@eminuckan/spine 0.3.0 → 0.3.2

package/dist/server-CqX2yCa4.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-CqX2yCa4.mjs","names":[],"sources":["../src/http/response.ts","../src/auth/authorization-parameters.ts","../src/auth/auth.server.ts","../src/auth/route-protection.server.ts","../src/auth/token-refresh.server.ts"],"sourcesContent":["/**\n * HTTP response helpers that stay framework-agnostic.\n */\n\nexport interface RedirectResponseInit {\n  headers?: HeadersInit;\n  status?: number;\n}\n\n/**\n * Create a redirect response without relying on a router/framework helper.\n */\nexport function createRedirectResponse(\n  location: string,\n  init: RedirectResponseInit = {}\n): Response {\n  const headers = new Headers(init.headers);\n  headers.set('Location', location);\n\n  return new Response(null, {\n    status: init.status ?? 302,\n    headers,\n  });\n}\n","import type { LoginOptions } from './types';\n\nconst RESERVED_AUTHORIZATION_PARAMETER_NAMES = new Set([\n  'client_id',\n  'code_challenge',\n  'code_challenge_method',\n  'kc_action',\n  'nonce',\n  'prompt',\n  'redirect_uri',\n  'response_mode',\n  'response_type',\n  'scope',\n  'state',\n]);\n\nconst DEFAULT_EXTRA_AUTHORIZATION_PARAMETER_NAMES = new Set([\n  'acr_values',\n  'kc_idp_hint',\n  'login_hint',\n  'ui_locales',\n]);\n\nfunction isAllowedExtraAuthorizationParameter(\n  key: string,\n  allowedNames: Set<string>,\n  allowedPrefixes: string[]\n): boolean {\n  const normalized = key.toLowerCase();\n  return allowedNames.has(normalized) || allowedPrefixes.some((prefix) => normalized.startsWith(prefix));\n}\n\nexport function sanitizeExtraAuthorizationParameters(\n  params: LoginOptions['extraAuthParams'] | undefined,\n  options: Pick<LoginOptions, 'extraAuthParamNames' | 'extraAuthParamPrefixes'> = {}\n): Record<string, string> {\n  if (!params) {\n    return {};\n  }\n\n  const allowedNames = new Set([\n    ...DEFAULT_EXTRA_AUTHORIZATION_PARAMETER_NAMES,\n    ...(options.extraAuthParamNames ?? []).map((name) => name.trim().toLowerCase()).filter(Boolean),\n  ]);\n  const allowedPrefixes = (options.extraAuthParamPrefixes ?? [])\n    .map((prefix) => prefix.trim().toLowerCase())\n    .filter(Boolean);\n  const sanitized: Record<string, string> = {};\n\n  for (const [key, value] of Object.entries(params)) {\n    const normalizedKey = key.trim();\n    if (\n      normalizedKey.length === 0 ||\n      RESERVED_AUTHORIZATION_PARAMETER_NAMES.has(normalizedKey.toLowerCase()) ||\n      !isAllowedExtraAuthorizationParameter(normalizedKey, allowedNames, allowedPrefixes) ||\n      value === null ||\n      value === undefined\n    ) {\n      continue;\n    }\n\n    const normalizedValue = String(value).trim();\n    if (normalizedValue.length === 0) {\n      continue;\n    }\n\n    sanitized[normalizedKey] = normalizedValue;\n  }\n\n  return sanitized;\n}\n\nexport function normalizePublicAuthorizationStateContext(\n  context: LoginOptions['publicStateContext']\n): Record<string, string> | null {\n  if (!context) {\n    return null;\n  }\n\n  const normalized: Record<string, string> = {};\n\n  for (const [key, value] of Object.entries(context)) {\n    const normalizedKey = key.trim();\n    if (\n      normalizedKey.length === 0 ||\n      RESERVED_AUTHORIZATION_PARAMETER_NAMES.has(normalizedKey.toLowerCase()) ||\n      value === null ||\n      value === undefined\n    ) {\n      continue;\n    }\n\n    const normalizedValue = String(value).trim();\n    if (normalizedValue.length === 0) {\n      continue;\n    }\n\n    normalized[normalizedKey] = normalizedValue;\n  }\n\n  return Object.keys(normalized).length > 0 ? normalized : null;\n}\n\nexport function buildAuthorizationState(\n  baseState: string,\n  publicStateContext: LoginOptions['publicStateContext']\n): string {\n  const normalizedContext = normalizePublicAuthorizationStateContext(publicStateContext);\n  if (!normalizedContext) {\n    return baseState;\n  }\n\n  return `${baseState}.${Buffer.from(JSON.stringify(normalizedContext), 'utf8').toString('base64url')}`;\n}\n","/**\n * OpenID Connect Authentication Server Module\n *\n * Handles:\n * - Login flow (PKCE)\n * - Token exchange\n * - Token refresh\n * - Logout\n * - Session management\n */\n\nimport * as oidc from 'openid-client';\nimport { createRemoteJWKSet, jwtVerify } from 'jose';\n\nimport {\n  createAuthSession,\n  getAuthSession,\n  updateAuthSession,\n  destroyAuthSession,\n  isSessionValid,\n  listAuthSessionDataForUser,\n  destroyAuthSessionsByIdentitySession,\n  destroyAuthSessionsBySid,\n  destroyAuthSessionsForUser,\n  createOAuthState,\n  getOAuthState,\n  deleteOAuthState,\n  AUTH_ERROR_COOKIE_PREFIX,\n} from './redis-session-storage.server';\nimport type { \n  AuthConfig, \n  AuthClaimMapping,\n  UserInfo, \n  SessionData, \n  OAuthState,\n  TokenRefreshResult,\n  LoginOptions,\n  ApplicationType,\n  OidcClientAuthMethod,\n  BackChannelLogoutResult,\n  FrontChannelLogoutResult,\n  AuthError\n} from './types';\nimport { logger } from '../logging';\nimport { createRedirectResponse } from '../http/response';\nimport {\n  buildAuthorizationState,\n  sanitizeExtraAuthorizationParameters,\n} from './authorization-parameters';\n\ntype OidcTokenResponse = oidc.TokenEndpointResponse & oidc.TokenEndpointResponseHelpers;\ntype LogoutScope = 'identity' | 'local' | 'all';\n\n// ============================================================================\n// Configuration\n// ============================================================================\n\n/**\n * Get effective hasLandingPage setting based on config\n */\nfunction getEffectiveHasLandingPage(config: AuthConfig): boolean {\n  // Explicit setting takes precedence\n  if (config.hasLandingPage !== undefined) {\n    return config.hasLandingPage;\n  }\n  \n  // Determine by application type\n  switch (config.applicationType) {\n    case 'no-landing-page':\n    case 'dashboard':\n      return false; // Dashboard has no landing page\n    case 'landing-page':\n    case 'tenant-app':\n      return true; // Tenant app has landing page\n    default:\n      return true; // Default to having a landing page\n  }\n}\n\n/**\n * Create OAuth configuration from environment variables\n */\nfunction createAuthConfig(): AuthConfig {\n  const requiredEnvVars = {\n    authority: process.env.OIDC_AUTHORITY,\n    clientId: process.env.OIDC_CLIENT_ID,\n    redirectUri: process.env.OIDC_REDIRECT_URI,\n  };\n\n  for (const [key, value] of Object.entries(requiredEnvVars)) {\n    if (!value) {\n      throw new Error(`Missing required environment variable: OIDC_${key.toUpperCase()}`);\n    }\n  }\n\n  // Parse application type from env\n  const appTypeEnv = process.env.OIDC_APPLICATION_TYPE?.toLowerCase();\n  let applicationType: ApplicationType = 'custom';\n  if (appTypeEnv === 'no-landing-page' || appTypeEnv === 'no_landing_page') {\n    applicationType = 'no-landing-page';\n  } else if (appTypeEnv === 'landing-page' || appTypeEnv === 'landing_page') {\n    applicationType = 'landing-page';\n  } else if (appTypeEnv === 'dashboard') {\n    applicationType = 'dashboard';\n  } else if (appTypeEnv === 'tenant-app' || appTypeEnv === 'tenant_app') {\n    applicationType = 'tenant-app';\n  }\n\n  const clientAuthMethod = parseOidcClientAuthMethod(\n    process.env.OIDC_CLIENT_AUTH_METHOD,\n    process.env.OIDC_CLIENT_SECRET ? 'client_secret_post' : 'none'\n  );\n\n  const hasLandingPage = process.env.OIDC_HAS_LANDING_PAGE !== undefined\n    ? process.env.OIDC_HAS_LANDING_PAGE === 'true'\n    : undefined;\n\n  return {\n    authority: requiredEnvVars.authority!,\n    clientId: requiredEnvVars.clientId!,\n    clientSecret: process.env.OIDC_CLIENT_SECRET,\n    clientAuthMethod,\n    redirectUri: requiredEnvVars.redirectUri!,\n    scope: process.env.OIDC_SCOPE || 'openid profile email api',\n    postLogoutRedirectUri: process.env.OIDC_POST_LOGOUT_REDIRECT_URI,\n    applicationType,\n    hasLandingPage,\n  };\n}\n\nfunction parseOidcClientAuthMethod(\n  value: string | undefined,\n  fallback: OidcClientAuthMethod\n): OidcClientAuthMethod {\n  const normalized = value?.trim().toLowerCase();\n\n  switch (normalized) {\n    case undefined:\n    case '':\n      return fallback;\n    case 'none':\n      return 'none';\n    case 'client_secret_post':\n    case 'post':\n      return 'client_secret_post';\n    case 'client_secret_basic':\n    case 'basic':\n      return 'client_secret_basic';\n    default:\n      throw new Error(`Unsupported OIDC_CLIENT_AUTH_METHOD: ${value}`);\n  }\n}\n\nlet OIDC_CONFIG: AuthConfig | null = null;\n\nfunction getAuthConfig(): AuthConfig {\n  if (!OIDC_CONFIG) {\n    OIDC_CONFIG = createAuthConfig();\n  }\n  return OIDC_CONFIG;\n}\n\n// ============================================================================\n// OAuth Discovery Cache\n// ============================================================================\n\nlet authServerCache: {\n  configuration: oidc.Configuration;\n  cachedAt: number;\n} | null = null;\n\nconst CACHE_TTL = 60 * 60 * 1000; // 1 hour\nconst jwksCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\nfunction normalizeIssuer(value: string | undefined): string | null {\n  const normalized = value?.trim().replace(/\\/+$/, '');\n  return normalized && normalized.length > 0 ? normalized : null;\n}\n\nfunction getJwtClaims(token: string | undefined): Record<string, unknown> | null {\n  if (!token) {\n    return null;\n  }\n\n  try {\n    const [, payload] = token.split('.');\n    if (!payload) {\n      return null;\n    }\n\n    return JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nfunction getJwtIssuer(token: string | undefined): string | null {\n  const issuer = getJwtClaims(token)?.iss;\n  return typeof issuer === 'string' ? normalizeIssuer(issuer) : null;\n}\n\nfunction canUseIdTokenHint(idToken: string | undefined, expectedIssuer: string): boolean {\n  if (!idToken) {\n    return false;\n  }\n\n  const tokenIssuer = getJwtIssuer(idToken);\n  return tokenIssuer !== null && tokenIssuer === normalizeIssuer(expectedIssuer);\n}\n\nfunction sanitizeLogoutReturnUrl(returnUrl: string | null, request: Request): string | null {\n  if (!returnUrl) {\n    return null;\n  }\n\n  try {\n    const requestUrl = new URL(request.url);\n    const decodedReturnUrl = decodeURIComponent(returnUrl);\n\n    if (decodedReturnUrl.startsWith('/') && !decodedReturnUrl.startsWith('//')) {\n      return isAuthLoopPath(decodedReturnUrl) ? null : decodedReturnUrl;\n    }\n\n    const candidateUrl = new URL(decodedReturnUrl);\n    if (candidateUrl.origin !== requestUrl.origin) {\n      return null;\n    }\n\n    const sameOriginPath = `${candidateUrl.pathname}${candidateUrl.search}${candidateUrl.hash}`;\n    return isAuthLoopPath(sameOriginPath) ? null : sameOriginPath;\n  } catch {\n    return null;\n  }\n}\n\nfunction appendApplicationInitiatedActionResult(\n  returnUrl: string,\n  action: string | null | undefined,\n  status: string | null | undefined\n): string {\n  if (!action && !status) {\n    return returnUrl;\n  }\n\n  try {\n    const isRelative = returnUrl.startsWith('/') && !returnUrl.startsWith('//');\n    const url = new URL(returnUrl, isRelative ? 'http://spine.local' : undefined);\n\n    if (action) {\n      url.searchParams.set('kc_action', action);\n    }\n\n    if (status) {\n      url.searchParams.set('kc_action_status', status);\n    }\n\n    return isRelative ? `${url.pathname}${url.search}${url.hash}` : url.toString();\n  } catch {\n    const params = new URLSearchParams();\n    if (action) params.set('kc_action', action);\n    if (status) params.set('kc_action_status', status);\n    const separator = returnUrl.includes('?') ? '&' : '?';\n    return `${returnUrl}${separator}${params.toString()}`;\n  }\n}\n\nexport function createAuthorizationResponseUrl(requestUrl: string, redirectUri: string): URL {\n  const incomingUrl = new URL(requestUrl);\n  const authorizationResponseUrl = new URL(redirectUri);\n  authorizationResponseUrl.search = incomingUrl.search;\n  authorizationResponseUrl.hash = \"\";\n  return authorizationResponseUrl;\n}\n\nfunction isAuthLoopPath(path: string): boolean {\n  const normalized = path.split('#')[0].split('?')[0].replace(/\\/+$/, '') || '/';\n  return normalized === '/auth/logout' || normalized === '/auth/callback';\n}\n\nfunction isLocalInsecureIssuer(authority: string): boolean {\n  try {\n    const issuer = new URL(authority);\n    return (\n      issuer.protocol === 'http:' &&\n      ['localhost', '127.0.0.1', '::1', '[::1]'].includes(issuer.hostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction shouldAllowInsecureOidcRequests(authority: string): boolean {\n  if (process.env.NODE_ENV === 'production') {\n    return false;\n  }\n\n  if (process.env.OIDC_ALLOW_INSECURE_REQUESTS === 'true') {\n    return true;\n  }\n\n  return isLocalInsecureIssuer(authority);\n}\n\nfunction getDiscoveryOptions(): oidc.DiscoveryRequestOptions {\n  const config = getAuthConfig();\n\n  return shouldAllowInsecureOidcRequests(config.authority)\n    ? { algorithm: 'oidc', execute: [oidc.allowInsecureRequests] }\n    : { algorithm: 'oidc' };\n}\n\nfunction getClientMetadata(config: AuthConfig): string | undefined {\n  return config.clientAuthMethod === 'none' ? undefined : config.clientSecret;\n}\n\nfunction getClientAuthentication(config: AuthConfig): oidc.ClientAuth {\n  switch (config.clientAuthMethod) {\n    case 'client_secret_basic':\n      if (!config.clientSecret) {\n        throw new Error('OIDC_CLIENT_SECRET is required for client_secret_basic authentication');\n      }\n\n      return oidc.ClientSecretBasic(config.clientSecret);\n    case 'client_secret_post':\n      if (!config.clientSecret) {\n        throw new Error('OIDC_CLIENT_SECRET is required for client_secret_post authentication');\n      }\n\n      return oidc.ClientSecretPost(config.clientSecret);\n    case 'none':\n    default:\n      return oidc.None();\n  }\n}\n\nfunction getOAuthErrorMessage(error: unknown): string {\n  if (error instanceof oidc.ResponseBodyError) {\n    return error.error_description || error.error || error.message;\n  }\n\n  if (error instanceof Error) {\n    return error.message;\n  }\n\n  return 'Unknown error';\n}\n\nfunction shouldLogoutAfterOAuthError(error: unknown): boolean {\n  if (error instanceof oidc.ResponseBodyError) {\n    return (\n      error.status === 400 ||\n      error.status === 401 ||\n      error.error === 'invalid_grant' ||\n      error.error === 'invalid_token'\n    );\n  }\n\n  const message = error instanceof Error ? error.message.toLowerCase() : '';\n  return message.includes('invalid_grant') || message.includes('invalid_token') || message.includes('unauthorized');\n}\n\nfunction getLogoutScope(url: URL): LogoutScope {\n  const requestedScope =\n    url.searchParams.get('logout') ??\n    url.searchParams.get('logout_scope') ??\n    url.searchParams.get('scope');\n  const normalized = requestedScope?.trim().toLowerCase();\n\n  if (\n    normalized === 'local' ||\n    normalized === 'application' ||\n    normalized === 'app' ||\n    normalized === 'current-device'\n  ) {\n    return 'local';\n  }\n\n  if (\n    normalized === 'all' ||\n    normalized === 'all-local' ||\n    normalized === 'all-devices' ||\n    normalized === 'everywhere'\n  ) {\n    return 'all';\n  }\n\n  if (url.searchParams.get('local_only') === 'true' || url.searchParams.get('client_id_only') === 'true') {\n    return 'local';\n  }\n\n  return 'identity';\n}\n\nfunction getAbsoluteRedirectUrl(request: Request, redirectUrl: string): string {\n  if (/^https?:\\/\\//i.test(redirectUrl)) {\n    return redirectUrl;\n  }\n\n  return new URL(redirectUrl, new URL(request.url).origin).toString();\n}\n\nasync function revokeTokenBestEffort(\n  configuration: oidc.Configuration,\n  token: string | undefined,\n  tokenTypeHint: 'access_token' | 'refresh_token'\n): Promise<void> {\n  if (!token) {\n    return;\n  }\n\n  try {\n    await oidc.tokenRevocation(configuration, token, {\n      token_type_hint: tokenTypeHint,\n    });\n  } catch (error) {\n    logger.warn('OIDC token revocation failed', {\n      tokenTypeHint,\n      error: getOAuthErrorMessage(error),\n    });\n  }\n}\n\nasync function revokeSessionTokensBestEffort(sessionData: SessionData): Promise<void> {\n  if (!sessionData.refreshToken && !sessionData.accessToken) {\n    return;\n  }\n\n  try {\n    const configuration = await getOAuthConfig();\n    await revokeTokenBestEffort(configuration, sessionData.refreshToken, 'refresh_token');\n    await revokeTokenBestEffort(configuration, sessionData.accessToken, 'access_token');\n  } catch (error) {\n    logger.warn('Skipping OIDC token revocation because provider configuration is unavailable', {\n      error: getOAuthErrorMessage(error),\n    });\n  }\n}\n\nasync function revokeAndDestroyAllUserSessionsBestEffort(userId: string): Promise<number> {\n  const sessions = await listAuthSessionDataForUser(userId);\n\n  try {\n    const configuration = await getOAuthConfig();\n    for (const { data } of sessions) {\n      await revokeTokenBestEffort(configuration, data.refreshToken, 'refresh_token');\n      await revokeTokenBestEffort(configuration, data.accessToken, 'access_token');\n    }\n  } catch (error) {\n    logger.warn('Skipping all-session token revocation because provider configuration is unavailable', {\n      error: getOAuthErrorMessage(error),\n    });\n  }\n\n  return await destroyAuthSessionsForUser(userId);\n}\n\nfunction getClaimsFromTokenResponse(tokenResult: OidcTokenResponse): Record<string, unknown> {\n  const claims = tokenResult.claims();\n\n  if (claims) {\n    return claims as Record<string, unknown>;\n  }\n\n  return getJwtClaims(tokenResult.id_token) ?? {};\n}\n\n/**\n * Get OIDC configuration with caching.