@eminuckan/spine 0.3.0 → 0.3.2

package/CHANGELOG.md

@@ -6,6 +6,18 @@ All notable changes to this project will be documented in this file.
 
 No unreleased changes.
 
+## [0.3.2] - 2026-07-11
+
+### Fixed
+
+- Use the configured public OIDC redirect URI during authorization-code exchange so callbacks remain valid behind TLS-terminating reverse proxies.
+
+## [0.3.1] - 2026-06-01
+
+### Changed
+
+- Clarified README positioning, backend contract guidance, and quick-start snippets for the open source package.
+
 ## [0.3.0] - 2026-06-01
 
 ### Added

package/README.md

@@ -4,17 +4,20 @@
 [![npm version](https://img.shields.io/npm/v/%40eminuckan%2Fspine.svg)](https://www.npmjs.com/package/@eminuckan/spine)
 [![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
-Framework-agnostic SaaS primitives for authentication, identity, permissions, multi-tenancy, API access, realtime events, query configuration, and logging.
+Framework-agnostic TypeScript primitives for authentication, identity, permissions, multi-tenancy, API access, realtime events, query configuration, and logging in SaaS frontends.
 
-Spine is designed around one idea: the reusable parts of a SaaS platform should live in a single package, while application policy and framework quirks should stay in thin adapters. Today the package ships a framework-agnostic core plus a React Router adapter surface. Future adapters can follow the same pattern.
+Spine is designed around one idea: the reusable infrastructure in a SaaS frontend should live in a shared package, while product policy, backend DTOs, generated clients, and framework glue should stay in thin adapters owned by the consuming app.
+
+The package is currently on a `0.x` release line. It is usable, tested, and published, but some compatibility aliases remain while the public API moves toward a cleaner `1.0` shape.
 
 ## Status
 
 - Core package: `@eminuckan/spine`
 - Current adapter: `@eminuckan/spine/react-router`
-- Server primitives use Web `Request`/`Response` objects, not framework-specific response helpers
-- React Router adapter is intentionally thin today so other adapters can be added without changing the core contract
-- Extracted from repeated production-facing SaaS frontend infrastructure needs, then rebooted as an independent OSS package
+- Server-facing APIs accept Web `Request`/`Response` objects instead of framework-specific response helpers
+- React Router adapter is intentionally thin so future adapters can follow the same core contract
+- Built-in auth uses OpenID Connect and Redis-backed session/OAuth state storage
+- Extracted from repeated production-facing SaaS frontend infrastructure needs and maintained as independent OSS
 
 ## Why Spine
 
@@ -25,6 +28,7 @@ Spine aims to be:
 - Framework-agnostic at its core
 - Adapter-friendly for framework integration
 - Config-driven for backend conventions
+- Explicit about backend contracts instead of forcing one API shape
 - Honest about boundaries between reusable primitives and app-specific policy
 - Small enough to understand, flexible enough to extend
 
@@ -32,7 +36,7 @@ Spine aims to be:
 
 - Core before adapter: framework-specific behavior belongs in dedicated adapter entry points
 - Configure, do not fork: backend claim names, cookie behavior, endpoints, and redirects should be configured first
-- Request/Response first: server modules should work anywhere a standard Web `Request` and `Response` exist
+- Request/Response first: server-facing APIs should use standard Web `Request` and `Response` objects
 - App policy stays local: setup flows, entitlement gates, product-specific redirects, and permission taxonomies should live in the consuming app
 - Open for composition: apps should be able to wrap Spine primitives instead of rewriting them
 
@@ -41,7 +45,7 @@ Spine aims to be:
 | Entry point | Purpose |
 | --- | --- |
 | `@eminuckan/spine` | Client-side primitives and shared types |
-| `@eminuckan/spine/server` | Framework-agnostic server primitives |
+| `@eminuckan/spine/server` | Framework-agnostic server primitives and shared exports |
 | `@eminuckan/spine/react-router` | React Router client adapter |
 | `@eminuckan/spine/react-router/server` | React Router server adapter |
 | `@eminuckan/spine/auth` | Auth types |
@@ -81,6 +85,20 @@ Spine aims to be:
 
 Those belong in the consuming app or in a product-specific adapter package.
 
+## Backend Contract Model
+
+Spine does not require your backend to expose a fixed set of endpoints. It provides defaults for simple apps, but real SaaS apps often have different vocabulary:
+
+- tenant, workspace, account, company, project, or organization
+- permissions, capabilities, scopes, roles, or policy grants
+- bearer headers, custom session headers, cookie-backed APIs, or generated clients
+
+The intended integration style is:
+
+1. Configure claim names, cookie names, route policy, and API headers.
+2. Provide fetchers when your identity, permission, or tenant response shape differs.
+3. Keep product setup, billing, entitlement, and permission vocabulary in your app.
+
 ## Architecture
 
 ```mermaid
@@ -139,7 +157,7 @@ The built-in auth/session layer currently reads these environment variables:
 | `OIDC_CLIENT_AUTH_METHOD` | No | `none`, `client_secret_post`, or `client_secret_basic` |
 | `OIDC_SCOPE` | No | Requested scope string. Defaults to `openid profile email api` |
 | `OIDC_POST_LOGOUT_REDIRECT_URI` | No | Logout return URL |
-| `OIDC_APPLICATION_TYPE` | No | `no-landing-page`, `landing-page`, or legacy aliases |
+| `OIDC_APPLICATION_TYPE` | No | `no-landing-page`, `landing-page`, or deprecated aliases `dashboard` and `tenant-app` |
 | `OIDC_HAS_LANDING_PAGE` | No | Explicit landing-page behavior override |
 | `OIDC_ALLOW_INSECURE_REQUESTS` | No | Allows non-HTTPS OIDC issuer calls only outside production |
 | `REDIS_URL` | No | Redis connection string for sessions and OAuth state |
@@ -185,9 +203,40 @@ Back-channel logout verifies the signed `logout_token` against the provider JWKS
 
 ## Quick Start
 
-### 1. Configure Identity and Tenant Adapters
+The snippets below show the integration shape. See [examples/react-router-saas](examples/react-router-saas) for a runnable React Router app.
+
+### 1. Add Auth Routes
+
+```ts
+// app/routes/auth.login.tsx
+import { login } from '@eminuckan/spine/react-router/server';
+
+export async function loader({ request }: { request: Request }) {
+  throw await login(request, { returnUrl: '/dashboard' });
+}
+```
+
+```ts
+// app/routes/auth.callback.tsx
+import { handleCallback } from '@eminuckan/spine/react-router/server';
+
+export async function loader({ request }: { request: Request }) {
+  return handleCallback(request);
+}
+```
+
+```ts
+// app/routes/auth.logout.tsx
+import { logout } from '@eminuckan/spine/react-router/server';
+
+export async function loader({ request }: { request: Request }) {
+  return logout(request);
+}
+```
+
+### 2. Configure Server Adapters
 
-Spine's server modules are generic, so your app should provide backend-specific fetchers once.
+Spine's server modules are generic. Your app should provide backend-specific identity and tenant fetchers once.
 
