@eminuckan/spine 0.2.4 → 0.3.0

package/dist/{redis-session-storage.server-D0-72FV-.js.map → redis-session-storage.server-v2VcpFsQ.js.map}

@@ -1 +1 @@
-{"version":3,"file":"redis-session-storage.server-D0-72FV-.js","names":["redis: Redis | null","stateId: string","sessionId: string","userId: string","sid: string","sessionState: string","name: string","defaultValue: boolean","defaultValue: number","value: string","enabled: boolean","cookieHeader: string | null","secret: string","left: string","right: string","cookieValue: string | undefined","decodedValue: string","options: SessionCookieOptions","request: Request","data: SessionData","sessionData: string | null","existingData: SessionData","updates: Partial<SessionData>","indexKey: string","activeSessionIds: string[]","staleSessionIds: string[]","session: SessionData","currentSessionId?: string | null","sessionIds: string[]","sessions: Array<{ sessionId: string; data: SessionData }>","sessionData: Partial<SessionData>","params: {\n  sid?: string;\n  sessionState?: string;\n  userId?: string;\n}","state: OAuthState"],"sources":["../src/auth/redis-session-storage.server.ts"],"sourcesContent":["/**\n * Redis Session Storage Server Module\n *\n * Redis-backed session storage for authentication.\n * Provides secure session management with automatic expiration,\n * without depending on a framework-specific session implementation.\n */\n\nimport Redis from 'ioredis';\nimport { createCipheriv, createDecipheriv, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';\nimport type { AuthSessionSummary, SessionData, OAuthState } from './types';\nimport { logger } from '../logging';\n\n// ============================================================================\n// Redis Client Setup\n// ============================================================================\n\nlet redis: Redis | null = null;\n\nfunction getRedis(): Redis {\n  if (!redis) {\n    redis = new Redis(process.env.REDIS_URL || 'redis://localhost:6379');\n\n    redis.on('error', (err) => {\n      logger.error('Redis Client Error', err);\n    });\n\n    redis.on('connect', () => {\n      logger.info('Redis connected successfully');\n    });\n  }\n  return redis;\n}\n\n// ============================================================================\n// Redis Key Patterns\n// ============================================================================\n\nconst KEY_PREFIX = process.env.REDIS_KEY_PREFIX || '';\n\nconst REDIS_KEYS = {\n  oauthState: (stateId: string) => `${KEY_PREFIX}oauth:state:${stateId}`,\n  session: (sessionId: string) => `${KEY_PREFIX}session:${sessionId}`,\n  sessionByUser: (userId: string) => `${KEY_PREFIX}session:index:user:${userId}`,\n  sessionBySid: (sid: string) => `${KEY_PREFIX}session:index:sid:${sid}`,\n  sessionBySessionState: (sessionState: string) => `${KEY_PREFIX}session:index:session_state:${sessionState}`,\n};\n\nconst DEFAULT_SESSION_SECRET = 'default-secret-change-in-production';\nconst DEFAULT_SESSION_TTL = 60 * 60 * 24 * 7;\nconst DEFAULT_OAUTH_STATE_TTL = 10 * 60;\n\nconst OAUTH_STATE_TTL = resolvePositiveIntegerEnv('OAUTH_STATE_TTL', DEFAULT_OAUTH_STATE_TTL);\nconst SESSION_TTL = resolvePositiveIntegerEnv('SESSION_DEFAULT_TTL', resolvePositiveIntegerEnv('SESSION_TTL', DEFAULT_SESSION_TTL));\n\nconst SESSION_COOKIE_NAME = process.env.SESSION_COOKIE_NAME || '__session_id';\nconst SESSION_SECRET = resolveSessionSecret();\nconst SESSION_COOKIE_SECURE = resolveCookieSecure();\nconst SESSION_COOKIE_PATH = '/';\nconst SESSION_COOKIE_SAME_SITE = resolveCookieSameSite();\nconst SESSION_COOKIE_DOMAIN = process.env.SESSION_COOKIE_DOMAIN?.trim();\nconst SESSION_ENCRYPTION_ENABLED = resolveSessionEncryptionEnabled();\nconst SESSION_ENCRYPTION_KEY = resolveSessionEncryptionKey(SESSION_ENCRYPTION_ENABLED);\n\nexport const AUTH_ERROR_COOKIE_PREFIX = SESSION_COOKIE_NAME.replace('_session', '').replace('__', '');\n\nfunction resolveBooleanEnv(name: string, defaultValue: boolean): boolean {\n  const value = process.env[name]?.trim().toLowerCase();\n  if (!value) {\n    return defaultValue;\n  }\n\n  if (['1', 'true', 'yes', 'on'].includes(value)) {\n    return true;\n  }\n\n  if (['0', 'false', 'no', 'off'].includes(value)) {\n    return false;\n  }\n\n  throw new Error(`${name} must be a boolean value.`);\n}\n\nfunction resolvePositiveIntegerEnv(name: string, defaultValue: number): number {\n  const value = process.env[name]?.trim();\n  if (!value) {\n    return defaultValue;\n  }\n\n  const parsed = Number(value);\n  if (!Number.isSafeInteger(parsed) || parsed <= 0) {\n    throw new Error(`${name} must be a positive integer.`);\n  }\n\n  return parsed;\n}\n\nfunction resolveSessionSecret(): string {\n  const secret = process.env.SESSION_SECRET?.trim();\n  if (!secret || secret === DEFAULT_SESSION_SECRET) {\n    if (process.env.NODE_ENV === 'production') {\n      throw new Error('SESSION_SECRET must be set to a unique random value in production.');\n    }\n\n    return DEFAULT_SESSION_SECRET;\n  }\n\n  if (secret.length < 32) {\n    throw new Error('SESSION_SECRET must be at least 32 characters long.');\n  }\n\n  return secret;\n}\n\nfunction resolveCookieSecure(): boolean {\n  return resolveBooleanEnv('SESSION_COOKIE_SECURE', process.env.NODE_ENV === 'production');\n}\n\nfunction resolveCookieSameSite(): 'Lax' | 'Strict' | 'None' {\n  const value = process.env.SESSION_COOKIE_SAME_SITE?.trim().toLowerCase();\n  const sameSite = value === 'strict' ? 'Strict' : value === 'none' ? 'None' : 'Lax';\n\n  if (sameSite === 'None' && !SESSION_COOKIE_SECURE) {\n    throw new Error('SESSION_COOKIE_SAME_SITE=None requires SESSION_COOKIE_SECURE=true.');\n  }\n\n  return sameSite;\n}\n\nfunction resolveSessionEncryptionEnabled(): boolean {\n  const enabled = resolveBooleanEnv('SESSION_ENCRYPTION', process.env.NODE_ENV === 'production');\n  if (process.env.NODE_ENV === 'production' && !enabled) {\n    throw new Error('SESSION_ENCRYPTION cannot be disabled in production.');\n  }\n\n  return enabled;\n}\n\nfunction decodeBase64Url(value: string): Buffer {\n  const normalized = value.replace(/-/g, '+').replace(/_/g, '/');\n  const padded = normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), '=');\n  return Buffer.from(padded, 'base64');\n}\n\nfunction resolveSessionEncryptionKey(enabled: boolean): Buffer | null {\n  if (!enabled) {\n    return null;\n  }\n\n  const value = process.env.SESSION_ENCRYPTION_KEY?.trim();\n  if (!value) {\n    throw new Error('SESSION_ENCRYPTION_KEY is required when session encryption is enabled.');\n  }\n\n  const key = /^[0-9a-f]{64}$/i.test(value)\n    ? Buffer.from(value, 'hex')\n    : decodeBase64Url(value);\n\n  if (key.length !== 32) {\n    throw new Error('SESSION_ENCRYPTION_KEY must decode to exactly 32 bytes. Generate one with: openssl rand -base64 32');\n  }\n\n  return key;\n}\n\ntype SessionCookieOptions = {\n  maxAge: number;\n};\n\nfunction parseCookieHeader(cookieHeader: string | null): Record<string, string> {\n  if (!cookieHeader) {\n    return {};\n  }\n\n  return cookieHeader\n    .split(';')\n    .map((part) => part.trim())\n    .filter(Boolean)\n    .reduce<Record<string, string>>((cookies, part) => {\n      const separatorIndex = part.indexOf('=');\n      if (separatorIndex <= 0) {\n        return cookies;\n      }\n\n      const name = part.slice(0, separatorIndex).trim();\n      const value = part.slice(separatorIndex + 1).trim();\n      if (!name) {\n        return cookies;\n      }\n\n      cookies[name] = value;\n      return cookies;\n    }, {});\n}\n\nfunction createCookieSignature(value: string, secret: string): string {\n  return createHmac('sha256', secret).update(value).digest('base64url');\n}\n\nfunction safelyCompareValues(left: string, right: string): boolean {\n  const leftBuffer = Buffer.from(left);\n  const rightBuffer = Buffer.from(right);\n\n  if (leftBuffer.length !== rightBuffer.length) {\n    return false;\n  }\n\n  return timingSafeEqual(leftBuffer, rightBuffer);\n}\n\nfunction signSessionId(sessionId: string): string {\n  const signature = createCookieSignature(sessionId, SESSION_SECRET);\n  return `${sessionId}.${signature}`;\n}\n\nfunction unsignSessionId(cookieValue: string | undefined): string | null {\n  if (!cookieValue) {\n    return null;\n  }\n\n  let decodedValue: string;\n  try {\n    decodedValue = decodeURIComponent(cookieValue);\n  } catch {\n    return null;\n  }\n\n  const separatorIndex = decodedValue.lastIndexOf('.');\n  if (separatorIndex <= 0 || separatorIndex === decodedValue.length - 1) {\n    return null;\n  }\n\n  const sessionId = decodedValue.slice(0, separatorIndex);\n  const signature = decodedValue.slice(separatorIndex + 1);\n  const expectedSignature = createCookieSignature(sessionId, SESSION_SECRET);\n\n  return safelyCompareValues(signature, expectedSignature) ? sessionId : null;\n}\n\nfunction serializeSessionCookieValue(sessionId: string, options: SessionCookieOptions): string {\n  const signedValue = encodeURIComponent(signSessionId(sessionId));\n  const segments = [\n    `${SESSION_COOKIE_NAME}=${signedValue}`,\n    `Max-Age=${options.maxAge}`,\n    `Path=${SESSION_COOKIE_PATH}`,\n    `SameSite=${SESSION_COOKIE_SAME_SITE}`,\n    'HttpOnly',\n  ];\n\n  if (SESSION_COOKIE_DOMAIN) {\n    segments.push(`Domain=${SESSION_COOKIE_DOMAIN}`);\n  }\n\n  if (SESSION_COOKIE_SECURE) {\n    segments.push('Secure');\n  }\n\n  return segments.join('; ');\n}\n\nfunction serializeExpiredSessionCookie(): string {\n  const segments = [\n    `${SESSION_COOKIE_NAME}=`,\n    'Max-Age=0',\n    `Path=${SESSION_COOKIE_PATH}`,\n    `SameSite=${SESSION_COOKIE_SAME_SITE}`,\n    'HttpOnly',\n  ];\n\n  if (SESSION_COOKIE_DOMAIN) {\n    segments.push(`Domain=${SESSION_COOKIE_DOMAIN}`);\n  }\n\n  if (SESSION_COOKIE_SECURE) {\n    segments.push('Secure');\n  }\n\n  return segments.join('; ');\n}\n\nasync function getSessionIdFromRequest(request: Request): Promise<string | null> {\n  const cookies = parseCookieHeader(request.headers.get('Cookie'));\n  return unsignSessionId(cookies[SESSION_COOKIE_NAME]);\n}\n\nfunction getSessionIndexKeys(data: SessionData): string[] {\n  const keys = new Set<string>();\n\n  if (data.userId) {\n    keys.add(REDIS_KEYS.sessionByUser(data.userId));\n  }\n\n  if (data.sid) {\n    keys.add(REDIS_KEYS.sessionBySid(data.sid));\n  }\n\n  if (data.sessionState) {\n    keys.add(REDIS_KEYS.sessionBySessionState(data.sessionState));\n  }\n\n  return Array.from(keys);\n}\n\nasync function registerSessionIndexes(sessionId: string, data: SessionData): Promise<void> {\n  const indexKeys = getSessionIndexKeys(data);\n  if (indexKeys.length === 0) {\n    return;\n  }\n\n  const redisClient = getRedis();\n  const pipeline = redisClient.pipeline();\n\n  for (const indexKey of indexKeys) {\n    pipeline.sadd(indexKey, sessionId);\n    pipeline.expire(indexKey, SESSION_TTL);\n  }\n\n  await pipeline.exec();\n}\n\nasync function unregisterSessionIndexes(sessionId: string, data: SessionData): Promise<void> {\n  const indexKeys = getSessionIndexKeys(data);\n  if (indexKeys.length === 0) {\n    return;\n  }\n\n  const redisClient = getRedis();\n  const pipeline = redisClient.pipeline();\n\n  for (const indexKey of indexKeys) {\n    pipeline.srem(indexKey, sessionId);\n  }\n\n  await pipeline.exec();\n}\n\nfunction parseSessionData(sessionData: string | null): SessionData | null {\n  if (!sessionData) {\n    return null;\n  }\n\n  try {\n    return JSON.parse(decodeSessionData(sessionData)) as SessionData;\n  } catch (error) {\n    logger.error('Failed to parse session data', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\nfunction encodeSessionData(data: SessionData): string {\n  const plaintext = JSON.stringify(data);\n  if (!SESSION_ENCRYPTION_KEY) {\n    return plaintext;\n  }\n\n  const iv = randomBytes(12);\n  const cipher = createCipheriv('aes-256-gcm', SESSION_ENCRYPTION_KEY, iv);\n  const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);\n  const tag = cipher.getAuthTag();\n\n  return [\n    'enc:v1',\n    iv.toString('base64url'),\n    tag.toString('base64url'),\n    ciphertext.toString('base64url'),\n  ].join(':');\n}\n\nfunction decodeSessionData(value: string): string {\n  if (!value.startsWith('enc:v1:')) {\n    if (SESSION_ENCRYPTION_ENABLED) {\n      logger.warn('Reading legacy plaintext auth session payload while session encryption is enabled.');\n    }\n\n    return value;\n  }\n\n  if (!SESSION_ENCRYPTION_KEY) {\n    throw new Error('Cannot decrypt auth session payload because SESSION_ENCRYPTION_KEY is not configured.');\n  }\n\n  const [, version, ivValue, tagValue, ciphertextValue] = value.split(':');\n  if (version !== 'v1' || !ivValue || !tagValue || !ciphertextValue) {\n    throw new Error('Invalid encrypted auth session payload format.');\n  }\n\n  const decipher = createDecipheriv('aes-256-gcm', SESSION_ENCRYPTION_KEY, Buffer.from(ivValue, 'base64url'));\n  decipher.setAuthTag(Buffer.from(tagValue, 'base64url'));\n\n  return Buffer.concat([\n    decipher.update(Buffer.from(ciphertextValue, 'base64url')),\n    decipher.final(),\n  ]).toString('utf8');\n}\n\nasync function readSessionData(sessionId: string): Promise<SessionData | null> {\n  try {\n    const sessionData = await getRedis().get(REDIS_KEYS.session(sessionId));\n    if (!sessionData) {\n      logger.debug('Session not found in Redis', { sessionId });\n      return null;\n    }\n\n    await getRedis().expire(REDIS_KEYS.session(sessionId), SESSION_TTL);\n    return parseSessionData(sessionData);\n  } catch (error) {\n    logger.error('Failed to read session from Redis', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\nasync function writeSessionData(sessionId: string, data: SessionData): Promise<void> {\n  try {\n    const existingSessionData = parseSessionData(await getRedis().get(REDIS_KEYS.session(sessionId)));\n    if (existingSessionData) {\n      await unregisterSessionIndexes(sessionId, existingSessionData);\n    }\n\n    await getRedis().setex(REDIS_KEYS.session(sessionId), SESSION_TTL, encodeSessionData(data));\n    await registerSessionIndexes(sessionId, data);\n    logger.debug('Updated Redis session', { sessionId });\n  } catch (error) {\n    logger.error('Failed to update session in Redis', error instanceof Error ? error : undefined);\n    throw error;\n  }\n}\n\nasync function deleteSessionData(sessionId: string): Promise<void> {\n  try {\n    const existingSessionData = parseSessionData(await getRedis().get(REDIS_KEYS.session(sessionId)));\n    if (existingSessionData) {\n      await unregisterSessionIndexes(sessionId, existingSessionData);\n    }\n\n    await getRedis().del(REDIS_KEYS.session(sessionId));\n    logger.debug('Deleted Redis session', { sessionId });\n  } catch (error) {\n    logger.error('Failed to delete session from Redis', error instanceof Error ? error : undefined);\n  }\n}\n\nfunction mergeSessionData(existingData: SessionData, updates: Partial<SessionData>): SessionData {\n  const nextData = { ...existingData } as Record<string, unknown>;\n\n  Object.entries(updates).forEach(([key, value]) => {\n    if (value === undefined) {\n      delete nextData[key];\n      return;\n    }\n\n    nextData[key] = value;\n  });\n\n  return nextData as SessionData;\n}\n\nasync function getSessionIdsFromIndex(indexKey: string): Promise<string[]> {\n  const sessionIds = await getRedis().smembers(indexKey);\n  const activeSessionIds: string[] = [];\n  const staleSessionIds: string[] = [];\n\n  for (const sessionId of sessionIds) {\n    const exists = await getRedis().exists(REDIS_KEYS.session(sessionId));\n    if (exists) {\n      activeSessionIds.push(sessionId);\n    } else {\n      staleSessionIds.push(sessionId);\n    }\n  }\n\n  if (staleSessionIds.length > 0) {\n    await getRedis().srem(indexKey, ...staleSessionIds);\n  }\n\n  return activeSessionIds;\n}\n\nfunction toAuthSessionSummary(\n  sessionId: string,\n  session: SessionData,\n  currentSessionId?: string | null\n): AuthSessionSummary {\n  return {\n    sessionId,\n    userId: session.userId,\n    email: session.user?.email,\n    name: session.user?.name,\n    issuer: session.issuer,\n    sid: session.sid,\n    sessionState: session.sessionState,\n    clientId: session.clientId,\n    ipAddress: session.ipAddress,\n    userAgent: session.userAgent,\n    createdAt: session.createdAt,\n    lastActivity: session.lastActivity,\n    expiresAt: session.expiresAt,\n    isCurrent: currentSessionId ? sessionId === currentSessionId : undefined,\n  };\n}\n\nasync function listSessionDataByIds(sessionIds: string[]): Promise<Array<{ sessionId: string; data: SessionData }>> {\n  const sessions: Array<{ sessionId: string; data: SessionData }> = [];\n\n  for (const sessionId of sessionIds) {\n    const data = await readSessionData(sessionId);\n    