@eminuckan/spine 0.2.2 → 0.3.0

package/dist/auth.server-Cx2h2qu3.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.server-Cx2h2qu3.js","names":["location: string","init: RedirectResponseInit","config: AuthConfig","applicationType: ApplicationType","OIDC_CONFIG: AuthConfig | null","authServerCache: {\n  authorizationServer: oauth.AuthorizationServer;\n  client: oauth.Client;\n  cachedAt: number;\n} | null","client: oauth.Client","DEFAULT_AUTH_CLAIM_MAPPING: Required<AuthClaimMapping>","authClaimMapping: Required<AuthClaimMapping>","keys?: string[]","mapping: AuthClaimMapping","claims: Record<string, unknown>","claimKeys: string[]","value: string","value: unknown","tenants: string[]","tenantRoles: Record<string, string[]>","parsedRoles: unknown","tokenResult: oauth.TokenEndpointResponse","baseUser: UserInfo","request: Request","returnUrlOrOptions?: string | LoginOptions","options: LoginOptions","headers","oauthState: OAuthState","redirectUri","baseUrl","refreshToken?: string","errorData: Record<string, unknown>"],"sources":["../src/http/response.ts","../src/auth/auth.server.ts"],"sourcesContent":["/**\n * HTTP response helpers that stay framework-agnostic.\n */\n\nexport interface RedirectResponseInit {\n  headers?: HeadersInit;\n  status?: number;\n}\n\n/**\n * Create a redirect response without relying on a router/framework helper.\n */\nexport function createRedirectResponse(\n  location: string,\n  init: RedirectResponseInit = {}\n): Response {\n  const headers = new Headers(init.headers);\n  headers.set('Location', location);\n\n  return new Response(null, {\n    status: init.status ?? 302,\n    headers,\n  });\n}\n","/**\n * OAuth2/OIDC Authentication Server Module\n *\n * Handles:\n * - Login flow (PKCE)\n * - Token exchange\n * - Token refresh\n * - Logout\n * - Session management\n */\n\nimport * as oauth from 'oauth4webapi';\n\nimport {\n  createAuthSession,\n  getAuthSession,\n  updateAuthSession,\n  destroyAuthSession,\n  isSessionValid,\n  createOAuthState,\n  getOAuthState,\n  deleteOAuthState,\n  AUTH_ERROR_COOKIE_PREFIX,\n} from './redis-session-storage.server';\nimport type { \n  AuthConfig, \n  AuthClaimMapping,\n  UserInfo, \n  SessionData, \n  OAuthState,\n  TokenRefreshResult,\n  LoginOptions,\n  ApplicationType,\n  AuthError\n} from './types';\nimport { logger } from '../logging';\nimport { createRedirectResponse } from '../http/response';\n\n// ============================================================================\n// Configuration\n// ============================================================================\n\n/**\n * Get effective SSO logout setting based on config\n */\nfunction getEffectiveSsoLogout(config: AuthConfig): boolean {\n  // Explicit setting takes precedence\n  if (config.ssoLogout !== undefined) {\n    return config.ssoLogout;\n  }\n  \n  // Determine by application type\n  switch (config.applicationType) {\n    case 'no-landing-page':\n    case 'dashboard':\n      return true; // Dashboard needs full logout (no landing page)\n    case 'landing-page':\n    case 'tenant-app':\n      return false; // Tenant app uses app-specific logout\n    default:\n      return false; // Default to app-specific logout\n  }\n}\n\n/**\n * Get effective hasLandingPage setting based on config\n */\nfunction getEffectiveHasLandingPage(config: AuthConfig): boolean {\n  // Explicit setting takes precedence\n  if (config.hasLandingPage !== undefined) {\n    return config.hasLandingPage;\n  }\n  \n  // Determine by application type\n  switch (config.applicationType) {\n    case 'no-landing-page':\n    case 'dashboard':\n      return false; // Dashboard has no landing page\n    case 'landing-page':\n    case 'tenant-app':\n      return true; // Tenant app has landing page\n    default:\n      return true; // Default to having a landing page\n  }\n}\n\n/**\n * Create OAuth configuration from environment variables\n */\nfunction createAuthConfig(): AuthConfig {\n  const requiredEnvVars = {\n    authority: process.env.OIDC_AUTHORITY,\n    clientId: process.env.OIDC_CLIENT_ID,\n    redirectUri: process.env.OIDC_REDIRECT_URI,\n  };\n\n  for (const [key, value] of Object.entries(requiredEnvVars)) {\n    if (!value) {\n      throw new Error(`Missing required environment variable: OIDC_${key.toUpperCase()}`);\n    }\n  }\n\n  // Parse application type from env\n  const appTypeEnv = process.env.OIDC_APPLICATION_TYPE?.toLowerCase();\n  let applicationType: ApplicationType = 'custom';\n  if (appTypeEnv === 'no-landing-page' || appTypeEnv === 'no_landing_page') {\n    applicationType = 'no-landing-page';\n  } else if (appTypeEnv === 'landing-page' || appTypeEnv === 'landing_page') {\n    applicationType = 'landing-page';\n  } else if (appTypeEnv === 'dashboard') {\n    applicationType = 'dashboard';\n  } else if (appTypeEnv === 'tenant-app' || appTypeEnv === 'tenant_app') {\n    applicationType = 'tenant-app';\n  }\n\n  // Parse boolean env vars\n  const ssoLogout = process.env.OIDC_SSO_LOGOUT !== undefined\n    ? process.env.OIDC_SSO_LOGOUT === 'true'\n    : undefined;\n    \n  const hasLandingPage = process.env.OIDC_HAS_LANDING_PAGE !== undefined\n    ? process.env.OIDC_HAS_LANDING_PAGE === 'true'\n    : undefined;\n\n  return {\n    authority: requiredEnvVars.authority!,\n    clientId: requiredEnvVars.clientId!,\n    clientSecret: process.env.OIDC_CLIENT_SECRET,\n    redirectUri: requiredEnvVars.redirectUri!,\n    scope: process.env.OIDC_SCOPE || 'openid offline_access api',\n    postLogoutRedirectUri: process.env.OIDC_POST_LOGOUT_REDIRECT_URI,\n    applicationType,\n    ssoLogout,\n    hasLandingPage,\n  };\n}\n\nlet OIDC_CONFIG: AuthConfig | null = null;\n\nfunction getAuthConfig(): AuthConfig {\n  if (!OIDC_CONFIG) {\n    OIDC_CONFIG = createAuthConfig();\n  }\n  return OIDC_CONFIG;\n}\n\n// ============================================================================\n// OAuth Discovery Cache\n// ============================================================================\n\nlet authServerCache: {\n  authorizationServer: oauth.AuthorizationServer;\n  client: oauth.Client;\n  cachedAt: number;\n} | null = null;\n\nconst CACHE_TTL = 60 * 60 * 1000; // 1 hour\n\n/**\n * Get OAuth configuration with caching\n */\nasync function getOAuthConfig(): Promise<{\n  authorizationServer: oauth.AuthorizationServer;\n  client: oauth.Client;\n}> {\n  const config = getAuthConfig();\n  const now = Date.now();\n\n  if (authServerCache && now - authServerCache.cachedAt < CACHE_TTL) {\n    return {\n      authorizationServer: authServerCache.authorizationServer,\n      client: authServerCache.client,\n    };\n  }\n\n  try {\n    const issuer = new URL(config.authority);\n    const discoveryResponse = await oauth.discoveryRequest(issuer, {\n      algorithm: 'oidc',\n    });\n\n    if (!discoveryResponse.ok) {\n      const errorText = await discoveryResponse.text().catch(() => 'Unable to read response');\n      logger.error('OAuth discovery error', undefined, { errorText });\n      throw new Error(`OAuth discovery failed with status ${discoveryResponse.status}`);\n    }\n\n    const authorizationServer = await oauth.processDiscoveryResponse(issuer, discoveryResponse);\n\n    const client: oauth.Client = {\n      client_id: config.clientId,\n    };\n\n    authServerCache = {\n      authorizationServer,\n      client,\n      cachedAt: now,\n    };\n\n    logger.info('OAuth discovery completed successfully');\n    return { authorizationServer, client };\n  } catch (error) {\n    logger.error('OAuth discovery failed', error instanceof Error ? error : undefined);\n    throw new Error(`OAuth discovery failed: ${error instanceof Error ? error.message : 'Unknown error'}`);\n  }\n}\n\n/**\n * Get client authentication method (None for public client with PKCE)\n */\nfunction getClientAuth(): oauth.ClientAuth {\n  return oauth.None();\n}\n\n// ============================================================================\n// Claim Extraction\n// ============================================================================\n\nconst DEFAULT_AUTH_CLAIM_MAPPING: Required<AuthClaimMapping> = {\n  subject: ['sub'],\n  name: ['name', 'preferred_username', 'email'],\n  email: ['email'],\n  givenName: ['given_name', 'givenName'],\n  familyName: ['family_name', 'familyName'],\n  picture: ['picture', 'avatar_url'],\n  locale: ['locale'],\n  zoneinfo: ['zoneinfo'],\n  updatedAt: ['updated_at'],\n  tenantIds: ['tenant_ids'],\n  tenantRoles: ['tenant_roles'],\n  permissions: ['app_perms', 'permissions', 'scope'],\n  isOnboarded: ['is_onboarded'],\n};\n\nlet authClaimMapping: Required<AuthClaimMapping> = {\n  ...DEFAULT_AUTH_CLAIM_MAPPING,\n};\n\nfunction normalizeClaimKeys(keys?: string[]): string[] {\n  if (!Array.isArray(keys)) {\n    return [];\n  }\n\n  return Array.from(\n    new Set(\n      keys\n        .map((key) => key.trim())\n        .filter((key) => key.length > 0)\n    )\n  );\n}\n\n/**\n * Configure claim mapping so different providers/backends can project their\n * own claim names onto the shared auth/session primitives.\n */\nexport function configureAuthClaimMapping(mapping: AuthClaimMapping): void {\n  authClaimMapping = {\n    subject: mapping.subject !== undefined ? normalizeClaimKeys(mapping.subject) : DEFAULT_AUTH_CLAIM_MAPPING.subject,\n    name: mapping.name !== undefined ? normalizeClaimKeys(mapping.name) : DEFAULT_AUTH_CLAIM_MAPPING.name,\n    email: mapping.email !== undefined ? normalizeClaimKeys(mapping.email) : DEFAULT_AUTH_CLAIM_MAPPING.email,\n    givenName: mapping.givenName !== undefined ? normalizeClaimKeys(mapping.givenName) : DEFAULT_AUTH_CLAIM_MAPPING.givenName,\n    familyName: mapping.familyName !== undefined ? normalizeClaimKeys(mapping.familyName) : DEFAULT_AUTH_CLAIM_MAPPING.familyName,\n    picture: mapping.picture !== undefined ? normalizeClaimKeys(mapping.picture) : DEFAULT_AUTH_CLAIM_MAPPING.picture,\n    locale: mapping.locale !== undefined ? normalizeClaimKeys(mapping.locale) : DEFAULT_AUTH_CLAIM_MAPPING.locale,\n    zoneinfo: mapping.zoneinfo !== undefined ? normalizeClaimKeys(mapping.zoneinfo) : DEFAULT_AUTH_CLAIM_MAPPING.zoneinfo,\n    updatedAt: mapping.updatedAt !== undefined ? normalizeClaimKeys(mapping.updatedAt) : DEFAULT_AUTH_CLAIM_MAPPING.updatedAt,\n    tenantIds: mapping.tenantIds !== undefined ? normalizeClaimKeys(mapping.tenantIds) : DEFAULT_AUTH_CLAIM_MAPPING.tenantIds,\n    tenantRoles: mapping.tenantRoles !== undefined ? normalizeClaimKeys(mapping.tenantRoles) : DEFAULT_AUTH_CLAIM_MAPPING.tenantRoles,\n    permissions: mapping.permissions !== undefined ? normalizeClaimKeys(mapping.permissions) : DEFAULT_AUTH_CLAIM_MAPPING.permissions,\n    isOnboarded: mapping.isOnboarded !== undefined ? normalizeClaimKeys(mapping.isOnboarded) : DEFAULT_AUTH_CLAIM_MAPPING.isOnboarded,\n  };\n}\n\n/**\n * Reset claim mapping to the built-in defaults.\n */\nexport function resetAuthClaimMapping(): void {\n  authClaimMapping = {\n    ...DEFAULT_AUTH_CLAIM_MAPPING,\n  };\n}\n\nfunction getConfiguredAuthClaimMapping(): Required<AuthClaimMapping> {\n  return authClaimMapping;\n}\n\nfunction getFirstClaimValue(\n  claims: Record<string, unknown>,\n  claimKeys: string[]\n): { key?: string; value?: unknown } {\n  for (const claimKey of claimKeys) {\n    if (claimKey in claims) {\n      return {\n        key: claimKey,\n        value: claims[claimKey],\n      };\n    }\n  }\n\n  return {};\n}\n\nfunction getStringClaim(claims: Record<string, unknown>, claimKeys: string[]): string | undefined {\n  const { value } = getFirstClaimValue(claims, claimKeys);\n\n  if (typeof value === 'string') {\n    const trimmed = value.trim();\n    return trimmed.length > 0 ? trimmed : undefined;\n  }\n\n  if (typeof value === 'number' || typeof value === 'boolean') {\n    return `${value}`;\n  }\n\n  return undefined;\n}\n\nfunction getNumberClaim(claims: Record<string, unknown>, claimKeys: string[]): number | undefined {\n  const { value } = getFirstClaimValue(claims, claimKeys);\n\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    return value;\n  }\n\n  if (typeof value === 'string') {\n    const parsed = Number(value);\n    return Number.isFinite(parsed) ? parsed : undefined;\n  }\n\n  return undefined;\n}\n\nfunction getBooleanClaim(\n  claims: Record<string, unknown>,\n  claimKeys: string[],\n  defaultValue = false\n): boolean {\n  const { value } = getFirstClaimValue(claims, claimKeys);\n\n  if (typeof value === 'boolean') {\n    return value;\n  }\n\n  if (typeof value === 'string') {\n    return value.toLowerCase() === 'true';\n  }\n\n  return defaultValue;\n}\n\n/**\n * Parse JSON safely\n */\nfunction parseJson(value: string): unknown {\n  try {\n    return JSON.parse(value);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Convert value to string array\n */\nfunction toStringArray(value: unknown): string[] {\n  if (!value) return [];\n\n  if (Array.isArray(value)) {\n    return value\n      .map((item) => (typeof item === 'string' ? item.trim() : `${item}`.trim()))\n      .filter((item) => item.length > 0);\n  }\n\n  if (typeof value === 'string') {\n    const trimmed = value.trim();\n    if (!trimmed) return [];\n\n    if (trimmed.startsWith('[')) {\n      const parsed = parseJson(trimmed);\n      if (Array.isArray(parsed)) {\n        return parsed\n          .map((item) => (typeof item === 'string' ? item.trim() : `${item}`.trim()))\n          .filter((item) => item.length > 0);\n      }\n    }\n\n    if (trimmed.includes(',')) {\n      return trimmed\n        .split(',')\n        .map((item) => item.trim())\n        .filter((item) => item.length > 0);\n    }\n\n    return [trimmed];\n  }\n\n  return [];\n}\n\nfunction toScopeArray(value: unknown): string[] {\n  if (typeof value === 'string') {\n    return value\n      .trim()\n      .split(/\\s+/)\n      .filter((item) => item.length > 0);\n  }\n\n  return toStringArray(value);\n}\n\n/**\n * Extract user info from ID token claims\n */\nexport function extractUserInfo(claims: Record<string, unknown>): {\n  tenants: string[];\n  currentTenant?: string;\n  isOnboarded: boolean;\n  tenantRoles: Record<string, string[]>;\n  permissions: string[];\n} {\n  const claimMapping = getConfiguredAuthClaimMapping();\n\n  // Extract tenant IDs\n  let tenants: string[] = [];\n  const { value: rawTenantIds } = getFirstClaimValue(claims, claimMapping.tenantIds);\n  if (rawTenantIds !== undefined) {\n    if (typeof rawTenantIds === 'string' && rawTenantIds.trim().startsWith('[')) {\n      const parsed = parseJson(rawTenantIds.trim());\n      if (Array.isArray(parsed)) {\n        tenants = parsed\n          .map((id) => (typeof id === 'string' ? id.trim() : `${id}`.trim()))\n          .filter((id) => id.length > 0);\n      }\n    } else {\n      tenants = toStringArray(rawTenantIds);\n    }\n  }\n\n  // Extract tenant roles\n  const tenantRoles: Record<string, string[]> = {};\n  const { value: rawRoles } = getFirstClaimValue(claims, claimMapping.tenantRoles);\n  if (rawRoles !== undefined) {\n    let parsedRoles: unknown = rawRoles;\n\n    if (typeof rawRoles === 'string' && rawRoles.trim().startsWith('{')) {\n      parsedRoles = parseJson(rawRoles.trim()) ?? rawRoles;\n    }\n\n    if (parsedRoles && typeof parsedRoles === 'object' && !Array.isArray(parsedRoles)) {\n      for (const [tenantId, roleValue] of Object.entries(parsedRoles as Record<string, unknown>)) {\n        const roleIds = toStringArray(roleValue);\n        if (roleIds.length > 0) {\n          tenantRoles[tenantId] = roleIds;\n        }\n      }\n    }\n  }\n\n  // Extract permissions\n  const permissionClaim = getFirstClaimValue(claims, claimMapping.permissions);\n  const permissions =\n    permissionClaim.key === 'scope'\n      ? toScopeArray(permissionClaim.value)\n      : toStringArray(permissionClaim.value);\n\n  // Extract onboarding status\n  const isOnboarded = getBooleanClaim(claims, claimMapping.isOnboarded);\n\n  return { tenants, isOnboarded, tenantRoles, permissions };\n}\n\n// ============================================================================\n// Session Data Creation\n// ============================================================================\n\n/**\n * Create session data from token result\n */\nasync function createSessionData(\n  tokenResult: oauth.TokenEndpointResponse,\n  claims: Record<string, unknown>\n): Promise<Partial<SessionData>> {\n  const claimMapping = getConfiguredAuthClaimMapping();\n  const baseUser: UserInfo = {\n    sub: getStringClaim(claims, claimMapping.subject) || 'unknown',\n    name: getStringClaim(claims, claimMapping.name) || getStringClaim(claims, claimMapping.email) || 'User',\n    email: getStringClaim(claims, claimMapping.email),\n    givenName: getStringClaim(claims, claimMapping.givenName),\n    familyName: getStringClaim(claims, claimMapping.familyName),\n    picture: getStringClaim(claims, claimMapping.picture),\n    locale: getStringClaim(claims, claimMapping.locale),\n    zoneinfo: getStringClaim(claims, claimMapping.zoneinfo),\n    updated_at: getNumberClaim(claims, claimMapping.updatedAt),\n  };\n\n  const expiresAt = tokenResult.expires_in\n    ? Date.now() + tokenResult.expires_in * 1000\n    : undefined;\n\n  return {\n    userId: baseUser.sub,\n    accessToken: tokenResult.access_token,\n    refreshToken: tokenResult.refresh_token,\n    idToken: tokenResult.id_token,\n    expiresAt,\n    user: baseUser,\n    lastActivity: Date.now(),\n  };\n}\n\n// ============================================================================\n// Auth Error Handling\n// ============================================================================\n\n// Auth error cookie names - unique per application to prevent conflicts\nconst AUTH_ERROR_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_auth_error`;\nconst AUTH_ERROR_DESC_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_auth_error_desc`;\nconst OAUTH_STATE_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_oauth_state_id`;\n\n/**\n * Check if there's an auth error in cookies\n * \n * This should be called by apps (especially those without landing pages like Dashboard)\n * BEFORE starting OAuth flow to prevent redirect loops.