 ```ts
 // app/lib/spine/identity.server.ts
@@ -197,20 +246,19 @@ import {
   contextToUserInfo,
   getIdentityContext,
 } from '@eminuckan/spine/identity/server';
-import { createAPIConfigFactory } from '@eminuckan/spine/api-client/server';
 import { getAccessToken } from '@eminuckan/spine/react-router/server';
-import { getCurrentTenant } from '@eminuckan/spine/tenant/server';
 
-const { createAPIConfig } = createAPIConfigFactory(getAccessToken, getCurrentTenant);
+const apiBaseUrl = process.env.API_BASE_URL;
+
+if (!apiBaseUrl) {
+  throw new Error('API_BASE_URL is required by this app adapter.');
+}
 
 configureIdentityAPIFetcher(async (request) => {
-  const config = await createAPIConfig(request, {
-    requireTenant: false,
-    includeAuth: true,
-  });
+  const accessToken = await getAccessToken(request);
 
-  const response = await fetch(`${config.basePath}/api/me/context`, {
-    headers: config.headers,
+  const response = await fetch(`${apiBaseUrl}/api/me/context`, {
+    headers: accessToken ? { Authorization: `Bearer ${accessToken}` } : undefined,
   });
 
   if (!response.ok) {
@@ -221,9 +269,12 @@ configureIdentityAPIFetcher(async (request) => {
 });
 
 configurePermissionFetcher(async (request, tenantId) => {
-  const config = await createAPIConfig(request, { requireTenant: false });
-  const response = await fetch(`${config.basePath}/api/me/permissions?tenantId=${tenantId}`, {
-    headers: config.headers,
+  const accessToken = await getAccessToken(request);
+  const url = new URL('/api/me/permissions', apiBaseUrl);
+  url.searchParams.set('tenantId', tenantId);
+
+  const response = await fetch(url, {
+    headers: accessToken ? { Authorization: `Bearer ${accessToken}` } : undefined,
   });
 
   if (!response.ok) {
@@ -231,7 +282,7 @@ configurePermissionFetcher(async (request, tenantId) => {
   }
 
   const payload = await response.json();
-  return payload.permissions || [];
+  return Array.isArray(payload.permissions) ? payload.permissions : [];
 });
 
 export { contextToUserInfo, getIdentityContext };
@@ -242,105 +293,58 @@ export { contextToUserInfo, getIdentityContext };
 import {
   configureTenantResolution,
   configureTenantCookie,
-  getAvailableTenants,
-  getCurrentTenant,
+  getActiveTenant,
   initializeTenant,
 } from '@eminuckan/spine/tenant/server';
-import { fetchIdentityContext } from './identity.server';
+import { getUser } from '@eminuckan/spine/react-router/server';
+import { getIdentityContext } from './identity.server';
 
 configureTenantCookie({
+  name: '__spine_tenant',
   httpOnly: false,
   sameSite: 'Lax',
 });
 
 configureTenantResolution({
-  identityContextFetcher: fetchIdentityContext,
-});
-
-export {
-  getAvailableTenants,
-  getCurrentTenant,
-  initializeTenant,
-};
-```
-
-### 2. Configure Server-Side Permission Protection
-
-```ts
-// app/lib/spine/permissions.server.ts
-import {
-  configurePermissionRouteProtection,
-  requirePermission,
-} from '@eminuckan/spine/server';
-import { getAuthSession } from '@eminuckan/spine/react-router/server';
-import { contextToUserInfo, getIdentityContext } from './identity.server';
-import { getCurrentTenant } from './tenant.server';
-
-configurePermissionRouteProtection({
-  getSession: getAuthSession,
-  resolveContext: async (request, session) => {
-    if (!session.user?.sub) {
-      return { permissions: [], currentTenant: null };
+  identityContextFetcher: async (request) => {
+    const user = await getUser(request);
+    if (!user) {
+      return null;
     }
 
-    const identityContext = await getIdentityContext(request, session.user.sub);
-    const currentTenant = await getCurrentTenant(request);
-    const userInfo = await contextToUserInfo(identityContext, {
-      currentTenant,
-      request,
-    });
-
+    const context = await getIdentityContext(request, user.sub);
     return {
-      permissions: userInfo.permissions,
-      currentTenant: userInfo.currentTenant,
+      memberships: context.memberships ?? [],
     };
   },
 });
 
-export { requirePermission };
+export { getActiveTenant, initializeTenant };
 ```
 
-### 3. Protect Routes
+### 3. Protect a Route
 
 ```ts
-// app/routes/_protected.tsx
+// app/routes/dashboard.tsx
 import { authRoute, getAccessToken } from '@eminuckan/spine/react-router/server';
-import { getCurrentTenant, initializeTenant } from '~/lib/spine/tenant.server';
-import { contextToUserInfo, getIdentityContext } from '~/lib/spine/identity.server';
+import { getActiveTenant, initializeTenant } from '~/lib/spine/tenant.server';
 
 export async function loader({ request }: { request: Request }) {
   return authRoute(request, async (user) => {
-    const [accessToken, identityContext, currentTenant] = await Promise.all([
-      getAccessToken(request),
-      getIdentityContext(request, user.sub),
-      getCurrentTenant(request),
-    ]);
-
-    const initResult =
-      !currentTenant && identityContext.hasAnyMembership
-        ? await initializeTenant(request)
-        : null;
-
-    const userInfo = await contextToUserInfo(identityContext, {
-      currentTenant: initResult?.tenantId ?? currentTenant,
-      request,
-    });
+    const currentTenant = await getActiveTenant(request);
+    const initializedTenant = currentTenant ? null : await initializeTenant(request);
+    const accessToken = await getAccessToken(request);
 
     return {
       user,
-      accessToken,
-      identity: {
-        ...identityContext,
-        permissions: userInfo.permissions,
-        currentTenant: userInfo.currentTenant,
-      },
-      tenantHeaders: initResult?.headers ?? null,
+      hasAccessToken: Boolean(accessToken),
+      currentTenant: initializedTenant?.tenantId ?? currentTenant,
     };
   });
 }
 ```
 
-### 4. Wire Client Providers
+### 4. Wire React Providers
 
 ```tsx
 import { QueryClientProvider } from '@tanstack/react-query';
@@ -388,14 +392,12 @@ export function AppProviders({
 }
 ```
 
-### 5. Configure Backend Conventions Instead of Forking
+### 5. Configure Conventions Instead of Forking
 