if (data) {\n      sessions.push({ sessionId, data });\n    }\n  }\n\n  return sessions;\n}\n\nfunction getRequestIpAddress(request: Request): string | undefined {\n  const forwardedFor = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim();\n  return (\n    forwardedFor ||\n    request.headers.get('cf-connecting-ip')?.trim() ||\n    request.headers.get('x-real-ip')?.trim() ||\n    undefined\n  );\n}\n\n// ============================================================================\n// Session Helper Functions\n// ============================================================================\n\nexport async function createAuthSession(\n  request: Request,\n  sessionData: Partial<SessionData>\n): Promise<Headers> {\n  const currentSessionId = await getSessionIdFromRequest(request);\n  const nextSessionId = crypto.randomUUID();\n  const nextSessionData = mergeSessionData({}, {\n    ...sessionData,\n    sessionId: nextSessionId,\n    ipAddress: sessionData.ipAddress ?? getRequestIpAddress(request),\n    userAgent: sessionData.userAgent ?? request.headers.get('user-agent') ?? undefined,\n  });\n\n  logger.debug('Creating auth session', { dataKeys: Object.keys(sessionData) });\n\n  if (currentSessionId) {\n    await deleteSessionData(currentSessionId);\n  }\n\n  await writeSessionData(nextSessionId, nextSessionData);\n\n  return new Headers({\n    'Set-Cookie': serializeSessionCookieValue(nextSessionId, { maxAge: SESSION_TTL }),\n  });\n}\n\nexport async function getAuthSession(request: Request): Promise<SessionData> {\n  const sessionId = await getSessionIdFromRequest(request);\n  if (!sessionId) {\n    return {};\n  }\n\n  const session = await readSessionData(sessionId);\n  if (!session) {\n    return {};\n  }\n\n  return {\n    sessionId,\n    userId: session.userId,\n    accessToken: session.accessToken,\n    refreshToken: session.refreshToken,\n    idToken: session.idToken,\n    expiresAt: session.expiresAt,\n    issuer: session.issuer,\n    sid: session.sid,\n    sessionState: session.sessionState,\n    clientId: session.clientId,\n    ipAddress: session.ipAddress,\n    userAgent: session.userAgent,\n    user: session.user,\n    createdAt: session.createdAt,\n    lastActivity: session.lastActivity,\n  };\n}\n\nexport async function updateAuthSession(\n  request: Request,\n  updates: Partial<SessionData>\n): Promise<Headers> {\n  const currentSessionId = await getSessionIdFromRequest(request);\n  const currentSessionData = currentSessionId\n    ? (await readSessionData(currentSessionId)) ?? {}\n    : {};\n  const nextSessionId = currentSessionId ?? crypto.randomUUID();\n  const nextSessionData = mergeSessionData(currentSessionData, {\n    ...updates,\n    sessionId: nextSessionId,\n  });\n\n  await writeSessionData(nextSessionId, nextSessionData);\n\n  return new Headers({\n    'Set-Cookie': serializeSessionCookieValue(nextSessionId, { maxAge: SESSION_TTL }),\n  });\n}\n\nexport async function destroyAuthSession(request: Request): Promise<Headers> {\n  const sessionId = await getSessionIdFromRequest(request);\n  if (sessionId) {\n    await deleteSessionData(sessionId);\n  }\n\n  return new Headers({\n    'Set-Cookie': serializeExpiredSessionCookie(),\n  });\n}\n\nexport async function getCurrentAuthSessionId(request: Request): Promise<string | null> {\n  return await getSessionIdFromRequest(request);\n}\n\nexport async function getAuthSessionById(sessionId: string): Promise<SessionData | null> {\n  const session = await readSessionData(sessionId);\n  return session ? { ...session, sessionId } : null;\n}\n\nexport async function listAuthSessionDataForUser(\n  userId: string\n): Promise<Array<{ sessionId: string; data: SessionData }>> {\n  const sessionIds = await getSessionIdsFromIndex(REDIS_KEYS.sessionByUser(userId));\n  return await listSessionDataByIds(sessionIds);\n}\n\nexport async function listAuthSessionsForUser(\n  userId: string,\n  currentSessionId?: string | null\n): Promise<AuthSessionSummary[]> {\n  const sessions = await listAuthSessionDataForUser(userId);\n\n  return sessions\n    .map(({ sessionId, data }) => toAuthSessionSummary(sessionId, data, currentSessionId))\n    .sort((left, right) => (right.lastActivity ?? right.createdAt ?? 0) - (left.lastActivity ?? left.createdAt ?? 0));\n}\n\nexport async function listCurrentUserAuthSessions(request: Request): Promise<AuthSessionSummary[]> {\n  const currentSession = await getAuthSession(request);\n  if (!currentSession.userId) {\n    return [];\n  }\n\n  return await listAuthSessionsForUser(currentSession.userId, currentSession.sessionId);\n}\n\nexport async function destroyAuthSessionById(sessionId: string): Promise<boolean> {\n  const session = await readSessionData(sessionId);\n  if (!session) {\n    return false;\n  }\n\n  await deleteSessionData(sessionId);\n  return true;\n}\n\nexport async function destroyAuthSessionsForUser(userId: string): Promise<number> {\n  const sessionIds = await getSessionIdsFromIndex(REDIS_KEYS.sessionByUser(userId));\n  let destroyedSessions = 0;\n\n  for (const sessionId of sessionIds) {\n    if (await destroyAuthSessionById(sessionId)) {\n      destroyedSessions += 1;\n    }\n  }\n\n  return destroyedSessions;\n}\n\nexport async function destroyAuthSessionsBySid(sid: string): Promise<number> {\n  const sessionIds = await getSessionIdsFromIndex(REDIS_KEYS.sessionBySid(sid));\n  let destroyedSessions = 0;\n\n  for (const sessionId of sessionIds) {\n    if (await destroyAuthSessionById(sessionId)) {\n      destroyedSessions += 1;\n    }\n  }\n\n  return destroyedSessions;\n}\n\nexport async function destroyAuthSessionsBySessionState(sessionState: string): Promise<number> {\n  const sessionIds = await getSessionIdsFromIndex(REDIS_KEYS.sessionBySessionState(sessionState));\n  let destroyedSessions = 0;\n\n  for (const sessionId of sessionIds) {\n    if (await destroyAuthSessionById(sessionId)) {\n      destroyedSessions += 1;\n    }\n  }\n\n  return destroyedSessions;\n}\n\nexport async function destroyAuthSessionsByIdentitySession(params: {\n  sid?: string;\n  sessionState?: string;\n  userId?: string;\n}): Promise<number> {\n  if (params.sid) {\n    return await destroyAuthSessionsBySid(params.sid);\n  }\n\n  if (params.sessionState) {\n    return await destroyAuthSessionsBySessionState(params.sessionState);\n  }\n\n  if (params.userId) {\n    return await destroyAuthSessionsForUser(params.userId);\n  }\n\n  return 0;\n}\n\nexport async function requireAuthSession(request: Request): Promise<SessionData> {\n  const sessionData = await getAuthSession(request);\n\n  if (!sessionData.userId || !sessionData.accessToken) {\n    throw new Response('Unauthorized', { status: 401 });\n  }\n\n  return sessionData;\n}\n\nexport async function isSessionValid(request: Request): Promise<boolean> {\n  try {\n    const sessionData = await getAuthSession(request);\n\n    if (!sessionData.user || !sessionData.accessToken) {\n      return false;\n    }\n\n    if (sessionData.expiresAt && Date.now() >= sessionData.expiresAt) {\n      return false;\n    }\n\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n// ============================================================================\n// OAuth State Management\n// ============================================================================\n\nexport async function createOAuthState(state: OAuthState): Promise<string> {\n  const stateId = crypto.randomUUID();\n  const key = REDIS_KEYS.oauthState(stateId);\n\n  await getRedis().setex(key, OAUTH_STATE_TTL, JSON.stringify(state));\n\n  logger.debug('OAuth state created', { stateId, ttl: OAUTH_STATE_TTL });\n\n  return stateId;\n}\n\nexport async function getOAuthState(stateId: string): Promise<OAuthState | null> {\n  const key = REDIS_KEYS.oauthState(stateId);\n  const data = await getRedis().get(key);\n\n  if (!data) {\n    logger.warn('OAuth state not found or expired', { stateId });\n    return null;\n  }\n\n  try {\n    return JSON.parse(data);\n  } catch (error) {\n    logger.error('Failed to parse OAuth state', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\nexport async function deleteOAuthState(stateId: string): Promise<void> {\n  const key = REDIS_KEYS.oauthState(stateId);\n  await getRedis().del(key);\n  logger.debug('OAuth state deleted', { stateId });\n}\n\nexport async function cleanupExpiredOAuthStates(): Promise<number> {\n  const pattern = REDIS_KEYS.oauthState('*');\n  const keys = await getRedis().keys(pattern);\n\n  let cleaned = 0;\n  for (const key of keys) {\n    const ttl = await getRedis().ttl(key);\n    if (ttl === -1) {\n      await getRedis().del(key);\n      cleaned++;\n    }\n  }\n\n  logger.info('OAuth state cleanup completed', { cleaned, total: keys.length });\n  return cleaned;\n}\n\n// ============================================================================\n// Cleanup\n// ============================================================================\n\nexport async function closeRedisConnection(): Promise<void> {\n  if (redis) {\n    await redis.quit();\n    redis = null;\n    logger.info('Redis connection closed');\n  }\n}\n"],"mappings":";;;;;AAiBA,IAAIA,QAAsB;AAE1B,SAAS,WAAkB;AACzB,MAAK,OAAO;AACV,UAAQ,IAAI,MAAM,QAAQ,IAAI,aAAa;AAE3C,QAAM,GAAG,SAAS,CAAC,QAAQ;AACzB,UAAO,MAAM,sBAAsB,IAAI;EACxC,EAAC;AAEF,QAAM,GAAG,WAAW,MAAM;AACxB,UAAO,KAAK,+BAA+B;EAC5C,EAAC;CACH;AACD,QAAO;AACR;AAMD,MAAM,aAAa,QAAQ,IAAI,oBAAoB;AAEnD,MAAM,aAAa;CACjB,YAAY,CAACC,aAAqB,EAAE,WAAW,cAAc,QAAQ;CACrE,SAAS,CAACC,eAAuB,EAAE,WAAW,UAAU,UAAU;CAClE,eAAe,CAACC,YAAoB,EAAE,WAAW,qBAAqB,OAAO;CAC7E,cAAc,CAACC,SAAiB,EAAE,WAAW,oBAAoB,IAAI;CACrE,uBAAuB,CAACC,kBAA0B,EAAE,WAAW,8BAA8B,aAAa;AAC3G;AAED,MAAM,yBAAyB;AAC/B,MAAM,sBAAsB,KAAK,KAAK,KAAK;AAC3C,MAAM,0BAA0B,KAAK;AAErC,MAAM,kBAAkB,0BAA0B,mBAAmB,wBAAwB;AAC7F,MAAM,cAAc,0BAA0B,uBAAuB,0BAA0B,eAAe,oBAAoB,CAAC;AAEnI,MAAM,sBAAsB,QAAQ,IAAI,uBAAuB;AAC/D,MAAM,iBAAiB,sBAAsB;AAC7C,MAAM,wBAAwB,qBAAqB;AACnD,MAAM,sBAAsB;AAC5B,MAAM,2BAA2B,uBAAuB;AACxD,MAAM,wBAAwB,QAAQ,IAAI,uBAAuB,MAAM;AACvE,MAAM,6BAA6B,iCAAiC;AACpE,MAAM,yBAAyB,4BAA4B,2BAA2B;AAEtF,MAAa,2BAA2B,oBAAoB,QAAQ,YAAY,GAAG,CAAC,QAAQ,MAAM,GAAG;AAErG,SAAS,kBAAkBC,MAAcC,cAAgC;CACvE,MAAM,QAAQ,QAAQ,IAAI,OAAO,MAAM,CAAC,aAAa;AACrD,MAAK,MACH,QAAO;AAGT,KAAI;EAAC;EAAK;EAAQ;EAAO;CAAK,EAAC,SAAS,MAAM,CAC5C,QAAO;AAGT,KAAI;EAAC;EAAK;EAAS;EAAM;CAAM,EAAC,SAAS,MAAM,CAC7C,QAAO;AAGT,OAAM,IAAI,OAAO,EAAE,KAAK;AACzB;AAED,SAAS,0BAA0BD,MAAcE,cAA8B;CAC7E,MAAM,QAAQ,QAAQ,IAAI,OAAO,MAAM;AACvC,MAAK,MACH,QAAO;CAGT,MAAM,SAAS,OAAO,MAAM;AAC5B,MAAK,OAAO,cAAc,OAAO,IAAI,UAAU,EAC7C,OAAM,IAAI,OAAO,EAAE,KAAK;AAG1B,QAAO;AACR;AAED,SAAS,uBAA+B;CACtC,MAAM,SAAS,QAAQ,IAAI,gBAAgB,MAAM;AACjD,MAAK,UAAU,WAAW,wBAAwB;AAChD,MAAI,QAAQ,IAAI,aAAa,aAC3B,OAAM,IAAI,MAAM;AAGlB,SAAO;CACR;AAED,KAAI,OAAO,SAAS,GAClB,OAAM,IAAI,MAAM;AAGlB,QAAO;AACR;AAED,SAAS,sBAA+B;AACtC,QAAO,kBAAkB,yBAAyB,QAAQ,IAAI,aAAa,aAAa;AACzF;AAED,SAAS,wBAAmD;CAC1D,MAAM,QAAQ,QAAQ,IAAI,0BAA0B,MAAM,CAAC,aAAa;CACxE,MAAM,WAAW,UAAU,WAAW,WAAW,UAAU,SAAS,SAAS;AAE7E,KAAI,aAAa,WAAW,sBAC1B,OAAM,IAAI,MAAM;AAGlB,QAAO;AACR;AAED,SAAS,kCAA2C;CAClD,MAAM,UAAU,kBAAkB,sBAAsB,QAAQ,IAAI,aAAa,aAAa;AAC9F,KAAI,QAAQ,IAAI,aAAa,iBAAiB,QAC5C,OAAM,IAAI,MAAM;AAGlB,QAAO;AACR;AAED,SAAS,gBAAgBC,OAAuB;CAC9C,MAAM,aAAa,MAAM,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI;CAC9D,MAAM,SAAS,WAAW,OAAO,WAAW,UAAW,IAAK,WAAW,SAAS,KAAM,GAAI,IAAI;AAC9F,QAAO,OAAO,KAAK,QAAQ,SAAS;AACrC;AAED,SAAS,4BAA4BC,SAAiC;AACpE,MAAK,QACH,QAAO;CAGT,MAAM,QAAQ,QAAQ,IAAI,wBAAwB,MAAM;AACxD,MAAK,MACH,OAAM,IAAI,MAAM;CAGlB,MAAM,MAAM,kBAAkB,KAAK,MAAM,GACrC,OAAO,KAAK,OAAO,MAAM,GACzB,gBAAgB,MAAM;AAE1B,KAAI,IAAI,WAAW,GACjB,OAAM,IAAI,MAAM;AAGlB,QAAO;AACR;AAMD,SAAS,kBAAkBC,cAAqD;AAC9E,MAAK,aACH,QAAO,CAAE;AAGX,QAAO,aACJ,MAAM,IAAI,CACV,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAC1B,OAAO,QAAQ,CACf,OAA+B,CAAC,SAAS,SAAS;EACjD,MAAM,iBAAiB,KAAK,QAAQ,IAAI;AACxC,MAAI,kBAAkB,EACpB,QAAO;EAGT,MAAM,OAAO,KAAK,MAAM,GAAG,eAAe,CAAC,MAAM;EACjD,MAAM,QAAQ,KAAK,MAAM,iBAAiB,EAAE,CAAC,MAAM;AACnD,OAAK,KACH,QAAO;AAGT,UAAQ,QAAQ;AAChB,SAAO;CACR,GAAE,CAAE,EAAC;AACT;AAED,SAAS,sBAAsBF,OAAeG,QAAwB;AACpE,QAAO,WAAW,UAAU,OAAO,CAAC,OAAO,MAAM,CAAC,OAAO,YAAY;AACtE;AAED,SAAS,oBAAoBC,MAAcC,OAAwB;CACjE,MAAM,aAAa,OAAO,KAAK,KAAK;CACpC,MAAM,cAAc,OAAO,KAAK,MAAM;AAEtC,KAAI,WAAW,WAAW,YAAY,OACpC,QAAO;AAGT,QAAO,gBAAgB,YAAY,YAAY;AAChD;AAED,SAAS,cAAcZ,WAA2B;CAChD,MAAM,YAAY,sBAAsB,WAAW,eAAe;AAClE,SAAQ,EAAE,UAAU,GAAG,UAAU;AAClC;AAED,SAAS,gBAAgBa,aAAgD;AACvE,MAAK,YACH,QAAO;CAGT,IAAIC;AACJ,KAAI;AACF,iBAAe,mBAAmB,YAAY;CAC/C,QAAO;AACN,SAAO;CACR;CAED,MAAM,iBAAiB,aAAa,YAAY,IAAI;AACpD,KAAI,kBAAkB,KAAK,mBAAmB,aAAa,SAAS,EAClE,QAAO;CAGT,MAAM,YAAY,aAAa,MAAM,GAAG,eAAe;CACvD,MAAM,YAAY,aAAa,MAAM,iBAAiB,EAAE;CACxD,MAAM,oBAAoB,sBAAsB,WAAW,eAAe;AAE1E,QAAO,oBAAoB,WAAW,kBAAkB,GAAG,YAAY;AACxE;AAED,SAAS,4BAA4Bd,WAAmBe,SAAuC;CAC7F,MAAM,cAAc,mBAAmB,cAAc,UAAU,CAAC;CAChE,MAAM,WAAW;GACd,EAAE,oBAAoB,GAAG,YAAY;GACrC,UAAU,QAAQ,OAAO;GACzB,OAAO,oBAAoB;GAC3B,WAAW,yBAAyB;EACrC;CACD;AAED,KAAI,sBACF,UAAS,MAAM,SAAS,sBAAsB,EAAE;AAGlD,KAAI,sBACF,UAAS,KAAK,SAAS;AAGzB,QAAO,SAAS,KAAK,KAAK;AAC3B;AAED,SAAS,gCAAwC;CAC/C,MAAM,WAAW;GACd,EAAE,oBAAoB;EACvB;GACC,OAAO,oBAAoB;GAC3B,WAAW,yBAAyB;EACrC;CACD;AAED,KAAI,sBACF,UAAS,MAAM,SAAS,sBAAsB,EAAE;AAGlD,KAAI,sBACF,UAAS,KAAK,SAAS;AAGzB,QAAO,SAAS,KAAK,KAAK;AAC3B;AAED,eAAe,wBAAwBC,SAA0C;CAC/E,MAAM,UAAU,kBAAkB,QAAQ,QAAQ,IAAI,SAAS,CAAC;AAChE,QAAO,gBAAgB,QAAQ,qBAAqB;AACrD;AAED,SAAS,oBAAoBC,MAA6B;CACxD,MAAM,OAAO,IAAI;AAEjB,KAAI,KAAK,OACP,MAAK,IAAI,WAAW,cAAc,KAAK,OAAO,CAAC;AAGjD,KAAI,KAAK,IACP,MAAK,IAAI,WAAW,aAAa,KAAK,IAAI,CAAC;AAG7C,KAAI,KAAK,aACP,MAAK,IAAI,WAAW,sBAAsB,KAAK,aAAa,CAAC;AAG/D,QAAO,MAAM,KAAK,KAAK;AACxB;AAED,eAAe,uBAAuBjB,WAAmBiB,MAAkC;CACzF,MAAM,YAAY,oBAAoB,KAAK;AAC3C,KAAI,UAAU,WAAW,EACvB;CAGF,MAAM,cAAc,UAAU;CAC9B,MAAM,WAAW,YAAY,UAAU;AAEvC,MAAK,MAAM,YAAY,WAAW;AAChC,WAAS,KAAK,UAAU,UAAU;AAClC,WAAS,OAAO,UAAU,YAAY;CACvC;AAED,OAAM,SAAS,MAAM;AACtB;AAED,eAAe,yBAAyBjB,WAAmBiB,MAAkC;CAC3F,MAAM,YAAY,oBAAoB,KAAK;AAC3C,KAAI,UAAU,WAAW,EACvB;CAGF,MAAM,cAAc,UAAU;CAC9B,MAAM,WAAW,YAAY,UAAU;AAEvC,MAAK,MAAM,YAAY,UACrB,UAAS,KAAK,UAAU,UAAU;AAGpC,OAAM,SAAS,MAAM;AACtB;AAED,SAAS,iBAAiBC,aAAgD;AACxE,MAAK,YACH,QAAO;AAGT,KAAI;AACF,SAAO,KAAK,MAAM,kBAAkB,YAAY,CAAC;CAClD,SAAQ,OAAO;AACd,SAAO,MAAM,gCAAgC,iBAAiB,QAAQ,eAAkB;AACxF,SAAO;CACR;AACF;AAED,SAAS,kBAAkBD,MAA2B;CACpD,MAAM,YAAY,KAAK,UAAU,KAAK;AACtC,MAAK,uBACH,QAAO;CAGT,MAAM,KAAK,YAAY,GAAG;CAC1B,MAAM,SAAS,eAAe,eAAe,wBAAwB,GAAG;CACxE,MAAM,aAAa,OAAO,OAAO,CAAC,OAAO,OAAO,WAAW,OAAO,EAAE,OAAO,OAAO,AAAC,EAAC;CACpF,MAAM,MAAM,OAAO,YAAY;AAE/B,QAAO;EACL;EACA,GAAG,SAAS,YAAY;EACxB,IAAI,SAAS,YAAY;EACzB,WAAW,SAAS,YAAY;CACjC,EAAC,KAAK,IAAI;AACZ;AAED,SAAS,kBAAkBV,OAAuB;AAChD,MAAK,MAAM,WAAW,UAAU,EAAE;AAChC,MAAI,2BACF,QAAO,KAAK,qFAAqF;AAGnG,SAAO;CACR;AAED,MAAK,uBACH,OAAM,IAAI,MAAM;CAGlB,MAAM,GAAG,SAAS,SAAS,UAAU,gBAAgB,GAAG,MAAM,MAAM,IAAI;AACxE,KAAI,YAAY,SAAS,YAAY,aAAa,gBAChD,OAAM,IAAI,MAAM;CAGlB,MAAM,WAAW,iBAAiB,eAAe,wBAAwB,OAAO,KAAK,SAAS,YAAY,CAAC;AAC3G,UAAS,WAAW,OAAO,KAAK,UAAU,YAAY,CAAC;AAEvD,QAAO,OAAO,OAAO,CACnB,SAAS,OAAO,OAAO,KAAK,iBAAiB,YAAY,CAAC,EAC1D,SAAS,OAAO,AACjB,EAAC,CAAC,SAAS,OAAO;AACpB;AAED,eAAe,gBAAgBP,WAAgD;AAC7E,KAAI;EACF,MAAM,cAAc,MAAM,UAAU,CAAC,IAAI,WAAW,QAAQ,UAAU,CAAC;AACvE,OAAK,aAAa;AAChB,UAAO,MAAM,8BAA8B,EAAE,UAAW,EAAC;AACzD,UAAO;EACR;AAED,QAAM,UAAU,CAAC,OAAO,WAAW,QAAQ,UAAU,EAAE,YAAY;AACnE,SAAO,iBAAiB,YAAY;CACrC,SAAQ,OAAO;AACd,SAAO,MAAM,qCAAqC,iBAAiB,QAAQ,eAAkB;AAC7F,SAAO;CACR;AACF;AAED,eAAe,iBAAiBA,WAAmBiB,MAAkC;AACnF,KAAI;EACF,MAAM,sBAAsB,iBAAiB,MAAM,UAAU,CAAC,IAAI,WAAW,QAAQ,UAAU,CAAC,CAAC;AACjG,MAAI,oBACF,OAAM,yBAAyB,WAAW,oBAAoB;AAGhE,QAAM,UAAU,CAAC,MAAM,WAAW,QAAQ,UAAU,EAAE,aAAa,kBAAkB,KAAK,CAAC;AAC3F,QAAM,uBAAuB,WAAW,KAAK;AAC7C,SAAO,MAAM,yBAAyB,EAAE,UAAW,EAAC;CACrD,SAAQ,OAAO;AACd,SAAO,MAAM,qCAAqC,iBAAiB,QAAQ,eAAkB;AAC7F,QAAM;CACP;AACF;AAED,eAAe,kBAAkBjB,WAAkC;AACjE,KAAI;EACF,MAAM,sBAAsB,iBAAiB,MAAM,UAAU,CAAC,IAAI,WAAW,QAAQ,UAAU,CAAC,CAAC;AACjG,MAAI,oBACF,OAAM,yBAAyB,WAAW,oBAAoB;AAGhE,QAAM,UAAU,CAAC,IAAI,WAAW,QAAQ,UAAU,CAAC;AACnD,SAAO,MAAM,yBAAyB,EAAE,UAAW,EAAC;CACrD,SAAQ,OAAO;AACd,SAAO,MAAM,uCAAuC,iBAAiB,QAAQ,eAAkB;CAChG;AACF;AAED,SAAS,iBAAiBmB,cAA2BC,SAA4C;CAC/F,MAAM,WAAW,EAAE,GAAG,aAAc;AAEpC,QAAO,QAAQ,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,MAAM,KAAK;AAChD,MAAI,kBAAqB;AACvB,UAAO,SAAS;AAChB;EACD;AAED,WAAS,OAAO;CACjB,EAAC;AAEF,QAAO;AACR;AAED,eAAe,uBAAuBC,UAAqC;CACzE,MAAM,aAAa,MAAM,UAAU,CAAC,SAAS,SAAS;CACtD,MAAMC,mBAA6B,CAAE;CACrC,MAAMC,kBAA4B,CAAE;AAEpC,MAAK,MAAM,aAAa,YAAY;EAClC,MAAM,SAAS,MAAM,UAAU,CAAC,OAAO,WAAW,QAAQ,UAAU,CAAC;AACrE,MAAI,OACF,kBAAiB,KAAK,UAAU;MAEhC,iBAAgB,KAAK,UAAU;CAElC;AAED,KAAI,gBAAgB,SAAS,EAC3B,OAAM,UAAU,CAAC,KAAK,UAAU,GAAG,gBAAgB;AAGrD,QAAO;AACR;AAED,SAAS,qBACPvB,WACAwB,SACAC,kBACoB;AACpB,QAAO;EACL;EACA,QAAQ,QAAQ;EAChB,OAAO,QAAQ,MAAM;EACrB,MAAM,QAAQ,MAAM;EACpB,QAAQ,QAAQ;EAChB,KAAK,QAAQ;EACb,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,cAAc,QAAQ;EACtB,WAAW,QAAQ;EACnB,WAAW,mBAAmB,cAAc;CAC7C;AACF;AAED,eAAe,qBAAqBC,YAAgF;CAClH,MAAMC,WAA4D,CAAE;