\n */\nasync function getOAuthConfig(): Promise<oidc.Configuration> {\n  const config = getAuthConfig();\n  const now = Date.now();\n\n  if (authServerCache && now - authServerCache.cachedAt < CACHE_TTL) {\n    return authServerCache.configuration;\n  }\n\n  try {\n    const configuration = await oidc.discovery(\n      new URL(config.authority),\n      config.clientId,\n      getClientMetadata(config),\n      getClientAuthentication(config),\n      getDiscoveryOptions()\n    );\n\n    authServerCache = {\n      configuration,\n      cachedAt: now,\n    };\n\n    logger.info('OIDC discovery completed successfully', {\n      issuer: configuration.serverMetadata().issuer,\n      clientId: config.clientId,\n      clientAuthMethod: config.clientAuthMethod,\n    });\n    return configuration;\n  } catch (error) {\n    logger.error('OIDC discovery failed', error instanceof Error ? error : undefined, {\n      authority: config.authority,\n      clientId: config.clientId,\n    });\n    throw new Error(`OIDC discovery failed: ${getOAuthErrorMessage(error)}`);\n  }\n}\n\nfunction getJwks(jwksUri: string): ReturnType<typeof createRemoteJWKSet> {\n  const cachedJwks = jwksCache.get(jwksUri);\n  if (cachedJwks) {\n    return cachedJwks;\n  }\n\n  const jwks = createRemoteJWKSet(new URL(jwksUri));\n  jwksCache.set(jwksUri, jwks);\n  return jwks;\n}\n\nasync function getLogoutTokenFromRequest(request: Request): Promise<string | null> {\n  const contentType = request.headers.get('content-type') ?? '';\n\n  if (contentType.includes('application/json')) {\n    const body = await request.json().catch(() => null) as { logout_token?: unknown } | null;\n    return typeof body?.logout_token === 'string' ? body.logout_token : null;\n  }\n\n  const formData = await request.formData().catch(() => null);\n  const logoutToken = formData?.get('logout_token');\n  return typeof logoutToken === 'string' ? logoutToken : null;\n}\n\nfunction validateBackChannelLogoutClaims(payload: Record<string, unknown>, clientId: string): {\n  issuer?: string;\n  subject?: string;\n  sid?: string;\n} {\n  const events = payload.events;\n  const hasBackChannelEvent =\n    events &&\n    typeof events === 'object' &&\n    !Array.isArray(events) &&\n    'http://schemas.openid.net/event/backchannel-logout' in events;\n\n  if (!hasBackChannelEvent) {\n    throw new Error('Invalid back-channel logout token: missing back-channel logout event');\n  }\n\n  if ('nonce' in payload) {\n    throw new Error('Invalid back-channel logout token: nonce is not allowed');\n  }\n\n  const audience = payload.aud;\n  const hasClientAudience = Array.isArray(audience)\n    ? audience.includes(clientId)\n    : audience === clientId;\n\n  if (!hasClientAudience) {\n    throw new Error('Invalid back-channel logout token: audience mismatch');\n  }\n\n  const subject = typeof payload.sub === 'string' ? payload.sub : undefined;\n  const sid = typeof payload.sid === 'string' ? payload.sid : undefined;\n\n  if (!subject && !sid) {\n    throw new Error('Invalid back-channel logout token: subject or sid is required');\n  }\n\n  return {\n    issuer: typeof payload.iss === 'string' ? payload.iss : undefined,\n    subject,\n    sid,\n  };\n}\n\n// ============================================================================\n// Claim Extraction\n// ============================================================================\n\nconst DEFAULT_AUTH_CLAIM_MAPPING: Required<AuthClaimMapping> = {\n  subject: ['sub'],\n  name: ['name', 'preferred_username', 'email'],\n  email: ['email'],\n  givenName: ['given_name', 'givenName'],\n  familyName: ['family_name', 'familyName'],\n  picture: ['picture', 'avatar_url'],\n  locale: ['locale'],\n  zoneinfo: ['zoneinfo'],\n  updatedAt: ['updated_at'],\n  tenantIds: ['tenant_ids'],\n  tenantRoles: ['tenant_roles'],\n  permissions: ['app_perms', 'permissions', 'scope'],\n  isOnboarded: ['is_onboarded'],\n};\n\nlet authClaimMapping: Required<AuthClaimMapping> = {\n  ...DEFAULT_AUTH_CLAIM_MAPPING,\n};\n\nfunction normalizeClaimKeys(keys?: string[]): string[] {\n  if (!Array.isArray(keys)) {\n    return [];\n  }\n\n  return Array.from(\n    new Set(\n      keys\n        .map((key) => key.trim())\n        .filter((key) => key.length > 0)\n    )\n  );\n}\n\n/**\n * Configure claim mapping so different providers/backends can project their\n * own claim names onto the shared auth/session primitives.\n */\nexport function configureAuthClaimMapping(mapping: AuthClaimMapping): void {\n  authClaimMapping = {\n    subject: mapping.subject !== undefined ? normalizeClaimKeys(mapping.subject) : DEFAULT_AUTH_CLAIM_MAPPING.subject,\n    name: mapping.name !== undefined ? normalizeClaimKeys(mapping.name) : DEFAULT_AUTH_CLAIM_MAPPING.name,\n    email: mapping.email !== undefined ? normalizeClaimKeys(mapping.email) : DEFAULT_AUTH_CLAIM_MAPPING.email,\n    givenName: mapping.givenName !== undefined ? normalizeClaimKeys(mapping.givenName) : DEFAULT_AUTH_CLAIM_MAPPING.givenName,\n    familyName: mapping.familyName !== undefined ? normalizeClaimKeys(mapping.familyName) : DEFAULT_AUTH_CLAIM_MAPPING.familyName,\n    picture: mapping.picture !== undefined ? normalizeClaimKeys(mapping.picture) : DEFAULT_AUTH_CLAIM_MAPPING.picture,\n    locale: mapping.locale !== undefined ? normalizeClaimKeys(mapping.locale) : DEFAULT_AUTH_CLAIM_MAPPING.locale,\n    zoneinfo: mapping.zoneinfo !== undefined ? normalizeClaimKeys(mapping.zoneinfo) : DEFAULT_AUTH_CLAIM_MAPPING.zoneinfo,\n    updatedAt: mapping.updatedAt !== undefined ? normalizeClaimKeys(mapping.updatedAt) : DEFAULT_AUTH_CLAIM_MAPPING.updatedAt,\n    tenantIds: mapping.tenantIds !== undefined ? normalizeClaimKeys(mapping.tenantIds) : DEFAULT_AUTH_CLAIM_MAPPING.tenantIds,\n    tenantRoles: mapping.tenantRoles !== undefined ? normalizeClaimKeys(mapping.tenantRoles) : DEFAULT_AUTH_CLAIM_MAPPING.tenantRoles,\n    permissions: mapping.permissions !== undefined ? normalizeClaimKeys(mapping.permissions) : DEFAULT_AUTH_CLAIM_MAPPING.permissions,\n    isOnboarded: mapping.isOnboarded !== undefined ? normalizeClaimKeys(mapping.isOnboarded) : DEFAULT_AUTH_CLAIM_MAPPING.isOnboarded,\n  };\n}\n\n/**\n * Reset claim mapping to the built-in defaults.\n */\nexport function resetAuthClaimMapping(): void {\n  authClaimMapping = {\n    ...DEFAULT_AUTH_CLAIM_MAPPING,\n  };\n}\n\nfunction getConfiguredAuthClaimMapping(): Required<AuthClaimMapping> {\n  return authClaimMapping;\n}\n\nfunction getFirstClaimValue(\n  claims: Record<string, unknown>,\n  claimKeys: string[]\n): { key?: string; value?: unknown } {\n  for (const claimKey of claimKeys) {\n    if (claimKey in claims) {\n      return {\n        key: claimKey,\n        value: claims[claimKey],\n      };\n    }\n  }\n\n  return {};\n}\n\nfunction getStringClaim(claims: Record<string, unknown>, claimKeys: string[]): string | undefined {\n  const { value } = getFirstClaimValue(claims, claimKeys);\n\n  if (typeof value === 'string') {\n    const trimmed = value.trim();\n    return trimmed.length > 0 ? trimmed : undefined;\n  }\n\n  if (typeof value === 'number' || typeof value === 'boolean') {\n    return `${value}`;\n  }\n\n  return undefined;\n}\n\nfunction getNumberClaim(claims: Record<string, unknown>, claimKeys: string[]): number | undefined {\n  const { value } = getFirstClaimValue(claims, claimKeys);\n\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    return value;\n  }\n\n  if (typeof value === 'string') {\n    const parsed = Number(value);\n    return Number.isFinite(parsed) ? parsed : undefined;\n  }\n\n  return undefined;\n}\n\nfunction getBooleanClaim(\n  claims: Record<string, unknown>,\n  claimKeys: string[],\n  defaultValue = false\n): boolean {\n  const { value } = getFirstClaimValue(claims, claimKeys);\n\n  if (typeof value === 'boolean') {\n    return value;\n  }\n\n  if (typeof value === 'string') {\n    return value.toLowerCase() === 'true';\n  }\n\n  return defaultValue;\n}\n\n/**\n * Parse JSON safely\n */\nfunction parseJson(value: string): unknown {\n  try {\n    return JSON.parse(value);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Convert value to string array\n */\nfunction toStringArray(value: unknown): string[] {\n  if (!value) return [];\n\n  if (Array.isArray(value)) {\n    return value\n      .map((item) => (typeof item === 'string' ? item.trim() : `${item}`.trim()))\n      .filter((item) => item.length > 0);\n  }\n\n  if (typeof value === 'string') {\n    const trimmed = value.trim();\n    if (!trimmed) return [];\n\n    if (trimmed.startsWith('[')) {\n      const parsed = parseJson(trimmed);\n      if (Array.isArray(parsed)) {\n        return parsed\n          .map((item) => (typeof item === 'string' ? item.trim() : `${item}`.trim()))\n          .filter((item) => item.length > 0);\n      }\n    }\n\n    if (trimmed.includes(',')) {\n      return trimmed\n        .split(',')\n        .map((item) => item.trim())\n        .filter((item) => item.length > 0);\n    }\n\n    return [trimmed];\n  }\n\n  return [];\n}\n\nfunction toScopeArray(value: unknown): string[] {\n  if (typeof value === 'string') {\n    return value\n      .trim()\n      .split(/\\s+/)\n      .filter((item) => item.length > 0);\n  }\n\n  return toStringArray(value);\n}\n\n/**\n * Extract user info from ID token claims\n */\nexport function extractUserInfo(claims: Record<string, unknown>): {\n  tenants: string[];\n  currentTenant?: string;\n  isOnboarded: boolean;\n  tenantRoles: Record<string, string[]>;\n  permissions: string[];\n} {\n  const claimMapping = getConfiguredAuthClaimMapping();\n\n  // Extract tenant IDs\n  let tenants: string[] = [];\n  const { value: rawTenantIds } = getFirstClaimValue(claims, claimMapping.tenantIds);\n  if (rawTenantIds !== undefined) {\n    if (typeof rawTenantIds === 'string' && rawTenantIds.trim().startsWith('[')) {\n      const parsed = parseJson(rawTenantIds.trim());\n      if (Array.isArray(parsed)) {\n        tenants = parsed\n          .map((id) => (typeof id === 'string' ? id.trim() : `${id}`.trim()))\n          .filter((id) => id.length > 0);\n      }\n    } else {\n      tenants = toStringArray(rawTenantIds);\n    }\n  }\n\n  // Extract tenant roles\n  const tenantRoles: Record<string, string[]> = {};\n  const { value: rawRoles } = getFirstClaimValue(claims, claimMapping.tenantRoles);\n  if (rawRoles !== undefined) {\n    let parsedRoles: unknown = rawRoles;\n\n    if (typeof rawRoles === 'string' && rawRoles.trim().startsWith('{')) {\n      parsedRoles = parseJson(rawRoles.trim()) ?? rawRoles;\n    }\n\n    if (parsedRoles && typeof parsedRoles === 'object' && !Array.isArray(parsedRoles)) {\n      for (const [tenantId, roleValue] of Object.entries(parsedRoles as Record<string, unknown>)) {\n        const roleIds = toStringArray(roleValue);\n        if (roleIds.length > 0) {\n          tenantRoles[tenantId] = roleIds;\n        }\n      }\n    }\n  }\n\n  // Extract permissions\n  const permissionClaim = getFirstClaimValue(claims, claimMapping.permissions);\n  const permissions =\n    permissionClaim.key === 'scope'\n      ? toScopeArray(permissionClaim.value)\n      : toStringArray(permissionClaim.value);\n\n  // Extract onboarding status\n  const isOnboarded = getBooleanClaim(claims, claimMapping.isOnboarded);\n\n  return { tenants, isOnboarded, tenantRoles, permissions };\n}\n\n// ============================================================================\n// Session Data Creation\n// ============================================================================\n\n/**\n * Create session data from token result\n */\nasync function createSessionData(\n  tokenResult: OidcTokenResponse,\n  claims: Record<string, unknown>\n): Promise<Partial<SessionData>> {\n  const claimMapping = getConfiguredAuthClaimMapping();\n  const baseUser: UserInfo = {\n    sub: getStringClaim(claims, claimMapping.subject) || 'unknown',\n    name: getStringClaim(claims, claimMapping.name) || getStringClaim(claims, claimMapping.email) || 'User',\n    email: getStringClaim(claims, claimMapping.email),\n    givenName: getStringClaim(claims, claimMapping.givenName),\n    familyName: getStringClaim(claims, claimMapping.familyName),\n    picture: getStringClaim(claims, claimMapping.picture),\n    locale: getStringClaim(claims, claimMapping.locale),\n    zoneinfo: getStringClaim(claims, claimMapping.zoneinfo),\n    updated_at: getNumberClaim(claims, claimMapping.updatedAt),\n  };\n\n  const expiresAt = tokenResult.expires_in\n    ? Date.now() + tokenResult.expires_in * 1000\n    : undefined;\n  const now = Date.now();\n  const sessionState = (tokenResult as Record<string, unknown>).session_state;\n\n  return {\n    userId: baseUser.sub,\n    accessToken: tokenResult.access_token,\n    refreshToken: tokenResult.refresh_token,\n    idToken: tokenResult.id_token,\n    expiresAt,\n    issuer: getStringClaim(claims, ['iss']),\n    sid: getStringClaim(claims, ['sid']),\n    sessionState: typeof sessionState === 'string' ? sessionState : undefined,\n    clientId: getAuthConfig().clientId,\n    user: baseUser,\n    createdAt: now,\n    lastActivity: now,\n  };\n}\n\n// ============================================================================\n// Auth Error Handling\n// ============================================================================\n\n// Auth error cookie names - unique per application to prevent conflicts\nconst AUTH_ERROR_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_auth_error`;\nconst AUTH_ERROR_DESC_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_auth_error_desc`;\nconst OAUTH_STATE_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_oauth_state_id`;\n\n/**\n * Check if there's an auth error in cookies\n * \n * This should be called by apps (especially those without landing pages like Dashboard)\n * BEFORE starting OAuth flow to prevent redirect loops.\n * \n * @example\n * ```ts\n * // In dashboard's index route loader\n * const authError = getAuthError(request);\n * if (authError) {\n *   return { authError }; // Show error to user\n * }\n * // No error, proceed with session check\n * const user = await getUser(request);\n * if (!user) {\n *   return login(request);\n * }\n * ```\n */\nexport function getAuthError(request: Request): AuthError | null {\n  const cookies = request.headers.get('Cookie');\n  if (!cookies) return null;\n  \n  // Parse auth_error cookie (app-specific)\n  const errorRegex = new RegExp(`${AUTH_ERROR_COOKIE}=([^;]+)`);\n  const errorMatch = cookies.match(errorRegex);\n  if (!errorMatch) return null;\n  \n  const error = decodeURIComponent(errorMatch[1]);\n  if (!error) return null;\n  \n  // Parse auth_error_description cookie (app-specific)\n  const descRegex = new RegExp(`${AUTH_ERROR_DESC_COOKIE}=([^;]+)`);\n  const descMatch = cookies.match(descRegex);\n  const description = descMatch ? decodeURIComponent(descMatch[1]) : undefined;\n  \n  return { error, description };\n}\n\n/**\n * Clear auth error cookies\n * \n * Call this after displaying the error to the user\n */\nexport function clearAuthErrorHeaders(): Headers {\n  const headers = new Headers();\n  headers.append('Set-Cookie', `${AUTH_ERROR_COOKIE}=; Path=/; Max-Age=0`);\n  headers.append('Set-Cookie', `${AUTH_ERROR_DESC_COOKIE}=; Path=/; Max-Age=0`);\n  return headers;\n}\n\n/**\n * Check if request has auth error (quick check without parsing)\n */\nexport function hasAuthError(request: Request): boolean {\n  const cookies = request.headers.get('Cookie');\n  return cookies?.includes(`${AUTH_ERROR_COOKIE}=`) ?? false;\n}\n\n// ============================================================================\n// Auth Functions\n// ============================================================================\n\n/**\n * Initiate OAuth login flow\n * \n * @param request - The incoming request\n * @param returnUrlOrOptions - Either a return URL string or LoginOptions object\n */\nexport async function login(\n  request: Request, \n  returnUrlOrOptions?: string | LoginOptions\n): Promise<Response> {\n  try {\n    const config = getAuthConfig();\n    \n    // Parse options\n    const options: LoginOptions = typeof returnUrlOrOptions === 'string' \n      ? { returnUrl: returnUrlOrOptions }\n      : returnUrlOrOptions || {};\n\n    // Check for auth_error cookie to prevent redirect loops\n    const cookies = request.headers.get('Cookie');\n    const hasError = cookies?.includes(`${AUTH_ERROR_COOKIE}=`);\n    if (hasError) {\n      logger.warn('Auth error cookie detected, preventing redirect loop');\n      // Clear the error cookie and redirect to home\n      const headers = new Headers();\n      headers.append('Set-Cookie', `${AUTH_ERROR_COOKIE}=; Path=/; Max-Age=0`);\n      // Use redirectUri to get correct base URL with port\n      const redirectUri = new URL(config.redirectUri);\n      const baseUrl = redirectUri.origin;\n      return createRedirectResponse(baseUrl, { headers });\n    }\n\n    const oidcConfig = await getOAuthConfig();\n\n    // Generate PKCE challenge\n    const codeVerifier = oidc.randomPKCECodeVerifier();\n    const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);\n\n    const extraAuthParams = sanitizeExtraAuthorizationParameters(options.extraAuthParams, options);\n\n    // Generate secure state and nonce. The state may carry a non-secret UI\n    // hint for Keycloak themes, but callback validation still compares the\n    // exact value stored server-side.\n    const state = buildAuthorizationState(oidc.randomState(), options.publicStateContext);\n    const nonce = oidc.randomNonce();\n\n    // Create OAuth state object\n    const oauthState: OAuthState = {\n      state,\n      codeVerifier,\n      nonce,\n      returnUrl: options.returnUrl,\n      kcAction: options.kcAction,\n      createdAt: Date.now(),\n    };\n\n    logger.info('Creating OAuth state', {\n      returnUrl: options.returnUrl,\n      prompt: options.prompt,\n      kcAction: options.kcAction,\n      extraAuthParamKeys: Object.keys(extraAuthParams),\n    });\n\n    // Store OAuth state in Redis\n    const stateId = await createOAuthState(oauthState);\n\n    const authorizationParameters: Record<string, string> = {\n      redirect_uri: config.redirectUri,\n      scope: config.scope,\n      state,\n      nonce,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n      ...extraAuthParams,\n    };\n\n    if (options.prompt) {\n      authorizationParameters.prompt = options.prompt;\n    }\n\n    if (options.kcAction) {\n      authorizationParameters.kc_action = options.kcAction;\n    }\n\n    const authorizationUrl = oidc.buildAuthorizationUrl(oidcConfig, authorizationParameters);\n\n    // Store stateId in cookie for callback (app-specific to prevent conflicts)\n    const headers = new Headers();\n    headers.append('Set-Cookie', `${OAUTH_STATE_COOKIE}=${stateId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=600`);\n\n    logger.info('OIDC authorization flow initiated', {\n      clientId: config.clientId,\n      redirectUri: config.redirectUri,\n      scope: config.scope,\n      authorizationEndpoint: oidcConfig.serverMetadata().authorization_endpoint,\n      stateId,\n      prompt: options.prompt,\n      kcAction: options.kcAction,\n    });\n\n    return createRedirectResponse(authorizationUrl.toString(), { headers });\n  } catch (error) {\n    logger.error('Failed to initiate OAuth login', error instanceof Error ? error : undefined);\n    throw new Error('Login failed');\n  }\n}\n\n/**\n * Handle OAuth callback\n * \n * Handles OAuth authorization response including success and error cases.\n * \n * Error Handling:\n * - `access_denied`: User doesn't have access to this application\n *   - For apps with landing page: Redirect home with error cookie\n *   - For apps without landing page: Redirect home with error cookie (must handle specially)\n * - `login_required`: No active identity session\n *   - Redirect to home to start fresh login\n */\nexport async function handleCallback(request: Request): Promise<Response> {\n  try {\n    const config = getAuthConfig();\n    const hasLandingPage = getEffectiveHasLandingPage(config);\n    const url = new URL(request.url);\n    const code = url.searchParams.get('code');\n    const state = url.searchParams.get('state');\n    const error = url.searchParams.get('error');\n    const errorDescription = url.searchParams.get('error_description');\n    const kcAction = url.searchParams.get('kc_action');\n    const kcActionStatus = url.searchParams.get('kc_action_status');\n\n    logger.info('OIDC callback received', {\n      hasCode: !!code,\n      hasState: !!state,\n      error,\n      errorDescription,\n      kcAction,\n      kcActionStatus,\n      clientId: config.clientId,\n      redirectUri: config.redirectUri\n    });\n\n    // Handle OAuth errors\n    if (error) {\n      if (kcActionStatus && state) {\n        const cookies = request.headers.get('Cookie');\n        const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);\n        const cookieMatch = cookies?.match(oauthStateRegex);\n        const stateId = cookieMatch?.[1];\n\n        if (stateId) {\n          const oauthState = await getOAuthState(stateId);\n          const stateAge = oauthState ? Date.now() - oauthState.createdAt : Number.POSITIVE_INFINITY;\n\n          if (oauthState && oauthState.state === state && stateAge <= 10 * 60 * 1000) {\n            await deleteOAuthState(stateId);\n            const headers = new Headers();\n            headers.append('Set-Cookie', `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);\n\n            const redirectUrl = appendApplicationInitiatedActionResult(\n              oauthState.returnUrl || '/',\n              kcAction || oauthState.kcAction,\n              kcActionStatus\n            );\n\n            logger.info('Application initiated action returned with OAuth error', {\n              error,\n              errorDescription,\n              kcAction: kcAction || oauthState.kcAction,\n              kcActionStatus,\n            });\n\n            return createRedirectResponse(redirectUrl, { headers });\n          }\n        }\n      }\n\n      logger.error('OAuth callback error', undefined, { \n        error, \n        errorDescription,\n        clientId: config.clientId,\n        applicationType: config.applicationType,\n        hasLandingPage\n      });\n      \n      // Handle access_denied specially - user doesn't have access to this app\n      // This can happen when identity cookie is valid but user has no access to this client\n      if (error === 'access_denied') {\n        logger.warn('Access denied for this application', { clientId: config.clientId });\n        // Clear any existing session and redirect to home without triggering new login\n        const headers = await destroyAuthSession(request);\n        // Set error cookies to:\n        // 1. Prevent redirect loop (auth_error)\n        // 2. Allow UI to show appropriate message (auth_error_type, auth_error_description)\n        headers.append(\n          'Set-Cookie',\n          `${AUTH_ERROR_COOKIE}=access_denied; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`\n        );\n        headers.append(\n          'Set-Cookie',\n          `${AUTH_ERROR_DESC_COOKIE}=${encodeURIComponent(errorDescription || 'You do not have access to this application.')}; Path=/; SameSite=Lax; Max-Age=300`\n        );\n        // Use redirectUri to get the correct base URL with port\n        // request.url.origin can lose the port in some cases\n        const redirectUri = new URL(config.redirectUri);\n        const baseUrl = redirectUri.origin;\n        logger.info('Redirecting to /auth/login to show access_denied error', { \n          hasLandingPage,\n          baseUrl,\n          configRedirectUri: config.redirectUri\n        });\n        // Redirect to /auth/login so user immediately sees the access denied page\n        // instead of landing page (which doesn't show the error)\n        return createRedirectResponse(`${baseUrl}/auth/login`, { headers });\n      }\n      \n      // Handle login_required - session expired or user not logged in\n      if (error === 'login_required') {\n        logger.info('Login required, user session may have expired');\n        const headers = await destroyAuthSession(request);\n        // Use redirectUri to get correct base URL with port\n        const redirectUri = new URL(config.redirectUri);\n        const baseUrl = redirectUri.origin;\n        return createRedirectResponse(baseUrl, { headers });\n      }\n      \n      // Handle other errors\n      const headers = await destroyAuthSession(request);\n      headers.append(\n        'Set-Cookie',\n        `${AUTH_ERROR_COOKIE}=${encodeURIComponent(error)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`\n      );\n      if (errorDescription) {\n        headers.append(\n          'Set-Cookie',\n          `${AUTH_ERROR_DESC_COOKIE}=${encodeURIComponent(errorDescription)}; Path=/; SameSite=Lax; Max-Age=300`\n        );\n      }\n      // Use redirectUri to get correct base URL with port\n      const redirectUri = new URL(config.redirectUri);\n      const baseUrl = redirectUri.origin;\n      return createRedirectResponse(baseUrl, { headers });\n    }\n\n    // Get stateId from cookie (app-specific)\n    const cookies = request.headers.get('Cookie');\n    const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);\n    const cookieMatch = cookies?.match(oauthStateRegex);\n    const stateId = cookieMatch?.[1];\n\n    if (!stateId) {\n      throw new Error('OAuth state ID not found in cookie');\n    }\n\n    // Retrieve OAuth state from Redis\n    const oauthState = await getOAuthState(stateId);\n\n    if (!oauthState) {\n      throw new Error('No OAuth state found - state may have expired');\n    }\n\n    if (!state) {\n      throw new Error('Missing required callback state parameter');\n    }\n\n    if (oauthState.state !== state) {\n      throw new Error(`OAuth state mismatch`);\n    }\n\n    // Check state age (10 minutes max)\n    const stateAge = Date.now() - oauthState.createdAt;\n    if (stateAge > 10 * 60 * 1000) {\n      throw new Error('OAuth state expired');\n    }\n\n    if (!code) {\n      if (kcActionStatus) {\n        await deleteOAuthState(stateId);\n        const headers = new Headers();\n        headers.append('Set-Cookie', `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);\n\n        const redirectUrl = appendApplicationInitiatedActionResult(\n          oauthState.returnUrl || '/',\n          kcAction || oauthState.kcAction,\n          kcActionStatus\n        );\n\n        logger.info('Application initiated action returned without authorization code', {\n          kcAction: kcAction || oauthState.kcAction,\n          kcActionStatus,\n        });\n\n        return createRedirectResponse(redirectUrl, { headers });\n      }\n\n      throw new Error('Missing required callback code parameter');\n    }\n\n    logger.info('Initiating token exchange');\n\n    const oidcConfig = await getOAuthConfig();\n    const authorizationResponseUrl = createAuthorizationResponseUrl(request.url, config.redirectUri);\n    const tokenResult = await oidc.authorizationCodeGrant(oidcConfig, authorizationResponseUrl, {\n      pkceCodeVerifier: oauthState.codeVerifier,\n      expectedState: oauthState.state,\n      expectedNonce: oauthState.nonce,\n      idTokenExpected: config.scope.split(/\\s+/).includes('openid'),\n    });\n\n    logger.info('Token exchange completed successfully');\n\n    const claims = getClaimsFromTokenResponse(tokenResult);\n\n    // Create session data\n    const newSessionData = await createSessionData(tokenResult, claims);\n\n    // Create new session\n    const sessionHeaders = await createAuthSession(request, newSessionData);\n\n    // Clean up OAuth state from Redis\n    await deleteOAuthState(stateId);\n\n    // Combine headers and clear OAuth state cookie (app-specific)\n    const headers = new Headers(sessionHeaders);\n    headers.append('Set-Cookie', `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);\n\n    logger.info('OAuth callback processed successfully');\n\n    // Redirect to return URL or default location\n    const redirectUrl = appendApplicationInitiatedActionResult(\n      oauthState.returnUrl || '/',\n      kcAction || oauthState.kcAction,\n      kcActionStatus\n    );\n    return createRedirectResponse(redirectUrl, { headers });\n  } catch (error) {\n    logger.error('OAuth callback failed', error instanceof Error ? error : undefined);\n\n    // Try to clean up OAuth state on error\n    try {\n      const cookies = request.headers.get('Cookie');\n      const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);\n      const cookieMatch = cookies?.match(oauthStateRegex);\n      const stateId = cookieMatch?.[1];\n      if (stateId) {\n        await deleteOAuthState(stateId);\n      }\n    } catch {\n      // Ignore cleanup errors\n    }\n\n    await destroyAuthSession(request);\n    throw new Error('Authentication failed');\n  }\n}\n\n/**\n * Logout user.\n *\n * Default logout follows OIDC RP-Initiated Logout and ends the identity\n * provider session. Automatic/session-expiry cleanup can request\n * `/auth/logout?logout=local` to clear only this app's Redis session without\n * bouncing the browser through the identity provider or revoking SSO tokens.\n */\nexport async function logout(request: Request): Promise<Response> {\n  try {\n    const config = getAuthConfig();\n    const url = new URL(request.url);\n    \n    const logoutScope = getLogoutScope(url);\n    const returnUrl = sanitizeLogoutReturnUrl(url.searchParams.get('returnUrl'), request);\n    \n    logger.info('Logout initiated', { \n      clientId: config.clientId,\n      logoutScope,\n    });\n    \n    const sessionData = await getAuthSession(request);\n    const idToken = sessionData.idToken;\n\n    if (logoutScope === 'local') {\n      // Local logout is RP-only cleanup. Tokens are server-side and become\n      // unreachable once the Redis session is destroyed; revoking the refresh\n      // token can also terminate the Keycloak SSO session for this user.\n      const headers = await destroyAuthSession(request);\n      const redirectUrl = returnUrl || '/';\n      const absoluteRedirectUrl = getAbsoluteRedirectUrl(request, redirectUrl);\n\n      headers.append('Set-Cookie', 'logout_return_url=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0');\n      logger.info('Local application logout completed', { redirectUrl: absoluteRedirectUrl });\n      return createRedirectResponse(absoluteRedirectUrl, { headers });\n    }\n\n    const sessionHeaders = new Headers();\n\n    if (logoutScope === 'all' && sessionData.userId) {\n      await revokeAndDestroyAllUserSessionsBestEffort(sessionData.userId);\n      sessionHeaders.append('Set-Cookie', 'logout_return_url=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0');\n      const expiredHeaders = await destroyAuthSession(request);\n      expiredHeaders.forEach((value, key) => sessionHeaders.append(key, value));\n    } else {\n      await revokeSessionTokensBestEffort(sessionData);\n      const expiredHeaders = await destroyAuthSession(request);\n      expiredHeaders.forEach((value, key) => sessionHeaders.append(key, value));\n    }\n\n    const headers = new Headers(sessionHeaders);\n\n    // Store returnUrl in cookie if provided for the post-logout landing redirect.\n    if (returnUrl) {\n      headers.append(\n        'Set-Cookie',\n        `logout_return_url=${encodeURIComponent(returnUrl)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`\n      );\n    } else {\n      headers.append('Set-Cookie', 'logout_return_url=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0');\n    }\n\n    try {\n      const oidcConfig = await getOAuthConfig();\n      const serverMetadata = oidcConfig.serverMetadata();\n      const logoutParameters: Record<string, string> = {};\n      const expectedIssuer = serverMetadata.issuer ?? config.authority;\n\n      if (idToken && canUseIdTokenHint(idToken, expectedIssuer)) {\n        logoutParameters.id_token_hint = idToken;\n      } else if (idToken) {\n        logger.warn('Skipping id_token_hint because the session token issuer does not match the active OIDC provider', {\n          tokenIssuer: getJwtIssuer(idToken),\n          expectedIssuer: normalizeIssuer(expectedIssuer),\n          clientId: config.clientId,\n        });\n      }\n\n      if (config.postLogoutRedirectUri) {\n        logoutParameters.post_logout_redirect_uri = config.postLogoutRedirectUri;\n      }\n\n      const endSessionUrl = oidc.buildEndSessionUrl(oidcConfig, logoutParameters);\n      logger.info('RP-Initiated Logout redirect created', {\n        endSessionEndpoint: serverMetadata.end_session_endpoint,\n        hasIdTokenHint: Boolean(logoutParameters.id_token_hint),\n      });\n\n      return createRedirectResponse(endSessionUrl.toString(), { headers });\n    } catch (error) {\n      logger.warn('OIDC end_session endpoint unavailable, falling back to local redirect', {\n        error: getOAuthErrorMessage(error),\n      });\n    }\n\n    // Fallback redirect\n    const registeredPath = config.postLogoutRedirectUri || '/';\n    const finalRedirectUrl = getAbsoluteRedirectUrl(request, registeredPath);\n\n    logger.info('Logout completed', { redirectUrl: finalRedirectUrl });\n    return createRedirectResponse(finalRedirectUrl, { headers });\n  } catch (error) {\n    logger.error('Logout failed', error instanceof Error ? error : undefined);\n    const headers = await destroyAuthSession(request);\n    return createRedirectResponse('/', { headers });\n  }\n}\n\n/**\n * Handle an OIDC Back-Channel Logout request from Keycloak or another OP.\n *\n * Configure the client Backchannel logout URL to this endpoint. The logout\n * token is signature-verified against the provider JWKS, issuer/audience are\n * checked, and all matching local Redis sessions are destroyed by `sid` first,\n * falling back to `sub` when the OP omits a session id.\n */\nexport async function handleBackChannelLogout(request: Request): Promise<Response> {\n  if (request.method !== 'POST') {\n    return Response.json({ error: 'method_not_allowed' }, { status: 405 });\n  }\n\n  try {\n    const config = getAuthConfig();\n    const oidcConfig = await getOAuthConfig();\n    const serverMetadata = oidcConfig.serverMetadata();\n    const logoutToken = await getLogoutTokenFromRequest(request);\n\n    if (!logoutToken) {\n      return Response.json({ error: 'missing_logout_token' }, { status: 400 });\n    }\n\n    if (!serverMetadata.jwks_uri) {\n      throw new Error('OIDC provider does not expose jwks_uri');\n    }\n\n    const { payload } = await jwtVerify(logoutToken, getJwks(serverMetadata.jwks_uri), {\n      issuer: serverMetadata.issuer ?? config.authority,\n      audience: config.clientId,\n      clockTolerance: 60,\n    });\n\n    const claims = validateBackChannelLogoutClaims(payload as Record<string, unknown>, config.clientId);\n    const destroyedSessions = await destroyAuthSessionsByIdentitySession({\n      sid: claims.sid,\n      userId: claims.subject,\n    });\n    const result: BackChannelLogoutResult = {\n      destroyedSessions,\n      issuer: claims.issuer,\n      subject: claims.subject,\n      sid: claims.sid,\n    };\n\n    logger.info('Back-channel logout processed', { ...result });\n    return Response.json({ success: true, ...result });\n  } catch (error) {\n    logger.error('Back-channel logout failed', error instanceof Error ? error : undefined);\n    return Response.json(\n      { error: 'invalid_logout_token', error_description: getOAuthErrorMessage(error) },\n      { status: 400 }\n    );\n  }\n}\n\n/**\n * Handle OIDC Front-Channel Logout iframe/browser requests.\n *\n * Front-channel logout cannot carry a signed logout token, so this validates the\n * issuer and applies local cleanup only when a `sid` is present.\n */\nexport async function handleFrontChannelLogout(request: Request): Promise<Response> {\n  try {\n    const config = getAuthConfig();\n    const oidcConfig = await getOAuthConfig();\n    const serverMetadata = oidcConfig.serverMetadata();\n    const url = new URL(request.url);\n    const issuer = url.searchParams.get('iss');\n    const sid = url.searchParams.get('sid');\n    const expectedIssuer = normalizeIssuer(serverMetadata.issuer ?? config.authority);\n\n    if (!issuer || normalizeIssuer(issuer) !== expectedIssuer) {\n      return new Response(null, { status: 204 });\n    }\n\n    const destroyedSessions = sid ? await destroyAuthSessionsBySid(sid) : 0;\n    const result: FrontChannelLogoutResult = {\n      destroyedSessions,\n      issuer,\n      sid: sid ?? undefined,\n    };\n\n    logger.info('Front-channel logout processed', { ...result });\n    return new Response(null, {\n      status: 204,\n      headers: {\n        'Cache-Control': 'no-store',\n      },\n    });\n  } catch (error) {\n    logger.warn('Front-channel logout ignored', {\n      error: getOAuthErrorMessage(error),\n    });\n\n    return new Response(null, { status: 204 });\n  }\n}\n\n/**\n * Get current user from session\n */\nexport async function getUser(request: Request): Promise<UserInfo | null> {\n  try {\n    const sessionData = await getAuthSession(request);\n    return sessionData.user || null;\n  } catch (error) {\n    logger.error('Failed to get user', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\n/**\n * Require authenticated user (throws redirect to login if not authenticated)\n */\nexport async function requireAuth(request: Request): Promise<UserInfo> {\n  const user = await getUser(request);\n\n  if (!user) {\n    const url = new URL(request.url);\n    const returnUrl = `${url.pathname}${url.search}`;\n    logger.info('No user found, starting OAuth flow', { returnUrl });\n    throw await login(request, returnUrl);\n  }\n\n  return user;\n}\n\n/**\n * Get access token from session\n */\nexport async function getAccessToken(request: Request): Promise<string | null> {\n  try {\n    const sessionData = await getAuthSession(request);\n    return sessionData.accessToken || null;\n  } catch (error) {\n    logger.error('Failed to get access token', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\n/**\n * Refresh tokens\n */\nexport async function refreshTokens(\n  request: Request,\n  refreshToken?: string\n): Promise<TokenRefreshResult> {\n  try {\n    const sessionData = await getAuthSession(request);\n    const tokenToRefresh = refreshToken || sessionData.refreshToken;\n\n    if (!tokenToRefresh) {\n      logger.warn('No refresh token available');\n      return { success: false, error: 'No refresh token available', shouldLogout: true };\n    }\n\n    logger.info('Initiating token refresh');\n\n    const oidcConfig = await getOAuthConfig();\n    const refreshResult = await oidc.refreshTokenGrant(oidcConfig, tokenToRefresh);\n\n    logger.info('Token refresh successful');\n\n    const newRefreshToken = refreshResult.refresh_token || tokenToRefresh;\n    const expiresAt = refreshResult.expires_in\n      ? Date.now() + refreshResult.expires_in * 1000\n      : sessionData.expiresAt;\n\n    // Update session\n    await updateAuthSession(request, {\n      accessToken: refreshResult.access_token,\n      refreshToken: newRefreshToken,\n      idToken: refreshResult.id_token,\n      expiresAt,\n      lastActivity: Date.now(),\n    });\n\n    return {\n      success: true,\n      tokens: {\n        access_token: refreshResult.access_token,\n        refresh_token: newRefreshToken,\n        id_token: refreshResult.id_token,\n        expires_in: refreshResult.expires_in,\n      },\n    };\n  } catch (error) {\n    logger.error('Token refresh failed with exception', error instanceof Error ? error : undefined);\n\n    return {\n      success: false,\n      error: getOAuthErrorMessage(error),\n      shouldLogout: shouldLogoutAfterOAuthError(error),\n    };\n  }\n}\n\n// Re-export session validation\nexport { isSessionValid };\n\n/**\n * Clear auth server cache (useful for testing)\n */\nexport function clearAuthServerCache(): void {\n  authServerCache = null;\n  jwksCache.clear();\n}\n","/**\n * Route Protection Server Module\n * \n * Provides route protection utilities for different authentication levels.\n */\n\nimport { getUser, requireAuth, refreshTokens, login, logout } from './auth.server';\nimport { getAuthSession } from './redis-session-storage.server';\nimport type { ProtectionLevel, UserInfo } from './types';\nimport { logger } from '../logging';\nimport { createRedirectResponse } from '../http/response';\n\n// Refresh shortly before expiry. Keep this below common 5-minute access-token\n// lifetimes so a freshly issued token does not refresh again immediately.\nconst REFRESH_THRESHOLD = resolveRefreshThreshold();\n\nfunction resolveRefreshThreshold(): number {\n  const configured = Number(process.env.OIDC_REFRESH_THRESHOLD_MS);\n  return Number.isFinite(configured) && configured > 0 ? configured : 60_000;\n}\n\n/**\n * Check if token needs refresh\n */\nexport async function shouldRefreshToken(request: Request): Promise<boolean> {\n  try {\n    const sessionData = await getAuthSession(request);\n\n    if (!sessionData.refreshToken || sessionData.refreshToken.length === 0) {\n      if (sessionData.expiresAt && Date.now() >= sessionData.expiresAt) {\n        logger.info('Token expired and no refresh token, forcing local application logout');\n        const logoutRequest = await createAutomaticLogoutRequest(request, 'expired-no-refresh-token');\n        throw await logout(logoutRequest);\n      }\n      return false;\n    }\n\n    if (!sessionData.expiresAt || !sessionData.accessToken) {\n      return false;\n    }\n\n    const now = Date.now();\n\n    // Check JWT expiry\n    let jwtExpiry: number | null = null;\n    try {\n      const tokenParts = sessionData.accessToken.split('.');\n      if (tokenParts.length === 3) {\n        const payload = JSON.parse(Buffer.from(tokenParts[1], 'base64').toString());\n        if (payload.exp) {\n          jwtExpiry = payload.exp * 1000;\n        }\n      }\n    } catch {\n      // Ignore JWT decode errors\n    }\n\n    const earliestExpiry = jwtExpiry && jwtExpiry < sessionData.expiresAt \n      ? jwtExpiry \n      : sessionData.expiresAt;\n    const timeUntilEarliestExpiry = earliestExpiry - now;\n\n    return timeUntilEarliestExpiry <= REFRESH_THRESHOLD;\n  } catch (error) {\n    logger.error('Error checking token refresh', error instanceof Error ? error : undefined);\n    return false;\n  }\n}\n\n/**\n * Auto-refresh tokens if needed\n */\nasync function autoRefreshTokens(request: Request): Promise<void> {\n  try {\n    const needsRefresh = await shouldRefreshToken(request);\n\n    if (needsRefresh) {\n      logger.info('Auto-refreshing tokens due to expiry');\n      const result = await refreshTokens(request);\n\n      if (result.success) {\n        logger.info('Auto-refresh completed successfully');\n      } else {\n        logger.error('Auto-refresh failed', undefined, { error: result.error });\n\n        if (result.shouldLogout) {\n          logger.error('Refresh token invalid, forcing local application logout');\n          const logoutRequest = await createAutomaticLogoutRequest(request, 'refresh-failed');\n          throw await logout(logoutRequest);\n        }\n      }\n    }\n  } catch (error) {\n    if (error instanceof Response && error.status >= 300 && error.status < 400) {\n      throw error;\n    }\n    throw error;\n  }\n}\n\n/**\n * Identity context check configuration\n */\nexport interface DefaultRouteIdentityContext {\n  hasAnyMembership: boolean;\n  hasEntitlement?: boolean;\n  /** @deprecated Use hasEntitlement or app-specific fields instead. */\n  hasSubscription: boolean;\n  isOnboarded: boolean;\n}\n\nexport interface IdentityContextChecker<TIdentityContext = DefaultRouteIdentityContext> {\n  getIdentityContext: (\n    request: Request,\n    userId: string,\n    forceRefresh?: boolean\n  ) => Promise<DefaultRouteIdentityContext & TIdentityContext>;\n}\n\n/**\n * Tenant checker configuration\n */\nexport interface TenantChecker {\n  getCurrentTenant: (request: Request) => Promise<string | null>;\n  initializeTenant: (request: Request) => Promise<{ headers: Headers; tenantId: string } | null>;\n}\n\n/**\n * Legacy subscription checker configuration\n *\n * @deprecated Put entitlement policy in resolveRoute or app-level route loaders.\n */\nexport interface SubscriptionChecker {\n  checkTenantSubscriptionStatus: (request: Request, tenantId: string) => Promise<boolean>;\n}\n\nexport interface RouteProtectionRedirect {\n  location: string;\n  headers?: HeadersInit;\n  status?: number;\n}\n\nexport interface AutomaticLogoutRequestContext {\n  request: Request;\n  reason: 'expired-no-refresh-token' | 'refresh-failed';\n}\n\nexport interface LoginReturnUrlContext {\n  request: Request;\n  currentPath: string;\n  protection: ProtectionLevel;\n}\n\nexport interface RouteProtectionResolverContext<TIdentityContext = DefaultRouteIdentityContext> {\n  request: Request;\n  user: UserInfo;\n  currentPath: string;\n  protection: ProtectionLevel;\n  getIdentityContext: (forceRefresh?: boolean) => Promise<TIdentityContext | null>;\n  getCurrentTenant: () => Promise<string | null>;\n  initializeTenant: () => Promise<{ headers: Headers; tenantId: string } | null>;\n}\n\nexport interface RouteProtectionErrorHandlerContext<TIdentityContext = DefaultRouteIdentityContext>\n  extends RouteProtectionResolverContext<TIdentityContext> {\n  error: unknown;\n}\n\n/**\n * Route protection configuration\n */\nexport interface RouteProtectionConfig<TIdentityContext = DefaultRouteIdentityContext> {\n  identityChecker?: IdentityContextChecker<TIdentityContext>;\n  tenantChecker?: TenantChecker;\n  subscriptionChecker?: SubscriptionChecker;\n  resolveRoute?: (\n    context: RouteProtectionResolverContext<TIdentityContext>\n  ) => Promise<RouteProtectionRedirect | null | void> | RouteProtectionRedirect | null | void;\n  handleRouteError?: (\n    context: RouteProtectionErrorHandlerContext<TIdentityContext>\n  ) => Promise<RouteProtectionRedirect | null | void> | RouteProtectionRedirect | null | void;\n  getLoginReturnUrl?: (context: LoginReturnUrlContext) => string;\n  createAutomaticLogoutRequest?: (\n    context: AutomaticLogoutRequestContext\n  ) => Promise<Request> | Request;\n}\n\nlet protectionConfig: RouteProtectionConfig<any> = {};\n\n/**\n * Configure route protection with identity, tenant, and app policy checkers\n */\nexport function configureRouteProtection<TIdentityContext = DefaultRouteIdentityContext>(\n  config: RouteProtectionConfig<TIdentityContext>\n): void {\n  protectionConfig = config;\n}\n\n/**\n * Reset route protection to its built-in defaults.\n */\nexport function resetRouteProtectionConfig(): void {\n  protectionConfig = {};\n}\n\nfunction createRedirectFromConfig(redirect: RouteProtectionRedirect): Response {\n  return createRedirectResponse(redirect.location, {\n    headers: redirect.headers,\n    status: redirect.status,\n  });\n}\n\nfunction getLoginReturnUrl(\n  request: Request,\n  currentPath: string,\n  protection: ProtectionLevel\n): string {\n  if (protectionConfig.getLoginReturnUrl) {\n    return protectionConfig.getLoginReturnUrl({\n      request,\n      currentPath,\n      protection,\n    });\n  }\n\n  switch (protection) {\n    case 'onboarding-required':\n    case 'subscription-required':\n    case 'public':\n    case 'auth':\n    default: {\n      const url = new URL(request.url);\n      return url.pathname === '/' ? '/' : `${url.pathname}${url.search}`;\n    }\n  }\n}\n\nasync function createAutomaticLogoutRequest(\n  request: Request,\n  reason: AutomaticLogoutRequestContext['reason']\n): Promise<Request> {\n  if (protectionConfig.createAutomaticLogoutRequest) {\n    return protectionConfig.createAutomaticLogoutRequest({ request, reason });\n  }\n\n  const logoutUrl = new URL(request.url);\n  logoutUrl.pathname = '/auth/logout';\n  logoutUrl.searchParams.set('logout', 'local');\n\n  return new Request(logoutUrl.toString(), {\n    headers: request.headers,\n  });\n}\n\nfunction createRouteResolverContext(\n  request: Request,\n  user: UserInfo,\n  currentPath: string,\n  protection: ProtectionLevel\n): RouteProtectionResolverContext<any> {\n  let identityContextPromise: Promise<any | null> | null = null;\n  let currentTenantPromise: Promise<string | null> | null = null;\n  let initializeTenantPromise: Promise<{ headers: Headers; tenantId: string } | null> | null = null;\n\n  return {\n    request,\n    user,\n    currentPath,\n    protection,\n    getIdentityContext: async (forceRefresh = false) => {\n      if (!protectionConfig.identityChecker) {\n        return null;\n      }\n\n      if (forceRefresh) {\n        return protectionConfig.identityChecker.getIdentityContext(request, user.sub, true);\n      }\n\n      if (!identityContextPromise) {\n        identityContextPromise = protectionConfig.identityChecker.getIdentityContext(request, user.sub);\n      }\n\n      return identityContextPromise;\n    },\n    getCurrentTenant: async () => {\n      if (!protectionConfig.tenantChecker) {\n        return null;\n      }\n\n      if (!currentTenantPromise) {\n        currentTenantPromise = protectionConfig.tenantChecker.getCurrentTenant(request);\n      }\n\n      return currentTenantPromise;\n    },\n    initializeTenant: async () => {\n      if (!protectionConfig.tenantChecker) {\n        return null;\n      }\n\n      if (!initializeTenantPromise) {\n        initializeTenantPromise = protectionConfig.tenantChecker.initializeTenant(request);\n      }\n\n      return initializeTenantPromise;\n    },\n  };\n}\n\nasync function applyConfiguredRouteResolution(\n  request: Request,\n  user: UserInfo,\n  currentPath: string,\n  protection: ProtectionLevel\n): Promise<boolean> {\n  if (!protectionConfig.resolveRoute) {\n    return false;\n  }\n\n  const context = createRouteResolverContext(request, user, currentPath, protection);\n\n  try {\n    const result = await protectionConfig.resolveRoute(context);\n    if (result) {\n      throw createRedirectFromConfig(result);\n    }\n\n    return true;\n  } catch (error) {\n    if (error instanceof Response && error.status >= 300 && error.status < 400) {\n      throw error;\n    }\n\n    if (!protectionConfig.handleRouteError) {\n      throw error;\n    }\n\n    const recovery = await protectionConfig.handleRouteError({\n      ...context,\n      error,\n    });\n\n    if (recovery) {\n      throw createRedirectFromConfig(recovery);\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Main route protection function\n */\nexport async function protectRoute<T>(\n  request: Request,\n  protection: ProtectionLevel,\n  loaderFn: (user?: UserInfo) => Promise<T> | T\n): Promise<T> {\n  const url = new URL(request.url);\n\n  switch (protection) {\n    case 'public':\n      try {\n        await autoRefreshTokens(request);\n        const user = await getUser(request);\n        return loaderFn(user ?? undefined);\n      } catch {\n        return loaderFn(undefined);\n      }\n\n    case 'auth':\n    case 'policy':\n      try {\n        await autoRefreshTokens(request);\n        const user = await requireAuth(request);\n        await applyConfiguredRouteResolution(request, user, url.pathname, protection);\n        return loaderFn(user);\n      } catch (error) {\n        if (error instanceof Response && error.status >= 300 && error.status < 400) {\n          throw error;\n        }\n        throw await login(request, getLoginReturnUrl(request, url.pathname, protection));\n      }\n\n    case 'onboarding-required':\n      try {\n        await autoRefreshTokens(request);\n        const user = await requireAuth(request);\n\n        await applyConfiguredRouteResolution(\n          request,\n          user,\n          url.pathname,\n          'onboarding-required'\n        );\n\n        return loaderFn(user);\n      } catch (error) {\n        if (error instanceof Response && error.status >= 300 && error.status < 400) {\n          throw error;\n        }\n        throw await login(request, getLoginReturnUrl(request, url.pathname, 'onboarding-required'));\n      }\n\n    case 'subscription-required':\n      try {\n        await autoRefreshTokens(request);\n        const user = await requireAuth(request);\n\n        await applyConfiguredRouteResolution(\n          request,\n          user,\n          url.pathname,\n          'subscription-required'\n        );\n\n        // Initialize tenant if needed\n        if (protectionConfig.tenantChecker) {\n          const currentTenant = await protectionConfig.tenantChecker.getCurrentTenant(request);\n          if (!currentTenant) {\n            await protectionConfig.tenantChecker.initializeTenant(request);\n          }\n        }\n\n        return loaderFn(user);\n      } catch (error) {\n        if (error instanceof Response && error.status >= 300 && error.status < 400) {\n          throw error;\n        }\n        throw await login(request, getLoginReturnUrl(request, url.pathname, 'subscription-required'));\n      }\n\n    default:\n      throw new Error(`Unknown protection level: ${protection}`);\n  }\n}\n\n// ============================================================================\n// Convenience Functions\n// ============================================================================\n\n/**\n * Public route (optional auth)\n */\nexport const publicRoute = <T>(\n  request: Request,\n  loaderFn: (user?: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'public', loaderFn);\n\n/**\n * Auth-protected route\n */\nexport const authRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'auth', loaderFn as (user?: UserInfo) => Promise<T> | T);\n\n/**\n * Generic policy-protected route. Apps define policy in configureRouteProtection.\n */\nexport const policyRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'policy', loaderFn as (user?: UserInfo) => Promise<T> | T);\n\n/**\n * Alias for auth-protected routes.\n */\nexport const protectedRoute = authRoute;\n\n/**\n * Setup policy route\n *\n * @deprecated Use policyRoute with configureRouteProtection instead.\n */\nexport const onboardingRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'onboarding-required', loaderFn as (user?: UserInfo) => Promise<T> | T);\n\n/**\n * Entitlement policy route\n *\n * @deprecated Use policyRoute with configureRouteProtection instead.\n */\nexport const subscriptionRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'subscription-required', loaderFn as (user?: UserInfo) => Promise<T> | T);\n","/**\n * Token Refresh Server Module\n */\n\nimport { refreshTokens } from './auth.server';\nimport { getAuthSession } from './redis-session-storage.server';\nimport type { TokenRefreshResult } from './types';\nimport { logger } from '../logging';\n\n/**\n * Attempt to refresh the access token\n */\nexport async function attemptTokenRefresh(request: Request): Promise<TokenRefreshResult> {\n  try {\n    logger.info('Attempting token refresh due to 401 response');\n\n    const sessionData = await getAuthSession(request);\n\n    if (!sessionData.refreshToken) {\n      logger.warn('No refresh token available in session');\n      return {\n        success: false,\n        error: 'No refresh token available',\n        shouldLogout: true,\n      };\n    }\n\n    const refreshResult = await refreshTokens(request, sessionData.refreshToken);\n\n    if (!refreshResult.success) {\n      logger.error('Token refresh failed', undefined, {\n        error: refreshResult.error,\n        shouldLogout: refreshResult.shouldLogout,\n      });\n\n      return {\n        success: false,\n        error: refreshResult.error,\n        shouldLogout: refreshResult.shouldLogout,\n      };\n    }\n\n    const tokens = refreshResult.tokens;\n    if (!tokens || !tokens.access_token) {\n      logger.error('Token refresh succeeded but no access token returned');\n      return {\n        success: false,\n        error: 'No access token in refresh response',\n        shouldLogout: true,\n      };\n    }\n\n    logger.info('Token refresh successful');\n\n    return {\n      success: true,\n      newAccessToken: tokens.access_token,\n    };\n  } catch (error) {\n    logger.error('Token refresh attempt failed', error instanceof Error ? error : undefined);\n    return {\n      success: false,\n      error: error instanceof Error ? error.message : 'Unknown error',\n      shouldLogout: true,\n    };\n  }\n}\n\n/**\n * Check if a response indicates token expiration\n */\nexport function isTokenExpiredResponse(response: Response): boolean {\n  return response.status === 401;\n}\n\n/**\n * Check if token refresh should be attempted\n */\nexport function shouldAttemptTokenRefresh(response: Response, hasAuth: boolean): boolean {\n  return hasAuth && isTokenExpiredResponse(response);\n}\n"],"mappings":";;;;;;;;AAYA,SAAgB,uBACd,UACA,OAA6B,CAAC,GACpB;CACV,MAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;CACxC,QAAQ,IAAI,YAAY,QAAQ;CAEhC,OAAO,IAAI,SAAS,MAAM;EACxB,QAAQ,KAAK,UAAU;EACvB;CACF,CAAC;AACH;;;ACrBA,MAAM,yDAAyC,IAAI,IAAI;CACrD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,8DAA8C,IAAI,IAAI;CAC1D;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,qCACP,KACA,cACA,iBACS;CACT,MAAM,aAAa,IAAI,YAAY;CACnC,OAAO,aAAa,IAAI,UAAU,KAAK,gBAAgB,MAAM,WAAW,WAAW,WAAW,MAAM,CAAC;AACvG;AAEA,SAAgB,qCACd,QACA,UAAgF,CAAC,GACzD;CACxB,IAAI,CAAC,QACH,OAAO,CAAC;CAGV,MAAM,+BAAe,IAAI,IAAI,CAC3B,GAAG,6CACH,IAAI,QAAQ,uBAAuB,CAAC,EAAA,CAAG,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,OAAO,CAChG,CAAC;CACD,MAAM,mBAAmB,QAAQ,0BAA0B,CAAC,EAAA,CACzD,KAAK,WAAW,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAC5C,OAAO,OAAO;CACjB,MAAM,YAAoC,CAAC;CAE3C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;EACjD,MAAM,gBAAgB,IAAI,KAAK;EAC/B,IACE,cAAc,WAAW,KACzB,uCAAuC,IAAI,cAAc,YAAY,CAAC,KACtE,CAAC,qCAAqC,eAAe,cAAc,eAAe,KAClF,UAAU,QACV,UAAU,KAAA,GAEV;EAGF,MAAM,kBAAkB,OAAO,KAAK,CAAC,CAAC,KAAK;EAC3C,IAAI,gBAAgB,WAAW,GAC7B;EAGF,UAAU,iBAAiB;CAC7B;CAEA,OAAO;AACT;AAEA,SAAgB,yCACd,SAC+B;CAC/B,IAAI,CAAC,SACH,OAAO;CAGT,MAAM,aAAqC,CAAC;CAE5C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;EAClD,MAAM,gBAAgB,IAAI,KAAK;EAC/B,IACE,cAAc,WAAW,KACzB,uCAAuC,IAAI,cAAc,YAAY,CAAC,KACtE,UAAU,QACV,UAAU,KAAA,GAEV;EAGF,MAAM,kBAAkB,OAAO,KAAK,CAAC,CAAC,KAAK;EAC3C,IAAI,gBAAgB,WAAW,GAC7B;EAGF,WAAW,iBAAiB;CAC9B;CAEA,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,SAAS,IAAI,aAAa;AAC3D;AAEA,SAAgB,wBACd,WACA,oBACQ;CACR,MAAM,oBAAoB,yCAAyC,kBAAkB;CACrF,IAAI,CAAC,mBACH,OAAO;CAGT,OAAO,GAAG,UAAU,GAAG,OAAO,KAAK,KAAK,UAAU,iBAAiB,GAAG,MAAM,CAAC,CAAC,SAAS,WAAW;AACpG;;;;;;;;;;;;;;;;ACrDA,SAAS,2BAA2B,QAA6B;CAE/D,IAAI,OAAO,mBAAmB,KAAA,GAC5B,OAAO,OAAO;CAIhB,QAAQ,OAAO,iBAAf;EACE,KAAK;EACL,KAAK,aACH,OAAO;EACT,KAAK;EACL,KAAK,cACH,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;AAKA,SAAS,mBAA+B;CACtC,MAAM,kBAAkB;EACtB,WAAW,QAAQ,IAAI;EACvB,UAAU,QAAQ,IAAI;EACtB,aAAa,QAAQ,IAAI;CAC3B;CAEA,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,eAAe,GACvD,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,+CAA+C,IAAI,YAAY,GAAG;CAKtF,MAAM,aAAa,QAAQ,IAAI,uBAAuB,YAAY;CAClE,IAAI,kBAAmC;CACvC,IAAI,eAAe,qBAAqB,eAAe,mBACrD,kBAAkB;MACb,IAAI,eAAe,kBAAkB,eAAe,gBACzD,kBAAkB;MACb,IAAI,eAAe,aACxB,kBAAkB;MACb,IAAI,eAAe,gBAAgB,eAAe,cACvD,kBAAkB;CAGpB,MAAM,mBAAmB,0BACvB,QAAQ,IAAI,yBACZ,QAAQ,IAAI,qBAAqB,uBAAuB,MAC1D;CAEA,MAAM,iBAAiB,QAAQ,IAAI,0BAA0B,KAAA,IACzD,QAAQ,IAAI,0BAA0B,SACtC,KAAA;CAEJ,OAAO;EACL,WAAW,gBAAgB;EAC3B,UAAU,gBAAgB;EAC1B,cAAc,QAAQ,IAAI;EAC1B;EACA,aAAa,gBAAgB;EAC7B,OAAO,QAAQ,IAAI,cAAc;EACjC,uBAAuB,QAAQ,IAAI;EACnC;EACA;CACF;AACF;AAEA,SAAS,0BACP,OACA,UACsB;CAGtB,QAFmB,OAAO,KAAK,CAAC,CAAC,YAAY,GAE7C;EACE,KAAK,KAAA;EACL,KAAK,IACH,OAAO;EACT,KAAK,QACH,OAAO;EACT,KAAK;EACL,KAAK,QACH,OAAO;EACT,KAAK;EACL,KAAK,SACH,OAAO;EACT,SACE,MAAM,IAAI,MAAM,wCAAwC,OAAO;CACnE;AACF;AAEA,IAAI,cAAiC;AAErC,SAAS,gBAA4B;CACnC,IAAI,CAAC,aACH,cAAc,iBAAiB;CAEjC,OAAO;AACT;AAMA,IAAI,kBAGO;AAEX,MAAM,YAAY,OAAU;AAC5B,MAAM,4BAAY,IAAI,IAAmD;AAEzE,SAAS,gBAAgB,OAA0C;CACjE,MAAM,aAAa,OAAO,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE;CACnD,OAAO,cAAc,WAAW,SAAS,IAAI,aAAa;AAC5D;AAEA,SAAS,aAAa,OAA2D;CAC/E,IAAI,CAAC,OACH,OAAO;CAGT,IAAI;EACF,MAAM,GAAG,WAAW,MAAM,MAAM,GAAG;EACnC,IAAI,CAAC,SACH,OAAO;EAGT,OAAO,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;CACtE,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,aAAa,OAA0C;CAC9D,MAAM,SAAS,aAAa,KAAK,CAAC,EAAE;CACpC,OAAO,OAAO,WAAW,WAAW,gBAAgB,MAAM,IAAI;AAChE;AAEA,SAAS,kBAAkB,SAA6B,gBAAiC;CACvF,IAAI,CAAC,SACH,OAAO;CAGT,MAAM,cAAc,aAAa,OAAO;CACxC,OAAO,gBAAgB,QAAQ,gBAAgB,gBAAgB,cAAc;AAC/E;AAEA,SAAS,wBAAwB,WAA0B,SAAiC;CAC1F,IAAI,CAAC,WACH,OAAO;CAGT,IAAI;EACF,MAAM,aAAa,IAAI,IAAI,QAAQ,GAAG;EACtC,MAAM,mBAAmB,mBAAmB,SAAS;EAErD,IAAI,iBAAiB,WAAW,GAAG,KAAK,CAAC,iBAAiB,WAAW,IAAI,GACvE,OAAO,eAAe,gBAAgB,IAAI,OAAO;EAGnD,MAAM,eAAe,IAAI,IAAI,gBAAgB;EAC7C,IAAI,aAAa,WAAW,WAAW,QACrC,OAAO;EAGT,MAAM,iBAAiB,GAAG,aAAa,WAAW,aAAa,SAAS,aAAa;EACrF,OAAO,eAAe,cAAc,IAAI,OAAO;CACjD,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,uCACP,WACA,QACA,QACQ;CACR,IAAI,CAAC,UAAU,CAAC,QACd,OAAO;CAGT,IAAI;EACF,MAAM,aAAa,UAAU,WAAW,GAAG,KAAK,CAAC,UAAU,WAAW,IAAI;EAC1E,MAAM,MAAM,IAAI,IAAI,WAAW,aAAa,uBAAuB,KAAA,CAAS;EAE5E,IAAI,QACF,IAAI,aAAa,IAAI,aAAa,MAAM;EAG1C,IAAI,QACF,IAAI,aAAa,IAAI,oBAAoB,MAAM;EAGjD,OAAO,aAAa,GAAG,IAAI,WAAW,IAAI,SAAS,IAAI,SAAS,IAAI,SAAS;CAC/E,QAAQ;EACN,MAAM,SAAS,IAAI,gBAAgB;EACnC,IAAI,QAAQ,OAAO,IAAI,aAAa,MAAM;EAC1C,IAAI,QAAQ,OAAO,IAAI,oBAAoB,MAAM;EAEjD,OAAO,GAAG,YADQ,UAAU,SAAS,GAAG,IAAI,MAAM,MAChB,OAAO,SAAS;CACpD;AACF;AAEA,SAAgB,+BAA+B,YAAoB,aAA0B;CAC3F,MAAM,cAAc,IAAI,IAAI,UAAU;CACtC,MAAM,2BAA2B,IAAI,IAAI,WAAW;CACpD,yBAAyB,SAAS,YAAY;CAC9C,yBAAyB,OAAO;CAChC,OAAO;AACT;AAEA,SAAS,eAAe,MAAuB;CAC7C,MAAM,aAAa,KAAK,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,QAAQ,EAAE,KAAK;CAC3E,OAAO,eAAe,kBAAkB,eAAe;AACzD;AAEA,SAAS,sBAAsB,WAA4B;CACzD,IAAI;EACF,MAAM,SAAS,IAAI,IAAI,SAAS;EAChC,OACE,OAAO,aAAa,WACpB;GAAC;GAAa;GAAa;GAAO;EAAO,CAAC,CAAC,SAAS,OAAO,QAAQ;CAEvE,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,gCAAgC,WAA4B;CACnE,IAAI,QAAQ,IAAI,aAAa,cAC3B,OAAO;CAGT,IAAI,QAAQ,IAAI,iCAAiC,QAC/C,OAAO;CAGT,OAAO,sBAAsB,SAAS;AACxC;AAEA,SAAS,sBAAoD;CAG3D,OAAO,gCAFQ,cAE6B,CAAC,CAAC,SAAS,IACnD;EAAE,WAAW;EAAQ,SAAS,CAAC,KAAK,qBAAqB;CAAE,IAC3D,EAAE,WAAW,OAAO;AAC1B;AAEA,SAAS,kBAAkB,QAAwC;CACjE,OAAO,OAAO,qBAAqB,SAAS,KAAA,IAAY,OAAO;AACjE;AAEA,SAAS,wBAAwB,QAAqC;CACpE,QAAQ,OAAO,kBAAf;EACE,KAAK;GACH,IAAI,CAAC,OAAO,cACV,MAAM,IAAI,MAAM,uEAAuE;GAGzF,OAAO,KAAK,kBAAkB,OAAO,YAAY;EACnD,KAAK;GACH,IAAI,CAAC,OAAO,cACV,MAAM,IAAI,MAAM,sEAAsE;GAGxF,OAAO,KAAK,iBAAiB,OAAO,YAAY;EAElD,SACE,OAAO,KAAK,KAAK;CACrB;AACF;AAEA,SAAS,qBAAqB,OAAwB;CACpD,IAAI,iBAAiB,KAAK,mBACxB,OAAO,MAAM,qBAAqB,MAAM,SAAS,MAAM;CAGzD,IAAI,iBAAiB,OACnB,OAAO,MAAM;CAGf,OAAO;AACT;AAEA,SAAS,4BAA4B,OAAyB;CAC5D,IAAI,iBAAiB,KAAK,mBACxB,OACE,MAAM,WAAW,OACjB,MAAM,WAAW,OACjB,MAAM,UAAU,mBAChB,MAAM,UAAU;CAIpB,MAAM,UAAU,iBAAiB,QAAQ,MAAM,QAAQ,YAAY,IAAI;CACvE,OAAO,QAAQ,SAAS,eAAe,KAAK,QAAQ,SAAS,eAAe,KAAK,QAAQ,SAAS,cAAc;AAClH;AAEA,SAAS,eAAe,KAAuB;CAK7C,MAAM,cAHJ,IAAI,aAAa,IAAI,QAAQ,KAC7B,IAAI,aAAa,IAAI,cAAc,KACnC,IAAI,aAAa,IAAI,OAAO,EAAA,EACK,KAAK,CAAC,CAAC,YAAY;CAEtD,IACE,eAAe,WACf,eAAe,iBACf,eAAe,SACf,eAAe,kBAEf,OAAO;CAGT,IACE,eAAe,SACf,eAAe,eACf,eAAe,iBACf,eAAe,cAEf,OAAO;CAGT,IAAI,IAAI,aAAa,IAAI,YAAY,MAAM,UAAU,IAAI,aAAa,IAAI,gBAAgB,MAAM,QAC9F,OAAO;CAGT,OAAO;AACT;AAEA,SAAS,uBAAuB,SAAkB,aAA6B;CAC7E,IAAI,gBAAgB,KAAK,WAAW,GAClC,OAAO;CAGT,OAAO,IAAI,IAAI,aAAa,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;AACpE;AAEA,eAAe,sBACb,eACA,OACA,eACe;CACf,IAAI,CAAC,OACH;CAGF,IAAI;EACF,MAAM,KAAK,gBAAgB,eAAe,OAAO,EAC/C,iBAAiB,cACnB,CAAC;CACH,SAAS,OAAO;EACd,OAAO,KAAK,gCAAgC;GAC1C;GACA,OAAO,qBAAqB,KAAK;EACnC,CAAC;CACH;AACF;AAEA,eAAe,8BAA8B,aAAyC;CACpF,IAAI,CAAC,YAAY,gBAAgB,CAAC,YAAY,aAC5C;CAGF,IAAI;EACF,MAAM,gBAAgB,MAAM,eAAe;EAC3C,MAAM,sBAAsB,eAAe,YAAY,cAAc,eAAe;EACpF,MAAM,sBAAsB,eAAe,YAAY,aAAa,cAAc;CACpF,SAAS,OAAO;EACd,OAAO,KAAK,gFAAgF,EAC1F,OAAO,qBAAqB,KAAK,EACnC,CAAC;CACH;AACF;AAEA,eAAe,0CAA0C,QAAiC;CACxF,MAAM,WAAW,MAAM,2BAA2B,MAAM;CAExD,IAAI;EACF,MAAM,gBAAgB,MAAM,eAAe;EAC3C,KAAK,MAAM,EAAE,UAAU,UAAU;GAC/B,MAAM,sBAAsB,eAAe,KAAK,cAAc,eAAe;GAC7E,MAAM,sBAAsB,eAAe,KAAK,aAAa,cAAc;EAC7E;CACF,SAAS,OAAO;EACd,OAAO,KAAK,uFAAuF,EACjG,OAAO,qBAAqB,KAAK,EACnC,CAAC;CACH;CAEA,OAAO,MAAM,2BAA2B,MAAM;AAChD;AAEA,SAAS,2BAA2B,aAAyD;CAC3F,MAAM,SAAS,YAAY,OAAO;CAElC,IAAI,QACF,OAAO;CAGT,OAAO,aAAa,YAAY,QAAQ,KAAK,CAAC;AAChD;;;;AAKA,eAAe,iBAA8C;CAC3D,MAAM,SAAS,cAAc;CAC7B,MAAM,MAAM,KAAK,IAAI;CAErB,IAAI,mBAAmB,MAAM,gBAAgB,WAAW,WACtD,OAAO,gBAAgB;CAGzB,IAAI;EACF,MAAM,gBAAgB,MAAM,KAAK,UAC/B,IAAI,IAAI,OAAO,SAAS,GACxB,OAAO,UACP,kBAAkB,MAAM,GACxB,wBAAwB,MAAM,GAC9B,oBAAoB,CACtB;EAEA,kBAAkB;GAChB;GACA,UAAU;EACZ;EAEA,OAAO,KAAK,yCAAyC;GACnD,QAAQ,cAAc,eAAe,CAAC,CAAC;GACvC,UAAU,OAAO;GACjB,kBAAkB,OAAO;EAC3B,CAAC;EACD,OAAO;CACT,SAAS,OAAO;EACd,OAAO,MAAM,yBAAyB,iBAAiB,QAAQ,QAAQ,KAAA,GAAW;GAChF,WAAW,OAAO;GAClB,UAAU,OAAO;EACnB,CAAC;EACD,MAAM,IAAI,MAAM,0BAA0B,qBAAqB,KAAK,GAAG;CACzE;AACF;AAEA,SAAS,QAAQ,SAAwD;CACvE,MAAM,aAAa,UAAU,IAAI,OAAO;CACxC,IAAI,YACF,OAAO;CAGT,MAAM,OAAO,mBAAmB,IAAI,IAAI,OAAO,CAAC;CAChD,UAAU,IAAI,SAAS,IAAI;CAC3B,OAAO;AACT;AAEA,eAAe,0BAA0B,SAA0C;CAGjF,KAFoB,QAAQ,QAAQ,IAAI,cAAc,KAAK,GAAA,CAE3C,SAAS,kBAAkB,GAAG;EAC5C,MAAM,OAAO,MAAM,QAAQ,KAAK,CAAC,CAAC,YAAY,IAAI;EAClD,OAAO,OAAO,MAAM,iBAAiB,WAAW,KAAK,eAAe;CACtE;CAGA,MAAM,eAAc,MADG,QAAQ,SAAS,CAAC,CAAC,YAAY,IAAI,EAAA,EAC5B,IAAI,cAAc;CAChD,OAAO,OAAO,gBAAgB,WAAW,cAAc;AACzD;AAEA,SAAS,gCAAgC,SAAkC,UAIzE;CACA,MAAM,SAAS,QAAQ;CAOvB,IAAI,EALF,UACA,OAAO,WAAW,YAClB,CAAC,MAAM,QAAQ,MAAM,KACrB,wDAAwD,SAGxD,MAAM,IAAI,MAAM,sEAAsE;CAGxF,IAAI,WAAW,SACb,MAAM,IAAI,MAAM,yDAAyD;CAG3E,MAAM,WAAW,QAAQ;CAKzB,IAAI,EAJsB,MAAM,QAAQ,QAAQ,IAC5C,SAAS,SAAS,QAAQ,IAC1B,aAAa,WAGf,MAAM,IAAI,MAAM,sDAAsD;CAGxE,MAAM,UAAU,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM,KAAA;CAChE,MAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM,KAAA;CAE5D,IAAI,CAAC,WAAW,CAAC,KACf,MAAM,IAAI,MAAM,+DAA+D;CAGjF,OAAO;EACL,QAAQ,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM,KAAA;EACxD;EACA;CACF;AACF;AAMA,MAAM,6BAAyD;CAC7D,SAAS,CAAC,KAAK;CACf,MAAM;EAAC;EAAQ;EAAsB;CAAO;CAC5C,OAAO,CAAC,OAAO;CACf,WAAW,CAAC,cAAc,WAAW;CACrC,YAAY,CAAC,eAAe,YAAY;CACxC,SAAS,CAAC,WAAW,YAAY;CACjC,QAAQ,CAAC,QAAQ;CACjB,UAAU,CAAC,UAAU;CACrB,WAAW,CAAC,YAAY;CACxB,WAAW,CAAC,YAAY;CACxB,aAAa,CAAC,cAAc;CAC5B,aAAa;EAAC;EAAa;EAAe;CAAO;CACjD,aAAa,CAAC,cAAc;AAC9B;AAEA,IAAI,mBAA+C,EACjD,GAAG,2BACL;AAEA,SAAS,mBAAmB,MAA2B;CACrD,IAAI,CAAC,MAAM,QAAQ,IAAI,GACrB,OAAO,CAAC;CAGV,OAAO,MAAM,KACX,IAAI,IACF,KACG,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CACxB,QAAQ,QAAQ,IAAI,SAAS,CAAC,CACnC,CACF;AACF;;;;;AAMA,SAAgB,0BAA0B,SAAiC;CACzE,mBAAmB;EACjB,SAAS,QAAQ,YAAY,KAAA,IAAY,mBAAmB,QAAQ,OAAO,IAAI,2BAA2B;EAC1G,MAAM,QAAQ,SAAS,KAAA,IAAY,mBAAmB,QAAQ,IAAI,IAAI,2BAA2B;EACjG,OAAO,QAAQ,UAAU,KAAA,IAAY,mBAAmB,QAAQ,KAAK,IAAI,2BAA2B;EACpG,WAAW,QAAQ,cAAc,KAAA,IAAY,mBAAmB,QAAQ,SAAS,IAAI,2BAA2B;EAChH,YAAY,QAAQ,eAAe,KAAA,IAAY,mBAAmB,QAAQ,UAAU,IAAI,2BAA2B;EACnH,SAAS,QAAQ,YAAY,KAAA,IAAY,mBAAmB,QAAQ,OAAO,IAAI,2BAA2B;EAC1G,QAAQ,QAAQ,WAAW,KAAA,IAAY,mBAAmB,QAAQ,MAAM,IAAI,2BAA2B;EACvG,UAAU,QAAQ,aAAa,KAAA,IAAY,mBAAmB,QAAQ,QAAQ,IAAI,2BAA2B;EAC7G,WAAW,QAAQ,cAAc,KAAA,IAAY,mBAAmB,QAAQ,SAAS,IAAI,2BAA2B;EAChH,WAAW,QAAQ,cAAc,KAAA,IAAY,mBAAmB,QAAQ,SAAS,IAAI,2BAA2B;EAChH,aAAa,QAAQ,gBAAgB,KAAA,IAAY,mBAAmB,QAAQ,WAAW,IAAI,2BAA2B;EACtH,aAAa,QAAQ,gBAAgB,KAAA,IAAY,mBAAmB,QAAQ,WAAW,IAAI,2BAA2B;EACtH,aAAa,QAAQ,gBAAgB,KAAA,IAAY,mBAAmB,QAAQ,WAAW,IAAI,2BAA2B;CACxH;AACF;;;;AAKA,SAAgB,wBAA8B;CAC5C,mBAAmB,EACjB,GAAG,2BACL;AACF;AAEA,SAAS,gCAA4D;CACnE,OAAO;AACT;AAEA,SAAS,mBACP,QACA,WACmC;CACnC,KAAK,MAAM,YAAY,WACrB,IAAI,YAAY,QACd,OAAO;EACL,KAAK;EACL,OAAO,OAAO;CAChB;CAIJ,OAAO,CAAC;AACV;AAEA,SAAS,eAAe,QAAiC,WAAyC;CAChG,MAAM,EAAE,UAAU,mBAAmB,QAAQ,SAAS;CAEtD,IAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,UAAU,MAAM,KAAK;EAC3B,OAAO,QAAQ,SAAS,IAAI,UAAU,KAAA;CACxC;CAEA,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,WAChD,OAAO,GAAG;AAId;AAEA,SAAS,eAAe,QAAiC,WAAyC;CAChG,MAAM,EAAE,UAAU,mBAAmB,QAAQ,SAAS;CAEtD,IAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GACpD,OAAO;CAGT,IAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,SAAS,OAAO,KAAK;EAC3B,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,KAAA;CAC5C;AAGF;AAEA,SAAS,gBACP,QACA,WACA,eAAe,OACN;CACT,MAAM,EAAE,UAAU,mBAAmB,QAAQ,SAAS;CAEtD,IAAI,OAAO,UAAU,WACnB,OAAO;CAGT,IAAI,OAAO,UAAU,UACnB,OAAO,MAAM,YAAY,MAAM;CAGjC,OAAO;AACT;;;;AAKA,SAAS,UAAU,OAAwB;CACzC,IAAI;EACF,OAAO,KAAK,MAAM,KAAK;CACzB,QAAQ;EACN,OAAO;CACT;AACF;;;;AAKA,SAAS,cAAc,OAA0B;CAC/C,IAAI,CAAC,OAAO,OAAO,CAAC;CAEpB,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MACJ,KAAK,SAAU,OAAO,SAAS,WAAW,KAAK,KAAK,IAAI,GAAG,OAAO,KAAK,CAAE,CAAC,CAC1E,QAAQ,SAAS,KAAK,SAAS,CAAC;CAGrC,IAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,UAAU,MAAM,KAAK;EAC3B,IAAI,CAAC,SAAS,OAAO,CAAC;EAEtB,IAAI,QAAQ,WAAW,GAAG,GAAG;GAC3B,MAAM,SAAS,UAAU,OAAO;GAChC,IAAI,MAAM,QAAQ,MAAM,GACtB,OAAO,OACJ,KAAK,SAAU,OAAO,SAAS,WAAW,KAAK,KAAK,IAAI,GAAG,OAAO,KAAK,CAAE,CAAC,CAC1E,QAAQ,SAAS,KAAK,SAAS,CAAC;EAEvC;EAEA,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,QACJ,MAAM,GAAG,CAAC,CACV,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,CAC1B,QAAQ,SAAS,KAAK,SAAS,CAAC;EAGrC,OAAO,CAAC,OAAO;CACjB;CAEA,OAAO,CAAC;AACV;AAEA,SAAS,aAAa,OAA0B;CAC9C,IAAI,OAAO,UAAU,UACnB,OAAO,MACJ,KAAK,CAAC,CACN,MAAM,KAAK,CAAC,CACZ,QAAQ,SAAS,KAAK,SAAS,CAAC;CAGrC,OAAO,cAAc,KAAK;AAC5B;;;;AAKA,SAAgB,gBAAgB,QAM9B;CACA,MAAM,eAAe,8BAA8B;CAGnD,IAAI,UAAoB,CAAC;CACzB,MAAM,EAAE,OAAO,iBAAiB,mBAAmB,QAAQ,aAAa,SAAS;CACjF,IAAI,iBAAiB,KAAA,GACnB,IAAI,OAAO,iBAAiB,YAAY,aAAa,KAAK,CAAC,CAAC,WAAW,GAAG,GAAG;EAC3E,MAAM,SAAS,UAAU,aAAa,KAAK,CAAC;EAC5C,IAAI,MAAM,QAAQ,MAAM,GACtB,UAAU,OACP,KAAK,OAAQ,OAAO,OAAO,WAAW,GAAG,KAAK,IAAI,GAAG,KAAK,KAAK,CAAE,CAAC,CAClE,QAAQ,OAAO,GAAG,SAAS,CAAC;CAEnC,OACE,UAAU,cAAc,YAAY;CAKxC,MAAM,cAAwC,CAAC;CAC/C,MAAM,EAAE,OAAO,aAAa,mBAAmB,QAAQ,aAAa,WAAW;CAC/E,IAAI,aAAa,KAAA,GAAW;EAC1B,IAAI,cAAuB;EAE3B,IAAI,OAAO,aAAa,YAAY,SAAS,KAAK,CAAC,CAAC,WAAW,GAAG,GAChE,cAAc,UAAU,SAAS,KAAK,CAAC,KAAK;EAG9C,IAAI,eAAe,OAAO,gBAAgB,YAAY,CAAC,MAAM,QAAQ,WAAW,GAC9E,KAAK,MAAM,CAAC,UAAU,cAAc,OAAO,QAAQ,WAAsC,GAAG;GAC1F,MAAM,UAAU,cAAc,SAAS;GACvC,IAAI,QAAQ,SAAS,GACnB,YAAY,YAAY;EAE5B;CAEJ;CAGA,MAAM,kBAAkB,mBAAmB,QAAQ,aAAa,WAAW;CAC3E,MAAM,cACJ,gBAAgB,QAAQ,UACpB,aAAa,gBAAgB,KAAK,IAClC,cAAc,gBAAgB,KAAK;CAGzC,MAAM,cAAc,gBAAgB,QAAQ,aAAa,WAAW;CAEpE,OAAO;EAAE;EAAS;EAAa;EAAa;CAAY;AAC1D;;;;AASA,eAAe,kBACb,aACA,QAC+B;CAC/B,MAAM,eAAe,8BAA8B;CACnD,MAAM,WAAqB;EACzB,KAAK,eAAe,QAAQ,aAAa,OAAO,KAAK;EACrD,MAAM,eAAe,QAAQ,aAAa,IAAI,KAAK,eAAe,QAAQ,aAAa,KAAK,KAAK;EACjG,OAAO,eAAe,QAAQ,aAAa,KAAK;EAChD,WAAW,eAAe,QAAQ,aAAa,SAAS;EACxD,YAAY,eAAe,QAAQ,aAAa,UAAU;EAC1D,SAAS,eAAe,QAAQ,aAAa,OAAO;EACpD,QAAQ,eAAe,QAAQ,aAAa,MAAM;EAClD,UAAU,eAAe,QAAQ,aAAa,QAAQ;EACtD,YAAY,eAAe,QAAQ,aAAa,SAAS;CAC3D;CAEA,MAAM,YAAY,YAAY,aAC1B,KAAK,IAAI,IAAI,YAAY,aAAa,MACtC,KAAA;CACJ,MAAM,MAAM,KAAK,IAAI;CACrB,MAAM,eAAgB,YAAwC;CAE9D,OAAO;EACL,QAAQ,SAAS;EACjB,aAAa,YAAY;EACzB,cAAc,YAAY;EAC1B,SAAS,YAAY;EACrB;EACA,QAAQ,eAAe,QAAQ,CAAC,KAAK,CAAC;EACtC,KAAK,eAAe,QAAQ,CAAC,KAAK,CAAC;EACnC,cAAc,OAAO,iBAAiB,WAAW,eAAe,KAAA;EAChE,UAAU,cAAc,CAAC,CAAC;EAC1B,MAAM;EACN,WAAW;EACX,cAAc;CAChB;AACF;AAOA,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,yBAAyB,GAAG,yBAAyB;AAC3D,MAAM,qBAAqB,GAAG,yBAAyB;;;;;;;;;;;;;;;;;;;;;AAsBvD,SAAgB,aAAa,SAAoC;CAC/D,MAAM,UAAU,QAAQ,QAAQ,IAAI,QAAQ;CAC5C,IAAI,CAAC,SAAS,OAAO;CAGrB,MAAM,aAAa,IAAI,OAAO,GAAG,kBAAkB,SAAS;CAC5D,MAAM,aAAa,QAAQ,MAAM,UAAU;CAC3C,IAAI,CAAC,YAAY,OAAO;CAExB,MAAM,QAAQ,mBAAmB,WAAW,EAAE;CAC9C,IAAI,CAAC,OAAO,OAAO;CAGnB,MAAM,YAAY,IAAI,OAAO,GAAG,uBAAuB,SAAS;CAChE,MAAM,YAAY,QAAQ,MAAM,SAAS;CAGzC,OAAO;EAAE;EAAO,aAFI,YAAY,mBAAmB,UAAU,EAAE,IAAI,KAAA;CAEvC;AAC9B;;;;;;AAOA,SAAgB,wBAAiC;CAC/C,MAAM,UAAU,IAAI,QAAQ;CAC5B,QAAQ,OAAO,cAAc,GAAG,kBAAkB,qBAAqB;CACvE,QAAQ,OAAO,cAAc,GAAG,uBAAuB,qBAAqB;CAC5E,OAAO;AACT;;;;AAKA,SAAgB,aAAa,SAA2B;CAEtD,OADgB,QAAQ,QAAQ,IAAI,QACvB,CAAC,EAAE,SAAS,GAAG,kBAAkB,EAAE,KAAK;AACvD;;;;;;;AAYA,eAAsB,MACpB,SACA,oBACmB;CACnB,IAAI;EACF,MAAM,SAAS,cAAc;EAG7B,MAAM,UAAwB,OAAO,uBAAuB,WACxD,EAAE,WAAW,mBAAmB,IAChC,sBAAsB,CAAC;EAK3B,IAFgB,QAAQ,QAAQ,IAAI,QACb,CAAC,EAAE,SAAS,GAAG,kBAAkB,EAAE,GAC5C;GACZ,OAAO,KAAK,sDAAsD;GAElE,MAAM,UAAU,IAAI,QAAQ;GAC5B,QAAQ,OAAO,cAAc,GAAG,kBAAkB,qBAAqB;GAGvE,MAAM,UAAU,IADQ,IAAI,OAAO,WACT,CAAC,CAAC;GAC5B,OAAO,uBAAuB,SAAS,EAAE,QAAQ,CAAC;EACpD;EAEA,MAAM,aAAa,MAAM,eAAe;EAGxC,MAAM,eAAe,KAAK,uBAAuB;EACjD,MAAM,gBAAgB,MAAM,KAAK,2BAA2B,YAAY;EAExE,MAAM,kBAAkB,qCAAqC,QAAQ,iBAAiB,OAAO;EAK7F,MAAM,QAAQ,wBAAwB,KAAK,YAAY,GAAG,QAAQ,kBAAkB;EACpF,MAAM,QAAQ,KAAK,YAAY;EAG/B,MAAM,aAAyB;GAC7B;GACA;GACA;GACA,WAAW,QAAQ;GACnB,UAAU,QAAQ;GAClB,WAAW,KAAK,IAAI;EACtB;EAEA,OAAO,KAAK,wBAAwB;GAClC,WAAW,QAAQ;GACnB,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB,oBAAoB,OAAO,KAAK,eAAe;EACjD,CAAC;EAGD,MAAM,UAAU,MAAM,iBAAiB,UAAU;EAEjD,MAAM,0BAAkD;GACtD,cAAc,OAAO;GACrB,OAAO,OAAO;GACd;GACA;GACA,gBAAgB;GAChB,uBAAuB;GACvB,GAAG;EACL;EAEA,IAAI,QAAQ,QACV,wBAAwB,SAAS,QAAQ;EAG3C,IAAI,QAAQ,UACV,wBAAwB,YAAY,QAAQ;EAG9C,MAAM,mBAAmB,KAAK,sBAAsB,YAAY,uBAAuB;EAGvF,MAAM,UAAU,IAAI,QAAQ;EAC5B,QAAQ,OAAO,cAAc,GAAG,mBAAmB,GAAG,QAAQ,8CAA8C;EAE5G,OAAO,KAAK,qCAAqC;GAC/C,UAAU,OAAO;GACjB,aAAa,OAAO;GACpB,OAAO,OAAO;GACd,uBAAuB,WAAW,eAAe,CAAC,CAAC;GACnD;GACA,QAAQ,QAAQ;GAChB,UAAU,QAAQ;EACpB,CAAC;EAED,OAAO,uBAAuB,iBAAiB,SAAS,GAAG,EAAE,QAAQ,CAAC;CACxE,SAAS,OAAO;EACd,OAAO,MAAM,kCAAkC,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EACzF,MAAM,IAAI,MAAM,cAAc;CAChC;AACF;;;;;;;;;;;;;AAcA,eAAsB,eAAe,SAAqC;CACxE,IAAI;EACF,MAAM,SAAS,cAAc;EAC7B,MAAM,iBAAiB,2BAA2B,MAAM;EACxD,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAC/B,MAAM,OAAO,IAAI,aAAa,IAAI,MAAM;EACxC,MAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;EAC1C,MAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;EAC1C,MAAM,mBAAmB,IAAI,aAAa,IAAI,mBAAmB;EACjE,MAAM,WAAW,IAAI,aAAa,IAAI,WAAW;EACjD,MAAM,iBAAiB,IAAI,aAAa,IAAI,kBAAkB;EAE9D,OAAO,KAAK,0BAA0B;GACpC,SAAS,CAAC,CAAC;GACX,UAAU,CAAC,CAAC;GACZ;GACA;GACA;GACA;GACA,UAAU,OAAO;GACjB,aAAa,OAAO;EACtB,CAAC;EAGD,IAAI,OAAO;GACT,IAAI,kBAAkB,OAAO;IAC3B,MAAM,UAAU,QAAQ,QAAQ,IAAI,QAAQ;IAC5C,MAAM,kBAAkB,IAAI,OAAO,GAAG,mBAAmB,SAAS;IAElE,MAAM,WADc,SAAS,MAAM,eAAe,EAAA,GACpB;IAE9B,IAAI,SAAS;KACX,MAAM,aAAa,MAAM,cAAc,OAAO;KAC9C,MAAM,WAAW,aAAa,KAAK,IAAI,IAAI,WAAW,YAAY,OAAO;KAEzE,IAAI,cAAc,WAAW,UAAU,SAAS,YAAY,MAAU,KAAM;MAC1E,MAAM,iBAAiB,OAAO;MAC9B,MAAM,UAAU,IAAI,QAAQ;MAC5B,QAAQ,OAAO,cAAc,GAAG,mBAAmB,6CAA6C;MAEhG,MAAM,cAAc,uCAClB,WAAW,aAAa,KACxB,YAAY,WAAW,UACvB,cACF;MAEA,OAAO,KAAK,0DAA0D;OACpE;OACA;OACA,UAAU,YAAY,WAAW;OACjC;MACF,CAAC;MAED,OAAO,uBAAuB,aAAa,EAAE,QAAQ,CAAC;KACxD;IACF;GACF;GAEA,OAAO,MAAM,wBAAwB,KAAA,GAAW;IAC9C;IACA;IACA,UAAU,OAAO;IACjB,iBAAiB,OAAO;IACxB;GACF,CAAC;GAID,IAAI,UAAU,iBAAiB;IAC7B,OAAO,KAAK,sCAAsC,EAAE,UAAU,OAAO,SAAS,CAAC;IAE/E,MAAM,UAAU,MAAM,mBAAmB,OAAO;IAIhD,QAAQ,OACN,cACA,GAAG,kBAAkB,4DACvB;IACA,QAAQ,OACN,cACA,GAAG,uBAAuB,GAAG,mBAAmB,oBAAoB,6CAA6C,EAAE,oCACrH;IAIA,MAAM,UAAU,IADQ,IAAI,OAAO,WACT,CAAC,CAAC;IAC5B,OAAO,KAAK,0DAA0D;KACpE;KACA;KACA,mBAAmB,OAAO;IAC5B,CAAC;IAGD,OAAO,uBAAuB,GAAG,QAAQ,cAAc,EAAE,QAAQ,CAAC;GACpE;GAGA,IAAI,UAAU,kBAAkB;IAC9B,OAAO,KAAK,+CAA+C;IAC3D,MAAM,UAAU,MAAM,mBAAmB,OAAO;IAGhD,MAAM,UAAU,IADQ,IAAI,OAAO,WACT,CAAC,CAAC;IAC5B,OAAO,uBAAuB,SAAS,EAAE,QAAQ,CAAC;GACpD;GAGA,MAAM,UAAU,MAAM,mBAAmB,OAAO;GAChD,QAAQ,OACN,cACA,GAAG,kBAAkB,GAAG,mBAAmB,KAAK,EAAE,8CACpD;GACA,IAAI,kBACF,QAAQ,OACN,cACA,GAAG,uBAAuB,GAAG,mBAAmB,gBAAgB,EAAE,oCACpE;GAIF,MAAM,UAAU,IADQ,IAAI,OAAO,WACT,CAAC,CAAC;GAC5B,OAAO,uBAAuB,SAAS,EAAE,QAAQ,CAAC;EACpD;EAGA,MAAM,UAAU,QAAQ,QAAQ,IAAI,QAAQ;EAC5C,MAAM,kBAAkB,IAAI,OAAO,GAAG,mBAAmB,SAAS;EAElE,MAAM,WADc,SAAS,MAAM,eAAe,EAAA,GACpB;EAE9B,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,oCAAoC;EAItD,MAAM,aAAa,MAAM,cAAc,OAAO;EAE9C,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,+CAA+C;EAGjE,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,2CAA2C;EAG7D,IAAI,WAAW,UAAU,OACvB,MAAM,IAAI,MAAM,sBAAsB;EAKxC,IADiB,KAAK,IAAI,IAAI,WAAW,YAC1B,MAAU,KACvB,MAAM,IAAI,MAAM,qBAAqB;EAGvC,IAAI,CAAC,MAAM;GACT,IAAI,gBAAgB;IAClB,MAAM,iBAAiB,OAAO;IAC9B,MAAM,UAAU,IAAI,QAAQ;IAC5B,QAAQ,OAAO,cAAc,GAAG,mBAAmB,6CAA6C;IAEhG,MAAM,cAAc,uCAClB,WAAW,aAAa,KACxB,YAAY,WAAW,UACvB,cACF;IAEA,OAAO,KAAK,oEAAoE;KAC9E,UAAU,YAAY,WAAW;KACjC;IACF,CAAC;IAED,OAAO,uBAAuB,aAAa,EAAE,QAAQ,CAAC;GACxD;GAEA,MAAM,IAAI,MAAM,0CAA0C;EAC5D;EAEA,OAAO,KAAK,2BAA2B;EAEvC,MAAM,aAAa,MAAM,eAAe;EACxC,MAAM,2BAA2B,+BAA+B,QAAQ,KAAK,OAAO,WAAW;EAC/F,MAAM,cAAc,MAAM,KAAK,uBAAuB,YAAY,0BAA0B;GAC1F,kBAAkB,WAAW;GAC7B,eAAe,WAAW;GAC1B,eAAe,WAAW;GAC1B,iBAAiB,OAAO,MAAM,MAAM,KAAK,CAAC,CAAC,SAAS,QAAQ;EAC9D,CAAC;EAED,OAAO,KAAK,uCAAuC;EAQnD,MAAM,iBAAiB,MAAM,kBAAkB,SAAS,MAH3B,kBAAkB,aAHhC,2BAA2B,WAGuB,CAAC,CAGI;EAGtE,MAAM,iBAAiB,OAAO;EAG9B,MAAM,UAAU,IAAI,QAAQ,cAAc;EAC1C,QAAQ,OAAO,cAAc,GAAG,mBAAmB,6CAA6C;EAEhG,OAAO,KAAK,uCAAuC;EAQnD,OAAO,uBALa,uCAClB,WAAW,aAAa,KACxB,YAAY,WAAW,UACvB,cAEsC,GAAG,EAAE,QAAQ,CAAC;CACxD,SAAS,OAAO;EACd,OAAO,MAAM,yBAAyB,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EAGhF,IAAI;GACF,MAAM,UAAU,QAAQ,QAAQ,IAAI,QAAQ;GAC5C,MAAM,kBAAkB,IAAI,OAAO,GAAG,mBAAmB,SAAS;GAElE,MAAM,WADc,SAAS,MAAM,eAAe,EAAA,GACpB;GAC9B,IAAI,SACF,MAAM,iBAAiB,OAAO;EAElC,QAAQ,CAER;EAEA,MAAM,mBAAmB,OAAO;EAChC,MAAM,IAAI,MAAM,uBAAuB;CACzC;AACF;;;;;;;;;AAUA,eAAsB,OAAO,SAAqC;CAChE,IAAI;EACF,MAAM,SAAS,cAAc;EAC7B,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAE/B,MAAM,cAAc,eAAe,GAAG;EACtC,MAAM,YAAY,wBAAwB,IAAI,aAAa,IAAI,WAAW,GAAG,OAAO;EAEpF,OAAO,KAAK,oBAAoB;GAC9B,UAAU,OAAO;GACjB;EACF,CAAC;EAED,MAAM,cAAc,MAAM,eAAe,OAAO;EAChD,MAAM,UAAU,YAAY;EAE5B,IAAI,gBAAgB,SAAS;GAI3B,MAAM,UAAU,MAAM,mBAAmB,OAAO;GAEhD,MAAM,sBAAsB,uBAAuB,SAD/B,aAAa,GACsC;GAEvE,QAAQ,OAAO,cAAc,+DAA+D;GAC5F,OAAO,KAAK,sCAAsC,EAAE,aAAa,oBAAoB,CAAC;GACtF,OAAO,uBAAuB,qBAAqB,EAAE,QAAQ,CAAC;EAChE;EAEA,MAAM,iBAAiB,IAAI,QAAQ;EAEnC,IAAI,gBAAgB,SAAS,YAAY,QAAQ;GAC/C,MAAM,0CAA0C,YAAY,MAAM;GAClE,eAAe,OAAO,cAAc,+DAA+D;GAEnG,CAAA,MAD6B,mBAAmB,OAAO,EAAA,CACxC,SAAS,OAAO,QAAQ,eAAe,OAAO,KAAK,KAAK,CAAC;EAC1E,OAAO;GACL,MAAM,8BAA8B,WAAW;GAE/C,CAAA,MAD6B,mBAAmB,OAAO,EAAA,CACxC,SAAS,OAAO,QAAQ,eAAe,OAAO,KAAK,KAAK,CAAC;EAC1E;EAEA,MAAM,UAAU,IAAI,QAAQ,cAAc;EAG1C,IAAI,WACF,QAAQ,OACN,cACA,qBAAqB,mBAAmB,SAAS,EAAE,8CACrD;OAEA,QAAQ,OAAO,cAAc,+DAA+D;EAG9F,IAAI;GACF,MAAM,aAAa,MAAM,eAAe;GACxC,MAAM,iBAAiB,WAAW,eAAe;GACjD,MAAM,mBAA2C,CAAC;GAClD,MAAM,iBAAiB,eAAe,UAAU,OAAO;GAEvD,IAAI,WAAW,kBAAkB,SAAS,cAAc,GACtD,iBAAiB,gBAAgB;QAC5B,IAAI,SACT,OAAO,KAAK,mGAAmG;IAC7G,aAAa,aAAa,OAAO;IACjC,gBAAgB,gBAAgB,cAAc;IAC9C,UAAU,OAAO;GACnB,CAAC;GAGH,IAAI,OAAO,uBACT,iBAAiB,2BAA2B,OAAO;GAGrD,MAAM,gBAAgB,KAAK,mBAAmB,YAAY,gBAAgB;GAC1E,OAAO,KAAK,wCAAwC;IAClD,oBAAoB,eAAe;IACnC,gBAAgB,QAAQ,iBAAiB,aAAa;GACxD,CAAC;GAED,OAAO,uBAAuB,cAAc,SAAS,GAAG,EAAE,QAAQ,CAAC;EACrE,SAAS,OAAO;GACd,OAAO,KAAK,yEAAyE,EACnF,OAAO,qBAAqB,KAAK,EACnC,CAAC;EACH;EAIA,MAAM,mBAAmB,uBAAuB,SADzB,OAAO,yBAAyB,GACgB;EAEvE,OAAO,KAAK,oBAAoB,EAAE,aAAa,iBAAiB,CAAC;EACjE,OAAO,uBAAuB,kBAAkB,EAAE,QAAQ,CAAC;CAC7D,SAAS,OAAO;EACd,OAAO,MAAM,iBAAiB,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EAExE,OAAO,uBAAuB,KAAK,EAAE,SAAA,MADf,mBAAmB,OAAO,EACH,CAAC;CAChD;AACF;;;;;;;;;AAUA,eAAsB,wBAAwB,SAAqC;CACjF,IAAI,QAAQ,WAAW,QACrB,OAAO,SAAS,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;CAGvE,IAAI;EACF,MAAM,SAAS,cAAc;EAE7B,MAAM,kBAAiB,MADE,eAAe,EAAA,CACN,eAAe;EACjD,MAAM,cAAc,MAAM,0BAA0B,OAAO;EAE3D,IAAI,CAAC,aACH,OAAO,SAAS,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;EAGzE,IAAI,CAAC,eAAe,UAClB,MAAM,IAAI,MAAM,wCAAwC;EAG1D,MAAM,EAAE,YAAY,MAAM,UAAU,aAAa,QAAQ,eAAe,QAAQ,GAAG;GACjF,QAAQ,eAAe,UAAU,OAAO;GACxC,UAAU,OAAO;GACjB,gBAAgB;EAClB,CAAC;EAED,MAAM,SAAS,gCAAgC,SAAoC,OAAO,QAAQ;EAKlG,MAAM,SAAkC;GACtC,mBAAA,MAL8B,qCAAqC;IACnE,KAAK,OAAO;IACZ,QAAQ,OAAO;GACjB,CAAC;GAGC,QAAQ,OAAO;GACf,SAAS,OAAO;GAChB,KAAK,OAAO;EACd;EAEA,OAAO,KAAK,iCAAiC,EAAE,GAAG,OAAO,CAAC;EAC1D,OAAO,SAAS,KAAK;GAAE,SAAS;GAAM,GAAG;EAAO,CAAC;CACnD,SAAS,OAAO;EACd,OAAO,MAAM,8BAA8B,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EACrF,OAAO,SAAS,KACd;GAAE,OAAO;GAAwB,mBAAmB,qBAAqB,KAAK;EAAE,GAChF,EAAE,QAAQ,IAAI,CAChB;CACF;AACF;;;;;;;AAQA,eAAsB,yBAAyB,SAAqC;CAClF,IAAI;EACF,MAAM,SAAS,cAAc;EAE7B,MAAM,kBAAiB,MADE,eAAe,EAAA,CACN,eAAe;EACjD,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAC/B,MAAM,SAAS,IAAI,aAAa,IAAI,KAAK;EACzC,MAAM,MAAM,IAAI,aAAa,IAAI,KAAK;EACtC,MAAM,iBAAiB,gBAAgB,eAAe,UAAU,OAAO,SAAS;EAEhF,IAAI,CAAC,UAAU,gBAAgB,MAAM,MAAM,gBACzC,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;EAI3C,MAAM,SAAmC;GACvC,mBAFwB,MAAM,MAAM,yBAAyB,GAAG,IAAI;GAGpE;GACA,KAAK,OAAO,KAAA;EACd;EAEA,OAAO,KAAK,kCAAkC,EAAE,GAAG,OAAO,CAAC;EAC3D,OAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,SAAS,EACP,iBAAiB,WACnB;EACF,CAAC;CACH,SAAS,OAAO;EACd,OAAO,KAAK,gCAAgC,EAC1C,OAAO,qBAAqB,KAAK,EACnC,CAAC;EAED,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;CAC3C;AACF;;;;AAKA,eAAsB,QAAQ,SAA4C;CACxE,IAAI;EAEF,QAAO,MADmB,eAAe,OAAO,EAAA,CAC7B,QAAQ;CAC7B,SAAS,OAAO;EACd,OAAO,MAAM,sBAAsB,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EAC7E,OAAO;CACT;AACF;;;;AAKA,eAAsB,YAAY,SAAqC;CACrE,MAAM,OAAO,MAAM,QAAQ,OAAO;CAElC,IAAI,CAAC,MAAM;EACT,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAC/B,MAAM,YAAY,GAAG,IAAI,WAAW,IAAI;EACxC,OAAO,KAAK,sCAAsC,EAAE,UAAU,CAAC;EAC/D,MAAM,MAAM,MAAM,SAAS,SAAS;CACtC;CAEA,OAAO;AACT;;;;AAKA,eAAsB,eAAe,SAA0C;CAC7E,IAAI;EAEF,QAAO,MADmB,eAAe,OAAO,EAAA,CAC7B,eAAe;CACpC,SAAS,OAAO;EACd,OAAO,MAAM,8BAA8B,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EACrF,OAAO;CACT;AACF;;;;AAKA,eAAsB,cACpB,SACA,cAC6B;CAC7B,IAAI;EACF,MAAM,cAAc,MAAM,eAAe,OAAO;EAChD,MAAM,iBAAiB,gBAAgB,YAAY;EAEnD,IAAI,CAAC,gBAAgB;GACnB,OAAO,KAAK,4BAA4B;GACxC,OAAO;IAAE,SAAS;IAAO,OAAO;IAA8B,cAAc;GAAK;EACnF;EAEA,OAAO,KAAK,0BAA0B;EAEtC,MAAM,aAAa,MAAM,eAAe;EACxC,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,YAAY,cAAc;EAE7E,OAAO,KAAK,0BAA0B;EAEtC,MAAM,kBAAkB,cAAc,iBAAiB;EACvD,MAAM,YAAY,cAAc,aAC5B,KAAK,IAAI,IAAI,cAAc,aAAa,MACxC,YAAY;EAGhB,MAAM,kBAAkB,SAAS;GAC/B,aAAa,cAAc;GAC3B,cAAc;GACd,SAAS,cAAc;GACvB;GACA,cAAc,KAAK,IAAI;EACzB,CAAC;EAED,OAAO;GACL,SAAS;GACT,QAAQ;IACN,cAAc,cAAc;IAC5B,eAAe;IACf,UAAU,cAAc;IACxB,YAAY,cAAc;GAC5B;EACF;CACF,SAAS,OAAO;EACd,OAAO,MAAM,uCAAuC,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EAE9F,OAAO;GACL,SAAS;GACT,OAAO,qBAAqB,KAAK;GACjC,cAAc,4BAA4B,KAAK;EACjD;CACF;AACF;;;;AAQA,SAAgB,uBAA6B;CAC3C,kBAAkB;CAClB,UAAU,MAAM;AAClB;;;;;;;;ACvkDA,MAAM,oBAAoB,wBAAwB;AAElD,SAAS,0BAAkC;CACzC,MAAM,aAAa,OAAO,QAAQ,IAAI,yBAAyB;CAC/D,OAAO,OAAO,SAAS,UAAU,KAAK,aAAa,IAAI,aAAa;AACtE;;;;AAKA,eAAsB,mBAAmB,SAAoC;CAC3E,IAAI;EACF,MAAM,cAAc,MAAM,eAAe,OAAO;EAEhD,IAAI,CAAC,YAAY,gBAAgB,YAAY,aAAa,WAAW,GAAG;GACtE,IAAI,YAAY,aAAa,KAAK,IAAI,KAAK,YAAY,WAAW;IAChE,OAAO,KAAK,sEAAsE;IAElF,MAAM,MAAM,OAAO,MADS,6BAA6B,SAAS,0BAA0B,CAC5D;GAClC;GACA,OAAO;EACT;EAEA,IAAI,CAAC,YAAY,aAAa,CAAC,YAAY,aACzC,OAAO;EAGT,MAAM,MAAM,KAAK,IAAI;EAGrB,IAAI,YAA2B;EAC/B,IAAI;GACF,MAAM,aAAa,YAAY,YAAY,MAAM,GAAG;GACpD,IAAI,WAAW,WAAW,GAAG;IAC3B,MAAM,UAAU,KAAK,MAAM,OAAO,KAAK,WAAW,IAAI,QAAQ,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,QAAQ,KACV,YAAY,QAAQ,MAAM;GAE9B;EACF,QAAQ,CAER;EAOA,QALuB,aAAa,YAAY,YAAY,YACxD,YACA,YAAY,aACiC,OAEf;CACpC,SAAS,OAAO;EACd,OAAO,MAAM,gCAAgC,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EACvF,OAAO;CACT;AACF;;;;AAKA,eAAe,kBAAkB,SAAiC;CAChE,IAAI;EAGF,IAAI,MAFuB,mBAAmB,OAAO,GAEnC;GAChB,OAAO,KAAK,sCAAsC;GAClD,MAAM,SAAS,MAAM,cAAc,OAAO;GAE1C,IAAI,OAAO,SACT,OAAO,KAAK,qCAAqC;QAC5C;IACL,OAAO,MAAM,uBAAuB,KAAA,GAAW,EAAE,OAAO,OAAO,MAAM,CAAC;IAEtE,IAAI,OAAO,cAAc;KACvB,OAAO,MAAM,yDAAyD;KAEtE,MAAM,MAAM,OAAO,MADS,6BAA6B,SAAS,gBAAgB,CAClD;IAClC;GACF;EACF;CACF,SAAS,OAAO;EACd,IAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,KACrE,MAAM;EAER,MAAM;CACR;AACF;AAyFA,IAAI,mBAA+C,CAAC;;;;AAKpD,SAAgB,yBACd,QACM;CACN,mBAAmB;AACrB;;;;AAKA,SAAgB,6BAAmC;CACjD,mBAAmB,CAAC;AACtB;AAEA,SAAS,yBAAyB,UAA6C;CAC7E,OAAO,uBAAuB,SAAS,UAAU;EAC/C,SAAS,SAAS;EAClB,QAAQ,SAAS;CACnB,CAAC;AACH;AAEA,SAAS,kBACP,SACA,aACA,YACQ;CACR,IAAI,iBAAiB,mBACnB,OAAO,iBAAiB,kBAAkB;EACxC;EACA;EACA;CACF,CAAC;CAGH,QAAQ,YAAR;EAKE,SAAS;GACP,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;GAC/B,OAAO,IAAI,aAAa,MAAM,MAAM,GAAG,IAAI,WAAW,IAAI;EAC5D;CACF;AACF;AAEA,eAAe,6BACb,SACA,QACkB;CAClB,IAAI,iBAAiB,8BACnB,OAAO,iBAAiB,6BAA6B;EAAE;EAAS;CAAO,CAAC;CAG1E,MAAM,YAAY,IAAI,IAAI,QAAQ,GAAG;CACrC,UAAU,WAAW;CACrB,UAAU,aAAa,IAAI,UAAU,OAAO;CAE5C,OAAO,IAAI,QAAQ,UAAU,SAAS,GAAG,EACvC,SAAS,QAAQ,QACnB,CAAC;AACH;AAEA,SAAS,2BACP,SACA,MACA,aACA,YACqC;CACrC,IAAI,yBAAqD;CACzD,IAAI,uBAAsD;CAC1D,IAAI,0BAAyF;CAE7F,OAAO;EACL;EACA;EACA;EACA;EACA,oBAAoB,OAAO,eAAe,UAAU;GAClD,IAAI,CAAC,iBAAiB,iBACpB,OAAO;GAGT,IAAI,cACF,OAAO,iBAAiB,gBAAgB,mBAAmB,SAAS,KAAK,KAAK,IAAI;GAGpF,IAAI,CAAC,wBACH,yBAAyB,iBAAiB,gBAAgB,mBAAmB,SAAS,KAAK,GAAG;GAGhG,OAAO;EACT;EACA,kBAAkB,YAAY;GAC5B,IAAI,CAAC,iBAAiB,eACpB,OAAO;GAGT,IAAI,CAAC,sBACH,uBAAuB,iBAAiB,cAAc,iBAAiB,OAAO;GAGhF,OAAO;EACT;EACA,kBAAkB,YAAY;GAC5B,IAAI,CAAC,iBAAiB,eACpB,OAAO;GAGT,IAAI,CAAC,yBACH,0BAA0B,iBAAiB,cAAc,iBAAiB,OAAO;GAGnF,OAAO;EACT;CACF;AACF;AAEA,eAAe,+BACb,SACA,MACA,aACA,YACkB;CAClB,IAAI,CAAC,iBAAiB,cACpB,OAAO;CAGT,MAAM,UAAU,2BAA2B,SAAS,MAAM,aAAa,UAAU;CAEjF,IAAI;EACF,MAAM,SAAS,MAAM,iBAAiB,aAAa,OAAO;EAC1D,IAAI,QACF,MAAM,yBAAyB,MAAM;EAGvC,OAAO;CACT,SAAS,OAAO;EACd,IAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,KACrE,MAAM;EAGR,IAAI,CAAC,iBAAiB,kBACpB,MAAM;EAGR,MAAM,WAAW,MAAM,iBAAiB,iBAAiB;GACvD,GAAG;GACH;EACF,CAAC;EAED,IAAI,UACF,MAAM,yBAAyB,QAAQ;EAGzC,MAAM;CACR;AACF;;;;AAKA,eAAsB,aACpB,SACA,YACA,UACY;CACZ,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAE/B,QAAQ,YAAR;EACE,KAAK,UACH,IAAI;GACF,MAAM,kBAAkB,OAAO;GAE/B,OAAO,SAAS,MADG,QAAQ,OAAO,KACV,KAAA,CAAS;EACnC,QAAQ;GACN,OAAO,SAAS,KAAA,CAAS;EAC3B;EAEF,KAAK;EACL,KAAK,UACH,IAAI;GACF,MAAM,kBAAkB,OAAO;GAC/B,MAAM,OAAO,MAAM,YAAY,OAAO;GACtC,MAAM,+BAA+B,SAAS,MAAM,IAAI,UAAU,UAAU;GAC5E,OAAO,SAAS,IAAI;EACtB,SAAS,OAAO;GACd,IAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,KACrE,MAAM;GAER,MAAM,MAAM,MAAM,SAAS,kBAAkB,SAAS,IAAI,UAAU,UAAU,CAAC;EACjF;EAEF,KAAK,uBACH,IAAI;GACF,MAAM,kBAAkB,OAAO;GAC/B,MAAM,OAAO,MAAM,YAAY,OAAO;GAEtC,MAAM,+BACJ,SACA,MACA,IAAI,UACJ,qBACF;GAEA,OAAO,SAAS,IAAI;EACtB,SAAS,OAAO;GACd,IAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,KACrE,MAAM;GAER,MAAM,MAAM,MAAM,SAAS,kBAAkB,SAAS,IAAI,UAAU,qBAAqB,CAAC;EAC5F;EAEF,KAAK,yBACH,IAAI;GACF,MAAM,kBAAkB,OAAO;GAC/B,MAAM,OAAO,MAAM,YAAY,OAAO;GAEtC,MAAM,+BACJ,SACA,MACA,IAAI,UACJ,uBACF;GAGA,IAAI,iBAAiB;QAEf,CAAC,MADuB,iBAAiB,cAAc,iBAAiB,OAAO,GAEjF,MAAM,iBAAiB,cAAc,iBAAiB,OAAO;GAAA;GAIjE,OAAO,SAAS,IAAI;EACtB,SAAS,OAAO;GACd,IAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,KACrE,MAAM;GAER,MAAM,MAAM,MAAM,SAAS,kBAAkB,SAAS,IAAI,UAAU,uBAAuB,CAAC;EAC9F;EAEF,SACE,MAAM,IAAI,MAAM,6BAA6B,YAAY;CAC7D;AACF;;;;AASA,MAAa,eACX,SACA,aACG,aAAa,SAAS,UAAU,QAAQ;;;;AAK7C,MAAa,aACX,SACA,aACG,aAAa,SAAS,QAAQ,QAA+C;;;;AAKlF,MAAa,eACX,SACA,aACG,aAAa,SAAS,UAAU,QAA+C;;;;AAKpF,MAAa,iBAAiB;;;;;;AAO9B,MAAa,mBACX,SACA,aACG,aAAa,SAAS,uBAAuB,QAA+C;;;;;;AAOjG,MAAa,qBACX,SACA,aACG,aAAa,SAAS,yBAAyB,QAA+C;;;;;;;;;AC5dnG,eAAsB,oBAAoB,SAA+C;CACvF,IAAI;EACF,OAAO,KAAK,8CAA8C;EAE1D,MAAM,cAAc,MAAM,eAAe,OAAO;EAEhD,IAAI,CAAC,YAAY,cAAc;GAC7B,OAAO,KAAK,uCAAuC;GACnD,OAAO;IACL,SAAS;IACT,OAAO;IACP,cAAc;GAChB;EACF;EAEA,MAAM,gBAAgB,MAAM,cAAc,SAAS,YAAY,YAAY;EAE3E,IAAI,CAAC,cAAc,SAAS;GAC1B,OAAO,MAAM,wBAAwB,KAAA,GAAW;IAC9C,OAAO,cAAc;IACrB,cAAc,cAAc;GAC9B,CAAC;GAED,OAAO;IACL,SAAS;IACT,OAAO,cAAc;IACrB,cAAc,cAAc;GAC9B;EACF;EAEA,MAAM,SAAS,cAAc;EAC7B,IAAI,CAAC,UAAU,CAAC,OAAO,cAAc;GACnC,OAAO,MAAM,sDAAsD;GACnE,OAAO;IACL,SAAS;IACT,OAAO;IACP,cAAc;GAChB;EACF;EAEA,OAAO,KAAK,0BAA0B;EAEtC,OAAO;GACL,SAAS;GACT,gBAAgB,OAAO;EACzB;CACF,SAAS,OAAO;EACd,OAAO,MAAM,gCAAgC,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EACvF,OAAO;GACL,SAAS;GACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU;GAChD,cAAc;EAChB;CACF;AACF;;;;AAKA,SAAgB,uBAAuB,UAA6B;CAClE,OAAO,SAAS,WAAW;AAC7B;;;;AAKA,SAAgB,0BAA0B,UAAoB,SAA2B;CACvF,OAAO,WAAW,uBAAuB,QAAQ;AACnD"}

package/dist/server.mjs

@@ -0,0 +1,90 @@
+import { LOG_LEVEL_PRIORITY, LogLevel, Logger, createLogger, defaultLoggerConfig, logger } from "./logging/index.mjs";
+import { t as PermissionChecker } from "./permission-service-DUyKomU3.mjs";
+import { _ as initializePermissions, a as ProtectedSection, c as useHasPermission, d as usePermission, f as usePermissionChecker, g as getPermissions, h as getPermissionChecker, i as ProtectedLink, l as useHasPermissions, m as PermissionInitializer, n as ProtectedAction, o as useAllPermissions, p as usePermissions, r as ProtectedButton, s as useHasModulePermission, t as PERMISSION_MODULES, u as useModulePermission, v as usePermissionStore } from "./permissions-C5dTP9y4.mjs";
+import { t as evaluateAccessRequirement } from "./access-BHy1v5sr.mjs";
+import { TenantProvider, configureTenantClient, configureTenantEndpoints, getTenantCookieName, initializeTenantStore, normalizeTenantDataPayload, normalizeTenantSwitchPayload, resetTenantClientConfig, useCurrentOrganization, useCurrentTenant, useCurrentTenantData, useOrganization, useTenant, useTenantData, useTenantStore, useTenantSwitcher } from "./tenant/index.mjs";
+import { IdentityContextProvider, configureIdentityEndpoints, configureIdentityStore, initialIdentityContext, normalizeIdentityContextPayload, normalizeIdentityPermissionsPayload, resetIdentityStoreConfig, useHasEntitlement, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useUserPermissions, useUserTenants } from "./identity/index.mjs";
+import { t as isApiClientError } from "./types-DqCXinAk.mjs";
+import { a as withRetry, c as handleApiError, i as isRetryableError, l as ErrorCodes, n as createRetryFetch, o as ApiError, r as fetchWithTimeout, s as ErrorHandler, t as calculateBackoffDelay } from "./api-client-CB7XZaMg.mjs";
+import { a as getIdentitySignalRClient, i as createIdentitySignalRClient, n as SignalRClient, o as initializeSignalR, r as cleanupSignalR, t as IdentitySignalRClient } from "./signalr-C-TA8nEE.mjs";
+import { i as invalidationHelpers, n as createQueryClient, r as createQueryKeyFactory, t as cachePresets } from "./query-client-_xB300gc.mjs";
+import { S as updateAuthSession, _ as isSessionValid, a as createOAuthState, b as listCurrentUserAuthSessions, c as destroyAuthSessionById, d as destroyAuthSessionsBySid, f as destroyAuthSessionsForUser, g as getOAuthState, h as getCurrentAuthSessionId, i as createAuthSession, l as destroyAuthSessionsByIdentitySession, m as getAuthSessionById, n as cleanupExpiredOAuthStates, o as deleteOAuthState, p as getAuthSession, r as closeRedisConnection, s as destroyAuthSession, t as AUTH_ERROR_COOKIE_PREFIX, u as destroyAuthSessionsBySessionState, v as listAuthSessionDataForUser, x as requireAuthSession, y as listAuthSessionsForUser } from "./redis-session-storage.server-DGgQcJ9B.mjs";
+import { A as resetAuthClaimMapping, C as handleCallback, D as logout, E as login, O as refreshTokens, S as handleBackChannelLogout, T as hasAuthError, _ as createAuthorizationResponseUrl, a as configureRouteProtection, b as getAuthError, c as protectRoute, d as resetRouteProtectionConfig, f as shouldRefreshToken, g as configureAuthClaimMapping, h as clearAuthServerCache, i as authRoute, k as requireAuth, l as protectedRoute, m as clearAuthErrorHeaders, n as isTokenExpiredResponse, o as onboardingRoute, p as subscriptionRoute, r as shouldAttemptTokenRefresh, s as policyRoute, t as attemptTokenRefresh, u as publicRoute, v as extractUserInfo, w as handleFrontChannelLogout, x as getUser, y as getAccessToken } from "./server-CqX2yCa4.mjs";
+import { clearActiveTenant, clearCurrentTenant, configureIdentityContextFetcher, configureTenantCookie, configureTenantResolution, getActiveTenant, getAvailableTenants, getCurrentTenant, getTenantFromIdentityContext, initializeTenant, resetTenantCookieConfig, resetTenantResolutionConfig, setActiveTenant, setCurrentTenant } from "./tenant/server.mjs";
+import { clearIdentityContextCache, configureIdentityAPIFetcher, configurePermissionFetcher, contextToUserInfo, fetchIdentityContext, fetchUserPermissions, getIdentityContext, hasContextVersionChanged, updateContextVersion } from "./identity/server.mjs";
+import { n as createFetchMiddleware, r as createAPIConfigFactory, t as createApiClient } from "./server-ByScGRXA.mjs";
+//#region src/permissions/route-protection.server.ts
+const DEFAULT_UNAUTHORIZED_RESPONSE = () => new Response("Unauthorized", {
+	status: 401,
+	statusText: "You must be logged in to access this resource"
+});
+const DEFAULT_FORBIDDEN_RESPONSE = (details) => {
+	const message = process.env.NODE_ENV === "development" ? `Missing permissions: ${details.missingPermissions?.join(", ")}` : "You don't have permission to access this resource";
+	return new Response(message, {
+		status: 403,
+		statusText: "Forbidden"
+	});
+};
+let permissionRouteProtectionConfig = {};
+function getPermissionRouteProtectionConfig() {
+	if (!permissionRouteProtectionConfig.getSession) throw new Error("Permission route protection session getter not configured. Call configurePermissionRouteProtection first.");
+	if (!permissionRouteProtectionConfig.resolveContext) throw new Error("Permission route protection context resolver not configured. Call configurePermissionRouteProtection first.");
+	return {
+		getSession: permissionRouteProtectionConfig.getSession,
+		resolveContext: permissionRouteProtectionConfig.resolveContext,
+		createUnauthorizedResponse: permissionRouteProtectionConfig.createUnauthorizedResponse || DEFAULT_UNAUTHORIZED_RESPONSE,
+		createForbiddenResponse: permissionRouteProtectionConfig.createForbiddenResponse || DEFAULT_FORBIDDEN_RESPONSE
+	};
+}
+function configurePermissionRouteProtection(config) {
+	permissionRouteProtectionConfig = {
+		...permissionRouteProtectionConfig,
+		...config
+	};
+}
+function resetPermissionRouteProtection() {
+	permissionRouteProtectionConfig = {};
+}
+async function getPermissionRouteState(request) {
+	const config = getPermissionRouteProtectionConfig();
+	const session = await config.getSession(request);
+	return {
+		config,
+		session,
+		context: await config.resolveContext(request, session)
+	};
+}
+async function requirePermission(request, permission, options = {}) {
+	const { config, session, context } = await getPermissionRouteState(request);
+	if (!session.user || !session.accessToken) throw config.createUnauthorizedResponse(request, session);
+	const checker = new PermissionChecker(context.permissions || []);
+	const permissionsToCheck = Array.isArray(permission) ? permission : [permission];
+	const result = checker.hasPermissions(permissionsToCheck, options);
+	if (!result.hasPermission) throw config.createForbiddenResponse({
+		request,
+		permission,
+		permissionsToCheck,
+		missingPermissions: result.missingPermissions,
+		options,
+		session,
+		context
+	});
+}
+async function checkPermission(request, permission, options = {}) {
+	try {
+		await requirePermission(request, permission, options);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function withPermission(permission, loader, options) {
+	return async (args) => {
+		await requirePermission(args.request, permission, options);
+		return loader(args);
+	};
+}
+//#endregion
+export { AUTH_ERROR_COOKIE_PREFIX, ApiError, ErrorCodes, ErrorHandler, IdentityContextProvider, IdentitySignalRClient, LOG_LEVEL_PRIORITY, LogLevel, Logger, PERMISSION_MODULES, PermissionChecker, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, SignalRClient, TenantProvider, attemptTokenRefresh, authRoute, cachePresets, calculateBackoffDelay, checkPermission, cleanupExpiredOAuthStates, cleanupSignalR, clearActiveTenant, clearAuthErrorHeaders, clearAuthServerCache, clearCurrentTenant, clearIdentityContextCache, closeRedisConnection, configureAuthClaimMapping, configureIdentityAPIFetcher, configureIdentityContextFetcher, configureIdentityEndpoints, configureIdentityStore, configurePermissionFetcher, configurePermissionRouteProtection, configureRouteProtection, configureTenantClient, configureTenantCookie, configureTenantEndpoints, configureTenantResolution, contextToUserInfo, createAPIConfigFactory, createApiClient, createAuthSession, createAuthorizationResponseUrl, createFetchMiddleware, createIdentitySignalRClient, createLogger, createOAuthState, createQueryClient, createQueryKeyFactory, createRetryFetch, defaultLoggerConfig, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, evaluateAccessRequirement, extractUserInfo, fetchIdentityContext, fetchUserPermissions, fetchWithTimeout, getAccessToken, getActiveTenant, getAuthError, getAuthSession, getAuthSessionById, getAvailableTenants, getCurrentAuthSessionId, getCurrentTenant, getIdentityContext, getIdentitySignalRClient, getOAuthState, getPermissionChecker, getPermissions, getTenantCookieName, getTenantFromIdentityContext, getUser, handleApiError, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, hasContextVersionChanged, initialIdentityContext, initializePermissions, initializeSignalR, initializeTenant, initializeTenantStore, invalidationHelpers, isApiClientError, isRetryableError, isSessionValid, isTokenExpiredResponse, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, logger, login, logout, normalizeIdentityContextPayload, normalizeIdentityPermissionsPayload, normalizeTenantDataPayload, normalizeTenantSwitchPayload, onboardingRoute, policyRoute, protectRoute, protectedRoute, publicRoute, refreshTokens, requireAuth, requireAuthSession, requirePermission, resetAuthClaimMapping, resetIdentityStoreConfig, resetPermissionRouteProtection, resetRouteProtectionConfig, resetTenantClientConfig, resetTenantCookieConfig, resetTenantResolutionConfig, setActiveTenant, setCurrentTenant, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession, updateContextVersion, useAllPermissions, useCurrentOrganization, useCurrentTenant, useCurrentTenantData, useHasEntitlement, useHasModulePermission, useHasPermission, useHasPermissions, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useModulePermission, useOrganization, usePermission, usePermissionChecker, usePermissionStore, usePermissions, useTenant, useTenantData, useTenantStore, useTenantSwitcher, useUserPermissions, useUserTenants, withPermission, withRetry };
+
+//# sourceMappingURL=server.mjs.map

package/dist/server.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.mjs","names":[],"sources":["../src/permissions/route-protection.server.ts"],"sourcesContent":["import { PermissionChecker } from './permission-service';\nimport type { PermissionCheckOptions, PermissionCode } from './types';\n\nexport interface PermissionRouteSession {\n  user?: {\n    sub?: string;\n    email?: string | null;\n  } | null;\n  accessToken?: string | null;\n}\n\nexport interface PermissionRouteContext {\n  permissions: PermissionCode[];\n  currentTenant?: string | null;\n}\n\nexport interface ForbiddenPermissionDetails {\n  request: Request;\n  permission: PermissionCode | PermissionCode[];\n  permissionsToCheck: PermissionCode[];\n  missingPermissions?: PermissionCode[];\n  options: PermissionCheckOptions;\n  session: PermissionRouteSession;\n  context: PermissionRouteContext;\n}\n\nexport interface PermissionRouteProtectionConfig {\n  getSession?: (request: Request) => Promise<PermissionRouteSession>;\n  resolveContext?: (\n    request: Request,\n    session: PermissionRouteSession\n  ) => Promise<PermissionRouteContext>;\n  createUnauthorizedResponse?: (\n    request: Request,\n    session: PermissionRouteSession\n  ) => Response;\n  createForbiddenResponse?: (details: ForbiddenPermissionDetails) => Response;\n}\n\nconst DEFAULT_UNAUTHORIZED_RESPONSE = () =>\n  new Response('Unauthorized', {\n    status: 401,\n    statusText: 'You must be logged in to access this resource',\n  });\n\nconst DEFAULT_FORBIDDEN_RESPONSE = (details: ForbiddenPermissionDetails) => {\n  const message =\n    process.env.NODE_ENV === 'development'\n      ? `Missing permissions: ${details.missingPermissions?.join(', ')}`\n      : \"You don't have permission to access this resource\";\n\n  return new Response(message, {\n    status: 403,\n    statusText: 'Forbidden',\n  });\n};\n\nlet permissionRouteProtectionConfig: PermissionRouteProtectionConfig = {};\n\nfunction getPermissionRouteProtectionConfig(): Required<PermissionRouteProtectionConfig> {\n  if (!permissionRouteProtectionConfig.getSession) {\n    throw new Error(\n      'Permission route protection session getter not configured. Call configurePermissionRouteProtection first.'\n    );\n  }\n\n  if (!permissionRouteProtectionConfig.resolveContext) {\n    throw new Error(\n      'Permission route protection context resolver not configured. Call configurePermissionRouteProtection first.'\n    );\n  }\n\n  return {\n    getSession: permissionRouteProtectionConfig.getSession,\n    resolveContext: permissionRouteProtectionConfig.resolveContext,\n    createUnauthorizedResponse:\n      permissionRouteProtectionConfig.createUnauthorizedResponse || DEFAULT_UNAUTHORIZED_RESPONSE,\n    createForbiddenResponse:\n      permissionRouteProtectionConfig.createForbiddenResponse || DEFAULT_FORBIDDEN_RESPONSE,\n  };\n}\n\nexport function configurePermissionRouteProtection(\n  config: PermissionRouteProtectionConfig\n): void {\n  permissionRouteProtectionConfig = {\n    ...permissionRouteProtectionConfig,\n    ...config,\n  };\n}\n\nexport function resetPermissionRouteProtection(): void {\n  permissionRouteProtectionConfig = {};\n}\n\nasync function getPermissionRouteState(request: Request): Promise<{\n  config: Required<PermissionRouteProtectionConfig>;\n  session: PermissionRouteSession;\n  context: PermissionRouteContext;\n}> {\n  const config = getPermissionRouteProtectionConfig();\n  const session = await config.getSession(request);\n  const context = await config.resolveContext(request, session);\n\n  return {\n    config,\n    session,\n    context,\n  };\n}\n\nexport async function requirePermission(\n  request: Request,\n  permission: PermissionCode | PermissionCode[],\n  options: PermissionCheckOptions = {}\n): Promise<void> {\n  const { config, session, context } = await getPermissionRouteState(request);\n\n  if (!session.user || !session.accessToken) {\n    throw config.createUnauthorizedResponse(request, session);\n  }\n\n  const checker = new PermissionChecker(context.permissions || []);\n  const permissionsToCheck = Array.isArray(permission) ? permission : [permission];\n  const result = checker.hasPermissions(permissionsToCheck, options);\n\n  if (!result.hasPermission) {\n    throw config.createForbiddenResponse({\n      request,\n      permission,\n      permissionsToCheck,\n      missingPermissions: result.missingPermissions,\n      options,\n      session,\n      context,\n    });\n  }\n}\n\nexport async function checkPermission(\n  request: Request,\n  permission: PermissionCode | PermissionCode[],\n  options: PermissionCheckOptions = {}\n): Promise<boolean> {\n  try {\n    await requirePermission(request, permission, options);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport function withPermission<TLoaderData>(\n  permission: PermissionCode | PermissionCode[],\n  loader: (args: any) => Promise<TLoaderData>,\n  options?: PermissionCheckOptions\n) {\n  return async (args: any): Promise<TLoaderData> => {\n    await requirePermission(args.request, permission, options);\n    return loader(args);\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAuCA,MAAM,sCACJ,IAAI,SAAS,gBAAgB;CAC3B,QAAQ;CACR,YAAY;AACd,CAAC;AAEH,MAAM,8BAA8B,YAAwC;CAC1E,MAAM,UACJ,QAAQ,IAAI,aAAa,gBACrB,wBAAwB,QAAQ,oBAAoB,KAAK,IAAI,MAC7D;CAEN,OAAO,IAAI,SAAS,SAAS;EAC3B,QAAQ;EACR,YAAY;CACd,CAAC;AACH;AAEA,IAAI,kCAAmE,CAAC;AAExE,SAAS,qCAAgF;CACvF,IAAI,CAAC,gCAAgC,YACnC,MAAM,IAAI,MACR,2GACF;CAGF,IAAI,CAAC,gCAAgC,gBACnC,MAAM,IAAI,MACR,6GACF;CAGF,OAAO;EACL,YAAY,gCAAgC;EAC5C,gBAAgB,gCAAgC;EAChD,4BACE,gCAAgC,8BAA8B;EAChE,yBACE,gCAAgC,2BAA2B;CAC/D;AACF;AAEA,SAAgB,mCACd,QACM;CACN,kCAAkC;EAChC,GAAG;EACH,GAAG;CACL;AACF;AAEA,SAAgB,iCAAuC;CACrD,kCAAkC,CAAC;AACrC;AAEA,eAAe,wBAAwB,SAIpC;CACD,MAAM,SAAS,mCAAmC;CAClD,MAAM,UAAU,MAAM,OAAO,WAAW,OAAO;CAG/C,OAAO;EACL;EACA;EACA,SAAA,MALoB,OAAO,eAAe,SAAS,OAAO;CAM5D;AACF;AAEA,eAAsB,kBACpB,SACA,YACA,UAAkC,CAAC,GACpB;CACf,MAAM,EAAE,QAAQ,SAAS,YAAY,MAAM,wBAAwB,OAAO;CAE1E,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,aAC5B,MAAM,OAAO,2BAA2B,SAAS,OAAO;CAG1D,MAAM,UAAU,IAAI,kBAAkB,QAAQ,eAAe,CAAC,CAAC;CAC/D,MAAM,qBAAqB,MAAM,QAAQ,UAAU,IAAI,aAAa,CAAC,UAAU;CAC/E,MAAM,SAAS,QAAQ,eAAe,oBAAoB,OAAO;CAEjE,IAAI,CAAC,OAAO,eACV,MAAM,OAAO,wBAAwB;EACnC;EACA;EACA;EACA,oBAAoB,OAAO;EAC3B;EACA;EACA;CACF,CAAC;AAEL;AAEA,eAAsB,gBACpB,SACA,YACA,UAAkC,CAAC,GACjB;CAClB,IAAI;EACF,MAAM,kBAAkB,SAAS,YAAY,OAAO;EACpD,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAgB,eACd,YACA,QACA,SACA;CACA,OAAO,OAAO,SAAoC;EAChD,MAAM,kBAAkB,KAAK,SAAS,YAAY,OAAO;EACzD,OAAO,OAAO,IAAI;CACpB;AACF"}

package/dist/signalr/index.mjs

@@ -0,0 +1,2 @@
+import { a as getIdentitySignalRClient, i as createIdentitySignalRClient, n as SignalRClient, o as initializeSignalR, r as cleanupSignalR, t as IdentitySignalRClient } from "../signalr-C-TA8nEE.mjs";
+export { IdentitySignalRClient, SignalRClient, cleanupSignalR, createIdentitySignalRClient, getIdentitySignalRClient, initializeSignalR };

package/dist/{signalr-k-70VHKo.js → signalr-C-TA8nEE.mjs}

@@ -1,7 +1,12 @@
 import { HubConnectionBuilder, LogLevel } from "@microsoft/signalr";
-
 //#region src/signalr/signalr-client.ts
 /**
+* SignalR Client for Real-time Updates
+* 
+* This client connects to SignalR hub and listens for real-time events.
+* Supports identity context changes, permissions updates, etc.
+*/
+/**
 * Default configuration
 */
 const DEFAULT_CONFIG = {
@@ -21,7 +26,7 @@ var SignalRClient = class {
 	isConnecting = false;
 	reconnectAttempts = 0;
 	config;
-	eventHandlers = new Map();
+	eventHandlers = /* @__PURE__ */ new Map();
 	visibilityHandler = null;
 	constructor(config) {
 		this.config = {
@@ -137,7 +142,7 @@ var SignalRClient = class {
 	* Register event handler
 	*/
 	on(eventName, handler) {
-		if (!this.eventHandlers.has(eventName)) this.eventHandlers.set(eventName, new Set());
+		if (!this.eventHandlers.has(eventName)) this.eventHandlers.set(eventName, /* @__PURE__ */ new Set());
 		this.eventHandlers.get(eventName).add(handler);
 		if (this.connection) this.connection.on(eventName, handler);
 		return () => {
@@ -269,7 +274,7 @@ async function cleanupSignalR() {
 		identityClientInstance = null;
 	}
 }
-
 //#endregion
-export { IdentitySignalRClient, SignalRClient, cleanupSignalR, createIdentitySignalRClient, getIdentitySignalRClient, initializeSignalR };
-//# sourceMappingURL=signalr-k-70VHKo.js.map
+export { getIdentitySignalRClient as a, createIdentitySignalRClient as i, SignalRClient as n, initializeSignalR as o, cleanupSignalR as r, IdentitySignalRClient as t };
+
+//# sourceMappingURL=signalr-C-TA8nEE.mjs.map

package/dist/signalr-C-TA8nEE.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"signalr-C-TA8nEE.mjs","names":[],"sources":["../src/signalr/signalr-client.ts"],"sourcesContent":["/**\n * SignalR Client for Real-time Updates\n * \n * This client connects to SignalR hub and listens for real-time events.\n * Supports identity context changes, permissions updates, etc.\n */\n\nimport { HubConnection, HubConnectionBuilder, LogLevel } from '@microsoft/signalr';\nimport type {\n  SignalRClientConfig,\n  SignalRConnectionState,\n  SignalREventHandler,\n  IdentityContextChangedEvent,\n  IdentityContextChangeHandler,\n} from './types';\n\n/**\n * Default configuration\n */\nconst DEFAULT_CONFIG: Required<Omit<SignalRClientConfig, 'hubPath' | 'baseUrl'>> = {\n  maxReconnectAttempts: 5,\n  reconnectDelay: 1000,\n  verbose: false,\n  autoReconnectOnVisibility: true,\n};\n\n/**\n * SignalR Client Class\n * \n * Generic SignalR client that can be used for any hub connection.\n */\nexport class SignalRClient {\n  private connection: HubConnection | null = null;\n  private accessToken: string | null = null;\n  private isConnecting = false;\n  private reconnectAttempts = 0;\n  private config: Required<Omit<SignalRClientConfig, 'baseUrl'>> & { baseUrl?: string };\n  private eventHandlers: Map<string, Set<SignalREventHandler>> = new Map();\n  private visibilityHandler: (() => void) | null = null;\n\n  constructor(config: SignalRClientConfig) {\n    this.config = {\n      ...DEFAULT_CONFIG,\n      ...config,\n    };\n\n    // Auto-reconnect on page visibility change\n    if (typeof document !== 'undefined' && this.config.autoReconnectOnVisibility) {\n      this.visibilityHandler = () => {\n        if (document.visibilityState === 'visible' && this.connection?.state === 'Disconnected') {\n          this.log('🔄 Page became visible, attempting reconnection...');\n          this.connect(this.accessToken);\n        }\n      };\n      document.addEventListener('visibilitychange', this.visibilityHandler);\n    }\n  }\n\n  /**\n   * Connect to SignalR hub\n   */\n  async connect(accessToken: string | null): Promise<void> {\n    if (!accessToken) {\n      this.log('⚠️ No access token provided for SignalR connection', 'warn');\n      return;\n    }\n\n    if (this.isConnecting) {\n      this.log('🔄 Connection already in progress...');\n      return;\n    }\n\n    if (this.connection?.state === 'Connected') {\n      this.log('✅ Already connected');\n      return;\n    }\n\n    this.accessToken = accessToken;\n    this.isConnecting = true;\n\n    try {\n      const hubUrl = this.buildHubUrl();\n\n      this.connection = new HubConnectionBuilder()\n        .withUrl(hubUrl, {\n          accessTokenFactory: () => accessToken,\n        })\n        .withAutomaticReconnect({\n          nextRetryDelayInMilliseconds: (retryContext) => {\n            // Exponential backoff: 1s, 2s, 4s, 8s, 16s\n            const delay = Math.min(\n              this.config.reconnectDelay * Math.pow(2, retryContext.previousRetryCount),\n              16000\n            );\n            this.log(`🔄 Reconnect attempt ${retryContext.previousRetryCount + 1} in ${delay}ms`);\n            return delay;\n          },\n        })\n        .configureLogging(this.config.verbose ? LogLevel.Information : LogLevel.Warning)\n        .build();\n\n      // Setup event handlers\n      this.setupConnectionHandlers();\n\n      // Connect\n      this.log(`🔄 Connecting to SignalR hub: ${hubUrl}`);\n      await this.connection.start();\n\n      this.log(`✅ Connected successfully (ID: ${this.connection.connectionId})`);\n      this.reconnectAttempts = 0;\n    } catch (error) {\n      this.log(`❌ Connection failed: ${error}`, 'error');\n      this.reconnectAttempts++;\n\n      // Retry with exponential backoff\n      if (this.reconnectAttempts <= this.config.maxReconnectAttempts) {\n        const delay = Math.min(\n          this.config.reconnectDelay * Math.pow(2, this.reconnectAttempts - 1),\n          30000\n        );\n        this.log(\n          `🔄 Retrying in ${delay}ms (attempt ${this.reconnectAttempts}/${this.config.maxReconnectAttempts})`\n        );\n\n        setTimeout(() => {\n          this.connect(accessToken);\n        }, delay);\n      } else {\n        this.log('❌ Max reconnection attempts reached', 'error');\n      }\n    } finally {\n      this.isConnecting = false;\n    }\n  }\n\n  /**\n   * Build hub URL\n   */\n  private buildHubUrl(): string {\n    let baseUrl = this.config.baseUrl;\n\n    if (!baseUrl && typeof window !== 'undefined') {\n      baseUrl = window.location.origin;\n    }\n\n    if (!baseUrl) {\n      throw new Error('SignalR baseUrl is required outside browser runtimes');\n    }\n\n    return `${baseUrl}${this.config.hubPath}`;\n  }\n\n  /**\n   * Setup connection lifecycle handlers\n   */\n  private setupConnectionHandlers(): void {\n    if (!this.connection) return;\n\n    this.connection.onreconnecting((error) => {\n      this.log(`🔄 Reconnecting... ${error?.message || ''}`);\n    });\n\n    this.connection.onreconnected((connectionId) => {\n      this.log(`✅ Reconnected (ID: ${connectionId})`);\n      this.reconnectAttempts = 0;\n    });\n\n    this.connection.onclose((error) => {\n      this.log(`🔌 Connection closed: ${error?.message || 'No error'}`);\n\n      // Auto-reconnect if we have a token and it wasn't a manual disconnect\n      if (this.accessToken && error) {\n        setTimeout(() => {\n          this.connect(this.accessToken);\n        }, 5000);\n      }\n    });\n\n    // Re-register all event handlers\n    this.eventHandlers.forEach((handlers, eventName) => {\n      this.connection!.on(eventName, (event: unknown) => {\n        handlers.forEach((handler) => {\n          try {\n            handler(event);\n          } catch (err) {\n            this.log(`❌ Error in ${eventName} handler: ${err}`, 'error');\n          }\n        });\n      });\n    });\n  }\n\n  /**\n   * Disconnect from SignalR hub\n   */\n  async disconnect(): Promise<void> {\n    if (this.connection) {\n      this.log('🔌 Disconnecting...');\n      await this.connection.stop();\n      this.connection = null;\n      this.accessToken = null;\n      this.reconnectAttempts = 0;\n    }\n  }\n\n  /**\n   * Register event handler\n   */\n  on<T = unknown>(eventName: string, handler: SignalREventHandler<T>): () => void {\n    // Add to handlers map\n    if (!this.eventHandlers.has(eventName)) {\n      this.eventHandlers.set(eventName, new Set());\n    }\n    this.eventHandlers.get(eventName)!.add(handler as SignalREventHandler);\n\n    // If already connected, register immediately\n    if (this.connection) {\n      this.connection.on(eventName, handler);\n    }\n\n    // Return unsubscribe function\n    return () => {\n      this.eventHandlers.get(eventName)?.delete(handler as SignalREventHandler);\n      this.connection?.off(eventName, handler);\n    };\n  }\n\n  /**\n   * Invoke hub method\n   */\n  async invoke<T = void>(methodName: string, ...args: unknown[]): Promise<T> {\n    if (!this.connection || this.connection.state !== 'Connected') {\n      throw new Error('SignalR not connected');\n    }\n    return this.connection.invoke<T>(methodName, ...args);\n  }\n\n  /**\n   * Get current connection state\n   */\n  get connectionState(): SignalRConnectionState {\n    return (this.connection?.state as SignalRConnectionState) || 'Disconnected';\n  }\n\n  /**\n   * Check if connected\n   */\n  get isConnected(): boolean {\n    return this.connection?.state === 'Connected';\n  }\n\n  /**\n   * Get connection ID\n   */\n  get connectionId(): string | null {\n    return this.connection?.connectionId || null;\n  }\n\n  /**\n   * Cleanup resources\n   */\n  dispose(): void {\n    if (this.visibilityHandler && typeof document !== 'undefined') {\n      document.removeEventListener('visibilitychange', this.visibilityHandler);\n    }\n    this.disconnect();\n    this.eventHandlers.clear();\n  }\n\n  /**\n   * Log message\n   */\n  private log(message: string, level: 'info' | 'warn' | 'error' = 'info'): void {\n    if (!this.config.verbose && level === 'info') return;\n\n    const prefix = '[SignalR]';\n    switch (level) {\n      case 'warn':\n        console.warn(prefix, message);\n        break;\n      case 'error':\n        console.error(prefix, message);\n        break;\n      default:\n        console.log(prefix, message);\n    }\n  }\n}\n\n/**\n * Create Identity SignalR Client\n * \n * Factory function to create a SignalR client for identity hub.\n */\nexport function createIdentitySignalRClient(\n  options: Omit<SignalRClientConfig, 'hubPath'> = {}\n): SignalRClient {\n  return new SignalRClient({\n    ...options,\n    hubPath: '/hubs/identity',\n  });\n}\n\n/**\n * Identity SignalR Client\n * \n * Specialized client for identity context changes.\n */\nexport class IdentitySignalRClient extends SignalRClient {\n  private identityHandlers: IdentityContextChangeHandler[] = [];\n\n  constructor(options: Omit<SignalRClientConfig, 'hubPath'> = {}) {\n    super({\n      ...options,\n      hubPath: '/hubs/identity',\n    });\n\n    // Register identity context change handler\n    this.on<IdentityContextChangedEvent>('IdentityContextChanged', (event) => {\n      this.identityHandlers.forEach((handler) => {\n        try {\n          handler(event);\n        } catch (error) {\n          console.error('Error in identity context change handler:', error);\n        }\n      });\n    });\n  }\n\n  /**\n   * Add handler for identity context changes\n   */\n  onIdentityContextChanged(handler: IdentityContextChangeHandler): () => void {\n    this.identityHandlers.push(handler);\n\n    return () => {\n      const index = this.identityHandlers.indexOf(handler);\n      if (index > -1) {\n        this.identityHandlers.splice(index, 1);\n      }\n    };\n  }\n}\n\n/**\n * Singleton identity client instance\n */\nlet identityClientInstance: IdentitySignalRClient | null = null;\n\n/**\n * Get or create singleton identity SignalR client\n */\nexport function getIdentitySignalRClient(\n  options: Omit<SignalRClientConfig, 'hubPath'> = {}\n): IdentitySignalRClient {\n  if (!identityClientInstance) {\n    identityClientInstance = new IdentitySignalRClient(options);\n  }\n  return identityClientInstance;\n}\n\n/**\n * Initialize SignalR with access token\n */\nexport async function initializeSignalR(\n  accessToken: string | null,\n  options: Omit<SignalRClientConfig, 'hubPath'> = {}\n): Promise<IdentitySignalRClient> {\n  if (typeof window === 'undefined') {\n    throw new Error('SignalR can only be initialized on the client');\n  }\n\n  const client = getIdentitySignalRClient(options);\n  await client.connect(accessToken);\n  return client;\n}\n\n/**\n * Cleanup SignalR connection\n */\nexport async function cleanupSignalR(): Promise<void> {\n  if (identityClientInstance) {\n    await identityClientInstance.disconnect();\n    identityClientInstance.dispose();\n    identityClientInstance = null;\n  }\n}\n"],"mappings":";;;;;;;;;;;AAmBA,MAAM,iBAA6E;CACjF,sBAAsB;CACtB,gBAAgB;CAChB,SAAS;CACT,2BAA2B;AAC7B;;;;;;AAOA,IAAa,gBAAb,MAA2B;CACzB,aAA2C;CAC3C,cAAqC;CACrC,eAAuB;CACvB,oBAA4B;CAC5B;CACA,gCAA+D,IAAI,IAAI;CACvE,oBAAiD;CAEjD,YAAY,QAA6B;EACvC,KAAK,SAAS;GACZ,GAAG;GACH,GAAG;EACL;EAGA,IAAI,OAAO,aAAa,eAAe,KAAK,OAAO,2BAA2B;GAC5E,KAAK,0BAA0B;IAC7B,IAAI,SAAS,oBAAoB,aAAa,KAAK,YAAY,UAAU,gBAAgB;KACvF,KAAK,IAAI,oDAAoD;KAC7D,KAAK,QAAQ,KAAK,WAAW;IAC/B;GACF;GACA,SAAS,iBAAiB,oBAAoB,KAAK,iBAAiB;EACtE;CACF;;;;CAKA,MAAM,QAAQ,aAA2C;EACvD,IAAI,CAAC,aAAa;GAChB,KAAK,IAAI,sDAAsD,MAAM;GACrE;EACF;EAEA,IAAI,KAAK,cAAc;GACrB,KAAK,IAAI,sCAAsC;GAC/C;EACF;EAEA,IAAI,KAAK,YAAY,UAAU,aAAa;GAC1C,KAAK,IAAI,qBAAqB;GAC9B;EACF;EAEA,KAAK,cAAc;EACnB,KAAK,eAAe;EAEpB,IAAI;GACF,MAAM,SAAS,KAAK,YAAY;GAEhC,KAAK,aAAa,IAAI,qBAAqB,CAAC,CACzC,QAAQ,QAAQ,EACf,0BAA0B,YAC5B,CAAC,CAAC,CACD,uBAAuB,EACtB,+BAA+B,iBAAiB;IAE9C,MAAM,QAAQ,KAAK,IACjB,KAAK,OAAO,iBAAiB,KAAK,IAAI,GAAG,aAAa,kBAAkB,GACxE,IACF;IACA,KAAK,IAAI,wBAAwB,aAAa,qBAAqB,EAAE,MAAM,MAAM,GAAG;IACpF,OAAO;GACT,EACF,CAAC,CAAC,CACD,iBAAiB,KAAK,OAAO,UAAU,SAAS,cAAc,SAAS,OAAO,CAAC,CAC/E,MAAM;GAGT,KAAK,wBAAwB;GAG7B,KAAK,IAAI,iCAAiC,QAAQ;GAClD,MAAM,KAAK,WAAW,MAAM;GAE5B,KAAK,IAAI,iCAAiC,KAAK,WAAW,aAAa,EAAE;GACzE,KAAK,oBAAoB;EAC3B,SAAS,OAAO;GACd,KAAK,IAAI,wBAAwB,SAAS,OAAO;GACjD,KAAK;GAGL,IAAI,KAAK,qBAAqB,KAAK,OAAO,sBAAsB;IAC9D,MAAM,QAAQ,KAAK,IACjB,KAAK,OAAO,iBAAiB,KAAK,IAAI,GAAG,KAAK,oBAAoB,CAAC,GACnE,GACF;IACA,KAAK,IACH,kBAAkB,MAAM,cAAc,KAAK,kBAAkB,GAAG,KAAK,OAAO,qBAAqB,EACnG;IAEA,iBAAiB;KACf,KAAK,QAAQ,WAAW;IAC1B,GAAG,KAAK;GACV,OACE,KAAK,IAAI,uCAAuC,OAAO;EAE3D,UAAU;GACR,KAAK,eAAe;EACtB;CACF;;;;CAKA,cAA8B;EAC5B,IAAI,UAAU,KAAK,OAAO;EAE1B,IAAI,CAAC,WAAW,OAAO,WAAW,aAChC,UAAU,OAAO,SAAS;EAG5B,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,sDAAsD;EAGxE,OAAO,GAAG,UAAU,KAAK,OAAO;CAClC;;;;CAKA,0BAAwC;EACtC,IAAI,CAAC,KAAK,YAAY;EAEtB,KAAK,WAAW,gBAAgB,UAAU;GACxC,KAAK,IAAI,sBAAsB,OAAO,WAAW,IAAI;EACvD,CAAC;EAED,KAAK,WAAW,eAAe,iBAAiB;GAC9C,KAAK,IAAI,sBAAsB,aAAa,EAAE;GAC9C,KAAK,oBAAoB;EAC3B,CAAC;EAED,KAAK,WAAW,SAAS,UAAU;GACjC,KAAK,IAAI,yBAAyB,OAAO,WAAW,YAAY;GAGhE,IAAI,KAAK,eAAe,OACtB,iBAAiB;IACf,KAAK,QAAQ,KAAK,WAAW;GAC/B,GAAG,GAAI;EAEX,CAAC;EAGD,KAAK,cAAc,SAAS,UAAU,cAAc;GAClD,KAAK,WAAY,GAAG,YAAY,UAAmB;IACjD,SAAS,SAAS,YAAY;KAC5B,IAAI;MACF,QAAQ,KAAK;KACf,SAAS,KAAK;MACZ,KAAK,IAAI,cAAc,UAAU,YAAY,OAAO,OAAO;KAC7D;IACF,CAAC;GACH,CAAC;EACH,CAAC;CACH;;;;CAKA,MAAM,aAA4B;EAChC,IAAI,KAAK,YAAY;GACnB,KAAK,IAAI,qBAAqB;GAC9B,MAAM,KAAK,WAAW,KAAK;GAC3B,KAAK,aAAa;GAClB,KAAK,cAAc;GACnB,KAAK,oBAAoB;EAC3B;CACF;;;;CAKA,GAAgB,WAAmB,SAA6C;EAE9E,IAAI,CAAC,KAAK,cAAc,IAAI,SAAS,GACnC,KAAK,cAAc,IAAI,2BAAW,IAAI,IAAI,CAAC;EAE7C,KAAK,cAAc,IAAI,SAAS,CAAC,CAAE,IAAI,OAA8B;EAGrE,IAAI,KAAK,YACP,KAAK,WAAW,GAAG,WAAW,OAAO;EAIvC,aAAa;GACX,KAAK,cAAc,IAAI,SAAS,CAAC,EAAE,OAAO,OAA8B;GACxE,KAAK,YAAY,IAAI,WAAW,OAAO;EACzC;CACF;;;;CAKA,MAAM,OAAiB,YAAoB,GAAG,MAA6B;EACzE,IAAI,CAAC,KAAK,cAAc,KAAK,WAAW,UAAU,aAChD,MAAM,IAAI,MAAM,uBAAuB;EAEzC,OAAO,KAAK,WAAW,OAAU,YAAY,GAAG,IAAI;CACtD;;;;CAKA,IAAI,kBAA0C;EAC5C,OAAQ,KAAK,YAAY,SAAoC;CAC/D;;;;CAKA,IAAI,cAAuB;EACzB,OAAO,KAAK,YAAY,UAAU;CACpC;;;;CAKA,IAAI,eAA8B;EAChC,OAAO,KAAK,YAAY,gBAAgB;CAC1C;;;;CAKA,UAAgB;EACd,IAAI,KAAK,qBAAqB,OAAO,aAAa,aAChD,SAAS,oBAAoB,oBAAoB,KAAK,iBAAiB;EAEzE,KAAK,WAAW;EAChB,KAAK,cAAc,MAAM;CAC3B;;;;CAKA,IAAY,SAAiB,QAAmC,QAAc;EAC5E,IAAI,CAAC,KAAK,OAAO,WAAW,UAAU,QAAQ;EAE9C,MAAM,SAAS;EACf,QAAQ,OAAR;GACE,KAAK;IACH,QAAQ,KAAK,QAAQ,OAAO;IAC5B;GACF,KAAK;IACH,QAAQ,MAAM,QAAQ,OAAO;IAC7B;GACF,SACE,QAAQ,IAAI,QAAQ,OAAO;EAC/B;CACF;AACF;;;;;;AAOA,SAAgB,4BACd,UAAgD,CAAC,GAClC;CACf,OAAO,IAAI,cAAc;EACvB,GAAG;EACH,SAAS;CACX,CAAC;AACH;;;;;;AAOA,IAAa,wBAAb,cAA2C,cAAc;CACvD,mBAA2D,CAAC;CAE5D,YAAY,UAAgD,CAAC,GAAG;EAC9D,MAAM;GACJ,GAAG;GACH,SAAS;EACX,CAAC;EAGD,KAAK,GAAgC,2BAA2B,UAAU;GACxE,KAAK,iBAAiB,SAAS,YAAY;IACzC,IAAI;KACF,QAAQ,KAAK;IACf,SAAS,OAAO;KACd,QAAQ,MAAM,6CAA6C,KAAK;IAClE;GACF,CAAC;EACH,CAAC;CACH;;;;CAKA,yBAAyB,SAAmD;EAC1E,KAAK,iBAAiB,KAAK,OAAO;EAElC,aAAa;GACX,MAAM,QAAQ,KAAK,iBAAiB,QAAQ,OAAO;GACnD,IAAI,QAAQ,IACV,KAAK,iBAAiB,OAAO,OAAO,CAAC;EAEzC;CACF;AACF;;;;AAKA,IAAI,yBAAuD;;;;AAK3D,SAAgB,yBACd,UAAgD,CAAC,GAC1B;CACvB,IAAI,CAAC,wBACH,yBAAyB,IAAI,sBAAsB,OAAO;CAE5D,OAAO;AACT;;;;AAKA,eAAsB,kBACpB,aACA,UAAgD,CAAC,GACjB;CAChC,IAAI,OAAO,WAAW,aACpB,MAAM,IAAI,MAAM,+CAA+C;CAGjE,MAAM,SAAS,yBAAyB,OAAO;CAC/C,MAAM,OAAO,QAAQ,WAAW;CAChC,OAAO;AACT;;;;AAKA,eAAsB,iBAAgC;CACpD,IAAI,wBAAwB;EAC1B,MAAM,uBAAuB,WAAW;EACxC,uBAAuB,QAAQ;EAC/B,yBAAyB;CAC3B;AACF"}

package/dist/{tenant-DfLemb6n.js → tenant/index.mjs}

@@ -2,9 +2,13 @@ import { create } from "zustand";
 import { createContext, useContext, useEffect } from "react";
 import { jsx } from "react/jsx-runtime";
 import { devtools } from "zustand/middleware";
-
 //#region src/tenant/tenant-store.ts
 /**
+* Tenant Store (Zustand)
+* 
+* Client-side state management for tenant data.
+*/
+/**
 * Tenant client endpoints and browser-visible tenant cookie (configurable).
 */
 let tenantDataEndpoint = "/api/tenant/data";
@@ -96,9 +100,9 @@ async function defaultSwitchTenant({ tenantId, endpoint, fetch: fetchFn }) {
 const useTenantStore = create()(devtools((set, get) => ({
 	currentTenant: null,
 	availableTenants: [],
-	memberships: new Map(),
-	tenantData: new Map(),
-	organizations: new Map(),
+	memberships: /* @__PURE__ */ new Map(),
+	tenantData: /* @__PURE__ */ new Map(),
+	organizations: /* @__PURE__ */ new Map(),
 	isLoading: false,
 	isSwitching: false,
 	setCurrentTenant: (tenantId) => set({ currentTenant: tenantId }),
@@ -110,7 +114,7 @@ const useTenantStore = create()(devtools((set, get) => ({
 		});
 	},
 	setMemberships: (memberships) => {
-		const membershipMap = new Map();
+		const membershipMap = /* @__PURE__ */ new Map();
 		memberships.forEach((membership) => {
 			membershipMap.set(membership.tenantId, membership);
 		});
@@ -218,9 +222,13 @@ function initializeTenantStore(currentTenant, availableTenants, memberships) {
 	store.setAvailableTenants(availableTenants);
 	if (memberships) store.setMemberships(memberships);
 }
-
 //#endregion
 //#region src/tenant/tenant-context.tsx
+/**
+* Tenant Context Provider
+* 
+* React context for tenant management.
+*/
 const TenantContext = createContext(null);
 function TenantProvider({ children, initialTenant = null, initialTenants = [], initialMemberships = [], onTenantChange }) {
 	const currentTenant = useTenantStore((state) => state.currentTenant);
@@ -258,8 +266,8 @@ function TenantProvider({ children, initialTenant = null, initialTenants = [], i
 			const cookieName = getTenantCookieName();
 			const tenantCookie = cookies.find((cookie) => cookie.trim().startsWith(`${cookieName}=`));
 			if (tenantCookie) {
-				const value$1 = tenantCookie.split("=")[1];
-				return decodeURIComponent(value$1);
+				const value = tenantCookie.split("=")[1];
+				return decodeURIComponent(value);
 			}
 			return null;
 		};
@@ -287,7 +295,6 @@ function TenantProvider({ children, initialTenant = null, initialTenants = [], i
 	useEffect(() => {
 		if (currentTenant && !currentTenantData) refreshTenantData();
 	}, [currentTenant, currentTenantData]);
-	const currentOrganization = currentTenantData;
 	const value = {
 		currentTenant,
 		availableTenants,
@@ -302,7 +309,7 @@ function TenantProvider({ children, initialTenant = null, initialTenants = [], i
 		getTenantData,
 		getMembership,
 		getTenantName,
-		currentOrganization,
+		currentOrganization: currentTenantData,
 		organizations,
 		refreshOrganization,
 		getOrganization
@@ -378,7 +385,7 @@ function useOrganization() {
 		isLoading
 	};
 }
-
 //#endregion
 export { TenantProvider, configureTenantClient, configureTenantEndpoints, getTenantCookieName, initializeTenantStore, normalizeTenantDataPayload, normalizeTenantSwitchPayload, resetTenantClientConfig, useCurrentOrganization, useCurrentTenant, useCurrentTenantData, useOrganization, useTenant, useTenantData, useTenantStore, useTenantSwitcher };
-//# sourceMappingURL=tenant-DfLemb6n.js.map
+
+//# sourceMappingURL=index.mjs.map