 ```ts
-import {
-  configureAuthClaimMapping,
-  configureIdentityStore,
-  configureRouteProtection,
-} from '@eminuckan/spine/server';
+import { configureAuthClaimMapping, configureRouteProtection } from '@eminuckan/spine/server';
+import { configureIdentityStore } from '@eminuckan/spine/identity';
+import { configureTenantClient } from '@eminuckan/spine/tenant';
 
 configureAuthClaimMapping({
   tenantIds: ['tenant_ids'],
@@ -410,6 +412,17 @@ configureIdentityStore({
   logoutPath: '/session/logout',
 });
 
+configureTenantClient({
+  fetchTenantData: async ({ tenantId }) => {
+    const response = await fetch(`/api/workspaces/${tenantId}`);
+    const payload = await response.json();
+    return {
+      id: payload.workspace.id,
+      name: payload.workspace.displayName,
+    };
+  },
+});
+
 configureRouteProtection({
   getLoginReturnUrl: ({ request }) => new URL(request.url).pathname,
 });
@@ -419,20 +432,25 @@ Client contracts are configurable too. Simple apps can use endpoint configuratio
 
 More adaptation examples live in [docs/backend-adaptation.md](docs/backend-adaptation.md).
 
-## Module Guides
+## Documentation
+
+Integration docs:
 
 - [Architecture](docs/architecture.md)
 - [Installation](docs/installation.md)
 - [Adapters](docs/adapters.md)
 - [Backend Adaptation](docs/backend-adaptation.md)
 - [Module Reference](docs/module-reference.md)
+
+Project docs:
+
 - [Roadmap](ROADMAP.md)
-- [Codex Maintenance Plan](docs/codex-maintenance.md)
 - [Releasing](docs/releasing.md)
 - [Contributing](CONTRIBUTING.md)
 - [Maintainers](MAINTAINERS.md)
 - [Security](SECURITY.md)
 - [Code of Conduct](CODE_OF_CONDUCT.md)
+- [Codex Maintenance Plan](docs/codex-maintenance.md)
 
 ## Current Boundaries
 

package/SECURITY.md

@@ -2,27 +2,17 @@
 
 ## Supported Versions
 
-Security fixes are applied to the latest published release line.
+Security fixes are applied to the latest published release line and the current `main` branch. Older releases are not supported.
 
 ## Reporting a Vulnerability
 
-Please do not open public GitHub issues for security problems.
+Do not open a public issue or discussion for a suspected vulnerability.
 
-Instead, report vulnerabilities privately to:
+Use [GitHub private vulnerability reporting](https://github.com/eminuckan/spine/security/advisories/new) from the repository's **Security** tab. Maintainers should coordinate investigation and remediation in a private draft security advisory.
 
-- Email: `eminuckan@gmail.com`
+Include the affected package entry point or adapter, impact, reproduction steps, affected version or revision, and any suggested mitigation. Redact credentials, tokens, session material, and application data from the report.
 
-When possible, include:
-
-- A clear description of the issue
-- Affected versions
-- Reproduction steps
-- Potential impact
-- Any suggested mitigation
-
-## Response Expectations
-
-The goal is to acknowledge reports quickly, validate impact, and coordinate a fix before public disclosure.
+We will validate the report, prioritize remediation by impact and exploitability, and coordinate disclosure after a fix is available.
 
 ## Scope Notes
 

package/dist/access/index.mjs

@@ -0,0 +1,2 @@
+import { t as evaluateAccessRequirement } from "../access-BHy1v5sr.mjs";
+export { evaluateAccessRequirement };

package/dist/{access-CGrsDMwu.js → access-BHy1v5sr.mjs}

@@ -1,7 +1,6 @@
-import { PermissionChecker } from "./permission-service-CvGpwI0d.js";
-
+import { t as PermissionChecker } from "./permission-service-DUyKomU3.mjs";
 //#region src/access/evaluator.ts
-const ACTIVE_ENTITLEMENT_STATUSES = new Set(["active", "trialing"]);
+const ACTIVE_ENTITLEMENT_STATUSES = /* @__PURE__ */ new Set(["active", "trialing"]);
 const EMPTY_DECISION = Object.freeze({
 	allowed: true,
 	reasons: [],
@@ -34,8 +33,7 @@ function evaluateAccessRequirement(requirement, subject) {
 	if (requirement.requireActiveEntitlement && !hasActiveEntitlement(entitlement)) reasons.push("inactive-entitlement");
 	else if (requirement.requireActiveSubscription && !hasActiveEntitlement(entitlement)) reasons.push("inactive-subscription");
 	if (permissions.length > 0) {
-		const checker = new PermissionChecker([...subject.permissions ?? []]);
-		const result = checker.hasPermissions([...permissions], {
+		const result = new PermissionChecker([...subject.permissions ?? []]).hasPermissions([...permissions], {
 			operator: requirement.permissionOperator ?? "AND",
 			wildcard: true
 		});
@@ -55,7 +53,7 @@ function evaluateAccessRequirement(requirement, subject) {
 		missingFeatures
 	};
 }
-
 //#endregion
-export { evaluateAccessRequirement };
-//# sourceMappingURL=access-CGrsDMwu.js.map
+export { evaluateAccessRequirement as t };
+
+//# sourceMappingURL=access-BHy1v5sr.mjs.map

