@eminuckan/spine 0.2.2 → 0.3.0

package/dist/access/types.d.ts

@@ -0,0 +1,38 @@
+import type { PermissionCode } from '../permissions/types';
+export type AccessOperator = 'AND' | 'OR';
+export interface EntitlementAccessSnapshot {
+    exists?: boolean;
+    status?: string | null;
+    planCode?: string | null;
+    featureKeys?: readonly string[] | null;
+    limits?: Record<string, unknown> | null;
+}
+/** @deprecated Use EntitlementAccessSnapshot instead. */
+export type SubscriptionAccessSnapshot = EntitlementAccessSnapshot;
+export interface AccessSubject {
+    permissions?: readonly PermissionCode[] | null;
+    entitlement?: EntitlementAccessSnapshot | null;
+    /** @deprecated Use entitlement instead. */
+    subscription?: SubscriptionAccessSnapshot | null;
+    isInternalUser?: boolean;
+}
+export interface AccessRequirement {
+    permissions?: readonly PermissionCode[];
+    permissionOperator?: AccessOperator;
+    features?: readonly string[];
+    featureOperator?: AccessOperator;
+    requireActiveEntitlement?: boolean;
+    /** @deprecated Use requireActiveEntitlement instead. */
+    requireActiveSubscription?: boolean;
+    internalOnly?: boolean;
+}
+export type AccessDeniedReason = 'internal-only' | 'inactive-entitlement'
+/** @deprecated Use inactive-entitlement instead. */
+ | 'inactive-subscription' | 'missing-permissions' | 'missing-features';
+export interface AccessDecision {
+    allowed: boolean;
+    reasons: AccessDeniedReason[];
+    missingPermissions: PermissionCode[];
+    missingFeatures: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/access/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/access/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,IAAI,CAAC;AAE1C,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzC;AAED,yDAAyD;AACzD,MAAM,MAAM,0BAA0B,GAAG,yBAAyB,CAAC;AAEnE,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI,CAAC;IAC/C,WAAW,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC/C,2CAA2C;IAC3C,YAAY,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAC;IACjD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACxC,kBAAkB,CAAC,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,wDAAwD;IACxD,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,kBAAkB,GAC1B,eAAe,GACf,sBAAsB;AACxB,oDAAoD;GAClD,uBAAuB,GACvB,qBAAqB,GACrB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,kBAAkB,EAAE,cAAc,EAAE,CAAC;IACrC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B"}

package/dist/access-CGrsDMwu.js

@@ -0,0 +1,61 @@
+import { PermissionChecker } from "./permission-service-CvGpwI0d.js";
+
+//#region src/access/evaluator.ts
+const ACTIVE_ENTITLEMENT_STATUSES = new Set(["active", "trialing"]);
+const EMPTY_DECISION = Object.freeze({
+	allowed: true,
+	reasons: [],
+	missingPermissions: [],
+	missingFeatures: []
+});
+function normalizeFeature(value) {
+	return value.trim().toLowerCase();
+}
+function hasActiveEntitlement(entitlement) {
+	if (!entitlement?.exists) return false;
+	return ACTIVE_ENTITLEMENT_STATUSES.has(entitlement.status?.toLowerCase() ?? "");
+}
+function checkFeatureSet(grantedFeatures, requiredFeatures, operator) {
+	if (requiredFeatures.length === 0) return [];
+	const granted = new Set(grantedFeatures.map(normalizeFeature));
+	const normalizedRequired = requiredFeatures.map(normalizeFeature).filter(Boolean);
+	if (operator === "OR") return normalizedRequired.some((feature) => granted.has(feature)) ? [] : normalizedRequired;
+	return normalizedRequired.filter((feature) => !granted.has(feature));
+}
+function evaluateAccessRequirement(requirement, subject) {
+	if (!requirement) return EMPTY_DECISION;
+	const reasons = [];
+	const permissions = requirement.permissions ?? [];
+	const features = requirement.features ?? [];
+	const entitlement = subject.entitlement ?? subject.subscription;
+	let missingPermissions = [];
+	let missingFeatures = [];
+	if (requirement.internalOnly && !subject.isInternalUser) reasons.push("internal-only");
+	if (requirement.requireActiveEntitlement && !hasActiveEntitlement(entitlement)) reasons.push("inactive-entitlement");
+	else if (requirement.requireActiveSubscription && !hasActiveEntitlement(entitlement)) reasons.push("inactive-subscription");
+	if (permissions.length > 0) {
+		const checker = new PermissionChecker([...subject.permissions ?? []]);
+		const result = checker.hasPermissions([...permissions], {
+			operator: requirement.permissionOperator ?? "AND",
+			wildcard: true
+		});
+		if (!result.hasPermission) {
+			missingPermissions = result.missingPermissions;
+			reasons.push("missing-permissions");
+		}
+	}
+	if (features.length > 0) {
+		missingFeatures = checkFeatureSet(entitlement?.featureKeys ?? [], features, requirement.featureOperator ?? "AND");
+		if (missingFeatures.length > 0) reasons.push("missing-features");
+	}
+	return {
+		allowed: reasons.length === 0,
+		reasons,
+		missingPermissions,
+		missingFeatures
+	};
+}
+
+//#endregion
+export { evaluateAccessRequirement };
+//# sourceMappingURL=access-CGrsDMwu.js.map

