          console.error("[ProtectedPage] Validation error:", error);
+          setIsAuthorized(false);
+          setIsValidating(false);
+          return;
+        }
+      }
+      if (debug) {
+        console.log("[ProtectedPage] Authorization successful");
+      }
+      setIsAuthorized(true);
+      setIsValidating(false);
+    }
+    checkAuth();
+  }, [isAuthenticated, account, inProgress, config, router, defaultRedirectTo, debug]);
+  if (isValidating || inProgress) {
+    if (config.loading) {
+      return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_jsx_runtime10.Fragment, { children: config.loading });
+    }
+    if (defaultLoading) {
+      return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_jsx_runtime10.Fragment, { children: defaultLoading });
+    }
+    return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("div", { className: "flex items-center justify-center min-h-screen", children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("div", { className: "animate-spin rounded-full h-12 w-12 border-b-2 border-blue-600" }) });
+  }
+  if (!isAuthorized) {
+    if (config.unauthorized) {
+      return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_jsx_runtime10.Fragment, { children: config.unauthorized });
+    }
+    if (defaultUnauthorized) {
+      return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_jsx_runtime10.Fragment, { children: defaultUnauthorized });
+    }
+    return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("div", { className: "flex items-center justify-center min-h-screen", children: /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("div", { className: "text-center", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("h1", { className: "text-2xl font-bold text-gray-900 mb-2", children: "Access Denied" }),
+      /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("p", { className: "text-gray-600", children: "You don't have permission to access this page." })
+    ] }) });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_jsx_runtime10.Fragment, { children });
+}
+
+// src/protection/withPageAuth.tsx
+var import_jsx_runtime11 = require("react/jsx-runtime");
+function withPageAuth(Component2, authConfig, globalConfig) {
+  const WrappedComponent = (props) => {
+    return /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
+      ProtectedPage,
+      {
+        config: authConfig,
+        defaultRedirectTo: globalConfig?.defaultRedirectTo,
+        defaultLoading: globalConfig?.defaultLoading,
+        defaultUnauthorized: globalConfig?.defaultUnauthorized,
+        debug: globalConfig?.debug,
+        children: /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Component2, { ...props })
+      }
+    );
+  };
+  WrappedComponent.displayName = `withPageAuth(${Component2.displayName || Component2.name || "Component"})`;
+  return WrappedComponent;
+}
+
+// src/middleware/createAuthMiddleware.ts
+var import_server = require("next/server");
+function createAuthMiddleware(config = {}) {
+  const {
+    protectedRoutes = [],
+    publicOnlyRoutes = [],
+    loginPath = "/login",
+    redirectAfterLogin = "/",
+    sessionCookie = "msal.account",
+    isAuthenticated: customAuthCheck,
+    debug = false
+  } = config;
+  return async function authMiddleware(request) {
+    const { pathname } = request.nextUrl;
+    if (debug) {
+      console.log("[AuthMiddleware] Processing:", pathname);
+    }
+    let authenticated = false;
+    if (customAuthCheck) {
+      authenticated = await customAuthCheck(request);
+    } else {
+      const sessionData = request.cookies.get(sessionCookie);
+      authenticated = !!sessionData?.value;
+    }
+    if (debug) {
+      console.log("[AuthMiddleware] Authenticated:", authenticated);
+    }
+    const isProtectedRoute = protectedRoutes.some(
+      (route) => pathname.startsWith(route)
+    );
+    const isPublicOnlyRoute = publicOnlyRoutes.some(
+      (route) => pathname.startsWith(route)
+    );
+    if (isProtectedRoute && !authenticated) {
+      if (debug) {
+        console.log("[AuthMiddleware] Redirecting to login");
+      }
+      const url = request.nextUrl.clone();
+      url.pathname = loginPath;
+      url.searchParams.set("returnUrl", pathname);
+      return import_server.NextResponse.redirect(url);
+    }
+    if (isPublicOnlyRoute && authenticated) {
+      if (debug) {
+        console.log("[AuthMiddleware] Redirecting to home");
+      }
+      const returnUrl = request.nextUrl.searchParams.get("returnUrl");
+      const url = request.nextUrl.clone();
+      url.pathname = returnUrl || redirectAfterLogin;
+      url.searchParams.delete("returnUrl");
+      return import_server.NextResponse.redirect(url);
+    }
+    const response = import_server.NextResponse.next();
+    if (authenticated) {
+      response.headers.set("x-msal-authenticated", "true");
+      try {
+        const sessionData = request.cookies.get(sessionCookie);
+        if (sessionData?.value) {
+          const account = safeJsonParse(sessionData.value, isValidAccountData);
+          if (account?.username) {
+            response.headers.set("x-msal-username", account.username);
+          }
+        }
+      } catch (error) {
+        if (debug) {
+          console.warn("[AuthMiddleware] Failed to parse session data");
+        }
+      }
+    }
+    return response;
+  };
+}
+
+// src/client.ts
+var import_msal_react3 = require("@azure/msal-react");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AuthGuard,
+  AuthStatus,
+  ErrorBoundary,
+  MSALProvider,
+  MicrosoftSignInButton,
+  MsalAuthProvider,
+  MsalError,
+  ProtectedPage,
+  SignOutButton,
+  UserAvatar,
+  createAuthMiddleware,
+  createMissingEnvVarError,
+  createMsalConfig,
+  createRetryWrapper,
+  createScopedLogger,
+  displayValidationResults,
+  getDebugLogger,
+  getMsalInstance,
+  isValidAccountData,
+  isValidRedirectUri,
+  isValidScope,
+  retryWithBackoff,
+  safeJsonParse,
+  sanitizeError,
+  useAccount,
+  useGraphApi,
+  useIsAuthenticated,
+  useMsal,
+  useMsalAuth,
+  useRoles,
+  useTokenRefresh,
+  useUserProfile,
+  validateConfig,
+  validateScopes,
+  withAuth,
+  withPageAuth,
+  wrapMsalError
+});