@eminuckan/spine 0.3.11 → 0.3.12

package/CHANGELOG.md

@@ -6,6 +6,83 @@ All notable changes to this project will be documented in this file.
 
 No unreleased changes.
 
+## [0.3.12] - 2026-11-05
+
+### Added
+
+- Added a server-only Redis refresh lease so concurrent token refreshes for one
+  session are serialized across server processes. A caller that loses the race
+  reuses the tokens the winner saved instead of redeeming the same rotating
+  refresh token a second time.
+- Added `TokenRefreshResult.sessionInvalidated`, set when a terminal refresh
+  failure has already deleted the Redis session, and an optional
+  `logout(request, { sessionInvalidated })` argument that then only clears the
+  session cookie without rereading or revoking a replacement session.
+- Added an optional `state` argument to `clearOAuthRecoveryIntentHeaders` to
+  clear the recovery cookie of one exact OAuth transaction.
+- Added `getAuthSession(request, { throwOnError })` so callers can tell a Redis
+  failure apart from a missing session.
+
+### Changed
+
+- Split token refresh failures into terminal and temporary. Only a provider
+  `invalid_grant` rejection, a missing or replaced session, or a missing
+  refresh token sets `shouldLogout: true`; provider outages, timeouts,
+  malformed refresh responses and lease contention now return
+  `shouldLogout: false` and keep the refreshable session. Consumers that
+  treated every failed `refreshTokens` or `attemptTokenRefresh` result as a
+  logout must read `shouldLogout` instead.
+- The fetch middleware now answers a temporary refresh failure with the
+  `AUTH_REFRESH_UNAVAILABLE` client error, a synthetic 503 and
+  `shouldLogout: false`, and keeps `REFRESH_TOKEN_EXPIRED` for terminal
+  failures.
+- `protectRoute` and `shouldRefreshToken` now throw a `503` response
+  (`Cache-Control: no-store`, `Retry-After: 5`) when renewal or session storage
+  is temporarily unavailable, instead of logging the user out. Route modules
+  must let a thrown `Response` through, as they already do for redirects.
+- A session with an expired token and no refresh token is now invalidated by the
+  same conditional refresh path, so it can no longer delete a session
+  generation that replaced it.
+- Refresh requests to the provider now time out after 15 seconds, and the token
+  expiry check uses the earlier of the stored `expiresAt` and the JWT `exp`
+  claim consistently across route protection, session validation and refresh.
+- OAuth transaction cookies are now scoped per callback state. The state
+  pointer and the recovery ticket cookie names gain a `_<sha256 of the exact
+  state>` suffix, so two login tabs no longer overwrite each other's pending
+  transaction. Cookie names still derive from the existing application cookie
+  prefix; no environment variable or configuration changes.
+- Adapters that inspect `Set-Cookie` names from `login` or recovery responses
+  must match the suffixed names (`<prefix>_oauth_state_id_<hash>` and
+  `<prefix>_oauth_recovery_<hash>`) instead of the bare names.
+  `OAUTH_RECOVERY_COOKIE_NAME` remains the exported base name.
+- An OAuth login that is in flight across the upgrade still completes: when no
+  scoped cookie exists, the callback and recovery paths fall back to the legacy
+  single-cookie names, and a legacy cookie is cleared only after its exact
+  state is verified.
+- A callback now deletes its Redis OAuth state only when the stored `state`
+  equals the callback's `state`, and a callback with a repeated or oversized
+  `state` parameter is not eligible for stale-callback recovery.
+- Read `NODE_ENV` through `node:process` in the server cookie helpers.
+
+### Security
+
+- Capped pending OAuth transactions at 8 per browser. `login` fails with
+  `Login failed` instead of growing the cookie header or evicting another tab's
+  transaction, and callbacks with an oversized, duplicated or malformed
+  cookie header are rejected as malformed.
+- Refresh persistence, lease release and invalidation compare the encrypted
+  Redis snapshot and the lease owner atomically, so a concurrent logout or a
+  newer token generation is never overwritten by a late refresh.
+- A late provider response after the refresh deadline no longer persists tokens.
+
+### Tested
+
+- Added a real-Redis token refresh integration suite covering concurrent
+  refresh coordination, provider outages, `invalid_grant` invalidation, lease
+  loss and concurrent logout. It runs when `SPINE_TEST_REDIS_URL` points at a
+  Redis server, which CI now provides, and is skipped otherwise.
+- Added per-state OAuth transaction cookie, recovery and capacity coverage.
+
 ## [0.3.11] - 2026-08-11
 