AAEpE,MAAK,MAAM,aAAa,YAAY;EAClC,MAAM,OAAO,MAAM,gBAAgB,UAAU;AAC7C,MAAI,KACF,UAAS,KAAK;GAAE;GAAW;EAAM,EAAC;CAErC;AAED,QAAO;AACR;AAED,SAAS,oBAAoBX,SAAsC;CACjE,MAAM,eAAe,QAAQ,QAAQ,IAAI,kBAAkB,EAAE,MAAM,IAAI,CAAC,IAAI,MAAM;AAClF,QACE,gBACA,QAAQ,QAAQ,IAAI,mBAAmB,EAAE,MAAM,IAC/C,QAAQ,QAAQ,IAAI,YAAY,EAAE,MAAM;AAG3C;AAMD,eAAsB,kBACpBA,SACAY,aACkB;CAClB,MAAM,mBAAmB,MAAM,wBAAwB,QAAQ;CAC/D,MAAM,gBAAgB,OAAO,YAAY;CACzC,MAAM,kBAAkB,iBAAiB,CAAE,GAAE;EAC3C,GAAG;EACH,WAAW;EACX,WAAW,YAAY,aAAa,oBAAoB,QAAQ;EAChE,WAAW,YAAY,aAAa,QAAQ,QAAQ,IAAI,aAAa;CACtE,EAAC;AAEF,QAAO,MAAM,yBAAyB,EAAE,UAAU,OAAO,KAAK,YAAY,CAAE,EAAC;AAE7E,KAAI,iBACF,OAAM,kBAAkB,iBAAiB;AAG3C,OAAM,iBAAiB,eAAe,gBAAgB;AAEtD,QAAO,IAAI,QAAQ,EACjB,cAAc,4BAA4B,eAAe,EAAE,QAAQ,YAAa,EAAC,CAClF;AACF;AAED,eAAsB,eAAeZ,SAAwC;CAC3E,MAAM,YAAY,MAAM,wBAAwB,QAAQ;AACxD,MAAK,UACH,QAAO,CAAE;CAGX,MAAM,UAAU,MAAM,gBAAgB,UAAU;AAChD,MAAK,QACH,QAAO,CAAE;AAGX,QAAO;EACL;EACA,QAAQ,QAAQ;EAChB,aAAa,QAAQ;EACrB,cAAc,QAAQ;EACtB,SAAS,QAAQ;EACjB,WAAW,QAAQ;EACnB,QAAQ,QAAQ;EAChB,KAAK,QAAQ;EACb,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,MAAM,QAAQ;EACd,WAAW,QAAQ;EACnB,cAAc,QAAQ;CACvB;AACF;AAED,eAAsB,kBACpBA,SACAI,SACkB;CAClB,MAAM,mBAAmB,MAAM,wBAAwB,QAAQ;CAC/D,MAAM,qBAAqB,mBACtB,MAAM,gBAAgB,iBAAiB,IAAK,CAAE,IAC/C,CAAE;CACN,MAAM,gBAAgB,oBAAoB,OAAO,YAAY;CAC7D,MAAM,kBAAkB,iBAAiB,oBAAoB;EAC3D,GAAG;EACH,WAAW;CACZ,EAAC;AAEF,OAAM,iBAAiB,eAAe,gBAAgB;AAEtD,QAAO,IAAI,QAAQ,EACjB,cAAc,4BAA4B,eAAe,EAAE,QAAQ,YAAa,EAAC,CAClF;AACF;AAED,eAAsB,mBAAmBJ,SAAoC;CAC3E,MAAM,YAAY,MAAM,wBAAwB,QAAQ;AACxD,KAAI,UACF,OAAM,kBAAkB,UAAU;AAGpC,QAAO,IAAI,QAAQ,EACjB,cAAc,+BAA+B,CAC9C;AACF;AAED,eAAsB,wBAAwBA,SAA0C;AACtF,QAAO,MAAM,wBAAwB,QAAQ;AAC9C;AAED,eAAsB,mBAAmBhB,WAAgD;CACvF,MAAM,UAAU,MAAM,gBAAgB,UAAU;AAChD,QAAO,UAAU;EAAE,GAAG;EAAS;CAAW,IAAG;AAC9C;AAED,eAAsB,2BACpBC,QAC0D;CAC1D,MAAM,aAAa,MAAM,uBAAuB,WAAW,cAAc,OAAO,CAAC;AACjF,QAAO,MAAM,qBAAqB,WAAW;AAC9C;AAED,eAAsB,wBACpBA,QACAwB,kBAC+B;CAC/B,MAAM,WAAW,MAAM,2BAA2B,OAAO;AAEzD,QAAO,SACJ,IAAI,CAAC,EAAE,WAAW,MAAM,KAAK,qBAAqB,WAAW,MAAM,iBAAiB,CAAC,CACrF,KAAK,CAAC,MAAM,WAAW,MAAM,gBAAgB,MAAM,aAAa,MAAM,KAAK,gBAAgB,KAAK,aAAa,GAAG;AACpH;AAED,eAAsB,4BAA4BT,SAAiD;CACjG,MAAM,iBAAiB,MAAM,eAAe,QAAQ;AACpD,MAAK,eAAe,OAClB,QAAO,CAAE;AAGX,QAAO,MAAM,wBAAwB,eAAe,QAAQ,eAAe,UAAU;AACtF;AAED,eAAsB,uBAAuBhB,WAAqC;CAChF,MAAM,UAAU,MAAM,gBAAgB,UAAU;AAChD,MAAK,QACH,QAAO;AAGT,OAAM,kBAAkB,UAAU;AAClC,QAAO;AACR;AAED,eAAsB,2BAA2BC,QAAiC;CAChF,MAAM,aAAa,MAAM,uBAAuB,WAAW,cAAc,OAAO,CAAC;CACjF,IAAI,oBAAoB;AAExB,MAAK,MAAM,aAAa,WACtB,KAAI,MAAM,uBAAuB,UAAU,CACzC,sBAAqB;AAIzB,QAAO;AACR;AAED,eAAsB,yBAAyBC,KAA8B;CAC3E,MAAM,aAAa,MAAM,uBAAuB,WAAW,aAAa,IAAI,CAAC;CAC7E,IAAI,oBAAoB;AAExB,MAAK,MAAM,aAAa,WACtB,KAAI,MAAM,uBAAuB,UAAU,CACzC,sBAAqB;AAIzB,QAAO;AACR;AAED,eAAsB,kCAAkCC,cAAuC;CAC7F,MAAM,aAAa,MAAM,uBAAuB,WAAW,sBAAsB,aAAa,CAAC;CAC/F,IAAI,oBAAoB;AAExB,MAAK,MAAM,aAAa,WACtB,KAAI,MAAM,uBAAuB,UAAU,CACzC,sBAAqB;AAIzB,QAAO;AACR;AAED,eAAsB,qCAAqC0B,QAIvC;AAClB,KAAI,OAAO,IACT,QAAO,MAAM,yBAAyB,OAAO,IAAI;AAGnD,KAAI,OAAO,aACT,QAAO,MAAM,kCAAkC,OAAO,aAAa;AAGrE,KAAI,OAAO,OACT,QAAO,MAAM,2BAA2B,OAAO,OAAO;AAGxD,QAAO;AACR;AAED,eAAsB,mBAAmBb,SAAwC;CAC/E,MAAM,cAAc,MAAM,eAAe,QAAQ;AAEjD,MAAK,YAAY,WAAW,YAAY,YACtC,OAAM,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAK;AAGpD,QAAO;AACR;AAED,eAAsB,eAAeA,SAAoC;AACvE,KAAI;EACF,MAAM,cAAc,MAAM,eAAe,QAAQ;AAEjD,OAAK,YAAY,SAAS,YAAY,YACpC,QAAO;AAGT,MAAI,YAAY,aAAa,KAAK,KAAK,IAAI,YAAY,UACrD,QAAO;AAGT,SAAO;CACR,QAAO;AACN,SAAO;CACR;AACF;AAMD,eAAsB,iBAAiBc,OAAoC;CACzE,MAAM,UAAU,OAAO,YAAY;CACnC,MAAM,MAAM,WAAW,WAAW,QAAQ;AAE1C,OAAM,UAAU,CAAC,MAAM,KAAK,iBAAiB,KAAK,UAAU,MAAM,CAAC;AAEnE,QAAO,MAAM,uBAAuB;EAAE;EAAS,KAAK;CAAiB,EAAC;AAEtE,QAAO;AACR;AAED,eAAsB,cAAc/B,SAA6C;CAC/E,MAAM,MAAM,WAAW,WAAW,QAAQ;CAC1C,MAAM,OAAO,MAAM,UAAU,CAAC,IAAI,IAAI;AAEtC,MAAK,MAAM;AACT,SAAO,KAAK,oCAAoC,EAAE,QAAS,EAAC;AAC5D,SAAO;CACR;AAED,KAAI;AACF,SAAO,KAAK,MAAM,KAAK;CACxB,SAAQ,OAAO;AACd,SAAO,MAAM,+BAA+B,iBAAiB,QAAQ,eAAkB;AACvF,SAAO;CACR;AACF;AAED,eAAsB,iBAAiBA,SAAgC;CACrE,MAAM,MAAM,WAAW,WAAW,QAAQ;AAC1C,OAAM,UAAU,CAAC,IAAI,IAAI;AACzB,QAAO,MAAM,uBAAuB,EAAE,QAAS,EAAC;AACjD;AAED,eAAsB,4BAA6C;CACjE,MAAM,UAAU,WAAW,WAAW,IAAI;CAC1C,MAAM,OAAO,MAAM,UAAU,CAAC,KAAK,QAAQ;CAE3C,IAAI,UAAU;AACd,MAAK,MAAM,OAAO,MAAM;EACtB,MAAM,MAAM,MAAM,UAAU,CAAC,IAAI,IAAI;AACrC,MAAI,QAAQ,IAAI;AACd,SAAM,UAAU,CAAC,IAAI,IAAI;AACzB;EACD;CACF;AAED,QAAO,KAAK,iCAAiC;EAAE;EAAS,OAAO,KAAK;CAAQ,EAAC;AAC7E,QAAO;AACR;AAMD,eAAsB,uBAAsC;AAC1D,KAAI,OAAO;AACT,QAAM,MAAM,MAAM;AAClB,UAAQ;AACR,SAAO,KAAK,0BAA0B;CACvC;AACF"}
+{"version":3,"file":"redis-session-storage.server-v2VcpFsQ.js","names":["redis: Redis | null","stateId: string","sessionId: string","userId: string","sid: string","sessionState: string","name: string","defaultValue: boolean","defaultValue: number","value: string","enabled: boolean","cookieHeader: string | null","secret: string","left: string","right: string","cookieValue: string | undefined","decodedValue: string","options: SessionCookieOptions","request: Request","data: SessionData","sessionData: string | null","existingData: SessionData","updates: Partial<SessionData>","indexKey: string","activeSessionIds: string[]","staleSessionIds: string[]","session: SessionData","currentSessionId?: string | null","sessionIds: string[]","sessions: Array<{ sessionId: string; data: SessionData }>","sessionData: Partial<SessionData>","params: {\n  sid?: string;\n  sessionState?: string;\n  userId?: string;\n}","state: OAuthState"],"sources":["../src/auth/redis-session-storage.server.ts"],"sourcesContent":["/**\n * Redis Session Storage Server Module\n *\n * Redis-backed session storage for authentication.\n * Provides secure session management with automatic expiration,\n * without depending on a framework-specific session implementation.\n */\n\nimport Redis from 'ioredis';\nimport { createCipheriv, createDecipheriv, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';\nimport type { AuthSessionSummary, SessionData, OAuthState } from './types';\nimport { logger } from '../logging';\n\n// ============================================================================\n// Redis Client Setup\n// ============================================================================\n\nlet redis: Redis | null = null;\n\nfunction getRedis(): Redis {\n  if (!redis) {\n    redis = new Redis(process.env.REDIS_URL || 'redis://localhost:6379');\n\n    redis.on('error', (err) => {\n      logger.error('Redis Client Error', err);\n    });\n\n    redis.on('connect', () => {\n      logger.info('Redis connected successfully');\n    });\n  }\n  return redis;\n}\n\n// ============================================================================\n// Redis Key Patterns\n// ============================================================================\n\nconst KEY_PREFIX = process.env.REDIS_KEY_PREFIX || '';\n\nconst REDIS_KEYS = {\n  oauthState: (stateId: string) => `${KEY_PREFIX}oauth:state:${stateId}`,\n  session: (sessionId: string) => `${KEY_PREFIX}session:${sessionId}`,\n  sessionByUser: (userId: string) => `${KEY_PREFIX}session:index:user:${userId}`,\n  sessionBySid: (sid: string) => `${KEY_PREFIX}session:index:sid:${sid}`,\n  sessionBySessionState: (sessionState: string) => `${KEY_PREFIX}session:index:session_state:${sessionState}`,\n};\n\nconst DEFAULT_SESSION_SECRET = 'default-secret-change-in-production';\nconst DEFAULT_SESSION_TTL = 60 * 60 * 24 * 7;\nconst DEFAULT_OAUTH_STATE_TTL = 10 * 60;\n\nconst OAUTH_STATE_TTL = resolvePositiveIntegerEnv('OAUTH_STATE_TTL', DEFAULT_OAUTH_STATE_TTL);\nconst SESSION_TTL = resolvePositiveIntegerEnv('SESSION_DEFAULT_TTL', resolvePositiveIntegerEnv('SESSION_TTL', DEFAULT_SESSION_TTL));\n\nconst SESSION_COOKIE_NAME = process.env.SESSION_COOKIE_NAME || '__session_id';\nconst SESSION_SECRET = resolveSessionSecret();\nconst SESSION_COOKIE_SECURE = resolveCookieSecure();\nconst SESSION_COOKIE_PATH = '/';\nconst SESSION_COOKIE_SAME_SITE = resolveCookieSameSite();\nconst SESSION_COOKIE_DOMAIN = process.env.SESSION_COOKIE_DOMAIN?.trim();\nconst SESSION_ENCRYPTION_ENABLED = resolveSessionEncryptionEnabled();\nconst SESSION_ENCRYPTION_KEY = resolveSessionEncryptionKey(SESSION_ENCRYPTION_ENABLED);\n\nexport const AUTH_ERROR_COOKIE_PREFIX = SESSION_COOKIE_NAME.replace('_session', '').replace('__', '');\n\nfunction resolveBooleanEnv(name: string, defaultValue: boolean): boolean {\n  const value = process.env[name]?.trim().toLowerCase();\n  if (!value) {\n    return defaultValue;\n  }\n\n  if (['1', 'true', 'yes', 'on'].includes(value)) {\n    return true;\n  }\n\n  if (['0', 'false', 'no', 'off'].includes(value)) {\n    return false;\n  }\n\n  throw new Error(`${name} must be a boolean value.`);\n}\n\nfunction resolvePositiveIntegerEnv(name: string, defaultValue: number): number {\n  const value = process.env[name]?.trim();\n  if (!value) {\n    return defaultValue;\n  }\n\n  const parsed = Number(value);\n  if (!Number.isSafeInteger(parsed) || parsed <= 0) {\n    throw new Error(`${name} must be a positive integer.`);\n  }\n\n  return parsed;\n}\n\nfunction resolveSessionSecret(): string {\n  const secret = process.env.SESSION_SECRET?.trim();\n  if (!secret || secret === DEFAULT_SESSION_SECRET) {\n    if (process.env.NODE_ENV === 'production') {\n      throw new Error('SESSION_SECRET must be set to a unique random value in production.');\n    }\n\n    return DEFAULT_SESSION_SECRET;\n  }\n\n  if (secret.length < 32) {\n    throw new Error('SESSION_SECRET must be at least 32 characters long.');\n  }\n\n  return secret;\n}\n\nfunction resolveCookieSecure(): boolean {\n  return resolveBooleanEnv('SESSION_COOKIE_SECURE', process.env.NODE_ENV === 'production');\n}\n\nfunction resolveCookieSameSite(): 'Lax' | 'Strict' | 'None' {\n  const value = process.env.SESSION_COOKIE_SAME_SITE?.trim().toLowerCase();\n  const sameSite = value === 'strict' ? 'Strict' : value === 'none' ? 'None' : 'Lax';\n\n  if (sameSite === 'None' && !SESSION_COOKIE_SECURE) {\n    throw new Error('SESSION_COOKIE_SAME_SITE=None requires SESSION_COOKIE_SECURE=true.');\n  }\n\n  return sameSite;\n}\n\nfunction resolveSessionEncryptionEnabled(): boolean {\n  const enabled = resolveBooleanEnv('SESSION_ENCRYPTION', process.env.NODE_ENV === 'production');\n  if (process.env.NODE_ENV === 'production' && !enabled) {\n    throw new Error('SESSION_ENCRYPTION cannot be disabled in production.');\n  }\n\n  return enabled;\n}\n\nfunction decodeBase64Url(value: string): Buffer {\n  const normalized = value.replace(/-/g, '+').replace(/_/g, '/');\n  const padded = normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), '=');\n  return Buffer.from(padded, 'base64');\n}\n\nfunction resolveSessionEncryptionKey(enabled: boolean): Buffer | null {\n  if (!enabled) {\n    return null;\n  }\n\n  const value = process.env.SESSION_ENCRYPTION_KEY?.trim();\n  if (!value) {\n    throw new Error('SESSION_ENCRYPTION_KEY is required when session encryption is enabled.');\n  }\n\n  const key = /^[0-9a-f]{64}$/i.test(value)\n    ? Buffer.from(value, 'hex')\n    : decodeBase64Url(value);\n\n  if (key.length !== 32) {\n    throw new Error('SESSION_ENCRYPTION_KEY must decode to exactly 32 bytes. Generate one with: openssl rand -base64 32');\n  }\n\n  return key;\n}\n\ntype SessionCookieOptions = {\n  maxAge: number;\n};\n\nfunction parseCookieHeader(cookieHeader: string | null): Record<string, string> {\n  if (!cookieHeader) {\n    return {};\n  }\n\n  return cookieHeader\n    .split(';')\n    .map((part) => part.trim())\n    .filter(Boolean)\n    .reduce<Record<string, string>>((cookies, part) => {\n      const separatorIndex = part.indexOf('=');\n      if (separatorIndex <= 0) {\n        return cookies;\n      }\n\n      const name = part.slice(0, separatorIndex).trim();\n      const value = part.slice(separatorIndex + 1).trim();\n      if (!name) {\n        return cookies;\n      }\n\n      cookies[name] = value;\n      return cookies;\n    }, {});\n}\n\nfunction createCookieSignature(value: string, secret: string): string {\n  return createHmac('sha256', secret).update(value).digest('base64url');\n}\n\nfunction safelyCompareValues(left: string, right: string): boolean {\n  const leftBuffer = Buffer.from(left);\n  const rightBuffer = Buffer.from(right);\n\n  if (leftBuffer.length !== rightBuffer.length) {\n    return false;\n  }\n\n  return timingSafeEqual(leftBuffer, rightBuffer);\n}\n\nfunction signSessionId(sessionId: string): string {\n  const signature = createCookieSignature(sessionId, SESSION_SECRET);\n  return `${sessionId}.${signature}`;\n}\n\nfunction unsignSessionId(cookieValue: string | undefined): string | null {\n  if (!cookieValue) {\n    return null;\n  }\n\n  let decodedValue: string;\n  try {\n    decodedValue = decodeURIComponent(cookieValue);\n  } catch {\n    return null;\n  }\n\n  const separatorIndex = decodedValue.lastIndexOf('.');\n  if (separatorIndex <= 0 || separatorIndex === decodedValue.length - 1) {\n    return null;\n  }\n\n  const sessionId = decodedValue.slice(0, separatorIndex);\n  const signature = decodedValue.slice(separatorIndex + 1);\n  const expectedSignature = createCookieSignature(sessionId, SESSION_SECRET);\n\n  return safelyCompareValues(signature, expectedSignature) ? sessionId : null;\n}\n\nfunction serializeSessionCookieValue(sessionId: string, options: SessionCookieOptions): string {\n  const signedValue = encodeURIComponent(signSessionId(sessionId));\n  const segments = [\n    `${SESSION_COOKIE_NAME}=${signedValue}`,\n    `Max-Age=${options.maxAge}`,\n    `Path=${SESSION_COOKIE_PATH}`,\n    `SameSite=${SESSION_COOKIE_SAME_SITE}`,\n    'HttpOnly',\n  ];\n\n  if (SESSION_COOKIE_DOMAIN) {\n    segments.push(`Domain=${SESSION_COOKIE_DOMAIN}`);\n  }\n\n  if (SESSION_COOKIE_SECURE) {\n    segments.push('Secure');\n  }\n\n  return segments.join('; ');\n}\n\nfunction serializeExpiredSessionCookie(): string {\n  const segments = [\n    `${SESSION_COOKIE_NAME}=`,\n    'Max-Age=0',\n    `Path=${SESSION_COOKIE_PATH}`,\n    `SameSite=${SESSION_COOKIE_SAME_SITE}`,\n    'HttpOnly',\n  ];\n\n  if (SESSION_COOKIE_DOMAIN) {\n    segments.push(`Domain=${SESSION_COOKIE_DOMAIN}`);\n  }\n\n  if (SESSION_COOKIE_SECURE) {\n    segments.push('Secure');\n  }\n\n  return segments.join('; ');\n}\n\nasync function getSessionIdFromRequest(request: Request): Promise<string | null> {\n  const cookies = parseCookieHeader(request.headers.get('Cookie'));\n  return unsignSessionId(cookies[SESSION_COOKIE_NAME]);\n}\n\nfunction getSessionIndexKeys(data: SessionData): string[] {\n  const keys = new Set<string>();\n\n  if (data.userId) {\n    keys.add(REDIS_KEYS.sessionByUser(data.userId));\n  }\n\n  if (data.sid) {\n    keys.add(REDIS_KEYS.sessionBySid(data.sid));\n  }\n\n  if (data.sessionState) {\n    keys.add(REDIS_KEYS.sessionBySessionState(data.sessionState));\n  }\n\n  return Array.from(keys);\n}\n\nasync function registerSessionIndexes(sessionId: string, data: SessionData): Promise<void> {\n  const indexKeys = getSessionIndexKeys(data);\n  if (indexKeys.length === 0) {\n    return;\n  }\n\n  const redisClient = getRedis();\n  const pipeline = redisClient.pipeline();\n\n  for (const indexKey of indexKeys) {\n    pipeline.sadd(indexKey, sessionId);\n    pipeline.expire(indexKey, SESSION_TTL);\n  }\n\n  await pipeline.exec();\n}\n\nasync function unregisterSessionIndexes(sessionId: string, data: SessionData): Promise<void> {\n  const indexKeys = getSessionIndexKeys(data);\n  if (indexKeys.length === 0) {\n    return;\n  }\n\n  const redisClient = getRedis();\n  const pipeline = redisClient.pipeline();\n\n  for (const indexKey of indexKeys) {\n    pipeline.srem(indexKey, sessionId);\n  }\n\n  await pipeline.exec();\n}\n\nfunction parseSessionData(sessionData: string | null): SessionData | null {\n  if (!sessionData) {\n    return null;\n  }\n\n  try {\n    return JSON.parse(decodeSessionData(sessionData)) as SessionData;\n  } catch (error) {\n    logger.error('Failed to parse session data', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\nfunction encodeSessionData(data: SessionData): string {\n  const plaintext = JSON.stringify(data);\n  if (!SESSION_ENCRYPTION_KEY) {\n    return plaintext;\n  }\n\n  const iv = randomBytes(12);\n  const cipher = createCipheriv('aes-256-gcm', SESSION_ENCRYPTION_KEY, iv);\n  const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);\n  const tag = cipher.getAuthTag();\n\n  return [\n    'enc:v1',\n    iv.toString('base64url'),\n    tag.toString('base64url'),\n    ciphertext.toString('base64url'),\n  ].join(':');\n}\n\nfunction decodeSessionData(value: string): string {\n  if (!value.startsWith('enc:v1:')) {\n    if (SESSION_ENCRYPTION_ENABLED) {\n      logger.warn('Reading legacy plaintext auth session payload while session encryption is enabled.');\n    }\n\n    return value;\n  }\n\n  if (!SESSION_ENCRYPTION_KEY) {\n    throw new Error('Cannot decrypt auth session payload because SESSION_ENCRYPTION_KEY is not configured.');\n  }\n\n  const [, version, ivValue, tagValue, ciphertextValue] = value.split(':');\n  if (version !== 'v1' || !ivValue || !tagValue || !ciphertextValue) {\n    throw new Error('Invalid encrypted auth session payload format.');\n  }\n\n  const decipher = createDecipheriv('aes-256-gcm', SESSION_ENCRYPTION_KEY, Buffer.from(ivValue, 'base64url'));\n  decipher.setAuthTag(Buffer.from(tagValue, 'base64url'));\n\n  return Buffer.concat([\n    decipher.update(Buffer.from(ciphertextValue, 'base64url')),\n    decipher.final(),\n  ]).toString('utf8');\n}\n\nasync function readSessionData(sessionId: string): Promise<SessionData | null> {\n  try {\n    const sessionData = await getRedis().get(REDIS_KEYS.session(sessionId));\n    if (!sessionData) {\n      logger.debug('Session not found in Redis', { sessionId });\n      return null;\n    }\n\n    await getRedis().expire(REDIS_KEYS.session(sessionId), SESSION_TTL);\n    return parseSessionData(sessionData);\n  } catch (error) {\n    logger.error('Failed to read session from Redis', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\nasync function writeSessionData(sessionId: string, data: SessionData): Promise<void> {\n  try {\n    const existingSessionData = parseSessionData(await getRedis().get(REDIS_KEYS.session(sessionId)));\n    if (existingSessionData) {\n      await unregisterSessionIndexes(sessionId, existingSessionData);\n    }\n\n    await getRedis().setex(REDIS_KEYS.session(sessionId), SESSION_TTL, encodeSessionData(data));\n    await registerSessionIndexes(sessionId, data);\n    logger.debug('Updated Redis session', { sessionId });\n  } catch (error) {\n    logger.error('Failed to update session in Redis', error instanceof Error ? error : undefined);\n    throw error;\n  }\n}\n\nasync function deleteSessionData(sessionId: string): Promise<void> {\n  try {\n    const existingSessionData = parseSessionData(await getRedis().get(REDIS_KEYS.session(sessionId)));\n    if (existingSessionData) {\n      await unregisterSessionIndexes(sessionId, existingSessionData);\n    }\n\n    await getRedis().del(REDIS_KEYS.session(sessionId));\n    logger.debug('Deleted Redis session', { sessionId });\n  } catch (error) {\n    logger.error('Failed to delete session from Redis', error instanceof Error ? error : undefined);\n  }\n}\n\nfunction mergeSessionData(existingData: SessionData, updates: Partial<SessionData>): SessionData {\n  const nextData = { ...existingData } as Record<string, unknown>;\n\n  Object.entries(updates).forEach(([key, value]) => {\n    if (value === undefined) {\n      delete nextData[key];\n      return;\n    }\n\n    nextData[key] = value;\n  });\n\n  return nextData as SessionData;\n}\n\nasync function getSessionIdsFromIndex(indexKey: string): Promise<string[]> {\n  const sessionIds = await getRedis().smembers(indexKey);\n  const activeSessionIds: string[] = [];\n  const staleSessionIds: string[] = [];\n\n  for (const sessionId of sessionIds) {\n    const exists = await getRedis().exists(REDIS_KEYS.session(sessionId));\n    if (exists) {\n      activeSessionIds.push(sessionId);\n    } else {\n      staleSessionIds.push(sessionId);\n    }\n  }\n\n  if (staleSessionIds.length > 0) {\n    await getRedis().srem(indexKey, ...staleSessionIds);\n  }\n\n  return activeSessionIds;\n}\n\nfunction toAuthSessionSummary(\n  sessionId: string,\n  session: SessionData,\n  currentSessionId?: string | null\n): AuthSessionSummary {\n  return {\n    sessionId,\n    userId: session.userId,\n    email: session.user?.email,\n    name: session.user?.name,\n    issuer: session.issuer,\n    sid: session.sid,\n    sessionState: session.sessionState,\n    clientId: session.clientId,\n    ipAddress: session.ipAddress,\n    userAgent: session.userAgent,\n    createdAt: session.createdAt,\n    lastActivity: session.lastActivity,\n    expiresAt: session.expiresAt,\n    isCurrent: currentSessionId ? sessionId === currentSessionId : undefined,\n  };\n}\n\nasync function listSessionDataByIds(sessionIds: string[]): Promise<Array<{ sessionId: string; data: SessionData }>> {\n  const sessions: Array<{ sessionId: string; data: SessionData }> = [];\n\n  for (const sessionId of sessionIds) {\n    const data = await readSessionData(sessionId);\n    if (data) {\n      sessions.push({ sessionId, data });\n    }\n  }\n\n  return sessions;\n}\n\nfunction getRequestIpAddress(request: Request): string | undefined {\n  const forwardedFor = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim();\n  return (\n    forwardedFor ||\n    request.headers.get('cf-connecting-ip')?.trim() ||\n    request.headers.get('x-real-ip')?.trim() ||\n    undefined\n  );\n}\n\n// ============================================================================\n// Session Helper Functions\n// ============================================================================\n\nexport async function createAuthSession(\n  request: Request,\n  sessionData: Partial<SessionData>\n): Promise<Headers> {\n  const currentSessionId = await getSessionIdFromRequest(request);\n  const nextSessionId = crypto.randomUUID();\n  const nextSessionData = mergeSessionData({}, {\n    ...sessionData,\n    sessionId: nextSessionId,\n    ipAddress: sessionData.ipAddress ?? getRequestIpAddress(request),\n    userAgent: sessionData.userAgent ?? request.headers.get('user-agent') ?? undefined,\n  });\n\n  logger.debug('Creating auth session', { dataKeys: Object.keys(sessionData) });\n\n  if (currentSessionId) {\n    await deleteSessionData(currentSessionId);\n  }\n\n  await writeSessionData(nextSessionId, nextSessionData);\n\n  return new Headers({\n    'Set-Cookie': serializeSessionCookieValue(nextSessionId, { maxAge: SESSION_TTL }),\n  });\n}\n\nexport async function getAuthSession(request: Request): Promise<SessionData> {\n  const sessionId = await getSessionIdFromRequest(request);\n  if (!sessionId) {\n    return {};\n  }\n\n  const session = await readSessionData(sessionId);\n  if (!session) {\n    return {};\n  }\n\n  return {\n    sessionId,\n    userId: session.userId,\n    accessToken: session.accessToken,\n    refreshToken: session.refreshToken,\n    idToken: session.idToken,\n    expiresAt: session.expiresAt,\n    issuer: session.issuer,\n    sid: session.sid,\n    sessionState: session.sessionState,\n    clientId: session.clientId,\n    ipAddress: session.ipAddress,\n    userAgent: session.userAgent,\n    user: session.user,\n    createdAt: session.createdAt,\n    lastActivity: session.lastActivity,\n  };\n}\n\nexport async function updateAuthSession(\n  request: Request,\n  updates: Partial<SessionData>\n): Promise<Headers> {\n  const currentSessionId = await getSessionIdFromRequest(request);\n  const currentSessionData = currentSessionId\n    ? (await readSessionData(currentSessionId)) ?? {}\n    : {};\n  const nextSessionId = currentSessionId ?? crypto.randomUUID();\n  const nextSessionData = mergeSessionData(currentSessionData, {\n    ...updates,\n    sessionId: nextSessionId,\n  });\n\n  await writeSessionData(nextSessionId, nextSessionData);\n\n  return new Headers({\n    'Set-Cookie': serializeSessionCookieValue(nextSessionId, { maxAge: SESSION_TTL }),\n  });\n}\n\nexport async function destroyAuthSession(request: Request): Promise<Headers> {\n  const sessionId = await getSessionIdFromRequest(request);\n  if (sessionId) {\n    await deleteSessionData(sessionId);\n  }\n\n  return new Headers({\n    'Set-Cookie': serializeExpiredSessionCookie(),\n  });\n}\n\nexport async function getCurrentAuthSessionId(request: Request): Promise<string | null> {\n  return await getSessionIdFromRequest(request);\n}\n\nexport async function getAuthSessionById(sessionId: string): Promise<SessionData | null> {\n  const session = await readSessionData(sessionId);\n  return session ? { ...session, sessionId } : null;\n}\n\nexport async function listAuthSessionDataForUser(\n  userId: string\n): Promise<Array<{ sessionId: string; data: SessionData }>> {\n  const sessionIds = await getSessionIdsFromIndex(REDIS_KEYS.sessionByUser(userId));\n  return await listSessionDataByIds(sessionIds);\n}\n\nexport async function listAuthSessionsForUser(\n  userId: string,\n  currentSessionId?: string | null\n): Promise<AuthSessionSummary[]> {\n  const sessions = await listAuthSessionDataForUser(userId);\n\n  return sessions\n    .map(({ sessionId, data }) => toAuthSessionSummary(sessionId, data, currentSessionId))\n    .sort((left, right) => (right.lastActivity ?? right.createdAt ?? 0) - (left.lastActivity ?? left.createdAt ?? 0));\n}\n\nexport async function listCurrentUserAuthSessions(request: Request): Promise<AuthSessionSummary[]> {\n  const currentSession = await getAuthSession(request);\n  if (!currentSession.userId) {\n    return [];\n  }\n\n  return await listAuthSessionsForUser(currentSession.userId, currentSession.sessionId);\n}\n\nexport async function destroyAuthSessionById(sessionId: string): Promise<boolean> {\n  const session = await readSessionData(sessionId);\n  if (!session) {\n    return false;\n  }\n\n  await deleteSessionData(sessionId);\n  return true;\n}\n\nexport async function destroyAuthSessionsForUser(userId: string): Promise<number> {\n  const sessionIds = await getSessionIdsFromIndex(REDIS_KEYS.sessionByUser(userId));\n  let destroyedSessions = 0;\n\n  for (const sessionId of sessionIds) {\n    if (await destroyAuthSessionById(sessionId)) {\n      destroyedSessions += 1;\n    }\n  }\n\n  return destroyedSessions;\n}\n\nexport async function destroyAuthSessionsBySid(sid: string): Promise<number> {\n  const sessionIds = await getSessionIdsFromIndex(REDIS_KEYS.sessionBySid(sid));\n  let destroyedSessions = 0;\n\n  for (const sessionId of sessionIds) {\n    if (await destroyAuthSessionById(sessionId)) {\n      destroyedSessions += 1;\n    }\n  }\n\n  return destroyedSessions;\n}\n\nexport async function destroyAuthSessionsBySessionState(sessionState: string): Promise<number> {\n  const sessionIds = await getSessionIdsFromIndex(REDIS_KEYS.sessionBySessionState(sessionState));\n  let destroyedSessions = 0;\n\n  for (const sessionId of sessionIds) {\n    if (await destroyAuthSessionById(sessionId)) {\n      destroyedSessions += 1;\n    }\n  }\n\n  return destroyedSessions;\n}\n\nexport async function destroyAuthSessionsByIdentitySession(params: {\n  sid?: string;\n  sessionState?: string;\n  userId?: string;\n}): Promise<number> {\n  if (params.sid) {\n    return await destroyAuthSessionsBySid(params.sid);\n  }\n\n  if (params.sessionState) {\n    return await destroyAuthSessionsBySessionState(params.sessionState);\n  }\n\n  if (params.userId) {\n    return await destroyAuthSessionsForUser(params.userId);\n  }\n\n  return 0;\n}\n\nexport async function requireAuthSession(request: Request): Promise<SessionData> {\n  const sessionData = await getAuthSession(request);\n\n  if (!sessionData.userId || !sessionData.accessToken) {\n    throw new Response('Unauthorized', { status: 401 });\n  }\n\n  return sessionData;\n}\n\nexport async function isSessionValid(request: Request): Promise<boolean> {\n  try {\n    const sessionData = await getAuthSession(request);\n\n    if (!sessionData.user || !sessionData.accessToken) {\n      return false;\n    }\n\n    if (sessionData.expiresAt && Date.now() >= sessionData.expiresAt) {\n      return false;\n    }\n\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n// ============================================================================\n// OAuth State Management\n// ============================================================================\n\nexport async function createOAuthState(state: OAuthState): Promise<string> {\n  const stateId = crypto.randomUUID();\n  const key = REDIS_KEYS.oauthState(stateId);\n\n  await getRedis().setex(key, OAUTH_STATE_TTL, JSON.stringify(state));\n\n  logger.debug('OAuth state created', { stateId, ttl: OAUTH_STATE_TTL });\n\n  return stateId;\n}\n\nexport async function getOAuthState(stateId: string): Promise<OAuthState | null> {\n  const key = REDIS_KEYS.oauthState(stateId);\n  const data = await getRedis().get(key);\n\n  if (!data) {\n    logger.warn('OAuth state not found or expired', { stateId });\n    return null;\n  }\n\n  try {\n    return JSON.parse(data);\n  } catch (error) {\n    logger.error('Failed to parse OAuth state', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\nexport async function deleteOAuthState(stateId: string): Promise<void> {\n  const key = REDIS_KEYS.oauthState(stateId);\n  await getRedis().del(key);\n  logger.debug('OAuth state deleted', { stateId });\n}\n\nexport async function cleanupExpiredOAuthStates(): Promise<number> {\n  const pattern = REDIS_KEYS.oauthState('*');\n  const keys = await getRedis().keys(pattern);\n\n  let cleaned = 0;\n  for (const key of keys) {\n    const ttl = await getRedis().ttl(key);\n    if (ttl === -1) {\n      await getRedis().del(key);\n      cleaned++;\n    }\n  }\n\n  logger.info('OAuth state cleanup completed', { cleaned, total: keys.length });\n  return cleaned;\n}\n\n// ============================================================================\n// Cleanup\n// ============================================================================\n\nexport async function closeRedisConnection(): Promise<void> {\n  if (redis) {\n    await redis.quit();\n    redis = null;\n    logger.info('Redis connection closed');\n  }\n}\n"],"mappings":";;;;;AAiBA,IAAIA,QAAsB;AAE1B,SAAS,WAAkB;AACzB,MAAK,OAAO;AACV,UAAQ,IAAI,MAAM,QAAQ,IAAI,aAAa;AAE3C,QAAM,GAAG,SAAS,CAAC,QAAQ;AACzB,UAAO,MAAM,sBAAsB,IAAI;EACxC,EAAC;AAEF,QAAM,GAAG,WAAW,MAAM;AACxB,UAAO,KAAK,+BAA+B;EAC5C,EAAC;CACH;AACD,QAAO;AACR;AAMD,MAAM,aAAa,QAAQ,IAAI,oBAAoB;AAEnD,MAAM,aAAa;CACjB,YAAY,CAACC,aAAqB,EAAE,WAAW,cAAc,QAAQ;CACrE,SAAS,CAACC,eAAuB,EAAE,WAAW,UAAU,UAAU;CAClE,eAAe,CAACC,YAAoB,EAAE,WAAW,qBAAqB,OAAO;CAC7E,cAAc,CAACC,SAAiB,EAAE,WAAW,oBAAoB,IAAI;CACrE,uBAAuB,CAACC,kBAA0B,EAAE,WAAW,8BAA8B,aAAa;AAC3G;AAED,MAAM,yBAAyB;AAC/B,MAAM,sBAAsB,KAAK,KAAK,KAAK;AAC3C,MAAM,0BAA0B,KAAK;AAErC,MAAM,kBAAkB,0BAA0B,mBAAmB,wBAAwB;AAC7F,MAAM,cAAc,0BAA0B,uBAAuB,0BAA0B,eAAe,oBAAoB,CAAC;AAEnI,MAAM,sBAAsB,QAAQ,IAAI,uBAAuB;AAC/D,MAAM,iBAAiB,sBAAsB;AAC7C,MAAM,wBAAwB,qBAAqB;AACnD,MAAM,sBAAsB;AAC5B,MAAM,2BAA2B,uBAAuB;AACxD,MAAM,wBAAwB,QAAQ,IAAI,uBAAuB,MAAM;AACvE,MAAM,6BAA6B,iCAAiC;AACpE,MAAM,yBAAyB,4BAA4B,2BAA2B;AAEtF,MAAa,2BAA2B,oBAAoB,QAAQ,YAAY,GAAG,CAAC,QAAQ,MAAM,GAAG;AAErG,SAAS,kBAAkBC,MAAcC,cAAgC;CACvE,MAAM,QAAQ,QAAQ,IAAI,OAAO,MAAM,CAAC,aAAa;AACrD,MAAK,MACH,QAAO;AAGT,KAAI;EAAC;EAAK;EAAQ;EAAO;CAAK,EAAC,SAAS,MAAM,CAC5C,QAAO;AAGT,KAAI;EAAC;EAAK;EAAS;EAAM;CAAM,EAAC,SAAS,MAAM,CAC7C,QAAO;AAGT,OAAM,IAAI,OAAO,EAAE,KAAK;AACzB;AAED,SAAS,0BAA0BD,MAAcE,cAA8B;CAC7E,MAAM,QAAQ,QAAQ,IAAI,OAAO,MAAM;AACvC,MAAK,MACH,QAAO;CAGT,MAAM,SAAS,OAAO,MAAM;AAC5B,MAAK,OAAO,cAAc,OAAO,IAAI,UAAU,EAC7C,OAAM,IAAI,OAAO,EAAE,KAAK;AAG1B,QAAO;AACR;AAED,SAAS,uBAA+B;CACtC,MAAM,SAAS,QAAQ,IAAI,gBAAgB,MAAM;AACjD,MAAK,UAAU,WAAW,wBAAwB;AAChD,MAAI,QAAQ,IAAI,aAAa,aAC3B,OAAM,IAAI,MAAM;AAGlB,SAAO;CACR;AAED,KAAI,OAAO,SAAS,GAClB,OAAM,IAAI,MAAM;AAGlB,QAAO;AACR;AAED,SAAS,sBAA+B;AACtC,QAAO,kBAAkB,yBAAyB,QAAQ,IAAI,aAAa,aAAa;AACzF;AAED,SAAS,wBAAmD;CAC1D,MAAM,QAAQ,QAAQ,IAAI,0BAA0B,MAAM,CAAC,aAAa;CACxE,MAAM,WAAW,UAAU,WAAW,WAAW,UAAU,SAAS,SAAS;AAE7E,KAAI,aAAa,WAAW,sBAC1B,OAAM,IAAI,MAAM;AAGlB,QAAO;AACR;AAED,SAAS,kCAA2C;CAClD,MAAM,UAAU,kBAAkB,sBAAsB,QAAQ,IAAI,aAAa,aAAa;AAC9F,KAAI,QAAQ,IAAI,aAAa,iBAAiB,QAC5C,OAAM,IAAI,MAAM;AAGlB,QAAO;AACR;AAED,SAAS,gBAAgBC,OAAuB;CAC9C,MAAM,aAAa,MAAM,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI;CAC9D,MAAM,SAAS,WAAW,OAAO,WAAW,UAAW,IAAK,WAAW,SAAS,KAAM,GAAI,IAAI;AAC9F,QAAO,OAAO,KAAK,QAAQ,SAAS;AACrC;AAED,SAAS,4BAA4BC,SAAiC;AACpE,MAAK,QACH,QAAO;CAGT,MAAM,QAAQ,QAAQ,IAAI,wBAAwB,MAAM;AACxD,MAAK,MACH,OAAM,IAAI,MAAM;CAGlB,MAAM,MAAM,kBAAkB,KAAK,MAAM,GACrC,OAAO,KAAK,OAAO,MAAM,GACzB,gBAAgB,MAAM;AAE1B,KAAI,IAAI,WAAW,GACjB,OAAM,IAAI,MAAM;AAGlB,QAAO;AACR;AAMD,SAAS,kBAAkBC,cAAqD;AAC9E,MAAK,aACH,QAAO,CAAE;AAGX,QAAO,aACJ,MAAM,IAAI,CACV,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAC1B,OAAO,QAAQ,CACf,OAA+B,CAAC,SAAS,SAAS;EACjD,MAAM,iBAAiB,KAAK,QAAQ,IAAI;AACxC,MAAI,kBAAkB,EACpB,QAAO;EAGT,MAAM,OAAO,KAAK,MAAM,GAAG,eAAe,CAAC,MAAM;EACjD,MAAM,QAAQ,KAAK,MAAM,iBAAiB,EAAE,CAAC,MAAM;AACnD,OAAK,KACH,QAAO;AAGT,UAAQ,QAAQ;AAChB,SAAO;CACR,GAAE,CAAE,EAAC;AACT;AAED,SAAS,sBAAsBF,OAAeG,QAAwB;AACpE,QAAO,WAAW,UAAU,OAAO,CAAC,OAAO,MAAM,CAAC,OAAO,YAAY;AACtE;AAED,SAAS,oBAAoBC,MAAcC,OAAwB;CACjE,MAAM,aAAa,OAAO,KAAK,KAAK;CACpC,MAAM,cAAc,OAAO,KAAK,MAAM;AAEtC,KAAI,WAAW,WAAW,YAAY,OACpC,QAAO;AAGT,QAAO,gBAAgB,YAAY,YAAY;AAChD;AAED,SAAS,cAAcZ,WAA2B;CAChD,MAAM,YAAY,sBAAsB,WAAW,eAAe;AAClE,SAAQ,EAAE,UAAU,GAAG,UAAU;AAClC;AAED,SAAS,gBAAgBa,aAAgD;AACvE,MAAK,YACH,QAAO;CAGT,IAAIC;AACJ,KAAI;AACF,iBAAe,mBAAmB,YAAY;CAC/C,QAAO;AACN,SAAO;CACR;CAED,MAAM,iBAAiB,aAAa,YAAY,IAAI;AACpD,KAAI,kBAAkB,KAAK,mBAAmB,aAAa,SAAS,EAClE,QAAO;CAGT,MAAM,YAAY,aAAa,MAAM,GAAG,eAAe;CACvD,MAAM,YAAY,aAAa,MAAM,iBAAiB,EAAE;CACxD,MAAM,oBAAoB,sBAAsB,WAAW,eAAe;AAE1E,QAAO,oBAAoB,WAAW,kBAAkB,GAAG,YAAY;AACxE;AAED,SAAS,4BAA4Bd,WAAmBe,SAAuC;CAC7F,MAAM,cAAc,mBAAmB,cAAc,UAAU,CAAC;CAChE,MAAM,WAAW;GACd,EAAE,oBAAoB,GAAG,YAAY;GACrC,UAAU,QAAQ,OAAO;GACzB,OAAO,oBAAoB;GAC3B,WAAW,yBAAyB;EACrC;CACD;AAED,KAAI,sBACF,UAAS,MAAM,SAAS,sBAAsB,EAAE;AAGlD,KAAI,sBACF,UAAS,KAAK,SAAS;AAGzB,QAAO,SAAS,KAAK,KAAK;AAC3B;AAED,SAAS,gCAAwC;CAC/C,MAAM,WAAW;GACd,EAAE,oBAAoB;EACvB;GACC,OAAO,oBAAoB;GAC3B,WAAW,yBAAyB;EACrC;CACD;AAED,KAAI,sBACF,UAAS,MAAM,SAAS,sBAAsB,EAAE;AAGlD,KAAI,sBACF,UAAS,KAAK,SAAS;AAGzB,QAAO,SAAS,KAAK,KAAK;AAC3B;AAED,eAAe,wBAAwBC,SAA0C;CAC/E,MAAM,UAAU,kBAAkB,QAAQ,QAAQ,IAAI,SAAS,CAAC;AAChE,QAAO,gBAAgB,QAAQ,qBAAqB;AACrD;AAED,SAAS,oBAAoBC,MAA6B;CACxD,MAAM,OAAO,IAAI;AAEjB,KAAI,KAAK,OACP,MAAK,IAAI,WAAW,cAAc,KAAK,OAAO,CAAC;AAGjD,KAAI,KAAK,IACP,MAAK,IAAI,WAAW,aAAa,KAAK,IAAI,CAAC;AAG7C,KAAI,KAAK,aACP,MAAK,IAAI,WAAW,sBAAsB,KAAK,aAAa,CAAC;AAG/D,QAAO,MAAM,KAAK,KAAK;AACxB;AAED,eAAe,uBAAuBjB,WAAmBiB,MAAkC;CACzF,MAAM,YAAY,oBAAoB,KAAK;AAC3C,KAAI,UAAU,WAAW,EACvB;CAGF,MAAM,cAAc,UAAU;CAC9B,MAAM,WAAW,YAAY,UAAU;AAEvC,MAAK,MAAM,YAAY,WAAW;AAChC,WAAS,KAAK,UAAU,UAAU;AAClC,WAAS,OAAO,UAAU,YAAY;CACvC;AAED,OAAM,SAAS,MAAM;AACtB;AAED,eAAe,yBAAyBjB,WAAmBiB,MAAkC;CAC3F,MAAM,YAAY,oBAAoB,KAAK;AAC3C,KAAI,UAAU,WAAW,EACvB;CAGF,MAAM,cAAc,UAAU;CAC9B,MAAM,WAAW,YAAY,UAAU;AAEvC,MAAK,MAAM,YAAY,UACrB,UAAS,KAAK,UAAU,UAAU;AAGpC,OAAM,SAAS,MAAM;AACtB;AAED,SAAS,iBAAiBC,aAAgD;AACxE,MAAK,YACH,QAAO;AAGT,KAAI;AACF,SAAO,KAAK,MAAM,kBAAkB,YAAY,CAAC;CAClD,SAAQ,OAAO;AACd,SAAO,MAAM,gCAAgC,iBAAiB,QAAQ,eAAkB;AACxF,SAAO;CACR;AACF;AAED,SAAS,kBAAkBD,MAA2B;CACpD,MAAM,YAAY,KAAK,UAAU,KAAK;AACtC,MAAK,uBACH,QAAO;CAGT,MAAM,KAAK,YAAY,GAAG;CAC1B,MAAM,SAAS,eAAe,eAAe,wBAAwB,GAAG;CACxE,MAAM,aAAa,OAAO,OAAO,CAAC,OAAO,OAAO,WAAW,OAAO,EAAE,OAAO,OAAO,AAAC,EAAC;CACpF,MAAM,MAAM,OAAO,YAAY;AAE/B,QAAO;EACL;EACA,GAAG,SAAS,YAAY;EACxB,IAAI,SAAS,YAAY;EACzB,WAAW,SAAS,YAAY;CACjC,EAAC,KAAK,IAAI;AACZ;AAED,SAAS,kBAAkBV,OAAuB;AAChD,MAAK,MAAM,WAAW,UAAU,EAAE;AAChC,MAAI,2BACF,QAAO,KAAK,qFAAqF;AAGnG,SAAO;CACR;AAED,MAAK,uBACH,OAAM,IAAI,MAAM;CAGlB,MAAM,GAAG,SAAS,SAAS,UAAU,gBAAgB,GAAG,MAAM,MAAM,IAAI;AACxE,KAAI,YAAY,SAAS,YAAY,aAAa,gBAChD,OAAM,IAAI,MAAM;CAGlB,MAAM,WAAW,iBAAiB,eAAe,wBAAwB,OAAO,KAAK,SAAS,YAAY,CAAC;AAC3G,UAAS,WAAW,OAAO,KAAK,UAAU,YAAY,CAAC;AAEvD,QAAO,OAAO,OAAO,CACnB,SAAS,OAAO,OAAO,KAAK,iBAAiB,YAAY,CAAC,EAC1D,SAAS,OAAO,AACjB,EAAC,CAAC,SAAS,OAAO;AACpB;AAED,eAAe,gBAAgBP,WAAgD;AAC7E,KAAI;EACF,MAAM,cAAc,MAAM,UAAU,CAAC,IAAI,WAAW,QAAQ,UAAU,CAAC;AACvE,OAAK,aAAa;AAChB,UAAO,MAAM,8BAA8B,EAAE,UAAW,EAAC;AACzD,UAAO;EACR;AAED,QAAM,UAAU,CAAC,OAAO,WAAW,QAAQ,UAAU,EAAE,YAAY;AACnE,SAAO,iBAAiB,YAAY;CACrC,SAAQ,OAAO;AACd,SAAO,MAAM,qCAAqC,iBAAiB,QAAQ,eAAkB;AAC7F,SAAO;CACR;AACF;AAED,eAAe,iBAAiBA,WAAmBiB,MAAkC;AACnF,KAAI;EACF,MAAM,sBAAsB,iBAAiB,MAAM,UAAU,CAAC,IAAI,WAAW,QAAQ,UAAU,CAAC,CAAC;AACjG,MAAI,oBACF,OAAM,yBAAyB,WAAW,oBAAoB;AAGhE,QAAM,UAAU,CAAC,MAAM,WAAW,QAAQ,UAAU,EAAE,aAAa,kBAAkB,KAAK,CAAC;AAC3F,QAAM,uBAAuB,WAAW,KAAK;AAC7C,SAAO,MAAM,yBAAyB,EAAE,UAAW,EAAC;CACrD,SAAQ,OAAO;AACd,SAAO,MAAM,qCAAqC,iBAAiB,QAAQ,eAAkB;AAC7F,QAAM;CACP;AACF;AAED,eAAe,kBAAkBjB,WAAkC;AACjE,KAAI;EACF,MAAM,sBAAsB,iBAAiB,MAAM,UAAU,CAAC,IAAI,WAAW,QAAQ,UAAU,CAAC,CAAC;AACjG,MAAI,oBACF,OAAM,yBAAyB,WAAW,oBAAoB;AAGhE,QAAM,UAAU,CAAC,IAAI,WAAW,QAAQ,UAAU,CAAC;AACnD,SAAO,MAAM,yBAAyB,EAAE,UAAW,EAAC;CACrD,SAAQ,OAAO;AACd,SAAO,MAAM,uCAAuC,iBAAiB,QAAQ,eAAkB;CAChG;AACF;AAED,SAAS,iBAAiBmB,cAA2BC,SAA4C;CAC/F,MAAM,WAAW,EAAE,GAAG,aAAc;AAEpC,QAAO,QAAQ,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,MAAM,KAAK;AAChD,MAAI,kBAAqB;AACvB,UAAO,SAAS;AAChB;EACD;AAED,WAAS,OAAO;CACjB,EAAC;AAEF,QAAO;AACR;AAED,eAAe,uBAAuBC,UAAqC;CACzE,MAAM,aAAa,MAAM,UAAU,CAAC,SAAS,SAAS;CACtD,MAAMC,mBAA6B,CAAE;CACrC,MAAMC,kBAA4B,CAAE;AAEpC,MAAK,MAAM,aAAa,YAAY;EAClC,MAAM,SAAS,MAAM,UAAU,CAAC,OAAO,WAAW,QAAQ,UAAU,CAAC;AACrE,MAAI,OACF,kBAAiB,KAAK,UAAU;MAEhC,iBAAgB,KAAK,UAAU;CAElC;AAED,KAAI,gBAAgB,SAAS,EAC3B,OAAM,UAAU,CAAC,KAAK,UAAU,GAAG,gBAAgB;AAGrD,QAAO;AACR;AAED,SAAS,qBACPvB,WACAwB,SACAC,kBACoB;AACpB,QAAO;EACL;EACA,QAAQ,QAAQ;EAChB,OAAO,QAAQ,MAAM;EACrB,MAAM,QAAQ,MAAM;EACpB,QAAQ,QAAQ;EAChB,KAAK,QAAQ;EACb,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,cAAc,QAAQ;EACtB,WAAW,QAAQ;EACnB,WAAW,mBAAmB,cAAc;CAC7C;AACF;AAED,eAAe,qBAAqBC,YAAgF;CAClH,MAAMC,WAA4D,CAAE;AAEpE,MAAK,MAAM,aAAa,YAAY;EAClC,MAAM,OAAO,MAAM,gBAAgB,UAAU;AAC7C,MAAI,KACF,UAAS,KAAK;GAAE;GAAW;EAAM,EAAC;CAErC;AAED,QAAO;AACR;AAED,SAAS,oBAAoBX,SAAsC;CACjE,MAAM,eAAe,QAAQ,QAAQ,IAAI,kBAAkB,EAAE,MAAM,IAAI,CAAC,IAAI,MAAM;AAClF,QACE,gBACA,QAAQ,QAAQ,IAAI,mBAAmB,EAAE,MAAM,IAC/C,QAAQ,QAAQ,IAAI,YAAY,EAAE,MAAM;AAG3C;AAMD,eAAsB,kBACpBA,SACAY,aACkB;CAClB,MAAM,mBAAmB,MAAM,wBAAwB,QAAQ;CAC/D,MAAM,gBAAgB,OAAO,YAAY;CACzC,MAAM,kBAAkB,iBAAiB,CAAE,GAAE;EAC3C,GAAG;EACH,WAAW;EACX,WAAW,YAAY,aAAa,oBAAoB,QAAQ;EAChE,WAAW,YAAY,aAAa,QAAQ,QAAQ,IAAI,aAAa;CACtE,EAAC;AAEF,QAAO,MAAM,yBAAyB,EAAE,UAAU,OAAO,KAAK,YAAY,CAAE,EAAC;AAE7E,KAAI,iBACF,OAAM,kBAAkB,iBAAiB;AAG3C,OAAM,iBAAiB,eAAe,gBAAgB;AAEtD,QAAO,IAAI,QAAQ,EACjB,cAAc,4BAA4B,eAAe,EAAE,QAAQ,YAAa,EAAC,CAClF;AACF;AAED,eAAsB,eAAeZ,SAAwC;CAC3E,MAAM,YAAY,MAAM,wBAAwB,QAAQ;AACxD,MAAK,UACH,QAAO,CAAE;CAGX,MAAM,UAAU,MAAM,gBAAgB,UAAU;AAChD,MAAK,QACH,QAAO,CAAE;AAGX,QAAO;EACL;EACA,QAAQ,QAAQ;EAChB,aAAa,QAAQ;EACrB,cAAc,QAAQ;EACtB,SAAS,QAAQ;EACjB,WAAW,QAAQ;EACnB,QAAQ,QAAQ;EAChB,KAAK,QAAQ;EACb,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,MAAM,QAAQ;EACd,WAAW,QAAQ;EACnB,cAAc,QAAQ;CACvB;AACF;AAED,eAAsB,kBACpBA,SACAI,SACkB;CAClB,MAAM,mBAAmB,MAAM,wBAAwB,QAAQ;CAC/D,MAAM,qBAAqB,mBACtB,MAAM,gBAAgB,iBAAiB,IAAK,CAAE,IAC/C,CAAE;CACN,MAAM,gBAAgB,oBAAoB,OAAO,YAAY;CAC7D,MAAM,kBAAkB,iBAAiB,oBAAoB;EAC3D,GAAG;EACH,WAAW;CACZ,EAAC;AAEF,OAAM,iBAAiB,eAAe,gBAAgB;AAEtD,QAAO,IAAI,QAAQ,EACjB,cAAc,4BAA4B,eAAe,EAAE,QAAQ,YAAa,EAAC,CAClF;AACF;AAED,eAAsB,mBAAmBJ,SAAoC;CAC3E,MAAM,YAAY,MAAM,wBAAwB,QAAQ;AACxD,KAAI,UACF,OAAM,kBAAkB,UAAU;AAGpC,QAAO,IAAI,QAAQ,EACjB,cAAc,+BAA+B,CAC9C;AACF;AAED,eAAsB,wBAAwBA,SAA0C;AACtF,QAAO,MAAM,wBAAwB,QAAQ;AAC9C;AAED,eAAsB,mBAAmBhB,WAAgD;CACvF,MAAM,UAAU,MAAM,gBAAgB,UAAU;AAChD,QAAO,UAAU;EAAE,GAAG;EAAS;CAAW,IAAG;AAC9C;AAED,eAAsB,2BACpBC,QAC0D;CAC1D,MAAM,aAAa,MAAM,uBAAuB,WAAW,cAAc,OAAO,CAAC;AACjF,QAAO,MAAM,qBAAqB,WAAW;AAC9C;AAED,eAAsB,wBACpBA,QACAwB,kBAC+B;CAC/B,MAAM,WAAW,MAAM,2BAA2B,OAAO;AAEzD,QAAO,SACJ,IAAI,CAAC,EAAE,WAAW,MAAM,KAAK,qBAAqB,WAAW,MAAM,iBAAiB,CAAC,CACrF,KAAK,CAAC,MAAM,WAAW,MAAM,gBAAgB,MAAM,aAAa,MAAM,KAAK,gBAAgB,KAAK,aAAa,GAAG;AACpH;AAED,eAAsB,4BAA4BT,SAAiD;CACjG,MAAM,iBAAiB,MAAM,eAAe,QAAQ;AACpD,MAAK,eAAe,OAClB,QAAO,CAAE;AAGX,QAAO,MAAM,wBAAwB,eAAe,QAAQ,eAAe,UAAU;AACtF;AAED,eAAsB,uBAAuBhB,WAAqC;CAChF,MAAM,UAAU,MAAM,gBAAgB,UAAU;AAChD,MAAK,QACH,QAAO;AAGT,OAAM,kBAAkB,UAAU;AAClC,QAAO;AACR;AAED,eAAsB,2BAA2BC,QAAiC;CAChF,MAAM,aAAa,MAAM,uBAAuB,WAAW,cAAc,OAAO,CAAC;CACjF,IAAI,oBAAoB;AAExB,MAAK,MAAM,aAAa,WACtB,KAAI,MAAM,uBAAuB,UAAU,CACzC,sBAAqB;AAIzB,QAAO;AACR;AAED,eAAsB,yBAAyBC,KAA8B;CAC3E,MAAM,aAAa,MAAM,uBAAuB,WAAW,aAAa,IAAI,CAAC;CAC7E,IAAI,oBAAoB;AAExB,MAAK,MAAM,aAAa,WACtB,KAAI,MAAM,uBAAuB,UAAU,CACzC,sBAAqB;AAIzB,QAAO;AACR;AAED,eAAsB,kCAAkCC,cAAuC;CAC7F,MAAM,aAAa,MAAM,uBAAuB,WAAW,sBAAsB,aAAa,CAAC;CAC/F,IAAI,oBAAoB;AAExB,MAAK,MAAM,aAAa,WACtB,KAAI,MAAM,uBAAuB,UAAU,CACzC,sBAAqB;AAIzB,QAAO;AACR;AAED,eAAsB,qCAAqC0B,QAIvC;AAClB,KAAI,OAAO,IACT,QAAO,MAAM,yBAAyB,OAAO,IAAI;AAGnD,KAAI,OAAO,aACT,QAAO,MAAM,kCAAkC,OAAO,aAAa;AAGrE,KAAI,OAAO,OACT,QAAO,MAAM,2BAA2B,OAAO,OAAO;AAGxD,QAAO;AACR;AAED,eAAsB,mBAAmBb,SAAwC;CAC/E,MAAM,cAAc,MAAM,eAAe,QAAQ;AAEjD,MAAK,YAAY,WAAW,YAAY,YACtC,OAAM,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAK;AAGpD,QAAO;AACR;AAED,eAAsB,eAAeA,SAAoC;AACvE,KAAI;EACF,MAAM,cAAc,MAAM,eAAe,QAAQ;AAEjD,OAAK,YAAY,SAAS,YAAY,YACpC,QAAO;AAGT,MAAI,YAAY,aAAa,KAAK,KAAK,IAAI,YAAY,UACrD,QAAO;AAGT,SAAO;CACR,QAAO;AACN,SAAO;CACR;AACF;AAMD,eAAsB,iBAAiBc,OAAoC;CACzE,MAAM,UAAU,OAAO,YAAY;CACnC,MAAM,MAAM,WAAW,WAAW,QAAQ;AAE1C,OAAM,UAAU,CAAC,MAAM,KAAK,iBAAiB,KAAK,UAAU,MAAM,CAAC;AAEnE,QAAO,MAAM,uBAAuB;EAAE;EAAS,KAAK;CAAiB,EAAC;AAEtE,QAAO;AACR;AAED,eAAsB,cAAc/B,SAA6C;CAC/E,MAAM,MAAM,WAAW,WAAW,QAAQ;CAC1C,MAAM,OAAO,MAAM,UAAU,CAAC,IAAI,IAAI;AAEtC,MAAK,MAAM;AACT,SAAO,KAAK,oCAAoC,EAAE,QAAS,EAAC;AAC5D,SAAO;CACR;AAED,KAAI;AACF,SAAO,KAAK,MAAM,KAAK;CACxB,SAAQ,OAAO;AACd,SAAO,MAAM,+BAA+B,iBAAiB,QAAQ,eAAkB;AACvF,SAAO;CACR;AACF;AAED,eAAsB,iBAAiBA,SAAgC;CACrE,MAAM,MAAM,WAAW,WAAW,QAAQ;AAC1C,OAAM,UAAU,CAAC,IAAI,IAAI;AACzB,QAAO,MAAM,uBAAuB,EAAE,QAAS,EAAC;AACjD;AAED,eAAsB,4BAA6C;CACjE,MAAM,UAAU,WAAW,WAAW,IAAI;CAC1C,MAAM,OAAO,MAAM,UAAU,CAAC,KAAK,QAAQ;CAE3C,IAAI,UAAU;AACd,MAAK,MAAM,OAAO,MAAM;EACtB,MAAM,MAAM,MAAM,UAAU,CAAC,IAAI,IAAI;AACrC,MAAI,QAAQ,IAAI;AACd,SAAM,UAAU,CAAC,IAAI,IAAI;AACzB;EACD;CACF;AAED,QAAO,KAAK,iCAAiC;EAAE;EAAS,OAAO,KAAK;CAAQ,EAAC;AAC7E,QAAO;AACR;AAMD,eAAsB,uBAAsC;AAC1D,KAAI,OAAO;AACT,QAAM,MAAM,MAAM;AAClB,UAAQ;AACR,SAAO,KAAK,0BAA0B;CACvC;AACF"}

package/dist/{server-B7JN86_0.js → server-B6PCxc-T.js}

@@ -1,6 +1,6 @@
-import { logger } from "./logging-_h2mi3L9.js";
-import { getAuthSession } from "./redis-session-storage.server-D0-72FV-.js";
-import { createRedirectResponse, getUser, login, refreshTokens, requireAuth } from "./auth.server-B3ODGIX4.js";
+import { logger } from "./logging-DviiAkLx.js";
+import { getAuthSession } from "./redis-session-storage.server-v2VcpFsQ.js";
+import { createRedirectResponse, getUser, login, refreshTokens, requireAuth } from "./auth.server-D5oiz9aF.js";
 
 //#region src/auth/route-protection.server.ts
 const REFRESH_THRESHOLD = resolveRefreshThreshold();
@@ -17,7 +17,7 @@ async function shouldRefreshToken(request) {
 		if (!sessionData.refreshToken || sessionData.refreshToken.length === 0) {
 			if (sessionData.expiresAt && Date.now() >= sessionData.expiresAt) {
 				logger.info("Token expired and no refresh token, forcing local application logout");
-				const { logout } = await import("./auth.server-wdKsjQsn.js");
+				const { logout } = await import("./auth.server-lC94lmlx.js");
 				const logoutRequest = await createAutomaticLogoutRequest(request, "expired-no-refresh-token");
 				throw await logout(logoutRequest);
 			}
@@ -55,7 +55,7 @@ async function autoRefreshTokens(request) {
 				logger.error("Auto-refresh failed", void 0, { error: result.error });
 				if (result.shouldLogout) {
 					logger.error("Refresh token invalid, forcing local application logout");
-					const { logout } = await import("./auth.server-wdKsjQsn.js");
+					const { logout } = await import("./auth.server-lC94lmlx.js");
 					const logoutRequest = await createAutomaticLogoutRequest(request, "refresh-failed");
 					throw await logout(logoutRequest);
 				}
@@ -68,7 +68,7 @@ async function autoRefreshTokens(request) {
 }
 let protectionConfig = {};
 /**
-* Configure route protection with identity/tenant/subscription checkers
+* Configure route protection with identity, tenant, and app policy checkers
 */
 function configureRouteProtection(config) {
 	protectionConfig = config;
@@ -92,9 +92,9 @@ function getLoginReturnUrl(request, currentPath, protection) {
 		protection
 	});
 	switch (protection) {
-		case "onboarding-required": return "/onboarding";
-		case "subscription-required": return "/subscription";
-		case "public": return "/";
+		case "onboarding-required":
+		case "subscription-required":
+		case "public":
 		case "auth":
 		default: {
 			const url = new URL(request.url);
@@ -158,62 +158,6 @@ async function applyConfiguredRouteResolution(request, user, currentPath, protec
 	}
 }
 /**
-* Check user status (onboarding, subscription)
-*/
-async function checkUserStatus(request, user, currentPath) {
-	if (!protectionConfig.identityChecker) {
-		logger.warn("Identity checker not configured, skipping status check");
-		return null;
-	}
-	try {
-		const context = await protectionConfig.identityChecker.getIdentityContext(request, user.sub);
-		logger.debug("User status check", {
-			userId: user.sub,
-			currentPath,
-			hasAnyMembership: context.hasAnyMembership,
-			isOnboarded: context.isOnboarded,
-			hasSubscription: context.hasSubscription
-		});
-		if (!context.hasAnyMembership) {
-			if (currentPath !== "/onboarding") {
-				logger.info("User has no memberships, redirecting to onboarding");
-				throw createRedirectResponse("/onboarding");
-			}
-			return null;
-		}
-		if (context.hasAnyMembership) {
-			if (currentPath === "/onboarding") {
-				logger.info("User has memberships, redirecting from onboarding to subscription");
-				throw createRedirectResponse("/subscription");
-			}
-			if (currentPath === "/subscription") return null;
-			if (protectionConfig.tenantChecker && protectionConfig.subscriptionChecker) {
-				let currentTenant = await protectionConfig.tenantChecker.getCurrentTenant(request);
-				if (!currentTenant) {
-					const initResult = await protectionConfig.tenantChecker.initializeTenant(request);
-					if (initResult) currentTenant = initResult.tenantId;
-				}
-				if (currentTenant) {
-					const hasSubscription = await protectionConfig.subscriptionChecker.checkTenantSubscriptionStatus(request, currentTenant);
-					if (!hasSubscription) {
-						logger.info("Tenant has no subscription, redirecting to subscription");
-						throw createRedirectResponse("/subscription");
-					}
-				} else {
-					logger.info("Could not initialize tenant, redirecting to subscription");
-					throw createRedirectResponse("/subscription");
-				}
-			}
-		}
-		return null;
-	} catch (error) {
-		if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
-		logger.error("Error checking user status", error instanceof Error ? error : void 0);
-		if (currentPath !== "/onboarding") throw createRedirectResponse("/onboarding");
-		return null;
-	}
-}
-/**
 * Main route protection function
 */
 async function protectRoute(request, protection, loaderFn) {
@@ -226,24 +170,20 @@ async function protectRoute(request, protection, loaderFn) {
 		} catch {
 			return loaderFn(void 0);
 		}
-		case "auth": try {
+		case "auth":
+		case "policy": try {
 			await autoRefreshTokens(request);
 			const user = await requireAuth(request);
-			const handledByConfig = await applyConfiguredRouteResolution(request, user, url.pathname, "auth");
-			if (!handledByConfig) await checkUserStatus(request, user, url.pathname);
+			await applyConfiguredRouteResolution(request, user, url.pathname, protection);
 			return loaderFn(user);
 		} catch (error) {
 			if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
-			throw await login(request, getLoginReturnUrl(request, url.pathname, "auth"));
+			throw await login(request, getLoginReturnUrl(request, url.pathname, protection));
 		}
 		case "onboarding-required": try {
 			await autoRefreshTokens(request);
 			const user = await requireAuth(request);
-			const handledByConfig = await applyConfiguredRouteResolution(request, user, url.pathname, "onboarding-required");
-			if (!handledByConfig && protectionConfig.identityChecker) {
-				const context = await protectionConfig.identityChecker.getIdentityContext(request, user.sub);
-				if (context.hasAnyMembership) throw createRedirectResponse("/subscription");
-			}
+			await applyConfiguredRouteResolution(request, user, url.pathname, "onboarding-required");
 			return loaderFn(user);
 		} catch (error) {
 			if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
@@ -252,11 +192,7 @@ async function protectRoute(request, protection, loaderFn) {
 		case "subscription-required": try {
 			await autoRefreshTokens(request);
 			const user = await requireAuth(request);
-			const handledByConfig = await applyConfiguredRouteResolution(request, user, url.pathname, "subscription-required");
-			if (!handledByConfig && protectionConfig.identityChecker) {
-				const context = await protectionConfig.identityChecker.getIdentityContext(request, user.sub);
-				if (!context.hasAnyMembership) throw createRedirectResponse("/onboarding");
-			}
+			await applyConfiguredRouteResolution(request, user, url.pathname, "subscription-required");
 			if (protectionConfig.tenantChecker) {
 				const currentTenant = await protectionConfig.tenantChecker.getCurrentTenant(request);
 				if (!currentTenant) await protectionConfig.tenantChecker.initializeTenant(request);
@@ -278,11 +214,23 @@ const publicRoute = (request, loaderFn) => protectRoute(request, "public", loade
 */
 const authRoute = (request, loaderFn) => protectRoute(request, "auth", loaderFn);
 /**
-* Onboarding route
+* Generic policy-protected route. Apps define policy in configureRouteProtection.
+*/
+const policyRoute = (request, loaderFn) => protectRoute(request, "policy", loaderFn);
+/**
+* Alias for auth-protected routes.
+*/
+const protectedRoute = authRoute;
+/**
+* Setup policy route
+*
+* @deprecated Use policyRoute with configureRouteProtection instead.
 */
 const onboardingRoute = (request, loaderFn) => protectRoute(request, "onboarding-required", loaderFn);
 /**
-* Subscription route
+* Entitlement policy route
+*
+* @deprecated Use policyRoute with configureRouteProtection instead.
 */
 const subscriptionRoute = (request, loaderFn) => protectRoute(request, "subscription-required", loaderFn);
 
@@ -352,5 +300,5 @@ function shouldAttemptTokenRefresh(response, hasAuth) {
 }
 
 //#endregion
-export { attemptTokenRefresh, authRoute, configureRouteProtection, isTokenExpiredResponse, onboardingRoute, protectRoute, publicRoute, resetRouteProtectionConfig, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute };
-//# sourceMappingURL=server-B7JN86_0.js.map
+export { attemptTokenRefresh, authRoute, configureRouteProtection, isTokenExpiredResponse, onboardingRoute, policyRoute, protectRoute, protectedRoute, publicRoute, resetRouteProtectionConfig, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute };
+//# sourceMappingURL=server-B6PCxc-T.js.map

package/dist/server-B6PCxc-T.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-B6PCxc-T.js","names":["request: Request","jwtExpiry: number | null","protectionConfig: RouteProtectionConfig<any>","config: RouteProtectionConfig<TIdentityContext>","redirect: RouteProtectionRedirect","currentPath: string","protection: ProtectionLevel","reason: AutomaticLogoutRequestContext['reason']","user: UserInfo","identityContextPromise: Promise<any | null> | null","currentTenantPromise: Promise<string | null> | null","initializeTenantPromise: Promise<{ headers: Headers; tenantId: string } | null> | null","loaderFn: (user?: UserInfo) => Promise<T> | T","loaderFn: (user: UserInfo) => Promise<T> | T","request: Request","response: Response","hasAuth: boolean"],"sources":["../src/auth/route-protection.server.ts","../src/auth/token-refresh.server.ts"],"sourcesContent":["/**\n * Route Protection Server Module\n * \n * Provides route protection utilities for different authentication levels.\n */\n\nimport { getUser, requireAuth, refreshTokens, login } from './auth.server';\nimport { getAuthSession } from './redis-session-storage.server';\nimport type { ProtectionLevel, UserInfo } from './types';\nimport { logger } from '../logging';\nimport { createRedirectResponse } from '../http/response';\n\n// Refresh shortly before expiry. Keep this below common 5-minute access-token\n// lifetimes so a freshly issued token does not refresh again immediately.\nconst REFRESH_THRESHOLD = resolveRefreshThreshold();\n\nfunction resolveRefreshThreshold(): number {\n  const configured = Number(process.env.OIDC_REFRESH_THRESHOLD_MS);\n  return Number.isFinite(configured) && configured > 0 ? configured : 60_000;\n}\n\n/**\n * Check if token needs refresh\n */\nexport async function shouldRefreshToken(request: Request): Promise<boolean> {\n  try {\n    const sessionData = await getAuthSession(request);\n\n    if (!sessionData.refreshToken || sessionData.refreshToken.length === 0) {\n      if (sessionData.expiresAt && Date.now() >= sessionData.expiresAt) {\n        logger.info('Token expired and no refresh token, forcing local application logout');\n        const { logout } = await import('./auth.server');\n        const logoutRequest = await createAutomaticLogoutRequest(request, 'expired-no-refresh-token');\n        throw await logout(logoutRequest);\n      }\n      return false;\n    }\n\n    if (!sessionData.expiresAt || !sessionData.accessToken) {\n      return false;\n    }\n\n    const now = Date.now();\n\n    // Check JWT expiry\n    let jwtExpiry: number | null = null;\n    try {\n      const tokenParts = sessionData.accessToken.split('.');\n      if (tokenParts.length === 3) {\n        const payload = JSON.parse(Buffer.from(tokenParts[1], 'base64').toString());\n        if (payload.exp) {\n          jwtExpiry = payload.exp * 1000;\n        }\n      }\n    } catch {\n      // Ignore JWT decode errors\n    }\n\n    const earliestExpiry = jwtExpiry && jwtExpiry < sessionData.expiresAt \n      ? jwtExpiry \n      : sessionData.expiresAt;\n    const timeUntilEarliestExpiry = earliestExpiry - now;\n\n    return timeUntilEarliestExpiry <= REFRESH_THRESHOLD;\n  } catch (error) {\n    logger.error('Error checking token refresh', error instanceof Error ? error : undefined);\n    return false;\n  }\n}\n\n/**\n * Auto-refresh tokens if needed\n */\nasync function autoRefreshTokens(request: Request): Promise<void> {\n  try {\n    const needsRefresh = await shouldRefreshToken(request);\n\n    if (needsRefresh) {\n      logger.info('Auto-refreshing tokens due to expiry');\n      const result = await refreshTokens(request);\n\n      if (result.success) {\n        logger.info('Auto-refresh completed successfully');\n      } else {\n        logger.error('Auto-refresh failed', undefined, { error: result.error });\n\n        if (result.shouldLogout) {\n          logger.error('Refresh token invalid, forcing local application logout');\n          const { logout } = await import('./auth.server');\n          const logoutRequest = await createAutomaticLogoutRequest(request, 'refresh-failed');\n          throw await logout(logoutRequest);\n        }\n      }\n    }\n  } catch (error) {\n    if (error instanceof Response && error.status >= 300 && error.status < 400) {\n      throw error;\n    }\n    throw error;\n  }\n}\n\n/**\n * Identity context check configuration\n */\nexport interface DefaultRouteIdentityContext {\n  hasAnyMembership: boolean;\n  hasEntitlement?: boolean;\n  /** @deprecated Use hasEntitlement or app-specific fields instead. */\n  hasSubscription: boolean;\n  isOnboarded: boolean;\n}\n\nexport interface IdentityContextChecker<TIdentityContext = DefaultRouteIdentityContext> {\n  getIdentityContext: (\n    request: Request,\n    userId: string,\n    forceRefresh?: boolean\n  ) => Promise<DefaultRouteIdentityContext & TIdentityContext>;\n}\n\n/**\n * Tenant checker configuration\n */\nexport interface TenantChecker {\n  getCurrentTenant: (request: Request) => Promise<string | null>;\n  initializeTenant: (request: Request) => Promise<{ headers: Headers; tenantId: string } | null>;\n}\n\n/**\n * Legacy subscription checker configuration\n *\n * @deprecated Put entitlement policy in resolveRoute or app-level route loaders.\n */\nexport interface SubscriptionChecker {\n  checkTenantSubscriptionStatus: (request: Request, tenantId: string) => Promise<boolean>;\n}\n\nexport interface RouteProtectionRedirect {\n  location: string;\n  headers?: HeadersInit;\n  status?: number;\n}\n\nexport interface AutomaticLogoutRequestContext {\n  request: Request;\n  reason: 'expired-no-refresh-token' | 'refresh-failed';\n}\n\nexport interface LoginReturnUrlContext {\n  request: Request;\n  currentPath: string;\n  protection: ProtectionLevel;\n}\n\nexport interface RouteProtectionResolverContext<TIdentityContext = DefaultRouteIdentityContext> {\n  request: Request;\n  user: UserInfo;\n  currentPath: string;\n  protection: ProtectionLevel;\n  getIdentityContext: (forceRefresh?: boolean) => Promise<TIdentityContext | null>;\n  getCurrentTenant: () => Promise<string | null>;\n  initializeTenant: () => Promise<{ headers: Headers; tenantId: string } | null>;\n}\n\nexport interface RouteProtectionErrorHandlerContext<TIdentityContext = DefaultRouteIdentityContext>\n  extends RouteProtectionResolverContext<TIdentityContext> {\n  error: unknown;\n}\n\n/**\n * Route protection configuration\n */\nexport interface RouteProtectionConfig<TIdentityContext = DefaultRouteIdentityContext> {\n  identityChecker?: IdentityContextChecker<TIdentityContext>;\n  tenantChecker?: TenantChecker;\n  subscriptionChecker?: SubscriptionChecker;\n  resolveRoute?: (\n    context: RouteProtectionResolverContext<TIdentityContext>\n  ) => Promise<RouteProtectionRedirect | null | void> | RouteProtectionRedirect | null | void;\n  handleRouteError?: (\n    context: RouteProtectionErrorHandlerContext<TIdentityContext>\n  ) => Promise<RouteProtectionRedirect | null | void> | RouteProtectionRedirect | null | void;\n  getLoginReturnUrl?: (context: LoginReturnUrlContext) => string;\n  createAutomaticLogoutRequest?: (\n    context: AutomaticLogoutRequestContext\n  ) => Promise<Request> | Request;\n}\n\nlet protectionConfig: RouteProtectionConfig<any> = {};\n\n/**\n * Configure route protection with identity, tenant, and app policy checkers\n */\nexport function configureRouteProtection<TIdentityContext = DefaultRouteIdentityContext>(\n  config: RouteProtectionConfig<TIdentityContext>\n): void {\n  protectionConfig = config;\n}\n\n/**\n * Reset route protection to its built-in defaults.\n */\nexport function resetRouteProtectionConfig(): void {\n  protectionConfig = {};\n}\n\nfunction createRedirectFromConfig(redirect: RouteProtectionRedirect): Response {\n  return createRedirectResponse(redirect.location, {\n    headers: redirect.headers,\n    status: redirect.status,\n  });\n}\n\nfunction getLoginReturnUrl(\n  request: Request,\n  currentPath: string,\n  protection: ProtectionLevel\n): string {\n  if (protectionConfig.getLoginReturnUrl) {\n    return protectionConfig.getLoginReturnUrl({\n      request,\n      currentPath,\n      protection,\n    });\n  }\n\n  switch (protection) {\n    case 'onboarding-required':\n    case 'subscription-required':\n    case 'public':\n    case 'auth':\n    default: {\n      const url = new URL(request.url);\n      return url.pathname === '/' ? '/' : `${url.pathname}${url.search}`;\n    }\n  }\n}\n\nasync function createAutomaticLogoutRequest(\n  request: Request,\n  reason: AutomaticLogoutRequestContext['reason']\n): Promise<Request> {\n  if (protectionConfig.createAutomaticLogoutRequest) {\n    return protectionConfig.createAutomaticLogoutRequest({ request, reason });\n  }\n\n  const logoutUrl = new URL(request.url);\n  logoutUrl.pathname = '/auth/logout';\n  logoutUrl.searchParams.set('logout', 'local');\n\n  return new Request(logoutUrl.toString(), {\n    headers: request.headers,\n  });\n}\n\nfunction createRouteResolverContext(\n  request: Request,\n  user: UserInfo,\n  currentPath: string,\n  protection: ProtectionLevel\n): RouteProtectionResolverContext<any> {\n  let identityContextPromise: Promise<any | null> | null = null;\n  let currentTenantPromise: Promise<string | null> | null = null;\n  let initializeTenantPromise: Promise<{ headers: Headers; tenantId: string } | null> | null = null;\n\n  return {\n    request,\n    user,\n    currentPath,\n    protection,\n    getIdentityContext: async (forceRefresh = false) => {\n      if (!protectionConfig.identityChecker) {\n        return null;\n      }\n\n      if (forceRefresh) {\n        return protectionConfig.identityChecker.getIdentityContext(request, user.sub, true);\n      }\n\n      if (!identityContextPromise) {\n        identityContextPromise = protectionConfig.identityChecker.getIdentityContext(request, user.sub);\n      }\n\n      return identityContextPromise;\n    },\n    getCurrentTenant: async () => {\n      if (!protectionConfig.tenantChecker) {\n        return null;\n      }\n\n      if (!currentTenantPromise) {\n        currentTenantPromise = protectionConfig.tenantChecker.getCurrentTenant(request);\n      }\n\n      return currentTenantPromise;\n    },\n    initializeTenant: async () => {\n      if (!protectionConfig.tenantChecker) {\n        return null;\n      }\n\n      if (!initializeTenantPromise) {\n        initializeTenantPromise = protectionConfig.tenantChecker.initializeTenant(request);\n      }\n\n      return initializeTenantPromise;\n    },\n  };\n}\n\nasync function applyConfiguredRouteResolution(\n  request: Request,\n  user: UserInfo,\n  currentPath: string,\n  protection: ProtectionLevel\n): Promise<boolean> {\n  if (!protectionConfig.resolveRoute) {\n    return false;\n  }\n\n  const context = createRouteResolverContext(request, user, currentPath, protection);\n\n  try {\n    const result = await protectionConfig.resolveRoute(context);\n    if (result) {\n      throw createRedirectFromConfig(result);\n    }\n\n    return true;\n  } catch (error) {\n    if (error instanceof Response && error.status >= 300 && error.status < 400) {\n      throw error;\n    }\n\n    if (!protectionConfig.handleRouteError) {\n      throw error;\n    }\n\n    const recovery = await protectionConfig.handleRouteError({\n      ...context,\n      error,\n    });\n\n    if (recovery) {\n      throw createRedirectFromConfig(recovery);\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Main route protection function\n */\nexport async function protectRoute<T>(\n  request: Request,\n  protection: ProtectionLevel,\n  loaderFn: (user?: UserInfo) => Promise<T> | T\n): Promise<T> {\n  const url = new URL(request.url);\n\n  switch (protection) {\n    case 'public':\n      try {\n        await autoRefreshTokens(request);\n        const user = await getUser(request);\n        return loaderFn(user ?? undefined);\n      } catch {\n        return loaderFn(undefined);\n      }\n\n    case 'auth':\n    case 'policy':\n      try {\n        await autoRefreshTokens(request);\n        const user = await requireAuth(request);\n        await applyConfiguredRouteResolution(request, user, url.pathname, protection);\n        return loaderFn(user);\n      } catch (error) {\n        if (error instanceof Response && error.status >= 300 && error.status < 400) {\n          throw error;\n        }\n        throw await login(request, getLoginReturnUrl(request, url.pathname, protection));\n      }\n\n    case 'onboarding-required':\n      try {\n        await autoRefreshTokens(request);\n        const user = await requireAuth(request);\n\n        await applyConfiguredRouteResolution(\n          request,\n          user,\n          url.pathname,\n          'onboarding-required'\n        );\n\n        return loaderFn(user);\n      } catch (error) {\n        if (error instanceof Response && error.status >= 300 && error.status < 400) {\n          throw error;\n        }\n        throw await login(request, getLoginReturnUrl(request, url.pathname, 'onboarding-required'));\n      }\n\n    case 'subscription-required':\n      try {\n        await autoRefreshTokens(request);\n        const user = await requireAuth(request);\n\n        await applyConfiguredRouteResolution(\n          request,\n          user,\n          url.pathname,\n          'subscription-required'\n        );\n\n        // Initialize tenant if needed\n        if (protectionConfig.tenantChecker) {\n          const currentTenant = await protectionConfig.tenantChecker.getCurrentTenant(request);\n          if (!currentTenant) {\n            await protectionConfig.tenantChecker.initializeTenant(request);\n          }\n        }\n\n        return loaderFn(user);\n      } catch (error) {\n        if (error instanceof Response && error.status >= 300 && error.status < 400) {\n          throw error;\n        }\n        throw await login(request, getLoginReturnUrl(request, url.pathname, 'subscription-required'));\n      }\n\n    default:\n      throw new Error(`Unknown protection level: ${protection}`);\n  }\n}\n\n// ============================================================================\n// Convenience Functions\n// ============================================================================\n\n/**\n * Public route (optional auth)\n */\nexport const publicRoute = <T>(\n  request: Request,\n  loaderFn: (user?: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'public', loaderFn);\n\n/**\n * Auth-protected route\n */\nexport const authRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'auth', loaderFn as (user?: UserInfo) => Promise<T> | T);\n\n/**\n * Generic policy-protected route. Apps define policy in configureRouteProtection.\n */\nexport const policyRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'policy', loaderFn as (user?: UserInfo) => Promise<T> | T);\n\n/**\n * Alias for auth-protected routes.\n */\nexport const protectedRoute = authRoute;\n\n/**\n * Setup policy route\n *\n * @deprecated Use policyRoute with configureRouteProtection instead.\n */\nexport const onboardingRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'onboarding-required', loaderFn as (user?: UserInfo) => Promise<T> | T);\n\n/**\n * Entitlement policy route\n *\n * @deprecated Use policyRoute with configureRouteProtection instead.\n */\nexport const subscriptionRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'subscription-required', loaderFn as (user?: UserInfo) => Promise<T> | T);\n","/**\n * Token Refresh Server Module\n */\n\nimport { refreshTokens } from './auth.server';\nimport { getAuthSession } from './redis-session-storage.server';\nimport type { TokenRefreshResult } from './types';\nimport { logger } from '../logging';\n\n/**\n * Attempt to refresh the access token\n */\nexport async function attemptTokenRefresh(request: Request): Promise<TokenRefreshResult> {\n  try {\n    logger.info('Attempting token refresh due to 401 response');\n\n    const sessionData = await getAuthSession(request);\n\n    if (!sessionData.refreshToken) {\n      logger.warn('No refresh token available in session');\n      return {\n        success: false,\n        error: 'No refresh token available',\n        shouldLogout: true,\n      };\n    }\n\n    const refreshResult = await refreshTokens(request, sessionData.refreshToken);\n\n    if (!refreshResult.success) {\n      logger.error('Token refresh failed', undefined, {\n        error: refreshResult.error,\n        shouldLogout: refreshResult.shouldLogout,\n      });\n\n      return {\n        success: false,\n        error: refreshResult.error,\n        shouldLogout: refreshResult.shouldLogout,\n      };\n    }\n\n    const tokens = refreshResult.tokens;\n    if (!tokens || !tokens.access_token) {\n      logger.error('Token refresh succeeded but no access token returned');\n      return {\n        success: false,\n        error: 'No access token in refresh response',\n        shouldLogout: true,\n      };\n    }\n\n    logger.info('Token refresh successful');\n\n    return {\n      success: true,\n      newAccessToken: tokens.access_token,\n    };\n  } catch (error) {\n    logger.error('Token refresh attempt failed', error instanceof Error ? error : undefined);\n    return {\n      success: false,\n      error: error instanceof Error ? error.message : 'Unknown error',\n      shouldLogout: true,\n    };\n  }\n}\n\n/**\n * Check if a response indicates token expiration\n */\nexport function isTokenExpiredResponse(response: Response): boolean {\n  return response.status === 401;\n}\n\n/**\n * Check if token refresh should be attempted\n */\nexport function shouldAttemptTokenRefresh(response: Response, hasAuth: boolean): boolean {\n  return hasAuth && isTokenExpiredResponse(response);\n}\n"],"mappings":";;;;;AAcA,MAAM,oBAAoB,yBAAyB;AAEnD,SAAS,0BAAkC;CACzC,MAAM,aAAa,OAAO,QAAQ,IAAI,0BAA0B;AAChE,QAAO,OAAO,SAAS,WAAW,IAAI,aAAa,IAAI,aAAa;AACrE;;;;AAKD,eAAsB,mBAAmBA,SAAoC;AAC3E,KAAI;EACF,MAAM,cAAc,MAAM,eAAe,QAAQ;AAEjD,OAAK,YAAY,gBAAgB,YAAY,aAAa,WAAW,GAAG;AACtE,OAAI,YAAY,aAAa,KAAK,KAAK,IAAI,YAAY,WAAW;AAChE,WAAO,KAAK,uEAAuE;IACnF,MAAM,EAAE,QAAQ,GAAG,MAAM,OAAO;IAChC,MAAM,gBAAgB,MAAM,6BAA6B,SAAS,2BAA2B;AAC7F,UAAM,MAAM,OAAO,cAAc;GAClC;AACD,UAAO;EACR;AAED,OAAK,YAAY,cAAc,YAAY,YACzC,QAAO;EAGT,MAAM,MAAM,KAAK,KAAK;EAGtB,IAAIC,YAA2B;AAC/B,MAAI;GACF,MAAM,aAAa,YAAY,YAAY,MAAM,IAAI;AACrD,OAAI,WAAW,WAAW,GAAG;IAC3B,MAAM,UAAU,KAAK,MAAM,OAAO,KAAK,WAAW,IAAI,SAAS,CAAC,UAAU,CAAC;AAC3E,QAAI,QAAQ,IACV,aAAY,QAAQ,MAAM;GAE7B;EACF,QAAO,CAEP;EAED,MAAM,iBAAiB,aAAa,YAAY,YAAY,YACxD,YACA,YAAY;EAChB,MAAM,0BAA0B,iBAAiB;AAEjD,SAAO,2BAA2B;CACnC,SAAQ,OAAO;AACd,SAAO,MAAM,gCAAgC,iBAAiB,QAAQ,eAAkB;AACxF,SAAO;CACR;AACF;;;;AAKD,eAAe,kBAAkBD,SAAiC;AAChE,KAAI;EACF,MAAM,eAAe,MAAM,mBAAmB,QAAQ;AAEtD,MAAI,cAAc;AAChB,UAAO,KAAK,uCAAuC;GACnD,MAAM,SAAS,MAAM,cAAc,QAAQ;AAE3C,OAAI,OAAO,QACT,QAAO,KAAK,sCAAsC;QAC7C;AACL,WAAO,MAAM,+BAAkC,EAAE,OAAO,OAAO,MAAO,EAAC;AAEvE,QAAI,OAAO,cAAc;AACvB,YAAO,MAAM,0DAA0D;KACvE,MAAM,EAAE,QAAQ,GAAG,MAAM,OAAO;KAChC,MAAM,gBAAgB,MAAM,6BAA6B,SAAS,iBAAiB;AACnF,WAAM,MAAM,OAAO,cAAc;IAClC;GACF;EACF;CACF,SAAQ,OAAO;AACd,MAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,IACrE,OAAM;AAER,QAAM;CACP;AACF;AAyFD,IAAIE,mBAA+C,CAAE;;;;AAKrD,SAAgB,yBACdC,QACM;AACN,oBAAmB;AACpB;;;;AAKD,SAAgB,6BAAmC;AACjD,oBAAmB,CAAE;AACtB;AAED,SAAS,yBAAyBC,UAA6C;AAC7E,QAAO,uBAAuB,SAAS,UAAU;EAC/C,SAAS,SAAS;EAClB,QAAQ,SAAS;CAClB,EAAC;AACH;AAED,SAAS,kBACPJ,SACAK,aACAC,YACQ;AACR,KAAI,iBAAiB,kBACnB,QAAO,iBAAiB,kBAAkB;EACxC;EACA;EACA;CACD,EAAC;AAGJ,SAAQ,YAAR;EACE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,SAAS;GACP,MAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,UAAO,IAAI,aAAa,MAAM,OAAO,EAAE,IAAI,SAAS,EAAE,IAAI,OAAO;EAClE;CACF;AACF;AAED,eAAe,6BACbN,SACAO,QACkB;AAClB,KAAI,iBAAiB,6BACnB,QAAO,iBAAiB,6BAA6B;EAAE;EAAS;CAAQ,EAAC;CAG3E,MAAM,YAAY,IAAI,IAAI,QAAQ;AAClC,WAAU,WAAW;AACrB,WAAU,aAAa,IAAI,UAAU,QAAQ;AAE7C,QAAO,IAAI,QAAQ,UAAU,UAAU,EAAE,EACvC,SAAS,QAAQ,QAClB;AACF;AAED,SAAS,2BACPP,SACAQ,MACAH,aACAC,YACqC;CACrC,IAAIG,yBAAqD;CACzD,IAAIC,uBAAsD;CAC1D,IAAIC,0BAAyF;AAE7F,QAAO;EACL;EACA;EACA;EACA;EACA,oBAAoB,OAAO,eAAe,UAAU;AAClD,QAAK,iBAAiB,gBACpB,QAAO;AAGT,OAAI,aACF,QAAO,iBAAiB,gBAAgB,mBAAmB,SAAS,KAAK,KAAK,KAAK;AAGrF,QAAK,uBACH,0BAAyB,iBAAiB,gBAAgB,mBAAmB,SAAS,KAAK,IAAI;AAGjG,UAAO;EACR;EACD,kBAAkB,YAAY;AAC5B,QAAK,iBAAiB,cACpB,QAAO;AAGT,QAAK,qBACH,wBAAuB,iBAAiB,cAAc,iBAAiB,QAAQ;AAGjF,UAAO;EACR;EACD,kBAAkB,YAAY;AAC5B,QAAK,iBAAiB,cACpB,QAAO;AAGT,QAAK,wBACH,2BAA0B,iBAAiB,cAAc,iBAAiB,QAAQ;AAGpF,UAAO;EACR;CACF;AACF;AAED,eAAe,+BACbX,SACAQ,MACAH,aACAC,YACkB;AAClB,MAAK,iBAAiB,aACpB,QAAO;CAGT,MAAM,UAAU,2BAA2B,SAAS,MAAM,aAAa,WAAW;AAElF,KAAI;EACF,MAAM,SAAS,MAAM,iBAAiB,aAAa,QAAQ;AAC3D,MAAI,OACF,OAAM,yBAAyB,OAAO;AAGxC,SAAO;CACR,SAAQ,OAAO;AACd,MAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,IACrE,OAAM;AAGR,OAAK,iBAAiB,iBACpB,OAAM;EAGR,MAAM,WAAW,MAAM,iBAAiB,iBAAiB;GACvD,GAAG;GACH;EACD,EAAC;AAEF,MAAI,SACF,OAAM,yBAAyB,SAAS;AAG1C,QAAM;CACP;AACF;;;;AAKD,eAAsB,aACpBN,SACAM,YACAM,UACY;CACZ,MAAM,MAAM,IAAI,IAAI,QAAQ;AAE5B,SAAQ,YAAR;EACE,KAAK,SACH,KAAI;AACF,SAAM,kBAAkB,QAAQ;GAChC,MAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,UAAO,SAAS,eAAkB;EACnC,QAAO;AACN,UAAO,gBAAmB;EAC3B;EAEH,KAAK;EACL,KAAK,SACH,KAAI;AACF,SAAM,kBAAkB,QAAQ;GAChC,MAAM,OAAO,MAAM,YAAY,QAAQ;AACvC,SAAM,+BAA+B,SAAS,MAAM,IAAI,UAAU,WAAW;AAC7E,UAAO,SAAS,KAAK;EACtB,SAAQ,OAAO;AACd,OAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,IACrE,OAAM;AAER,SAAM,MAAM,MAAM,SAAS,kBAAkB,SAAS,IAAI,UAAU,WAAW,CAAC;EACjF;EAEH,KAAK,sBACH,KAAI;AACF,SAAM,kBAAkB,QAAQ;GAChC,MAAM,OAAO,MAAM,YAAY,QAAQ;AAEvC,SAAM,+BACJ,SACA,MACA,IAAI,UACJ,sBACD;AAED,UAAO,SAAS,KAAK;EACtB,SAAQ,OAAO;AACd,OAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,IACrE,OAAM;AAER,SAAM,MAAM,MAAM,SAAS,kBAAkB,SAAS,IAAI,UAAU,sBAAsB,CAAC;EAC5F;EAEH,KAAK,wBACH,KAAI;AACF,SAAM,kBAAkB,QAAQ;GAChC,MAAM,OAAO,MAAM,YAAY,QAAQ;AAEvC,SAAM,+BACJ,SACA,MACA,IAAI,UACJ,wBACD;AAGD,OAAI,iBAAiB,eAAe;IAClC,MAAM,gBAAgB,MAAM,iBAAiB,cAAc,iBAAiB,QAAQ;AACpF,SAAK,cACH,OAAM,iBAAiB,cAAc,iBAAiB,QAAQ;GAEjE;AAED,UAAO,SAAS,KAAK;EACtB,SAAQ,OAAO;AACd,OAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,IACrE,OAAM;AAER,SAAM,MAAM,MAAM,SAAS,kBAAkB,SAAS,IAAI,UAAU,wBAAwB,CAAC;EAC9F;EAEH,QACE,OAAM,IAAI,OAAO,4BAA4B,WAAW;CAC3D;AACF;;;;AASD,MAAa,cAAc,CACzBZ,SACAY,aACG,aAAa,SAAS,UAAU,SAAS;;;;AAK9C,MAAa,YAAY,CACvBZ,SACAa,aACG,aAAa,SAAS,QAAQ,SAAgD;;;;AAKnF,MAAa,cAAc,CACzBb,SACAa,aACG,aAAa,SAAS,UAAU,SAAgD;;;;AAKrF,MAAa,iBAAiB;;;;;;AAO9B,MAAa,kBAAkB,CAC7Bb,SACAa,aACG,aAAa,SAAS,uBAAuB,SAAgD;;;;;;AAOlG,MAAa,oBAAoB,CAC/Bb,SACAa,aACG,aAAa,SAAS,yBAAyB,SAAgD;;;;;;;AC9dpG,eAAsB,oBAAoBC,SAA+C;AACvF,KAAI;AACF,SAAO,KAAK,+CAA+C;EAE3D,MAAM,cAAc,MAAM,eAAe,QAAQ;AAEjD,OAAK,YAAY,cAAc;AAC7B,UAAO,KAAK,wCAAwC;AACpD,UAAO;IACL,SAAS;IACT,OAAO;IACP,cAAc;GACf;EACF;EAED,MAAM,gBAAgB,MAAM,cAAc,SAAS,YAAY,aAAa;AAE5E,OAAK,cAAc,SAAS;AAC1B,UAAO,MAAM,gCAAmC;IAC9C,OAAO,cAAc;IACrB,cAAc,cAAc;GAC7B,EAAC;AAEF,UAAO;IACL,SAAS;IACT,OAAO,cAAc;IACrB,cAAc,cAAc;GAC7B;EACF;EAED,MAAM,SAAS,cAAc;AAC7B,OAAK,WAAW,OAAO,cAAc;AACnC,UAAO,MAAM,uDAAuD;AACpE,UAAO;IACL,SAAS;IACT,OAAO;IACP,cAAc;GACf;EACF;AAED,SAAO,KAAK,2BAA2B;AAEvC,SAAO;GACL,SAAS;GACT,gBAAgB,OAAO;EACxB;CACF,SAAQ,OAAO;AACd,SAAO,MAAM,gCAAgC,iBAAiB,QAAQ,eAAkB;AACxF,SAAO;GACL,SAAS;GACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU;GAChD,cAAc;EACf;CACF;AACF;;;;AAKD,SAAgB,uBAAuBC,UAA6B;AAClE,QAAO,SAAS,WAAW;AAC5B;;;;AAKD,SAAgB,0BAA0BA,UAAoBC,SAA2B;AACvF,QAAO,WAAW,uBAAuB,SAAS;AACnD"}

package/dist/{server-DeBlxoaW.js → server-C96NMFBy.js}

@@ -1,5 +1,5 @@
 import { isApiClientError } from "./types-BaaE6wjY.js";
-import { calculateBackoffDelay, fetchWithTimeout, isRetryableError } from "./api-client-CZapXIF8.js";
+import { calculateBackoffDelay, fetchWithTimeout, isRetryableError } from "./api-client-CgZUMukO.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 
 //#region src/api-client/api-config.server.ts
@@ -7,7 +7,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 * Base URL Configuration
 * Single unified base URL for all API operations
 */
-const DEFAULT_API_BASE_URL = process.env.API_BASE_URL || "https://localhost:5001";
+const DEFAULT_API_BASE_URL = process.env.API_BASE_URL || "";
 /**
 * Default Headers
 * Applied to all API requests
@@ -23,7 +23,7 @@ const DEFAULT_HEADERS = {
 * with the provided auth and tenant resolvers.
 */
 function createAPIConfigFactory(getAccessToken, getCurrentTenant, logger, factoryOptions = {}) {
-	const { baseURL = DEFAULT_API_BASE_URL, defaultHeaders = DEFAULT_HEADERS, userAgent = "MimirCore/1.0", timeout = 3e4 } = factoryOptions;
+	const { baseURL = DEFAULT_API_BASE_URL, defaultHeaders = DEFAULT_HEADERS, userAgent = "Spine/1.0", timeout = 3e4, authHeaderName = "Authorization", authHeaderValue = (token) => `Bearer ${token}`, tenantHeaderName = "X-Tenant-Id", buildHeaders } = factoryOptions;
 	/**
 	* Resolve tenant ID from request or options
 	*/
@@ -45,9 +45,9 @@ function createAPIConfigFactory(getAccessToken, getCurrentTenant, logger, factor
 	* Creates unified API configuration for all services.
 	*
 	* This function automatically:
-	* - Adds authentication token to Authorization header
-	* - Injects tenant context as X-Tenant-Id header
-	* - Configures base URL from environment
+	* - Adds authentication token using the configured auth header strategy
+	* - Injects tenant context using the configured tenant header strategy
+	* - Configures base URL from options or environment
 	* - Applies default headers
 	*
 	* @param request - The incoming request object
@@ -83,7 +83,7 @@ function createAPIConfigFactory(getAccessToken, getCurrentTenant, logger, factor
 				throw new Error("No access token available");
 			}
 			accessToken = token;
-			headers.Authorization = `Bearer ${token}`;
+			if (authHeaderName) headers[authHeaderName] = authHeaderValue(token);
 			logger?.debug?.("Added authorization header to API config");
 		}
 		const tenantId = await resolveTenantId(request, options);
@@ -92,9 +92,17 @@ function createAPIConfigFactory(getAccessToken, getCurrentTenant, logger, factor
 				logger?.error?.("Tenant context required but not available");
 				throw new Error("Tenant context is required for this operation");
 			}
-			headers["X-Tenant-Id"] = tenantId;
+			if (tenantHeaderName) headers[tenantHeaderName] = tenantId;
 			logger?.debug?.("Added tenant context header", { tenantId });
 		}
+		if (buildHeaders) Object.assign(headers, buildHeaders({
+			request,
+			options,
+			accessToken,
+			tenantId,
+			includeAuth,
+			requireTenant
+		}));
 		logger?.debug?.("API config created", {
 			basePath: baseURL,
 			hasAuth: includeAuth,
@@ -419,4 +427,4 @@ async function createApiClient(request, ClientClass, createAPIConfig, Configurat
 
 //#endregion
 export { createAPIConfigFactory, createApiClient, createFetchMiddleware };
-//# sourceMappingURL=server-DeBlxoaW.js.map
+//# sourceMappingURL=server-C96NMFBy.js.map

package/dist/server-C96NMFBy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-C96NMFBy.js","names":["DEFAULT_HEADERS: Record<string, string>","getAccessToken: GetAccessTokenFn","getCurrentTenant: GetCurrentTenantFn","logger?: APILogger","factoryOptions: APIConfigFactoryOptions","token: string","request: Request","options: CreateAPIConfigOptions","headers: Record<string, string>","accessToken: string | undefined","request: Request","sessionKey: string","refreshFn: () => Promise<TokenRefreshResult>","logger?: APILogger","init: SpineRequestInit","headersInit?: HeadersInit","init: RequestInit","timeout?: number","value: unknown","response: Response","params: {\n  message: string;\n  response?: APIResponse<T>;\n  config?: ResponseRequestMeta;\n  problemDetails?: ProblemDetails;\n  shouldLogout?: boolean;\n  originalError?: unknown;\n  cause?: unknown;\n}","rawResponse: Response","resolvedData?: T","error: unknown","context: FetchResponseContext","retryConfig: Required<Pick<RetryConfig, 'maxRetries' | 'baseDelay' | 'maxDelay'>>","context: FetchErrorContext","options: FetchSetupOptions","client: T","ClientClass: new (configuration?: unknown) => T","createAPIConfig: (request: Request, options?: CreateAPIConfigOptions) => Promise<APIConfig>","ConfigurationClass: new (params?: Record<string, unknown>) => unknown","options: CreateApiClientOptions"],"sources":["../src/api-client/api-config.server.ts","../src/api-client/fetch-client.server.ts"],"sourcesContent":["/**\n * API Configuration Server Module\n *\n * Centralized configuration for all API clients,\n * automatically handling authentication tokens and tenant context.\n */\n\nimport type { APIConfig, CreateAPIConfigOptions, GetAccessTokenFn, GetCurrentTenantFn, APILogger } from './types';\n\n/**\n * Base URL Configuration\n * Single unified base URL for all API operations\n */\nconst DEFAULT_API_BASE_URL = process.env.API_BASE_URL || '';\n\n/**\n * Default Headers\n * Applied to all API requests\n */\nconst DEFAULT_HEADERS: Record<string, string> = {\n  Accept: 'application/json, application/problem+json',\n  'Content-Type': 'application/json',\n};\n\n/**\n * API Config Factory Options\n */\nexport interface APIConfigFactoryOptions {\n  /**\n   * Base URL for API requests\n   */\n  baseURL?: string;\n  /**\n   * Default headers applied to all requests\n   */\n  defaultHeaders?: Record<string, string>;\n  /**\n   * User agent string\n   */\n  userAgent?: string;\n  /**\n   * Default timeout in milliseconds\n   */\n  timeout?: number;\n  /**\n   * Header name used for bearer-style auth. Set to null when buildHeaders owns auth.\n   * @default 'Authorization'\n   */\n  authHeaderName?: string | null;\n  /**\n   * Build an auth header value from the resolved access token.\n   * @default token => `Bearer ${token}`\n   */\n  authHeaderValue?: (accessToken: string) => string;\n  /**\n   * Header name used for tenant context. Set to null when buildHeaders owns tenancy.\n   * @default 'X-Tenant-Id'\n   */\n  tenantHeaderName?: string | null;\n  /**\n   * Final app-specific header hook. Returned headers are merged last.\n   */\n  buildHeaders?: (context: APIHeaderStrategyContext) => Record<string, string>;\n}\n\nexport interface APIHeaderStrategyContext {\n  request: Request;\n  options: CreateAPIConfigOptions;\n  accessToken?: string;\n  tenantId: string | null;\n  includeAuth: boolean;\n  requireTenant: boolean;\n}\n\n/**\n * Create API Config Factory\n *\n * Creates a factory function that generates API configurations\n * with the provided auth and tenant resolvers.\n */\nexport function createAPIConfigFactory(\n  getAccessToken: GetAccessTokenFn,\n  getCurrentTenant: GetCurrentTenantFn,\n  logger?: APILogger,\n  factoryOptions: APIConfigFactoryOptions = {}\n) {\n  const {\n    baseURL = DEFAULT_API_BASE_URL,\n    defaultHeaders = DEFAULT_HEADERS,\n    userAgent = 'Spine/1.0',\n    timeout = 30000,\n    authHeaderName = 'Authorization',\n    authHeaderValue = (token: string) => `Bearer ${token}`,\n    tenantHeaderName = 'X-Tenant-Id',\n    buildHeaders,\n  } = factoryOptions;\n\n  /**\n   * Resolve tenant ID from request or options\n   */\n  async function resolveTenantId(\n    request: Request,\n    options: CreateAPIConfigOptions\n  ): Promise<string | null> {\n    // Use explicit tenant ID if provided\n    if (options.tenantId) {\n      logger?.debug?.('Using explicit tenant ID', { tenantId: options.tenantId });\n      return options.tenantId;\n    }\n\n    // Resolve from current tenant context\n    try {\n      const tenantId = await getCurrentTenant(request);\n      if (tenantId) {\n        logger?.debug?.('Resolved tenant from context', { tenantId });\n      }\n      return tenantId;\n    } catch (error) {\n      logger?.warn?.('Failed to resolve current tenant', error instanceof Error ? error : undefined);\n      return null;\n    }\n  }\n\n  /**\n   * Creates unified API configuration for all services.\n   *\n   * This function automatically:\n   * - Adds authentication token using the configured auth header strategy\n   * - Injects tenant context using the configured tenant header strategy\n   * - Configures base URL from options or environment\n   * - Applies default headers\n   *\n   * @param request - The incoming request object\n   * @param options - Configuration options\n   * @returns API configuration object\n   * @throws Error if required authentication or tenant context is missing\n   *\n   * @example\n   * `\typescript\n   * // Standard usage with auth and tenant\n   * const config = await createAPIConfig(request);\n   * const api = new IdentityApi(config);\n   *\n   * // Without tenant requirement\n   * const config = await createAPIConfig(request, { requireTenant: false });\n   *\n   * // With explicit tenant override\n   * const config = await createAPIConfig(request, { tenantId: 'specific-tenant-id' });\n   * `\n   */\n  async function createAPIConfig(\n    request: Request,\n    options: CreateAPIConfigOptions = {}\n  ): Promise<APIConfig> {\n    const {\n      requireTenant = true,\n      includeAuth = true,\n      customHeaders = {},\n    } = options;\n\n    // Start with default headers\n    const headers: Record<string, string> = {\n      ...defaultHeaders,\n      'User-Agent': userAgent,\n      ...customHeaders,\n    };\n\n    let accessToken: string | undefined;\n\n    // Add authentication if required\n    if (includeAuth) {\n      const token = await getAccessToken(request);\n      if (!token) {\n        logger?.error?.('No access token available for API request');\n        throw new Error('No access token available');\n      }\n\n      accessToken = token;\n      if (authHeaderName) {\n        headers[authHeaderName] = authHeaderValue(token);\n      }\n      logger?.debug?.('Added authorization header to API config');\n    }\n\n    // Resolve tenant context\n    const tenantId = await resolveTenantId(request, options);\n\n    // Add tenant header if required\n    if (requireTenant) {\n      if (!tenantId) {\n        logger?.error?.('Tenant context required but not available');\n        throw new Error('Tenant context is required for this operation');\n      }\n\n      if (tenantHeaderName) {\n        headers[tenantHeaderName] = tenantId;\n      }\n      logger?.debug?.('Added tenant context header', { tenantId });\n    }\n\n    if (buildHeaders) {\n      Object.assign(headers, buildHeaders({\n        request,\n        options,\n        accessToken,\n        tenantId,\n        includeAuth,\n        requireTenant,\n      }));\n    }\n\n    logger?.debug?.('API config created', {\n      basePath: baseURL,\n      hasAuth: includeAuth,\n      hasTenant: !!tenantId,\n      requireTenant,\n    });\n\n    return {\n      basePath: baseURL,\n      accessToken,\n      headers,\n      tenantId: tenantId || '',\n      baseOptions: {\n        timeout,\n      },\n    };\n  }\n\n  /**\n   * Get the configured API base URL\n   */\n  function getAPIBaseURL(): string {\n    return baseURL;\n  }\n\n  return {\n    createAPIConfig,\n    getAPIBaseURL,\n  };\n}\n\nexport type APIConfigFactory = ReturnType<typeof createAPIConfigFactory>;\n","/**\n * Fetch-native API client setup for generated OpenAPI clients.\n *\n * This module preserves the shared request behaviors we need around fetch:\n * - request ID enrichment\n * - serialized token refresh on 401\n * - retry with exponential backoff\n * - ProblemDetails-aware error shaping\n *\n * It gives downstream apps a single fetch-native entry point for generated clients.\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport type {\n  APIClientError,\n  APIConfig,\n  APIResponse,\n  APILogger,\n  CreateAPIConfigOptions,\n  EnhancedAPIClient,\n  FetchErrorContext,\n  FetchMiddleware,\n  FetchResponseContext,\n  ProblemDetails,\n  RetryConfig,\n  TokenRefreshFn,\n  TokenRefreshResult,\n} from './types';\nimport { isApiClientError } from './types';\nimport { calculateBackoffDelay, fetchWithTimeout, isRetryableError } from './retry-handler';\n\ntype RuntimeApiResponse<T> = {\n  raw: Response;\n  value(): Promise<T>;\n};\n\ntype GeneratedFetchClient = object;\n\ntype SpineRequestInit = RequestInit & {\n  __spineMeta?: {\n    requestId?: string;\n    retryCount?: number;\n    refreshed?: boolean;\n  };\n};\n\ntype ResponseRequestMeta = {\n  url: string;\n  method: string;\n  headers: Record<string, string>;\n};\n\nconst refreshPromiseMap = new Map<string, Promise<TokenRefreshResult>>();\nconst responseRequestMeta = new WeakMap<Response, ResponseRequestMeta>();\nconst rawResponseStore = new AsyncLocalStorage<Map<string, RuntimeApiResponse<unknown>>>();\n\nfunction getSessionKeyFromRequest(request: Request): string {\n  const cookie = request.headers.get('cookie') || '';\n  return `session:${cookie.slice(0, 50)}`;\n}\n\nfunction getOrCreateRefreshPromise(\n  sessionKey: string,\n  refreshFn: () => Promise<TokenRefreshResult>,\n  logger?: APILogger\n): Promise<TokenRefreshResult> {\n  const existingPromise = refreshPromiseMap.get(sessionKey);\n  if (existingPromise) {\n    logger?.info?.('Token refresh already in progress, waiting for existing refresh');\n    return existingPromise;\n  }\n\n  logger?.info?.('Starting new token refresh');\n\n  const refreshPromise = refreshFn().finally(() => {\n    refreshPromiseMap.delete(sessionKey);\n  });\n\n  refreshPromiseMap.set(sessionKey, refreshPromise);\n  return refreshPromise;\n}\n\nfunction ensureRequestMeta(init: SpineRequestInit): NonNullable<SpineRequestInit['__spineMeta']> {\n  if (!init.__spineMeta) {\n    init.__spineMeta = {};\n  }\n\n  return init.__spineMeta;\n}\n\nfunction headersToRecord(headersInit?: HeadersInit): Record<string, string> {\n  return Object.fromEntries(new Headers(headersInit).entries());\n}\n\nfunction cloneInit(init: RequestInit): SpineRequestInit {\n  const source = init as SpineRequestInit;\n\n  return {\n    ...source,\n    headers: headersToRecord(source.headers),\n    __spineMeta: source.__spineMeta ? { ...source.__spineMeta } : undefined,\n  };\n}\n\nfunction createTimeoutFetch(timeout?: number): typeof fetch | undefined {\n  if (!timeout) {\n    return undefined;\n  }\n\n  return (input, init) => fetchWithTimeout(input, { ...init, timeout });\n}\n\nfunction isProblemDetails(value: unknown): value is ProblemDetails {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    'title' in value &&\n    'status' in value &&\n    'detail' in value\n  );\n}\n\nasync function parseResponseBody(response: Response): Promise<unknown> {\n  const clone = response.clone();\n  const contentType = clone.headers.get('content-type') || '';\n\n  if (contentType.includes('application/json') || contentType.includes('+json')) {\n    try {\n      return await clone.json();\n    } catch {\n      return undefined;\n    }\n  }\n\n  try {\n    const text = await clone.text();\n    return text || undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction createClientError<T = unknown>(params: {\n  message: string;\n  response?: APIResponse<T>;\n  config?: ResponseRequestMeta;\n  problemDetails?: ProblemDetails;\n  shouldLogout?: boolean;\n  originalError?: unknown;\n  cause?: unknown;\n}): APIClientError<T> {\n  const error = new Error(params.message) as APIClientError<T>;\n\n  error.name = 'APIClientError';\n  error.isApiClientError = true;\n  error.response = params.response;\n  error.config = params.config;\n  error.problemDetails = params.problemDetails;\n  error.shouldLogout = params.shouldLogout;\n  error.originalError = params.originalError;\n  error.cause = params.cause;\n\n  return error;\n}\n\nasync function toAPIResponse<T>(\n  rawResponse: Response,\n  resolvedData?: T\n): Promise<APIResponse<T>> {\n  const data = resolvedData === undefined ? ((await parseResponseBody(rawResponse)) as T) : resolvedData;\n\n  return {\n    data,\n    status: rawResponse.status,\n    statusText: rawResponse.statusText,\n    headers: headersToRecord(rawResponse.headers),\n    raw: rawResponse,\n  };\n}\n\nasync function normalizeClientError(error: unknown): Promise<APIClientError> {\n  if (isApiClientError(error)) {\n    return error;\n  }\n\n  if (error && typeof error === 'object' && 'response' in error && (error as { response?: unknown }).response instanceof Response) {\n    const response = (error as { response: Response }).response;\n    const responseData = await parseResponseBody(response);\n    const problemDetails = isProblemDetails(responseData) ? responseData : undefined;\n\n    return createClientError({\n      message:\n        problemDetails?.detail ||\n        problemDetails?.title ||\n        response.statusText ||\n        'API request failed',\n      response: await toAPIResponse(response, responseData),\n      config: responseRequestMeta.get(response),\n      problemDetails,\n      cause: error,\n    });\n  }\n\n  return createClientError({\n    message: error instanceof Error ? error.message : 'API request failed',\n    cause: error,\n  });\n}\n\nfunction isRetryableFetchError(error: unknown): boolean {\n  if (isRetryableError(error)) {\n    return true;\n  }\n\n  if (error && typeof error === 'object' && 'cause' in error) {\n    return isRetryableError((error as { cause?: unknown }).cause);\n  }\n\n  return false;\n}\n\nasync function maybeRetryResponse(\n  context: FetchResponseContext,\n  retryConfig: Required<Pick<RetryConfig, 'maxRetries' | 'baseDelay' | 'maxDelay'>>,\n  logger?: APILogger\n): Promise<Response | undefined> {\n  const init = cloneInit(context.init);\n  const meta = ensureRequestMeta(init);\n\n  if (context.response.status === 401 || context.response.status === 409) {\n    return undefined;\n  }\n\n  if (!isRetryableError(context.response)) {\n    return undefined;\n  }\n\n  const retryCount = meta.retryCount ?? 