@eminuckan/spine 0.2.0 → 0.2.2

package/dist/auth/auth.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.server.d.ts","sourceRoot":"","sources":["../../src/auth/auth.server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAKL,cAAc,EAKf,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAEV,gBAAgB,EAChB,QAAQ,EAGR,kBAAkB,EAClB,YAAY,EAEZ,SAAS,EACV,MAAM,SAAS,CAAC;AA0NjB;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAgBzE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAI5C;AAkID;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CAkDA;AAkDD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAkB/D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAK/C;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAGtD;AAMD;;;;;GAKG;AACH,wBAAsB,KAAK,CACzB,OAAO,EAAE,OAAO,EAChB,kBAAkB,CAAC,EAAE,MAAM,GAAG,YAAY,GACzC,OAAO,CAAC,QAAQ,CAAC,CAoFnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2NxE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyEhE;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAQxE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWrE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ7E;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,kBAAkB,CAAC,CA4F7B;AAGD,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}

package/dist/auth/index.d.ts

@@ -1,2 +1,8 @@
-import { ApplicationType, AuthConfig, AuthError, LoginOptions, OAuthState, SessionData, UserInfo } from "../types-DufLRY7A.js";
-export { ApplicationType, AuthConfig, AuthError, LoginOptions, OAuthState, SessionData, UserInfo };
+/**
+ * Auth Module - Client-side exports
+ *
+ * Client-side auth types live here.
+ * For server-side auth primitives, use `@eminuckan/spine/auth/server`.
+ */
+export type { UserInfo, AuthConfig, SessionData, OAuthState, LoginOptions, AuthError, ApplicationType, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,YAAY,EACV,QAAQ,EACR,UAAU,EACV,WAAW,EACX,UAAU,EACV,YAAY,EACZ,SAAS,EACT,eAAe,GAChB,MAAM,SAAS,CAAC"}

package/dist/auth/redis-session-storage.server.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Redis Session Storage Server Module
+ *
+ * Redis-backed session storage for authentication.
+ * Provides secure session management with automatic expiration,
+ * without depending on a framework-specific session implementation.
+ */
+import type { SessionData, OAuthState } from './types';
+export declare const AUTH_ERROR_COOKIE_PREFIX: string;
+export declare function createAuthSession(request: Request, sessionData: Partial<SessionData>): Promise<Headers>;
+export declare function getAuthSession(request: Request): Promise<SessionData>;
+export declare function updateAuthSession(request: Request, updates: Partial<SessionData>): Promise<Headers>;
+export declare function destroyAuthSession(request: Request): Promise<Headers>;
+export declare function requireAuthSession(request: Request): Promise<SessionData>;
+export declare function isSessionValid(request: Request): Promise<boolean>;
+export declare function createOAuthState(state: OAuthState): Promise<string>;
+export declare function getOAuthState(stateId: string): Promise<OAuthState | null>;
+export declare function deleteOAuthState(stateId: string): Promise<void>;
+export declare function cleanupExpiredOAuthStates(): Promise<number>;
+export declare function closeRedisConnection(): Promise<void>;
+//# sourceMappingURL=redis-session-storage.server.d.ts.map

package/dist/auth/redis-session-storage.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-session-storage.server.d.ts","sourceRoot":"","sources":["../../src/auth/redis-session-storage.server.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AA4CvD,eAAO,MAAM,wBAAwB,QAAgE,CAAC;AAyKtG,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,GAChC,OAAO,CAAC,OAAO,CAAC,CAelB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAoB3E;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAS3E;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAQ/E;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBvE;AAMD,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CASzE;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAe/E;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIrE;AAED,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CAejE;AAMD,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAM1D"}

package/dist/auth/route-protection.server.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Route Protection Server Module
+ *
+ * Provides route protection utilities for different authentication levels.
+ */
+import type { ProtectionLevel, UserInfo } from './types';
+/**
+ * Check if token needs refresh
+ */
+export declare function shouldRefreshToken(request: Request): Promise<boolean>;
+/**
+ * Identity context check configuration
+ */
+export interface DefaultRouteIdentityContext {
+    hasAnyMembership: boolean;
+    hasSubscription: boolean;
+    isOnboarded: boolean;
+}
+export interface IdentityContextChecker<TIdentityContext = DefaultRouteIdentityContext> {
+    getIdentityContext: (request: Request, userId: string, forceRefresh?: boolean) => Promise<DefaultRouteIdentityContext & TIdentityContext>;
+}
+/**
+ * Tenant checker configuration
+ */
+export interface TenantChecker {
+    getCurrentTenant: (request: Request) => Promise<string | null>;
+    initializeTenant: (request: Request) => Promise<{
+        headers: Headers;
+        tenantId: string;
+    } | null>;
+}
+/**
+ * Subscription checker configuration
+ */
+export interface SubscriptionChecker {
+    checkTenantSubscriptionStatus: (request: Request, tenantId: string) => Promise<boolean>;
+}
+export interface RouteProtectionRedirect {
+    location: string;
+    headers?: HeadersInit;
+    status?: number;
+}
+export interface AutomaticLogoutRequestContext {
+    request: Request;
+    reason: 'expired-no-refresh-token' | 'refresh-failed';
+}
+export interface LoginReturnUrlContext {
+    request: Request;
+    currentPath: string;
+    protection: ProtectionLevel;
+}
+export interface RouteProtectionResolverContext<TIdentityContext = DefaultRouteIdentityContext> {
+    request: Request;
+    user: UserInfo;
+    currentPath: string;
+    protection: ProtectionLevel;
+    getIdentityContext: (forceRefresh?: boolean) => Promise<TIdentityContext | null>;
+    getCurrentTenant: () => Promise<string | null>;
+    initializeTenant: () => Promise<{
+        headers: Headers;
+        tenantId: string;
+    } | null>;
+}
+export interface RouteProtectionErrorHandlerContext<TIdentityContext = DefaultRouteIdentityContext> extends RouteProtectionResolverContext<TIdentityContext> {
+    error: unknown;
+}
+/**
+ * Route protection configuration
+ */
+export interface RouteProtectionConfig<TIdentityContext = DefaultRouteIdentityContext> {
+    identityChecker?: IdentityContextChecker<TIdentityContext>;
+    tenantChecker?: TenantChecker;
+    subscriptionChecker?: SubscriptionChecker;
+    resolveRoute?: (context: RouteProtectionResolverContext<TIdentityContext>) => Promise<RouteProtectionRedirect | null | void> | RouteProtectionRedirect | null | void;
+    handleRouteError?: (context: RouteProtectionErrorHandlerContext<TIdentityContext>) => Promise<RouteProtectionRedirect | null | void> | RouteProtectionRedirect | null | void;
+    getLoginReturnUrl?: (context: LoginReturnUrlContext) => string;
+    createAutomaticLogoutRequest?: (context: AutomaticLogoutRequestContext) => Promise<Request> | Request;
+}
+/**
+ * Configure route protection with identity/tenant/subscription checkers
+ */
+export declare function configureRouteProtection<TIdentityContext = DefaultRouteIdentityContext>(config: RouteProtectionConfig<TIdentityContext>): void;
+/**
+ * Reset route protection to its built-in defaults.
+ */
+export declare function resetRouteProtectionConfig(): void;
+/**
+ * Main route protection function
+ */
+export declare function protectRoute<T>(request: Request, protection: ProtectionLevel, loaderFn: (user?: UserInfo) => Promise<T> | T): Promise<T>;
+/**
+ * Public route (optional auth)
+ */
+export declare const publicRoute: <T>(request: Request, loaderFn: (user?: UserInfo) => Promise<T> | T) => Promise<T>;
+/**
+ * Auth-protected route
+ */
+export declare const authRoute: <T>(request: Request, loaderFn: (user: UserInfo) => Promise<T> | T) => Promise<T>;
+/**
+ * Onboarding route
+ */
+export declare const onboardingRoute: <T>(request: Request, loaderFn: (user: UserInfo) => Promise<T> | T) => Promise<T>;
+/**
+ * Subscription route
+ */
+export declare const subscriptionRoute: <T>(request: Request, loaderFn: (user: UserInfo) => Promise<T> | T) => Promise<T>;
+//# sourceMappingURL=route-protection.server.d.ts.map

package/dist/auth/route-protection.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-protection.server.d.ts","sourceRoot":"","sources":["../../src/auth/route-protection.server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAOzD;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CA4C3E;AAkCD;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB,CAAC,gBAAgB,GAAG,2BAA2B;IACpF,kBAAkB,EAAE,CAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,KACnB,OAAO,CAAC,2BAA2B,GAAG,gBAAgB,CAAC,CAAC;CAC9D;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,gBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/D,gBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChG;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,6BAA6B,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACzF;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,0BAA0B,GAAG,gBAAgB,CAAC;CACvD;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,8BAA8B,CAAC,gBAAgB,GAAG,2BAA2B;IAC5F,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;IAC5B,kBAAkB,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACjF,gBAAgB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C,gBAAgB,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,kCAAkC,CAAC,gBAAgB,GAAG,2BAA2B,CAChG,SAAQ,8BAA8B,CAAC,gBAAgB,CAAC;IACxD,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB,CAAC,gBAAgB,GAAG,2BAA2B;IACnF,eAAe,CAAC,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,YAAY,CAAC,EAAE,CACb,OAAO,EAAE,8BAA8B,CAAC,gBAAgB,CAAC,KACtD,OAAO,CAAC,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5F,gBAAgB,CAAC,EAAE,CACjB,OAAO,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAC1D,OAAO,CAAC,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5F,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,MAAM,CAAC;IAC/D,4BAA4B,CAAC,EAAE,CAC7B,OAAO,EAAE,6BAA6B,KACnC,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACjC;AAID;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,gBAAgB,GAAG,2BAA2B,EACrF,MAAM,EAAE,qBAAqB,CAAC,gBAAgB,CAAC,GAC9C,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AA8OD;;GAEG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,eAAe,EAC3B,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,CA4FZ;AAMD;;GAEG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,EAC3B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACD,CAAC;AAE/C;;GAEG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,EACzB,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACqC,CAAC;AAEpF;;GAEG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,EAC/B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACoD,CAAC;AAEnG;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAAI,CAAC,EACjC,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACsD,CAAC"}

package/dist/auth/server.d.ts

@@ -1,3 +1,13 @@
-import { ApplicationType, AuthClaimMapping, AuthConfig, AuthError, LoginOptions, OAuthState, ProtectedLoaderFn, ProtectionLevel, SessionData, SessionFlashData, TokenRefreshResult$1 as TokenRefreshResult, UserInfo } from "../types-DufLRY7A.js";
-import { AUTH_ERROR_COOKIE_PREFIX, AutomaticLogoutRequestContext, DefaultRouteIdentityContext, IdentityContextChecker, LoginReturnUrlContext, RouteProtectionConfig, RouteProtectionErrorHandlerContext, RouteProtectionRedirect, RouteProtectionResolverContext, SubscriptionChecker, TenantChecker, attemptTokenRefresh$1 as attemptTokenRefresh, authRoute$1 as authRoute, cleanupExpiredOAuthStates, clearAuthErrorHeaders, clearAuthServerCache, closeRedisConnection, configureAuthClaimMapping, configureRouteProtection$1 as configureRouteProtection, createAuthSession, createOAuthState, deleteOAuthState, destroyAuthSession, extractUserInfo, getAccessToken, getAuthError, getAuthSession, getOAuthState, getUser, handleCallback, hasAuthError, isSessionValid, isTokenExpiredResponse$1 as isTokenExpiredResponse, login, logout, onboardingRoute$1 as onboardingRoute, protectRoute$1 as protectRoute, publicRoute$1 as publicRoute, refreshTokens, requireAuth, requireAuthSession, resetAuthClaimMapping, resetRouteProtectionConfig$1 as resetRouteProtectionConfig, shouldAttemptTokenRefresh$1 as shouldAttemptTokenRefresh, shouldRefreshToken$1 as shouldRefreshToken, subscriptionRoute$1 as subscriptionRoute, updateAuthSession } from "../server-CXGaRaiS.js";
-export { AUTH_ERROR_COOKIE_PREFIX, ApplicationType, AuthClaimMapping, AuthConfig, AuthError, TokenRefreshResult as AuthTokenRefreshResult, AutomaticLogoutRequestContext, DefaultRouteIdentityContext, IdentityContextChecker, LoginOptions, LoginReturnUrlContext, OAuthState, ProtectedLoaderFn, ProtectionLevel, RouteProtectionConfig, RouteProtectionErrorHandlerContext, RouteProtectionRedirect, RouteProtectionResolverContext, SessionData, SessionFlashData, SubscriptionChecker, TenantChecker, UserInfo, attemptTokenRefresh, authRoute, cleanupExpiredOAuthStates, clearAuthErrorHeaders, clearAuthServerCache, closeRedisConnection, configureAuthClaimMapping, configureRouteProtection, createAuthSession, createOAuthState, deleteOAuthState, destroyAuthSession, extractUserInfo, getAccessToken, getAuthError, getAuthSession, getOAuthState, getUser, handleCallback, hasAuthError, isSessionValid, isTokenExpiredResponse, login, logout, onboardingRoute, protectRoute, publicRoute, refreshTokens, requireAuth, requireAuthSession, resetAuthClaimMapping, resetRouteProtectionConfig, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession };
+/**
+ * Auth module server exports.
+ *
+ * These exports are framework-agnostic. Framework adapters can re-export
+ * them from their own namespaces such as `@eminuckan/spine/react-router/server`.
+ */
+export * from './auth.server';
+export * from './redis-session-storage.server';
+export * from './route-protection.server';
+export * from './token-refresh.server';
+export type { ApplicationType, AuthClaimMapping, AuthConfig, AuthError, LoginOptions, OAuthState, ProtectedLoaderFn, ProtectionLevel, SessionData, SessionFlashData, UserInfo, } from './types';
+export type { TokenRefreshResult as AuthTokenRefreshResult, } from './types';
+//# sourceMappingURL=server.d.ts.map

package/dist/auth/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/auth/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,eAAe,CAAC;AAC9B,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,QAAQ,GACT,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,kBAAkB,IAAI,sBAAsB,GAC7C,MAAM,SAAS,CAAC"}

package/dist/auth/server.js

@@ -1,6 +1,6 @@
 import "../logging-_h2mi3L9.js";
-import { AUTH_ERROR_COOKIE_PREFIX$1 as AUTH_ERROR_COOKIE_PREFIX, cleanupExpiredOAuthStates$1 as cleanupExpiredOAuthStates, closeRedisConnection$1 as closeRedisConnection, createAuthSession$1 as createAuthSession, createOAuthState$1 as createOAuthState, deleteOAuthState$1 as deleteOAuthState, destroyAuthSession$1 as destroyAuthSession, getAuthSession$1 as getAuthSession, getOAuthState$1 as getOAuthState, isSessionValid$1 as isSessionValid, requireAuthSession$1 as requireAuthSession, updateAuthSession$1 as updateAuthSession } from "../redis-session-storage.server-DhufyPjd.js";
-import { clearAuthErrorHeaders$1 as clearAuthErrorHeaders, clearAuthServerCache$1 as clearAuthServerCache, configureAuthClaimMapping$1 as configureAuthClaimMapping, extractUserInfo$1 as extractUserInfo, getAccessToken$1 as getAccessToken, getAuthError$1 as getAuthError, getUser$1 as getUser, handleCallback$1 as handleCallback, hasAuthError$1 as hasAuthError, login$1 as login, logout$1 as logout, refreshTokens$1 as refreshTokens, requireAuth$1 as requireAuth, resetAuthClaimMapping$1 as resetAuthClaimMapping } from "../auth.server-C979TR6W.js";
-import { attemptTokenRefresh, authRoute, configureRouteProtection, isTokenExpiredResponse, onboardingRoute, protectRoute, publicRoute, resetRouteProtectionConfig, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute } from "../server-CiSbg-9C.js";
+import { AUTH_ERROR_COOKIE_PREFIX, cleanupExpiredOAuthStates, closeRedisConnection, createAuthSession, createOAuthState, deleteOAuthState, destroyAuthSession, getAuthSession, getOAuthState, isSessionValid, requireAuthSession, updateAuthSession } from "../redis-session-storage.server-BR_0y-QO.js";
+import { clearAuthErrorHeaders, clearAuthServerCache, configureAuthClaimMapping, extractUserInfo, getAccessToken, getAuthError, getUser, handleCallback, hasAuthError, login, logout, refreshTokens, requireAuth, resetAuthClaimMapping } from "../auth.server-Cx2h2qu3.js";
+import { attemptTokenRefresh, authRoute, configureRouteProtection, isTokenExpiredResponse, onboardingRoute, protectRoute, publicRoute, resetRouteProtectionConfig, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute } from "../server-BHfKHKF_.js";
 
 export { AUTH_ERROR_COOKIE_PREFIX, attemptTokenRefresh, authRoute, cleanupExpiredOAuthStates, clearAuthErrorHeaders, clearAuthServerCache, closeRedisConnection, configureAuthClaimMapping, configureRouteProtection, createAuthSession, createOAuthState, deleteOAuthState, destroyAuthSession, extractUserInfo, getAccessToken, getAuthError, getAuthSession, getOAuthState, getUser, handleCallback, hasAuthError, isSessionValid, isTokenExpiredResponse, login, logout, onboardingRoute, protectRoute, publicRoute, refreshTokens, requireAuth, requireAuthSession, resetAuthClaimMapping, resetRouteProtectionConfig, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession };

package/dist/auth/token-refresh.server.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Token Refresh Server Module
+ */
+import type { TokenRefreshResult } from './types';
+/**
+ * Attempt to refresh the access token
+ */
+export declare function attemptTokenRefresh(request: Request): Promise<TokenRefreshResult>;
+/**
+ * Check if a response indicates token expiration
+ */
+export declare function isTokenExpiredResponse(response: Response): boolean;
+/**
+ * Check if token refresh should be attempted
+ */
+export declare function shouldAttemptTokenRefresh(response: Response, hasAuth: boolean): boolean;
+//# sourceMappingURL=token-refresh.server.d.ts.map

package/dist/auth/token-refresh.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh.server.d.ts","sourceRoot":"","sources":["../../src/auth/token-refresh.server.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAGlD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAsDvF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAElE;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAEvF"}

package/dist/auth/types.d.ts

@@ -0,0 +1,160 @@
+/**
+ * Auth Types
+ */
+/**
+ * Application Type
+ * Determines logout behavior and error handling
+ */
+export type ApplicationType = 'no-landing-page' | 'landing-page' | 'dashboard' | 'tenant-app' | 'custom';
+/**
+ * OAuth Configuration
+ */
+export interface AuthConfig {
+    authority: string;
+    clientId: string;
+    clientSecret?: string;
+    redirectUri: string;
+    postLogoutRedirectUri?: string;
+    scope: string;
+    /**
+     * Application type - determines logout behavior
+     * - 'no-landing-page': No landing page, defaults to full SSO logout
+     * - 'landing-page': Has a landing page, defaults to app-specific logout
+     * - 'dashboard': Legacy alias for 'no-landing-page'
+     * - 'tenant-app': Legacy alias for 'landing-page'
+     * - 'custom': Use explicit ssoLogout setting
+     * @default 'custom'
+     */
+    applicationType?: ApplicationType;
+    /**
+     * Whether to perform full SSO logout (clear identity cookie) or app-specific logout
+     * - true: Full logout - clears identity cookie, revokes all tokens
+     * - false: App-specific logout - keeps identity cookie, revokes only this app's tokens
+     *
+     * If not set, determined by applicationType:
+     * - 'no-landing-page': true (full logout)
+     * - 'landing-page': false (app-specific)
+     * - 'dashboard': true (legacy alias)
+     * - 'tenant-app': false (legacy alias)
+     * - 'custom': false (default)
+     */
+    ssoLogout?: boolean;
+    /**
+     * Whether the application has a landing page
+     * - true: Has landing page - OAuth errors redirect to home, user sees landing
+     * - false: No landing page - Must handle OAuth errors specially to avoid loops
+     *
+     * If not set, determined by applicationType:
+     * - 'no-landing-page': false
+     * - 'landing-page': true
+     * - 'dashboard': false (legacy alias)
+     * - 'tenant-app': true (legacy alias)
+     * - 'custom': true (default)
+     */
+    hasLandingPage?: boolean;
+}
+/**
+ * Configurable claim mapping for adapting auth/session extraction
+ * to different identity providers and backend conventions.
+ */
+export interface AuthClaimMapping {
+    subject?: string[];
+    name?: string[];
+    email?: string[];
+    givenName?: string[];
+    familyName?: string[];
+    picture?: string[];
+    locale?: string[];
+    zoneinfo?: string[];
+    updatedAt?: string[];
+    tenantIds?: string[];
+    tenantRoles?: string[];
+    permissions?: string[];
+    isOnboarded?: string[];
+}
+/**
+ * User Info from OAuth provider
+ */
+export interface UserInfo {
+    sub: string;
+    name?: string;
+    email?: string;
+    givenName?: string;
+    familyName?: string;
+    picture?: string;
+    locale?: string;
+    zoneinfo?: string;
+    updated_at?: number;
+    [key: string]: unknown;
+}
+/**
+ * OAuth State for PKCE flow
+ */
+export interface OAuthState {
+    state: string;
+    codeVerifier: string;
+    nonce?: string;
+    returnUrl?: string;
+    createdAt: number;
+}
+/**
+ * Session Data stored in Redis
+ */
+export interface SessionData {
+    userId?: string;
+    accessToken?: string;
+    refreshToken?: string;
+    idToken?: string;
+    expiresAt?: number;
+    user?: UserInfo;
+    lastActivity?: number;
+}
+/**
+ * Session Flash Data for temporary messages
+ */
+export interface SessionFlashData {
+    error: string;
+    success: string;
+}
+/**
+ * Token refresh result
+ */
+export interface TokenRefreshResult {
+    success: boolean;
+    newAccessToken?: string;
+    tokens?: {
+        access_token: string;
+        refresh_token?: string;
+        id_token?: string;
+        expires_in?: number;
+    };
+    error?: string;
+    shouldLogout?: boolean;
+}
+/**
+ * Route protection levels
+ */
+export type ProtectionLevel = 'public' | 'auth' | 'onboarding-required' | 'subscription-required';
+/**
+ * Protected route loader function type
+ */
+export type ProtectedLoaderFn<T> = (user?: UserInfo) => Promise<T> | T;
+/**
+ * Login options
+ */
+export interface LoginOptions {
+    /** Return URL after successful login */
+    returnUrl?: string;
+    /** OAuth prompt parameter (none, login, consent, select_account) */
+    prompt?: 'none' | 'login' | 'consent' | 'select_account';
+}
+/**
+ * Auth error information from OAuth callback
+ */
+export interface AuthError {
+    /** Error code (e.g., 'access_denied', 'login_required') */
+    error: string;
+    /** Human-readable error description */
+    description?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,cAAc,GACd,WAAW,GACX,YAAY,GACZ,QAAQ,CAAC;AAEb;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IAEd;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAElC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB,QAAQ,GACR,MAAM,GACN,qBAAqB,GACrB,uBAAuB,CAAC;AAE5B;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,CAAC;CAC1D;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/dist/auth.server-BPiCtlJE.js

@@ -0,0 +1,5 @@
+import "./logging-_h2mi3L9.js";
+import { isSessionValid } from "./redis-session-storage.server-BR_0y-QO.js";
+import { clearAuthErrorHeaders, clearAuthServerCache, configureAuthClaimMapping, extractUserInfo, getAccessToken, getAuthError, getUser, handleCallback, hasAuthError, login, logout, refreshTokens, requireAuth, resetAuthClaimMapping } from "./auth.server-Cx2h2qu3.js";
+
+export { logout };

package/dist/{auth.server-C979TR6W.js → auth.server-Cx2h2qu3.js}

@@ -1,5 +1,5 @@
 import { logger } from "./logging-_h2mi3L9.js";
-import { AUTH_ERROR_COOKIE_PREFIX$1 as AUTH_ERROR_COOKIE_PREFIX, createAuthSession$1 as createAuthSession, createOAuthState$1 as createOAuthState, deleteOAuthState$1 as deleteOAuthState, destroyAuthSession$1 as destroyAuthSession, getAuthSession$1 as getAuthSession, getOAuthState$1 as getOAuthState, updateAuthSession$1 as updateAuthSession } from "./redis-session-storage.server-DhufyPjd.js";
+import { AUTH_ERROR_COOKIE_PREFIX, createAuthSession, createOAuthState, deleteOAuthState, destroyAuthSession, getAuthSession, getOAuthState, updateAuthSession } from "./redis-session-storage.server-BR_0y-QO.js";
 import * as oauth from "oauth4webapi";
 
 //#region src/http/response.ts
@@ -720,5 +720,5 @@ function clearAuthServerCache() {
 }
 
 //#endregion
-export { clearAuthErrorHeaders as clearAuthErrorHeaders$1, clearAuthServerCache as clearAuthServerCache$1, configureAuthClaimMapping as configureAuthClaimMapping$1, createRedirectResponse, extractUserInfo as extractUserInfo$1, getAccessToken as getAccessToken$1, getAuthError as getAuthError$1, getUser as getUser$1, handleCallback as handleCallback$1, hasAuthError as hasAuthError$1, login as login$1, logout as logout$1, refreshTokens as refreshTokens$1, requireAuth as requireAuth$1, resetAuthClaimMapping as resetAuthClaimMapping$1 };
-//# sourceMappingURL=auth.server-C979TR6W.js.map
+export { clearAuthErrorHeaders, clearAuthServerCache, configureAuthClaimMapping, createRedirectResponse, extractUserInfo, getAccessToken, getAuthError, getUser, handleCallback, hasAuthError, login, logout, refreshTokens, requireAuth, resetAuthClaimMapping };
+//# sourceMappingURL=auth.server-Cx2h2qu3.js.map