package/dist/access-BHy1v5sr.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-BHy1v5sr.mjs","names":[],"sources":["../src/access/evaluator.ts"],"sourcesContent":["import { PermissionChecker } from '../permissions/permission-service';\nimport type {\n  AccessDecision,\n  AccessDeniedReason,\n  AccessOperator,\n  AccessRequirement,\n  AccessSubject,\n  EntitlementAccessSnapshot,\n} from './types';\n\nconst ACTIVE_ENTITLEMENT_STATUSES = new Set(['active', 'trialing']);\n\nconst EMPTY_DECISION: AccessDecision = Object.freeze({\n  allowed: true,\n  reasons: [],\n  missingPermissions: [],\n  missingFeatures: [],\n});\n\nfunction normalizeFeature(value: string): string {\n  return value.trim().toLowerCase();\n}\n\nfunction hasActiveEntitlement(entitlement?: EntitlementAccessSnapshot | null): boolean {\n  if (!entitlement?.exists) {\n    return false;\n  }\n\n  return ACTIVE_ENTITLEMENT_STATUSES.has(entitlement.status?.toLowerCase() ?? '');\n}\n\nfunction checkFeatureSet(\n  grantedFeatures: readonly string[],\n  requiredFeatures: readonly string[],\n  operator: AccessOperator,\n): string[] {\n  if (requiredFeatures.length === 0) {\n    return [];\n  }\n\n  const granted = new Set(grantedFeatures.map(normalizeFeature));\n  const normalizedRequired = requiredFeatures.map(normalizeFeature).filter(Boolean);\n\n  if (operator === 'OR') {\n    return normalizedRequired.some((feature) => granted.has(feature)) ? [] : normalizedRequired;\n  }\n\n  return normalizedRequired.filter((feature) => !granted.has(feature));\n}\n\nexport function evaluateAccessRequirement(\n  requirement: AccessRequirement | null | undefined,\n  subject: AccessSubject,\n): AccessDecision {\n  if (!requirement) {\n    return EMPTY_DECISION;\n  }\n\n  const reasons: AccessDeniedReason[] = [];\n  const permissions = requirement.permissions ?? [];\n  const features = requirement.features ?? [];\n  const entitlement = subject.entitlement ?? subject.subscription;\n  let missingPermissions: string[] = [];\n  let missingFeatures: string[] = [];\n\n  if (requirement.internalOnly && !subject.isInternalUser) {\n    reasons.push('internal-only');\n  }\n\n  if (requirement.requireActiveEntitlement && !hasActiveEntitlement(entitlement)) {\n    reasons.push('inactive-entitlement');\n  } else if (requirement.requireActiveSubscription && !hasActiveEntitlement(entitlement)) {\n    reasons.push('inactive-subscription');\n  }\n\n  if (permissions.length > 0) {\n    const checker = new PermissionChecker([...(subject.permissions ?? [])]);\n    const result = checker.hasPermissions([...permissions], {\n      operator: requirement.permissionOperator ?? 'AND',\n      wildcard: true,\n    });\n\n    if (!result.hasPermission) {\n      missingPermissions = result.missingPermissions;\n      reasons.push('missing-permissions');\n    }\n  }\n\n  if (features.length > 0) {\n    missingFeatures = checkFeatureSet(\n      entitlement?.featureKeys ?? [],\n      features,\n      requirement.featureOperator ?? 'AND',\n    );\n\n    if (missingFeatures.length > 0) {\n      reasons.push('missing-features');\n    }\n  }\n\n  return {\n    allowed: reasons.length === 0,\n    reasons,\n    missingPermissions,\n    missingFeatures,\n  };\n}\n"],"mappings":";;AAUA,MAAM,8CAA8B,IAAI,IAAI,CAAC,UAAU,UAAU,CAAC;AAElE,MAAM,iBAAiC,OAAO,OAAO;CACnD,SAAS;CACT,SAAS,CAAC;CACV,oBAAoB,CAAC;CACrB,iBAAiB,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,OAAuB;CAC/C,OAAO,MAAM,KAAK,CAAC,CAAC,YAAY;AAClC;AAEA,SAAS,qBAAqB,aAAyD;CACrF,IAAI,CAAC,aAAa,QAChB,OAAO;CAGT,OAAO,4BAA4B,IAAI,YAAY,QAAQ,YAAY,KAAK,EAAE;AAChF;AAEA,SAAS,gBACP,iBACA,kBACA,UACU;CACV,IAAI,iBAAiB,WAAW,GAC9B,OAAO,CAAC;CAGV,MAAM,UAAU,IAAI,IAAI,gBAAgB,IAAI,gBAAgB,CAAC;CAC7D,MAAM,qBAAqB,iBAAiB,IAAI,gBAAgB,CAAC,CAAC,OAAO,OAAO;CAEhF,IAAI,aAAa,MACf,OAAO,mBAAmB,MAAM,YAAY,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI;CAG3E,OAAO,mBAAmB,QAAQ,YAAY,CAAC,QAAQ,IAAI,OAAO,CAAC;AACrE;AAEA,SAAgB,0BACd,aACA,SACgB;CAChB,IAAI,CAAC,aACH,OAAO;CAGT,MAAM,UAAgC,CAAC;CACvC,MAAM,cAAc,YAAY,eAAe,CAAC;CAChD,MAAM,WAAW,YAAY,YAAY,CAAC;CAC1C,MAAM,cAAc,QAAQ,eAAe,QAAQ;CACnD,IAAI,qBAA+B,CAAC;CACpC,IAAI,kBAA4B,CAAC;CAEjC,IAAI,YAAY,gBAAgB,CAAC,QAAQ,gBACvC,QAAQ,KAAK,eAAe;CAG9B,IAAI,YAAY,4BAA4B,CAAC,qBAAqB,WAAW,GAC3E,QAAQ,KAAK,sBAAsB;MAC9B,IAAI,YAAY,6BAA6B,CAAC,qBAAqB,WAAW,GACnF,QAAQ,KAAK,uBAAuB;CAGtC,IAAI,YAAY,SAAS,GAAG;EAE1B,MAAM,SAAS,IADK,kBAAkB,CAAC,GAAI,QAAQ,eAAe,CAAC,CAAE,CAChD,CAAC,CAAC,eAAe,CAAC,GAAG,WAAW,GAAG;GACtD,UAAU,YAAY,sBAAsB;GAC5C,UAAU;EACZ,CAAC;EAED,IAAI,CAAC,OAAO,eAAe;GACzB,qBAAqB,OAAO;GAC5B,QAAQ,KAAK,qBAAqB;EACpC;CACF;CAEA,IAAI,SAAS,SAAS,GAAG;EACvB,kBAAkB,gBAChB,aAAa,eAAe,CAAC,GAC7B,UACA,YAAY,mBAAmB,KACjC;EAEA,IAAI,gBAAgB,SAAS,GAC3B,QAAQ,KAAK,kBAAkB;CAEnC;CAEA,OAAO;EACL,SAAS,QAAQ,WAAW;EAC5B;EACA;EACA;CACF;AACF"}

package/dist/api-client/index.mjs

@@ -0,0 +1,3 @@
+import { t as isApiClientError } from "../types-DqCXinAk.mjs";
+import { a as withRetry, c as handleApiError, i as isRetryableError, l as ErrorCodes, n as createRetryFetch, o as ApiError, r as fetchWithTimeout, s as ErrorHandler, t as calculateBackoffDelay } from "../api-client-CB7XZaMg.mjs";
+export { ApiError, ErrorCodes, ErrorHandler, calculateBackoffDelay, createRetryFetch, fetchWithTimeout, handleApiError, isApiClientError, isRetryableError, withRetry };

package/dist/api-client/server.mjs

@@ -0,0 +1,4 @@
+import { t as isApiClientError } from "../types-DqCXinAk.mjs";
+import { a as withRetry, c as handleApiError, i as isRetryableError, l as ErrorCodes, n as createRetryFetch, o as ApiError, r as fetchWithTimeout, s as ErrorHandler, t as calculateBackoffDelay } from "../api-client-CB7XZaMg.mjs";
+import { n as createFetchMiddleware, r as createAPIConfigFactory, t as createApiClient } from "../server-ByScGRXA.mjs";
+export { ApiError, ErrorCodes, ErrorHandler, calculateBackoffDelay, createAPIConfigFactory, createApiClient, createFetchMiddleware, createRetryFetch, fetchWithTimeout, handleApiError, isApiClientError, isRetryableError, withRetry };