\n * \n * @example\n * ```ts\n * // In dashboard's index route loader\n * const authError = getAuthError(request);\n * if (authError) {\n *   return { authError }; // Show error to user\n * }\n * // No error, proceed with session check\n * const user = await getUser(request);\n * if (!user) {\n *   return login(request);\n * }\n * ```\n */\nexport function getAuthError(request: Request): AuthError | null {\n  const cookies = request.headers.get('Cookie');\n  if (!cookies) return null;\n  \n  // Parse auth_error cookie (app-specific)\n  const errorRegex = new RegExp(`${AUTH_ERROR_COOKIE}=([^;]+)`);\n  const errorMatch = cookies.match(errorRegex);\n  if (!errorMatch) return null;\n  \n  const error = decodeURIComponent(errorMatch[1]);\n  if (!error) return null;\n  \n  // Parse auth_error_description cookie (app-specific)\n  const descRegex = new RegExp(`${AUTH_ERROR_DESC_COOKIE}=([^;]+)`);\n  const descMatch = cookies.match(descRegex);\n  const description = descMatch ? decodeURIComponent(descMatch[1]) : undefined;\n  \n  return { error, description };\n}\n\n/**\n * Clear auth error cookies\n * \n * Call this after displaying the error to the user\n */\nexport function clearAuthErrorHeaders(): Headers {\n  const headers = new Headers();\n  headers.append('Set-Cookie', `${AUTH_ERROR_COOKIE}=; Path=/; Max-Age=0`);\n  headers.append('Set-Cookie', `${AUTH_ERROR_DESC_COOKIE}=; Path=/; Max-Age=0`);\n  return headers;\n}\n\n/**\n * Check if request has auth error (quick check without parsing)\n */\nexport function hasAuthError(request: Request): boolean {\n  const cookies = request.headers.get('Cookie');\n  return cookies?.includes(`${AUTH_ERROR_COOKIE}=`) ?? false;\n}\n\n// ============================================================================\n// Auth Functions\n// ============================================================================\n\n/**\n * Initiate OAuth login flow\n * \n * @param request - The incoming request\n * @param returnUrlOrOptions - Either a return URL string or LoginOptions object\n */\nexport async function login(\n  request: Request, \n  returnUrlOrOptions?: string | LoginOptions\n): Promise<Response> {\n  try {\n    const config = getAuthConfig();\n    \n    // Parse options\n    const options: LoginOptions = typeof returnUrlOrOptions === 'string' \n      ? { returnUrl: returnUrlOrOptions }\n      : returnUrlOrOptions || {};\n\n    // Check for auth_error cookie to prevent redirect loops\n    const cookies = request.headers.get('Cookie');\n    const hasError = cookies?.includes(`${AUTH_ERROR_COOKIE}=`);\n    if (hasError) {\n      logger.warn('Auth error cookie detected, preventing redirect loop');\n      // Clear the error cookie and redirect to home\n      const headers = new Headers();\n      headers.append('Set-Cookie', `${AUTH_ERROR_COOKIE}=; Path=/; Max-Age=0`);\n      // Use redirectUri to get correct base URL with port\n      const redirectUri = new URL(config.redirectUri);\n      const baseUrl = redirectUri.origin;\n      return createRedirectResponse(baseUrl, { headers });\n    }\n\n    const { authorizationServer, client } = await getOAuthConfig();\n\n    // Generate PKCE challenge\n    const codeVerifier = oauth.generateRandomCodeVerifier();\n    const codeChallenge = await oauth.calculatePKCECodeChallenge(codeVerifier);\n\n    // Generate secure state and nonce\n    const state = oauth.generateRandomState();\n    const nonce = oauth.generateRandomNonce();\n\n    // Create OAuth state object\n    const oauthState: OAuthState = {\n      state,\n      codeVerifier,\n      nonce,\n      returnUrl: options.returnUrl,\n      createdAt: Date.now(),\n    };\n\n    logger.info('Creating OAuth state', { returnUrl: options.returnUrl, prompt: options.prompt });\n\n    // Store OAuth state in Redis\n    const stateId = await createOAuthState(oauthState);\n\n    // Build authorization URL\n    const authorizationUrl = new URL(authorizationServer.authorization_endpoint!);\n    authorizationUrl.searchParams.set('client_id', client.client_id);\n    authorizationUrl.searchParams.set('redirect_uri', config.redirectUri);\n    authorizationUrl.searchParams.set('response_type', 'code');\n    authorizationUrl.searchParams.set('scope', config.scope);\n    authorizationUrl.searchParams.set('state', state);\n    authorizationUrl.searchParams.set('code_challenge', codeChallenge);\n    authorizationUrl.searchParams.set('code_challenge_method', 'S256');\n    authorizationUrl.searchParams.set('nonce', nonce);\n    \n    // Add prompt parameter if specified\n    if (options.prompt) {\n      authorizationUrl.searchParams.set('prompt', options.prompt);\n    }\n\n    // Store stateId in cookie for callback (app-specific to prevent conflicts)\n    const headers = new Headers();\n    headers.append('Set-Cookie', `${OAUTH_STATE_COOKIE}=${stateId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=600`);\n\n    // DEBUG: Log full authorization URL and config\n    logger.info('🔍 DEBUG: OAuth login config', {\n      clientId: config.clientId,\n      redirectUri: config.redirectUri,\n      postLogoutRedirectUri: config.postLogoutRedirectUri,\n      scope: config.scope,\n      authority: config.authority,\n      authorizationEndpoint: authorizationServer.authorization_endpoint,\n      fullAuthUrl: authorizationUrl.toString()\n    });\n\n    logger.info('OAuth authorization flow initiated', { state, stateId, prompt: options.prompt });\n    return createRedirectResponse(authorizationUrl.toString(), { headers });\n  } catch (error) {\n    logger.error('Failed to initiate OAuth login', error instanceof Error ? error : undefined);\n    throw new Error('Login failed');\n  }\n}\n\n/**\n * Handle OAuth callback\n * \n * Handles OAuth authorization response including success and error cases.\n * \n * Error Handling:\n * - `access_denied`: User doesn't have access to this application\n *   - For apps with landing page: Redirect home with error cookie\n *   - For apps without landing page: Redirect home with error cookie (must handle specially)\n * - `login_required`: No active identity session\n *   - Redirect to home to start fresh login\n */\nexport async function handleCallback(request: Request): Promise<Response> {\n  try {\n    const config = getAuthConfig();\n    const hasLandingPage = getEffectiveHasLandingPage(config);\n    const url = new URL(request.url);\n    const code = url.searchParams.get('code');\n    const state = url.searchParams.get('state');\n    const error = url.searchParams.get('error');\n    const errorDescription = url.searchParams.get('error_description');\n\n    // DEBUG: Log callback URL and params\n    logger.info('🔍 DEBUG: OAuth callback received', {\n      fullUrl: url.toString(),\n      origin: url.origin,\n      pathname: url.pathname,\n      hasCode: !!code,\n      hasState: !!state,\n      error,\n      errorDescription,\n      clientId: config.clientId,\n      redirectUri: config.redirectUri\n    });\n\n    // Handle OAuth errors\n    if (error) {\n      logger.error('OAuth callback error', undefined, { \n        error, \n        errorDescription,\n        clientId: config.clientId,\n        applicationType: config.applicationType,\n        hasLandingPage\n      });\n      \n      // Handle access_denied specially - user doesn't have access to this app\n      // This can happen when identity cookie is valid but user has no access to this client\n      if (error === 'access_denied') {\n        logger.warn('Access denied for this application', { clientId: config.clientId });\n        // Clear any existing session and redirect to home without triggering new login\n        const headers = await destroyAuthSession(request);\n        // Set error cookies to:\n        // 1. Prevent redirect loop (auth_error)\n        // 2. Allow UI to show appropriate message (auth_error_type, auth_error_description)\n        headers.append(\n          'Set-Cookie',\n          `${AUTH_ERROR_COOKIE}=access_denied; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`\n        );\n        headers.append(\n          'Set-Cookie',\n          `${AUTH_ERROR_DESC_COOKIE}=${encodeURIComponent(errorDescription || 'You do not have access to this application.')}; Path=/; SameSite=Lax; Max-Age=300`\n        );\n        // Use redirectUri to get the correct base URL with port\n        // request.url.origin can lose the port in some cases\n        const redirectUri = new URL(config.redirectUri);\n        const baseUrl = redirectUri.origin;\n        logger.info('Redirecting to /auth/login to show access_denied error', { \n          hasLandingPage,\n          baseUrl,\n          configRedirectUri: config.redirectUri\n        });\n        // Redirect to /auth/login so user immediately sees the access denied page\n        // instead of landing page (which doesn't show the error)\n        return createRedirectResponse(`${baseUrl}/auth/login`, { headers });\n      }\n      \n      // Handle login_required - session expired or user not logged in\n      if (error === 'login_required') {\n        logger.info('Login required, user session may have expired');\n        const headers = await destroyAuthSession(request);\n        // Use redirectUri to get correct base URL with port\n        const redirectUri = new URL(config.redirectUri);\n        const baseUrl = redirectUri.origin;\n        return createRedirectResponse(baseUrl, { headers });\n      }\n      \n      // Handle other errors\n      const headers = await destroyAuthSession(request);\n      headers.append(\n        'Set-Cookie',\n        `${AUTH_ERROR_COOKIE}=${encodeURIComponent(error)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`\n      );\n      if (errorDescription) {\n        headers.append(\n          'Set-Cookie',\n          `${AUTH_ERROR_DESC_COOKIE}=${encodeURIComponent(errorDescription)}; Path=/; SameSite=Lax; Max-Age=300`\n        );\n      }\n      // Use redirectUri to get correct base URL with port\n      const redirectUri = new URL(config.redirectUri);\n      const baseUrl = redirectUri.origin;\n      return createRedirectResponse(baseUrl, { headers });\n    }\n\n    // Validate required parameters\n    if (!code || !state) {\n      throw new Error('Missing required callback parameters');\n    }\n\n    // Get stateId from cookie (app-specific)\n    const cookies = request.headers.get('Cookie');\n    const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);\n    const cookieMatch = cookies?.match(oauthStateRegex);\n    const stateId = cookieMatch?.[1];\n\n    if (!stateId) {\n      throw new Error('OAuth state ID not found in cookie');\n    }\n\n    // Retrieve OAuth state from Redis\n    const oauthState = await getOAuthState(stateId);\n\n    if (!oauthState) {\n      throw new Error('No OAuth state found - state may have expired');\n    }\n\n    if (oauthState.state !== state) {\n      throw new Error(`OAuth state mismatch`);\n    }\n\n    // Check state age (10 minutes max)\n    const stateAge = Date.now() - oauthState.createdAt;\n    if (stateAge > 10 * 60 * 1000) {\n      throw new Error('OAuth state expired');\n    }\n\n    const { authorizationServer, client } = await getOAuthConfig();\n    const clientAuth = getClientAuth();\n\n    logger.info('Initiating token exchange');\n\n    // Validate authorization response\n    const currentUrl = new URL(request.url);\n    const callbackParameters = oauth.validateAuthResponse(\n      authorizationServer,\n      client,\n      currentUrl,\n      oauthState.state\n    );\n\n    // Exchange authorization code for tokens\n    const tokenEndpointResponse = await oauth.authorizationCodeGrantRequest(\n      authorizationServer,\n      client,\n      clientAuth,\n      callbackParameters,\n      config.redirectUri,\n      oauthState.codeVerifier\n    );\n\n    if (!tokenEndpointResponse.ok) {\n      const errorText = await tokenEndpointResponse.text().catch(() => 'Unable to read response');\n      logger.error('Token endpoint error', undefined, { errorText });\n      throw new Error('Token exchange failed');\n    }\n\n    // Process token response\n    const tokenResult = await oauth.processAuthorizationCodeResponse(\n      authorizationServer,\n      client,\n      tokenEndpointResponse,\n      { expectedNonce: oauthState.nonce }\n    );\n\n    logger.info('Token exchange completed successfully');\n\n    // Extract claims from ID token\n    let claims: Record<string, unknown> = {};\n    if (tokenResult.id_token) {\n      try {\n        const payload = tokenResult.id_token.split('.')[1];\n        const base64 = payload.replace(/-/g, '+').replace(/_/g, '/');\n        const binaryString = atob(base64);\n        const bytes = new Uint8Array(binaryString.length);\n        for (let i = 0; i < binaryString.length; i++) {\n          bytes[i] = binaryString.charCodeAt(i);\n        }\n        claims = JSON.parse(new TextDecoder('utf-8').decode(bytes));\n      } catch (decodeError) {\n        logger.error('Failed to decode ID token', decodeError instanceof Error ? decodeError : undefined);\n        throw new Error('Invalid ID token received');\n      }\n    }\n\n    // Create session data\n    const newSessionData = await createSessionData(tokenResult, claims);\n\n    // Create new session\n    const sessionHeaders = await createAuthSession(request, newSessionData);\n\n    // Clean up OAuth state from Redis\n    await deleteOAuthState(stateId);\n\n    // Combine headers and clear OAuth state cookie (app-specific)\n    const headers = new Headers(sessionHeaders);\n    headers.append('Set-Cookie', `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);\n\n    logger.info('OAuth callback processed successfully');\n\n    // Redirect to return URL or default location\n    const redirectUrl = oauthState.returnUrl || '/';\n    return createRedirectResponse(redirectUrl, { headers });\n  } catch (error) {\n    logger.error('OAuth callback failed', error instanceof Error ? error : undefined);\n\n    // Try to clean up OAuth state on error\n    try {\n      const cookies = request.headers.get('Cookie');\n      const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);\n      const cookieMatch = cookies?.match(oauthStateRegex);\n      const stateId = cookieMatch?.[1];\n      if (stateId) {\n        await deleteOAuthState(stateId);\n      }\n    } catch {\n      // Ignore cleanup errors\n    }\n\n    await destroyAuthSession(request);\n    throw new Error('Authentication failed');\n  }\n}\n\n/**\n * Logout user\n * \n * Backend uses id_token_hint to identify which tokens to revoke.\n * \n * **Scenario 1: Full SSO Logout (Manual Sign Out)**\n * - Query param: sso_logout=true\n * - Result: Full logout + identity cookie cleared\n * - User must re-authenticate everywhere\n * \n * **Scenario 2: Standard Logout (Automatic/Token Expired)**\n * - No sso_logout param\n * - Result: Tokens revoked based on id_token_hint\n * - Backend determines which tokens to revoke\n * \n * Configuration:\n * - `OIDC_SSO_LOGOUT` env var ('true' | 'false') - default behavior\n * - Query param `sso_logout=true` - override for full logout\n */\nexport async function logout(request: Request): Promise<Response> {\n  try {\n    const config = getAuthConfig();\n    const url = new URL(request.url);\n    \n    // Check for explicit sso_logout from query params\n    const ssoLogout = url.searchParams.get('sso_logout') === 'true' || getEffectiveSsoLogout(config);\n    const returnUrl = url.searchParams.get('returnUrl');\n    \n    logger.info('Logout initiated', { \n      clientId: config.clientId,\n      ssoLogout\n    });\n    \n    const sessionData = await getAuthSession(request);\n    const idToken = sessionData.idToken;\n\n    // Destroy local session\n    const sessionHeaders = await destroyAuthSession(request);\n    const headers = new Headers(sessionHeaders);\n\n    // Store returnUrl in cookie if provided\n    if (returnUrl) {\n      headers.append(\n        'Set-Cookie',\n        `logout_return_url=${encodeURIComponent(returnUrl)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`\n      );\n    }\n\n    // Redirect to OAuth end_session_endpoint if available\n    if (idToken) {\n      try {\n        const { authorizationServer } = await getOAuthConfig();\n        if (authorizationServer.end_session_endpoint) {\n          const endSessionUrl = new URL(authorizationServer.end_session_endpoint);\n          \n          // Backend uses id_token_hint to identify which tokens to revoke\n          endSessionUrl.searchParams.set('id_token_hint', idToken);\n          \n          // Add sso_logout for full SSO logout (clears identity cookie)\n          if (ssoLogout) {\n            endSessionUrl.searchParams.set('sso_logout', 'true');\n            logger.info('Performing full SSO logout (identity cookie will be cleared)');\n          } else {\n            logger.info('Performing standard logout (tokens revoked based on id_token_hint)');\n          }\n          \n          // Add post_logout_redirect_uri if configured\n          if (config.postLogoutRedirectUri) {\n            endSessionUrl.searchParams.set('post_logout_redirect_uri', config.postLogoutRedirectUri);\n          }\n          \n          return createRedirectResponse(endSessionUrl.toString(), { headers });\n        }\n      } catch {\n        // Ignore OAuth logout errors\n      }\n    }\n\n    // Fallback redirect\n    const baseUrl = new URL(request.url).origin;\n    const registeredPath = config.postLogoutRedirectUri || '/';\n    const finalRedirectUrl = registeredPath.startsWith('http') \n      ? registeredPath \n      : `${baseUrl}${registeredPath}`;\n\n    logger.info('Logout completed', { redirectUrl: finalRedirectUrl });\n    return createRedirectResponse(finalRedirectUrl, { headers });\n  } catch (error) {\n    logger.error('Logout failed', error instanceof Error ? error : undefined);\n    const headers = await destroyAuthSession(request);\n    return createRedirectResponse('/', { headers });\n  }\n}\n\n/**\n * Get current user from session\n */\nexport async function getUser(request: Request): Promise<UserInfo | null> {\n  try {\n    const sessionData = await getAuthSession(request);\n    return sessionData.user || null;\n  } catch (error) {\n    logger.error('Failed to get user', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\n/**\n * Require authenticated user (throws redirect to login if not authenticated)\n */\nexport async function requireAuth(request: Request): Promise<UserInfo> {\n  const user = await getUser(request);\n\n  if (!user) {\n    const url = new URL(request.url);\n    const returnUrl = `${url.pathname}${url.search}`;\n    logger.info('No user found, starting OAuth flow', { returnUrl });\n    throw await login(request, returnUrl);\n  }\n\n  return user;\n}\n\n/**\n * Get access token from session\n */\nexport async function getAccessToken(request: Request): Promise<string | null> {\n  try {\n    const sessionData = await getAuthSession(request);\n    return sessionData.accessToken || null;\n  } catch (error) {\n    logger.error('Failed to get access token', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\n/**\n * Refresh tokens\n */\nexport async function refreshTokens(\n  request: Request,\n  refreshToken?: string\n): Promise<TokenRefreshResult> {\n  try {\n    const sessionData = await getAuthSession(request);\n    const tokenToRefresh = refreshToken || sessionData.refreshToken;\n\n    if (!tokenToRefresh) {\n      logger.warn('No refresh token available');\n      return { success: false, error: 'No refresh token available', shouldLogout: true };\n    }\n\n    const { authorizationServer, client } = await getOAuthConfig();\n    const clientAuth = getClientAuth();\n\n    logger.info('Initiating token refresh');\n\n    const refreshResponse = await oauth.refreshTokenGrantRequest(\n      authorizationServer,\n      client,\n      clientAuth,\n      tokenToRefresh\n    );\n\n    if (!refreshResponse.ok) {\n      const errorText = await refreshResponse.text().catch(() => 'Unknown error');\n      logger.error('Token refresh failed', undefined, { status: refreshResponse.status, errorText });\n\n      let errorData: Record<string, unknown> = {};\n      try {\n        errorData = JSON.parse(errorText);\n      } catch {\n        // Ignore parse errors\n      }\n\n      const shouldLogout =\n        refreshResponse.status === 400 ||\n        errorData.error === 'invalid_grant' ||\n        errorData.error === 'invalid_token' ||\n        refreshResponse.status === 401;\n\n      return {\n        success: false,\n        error: `Token refresh failed: ${errorData.error_description || errorData.error || 'Unknown'}`,\n        shouldLogout,\n      };\n    }\n\n    const refreshResult = await oauth.processRefreshTokenResponse(\n      authorizationServer,\n      client,\n      refreshResponse\n    );\n\n    logger.info('Token refresh successful');\n\n    const newRefreshToken = refreshResult.refresh_token || tokenToRefresh;\n    const expiresAt = refreshResult.expires_in\n      ? Date.now() + refreshResult.expires_in * 1000\n      : sessionData.expiresAt;\n\n    // Update session\n    await updateAuthSession(request, {\n      accessToken: refreshResult.access_token,\n      refreshToken: newRefreshToken,\n      idToken: refreshResult.id_token,\n      expiresAt,\n      lastActivity: Date.now(),\n    });\n\n    return {\n      success: true,\n      tokens: {\n        access_token: refreshResult.access_token,\n        refresh_token: newRefreshToken,\n        id_token: refreshResult.id_token,\n        expires_in: refreshResult.expires_in,\n      },\n    };\n  } catch (error) {\n    logger.error('Token refresh failed with exception', error instanceof Error ? error : undefined);\n\n    const shouldLogout =\n      error instanceof Error &&\n      (error.message.includes('invalid_grant') ||\n        error.message.includes('invalid_token') ||\n        error.message.includes('unauthorized'));\n\n    return {\n      success: false,\n      error: error instanceof Error ? error.message : 'Token refresh failed',\n      shouldLogout,\n    };\n  }\n}\n\n// Re-export session validation\nexport { isSessionValid };\n\n/**\n * Clear auth server cache (useful for testing)\n */\nexport function clearAuthServerCache(): void {\n  authServerCache = null;\n}\n"],"mappings":";;;;;;;;AAYA,SAAgB,uBACdA,UACAC,OAA6B,CAAE,GACrB;CACV,MAAM,UAAU,IAAI,QAAQ,KAAK;AACjC,SAAQ,IAAI,YAAY,SAAS;AAEjC,QAAO,IAAI,SAAS,MAAM;EACxB,QAAQ,KAAK,UAAU;EACvB;CACD;AACF;;;;;;;ACsBD,SAAS,sBAAsBC,QAA6B;AAE1D,KAAI,OAAO,qBACT,QAAO,OAAO;AAIhB,SAAQ,OAAO,iBAAf;EACE,KAAK;EACL,KAAK,YACH,QAAO;EACT,KAAK;EACL,KAAK,aACH,QAAO;EACT,QACE,QAAO;CACV;AACF;;;;AAKD,SAAS,2BAA2BA,QAA6B;AAE/D,KAAI,OAAO,0BACT,QAAO,OAAO;AAIhB,SAAQ,OAAO,iBAAf;EACE,KAAK;EACL,KAAK,YACH,QAAO;EACT,KAAK;EACL,KAAK,aACH,QAAO;EACT,QACE,QAAO;CACV;AACF;;;;AAKD,SAAS,mBAA+B;CACtC,MAAM,kBAAkB;EACtB,WAAW,QAAQ,IAAI;EACvB,UAAU,QAAQ,IAAI;EACtB,aAAa,QAAQ,IAAI;CAC1B;AAED,MAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,gBAAgB,CACxD,MAAK,MACH,OAAM,IAAI,OAAO,8CAA8C,IAAI,aAAa,CAAC;CAKrF,MAAM,aAAa,QAAQ,IAAI,uBAAuB,aAAa;CACnE,IAAIC,kBAAmC;AACvC,KAAI,eAAe,qBAAqB,eAAe,kBACrD,mBAAkB;UACT,eAAe,kBAAkB,eAAe,eACzD,mBAAkB;UACT,eAAe,YACxB,mBAAkB;UACT,eAAe,gBAAgB,eAAe,aACvD,mBAAkB;CAIpB,MAAM,YAAY,QAAQ,IAAI,6BAC1B,QAAQ,IAAI,oBAAoB;CAGpC,MAAM,iBAAiB,QAAQ,IAAI,mCAC/B,QAAQ,IAAI,0BAA0B;AAG1C,QAAO;EACL,WAAW,gBAAgB;EAC3B,UAAU,gBAAgB;EAC1B,cAAc,QAAQ,IAAI;EAC1B,aAAa,gBAAgB;EAC7B,OAAO,QAAQ,IAAI,cAAc;EACjC,uBAAuB,QAAQ,IAAI;EACnC;EACA;EACA;CACD;AACF;AAED,IAAIC,cAAiC;AAErC,SAAS,gBAA4B;AACnC,MAAK,YACH,eAAc,kBAAkB;AAElC,QAAO;AACR;AAMD,IAAIC,kBAIO;AAEX,MAAM,YAAY,KAAK,KAAK;;;;AAK5B,eAAe,iBAGZ;CACD,MAAM,SAAS,eAAe;CAC9B,MAAM,MAAM,KAAK,KAAK;AAEtB,KAAI,mBAAmB,MAAM,gBAAgB,WAAW,UACtD,QAAO;EACL,qBAAqB,gBAAgB;EACrC,QAAQ,gBAAgB;CACzB;AAGH,KAAI;EACF,MAAM,SAAS,IAAI,IAAI,OAAO;EAC9B,MAAM,oBAAoB,MAAM,MAAM,iBAAiB,QAAQ,EAC7D,WAAW,OACZ,EAAC;AAEF,OAAK,kBAAkB,IAAI;GACzB,MAAM,YAAY,MAAM,kBAAkB,MAAM,CAAC,MAAM,MAAM,0BAA0B;AACvF,UAAO,MAAM,iCAAoC,EAAE,UAAW,EAAC;AAC/D,SAAM,IAAI,OAAO,qCAAqC,kBAAkB,OAAO;EAChF;EAED,MAAM,sBAAsB,MAAM,MAAM,yBAAyB,QAAQ,kBAAkB;EAE3F,MAAMC,SAAuB,EAC3B,WAAW,OAAO,SACnB;AAED,oBAAkB;GAChB;GACA;GACA,UAAU;EACX;AAED,SAAO,KAAK,yCAAyC;AACrD,SAAO;GAAE;GAAqB;EAAQ;CACvC,SAAQ,OAAO;AACd,SAAO,MAAM,0BAA0B,iBAAiB,QAAQ,eAAkB;AAClF,QAAM,IAAI,OAAO,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,gBAAgB;CACrG;AACF;;;;AAKD,SAAS,gBAAkC;AACzC,QAAO,MAAM,MAAM;AACpB;AAMD,MAAMC,6BAAyD;CAC7D,SAAS,CAAC,KAAM;CAChB,MAAM;EAAC;EAAQ;EAAsB;CAAQ;CAC7C,OAAO,CAAC,OAAQ;CAChB,WAAW,CAAC,cAAc,WAAY;CACtC,YAAY,CAAC,eAAe,YAAa;CACzC,SAAS,CAAC,WAAW,YAAa;CAClC,QAAQ,CAAC,QAAS;CAClB,UAAU,CAAC,UAAW;CACtB,WAAW,CAAC,YAAa;CACzB,WAAW,CAAC,YAAa;CACzB,aAAa,CAAC,cAAe;CAC7B,aAAa;EAAC;EAAa;EAAe;CAAQ;CAClD,aAAa,CAAC,cAAe;AAC9B;AAED,IAAIC,mBAA+C,EACjD,GAAG,2BACJ;AAED,SAAS,mBAAmBC,MAA2B;AACrD,MAAK,MAAM,QAAQ,KAAK,CACtB,QAAO,CAAE;AAGX,QAAO,MAAM,KACX,IAAI,IACF,KACG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,CACxB,OAAO,CAAC,QAAQ,IAAI,SAAS,EAAE,EAErC;AACF;;;;;AAMD,SAAgB,0BAA0BC,SAAiC;AACzE,oBAAmB;EACjB,SAAS,QAAQ,qBAAwB,mBAAmB,QAAQ,QAAQ,GAAG,2BAA2B;EAC1G,MAAM,QAAQ,kBAAqB,mBAAmB,QAAQ,KAAK,GAAG,2BAA2B;EACjG,OAAO,QAAQ,mBAAsB,mBAAmB,QAAQ,MAAM,GAAG,2BAA2B;EACpG,WAAW,QAAQ,uBAA0B,mBAAmB,QAAQ,UAAU,GAAG,2BAA2B;EAChH,YAAY,QAAQ,wBAA2B,mBAAmB,QAAQ,WAAW,GAAG,2BAA2B;EACnH,SAAS,QAAQ,qBAAwB,mBAAmB,QAAQ,QAAQ,GAAG,2BAA2B;EAC1G,QAAQ,QAAQ,oBAAuB,mBAAmB,QAAQ,OAAO,GAAG,2BAA2B;EACvG,UAAU,QAAQ,sBAAyB,mBAAmB,QAAQ,SAAS,GAAG,2BAA2B;EAC7G,WAAW,QAAQ,uBAA0B,mBAAmB,QAAQ,UAAU,GAAG,2BAA2B;EAChH,WAAW,QAAQ,uBAA0B,mBAAmB,QAAQ,UAAU,GAAG,2BAA2B;EAChH,aAAa,QAAQ,yBAA4B,mBAAmB,QAAQ,YAAY,GAAG,2BAA2B;EACtH,aAAa,QAAQ,yBAA4B,mBAAmB,QAAQ,YAAY,GAAG,2BAA2B;EACtH,aAAa,QAAQ,yBAA4B,mBAAmB,QAAQ,YAAY,GAAG,2BAA2B;CACvH;AACF;;;;AAKD,SAAgB,wBAA8B;AAC5C,oBAAmB,EACjB,GAAG,2BACJ;AACF;AAED,SAAS,gCAA4D;AACnE,QAAO;AACR;AAED,SAAS,mBACPC,QACAC,WACmC;AACnC,MAAK,MAAM,YAAY,UACrB,KAAI,YAAY,OACd,QAAO;EACL,KAAK;EACL,OAAO,OAAO;CACf;AAIL,QAAO,CAAE;AACV;AAED,SAAS,eAAeD,QAAiCC,WAAyC;CAChG,MAAM,EAAE,OAAO,GAAG,mBAAmB,QAAQ,UAAU;AAEvD,YAAW,UAAU,UAAU;EAC7B,MAAM,UAAU,MAAM,MAAM;AAC5B,SAAO,QAAQ,SAAS,IAAI;CAC7B;AAED,YAAW,UAAU,mBAAmB,UAAU,UAChD,SAAQ,EAAE,MAAM;AAGlB;AACD;AAED,SAAS,eAAeD,QAAiCC,WAAyC;CAChG,MAAM,EAAE,OAAO,GAAG,mBAAmB,QAAQ,UAAU;AAEvD,YAAW,UAAU,YAAY,OAAO,SAAS,MAAM,CACrD,QAAO;AAGT,YAAW,UAAU,UAAU;EAC7B,MAAM,SAAS,OAAO,MAAM;AAC5B,SAAO,OAAO,SAAS,OAAO,GAAG;CAClC;AAED;AACD;AAED,SAAS,gBACPD,QACAC,WACA,eAAe,OACN;CACT,MAAM,EAAE,OAAO,GAAG,mBAAmB,QAAQ,UAAU;AAEvD,YAAW,UAAU,UACnB,QAAO;AAGT,YAAW,UAAU,SACnB,QAAO,MAAM,aAAa,KAAK;AAGjC,QAAO;AACR;;;;AAKD,SAAS,UAAUC,OAAwB;AACzC,KAAI;AACF,SAAO,KAAK,MAAM,MAAM;CACzB,QAAO;AACN,SAAO;CACR;AACF;;;;AAKD,SAAS,cAAcC,OAA0B;AAC/C,MAAK,MAAO,QAAO,CAAE;AAErB,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,MACJ,IAAI,CAAC,gBAAiB,SAAS,WAAW,KAAK,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAE,CAC1E,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE;AAGtC,YAAW,UAAU,UAAU;EAC7B,MAAM,UAAU,MAAM,MAAM;AAC5B,OAAK,QAAS,QAAO,CAAE;AAEvB,MAAI,QAAQ,WAAW,IAAI,EAAE;GAC3B,MAAM,SAAS,UAAU,QAAQ;AACjC,OAAI,MAAM,QAAQ,OAAO,CACvB,QAAO,OACJ,IAAI,CAAC,gBAAiB,SAAS,WAAW,KAAK,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAE,CAC1E,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE;EAEvC;AAED,MAAI,QAAQ,SAAS,IAAI,CACvB,QAAO,QACJ,MAAM,IAAI,CACV,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAC1B,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE;AAGtC,SAAO,CAAC,OAAQ;CACjB;AAED,QAAO,CAAE;AACV;AAED,SAAS,aAAaA,OAA0B;AAC9C,YAAW,UAAU,SACnB,QAAO,MACJ,MAAM,CACN,MAAM,MAAM,CACZ,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE;AAGtC,QAAO,cAAc,MAAM;AAC5B;;;;AAKD,SAAgB,gBAAgBH,QAM9B;CACA,MAAM,eAAe,+BAA+B;CAGpD,IAAII,UAAoB,CAAE;CAC1B,MAAM,EAAE,OAAO,cAAc,GAAG,mBAAmB,QAAQ,aAAa,UAAU;AAClF,KAAI,wBACF,YAAW,iBAAiB,YAAY,aAAa,MAAM,CAAC,WAAW,IAAI,EAAE;EAC3E,MAAM,SAAS,UAAU,aAAa,MAAM,CAAC;AAC7C,MAAI,MAAM,QAAQ,OAAO,CACvB,WAAU,OACP,IAAI,CAAC,cAAe,OAAO,WAAW,GAAG,MAAM,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAE,CAClE,OAAO,CAAC,OAAO,GAAG,SAAS,EAAE;CAEnC,MACC,WAAU,cAAc,aAAa;CAKzC,MAAMC,cAAwC,CAAE;CAChD,MAAM,EAAE,OAAO,UAAU,GAAG,mBAAmB,QAAQ,aAAa,YAAY;AAChF,KAAI,qBAAwB;EAC1B,IAAIC,cAAuB;AAE3B,aAAW,aAAa,YAAY,SAAS,MAAM,CAAC,WAAW,IAAI,CACjE,eAAc,UAAU,SAAS,MAAM,CAAC,IAAI;AAG9C,MAAI,sBAAsB,gBAAgB,aAAa,MAAM,QAAQ,YAAY,CAC/E,MAAK,MAAM,CAAC,UAAU,UAAU,IAAI,OAAO,QAAQ,YAAuC,EAAE;GAC1F,MAAM,UAAU,cAAc,UAAU;AACxC,OAAI,QAAQ,SAAS,EACnB,aAAY,YAAY;EAE3B;CAEJ;CAGD,MAAM,kBAAkB,mBAAmB,QAAQ,aAAa,YAAY;CAC5E,MAAM,cACJ,gBAAgB,QAAQ,UACpB,aAAa,gBAAgB,MAAM,GACnC,cAAc,gBAAgB,MAAM;CAG1C,MAAM,cAAc,gBAAgB,QAAQ,aAAa,YAAY;AAErE,QAAO;EAAE;EAAS;EAAa;EAAa;CAAa;AAC1D;;;;AASD,eAAe,kBACbC,aACAP,QAC+B;CAC/B,MAAM,eAAe,+BAA+B;CACpD,MAAMQ,WAAqB;EACzB,KAAK,eAAe,QAAQ,aAAa,QAAQ,IAAI;EACrD,MAAM,eAAe,QAAQ,aAAa,KAAK,IAAI,eAAe,QAAQ,aAAa,MAAM,IAAI;EACjG,OAAO,eAAe,QAAQ,aAAa,MAAM;EACjD,WAAW,eAAe,QAAQ,aAAa,UAAU;EACzD,YAAY,eAAe,QAAQ,aAAa,WAAW;EAC3D,SAAS,eAAe,QAAQ,aAAa,QAAQ;EACrD,QAAQ,eAAe,QAAQ,aAAa,OAAO;EACnD,UAAU,eAAe,QAAQ,aAAa,SAAS;EACvD,YAAY,eAAe,QAAQ,aAAa,UAAU;CAC3D;CAED,MAAM,YAAY,YAAY,aAC1B,KAAK,KAAK,GAAG,YAAY,aAAa;AAG1C,QAAO;EACL,QAAQ,SAAS;EACjB,aAAa,YAAY;EACzB,cAAc,YAAY;EAC1B,SAAS,YAAY;EACrB;EACA,MAAM;EACN,cAAc,KAAK,KAAK;CACzB;AACF;AAOD,MAAM,qBAAqB,EAAE,yBAAyB;AACtD,MAAM,0BAA0B,EAAE,yBAAyB;AAC3D,MAAM,sBAAsB,EAAE,yBAAyB;;;;;;;;;;;;;;;;;;;;;AAsBvD,SAAgB,aAAaC,SAAoC;CAC/D,MAAM,UAAU,QAAQ,QAAQ,IAAI,SAAS;AAC7C,MAAK,QAAS,QAAO;CAGrB,MAAM,aAAa,IAAI,QAAQ,EAAE,kBAAkB;CACnD,MAAM,aAAa,QAAQ,MAAM,WAAW;AAC5C,MAAK,WAAY,QAAO;CAExB,MAAM,QAAQ,mBAAmB,WAAW,GAAG;AAC/C,MAAK,MAAO,QAAO;CAGnB,MAAM,YAAY,IAAI,QAAQ,EAAE,uBAAuB;CACvD,MAAM,YAAY,QAAQ,MAAM,UAAU;CAC1C,MAAM,cAAc,YAAY,mBAAmB,UAAU,GAAG;AAEhE,QAAO;EAAE;EAAO;CAAa;AAC9B;;;;;;AAOD,SAAgB,wBAAiC;CAC/C,MAAM,UAAU,IAAI;AACpB,SAAQ,OAAO,eAAe,EAAE,kBAAkB,sBAAsB;AACxE,SAAQ,OAAO,eAAe,EAAE,uBAAuB,sBAAsB;AAC7E,QAAO;AACR;;;;AAKD,SAAgB,aAAaA,SAA2B;CACtD,MAAM,UAAU,QAAQ,QAAQ,IAAI,SAAS;AAC7C,QAAO,SAAS,UAAU,EAAE,kBAAkB,GAAG,IAAI;AACtD;;;;;;;AAYD,eAAsB,MACpBA,SACAC,oBACmB;AACnB,KAAI;EACF,MAAM,SAAS,eAAe;EAG9B,MAAMC,iBAA+B,uBAAuB,WACxD,EAAE,WAAW,mBAAoB,IACjC,sBAAsB,CAAE;EAG5B,MAAM,UAAU,QAAQ,QAAQ,IAAI,SAAS;EAC7C,MAAM,WAAW,SAAS,UAAU,EAAE,kBAAkB,GAAG;AAC3D,MAAI,UAAU;AACZ,UAAO,KAAK,uDAAuD;GAEnE,MAAMC,YAAU,IAAI;AACpB,aAAQ,OAAO,eAAe,EAAE,kBAAkB,sBAAsB;GAExE,MAAM,cAAc,IAAI,IAAI,OAAO;GACnC,MAAM,UAAU,YAAY;AAC5B,UAAO,uBAAuB,SAAS,EAAE,mBAAS,EAAC;EACpD;EAED,MAAM,EAAE,qBAAqB,QAAQ,GAAG,MAAM,gBAAgB;EAG9D,MAAM,eAAe,MAAM,4BAA4B;EACvD,MAAM,gBAAgB,MAAM,MAAM,2BAA2B,aAAa;EAG1E,MAAM,QAAQ,MAAM,qBAAqB;EACzC,MAAM,QAAQ,MAAM,qBAAqB;EAGzC,MAAMC,aAAyB;GAC7B;GACA;GACA;GACA,WAAW,QAAQ;GACnB,WAAW,KAAK,KAAK;EACtB;AAED,SAAO,KAAK,wBAAwB;GAAE,WAAW,QAAQ;GAAW,QAAQ,QAAQ;EAAQ,EAAC;EAG7F,MAAM,UAAU,MAAM,iBAAiB,WAAW;EAGlD,MAAM,mBAAmB,IAAI,IAAI,oBAAoB;AACrD,mBAAiB,aAAa,IAAI,aAAa,OAAO,UAAU;AAChE,mBAAiB,aAAa,IAAI,gBAAgB,OAAO,YAAY;AACrE,mBAAiB,aAAa,IAAI,iBAAiB,OAAO;AAC1D,mBAAiB,aAAa,IAAI,SAAS,OAAO,MAAM;AACxD,mBAAiB,aAAa,IAAI,SAAS,MAAM;AACjD,mBAAiB,aAAa,IAAI,kBAAkB,cAAc;AAClE,mBAAiB,aAAa,IAAI,yBAAyB,OAAO;AAClE,mBAAiB,aAAa,IAAI,SAAS,MAAM;AAGjD,MAAI,QAAQ,OACV,kBAAiB,aAAa,IAAI,UAAU,QAAQ,OAAO;EAI7D,MAAM,UAAU,IAAI;AACpB,UAAQ,OAAO,eAAe,EAAE,mBAAmB,GAAG,QAAQ,+CAA+C;AAG7G,SAAO,KAAK,gCAAgC;GAC1C,UAAU,OAAO;GACjB,aAAa,OAAO;GACpB,uBAAuB,OAAO;GAC9B,OAAO,OAAO;GACd,WAAW,OAAO;GAClB,uBAAuB,oBAAoB;GAC3C,aAAa,iBAAiB,UAAU;EACzC,EAAC;AAEF,SAAO,KAAK,sCAAsC;GAAE;GAAO;GAAS,QAAQ,QAAQ;EAAQ,EAAC;AAC7F,SAAO,uBAAuB,iBAAiB,UAAU,EAAE,EAAE,QAAS,EAAC;CACxE,SAAQ,OAAO;AACd,SAAO,MAAM,kCAAkC,iBAAiB,QAAQ,eAAkB;AAC1F,QAAM,IAAI,MAAM;CACjB;AACF;;;;;;;;;;;;;AAcD,eAAsB,eAAeJ,SAAqC;AACxE,KAAI;EACF,MAAM,SAAS,eAAe;EAC9B,MAAM,iBAAiB,2BAA2B,OAAO;EACzD,MAAM,MAAM,IAAI,IAAI,QAAQ;EAC5B,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;EACzC,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;EAC3C,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;EAC3C,MAAM,mBAAmB,IAAI,aAAa,IAAI,oBAAoB;AAGlE,SAAO,KAAK,qCAAqC;GAC/C,SAAS,IAAI,UAAU;GACvB,QAAQ,IAAI;GACZ,UAAU,IAAI;GACd,WAAW;GACX,YAAY;GACZ;GACA;GACA,UAAU,OAAO;GACjB,aAAa,OAAO;EACrB,EAAC;AAGF,MAAI,OAAO;AACT,UAAO,MAAM,gCAAmC;IAC9C;IACA;IACA,UAAU,OAAO;IACjB,iBAAiB,OAAO;IACxB;GACD,EAAC;AAIF,OAAI,UAAU,iBAAiB;AAC7B,WAAO,KAAK,sCAAsC,EAAE,UAAU,OAAO,SAAU,EAAC;IAEhF,MAAMG,YAAU,MAAM,mBAAmB,QAAQ;AAIjD,cAAQ,OACN,eACC,EAAE,kBAAkB,6DACtB;AACD,cAAQ,OACN,eACC,EAAE,uBAAuB,GAAG,mBAAmB,oBAAoB,8CAA8C,CAAC,qCACpH;IAGD,MAAME,gBAAc,IAAI,IAAI,OAAO;IACnC,MAAMC,YAAUD,cAAY;AAC5B,WAAO,KAAK,0DAA0D;KACpE;KACA;KACA,mBAAmB,OAAO;IAC3B,EAAC;AAGF,WAAO,wBAAwB,EAAEC,UAAQ,cAAc,EAAE,mBAAS,EAAC;GACpE;AAGD,OAAI,UAAU,kBAAkB;AAC9B,WAAO,KAAK,gDAAgD;IAC5D,MAAMH,YAAU,MAAM,mBAAmB,QAAQ;IAEjD,MAAME,gBAAc,IAAI,IAAI,OAAO;IACnC,MAAMC,YAAUD,cAAY;AAC5B,WAAO,uBAAuBC,WAAS,EAAE,mBAAS,EAAC;GACpD;GAGD,MAAMH,YAAU,MAAM,mBAAmB,QAAQ;AACjD,aAAQ,OACN,eACC,EAAE,kBAAkB,GAAG,mBAAmB,MAAM,CAAC,+CACnD;AACD,OAAI,iBACF,WAAQ,OACN,eACC,EAAE,uBAAuB,GAAG,mBAAmB,iBAAiB,CAAC,qCACnE;GAGH,MAAM,cAAc,IAAI,IAAI,OAAO;GACnC,MAAM,UAAU,YAAY;AAC5B,UAAO,uBAAuB,SAAS,EAAE,mBAAS,EAAC;EACpD;AAGD,OAAK,SAAS,MACZ,OAAM,IAAI,MAAM;EAIlB,MAAM,UAAU,QAAQ,QAAQ,IAAI,SAAS;EAC7C,MAAM,kBAAkB,IAAI,QAAQ,EAAE,mBAAmB;EACzD,MAAM,cAAc,SAAS,MAAM,gBAAgB;EACnD,MAAM,UAAU,cAAc;AAE9B,OAAK,QACH,OAAM,IAAI,MAAM;EAIlB,MAAM,aAAa,MAAM,cAAc,QAAQ;AAE/C,OAAK,WACH,OAAM,IAAI,MAAM;AAGlB,MAAI,WAAW,UAAU,MACvB,OAAM,IAAI,OAAO;EAInB,MAAM,WAAW,KAAK,KAAK,GAAG,WAAW;AACzC,MAAI,WAAW,KAAK,KAAK,IACvB,OAAM,IAAI,MAAM;EAGlB,MAAM,EAAE,qBAAqB,QAAQ,GAAG,MAAM,gBAAgB;EAC9D,MAAM,aAAa,eAAe;AAElC,SAAO,KAAK,4BAA4B;EAGxC,MAAM,aAAa,IAAI,IAAI,QAAQ;EACnC,MAAM,qBAAqB,MAAM,qBAC/B,qBACA,QACA,YACA,WAAW,MACZ;EAGD,MAAM,wBAAwB,MAAM,MAAM,8BACxC,qBACA,QACA,YACA,oBACA,OAAO,aACP,WAAW,aACZ;AAED,OAAK,sBAAsB,IAAI;GAC7B,MAAM,YAAY,MAAM,sBAAsB,MAAM,CAAC,MAAM,MAAM,0BAA0B;AAC3F,UAAO,MAAM,gCAAmC,EAAE,UAAW,EAAC;AAC9D,SAAM,IAAI,MAAM;EACjB;EAGD,MAAM,cAAc,MAAM,MAAM,iCAC9B,qBACA,QACA,uBACA,EAAE,eAAe,WAAW,MAAO,EACpC;AAED,SAAO,KAAK,wCAAwC;EAGpD,IAAIZ,SAAkC,CAAE;AACxC,MAAI,YAAY,SACd,KAAI;GACF,MAAM,UAAU,YAAY,SAAS,MAAM,IAAI,CAAC;GAChD,MAAM,SAAS,QAAQ,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI;GAC5D,MAAM,eAAe,KAAK,OAAO;GACjC,MAAM,QAAQ,IAAI,WAAW,aAAa;AAC1C,QAAK,IAAI,IAAI,GAAG,IAAI,aAAa,QAAQ,IACvC,OAAM,KAAK,aAAa,WAAW,EAAE;AAEvC,YAAS,KAAK,MAAM,IAAI,YAAY,SAAS,OAAO,MAAM,CAAC;EAC5D,SAAQ,aAAa;AACpB,UAAO,MAAM,6BAA6B,uBAAuB,QAAQ,qBAAwB;AACjG,SAAM,IAAI,MAAM;EACjB;EAIH,MAAM,iBAAiB,MAAM,kBAAkB,aAAa,OAAO;EAGnE,MAAM,iBAAiB,MAAM,kBAAkB,SAAS,eAAe;AAGvE,QAAM,iBAAiB,QAAQ;EAG/B,MAAM,UAAU,IAAI,QAAQ;AAC5B,UAAQ,OAAO,eAAe,EAAE,mBAAmB,8CAA8C;AAEjG,SAAO,KAAK,wCAAwC;EAGpD,MAAM,cAAc,WAAW,aAAa;AAC5C,SAAO,uBAAuB,aAAa,EAAE,QAAS,EAAC;CACxD,SAAQ,OAAO;AACd,SAAO,MAAM,yBAAyB,iBAAiB,QAAQ,eAAkB;AAGjF,MAAI;GACF,MAAM,UAAU,QAAQ,QAAQ,IAAI,SAAS;GAC7C,MAAM,kBAAkB,IAAI,QAAQ,EAAE,mBAAmB;GACzD,MAAM,cAAc,SAAS,MAAM,gBAAgB;GACnD,MAAM,UAAU,cAAc;AAC9B,OAAI,QACF,OAAM,iBAAiB,QAAQ;EAElC,QAAO,CAEP;AAED,QAAM,mBAAmB,QAAQ;AACjC,QAAM,IAAI,MAAM;CACjB;AACF;;;;;;;;;;;;;;;;;;;;AAqBD,eAAsB,OAAOS,SAAqC;AAChE,KAAI;EACF,MAAM,SAAS,eAAe;EAC9B,MAAM,MAAM,IAAI,IAAI,QAAQ;EAG5B,MAAM,YAAY,IAAI,aAAa,IAAI,aAAa,KAAK,UAAU,sBAAsB,OAAO;EAChG,MAAM,YAAY,IAAI,aAAa,IAAI,YAAY;AAEnD,SAAO,KAAK,oBAAoB;GAC9B,UAAU,OAAO;GACjB;EACD,EAAC;EAEF,MAAM,cAAc,MAAM,eAAe,QAAQ;EACjD,MAAM,UAAU,YAAY;EAG5B,MAAM,iBAAiB,MAAM,mBAAmB,QAAQ;EACxD,MAAM,UAAU,IAAI,QAAQ;AAG5B,MAAI,UACF,SAAQ,OACN,eACC,oBAAoB,mBAAmB,UAAU,CAAC,+CACpD;AAIH,MAAI,QACF,KAAI;GACF,MAAM,EAAE,qBAAqB,GAAG,MAAM,gBAAgB;AACtD,OAAI,oBAAoB,sBAAsB;IAC5C,MAAM,gBAAgB,IAAI,IAAI,oBAAoB;AAGlD,kBAAc,aAAa,IAAI,iBAAiB,QAAQ;AAGxD,QAAI,WAAW;AACb,mBAAc,aAAa,IAAI,cAAc,OAAO;AACpD,YAAO,KAAK,+DAA+D;IAC5E,MACC,QAAO,KAAK,qEAAqE;AAInF,QAAI,OAAO,sBACT,eAAc,aAAa,IAAI,4BAA4B,OAAO,sBAAsB;AAG1F,WAAO,uBAAuB,cAAc,UAAU,EAAE,EAAE,QAAS,EAAC;GACrE;EACF,QAAO,CAEP;EAIH,MAAM,UAAU,IAAI,IAAI,QAAQ,KAAK;EACrC,MAAM,iBAAiB,OAAO,yBAAyB;EACvD,MAAM,mBAAmB,eAAe,WAAW,OAAO,GACtD,kBACC,EAAE,QAAQ,EAAE,eAAe;AAEhC,SAAO,KAAK,oBAAoB,EAAE,aAAa,iBAAkB,EAAC;AAClE,SAAO,uBAAuB,kBAAkB,EAAE,QAAS,EAAC;CAC7D,SAAQ,OAAO;AACd,SAAO,MAAM,iBAAiB,iBAAiB,QAAQ,eAAkB;EACzE,MAAM,UAAU,MAAM,mBAAmB,QAAQ;AACjD,SAAO,uBAAuB,KAAK,EAAE,QAAS,EAAC;CAChD;AACF;;;;AAKD,eAAsB,QAAQA,SAA4C;AACxE,KAAI;EACF,MAAM,cAAc,MAAM,eAAe,QAAQ;AACjD,SAAO,YAAY,QAAQ;CAC5B,SAAQ,OAAO;AACd,SAAO,MAAM,sBAAsB,iBAAiB,QAAQ,eAAkB;AAC9E,SAAO;CACR;AACF;;;;AAKD,eAAsB,YAAYA,SAAqC;CACrE,MAAM,OAAO,MAAM,QAAQ,QAAQ;AAEnC,MAAK,MAAM;EACT,MAAM,MAAM,IAAI,IAAI,QAAQ;EAC5B,MAAM,aAAa,EAAE,IAAI,SAAS,EAAE,IAAI,OAAO;AAC/C,SAAO,KAAK,sCAAsC,EAAE,UAAW,EAAC;AAChE,QAAM,MAAM,MAAM,SAAS,UAAU;CACtC;AAED,QAAO;AACR;;;;AAKD,eAAsB,eAAeA,SAA0C;AAC7E,KAAI;EACF,MAAM,cAAc,MAAM,eAAe,QAAQ;AACjD,SAAO,YAAY,eAAe;CACnC,SAAQ,OAAO;AACd,SAAO,MAAM,8BAA8B,iBAAiB,QAAQ,eAAkB;AACtF,SAAO;CACR;AACF;;;;AAKD,eAAsB,cACpBA,SACAO,cAC6B;AAC7B,KAAI;EACF,MAAM,cAAc,MAAM,eAAe,QAAQ;EACjD,MAAM,iBAAiB,gBAAgB,YAAY;AAEnD,OAAK,gBAAgB;AACnB,UAAO,KAAK,6BAA6B;AACzC,UAAO;IAAE,SAAS;IAAO,OAAO;IAA8B,cAAc;GAAM;EACnF;EAED,MAAM,EAAE,qBAAqB,QAAQ,GAAG,MAAM,gBAAgB;EAC9D,MAAM,aAAa,eAAe;AAElC,SAAO,KAAK,2BAA2B;EAEvC,MAAM,kBAAkB,MAAM,MAAM,yBAClC,qBACA,QACA,YACA,eACD;AAED,OAAK,gBAAgB,IAAI;GACvB,MAAM,YAAY,MAAM,gBAAgB,MAAM,CAAC,MAAM,MAAM,gBAAgB;AAC3E,UAAO,MAAM,gCAAmC;IAAE,QAAQ,gBAAgB;IAAQ;GAAW,EAAC;GAE9F,IAAIC,YAAqC,CAAE;AAC3C,OAAI;AACF,gBAAY,KAAK,MAAM,UAAU;GAClC,QAAO,CAEP;GAED,MAAM,eACJ,gBAAgB,WAAW,OAC3B,UAAU,UAAU,mBACpB,UAAU,UAAU,mBACpB,gBAAgB,WAAW;AAE7B,UAAO;IACL,SAAS;IACT,QAAQ,wBAAwB,UAAU,qBAAqB,UAAU,SAAS,UAAU;IAC5F;GACD;EACF;EAED,MAAM,gBAAgB,MAAM,MAAM,4BAChC,qBACA,QACA,gBACD;AAED,SAAO,KAAK,2BAA2B;EAEvC,MAAM,kBAAkB,cAAc,iBAAiB;EACvD,MAAM,YAAY,cAAc,aAC5B,KAAK,KAAK,GAAG,cAAc,aAAa,MACxC,YAAY;AAGhB,QAAM,kBAAkB,SAAS;GAC/B,aAAa,cAAc;GAC3B,cAAc;GACd,SAAS,cAAc;GACvB;GACA,cAAc,KAAK,KAAK;EACzB,EAAC;AAEF,SAAO;GACL,SAAS;GACT,QAAQ;IACN,cAAc,cAAc;IAC5B,eAAe;IACf,UAAU,cAAc;IACxB,YAAY,cAAc;GAC3B;EACF;CACF,SAAQ,OAAO;AACd,SAAO,MAAM,uCAAuC,iBAAiB,QAAQ,eAAkB;EAE/F,MAAM,eACJ,iBAAiB,UAChB,MAAM,QAAQ,SAAS,gBAAgB,IACtC,MAAM,QAAQ,SAAS,gBAAgB,IACvC,MAAM,QAAQ,SAAS,eAAe;AAE1C,SAAO;GACL,SAAS;GACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU;GAChD;EACD;CACF;AACF;;;;AAQD,SAAgB,uBAA6B;AAC3C,mBAAkB;AACnB"}