0;\n  if (retryCount >= retryConfig.maxRetries) {\n    return undefined;\n  }\n\n  meta.retryCount = retryCount + 1;\n\n  const delay = calculateBackoffDelay(meta.retryCount, retryConfig.baseDelay, retryConfig.maxDelay);\n  logger?.info?.('Retrying request', {\n    url: context.url,\n    method: (init.method ?? 'GET').toUpperCase(),\n    attempt: meta.retryCount,\n    maxRetries: retryConfig.maxRetries,\n    delay,\n    status: context.response.status,\n  });\n\n  await new Promise((resolve) => setTimeout(resolve, delay));\n\n  return context.fetch(context.url, init);\n}\n\nasync function maybeRetryError(\n  context: FetchErrorContext,\n  retryConfig: Required<Pick<RetryConfig, 'maxRetries' | 'baseDelay' | 'maxDelay'>>,\n  logger?: APILogger\n): Promise<Response | undefined> {\n  const init = cloneInit(context.init);\n  const meta = ensureRequestMeta(init);\n  const retryCount = meta.retryCount ?? 0;\n\n  if (!isRetryableFetchError(context.error) || retryCount >= retryConfig.maxRetries) {\n    return undefined;\n  }\n\n  meta.retryCount = retryCount + 1;\n\n  const delay = calculateBackoffDelay(meta.retryCount, retryConfig.baseDelay, retryConfig.maxDelay);\n  logger?.info?.('Retrying request after fetch failure', {\n    url: context.url,\n    method: (init.method ?? 'GET').toUpperCase(),\n    attempt: meta.retryCount,\n    maxRetries: retryConfig.maxRetries,\n    delay,\n  });\n\n  await new Promise((resolve) => setTimeout(resolve, delay));\n\n  return context.fetch(context.url, init);\n}\n\nexport interface FetchSetupOptions {\n  logger?: APILogger;\n  attemptTokenRefresh?: TokenRefreshFn;\n  retryConfig?: RetryConfig;\n  addRequestId?: boolean;\n}\n\nexport function createFetchMiddleware(\n  request: Request,\n  options: FetchSetupOptions = {}\n): FetchMiddleware[] {\n  const {\n    logger,\n    attemptTokenRefresh,\n    retryConfig = {},\n    addRequestId = true,\n  } = options;\n\n  const normalizedRetryConfig = {\n    maxRetries: retryConfig.maxRetries ?? 3,\n    baseDelay: retryConfig.baseDelay ?? 1000,\n    maxDelay: retryConfig.maxDelay ?? 10000,\n  };\n\n  return [\n    {\n      async pre(context) {\n        const init = cloneInit(context.init);\n        const meta = ensureRequestMeta(init);\n        const headers = new Headers(init.headers);\n\n        if (addRequestId) {\n          const requestId = headers.get('X-Request-Id') || crypto.randomUUID();\n          headers.set('X-Request-Id', requestId);\n          meta.requestId = requestId;\n        }\n\n        init.headers = headersToRecord(headers);\n\n        logger?.debug?.('API request initiated', {\n          method: (init.method ?? 'GET').toUpperCase(),\n          url: context.url,\n          requestId: meta.requestId,\n        });\n\n        return {\n          url: context.url,\n          init,\n        };\n      },\n\n      async post(context) {\n        const init = cloneInit(context.init);\n        const meta = ensureRequestMeta(init);\n\n        responseRequestMeta.set(context.response, {\n          url: context.url,\n          method: (init.method ?? 'GET').toUpperCase(),\n          headers: headersToRecord(init.headers),\n        });\n\n        if (context.response.status === 401 && attemptTokenRefresh && !meta.refreshed) {\n          meta.refreshed = true;\n\n          logger?.info?.('Received 401 from backend, attempting token refresh', {\n            url: context.url,\n            method: (init.method ?? 'GET').toUpperCase(),\n          });\n\n          const refreshResult = await getOrCreateRefreshPromise(\n            getSessionKeyFromRequest(request),\n            () => attemptTokenRefresh(request),\n            logger\n          );\n\n          if (refreshResult.success && refreshResult.newAccessToken) {\n            const headers = new Headers(init.headers);\n            headers.set('Authorization', `Bearer ${refreshResult.newAccessToken}`);\n            init.headers = headersToRecord(headers);\n\n            logger?.info?.('Token refresh successful, retrying original request');\n\n            return context.fetch(context.url, init);\n          }\n\n          if (refreshResult.shouldLogout) {\n            throw createClientError({\n              message: 'REFRESH_TOKEN_EXPIRED',\n              response: await toAPIResponse(context.response),\n              config: responseRequestMeta.get(context.response),\n              shouldLogout: true,\n              originalError: refreshResult,\n              cause: refreshResult,\n            });\n          }\n        }\n\n        const retryResponse = await maybeRetryResponse(context, normalizedRetryConfig, logger);\n        if (retryResponse) {\n          return retryResponse;\n        }\n\n        if (context.response.status >= 400) {\n          const responseData = await parseResponseBody(context.response);\n          const problemDetails = isProblemDetails(responseData) ? responseData : undefined;\n\n          logger?.error?.('API error response received', undefined, {\n            url: context.url,\n            method: (init.method ?? 'GET').toUpperCase(),\n            status: context.response.status,\n            code: problemDetails?.title,\n            detail: problemDetails?.detail,\n            traceId: problemDetails?.traceId,\n          });\n        }\n\n        return context.response;\n      },\n\n      async onError(context) {\n        const retryResponse = await maybeRetryError(context, normalizedRetryConfig, logger);\n        if (retryResponse) {\n          return retryResponse;\n        }\n\n        return undefined;\n      },\n    },\n  ];\n}\n\nexport interface CreateApiClientOptions extends FetchSetupOptions, CreateAPIConfigOptions {\n  credentials?: RequestCredentials;\n}\n\nfunction instrumentRawMethods<T extends GeneratedFetchClient>(client: T): void {\n  if ((client as { __spineRawMethodsInstrumented?: boolean }).__spineRawMethodsInstrumented) {\n    return;\n  }\n\n  const prototype = Object.getPrototypeOf(client) as Record<string, unknown>;\n\n  for (const key of Object.getOwnPropertyNames(prototype)) {\n    if (!key.endsWith('Raw')) {\n      continue;\n    }\n\n    const original = prototype[key];\n    if (typeof original !== 'function') {\n      continue;\n    }\n\n    Object.defineProperty(client, key, {\n      configurable: true,\n      enumerable: false,\n      writable: true,\n      value: async (...args: unknown[]) => {\n        const result = await (original as (...innerArgs: unknown[]) => Promise<RuntimeApiResponse<unknown>>).apply(client, args);\n        rawResponseStore.getStore()?.set(key, result);\n        return result;\n      },\n    });\n  }\n\n  (client as { __spineRawMethodsInstrumented?: boolean }).__spineRawMethodsInstrumented = true;\n}\n\nfunction wrapClient<T extends GeneratedFetchClient>(client: T): EnhancedAPIClient<T> {\n  instrumentRawMethods(client);\n\n  const methodCache = new Map<PropertyKey, unknown>();\n\n  return new Proxy(client, {\n    get(target, prop, receiver) {\n      const value = Reflect.get(target, prop, receiver);\n\n      if (typeof prop !== 'string' || typeof value !== 'function' || prop.endsWith('Raw')) {\n        return typeof value === 'function' ? value.bind(target) : value;\n      }\n\n      if (methodCache.has(prop)) {\n        return methodCache.get(prop);\n      }\n\n      const wrapped = async (...args: unknown[]) =>\n        rawResponseStore.run(new Map(), async () => {\n          try {\n            const resolvedData = await (value as (...innerArgs: unknown[]) => Promise<unknown>).apply(target, args);\n            const rawResponse = rawResponseStore.getStore()?.get(`${prop}Raw`);\n\n            if (rawResponse) {\n              return toAPIResponse(rawResponse.raw, resolvedData);\n            }\n\n            return {\n              data: resolvedData,\n              status: 200,\n              statusText: 'OK',\n              headers: {},\n            };\n          } catch (error) {\n            throw await normalizeClientError(error);\n          }\n        });\n\n      methodCache.set(prop, wrapped);\n      return wrapped;\n    },\n  }) as EnhancedAPIClient<T>;\n}\n\nexport async function createApiClient<T extends GeneratedFetchClient>(\n  request: Request,\n  ClientClass: new (configuration?: unknown) => T,\n  createAPIConfig: (request: Request, options?: CreateAPIConfigOptions) => Promise<APIConfig>,\n  ConfigurationClass: new (params?: Record<string, unknown>) => unknown,\n  options: CreateApiClientOptions = {}\n): Promise<{ client: EnhancedAPIClient<T>; tenantId: string }> {\n  const {\n    requireTenant,\n    includeAuth,\n    tenantId,\n    customHeaders,\n    credentials,\n    ...fetchOptions\n  } = options;\n\n  const config = await createAPIConfig(request, {\n    requireTenant,\n    includeAuth,\n    tenantId,\n    customHeaders,\n  });\n\n  const configuration = new ConfigurationClass({\n    basePath: config.basePath,\n    accessToken: config.accessToken,\n    headers: config.headers,\n    credentials: credentials ?? config.credentials,\n    middleware: createFetchMiddleware(request, fetchOptions),\n    fetchApi: createTimeoutFetch(config.baseOptions?.timeout),\n  });\n\n  const client = new ClientClass(configuration);\n\n  return {\n    client: wrapClient(client),\n    tenantId: config.tenantId,\n  };\n}\n"],"mappings":";;;;;;;;;AAaA,MAAM,uBAAuB,QAAQ,IAAI,gBAAgB;;;;;AAMzD,MAAMA,kBAA0C;CAC9C,QAAQ;CACR,gBAAgB;AACjB;;;;;;;AA0DD,SAAgB,uBACdC,gBACAC,kBACAC,QACAC,iBAA0C,CAAE,GAC5C;CACA,MAAM,EACJ,UAAU,sBACV,iBAAiB,iBACjB,YAAY,aACZ,UAAU,KACV,iBAAiB,iBACjB,kBAAkB,CAACC,WAAmB,SAAS,MAAM,GACrD,mBAAmB,eACnB,cACD,GAAG;;;;CAKJ,eAAe,gBACbC,SACAC,SACwB;AAExB,MAAI,QAAQ,UAAU;AACpB,WAAQ,QAAQ,4BAA4B,EAAE,UAAU,QAAQ,SAAU,EAAC;AAC3E,UAAO,QAAQ;EAChB;AAGD,MAAI;GACF,MAAM,WAAW,MAAM,iBAAiB,QAAQ;AAChD,OAAI,SACF,SAAQ,QAAQ,gCAAgC,EAAE,SAAU,EAAC;AAE/D,UAAO;EACR,SAAQ,OAAO;AACd,WAAQ,OAAO,oCAAoC,iBAAiB,QAAQ,eAAkB;AAC9F,UAAO;EACR;CACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BD,eAAe,gBACbD,SACAC,UAAkC,CAAE,GAChB;EACpB,MAAM,EACJ,gBAAgB,MAChB,cAAc,MACd,gBAAgB,CAAE,GACnB,GAAG;EAGJ,MAAMC,UAAkC;GACtC,GAAG;GACH,cAAc;GACd,GAAG;EACJ;EAED,IAAIC;AAGJ,MAAI,aAAa;GACf,MAAM,QAAQ,MAAM,eAAe,QAAQ;AAC3C,QAAK,OAAO;AACV,YAAQ,QAAQ,4CAA4C;AAC5D,UAAM,IAAI,MAAM;GACjB;AAED,iBAAc;AACd,OAAI,eACF,SAAQ,kBAAkB,gBAAgB,MAAM;AAElD,WAAQ,QAAQ,2CAA2C;EAC5D;EAGD,MAAM,WAAW,MAAM,gBAAgB,SAAS,QAAQ;AAGxD,MAAI,eAAe;AACjB,QAAK,UAAU;AACb,YAAQ,QAAQ,4CAA4C;AAC5D,UAAM,IAAI,MAAM;GACjB;AAED,OAAI,iBACF,SAAQ,oBAAoB;AAE9B,WAAQ,QAAQ,+BAA+B,EAAE,SAAU,EAAC;EAC7D;AAED,MAAI,aACF,QAAO,OAAO,SAAS,aAAa;GAClC;GACA;GACA;GACA;GACA;GACA;EACD,EAAC,CAAC;AAGL,UAAQ,QAAQ,sBAAsB;GACpC,UAAU;GACV,SAAS;GACT,aAAa;GACb;EACD,EAAC;AAEF,SAAO;GACL,UAAU;GACV;GACA;GACA,UAAU,YAAY;GACtB,aAAa,EACX,QACD;EACF;CACF;;;;CAKD,SAAS,gBAAwB;AAC/B,SAAO;CACR;AAED,QAAO;EACL;EACA;CACD;AACF;;;;AC5LD,MAAM,oBAAoB,IAAI;AAC9B,MAAM,sBAAsB,IAAI;AAChC,MAAM,mBAAmB,IAAI;AAE7B,SAAS,yBAAyBC,SAA0B;CAC1D,MAAM,SAAS,QAAQ,QAAQ,IAAI,SAAS,IAAI;AAChD,SAAQ,UAAU,OAAO,MAAM,GAAG,GAAG,CAAC;AACvC;AAED,SAAS,0BACPC,YACAC,WACAC,QAC6B;CAC7B,MAAM,kBAAkB,kBAAkB,IAAI,WAAW;AACzD,KAAI,iBAAiB;AACnB,UAAQ,OAAO,kEAAkE;AACjF,SAAO;CACR;AAED,SAAQ,OAAO,6BAA6B;CAE5C,MAAM,iBAAiB,WAAW,CAAC,QAAQ,MAAM;AAC/C,oBAAkB,OAAO,WAAW;CACrC,EAAC;AAEF,mBAAkB,IAAI,YAAY,eAAe;AACjD,QAAO;AACR;AAED,SAAS,kBAAkBC,MAAsE;AAC/F,MAAK,KAAK,YACR,MAAK,cAAc,CAAE;AAGvB,QAAO,KAAK;AACb;AAED,SAAS,gBAAgBC,aAAmD;AAC1E,QAAO,OAAO,YAAY,IAAI,QAAQ,aAAa,SAAS,CAAC;AAC9D;AAED,SAAS,UAAUC,MAAqC;CACtD,MAAM,SAAS;AAEf,QAAO;EACL,GAAG;EACH,SAAS,gBAAgB,OAAO,QAAQ;EACxC,aAAa,OAAO,cAAc,EAAE,GAAG,OAAO,YAAa;CAC5D;AACF;AAED,SAAS,mBAAmBC,SAA4C;AACtE,MAAK,QACH;AAGF,QAAO,CAAC,OAAO,SAAS,iBAAiB,OAAO;EAAE,GAAG;EAAM;CAAS,EAAC;AACtE;AAED,SAAS,iBAAiBC,OAAyC;AACjE,eACS,UAAU,YACjB,UAAU,QACV,WAAW,SACX,YAAY,SACZ,YAAY;AAEf;AAED,eAAe,kBAAkBC,UAAsC;CACrE,MAAM,QAAQ,SAAS,OAAO;CAC9B,MAAM,cAAc,MAAM,QAAQ,IAAI,eAAe,IAAI;AAEzD,KAAI,YAAY,SAAS,mBAAmB,IAAI,YAAY,SAAS,QAAQ,CAC3E,KAAI;AACF,SAAO,MAAM,MAAM,MAAM;CAC1B,QAAO;AACN;CACD;AAGH,KAAI;EACF,MAAM,OAAO,MAAM,MAAM,MAAM;AAC/B,SAAO;CACR,QAAO;AACN;CACD;AACF;AAED,SAAS,kBAA+BC,QAQlB;CACpB,MAAM,QAAQ,IAAI,MAAM,OAAO;AAE/B,OAAM,OAAO;AACb,OAAM,mBAAmB;AACzB,OAAM,WAAW,OAAO;AACxB,OAAM,SAAS,OAAO;AACtB,OAAM,iBAAiB,OAAO;AAC9B,OAAM,eAAe,OAAO;AAC5B,OAAM,gBAAgB,OAAO;AAC7B,OAAM,QAAQ,OAAO;AAErB,QAAO;AACR;AAED,eAAe,cACbC,aACAC,cACyB;CACzB,MAAM,OAAO,0BAA+B,MAAM,kBAAkB,YAAY,GAAU;AAE1F,QAAO;EACL;EACA,QAAQ,YAAY;EACpB,YAAY,YAAY;EACxB,SAAS,gBAAgB,YAAY,QAAQ;EAC7C,KAAK;CACN;AACF;AAED,eAAe,qBAAqBC,OAAyC;AAC3E,KAAI,iBAAiB,MAAM,CACzB,QAAO;AAGT,KAAI,gBAAgB,UAAU,YAAY,cAAc,SAAU,MAAiC,oBAAoB,UAAU;EAC/H,MAAM,WAAY,MAAiC;EACnD,MAAM,eAAe,MAAM,kBAAkB,SAAS;EACtD,MAAM,iBAAiB,iBAAiB,aAAa,GAAG;AAExD,SAAO,kBAAkB;GACvB,SACE,gBAAgB,UAChB,gBAAgB,SAChB,SAAS,cACT;GACF,UAAU,MAAM,cAAc,UAAU,aAAa;GACrD,QAAQ,oBAAoB,IAAI,SAAS;GACzC;GACA,OAAO;EACR,EAAC;CACH;AAED,QAAO,kBAAkB;EACvB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;EAClD,OAAO;CACR,EAAC;AACH;AAED,SAAS,sBAAsBA,OAAyB;AACtD,KAAI,iBAAiB,MAAM,CACzB,QAAO;AAGT,KAAI,gBAAgB,UAAU,YAAY,WAAW,MACnD,QAAO,iBAAkB,MAA8B,MAAM;AAG/D,QAAO;AACR;AAED,eAAe,mBACbC,SACAC,aACAZ,QAC+B;CAC/B,MAAM,OAAO,UAAU,QAAQ,KAAK;CACpC,MAAM,OAAO,kBAAkB,KAAK;AAEpC,KAAI,QAAQ,SAAS,WAAW,OAAO,QAAQ,SAAS,WAAW,IACjE;AAGF,MAAK,iBAAiB,QAAQ,SAAS,CACrC;CAGF,MAAM,aAAa,KAAK,cAAc;AACtC,KAAI,cAAc,YAAY,WAC5B;AAGF,MAAK,aAAa,aAAa;CAE/B,MAAM,QAAQ,sBAAsB,KAAK,YAAY,YAAY,WAAW,YAAY,SAAS;AACjG,SAAQ,OAAO,oBAAoB;EACjC,KAAK,QAAQ;EACb,QAAQ,CAAC,KAAK,UAAU,OAAO,aAAa;EAC5C,SAAS,KAAK;EACd,YAAY,YAAY;EACxB;EACA,QAAQ,QAAQ,SAAS;CAC1B,EAAC;AAEF,OAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,MAAM;AAEzD,QAAO,QAAQ,MAAM,QAAQ,KAAK,KAAK;AACxC;AAED,eAAe,gBACba,SACAD,aACAZ,QAC+B;CAC/B,MAAM,OAAO,UAAU,QAAQ,KAAK;CACpC,MAAM,OAAO,kBAAkB,KAAK;CACpC,MAAM,aAAa,KAAK,cAAc;AAEtC,MAAK,sBAAsB,QAAQ,MAAM,IAAI,cAAc,YAAY,WACrE;AAGF,MAAK,aAAa,aAAa;CAE/B,MAAM,QAAQ,sBAAsB,KAAK,YAAY,YAAY,WAAW,YAAY,SAAS;AACjG,SAAQ,OAAO,wCAAwC;EACrD,KAAK,QAAQ;EACb,QAAQ,CAAC,KAAK,UAAU,OAAO,aAAa;EAC5C,SAAS,KAAK;EACd,YAAY,YAAY;EACxB;CACD,EAAC;AAEF,OAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,MAAM;AAEzD,QAAO,QAAQ,MAAM,QAAQ,KAAK,KAAK;AACxC;AASD,SAAgB,sBACdH,SACAiB,UAA6B,CAAE,GACZ;CACnB,MAAM,EACJ,QACA,qBACA,cAAc,CAAE,GAChB,eAAe,MAChB,GAAG;CAEJ,MAAM,wBAAwB;EAC5B,YAAY,YAAY,cAAc;EACtC,WAAW,YAAY,aAAa;EACpC,UAAU,YAAY,YAAY;CACnC;AAED,QAAO,CACL;EACE,MAAM,IAAI,SAAS;GACjB,MAAM,OAAO,UAAU,QAAQ,KAAK;GACpC,MAAM,OAAO,kBAAkB,KAAK;GACpC,MAAM,UAAU,IAAI,QAAQ,KAAK;AAEjC,OAAI,cAAc;IAChB,MAAM,YAAY,QAAQ,IAAI,eAAe,IAAI,OAAO,YAAY;AACpE,YAAQ,IAAI,gBAAgB,UAAU;AACtC,SAAK,YAAY;GAClB;AAED,QAAK,UAAU,gBAAgB,QAAQ;AAEvC,WAAQ,QAAQ,yBAAyB;IACvC,QAAQ,CAAC,KAAK,UAAU,OAAO,aAAa;IAC5C,KAAK,QAAQ;IACb,WAAW,KAAK;GACjB,EAAC;AAEF,UAAO;IACL,KAAK,QAAQ;IACb;GACD;EACF;EAED,MAAM,KAAK,SAAS;GAClB,MAAM,OAAO,UAAU,QAAQ,KAAK;GACpC,MAAM,OAAO,kBAAkB,KAAK;AAEpC,uBAAoB,IAAI,QAAQ,UAAU;IACxC,KAAK,QAAQ;IACb,QAAQ,CAAC,KAAK,UAAU,OAAO,aAAa;IAC5C,SAAS,gBAAgB,KAAK,QAAQ;GACvC,EAAC;AAEF,OAAI,QAAQ,SAAS,WAAW,OAAO,wBAAwB,KAAK,WAAW;AAC7E,SAAK,YAAY;AAEjB,YAAQ,OAAO,uDAAuD;KACpE,KAAK,QAAQ;KACb,QAAQ,CAAC,KAAK,UAAU,OAAO,aAAa;IAC7C,EAAC;IAEF,MAAM,gBAAgB,MAAM,0BAC1B,yBAAyB,QAAQ,EACjC,MAAM,oBAAoB,QAAQ,EAClC,OACD;AAED,QAAI,cAAc,WAAW,cAAc,gBAAgB;KACzD,MAAM,UAAU,IAAI,QAAQ,KAAK;AACjC,aAAQ,IAAI,kBAAkB,SAAS,cAAc,eAAe,EAAE;AACtE,UAAK,UAAU,gBAAgB,QAAQ;AAEvC,aAAQ,OAAO,sDAAsD;AAErE,YAAO,QAAQ,MAAM,QAAQ,KAAK,KAAK;IACxC;AAED,QAAI,cAAc,aAChB,OAAM,kBAAkB;KACtB,SAAS;KACT,UAAU,MAAM,cAAc,QAAQ,SAAS;KAC/C,QAAQ,oBAAoB,IAAI,QAAQ,SAAS;KACjD,cAAc;KACd,eAAe;KACf,OAAO;IACR,EAAC;GAEL;GAED,MAAM,gBAAgB,MAAM,mBAAmB,SAAS,uBAAuB,OAAO;AACtF,OAAI,cACF,QAAO;AAGT,OAAI,QAAQ,SAAS,UAAU,KAAK;IAClC,MAAM,eAAe,MAAM,kBAAkB,QAAQ,SAAS;IAC9D,MAAM,iBAAiB,iBAAiB,aAAa,GAAG;AAExD,YAAQ,QAAQ,uCAA0C;KACxD,KAAK,QAAQ;KACb,QAAQ,CAAC,KAAK,UAAU,OAAO,aAAa;KAC5C,QAAQ,QAAQ,SAAS;KACzB,MAAM,gBAAgB;KACtB,QAAQ,gBAAgB;KACxB,SAAS,gBAAgB;IAC1B,EAAC;GACH;AAED,UAAO,QAAQ;EAChB;EAED,MAAM,QAAQ,SAAS;GACrB,MAAM,gBAAgB,MAAM,gBAAgB,SAAS,uBAAuB,OAAO;AACnF,OAAI,cACF,QAAO;AAGT;EACD;CACF,CACF;AACF;AAMD,SAAS,qBAAqDC,QAAiB;AAC7E,KAAK,OAAuD,8BAC1D;CAGF,MAAM,YAAY,OAAO,eAAe,OAAO;AAE/C,MAAK,MAAM,OAAO,OAAO,oBAAoB,UAAU,EAAE;AACvD,OAAK,IAAI,SAAS,MAAM,CACtB;EAGF,MAAM,WAAW,UAAU;AAC3B,aAAW,aAAa,WACtB;AAGF,SAAO,eAAe,QAAQ,KAAK;GACjC,cAAc;GACd,YAAY;GACZ,UAAU;GACV,OAAO,OAAO,GAAG,SAAoB;IACnC,MAAM,SAAS,MAAM,AAAC,SAA+E,MAAM,QAAQ,KAAK;AACxH,qBAAiB,UAAU,EAAE,IAAI,KAAK,OAAO;AAC7C,WAAO;GACR;EACF,EAAC;CACH;AAED,CAAC,OAAuD,gCAAgC;AACzF;AAED,SAAS,WAA2CA,QAAiC;AACnF,sBAAqB,OAAO;CAE5B,MAAM,cAAc,IAAI;AAExB,QAAO,IAAI,MAAM,QAAQ,EACvB,IAAI,QAAQ,MAAM,UAAU;EAC1B,MAAM,QAAQ,QAAQ,IAAI,QAAQ,MAAM,SAAS;AAEjD,aAAW,SAAS,mBAAmB,UAAU,cAAc,KAAK,SAAS,MAAM,CACjF,eAAc,UAAU,aAAa,MAAM,KAAK,OAAO,GAAG;AAG5D,MAAI,YAAY,IAAI,KAAK,CACvB,QAAO,YAAY,IAAI,KAAK;EAG9B,MAAM,UAAU,OAAO,GAAG,SACxB,iBAAiB,IAAI,IAAI,OAAO,YAAY;AAC1C,OAAI;IACF,MAAM,eAAe,MAAM,AAAC,MAAwD,MAAM,QAAQ,KAAK;IACvG,MAAM,cAAc,iBAAiB,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK;AAElE,QAAI,YACF,QAAO,cAAc,YAAY,KAAK,aAAa;AAGrD,WAAO;KACL,MAAM;KACN,QAAQ;KACR,YAAY;KACZ,SAAS,CAAE;IACZ;GACF,SAAQ,OAAO;AACd,UAAM,MAAM,qBAAqB,MAAM;GACxC;EACF,EAAC;AAEJ,cAAY,IAAI,MAAM,QAAQ;AAC9B,SAAO;CACR,EACF;AACF;AAED,eAAsB,gBACpBlB,SACAmB,aACAC,iBACAC,oBACAC,UAAkC,CAAE,GACyB;CAC7D,MAAM,EACJ,eACA,aACA,UACA,eACA,YACA,GAAG,cACJ,GAAG;CAEJ,MAAM,SAAS,MAAM,gBAAgB,SAAS;EAC5C;EACA;EACA;EACA;CACD,EAAC;CAEF,MAAM,gBAAgB,IAAI,mBAAmB;EAC3C,UAAU,OAAO;EACjB,aAAa,OAAO;EACpB,SAAS,OAAO;EAChB,aAAa,eAAe,OAAO;EACnC,YAAY,sBAAsB,SAAS,aAAa;EACxD,UAAU,mBAAmB,OAAO,aAAa,QAAQ;CAC1D;CAED,MAAM,SAAS,IAAI,YAAY;AAE/B,QAAO;EACL,QAAQ,WAAW,OAAO;EAC1B,UAAU,OAAO;CAClB;AACF"}