package/dist/{api-client-CgZUMukO.js → api-client-CB7XZaMg.mjs}

@@ -1,5 +1,4 @@
-import { logger } from "./logging-DviiAkLx.js";
-
+import { logger } from "./logging/index.mjs";
 //#region src/api-client/error-codes.ts
 /**
 * Error Codes
@@ -30,13 +29,14 @@ const ErrorCodes = {
 	Forbidden: "Forbidden",
 	InternalError: "InternalError"
 };
-
 //#endregion
 //#region src/api-client/error-handler.ts
 /**
 * API Error Class
 */
 var ApiError = class extends Error {
+	problemDetails;
+	response;
 	constructor(problemDetails, response) {
 		super(problemDetails.detail);
 		this.problemDetails = problemDetails;
@@ -116,7 +116,6 @@ var ErrorHandler = class {
 		this.showToast(message, "error");
 	}
 };
-
 //#endregion
 //#region src/api-client/retry-handler.ts
 const DEFAULT_RETRY_CONFIG = {
@@ -168,15 +167,14 @@ async function withRetry(fn, config) {
 * Fetch with timeout
 */
 async function fetchWithTimeout(input, init) {
-	const { timeout = 3e4,...fetchInit } = init || {};
+	const { timeout = 3e4, ...fetchInit } = init || {};
 	const controller = new AbortController();
 	const timeoutId = setTimeout(() => controller.abort(), timeout);
 	try {
-		const response = await fetch(input, {
+		return await fetch(input, {
 			...fetchInit,
 			signal: controller.signal
 		});
-		return response;
 	} finally {
 		clearTimeout(timeoutId);
 	}
@@ -189,7 +187,7 @@ function createRetryFetch(config) {
 		return withRetry(() => fetch(input, init), config);
 	};
 }
-
 //#endregion
-export { ApiError, ErrorCodes, ErrorHandler, calculateBackoffDelay, createRetryFetch, fetchWithTimeout, handleApiError, isRetryableError, withRetry };
-//# sourceMappingURL=api-client-CgZUMukO.js.map
+export { withRetry as a, handleApiError as c, isRetryableError as i, ErrorCodes as l, createRetryFetch as n, ApiError as o, fetchWithTimeout as r, ErrorHandler as s, calculateBackoffDelay as t };
+
+//# sourceMappingURL=api-client-CB7XZaMg.mjs.map

package/dist/api-client-CB7XZaMg.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client-CB7XZaMg.mjs","names":[],"sources":["../src/api-client/error-codes.ts","../src/api-client/error-handler.ts","../src/api-client/retry-handler.ts"],"sourcesContent":["/**\n * Error Codes\n * \n * Generic error codes that apps can use as a starter vocabulary.\n * Domain-specific codes should live in the consuming app.\n */\n\nexport const ErrorCodes = {\n  // Validation\n  Validation: {\n    Failed: 'ValidationFailed',\n  },\n\n  // Identity\n  Identity: {\n    InvalidCredentials: 'InvalidCredentials',\n    UserInactive: 'UserInactive',\n    TenantContextMissing: 'TenantContextMissing',\n    InvalidCurrentPassword: 'InvalidCurrentPassword',\n    OwnerCannotDisableMembership: 'OwnerCannotDisableMembership',\n    CurrentUserMissing: 'CurrentUserMissing',\n    UserNotFound: 'UserNotFound',\n    EmailAlreadyExists: 'EmailAlreadyExists',\n  },\n\n  // Access and entitlement\n  Access: {\n    EntitlementRequired: 'EntitlementRequired',\n    EntitlementExpired: 'EntitlementExpired',\n    FeatureNotAvailable: 'FeatureNotAvailable',\n    TenantContextMissing: 'TenantContextMissing',\n  },\n\n  // General\n  NotFound: 'NotFound',\n  Unauthorized: 'Unauthorized',\n  Forbidden: 'Forbidden',\n  InternalError: 'InternalError',\n} as const;\n","/**\n * Error Handler\n * \n * Centralized error handling with ProblemDetails parsing.\n */\n\nimport type { ProblemDetails, ValidationError } from './types';\nimport { ErrorCodes } from './error-codes';\nimport { logger } from '../logging';\n\n/**\n * API Error Class\n */\nexport class ApiError extends Error {\n  constructor(\n    public problemDetails: ProblemDetails,\n    public response: Response\n  ) {\n    super(problemDetails.detail);\n    this.name = 'ApiError';\n  }\n\n  get code(): string {\n    return this.problemDetails.title;\n  }\n\n  get status(): number {\n    return this.problemDetails.status;\n  }\n\n  get isValidationError(): boolean {\n    return this.code === ErrorCodes.Validation.Failed;\n  }\n\n  get validationErrors(): ValidationError[] {\n    return this.problemDetails.meta?.errors ?? [];\n  }\n\n  get traceId(): string {\n    return this.problemDetails.traceId;\n  }\n}\n\n/**\n * Parse API error response\n */\nexport async function handleApiError(response: Response): Promise<never> {\n  let problemDetails: ProblemDetails;\n\n  try {\n    problemDetails = await response.json();\n  } catch {\n    problemDetails = {\n      type: `https://httpstatuses.com/${response.status}`,\n      title: 'UnknownError',\n      status: response.status,\n      detail: response.statusText || 'An unknown error occurred',\n      traceId: response.headers.get('x-trace-id') ?? 'unknown',\n    };\n  }\n\n  logger.error('API request failed', undefined, {\n    code: problemDetails.title,\n    status: problemDetails.status,\n    detail: problemDetails.detail,\n    traceId: problemDetails.traceId,\n  });\n\n  throw new ApiError(problemDetails, response);\n}\n\n/**\n * Error Handler Configuration\n */\nexport interface ErrorHandlerConfig {\n  handlers?: Partial<Record<string, (error: ApiError) => void>>;\n  showToast?: boolean;\n  toastMessages?: Partial<Record<string, string>>;\n  onError?: (error: ApiError) => void;\n  toast?: (message: string, type: 'error' | 'success' | 'info') => void;\n}\n\n/**\n * Error Handler Class\n */\nexport class ErrorHandler {\n  private config: ErrorHandlerConfig;\n\n  constructor(config: ErrorHandlerConfig = {}) {\n    this.config = {\n      showToast: true,\n      ...config,\n    };\n  }\n\n  handle(error: ApiError): void {\n    const code = error.code;\n\n    logger.error('Handling API Error', undefined, {\n      code,\n      status: error.status,\n      traceId: error.traceId,\n    });\n\n    // Try custom handler first\n    if (this.config.handlers?.[code]) {\n      this.config.handlers[code]!(error);\n      return;\n    }\n\n    // Fallback\n    if (this.config.onError) {\n      this.config.onError(error);\n    } else {\n      this.showDefaultToast(error);\n    }\n  }\n\n  private showToast(message: string, type: 'error' | 'success' | 'info'): void {\n    if (this.config.showToast && this.config.toast) {\n      this.config.toast(message, type);\n    }\n  }\n\n  private showDefaultToast(error: ApiError): void {\n    const message =\n      this.config.toastMessages?.[error.code] ||\n      error.problemDetails.detail ||\n      'An error occurred';\n    this.showToast(message, 'error');\n  }\n}\n\n/**\n * Create global error handler\n */\nexport function createErrorHandler(config?: ErrorHandlerConfig): ErrorHandler {\n  return new ErrorHandler(config);\n}\n\n/**\n * Map validation errors to form fields\n */\nexport function mapValidationErrors(errors: ValidationError[]): Record<string, string> {\n  const mapped: Record<string, string> = {};\n  for (const error of errors) {\n    const fieldName = error.field.charAt(0).toLowerCase() + error.field.slice(1);\n    mapped[fieldName] = error.message;\n  }\n  return mapped;\n}\n","/**\n * Retry Handler\n * \n * Retry logic for API requests.\n */\n\nimport type { RetryConfig } from './types';\n\nconst DEFAULT_RETRY_CONFIG: Required<RetryConfig> = {\n  maxRetries: 3,\n  baseDelay: 1000,\n  maxDelay: 10000,\n  retryCondition: (error: unknown) => {\n    if (error instanceof Response) {\n      return error.status >= 500 || error.status === 429;\n    }\n    return false;\n  },\n};\n\n/**\n * Calculate backoff delay\n */\nexport function calculateBackoffDelay(\n  attempt: number,\n  baseDelay: number,\n  maxDelay: number\n): number {\n  const delay = baseDelay * Math.pow(2, attempt);\n  const jitter = Math.random() * 0.3 * delay;\n  return Math.min(delay + jitter, maxDelay);\n}\n\n/**\n * Check if error is retryable\n */\nexport function isRetryableError(error: unknown): boolean {\n  if (error instanceof Response) {\n    return error.status >= 500 || error.status === 429;\n  }\n  if (error instanceof TypeError) {\n    // Network errors\n    return true;\n  }\n  return false;\n}\n\n/**\n * Execute function with retry logic\n */\nexport async function withRetry<T>(\n  fn: () => Promise<T>,\n  config?: RetryConfig\n): Promise<T> {\n  const { maxRetries, baseDelay, maxDelay, retryCondition } = {\n    ...DEFAULT_RETRY_CONFIG,\n    ...config,\n  };\n\n  let lastError: unknown;\n\n  for (let attempt = 0; attempt <= maxRetries; attempt++) {\n    try {\n      return await fn();\n    } catch (error) {\n      lastError = error;\n\n      if (attempt === maxRetries || !retryCondition(error)) {\n        throw error;\n      }\n\n      const delay = calculateBackoffDelay(attempt, baseDelay, maxDelay);\n      console.log(`Retry attempt ${attempt + 1}/${maxRetries} after ${delay}ms`);\n      await new Promise((resolve) => setTimeout(resolve, delay));\n    }\n  }\n\n  throw lastError;\n}\n\n/**\n * Fetch with timeout\n */\nexport async function fetchWithTimeout(\n  input: RequestInfo | URL,\n  init?: RequestInit & { timeout?: number }\n): Promise<Response> {\n  const { timeout = 30000, ...fetchInit } = init || {};\n\n  const controller = new AbortController();\n  const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n  try {\n    const response = await fetch(input, {\n      ...fetchInit,\n      signal: controller.signal,\n    });\n    return response;\n  } finally {\n    clearTimeout(timeoutId);\n  }\n}\n\n/**\n * Create fetch function with retry\n */\nexport function createRetryFetch(config?: RetryConfig) {\n  return async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {\n    return withRetry(() => fetch(input, init), config);\n  };\n}\n"],"mappings":";;;;;;;;AAOA,MAAa,aAAa;CAExB,YAAY,EACV,QAAQ,mBACV;CAGA,UAAU;EACR,oBAAoB;EACpB,cAAc;EACd,sBAAsB;EACtB,wBAAwB;EACxB,8BAA8B;EAC9B,oBAAoB;EACpB,cAAc;EACd,oBAAoB;CACtB;CAGA,QAAQ;EACN,qBAAqB;EACrB,oBAAoB;EACpB,qBAAqB;EACrB,sBAAsB;CACxB;CAGA,UAAU;CACV,cAAc;CACd,WAAW;CACX,eAAe;AACjB;;;;;;ACzBA,IAAa,WAAb,cAA8B,MAAM;CAEzB;CACA;CAFT,YACE,gBACA,UACA;EACA,MAAM,eAAe,MAAM;EAHpB,KAAA,iBAAA;EACA,KAAA,WAAA;EAGP,KAAK,OAAO;CACd;CAEA,IAAI,OAAe;EACjB,OAAO,KAAK,eAAe;CAC7B;CAEA,IAAI,SAAiB;EACnB,OAAO,KAAK,eAAe;CAC7B;CAEA,IAAI,oBAA6B;EAC/B,OAAO,KAAK,SAAS,WAAW,WAAW;CAC7C;CAEA,IAAI,mBAAsC;EACxC,OAAO,KAAK,eAAe,MAAM,UAAU,CAAC;CAC9C;CAEA,IAAI,UAAkB;EACpB,OAAO,KAAK,eAAe;CAC7B;AACF;;;;AAKA,eAAsB,eAAe,UAAoC;CACvE,IAAI;CAEJ,IAAI;EACF,iBAAiB,MAAM,SAAS,KAAK;CACvC,QAAQ;EACN,iBAAiB;GACf,MAAM,4BAA4B,SAAS;GAC3C,OAAO;GACP,QAAQ,SAAS;GACjB,QAAQ,SAAS,cAAc;GAC/B,SAAS,SAAS,QAAQ,IAAI,YAAY,KAAK;EACjD;CACF;CAEA,OAAO,MAAM,sBAAsB,KAAA,GAAW;EAC5C,MAAM,eAAe;EACrB,QAAQ,eAAe;EACvB,QAAQ,eAAe;EACvB,SAAS,eAAe;CAC1B,CAAC;CAED,MAAM,IAAI,SAAS,gBAAgB,QAAQ;AAC7C;;;;AAgBA,IAAa,eAAb,MAA0B;CACxB;CAEA,YAAY,SAA6B,CAAC,GAAG;EAC3C,KAAK,SAAS;GACZ,WAAW;GACX,GAAG;EACL;CACF;CAEA,OAAO,OAAuB;EAC5B,MAAM,OAAO,MAAM;EAEnB,OAAO,MAAM,sBAAsB,KAAA,GAAW;GAC5C;GACA,QAAQ,MAAM;GACd,SAAS,MAAM;EACjB,CAAC;EAGD,IAAI,KAAK,OAAO,WAAW,OAAO;GAChC,KAAK,OAAO,SAAS,KAAK,CAAE,KAAK;GACjC;EACF;EAGA,IAAI,KAAK,OAAO,SACd,KAAK,OAAO,QAAQ,KAAK;OAEzB,KAAK,iBAAiB,KAAK;CAE/B;CAEA,UAAkB,SAAiB,MAA0C;EAC3E,IAAI,KAAK,OAAO,aAAa,KAAK,OAAO,OACvC,KAAK,OAAO,MAAM,SAAS,IAAI;CAEnC;CAEA,iBAAyB,OAAuB;EAC9C,MAAM,UACJ,KAAK,OAAO,gBAAgB,MAAM,SAClC,MAAM,eAAe,UACrB;EACF,KAAK,UAAU,SAAS,OAAO;CACjC;AACF;;;AC3HA,MAAM,uBAA8C;CAClD,YAAY;CACZ,WAAW;CACX,UAAU;CACV,iBAAiB,UAAmB;EAClC,IAAI,iBAAiB,UACnB,OAAO,MAAM,UAAU,OAAO,MAAM,WAAW;EAEjD,OAAO;CACT;AACF;;;;AAKA,SAAgB,sBACd,SACA,WACA,UACQ;CACR,MAAM,QAAQ,YAAY,KAAK,IAAI,GAAG,OAAO;CAC7C,MAAM,SAAS,KAAK,OAAO,IAAI,KAAM;CACrC,OAAO,KAAK,IAAI,QAAQ,QAAQ,QAAQ;AAC1C;;;;AAKA,SAAgB,iBAAiB,OAAyB;CACxD,IAAI,iBAAiB,UACnB,OAAO,MAAM,UAAU,OAAO,MAAM,WAAW;CAEjD,IAAI,iBAAiB,WAEnB,OAAO;CAET,OAAO;AACT;;;;AAKA,eAAsB,UACpB,IACA,QACY;CACZ,MAAM,EAAE,YAAY,WAAW,UAAU,mBAAmB;EAC1D,GAAG;EACH,GAAG;CACL;CAEA,IAAI;CAEJ,KAAK,IAAI,UAAU,GAAG,WAAW,YAAY,WAC3C,IAAI;EACF,OAAO,MAAM,GAAG;CAClB,SAAS,OAAO;EACd,YAAY;EAEZ,IAAI,YAAY,cAAc,CAAC,eAAe,KAAK,GACjD,MAAM;EAGR,MAAM,QAAQ,sBAAsB,SAAS,WAAW,QAAQ;EAChE,QAAQ,IAAI,iBAAiB,UAAU,EAAE,GAAG,WAAW,SAAS,MAAM,GAAG;EACzE,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,KAAK,CAAC;CAC3D;CAGF,MAAM;AACR;;;;AAKA,eAAsB,iBACpB,OACA,MACmB;CACnB,MAAM,EAAE,UAAU,KAAO,GAAG,cAAc,QAAQ,CAAC;CAEnD,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,YAAY,iBAAiB,WAAW,MAAM,GAAG,OAAO;CAE9D,IAAI;EAKF,OAAO,MAJgB,MAAM,OAAO;GAClC,GAAG;GACH,QAAQ,WAAW;EACrB,CAAC;CAEH,UAAU;EACR,aAAa,SAAS;CACxB;AACF;;;;AAKA,SAAgB,iBAAiB,QAAsB;CACrD,OAAO,OAAO,OAA0B,SAA0C;EAChF,OAAO,gBAAgB,MAAM,OAAO,IAAI,GAAG,MAAM;CACnD;AACF"}

package/dist/auth/auth.server.d.ts

@@ -10,6 +10,7 @@
  */
 import { isSessionValid } from './redis-session-storage.server';
 import type { AuthClaimMapping, UserInfo, TokenRefreshResult, LoginOptions, AuthError } from './types';
+export declare function createAuthorizationResponseUrl(requestUrl: string, redirectUri: string): URL;
 /**
  * Configure claim mapping so different providers/backends can project their
  * own claim names onto the shared auth/session primitives.

package/dist/auth/auth.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.server.d.ts","sourceRoot":"","sources":["../../src/auth/auth.server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EAKL,cAAc,EASf,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAEV,gBAAgB,EAChB,QAAQ,EAGR,kBAAkB,EAClB,YAAY,EAKZ,SAAS,EACV,MAAM,SAAS,CAAC;AAijBjB;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAgBzE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAI5C;AAkID;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CAkDA;AAyDD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAkB/D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAK/C;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAGtD;AAMD;;;;;GAKG;AACH,wBAAsB,KAAK,CACzB,OAAO,EAAE,OAAO,EAChB,kBAAkB,CAAC,EAAE,MAAM,GAAG,YAAY,GACzC,OAAO,CAAC,QAAQ,CAAC,CAgGnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0OxE;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkGhE;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8CjF;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmClF;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAQxE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWrE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ7E;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAiD7B;AAGD,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C"}
+{"version":3,"file":"auth.server.d.ts","sourceRoot":"","sources":["../../src/auth/auth.server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EAKL,cAAc,EASf,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAEV,gBAAgB,EAChB,QAAQ,EAGR,kBAAkB,EAClB,YAAY,EAKZ,SAAS,EACV,MAAM,SAAS,CAAC;AAgOjB,wBAAgB,8BAA8B,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,GAAG,CAM3F;AAmVD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAgBzE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAI5C;AAkID;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CAkDA;AAyDD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAkB/D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAK/C;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAGtD;AAMD;;;;;GAKG;AACH,wBAAsB,KAAK,CACzB,OAAO,EAAE,OAAO,EAChB,kBAAkB,CAAC,EAAE,MAAM,GAAG,YAAY,GACzC,OAAO,CAAC,QAAQ,CAAC,CAgGnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2OxE;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkGhE;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8CjF;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmClF;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAQxE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWrE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ7E;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAiD7B;AAGD,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C"}

package/dist/auth/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/auth/route-protection.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-protection.server.d.ts","sourceRoot":"","sources":["../../src/auth/route-protection.server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAazD;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CA4C3E;AAkCD;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qEAAqE;IACrE,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB,CAAC,gBAAgB,GAAG,2BAA2B;IACpF,kBAAkB,EAAE,CAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,KACnB,OAAO,CAAC,2BAA2B,GAAG,gBAAgB,CAAC,CAAC;CAC9D;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,gBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/D,gBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChG;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,6BAA6B,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACzF;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,0BAA0B,GAAG,gBAAgB,CAAC;CACvD;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,8BAA8B,CAAC,gBAAgB,GAAG,2BAA2B;IAC5F,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;IAC5B,kBAAkB,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACjF,gBAAgB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C,gBAAgB,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,kCAAkC,CAAC,gBAAgB,GAAG,2BAA2B,CAChG,SAAQ,8BAA8B,CAAC,gBAAgB,CAAC;IACxD,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB,CAAC,gBAAgB,GAAG,2BAA2B;IACnF,eAAe,CAAC,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,YAAY,CAAC,EAAE,CACb,OAAO,EAAE,8BAA8B,CAAC,gBAAgB,CAAC,KACtD,OAAO,CAAC,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5F,gBAAgB,CAAC,EAAE,CACjB,OAAO,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAC1D,OAAO,CAAC,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5F,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,MAAM,CAAC;IAC/D,4BAA4B,CAAC,EAAE,CAC7B,OAAO,EAAE,6BAA6B,KACnC,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACjC;AAID;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,gBAAgB,GAAG,2BAA2B,EACrF,MAAM,EAAE,qBAAqB,CAAC,gBAAgB,CAAC,GAC9C,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAmJD;;GAEG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,eAAe,EAC3B,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,CA8EZ;AAMD;;GAEG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,EAC3B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACD,CAAC;AAE/C;;GAEG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,EACzB,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACqC,CAAC;AAEpF;;GAEG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,EAC3B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACuC,CAAC;AAEtF;;GAEG;AACH,eAAO,MAAM,cAAc,GAhBD,CAAC,WAChB,OAAO,YACN,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eAcP,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,EAC/B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACoD,CAAC;AAEnG;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,CAAC,EACjC,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACsD,CAAC"}
+{"version":3,"file":"route-protection.server.d.ts","sourceRoot":"","sources":["../../src/auth/route-protection.server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAazD;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CA2C3E;AAiCD;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qEAAqE;IACrE,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB,CAAC,gBAAgB,GAAG,2BAA2B;IACpF,kBAAkB,EAAE,CAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,KACnB,OAAO,CAAC,2BAA2B,GAAG,gBAAgB,CAAC,CAAC;CAC9D;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,gBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/D,gBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChG;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,6BAA6B,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACzF;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,0BAA0B,GAAG,gBAAgB,CAAC;CACvD;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,8BAA8B,CAAC,gBAAgB,GAAG,2BAA2B;IAC5F,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;IAC5B,kBAAkB,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACjF,gBAAgB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C,gBAAgB,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,kCAAkC,CAAC,gBAAgB,GAAG,2BAA2B,CAChG,SAAQ,8BAA8B,CAAC,gBAAgB,CAAC;IACxD,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB,CAAC,gBAAgB,GAAG,2BAA2B;IACnF,eAAe,CAAC,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,YAAY,CAAC,EAAE,CACb,OAAO,EAAE,8BAA8B,CAAC,gBAAgB,CAAC,KACtD,OAAO,CAAC,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5F,gBAAgB,CAAC,EAAE,CACjB,OAAO,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAC1D,OAAO,CAAC,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5F,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,MAAM,CAAC;IAC/D,4BAA4B,CAAC,EAAE,CAC7B,OAAO,EAAE,6BAA6B,KACnC,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACjC;AAID;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,gBAAgB,GAAG,2BAA2B,EACrF,MAAM,EAAE,qBAAqB,CAAC,gBAAgB,CAAC,GAC9C,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAmJD;;GAEG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,eAAe,EAC3B,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,CA8EZ;AAMD;;GAEG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,EAC3B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACD,CAAC;AAE/C;;GAEG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,EACzB,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACqC,CAAC;AAEpF;;GAEG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,EAC3B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACuC,CAAC;AAEtF;;GAEG;AACH,eAAO,MAAM,cAAc,GAhBD,CAAC,WAChB,OAAO,YACN,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eAcP,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,EAC/B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACoD,CAAC;AAEnG;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,CAAC,EACjC,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACsD,CAAC"}

package/dist/auth/server.mjs

@@ -0,0 +1,3 @@
+import { S as updateAuthSession, _ as isSessionValid, a as createOAuthState, b as listCurrentUserAuthSessions, c as destroyAuthSessionById, d as destroyAuthSessionsBySid, f as destroyAuthSessionsForUser, g as getOAuthState, h as getCurrentAuthSessionId, i as createAuthSession, l as destroyAuthSessionsByIdentitySession, m as getAuthSessionById, n as cleanupExpiredOAuthStates, o as deleteOAuthState, p as getAuthSession, r as closeRedisConnection, s as destroyAuthSession, t as AUTH_ERROR_COOKIE_PREFIX, u as destroyAuthSessionsBySessionState, v as listAuthSessionDataForUser, x as requireAuthSession, y as listAuthSessionsForUser } from "../redis-session-storage.server-DGgQcJ9B.mjs";
+import { A as resetAuthClaimMapping, C as handleCallback, D as logout, E as login, O as refreshTokens, S as handleBackChannelLogout, T as hasAuthError, _ as createAuthorizationResponseUrl, a as configureRouteProtection, b as getAuthError, c as protectRoute, d as resetRouteProtectionConfig, f as shouldRefreshToken, g as configureAuthClaimMapping, h as clearAuthServerCache, i as authRoute, k as requireAuth, l as protectedRoute, m as clearAuthErrorHeaders, n as isTokenExpiredResponse, o as onboardingRoute, p as subscriptionRoute, r as shouldAttemptTokenRefresh, s as policyRoute, t as attemptTokenRefresh, u as publicRoute, v as extractUserInfo, w as handleFrontChannelLogout, x as getUser, y as getAccessToken } from "../server-CqX2yCa4.mjs";
+export { AUTH_ERROR_COOKIE_PREFIX, attemptTokenRefresh, authRoute, cleanupExpiredOAuthStates, clearAuthErrorHeaders, clearAuthServerCache, closeRedisConnection, configureAuthClaimMapping, configureRouteProtection, createAuthSession, createAuthorizationResponseUrl, createOAuthState, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, extractUserInfo, getAccessToken, getAuthError, getAuthSession, getAuthSessionById, getCurrentAuthSessionId, getOAuthState, getUser, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, isSessionValid, isTokenExpiredResponse, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, login, logout, onboardingRoute, policyRoute, protectRoute, protectedRoute, publicRoute, refreshTokens, requireAuth, requireAuthSession, resetAuthClaimMapping, resetRouteProtectionConfig, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession };