@eminuckan/spine 0.2.2 → 0.3.0

package/dist/auth.server-D5oiz9aF.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.server-D5oiz9aF.js","names":["location: string","init: RedirectResponseInit","key: string","allowedNames: Set<string>","allowedPrefixes: string[]","params: LoginOptions['extraAuthParams'] | undefined","options: Pick<LoginOptions, 'extraAuthParamNames' | 'extraAuthParamPrefixes'>","sanitized: Record<string, string>","context: LoginOptions['publicStateContext']","normalized: Record<string, string>","baseState: string","publicStateContext: LoginOptions['publicStateContext']","config: AuthConfig","applicationType: ApplicationType","value: string | undefined","fallback: OidcClientAuthMethod","OIDC_CONFIG: AuthConfig | null","authServerCache: {\n  configuration: oidc.Configuration;\n  cachedAt: number;\n} | null","token: string | undefined","idToken: string | undefined","expectedIssuer: string","returnUrl: string | null","request: Request","returnUrl: string","action: string | null | undefined","status: string | null | undefined","path: string","authority: string","error: unknown","url: URL","redirectUrl: string","configuration: oidc.Configuration","tokenTypeHint: 'access_token' | 'refresh_token'","sessionData: SessionData","userId: string","tokenResult: OidcTokenResponse","jwksUri: string","payload: Record<string, unknown>","clientId: string","DEFAULT_AUTH_CLAIM_MAPPING: Required<AuthClaimMapping>","authClaimMapping: Required<AuthClaimMapping>","keys?: string[]","mapping: AuthClaimMapping","claims: Record<string, unknown>","claimKeys: string[]","value: string","value: unknown","tenants: string[]","tenantRoles: Record<string, string[]>","parsedRoles: unknown","baseUser: UserInfo","returnUrlOrOptions?: string | LoginOptions","options: LoginOptions","headers","oauthState: OAuthState","authorizationParameters: Record<string, string>","cookies","oauthStateRegex","cookieMatch","stateId","oauthState","stateAge","redirectUrl","redirectUri","baseUrl","logoutParameters: Record<string, string>","result: BackChannelLogoutResult","result: FrontChannelLogoutResult","refreshToken?: string"],"sources":["../src/http/response.ts","../src/auth/authorization-parameters.ts","../src/auth/auth.server.ts"],"sourcesContent":["/**\n * HTTP response helpers that stay framework-agnostic.\n */\n\nexport interface RedirectResponseInit {\n  headers?: HeadersInit;\n  status?: number;\n}\n\n/**\n * Create a redirect response without relying on a router/framework helper.\n */\nexport function createRedirectResponse(\n  location: string,\n  init: RedirectResponseInit = {}\n): Response {\n  const headers = new Headers(init.headers);\n  headers.set('Location', location);\n\n  return new Response(null, {\n    status: init.status ?? 302,\n    headers,\n  });\n}\n","import type { LoginOptions } from './types';\n\nconst RESERVED_AUTHORIZATION_PARAMETER_NAMES = new Set([\n  'client_id',\n  'code_challenge',\n  'code_challenge_method',\n  'kc_action',\n  'nonce',\n  'prompt',\n  'redirect_uri',\n  'response_mode',\n  'response_type',\n  'scope',\n  'state',\n]);\n\nconst DEFAULT_EXTRA_AUTHORIZATION_PARAMETER_NAMES = new Set([\n  'acr_values',\n  'kc_idp_hint',\n  'login_hint',\n  'ui_locales',\n]);\n\nfunction isAllowedExtraAuthorizationParameter(\n  key: string,\n  allowedNames: Set<string>,\n  allowedPrefixes: string[]\n): boolean {\n  const normalized = key.toLowerCase();\n  return allowedNames.has(normalized) || allowedPrefixes.some((prefix) => normalized.startsWith(prefix));\n}\n\nexport function sanitizeExtraAuthorizationParameters(\n  params: LoginOptions['extraAuthParams'] | undefined,\n  options: Pick<LoginOptions, 'extraAuthParamNames' | 'extraAuthParamPrefixes'> = {}\n): Record<string, string> {\n  if (!params) {\n    return {};\n  }\n\n  const allowedNames = new Set([\n    ...DEFAULT_EXTRA_AUTHORIZATION_PARAMETER_NAMES,\n    ...(options.extraAuthParamNames ?? []).map((name) => name.trim().toLowerCase()).filter(Boolean),\n  ]);\n  const allowedPrefixes = (options.extraAuthParamPrefixes ?? [])\n    .map((prefix) => prefix.trim().toLowerCase())\n    .filter(Boolean);\n  const sanitized: Record<string, string> = {};\n\n  for (const [key, value] of Object.entries(params)) {\n    const normalizedKey = key.trim();\n    if (\n      normalizedKey.length === 0 ||\n      RESERVED_AUTHORIZATION_PARAMETER_NAMES.has(normalizedKey.toLowerCase()) ||\n      !isAllowedExtraAuthorizationParameter(normalizedKey, allowedNames, allowedPrefixes) ||\n      value === null ||\n      value === undefined\n    ) {\n      continue;\n    }\n\n    const normalizedValue = String(value).trim();\n    if (normalizedValue.length === 0) {\n      continue;\n    }\n\n    sanitized[normalizedKey] = normalizedValue;\n  }\n\n  return sanitized;\n}\n\nexport function normalizePublicAuthorizationStateContext(\n  context: LoginOptions['publicStateContext']\n): Record<string, string> | null {\n  if (!context) {\n    return null;\n  }\n\n  const normalized: Record<string, string> = {};\n\n  for (const [key, value] of Object.entries(context)) {\n    const normalizedKey = key.trim();\n    if (\n      normalizedKey.length === 0 ||\n      RESERVED_AUTHORIZATION_PARAMETER_NAMES.has(normalizedKey.toLowerCase()) ||\n      value === null ||\n      value === undefined\n    ) {\n      continue;\n    }\n\n    const normalizedValue = String(value).trim();\n    if (normalizedValue.length === 0) {\n      continue;\n    }\n\n    normalized[normalizedKey] = normalizedValue;\n  }\n\n  return Object.keys(normalized).length > 0 ? normalized : null;\n}\n\nexport function buildAuthorizationState(\n  baseState: string,\n  publicStateContext: LoginOptions['publicStateContext']\n): string {\n  const normalizedContext = normalizePublicAuthorizationStateContext(publicStateContext);\n  if (!normalizedContext) {\n    return baseState;\n  }\n\n  return `${baseState}.${Buffer.from(JSON.stringify(normalizedContext), 'utf8').toString('base64url')}`;\n}\n","/**\n * OpenID Connect Authentication Server Module\n *\n * Handles:\n * - Login flow (PKCE)\n * - Token exchange\n * - Token refresh\n * - Logout\n * - Session management\n */\n\nimport * as oidc from 'openid-client';\nimport { createRemoteJWKSet, jwtVerify } from 'jose';\n\nimport {\n  createAuthSession,\n  getAuthSession,\n  updateAuthSession,\n  destroyAuthSession,\n  isSessionValid,\n  listAuthSessionDataForUser,\n  destroyAuthSessionsByIdentitySession,\n  destroyAuthSessionsBySid,\n  destroyAuthSessionsForUser,\n  createOAuthState,\n  getOAuthState,\n  deleteOAuthState,\n  AUTH_ERROR_COOKIE_PREFIX,\n} from './redis-session-storage.server';\nimport type { \n  AuthConfig, \n  AuthClaimMapping,\n  UserInfo, \n  SessionData, \n  OAuthState,\n  TokenRefreshResult,\n  LoginOptions,\n  ApplicationType,\n  OidcClientAuthMethod,\n  BackChannelLogoutResult,\n  FrontChannelLogoutResult,\n  AuthError\n} from './types';\nimport { logger } from '../logging';\nimport { createRedirectResponse } from '../http/response';\nimport {\n  buildAuthorizationState,\n  sanitizeExtraAuthorizationParameters,\n} from './authorization-parameters';\n\ntype OidcTokenResponse = oidc.TokenEndpointResponse & oidc.TokenEndpointResponseHelpers;\ntype LogoutScope = 'identity' | 'local' | 'all';\n\n// ============================================================================\n// Configuration\n// ============================================================================\n\n/**\n * Get effective hasLandingPage setting based on config\n */\nfunction getEffectiveHasLandingPage(config: AuthConfig): boolean {\n  // Explicit setting takes precedence\n  if (config.hasLandingPage !== undefined) {\n    return config.hasLandingPage;\n  }\n  \n  // Determine by application type\n  switch (config.applicationType) {\n    case 'no-landing-page':\n    case 'dashboard':\n      return false; // Dashboard has no landing page\n    case 'landing-page':\n    case 'tenant-app':\n      return true; // Tenant app has landing page\n    default:\n      return true; // Default to having a landing page\n  }\n}\n\n/**\n * Create OAuth configuration from environment variables\n */\nfunction createAuthConfig(): AuthConfig {\n  const requiredEnvVars = {\n    authority: process.env.OIDC_AUTHORITY,\n    clientId: process.env.OIDC_CLIENT_ID,\n    redirectUri: process.env.OIDC_REDIRECT_URI,\n  };\n\n  for (const [key, value] of Object.entries(requiredEnvVars)) {\n    if (!value) {\n      throw new Error(`Missing required environment variable: OIDC_${key.toUpperCase()}`);\n    }\n  }\n\n  // Parse application type from env\n  const appTypeEnv = process.env.OIDC_APPLICATION_TYPE?.toLowerCase();\n  let applicationType: ApplicationType = 'custom';\n  if (appTypeEnv === 'no-landing-page' || appTypeEnv === 'no_landing_page') {\n    applicationType = 'no-landing-page';\n  } else if (appTypeEnv === 'landing-page' || appTypeEnv === 'landing_page') {\n    applicationType = 'landing-page';\n  } else if (appTypeEnv === 'dashboard') {\n    applicationType = 'dashboard';\n  } else if (appTypeEnv === 'tenant-app' || appTypeEnv === 'tenant_app') {\n    applicationType = 'tenant-app';\n  }\n\n  const clientAuthMethod = parseOidcClientAuthMethod(\n    process.env.OIDC_CLIENT_AUTH_METHOD,\n    process.env.OIDC_CLIENT_SECRET ? 'client_secret_post' : 'none'\n  );\n\n  const hasLandingPage = process.env.OIDC_HAS_LANDING_PAGE !== undefined\n    ? process.env.OIDC_HAS_LANDING_PAGE === 'true'\n    : undefined;\n\n  return {\n    authority: requiredEnvVars.authority!,\n    clientId: requiredEnvVars.clientId!,\n    clientSecret: process.env.OIDC_CLIENT_SECRET,\n    clientAuthMethod,\n    redirectUri: requiredEnvVars.redirectUri!,\n    scope: process.env.OIDC_SCOPE || 'openid profile email api',\n    postLogoutRedirectUri: process.env.OIDC_POST_LOGOUT_REDIRECT_URI,\n    applicationType,\n    hasLandingPage,\n  };\n}\n\nfunction parseOidcClientAuthMethod(\n  value: string | undefined,\n  fallback: OidcClientAuthMethod\n): OidcClientAuthMethod {\n  const normalized = value?.trim().toLowerCase();\n\n  switch (normalized) {\n    case undefined:\n    case '':\n      return fallback;\n    case 'none':\n      return 'none';\n    case 'client_secret_post':\n    case 'post':\n      return 'client_secret_post';\n    case 'client_secret_basic':\n    case 'basic':\n      return 'client_secret_basic';\n    default:\n      throw new Error(`Unsupported OIDC_CLIENT_AUTH_METHOD: ${value}`);\n  }\n}\n\nlet OIDC_CONFIG: AuthConfig | null = null;\n\nfunction getAuthConfig(): AuthConfig {\n  if (!OIDC_CONFIG) {\n    OIDC_CONFIG = createAuthConfig();\n  }\n  return OIDC_CONFIG;\n}\n\n// ============================================================================\n// OAuth Discovery Cache\n// ============================================================================\n\nlet authServerCache: {\n  configuration: oidc.Configuration;\n  cachedAt: number;\n} | null = null;\n\nconst CACHE_TTL = 60 * 60 * 1000; // 1 hour\nconst jwksCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\nfunction normalizeIssuer(value: string | undefined): string | null {\n  const normalized = value?.trim().replace(/\\/+$/, '');\n  return normalized && normalized.length > 0 ? normalized : null;\n}\n\nfunction getJwtClaims(token: string | undefined): Record<string, unknown> | null {\n  if (!token) {\n    return null;\n  }\n\n  try {\n    const [, payload] = token.split('.');\n    if (!payload) {\n      return null;\n    }\n\n    return JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nfunction getJwtIssuer(token: string | undefined): string | null {\n  const issuer = getJwtClaims(token)?.iss;\n  return typeof issuer === 'string' ? normalizeIssuer(issuer) : null;\n}\n\nfunction canUseIdTokenHint(idToken: string | undefined, expectedIssuer: string): boolean {\n  if (!idToken) {\n    return false;\n  }\n\n  const tokenIssuer = getJwtIssuer(idToken);\n  return tokenIssuer !== null && tokenIssuer === normalizeIssuer(expectedIssuer);\n}\n\nfunction sanitizeLogoutReturnUrl(returnUrl: string | null, request: Request): string | null {\n  if (!returnUrl) {\n    return null;\n  }\n\n  try {\n    const requestUrl = new URL(request.url);\n    const decodedReturnUrl = decodeURIComponent(returnUrl);\n\n    if (decodedReturnUrl.startsWith('/') && !decodedReturnUrl.startsWith('//')) {\n      return isAuthLoopPath(decodedReturnUrl) ? null : decodedReturnUrl;\n    }\n\n    const candidateUrl = new URL(decodedReturnUrl);\n    if (candidateUrl.origin !== requestUrl.origin) {\n      return null;\n    }\n\n    const sameOriginPath = `${candidateUrl.pathname}${candidateUrl.search}${candidateUrl.hash}`;\n    return isAuthLoopPath(sameOriginPath) ? null : sameOriginPath;\n  } catch {\n    return null;\n  }\n}\n\nfunction appendApplicationInitiatedActionResult(\n  returnUrl: string,\n  action: string | null | undefined,\n  status: string | null | undefined\n): string {\n  if (!action && !status) {\n    return returnUrl;\n  }\n\n  try {\n    const isRelative = returnUrl.startsWith('/') && !returnUrl.startsWith('//');\n    const url = new URL(returnUrl, isRelative ? 'http://spine.local' : undefined);\n\n    if (action) {\n      url.searchParams.set('kc_action', action);\n    }\n\n    if (status) {\n      url.searchParams.set('kc_action_status', status);\n    }\n\n    return isRelative ? `${url.pathname}${url.search}${url.hash}` : url.toString();\n  } catch {\n    const params = new URLSearchParams();\n    if (action) params.set('kc_action', action);\n    if (status) params.set('kc_action_status', status);\n    const separator = returnUrl.includes('?') ? '&' : '?';\n    return `${returnUrl}${separator}${params.toString()}`;\n  }\n}\n\nfunction isAuthLoopPath(path: string): boolean {\n  const normalized = path.split('#')[0].split('?')[0].replace(/\\/+$/, '') || '/';\n  return normalized === '/auth/logout' || normalized === '/auth/callback';\n}\n\nfunction isLocalInsecureIssuer(authority: string): boolean {\n  try {\n    const issuer = new URL(authority);\n    return (\n      issuer.protocol === 'http:' &&\n      ['localhost', '127.0.0.1', '::1', '[::1]'].includes(issuer.hostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction shouldAllowInsecureOidcRequests(authority: string): boolean {\n  if (process.env.NODE_ENV === 'production') {\n    return false;\n  }\n\n  if (process.env.OIDC_ALLOW_INSECURE_REQUESTS === 'true') {\n    return true;\n  }\n\n  return isLocalInsecureIssuer(authority);\n}\n\nfunction getDiscoveryOptions(): oidc.DiscoveryRequestOptions {\n  const config = getAuthConfig();\n\n  return shouldAllowInsecureOidcRequests(config.authority)\n    ? { algorithm: 'oidc', execute: [oidc.allowInsecureRequests] }\n    : { algorithm: 'oidc' };\n}\n\nfunction getClientMetadata(config: AuthConfig): string | undefined {\n  return config.clientAuthMethod === 'none' ? undefined : config.clientSecret;\n}\n\nfunction getClientAuthentication(config: AuthConfig): oidc.ClientAuth {\n  switch (config.clientAuthMethod) {\n    case 'client_secret_basic':\n      if (!config.clientSecret) {\n        throw new Error('OIDC_CLIENT_SECRET is required for client_secret_basic authentication');\n      }\n\n      return oidc.ClientSecretBasic(config.clientSecret);\n    case 'client_secret_post':\n      if (!config.clientSecret) {\n        throw new Error('OIDC_CLIENT_SECRET is required for client_secret_post authentication');\n      }\n\n      return oidc.ClientSecretPost(config.clientSecret);\n    case 'none':\n    default:\n      return oidc.None();\n  }\n}\n\nfunction getOAuthErrorMessage(error: unknown): string {\n  if (error instanceof oidc.ResponseBodyError) {\n    return error.error_description || error.error || error.message;\n  }\n\n  if (error instanceof Error) {\n    return error.message;\n  }\n\n  return 'Unknown error';\n}\n\nfunction shouldLogoutAfterOAuthError(error: unknown): boolean {\n  if (error instanceof oidc.ResponseBodyError) {\n    return (\n      error.status === 400 ||\n      error.status === 401 ||\n      error.error === 'invalid_grant' ||\n      error.error === 'invalid_token'\n    );\n  }\n\n  const message = error instanceof Error ? error.message.toLowerCase() : '';\n  return message.includes('invalid_grant') || message.includes('invalid_token') || message.includes('unauthorized');\n}\n\nfunction getLogoutScope(url: URL): LogoutScope {\n  const requestedScope =\n    url.searchParams.get('logout') ??\n    url.searchParams.get('logout_scope') ??\n    url.searchParams.get('scope');\n  const normalized = requestedScope?.trim().toLowerCase();\n\n  if (\n    normalized === 'local' ||\n    normalized === 'application' ||\n    normalized === 'app' ||\n    normalized === 'current-device'\n  ) {\n    return 'local';\n  }\n\n  if (\n    normalized === 'all' ||\n    normalized === 'all-local' ||\n    normalized === 'all-devices' ||\n    normalized === 'everywhere'\n  ) {\n    return 'all';\n  }\n\n  if (url.searchParams.get('local_only') === 'true' || url.searchParams.get('client_id_only') === 'true') {\n    return 'local';\n  }\n\n  return 'identity';\n}\n\nfunction getAbsoluteRedirectUrl(request: Request, redirectUrl: string): string {\n  if (/^https?:\\/\\//i.test(redirectUrl)) {\n    return redirectUrl;\n  }\n\n  return new URL(redirectUrl, new URL(request.url).origin).toString();\n}\n\nasync function revokeTokenBestEffort(\n  configuration: oidc.Configuration,\n  token: string | undefined,\n  tokenTypeHint: 'access_token' | 'refresh_token'\n): Promise<void> {\n  if (!token) {\n    return;\n  }\n\n  try {\n    await oidc.tokenRevocation(configuration, token, {\n      token_type_hint: tokenTypeHint,\n    });\n  } catch (error) {\n    logger.warn('OIDC token revocation failed', {\n      tokenTypeHint,\n      error: getOAuthErrorMessage(error),\n    });\n  }\n}\n\nasync function revokeSessionTokensBestEffort(sessionData: SessionData): Promise<void> {\n  if (!sessionData.refreshToken && !sessionData.accessToken) {\n    return;\n  }\n\n  try {\n    const configuration = await getOAuthConfig();\n    await revokeTokenBestEffort(configuration, sessionData.refreshToken, 'refresh_token');\n    await revokeTokenBestEffort(configuration, sessionData.accessToken, 'access_token');\n  } catch (error) {\n    logger.warn('Skipping OIDC token revocation because provider configuration is unavailable', {\n      error: getOAuthErrorMessage(error),\n    });\n  }\n}\n\nasync function revokeAndDestroyAllUserSessionsBestEffort(userId: string): Promise<number> {\n  const sessions = await listAuthSessionDataForUser(userId);\n\n  try {\n    const configuration = await getOAuthConfig();\n    for (const { data } of sessions) {\n      await revokeTokenBestEffort(configuration, data.refreshToken, 'refresh_token');\n      await revokeTokenBestEffort(configuration, data.accessToken, 'access_token');\n    }\n  } catch (error) {\n    logger.warn('Skipping all-session token revocation because provider configuration is unavailable', {\n      error: getOAuthErrorMessage(error),\n    });\n  }\n\n  return await destroyAuthSessionsForUser(userId);\n}\n\nfunction getClaimsFromTokenResponse(tokenResult: OidcTokenResponse): Record<string, unknown> {\n  const claims = tokenResult.claims();\n\n  if (claims) {\n    return claims as Record<string, unknown>;\n  }\n\n  return getJwtClaims(tokenResult.id_token) ?? {};\n}\n\n/**\n * Get OIDC configuration with caching.\n */\nasync function getOAuthConfig(): Promise<oidc.Configuration> {\n  const config = getAuthConfig();\n  const now = Date.now();\n\n  if (authServerCache && now - authServerCache.cachedAt < CACHE_TTL) {\n    return authServerCache.configuration;\n  }\n\n  try {\n    const configuration = await oidc.discovery(\n      new URL(config.authority),\n      config.clientId,\n      getClientMetadata(config),\n      getClientAuthentication(config),\n      getDiscoveryOptions()\n    );\n\n    authServerCache = {\n      configuration,\n      cachedAt: now,\n    };\n\n    logger.info('OIDC discovery completed successfully', {\n      issuer: configuration.serverMetadata().issuer,\n      clientId: config.clientId,\n      clientAuthMethod: config.clientAuthMethod,\n    });\n    return configuration;\n  } catch (error) {\n    logger.error('OIDC discovery failed', error instanceof Error ? error : undefined, {\n      authority: config.authority,\n      clientId: config.clientId,\n    });\n    throw new Error(`OIDC discovery failed: ${getOAuthErrorMessage(error)}`);\n  }\n}\n\nfunction getJwks(jwksUri: string): ReturnType<typeof createRemoteJWKSet> {\n  const cachedJwks = jwksCache.get(jwksUri);\n  if (cachedJwks) {\n    return cachedJwks;\n  }\n\n  const jwks = createRemoteJWKSet(new URL(jwksUri));\n  jwksCache.set(jwksUri, jwks);\n  return jwks;\n}\n\nasync function getLogoutTokenFromRequest(request: Request): Promise<string | null> {\n  const contentType = request.headers.get('content-type') ?? '';\n\n  if (contentType.includes('application/json')) {\n    const body = await request.json().catch(() => null) as { logout_token?: unknown } | null;\n    return typeof body?.logout_token === 'string' ? body.logout_token : null;\n  }\n\n  const formData = await request.formData().catch(() => null);\n  const logoutToken = formData?.get('logout_token');\n  return typeof logoutToken === 'string' ? logoutToken : null;\n}\n\nfunction validateBackChannelLogoutClaims(payload: Record<string, unknown>, clientId: string): {\n  issuer?: string;\n  subject?: string;\n  sid?: string;\n} {\n  const events = payload.events;\n  const hasBackChannelEvent =\n    events &&\n    typeof events === 'object' &&\n    !Array.isArray(events) &&\n    'http://schemas.openid.net/event/backchannel-logout' in events;\n\n  if (!hasBackChannelEvent) {\n    throw new Error('Invalid back-channel logout token: missing back-channel logout event');\n  }\n\n  if ('nonce' in payload) {\n    throw new Error('Invalid back-channel logout token: nonce is not allowed');\n  }\n\n  const audience = payload.aud;\n  const hasClientAudience = Array.isArray(audience)\n    ? audience.includes(clientId)\n    : audience === clientId;\n\n  if (!hasClientAudience) {\n    throw new Error('Invalid back-channel logout token: audience mismatch');\n  }\n\n  const subject = typeof payload.sub === 'string' ? payload.sub : undefined;\n  const sid = typeof payload.sid === 'string' ? payload.sid : undefined;\n\n  if (!subject && !sid) {\n    throw new Error('Invalid back-channel logout token: subject or sid is required');\n  }\n\n  return {\n    issuer: typeof payload.iss === 'string' ? payload.iss : undefined,\n    subject,\n    sid,\n  };\n}\n\n// ============================================================================\n// Claim Extraction\n// ============================================================================\n\nconst DEFAULT_AUTH_CLAIM_MAPPING: Required<AuthClaimMapping> = {\n  subject: ['sub'],\n  name: ['name', 'preferred_username', 'email'],\n  email: ['email'],\n  givenName: ['given_name', 'givenName'],\n  familyName: ['family_name', 'familyName'],\n  picture: ['picture', 'avatar_url'],\n  locale: ['locale'],\n  zoneinfo: ['zoneinfo'],\n  updatedAt: ['updated_at'],\n  tenantIds: ['tenant_ids'],\n  tenantRoles: ['tenant_roles'],\n  permissions: ['app_perms', 'permissions', 'scope'],\n  isOnboarded: ['is_onboarded'],\n};\n\nlet authClaimMapping: Required<AuthClaimMapping> = {\n  ...DEFAULT_AUTH_CLAIM_MAPPING,\n};\n\nfunction normalizeClaimKeys(keys?: string[]): string[] {\n  if (!Array.isArray(keys)) {\n    return [];\n  }\n\n  return Array.from(\n    new Set(\n      keys\n        .map((key) => key.trim())\n        .filter((key) => key.length > 0)\n    )\n  );\n}\n\n/**\n * Configure claim mapping so different providers/backends can project their\n * own claim names onto the shared auth/session primitives.\n */\nexport function configureAuthClaimMapping(mapping: AuthClaimMapping): void {\n  authClaimMapping = {\n    subject: mapping.subject !== undefined ? normalizeClaimKeys(mapping.subject) : DEFAULT_AUTH_CLAIM_MAPPING.subject,\n    name: mapping.name !== undefined ? normalizeClaimKeys(mapping.name) : DEFAULT_AUTH_CLAIM_MAPPING.name,\n    email: mapping.email !== undefined ? normalizeClaimKeys(mapping.email) : DEFAULT_AUTH_CLAIM_MAPPING.email,\n    givenName: mapping.givenName !== undefined ? normalizeClaimKeys(mapping.givenName) : DEFAULT_AUTH_CLAIM_MAPPING.givenName,\n    familyName: mapping.familyName !== undefined ? normalizeClaimKeys(mapping.familyName) : DEFAULT_AUTH_CLAIM_MAPPING.familyName,\n    picture: mapping.picture !== undefined ? normalizeClaimKeys(mapping.picture) : DEFAULT_AUTH_CLAIM_MAPPING.picture,\n    locale: mapping.locale !== undefined ? normalizeClaimKeys(mapping.locale) : DEFAULT_AUTH_CLAIM_MAPPING.locale,\n    zoneinfo: mapping.zoneinfo !== undefined ? normalizeClaimKeys(mapping.zoneinfo) : DEFAULT_AUTH_CLAIM_MAPPING.zoneinfo,\n    updatedAt: mapping.updatedAt !== undefined ? normalizeClaimKeys(mapping.updatedAt) : DEFAULT_AUTH_CLAIM_MAPPING.updatedAt,\n    tenantIds: mapping.tenantIds !== undefined ? normalizeClaimKeys(mapping.tenantIds) : DEFAULT_AUTH_CLAIM_MAPPING.tenantIds,\n    tenantRoles: mapping.tenantRoles !== undefined ? normalizeClaimKeys(mapping.tenantRoles) : DEFAULT_AUTH_CLAIM_MAPPING.tenantRoles,\n    permissions: mapping.permissions !== undefined ? normalizeClaimKeys(mapping.permissions) : DEFAULT_AUTH_CLAIM_MAPPING.permissions,\n    isOnboarded: mapping.isOnboarded !== undefined ? normalizeClaimKeys(mapping.isOnboarded) : DEFAULT_AUTH_CLAIM_MAPPING.isOnboarded,\n  };\n}\n\n/**\n * Reset claim mapping to the built-in defaults.\n */\nexport function resetAuthClaimMapping(): void {\n  authClaimMapping = {\n    ...DEFAULT_AUTH_CLAIM_MAPPING,\n  };\n}\n\nfunction getConfiguredAuthClaimMapping(): Required<AuthClaimMapping> {\n  return authClaimMapping;\n}\n\nfunction getFirstClaimValue(\n  claims: Record<string, unknown>,\n  claimKeys: string[]\n): { key?: string; value?: unknown } {\n  for (const claimKey of claimKeys) {\n    if (claimKey in claims) {\n      return {\n        key: claimKey,\n        value: claims[claimKey],\n      };\n    }\n  }\n\n  return {};\n}\n\nfunction getStringClaim(claims: Record<string, unknown>, claimKeys: string[]): string | undefined {\n  const { value } = getFirstClaimValue(claims, claimKeys);\n\n  if (typeof value === 'string') {\n    const trimmed = value.trim();\n    return trimmed.length > 0 ? trimmed : undefined;\n  }\n\n  if (typeof value === 'number' || typeof value === 'boolean') {\n    return `${value}`;\n  }\n\n  return undefined;\n}\n\nfunction getNumberClaim(claims: Record<string, unknown>, claimKeys: string[]): number | undefined {\n  const { value } = getFirstClaimValue(claims, claimKeys);\n\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    return value;\n  }\n\n  if (typeof value === 'string') {\n    const parsed = Number(value);\n    return Number.isFinite(parsed) ? parsed : undefined;\n  }\n\n  return undefined;\n}\n\nfunction getBooleanClaim(\n  claims: Record<string, unknown>,\n  claimKeys: string[],\n  defaultValue = false\n): boolean {\n  const { value } = getFirstClaimValue(claims, claimKeys);\n\n  if (typeof value === 'boolean') {\n    return value;\n  }\n\n  if (typeof value === 'string') {\n    return value.toLowerCase() === 'true';\n  }\n\n  return defaultValue;\n}\n\n/**\n * Parse JSON safely\n */\nfunction parseJson(value: string): unknown {\n  try {\n    return JSON.parse(value);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Convert value to string array\n */\nfunction toStringArray(value: unknown): string[] {\n  if (!value) return [];\n\n  if (Array.isArray(value)) {\n    return value\n      .map((item) => (typeof item === 'string' ? item.trim() : `${item}`.trim()))\n      .filter((item) => item.length > 0);\n  }\n\n  if (typeof value === 'string') {\n    const trimmed = value.trim();\n    if (!trimmed) return [];\n\n    if (trimmed.startsWith('[')) {\n      const parsed = parseJson(trimmed);\n      if (Array.isArray(parsed)) {\n        return parsed\n          .map((item) => (typeof item === 'string' ? item.trim() : `${item}`.trim()))\n          .filter((item) => item.length > 0);\n      }\n    }\n\n    if (trimmed.includes(',')) {\n      return trimmed\n        .split(',')\n        .map((item) => item.trim())\n        .filter((item) => item.length > 0);\n    }\n\n    return [trimmed];\n  }\n\n  return [];\n}\n\nfunction toScopeArray(value: unknown): string[] {\n  if (typeof value === 'string') {\n    return value\n      .trim()\n      .split(/\\s+/)\n      .filter((item) => item.length > 0);\n  }\n\n  return toStringArray(value);\n}\n\n/**\n * Extract user info from ID token claims\n */\nexport function extractUserInfo(claims: Record<string, unknown>): {\n  tenants: string[];\n  currentTenant?: string;\n  isOnboarded: boolean;\n  tenantRoles: Record<string, string[]>;\n  permissions: string[];\n} {\n  const claimMapping = getConfiguredAuthClaimMapping();\n\n  // Extract tenant IDs\n  let tenants: string[] = [];\n  const { value: rawTenantIds } = getFirstClaimValue(claims, claimMapping.tenantIds);\n  if (rawTenantIds !== undefined) {\n    if (typeof rawTenantIds === 'string' && rawTenantIds.trim().startsWith('[')) {\n      const parsed = parseJson(rawTenantIds.trim());\n      if (Array.isArray(parsed)) {\n        tenants = parsed\n          .map((id) => (typeof id === 'string' ? id.trim() : `${id}`.trim()))\n          .filter((id) => id.length > 0);\n      }\n    } else {\n      tenants = toStringArray(rawTenantIds);\n    }\n  }\n\n  // Extract tenant roles\n  const tenantRoles: Record<string, string[]> = {};\n  const { value: rawRoles } = getFirstClaimValue(claims, claimMapping.tenantRoles);\n  if (rawRoles !== undefined) {\n    let parsedRoles: unknown = rawRoles;\n\n    if (typeof rawRoles === 'string' && rawRoles.trim().startsWith('{')) {\n      parsedRoles = parseJson(rawRoles.trim()) ?? rawRoles;\n    }\n\n    if (parsedRoles && typeof parsedRoles === 'object' && !Array.isArray(parsedRoles)) {\n      for (const [tenantId, roleValue] of Object.entries(parsedRoles as Record<string, unknown>)) {\n        const roleIds = toStringArray(roleValue);\n        if (roleIds.length > 0) {\n          tenantRoles[tenantId] = roleIds;\n        }\n      }\n    }\n  }\n\n  // Extract permissions\n  const permissionClaim = getFirstClaimValue(claims, claimMapping.permissions);\n  const permissions =\n    permissionClaim.key === 'scope'\n      ? toScopeArray(permissionClaim.value)\n      : toStringArray(permissionClaim.value);\n\n  // Extract onboarding status\n  const isOnboarded = getBooleanClaim(claims, claimMapping.isOnboarded);\n\n  return { tenants, isOnboarded, tenantRoles, permissions };\n}\n\n// ============================================================================\n// Session Data Creation\n// ============================================================================\n\n/**\n * Create session data from token result\n */\nasync function createSessionData(\n  tokenResult: OidcTokenResponse,\n  claims: Record<string, unknown>\n): Promise<Partial<SessionData>> {\n  const claimMapping = getConfiguredAuthClaimMapping();\n  const baseUser: UserInfo = {\n    sub: getStringClaim(claims, claimMapping.subject) || 'unknown',\n    name: getStringClaim(claims, claimMapping.name) || getStringClaim(claims, claimMapping.email) || 'User',\n    email: getStringClaim(claims, claimMapping.email),\n    givenName: getStringClaim(claims, claimMapping.givenName),\n    familyName: getStringClaim(claims, claimMapping.familyName),\n    picture: getStringClaim(claims, claimMapping.picture),\n    locale: getStringClaim(claims, claimMapping.locale),\n    zoneinfo: getStringClaim(claims, claimMapping.zoneinfo),\n    updated_at: getNumberClaim(claims, claimMapping.updatedAt),\n  };\n\n  const expiresAt = tokenResult.expires_in\n    ? Date.now() + tokenResult.expires_in * 1000\n    : undefined;\n  const now = Date.now();\n  const sessionState = (tokenResult as Record<string, unknown>).session_state;\n\n  return {\n    userId: baseUser.sub,\n    accessToken: tokenResult.access_token,\n    refreshToken: tokenResult.refresh_token,\n    idToken: tokenResult.id_token,\n    expiresAt,\n    issuer: getStringClaim(claims, ['iss']),\n    sid: getStringClaim(claims, ['sid']),\n    sessionState: typeof sessionState === 'string' ? sessionState : undefined,\n    clientId: getAuthConfig().clientId,\n    user: baseUser,\n    createdAt: now,\n    lastActivity: now,\n  };\n}\n\n// ============================================================================\n// Auth Error Handling\n// ============================================================================\n\n// Auth error cookie names - unique per application to prevent conflicts\nconst AUTH_ERROR_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_auth_error`;\nconst AUTH_ERROR_DESC_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_auth_error_desc`;\nconst OAUTH_STATE_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_oauth_state_id`;\n\n/**\n * Check if there's an auth error in cookies\n * \n * This should be called by apps (especially those without landing pages like Dashboard)\n * BEFORE starting OAuth flow to prevent redirect loops.\n * \n * @example\n * ```ts\n * // In dashboard's index route loader\n * const authError = getAuthError(request);\n * if (authError) {\n *   return { authError }; // Show error to user\n * }\n * // No error, proceed with session check\n * const user = await getUser(request);\n * if (!user) {\n *   return login(request);\n * }\n * ```\n */\nexport function getAuthError(request: Request): AuthError | null {\n  const cookies = request.headers.get('Cookie');\n  if (!cookies) return null;\n  \n  // Parse auth_error cookie (app-specific)\n  const errorRegex = new RegExp(`${AUTH_ERROR_COOKIE}=([^;]+)`);\n  const errorMatch = cookies.match(errorRegex);\n  if (!errorMatch) return null;\n  \n  const error = decodeURIComponent(errorMatch[1]);\n  if (!error) return null;\n  \n  // Parse auth_error_description cookie (app-specific)\n  const descRegex = new RegExp(`${AUTH_ERROR_DESC_COOKIE}=([^;]+)`);\n  const descMatch = cookies.match(descRegex);\n  const description = descMatch ? decodeURIComponent(descMatch[1]) : undefined;\n  \n  return { error, description };\n}\n\n/**\n * Clear auth error cookies\n * \n * Call this after displaying the error to the user\n */\nexport function clearAuthErrorHeaders(): Headers {\n  const headers = new Headers();\n  headers.append('Set-Cookie', `${AUTH_ERROR_COOKIE}=; Path=/; Max-Age=0`);\n  headers.append('Set-Cookie', `${AUTH_ERROR_DESC_COOKIE}=; Path=/; Max-Age=0`);\n  return headers;\n}\n\n/**\n * Check if request has auth error (quick check without parsing)\n */\nexport function hasAuthError(request: Request): boolean {\n  const cookies = request.headers.get('Cookie');\n  return cookies?.includes(`${AUTH_ERROR_COOKIE}=`) ?? false;\n}\n\n// ============================================================================\n// Auth Functions\n// ============================================================================\n\n/**\n * Initiate OAuth login flow\n * \n * @param request - The incoming request\n * @param returnUrlOrOptions - Either a return URL string or LoginOptions object\n */\nexport async function login(\n  request: Request, \n  returnUrlOrOptions?: string | LoginOptions\n): Promise<Response> {\n  try {\n    const config = getAuthConfig();\n    \n    // Parse options\n    const options: LoginOptions = typeof returnUrlOrOptions === 'string' \n      ? { returnUrl: returnUrlOrOptions }\n      : returnUrlOrOptions || {};\n\n    // Check for auth_error cookie to prevent redirect loops\n    const cookies = request.headers.get('Cookie');\n    const hasError = cookies?.includes(`${AUTH_ERROR_COOKIE}=`);\n    if (hasError) {\n      logger.warn('Auth error cookie detected, preventing redirect loop');\n      // Clear the error cookie and redirect to home\n      const headers = new Headers();\n      headers.append('Set-Cookie', `${AUTH_ERROR_COOKIE}=; Path=/; Max-Age=0`);\n      // Use redirectUri to get correct base URL with port\n      const redirectUri = new URL(config.redirectUri);\n      const baseUrl = redirectUri.origin;\n      return createRedirectResponse(baseUrl, { headers });\n    }\n\n    const oidcConfig = await getOAuthConfig();\n\n    // Generate PKCE challenge\n    const codeVerifier = oidc.randomPKCECodeVerifier();\n    const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);\n\n    const extraAuthParams = sanitizeExtraAuthorizationParameters(options.extraAuthParams, options);\n\n    // Generate secure state and nonce. The state may carry a non-secret UI\n    // hint for Keycloak themes, but callback validation still compares the\n    // exact value stored server-side.\n    const state = buildAuthorizationState(oidc.randomState(), options.publicStateContext);\n    const nonce = oidc.randomNonce();\n\n    // Create OAuth state object\n    const oauthState: OAuthState = {\n      state,\n      codeVerifier,\n      nonce,\n      returnUrl: options.returnUrl,\n      kcAction: options.kcAction,\n      createdAt: Date.now(),\n    };\n\n    logger.info('Creating OAuth state', {\n      returnUrl: options.returnUrl,\n      prompt: options.prompt,\n      kcAction: options.kcAction,\n      extraAuthParamKeys: Object.keys(extraAuthParams),\n    });\n\n    // Store OAuth state in Redis\n    const stateId = await createOAuthState(oauthState);\n\n    const authorizationParameters: Record<string, string> = {\n      redirect_uri: config.redirectUri,\n      scope: config.scope,\n      state,\n      nonce,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n      ...extraAuthParams,\n    };\n\n    if (options.prompt) {\n      authorizationParameters.prompt = options.prompt;\n    }\n\n    if (options.kcAction) {\n      authorizationParameters.kc_action = options.kcAction;\n    }\n\n    const authorizationUrl = oidc.buildAuthorizationUrl(oidcConfig, authorizationParameters);\n\n    // Store stateId in cookie for callback (app-specific to prevent conflicts)\n    const headers = new Headers();\n    headers.append('Set-Cookie', `${OAUTH_STATE_COOKIE}=${stateId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=600`);\n\n    logger.info('OIDC authorization flow initiated', {\n      clientId: config.clientId,\n      redirectUri: config.redirectUri,\n      scope: config.scope,\n      authorizationEndpoint: oidcConfig.serverMetadata().authorization_endpoint,\n      stateId,\n      prompt: options.prompt,\n      kcAction: options.kcAction,\n    });\n\n    return createRedirectResponse(authorizationUrl.toString(), { headers });\n  } catch (error) {\n    logger.error('Failed to initiate OAuth login', error instanceof Error ? error : undefined);\n    throw new Error('Login failed');\n  }\n}\n\n/**\n * Handle OAuth callback\n * \n * Handles OAuth authorization response including success and error cases.\n * \n * Error Handling:\n * - `access_denied`: User doesn't have access to this application\n *   - For apps with landing page: Redirect home with error cookie\n *   - For apps without landing page: Redirect home with error cookie (must handle specially)\n * - `login_required`: No active identity session\n *   - Redirect to home to start fresh login\n */\nexport async function handleCallback(request: Request): Promise<Response> {\n  try {\n    const config = getAuthConfig();\n    const hasLandingPage = getEffectiveHasLandingPage(config);\n    const url = new URL(request.url);\n    const code = url.searchParams.get('code');\n    const state = url.searchParams.get('state');\n    const error = url.searchParams.get('error');\n    const errorDescription = url.searchParams.get('error_description');\n    const kcAction = url.searchParams.get('kc_action');\n    const kcActionStatus = url.searchParams.get('kc_action_status');\n\n    logger.info('OIDC callback received', {\n      hasCode: !!code,\n      hasState: !!state,\n      error,\n      errorDescription,\n      kcAction,\n      kcActionStatus,\n      clientId: config.clientId,\n      redirectUri: config.redirectUri\n    });\n\n    // Handle OAuth errors\n    if (error) {\n      if (kcActionStatus && state) {\n        const cookies = request.headers.get('Cookie');\n        const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);\n        const cookieMatch = cookies?.match(oauthStateRegex);\n        const stateId = cookieMatch?.[1];\n\n        if (stateId) {\n          const oauthState = await getOAuthState(stateId);\n          const stateAge = oauthState ? Date.now() - oauthState.createdAt : Number.POSITIVE_INFINITY;\n\n          if (oauthState && oauthState.state === state && stateAge <= 10 * 60 * 1000) {\n            await deleteOAuthState(stateId);\n            const headers = new Headers();\n            headers.append('Set-Cookie', `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);\n\n            const redirectUrl = appendApplicationInitiatedActionResult(\n              oauthState.returnUrl || '/',\n              kcAction || oauthState.kcAction,\n              kcActionStatus\n            );\n\n            logger.info('Application initiated action returned with OAuth error', {\n              error,\n              errorDescription,\n              kcAction: kcAction || oauthState.kcAction,\n              kcActionStatus,\n            });\n\n            return createRedirectResponse(redirectUrl, { headers });\n          }\n        }\n      }\n\n      logger.error('OAuth callback error', undefined, { \n        error, \n        errorDescription,\n        clientId: config.clientId,\n        applicationType: config.applicationType,\n        hasLandingPage\n      });\n      \n      // Handle access_denied specially - user doesn't have access to this app\n      // This can happen when identity cookie is valid but user has no access to this client\n      if (error === 'access_denied') {\n        logger.warn('Access denied for this application', { clientId: config.clientId });\n        // Clear any existing session and redirect to home without triggering new login\n        const headers = await destroyAuthSession(request);\n        // Set error cookies to:\n        // 1. Prevent redirect loop (auth_error)\n        // 2. Allow UI to show appropriate message (auth_error_type, auth_error_description)\n        headers.append(\n          'Set-Cookie',\n          `${AUTH_ERROR_COOKIE}=access_denied; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`\n        );\n        headers.append(\n          'Set-Cookie',\n          `${AUTH_ERROR_DESC_COOKIE}=${encodeURIComponent(errorDescription || 'You do not have access to this application.')}; Path=/; SameSite=Lax; Max-Age=300`\n        );\n        // Use redirectUri to get the correct base URL with port\n        // request.url.origin can lose the port in some cases\n        const redirectUri = new URL(config.redirectUri);\n        const baseUrl = redirectUri.origin;\n        logger.info('Redirecting to /auth/login to show access_denied error', { \n          hasLandingPage,\n          baseUrl,\n          configRedirectUri: config.redirectUri\n        });\n        // Redirect to /auth/login so user immediately sees the access denied page\n        // instead of landing page (which doesn't show the error)\n        return createRedirectResponse(`${baseUrl}/auth/login`, { headers });\n      }\n      \n      // Handle login_required - session expired or user not logged in\n      if (error === 'login_required') {\n        logger.info('Login required, user session may have expired');\n        const headers = await destroyAuthSession(request);\n        // Use redirectUri to get correct base URL with port\n        const redirectUri = new URL(config.redirectUri);\n        const baseUrl = redirectUri.origin;\n        return createRedirectResponse(baseUrl, { headers });\n      }\n      \n      // Handle other errors\n      const headers = await destroyAuthSession(request);\n      headers.append(\n        'Set-Cookie',\n        `${AUTH_ERROR_COOKIE}=${encodeURIComponent(error)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`\n      );\n      if (errorDescription) {\n        headers.append(\n          'Set-Cookie',\n          `${AUTH_ERROR_DESC_COOKIE}=${encodeURIComponent(errorDescription)}; Path=/; SameSite=Lax; Max-Age=300`\n        );\n      }\n      // Use redirectUri to get correct base URL with port\n      const redirectUri = new URL(config.redirectUri);\n      const baseUrl = redirectUri.origin;\n      return createRedirectResponse(baseUrl, { headers });\n    }\n\n    // Get stateId from cookie (app-specific)\n    const cookies = request.headers.get('Cookie');\n    const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);\n    const cookieMatch = cookies?.match(oauthStateRegex);\n    const stateId = cookieMatch?.[1];\n\n    if (!stateId) {\n      throw new Error('OAuth state ID not found in cookie');\n    }\n\n    // Retrieve OAuth state from Redis\n    const oauthState = await getOAuthState(stateId);\n\n    if (!oauthState) {\n      throw new Error('No OAuth state found - state may have expired');\n    }\n\n    if (!state) {\n      throw new Error('Missing required callback state parameter');\n    }\n\n    if (oauthState.state !== state) {\n      throw new Error(`OAuth state mismatch`);\n    }\n\n    // Check state age (10 minutes max)\n    const stateAge = Date.now() - oauthState.createdAt;\n    if (stateAge > 10 * 60 * 1000) {\n      throw new Error('OAuth state expired');\n    }\n\n    if (!code) {\n      if (kcActionStatus) {\n        await deleteOAuthState(stateId);\n        const headers = new Headers();\n        headers.append('Set-Cookie', `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);\n\n        const redirectUrl = appendApplicationInitiatedActionResult(\n          oauthState.returnUrl || '/',\n          kcAction || oauthState.kcAction,\n          kcActionStatus\n        );\n\n        logger.info('Application initiated action returned without authorization code', {\n          kcAction: kcAction || oauthState.kcAction,\n          kcActionStatus,\n        });\n\n        return createRedirectResponse(redirectUrl, { headers });\n      }\n\n      throw new Error('Missing required callback code parameter');\n    }\n\n    logger.info('Initiating token exchange');\n\n    const oidcConfig = await getOAuthConfig();\n    const tokenResult = await oidc.authorizationCodeGrant(oidcConfig, url, {\n      pkceCodeVerifier: oauthState.codeVerifier,\n      expectedState: oauthState.state,\n      expectedNonce: oauthState.nonce,\n      idTokenExpected: config.scope.split(/\\s+/).includes('openid'),\n    });\n\n    logger.info('Token exchange completed successfully');\n\n    const claims = getClaimsFromTokenResponse(tokenResult);\n\n    // Create session data\n    const newSessionData = await createSessionData(tokenResult, claims);\n\n    // Create new session\n    const sessionHeaders = await createAuthSession(request, newSessionData);\n\n    // Clean up OAuth state from Redis\n    await deleteOAuthState(stateId);\n\n    // Combine headers and clear OAuth state cookie (app-specific)\n    const headers = new Headers(sessionHeaders);\n    headers.append('Set-Cookie', `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);\n\n    logger.info('OAuth callback processed successfully');\n\n    // Redirect to return URL or default location\n    const redirectUrl = appendApplicationInitiatedActionResult(\n      oauthState.returnUrl || '/',\n      kcAction || oauthState.kcAction,\n      kcActionStatus\n    );\n    return createRedirectResponse(redirectUrl, { headers });\n  } catch (error) {\n    logger.error('OAuth callback failed', error instanceof Error ? error : undefined);\n\n    // Try to clean up OAuth state on error\n    try {\n      const cookies = request.headers.get('Cookie');\n      const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);\n      const cookieMatch = cookies?.match(oauthStateRegex);\n      const stateId = cookieMatch?.[1];\n      if (stateId) {\n        await deleteOAuthState(stateId);\n      }\n    } catch {\n      // Ignore cleanup errors\n    }\n\n    await destroyAuthSession(request);\n    throw new Error('Authentication failed');\n  }\n}\n\n/**\n * Logout user.\n *\n * Default logout follows OIDC RP-Initiated Logout and ends the identity\n * provider session. Automatic/session-expiry cleanup can request\n * `/auth/logout?logout=local` to clear only this app's Redis session without\n * bouncing the browser through the identity provider or revoking SSO tokens.\n */\nexport async function logout(request: Request): Promise<Response> {\n  try {\n    const config = getAuthConfig();\n    const url = new URL(request.url);\n    \n    const logoutScope = getLogoutScope(url);\n    const returnUrl = sanitizeLogoutReturnUrl(url.searchParams.get('returnUrl'), request);\n    \n    logger.info('Logout initiated', { \n      clientId: config.clientId,\n      logoutScope,\n    });\n    \n    const sessionData = await getAuthSession(request);\n    const idToken = sessionData.idToken;\n\n    if (logoutScope === 'local') {\n      // Local logout is RP-only cleanup. Tokens are server-side and become\n      // unreachable once the Redis session is destroyed; revoking the refresh\n      // token can also terminate the Keycloak SSO session for this user.\n      const headers = await destroyAuthSession(request);\n      const redirectUrl = returnUrl || '/';\n      const absoluteRedirectUrl = getAbsoluteRedirectUrl(request, redirectUrl);\n\n      headers.append('Set-Cookie', 'logout_return_url=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0');\n      logger.info('Local application logout completed', { redirectUrl: absoluteRedirectUrl });\n      return createRedirectResponse(absoluteRedirectUrl, { headers });\n    }\n\n    const sessionHeaders = new Headers();\n\n    if (logoutScope === 'all' && sessionData.userId) {\n      await revokeAndDestroyAllUserSessionsBestEffort(sessionData.userId);\n      sessionHeaders.append('Set-Cookie', 'logout_return_url=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0');\n      const expiredHeaders = await destroyAuthSession(request);\n      expiredHeaders.forEach((value, key) => sessionHeaders.append(key, value));\n    } else {\n      await revokeSessionTokensBestEffort(sessionData);\n      const expiredHeaders = await destroyAuthSession(request);\n      expiredHeaders.forEach((value, key) => sessionHeaders.append(key, value));\n    }\n\n    const headers = new Headers(sessionHeaders);\n\n    // Store returnUrl in cookie if provided for the post-logout landing redirect.\n    if (returnUrl) {\n      headers.append(\n        'Set-Cookie',\n        `logout_return_url=${encodeURIComponent(returnUrl)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`\n      );\n    } else {\n      headers.append('Set-Cookie', 'logout_return_url=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0');\n    }\n\n    try {\n      const oidcConfig = await getOAuthConfig();\n      const serverMetadata = oidcConfig.serverMetadata();\n      const logoutParameters: Record<string, string> = {};\n      const expectedIssuer = serverMetadata.issuer ?? config.authority;\n\n      if (idToken && canUseIdTokenHint(idToken, expectedIssuer)) {\n        logoutParameters.id_token_hint = idToken;\n      } else if (idToken) {\n        logger.warn('Skipping id_token_hint because the session token issuer does not match the active OIDC provider', {\n          tokenIssuer: getJwtIssuer(idToken),\n          expectedIssuer: normalizeIssuer(expectedIssuer),\n          clientId: config.clientId,\n        });\n      }\n\n      if (config.postLogoutRedirectUri) {\n        logoutParameters.post_logout_redirect_uri = config.postLogoutRedirectUri;\n      }\n\n      const endSessionUrl = oidc.buildEndSessionUrl(oidcConfig, logoutParameters);\n      logger.info('RP-Initiated Logout redirect created', {\n        endSessionEndpoint: serverMetadata.end_session_endpoint,\n        hasIdTokenHint: Boolean(logoutParameters.id_token_hint),\n      });\n\n      return createRedirectResponse(endSessionUrl.toString(), { headers });\n    } catch (error) {\n      logger.warn('OIDC end_session endpoint unavailable, falling back to local redirect', {\n        error: getOAuthErrorMessage(error),\n      });\n    }\n\n    // Fallback redirect\n    const registeredPath = config.postLogoutRedirectUri || '/';\n    const finalRedirectUrl = getAbsoluteRedirectUrl(request, registeredPath);\n\n    logger.info('Logout completed', { redirectUrl: finalRedirectUrl });\n    return createRedirectResponse(finalRedirectUrl, { headers });\n  } catch (error) {\n    logger.error('Logout failed', error instanceof Error ? error : undefined);\n    const headers = await destroyAuthSession(request);\n    return createRedirectResponse('/', { headers });\n  }\n}\n\n/**\n * Handle an OIDC Back-Channel Logout request from Keycloak or another OP.\n *\n * Configure the client Backchannel logout URL to this endpoint. The logout\n * token is signature-verified against the provider JWKS, issuer/audience are\n * checked, and all matching local Redis sessions are destroyed by `sid` first,\n * falling back to `sub` when the OP omits a session id.\n */\nexport async function handleBackChannelLogout(request: Request): Promise<Response> {\n  if (request.method !== 'POST') {\n    return Response.json({ error: 'method_not_allowed' }, { status: 405 });\n  }\n\n  try {\n    const config = getAuthConfig();\n    const oidcConfig = await getOAuthConfig();\n    const serverMetadata = oidcConfig.serverMetadata();\n    const logoutToken = await getLogoutTokenFromRequest(request);\n\n    if (!logoutToken) {\n      return Response.json({ error: 'missing_logout_token' }, { status: 400 });\n    }\n\n    if (!serverMetadata.jwks_uri) {\n      throw new Error('OIDC provider does not expose jwks_uri');\n    }\n\n    const { payload } = await jwtVerify(logoutToken, getJwks(serverMetadata.jwks_uri), {\n      issuer: serverMetadata.issuer ?? config.authority,\n      audience: config.clientId,\n      clockTolerance: 60,\n    });\n\n    const claims = validateBackChannelLogoutClaims(payload as Record<string, unknown>, config.clientId);\n    const destroyedSessions = await destroyAuthSessionsByIdentitySession({\n      sid: claims.sid,\n      userId: claims.subject,\n    });\n    const result: BackChannelLogoutResult = {\n      destroyedSessions,\n      issuer: claims.issuer,\n      subject: claims.subject,\n      sid: claims.sid,\n    };\n\n    logger.info('Back-channel logout processed', { ...result });\n    return Response.json({ success: true, ...result });\n  } catch (error) {\n    logger.error('Back-channel logout failed', error instanceof Error ? error : undefined);\n    return Response.json(\n      { error: 'invalid_logout_token', error_description: getOAuthErrorMessage(error) },\n      { status: 400 }\n    );\n  }\n}\n\n/**\n * Handle OIDC Front-Channel Logout iframe/browser requests.\n *\n * Front-channel logout cannot carry a signed logout token, so this validates the\n * issuer and applies local cleanup only when a `sid` is present.\n */\nexport async function handleFrontChannelLogout(request: Request): Promise<Response> {\n  try {\n    const config = getAuthConfig();\n    const oidcConfig = await getOAuthConfig();\n    const serverMetadata = oidcConfig.serverMetadata();\n    const url = new URL(request.url);\n    const issuer = url.searchParams.get('iss');\n    const sid = url.searchParams.get('sid');\n    const expectedIssuer = normalizeIssuer(serverMetadata.issuer ?? config.authority);\n\n    if (!issuer || normalizeIssuer(issuer) !