package/dist/access-CGrsDMwu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-CGrsDMwu.js","names":["EMPTY_DECISION: AccessDecision","value: string","entitlement?: EntitlementAccessSnapshot | null","grantedFeatures: readonly string[]","requiredFeatures: readonly string[]","operator: AccessOperator","requirement: AccessRequirement | null | undefined","subject: AccessSubject","reasons: AccessDeniedReason[]","missingPermissions: string[]","missingFeatures: string[]"],"sources":["../src/access/evaluator.ts"],"sourcesContent":["import { PermissionChecker } from '../permissions/permission-service';\nimport type {\n  AccessDecision,\n  AccessDeniedReason,\n  AccessOperator,\n  AccessRequirement,\n  AccessSubject,\n  EntitlementAccessSnapshot,\n} from './types';\n\nconst ACTIVE_ENTITLEMENT_STATUSES = new Set(['active', 'trialing']);\n\nconst EMPTY_DECISION: AccessDecision = Object.freeze({\n  allowed: true,\n  reasons: [],\n  missingPermissions: [],\n  missingFeatures: [],\n});\n\nfunction normalizeFeature(value: string): string {\n  return value.trim().toLowerCase();\n}\n\nfunction hasActiveEntitlement(entitlement?: EntitlementAccessSnapshot | null): boolean {\n  if (!entitlement?.exists) {\n    return false;\n  }\n\n  return ACTIVE_ENTITLEMENT_STATUSES.has(entitlement.status?.toLowerCase() ?? '');\n}\n\nfunction checkFeatureSet(\n  grantedFeatures: readonly string[],\n  requiredFeatures: readonly string[],\n  operator: AccessOperator,\n): string[] {\n  if (requiredFeatures.length === 0) {\n    return [];\n  }\n\n  const granted = new Set(grantedFeatures.map(normalizeFeature));\n  const normalizedRequired = requiredFeatures.map(normalizeFeature).filter(Boolean);\n\n  if (operator === 'OR') {\n    return normalizedRequired.some((feature) => granted.has(feature)) ? [] : normalizedRequired;\n  }\n\n  return normalizedRequired.filter((feature) => !granted.has(feature));\n}\n\nexport function evaluateAccessRequirement(\n  requirement: AccessRequirement | null | undefined,\n  subject: AccessSubject,\n): AccessDecision {\n  if (!requirement) {\n    return EMPTY_DECISION;\n  }\n\n  const reasons: AccessDeniedReason[] = [];\n  const permissions = requirement.permissions ?? [];\n  const features = requirement.features ?? [];\n  const entitlement = subject.entitlement ?? subject.subscription;\n  let missingPermissions: string[] = [];\n  let missingFeatures: string[] = [];\n\n  if (requirement.internalOnly && !subject.isInternalUser) {\n    reasons.push('internal-only');\n  }\n\n  if (requirement.requireActiveEntitlement && !hasActiveEntitlement(entitlement)) {\n    reasons.push('inactive-entitlement');\n  } else if (requirement.requireActiveSubscription && !hasActiveEntitlement(entitlement)) {\n    reasons.push('inactive-subscription');\n  }\n\n  if (permissions.length > 0) {\n    const checker = new PermissionChecker([...(subject.permissions ?? [])]);\n    const result = checker.hasPermissions([...permissions], {\n      operator: requirement.permissionOperator ?? 'AND',\n      wildcard: true,\n    });\n\n    if (!result.hasPermission) {\n      missingPermissions = result.missingPermissions;\n      reasons.push('missing-permissions');\n    }\n  }\n\n  if (features.length > 0) {\n    missingFeatures = checkFeatureSet(\n      entitlement?.featureKeys ?? [],\n      features,\n      requirement.featureOperator ?? 'AND',\n    );\n\n    if (missingFeatures.length > 0) {\n      reasons.push('missing-features');\n    }\n  }\n\n  return {\n    allowed: reasons.length === 0,\n    reasons,\n    missingPermissions,\n    missingFeatures,\n  };\n}\n"],"mappings":";;;AAUA,MAAM,8BAA8B,IAAI,IAAI,CAAC,UAAU,UAAW;AAElE,MAAMA,iBAAiC,OAAO,OAAO;CACnD,SAAS;CACT,SAAS,CAAE;CACX,oBAAoB,CAAE;CACtB,iBAAiB,CAAE;AACpB,EAAC;AAEF,SAAS,iBAAiBC,OAAuB;AAC/C,QAAO,MAAM,MAAM,CAAC,aAAa;AAClC;AAED,SAAS,qBAAqBC,aAAyD;AACrF,MAAK,aAAa,OAChB,QAAO;AAGT,QAAO,4BAA4B,IAAI,YAAY,QAAQ,aAAa,IAAI,GAAG;AAChF;AAED,SAAS,gBACPC,iBACAC,kBACAC,UACU;AACV,KAAI,iBAAiB,WAAW,EAC9B,QAAO,CAAE;CAGX,MAAM,UAAU,IAAI,IAAI,gBAAgB,IAAI,iBAAiB;CAC7D,MAAM,qBAAqB,iBAAiB,IAAI,iBAAiB,CAAC,OAAO,QAAQ;AAEjF,KAAI,aAAa,KACf,QAAO,mBAAmB,KAAK,CAAC,YAAY,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAE,IAAG;AAG3E,QAAO,mBAAmB,OAAO,CAAC,aAAa,QAAQ,IAAI,QAAQ,CAAC;AACrE;AAED,SAAgB,0BACdC,aACAC,SACgB;AAChB,MAAK,YACH,QAAO;CAGT,MAAMC,UAAgC,CAAE;CACxC,MAAM,cAAc,YAAY,eAAe,CAAE;CACjD,MAAM,WAAW,YAAY,YAAY,CAAE;CAC3C,MAAM,cAAc,QAAQ,eAAe,QAAQ;CACnD,IAAIC,qBAA+B,CAAE;CACrC,IAAIC,kBAA4B,CAAE;AAElC,KAAI,YAAY,iBAAiB,QAAQ,eACvC,SAAQ,KAAK,gBAAgB;AAG/B,KAAI,YAAY,6BAA6B,qBAAqB,YAAY,CAC5E,SAAQ,KAAK,uBAAuB;UAC3B,YAAY,8BAA8B,qBAAqB,YAAY,CACpF,SAAQ,KAAK,wBAAwB;AAGvC,KAAI,YAAY,SAAS,GAAG;EAC1B,MAAM,UAAU,IAAI,kBAAkB,CAAC,GAAI,QAAQ,eAAe,CAAE,CAAE;EACtE,MAAM,SAAS,QAAQ,eAAe,CAAC,GAAG,WAAY,GAAE;GACtD,UAAU,YAAY,sBAAsB;GAC5C,UAAU;EACX,EAAC;AAEF,OAAK,OAAO,eAAe;AACzB,wBAAqB,OAAO;AAC5B,WAAQ,KAAK,sBAAsB;EACpC;CACF;AAED,KAAI,SAAS,SAAS,GAAG;AACvB,oBAAkB,gBAChB,aAAa,eAAe,CAAE,GAC9B,UACA,YAAY,mBAAmB,MAChC;AAED,MAAI,gBAAgB,SAAS,EAC3B,SAAQ,KAAK,mBAAmB;CAEnC;AAED,QAAO;EACL,SAAS,QAAQ,WAAW;EAC5B;EACA;EACA;CACD;AACF"}

package/dist/api-client/api-config.server.d.ts

@@ -25,6 +25,33 @@ export interface APIConfigFactoryOptions {
      * Default timeout in milliseconds
      */
     timeout?: number;
+    /**
+     * Header name used for bearer-style auth. Set to null when buildHeaders owns auth.
+     * @default 'Authorization'
+     */
+    authHeaderName?: string | null;
+    /**
+     * Build an auth header value from the resolved access token.
+     * @default token => `Bearer ${token}`
+     */
+    authHeaderValue?: (accessToken: string) => string;
+    /**
+     * Header name used for tenant context. Set to null when buildHeaders owns tenancy.
+     * @default 'X-Tenant-Id'
+     */
+    tenantHeaderName?: string | null;
+    /**
+     * Final app-specific header hook. Returned headers are merged last.
+     */
+    buildHeaders?: (context: APIHeaderStrategyContext) => Record<string, string>;
+}
+export interface APIHeaderStrategyContext {
+    request: Request;
+    options: CreateAPIConfigOptions;
+    accessToken?: string;
+    tenantId: string | null;
+    includeAuth: boolean;
+    requireTenant: boolean;
 }
 /**
  * Create API Config Factory

package/dist/api-client/api-config.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-config.server.d.ts","sourceRoot":"","sources":["../../src/api-client/api-config.server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAiBlH;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,gBAAgB,EAChC,gBAAgB,EAAE,kBAAkB,EACpC,MAAM,CAAC,EAAE,SAAS,EAClB,cAAc,GAAE,uBAA4B;+BA+DjC,OAAO,YACP,sBAAsB,KAC9B,OAAO,CAAC,SAAS,CAAC;yBAgEK,MAAM;EAQjC;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"api-config.server.d.ts","sourceRoot":"","sources":["../../src/api-client/api-config.server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAiBlH;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;IAClD;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;OAEG;IACH,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9E;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,sBAAsB,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,gBAAgB,EAChC,gBAAgB,EAAE,kBAAkB,EACpC,MAAM,CAAC,EAAE,SAAS,EAClB,cAAc,GAAE,uBAA4B;+BAmEjC,OAAO,YACP,sBAAsB,KAC9B,OAAO,CAAC,SAAS,CAAC;yBA+EK,MAAM;EAQjC;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/api-client/error-codes.d.ts

@@ -1,7 +1,8 @@
 /**
  * Error Codes
  *
- * Standard error codes from backend.
+ * Generic error codes that apps can use as a starter vocabulary.
+ * Domain-specific codes should live in the consuming app.
  */
 export declare const ErrorCodes: {
     readonly Validation: {
@@ -17,41 +18,15 @@ export declare const ErrorCodes: {
         readonly UserNotFound: "UserNotFound";
         readonly EmailAlreadyExists: "EmailAlreadyExists";
     };
-    readonly Accounting: {
-        readonly OpeningBalanceLockedReconciliation: "OpeningBalanceLockedReconciliation";
-        readonly OpeningBalanceLockedJournal: "OpeningBalanceLockedJournal";
-        readonly SystemLocked: "SystemLocked";
-        readonly AccountsDuplicate: "AccountsDuplicate";
-        readonly AccountNotFound: "AccountNotFound";
-    };
-    readonly Subscription: {
-        readonly SubscriptionRequired: "SubscriptionRequired";
-        readonly SubscriptionExpired: "SubscriptionExpired";
+    readonly Access: {
+        readonly EntitlementRequired: "EntitlementRequired";
+        readonly EntitlementExpired: "EntitlementExpired";
         readonly FeatureNotAvailable: "FeatureNotAvailable";
-    };
-    readonly PropertyManagement: {
-        readonly PropertyNotFound: "PropertyNotFound";
-        readonly UnitNotFound: "UnitNotFound";
-        readonly DuplicateProperty: "DuplicateProperty";
-        readonly DuplicateUnit: "DuplicateUnit";
-    };
-    readonly Leasing: {
-        readonly LeaseNotFound: "LeaseNotFound";
-        readonly LeaseConflict: "LeaseConflict";
-        readonly TenantNotFound: "TenantNotFound";
-        readonly LateFeeValidationError: "LateFeeValidationError";
+        readonly TenantContextMissing: "TenantContextMissing";
     };
     readonly NotFound: "NotFound";
     readonly Unauthorized: "Unauthorized";
     readonly Forbidden: "Forbidden";
     readonly InternalError: "InternalError";
 };
-/**
- * Check if error code is from PropertyManagement module
- */
-export declare function isPropertyManagementError(code: string): boolean;
-/**
- * Check if error code is from Leasing module
- */
-export declare function isLeasingError(code: string): boolean;
 //# sourceMappingURL=error-codes.d.ts.map

package/dist/api-client/error-codes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../../src/api-client/error-codes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDb,CAAC;AAEX;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD"}
+{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../../src/api-client/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;CA+Bb,CAAC"}

package/dist/api-client/index.js

@@ -1,5 +1,5 @@
-import "../logging-_h2mi3L9.js";
-import { isApiClientError } from "../types-BnKaWdfe.js";
-import { ApiError, ErrorCodes, ErrorHandler, calculateBackoffDelay, createRetryFetch, fetchWithTimeout, handleApiError, isRetryableError, withRetry } from "../api-client-DsrxK05Z.js";
+import "../logging-DviiAkLx.js";
+import { isApiClientError } from "../types-BaaE6wjY.js";
+import { ApiError, ErrorCodes, ErrorHandler, calculateBackoffDelay, createRetryFetch, fetchWithTimeout, handleApiError, isRetryableError, withRetry } from "../api-client-CgZUMukO.js";
 
 export { ApiError, ErrorCodes, ErrorHandler, calculateBackoffDelay, createRetryFetch, fetchWithTimeout, handleApiError, isApiClientError, isRetryableError, withRetry };

package/dist/api-client/server.d.ts

@@ -4,6 +4,6 @@
  * Server-side exports for API client module.
  */
 export * from './index';
-export { createAPIConfigFactory, type APIConfigFactory, type APIConfigFactoryOptions, } from './api-config.server';
+export { createAPIConfigFactory, type APIConfigFactory, type APIConfigFactoryOptions, type APIHeaderStrategyContext, } from './api-config.server';
 export { createFetchMiddleware, createApiClient, type FetchSetupOptions, type CreateApiClientOptions, } from './fetch-client.server';
 //# sourceMappingURL=server.d.ts.map

package/dist/api-client/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/api-client/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,cAAc,SAAS,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/api-client/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,cAAc,SAAS,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC"}

package/dist/api-client/server.js

@@ -1,6 +1,6 @@
-import "../logging-_h2mi3L9.js";
-import { isApiClientError } from "../types-BnKaWdfe.js";
-import { ApiError, ErrorCodes, ErrorHandler, calculateBackoffDelay, createRetryFetch, fetchWithTimeout, handleApiError, isRetryableError, withRetry } from "../api-client-DsrxK05Z.js";
-import { createAPIConfigFactory, createApiClient, createFetchMiddleware } from "../server-DZmcd2Lr.js";
+import "../logging-DviiAkLx.js";
+import { isApiClientError } from "../types-BaaE6wjY.js";
+import { ApiError, ErrorCodes, ErrorHandler, calculateBackoffDelay, createRetryFetch, fetchWithTimeout, handleApiError, isRetryableError, withRetry } from "../api-client-CgZUMukO.js";
+import { createAPIConfigFactory, createApiClient, createFetchMiddleware } from "../server-C96NMFBy.js";
 
 export { ApiError, ErrorCodes, ErrorHandler, calculateBackoffDelay, createAPIConfigFactory, createApiClient, createFetchMiddleware, createRetryFetch, fetchWithTimeout, handleApiError, isApiClientError, isRetryableError, withRetry };

package/dist/{api-client-DsrxK05Z.js → api-client-CgZUMukO.js}

@@ -1,10 +1,11 @@
-import { logger } from "./logging-_h2mi3L9.js";
+import { logger } from "./logging-DviiAkLx.js";
 
 //#region src/api-client/error-codes.ts
 /**
 * Error Codes
 * 
-* Standard error codes from backend.
+* Generic error codes that apps can use as a starter vocabulary.
+* Domain-specific codes should live in the consuming app.
 */
 const ErrorCodes = {
 	Validation: { Failed: "ValidationFailed" },
@@ -18,29 +19,11 @@ const ErrorCodes = {
 		UserNotFound: "UserNotFound",
 		EmailAlreadyExists: "EmailAlreadyExists"
 	},
-	Accounting: {
-		OpeningBalanceLockedReconciliation: "OpeningBalanceLockedReconciliation",
-		OpeningBalanceLockedJournal: "OpeningBalanceLockedJournal",
-		SystemLocked: "SystemLocked",
-		AccountsDuplicate: "AccountsDuplicate",
-		AccountNotFound: "AccountNotFound"
-	},
-	Subscription: {
-		SubscriptionRequired: "SubscriptionRequired",
-		SubscriptionExpired: "SubscriptionExpired",
-		FeatureNotAvailable: "FeatureNotAvailable"
-	},
-	PropertyManagement: {
-		PropertyNotFound: "PropertyNotFound",
-		UnitNotFound: "UnitNotFound",
-		DuplicateProperty: "DuplicateProperty",
-		DuplicateUnit: "DuplicateUnit"
-	},
-	Leasing: {
-		LeaseNotFound: "LeaseNotFound",
-		LeaseConflict: "LeaseConflict",
-		TenantNotFound: "TenantNotFound",
-		LateFeeValidationError: "LateFeeValidationError"
+	Access: {
+		EntitlementRequired: "EntitlementRequired",
+		EntitlementExpired: "EntitlementExpired",
+		FeatureNotAvailable: "FeatureNotAvailable",
+		TenantContextMissing: "TenantContextMissing"
 	},
 	NotFound: "NotFound",
 	Unauthorized: "Unauthorized",
@@ -209,4 +192,4 @@ function createRetryFetch(config) {
 