package/dist/identity-CFa1txoj.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-CFa1txoj.js","names":["initialContext: IdentityContextData","DEFAULT_IDENTITY_STORE_CONFIG: Required<\n  Pick<IdentityStoreConfig, 'contextEndpoint' | 'permissionsEndpoint' | 'logoutPath' | 'fetcher'>\n>","identityStoreConfig: IdentityStoreConfig","details: Omit<IdentityUnauthorizedDetails, 'logoutPath'>","unauthorizedDetails: IdentityUnauthorizedDetails","config: IdentityStoreConfig","config: {\n  contextEndpoint?: string;\n  permissionsEndpoint?: string;\n}","initialContext","event: IdentityContextChangedEvent"],"sources":["../src/identity/identity-store.ts","../src/identity/identity-context-provider.tsx"],"sourcesContent":["/**\n * Identity Store (Zustand)\n * \n * Centralized state management for identity context.\n */\n\nimport { create } from 'zustand';\nimport type { IdentityContextData } from './types';\n\nconst initialContext: IdentityContextData = {\n  hasAnyMembership: false,\n  hasSubscription: false,\n  isOnboarded: false,\n  tenants: [],\n  currentTenant: undefined,\n  permissions: [],\n  contextVersion: 0,\n  isLoading: true,\n  userId: undefined,\n  email: undefined,\n  firstName: undefined,\n  lastName: undefined,\n  displayName: undefined,\n  profileImageUrl: undefined,\n  phoneNumber: undefined,\n  timeZone: undefined,\n  addresses: undefined,\n  hasOwnerMembership: false,\n  memberships: undefined,\n};\n\ninterface IdentityState {\n  context: IdentityContextData;\n\n  // Actions\n  setContext: (context: Partial<IdentityContextData>) => void;\n  refreshContext: () => Promise<void>;\n  refreshPermissions: () => Promise<void>;\n  reset: () => void;\n}\n\nexport interface IdentityUnauthorizedDetails {\n  reason: 'current-user-missing' | 'unauthorized';\n  logoutPath: string;\n  response?: Response;\n}\n\nexport interface IdentityStoreConfig {\n  contextEndpoint?: string;\n  permissionsEndpoint?: string;\n  logoutPath?: string;\n  fetcher?: typeof fetch;\n  onUnauthorized?: (details: IdentityUnauthorizedDetails) => void;\n}\n\nconst DEFAULT_IDENTITY_STORE_CONFIG: Required<\n  Pick<IdentityStoreConfig, 'contextEndpoint' | 'permissionsEndpoint' | 'logoutPath' | 'fetcher'>\n> = {\n  contextEndpoint: '/api/identity/context',\n  permissionsEndpoint: '/api/identity/permissions',\n  logoutPath: '/auth/logout',\n  fetcher: (input, init) => fetch(input, init),\n};\n\nlet identityStoreConfig: IdentityStoreConfig = {\n  ...DEFAULT_IDENTITY_STORE_CONFIG,\n};\n\nfunction getIdentityStoreConfig(): IdentityStoreConfig & typeof DEFAULT_IDENTITY_STORE_CONFIG {\n  return {\n    ...DEFAULT_IDENTITY_STORE_CONFIG,\n    ...identityStoreConfig,\n  };\n}\n\nfunction handleUnauthorized(details: Omit<IdentityUnauthorizedDetails, 'logoutPath'>): void {\n  const config = getIdentityStoreConfig();\n  const unauthorizedDetails: IdentityUnauthorizedDetails = {\n    ...details,\n    logoutPath: config.logoutPath,\n  };\n\n  if (config.onUnauthorized) {\n    config.onUnauthorized(unauthorizedDetails);\n    return;\n  }\n\n  if (typeof window !== 'undefined') {\n    window.location.href = config.logoutPath;\n  }\n}\n\n/**\n * Configure the identity store for different app/back-end conventions.\n */\nexport function configureIdentityStore(config: IdentityStoreConfig): void {\n  identityStoreConfig = {\n    ...identityStoreConfig,\n    ...config,\n  };\n}\n\n/**\n * Reset identity store configuration to the built-in defaults.\n */\nexport function resetIdentityStoreConfig(): void {\n  identityStoreConfig = {\n    ...DEFAULT_IDENTITY_STORE_CONFIG,\n  };\n}\n\n/**\n * Backward-compatible endpoint-only configuration helper.\n */\nexport function configureIdentityEndpoints(config: {\n  contextEndpoint?: string;\n  permissionsEndpoint?: string;\n}): void {\n  configureIdentityStore(config);\n}\n\nexport const useIdentityStore = create<IdentityState>((set) => ({\n  context: initialContext,\n\n  setContext: (newContext) => {\n    set((state) => ({\n      context: {\n        ...state.context,\n        ...newContext,\n        isLoading: false,\n        lastUpdated: new Date(),\n      },\n    }));\n  },\n\n  refreshContext: async () => {\n    try {\n      const config = getIdentityStoreConfig();\n\n      set((state) => ({\n        context: { ...state.context, isLoading: true },\n      }));\n\n      const response = await config.fetcher(`${config.contextEndpoint}?refresh=true`, {\n        method: 'GET',\n        headers: {\n          'Content-Type': 'application/json',\n        },\n      });\n\n      if (response.ok) {\n        const newContext = await response.json();\n        set({\n          context: {\n            ...newContext,\n            isLoading: false,\n            lastUpdated: new Date(),\n          },\n        });\n        console.log('Identity context refreshed:', newContext);\n      } else if (response.status === 404) {\n        const errorData = await response.json().catch(() => ({}));\n        if (errorData.code === 'CurrentUserMissing' || errorData.title === 'CurrentUserMissing') {\n          console.error('CurrentUserMissing error - session is invalid, redirecting to logout');\n          handleUnauthorized({\n            reason: 'current-user-missing',\n            response,\n          });\n          return;\n        }\n        console.error('Failed to refresh identity context:', response.status);\n        set((state) => ({\n          context: { ...state.context, isLoading: false },\n        }));\n      } else if (response.status === 401) {\n        console.error('Identity context refresh returned 401, redirecting to logout');\n        handleUnauthorized({\n          reason: 'unauthorized',\n          response,\n        });\n        return;\n      } else {\n        console.error('Failed to refresh identity context:', response.status);\n        set((state) => ({\n          context: { ...state.context, isLoading: false },\n        }));\n      }\n    } catch (error) {\n      console.error('Error refreshing identity context:', error);\n      set((state) => ({\n        context: { ...state.context, isLoading: false },\n      }));\n    }\n  },\n\n  refreshPermissions: async () => {\n    try {\n      const config = getIdentityStoreConfig();\n\n      console.log('Refreshing permissions...');\n\n      const response = await config.fetcher(config.permissionsEndpoint, {\n        method: 'GET',\n        headers: {\n          'Content-Type': 'application/json',\n        },\n      });\n\n      if (response.ok) {\n        const result = await response.json();\n        const permissions = result.data?.permissions || [];\n\n        set((state) => ({\n          context: {\n            ...state.context,\n            permissions,\n            lastUpdated: new Date(),\n          },\n        }));\n\n        console.log('Permissions refreshed:', {\n          count: permissions.length,\n        });\n      } else if (response.status === 401) {\n        console.error('Permissions refresh returned 401, redirecting to logout');\n        handleUnauthorized({\n          reason: 'unauthorized',\n          response,\n        });\n      } else {\n        console.error('Failed to refresh permissions:', response.status);\n      }\n    } catch (error) {\n      console.error('Error refreshing permissions:', error);\n    }\n  },\n\n  reset: () => {\n    set({ context: initialContext });\n  },\n}));\n\n// Convenience selectors\nexport const useIsOnboarded = () => useIdentityStore((state) => state.context.isOnboarded);\nexport const useHasSubscription = () => useIdentityStore((state) => state.context.hasSubscription);\nexport const useUserTenants = () =>\n  useIdentityStore((state) => ({\n    tenants: state.context.tenants,\n    currentTenant: state.context.currentTenant,\n  }));\nexport const useUserPermissions = () => useIdentityStore((state) => state.context.permissions);\nexport const useIdentityContext = () => {\n  const context = useIdentityStore((state) => state.context);\n  const refreshContext = useIdentityStore((state) => state.refreshContext);\n  const refreshPermissions = useIdentityStore((state) => state.refreshPermissions);\n\n  return { context, refreshContext, refreshPermissions };\n};\n","/**\n * Identity Context Provider\n * \n * Initializes the identity store and listens to SignalR events.\n */\n\nimport { useEffect, type ReactNode } from 'react';\nimport { useIdentityStore } from './identity-store';\nimport type { IdentityContextData, IdentityContextChangedEvent } from './types';\n\ninterface IdentityContextProviderProps {\n  children: ReactNode;\n  initialContext?: Partial<IdentityContextData>;\n  accessToken?: string | null;\n  signalRClient?: {\n    onIdentityContextChanged: (handler: (event: IdentityContextChangedEvent) => void) => () => void;\n    disconnect: () => Promise<void>;\n  };\n}\n\nexport function IdentityContextProvider({\n  children,\n  initialContext,\n  accessToken,\n  signalRClient,\n}: IdentityContextProviderProps) {\n  const setContext = useIdentityStore((state) => state.setContext);\n  const refreshContext = useIdentityStore((state) => state.refreshContext);\n  const refreshPermissions = useIdentityStore((state) => state.refreshPermissions);\n  const contextVersion = useIdentityStore((state) => state.context.contextVersion);\n\n  // Initialize store with initial context from server\n  useEffect(() => {\n    if (initialContext) {\n      setContext(initialContext);\n    }\n  }, [initialContext, setContext]);\n\n  // Handle SignalR identity context changes\n  useEffect(() => {\n    if (!signalRClient) return;\n\n    const handleContextChange = (event: IdentityContextChangedEvent) => {\n      console.log('Identity context changed via SignalR:', event);\n\n      if (event.contextVersion > (contextVersion ?? 0)) {\n        console.log('Refreshing context due to SignalR event...');\n\n        if (event.reason === 'PermissionsChanged' || event.reason === 'RoleAssignmentChanged') {\n          console.log('Permission-specific change detected, refreshing permissions only...');\n          refreshPermissions();\n        } else {\n          refreshContext();\n        }\n      }\n    };\n\n    const unsubscribe = signalRClient.onIdentityContextChanged(handleContextChange);\n\n    return unsubscribe;\n  }, [accessToken, contextVersion, refreshContext, refreshPermissions, signalRClient]);\n\n  // Initial context load if not provided\n  useEffect(() => {\n    if (!initialContext) {\n      refreshContext();\n    }\n  }, [initialContext, refreshContext]);\n\n  // Cleanup SignalR on unmount\n  useEffect(() => {\n    return () => {\n      if (signalRClient) {\n        signalRClient.disconnect().catch((error) => {\n          console.error('Error disconnecting SignalR:', error);\n        });\n      }\n    };\n  }, [signalRClient]);\n\n  return <>{children}</>;\n}\n"],"mappings":";;;;;AASA,MAAMA,iBAAsC;CAC1C,kBAAkB;CAClB,iBAAiB;CACjB,aAAa;CACb,SAAS,CAAE;CACX;CACA,aAAa,CAAE;CACf,gBAAgB;CAChB,WAAW;CACX;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,oBAAoB;CACpB;AACD;AA0BD,MAAMC,gCAEF;CACF,iBAAiB;CACjB,qBAAqB;CACrB,YAAY;CACZ,SAAS,CAAC,OAAO,SAAS,MAAM,OAAO,KAAK;AAC7C;AAED,IAAIC,sBAA2C,EAC7C,GAAG,8BACJ;AAED,SAAS,yBAAqF;AAC5F,QAAO;EACL,GAAG;EACH,GAAG;CACJ;AACF;AAED,SAAS,mBAAmBC,SAAgE;CAC1F,MAAM,SAAS,wBAAwB;CACvC,MAAMC,sBAAmD;EACvD,GAAG;EACH,YAAY,OAAO;CACpB;AAED,KAAI,OAAO,gBAAgB;AACzB,SAAO,eAAe,oBAAoB;AAC1C;CACD;AAED,YAAW,WAAW,YACpB,QAAO,SAAS,OAAO,OAAO;AAEjC;;;;AAKD,SAAgB,uBAAuBC,QAAmC;AACxE,uBAAsB;EACpB,GAAG;EACH,GAAG;CACJ;AACF;;;;AAKD,SAAgB,2BAAiC;AAC/C,uBAAsB,EACpB,GAAG,8BACJ;AACF;;;;AAKD,SAAgB,2BAA2BC,QAGlC;AACP,wBAAuB,OAAO;AAC/B;AAED,MAAa,mBAAmB,OAAsB,CAAC,SAAS;CAC9D,SAAS;CAET,YAAY,CAAC,eAAe;AAC1B,MAAI,CAAC,WAAW,EACd,SAAS;GACP,GAAG,MAAM;GACT,GAAG;GACH,WAAW;GACX,aAAa,IAAI;EAClB,EACF,GAAE;CACJ;CAED,gBAAgB,YAAY;AAC1B,MAAI;GACF,MAAM,SAAS,wBAAwB;AAEvC,OAAI,CAAC,WAAW,EACd,SAAS;IAAE,GAAG,MAAM;IAAS,WAAW;GAAM,EAC/C,GAAE;GAEH,MAAM,WAAW,MAAM,OAAO,SAAS,EAAE,OAAO,gBAAgB,gBAAgB;IAC9E,QAAQ;IACR,SAAS,EACP,gBAAgB,mBACjB;GACF,EAAC;AAEF,OAAI,SAAS,IAAI;IACf,MAAM,aAAa,MAAM,SAAS,MAAM;AACxC,QAAI,EACF,SAAS;KACP,GAAG;KACH,WAAW;KACX,aAAa,IAAI;IAClB,EACF,EAAC;AACF,YAAQ,IAAI,+BAA+B,WAAW;GACvD,WAAU,SAAS,WAAW,KAAK;IAClC,MAAM,YAAY,MAAM,SAAS,MAAM,CAAC,MAAM,OAAO,CAAE,GAAE;AACzD,QAAI,UAAU,SAAS,wBAAwB,UAAU,UAAU,sBAAsB;AACvF,aAAQ,MAAM,uEAAuE;AACrF,wBAAmB;MACjB,QAAQ;MACR;KACD,EAAC;AACF;IACD;AACD,YAAQ,MAAM,uCAAuC,SAAS,OAAO;AACrE,QAAI,CAAC,WAAW,EACd,SAAS;KAAE,GAAG,MAAM;KAAS,WAAW;IAAO,EAChD,GAAE;GACJ,WAAU,SAAS,WAAW,KAAK;AAClC,YAAQ,MAAM,+DAA+D;AAC7E,uBAAmB;KACjB,QAAQ;KACR;IACD,EAAC;AACF;GACD,OAAM;AACL,YAAQ,MAAM,uCAAuC,SAAS,OAAO;AACrE,QAAI,CAAC,WAAW,EACd,SAAS;KAAE,GAAG,MAAM;KAAS,WAAW;IAAO,EAChD,GAAE;GACJ;EACF,SAAQ,OAAO;AACd,WAAQ,MAAM,sCAAsC,MAAM;AAC1D,OAAI,CAAC,WAAW,EACd,SAAS;IAAE,GAAG,MAAM;IAAS,WAAW;GAAO,EAChD,GAAE;EACJ;CACF;CAED,oBAAoB,YAAY;AAC9B,MAAI;GACF,MAAM,SAAS,wBAAwB;AAEvC,WAAQ,IAAI,4BAA4B;GAExC,MAAM,WAAW,MAAM,OAAO,QAAQ,OAAO,qBAAqB;IAChE,QAAQ;IACR,SAAS,EACP,gBAAgB,mBACjB;GACF,EAAC;AAEF,OAAI,SAAS,IAAI;IACf,MAAM,SAAS,MAAM,SAAS,MAAM;IACpC,MAAM,cAAc,OAAO,MAAM,eAAe,CAAE;AAElD,QAAI,CAAC,WAAW,EACd,SAAS;KACP,GAAG,MAAM;KACT;KACA,aAAa,IAAI;IAClB,EACF,GAAE;AAEH,YAAQ,IAAI,0BAA0B,EACpC,OAAO,YAAY,OACpB,EAAC;GACH,WAAU,SAAS,WAAW,KAAK;AAClC,YAAQ,MAAM,0DAA0D;AACxE,uBAAmB;KACjB,QAAQ;KACR;IACD,EAAC;GACH,MACC,SAAQ,MAAM,kCAAkC,SAAS,OAAO;EAEnE,SAAQ,OAAO;AACd,WAAQ,MAAM,iCAAiC,MAAM;EACtD;CACF;CAED,OAAO,MAAM;AACX,MAAI,EAAE,SAAS,eAAgB,EAAC;CACjC;AACF,GAAE;AAGH,MAAa,iBAAiB,MAAM,iBAAiB,CAAC,UAAU,MAAM,QAAQ,YAAY;AAC1F,MAAa,qBAAqB,MAAM,iBAAiB,CAAC,UAAU,MAAM,QAAQ,gBAAgB;AAClG,MAAa,iBAAiB,MAC5B,iBAAiB,CAAC,WAAW;CAC3B,SAAS,MAAM,QAAQ;CACvB,eAAe,MAAM,QAAQ;AAC9B,GAAE;AACL,MAAa,qBAAqB,MAAM,iBAAiB,CAAC,UAAU,MAAM,QAAQ,YAAY;AAC9F,MAAa,qBAAqB,MAAM;CACtC,MAAM,UAAU,iBAAiB,CAAC,UAAU,MAAM,QAAQ;CAC1D,MAAM,iBAAiB,iBAAiB,CAAC,UAAU,MAAM,eAAe;CACxE,MAAM,qBAAqB,iBAAiB,CAAC,UAAU,MAAM,mBAAmB;AAEhF,QAAO;EAAE;EAAS;EAAgB;CAAoB;AACvD;;;;AC7OD,SAAgB,wBAAwB,EACtC,UACA,kCACA,aACA,eAC6B,EAAE;CAC/B,MAAM,aAAa,iBAAiB,CAAC,UAAU,MAAM,WAAW;CAChE,MAAM,iBAAiB,iBAAiB,CAAC,UAAU,MAAM,eAAe;CACxE,MAAM,qBAAqB,iBAAiB,CAAC,UAAU,MAAM,mBAAmB;CAChF,MAAM,iBAAiB,iBAAiB,CAAC,UAAU,MAAM,QAAQ,eAAe;AAGhF,WAAU,MAAM;AACd,MAAIC,iBACF,YAAWA,iBAAe;CAE7B,GAAE,CAACA,kBAAgB,UAAW,EAAC;AAGhC,WAAU,MAAM;AACd,OAAK,cAAe;EAEpB,MAAM,sBAAsB,CAACC,UAAuC;AAClE,WAAQ,IAAI,yCAAyC,MAAM;AAE3D,OAAI,MAAM,kBAAkB,kBAAkB,IAAI;AAChD,YAAQ,IAAI,6CAA6C;AAEzD,QAAI,MAAM,WAAW,wBAAwB,MAAM,WAAW,yBAAyB;AACrF,aAAQ,IAAI,sEAAsE;AAClF,yBAAoB;IACrB,MACC,iBAAgB;GAEnB;EACF;EAED,MAAM,cAAc,cAAc,yBAAyB,oBAAoB;AAE/E,SAAO;CACR,GAAE;EAAC;EAAa;EAAgB;EAAgB;EAAoB;CAAc,EAAC;AAGpF,WAAU,MAAM;AACd,OAAKD,iBACH,iBAAgB;CAEnB,GAAE,CAACA,kBAAgB,cAAe,EAAC;AAGpC,WAAU,MAAM;AACd,SAAO,MAAM;AACX,OAAI,cACF,eAAc,YAAY,CAAC,MAAM,CAAC,UAAU;AAC1C,YAAQ,MAAM,gCAAgC,MAAM;GACrD,EAAC;EAEL;CACF,GAAE,CAAC,aAAc,EAAC;AAEnB,wBAAO,gBAAG,WAAY;AACvB"}

package/dist/permissions-D5ScGGnd.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissions-D5ScGGnd.js","names":["permissions: PermissionCode[]","permission: PermissionCode","options: PermissionCheckOptions","matchedPermissions: PermissionCode[]","missingPermissions: PermissionCode[]","pattern: PermissionCode","module: PermissionModule","entity: string","state: PermissionState","permissions: PermissionCode[]","isLoading: boolean","permission: PermissionCode","permissions: PermissionCode[]","options?: PermissionCheckOptions","module: PermissionModule","PERMISSION_MODULES: PermissionModule[]"],"sources":["../src/permissions/permission-service.ts","../src/permissions/permission-store.ts","../src/permissions/permission-initializer.tsx","../src/permissions/hooks.ts","../src/permissions/components.tsx","../src/permissions/constants.ts"],"sourcesContent":["/**\n * Permission Service\n * \n * Core permission checking logic.\n */\n\nimport type {\n  PermissionCode,\n  PermissionModule,\n  PermissionCheckOptions,\n  PermissionCheckResult,\n  FieldPermissionResult,\n} from './types';\n\n/**\n * Permission Checker Class\n * \n * Provides methods for checking user permissions.\n */\nexport class PermissionChecker {\n  private permissions: Set<PermissionCode>;\n  private permissionArray: PermissionCode[];\n\n  constructor(permissions: PermissionCode[]) {\n    this.permissionArray = permissions;\n    this.permissions = new Set(permissions);\n  }\n\n  /**\n   * Check if user has a single permission\n   */\n  hasPermission(permission: PermissionCode): boolean {\n    return this.permissions.has(permission);\n  }\n\n  /**\n   * Check multiple permissions with AND/OR logic\n   */\n  hasPermissions(\n    permissions: PermissionCode[],\n    options: PermissionCheckOptions = {}\n  ): PermissionCheckResult {\n    const { operator = 'OR', wildcard = false } = options;\n\n    const matchedPermissions: PermissionCode[] = [];\n    const missingPermissions: PermissionCode[] = [];\n\n    for (const permission of permissions) {\n      const hasIt = wildcard\n        ? this.hasWildcardPermission(permission)\n        : this.hasPermission(permission);\n\n      if (hasIt) {\n        matchedPermissions.push(permission);\n      } else {\n        missingPermissions.push(permission);\n      }\n    }\n\n    const hasPermission =\n      operator === 'AND'\n        ? missingPermissions.length === 0\n        : matchedPermissions.length > 0;\n\n    return {\n      hasPermission,\n      matchedPermissions,\n      missingPermissions,\n    };\n  }\n\n  /**\n   * Check wildcard permission pattern\n   */\n  private hasWildcardPermission(pattern: PermissionCode): boolean {\n    if (!pattern.includes('*')) {\n      return this.hasPermission(pattern);\n    }\n\n    const regex = new RegExp(\n      '^' + pattern.replace(/\\./g, '\\\\.').replace(/\\*/g, '.*') + '$'\n    );\n\n    return this.permissionArray.some((p) => regex.test(p));\n  }\n\n  /**\n   * Check if user has any permission in a module\n   */\n  hasModulePermission(module: PermissionModule): boolean {\n    const prefix = `${module}.`;\n    return this.permissionArray.some((p) => p.startsWith(prefix));\n  }\n\n  /**\n   * Get field-level permissions for an entity\n   */\n  getFieldPermissions(\n    module: PermissionModule,\n    entity: string\n  ): FieldPermissionResult {\n    const base = `${module}.${entity}`;\n\n    return {\n      canView: this.hasPermission(`${base}.View`),\n      canEdit: this.hasPermission(`${base}.Edit`),\n      canCreate: this.hasPermission(`${base}.Create`),\n      canDelete: this.hasPermission(`${base}.Delete`),\n    };\n  }\n\n  /**\n   * Get all permissions\n   */\n  getAllPermissions(): readonly PermissionCode[] {\n    return Object.freeze([...this.permissionArray]);\n  }\n\n  /**\n   * Get permissions for a specific module\n   */\n  getModulePermissions(module: PermissionModule): PermissionCode[] {\n    const prefix = `${module}.`;\n    return this.permissionArray.filter((p) => p.startsWith(prefix));\n  }\n\n  /**\n   * Check if user has any permissions\n   */\n  hasAnyPermissions(): boolean {\n    return this.permissionArray.length > 0;\n  }\n\n  /**\n   * Get permission count\n   */\n  getPermissionCount(): number {\n    return this.permissionArray.length;\n  }\n}\n","/**\n * Permission Store (Zustand)\n * \n * State management for permissions.\n */\n\nimport { create } from 'zustand';\nimport { PermissionChecker } from './permission-service';\nimport type { PermissionCode } from './types';\n\n/**\n * Permission store state interface\n */\ninterface PermissionState {\n  checker: PermissionChecker;\n  permissions: PermissionCode[];\n  isLoading: boolean;\n  setPermissions: (permissions: PermissionCode[]) => void;\n  setLoading: (isLoading: boolean) => void;\n  reset: () => void;\n}\n\n/**\n * Selectors for selective subscription\n */\nexport const selectChecker = (state: PermissionState) => state.checker;\nexport const selectPermissions = (state: PermissionState) => state.permissions;\nexport const selectIsLoading = (state: PermissionState) => state.isLoading;\n\n/**\n * Initial state\n */\nconst initialState = {\n  checker: new PermissionChecker([]),\n  permissions: [] as PermissionCode[],\n  isLoading: false,\n};\n\n/**\n * Permission store\n */\nexport const usePermissionStore = create<PermissionState>((set) => ({\n  ...initialState,\n\n  setPermissions: (permissions: PermissionCode[]) => {\n    set({\n      permissions,\n      checker: new PermissionChecker(permissions),\n    });\n  },\n\n  setLoading: (isLoading: boolean) => {\n    set({ isLoading });\n  },\n\n  reset: () => {\n    set(initialState);\n  },\n}));\n\n/**\n * Initialize permission store\n */\nexport function initializePermissions(\n  permissions: PermissionCode[],\n  isLoading: boolean = false\n): void {\n  usePermissionStore.getState().setPermissions(permissions);\n  usePermissionStore.getState().setLoading(isLoading);\n}\n\n/**\n * Get permission checker outside React components\n */\nexport function getPermissionChecker(): PermissionChecker {\n  return usePermissionStore.getState().checker;\n}\n\n/**\n * Get all permissions outside React components\n */\nexport function getPermissions(): PermissionCode[] {\n  return usePermissionStore.getState().permissions;\n}\n","/**\n * Permission Initializer Component\n * \n * Initializes permission store from identity context.\n */\n\nimport { useEffect, type ReactNode } from 'react';\nimport { initializePermissions } from './permission-store';\nimport type { PermissionCode } from './types';\n\ninterface PermissionInitializerProps {\n  permissions: PermissionCode[];\n  isLoading?: boolean;\n  children: ReactNode;\n}\n\n/**\n * Component that initializes permissions from props\n */\nexport function PermissionInitializer({\n  permissions,\n  isLoading = false,\n  children,\n}: PermissionInitializerProps) {\n  useEffect(() => {\n    initializePermissions(permissions, isLoading);\n  }, [permissions, isLoading]);\n\n  return <>{children}</>;\n}\n","/**\n * Permission Hooks\n * \n * React hooks for permission checks.\n */\n\nimport { useMemo, useCallback } from 'react';\nimport { usePermissionStore, selectChecker } from './permission-store';\nimport type { PermissionCode, PermissionCheckOptions, PermissionModule } from './types';\n\n/**\n * Hook for checking a single permission\n */\nexport function usePermission(permission: PermissionCode): boolean {\n  const checker = usePermissionStore(selectChecker);\n  return useMemo(() => checker.hasPermission(permission), [checker, permission]);\n}\n\n/**\n * Alias for usePermission\n */\nexport const useHasPermission = usePermission;\n\n/**\n * Hook for checking multiple permissions\n */\nexport function usePermissions(\n  permissions: PermissionCode[],\n  options?: PermissionCheckOptions\n) {\n  const checker = usePermissionStore(selectChecker);\n  return useMemo(\n    () => checker.hasPermissions(permissions, options),\n    [checker, permissions, options]\n  );\n}\n\n/**\n * Alias for usePermissions\n */\nexport const useHasPermissions = usePermissions;\n\n/**\n * Hook for checking module-level permissions\n */\nexport function useModulePermission(module: PermissionModule): boolean {\n  const checker = usePermissionStore(selectChecker);\n  return useMemo(() => checker.hasModulePermission(module), [checker, module]);\n}\n\n/**\n * Alias for useModulePermission\n */\nexport const useHasModulePermission = useModulePermission;\n\n/**\n * Hook for getting a memoized permission checker function\n */\nexport function usePermissionChecker() {\n  const checker = usePermissionStore(selectChecker);\n  return useCallback(\n    (permission: PermissionCode) => checker.hasPermission(permission),\n    [checker]\n  );\n}\n\n/**\n * Hook for getting all user permissions\n */\nexport function useAllPermissions(): readonly PermissionCode[] {\n  const checker = usePermissionStore(selectChecker);\n  return useMemo(() => checker.getAllPermissions(), [checker]);\n}\n\n/**\n * Hook for field-level permissions\n */\nexport function useFieldPermissions(module: PermissionModule, entity: string) {\n  const checker = usePermissionStore(selectChecker);\n  return useMemo(\n    () => checker.getFieldPermissions(module, entity),\n    [checker, module, entity]\n  );\n}\n\n/**\n * Hook for permission loading state\n */\nexport function usePermissionLoading(): boolean {\n  return usePermissionStore((state) => state.isLoading);\n}\n","/**\n * Permission Components\n * \n * Protected UI components that conditionally render based on permissions.\n */\n\nimport React, { type ReactNode, type ComponentProps } from 'react';\nimport { usePermission, usePermissions } from './hooks';\nimport type { PermissionCode, PermissionCheckOptions } from './types';\n\n// ============================================================================\n// ProtectedButton\n// ============================================================================\n\ninterface ProtectedButtonProps extends ComponentProps<'button'> {\n  permission: PermissionCode;\n  fallback?: ReactNode;\n}\n\n/**\n * Button that only renders if user has the required permission\n */\nexport function ProtectedButton({\n  permission,\n  fallback = null,\n  children,\n  ...props\n}: ProtectedButtonProps) {\n  const hasPermission = usePermission(permission);\n\n  if (!hasPermission) {\n    return <>{fallback}</>;\n  }\n\n  return <button {...props}>{children}</button>;\n}\n\n// ============================================================================\n// ProtectedLink\n// ============================================================================\n\ninterface ProtectedLinkProps extends ComponentProps<'a'> {\n  permission: PermissionCode;\n  fallback?: ReactNode;\n}\n\n/**\n * Link that only renders if user has the required permission\n */\nexport function ProtectedLink({\n  permission,\n  fallback = null,\n  children,\n  ...props\n}: ProtectedLinkProps) {\n  const hasPermission = usePermission(permission);\n\n  if (!hasPermission) {\n    return <>{fallback}</>;\n  }\n\n  return <a {...props}>{children}</a>;\n}\n\n// ============================================================================\n// ProtectedSection\n// ============================================================================\n\ninterface ProtectedSectionProps {\n  permission?: PermissionCode;\n  permissions?: PermissionCode[];\n  options?: PermissionCheckOptions;\n  fallback?: ReactNode;\n  children: ReactNode;\n}\n\n/**\n * Section that only renders if user has the required permission(s)\n */\nexport function ProtectedSection({\n  permission,\n  permissions,\n  options,\n  fallback = null,\n  children,\n}: ProtectedSectionProps) {\n  // Single permission check\n  const singlePermissionResult = usePermission(permission || '');\n  \n  // Multiple permissions check\n  const multiplePermissionsResult = usePermissions(permissions || [], options);\n\n  // Determine if we should render\n  let hasPermission = false;\n  \n  if (permission) {\n    hasPermission = singlePermissionResult;\n  } else if (permissions && permissions.length > 0) {\n    hasPermission = multiplePermissionsResult.hasPermission;\n  } else {\n    // No permission specified, render by default\n    hasPermission = true;\n  }\n\n  if (!hasPermission) {\n    return <>{fallback}</>;\n  }\n\n  return <>{children}</>;\n}\n\n// ============================================================================\n// ProtectedAction\n// ============================================================================\n\ninterface ProtectedActionProps {\n  permission: PermissionCode;\n  onAction: () => void;\n  children: (props: { onClick: () => void; disabled: boolean }) => ReactNode;\n}\n\n/**\n * Render prop component for protected actions\n */\nexport function ProtectedAction({\n  permission,\n  onAction,\n  children,\n}: ProtectedActionProps) {\n  const hasPermission = usePermission(permission);\n\n  return (\n    <>\n      {children({\n        onClick: hasPermission ? onAction : () => {},\n        disabled: !hasPermission,\n      })}\n    </>\n  );\n}\n","/**\n * Permission Constants\n */\n\nimport type { PermissionModule } from './types';\n\n/**\n * Available permission modules\n */\nexport const PERMISSION_MODULES: PermissionModule[] = [\n  'Identity',\n  'PropertyManagement',\n  'Leasing',\n  'Accounting',\n  'Tasks',\n  'People',\n  'Organization',\n  'Subscription',\n];\n"],"mappings":";;;;;;;;;;AAmBA,IAAa,oBAAb,MAA+B;CAC7B,AAAQ;CACR,AAAQ;CAER,YAAYA,aAA+B;AACzC,OAAK,kBAAkB;AACvB,OAAK,cAAc,IAAI,IAAI;CAC5B;;;;CAKD,cAAcC,YAAqC;AACjD,SAAO,KAAK,YAAY,IAAI,WAAW;CACxC;;;;CAKD,eACED,aACAE,UAAkC,CAAE,GACb;EACvB,MAAM,EAAE,WAAW,MAAM,WAAW,OAAO,GAAG;EAE9C,MAAMC,qBAAuC,CAAE;EAC/C,MAAMC,qBAAuC,CAAE;AAE/C,OAAK,MAAM,cAAc,aAAa;GACpC,MAAM,QAAQ,WACV,KAAK,sBAAsB,WAAW,GACtC,KAAK,cAAc,WAAW;AAElC,OAAI,MACF,oBAAmB,KAAK,WAAW;OAEnC,oBAAmB,KAAK,WAAW;EAEtC;EAED,MAAM,gBACJ,aAAa,QACT,mBAAmB,WAAW,IAC9B,mBAAmB,SAAS;AAElC,SAAO;GACL;GACA;GACA;EACD;CACF;;;;CAKD,AAAQ,sBAAsBC,SAAkC;AAC9D,OAAK,QAAQ,SAAS,IAAI,CACxB,QAAO,KAAK,cAAc,QAAQ;EAGpC,MAAM,QAAQ,IAAI,OAChB,MAAM,QAAQ,QAAQ,OAAO,MAAM,CAAC,QAAQ,OAAO,KAAK,GAAG;AAG7D,SAAO,KAAK,gBAAgB,KAAK,CAAC,MAAM,MAAM,KAAK,EAAE,CAAC;CACvD;;;;CAKD,oBAAoBC,QAAmC;EACrD,MAAM,UAAU,EAAE,OAAO;AACzB,SAAO,KAAK,gBAAgB,KAAK,CAAC,MAAM,EAAE,WAAW,OAAO,CAAC;CAC9D;;;;CAKD,oBACEA,QACAC,QACuB;EACvB,MAAM,QAAQ,EAAE,OAAO,GAAG,OAAO;AAEjC,SAAO;GACL,SAAS,KAAK,eAAe,EAAE,KAAK,OAAO;GAC3C,SAAS,KAAK,eAAe,EAAE,KAAK,OAAO;GAC3C,WAAW,KAAK,eAAe,EAAE,KAAK,SAAS;GAC/C,WAAW,KAAK,eAAe,EAAE,KAAK,SAAS;EAChD;CACF;;;;CAKD,oBAA+C;AAC7C,SAAO,OAAO,OAAO,CAAC,GAAG,KAAK,eAAgB,EAAC;CAChD;;;;CAKD,qBAAqBD,QAA4C;EAC/D,MAAM,UAAU,EAAE,OAAO;AACzB,SAAO,KAAK,gBAAgB,OAAO,CAAC,MAAM,EAAE,WAAW,OAAO,CAAC;CAChE;;;;CAKD,oBAA6B;AAC3B,SAAO,KAAK,gBAAgB,SAAS;CACtC;;;;CAKD,qBAA6B;AAC3B,SAAO,KAAK,gBAAgB;CAC7B;AACF;;;;;;;AClHD,MAAa,gBAAgB,CAACE,UAA2B,MAAM;;;;AAO/D,MAAM,eAAe;CACnB,SAAS,IAAI,kBAAkB,CAAE;CACjC,aAAa,CAAE;CACf,WAAW;AACZ;;;;AAKD,MAAa,qBAAqB,OAAwB,CAAC,SAAS;CAClE,GAAG;CAEH,gBAAgB,CAACC,gBAAkC;AACjD,MAAI;GACF;GACA,SAAS,IAAI,kBAAkB;EAChC,EAAC;CACH;CAED,YAAY,CAACC,cAAuB;AAClC,MAAI,EAAE,UAAW,EAAC;CACnB;CAED,OAAO,MAAM;AACX,MAAI,aAAa;CAClB;AACF,GAAE;;;;AAKH,SAAgB,sBACdD,aACAC,YAAqB,OACf;AACN,oBAAmB,UAAU,CAAC,eAAe,YAAY;AACzD,oBAAmB,UAAU,CAAC,WAAW,UAAU;AACpD;;;;AAKD,SAAgB,uBAA0C;AACxD,QAAO,mBAAmB,UAAU,CAAC;AACtC;;;;AAKD,SAAgB,iBAAmC;AACjD,QAAO,mBAAmB,UAAU,CAAC;AACtC;;;;;;;AChED,SAAgB,sBAAsB,EACpC,aACA,YAAY,OACZ,UAC2B,EAAE;AAC7B,WAAU,MAAM;AACd,wBAAsB,aAAa,UAAU;CAC9C,GAAE,CAAC,aAAa,SAAU,EAAC;AAE5B,wBAAO,gBAAG,WAAY;AACvB;;;;;;;AChBD,SAAgB,cAAcC,YAAqC;CACjE,MAAM,UAAU,mBAAmB,cAAc;AACjD,QAAO,QAAQ,MAAM,QAAQ,cAAc,WAAW,EAAE,CAAC,SAAS,UAAW,EAAC;AAC/E;;;;AAKD,MAAa,mBAAmB;;;;AAKhC,SAAgB,eACdC,aACAC,SACA;CACA,MAAM,UAAU,mBAAmB,cAAc;AACjD,QAAO,QACL,MAAM,QAAQ,eAAe,aAAa,QAAQ,EAClD;EAAC;EAAS;EAAa;CAAQ,EAChC;AACF;;;;AAKD,MAAa,oBAAoB;;;;AAKjC,SAAgB,oBAAoBC,QAAmC;CACrE,MAAM,UAAU,mBAAmB,cAAc;AACjD,QAAO,QAAQ,MAAM,QAAQ,oBAAoB,OAAO,EAAE,CAAC,SAAS,MAAO,EAAC;AAC7E;;;;AAKD,MAAa,yBAAyB;;;;AAKtC,SAAgB,uBAAuB;CACrC,MAAM,UAAU,mBAAmB,cAAc;AACjD,QAAO,YACL,CAACH,eAA+B,QAAQ,cAAc,WAAW,EACjE,CAAC,OAAQ,EACV;AACF;;;;AAKD,SAAgB,oBAA+C;CAC7D,MAAM,UAAU,mBAAmB,cAAc;AACjD,QAAO,QAAQ,MAAM,QAAQ,mBAAmB,EAAE,CAAC,OAAQ,EAAC;AAC7D;;;;;;;AClDD,SAAgB,gBAAgB,EAC9B,YACA,WAAW,MACX,SACA,GAAG,OACkB,EAAE;CACvB,MAAM,gBAAgB,cAAc,WAAW;AAE/C,MAAK,cACH,wBAAO,0BAAG,WAAY;AAGxB,wBAAO,IAAC;EAAO,GAAI;EAAQ;GAAkB;AAC9C;;;;AAcD,SAAgB,cAAc,EAC5B,YACA,WAAW,MACX,SACA,GAAG,OACgB,EAAE;CACrB,MAAM,gBAAgB,cAAc,WAAW;AAE/C,MAAK,cACH,wBAAO,0BAAG,WAAY;AAGxB,wBAAO,IAAC;EAAE,GAAI;EAAQ;GAAa;AACpC;;;;AAiBD,SAAgB,iBAAiB,EAC/B,YACA,aACA,SACA,WAAW,MACX,UACsB,EAAE;CAExB,MAAM,yBAAyB,cAAc,cAAc,GAAG;CAG9D,MAAM,4BAA4B,eAAe,eAAe,CAAE,GAAE,QAAQ;CAG5E,IAAI,gBAAgB;AAEpB,KAAI,WACF,iBAAgB;UACP,eAAe,YAAY,SAAS,EAC7C,iBAAgB,0BAA0B;KAG1C,iBAAgB;AAGlB,MAAK,cACH,wBAAO,0BAAG,WAAY;AAGxB,wBAAO,gBAAG,WAAY;AACvB;;;;AAeD,SAAgB,gBAAgB,EAC9B,YACA,UACA,UACqB,EAAE;CACvB,MAAM,gBAAgB,cAAc,WAAW;AAE/C,wBACE,0BACG,SAAS;EACR,SAAS,gBAAgB,WAAW,MAAM,CAAE;EAC5C,WAAW;CACZ,EAAC,GACD;AAEN;;;;;;;AClID,MAAaI,qBAAyC;CACpD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD"}

package/dist/query-client-Bpe08pk9.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"query-client-Bpe08pk9.js","names":["DEFAULT_CONFIG: Required<Omit<QueryClientConfig, 'logger' | 'onLogout'>>","error: unknown","returnUrl?: string","config: QueryClientConfig","cachePresets: CachePresets","module: T","filters?: Record<string, unknown>","id: string","queryClient: QueryClient","module: string","queryKey: readonly unknown[]"],"sources":["../src/query-client/query-config.ts"],"sourcesContent":["/**\n * Query Client Configuration\n * \n * Optimized caching strategy for different types of data:\n * - Static data (rarely changes): Long staleTime and gcTime\n * - Dynamic data (changes frequently): Short staleTime\n * - Critical data (needs to be fresh): Very short staleTime with prefetching\n */\n\nimport { QueryClient, QueryCache, MutationCache } from '@tanstack/react-query';\nimport type { QueryClientConfig, CachePresets } from './types';\n\n/**\n * Default configuration\n */\nconst DEFAULT_CONFIG: Required<Omit<QueryClientConfig, 'logger' | 'onLogout'>> = {\n  staleTime: 5 * 60 * 1000, // 5 minutes\n  gcTime: 10 * 60 * 1000, // 10 minutes\n  maxRetries: 3,\n  maxMutationRetries: 1,\n  refetchOnWindowFocus: true,\n  refetchOnReconnect: false,\n  refetchOnMount: false,\n};\n\n/**\n * Check if error is a 401 Unauthorized error\n */\nfunction is401Error(error: unknown): boolean {\n  if (error instanceof Response) {\n    return error.status === 401;\n  }\n\n  if (error && typeof error === 'object' && 'status' in error) {\n    return (error as any).status === 401;\n  }\n\n  return false;\n}\n\n/**\n * Check if error requires logout (refresh token expired)\n */\nfunction shouldLogout(error: unknown): boolean {\n  if (error && typeof error === 'object') {\n    // Check for shouldLogout flag from server\n    if ('shouldLogout' in error && (error as any).shouldLogout === true) {\n      return true;\n    }\n\n    // Check for SESSION_EXPIRED code\n    if ('code' in error && (error as any).code === 'SESSION_EXPIRED') {\n      return true;\n    }\n  }\n\n  return false;\n}\n\n/**\n * Create default logout handler\n */\nfunction createDefaultLogoutHandler(): (returnUrl?: string) => void {\n  return (returnUrl?: string) => {\n    if (typeof window !== 'undefined') {\n      const currentUrl = returnUrl || window.location.pathname + window.location.search;\n      window.location.href = `/auth/logout?returnUrl=${encodeURIComponent(currentUrl)}`;\n    }\n  };\n}\n\n/**\n * Create optimized QueryClient instance\n * \n * @param config - Configuration options\n * @returns Configured QueryClient with optimized defaults\n */\nexport function createQueryClient(config: QueryClientConfig = {}): QueryClient {\n  const {\n    staleTime,\n    gcTime,\n    maxRetries,\n    maxMutationRetries,\n    refetchOnWindowFocus,\n    refetchOnReconnect,\n    refetchOnMount,\n    logger,\n    onLogout,\n  } = { ...DEFAULT_CONFIG, ...config };\n\n  const handleLogout = onLogout || createDefaultLogoutHandler();\n\n  const queryClient = new QueryClient({\n    defaultOptions: {\n      queries: {\n        staleTime,\n        gcTime,\n        retry: (failureCount, error) => {\n          // Don't retry 401 errors - the fetch client handles refresh flows separately\n          if (is401Error(error)) {\n            logger?.debug?.('Query failed with 401, not retrying');\n            return false;\n          }\n          return failureCount < maxRetries;\n        },\n        retryDelay: (attemptIndex) => Math.min(1000 * 2 ** attemptIndex, 30000),\n        refetchOnWindowFocus,\n        refetchOnReconnect,\n        refetchOnMount,\n      },\n      mutations: {\n        retry: (failureCount, error) => {\n          if (is401Error(error)) {\n            logger?.debug?.('Mutation failed with 401, not retrying');\n            return false;\n          }\n          return failureCount < maxMutationRetries;\n        },\n        retryDelay: 1000,\n      },\n    },\n    queryCache: new QueryCache({\n      onError: (error) => {\n        if (shouldLogout(error)) {\n          handleLogout();\n          return;\n        }\n        logger?.error?.('Query error', error instanceof Error ? error : undefined, {\n          is401: is401Error(error),\n        });\n      },\n    }),\n    mutationCache: new MutationCache({\n      onError: (error) => {\n        if (shouldLogout(error)) {\n          handleLogout();\n          return;\n        }\n        logger?.error?.('Mutation error', error instanceof Error ? error : undefined, {\n          is401: is401Error(error),\n        });\n      },\n    }),\n  });\n\n  return queryClient;\n}\n\n/**\n * Cache Presets for different data types\n * \n * Use these presets for consistent caching across the application.\n */\nexport const cachePresets: CachePresets = {\n  /**\n   * Static data - rarely changes\n   * Good for: permissions, roles, system settings\n   */\n  static: {\n    staleTime: 30 * 60 * 1000, // 30 minutes\n    gcTime: 60 * 60 * 1000, // 1 hour\n    refetchOnWindowFocus: false,\n  },\n\n  /**\n   * Normal data - changes occasionally\n   * Good for: properties, users, organizations\n   */\n  normal: {\n    staleTime: 5 * 60 * 1000, // 5 minutes\n    gcTime: 10 * 60 * 1000, // 10 minutes\n    refetchOnWindowFocus: true,\n  },\n\n  /**\n   * Dynamic data - changes frequently\n   * Good for: transactions, activities, notifications\n   */\n  dynamic: {\n    staleTime: 1 * 60 * 1000, // 1 minute\n    gcTime: 5 * 60 * 1000, // 5 minutes\n    refetchOnWindowFocus: true,\n  },\n\n  /**\n   * Realtime data - always fresh\n   * Good for: live status, counters, dashboards\n   */\n  realtime: {\n    staleTime: 0, // Always stale\n    gcTime: 1 * 60 * 1000, // 1 minute\n    refetchOnWindowFocus: true,\n  },\n};\n\n/**\n * Create base query keys for a module\n */\nexport function createQueryKeyFactory<T extends string>(\n  module: T\n): {\n  all: readonly [T];\n  lists: () => readonly [T, 'list'];\n  list: (filters?: Record<string, unknown>) => readonly [T, 'list', Record<string, unknown>?];\n  details: () => readonly [T, 'detail'];\n  detail: (id: string) => readonly [T, 'detail', string];\n} {\n  return {\n    all: [module] as const,\n    lists: () => [module, 'list'] as const,\n    list: (filters?: Record<string, unknown>) => [module, 'list', filters] as const,\n    details: () => [module, 'detail'] as const,\n    detail: (id: string) => [module, 'detail', id] as const,\n  };\n}\n\n/**\n * Invalidation helpers for common patterns\n */\nexport const invalidationHelpers = {\n  /**\n   * Invalidate all queries for a module\n   */\n  invalidateModule: async (queryClient: QueryClient, module: string): Promise<void> => {\n    await queryClient.invalidateQueries({ queryKey: [module] });\n  },\n\n  /**\n   * Invalidate all list queries for a module\n   */\n  invalidateLists: async (queryClient: QueryClient, module: string): Promise<void> => {\n    await queryClient.invalidateQueries({ queryKey: [module, 'list'] });\n  },\n\n  /**\n   * Invalidate a specific detail query\n   */\n  invalidateDetail: async (\n    queryClient: QueryClient,\n    module: string,\n    id: string\n  ): Promise<void> => {\n    await queryClient.invalidateQueries({ queryKey: [module, 'detail', id] });\n  },\n\n  /**\n   * Invalidate and refetch (useful for critical data)\n   */\n  invalidateAndRefetch: async (queryClient: QueryClient, queryKey: readonly unknown[]): Promise<void> => {\n    await queryClient.invalidateQueries({ queryKey });\n    await queryClient.refetchQueries({ queryKey });\n  },\n};\n"],"mappings":";;;;;;AAeA,MAAMA,iBAA2E;CAC/E,WAAW,IAAI,KAAK;CACpB,QAAQ,KAAK,KAAK;CAClB,YAAY;CACZ,oBAAoB;CACpB,sBAAsB;CACtB,oBAAoB;CACpB,gBAAgB;AACjB;;;;AAKD,SAAS,WAAWC,OAAyB;AAC3C,KAAI,iBAAiB,SACnB,QAAO,MAAM,WAAW;AAG1B,KAAI,gBAAgB,UAAU,YAAY,YAAY,MACpD,QAAQ,MAAc,WAAW;AAGnC,QAAO;AACR;;;;AAKD,SAAS,aAAaA,OAAyB;AAC7C,KAAI,gBAAgB,UAAU,UAAU;AAEtC,MAAI,kBAAkB,SAAU,MAAc,iBAAiB,KAC7D,QAAO;AAIT,MAAI,UAAU,SAAU,MAAc,SAAS,kBAC7C,QAAO;CAEV;AAED,QAAO;AACR;;;;AAKD,SAAS,6BAA2D;AAClE,QAAO,CAACC,cAAuB;AAC7B,aAAW,WAAW,aAAa;GACjC,MAAM,aAAa,aAAa,OAAO,SAAS,WAAW,OAAO,SAAS;AAC3E,UAAO,SAAS,QAAQ,yBAAyB,mBAAmB,WAAW,CAAC;EACjF;CACF;AACF;;;;;;;AAQD,SAAgB,kBAAkBC,SAA4B,CAAE,GAAe;CAC7E,MAAM,EACJ,WACA,QACA,YACA,oBACA,sBACA,oBACA,gBACA,QACA,UACD,GAAG;EAAE,GAAG;EAAgB,GAAG;CAAQ;CAEpC,MAAM,eAAe,YAAY,4BAA4B;CAE7D,MAAM,cAAc,IAAI,YAAY;EAClC,gBAAgB;GACd,SAAS;IACP;IACA;IACA,OAAO,CAAC,cAAc,UAAU;AAE9B,SAAI,WAAW,MAAM,EAAE;AACrB,cAAQ,QAAQ,sCAAsC;AACtD,aAAO;KACR;AACD,YAAO,eAAe;IACvB;IACD,YAAY,CAAC,iBAAiB,KAAK,IAAI,MAAO,KAAK,cAAc,IAAM;IACvE;IACA;IACA;GACD;GACD,WAAW;IACT,OAAO,CAAC,cAAc,UAAU;AAC9B,SAAI,WAAW,MAAM,EAAE;AACrB,cAAQ,QAAQ,yCAAyC;AACzD,aAAO;KACR;AACD,YAAO,eAAe;IACvB;IACD,YAAY;GACb;EACF;EACD,YAAY,IAAI,WAAW,EACzB,SAAS,CAAC,UAAU;AAClB,OAAI,aAAa,MAAM,EAAE;AACvB,kBAAc;AACd;GACD;AACD,WAAQ,QAAQ,eAAe,iBAAiB,QAAQ,gBAAmB,EACzE,OAAO,WAAW,MAAM,CACzB,EAAC;EACH,EACF;EACD,eAAe,IAAI,cAAc,EAC/B,SAAS,CAAC,UAAU;AAClB,OAAI,aAAa,MAAM,EAAE;AACvB,kBAAc;AACd;GACD;AACD,WAAQ,QAAQ,kBAAkB,iBAAiB,QAAQ,gBAAmB,EAC5E,OAAO,WAAW,MAAM,CACzB,EAAC;EACH,EACF;CACF;AAED,QAAO;AACR;;;;;;AAOD,MAAaC,eAA6B;CAKxC,QAAQ;EACN,WAAW,KAAK,KAAK;EACrB,QAAQ,KAAK,KAAK;EAClB,sBAAsB;CACvB;CAMD,QAAQ;EACN,WAAW,IAAI,KAAK;EACpB,QAAQ,KAAK,KAAK;EAClB,sBAAsB;CACvB;CAMD,SAAS;EACP,WAAW,IAAI,KAAK;EACpB,QAAQ,IAAI,KAAK;EACjB,sBAAsB;CACvB;CAMD,UAAU;EACR,WAAW;EACX,QAAQ,IAAI,KAAK;EACjB,sBAAsB;CACvB;AACF;;;;AAKD,SAAgB,sBACdC,QAOA;AACA,QAAO;EACL,KAAK,CAAC,MAAO;EACb,OAAO,MAAM,CAAC,QAAQ,MAAO;EAC7B,MAAM,CAACC,YAAsC;GAAC;GAAQ;GAAQ;EAAQ;EACtE,SAAS,MAAM,CAAC,QAAQ,QAAS;EACjC,QAAQ,CAACC,OAAe;GAAC;GAAQ;GAAU;EAAG;CAC/C;AACF;;;;AAKD,MAAa,sBAAsB;CAIjC,kBAAkB,OAAOC,aAA0BC,WAAkC;AACnF,QAAM,YAAY,kBAAkB,EAAE,UAAU,CAAC,MAAO,EAAE,EAAC;CAC5D;CAKD,iBAAiB,OAAOD,aAA0BC,WAAkC;AAClF,QAAM,YAAY,kBAAkB,EAAE,UAAU,CAAC,QAAQ,MAAO,EAAE,EAAC;CACpE;CAKD,kBAAkB,OAChBD,aACAC,QACAF,OACkB;AAClB,QAAM,YAAY,kBAAkB,EAAE,UAAU;GAAC;GAAQ;GAAU;EAAG,EAAE,EAAC;CAC1E;CAKD,sBAAsB,OAAOC,aAA0BE,aAAgD;AACrG,QAAM,YAAY,kBAAkB,EAAE,SAAU,EAAC;AACjD,QAAM,YAAY,eAAe,EAAE,SAAU,EAAC;CAC/C;AACF"}

package/dist/redis-session-storage.server-BR_0y-QO.js

@@ -1,250 +0,0 @@
-import { logger } from "./logging-_h2mi3L9.js";
-import Redis from "ioredis";
-import { createHmac, timingSafeEqual } from "node:crypto";
-
-//#region src/auth/redis-session-storage.server.ts
-let redis = null;
-function getRedis() {
-	if (!redis) {
-		redis = new Redis(process.env.REDIS_URL || "redis://localhost:6379");
-		redis.on("error", (err) => {
-			logger.error("Redis Client Error", err);
-		});
-		redis.on("connect", () => {
-			logger.info("Redis connected successfully");
-		});
-	}
-	return redis;
-}
-const KEY_PREFIX = process.env.REDIS_KEY_PREFIX || "";
-const REDIS_KEYS = {
-	oauthState: (stateId) => `${KEY_PREFIX}oauth:state:${stateId}`,
-	session: (sessionId) => `${KEY_PREFIX}session:${sessionId}`
-};
-const OAUTH_STATE_TTL = 10 * 60;
-const SESSION_TTL = 60 * 60 * 24 * 7;
-const SESSION_COOKIE_NAME = process.env.SESSION_COOKIE_NAME || "__session_id";
-const SESSION_SECRET = process.env.SESSION_SECRET || "default-secret-change-in-production";
-const SESSION_COOKIE_SECURE = process.env.NODE_ENV === "production";
-const SESSION_COOKIE_PATH = "/";
-const SESSION_COOKIE_SAME_SITE = "Lax";
-const AUTH_ERROR_COOKIE_PREFIX = SESSION_COOKIE_NAME.replace("_session", "").replace("__", "");
-function parseCookieHeader(cookieHeader) {
-	if (!cookieHeader) return {};
-	return cookieHeader.split(";").map((part) => part.trim()).filter(Boolean).reduce((cookies, part) => {
-		const separatorIndex = part.indexOf("=");
-		if (separatorIndex <= 0) return cookies;
-		const name = part.slice(0, separatorIndex).trim();
-		const value = part.slice(separatorIndex + 1).trim();
-		if (!name) return cookies;
-		cookies[name] = value;
-		return cookies;
-	}, {});
-}
-function createCookieSignature(value, secret) {
-	return createHmac("sha256", secret).update(value).digest("base64url");
-}
-function safelyCompareValues(left, right) {
-	const leftBuffer = Buffer.from(left);
-	const rightBuffer = Buffer.from(right);
-	if (leftBuffer.length !== rightBuffer.length) return false;
-	return timingSafeEqual(leftBuffer, rightBuffer);
-}
-function signSessionId(sessionId) {
-	const signature = createCookieSignature(sessionId, SESSION_SECRET);
-	return `${sessionId}.${signature}`;
-}
-function unsignSessionId(cookieValue) {
-	if (!cookieValue) return null;
-	let decodedValue;
-	try {
-		decodedValue = decodeURIComponent(cookieValue);
-	} catch {
-		return null;
-	}
-	const separatorIndex = decodedValue.lastIndexOf(".");
-	if (separatorIndex <= 0 || separatorIndex === decodedValue.length - 1) return null;
-	const sessionId = decodedValue.slice(0, separatorIndex);
-	const signature = decodedValue.slice(separatorIndex + 1);
-	const expectedSignature = createCookieSignature(sessionId, SESSION_SECRET);
-	return safelyCompareValues(signature, expectedSignature) ? sessionId : null;
-}
-function serializeSessionCookieValue(sessionId, options) {
-	const signedValue = encodeURIComponent(signSessionId(sessionId));
-	const segments = [
-		`${SESSION_COOKIE_NAME}=${signedValue}`,
-		`Max-Age=${options.maxAge}`,
-		`Path=${SESSION_COOKIE_PATH}`,
-		`SameSite=${SESSION_COOKIE_SAME_SITE}`,
-		"HttpOnly"
-	];
-	if (SESSION_COOKIE_SECURE) segments.push("Secure");
-	return segments.join("; ");
-}
-function serializeExpiredSessionCookie() {
-	const segments = [
-		`${SESSION_COOKIE_NAME}=`,
-		"Max-Age=0",
-		`Path=${SESSION_COOKIE_PATH}`,
-		`SameSite=${SESSION_COOKIE_SAME_SITE}`,
-		"HttpOnly"
-	];
-	if (SESSION_COOKIE_SECURE) segments.push("Secure");
-	return segments.join("; ");
-}
-async function getSessionIdFromRequest(request) {
-	const cookies = parseCookieHeader(request.headers.get("Cookie"));
-	return unsignSessionId(cookies[SESSION_COOKIE_NAME]);
-}
-async function readSessionData(sessionId) {
-	try {
-		const sessionData = await getRedis().get(REDIS_KEYS.session(sessionId));
-		if (!sessionData) {
-			logger.debug("Session not found in Redis", { sessionId });
-			return null;
-		}
-		await getRedis().expire(REDIS_KEYS.session(sessionId), SESSION_TTL);
-		return JSON.parse(sessionData);
-	} catch (error) {
-		logger.error("Failed to read session from Redis", error instanceof Error ? error : void 0);
-		return null;
-	}
-}
-async function writeSessionData(sessionId, data) {
-	try {
-		const sessionData = JSON.stringify(data);
-		await getRedis().setex(REDIS_KEYS.session(sessionId), SESSION_TTL, sessionData);
-		logger.debug("Updated Redis session", { sessionId });
-	} catch (error) {
-		logger.error("Failed to update session in Redis", error instanceof Error ? error : void 0);
-		throw error;
-	}
-}
-async function deleteSessionData(sessionId) {
-	try {
-		await getRedis().del(REDIS_KEYS.session(sessionId));
-		logger.debug("Deleted Redis session", { sessionId });
-	} catch (error) {
-		logger.error("Failed to delete session from Redis", error instanceof Error ? error : void 0);
-	}
-}
-function mergeSessionData(existingData, updates) {
-	const nextData = { ...existingData };
-	Object.entries(updates).forEach(([key, value]) => {
-		if (value === void 0) {
-			delete nextData[key];
-			return;
-		}
-		nextData[key] = value;
-	});
-	return nextData;
-}
-async function createAuthSession(request, sessionData) {
-	const currentSessionId = await getSessionIdFromRequest(request);
-	const currentSessionData = currentSessionId ? await readSessionData(currentSessionId) ?? {} : {};
-	const nextSessionId = currentSessionId ?? crypto.randomUUID();
-	const nextSessionData = mergeSessionData(currentSessionData, sessionData);
-	logger.debug("Creating auth session", { dataKeys: Object.keys(sessionData) });
-	await writeSessionData(nextSessionId, nextSessionData);
-	return new Headers({ "Set-Cookie": serializeSessionCookieValue(nextSessionId, { maxAge: SESSION_TTL }) });
-}
-async function getAuthSession(request) {
-	const sessionId = await getSessionIdFromRequest(request);
-	if (!sessionId) return {};
-	const session = await readSessionData(sessionId);
-	if (!session) return {};
-	return {
-		userId: session.userId,
-		accessToken: session.accessToken,
-		refreshToken: session.refreshToken,
-		idToken: session.idToken,
-		expiresAt: session.expiresAt,
-		user: session.user,
-		lastActivity: session.lastActivity
-	};
-}
-async function updateAuthSession(request, updates) {
-	const currentSessionId = await getSessionIdFromRequest(request);
-	const currentSessionData = currentSessionId ? await readSessionData(currentSessionId) ?? {} : {};
-	const nextSessionId = currentSessionId ?? crypto.randomUUID();
-	const nextSessionData = mergeSessionData(currentSessionData, updates);
-	await writeSessionData(nextSessionId, nextSessionData);
-	return new Headers({ "Set-Cookie": serializeSessionCookieValue(nextSessionId, { maxAge: SESSION_TTL }) });
-}
-async function destroyAuthSession(request) {
-	const sessionId = await getSessionIdFromRequest(request);
-	if (sessionId) await deleteSessionData(sessionId);
-	return new Headers({ "Set-Cookie": serializeExpiredSessionCookie() });
-}
-async function requireAuthSession(request) {
-	const sessionData = await getAuthSession(request);
-	if (!sessionData.userId || !sessionData.accessToken) throw new Response("Unauthorized", { status: 401 });
-	return sessionData;
-}
-async function isSessionValid(request) {
-	try {
-		const sessionData = await getAuthSession(request);
-		if (!sessionData.user || !sessionData.accessToken) return false;
-		if (sessionData.expiresAt && Date.now() >= sessionData.expiresAt) return false;
-		return true;
-	} catch {
-		return false;
-	}
-}
-async function createOAuthState(state) {
-	const stateId = crypto.randomUUID();
-	const key = REDIS_KEYS.oauthState(stateId);
-	await getRedis().setex(key, OAUTH_STATE_TTL, JSON.stringify(state));
-	logger.debug("OAuth state created", {
-		stateId,
-		ttl: OAUTH_STATE_TTL
-	});
-	return stateId;
-}
-async function getOAuthState(stateId) {
-	const key = REDIS_KEYS.oauthState(stateId);
-	const data = await getRedis().get(key);
-	if (!data) {
-		logger.warn("OAuth state not found or expired", { stateId });
-		return null;
-	}
-	try {
-		return JSON.parse(data);
-	} catch (error) {
-		logger.error("Failed to parse OAuth state", error instanceof Error ? error : void 0);
-		return null;
-	}
-}
-async function deleteOAuthState(stateId) {
-	const key = REDIS_KEYS.oauthState(stateId);
-	await getRedis().del(key);
-	logger.debug("OAuth state deleted", { stateId });
-}
-async function cleanupExpiredOAuthStates() {
-	const pattern = REDIS_KEYS.oauthState("*");
-	const keys = await getRedis().keys(pattern);
-	let cleaned = 0;
-	for (const key of keys) {
-		const ttl = await getRedis().ttl(key);
-		if (ttl === -1) {
-			await getRedis().del(key);
-			cleaned++;
-		}
-	}
-	logger.info("OAuth state cleanup completed", {
-		cleaned,
-		total: keys.length
-	});
-	return cleaned;
-}
-async function closeRedisConnection() {
-	if (redis) {
-		await redis.quit();
-		redis = null;
-		logger.info("Redis connection closed");
-	}
-}
-
-//#endregion
-export { AUTH_ERROR_COOKIE_PREFIX, cleanupExpiredOAuthStates, closeRedisConnection, createAuthSession, createOAuthState, deleteOAuthState, destroyAuthSession, getAuthSession, getOAuthState, isSessionValid, requireAuthSession, updateAuthSession };
-//# sourceMappingURL=redis-session-storage.server-BR_0y-QO.js.map

package/dist/redis-session-storage.server-BR_0y-QO.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"redis-session-storage.server-BR_0y-QO.js","names":["redis: Redis | null","stateId: string","sessionId: string","cookieHeader: string | null","value: string","secret: string","left: string","right: string","cookieValue: string | undefined","decodedValue: string","options: SessionCookieOptions","request: Request","data: SessionData","existingData: SessionData","updates: Partial<SessionData>","sessionData: Partial<SessionData>","state: OAuthState"],"sources":["../src/auth/redis-session-storage.server.ts"],"sourcesContent":["/**\n * Redis Session Storage Server Module\n *\n * Redis-backed session storage for authentication.\n * Provides secure session management with automatic expiration,\n * without depending on a framework-specific session implementation.\n */\n\nimport Redis from 'ioredis';\nimport { createHmac, timingSafeEqual } from 'node:crypto';\nimport type { SessionData, OAuthState } from './types';\nimport { logger } from '../logging';\n\n// ============================================================================\n// Redis Client Setup\n// ============================================================================\n\nlet redis: Redis | null = null;\n\nfunction getRedis(): Redis {\n  if (!redis) {\n    redis = new Redis(process.env.REDIS_URL || 'redis://localhost:6379');\n\n    redis.on('error', (err) => {\n      logger.error('Redis Client Error', err);\n    });\n\n    redis.on('connect', () => {\n      logger.info('Redis connected successfully');\n    });\n  }\n  return redis;\n}\n\n// ============================================================================\n// Redis Key Patterns\n// ============================================================================\n\nconst KEY_PREFIX = process.env.REDIS_KEY_PREFIX || '';\n\nconst REDIS_KEYS = {\n  oauthState: (stateId: string) => `${KEY_PREFIX}oauth:state:${stateId}`,\n  session: (sessionId: string) => `${KEY_PREFIX}session:${sessionId}`,\n};\n\nconst OAUTH_STATE_TTL = 10 * 60;\nconst SESSION_TTL = 60 * 60 * 24 * 7;\n\nconst SESSION_COOKIE_NAME = process.env.SESSION_COOKIE_NAME || '__session_id';\nconst SESSION_SECRET = process.env.SESSION_SECRET || 'default-secret-change-in-production';\nconst SESSION_COOKIE_SECURE = process.env.NODE_ENV === 'production';\nconst SESSION_COOKIE_PATH = '/';\nconst SESSION_COOKIE_SAME_SITE = 'Lax';\n\nexport const AUTH_ERROR_COOKIE_PREFIX = SESSION_COOKIE_NAME.replace('_session', '').replace('__', '');\n\ntype SessionCookieOptions = {\n  maxAge: number;\n};\n\nfunction parseCookieHeader(cookieHeader: string | null): Record<string, string> {\n  if (!cookieHeader) {\n    return {};\n  }\n\n  return cookieHeader\n    .split(';')\n    .map((part) => part.trim())\n    .filter(Boolean)\n    .reduce<Record<string, string>>((cookies, part) => {\n      const separatorIndex = part.indexOf('=');\n      if (separatorIndex <= 0) {\n        return cookies;\n      }\n\n      const name = part.slice(0, separatorIndex).trim();\n      const value = part.slice(separatorIndex + 1).trim();\n      if (!name) {\n        return cookies;\n      }\n\n      cookies[name] = value;\n      return cookies;\n    }, {});\n}\n\nfunction createCookieSignature(value: string, secret: string): string {\n  return createHmac('sha256', secret).update(value).digest('base64url');\n}\n\nfunction safelyCompareValues(left: string, right: string): boolean {\n  const leftBuffer = Buffer.from(left);\n  const rightBuffer = Buffer.from(right);\n\n  if (leftBuffer.length !== rightBuffer.length) {\n    return false;\n  }\n\n  return timingSafeEqual(leftBuffer, rightBuffer);\n}\n\nfunction signSessionId(sessionId: string): string {\n  const signature = createCookieSignature(sessionId, SESSION_SECRET);\n  return `${sessionId}.${signature}`;\n}\n\nfunction unsignSessionId(cookieValue: string | undefined): string | null {\n  if (!cookieValue) {\n    return null;\n  }\n\n  let decodedValue: string;\n  try {\n    decodedValue = decodeURIComponent(cookieValue);\n  } catch {\n    return null;\n  }\n\n  const separatorIndex = decodedValue.lastIndexOf('.');\n  if (separatorIndex <= 0 || separatorIndex === decodedValue.length - 1) {\n    return null;\n  }\n\n  const sessionId = decodedValue.slice(0, separatorIndex);\n  const signature = decodedValue.slice(separatorIndex + 1);\n  const expectedSignature = createCookieSignature(sessionId, SESSION_SECRET);\n\n  return safelyCompareValues(signature, expectedSignature) ? sessionId : null;\n}\n\nfunction serializeSessionCookieValue(sessionId: string, options: SessionCookieOptions): string {\n  const signedValue = encodeURIComponent(signSessionId(sessionId));\n  const segments = [\n    `${SESSION_COOKIE_NAME}=${signedValue}`,\n    `Max-Age=${options.maxAge}`,\n    `Path=${SESSION_COOKIE_PATH}`,\n    `SameSite=${SESSION_COOKIE_SAME_SITE}`,\n    'HttpOnly',\n  ];\n\n  if (SESSION_COOKIE_SECURE) {\n    segments.push('Secure');\n  }\n\n  return segments.join('; ');\n}\n\nfunction serializeExpiredSessionCookie(): string {\n  const segments = [\n    `${SESSION_COOKIE_NAME}=`,\n    'Max-Age=0',\n    `Path=${SESSION_COOKIE_PATH}`,\n    `SameSite=${SESSION_COOKIE_SAME_SITE}`,\n    'HttpOnly',\n  ];\n\n  if (SESSION_COOKIE_SECURE) {\n    segments.push('Secure');\n  }\n\n  return segments.join('; ');\n}\n\nasync function getSessionIdFromRequest(request: Request): Promise<string | null> {\n  const cookies = parseCookieHeader(request.headers.get('Cookie'));\n  return unsignSessionId(cookies[SESSION_COOKIE_NAME]);\n}\n\nasync function readSessionData(sessionId: string): Promise<SessionData | null> {\n  try {\n    const sessionData = await getRedis().get(REDIS_KEYS.session(sessionId));\n    if (!sessionData) {\n      logger.debug('Session not found in Redis', { sessionId });\n      return null;\n    }\n\n    await getRedis().expire(REDIS_KEYS.session(sessionId), SESSION_TTL);\n    return JSON.parse(sessionData) as SessionData;\n  } catch (error) {\n    logger.error('Failed to read session from Redis', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\nasync function writeSessionData(sessionId: string, data: SessionData): Promise<void> {\n  try {\n    const sessionData = JSON.stringify(data);\n    await getRedis().setex(REDIS_KEYS.session(sessionId), SESSION_TTL, sessionData);\n    logger.debug('Updated Redis session', { sessionId });\n  } catch (error) {\n    logger.error('Failed to update session in Redis', error instanceof Error ? error : undefined);\n    throw error;\n  }\n}\n\nasync function deleteSessionData(sessionId: string): Promise<void> {\n  try {\n    await getRedis().del(REDIS_KEYS.session(sessionId));\n    logger.debug('Deleted Redis session', { sessionId });\n  } catch (error) {\n    logger.error('Failed to delete session from Redis', error instanceof Error ? error : undefined);\n  }\n}\n\nfunction mergeSessionData(existingData: SessionData, updates: Partial<SessionData>): SessionData {\n  const nextData = { ...existingData } as Record<string, unknown>;\n\n  Object.entries(updates).forEach(([key, value]) => {\n    if (value === undefined) {\n      delete nextData[key];\n      return;\n    }\n\n    nextData[key] = value;\n  });\n\n  return nextData as SessionData;\n}\n\n// ============================================================================\n// Session Helper Functions\n// ============================================================================\n\nexport async function createAuthSession(\n  request: Request,\n  sessionData: Partial<SessionData>\n): Promise<Headers> {\n  const currentSessionId = await getSessionIdFromRequest(request);\n  const currentSessionData = currentSessionId\n    ? (await readSessionData(currentSessionId)) ?? {}\n    : {};\n  const nextSessionId = currentSessionId ?? crypto.randomUUID();\n  const nextSessionData = mergeSessionData(currentSessionData, sessionData);\n\n  logger.debug('Creating auth session', { dataKeys: Object.keys(sessionData) });\n\n  await writeSessionData(nextSessionId, nextSessionData);\n\n  return new Headers({\n    'Set-Cookie': serializeSessionCookieValue(nextSessionId, { maxAge: SESSION_TTL }),\n  });\n}\n\nexport async function getAuthSession(request: Request): Promise<SessionData> {\n  const sessionId = await getSessionIdFromRequest(request);\n  if (!sessionId) {\n    return {};\n  }\n\n  const session = await readSessionData(sessionId);\n  if (!session) {\n    return {};\n  }\n\n  return {\n    userId: session.userId,\n    accessToken: session.accessToken,\n    refreshToken: session.refreshToken,\n    idToken: session.idToken,\n    expiresAt: session.expiresAt,\n    user: session.user,\n    lastActivity: session.lastActivity,\n  };\n}\n\nexport async function updateAuthSession(\n  request: Request,\n  updates: Partial<SessionData>\n): Promise<Headers> {\n  const currentSessionId = await getSessionIdFromRequest(request);\n  const currentSessionData = currentSessionId\n    ? (await readSessionData(currentSessionId)) ?? {}\n    : {};\n  const nextSessionId = currentSessionId ?? crypto.randomUUID();\n  const nextSessionData = mergeSessionData(currentSessionData, updates);\n\n  await writeSessionData(nextSessionId, nextSessionData);\n\n  return new Headers({\n    'Set-Cookie': serializeSessionCookieValue(nextSessionId, { maxAge: SESSION_TTL }),\n  });\n}\n\nexport async function destroyAuthSession(request: Request): Promise<Headers> {\n  const sessionId = await getSessionIdFromRequest(request);\n  if (sessionId) {\n    await deleteSessionData(sessionId);\n  }\n\n  return new Headers({\n    'Set-Cookie': serializeExpiredSessionCookie(),\n  });\n}\n\nexport async function requireAuthSession(request: Request): Promise<SessionData> {\n  const sessionData = await getAuthSession(request);\n\n  if (!sessionData.userId || !sessionData.accessToken) {\n    throw new Response('Unauthorized', { status: 401 });\n  }\n\n  return sessionData;\n}\n\nexport async function isSessionValid(request: Request): Promise<boolean> {\n  try {\n    const sessionData = await getAuthSession(request);\n\n    if (!sessionData.user || !sessionData.accessToken) {\n      return false;\n    }\n\n    if (sessionData.expiresAt && Date.now() >= sessionData.expiresAt) {\n      return false;\n    }\n\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n// ============================================================================\n// OAuth State Management\n// ============================================================================\n\nexport async function createOAuthState(state: OAuthState): Promise<string> {\n  const stateId = crypto.randomUUID();\n  const key = REDIS_KEYS.oauthState(stateId);\n\n  await getRedis().setex(key, OAUTH_STATE_TTL, JSON.stringify(state));\n\n  logger.debug('OAuth state created', { stateId, ttl: OAUTH_STATE_TTL });\n\n  return stateId;\n}\n\nexport async function getOAuthState(stateId: string): Promise<OAuthState | null> {\n  const key = REDIS_KEYS.oauthState(stateId);\n  const data = await getRedis().get(key);\n\n  if (!data) {\n    logger.warn('OAuth state not found or expired', { stateId });\n    return null;\n  }\n\n  try {\n    return JSON.parse(data);\n  } catch (error) {\n    logger.error('Failed to parse OAuth state', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\nexport async function deleteOAuthState(stateId: string): Promise<void> {\n  const key = REDIS_KEYS.oauthState(stateId);\n  await getRedis().del(key);\n  logger.debug('OAuth state deleted', { stateId });\n}\n\nexport async function cleanupExpiredOAuthStates(): Promise<number> {\n  const pattern = REDIS_KEYS.oauthState('*');\n  const keys = await getRedis().keys(pattern);\n\n  let cleaned = 0;\n  for (const key of keys) {\n    const ttl = await getRedis().ttl(key);\n    if (ttl === -1) {\n      await getRedis().del(key);\n      cleaned++;\n    }\n  }\n\n  logger.info('OAuth state cleanup completed', { cleaned, total: keys.length });\n  return cleaned;\n}\n\n// ============================================================================\n// Cleanup\n// ============================================================================\n\nexport async function closeRedisConnection(): Promise<void> {\n  if (redis) {\n    await redis.quit();\n    redis = null;\n    logger.info('Redis connection closed');\n  }\n}\n"],"mappings":";;;;;AAiBA,IAAIA,QAAsB;AAE1B,SAAS,WAAkB;AACzB,MAAK,OAAO;AACV,UAAQ,IAAI,MAAM,QAAQ,IAAI,aAAa;AAE3C,QAAM,GAAG,SAAS,CAAC,QAAQ;AACzB,UAAO,MAAM,sBAAsB,IAAI;EACxC,EAAC;AAEF,QAAM,GAAG,WAAW,MAAM;AACxB,UAAO,KAAK,+BAA+B;EAC5C,EAAC;CACH;AACD,QAAO;AACR;AAMD,MAAM,aAAa,QAAQ,IAAI,oBAAoB;AAEnD,MAAM,aAAa;CACjB,YAAY,CAACC,aAAqB,EAAE,WAAW,cAAc,QAAQ;CACrE,SAAS,CAACC,eAAuB,EAAE,WAAW,UAAU,UAAU;AACnE;AAED,MAAM,kBAAkB,KAAK;AAC7B,MAAM,cAAc,KAAK,KAAK,KAAK;AAEnC,MAAM,sBAAsB,QAAQ,IAAI,uBAAuB;AAC/D,MAAM,iBAAiB,QAAQ,IAAI,kBAAkB;AACrD,MAAM,wBAAwB,QAAQ,IAAI,aAAa;AACvD,MAAM,sBAAsB;AAC5B,MAAM,2BAA2B;AAEjC,MAAa,2BAA2B,oBAAoB,QAAQ,YAAY,GAAG,CAAC,QAAQ,MAAM,GAAG;AAMrG,SAAS,kBAAkBC,cAAqD;AAC9E,MAAK,aACH,QAAO,CAAE;AAGX,QAAO,aACJ,MAAM,IAAI,CACV,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAC1B,OAAO,QAAQ,CACf,OAA+B,CAAC,SAAS,SAAS;EACjD,MAAM,iBAAiB,KAAK,QAAQ,IAAI;AACxC,MAAI,kBAAkB,EACpB,QAAO;EAGT,MAAM,OAAO,KAAK,MAAM,GAAG,eAAe,CAAC,MAAM;EACjD,MAAM,QAAQ,KAAK,MAAM,iBAAiB,EAAE,CAAC,MAAM;AACnD,OAAK,KACH,QAAO;AAGT,UAAQ,QAAQ;AAChB,SAAO;CACR,GAAE,CAAE,EAAC;AACT;AAED,SAAS,sBAAsBC,OAAeC,QAAwB;AACpE,QAAO,WAAW,UAAU,OAAO,CAAC,OAAO,MAAM,CAAC,OAAO,YAAY;AACtE;AAED,SAAS,oBAAoBC,MAAcC,OAAwB;CACjE,MAAM,aAAa,OAAO,KAAK,KAAK;CACpC,MAAM,cAAc,OAAO,KAAK,MAAM;AAEtC,KAAI,WAAW,WAAW,YAAY,OACpC,QAAO;AAGT,QAAO,gBAAgB,YAAY,YAAY;AAChD;AAED,SAAS,cAAcL,WAA2B;CAChD,MAAM,YAAY,sBAAsB,WAAW,eAAe;AAClE,SAAQ,EAAE,UAAU,GAAG,UAAU;AAClC;AAED,SAAS,gBAAgBM,aAAgD;AACvE,MAAK,YACH,QAAO;CAGT,IAAIC;AACJ,KAAI;AACF,iBAAe,mBAAmB,YAAY;CAC/C,QAAO;AACN,SAAO;CACR;CAED,MAAM,iBAAiB,aAAa,YAAY,IAAI;AACpD,KAAI,kBAAkB,KAAK,mBAAmB,aAAa,SAAS,EAClE,QAAO;CAGT,MAAM,YAAY,aAAa,MAAM,GAAG,eAAe;CACvD,MAAM,YAAY,aAAa,MAAM,iBAAiB,EAAE;CACxD,MAAM,oBAAoB,sBAAsB,WAAW,eAAe;AAE1E,QAAO,oBAAoB,WAAW,kBAAkB,GAAG,YAAY;AACxE;AAED,SAAS,4BAA4BP,WAAmBQ,SAAuC;CAC7F,MAAM,cAAc,mBAAmB,cAAc,UAAU,CAAC;CAChE,MAAM,WAAW;GACd,EAAE,oBAAoB,GAAG,YAAY;GACrC,UAAU,QAAQ,OAAO;GACzB,OAAO,oBAAoB;GAC3B,WAAW,yBAAyB;EACrC;CACD;AAED,KAAI,sBACF,UAAS,KAAK,SAAS;AAGzB,QAAO,SAAS,KAAK,KAAK;AAC3B;AAED,SAAS,gCAAwC;CAC/C,MAAM,WAAW;GACd,EAAE,oBAAoB;EACvB;GACC,OAAO,oBAAoB;GAC3B,WAAW,yBAAyB;EACrC;CACD;AAED,KAAI,sBACF,UAAS,KAAK,SAAS;AAGzB,QAAO,SAAS,KAAK,KAAK;AAC3B;AAED,eAAe,wBAAwBC,SAA0C;CAC/E,MAAM,UAAU,kBAAkB,QAAQ,QAAQ,IAAI,SAAS,CAAC;AAChE,QAAO,gBAAgB,QAAQ,qBAAqB;AACrD;AAED,eAAe,gBAAgBT,WAAgD;AAC7E,KAAI;EACF,MAAM,cAAc,MAAM,UAAU,CAAC,IAAI,WAAW,QAAQ,UAAU,CAAC;AACvE,OAAK,aAAa;AAChB,UAAO,MAAM,8BAA8B,EAAE,UAAW,EAAC;AACzD,UAAO;EACR;AAED,QAAM,UAAU,CAAC,OAAO,WAAW,QAAQ,UAAU,EAAE,YAAY;AACnE,SAAO,KAAK,MAAM,YAAY;CAC/B,SAAQ,OAAO;AACd,SAAO,MAAM,qCAAqC,iBAAiB,QAAQ,eAAkB;AAC7F,SAAO;CACR;AACF;AAED,eAAe,iBAAiBA,WAAmBU,MAAkC;AACnF,KAAI;EACF,MAAM,cAAc,KAAK,UAAU,KAAK;AACxC,QAAM,UAAU,CAAC,MAAM,WAAW,QAAQ,UAAU,EAAE,aAAa,YAAY;AAC/E,SAAO,MAAM,yBAAyB,EAAE,UAAW,EAAC;CACrD,SAAQ,OAAO;AACd,SAAO,MAAM,qCAAqC,iBAAiB,QAAQ,eAAkB;AAC7F,QAAM;CACP;AACF;AAED,eAAe,kBAAkBV,WAAkC;AACjE,KAAI;AACF,QAAM,UAAU,CAAC,IAAI,WAAW,QAAQ,UAAU,CAAC;AACnD,SAAO,MAAM,yBAAyB,EAAE,UAAW,EAAC;CACrD,SAAQ,OAAO;AACd,SAAO,MAAM,uCAAuC,iBAAiB,QAAQ,eAAkB;CAChG;AACF;AAED,SAAS,iBAAiBW,cAA2BC,SAA4C;CAC/F,MAAM,WAAW,EAAE,GAAG,aAAc;AAEpC,QAAO,QAAQ,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,MAAM,KAAK;AAChD,MAAI,kBAAqB;AACvB,UAAO,SAAS;AAChB;EACD;AAED,WAAS,OAAO;CACjB,EAAC;AAEF,QAAO;AACR;AAMD,eAAsB,kBACpBH,SACAI,aACkB;CAClB,MAAM,mBAAmB,MAAM,wBAAwB,QAAQ;CAC/D,MAAM,qBAAqB,mBACtB,MAAM,gBAAgB,iBAAiB,IAAK,CAAE,IAC/C,CAAE;CACN,MAAM,gBAAgB,oBAAoB,OAAO,YAAY;CAC7D,MAAM,kBAAkB,iBAAiB,oBAAoB,YAAY;AAEzE,QAAO,MAAM,yBAAyB,EAAE,UAAU,OAAO,KAAK,YAAY,CAAE,EAAC;AAE7E,OAAM,iBAAiB,eAAe,gBAAgB;AAEtD,QAAO,IAAI,QAAQ,EACjB,cAAc,4BAA4B,eAAe,EAAE,QAAQ,YAAa,EAAC,CAClF;AACF;AAED,eAAsB,eAAeJ,SAAwC;CAC3E,MAAM,YAAY,MAAM,wBAAwB,QAAQ;AACxD,MAAK,UACH,QAAO,CAAE;CAGX,MAAM,UAAU,MAAM,gBAAgB,UAAU;AAChD,MAAK,QACH,QAAO,CAAE;AAGX,QAAO;EACL,QAAQ,QAAQ;EAChB,aAAa,QAAQ;EACrB,cAAc,QAAQ;EACtB,SAAS,QAAQ;EACjB,WAAW,QAAQ;EACnB,MAAM,QAAQ;EACd,cAAc,QAAQ;CACvB;AACF;AAED,eAAsB,kBACpBA,SACAG,SACkB;CAClB,MAAM,mBAAmB,MAAM,wBAAwB,QAAQ;CAC/D,MAAM,qBAAqB,mBACtB,MAAM,gBAAgB,iBAAiB,IAAK,CAAE,IAC/C,CAAE;CACN,MAAM,gBAAgB,oBAAoB,OAAO,YAAY;CAC7D,MAAM,kBAAkB,iBAAiB,oBAAoB,QAAQ;AAErE,OAAM,iBAAiB,eAAe,gBAAgB;AAEtD,QAAO,IAAI,QAAQ,EACjB,cAAc,4BAA4B,eAAe,EAAE,QAAQ,YAAa,EAAC,CAClF;AACF;AAED,eAAsB,mBAAmBH,SAAoC;CAC3E,MAAM,YAAY,MAAM,wBAAwB,QAAQ;AACxD,KAAI,UACF,OAAM,kBAAkB,UAAU;AAGpC,QAAO,IAAI,QAAQ,EACjB,cAAc,+BAA+B,CAC9C;AACF;AAED,eAAsB,mBAAmBA,SAAwC;CAC/E,MAAM,cAAc,MAAM,eAAe,QAAQ;AAEjD,MAAK,YAAY,WAAW,YAAY,YACtC,OAAM,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAK;AAGpD,QAAO;AACR;AAED,eAAsB,eAAeA,SAAoC;AACvE,KAAI;EACF,MAAM,cAAc,MAAM,eAAe,QAAQ;AAEjD,OAAK,YAAY,SAAS,YAAY,YACpC,QAAO;AAGT,MAAI,YAAY,aAAa,KAAK,KAAK,IAAI,YAAY,UACrD,QAAO;AAGT,SAAO;CACR,QAAO;AACN,SAAO;CACR;AACF;AAMD,eAAsB,iBAAiBK,OAAoC;CACzE,MAAM,UAAU,OAAO,YAAY;CACnC,MAAM,MAAM,WAAW,WAAW,QAAQ;AAE1C,OAAM,UAAU,CAAC,MAAM,KAAK,iBAAiB,KAAK,UAAU,MAAM,CAAC;AAEnE,QAAO,MAAM,uBAAuB;EAAE;EAAS,KAAK;CAAiB,EAAC;AAEtE,QAAO;AACR;AAED,eAAsB,cAAcf,SAA6C;CAC/E,MAAM,MAAM,WAAW,WAAW,QAAQ;CAC1C,MAAM,OAAO,MAAM,UAAU,CAAC,IAAI,IAAI;AAEtC,MAAK,MAAM;AACT,SAAO,KAAK,oCAAoC,EAAE,QAAS,EAAC;AAC5D,SAAO;CACR;AAED,KAAI;AACF,SAAO,KAAK,MAAM,KAAK;CACxB,SAAQ,OAAO;AACd,SAAO,MAAM,+BAA+B,iBAAiB,QAAQ,eAAkB;AACvF,SAAO;CACR;AACF;AAED,eAAsB,iBAAiBA,SAAgC;CACrE,MAAM,MAAM,WAAW,WAAW,QAAQ;AAC1C,OAAM,UAAU,CAAC,IAAI,IAAI;AACzB,QAAO,MAAM,uBAAuB,EAAE,QAAS,EAAC;AACjD;AAED,eAAsB,4BAA6C;CACjE,MAAM,UAAU,WAAW,WAAW,IAAI;CAC1C,MAAM,OAAO,MAAM,UAAU,CAAC,KAAK,QAAQ;CAE3C,IAAI,UAAU;AACd,MAAK,MAAM,OAAO,MAAM;EACtB,MAAM,MAAM,MAAM,UAAU,CAAC,IAAI,IAAI;AACrC,MAAI,QAAQ,IAAI;AACd,SAAM,UAAU,CAAC,IAAI,IAAI;AACzB;EACD;CACF;AAED,QAAO,KAAK,iCAAiC;EAAE;EAAS,OAAO,KAAK;CAAQ,EAAC;AAC7E,QAAO;AACR;AAMD,eAAsB,uBAAsC;AAC1D,KAAI,OAAO;AACT,QAAM,MAAM,MAAM;AAClB,UAAQ;AACR,SAAO,KAAK,0BAA0B;CACvC;AACF"}

package/dist/server-BHfKHKF_.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"server-BHfKHKF_.js","names":["request: Request","jwtExpiry: number | null","protectionConfig: RouteProtectionConfig<any>","config: RouteProtectionConfig<TIdentityContext>","redirect: RouteProtectionRedirect","currentPath: string","protection: ProtectionLevel","reason: AutomaticLogoutRequestContext['reason']","user: UserInfo","identityContextPromise: Promise<any | null> | null","currentTenantPromise: Promise<string | null> | null","initializeTenantPromise: Promise<{ headers: Headers; tenantId: string } | null> | null","loaderFn: (user?: UserInfo) => Promise<T> | T","loaderFn: (user: UserInfo) => Promise<T> | T","request: Request","response: Response","hasAuth: boolean"],"sources":["../src/auth/route-protection.server.ts","../src/auth/token-refresh.server.ts"],"sourcesContent":["/**\n * Route Protection Server Module\n * \n * Provides route protection utilities for different authentication levels.\n */\n\nimport { getUser, requireAuth, refreshTokens, login } from './auth.server';\nimport { getAuthSession } from './redis-session-storage.server';\nimport type { ProtectionLevel, UserInfo } from './types';\nimport { logger } from '../logging';\nimport { createRedirectResponse } from '../http/response';\n\n// Token refresh threshold (5 minutes before expiry)\nconst REFRESH_THRESHOLD = 5 * 60 * 1000;\n\n/**\n * Check if token needs refresh\n */\nexport async function shouldRefreshToken(request: Request): Promise<boolean> {\n  try {\n    const sessionData = await getAuthSession(request);\n\n    if (!sessionData.refreshToken || sessionData.refreshToken.length === 0) {\n      if (sessionData.expiresAt && Date.now() >= sessionData.expiresAt) {\n        logger.info('Token expired and no refresh token, forcing app-specific logout');\n        const { logout } = await import('./auth.server');\n        const logoutRequest = await createAutomaticLogoutRequest(request, 'expired-no-refresh-token');\n        throw await logout(logoutRequest);\n      }\n      return false;\n    }\n\n    if (!sessionData.expiresAt || !sessionData.accessToken) {\n      return false;\n    }\n\n    const now = Date.now();\n\n    // Check JWT expiry\n    let jwtExpiry: number | null = null;\n    try {\n      const tokenParts = sessionData.accessToken.split('.');\n      if (tokenParts.length === 3) {\n        const payload = JSON.parse(Buffer.from(tokenParts[1], 'base64').toString());\n        if (payload.exp) {\n          jwtExpiry = payload.exp * 1000;\n        }\n      }\n    } catch {\n      // Ignore JWT decode errors\n    }\n\n    const earliestExpiry = jwtExpiry && jwtExpiry < sessionData.expiresAt \n      ? jwtExpiry \n      : sessionData.expiresAt;\n    const timeUntilEarliestExpiry = earliestExpiry - now;\n\n    return timeUntilEarliestExpiry <= REFRESH_THRESHOLD;\n  } catch (error) {\n    logger.error('Error checking token refresh', error instanceof Error ? error : undefined);\n    return false;\n  }\n}\n\n/**\n * Auto-refresh tokens if needed\n */\nasync function autoRefreshTokens(request: Request): Promise<void> {\n  try {\n    const needsRefresh = await shouldRefreshToken(request);\n\n    if (needsRefresh) {\n      logger.info('Auto-refreshing tokens due to expiry');\n      const result = await refreshTokens(request);\n\n      if (result.success) {\n        logger.info('Auto-refresh completed successfully');\n      } else {\n        logger.error('Auto-refresh failed', undefined, { error: result.error });\n\n        if (result.shouldLogout) {\n          logger.error('Refresh token invalid, forcing app-specific logout');\n          const { logout } = await import('./auth.server');\n          const logoutRequest = await createAutomaticLogoutRequest(request, 'refresh-failed');\n          throw await logout(logoutRequest);\n        }\n      }\n    }\n  } catch (error) {\n    if (error instanceof Response && error.status >= 300 && error.status < 400) {\n      throw error;\n    }\n    throw error;\n  }\n}\n\n/**\n * Identity context check configuration\n */\nexport interface DefaultRouteIdentityContext {\n  hasAnyMembership: boolean;\n  hasSubscription: boolean;\n  isOnboarded: boolean;\n}\n\nexport interface IdentityContextChecker<TIdentityContext = DefaultRouteIdentityContext> {\n  getIdentityContext: (\n    request: Request,\n    userId: string,\n    forceRefresh?: boolean\n  ) => Promise<DefaultRouteIdentityContext & TIdentityContext>;\n}\n\n/**\n * Tenant checker configuration\n */\nexport interface TenantChecker {\n  getCurrentTenant: (request: Request) => Promise<string | null>;\n  initializeTenant: (request: Request) => Promise<{ headers: Headers; tenantId: string } | null>;\n}\n\n/**\n * Subscription checker configuration\n */\nexport interface SubscriptionChecker {\n  checkTenantSubscriptionStatus: (request: Request, tenantId: string) => Promise<boolean>;\n}\n\nexport interface RouteProtectionRedirect {\n  location: string;\n  headers?: HeadersInit;\n  status?: number;\n}\n\nexport interface AutomaticLogoutRequestContext {\n  request: Request;\n  reason: 'expired-no-refresh-token' | 'refresh-failed';\n}\n\nexport interface LoginReturnUrlContext {\n  request: Request;\n  currentPath: string;\n  protection: ProtectionLevel;\n}\n\nexport interface RouteProtectionResolverContext<TIdentityContext = DefaultRouteIdentityContext> {\n  request: Request;\n  user: UserInfo;\n  currentPath: string;\n  protection: ProtectionLevel;\n  getIdentityContext: (forceRefresh?: boolean) => Promise<TIdentityContext | null>;\n  getCurrentTenant: () => Promise<string | null>;\n  initializeTenant: () => Promise<{ headers: Headers; tenantId: string } | null>;\n}\n\nexport interface RouteProtectionErrorHandlerContext<TIdentityContext = DefaultRouteIdentityContext>\n  extends RouteProtectionResolverContext<TIdentityContext> {\n  error: unknown;\n}\n\n/**\n * Route protection configuration\n */\nexport interface RouteProtectionConfig<TIdentityContext = DefaultRouteIdentityContext> {\n  identityChecker?: IdentityContextChecker<TIdentityContext>;\n  tenantChecker?: TenantChecker;\n  subscriptionChecker?: SubscriptionChecker;\n  resolveRoute?: (\n    context: RouteProtectionResolverContext<TIdentityContext>\n  ) => Promise<RouteProtectionRedirect | null | void> | RouteProtectionRedirect | null | void;\n  handleRouteError?: (\n    context: RouteProtectionErrorHandlerContext<TIdentityContext>\n  ) => Promise<RouteProtectionRedirect | null | void> | RouteProtectionRedirect | null | void;\n  getLoginReturnUrl?: (context: LoginReturnUrlContext) => string;\n  createAutomaticLogoutRequest?: (\n    context: AutomaticLogoutRequestContext\n  ) => Promise<Request> | Request;\n}\n\nlet protectionConfig: RouteProtectionConfig<any> = {};\n\n/**\n * Configure route protection with identity/tenant/subscription checkers\n */\nexport function configureRouteProtection<TIdentityContext = DefaultRouteIdentityContext>(\n  config: RouteProtectionConfig<TIdentityContext>\n): void {\n  protectionConfig = config;\n}\n\n/**\n * Reset route protection to its built-in defaults.\n */\nexport function resetRouteProtectionConfig(): void {\n  protectionConfig = {};\n}\n\nfunction createRedirectFromConfig(redirect: RouteProtectionRedirect): Response {\n  return createRedirectResponse(redirect.location, {\n    headers: redirect.headers,\n    status: redirect.status,\n  });\n}\n\nfunction getLoginReturnUrl(\n  request: Request,\n  currentPath: string,\n  protection: ProtectionLevel\n): string {\n  if (protectionConfig.getLoginReturnUrl) {\n    return protectionConfig.getLoginReturnUrl({\n      request,\n      currentPath,\n      protection,\n    });\n  }\n\n  switch (protection) {\n    case 'onboarding-required':\n      return '/onboarding';\n    case 'subscription-required':\n      return '/subscription';\n    case 'public':\n      return '/';\n    case 'auth':\n    default: {\n      const url = new URL(request.url);\n      return url.pathname === '/' ? '/' : `${url.pathname}${url.search}`;\n    }\n  }\n}\n\nasync function createAutomaticLogoutRequest(\n  request: Request,\n  reason: AutomaticLogoutRequestContext['reason']\n): Promise<Request> {\n  if (protectionConfig.createAutomaticLogoutRequest) {\n    return protectionConfig.createAutomaticLogoutRequest({ request, reason });\n  }\n\n  const logoutUrl = new URL(request.url);\n  logoutUrl.pathname = '/auth/logout';\n  logoutUrl.searchParams.set('client_id_only', 'true');\n\n  return new Request(logoutUrl.toString(), {\n    headers: request.headers,\n  });\n}\n\nfunction createRouteResolverContext(\n  request: Request,\n  user: UserInfo,\n  currentPath: string,\n  protection: ProtectionLevel\n): RouteProtectionResolverContext<any> {\n  let identityContextPromise: Promise<any | null> | null = null;\n  let currentTenantPromise: Promise<string | null> | null = null;\n  let initializeTenantPromise: Promise<{ headers: Headers; tenantId: string } | null> | null = null;\n\n  return {\n    request,\n    user,\n    currentPath,\n    protection,\n    getIdentityContext: async (forceRefresh = false) => {\n      if (!protectionConfig.identityChecker) {\n        return null;\n      }\n\n      if (forceRefresh) {\n        return protectionConfig.identityChecker.getIdentityContext(request, user.sub, true);\n      }\n\n      if (!identityContextPromise) {\n        identityContextPromise = protectionConfig.identityChecker.getIdentityContext(request, user.sub);\n      }\n\n      return identityContextPromise;\n    },\n    getCurrentTenant: async () => {\n      if (!protectionConfig.tenantChecker) {\n        return null;\n      }\n\n      if (!currentTenantPromise) {\n        currentTenantPromise = protectionConfig.tenantChecker.getCurrentTenant(request);\n      }\n\n      return currentTenantPromise;\n    },\n    initializeTenant: async () => {\n      if (!protectionConfig.tenantChecker) {\n        return null;\n      }\n\n      if (!initializeTenantPromise) {\n        initializeTenantPromise = protectionConfig.tenantChecker.initializeTenant(request);\n      }\n\n      return initializeTenantPromise;\n    },\n  };\n}\n\nasync function applyConfiguredRouteResolution(\n  request: Request,\n  user: UserInfo,\n  currentPath: string,\n  protection: ProtectionLevel\n): Promise<boolean> {\n  if (!protectionConfig.resolveRoute) {\n    return false;\n  }\n\n  const context = createRouteResolverContext(request, user, currentPath, protection);\n\n  try {\n    const result = await protectionConfig.resolveRoute(context);\n    if (result) {\n      throw createRedirectFromConfig(result);\n    }\n\n    return true;\n  } catch (error) {\n    if (error instanceof Response && error.status >= 300 && error.status < 400) {\n      throw error;\n    }\n\n    if (!protectionConfig.handleRouteError) {\n      throw error;\n    }\n\n    const recovery = await protectionConfig.handleRouteError({\n      ...context,\n      error,\n    });\n\n    if (recovery) {\n      throw createRedirectFromConfig(recovery);\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Check user status (onboarding, subscription)\n */\nasync function checkUserStatus(\n  request: Request, \n  user: UserInfo, \n  currentPath: string\n): Promise<Response | null> {\n  if (!protectionConfig.identityChecker) {\n    logger.warn('Identity checker not configured, skipping status check');\n    return null;\n  }\n\n  try {\n    const context = await protectionConfig.identityChecker.getIdentityContext(request, user.sub);\n\n    logger.debug('User status check', {\n      userId: user.sub,\n      currentPath,\n      hasAnyMembership: context.hasAnyMembership,\n      isOnboarded: context.isOnboarded,\n      hasSubscription: context.hasSubscription,\n    });\n\n    // Check if user needs onboarding\n    if (!context.hasAnyMembership) {\n      if (currentPath !== '/onboarding') {\n        logger.info('User has no memberships, redirecting to onboarding');\n        throw createRedirectResponse('/onboarding');\n      }\n      return null;\n    }\n\n    // Check subscription status\n    if (context.hasAnyMembership) {\n      if (currentPath === '/onboarding') {\n        logger.info('User has memberships, redirecting from onboarding to subscription');\n        throw createRedirectResponse('/subscription');\n      }\n\n      if (currentPath === '/subscription') {\n        return null;\n      }\n\n      // Check tenant subscription\n      if (protectionConfig.tenantChecker && protectionConfig.subscriptionChecker) {\n        let currentTenant = await protectionConfig.tenantChecker.getCurrentTenant(request);\n\n        if (!currentTenant) {\n          const initResult = await protectionConfig.tenantChecker.initializeTenant(request);\n          if (initResult) {\n            currentTenant = initResult.tenantId;\n          }\n        }\n\n        if (currentTenant) {\n          const hasSubscription = await protectionConfig.subscriptionChecker.checkTenantSubscriptionStatus(\n            request,\n            currentTenant\n          );\n\n          if (!hasSubscription) {\n            logger.info('Tenant has no subscription, redirecting to subscription');\n            throw createRedirectResponse('/subscription');\n          }\n        } else {\n          logger.info('Could not initialize tenant, redirecting to subscription');\n          throw createRedirectResponse('/subscription');\n        }\n      }\n    }\n\n    return null;\n  } catch (error) {\n    if (error instanceof Response && error.status >= 300 && error.status < 400) {\n      throw error;\n    }\n\n    logger.error('Error checking user status', error instanceof Error ? error : undefined);\n\n    if (currentPath !== '/onboarding') {\n      throw createRedirectResponse('/onboarding');\n    }\n\n    return null;\n  }\n}\n\n/**\n * Main route protection function\n */\nexport async function protectRoute<T>(\n  request: Request,\n  protection: ProtectionLevel,\n  loaderFn: (user?: UserInfo) => Promise<T> | T\n): Promise<T> {\n  const url = new URL(request.url);\n\n  switch (protection) {\n    case 'public':\n      try {\n        await autoRefreshTokens(request);\n        const user = await getUser(request);\n        return loaderFn(user ?? undefined);\n      } catch {\n        return loaderFn(undefined);\n      }\n\n    case 'auth':\n      try {\n        await autoRefreshTokens(request);\n        const user = await requireAuth(request);\n        const handledByConfig = await applyConfiguredRouteResolution(request, user, url.pathname, 'auth');\n        if (!handledByConfig) {\n          await checkUserStatus(request, user, url.pathname);\n        }\n        return loaderFn(user);\n      } catch (error) {\n        if (error instanceof Response && error.status >= 300 && error.status < 400) {\n          throw error;\n        }\n        throw await login(request, getLoginReturnUrl(request, url.pathname, 'auth'));\n      }\n\n    case 'onboarding-required':\n      try {\n        await autoRefreshTokens(request);\n        const user = await requireAuth(request);\n\n        const handledByConfig = await applyConfiguredRouteResolution(\n          request,\n          user,\n          url.pathname,\n          'onboarding-required'\n        );\n        if (!handledByConfig && protectionConfig.identityChecker) {\n          const context = await protectionConfig.identityChecker.getIdentityContext(request, user.sub);\n          if (context.hasAnyMembership) {\n            throw createRedirectResponse('/subscription');\n          }\n        }\n\n        return loaderFn(user);\n      } catch (error) {\n        if (error instanceof Response && error.status >= 300 && error.status < 400) {\n          throw error;\n        }\n        throw await login(request, getLoginReturnUrl(request, url.pathname, 'onboarding-required'));\n      }\n\n    case 'subscription-required':\n      try {\n        await autoRefreshTokens(request);\n        const user = await requireAuth(request);\n\n        const handledByConfig = await applyConfiguredRouteResolution(\n          request,\n          user,\n          url.pathname,\n          'subscription-required'\n        );\n        if (!handledByConfig && protectionConfig.identityChecker) {\n          const context = await protectionConfig.identityChecker.getIdentityContext(request, user.sub);\n          if (!context.hasAnyMembership) {\n            throw createRedirectResponse('/onboarding');\n          }\n        }\n\n        // Initialize tenant if needed\n        if (protectionConfig.tenantChecker) {\n          const currentTenant = await protectionConfig.tenantChecker.getCurrentTenant(request);\n          if (!currentTenant) {\n            await protectionConfig.tenantChecker.initializeTenant(request);\n          }\n        }\n\n        return loaderFn(user);\n      } catch (error) {\n        if (error instanceof Response && error.status >= 300 && error.status < 400) {\n          throw error;\n        }\n        throw await login(request, getLoginReturnUrl(request, url.pathname, 'subscription-required'));\n      }\n\n    default:\n      throw new Error(`Unknown protection level: ${protection}`);\n  }\n}\n\n// ============================================================================\n// Convenience Functions\n// ============================================================================\n\n/**\n * Public route (optional auth)\n */\nexport const publicRoute = <T>(\n  request: Request,\n  loaderFn: (user?: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'public', loaderFn);\n\n/**\n * Auth-protected route\n */\nexport const authRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'auth', loaderFn as (user?: UserInfo) => Promise<T> | T);\n\n/**\n * Onboarding route\n */\nexport const onboardingRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'onboarding-required', loaderFn as (user?: UserInfo) => Promise<T> | T);\n\n/**\n * Subscription route\n */\nexport const subscriptionRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'subscription-required', loaderFn as (user?: UserInfo) => Promise<T> | T);\n","/**\n * Token Refresh Server Module\n */\n\nimport { refreshTokens } from './auth.server';\nimport { getAuthSession } from './redis-session-storage.server';\nimport type { TokenRefreshResult } from './types';\nimport { logger } from '../logging';\n\n/**\n * Attempt to refresh the access token\n */\nexport async function attemptTokenRefresh(request: Request): Promise<TokenRefreshResult> {\n  try {\n    logger.info('Attempting token refresh due to 401 response');\n\n    const sessionData = await getAuthSession(request);\n\n    if (!sessionData.refreshToken) {\n      logger.warn('No refresh token available in session');\n      return {\n        success: false,\n        error: 'No refresh token available',\n        shouldLogout: true,\n      };\n    }\n\n    const refreshResult = await refreshTokens(request, sessionData.refreshToken);\n\n    if (!refreshResult.success) {\n      logger.error('Token refresh failed', undefined, {\n        error: refreshResult.error,\n        shouldLogout: refreshResult.shouldLogout,\n      });\n\n      return {\n        success: false,\n        error: refreshResult.error,\n        shouldLogout: refreshResult.shouldLogout,\n      };\n    }\n\n    const tokens = refreshResult.tokens;\n    if (!tokens || !tokens.access_token) {\n      logger.error('Token refresh succeeded but no access token returned');\n      return {\n        success: false,\n        error: 'No access token in refresh response',\n        shouldLogout: true,\n      };\n    }\n\n    logger.info('Token refresh successful');\n\n    return {\n      success: true,\n      newAccessToken: tokens.access_token,\n    };\n  } catch (error) {\n    logger.error('Token refresh attempt failed', error instanceof Error ? error : undefined);\n    return {\n      success: false,\n      error: error instanceof Error ? error.message : 'Unknown error',\n      shouldLogout: true,\n    };\n  }\n}\n\n/**\n * Check if a response indicates token expiration\n */\nexport function isTokenExpiredResponse(response: Response): boolean {\n  return response.status === 401;\n}\n\n/**\n * Check if token refresh should be attempted\n */\nexport function shouldAttemptTokenRefresh(response: Response, hasAuth: boolean): boolean {\n  return hasAuth && isTokenExpiredResponse(response);\n}\n"],"mappings":";;;;;AAaA,MAAM,oBAAoB,IAAI,KAAK;;;;AAKnC,eAAsB,mBAAmBA,SAAoC;AAC3E,KAAI;EACF,MAAM,cAAc,MAAM,eAAe,QAAQ;AAEjD,OAAK,YAAY,gBAAgB,YAAY,aAAa,WAAW,GAAG;AACtE,OAAI,YAAY,aAAa,KAAK,KAAK,IAAI,YAAY,WAAW;AAChE,WAAO,KAAK,kEAAkE;IAC9E,MAAM,EAAE,QAAQ,GAAG,MAAM,OAAO;IAChC,MAAM,gBAAgB,MAAM,6BAA6B,SAAS,2BAA2B;AAC7F,UAAM,MAAM,OAAO,cAAc;GAClC;AACD,UAAO;EACR;AAED,OAAK,YAAY,cAAc,YAAY,YACzC,QAAO;EAGT,MAAM,MAAM,KAAK,KAAK;EAGtB,IAAIC,YAA2B;AAC/B,MAAI;GACF,MAAM,aAAa,YAAY,YAAY,MAAM,IAAI;AACrD,OAAI,WAAW,WAAW,GAAG;IAC3B,MAAM,UAAU,KAAK,MAAM,OAAO,KAAK,WAAW,IAAI,SAAS,CAAC,UAAU,CAAC;AAC3E,QAAI,QAAQ,IACV,aAAY,QAAQ,MAAM;GAE7B;EACF,QAAO,CAEP;EAED,MAAM,iBAAiB,aAAa,YAAY,YAAY,YACxD,YACA,YAAY;EAChB,MAAM,0BAA0B,iBAAiB;AAEjD,SAAO,2BAA2B;CACnC,SAAQ,OAAO;AACd,SAAO,MAAM,gCAAgC,iBAAiB,QAAQ,eAAkB;AACxF,SAAO;CACR;AACF;;;;AAKD,eAAe,kBAAkBD,SAAiC;AAChE,KAAI;EACF,MAAM,eAAe,MAAM,mBAAmB,QAAQ;AAEtD,MAAI,cAAc;AAChB,UAAO,KAAK,uCAAuC;GACnD,MAAM,SAAS,MAAM,cAAc,QAAQ;AAE3C,OAAI,OAAO,QACT,QAAO,KAAK,sCAAsC;QAC7C;AACL,WAAO,MAAM,+BAAkC,EAAE,OAAO,OAAO,MAAO,EAAC;AAEvE,QAAI,OAAO,cAAc;AACvB,YAAO,MAAM,qDAAqD;KAClE,MAAM,EAAE,QAAQ,GAAG,MAAM,OAAO;KAChC,MAAM,gBAAgB,MAAM,6BAA6B,SAAS,iBAAiB;AACnF,WAAM,MAAM,OAAO,cAAc;IAClC;GACF;EACF;CACF,SAAQ,OAAO;AACd,MAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,IACrE,OAAM;AAER,QAAM;CACP;AACF;AAqFD,IAAIE,mBAA+C,CAAE;;;;AAKrD,SAAgB,yBACdC,QACM;AACN,oBAAmB;AACpB;;;;AAKD,SAAgB,6BAAmC;AACjD,oBAAmB,CAAE;AACtB;AAED,SAAS,yBAAyBC,UAA6C;AAC7E,QAAO,uBAAuB,SAAS,UAAU;EAC/C,SAAS,SAAS;EAClB,QAAQ,SAAS;CAClB,EAAC;AACH;AAED,SAAS,kBACPJ,SACAK,aACAC,YACQ;AACR,KAAI,iBAAiB,kBACnB,QAAO,iBAAiB,kBAAkB;EACxC;EACA;EACA;CACD,EAAC;AAGJ,SAAQ,YAAR;EACE,KAAK,sBACH,QAAO;EACT,KAAK,wBACH,QAAO;EACT,KAAK,SACH,QAAO;EACT,KAAK;EACL,SAAS;GACP,MAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,UAAO,IAAI,aAAa,MAAM,OAAO,EAAE,IAAI,SAAS,EAAE,IAAI,OAAO;EAClE;CACF;AACF;AAED,eAAe,6BACbN,SACAO,QACkB;AAClB,KAAI,iBAAiB,6BACnB,QAAO,iBAAiB,6BAA6B;EAAE;EAAS;CAAQ,EAAC;CAG3E,MAAM,YAAY,IAAI,IAAI,QAAQ;AAClC,WAAU,WAAW;AACrB,WAAU,aAAa,IAAI,kBAAkB,OAAO;AAEpD,QAAO,IAAI,QAAQ,UAAU,UAAU,EAAE,EACvC,SAAS,QAAQ,QAClB;AACF;AAED,SAAS,2BACPP,SACAQ,MACAH,aACAC,YACqC;CACrC,IAAIG,yBAAqD;CACzD,IAAIC,uBAAsD;CAC1D,IAAIC,0BAAyF;AAE7F,QAAO;EACL;EACA;EACA;EACA;EACA,oBAAoB,OAAO,eAAe,UAAU;AAClD,QAAK,iBAAiB,gBACpB,QAAO;AAGT,OAAI,aACF,QAAO,iBAAiB,gBAAgB,mBAAmB,SAAS,KAAK,KAAK,KAAK;AAGrF,QAAK,uBACH,0BAAyB,iBAAiB,gBAAgB,mBAAmB,SAAS,KAAK,IAAI;AAGjG,UAAO;EACR;EACD,kBAAkB,YAAY;AAC5B,QAAK,iBAAiB,cACpB,QAAO;AAGT,QAAK,qBACH,wBAAuB,iBAAiB,cAAc,iBAAiB,QAAQ;AAGjF,UAAO;EACR;EACD,kBAAkB,YAAY;AAC5B,QAAK,iBAAiB,cACpB,QAAO;AAGT,QAAK,wBACH,2BAA0B,iBAAiB,cAAc,iBAAiB,QAAQ;AAGpF,UAAO;EACR;CACF;AACF;AAED,eAAe,+BACbX,SACAQ,MACAH,aACAC,YACkB;AAClB,MAAK,iBAAiB,aACpB,QAAO;CAGT,MAAM,UAAU,2BAA2B,SAAS,MAAM,aAAa,WAAW;AAElF,KAAI;EACF,MAAM,SAAS,MAAM,iBAAiB,aAAa,QAAQ;AAC3D,MAAI,OACF,OAAM,yBAAyB,OAAO;AAGxC,SAAO;CACR,SAAQ,OAAO;AACd,MAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,IACrE,OAAM;AAGR,OAAK,iBAAiB,iBACpB,OAAM;EAGR,MAAM,WAAW,MAAM,iBAAiB,iBAAiB;GACvD,GAAG;GACH;EACD,EAAC;AAEF,MAAI,SACF,OAAM,yBAAyB,SAAS;AAG1C,QAAM;CACP;AACF;;;;AAKD,eAAe,gBACbN,SACAQ,MACAH,aAC0B;AAC1B,MAAK,iBAAiB,iBAAiB;AACrC,SAAO,KAAK,yDAAyD;AACrE,SAAO;CACR;AAED,KAAI;EACF,MAAM,UAAU,MAAM,iBAAiB,gBAAgB,mBAAmB,SAAS,KAAK,IAAI;AAE5F,SAAO,MAAM,qBAAqB;GAChC,QAAQ,KAAK;GACb;GACA,kBAAkB,QAAQ;GAC1B,aAAa,QAAQ;GACrB,iBAAiB,QAAQ;EAC1B,EAAC;AAGF,OAAK,QAAQ,kBAAkB;AAC7B,OAAI,gBAAgB,eAAe;AACjC,WAAO,KAAK,qDAAqD;AACjE,UAAM,uBAAuB,cAAc;GAC5C;AACD,UAAO;EACR;AAGD,MAAI,QAAQ,kBAAkB;AAC5B,OAAI,gBAAgB,eAAe;AACjC,WAAO,KAAK,oEAAoE;AAChF,UAAM,uBAAuB,gBAAgB;GAC9C;AAED,OAAI,gBAAgB,gBAClB,QAAO;AAIT,OAAI,iBAAiB,iBAAiB,iBAAiB,qBAAqB;IAC1E,IAAI,gBAAgB,MAAM,iBAAiB,cAAc,iBAAiB,QAAQ;AAElF,SAAK,eAAe;KAClB,MAAM,aAAa,MAAM,iBAAiB,cAAc,iBAAiB,QAAQ;AACjF,SAAI,WACF,iBAAgB,WAAW;IAE9B;AAED,QAAI,eAAe;KACjB,MAAM,kBAAkB,MAAM,iBAAiB,oBAAoB,8BACjE,SACA,cACD;AAED,UAAK,iBAAiB;AACpB,aAAO,KAAK,0DAA0D;AACtE,YAAM,uBAAuB,gBAAgB;KAC9C;IACF,OAAM;AACL,YAAO,KAAK,2DAA2D;AACvE,WAAM,uBAAuB,gBAAgB;IAC9C;GACF;EACF;AAED,SAAO;CACR,SAAQ,OAAO;AACd,MAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,IACrE,OAAM;AAGR,SAAO,MAAM,8BAA8B,iBAAiB,QAAQ,eAAkB;AAEtF,MAAI,gBAAgB,cAClB,OAAM,uBAAuB,cAAc;AAG7C,SAAO;CACR;AACF;;;;AAKD,eAAsB,aACpBL,SACAM,YACAM,UACY;CACZ,MAAM,MAAM,IAAI,IAAI,QAAQ;AAE5B,SAAQ,YAAR;EACE,KAAK,SACH,KAAI;AACF,SAAM,kBAAkB,QAAQ;GAChC,MAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,UAAO,SAAS,eAAkB;EACnC,QAAO;AACN,UAAO,gBAAmB;EAC3B;EAEH,KAAK,OACH,KAAI;AACF,SAAM,kBAAkB,QAAQ;GAChC,MAAM,OAAO,MAAM,YAAY,QAAQ;GACvC,MAAM,kBAAkB,MAAM,+BAA+B,SAAS,MAAM,IAAI,UAAU,OAAO;AACjG,QAAK,gBACH,OAAM,gBAAgB,SAAS,MAAM,IAAI,SAAS;AAEpD,UAAO,SAAS,KAAK;EACtB,SAAQ,OAAO;AACd,OAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,IACrE,OAAM;AAER,SAAM,MAAM,MAAM,SAAS,kBAAkB,SAAS,IAAI,UAAU,OAAO,CAAC;EAC7E;EAEH,KAAK,sBACH,KAAI;AACF,SAAM,kBAAkB,QAAQ;GAChC,MAAM,OAAO,MAAM,YAAY,QAAQ;GAEvC,MAAM,kBAAkB,MAAM,+BAC5B,SACA,MACA,IAAI,UACJ,sBACD;AACD,QAAK,mBAAmB,iBAAiB,iBAAiB;IACxD,MAAM,UAAU,MAAM,iBAAiB,gBAAgB,mBAAmB,SAAS,KAAK,IAAI;AAC5F,QAAI,QAAQ,iBACV,OAAM,uBAAuB,gBAAgB;GAEhD;AAED,UAAO,SAAS,KAAK;EACtB,SAAQ,OAAO;AACd,OAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,IACrE,OAAM;AAER,SAAM,MAAM,MAAM,SAAS,kBAAkB,SAAS,IAAI,UAAU,sBAAsB,CAAC;EAC5F;EAEH,KAAK,wBACH,KAAI;AACF,SAAM,kBAAkB,QAAQ;GAChC,MAAM,OAAO,MAAM,YAAY,QAAQ;GAEvC,MAAM,kBAAkB,MAAM,+BAC5B,SACA,MACA,IAAI,UACJ,wBACD;AACD,QAAK,mBAAmB,iBAAiB,iBAAiB;IACxD,MAAM,UAAU,MAAM,iBAAiB,gBAAgB,mBAAmB,SAAS,KAAK,IAAI;AAC5F,SAAK,QAAQ,iBACX,OAAM,uBAAuB,cAAc;GAE9C;AAGD,OAAI,iBAAiB,eAAe;IAClC,MAAM,gBAAgB,MAAM,iBAAiB,cAAc,iBAAiB,QAAQ;AACpF,SAAK,cACH,OAAM,iBAAiB,cAAc,iBAAiB,QAAQ;GAEjE;AAED,UAAO,SAAS,KAAK;EACtB,SAAQ,OAAO;AACd,OAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,IACrE,OAAM;AAER,SAAM,MAAM,MAAM,SAAS,kBAAkB,SAAS,IAAI,UAAU,wBAAwB,CAAC;EAC9F;EAEH,QACE,OAAM,IAAI,OAAO,4BAA4B,WAAW;CAC3D;AACF;;;;AASD,MAAa,cAAc,CACzBZ,SACAY,aACG,aAAa,SAAS,UAAU,SAAS;;;;AAK9C,MAAa,YAAY,CACvBZ,SACAa,aACG,aAAa,SAAS,QAAQ,SAAgD;;;;AAKnF,MAAa,kBAAkB,CAC7Bb,SACAa,aACG,aAAa,SAAS,uBAAuB,SAAgD;;;;AAKlG,MAAa,oBAAoB,CAC/Bb,SACAa,aACG,aAAa,SAAS,yBAAyB,SAAgD;;;;;;;AC5iBpG,eAAsB,oBAAoBC,SAA+C;AACvF,KAAI;AACF,SAAO,KAAK,+CAA+C;EAE3D,MAAM,cAAc,MAAM,eAAe,QAAQ;AAEjD,OAAK,YAAY,cAAc;AAC7B,UAAO,KAAK,wCAAwC;AACpD,UAAO;IACL,SAAS;IACT,OAAO;IACP,cAAc;GACf;EACF;EAED,MAAM,gBAAgB,MAAM,cAAc,SAAS,YAAY,aAAa;AAE5E,OAAK,cAAc,SAAS;AAC1B,UAAO,MAAM,gCAAmC;IAC9C,OAAO,cAAc;IACrB,cAAc,cAAc;GAC7B,EAAC;AAEF,UAAO;IACL,SAAS;IACT,OAAO,cAAc;IACrB,cAAc,cAAc;GAC7B;EACF;EAED,MAAM,SAAS,cAAc;AAC7B,OAAK,WAAW,OAAO,cAAc;AACnC,UAAO,MAAM,uDAAuD;AACpE,UAAO;IACL,SAAS;IACT,OAAO;IACP,cAAc;GACf;EACF;AAED,SAAO,KAAK,2BAA2B;AAEvC,SAAO;GACL,SAAS;GACT,gBAAgB,OAAO;EACxB;CACF,SAAQ,OAAO;AACd,SAAO,MAAM,gCAAgC,iBAAiB,QAAQ,eAAkB;AACxF,SAAO;GACL,SAAS;GACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU;GAChD,cAAc;EACf;CACF;AACF;;;;AAKD,SAAgB,uBAAuBC,UAA6B;AAClE,QAAO,SAAS,WAAW;AAC5B;;;;AAKD,SAAgB,0BAA0BA,UAAoBC,SAA2B;AACvF,QAAO,WAAW,uBAAuB,SAAS;AACnD"}