== expectedIssuer) {\n      return new Response(null, { status: 204 });\n    }\n\n    const destroyedSessions = sid ? await destroyAuthSessionsBySid(sid) : 0;\n    const result: FrontChannelLogoutResult = {\n      destroyedSessions,\n      issuer,\n      sid: sid ?? undefined,\n    };\n\n    logger.info('Front-channel logout processed', { ...result });\n    return new Response(null, {\n      status: 204,\n      headers: {\n        'Cache-Control': 'no-store',\n      },\n    });\n  } catch (error) {\n    logger.warn('Front-channel logout ignored', {\n      error: getOAuthErrorMessage(error),\n    });\n\n    return new Response(null, { status: 204 });\n  }\n}\n\n/**\n * Get current user from session\n */\nexport async function getUser(request: Request): Promise<UserInfo | null> {\n  try {\n    const sessionData = await getAuthSession(request);\n    return sessionData.user || null;\n  } catch (error) {\n    logger.error('Failed to get user', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\n/**\n * Require authenticated user (throws redirect to login if not authenticated)\n */\nexport async function requireAuth(request: Request): Promise<UserInfo> {\n  const user = await getUser(request);\n\n  if (!user) {\n    const url = new URL(request.url);\n    const returnUrl = `${url.pathname}${url.search}`;\n    logger.info('No user found, starting OAuth flow', { returnUrl });\n    throw await login(request, returnUrl);\n  }\n\n  return user;\n}\n\n/**\n * Get access token from session\n */\nexport async function getAccessToken(request: Request): Promise<string | null> {\n  try {\n    const sessionData = await getAuthSession(request);\n    return sessionData.accessToken || null;\n  } catch (error) {\n    logger.error('Failed to get access token', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\n/**\n * Refresh tokens\n */\nexport async function refreshTokens(\n  request: Request,\n  refreshToken?: string\n): Promise<TokenRefreshResult> {\n  try {\n    const sessionData = await getAuthSession(request);\n    const tokenToRefresh = refreshToken || sessionData.refreshToken;\n\n    if (!tokenToRefresh) {\n      logger.warn('No refresh token available');\n      return { success: false, error: 'No refresh token available', shouldLogout: true };\n    }\n\n    logger.info('Initiating token refresh');\n\n    const oidcConfig = await getOAuthConfig();\n    const refreshResult = await oidc.refreshTokenGrant(oidcConfig, tokenToRefresh);\n\n    logger.info('Token refresh successful');\n\n    const newRefreshToken = refreshResult.refresh_token || tokenToRefresh;\n    const expiresAt = refreshResult.expires_in\n      ? Date.now() + refreshResult.expires_in * 1000\n      : sessionData.expiresAt;\n\n    // Update session\n    await updateAuthSession(request, {\n      accessToken: refreshResult.access_token,\n      refreshToken: newRefreshToken,\n      idToken: refreshResult.id_token,\n      expiresAt,\n      lastActivity: Date.now(),\n    });\n\n    return {\n      success: true,\n      tokens: {\n        access_token: refreshResult.access_token,\n        refresh_token: newRefreshToken,\n        id_token: refreshResult.id_token,\n        expires_in: refreshResult.expires_in,\n      },\n    };\n  } catch (error) {\n    logger.error('Token refresh failed with exception', error instanceof Error ? error : undefined);\n\n    return {\n      success: false,\n      error: getOAuthErrorMessage(error),\n      shouldLogout: shouldLogoutAfterOAuthError(error),\n    };\n  }\n}\n\n// Re-export session validation\nexport { isSessionValid };\n\n/**\n * Clear auth server cache (useful for testing)\n */\nexport function clearAuthServerCache(): void {\n  authServerCache = null;\n  jwksCache.clear();\n}\n"],"mappings":";;;;;;;;;AAYA,SAAgB,uBACdA,UACAC,OAA6B,CAAE,GACrB;CACV,MAAM,UAAU,IAAI,QAAQ,KAAK;AACjC,SAAQ,IAAI,YAAY,SAAS;AAEjC,QAAO,IAAI,SAAS,MAAM;EACxB,QAAQ,KAAK,UAAU;EACvB;CACD;AACF;;;;ACrBD,MAAM,yCAAyC,IAAI,IAAI;CACrD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD;AAED,MAAM,8CAA8C,IAAI,IAAI;CAC1D;CACA;CACA;CACA;AACD;AAED,SAAS,qCACPC,KACAC,cACAC,iBACS;CACT,MAAM,aAAa,IAAI,aAAa;AACpC,QAAO,aAAa,IAAI,WAAW,IAAI,gBAAgB,KAAK,CAAC,WAAW,WAAW,WAAW,OAAO,CAAC;AACvG;AAED,SAAgB,qCACdC,QACAC,UAAgF,CAAE,GAC1D;AACxB,MAAK,OACH,QAAO,CAAE;CAGX,MAAM,eAAe,IAAI,IAAI,CAC3B,GAAG,6CACH,GAAG,CAAC,QAAQ,uBAAuB,CAAE,GAAE,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,QAAQ,AAChG;CACD,MAAM,kBAAkB,CAAC,QAAQ,0BAA0B,CAAE,GAC1D,IAAI,CAAC,WAAW,OAAO,MAAM,CAAC,aAAa,CAAC,CAC5C,OAAO,QAAQ;CAClB,MAAMC,YAAoC,CAAE;AAE5C,MAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,OAAO,EAAE;EACjD,MAAM,gBAAgB,IAAI,MAAM;AAChC,MACE,cAAc,WAAW,KACzB,uCAAuC,IAAI,cAAc,aAAa,CAAC,KACtE,qCAAqC,eAAe,cAAc,gBAAgB,IACnF,UAAU,QACV,iBAEA;EAGF,MAAM,kBAAkB,OAAO,MAAM,CAAC,MAAM;AAC5C,MAAI,gBAAgB,WAAW,EAC7B;AAGF,YAAU,iBAAiB;CAC5B;AAED,QAAO;AACR;AAED,SAAgB,yCACdC,SAC+B;AAC/B,MAAK,QACH,QAAO;CAGT,MAAMC,aAAqC,CAAE;AAE7C,MAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,QAAQ,EAAE;EAClD,MAAM,gBAAgB,IAAI,MAAM;AAChC,MACE,cAAc,WAAW,KACzB,uCAAuC,IAAI,cAAc,aAAa,CAAC,IACvE,UAAU,QACV,iBAEA;EAGF,MAAM,kBAAkB,OAAO,MAAM,CAAC,MAAM;AAC5C,MAAI,gBAAgB,WAAW,EAC7B;AAGF,aAAW,iBAAiB;CAC7B;AAED,QAAO,OAAO,KAAK,WAAW,CAAC,SAAS,IAAI,aAAa;AAC1D;AAED,SAAgB,wBACdC,WACAC,oBACQ;CACR,MAAM,oBAAoB,yCAAyC,mBAAmB;AACtF,MAAK,kBACH,QAAO;AAGT,SAAQ,EAAE,UAAU,GAAG,OAAO,KAAK,KAAK,UAAU,kBAAkB,EAAE,OAAO,CAAC,SAAS,YAAY,CAAC;AACrG;;;;;;;ACrDD,SAAS,2BAA2BC,QAA6B;AAE/D,KAAI,OAAO,0BACT,QAAO,OAAO;AAIhB,SAAQ,OAAO,iBAAf;EACE,KAAK;EACL,KAAK,YACH,QAAO;EACT,KAAK;EACL,KAAK,aACH,QAAO;EACT,QACE,QAAO;CACV;AACF;;;;AAKD,SAAS,mBAA+B;CACtC,MAAM,kBAAkB;EACtB,WAAW,QAAQ,IAAI;EACvB,UAAU,QAAQ,IAAI;EACtB,aAAa,QAAQ,IAAI;CAC1B;AAED,MAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,gBAAgB,CACxD,MAAK,MACH,OAAM,IAAI,OAAO,8CAA8C,IAAI,aAAa,CAAC;CAKrF,MAAM,aAAa,QAAQ,IAAI,uBAAuB,aAAa;CACnE,IAAIC,kBAAmC;AACvC,KAAI,eAAe,qBAAqB,eAAe,kBACrD,mBAAkB;UACT,eAAe,kBAAkB,eAAe,eACzD,mBAAkB;UACT,eAAe,YACxB,mBAAkB;UACT,eAAe,gBAAgB,eAAe,aACvD,mBAAkB;CAGpB,MAAM,mBAAmB,0BACvB,QAAQ,IAAI,yBACZ,QAAQ,IAAI,qBAAqB,uBAAuB,OACzD;CAED,MAAM,iBAAiB,QAAQ,IAAI,mCAC/B,QAAQ,IAAI,0BAA0B;AAG1C,QAAO;EACL,WAAW,gBAAgB;EAC3B,UAAU,gBAAgB;EAC1B,cAAc,QAAQ,IAAI;EAC1B;EACA,aAAa,gBAAgB;EAC7B,OAAO,QAAQ,IAAI,cAAc;EACjC,uBAAuB,QAAQ,IAAI;EACnC;EACA;CACD;AACF;AAED,SAAS,0BACPC,OACAC,UACsB;CACtB,MAAM,aAAa,OAAO,MAAM,CAAC,aAAa;AAE9C,SAAQ,YAAR;EACE;EACA,KAAK,GACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,KAAK;EACL,KAAK,OACH,QAAO;EACT,KAAK;EACL,KAAK,QACH,QAAO;EACT,QACE,OAAM,IAAI,OAAO,uCAAuC,MAAM;CACjE;AACF;AAED,IAAIC,cAAiC;AAErC,SAAS,gBAA4B;AACnC,MAAK,YACH,eAAc,kBAAkB;AAElC,QAAO;AACR;AAMD,IAAIC,kBAGO;AAEX,MAAM,YAAY,KAAK,KAAK;AAC5B,MAAM,YAAY,IAAI;AAEtB,SAAS,gBAAgBH,OAA0C;CACjE,MAAM,aAAa,OAAO,MAAM,CAAC,QAAQ,QAAQ,GAAG;AACpD,QAAO,cAAc,WAAW,SAAS,IAAI,aAAa;AAC3D;AAED,SAAS,aAAaI,OAA2D;AAC/E,MAAK,MACH,QAAO;AAGT,KAAI;EACF,MAAM,GAAG,QAAQ,GAAG,MAAM,MAAM,IAAI;AACpC,OAAK,QACH,QAAO;AAGT,SAAO,KAAK,MAAM,OAAO,KAAK,SAAS,YAAY,CAAC,SAAS,OAAO,CAAC;CACtE,QAAO;AACN,SAAO;CACR;AACF;AAED,SAAS,aAAaA,OAA0C;CAC9D,MAAM,SAAS,aAAa,MAAM,EAAE;AACpC,eAAc,WAAW,WAAW,gBAAgB,OAAO,GAAG;AAC/D;AAED,SAAS,kBAAkBC,SAA6BC,gBAAiC;AACvF,MAAK,QACH,QAAO;CAGT,MAAM,cAAc,aAAa,QAAQ;AACzC,QAAO,gBAAgB,QAAQ,gBAAgB,gBAAgB,eAAe;AAC/E;AAED,SAAS,wBAAwBC,WAA0BC,SAAiC;AAC1F,MAAK,UACH,QAAO;AAGT,KAAI;EACF,MAAM,aAAa,IAAI,IAAI,QAAQ;EACnC,MAAM,mBAAmB,mBAAmB,UAAU;AAEtD,MAAI,iBAAiB,WAAW,IAAI,KAAK,iBAAiB,WAAW,KAAK,CACxE,QAAO,eAAe,iBAAiB,GAAG,OAAO;EAGnD,MAAM,eAAe,IAAI,IAAI;AAC7B,MAAI,aAAa,WAAW,WAAW,OACrC,QAAO;EAGT,MAAM,kBAAkB,EAAE,aAAa,SAAS,EAAE,aAAa,OAAO,EAAE,aAAa,KAAK;AAC1F,SAAO,eAAe,eAAe,GAAG,OAAO;CAChD,QAAO;AACN,SAAO;CACR;AACF;AAED,SAAS,uCACPC,WACAC,QACAC,QACQ;AACR,MAAK,WAAW,OACd,QAAO;AAGT,KAAI;EACF,MAAM,aAAa,UAAU,WAAW,IAAI,KAAK,UAAU,WAAW,KAAK;EAC3E,MAAM,MAAM,IAAI,IAAI,WAAW,aAAa;AAE5C,MAAI,OACF,KAAI,aAAa,IAAI,aAAa,OAAO;AAG3C,MAAI,OACF,KAAI,aAAa,IAAI,oBAAoB,OAAO;AAGlD,SAAO,cAAc,EAAE,IAAI,SAAS,EAAE,IAAI,OAAO,EAAE,IAAI,KAAK,IAAI,IAAI,UAAU;CAC/E,QAAO;EACN,MAAM,SAAS,IAAI;AACnB,MAAI,OAAQ,QAAO,IAAI,aAAa,OAAO;AAC3C,MAAI,OAAQ,QAAO,IAAI,oBAAoB,OAAO;EAClD,MAAM,YAAY,UAAU,SAAS,IAAI,GAAG,MAAM;AAClD,UAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,UAAU,CAAC;CACrD;AACF;AAED,SAAS,eAAeC,MAAuB;CAC7C,MAAM,aAAa,KAAK,MAAM,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,QAAQ,QAAQ,GAAG,IAAI;AAC3E,QAAO,eAAe,kBAAkB,eAAe;AACxD;AAED,SAAS,sBAAsBC,WAA4B;AACzD,KAAI;EACF,MAAM,SAAS,IAAI,IAAI;AACvB,SACE,OAAO,aAAa,WACpB;GAAC;GAAa;GAAa;GAAO;EAAQ,EAAC,SAAS,OAAO,SAAS;CAEvE,QAAO;AACN,SAAO;CACR;AACF;AAED,SAAS,gCAAgCA,WAA4B;AACnE,KAAI,QAAQ,IAAI,aAAa,aAC3B,QAAO;AAGT,KAAI,QAAQ,IAAI,iCAAiC,OAC/C,QAAO;AAGT,QAAO,sBAAsB,UAAU;AACxC;AAED,SAAS,sBAAoD;CAC3D,MAAM,SAAS,eAAe;AAE9B,QAAO,gCAAgC,OAAO,UAAU,GACpD;EAAE,WAAW;EAAQ,SAAS,CAAC,KAAK,qBAAsB;CAAE,IAC5D,EAAE,WAAW,OAAQ;AAC1B;AAED,SAAS,kBAAkBf,QAAwC;AACjE,QAAO,OAAO,qBAAqB,kBAAqB,OAAO;AAChE;AAED,SAAS,wBAAwBA,QAAqC;AACpE,SAAQ,OAAO,kBAAf;EACE,KAAK;AACH,QAAK,OAAO,aACV,OAAM,IAAI,MAAM;AAGlB,UAAO,KAAK,kBAAkB,OAAO,aAAa;EACpD,KAAK;AACH,QAAK,OAAO,aACV,OAAM,IAAI,MAAM;AAGlB,UAAO,KAAK,iBAAiB,OAAO,aAAa;EACnD,KAAK;EACL,QACE,QAAO,KAAK,MAAM;CACrB;AACF;AAED,SAAS,qBAAqBgB,OAAwB;AACpD,KAAI,iBAAiB,KAAK,kBACxB,QAAO,MAAM,qBAAqB,MAAM,SAAS,MAAM;AAGzD,KAAI,iBAAiB,MACnB,QAAO,MAAM;AAGf,QAAO;AACR;AAED,SAAS,4BAA4BA,OAAyB;AAC5D,KAAI,iBAAiB,KAAK,kBACxB,QACE,MAAM,WAAW,OACjB,MAAM,WAAW,OACjB,MAAM,UAAU,mBAChB,MAAM,UAAU;CAIpB,MAAM,UAAU,iBAAiB,QAAQ,MAAM,QAAQ,aAAa,GAAG;AACvE,QAAO,QAAQ,SAAS,gBAAgB,IAAI,QAAQ,SAAS,gBAAgB,IAAI,QAAQ,SAAS,eAAe;AAClH;AAED,SAAS,eAAeC,KAAuB;CAC7C,MAAM,iBACJ,IAAI,aAAa,IAAI,SAAS,IAC9B,IAAI,aAAa,IAAI,eAAe,IACpC,IAAI,aAAa,IAAI,QAAQ;CAC/B,MAAM,aAAa,gBAAgB,MAAM,CAAC,aAAa;AAEvD,KACE,eAAe,WACf,eAAe,iBACf,eAAe,SACf,eAAe,iBAEf,QAAO;AAGT,KACE,eAAe,SACf,eAAe,eACf,eAAe,iBACf,eAAe,aAEf,QAAO;AAGT,KAAI,IAAI,aAAa,IAAI,aAAa,KAAK,UAAU,IAAI,aAAa,IAAI,iBAAiB,KAAK,OAC9F,QAAO;AAGT,QAAO;AACR;AAED,SAAS,uBAAuBP,SAAkBQ,aAA6B;AAC7E,KAAI,gBAAgB,KAAK,YAAY,CACnC,QAAO;AAGT,QAAO,IAAI,IAAI,aAAa,IAAI,IAAI,QAAQ,KAAK,QAAQ,UAAU;AACpE;AAED,eAAe,sBACbC,eACAb,OACAc,eACe;AACf,MAAK,MACH;AAGF,KAAI;AACF,QAAM,KAAK,gBAAgB,eAAe,OAAO,EAC/C,iBAAiB,cAClB,EAAC;CACH,SAAQ,OAAO;AACd,SAAO,KAAK,gCAAgC;GAC1C;GACA,OAAO,qBAAqB,MAAM;EACnC,EAAC;CACH;AACF;AAED,eAAe,8BAA8BC,aAAyC;AACpF,MAAK,YAAY,iBAAiB,YAAY,YAC5C;AAGF,KAAI;EACF,MAAM,gBAAgB,MAAM,gBAAgB;AAC5C,QAAM,sBAAsB,eAAe,YAAY,cAAc,gBAAgB;AACrF,QAAM,sBAAsB,eAAe,YAAY,aAAa,eAAe;CACpF,SAAQ,OAAO;AACd,SAAO,KAAK,gFAAgF,EAC1F,OAAO,qBAAqB,MAAM,CACnC,EAAC;CACH;AACF;AAED,eAAe,0CAA0CC,QAAiC;CACxF,MAAM,WAAW,MAAM,2BAA2B,OAAO;AAEzD,KAAI;EACF,MAAM,gBAAgB,MAAM,gBAAgB;AAC5C,OAAK,MAAM,EAAE,MAAM,IAAI,UAAU;AAC/B,SAAM,sBAAsB,eAAe,KAAK,cAAc,gBAAgB;AAC9E,SAAM,sBAAsB,eAAe,KAAK,aAAa,eAAe;EAC7E;CACF,SAAQ,OAAO;AACd,SAAO,KAAK,uFAAuF,EACjG,OAAO,qBAAqB,MAAM,CACnC,EAAC;CACH;AAED,QAAO,MAAM,2BAA2B,OAAO;AAChD;AAED,SAAS,2BAA2BC,aAAyD;CAC3F,MAAM,SAAS,YAAY,QAAQ;AAEnC,KAAI,OACF,QAAO;AAGT,QAAO,aAAa,YAAY,SAAS,IAAI,CAAE;AAChD;;;;AAKD,eAAe,iBAA8C;CAC3D,MAAM,SAAS,eAAe;CAC9B,MAAM,MAAM,KAAK,KAAK;AAEtB,KAAI,mBAAmB,MAAM,gBAAgB,WAAW,UACtD,QAAO,gBAAgB;AAGzB,KAAI;EACF,MAAM,gBAAgB,MAAM,KAAK,UAC/B,IAAI,IAAI,OAAO,YACf,OAAO,UACP,kBAAkB,OAAO,EACzB,wBAAwB,OAAO,EAC/B,qBAAqB,CACtB;AAED,oBAAkB;GAChB;GACA,UAAU;EACX;AAED,SAAO,KAAK,yCAAyC;GACnD,QAAQ,cAAc,gBAAgB,CAAC;GACvC,UAAU,OAAO;GACjB,kBAAkB,OAAO;EAC1B,EAAC;AACF,SAAO;CACR,SAAQ,OAAO;AACd,SAAO,MAAM,yBAAyB,iBAAiB,QAAQ,gBAAmB;GAChF,WAAW,OAAO;GAClB,UAAU,OAAO;EAClB,EAAC;AACF,QAAM,IAAI,OAAO,yBAAyB,qBAAqB,MAAM,CAAC;CACvE;AACF;AAED,SAAS,QAAQC,SAAwD;CACvE,MAAM,aAAa,UAAU,IAAI,QAAQ;AACzC,KAAI,WACF,QAAO;CAGT,MAAM,OAAO,mBAAmB,IAAI,IAAI,SAAS;AACjD,WAAU,IAAI,SAAS,KAAK;AAC5B,QAAO;AACR;AAED,eAAe,0BAA0Bd,SAA0C;CACjF,MAAM,cAAc,QAAQ,QAAQ,IAAI,eAAe,IAAI;AAE3D,KAAI,YAAY,SAAS,mBAAmB,EAAE;EAC5C,MAAM,OAAO,MAAM,QAAQ,MAAM,CAAC,MAAM,MAAM,KAAK;AACnD,gBAAc,MAAM,iBAAiB,WAAW,KAAK,eAAe;CACrE;CAED,MAAM,WAAW,MAAM,QAAQ,UAAU,CAAC,MAAM,MAAM,KAAK;CAC3D,MAAM,cAAc,UAAU,IAAI,eAAe;AACjD,eAAc,gBAAgB,WAAW,cAAc;AACxD;AAED,SAAS,gCAAgCe,SAAkCC,UAIzE;CACA,MAAM,SAAS,QAAQ;CACvB,MAAM,sBACJ,iBACO,WAAW,aACjB,MAAM,QAAQ,OAAO,IACtB,wDAAwD;AAE1D,MAAK,oBACH,OAAM,IAAI,MAAM;AAGlB,KAAI,WAAW,QACb,OAAM,IAAI,MAAM;CAGlB,MAAM,WAAW,QAAQ;CACzB,MAAM,oBAAoB,MAAM,QAAQ,SAAS,GAC7C,SAAS,SAAS,SAAS,GAC3B,aAAa;AAEjB,MAAK,kBACH,OAAM,IAAI,MAAM;CAGlB,MAAM,iBAAiB,QAAQ,QAAQ,WAAW,QAAQ;CAC1D,MAAM,aAAa,QAAQ,QAAQ,WAAW,QAAQ;AAEtD,MAAK,YAAY,IACf,OAAM,IAAI,MAAM;AAGlB,QAAO;EACL,eAAe,QAAQ,QAAQ,WAAW,QAAQ;EAClD;EACA;CACD;AACF;AAMD,MAAMC,6BAAyD;CAC7D,SAAS,CAAC,KAAM;CAChB,MAAM;EAAC;EAAQ;EAAsB;CAAQ;CAC7C,OAAO,CAAC,OAAQ;CAChB,WAAW,CAAC,cAAc,WAAY;CACtC,YAAY,CAAC,eAAe,YAAa;CACzC,SAAS,CAAC,WAAW,YAAa;CAClC,QAAQ,CAAC,QAAS;CAClB,UAAU,CAAC,UAAW;CACtB,WAAW,CAAC,YAAa;CACzB,WAAW,CAAC,YAAa;CACzB,aAAa,CAAC,cAAe;CAC7B,aAAa;EAAC;EAAa;EAAe;CAAQ;CAClD,aAAa,CAAC,cAAe;AAC9B;AAED,IAAIC,mBAA+C,EACjD,GAAG,2BACJ;AAED,SAAS,mBAAmBC,MAA2B;AACrD,MAAK,MAAM,QAAQ,KAAK,CACtB,QAAO,CAAE;AAGX,QAAO,MAAM,KACX,IAAI,IACF,KACG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,CACxB,OAAO,CAAC,QAAQ,IAAI,SAAS,EAAE,EAErC;AACF;;;;;AAMD,SAAgB,0BAA0BC,SAAiC;AACzE,oBAAmB;EACjB,SAAS,QAAQ,qBAAwB,mBAAmB,QAAQ,QAAQ,GAAG,2BAA2B;EAC1G,MAAM,QAAQ,kBAAqB,mBAAmB,QAAQ,KAAK,GAAG,2BAA2B;EACjG,OAAO,QAAQ,mBAAsB,mBAAmB,QAAQ,MAAM,GAAG,2BAA2B;EACpG,WAAW,QAAQ,uBAA0B,mBAAmB,QAAQ,UAAU,GAAG,2BAA2B;EAChH,YAAY,QAAQ,wBAA2B,mBAAmB,QAAQ,WAAW,GAAG,2BAA2B;EACnH,SAAS,QAAQ,qBAAwB,mBAAmB,QAAQ,QAAQ,GAAG,2BAA2B;EAC1G,QAAQ,QAAQ,oBAAuB,mBAAmB,QAAQ,OAAO,GAAG,2BAA2B;EACvG,UAAU,QAAQ,sBAAyB,mBAAmB,QAAQ,SAAS,GAAG,2BAA2B;EAC7G,WAAW,QAAQ,uBAA0B,mBAAmB,QAAQ,UAAU,GAAG,2BAA2B;EAChH,WAAW,QAAQ,uBAA0B,mBAAmB,QAAQ,UAAU,GAAG,2BAA2B;EAChH,aAAa,QAAQ,yBAA4B,mBAAmB,QAAQ,YAAY,GAAG,2BAA2B;EACtH,aAAa,QAAQ,yBAA4B,mBAAmB,QAAQ,YAAY,GAAG,2BAA2B;EACtH,aAAa,QAAQ,yBAA4B,mBAAmB,QAAQ,YAAY,GAAG,2BAA2B;CACvH;AACF;;;;AAKD,SAAgB,wBAA8B;AAC5C,oBAAmB,EACjB,GAAG,2BACJ;AACF;AAED,SAAS,gCAA4D;AACnE,QAAO;AACR;AAED,SAAS,mBACPC,QACAC,WACmC;AACnC,MAAK,MAAM,YAAY,UACrB,KAAI,YAAY,OACd,QAAO;EACL,KAAK;EACL,OAAO,OAAO;CACf;AAIL,QAAO,CAAE;AACV;AAED,SAAS,eAAeD,QAAiCC,WAAyC;CAChG,MAAM,EAAE,OAAO,GAAG,mBAAmB,QAAQ,UAAU;AAEvD,YAAW,UAAU,UAAU;EAC7B,MAAM,UAAU,MAAM,MAAM;AAC5B,SAAO,QAAQ,SAAS,IAAI;CAC7B;AAED,YAAW,UAAU,mBAAmB,UAAU,UAChD,SAAQ,EAAE,MAAM;AAGlB;AACD;AAED,SAAS,eAAeD,QAAiCC,WAAyC;CAChG,MAAM,EAAE,OAAO,GAAG,mBAAmB,QAAQ,UAAU;AAEvD,YAAW,UAAU,YAAY,OAAO,SAAS,MAAM,CACrD,QAAO;AAGT,YAAW,UAAU,UAAU;EAC7B,MAAM,SAAS,OAAO,MAAM;AAC5B,SAAO,OAAO,SAAS,OAAO,GAAG;CAClC;AAED;AACD;AAED,SAAS,gBACPD,QACAC,WACA,eAAe,OACN;CACT,MAAM,EAAE,OAAO,GAAG,mBAAmB,QAAQ,UAAU;AAEvD,YAAW,UAAU,UACnB,QAAO;AAGT,YAAW,UAAU,SACnB,QAAO,MAAM,aAAa,KAAK;AAGjC,QAAO;AACR;;;;AAKD,SAAS,UAAUC,OAAwB;AACzC,KAAI;AACF,SAAO,KAAK,MAAM,MAAM;CACzB,QAAO;AACN,SAAO;CACR;AACF;;;;AAKD,SAAS,cAAcC,OAA0B;AAC/C,MAAK,MAAO,QAAO,CAAE;AAErB,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,MACJ,IAAI,CAAC,gBAAiB,SAAS,WAAW,KAAK,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAE,CAC1E,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE;AAGtC,YAAW,UAAU,UAAU;EAC7B,MAAM,UAAU,MAAM,MAAM;AAC5B,OAAK,QAAS,QAAO,CAAE;AAEvB,MAAI,QAAQ,WAAW,IAAI,EAAE;GAC3B,MAAM,SAAS,UAAU,QAAQ;AACjC,OAAI,MAAM,QAAQ,OAAO,CACvB,QAAO,OACJ,IAAI,CAAC,gBAAiB,SAAS,WAAW,KAAK,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAE,CAC1E,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE;EAEvC;AAED,MAAI,QAAQ,SAAS,IAAI,CACvB,QAAO,QACJ,MAAM,IAAI,CACV,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAC1B,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE;AAGtC,SAAO,CAAC,OAAQ;CACjB;AAED,QAAO,CAAE;AACV;AAED,SAAS,aAAaA,OAA0B;AAC9C,YAAW,UAAU,SACnB,QAAO,MACJ,MAAM,CACN,MAAM,MAAM,CACZ,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE;AAGtC,QAAO,cAAc,MAAM;AAC5B;;;;AAKD,SAAgB,gBAAgBH,QAM9B;CACA,MAAM,eAAe,+BAA+B;CAGpD,IAAII,UAAoB,CAAE;CAC1B,MAAM,EAAE,OAAO,cAAc,GAAG,mBAAmB,QAAQ,aAAa,UAAU;AAClF,KAAI,wBACF,YAAW,iBAAiB,YAAY,aAAa,MAAM,CAAC,WAAW,IAAI,EAAE;EAC3E,MAAM,SAAS,UAAU,aAAa,MAAM,CAAC;AAC7C,MAAI,MAAM,QAAQ,OAAO,CACvB,WAAU,OACP,IAAI,CAAC,cAAe,OAAO,WAAW,GAAG,MAAM,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAE,CAClE,OAAO,CAAC,OAAO,GAAG,SAAS,EAAE;CAEnC,MACC,WAAU,cAAc,aAAa;CAKzC,MAAMC,cAAwC,CAAE;CAChD,MAAM,EAAE,OAAO,UAAU,GAAG,mBAAmB,QAAQ,aAAa,YAAY;AAChF,KAAI,qBAAwB;EAC1B,IAAIC,cAAuB;AAE3B,aAAW,aAAa,YAAY,SAAS,MAAM,CAAC,WAAW,IAAI,CACjE,eAAc,UAAU,SAAS,MAAM,CAAC,IAAI;AAG9C,MAAI,sBAAsB,gBAAgB,aAAa,MAAM,QAAQ,YAAY,CAC/E,MAAK,MAAM,CAAC,UAAU,UAAU,IAAI,OAAO,QAAQ,YAAuC,EAAE;GAC1F,MAAM,UAAU,cAAc,UAAU;AACxC,OAAI,QAAQ,SAAS,EACnB,aAAY,YAAY;EAE3B;CAEJ;CAGD,MAAM,kBAAkB,mBAAmB,QAAQ,aAAa,YAAY;CAC5E,MAAM,cACJ,gBAAgB,QAAQ,UACpB,aAAa,gBAAgB,MAAM,GACnC,cAAc,gBAAgB,MAAM;CAG1C,MAAM,cAAc,gBAAgB,QAAQ,aAAa,YAAY;AAErE,QAAO;EAAE;EAAS;EAAa;EAAa;CAAa;AAC1D;;;;AASD,eAAe,kBACbd,aACAQ,QAC+B;CAC/B,MAAM,eAAe,+BAA+B;CACpD,MAAMO,WAAqB;EACzB,KAAK,eAAe,QAAQ,aAAa,QAAQ,IAAI;EACrD,MAAM,eAAe,QAAQ,aAAa,KAAK,IAAI,eAAe,QAAQ,aAAa,MAAM,IAAI;EACjG,OAAO,eAAe,QAAQ,aAAa,MAAM;EACjD,WAAW,eAAe,QAAQ,aAAa,UAAU;EACzD,YAAY,eAAe,QAAQ,aAAa,WAAW;EAC3D,SAAS,eAAe,QAAQ,aAAa,QAAQ;EACrD,QAAQ,eAAe,QAAQ,aAAa,OAAO;EACnD,UAAU,eAAe,QAAQ,aAAa,SAAS;EACvD,YAAY,eAAe,QAAQ,aAAa,UAAU;CAC3D;CAED,MAAM,YAAY,YAAY,aAC1B,KAAK,KAAK,GAAG,YAAY,aAAa;CAE1C,MAAM,MAAM,KAAK,KAAK;CACtB,MAAM,eAAgB,YAAwC;AAE9D,QAAO;EACL,QAAQ,SAAS;EACjB,aAAa,YAAY;EACzB,cAAc,YAAY;EAC1B,SAAS,YAAY;EACrB;EACA,QAAQ,eAAe,QAAQ,CAAC,KAAM,EAAC;EACvC,KAAK,eAAe,QAAQ,CAAC,KAAM,EAAC;EACpC,qBAAqB,iBAAiB,WAAW;EACjD,UAAU,eAAe,CAAC;EAC1B,MAAM;EACN,WAAW;EACX,cAAc;CACf;AACF;AAOD,MAAM,qBAAqB,EAAE,yBAAyB;AACtD,MAAM,0BAA0B,EAAE,yBAAyB;AAC3D,MAAM,sBAAsB,EAAE,yBAAyB;;;;;;;;;;;;;;;;;;;;;AAsBvD,SAAgB,aAAa5B,SAAoC;CAC/D,MAAM,UAAU,QAAQ,QAAQ,IAAI,SAAS;AAC7C,MAAK,QAAS,QAAO;CAGrB,MAAM,aAAa,IAAI,QAAQ,EAAE,kBAAkB;CACnD,MAAM,aAAa,QAAQ,MAAM,WAAW;AAC5C,MAAK,WAAY,QAAO;CAExB,MAAM,QAAQ,mBAAmB,WAAW,GAAG;AAC/C,MAAK,MAAO,QAAO;CAGnB,MAAM,YAAY,IAAI,QAAQ,EAAE,uBAAuB;CACvD,MAAM,YAAY,QAAQ,MAAM,UAAU;CAC1C,MAAM,cAAc,YAAY,mBAAmB,UAAU,GAAG;AAEhE,QAAO;EAAE;EAAO;CAAa;AAC9B;;;;;;AAOD,SAAgB,wBAAiC;CAC/C,MAAM,UAAU,IAAI;AACpB,SAAQ,OAAO,eAAe,EAAE,kBAAkB,sBAAsB;AACxE,SAAQ,OAAO,eAAe,EAAE,uBAAuB,sBAAsB;AAC7E,QAAO;AACR;;;;AAKD,SAAgB,aAAaA,SAA2B;CACtD,MAAM,UAAU,QAAQ,QAAQ,IAAI,SAAS;AAC7C,QAAO,SAAS,UAAU,EAAE,kBAAkB,GAAG,IAAI;AACtD;;;;;;;AAYD,eAAsB,MACpBA,SACA6B,oBACmB;AACnB,KAAI;EACF,MAAM,SAAS,eAAe;EAG9B,MAAMC,iBAA+B,uBAAuB,WACxD,EAAE,WAAW,mBAAoB,IACjC,sBAAsB,CAAE;EAG5B,MAAM,UAAU,QAAQ,QAAQ,IAAI,SAAS;EAC7C,MAAM,WAAW,SAAS,UAAU,EAAE,kBAAkB,GAAG;AAC3D,MAAI,UAAU;AACZ,UAAO,KAAK,uDAAuD;GAEnE,MAAMC,YAAU,IAAI;AACpB,aAAQ,OAAO,eAAe,EAAE,kBAAkB,sBAAsB;GAExE,MAAM,cAAc,IAAI,IAAI,OAAO;GACnC,MAAM,UAAU,YAAY;AAC5B,UAAO,uBAAuB,SAAS,EAAE,mBAAS,EAAC;EACpD;EAED,MAAM,aAAa,MAAM,gBAAgB;EAGzC,MAAM,eAAe,KAAK,wBAAwB;EAClD,MAAM,gBAAgB,MAAM,KAAK,2BAA2B,aAAa;EAEzE,MAAM,kBAAkB,qCAAqC,QAAQ,iBAAiB,QAAQ;EAK9F,MAAM,QAAQ,wBAAwB,KAAK,aAAa,EAAE,QAAQ,mBAAmB;EACrF,MAAM,QAAQ,KAAK,aAAa;EAGhC,MAAMC,aAAyB;GAC7B;GACA;GACA;GACA,WAAW,QAAQ;GACnB,UAAU,QAAQ;GAClB,WAAW,KAAK,KAAK;EACtB;AAED,SAAO,KAAK,wBAAwB;GAClC,WAAW,QAAQ;GACnB,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB,oBAAoB,OAAO,KAAK,gBAAgB;EACjD,EAAC;EAGF,MAAM,UAAU,MAAM,iBAAiB,WAAW;EAElD,MAAMC,0BAAkD;GACtD,cAAc,OAAO;GACrB,OAAO,OAAO;GACd;GACA;GACA,gBAAgB;GAChB,uBAAuB;GACvB,GAAG;EACJ;AAED,MAAI,QAAQ,OACV,yBAAwB,SAAS,QAAQ;AAG3C,MAAI,QAAQ,SACV,yBAAwB,YAAY,QAAQ;EAG9C,MAAM,mBAAmB,KAAK,sBAAsB,YAAY,wBAAwB;EAGxF,MAAM,UAAU,IAAI;AACpB,UAAQ,OAAO,eAAe,EAAE,mBAAmB,GAAG,QAAQ,+CAA+C;AAE7G,SAAO,KAAK,qCAAqC;GAC/C,UAAU,OAAO;GACjB,aAAa,OAAO;GACpB,OAAO,OAAO;GACd,uBAAuB,WAAW,gBAAgB,CAAC;GACnD;GACA,QAAQ,QAAQ;GAChB,UAAU,QAAQ;EACnB,EAAC;AAEF,SAAO,uBAAuB,iBAAiB,UAAU,EAAE,EAAE,QAAS,EAAC;CACxE,SAAQ,OAAO;AACd,SAAO,MAAM,kCAAkC,iBAAiB,QAAQ,eAAkB;AAC1F,QAAM,IAAI,MAAM;CACjB;AACF;;;;;;;;;;;;;AAcD,eAAsB,eAAejC,SAAqC;AACxE,KAAI;EACF,MAAM,SAAS,eAAe;EAC9B,MAAM,iBAAiB,2BAA2B,OAAO;EACzD,MAAM,MAAM,IAAI,IAAI,QAAQ;EAC5B,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;EACzC,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;EAC3C,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;EAC3C,MAAM,mBAAmB,IAAI,aAAa,IAAI,oBAAoB;EAClE,MAAM,WAAW,IAAI,aAAa,IAAI,YAAY;EAClD,MAAM,iBAAiB,IAAI,aAAa,IAAI,mBAAmB;AAE/D,SAAO,KAAK,0BAA0B;GACpC,WAAW;GACX,YAAY;GACZ;GACA;GACA;GACA;GACA,UAAU,OAAO;GACjB,aAAa,OAAO;EACrB,EAAC;AAGF,MAAI,OAAO;AACT,OAAI,kBAAkB,OAAO;IAC3B,MAAMkC,YAAU,QAAQ,QAAQ,IAAI,SAAS;IAC7C,MAAMC,oBAAkB,IAAI,QAAQ,EAAE,mBAAmB;IACzD,MAAMC,gBAAc,WAAS,MAAMD,kBAAgB;IACnD,MAAME,YAAUD,gBAAc;AAE9B,QAAIC,WAAS;KACX,MAAMC,eAAa,MAAM,cAAcD,UAAQ;KAC/C,MAAME,aAAWD,eAAa,KAAK,KAAK,GAAGA,aAAW,YAAY,OAAO;AAEzE,SAAIA,gBAAcA,aAAW,UAAU,SAASC,cAAY,KAAK,KAAK,KAAM;AAC1E,YAAM,iBAAiBF,UAAQ;MAC/B,MAAMN,YAAU,IAAI;AACpB,gBAAQ,OAAO,eAAe,EAAE,mBAAmB,8CAA8C;MAEjG,MAAMS,gBAAc,uCAClBF,aAAW,aAAa,KACxB,YAAYA,aAAW,UACvB,eACD;AAED,aAAO,KAAK,0DAA0D;OACpE;OACA;OACA,UAAU,YAAYA,aAAW;OACjC;MACD,EAAC;AAEF,aAAO,uBAAuBE,eAAa,EAAE,mBAAS,EAAC;KACxD;IACF;GACF;AAED,UAAO,MAAM,gCAAmC;IAC9C;IACA;IACA,UAAU,OAAO;IACjB,iBAAiB,OAAO;IACxB;GACD,EAAC;AAIF,OAAI,UAAU,iBAAiB;AAC7B,WAAO,KAAK,sCAAsC,EAAE,UAAU,OAAO,SAAU,EAAC;IAEhF,MAAMT,YAAU,MAAM,mBAAmB,QAAQ;AAIjD,cAAQ,OACN,eACC,EAAE,kBAAkB,6DACtB;AACD,cAAQ,OACN,eACC,EAAE,uBAAuB,GAAG,mBAAmB,oBAAoB,8CAA8C,CAAC,qCACpH;IAGD,MAAMU,gBAAc,IAAI,IAAI,OAAO;IACnC,MAAMC,YAAUD,cAAY;AAC5B,WAAO,KAAK,0DAA0D;KACpE;KACA;KACA,mBAAmB,OAAO;IAC3B,EAAC;AAGF,WAAO,wBAAwB,EAAEC,UAAQ,cAAc,EAAE,mBAAS,EAAC;GACpE;AAGD,OAAI,UAAU,kBAAkB;AAC9B,WAAO,KAAK,gDAAgD;IAC5D,MAAMX,YAAU,MAAM,mBAAmB,QAAQ;IAEjD,MAAMU,gBAAc,IAAI,IAAI,OAAO;IACnC,MAAMC,YAAUD,cAAY;AAC5B,WAAO,uBAAuBC,WAAS,EAAE,mBAAS,EAAC;GACpD;GAGD,MAAMX,YAAU,MAAM,mBAAmB,QAAQ;AACjD,aAAQ,OACN,eACC,EAAE,kBAAkB,GAAG,mBAAmB,MAAM,CAAC,+CACnD;AACD,OAAI,iBACF,WAAQ,OACN,eACC,EAAE,uBAAuB,GAAG,mBAAmB,iBAAiB,CAAC,qCACnE;GAGH,MAAM,cAAc,IAAI,IAAI,OAAO;GACnC,MAAM,UAAU,YAAY;AAC5B,UAAO,uBAAuB,SAAS,EAAE,mBAAS,EAAC;EACpD;EAGD,MAAM,UAAU,QAAQ,QAAQ,IAAI,SAAS;EAC7C,MAAM,kBAAkB,IAAI,QAAQ,EAAE,mBAAmB;EACzD,MAAM,cAAc,SAAS,MAAM,gBAAgB;EACnD,MAAM,UAAU,cAAc;AAE9B,OAAK,QACH,OAAM,IAAI,MAAM;EAIlB,MAAM,aAAa,MAAM,cAAc,QAAQ;AAE/C,OAAK,WACH,OAAM,IAAI,MAAM;AAGlB,OAAK,MACH,OAAM,IAAI,MAAM;AAGlB,MAAI,WAAW,UAAU,MACvB,OAAM,IAAI,OAAO;EAInB,MAAM,WAAW,KAAK,KAAK,GAAG,WAAW;AACzC,MAAI,WAAW,KAAK,KAAK,IACvB,OAAM,IAAI,MAAM;AAGlB,OAAK,MAAM;AACT,OAAI,gBAAgB;AAClB,UAAM,iBAAiB,QAAQ;IAC/B,MAAMA,YAAU,IAAI;AACpB,cAAQ,OAAO,eAAe,EAAE,mBAAmB,8CAA8C;IAEjG,MAAMS,gBAAc,uCAClB,WAAW,aAAa,KACxB,YAAY,WAAW,UACvB,eACD;AAED,WAAO,KAAK,oEAAoE;KAC9E,UAAU,YAAY,WAAW;KACjC;IACD,EAAC;AAEF,WAAO,uBAAuBA,eAAa,EAAE,mBAAS,EAAC;GACxD;AAED,SAAM,IAAI,MAAM;EACjB;AAED,SAAO,KAAK,4BAA4B;EAExC,MAAM,aAAa,MAAM,gBAAgB;EACzC,MAAM,cAAc,MAAM,KAAK,uBAAuB,YAAY,KAAK;GACrE,kBAAkB,WAAW;GAC7B,eAAe,WAAW;GAC1B,eAAe,WAAW;GAC1B,iBAAiB,OAAO,MAAM,MAAM,MAAM,CAAC,SAAS,SAAS;EAC9D,EAAC;AAEF,SAAO,KAAK,wCAAwC;EAEpD,MAAM,SAAS,2BAA2B,YAAY;EAGtD,MAAM,iBAAiB,MAAM,kBAAkB,aAAa,OAAO;EAGnE,MAAM,iBAAiB,MAAM,kBAAkB,SAAS,eAAe;AAGvE,QAAM,iBAAiB,QAAQ;EAG/B,MAAM,UAAU,IAAI,QAAQ;AAC5B,UAAQ,OAAO,eAAe,EAAE,mBAAmB,8CAA8C;AAEjG,SAAO,KAAK,wCAAwC;EAGpD,MAAM,cAAc,uCAClB,WAAW,aAAa,KACxB,YAAY,WAAW,UACvB,eACD;AACD,SAAO,uBAAuB,aAAa,EAAE,QAAS,EAAC;CACxD,SAAQ,OAAO;AACd,SAAO,MAAM,yBAAyB,iBAAiB,QAAQ,eAAkB;AAGjF,MAAI;GACF,MAAM,UAAU,QAAQ,QAAQ,IAAI,SAAS;GAC7C,MAAM,kBAAkB,IAAI,QAAQ,EAAE,mBAAmB;GACzD,MAAM,cAAc,SAAS,MAAM,gBAAgB;GACnD,MAAM,UAAU,cAAc;AAC9B,OAAI,QACF,OAAM,iBAAiB,QAAQ;EAElC,QAAO,CAEP;AAED,QAAM,mBAAmB,QAAQ;AACjC,QAAM,IAAI,MAAM;CACjB;AACF;;;;;;;;;AAUD,eAAsB,OAAOxC,SAAqC;AAChE,KAAI;EACF,MAAM,SAAS,eAAe;EAC9B,MAAM,MAAM,IAAI,IAAI,QAAQ;EAE5B,MAAM,cAAc,eAAe,IAAI;EACvC,MAAM,YAAY,wBAAwB,IAAI,aAAa,IAAI,YAAY,EAAE,QAAQ;AAErF,SAAO,KAAK,oBAAoB;GAC9B,UAAU,OAAO;GACjB;EACD,EAAC;EAEF,MAAM,cAAc,MAAM,eAAe,QAAQ;EACjD,MAAM,UAAU,YAAY;AAE5B,MAAI,gBAAgB,SAAS;GAI3B,MAAM+B,YAAU,MAAM,mBAAmB,QAAQ;GACjD,MAAM,cAAc,aAAa;GACjC,MAAM,sBAAsB,uBAAuB,SAAS,YAAY;AAExE,aAAQ,OAAO,cAAc,gEAAgE;AAC7F,UAAO,KAAK,sCAAsC,EAAE,aAAa,oBAAqB,EAAC;AACvF,UAAO,uBAAuB,qBAAqB,EAAE,mBAAS,EAAC;EAChE;EAED,MAAM,iBAAiB,IAAI;AAE3B,MAAI,gBAAgB,SAAS,YAAY,QAAQ;AAC/C,SAAM,0CAA0C,YAAY,OAAO;AACnE,kBAAe,OAAO,cAAc,gEAAgE;GACpG,MAAM,iBAAiB,MAAM,mBAAmB,QAAQ;AACxD,kBAAe,QAAQ,CAAC,OAAO,QAAQ,eAAe,OAAO,KAAK,MAAM,CAAC;EAC1E,OAAM;AACL,SAAM,8BAA8B,YAAY;GAChD,MAAM,iBAAiB,MAAM,mBAAmB,QAAQ;AACxD,kBAAe,QAAQ,CAAC,OAAO,QAAQ,eAAe,OAAO,KAAK,MAAM,CAAC;EAC1E;EAED,MAAM,UAAU,IAAI,QAAQ;AAG5B,MAAI,UACF,SAAQ,OACN,eACC,oBAAoB,mBAAmB,UAAU,CAAC,+CACpD;MAED,SAAQ,OAAO,cAAc,gEAAgE;AAG/F,MAAI;GACF,MAAM,aAAa,MAAM,gBAAgB;GACzC,MAAM,iBAAiB,WAAW,gBAAgB;GAClD,MAAMY,mBAA2C,CAAE;GACnD,MAAM,iBAAiB,eAAe,UAAU,OAAO;AAEvD,OAAI,WAAW,kBAAkB,SAAS,eAAe,CACvD,kBAAiB,gBAAgB;YACxB,QACT,QAAO,KAAK,mGAAmG;IAC7G,aAAa,aAAa,QAAQ;IAClC,gBAAgB,gBAAgB,eAAe;IAC/C,UAAU,OAAO;GAClB,EAAC;AAGJ,OAAI,OAAO,sBACT,kBAAiB,2BAA2B,OAAO;GAGrD,MAAM,gBAAgB,KAAK,mBAAmB,YAAY,iBAAiB;AAC3E,UAAO,KAAK,wCAAwC;IAClD,oBAAoB,eAAe;IACnC,gBAAgB,QAAQ,iBAAiB,cAAc;GACxD,EAAC;AAEF,UAAO,uBAAuB,cAAc,UAAU,EAAE,EAAE,QAAS,EAAC;EACrE,SAAQ,OAAO;AACd,UAAO,KAAK,yEAAyE,EACnF,OAAO,qBAAqB,MAAM,CACnC,EAAC;EACH;EAGD,MAAM,iBAAiB,OAAO,yBAAyB;EACvD,MAAM,mBAAmB,uBAAuB,SAAS,eAAe;AAExE,SAAO,KAAK,oBAAoB,EAAE,aAAa,iBAAkB,EAAC;AAClE,SAAO,uBAAuB,kBAAkB,EAAE,QAAS,EAAC;CAC7D,SAAQ,OAAO;AACd,SAAO,MAAM,iBAAiB,iBAAiB,QAAQ,eAAkB;EACzE,MAAM,UAAU,MAAM,mBAAmB,QAAQ;AACjD,SAAO,uBAAuB,KAAK,EAAE,QAAS,EAAC;CAChD;AACF;;;;;;;;;AAUD,eAAsB,wBAAwB3C,SAAqC;AACjF,KAAI,QAAQ,WAAW,OACrB,QAAO,SAAS,KAAK,EAAE,OAAO,qBAAsB,GAAE,EAAE,QAAQ,IAAK,EAAC;AAGxE,KAAI;EACF,MAAM,SAAS,eAAe;EAC9B,MAAM,aAAa,MAAM,gBAAgB;EACzC,MAAM,iBAAiB,WAAW,gBAAgB;EAClD,MAAM,cAAc,MAAM,0BAA0B,QAAQ;AAE5D,OAAK,YACH,QAAO,SAAS,KAAK,EAAE,OAAO,uBAAwB,GAAE,EAAE,QAAQ,IAAK,EAAC;AAG1E,OAAK,eAAe,SAClB,OAAM,IAAI,MAAM;EAGlB,MAAM,EAAE,SAAS,GAAG,MAAM,UAAU,aAAa,QAAQ,eAAe,SAAS,EAAE;GACjF,QAAQ,eAAe,UAAU,OAAO;GACxC,UAAU,OAAO;GACjB,gBAAgB;EACjB,EAAC;EAEF,MAAM,SAAS,gCAAgC,SAAoC,OAAO,SAAS;EACnG,MAAM,oBAAoB,MAAM,qCAAqC;GACnE,KAAK,OAAO;GACZ,QAAQ,OAAO;EAChB,EAAC;EACF,MAAM4C,SAAkC;GACtC;GACA,QAAQ,OAAO;GACf,SAAS,OAAO;GAChB,KAAK,OAAO;EACb;AAED,SAAO,KAAK,iCAAiC,EAAE,GAAG,OAAQ,EAAC;AAC3D,SAAO,SAAS,KAAK;GAAE,SAAS;GAAM,GAAG;EAAQ,EAAC;CACnD,SAAQ,OAAO;AACd,SAAO,MAAM,8BAA8B,iBAAiB,QAAQ,eAAkB;AACtF,SAAO,SAAS,KACd;GAAE,OAAO;GAAwB,mBAAmB,qBAAqB,MAAM;EAAE,GACjF,EAAE,QAAQ,IAAK,EAChB;CACF;AACF;;;;;;;AAQD,eAAsB,yBAAyB5C,SAAqC;AAClF,KAAI;EACF,MAAM,SAAS,eAAe;EAC9B,MAAM,aAAa,MAAM,gBAAgB;EACzC,MAAM,iBAAiB,WAAW,gBAAgB;EAClD,MAAM,MAAM,IAAI,IAAI,QAAQ;EAC5B,MAAM,SAAS,IAAI,aAAa,IAAI,MAAM;EAC1C,MAAM,MAAM,IAAI,aAAa,IAAI,MAAM;EACvC,MAAM,iBAAiB,gBAAgB,eAAe,UAAU,OAAO,UAAU;AAEjF,OAAK,UAAU,gBAAgB,OAAO,KAAK,eACzC,QAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAK;EAG3C,MAAM,oBAAoB,MAAM,MAAM,yBAAyB,IAAI,GAAG;EACtE,MAAM6C,SAAmC;GACvC;GACA;GACA,KAAK;EACN;AAED,SAAO,KAAK,kCAAkC,EAAE,GAAG,OAAQ,EAAC;AAC5D,SAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,SAAS,EACP,iBAAiB,WAClB;EACF;CACF,SAAQ,OAAO;AACd,SAAO,KAAK,gCAAgC,EAC1C,OAAO,qBAAqB,MAAM,CACnC,EAAC;AAEF,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAK;CAC1C;AACF;;;;AAKD,eAAsB,QAAQ7C,SAA4C;AACxE,KAAI;EACF,MAAM,cAAc,MAAM,eAAe,QAAQ;AACjD,SAAO,YAAY,QAAQ;CAC5B,SAAQ,OAAO;AACd,SAAO,MAAM,sBAAsB,iBAAiB,QAAQ,eAAkB;AAC9E,SAAO;CACR;AACF;;;;AAKD,eAAsB,YAAYA,SAAqC;CACrE,MAAM,OAAO,MAAM,QAAQ,QAAQ;AAEnC,MAAK,MAAM;EACT,MAAM,MAAM,IAAI,IAAI,QAAQ;EAC5B,MAAM,aAAa,EAAE,IAAI,SAAS,EAAE,IAAI,OAAO;AAC/C,SAAO,KAAK,sCAAsC,EAAE,UAAW,EAAC;AAChE,QAAM,MAAM,MAAM,SAAS,UAAU;CACtC;AAED,QAAO;AACR;;;;AAKD,eAAsB,eAAeA,SAA0C;AAC7E,KAAI;EACF,MAAM,cAAc,MAAM,eAAe,QAAQ;AACjD,SAAO,YAAY,eAAe;CACnC,SAAQ,OAAO;AACd,SAAO,MAAM,8BAA8B,iBAAiB,QAAQ,eAAkB;AACtF,SAAO;CACR;AACF;;;;AAKD,eAAsB,cACpBA,SACA8C,cAC6B;AAC7B,KAAI;EACF,MAAM,cAAc,MAAM,eAAe,QAAQ;EACjD,MAAM,iBAAiB,gBAAgB,YAAY;AAEnD,OAAK,gBAAgB;AACnB,UAAO,KAAK,6BAA6B;AACzC,UAAO;IAAE,SAAS;IAAO,OAAO;IAA8B,cAAc;GAAM;EACnF;AAED,SAAO,KAAK,2BAA2B;EAEvC,MAAM,aAAa,MAAM,gBAAgB;EACzC,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,YAAY,eAAe;AAE9E,SAAO,KAAK,2BAA2B;EAEvC,MAAM,kBAAkB,cAAc,iBAAiB;EACvD,MAAM,YAAY,cAAc,aAC5B,KAAK,KAAK,GAAG,cAAc,aAAa,MACxC,YAAY;AAGhB,QAAM,kBAAkB,SAAS;GAC/B,aAAa,cAAc;GAC3B,cAAc;GACd,SAAS,cAAc;GACvB;GACA,cAAc,KAAK,KAAK;EACzB,EAAC;AAEF,SAAO;GACL,SAAS;GACT,QAAQ;IACN,cAAc,cAAc;IAC5B,eAAe;IACf,UAAU,cAAc;IACxB,YAAY,cAAc;GAC3B;EACF;CACF,SAAQ,OAAO;AACd,SAAO,MAAM,uCAAuC,iBAAiB,QAAQ,eAAkB;AAE/F,SAAO;GACL,SAAS;GACT,OAAO,qBAAqB,MAAM;GAClC,cAAc,4BAA4B,MAAM;EACjD;CACF;AACF;;;;AAQD,SAAgB,uBAA6B;AAC3C,mBAAkB;AAClB,WAAU,OAAO;AAClB"}