 //#endregion
 export { ApiError, ErrorCodes, ErrorHandler, calculateBackoffDelay, createRetryFetch, fetchWithTimeout, handleApiError, isRetryableError, withRetry };
-//# sourceMappingURL=api-client-DsrxK05Z.js.map
+//# sourceMappingURL=api-client-CgZUMukO.js.map

package/dist/api-client-CgZUMukO.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client-CgZUMukO.js","names":["problemDetails: ProblemDetails","response: Response","config: ErrorHandlerConfig","error: ApiError","message: string","type: 'error' | 'success' | 'info'","DEFAULT_RETRY_CONFIG: Required<RetryConfig>","error: unknown","attempt: number","baseDelay: number","maxDelay: number","fn: () => Promise<T>","config?: RetryConfig","lastError: unknown","input: RequestInfo | URL","init?: RequestInit & { timeout?: number }","init?: RequestInit"],"sources":["../src/api-client/error-codes.ts","../src/api-client/error-handler.ts","../src/api-client/retry-handler.ts"],"sourcesContent":["/**\n * Error Codes\n * \n * Generic error codes that apps can use as a starter vocabulary.\n * Domain-specific codes should live in the consuming app.\n */\n\nexport const ErrorCodes = {\n  // Validation\n  Validation: {\n    Failed: 'ValidationFailed',\n  },\n\n  // Identity\n  Identity: {\n    InvalidCredentials: 'InvalidCredentials',\n    UserInactive: 'UserInactive',\n    TenantContextMissing: 'TenantContextMissing',\n    InvalidCurrentPassword: 'InvalidCurrentPassword',\n    OwnerCannotDisableMembership: 'OwnerCannotDisableMembership',\n    CurrentUserMissing: 'CurrentUserMissing',\n    UserNotFound: 'UserNotFound',\n    EmailAlreadyExists: 'EmailAlreadyExists',\n  },\n\n  // Access and entitlement\n  Access: {\n    EntitlementRequired: 'EntitlementRequired',\n    EntitlementExpired: 'EntitlementExpired',\n    FeatureNotAvailable: 'FeatureNotAvailable',\n    TenantContextMissing: 'TenantContextMissing',\n  },\n\n  // General\n  NotFound: 'NotFound',\n  Unauthorized: 'Unauthorized',\n  Forbidden: 'Forbidden',\n  InternalError: 'InternalError',\n} as const;\n","/**\n * Error Handler\n * \n * Centralized error handling with ProblemDetails parsing.\n */\n\nimport type { ProblemDetails, ValidationError } from './types';\nimport { ErrorCodes } from './error-codes';\nimport { logger } from '../logging';\n\n/**\n * API Error Class\n */\nexport class ApiError extends Error {\n  constructor(\n    public problemDetails: ProblemDetails,\n    public response: Response\n  ) {\n    super(problemDetails.detail);\n    this.name = 'ApiError';\n  }\n\n  get code(): string {\n    return this.problemDetails.title;\n  }\n\n  get status(): number {\n    return this.problemDetails.status;\n  }\n\n  get isValidationError(): boolean {\n    return this.code === ErrorCodes.Validation.Failed;\n  }\n\n  get validationErrors(): ValidationError[] {\n    return this.problemDetails.meta?.errors ?? [];\n  }\n\n  get traceId(): string {\n    return this.problemDetails.traceId;\n  }\n}\n\n/**\n * Parse API error response\n */\nexport async function handleApiError(response: Response): Promise<never> {\n  let problemDetails: ProblemDetails;\n\n  try {\n    problemDetails = await response.json();\n  } catch {\n    problemDetails = {\n      type: `https://httpstatuses.com/${response.status}`,\n      title: 'UnknownError',\n      status: response.status,\n      detail: response.statusText || 'An unknown error occurred',\n      traceId: response.headers.get('x-trace-id') ?? 'unknown',\n    };\n  }\n\n  logger.error('API request failed', undefined, {\n    code: problemDetails.title,\n    status: problemDetails.status,\n    detail: problemDetails.detail,\n    traceId: problemDetails.traceId,\n  });\n\n  throw new ApiError(problemDetails, response);\n}\n\n/**\n * Error Handler Configuration\n */\nexport interface ErrorHandlerConfig {\n  handlers?: Partial<Record<string, (error: ApiError) => void>>;\n  showToast?: boolean;\n  toastMessages?: Partial<Record<string, string>>;\n  onError?: (error: ApiError) => void;\n  toast?: (message: string, type: 'error' | 'success' | 'info') => void;\n}\n\n/**\n * Error Handler Class\n */\nexport class ErrorHandler {\n  private config: ErrorHandlerConfig;\n\n  constructor(config: ErrorHandlerConfig = {}) {\n    this.config = {\n      showToast: true,\n      ...config,\n    };\n  }\n\n  handle(error: ApiError): void {\n    const code = error.code;\n\n    logger.error('Handling API Error', undefined, {\n      code,\n      status: error.status,\n      traceId: error.traceId,\n    });\n\n    // Try custom handler first\n    if (this.config.handlers?.[code]) {\n      this.config.handlers[code]!(error);\n      return;\n    }\n\n    // Fallback\n    if (this.config.onError) {\n      this.config.onError(error);\n    } else {\n      this.showDefaultToast(error);\n    }\n  }\n\n  private showToast(message: string, type: 'error' | 'success' | 'info'): void {\n    if (this.config.showToast && this.config.toast) {\n      this.config.toast(message, type);\n    }\n  }\n\n  private showDefaultToast(error: ApiError): void {\n    const message =\n      this.config.toastMessages?.[error.code] ||\n      error.problemDetails.detail ||\n      'An error occurred';\n    this.showToast(message, 'error');\n  }\n}\n\n/**\n * Create global error handler\n */\nexport function createErrorHandler(config?: ErrorHandlerConfig): ErrorHandler {\n  return new ErrorHandler(config);\n}\n\n/**\n * Map validation errors to form fields\n */\nexport function mapValidationErrors(errors: ValidationError[]): Record<string, string> {\n  const mapped: Record<string, string> = {};\n  for (const error of errors) {\n    const fieldName = error.field.charAt(0).toLowerCase() + error.field.slice(1);\n    mapped[fieldName] = error.message;\n  }\n  return mapped;\n}\n","/**\n * Retry Handler\n * \n * Retry logic for API requests.\n */\n\nimport type { RetryConfig } from './types';\n\nconst DEFAULT_RETRY_CONFIG: Required<RetryConfig> = {\n  maxRetries: 3,\n  baseDelay: 1000,\n  maxDelay: 10000,\n  retryCondition: (error: unknown) => {\n    if (error instanceof Response) {\n      return error.status >= 500 || error.status === 429;\n    }\n    return false;\n  },\n};\n\n/**\n * Calculate backoff delay\n */\nexport function calculateBackoffDelay(\n  attempt: number,\n  baseDelay: number,\n  maxDelay: number\n): number {\n  const delay = baseDelay * Math.pow(2, attempt);\n  const jitter = Math.random() * 0.3 * delay;\n  return Math.min(delay + jitter, maxDelay);\n}\n\n/**\n * Check if error is retryable\n */\nexport function isRetryableError(error: unknown): boolean {\n  if (error instanceof Response) {\n    return error.status >= 500 || error.status === 429;\n  }\n  if (error instanceof TypeError) {\n    // Network errors\n    return true;\n  }\n  return false;\n}\n\n/**\n * Execute function with retry logic\n */\nexport async function withRetry<T>(\n  fn: () => Promise<T>,\n  config?: RetryConfig\n): Promise<T> {\n  const { maxRetries, baseDelay, maxDelay, retryCondition } = {\n    ...DEFAULT_RETRY_CONFIG,\n    ...config,\n  };\n\n  let lastError: unknown;\n\n  for (let attempt = 0; attempt <= maxRetries; attempt++) {\n    try {\n      return await fn();\n    } catch (error) {\n      lastError = error;\n\n      if (attempt === maxRetries || !retryCondition(error)) {\n        throw error;\n      }\n\n      const delay = calculateBackoffDelay(attempt, baseDelay, maxDelay);\n      console.log(`Retry attempt ${attempt + 1}/${maxRetries} after ${delay}ms`);\n      await new Promise((resolve) => setTimeout(resolve, delay));\n    }\n  }\n\n  throw lastError;\n}\n\n/**\n * Fetch with timeout\n */\nexport async function fetchWithTimeout(\n  input: RequestInfo | URL,\n  init?: RequestInit & { timeout?: number }\n): Promise<Response> {\n  const { timeout = 30000, ...fetchInit } = init || {};\n\n  const controller = new AbortController();\n  const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n  try {\n    const response = await fetch(input, {\n      ...fetchInit,\n      signal: controller.signal,\n    });\n    return response;\n  } finally {\n    clearTimeout(timeoutId);\n  }\n}\n\n/**\n * Create fetch function with retry\n */\nexport function createRetryFetch(config?: RetryConfig) {\n  return async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {\n    return withRetry(() => fetch(input, init), config);\n  };\n}\n"],"mappings":";;;;;;;;;AAOA,MAAa,aAAa;CAExB,YAAY,EACV,QAAQ,mBACT;CAGD,UAAU;EACR,oBAAoB;EACpB,cAAc;EACd,sBAAsB;EACtB,wBAAwB;EACxB,8BAA8B;EAC9B,oBAAoB;EACpB,cAAc;EACd,oBAAoB;CACrB;CAGD,QAAQ;EACN,qBAAqB;EACrB,oBAAoB;EACpB,qBAAqB;EACrB,sBAAsB;CACvB;CAGD,UAAU;CACV,cAAc;CACd,WAAW;CACX,eAAe;AAChB;;;;;;;ACzBD,IAAa,WAAb,cAA8B,MAAM;CAClC,YACSA,gBACAC,UACP;AACA,QAAM,eAAe,OAAO;EAqI/B,KAxIU;EAwIT,KAvIS;AAGP,OAAK,OAAO;CACb;CAED,IAAI,OAAe;AACjB,SAAO,KAAK,eAAe;CAC5B;CAED,IAAI,SAAiB;AACnB,SAAO,KAAK,eAAe;CAC5B;CAED,IAAI,oBAA6B;AAC/B,SAAO,KAAK,SAAS,WAAW,WAAW;CAC5C;CAED,IAAI,mBAAsC;AACxC,SAAO,KAAK,eAAe,MAAM,UAAU,CAAE;CAC9C;CAED,IAAI,UAAkB;AACpB,SAAO,KAAK,eAAe;CAC5B;AACF;;;;AAKD,eAAsB,eAAeA,UAAoC;CACvE,IAAID;AAEJ,KAAI;AACF,mBAAiB,MAAM,SAAS,MAAM;CACvC,QAAO;AACN,mBAAiB;GACf,OAAO,2BAA2B,SAAS,OAAO;GAClD,OAAO;GACP,QAAQ,SAAS;GACjB,QAAQ,SAAS,cAAc;GAC/B,SAAS,SAAS,QAAQ,IAAI,aAAa,IAAI;EAChD;CACF;AAED,QAAO,MAAM,8BAAiC;EAC5C,MAAM,eAAe;EACrB,QAAQ,eAAe;EACvB,QAAQ,eAAe;EACvB,SAAS,eAAe;CACzB,EAAC;AAEF,OAAM,IAAI,SAAS,gBAAgB;AACpC;;;;AAgBD,IAAa,eAAb,MAA0B;CACxB,AAAQ;CAER,YAAYE,SAA6B,CAAE,GAAE;AAC3C,OAAK,SAAS;GACZ,WAAW;GACX,GAAG;EACJ;CACF;CAED,OAAOC,OAAuB;EAC5B,MAAM,OAAO,MAAM;AAEnB,SAAO,MAAM,8BAAiC;GAC5C;GACA,QAAQ,MAAM;GACd,SAAS,MAAM;EAChB,EAAC;AAGF,MAAI,KAAK,OAAO,WAAW,OAAO;AAChC,QAAK,OAAO,SAAS,MAAO,MAAM;AAClC;EACD;AAGD,MAAI,KAAK,OAAO,QACd,MAAK,OAAO,QAAQ,MAAM;MAE1B,MAAK,iBAAiB,MAAM;CAE/B;CAED,AAAQ,UAAUC,SAAiBC,MAA0C;AAC3E,MAAI,KAAK,OAAO,aAAa,KAAK,OAAO,MACvC,MAAK,OAAO,MAAM,SAAS,KAAK;CAEnC;CAED,AAAQ,iBAAiBF,OAAuB;EAC9C,MAAM,UACJ,KAAK,OAAO,gBAAgB,MAAM,SAClC,MAAM,eAAe,UACrB;AACF,OAAK,UAAU,SAAS,QAAQ;CACjC;AACF;;;;AC3HD,MAAMG,uBAA8C;CAClD,YAAY;CACZ,WAAW;CACX,UAAU;CACV,gBAAgB,CAACC,UAAmB;AAClC,MAAI,iBAAiB,SACnB,QAAO,MAAM,UAAU,OAAO,MAAM,WAAW;AAEjD,SAAO;CACR;AACF;;;;AAKD,SAAgB,sBACdC,SACAC,WACAC,UACQ;CACR,MAAM,QAAQ,YAAY,KAAK,IAAI,GAAG,QAAQ;CAC9C,MAAM,SAAS,KAAK,QAAQ,GAAG,KAAM;AACrC,QAAO,KAAK,IAAI,QAAQ,QAAQ,SAAS;AAC1C;;;;AAKD,SAAgB,iBAAiBH,OAAyB;AACxD,KAAI,iBAAiB,SACnB,QAAO,MAAM,UAAU,OAAO,MAAM,WAAW;AAEjD,KAAI,iBAAiB,UAEnB,QAAO;AAET,QAAO;AACR;;;;AAKD,eAAsB,UACpBI,IACAC,QACY;CACZ,MAAM,EAAE,YAAY,WAAW,UAAU,gBAAgB,GAAG;EAC1D,GAAG;EACH,GAAG;CACJ;CAED,IAAIC;AAEJ,MAAK,IAAI,UAAU,GAAG,WAAW,YAAY,UAC3C,KAAI;AACF,SAAO,MAAM,IAAI;CAClB,SAAQ,OAAO;AACd,cAAY;AAEZ,MAAI,YAAY,eAAe,eAAe,MAAM,CAClD,OAAM;EAGR,MAAM,QAAQ,sBAAsB,SAAS,WAAW,SAAS;AACjE,UAAQ,KAAK,gBAAgB,UAAU,EAAE,GAAG,WAAW,SAAS,MAAM,IAAI;AAC1E,QAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,MAAM;CAC1D;AAGH,OAAM;AACP;;;;AAKD,eAAsB,iBACpBC,OACAC,MACmB;CACnB,MAAM,EAAE,UAAU,IAAO,GAAG,WAAW,GAAG,QAAQ,CAAE;CAEpD,MAAM,aAAa,IAAI;CACvB,MAAM,YAAY,WAAW,MAAM,WAAW,OAAO,EAAE,QAAQ;AAE/D,KAAI;EACF,MAAM,WAAW,MAAM,MAAM,OAAO;GAClC,GAAG;GACH,QAAQ,WAAW;EACpB,EAAC;AACF,SAAO;CACR,UAAS;AACR,eAAa,UAAU;CACxB;AACF;;;;AAKD,SAAgB,iBAAiBH,QAAsB;AACrD,QAAO,OAAOE,OAA0BE,SAA0C;AAChF,SAAO,UAAU,MAAM,MAAM,OAAO,KAAK,EAAE,OAAO;CACnD;AACF"}

package/dist/auth/auth.server.d.ts

@@ -1,5 +1,5 @@
 /**
- * OAuth2/OIDC Authentication Server Module
+ * OpenID Connect Authentication Server Module
  *
  * Handles:
  * - Login flow (PKCE)
@@ -81,25 +81,30 @@ export declare function login(request: Request, returnUrlOrOptions?: string | Lo
  */
 export declare function handleCallback(request: Request): Promise<Response>;
 /**
- * Logout user
+ * Logout user.
  *
- * Backend uses id_token_hint to identify which tokens to revoke.
- *
- * **Scenario 1: Full SSO Logout (Manual Sign Out)**
- * - Query param: sso_logout=true
- * - Result: Full logout + identity cookie cleared
- * - User must re-authenticate everywhere
+ * Default logout follows OIDC RP-Initiated Logout and ends the identity
+ * provider session. Automatic/session-expiry cleanup can request
+ * `/auth/logout?logout=local` to clear only this app's Redis session without
+ * bouncing the browser through the identity provider or revoking SSO tokens.
+ */
+export declare function logout(request: Request): Promise<Response>;
+/**
+ * Handle an OIDC Back-Channel Logout request from Keycloak or another OP.
  *
- * **Scenario 2: Standard Logout (Automatic/Token Expired)**
- * - No sso_logout param
- * - Result: Tokens revoked based on id_token_hint
- * - Backend determines which tokens to revoke
+ * Configure the client Backchannel logout URL to this endpoint. The logout
+ * token is signature-verified against the provider JWKS, issuer/audience are
+ * checked, and all matching local Redis sessions are destroyed by `sid` first,
+ * falling back to `sub` when the OP omits a session id.
+ */
+export declare function handleBackChannelLogout(request: Request): Promise<Response>;
+/**
+ * Handle OIDC Front-Channel Logout iframe/browser requests.
  *
- * Configuration:
- * - `OIDC_SSO_LOGOUT` env var ('true' | 'false') - default behavior
- * - Query param `sso_logout=true` - override for full logout
+ * Front-channel logout cannot carry a signed logout token, so this validates the
+ * issuer and applies local cleanup only when a `sid` is present.
  */
-export declare function logout(request: Request): Promise<Response>;
+export declare function handleFrontChannelLogout(request: Request): Promise<Response>;
 /**
  * Get current user from session
  */

package/dist/auth/auth.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.server.d.ts","sourceRoot":"","sources":["../../src/auth/auth.server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAKL,cAAc,EAKf,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAEV,gBAAgB,EAChB,QAAQ,EAGR,kBAAkB,EAClB,YAAY,EAEZ,SAAS,EACV,MAAM,SAAS,CAAC;AA0NjB;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAgBzE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAI5C;AAkID;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CAkDA;AAkDD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAkB/D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAK/C;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAGtD;AAMD;;;;;GAKG;AACH,wBAAsB,KAAK,CACzB,OAAO,EAAE,OAAO,EAChB,kBAAkB,CAAC,EAAE,MAAM,GAAG,YAAY,GACzC,OAAO,CAAC,QAAQ,CAAC,CAoFnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2NxE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyEhE;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAQxE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWrE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ7E;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,kBAAkB,CAAC,CA4F7B;AAGD,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}
+{"version":3,"file":"auth.server.d.ts","sourceRoot":"","sources":["../../src/auth/auth.server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EAKL,cAAc,EASf,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAEV,gBAAgB,EAChB,QAAQ,EAGR,kBAAkB,EAClB,YAAY,EAKZ,SAAS,EACV,MAAM,SAAS,CAAC;AAijBjB;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAgBzE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAI5C;AAkID;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CAkDA;AAyDD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAkB/D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAK/C;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAGtD;AAMD;;;;;GAKG;AACH,wBAAsB,KAAK,CACzB,OAAO,EAAE,OAAO,EAChB,kBAAkB,CAAC,EAAE,MAAM,GAAG,YAAY,GACzC,OAAO,CAAC,QAAQ,CAAC,CAgGnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0OxE;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkGhE;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8CjF;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmClF;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAQxE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWrE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ7E;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAiD7B;AAGD,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C"}

package/dist/auth/authorization-parameters.d.ts

@@ -0,0 +1,5 @@
+import type { LoginOptions } from './types';
+export declare function sanitizeExtraAuthorizationParameters(params: LoginOptions['extraAuthParams'] | undefined, options?: Pick<LoginOptions, 'extraAuthParamNames' | 'extraAuthParamPrefixes'>): Record<string, string>;
+export declare function normalizePublicAuthorizationStateContext(context: LoginOptions['publicStateContext']): Record<string, string> | null;
+export declare function buildAuthorizationState(baseState: string, publicStateContext: LoginOptions['publicStateContext']): string;
+//# sourceMappingURL=authorization-parameters.d.ts.map

package/dist/auth/authorization-parameters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-parameters.d.ts","sourceRoot":"","sources":["../../src/auth/authorization-parameters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAgC5C,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,YAAY,CAAC,iBAAiB,CAAC,GAAG,SAAS,EACnD,OAAO,GAAE,IAAI,CAAC,YAAY,EAAE,qBAAqB,GAAG,wBAAwB,CAAM,GACjF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCxB;AAED,wBAAgB,wCAAwC,CACtD,OAAO,EAAE,YAAY,CAAC,oBAAoB,CAAC,GAC1C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CA2B/B;AAED,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC,GACrD,MAAM,CAOR"}

package/dist/auth/index.d.ts

@@ -4,5 +4,5 @@
  * Client-side auth types live here.
  * For server-side auth primitives, use `@eminuckan/spine/auth/server`.
  */
-export type { UserInfo, AuthConfig, SessionData, OAuthState, LoginOptions, AuthError, ApplicationType, } from './types';
+export type { UserInfo, AuthSessionSummary, AuthConfig, SessionData, OAuthState, LoginOptions, AuthError, ApplicationType, BackChannelLogoutResult, FrontChannelLogoutResult, OidcClientAuthMethod, } from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,YAAY,EACV,QAAQ,EACR,UAAU,EACV,WAAW,EACX,UAAU,EACV,YAAY,EACZ,SAAS,EACT,eAAe,GAChB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,YAAY,EACV,QAAQ,EACR,kBAAkB,EAClB,UAAU,EACV,WAAW,EACX,UAAU,EACV,YAAY,EACZ,SAAS,EACT,eAAe,EACf,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,SAAS,CAAC"}

package/dist/auth/redis-session-storage.server.d.ts

@@ -5,12 +5,29 @@
  * Provides secure session management with automatic expiration,
  * without depending on a framework-specific session implementation.
  */
-import type { SessionData, OAuthState } from './types';
+import type { AuthSessionSummary, SessionData, OAuthState } from './types';
 export declare const AUTH_ERROR_COOKIE_PREFIX: string;
 export declare function createAuthSession(request: Request, sessionData: Partial<SessionData>): Promise<Headers>;
 export declare function getAuthSession(request: Request): Promise<SessionData>;
 export declare function updateAuthSession(request: Request, updates: Partial<SessionData>): Promise<Headers>;
 export declare function destroyAuthSession(request: Request): Promise<Headers>;
+export declare function getCurrentAuthSessionId(request: Request): Promise<string | null>;
+export declare function getAuthSessionById(sessionId: string): Promise<SessionData | null>;
+export declare function listAuthSessionDataForUser(userId: string): Promise<Array<{
+    sessionId: string;
+    data: SessionData;
+}>>;
+export declare function listAuthSessionsForUser(userId: string, currentSessionId?: string | null): Promise<AuthSessionSummary[]>;
+export declare function listCurrentUserAuthSessions(request: Request): Promise<AuthSessionSummary[]>;
+export declare function destroyAuthSessionById(sessionId: string): Promise<boolean>;
+export declare function destroyAuthSessionsForUser(userId: string): Promise<number>;
+export declare function destroyAuthSessionsBySid(sid: string): Promise<number>;
+export declare function destroyAuthSessionsBySessionState(sessionState: string): Promise<number>;
+export declare function destroyAuthSessionsByIdentitySession(params: {
+    sid?: string;
+    sessionState?: string;
+    userId?: string;
+}): Promise<number>;
 export declare function requireAuthSession(request: Request): Promise<SessionData>;
 export declare function isSessionValid(request: Request): Promise<boolean>;
 export declare function createOAuthState(state: OAuthState): Promise<string>;

package/dist/auth/redis-session-storage.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis-session-storage.server.d.ts","sourceRoot":"","sources":["../../src/auth/redis-session-storage.server.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AA4CvD,eAAO,MAAM,wBAAwB,QAAgE,CAAC;AAyKtG,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,GAChC,OAAO,CAAC,OAAO,CAAC,CAelB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAoB3E;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAS3E;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAQ/E;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBvE;AAMD,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CASzE;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAe/E;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIrE;AAED,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CAejE;AAMD,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAM1D"}
+{"version":3,"file":"redis-session-storage.server.d.ts","sourceRoot":"","sources":["../../src/auth/redis-session-storage.server.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAsD3E,eAAO,MAAM,wBAAwB,QAAgE,CAAC;AA+ctG,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,GAChC,OAAO,CAAC,OAAO,CAAC,CAqBlB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CA4B3E;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAS3E;AAED,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEtF;AAED,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAGvF;AAED,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAAC,CAG1D;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAM/B;AAED,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAOjG;AAED,wBAAsB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQhF;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAWhF;AAED,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAW3E;AAED,wBAAsB,iCAAiC,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAW7F;AAED,wBAAsB,oCAAoC,CAAC,MAAM,EAAE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CAclB;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAQ/E;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBvE;AAMD,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CASzE;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAe/E;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIrE;AAED,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CAejE;AAMD,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAM1D"}

package/dist/auth/route-protection.server.d.ts

@@ -13,6 +13,8 @@ export declare function shouldRefreshToken(request: Request): Promise<boolean>;
  */
 export interface DefaultRouteIdentityContext {
     hasAnyMembership: boolean;
+    hasEntitlement?: boolean;
+    /** @deprecated Use hasEntitlement or app-specific fields instead. */
     hasSubscription: boolean;
     isOnboarded: boolean;
 }
@@ -30,7 +32,9 @@ export interface TenantChecker {
     } | null>;
 }
 /**
- * Subscription checker configuration
+ * Legacy subscription checker configuration
+ *
+ * @deprecated Put entitlement policy in resolveRoute or app-level route loaders.
  */
 export interface SubscriptionChecker {
     checkTenantSubscriptionStatus: (request: Request, tenantId: string) => Promise<boolean>;
@@ -77,7 +81,7 @@ export interface RouteProtectionConfig<TIdentityContext = DefaultRouteIdentityCo
     createAutomaticLogoutRequest?: (context: AutomaticLogoutRequestContext) => Promise<Request> | Request;
 }
 /**
- * Configure route protection with identity/tenant/subscription checkers
+ * Configure route protection with identity, tenant, and app policy checkers
  */
 export declare function configureRouteProtection<TIdentityContext = DefaultRouteIdentityContext>(config: RouteProtectionConfig<TIdentityContext>): void;
 /**
@@ -97,11 +101,23 @@ export declare const publicRoute: <T>(request: Request, loaderFn: (user?: UserIn
  */
 export declare const authRoute: <T>(request: Request, loaderFn: (user: UserInfo) => Promise<T> | T) => Promise<T>;
 /**
- * Onboarding route
+ * Generic policy-protected route. Apps define policy in configureRouteProtection.
+ */
+export declare const policyRoute: <T>(request: Request, loaderFn: (user: UserInfo) => Promise<T> | T) => Promise<T>;
+/**
+ * Alias for auth-protected routes.
+ */
+export declare const protectedRoute: <T>(request: Request, loaderFn: (user: UserInfo) => Promise<T> | T) => Promise<T>;
+/**
+ * Setup policy route
+ *
+ * @deprecated Use policyRoute with configureRouteProtection instead.
  */
 export declare const onboardingRoute: <T>(request: Request, loaderFn: (user: UserInfo) => Promise<T> | T) => Promise<T>;
 /**
- * Subscription route
+ * Entitlement policy route
+ *
+ * @deprecated Use policyRoute with configureRouteProtection instead.
  */
 export declare const subscriptionRoute: <T>(request: Request, loaderFn: (user: UserInfo) => Promise<T> | T) => Promise<T>;
 //# sourceMappingURL=route-protection.server.d.ts.map

package/dist/auth/route-protection.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-protection.server.d.ts","sourceRoot":"","sources":["../../src/auth/route-protection.server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAOzD;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CA4C3E;AAkCD;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB,CAAC,gBAAgB,GAAG,2BAA2B;IACpF,kBAAkB,EAAE,CAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,KACnB,OAAO,CAAC,2BAA2B,GAAG,gBAAgB,CAAC,CAAC;CAC9D;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,gBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/D,gBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChG;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,6BAA6B,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACzF;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,0BAA0B,GAAG,gBAAgB,CAAC;CACvD;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,8BAA8B,CAAC,gBAAgB,GAAG,2BAA2B;IAC5F,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;IAC5B,kBAAkB,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACjF,gBAAgB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C,gBAAgB,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,kCAAkC,CAAC,gBAAgB,GAAG,2BAA2B,CAChG,SAAQ,8BAA8B,CAAC,gBAAgB,CAAC;IACxD,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB,CAAC,gBAAgB,GAAG,2BAA2B;IACnF,eAAe,CAAC,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,YAAY,CAAC,EAAE,CACb,OAAO,EAAE,8BAA8B,CAAC,gBAAgB,CAAC,KACtD,OAAO,CAAC,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5F,gBAAgB,CAAC,EAAE,CACjB,OAAO,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAC1D,OAAO,CAAC,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5F,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,MAAM,CAAC;IAC/D,4BAA4B,CAAC,EAAE,CAC7B,OAAO,EAAE,6BAA6B,KACnC,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACjC;AAID;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,gBAAgB,GAAG,2BAA2B,EACrF,MAAM,EAAE,qBAAqB,CAAC,gBAAgB,CAAC,GAC9C,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AA8OD;;GAEG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,eAAe,EAC3B,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,CA4FZ;AAMD;;GAEG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,EAC3B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACD,CAAC;AAE/C;;GAEG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,EACzB,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACqC,CAAC;AAEpF;;GAEG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,EAC/B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACoD,CAAC;AAEnG;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAAI,CAAC,EACjC,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACsD,CAAC"}
+{"version":3,"file":"route-protection.server.d.ts","sourceRoot":"","sources":["../../src/auth/route-protection.server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAazD;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CA4C3E;AAkCD;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qEAAqE;IACrE,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB,CAAC,gBAAgB,GAAG,2BAA2B;IACpF,kBAAkB,EAAE,CAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,KACnB,OAAO,CAAC,2BAA2B,GAAG,gBAAgB,CAAC,CAAC;CAC9D;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,gBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/D,gBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChG;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,6BAA6B,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACzF;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,0BAA0B,GAAG,gBAAgB,CAAC;CACvD;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,8BAA8B,CAAC,gBAAgB,GAAG,2BAA2B;IAC5F,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;IAC5B,kBAAkB,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACjF,gBAAgB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C,gBAAgB,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,kCAAkC,CAAC,gBAAgB,GAAG,2BAA2B,CAChG,SAAQ,8BAA8B,CAAC,gBAAgB,CAAC;IACxD,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB,CAAC,gBAAgB,GAAG,2BAA2B;IACnF,eAAe,CAAC,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,YAAY,CAAC,EAAE,CACb,OAAO,EAAE,8BAA8B,CAAC,gBAAgB,CAAC,KACtD,OAAO,CAAC,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5F,gBAAgB,CAAC,EAAE,CACjB,OAAO,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAC1D,OAAO,CAAC,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5F,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,MAAM,CAAC;IAC/D,4BAA4B,CAAC,EAAE,CAC7B,OAAO,EAAE,6BAA6B,KACnC,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACjC;AAID;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,gBAAgB,GAAG,2BAA2B,EACrF,MAAM,EAAE,qBAAqB,CAAC,gBAAgB,CAAC,GAC9C,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAmJD;;GAEG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,eAAe,EAC3B,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,CA8EZ;AAMD;;GAEG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,EAC3B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACD,CAAC;AAE/C;;GAEG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,EACzB,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACqC,CAAC;AAEpF;;GAEG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,EAC3B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACuC,CAAC;AAEtF;;GAEG;AACH,eAAO,MAAM,cAAc,GAhBD,CAAC,WAChB,OAAO,YACN,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eAcP,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,EAC/B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACoD,CAAC;AAEnG;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,CAAC,EACjC,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACsD,CAAC"}

package/dist/auth/server.d.ts

@@ -8,6 +8,6 @@ export * from './auth.server';
 export * from './redis-session-storage.server';
 export * from './route-protection.server';
 export * from './token-refresh.server';
-export type { ApplicationType, AuthClaimMapping, AuthConfig, AuthError, LoginOptions, OAuthState, ProtectedLoaderFn, ProtectionLevel, SessionData, SessionFlashData, UserInfo, } from './types';
+export type { ApplicationType, AuthSessionSummary, AuthClaimMapping, AuthConfig, AuthError, BackChannelLogoutResult, FrontChannelLogoutResult, LoginOptions, OAuthState, OidcClientAuthMethod, ProtectedLoaderFn, ProtectionLevel, PublicAuthorizationStateContext, SessionData, SessionFlashData, UserInfo, } from './types';
 export type { TokenRefreshResult as AuthTokenRefreshResult, } from './types';
 //# sourceMappingURL=server.d.ts.map

package/dist/auth/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/auth/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,eAAe,CAAC;AAC9B,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,QAAQ,GACT,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,kBAAkB,IAAI,sBAAsB,GAC7C,MAAM,SAAS,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/auth/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,eAAe,CAAC;AAC9B,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,uBAAuB,EACvB,wBAAwB,EACxB,YAAY,EACZ,UAAU,EACV,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,+BAA+B,EAC/B,WAAW,EACX,gBAAgB,EAChB,QAAQ,GACT,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,kBAAkB,IAAI,sBAAsB,GAC7C,MAAM,SAAS,CAAC"}

package/dist/auth/server.js

@@ -1,6 +1,6 @@
-import "../logging-_h2mi3L9.js";
-import { AUTH_ERROR_COOKIE_PREFIX, cleanupExpiredOAuthStates, closeRedisConnection, createAuthSession, createOAuthState, deleteOAuthState, destroyAuthSession, getAuthSession, getOAuthState, isSessionValid, requireAuthSession, updateAuthSession } from "../redis-session-storage.server-BR_0y-QO.js";
-import { clearAuthErrorHeaders, clearAuthServerCache, configureAuthClaimMapping, extractUserInfo, getAccessToken, getAuthError, getUser, handleCallback, hasAuthError, login, logout, refreshTokens, requireAuth, resetAuthClaimMapping } from "../auth.server-Cx2h2qu3.js";
-import { attemptTokenRefresh, authRoute, configureRouteProtection, isTokenExpiredResponse, onboardingRoute, protectRoute, publicRoute, resetRouteProtectionConfig, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute } from "../server-BHfKHKF_.js";
+import "../logging-DviiAkLx.js";
+import { AUTH_ERROR_COOKIE_PREFIX, cleanupExpiredOAuthStates, closeRedisConnection, createAuthSession, createOAuthState, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, getAuthSession, getAuthSessionById, getCurrentAuthSessionId, getOAuthState, isSessionValid, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, requireAuthSession, updateAuthSession } from "../redis-session-storage.server-v2VcpFsQ.js";
+import { clearAuthErrorHeaders, clearAuthServerCache, configureAuthClaimMapping, extractUserInfo, getAccessToken, getAuthError, getUser, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, login, logout, refreshTokens, requireAuth, resetAuthClaimMapping } from "../auth.server-D5oiz9aF.js";
+import { attemptTokenRefresh, authRoute, configureRouteProtection, isTokenExpiredResponse, onboardingRoute, policyRoute, protectRoute, protectedRoute, publicRoute, resetRouteProtectionConfig, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute } from "../server-B6PCxc-T.js";
 
-export { AUTH_ERROR_COOKIE_PREFIX, attemptTokenRefresh, authRoute, cleanupExpiredOAuthStates, clearAuthErrorHeaders, clearAuthServerCache, closeRedisConnection, configureAuthClaimMapping, configureRouteProtection, createAuthSession, createOAuthState, deleteOAuthState, destroyAuthSession, extractUserInfo, getAccessToken, getAuthError, getAuthSession, getOAuthState, getUser, handleCallback, hasAuthError, isSessionValid, isTokenExpiredResponse, login, logout, onboardingRoute, protectRoute, publicRoute, refreshTokens, requireAuth, requireAuthSession, resetAuthClaimMapping, resetRouteProtectionConfig, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession };
+export { AUTH_ERROR_COOKIE_PREFIX, attemptTokenRefresh, authRoute, cleanupExpiredOAuthStates, clearAuthErrorHeaders, clearAuthServerCache, closeRedisConnection, configureAuthClaimMapping, configureRouteProtection, createAuthSession, createOAuthState, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, extractUserInfo, getAccessToken, getAuthError, getAuthSession, getAuthSessionById, getCurrentAuthSessionId, getOAuthState, getUser, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, isSessionValid, isTokenExpiredResponse, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, login, logout, onboardingRoute, policyRoute, protectRoute, protectedRoute, publicRoute, refreshTokens, requireAuth, requireAuthSession, resetAuthClaimMapping, resetRouteProtectionConfig, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession };