@eminuckan/spine 0.2.0

package/dist/server-CiSbg-9C.js

@@ -0,0 +1,352 @@
+import { logger } from "./logging-_h2mi3L9.js";
+import { getAuthSession$1 as getAuthSession } from "./redis-session-storage.server-DhufyPjd.js";
+import { createRedirectResponse, getUser$1 as getUser, login$1 as login, refreshTokens$1 as refreshTokens, requireAuth$1 as requireAuth } from "./auth.server-C979TR6W.js";
+
+//#region src/auth/route-protection.server.ts
+const REFRESH_THRESHOLD = 5 * 60 * 1e3;
+/**
+* Check if token needs refresh
+*/
+async function shouldRefreshToken(request) {
+	try {
+		const sessionData = await getAuthSession(request);
+		if (!sessionData.refreshToken || sessionData.refreshToken.length === 0) {
+			if (sessionData.expiresAt && Date.now() >= sessionData.expiresAt) {
+				logger.info("Token expired and no refresh token, forcing app-specific logout");
+				const { logout } = await import("./auth.server-DU-x2LPA.js");
+				const logoutRequest = await createAutomaticLogoutRequest(request, "expired-no-refresh-token");
+				throw await logout(logoutRequest);
+			}
+			return false;
+		}
+		if (!sessionData.expiresAt || !sessionData.accessToken) return false;
+		const now = Date.now();
+		let jwtExpiry = null;
+		try {
+			const tokenParts = sessionData.accessToken.split(".");
+			if (tokenParts.length === 3) {
+				const payload = JSON.parse(Buffer.from(tokenParts[1], "base64").toString());
+				if (payload.exp) jwtExpiry = payload.exp * 1e3;
+			}
+		} catch {}
+		const earliestExpiry = jwtExpiry && jwtExpiry < sessionData.expiresAt ? jwtExpiry : sessionData.expiresAt;
+		const timeUntilEarliestExpiry = earliestExpiry - now;
+		return timeUntilEarliestExpiry <= REFRESH_THRESHOLD;
+	} catch (error) {
+		logger.error("Error checking token refresh", error instanceof Error ? error : void 0);
+		return false;
+	}
+}
+/**
+* Auto-refresh tokens if needed
+*/
+async function autoRefreshTokens(request) {
+	try {
+		const needsRefresh = await shouldRefreshToken(request);
+		if (needsRefresh) {
+			logger.info("Auto-refreshing tokens due to expiry");
+			const result = await refreshTokens(request);
+			if (result.success) logger.info("Auto-refresh completed successfully");
+			else {
+				logger.error("Auto-refresh failed", void 0, { error: result.error });
+				if (result.shouldLogout) {
+					logger.error("Refresh token invalid, forcing app-specific logout");
+					const { logout } = await import("./auth.server-DU-x2LPA.js");
+					const logoutRequest = await createAutomaticLogoutRequest(request, "refresh-failed");
+					throw await logout(logoutRequest);
+				}
+			}
+		}
+	} catch (error) {
+		if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
+		throw error;
+	}
+}
+let protectionConfig = {};
+/**
+* Configure route protection with identity/tenant/subscription checkers
+*/
+function configureRouteProtection(config) {
+	protectionConfig = config;
+}
+/**
+* Reset route protection to its built-in defaults.
+*/
+function resetRouteProtectionConfig() {
+	protectionConfig = {};
+}
+function createRedirectFromConfig(redirect) {
+	return createRedirectResponse(redirect.location, {
+		headers: redirect.headers,
+		status: redirect.status
+	});
+}
+function getLoginReturnUrl(request, currentPath, protection) {
+	if (protectionConfig.getLoginReturnUrl) return protectionConfig.getLoginReturnUrl({
+		request,
+		currentPath,
+		protection
+	});
+	switch (protection) {
+		case "onboarding-required": return "/onboarding";
+		case "subscription-required": return "/subscription";
+		case "public": return "/";
+		case "auth":
+		default: {
+			const url = new URL(request.url);
+			return url.pathname === "/" ? "/" : `${url.pathname}${url.search}`;
+		}
+	}
+}
+async function createAutomaticLogoutRequest(request, reason) {
+	if (protectionConfig.createAutomaticLogoutRequest) return protectionConfig.createAutomaticLogoutRequest({
+		request,
+		reason
+	});
+	const logoutUrl = new URL(request.url);
+	logoutUrl.pathname = "/auth/logout";
+	logoutUrl.searchParams.set("client_id_only", "true");
+	return new Request(logoutUrl.toString(), { headers: request.headers });
+}
+function createRouteResolverContext(request, user, currentPath, protection) {
+	let identityContextPromise = null;
+	let currentTenantPromise = null;
+	let initializeTenantPromise = null;
+	return {
+		request,
+		user,
+		currentPath,
+		protection,
+		getIdentityContext: async (forceRefresh = false) => {
+			if (!protectionConfig.identityChecker) return null;
+			if (forceRefresh) return protectionConfig.identityChecker.getIdentityContext(request, user.sub, true);
+			if (!identityContextPromise) identityContextPromise = protectionConfig.identityChecker.getIdentityContext(request, user.sub);
+			return identityContextPromise;
+		},
+		getCurrentTenant: async () => {
+			if (!protectionConfig.tenantChecker) return null;
+			if (!currentTenantPromise) currentTenantPromise = protectionConfig.tenantChecker.getCurrentTenant(request);
+			return currentTenantPromise;
+		},
+		initializeTenant: async () => {