package/dist/auth.server-lC94lmlx.js

@@ -0,0 +1,5 @@
+import "./logging-DviiAkLx.js";
+import { isSessionValid } from "./redis-session-storage.server-v2VcpFsQ.js";
+import { clearAuthErrorHeaders, clearAuthServerCache, configureAuthClaimMapping, extractUserInfo, getAccessToken, getAuthError, getUser, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, login, logout, refreshTokens, requireAuth, resetAuthClaimMapping } from "./auth.server-D5oiz9aF.js";
+
+export { logout };

package/dist/identity/identity-context.server.d.ts

@@ -42,6 +42,8 @@ export interface UserContextInfo {
     currentTenant?: string;
     isOnboarded: boolean;
     permissions: string[];
+    hasEntitlement: boolean;
+    /** @deprecated Use hasEntitlement or app-specific fields instead. */
     hasSubscription: boolean;
     userId?: string;
     email?: string;

package/dist/identity/identity-context.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-context.server.d.ts","sourceRoot":"","sources":["../../src/identity/identity-context.server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAIlF;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAIpF;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAE7E;AAcD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA8BzF;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,UAAQ,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAuB9B;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAQ/D;AAED;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAI1F;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAE3E;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAgBhG;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,eAAe,CAAC,CA+B1B;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAGpF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAU7E"}
+{"version":3,"file":"identity-context.server.d.ts","sourceRoot":"","sources":["../../src/identity/identity-context.server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAIlF;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAIpF;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAE7E;AAcD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA8BzF;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,UAAQ,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAuB9B;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAQ/D;AAED;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAI1F;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAE3E;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAgBhG;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,qEAAqE;IACrE,eAAe,EAAE,OAAO,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,eAAe,CAAC,CAgC1B;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAGpF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAU7E"}

package/dist/identity/identity-store.d.ts

@@ -4,7 +4,19 @@
  * Centralized state management for identity context.
  */
 import type { IdentityContextData } from './types';
-interface IdentityState {
+export declare const initialIdentityContext: IdentityContextData;
+export interface IdentityContextFetchContext {
+    endpoint: string;
+    fetch: typeof fetch;
+    forceRefresh: boolean;
+    currentContext: IdentityContextData;
+}
+export interface IdentityPermissionsFetchContext {
+    endpoint: string;
+    fetch: typeof fetch;
+    currentContext: IdentityContextData;
+}
+export interface IdentityState {
     context: IdentityContextData;
     setContext: (context: Partial<IdentityContextData>) => void;
     refreshContext: () => Promise<void>;
@@ -21,8 +33,12 @@ export interface IdentityStoreConfig {
     permissionsEndpoint?: string;
     logoutPath?: string;
     fetcher?: typeof fetch;
+    fetchContext?: (context: IdentityContextFetchContext) => Promise<Partial<IdentityContextData> | null>;
+    fetchPermissions?: (context: IdentityPermissionsFetchContext) => Promise<string[]>;
     onUnauthorized?: (details: IdentityUnauthorizedDetails) => void;
 }
+export declare function normalizeIdentityContextPayload(payload: unknown): Partial<IdentityContextData> | null;
+export declare function normalizeIdentityPermissionsPayload(payload: unknown): string[];
 /**
  * Configure the identity store for different app/back-end conventions.
  */
@@ -40,6 +56,8 @@ export declare function configureIdentityEndpoints(config: {
 }): void;
 export declare const useIdentityStore: import("zustand").UseBoundStore<import("zustand").StoreApi<IdentityState>>;
 export declare const useIsOnboarded: () => boolean | undefined;
+export declare const useHasEntitlement: () => boolean | undefined;
+/** @deprecated Use useHasEntitlement or an app-specific selector instead. */
 export declare const useHasSubscription: () => boolean | undefined;
 export declare const useUserTenants: () => {
     tenants: string[] | undefined;
@@ -51,5 +69,4 @@ export declare const useIdentityContext: () => {
     refreshContext: () => Promise<void>;
     refreshPermissions: () => Promise<void>;
 };
-export {};
 //# sourceMappingURL=identity-store.d.ts.map

package/dist/identity/identity-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-store.d.ts","sourceRoot":"","sources":["../../src/identity/identity-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAwBnD,UAAU,aAAa;IACrB,OAAO,EAAE,mBAAmB,CAAC;IAG7B,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,mBAAmB,CAAC,KAAK,IAAI,CAAC;IAC5D,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,sBAAsB,GAAG,cAAc,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,2BAA2B,KAAK,IAAI,CAAC;CACjE;AAuCD;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAKxE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAI/C;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,IAAI,CAEP;AAED,eAAO,MAAM,gBAAgB,4EAuH1B,CAAC;AAGJ,eAAO,MAAM,cAAc,2BAA+D,CAAC;AAC3F,eAAO,MAAM,kBAAkB,2BAAmE,CAAC;AACnG,eAAO,MAAM,cAAc;;;CAItB,CAAC;AACN,eAAO,MAAM,kBAAkB,4BAA+D,CAAC;AAC/F,eAAO,MAAM,kBAAkB;;0BAvNP,OAAO,CAAC,IAAI,CAAC;8BACT,OAAO,CAAC,IAAI,CAAC;CA4NxC,CAAC"}
+{"version":3,"file":"identity-store.d.ts","sourceRoot":"","sources":["../../src/identity/identity-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEnD,eAAO,MAAM,sBAAsB,EAAE,mBAqBpC,CAAC;AAEF,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,cAAc,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,mBAAmB,CAAC;IAG7B,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,mBAAmB,CAAC,KAAK,IAAI,CAAC;IAC5D,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,sBAAsB,GAAG,cAAc,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,2BAA2B,KAAK,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,CAAC;IACtG,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,+BAA+B,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,2BAA2B,KAAK,IAAI,CAAC;CACjE;AAkDD,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAerG;AAED,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAiB9E;AA4ED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAKxE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAI/C;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,IAAI,CAEP;AAED,eAAO,MAAM,gBAAgB,4EAqG1B,CAAC;AAGJ,eAAO,MAAM,cAAc,2BAA+D,CAAC;AAC3F,eAAO,MAAM,iBAAiB,2BAAmG,CAAC;AAClI,6EAA6E;AAC7E,eAAO,MAAM,kBAAkB,2BAAmE,CAAC;AACnG,eAAO,MAAM,cAAc;;;CAItB,CAAC;AACN,eAAO,MAAM,kBAAkB,4BAA+D,CAAC;AAC/F,eAAO,MAAM,kBAAkB;;0BAlUP,OAAO,CAAC,IAAI,CAAC;8BACT,OAAO,CAAC,IAAI,CAAC;CAuUxC,CAAC"}

package/dist/identity/index.js

@@ -1,3 +1,3 @@
-import { IdentityContextProvider, configureIdentityEndpoints, configureIdentityStore, resetIdentityStoreConfig, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useUserPermissions, useUserTenants } from "../identity-CFa1txoj.js";
+import { IdentityContextProvider, configureIdentityEndpoints, configureIdentityStore, initialIdentityContext, normalizeIdentityContextPayload, normalizeIdentityPermissionsPayload, resetIdentityStoreConfig, useHasEntitlement, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useUserPermissions, useUserTenants } from "../identity-C5un-xAs.js";
 
-export { IdentityContextProvider, configureIdentityEndpoints, configureIdentityStore, resetIdentityStoreConfig, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useUserPermissions, useUserTenants };
+export { IdentityContextProvider, configureIdentityEndpoints, configureIdentityStore, initialIdentityContext, normalizeIdentityContextPayload, normalizeIdentityPermissionsPayload, resetIdentityStoreConfig, useHasEntitlement, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useUserPermissions, useUserTenants };

package/dist/identity/server.js

@@ -1,5 +1,5 @@
-import "../logging-_h2mi3L9.js";
-import "../types-BnKaWdfe.js";
-import { clearIdentityContextCache, configureIdentityAPIFetcher, configurePermissionFetcher, contextToUserInfo, fetchIdentityContext, fetchUserPermissions, getIdentityContext, hasContextVersionChanged, updateContextVersion } from "../server-C3L8J7iE.js";
+import "../logging-DviiAkLx.js";
+import "../types-BaaE6wjY.js";
+import { clearIdentityContextCache, configureIdentityAPIFetcher, configurePermissionFetcher, contextToUserInfo, fetchIdentityContext, fetchUserPermissions, getIdentityContext, hasContextVersionChanged, updateContextVersion } from "../server-Dxsww9v9.js";
 
 export { clearIdentityContextCache, configureIdentityAPIFetcher, configurePermissionFetcher, contextToUserInfo, fetchIdentityContext, fetchUserPermissions, getIdentityContext, hasContextVersionChanged, updateContextVersion };

package/dist/identity/types.d.ts

@@ -61,7 +61,9 @@ export interface IdentityContextData {
     memberships?: TenantMembership[];
     /** Whether user has completed onboarding */
     isOnboarded?: boolean;
-    /** Whether user has an active subscription */
+    /** Whether user has an active entitlement for gated product areas */
+    hasEntitlement?: boolean;
+    /** @deprecated Use hasEntitlement or app-specific metadata instead. */
     hasSubscription?: boolean;
     /** Whether user's email is verified */
     emailVerified?: boolean;

package/dist/identity/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAElC,6BAA6B;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,yCAAyC;IACzC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAGhC,0BAA0B;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uBAAuB;IACvB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAG1B,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,mCAAmC;IACnC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,iCAAiC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAGjC,4CAA4C;IAC5C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,8CAA8C;IAC9C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,uCAAuC;IACvC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,6BAA6B;IAC7B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAG3B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,0BAA0B;IAC1B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAGvB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,oCAAoC;IACpC,WAAW,CAAC,EAAE,IAAI,CAAC;IAGnB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,4BAA4B,GAAG,CAAC,KAAK,EAAE,2BAA2B,KAAK,IAAI,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAElC,6BAA6B;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,yCAAyC;IACzC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAGhC,0BAA0B;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uBAAuB;IACvB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAG1B,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,mCAAmC;IACnC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,iCAAiC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAGjC,4CAA4C;IAC5C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qEAAqE;IACrE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,uEAAuE;IACvE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,uCAAuC;IACvC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,6BAA6B;IAC7B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAG3B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,0BAA0B;IAC1B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAGvB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,oCAAoC;IACpC,WAAW,CAAC,EAAE,IAAI,CAAC;IAGnB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,4BAA4B,GAAG,CAAC,KAAK,EAAE,2BAA2B,KAAK,IAAI,CAAC"}

package/dist/{identity-CFa1txoj.js → identity-C5un-xAs.js}

@@ -3,8 +3,9 @@ import { useEffect } from "react";
 import { Fragment, jsx } from "react/jsx-runtime";
 
 //#region src/identity/identity-store.ts
-const initialContext = {
+const initialIdentityContext = {
 	hasAnyMembership: false,
+	hasEntitlement: false,
 	hasSubscription: false,
 	isOnboarded: false,
 	tenants: [],
@@ -31,12 +32,69 @@ const DEFAULT_IDENTITY_STORE_CONFIG = {
 	fetcher: (input, init) => fetch(input, init)
 };
 let identityStoreConfig = { ...DEFAULT_IDENTITY_STORE_CONFIG };
+var IdentityUnauthorizedError = class extends Error {
+	constructor(reason, response) {
+		super(reason);
+		this.reason = reason;
+		this.response = response;
+		this.name = "IdentityUnauthorizedError";
+	}
+};
 function getIdentityStoreConfig() {
 	return {
 		...DEFAULT_IDENTITY_STORE_CONFIG,
 		...identityStoreConfig
 	};
 }
+function isRecord(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function appendRefreshParam(endpoint, forceRefresh) {
+	if (!forceRefresh) return endpoint;
+	const separator = endpoint.includes("?") ? "&" : "?";
+	return `${endpoint}${separator}refresh=true`;
+}
+async function readJsonResponse(response) {
+	const text = await response.text();
+	return text.trim().length > 0 ? JSON.parse(text) : null;
+}
+function normalizeIdentityContextPayload(payload) {
+	if (!isRecord(payload)) return null;
+	if (payload.success === false) return null;
+	const nestedContext = payload.context ?? payload.data ?? payload.identity ?? payload.user;
+	if (isRecord(nestedContext)) return nestedContext;
+	return payload;
+}
+function normalizeIdentityPermissionsPayload(payload) {
+	if (Array.isArray(payload)) return payload.filter((permission) => typeof permission === "string");
+	if (!isRecord(payload)) return [];
+	const nestedPermissions = payload.permissions ?? (isRecord(payload.data) ? payload.data.permissions : payload.data) ?? (isRecord(payload.context) ? payload.context.permissions : void 0);
+	return Array.isArray(nestedPermissions) ? nestedPermissions.filter((permission) => typeof permission === "string") : [];
+}
+async function defaultFetchIdentityContext({ endpoint, fetch: fetchFn, forceRefresh }) {
+	const response = await fetchFn(appendRefreshParam(endpoint, forceRefresh), {
+		method: "GET",
+		headers: { "Content-Type": "application/json" }
+	});
+	if (response.ok) return normalizeIdentityContextPayload(await readJsonResponse(response));
+	if (response.status === 404) {
+		const errorData = await readJsonResponse(response).catch(() => ({}));
+		if (isRecord(errorData) && (errorData.code === "CurrentUserMissing" || errorData.title === "CurrentUserMissing")) throw new IdentityUnauthorizedError("current-user-missing", response);
+	}
+	if (response.status === 401) throw new IdentityUnauthorizedError("unauthorized", response);
+	console.error("Failed to refresh identity context:", response.status);
+	return null;
+}
+async function defaultFetchIdentityPermissions({ endpoint, fetch: fetchFn }) {
+	const response = await fetchFn(endpoint, {
+		method: "GET",
+		headers: { "Content-Type": "application/json" }
+	});
+	if (response.ok) return normalizeIdentityPermissionsPayload(await readJsonResponse(response));
+	if (response.status === 401) throw new IdentityUnauthorizedError("unauthorized", response);
+	console.error("Failed to refresh permissions:", response.status);
+	return [];
+}
 function handleUnauthorized(details) {
 	const config = getIdentityStoreConfig();
 	const unauthorizedDetails = {
@@ -70,8 +128,8 @@ function resetIdentityStoreConfig() {
 function configureIdentityEndpoints(config) {
 	configureIdentityStore(config);
 }
-const useIdentityStore = create((set) => ({
-	context: initialContext,
+const useIdentityStore = create((set, get) => ({
+	context: initialIdentityContext,
 	setContext: (newContext) => {
 		set((state) => ({ context: {
 			...state.context,
@@ -87,48 +145,33 @@ const useIdentityStore = create((set) => ({
 				...state.context,
 				isLoading: true
 			} }));
-			const response = await config.fetcher(`${config.contextEndpoint}?refresh=true`, {
-				method: "GET",
-				headers: { "Content-Type": "application/json" }
+			const fetchContext = config.fetchContext ?? defaultFetchIdentityContext;
+			const newContext = await fetchContext({
+				endpoint: config.contextEndpoint,
+				fetch: config.fetcher,
+				forceRefresh: true,
+				currentContext: get().context
 			});
-			if (response.ok) {
-				const newContext = await response.json();
+			if (newContext) {
 				set({ context: {
+					...get().context,
 					...newContext,
 					isLoading: false,
 					lastUpdated: new Date()
 				} });
 				console.log("Identity context refreshed:", newContext);
-			} else if (response.status === 404) {
-				const errorData = await response.json().catch(() => ({}));
-				if (errorData.code === "CurrentUserMissing" || errorData.title === "CurrentUserMissing") {
-					console.error("CurrentUserMissing error - session is invalid, redirecting to logout");
-					handleUnauthorized({
-						reason: "current-user-missing",
-						response
-					});
-					return;
-				}
-				console.error("Failed to refresh identity context:", response.status);
-				set((state) => ({ context: {
-					...state.context,
-					isLoading: false
-				} }));
-			} else if (response.status === 401) {
-				console.error("Identity context refresh returned 401, redirecting to logout");
+			} else set((state) => ({ context: {
+				...state.context,
+				isLoading: false
+			} }));
+		} catch (error) {
+			if (error instanceof IdentityUnauthorizedError) {
 				handleUnauthorized({
-					reason: "unauthorized",
-					response
+					reason: error.reason,
+					response: error.response
 				});
 				return;
-			} else {
-				console.error("Failed to refresh identity context:", response.status);
-				set((state) => ({ context: {
-					...state.context,
-					isLoading: false
-				} }));
 			}
-		} catch (error) {
 			console.error("Error refreshing identity context:", error);
 			set((state) => ({ context: {
 				...state.context,
@@ -140,35 +183,36 @@ const useIdentityStore = create((set) => ({
 		try {
 			const config = getIdentityStoreConfig();
 			console.log("Refreshing permissions...");
-			const response = await config.fetcher(config.permissionsEndpoint, {
-				method: "GET",
-				headers: { "Content-Type": "application/json" }
+			const fetchPermissions = config.fetchPermissions ?? defaultFetchIdentityPermissions;
+			const permissions = await fetchPermissions({
+				endpoint: config.permissionsEndpoint,
+				fetch: config.fetcher,
+				currentContext: get().context
 			});
-			if (response.ok) {
-				const result = await response.json();
-				const permissions = result.data?.permissions || [];
-				set((state) => ({ context: {
-					...state.context,
-					permissions,
-					lastUpdated: new Date()
-				} }));
-				console.log("Permissions refreshed:", { count: permissions.length });
-			} else if (response.status === 401) {
-				console.error("Permissions refresh returned 401, redirecting to logout");
+			set((state) => ({ context: {
+				...state.context,
+				permissions,
+				lastUpdated: new Date()
+			} }));
+			console.log("Permissions refreshed:", { count: permissions.length });
+		} catch (error) {
+			if (error instanceof IdentityUnauthorizedError) {
 				handleUnauthorized({
-					reason: "unauthorized",
-					response
+					reason: error.reason,
+					response: error.response
 				});
-			} else console.error("Failed to refresh permissions:", response.status);
-		} catch (error) {
+				return;
+			}
 			console.error("Error refreshing permissions:", error);
 		}
 	},
 	reset: () => {
-		set({ context: initialContext });
+		set({ context: initialIdentityContext });
 	}
 }));
 const useIsOnboarded = () => useIdentityStore((state) => state.context.isOnboarded);
+const useHasEntitlement = () => useIdentityStore((state) => state.context.hasEntitlement ?? state.context.hasSubscription);
+/** @deprecated Use useHasEntitlement or an app-specific selector instead. */
 const useHasSubscription = () => useIdentityStore((state) => state.context.hasSubscription);
 const useUserTenants = () => useIdentityStore((state) => ({
 	tenants: state.context.tenants,
@@ -188,14 +232,14 @@ const useIdentityContext = () => {
 
 //#endregion
 //#region src/identity/identity-context-provider.tsx
-function IdentityContextProvider({ children, initialContext: initialContext$1, accessToken, signalRClient }) {
+function IdentityContextProvider({ children, initialContext, accessToken, signalRClient }) {
 	const setContext = useIdentityStore((state) => state.setContext);
 	const refreshContext = useIdentityStore((state) => state.refreshContext);
 	const refreshPermissions = useIdentityStore((state) => state.refreshPermissions);
 	const contextVersion = useIdentityStore((state) => state.context.contextVersion);
 	useEffect(() => {
-		if (initialContext$1) setContext(initialContext$1);
-	}, [initialContext$1, setContext]);
+		if (initialContext) setContext(initialContext);
+	}, [initialContext, setContext]);
 	useEffect(() => {
 		if (!signalRClient) return;
 		const handleContextChange = (event) => {
@@ -218,8 +262,8 @@ function IdentityContextProvider({ children, initialContext: initialContext$1, a
 		signalRClient
 	]);
 	useEffect(() => {
-		if (!initialContext$1) refreshContext();
-	}, [initialContext$1, refreshContext]);
+		if (!initialContext) refreshContext();
+	}, [initialContext, refreshContext]);
 	useEffect(() => {
 		return () => {
 			if (signalRClient) signalRClient.disconnect().catch((error) => {
@@ -231,5 +275,5 @@ function IdentityContextProvider({ children, initialContext: initialContext$1, a
 }
 
 //#endregion
-export { IdentityContextProvider, configureIdentityEndpoints, configureIdentityStore, resetIdentityStoreConfig, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useUserPermissions, useUserTenants };
-//# sourceMappingURL=identity-CFa1txoj.js.map
+export { IdentityContextProvider, configureIdentityEndpoints, configureIdentityStore, initialIdentityContext, normalizeIdentityContextPayload, normalizeIdentityPermissionsPayload, resetIdentityStoreConfig, useHasEntitlement, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useUserPermissions, useUserTenants };
+//# sourceMappingURL=identity-C5un-xAs.js.map