+			if (!protectionConfig.tenantChecker) return null;
+			if (!initializeTenantPromise) initializeTenantPromise = protectionConfig.tenantChecker.initializeTenant(request);
+			return initializeTenantPromise;
+		}
+	};
+}
+async function applyConfiguredRouteResolution(request, user, currentPath, protection) {
+	if (!protectionConfig.resolveRoute) return false;
+	const context = createRouteResolverContext(request, user, currentPath, protection);
+	try {
+		const result = await protectionConfig.resolveRoute(context);
+		if (result) throw createRedirectFromConfig(result);
+		return true;
+	} catch (error) {
+		if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
+		if (!protectionConfig.handleRouteError) throw error;
+		const recovery = await protectionConfig.handleRouteError({
+			...context,
+			error
+		});
+		if (recovery) throw createRedirectFromConfig(recovery);
+		throw error;
+	}
+}
+/**
+* Check user status (onboarding, subscription)
+*/
+async function checkUserStatus(request, user, currentPath) {
+	if (!protectionConfig.identityChecker) {
+		logger.warn("Identity checker not configured, skipping status check");
+		return null;
+	}
+	try {
+		const context = await protectionConfig.identityChecker.getIdentityContext(request, user.sub);
+		logger.debug("User status check", {
+			userId: user.sub,
+			currentPath,
+			hasAnyMembership: context.hasAnyMembership,
+			isOnboarded: context.isOnboarded,
+			hasSubscription: context.hasSubscription
+		});
+		if (!context.hasAnyMembership) {
+			if (currentPath !== "/onboarding") {
+				logger.info("User has no memberships, redirecting to onboarding");
+				throw createRedirectResponse("/onboarding");
+			}
+			return null;
+		}
+		if (context.hasAnyMembership) {
+			if (currentPath === "/onboarding") {
+				logger.info("User has memberships, redirecting from onboarding to subscription");
+				throw createRedirectResponse("/subscription");
+			}
+			if (currentPath === "/subscription") return null;
+			if (protectionConfig.tenantChecker && protectionConfig.subscriptionChecker) {
+				let currentTenant = await protectionConfig.tenantChecker.getCurrentTenant(request);
+				if (!currentTenant) {
+					const initResult = await protectionConfig.tenantChecker.initializeTenant(request);
+					if (initResult) currentTenant = initResult.tenantId;
+				}
+				if (currentTenant) {
+					const hasSubscription = await protectionConfig.subscriptionChecker.checkTenantSubscriptionStatus(request, currentTenant);
+					if (!hasSubscription) {
+						logger.info("Tenant has no subscription, redirecting to subscription");
+						throw createRedirectResponse("/subscription");
+					}
+				} else {
+					logger.info("Could not initialize tenant, redirecting to subscription");
+					throw createRedirectResponse("/subscription");
+				}
+			}
+		}
+		return null;
+	} catch (error) {
+		if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
+		logger.error("Error checking user status", error instanceof Error ? error : void 0);
+		if (currentPath !== "/onboarding") throw createRedirectResponse("/onboarding");
+		return null;
+	}
+}
+/**
+* Main route protection function
+*/
+async function protectRoute(request, protection, loaderFn) {
+	const url = new URL(request.url);
+	switch (protection) {
+		case "public": try {
+			await autoRefreshTokens(request);
+			const user = await getUser(request);
+			return loaderFn(user ?? void 0);
+		} catch {
+			return loaderFn(void 0);
+		}
+		case "auth": try {
+			await autoRefreshTokens(request);
+			const user = await requireAuth(request);
+			const handledByConfig = await applyConfiguredRouteResolution(request, user, url.pathname, "auth");
+			if (!handledByConfig) await checkUserStatus(request, user, url.pathname);
+			return loaderFn(user);
+		} catch (error) {
+			if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
+			throw await login(request, getLoginReturnUrl(request, url.pathname, "auth"));
+		}
+		case "onboarding-required": try {
+			await autoRefreshTokens(request);
+			const user = await requireAuth(request);
+			const handledByConfig = await applyConfiguredRouteResolution(request, user, url.pathname, "onboarding-required");
+			if (!handledByConfig && protectionConfig.identityChecker) {
+				const context = await protectionConfig.identityChecker.getIdentityContext(request, user.sub);
+				if (context.hasAnyMembership) throw createRedirectResponse("/subscription");
+			}
+			return loaderFn(user);
+		} catch (error) {
+			if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
+			throw await login(request, getLoginReturnUrl(request, url.pathname, "onboarding-required"));
+		}
+		case "subscription-required": try {
+			await autoRefreshTokens(request);
+			const user = await requireAuth(request);
+			const handledByConfig = await applyConfiguredRouteResolution(request, user, url.pathname, "subscription-required");
+			if (!handledByConfig && protectionConfig.identityChecker) {
+				const context = await protectionConfig.identityChecker.getIdentityContext(request, user.sub);
+				if (!context.hasAnyMembership) throw createRedirectResponse("/onboarding");
+			}
+			if (protectionConfig.tenantChecker) {
+				const currentTenant = await protectionConfig.tenantChecker.getCurrentTenant(request);
+				if (!currentTenant) await protectionConfig.tenantChecker.initializeTenant(request);
+			}
+			return loaderFn(user);
+		} catch (error) {
+			if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
+			throw await login(request, getLoginReturnUrl(request, url.pathname, "subscription-required"));
+		}
+		default: throw new Error(`Unknown protection level: ${protection}`);
+	}
+}
+/**
+* Public route (optional auth)
+*/
+const publicRoute = (request, loaderFn) => protectRoute(request, "public", loaderFn);
+/**
+* Auth-protected route
+*/
+const authRoute = (request, loaderFn) => protectRoute(request, "auth", loaderFn);
+/**
+* Onboarding route
+*/
+const onboardingRoute = (request, loaderFn) => protectRoute(request, "onboarding-required", loaderFn);
+/**
+* Subscription route
+*/
+const subscriptionRoute = (request, loaderFn) => protectRoute(request, "subscription-required", loaderFn);
+
+//#endregion
+//#region src/auth/token-refresh.server.ts
+/**
+* Attempt to refresh the access token
+*/
+async function attemptTokenRefresh(request) {
+	try {
+		logger.info("Attempting token refresh due to 401 response");
+		const sessionData = await getAuthSession(request);
+		if (!sessionData.refreshToken) {
+			logger.warn("No refresh token available in session");
+			return {
+				success: false,
+				error: "No refresh token available",
+				shouldLogout: true
+			};
+		}
+		const refreshResult = await refreshTokens(request, sessionData.refreshToken);
+		if (!refreshResult.success) {
+			logger.error("Token refresh failed", void 0, {
+				error: refreshResult.error,
+				shouldLogout: refreshResult.shouldLogout
+			});
+			return {
+				success: false,
+				error: refreshResult.error,
+				shouldLogout: refreshResult.shouldLogout
+			};
+		}
+		const tokens = refreshResult.tokens;
+		if (!tokens || !tokens.access_token) {
+			logger.error("Token refresh succeeded but no access token returned");
+			return {
+				success: false,
+				error: "No access token in refresh response",
+				shouldLogout: true
+			};
+		}
+		logger.info("Token refresh successful");
+		return {
+			success: true,
+			newAccessToken: tokens.access_token
+		};
+	} catch (error) {
+		logger.error("Token refresh attempt failed", error instanceof Error ? error : void 0);
+		return {
+			success: false,
+			error: error instanceof Error ? error.message : "Unknown error",
+			shouldLogout: true
+		};
+	}
+}
+/**
+* Check if a response indicates token expiration
+*/
+function isTokenExpiredResponse(response) {
+	return response.status === 401;
+}
+/**
+* Check if token refresh should be attempted
+*/
+function shouldAttemptTokenRefresh(response, hasAuth) {
+	return hasAuth && isTokenExpiredResponse(response);
+}
+
+//#endregion
+export { attemptTokenRefresh, authRoute, configureRouteProtection, isTokenExpiredResponse, onboardingRoute, protectRoute, publicRoute, resetRouteProtectionConfig, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute };
+//# sourceMappingURL=server-CiSbg-9C.js.map

package/dist/server-CiSbg-9C.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-CiSbg-9C.js","names":["request: Request","jwtExpiry: number | null","protectionConfig: RouteProtectionConfig<any>","config: RouteProtectionConfig<TIdentityContext>","redirect: RouteProtectionRedirect","currentPath: string","protection: ProtectionLevel","reason: AutomaticLogoutRequestContext['reason']","user: UserInfo","identityContextPromise: Promise<any | null> | null","currentTenantPromise: Promise<string | null> | null","initializeTenantPromise: Promise<{ headers: Headers; tenantId: string } | null> | null","loaderFn: (user?: UserInfo) => Promise<T> | T","loaderFn: (user: UserInfo) => Promise<T> | T","request: Request","response: Response","hasAuth: boolean"],"sources":["../src/auth/route-protection.server.ts","../src/auth/token-refresh.server.ts"],"sourcesContent":["/**\n * Route Protection Server Module\n * \n * Provides route protection utilities for different authentication levels.\n */\n\nimport { getUser, requireAuth, refreshTokens, login } from './auth.server';\nimport { getAuthSession } from './redis-session-storage.server';\nimport type { ProtectionLevel, UserInfo } from './types';\nimport { logger } from '../logging';\nimport { createRedirectResponse } from '../http/response';\n\n// Token refresh threshold (5 minutes before expiry)\nconst REFRESH_THRESHOLD = 5 * 60 * 1000;\n\n/**\n * Check if token needs refresh\n */\nexport async function shouldRefreshToken(request: Request): Promise<boolean> {\n  try {\n    const sessionData = await getAuthSession(request);\n\n    if (!sessionData.refreshToken || sessionData.refreshToken.length === 0) {\n      if (sessionData.expiresAt && Date.now() >= sessionData.expiresAt) {\n        logger.info('Token expired and no refresh token, forcing app-specific logout');\n        const { logout } = await import('./auth.server');\n        const logoutRequest = await createAutomaticLogoutRequest(request, 'expired-no-refresh-token');\n        throw await logout(logoutRequest);\n      }\n      return false;\n    }\n\n    if (!sessionData.expiresAt || !sessionData.accessToken) {\n      return false;\n    }\n\n    const now = Date.now();\n\n    // Check JWT expiry\n    let jwtExpiry: number | null = null;\n    try {\n      const tokenParts = sessionData.accessToken.split('.');\n      if (tokenParts.length === 3) {\n        const payload = JSON.parse(Buffer.from(tokenParts[1], 'base64').toString());\n        if (payload.exp) {\n          jwtExpiry = payload.exp * 1000;\n        }\n      }\n    } catch {\n      // Ignore JWT decode errors\n    }\n\n    const earliestExpiry = jwtExpiry && jwtExpiry < sessionData.expiresAt \n      ? jwtExpiry \n      : sessionData.expiresAt;\n    const timeUntilEarliestExpiry = earliestExpiry - now;\n\n    return timeUntilEarliestExpiry <= REFRESH_THRESHOLD;\n  } catch (error) {\n    logger.error('Error checking token refresh', error instanceof Error ? error : undefined);\n    return false;\n  }\n}\n\n/**\n * Auto-refresh tokens if needed\n */\nasync function autoRefreshTokens(request: Request): Promise<void> {\n  try {\n    const needsRefresh = await shouldRefreshToken(request);\n\n    if (needsRefresh) {\n      logger.info('Auto-refreshing tokens due to expiry');\n      const result = await refreshTokens(request);\n\n      if (result.success) {\n        logger.info('Auto-refresh completed successfully');\n      } else {\n        logger.error('Auto-refresh failed', undefined, { error: result.error });\n\n        if (result.shouldLogout) {\n          logger.error('Refresh token invalid, forcing app-specific logout');\n          const { logout } = await import('./auth.server');\n          const logoutRequest = await createAutomaticLogoutRequest(request, 'refresh-failed');\n          throw await logout(logoutRequest);\n        }\n      }\n    }\n  } catch (error) {\n    if (error instanceof Response && error.status >= 300 && error.status < 400) {\n      throw error;\n    }\n    throw error;\n  }\n}\n\n/**\n * Identity context check configuration\n */\nexport interface DefaultRouteIdentityContext {\n  hasAnyMembership: boolean;\n  hasSubscription: boolean;\n  isOnboarded: boolean;\n}\n\nexport interface IdentityContextChecker<TIdentityContext = DefaultRouteIdentityContext> {\n  getIdentityContext: (\n    request: Request,\n    userId: string,\n    forceRefresh?: boolean\n  ) => Promise<DefaultRouteIdentityContext & TIdentityContext>;\n}\n\n/**\n * Tenant checker configuration\n */\nexport interface TenantChecker {\n  getCurrentTenant: (request: Request) => Promise<string | null>;\n  initializeTenant: (request: Request) => Promise<{ headers: Headers; tenantId: string } | null>;\n}\n\n/**\n * Subscription checker configuration\n */\nexport interface SubscriptionChecker {\n  checkTenantSubscriptionStatus: (request: Request, tenantId: string) => Promise<boolean>;\n}\n\nexport interface RouteProtectionRedirect {\n  location: string;\n  headers?: HeadersInit;\n  status?: number;\n}\n\nexport interface AutomaticLogoutRequestContext {\n  request: Request;\n  reason: 'expired-no-refresh-token' | 'refresh-failed';\n}\n\nexport interface LoginReturnUrlContext {\n  request: Request;\n  currentPath: string;\n  protection: ProtectionLevel;\n}\n\nexport interface RouteProtectionResolverContext<TIdentityContext = DefaultRouteIdentityContext> {\n  request: Request;\n  user: UserInfo;\n  currentPath: string;\n  protection: ProtectionLevel;\n  getIdentityContext: (forceRefresh?: boolean) => Promise<TIdentityContext | null>;\n  getCurrentTenant: () => Promise<string | null>;\n  initializeTenant: () => Promise<{ headers: Headers; tenantId: string } | null>;\n}\n\nexport interface RouteProtectionErrorHandlerContext<TIdentityContext = DefaultRouteIdentityContext>\n  extends RouteProtectionResolverContext<TIdentityContext> {\n  error: unknown;\n}\n\n/**\n * Route protection configuration\n */\nexport interface RouteProtectionConfig<TIdentityContext = DefaultRouteIdentityContext> {\n  identityChecker?: IdentityContextChecker<TIdentityContext>;\n  tenantChecker?: TenantChecker;\n  subscriptionChecker?: SubscriptionChecker;\n  resolveRoute?: (\n    context: RouteProtectionResolverContext<TIdentityContext>\n  ) => Promise<RouteProtectionRedirect | null | void> | RouteProtectionRedirect | null | void;\n  handleRouteError?: (\n    context: RouteProtectionErrorHandlerContext<TIdentityContext>\n  ) => Promise<RouteProtectionRedirect | null | void> | RouteProtectionRedirect | null | void;\n  getLoginReturnUrl?: (context: LoginReturnUrlContext) => string;\n  createAutomaticLogoutRequest?: (\n    context: AutomaticLogoutRequestContext\n  ) => Promise<Request> | Request;\n}\n\nlet protectionConfig: RouteProtectionConfig<any> = {};\n\n/**\n * Configure route protection with identity/tenant/subscription checkers\n */\nexport function configureRouteProtection<TIdentityContext = DefaultRouteIdentityContext>(\n  config: RouteProtectionConfig<TIdentityContext>\n): void {\n  protectionConfig = config;\n}\n\n/**\n * Reset route protection to its built-in defaults.\n */\nexport function resetRouteProtectionConfig(): void {\n  protectionConfig = {};\n}\n\nfunction createRedirectFromConfig(redirect: RouteProtectionRedirect): Response {\n  return createRedirectResponse(redirect.location, {\n    headers: redirect.headers,\n    status: redirect.status,\n  });\n}\n\nfunction getLoginReturnUrl(\n  request: Request,\n  currentPath: string,\n  protection: ProtectionLevel\n): string {\n  if (protectionConfig.getLoginReturnUrl) {\n    return protectionConfig.getLoginReturnUrl({\n      request,\n      currentPath,\n      protection,\n    });\n  }\n\n  switch (protection) {\n    case 'onboarding-required':\n      return '/onboarding';\n    case 'subscription-required':\n      return '/subscription';\n    case 'public':\n      return '/';\n    case 'auth':\n    default: {\n      const url = new URL(request.url);\n      return url.pathname === '/' ? '/' : `${url.pathname}${url.search}`;\n    }\n  }\n}\n\nasync function createAutomaticLogoutRequest(\n  request: Request,\n  reason: AutomaticLogoutRequestContext['reason']\n): Promise<Request> {\n  if (protectionConfig.createAutomaticLogoutRequest) {\n    return protectionConfig.createAutomaticLogoutRequest({ request, reason });\n  }\n\n  const logoutUrl = new URL(request.url);\n  logoutUrl.pathname = '/auth/logout';\n  logoutUrl.searchParams.set('client_id_only', 'true');\n\n  return new Request(logoutUrl.toString(), {\n    headers: request.headers,\n  });\n}\n\nfunction createRouteResolverContext(\n  request: Request,\n  user: UserInfo,\n  currentPath: string,\n  protection: ProtectionLevel\n): RouteProtectionResolverContext<any> {\n  let identityContextPromise: Promise<any | null> | null = null;\n  let currentTenantPromise: Promise<string | null> | null = null;\n  let initializeTenantPromise: Promise<{ headers: Headers; tenantId: string } | null> | null = null;\n\n  return {\n    request,\n    user,\n    currentPath,\n    protection,\n    getIdentityContext: async (forceRefresh = false) => {\n      if (!protectionConfig.identityChecker) {\n        return null;\n      }\n\n      if (forceRefresh) {\n        return protectionConfig.identityChecker.getIdentityContext(request, user.sub, true);\n      }\n\n      if (!identityContextPromise) {\n        identityContextPromise = protectionConfig.identityChecker.getIdentityContext(request, user.sub);\n      }\n\n      return identityContextPromise;\n    },\n    getCurrentTenant: async () => {\n      if (!protectionConfig.tenantChecker) {\n        return null;\n      }\n\n      if (!currentTenantPromise) {\n        currentTenantPromise = protectionConfig.tenantChecker.getCurrentTenant(request);\n      }\n\n      return currentTenantPromise;\n    },\n    initializeTenant: async () => {\n      if (!protectionConfig.tenantChecker) {\n        return null;\n      }\n\n      if (!initializeTenantPromise) {\n        initializeTenantPromise = protectionConfig.tenantChecker.initializeTenant(request);\n      }\n\n      return initializeTenantPromise;\n    },\n  };\n}\n\nasync function applyConfiguredRouteResolution(\n  request: Request,\n  user: UserInfo,\n  currentPath: string,\n  protection: ProtectionLevel\n): Promise<boolean> {\n  if (!protectionConfig.resolveRoute) {\n    return false;\n  }\n\n  const context = createRouteResolverContext(request, user, currentPath, protection);\n\n  try {\n    const result = await protectionConfig.resolveRoute(context);\n    if (result) {\n      throw createRedirectFromConfig(result);\n    }\n\n    return true;\n  } catch (error) {\n    if (error instanceof Response && error.status >= 300 && error.status < 400) {\n      throw error;\n    }\n\n    if (!protectionConfig.handleRouteError) {\n      throw error;\n    }\n\n    const recovery = await protectionConfig.handleRouteError({\n      ...context,\n      error,\n    });\n\n    if (recovery) {\n      throw createRedirectFromConfig(recovery);\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Check user status (onboarding, subscription)\n */\nasync function checkUserStatus(\n  request: Request, \n  user: UserInfo, \n  currentPath: string\n): Promise<Response | null> {\n  if (!protectionConfig.identityChecker) {\n    logger.warn('Identity checker not configured, skipping status check');\n    return null;\n  }\n\n  try {\n    const context = await protectionConfig.identityChecker.getIdentityContext(request, user.sub);\n\n    logger.debug('User status check', {\n      userId: user.sub,\n      currentPath,\n      hasAnyMembership: context.hasAnyMembership,\n      isOnboarded: context.isOnboarded,\n      hasSubscription: context.hasSubscription,\n    });\n\n    // Check if user needs onboarding\n    if (!context.hasAnyMembership) {\n      if (currentPath !== '/onboarding') {\n        logger.info('User has no memberships, redirecting to onboarding');\n        throw createRedirectResponse('/onboarding');\n      }\n      return null;\n    }\n\n    // Check subscription status\n    if (context.hasAnyMembership) {\n      if (currentPath === '/onboarding') {\n        logger.info('User has memberships, redirecting from onboarding to subscription');\n        throw createRedirectResponse('/subscription');\n      }\n\n      if (currentPath === '/subscription') {\n        return null;\n      }\n\n      // Check tenant subscription\n      if (protectionConfig.tenantChecker && protectionConfig.subscriptionChecker) {\n        let currentTenant = await protectionConfig.tenantChecker.getCurrentTenant(request);\n\n        if (!currentTenant) {\n          const initResult = await protectionConfig.tenantChecker.initializeTenant(request);\n          if (initResult) {\n            currentTenant = initResult.tenantId;\n          }\n        }\n\n        if (currentTenant) {\n          const hasSubscription = await protectionConfig.subscriptionChecker.checkTenantSubscriptionStatus(\n            request,\n            currentTenant\n          );\n\n          if (!hasSubscription) {\n            logger.info('Tenant has no subscription, redirecting to subscription');\n            throw createRedirectResponse('/subscription');\n          }\n        } else {\n          logger.info('Could not initialize tenant, redirecting to subscription');\n          throw createRedirectResponse('/subscription');\n        }\n      }\n    }\n\n    return null;\n  } catch (error) {\n    if (error instanceof Response && error.status >= 300 && error.status < 400) {\n      throw error;\n    }\n\n    logger.error('Error checking user status', error instanceof Error ? error : undefined);\n\n    if (currentPath !== '/onboarding') {\n      throw createRedirectResponse('/onboarding');\n    }\n\n    return null;\n  }\n}\n\n/**\n * Main route protection function\n */\nexport async function protectRoute<T>(\n  request: Request,\n  protection: ProtectionLevel,\n  loaderFn: (user?: UserInfo) => Promise<T> | T\n): Promise<T> {\n  const url = new URL(request.url);\n\n  switch (protection) {\n    case 'public':\n      try {\n        await autoRefreshTokens(request);\n        const user = await getUser(request);\n        return loaderFn(user ?? undefined);\n      } catch {\n        return loaderFn(undefined);\n      }\n\n    case 'auth':\n      try {\n        await autoRefreshTokens(request);\n        const user = await requireAuth(request);\n        const handledByConfig = await applyConfiguredRouteResolution(request, user, url.pathname, 'auth');\n        if (!handledByConfig) {\n          await checkUserStatus(request, user, url.pathname);\n        }\n        return loaderFn(user);\n      } catch (error) {\n        if (error instanceof Response && error.status >= 300 && error.status < 400) {\n          throw error;\n        }\n        throw await login(request, getLoginReturnUrl(request, url.pathname, 'auth'));\n      }\n\n    case 'onboarding-required':\n      try {\n        await autoRefreshTokens(request);\n        const user = await requireAuth(request);\n\n        const handledByConfig = await applyConfiguredRouteResolution(\n          request,\n          user,\n          url.pathname,\n          'onboarding-required'\n        );\n        if (!handledByConfig && protectionConfig.identityChecker) {\n          const context = await protectionConfig.identityChecker.getIdentityContext(request, user.sub);\n          if (context.hasAnyMembership) {\n            throw createRedirectResponse('/subscription');\n          }\n        }\n\n        return loaderFn(user);\n      } catch (error) {\n        if (error instanceof Response && error.status >= 300 && error.status < 400) {\n          throw error;\n        }\n        throw await login(request, getLoginReturnUrl(request, url.pathname, 'onboarding-required'));\n      }\n\n    case 'subscription-required':\n      try {\n        await autoRefreshTokens(request);\n        const user = await requireAuth(request);\n\n        const handledByConfig = await applyConfiguredRouteResolution(\n          request,\n          user,\n          url.pathname,\n          'subscription-required'\n        );\n        if (!handledByConfig && protectionConfig.identityChecker) {\n          const context = await protectionConfig.identityChecker.getIdentityContext(request, user.sub);\n          if (!context.hasAnyMembership) {\n            throw createRedirectResponse('/onboarding');\n          }\n        }\n\n        // Initialize tenant if needed\n        if (protectionConfig.tenantChecker) {\n          const currentTenant = await protectionConfig.tenantChecker.getCurrentTenant(request);\n          if (!currentTenant) {\n            await protectionConfig.tenantChecker.initializeTenant(request);\n          }\n        }\n\n        return loaderFn(user);\n      } catch (error) {\n        if (error instanceof Response && error.status >= 300 && error.status < 400) {\n          throw error;\n        }\n        throw await login(request, getLoginReturnUrl(request, url.pathname, 'subscription-required'));\n      }\n\n    default:\n      throw new Error(`Unknown protection level: ${protection}`);\n  }\n}\n\n// ============================================================================\n// Convenience Functions\n// ============================================================================\n\n/**\n * Public route (optional auth)\n */\nexport const publicRoute = <T>(\n  request: Request,\n  loaderFn: (user?: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'public', loaderFn);\n\n/**\n * Auth-protected route\n */\nexport const authRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'auth', loaderFn as (user?: UserInfo) => Promise<T> | T);\n\n/**\n * Onboarding route\n */\nexport const onboardingRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'onboarding-required', loaderFn as (user?: UserInfo) => Promise<T> | T);\n\n/**\n * Subscription route\n */\nexport const subscriptionRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'subscription-required', loaderFn as (user?: UserInfo) => Promise<T> | T);\n","/**\n * Token Refresh Server Module\n */\n\nimport { refreshTokens } from './auth.server';\nimport { getAuthSession } from './redis-session-storage.server';\nimport type { TokenRefreshResult } from './types';\nimport { logger } from '../logging';\n\n/**\n * Attempt to refresh the access token\n */\nexport async function attemptTokenRefresh(request: Request): Promise<TokenRefreshResult> {\n  try {\n    logger.info('Attempting token refresh due to 401 response');\n\n    const sessionData = await getAuthSession(request);\n\n    if (!sessionData.refreshToken) {\n      logger.warn('No refresh token available in session');\n      return {\n        success: false,\n        error: 'No refresh token available',\n        shouldLogout: true,\n      };\n    }\n\n    const refreshResult = await refreshTokens(request, sessionData.refreshToken);\n\n    if (!refreshResult.success) {\n      logger.error('Token refresh failed', undefined, {\n        error: refreshResult.error,\n        shouldLogout: refreshResult.shouldLogout,\n      });\n\n      return {\n        success: false,\n        error: refreshResult.error,\n        shouldLogout: refreshResult.shouldLogout,\n      };\n    }\n\n    const tokens = refreshResult.tokens;\n    if (!tokens || !tokens.access_token) {\n      logger.error('Token refresh succeeded but no access token returned');\n      return {\n        success: false,\n        error: 'No access token in refresh response',\n        shouldLogout: true,\n      };\n    }\n\n    logger.info('Token refresh successful');\n\n    return {\n      success: true,\n      newAccessToken: tokens.access_token,\n    };\n  } catch (error) {\n    logger.error('Token refresh attempt failed', error instanceof Error ? error : undefined);\n    return {\n      success: false,\n      error: error instanceof Error ? error.message : 'Unknown error',\n      shouldLogout: true,\n    };\n  }\n}\n\n/**\n * Check if a response indicates token expiration\n */\nexport function isTokenExpiredResponse(response: Response): boolean {\n  return response.status === 401;\n}\n\n/**\n * Check if token refresh should be attempted\n */\nexport function shouldAttemptTokenRefresh(response: Response, hasAuth: boolean): boolean {\n  return hasAuth && isTokenExpiredResponse(response);\n}\n"],"mappings":";;;;;AAaA,MAAM,oBAAoB,IAAI,KAAK;;;;AAKnC,eAAsB,mBAAmBA,SAAoC;AAC3E,KAAI;EACF,MAAM,cAAc,MAAM,eAAe,QAAQ;AAEjD,OAAK,YAAY,gBAAgB,YAAY,aAAa,WAAW,GAAG;AACtE,OAAI,YAAY,aAAa,KAAK,KAAK,IAAI,YAAY,WAAW;AAChE,WAAO,KAAK,kEAAkE;IAC9E,MAAM,EAAE,QAAQ,GAAG,MAAM,OAAO;IAChC,MAAM,gBAAgB,MAAM,6BAA6B,SAAS,2BAA2B;AAC7F,UAAM,MAAM,OAAO,cAAc;GAClC;AACD,UAAO;EACR;AAED,OAAK,YAAY,cAAc,YAAY,YACzC,QAAO;EAGT,MAAM,MAAM,KAAK,KAAK;EAGtB,IAAIC,YAA2B;AAC/B,MAAI;GACF,MAAM,aAAa,YAAY,YAAY,MAAM,IAAI;AACrD,OAAI,WAAW,WAAW,GAAG;IAC3B,MAAM,UAAU,KAAK,MAAM,OAAO,KAAK,WAAW,IAAI,SAAS,CAAC,UAAU,CAAC;AAC3E,QAAI,QAAQ,IACV,aAAY,QAAQ,MAAM;GAE7B;EACF,QAAO,CAEP;EAED,MAAM,iBAAiB,aAAa,YAAY,YAAY,YACxD,YACA,YAAY;EAChB,MAAM,0BAA0B,iBAAiB;AAEjD,SAAO,2BAA2B;CACnC,SAAQ,OAAO;AACd,SAAO,MAAM,gCAAgC,iBAAiB,QAAQ,eAAkB;AACxF,SAAO;CACR;AACF;;;;AAKD,eAAe,kBAAkBD,SAAiC;AAChE,KAAI;EACF,MAAM,eAAe,MAAM,mBAAmB,QAAQ;AAEtD,MAAI,cAAc;AAChB,UAAO,KAAK,uCAAuC;GACnD,MAAM,SAAS,MAAM,cAAc,QAAQ;AAE3C,OAAI,OAAO,QACT,QAAO,KAAK,sCAAsC;QAC7C;AACL,WAAO,MAAM,+BAAkC,EAAE,OAAO,OAAO,MAAO,EAAC;AAEvE,QAAI,OAAO,cAAc;AACvB,YAAO,MAAM,qDAAqD;KAClE,MAAM,EAAE,QAAQ,GAAG,MAAM,OAAO;KAChC,MAAM,gBAAgB,MAAM,6BAA6B,SAAS,iBAAiB;AACnF,WAAM,MAAM,OAAO,cAAc;IAClC;GACF;EACF;CACF,SAAQ,OAAO;AACd,MAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,IACrE,OAAM;AAER,QAAM;CACP;AACF;AAqFD,IAAIE,mBAA+C,CAAE;;;;AAKrD,SAAgB,yBACdC,QACM;AACN,oBAAmB;AACpB;;;;AAKD,SAAgB,6BAAmC;AACjD,oBAAmB,CAAE;AACtB;AAED,SAAS,yBAAyBC,UAA6C;AAC7E,QAAO,uBAAuB,SAAS,UAAU;EAC/C,SAAS,SAAS;EAClB,QAAQ,SAAS;CAClB,EAAC;AACH;AAED,SAAS,kBACPJ,SACAK,aACAC,YACQ;AACR,KAAI,iBAAiB,kBACnB,QAAO,iBAAiB,kBAAkB;EACxC;EACA;EACA;CACD,EAAC;AAGJ,SAAQ,YAAR;EACE,KAAK,sBACH,QAAO;EACT,KAAK,wBACH,QAAO;EACT,KAAK,SACH,QAAO;EACT,KAAK;EACL,SAAS;GACP,MAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,UAAO,IAAI,aAAa,MAAM,OAAO,EAAE,IAAI,SAAS,EAAE,IAAI,OAAO;EAClE;CACF;AACF;AAED,eAAe,6BACbN,SACAO,QACkB;AAClB,KAAI,iBAAiB,6BACnB,QAAO,iBAAiB,6BAA6B;EAAE;EAAS;CAAQ,EAAC;CAG3E,MAAM,YAAY,IAAI,IAAI,QAAQ;AAClC,WAAU,WAAW;AACrB,WAAU,aAAa,IAAI,kBAAkB,OAAO;AAEpD,QAAO,IAAI,QAAQ,UAAU,UAAU,EAAE,EACvC,SAAS,QAAQ,QAClB;AACF;AAED,SAAS,2BACPP,SACAQ,MACAH,aACAC,YACqC;CACrC,IAAIG,yBAAqD;CACzD,IAAIC,uBAAsD;CAC1D,IAAIC,0BAAyF;AAE7F,QAAO;EACL;EACA;EACA;EACA;EACA,oBAAoB,OAAO,eAAe,UAAU;AAClD,QAAK,iBAAiB,gBACpB,QAAO;AAGT,OAAI,aACF,QAAO,iBAAiB,gBAAgB,mBAAmB,SAAS,KAAK,KAAK,KAAK;AAGrF,QAAK,uBACH,0BAAyB,iBAAiB,gBAAgB,mBAAmB,SAAS,KAAK,IAAI;AAGjG,UAAO;EACR;EACD,kBAAkB,YAAY;AAC5B,QAAK,iBAAiB,cACpB,QAAO;AAGT,QAAK,qBACH,wBAAuB,iBAAiB,cAAc,iBAAiB,QAAQ;AAGjF,UAAO;EACR;EACD,kBAAkB,YAAY;AAC5B,QAAK,iBAAiB,cACpB,QAAO;AAGT,QAAK,wBACH,2BAA0B,iBAAiB,cAAc,iBAAiB,QAAQ;AAGpF,UAAO;EACR;CACF;AACF;AAED,eAAe,+BACbX,SACAQ,MACAH,aACAC,YACkB;AAClB,MAAK,iBAAiB,aACpB,QAAO;CAGT,MAAM,UAAU,2BAA2B,SAAS,MAAM,aAAa,WAAW;AAElF,KAAI;EACF,MAAM,SAAS,MAAM,iBAAiB,aAAa,QAAQ;AAC3D,MAAI,OACF,OAAM,yBAAyB,OAAO;AAGxC,SAAO;CACR,SAAQ,OAAO;AACd,MAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,IACrE,OAAM;AAGR,OAAK,iBAAiB,iBACpB,OAAM;EAGR,MAAM,WAAW,MAAM,iBAAiB,iBAAiB;GACvD,GAAG;GACH;EACD,EAAC;AAEF,MAAI,SACF,OAAM,yBAAyB,SAAS;AAG1C,QAAM;CACP;AACF;;;;AAKD,eAAe,gBACbN,SACAQ,MACAH,aAC0B;AAC1B,MAAK,iBAAiB,iBAAiB;AACrC,SAAO,KAAK,yDAAyD;AACrE,SAAO;CACR;AAED,KAAI;EACF,MAAM,UAAU,MAAM,iBAAiB,gBAAgB,mBAAmB,SAAS,KAAK,IAAI;AAE5F,SAAO,MAAM,qBAAqB;GAChC,QAAQ,KAAK;GACb;GACA,kBAAkB,QAAQ;GAC1B,aAAa,QAAQ;GACrB,iBAAiB,QAAQ;EAC1B,EAAC;AAGF,OAAK,QAAQ,kBAAkB;AAC7B,OAAI,gBAAgB,eAAe;AACjC,WAAO,KAAK,qDAAqD;AACjE,UAAM,uBAAuB,cAAc;GAC5C;AACD,UAAO;EACR;AAGD,MAAI,QAAQ,kBAAkB;AAC5B,OAAI,gBAAgB,eAAe;AACjC,WAAO,KAAK,oEAAoE;AAChF,UAAM,uBAAuB,gBAAgB;GAC9C;AAED,OAAI,gBAAgB,gBAClB,QAAO;AAIT,OAAI,iBAAiB,iBAAiB,iBAAiB,qBAAqB;IAC1E,IAAI,gBAAgB,MAAM,iBAAiB,cAAc,iBAAiB,QAAQ;AAElF,SAAK,eAAe;KAClB,MAAM,aAAa,MAAM,iBAAiB,cAAc,iBAAiB,QAAQ;AACjF,SAAI,WACF,iBAAgB,WAAW;IAE9B;AAED,QAAI,eAAe;KACjB,MAAM,kBAAkB,MAAM,iBAAiB,oBAAoB,8BACjE,SACA,cACD;AAED,UAAK,iBAAiB;AACpB,aAAO,KAAK,0DAA0D;AACtE,YAAM,uBAAuB,gBAAgB;KAC9C;IACF,OAAM;AACL,YAAO,KAAK,2DAA2D;AACvE,WAAM,uBAAuB,gBAAgB;IAC9C;GACF;EACF;AAED,SAAO;CACR,SAAQ,OAAO;AACd,MAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,IACrE,OAAM;AAGR,SAAO,MAAM,8BAA8B,iBAAiB,QAAQ,eAAkB;AAEtF,MAAI,gBAAgB,cAClB,OAAM,uBAAuB,cAAc;AAG7C,SAAO;CACR;AACF;;;;AAKD,eAAsB,aACpBL,SACAM,YACAM,UACY;CACZ,MAAM,MAAM,IAAI,IAAI,QAAQ;AAE5B,SAAQ,YAAR;EACE,KAAK,SACH,KAAI;AACF,SAAM,kBAAkB,QAAQ;GAChC,MAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,UAAO,SAAS,eAAkB;EACnC,QAAO;AACN,UAAO,gBAAmB;EAC3B;EAEH,KAAK,OACH,KAAI;AACF,SAAM,kBAAkB,QAAQ;GAChC,MAAM,OAAO,MAAM,YAAY,QAAQ;GACvC,MAAM,kBAAkB,MAAM,+BAA+B,SAAS,MAAM,IAAI,UAAU,OAAO;AACjG,QAAK,gBACH,OAAM,gBAAgB,SAAS,MAAM,IAAI,SAAS;AAEpD,UAAO,SAAS,KAAK;EACtB,SAAQ,OAAO;AACd,OAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,IACrE,OAAM;AAER,SAAM,MAAM,MAAM,SAAS,kBAAkB,SAAS,IAAI,UAAU,OAAO,CAAC;EAC7E;EAEH,KAAK,sBACH,KAAI;AACF,SAAM,kBAAkB,QAAQ;GAChC,MAAM,OAAO,MAAM,YAAY,QAAQ;GAEvC,MAAM,kBAAkB,MAAM,+BAC5B,SACA,MACA,IAAI,UACJ,sBACD;AACD,QAAK,mBAAmB,iBAAiB,iBAAiB;IACxD,MAAM,UAAU,MAAM,iBAAiB,gBAAgB,mBAAmB,SAAS,KAAK,IAAI;AAC5F,QAAI,QAAQ,iBACV,OAAM,uBAAuB,gBAAgB;GAEhD;AAED,UAAO,SAAS,KAAK;EACtB,SAAQ,OAAO;AACd,OAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,IACrE,OAAM;AAER,SAAM,MAAM,MAAM,SAAS,kBAAkB,SAAS,IAAI,UAAU,sBAAsB,CAAC;EAC5F;EAEH,KAAK,wBACH,KAAI;AACF,SAAM,kBAAkB,QAAQ;GAChC,MAAM,OAAO,MAAM,YAAY,QAAQ;GAEvC,MAAM,kBAAkB,MAAM,+BAC5B,SACA,MACA,IAAI,UACJ,wBACD;AACD,QAAK,mBAAmB,iBAAiB,iBAAiB;IACxD,MAAM,UAAU,MAAM,iBAAiB,gBAAgB,mBAAmB,SAAS,KAAK,IAAI;AAC5F,SAAK,QAAQ,iBACX,OAAM,uBAAuB,cAAc;GAE9C;AAGD,OAAI,iBAAiB,eAAe;IAClC,MAAM,gBAAgB,MAAM,iBAAiB,cAAc,iBAAiB,QAAQ;AACpF,SAAK,cACH,OAAM,iBAAiB,cAAc,iBAAiB,QAAQ;GAEjE;AAED,UAAO,SAAS,KAAK;EACtB,SAAQ,OAAO;AACd,OAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,IACrE,OAAM;AAER,SAAM,MAAM,MAAM,SAAS,kBAAkB,SAAS,IAAI,UAAU,wBAAwB,CAAC;EAC9F;EAEH,QACE,OAAM,IAAI,OAAO,4BAA4B,WAAW;CAC3D;AACF;;;;AASD,MAAa,cAAc,CACzBZ,SACAY,aACG,aAAa,SAAS,UAAU,SAAS;;;;AAK9C,MAAa,YAAY,CACvBZ,SACAa,aACG,aAAa,SAAS,QAAQ,SAAgD;;;;AAKnF,MAAa,kBAAkB,CAC7Bb,SACAa,aACG,aAAa,SAAS,uBAAuB,SAAgD;;;;AAKlG,MAAa,oBAAoB,CAC/Bb,SACAa,aACG,aAAa,SAAS,yBAAyB,SAAgD;;;;;;;AC5iBpG,eAAsB,oBAAoBC,SAA+C;AACvF,KAAI;AACF,SAAO,KAAK,+CAA+C;EAE3D,MAAM,cAAc,MAAM,eAAe,QAAQ;AAEjD,OAAK,YAAY,cAAc;AAC7B,UAAO,KAAK,wCAAwC;AACpD,UAAO;IACL,SAAS;IACT,OAAO;IACP,cAAc;GACf;EACF;EAED,MAAM,gBAAgB,MAAM,cAAc,SAAS,YAAY,aAAa;AAE5E,OAAK,cAAc,SAAS;AAC1B,UAAO,MAAM,gCAAmC;IAC9C,OAAO,cAAc;IACrB,cAAc,cAAc;GAC7B,EAAC;AAEF,UAAO;IACL,SAAS;IACT,OAAO,cAAc;IACrB,cAAc,cAAc;GAC7B;EACF;EAED,MAAM,SAAS,cAAc;AAC7B,OAAK,WAAW,OAAO,cAAc;AACnC,UAAO,MAAM,uDAAuD;AACpE,UAAO;IACL,SAAS;IACT,OAAO;IACP,cAAc;GACf;EACF;AAED,SAAO,KAAK,2BAA2B;AAEvC,SAAO;GACL,SAAS;GACT,gBAAgB,OAAO;EACxB;CACF,SAAQ,OAAO;AACd,SAAO,MAAM,gCAAgC,iBAAiB,QAAQ,eAAkB;AACxF,SAAO;GACL,SAAS;GACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU;GAChD,cAAc;EACf;CACF;AACF;;;;AAKD,SAAgB,uBAAuBC,UAA6B;AAClE,QAAO,SAAS,WAAW;AAC5B;;;;AAKD,SAAgB,0BAA0BA,UAAoBC,SAA2B;AACvF,QAAO,WAAW,uBAAuB,SAAS;AACnD"}