 ### Added

package/dist/api-client/fetch-client.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-client.server.d.ts","sourceRoot":"","sources":["../../src/api-client/fetch-client.server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAEV,SAAS,EAET,SAAS,EACT,sBAAsB,EACtB,iBAAiB,EAEjB,eAAe,EAGf,WAAW,EACX,cAAc,EAEf,MAAM,SAAS,CAAC;AASjB,KAAK,oBAAoB,GAAG,MAAM,CAAC;AAsQnC,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,mBAAmB,CAAC,EAAE,cAAc,CAAC;IACrC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,iBAAsB,GAC9B,eAAe,EAAE,CAyHnB;AAED,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB,EAAE,sBAAsB;IACvF,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AA8ED,wBAAsB,eAAe,CAAC,CAAC,SAAS,oBAAoB,EAClE,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,KAAK,aAAa,CAAC,EAAE,OAAO,KAAK,CAAC,EAC/C,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,sBAAsB,KAAK,OAAO,CAAC,SAAS,CAAC,EAC3F,kBAAkB,EAAE,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,EACrE,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC;IAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgC7D"}
+{"version":3,"file":"fetch-client.server.d.ts","sourceRoot":"","sources":["../../src/api-client/fetch-client.server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAEV,SAAS,EAET,SAAS,EACT,sBAAsB,EACtB,iBAAiB,EAEjB,eAAe,EAGf,WAAW,EACX,cAAc,EAEf,MAAM,SAAS,CAAC;AASjB,KAAK,oBAAoB,GAAG,MAAM,CAAC;AAsQnC,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,mBAAmB,CAAC,EAAE,cAAc,CAAC;IACrC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,iBAAsB,GAC9B,eAAe,EAAE,CA4HnB;AAED,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB,EAAE,sBAAsB;IACvF,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AA8ED,wBAAsB,eAAe,CAAC,CAAC,SAAS,oBAAoB,EAClE,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,KAAK,aAAa,CAAC,EAAE,OAAO,KAAK,CAAC,EAC/C,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,sBAAsB,KAAK,OAAO,CAAC,SAAS,CAAC,EAC3F,kBAAkB,EAAE,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,EACrE,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC;IAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgC7D"}

package/dist/api-client/server.mjs

@@ -1,4 +1,4 @@
 import { t as isApiClientError } from "../types-DqCXinAk.mjs";
 import { a as withRetry, c as handleApiError, i as isRetryableError, l as ErrorCodes, n as createRetryFetch, o as ApiError, r as fetchWithTimeout, s as ErrorHandler, t as calculateBackoffDelay } from "../api-client-CB7XZaMg.mjs";
-import { n as createFetchMiddleware, r as createAPIConfigFactory, t as createApiClient } from "../server-pnsLybIH.mjs";
+import { n as createFetchMiddleware, r as createAPIConfigFactory, t as createApiClient } from "../server-iCmy3RW8.mjs";
 export { ApiError, ErrorCodes, ErrorHandler, calculateBackoffDelay, createAPIConfigFactory, createApiClient, createFetchMiddleware, createRetryFetch, fetchWithTimeout, handleApiError, isApiClientError, isRetryableError, withRetry };

package/dist/auth/auth.server.d.ts

@@ -1,13 +1,3 @@
-/**
- * OpenID Connect Authentication Server Module
- *
- * Handles:
- * - Login flow (PKCE)
- * - Token exchange
- * - Token refresh
- * - Logout
- * - Session management
- */
 import { isSessionValid } from './redis-session-storage.server';
 import type { AuthClaimMapping, UserInfo, TokenRefreshResult, LoginOptions, AuthError } from './types';
 export declare function createAuthorizationResponseUrl(requestUrl: string, redirectUri: string): URL;
@@ -89,7 +79,9 @@ export declare function handleCallback(request: Request): Promise<Response>;
  * `/auth/logout?logout=local` to clear only this app's Redis session without
  * bouncing the browser through the identity provider or revoking SSO tokens.
  */
-export declare function logout(request: Request): Promise<Response>;
+export declare function logout(request: Request, options?: {
+    sessionInvalidated?: boolean;
+}): Promise<Response>;
 /**
  * Handle an OIDC Back-Channel Logout request from Keycloak or another OP.
  *
@@ -118,9 +110,7 @@ export declare function requireAuth(request: Request): Promise<UserInfo>;
  * Get access token from session
  */
 export declare function getAccessToken(request: Request): Promise<string | null>;
-/**
- * Refresh tokens
- */
+/** Refresh only a signed, existing session, serialized across server processes. */
 export declare function refreshTokens(request: Request, refreshToken?: string): Promise<TokenRefreshResult>;
 export { isSessionValid };
 /**

package/dist/auth/auth.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.server.d.ts","sourceRoot":"","sources":["../../src/auth/auth.server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EAKL,cAAc,EAUf,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAEV,gBAAgB,EAChB,QAAQ,EAGR,kBAAkB,EAClB,YAAY,EAKZ,SAAS,EACV,MAAM,SAAS,CAAC;AAmPjB,wBAAgB,8BAA8B,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,GAAG,CAM3F;AAyUD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAgBzE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAI5C;AAkID;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CAkDA;AA0DD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAkB/D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAW/C;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAGtD;AAkLD;;;;;GAKG;AACH,wBAAsB,KAAK,CACzB,OAAO,EAAE,OAAO,EAChB,kBAAkB,CAAC,EAAE,MAAM,GAAG,YAAY,GACzC,OAAO,CAAC,QAAQ,CAAC,CAgJnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8SxE;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2GhE;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsDjF;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmClF;AAqCD;;GAEG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAaxE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWrE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ7E;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAuE7B;AAGD,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C"}
+{"version":3,"file":"auth.server.d.ts","sourceRoot":"","sources":["../../src/auth/auth.server.ts"],"names":[],"mappings":"AAeA,OAAO,EAUL,cAAc,EAUf,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAEV,gBAAgB,EAChB,QAAQ,EAGR,kBAAkB,EAClB,YAAY,EAKZ,SAAS,EACV,MAAM,SAAS,CAAC;AA6PjB,wBAAgB,8BAA8B,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,GAAG,CAM3F;AAyUD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAgBzE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAI5C;AAkID;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CAkDA;AAyDD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAkB/D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAW/C;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAGtD;AA+JD;;;;;GAKG;AACH,wBAAsB,KAAK,CACzB,OAAO,EAAE,OAAO,EAChB,kBAAkB,CAAC,EAAE,MAAM,GAAG,YAAY,GACzC,OAAO,CAAC,QAAQ,CAAC,CAoJnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmUxE;AAUD;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE;IAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC7C,OAAO,CAAC,QAAQ,CAAC,CAkGnB;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsDjF;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmClF;AAYD;;GAEG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAaxE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWrE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ7E;AA2CD,mFAAmF;AACnF,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,kBAAkB,CAAC,CA+H7B;AAGD,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C"}

package/dist/auth/oauth-recovery.server.d.ts

@@ -1,13 +1,7 @@
-/**
- * Server-only recovery intent for stale OAuth callbacks.
- *
- * A recovery intent is an opaque, HttpOnly cookie backed by a separate Redis
- * record. Consumers must atomically consume it with the typed stale callback
- * error; the client never supplies a boolean budget or a return URL.
- */
 import { OAUTH_RECOVERY_TTL_SECONDS } from './oauth-state-config';
 import type { OAuthState } from './types';
-export declare const OAUTH_RECOVERY_COOKIE_NAME: string;
+import { OAUTH_RECOVERY_COOKIE_NAME } from './oauth-transaction-cookies.server';
+export { OAUTH_RECOVERY_COOKIE_NAME };
 export { OAUTH_RECOVERY_TTL_SECONDS };
 export interface OAuthRecoveryIntent {
     /** The sanitized destination originally supplied to login(). */
@@ -16,7 +10,7 @@ export interface OAuthRecoveryIntent {
 export interface OAuthRecoveryConsumeResult {
     /** A server-record-backed destination, or null when recovery is unavailable. */
     readonly intent: OAuthRecoveryIntent | null;
-    /** Always clear the one-shot ticket cookie in the adapter response. */
+    /** Clear this callback's ticket; preserve a legacy pointer of unknown ownership. */
     readonly cleanupHeaders: Headers;
     /** Lossless repeated Set-Cookie values for runtimes without getSetCookie(). */
     readonly cleanupSetCookies: readonly string[];
@@ -35,7 +29,7 @@ export declare function getOAuthRecoveryCookiePath(source: Request | URL | strin
  * Build a lossless ticket-clear header using a callback request, URL, or
  * configured redirect URI as the cookie-path source.
  */
-export declare function clearOAuthRecoveryIntentHeaders(source: Request | URL | string): Headers;
+export declare function clearOAuthRecoveryIntentHeaders(source: Request | URL | string, state?: string): Headers;
 /**
  * This check is intentionally stricter than the callback error code.  It
  * prevents recovery for provider errors, malformed callbacks, and account
@@ -47,7 +41,7 @@ export declare function isOAuthRecoveryEligibleCallback(request: Request): boole
  * Application-action transactions deliberately do not receive a recovery
  * ticket and therefore cannot enter the automatic recovery path.
  */
-export declare function createOAuthRecoveryForLogin(request: Request, state: Pick<OAuthState, 'state' | 'returnUrl'>, redirectUri: string): Promise<OAuthRecoveryLoginResult>;
+export declare function createOAuthRecoveryForLogin(request: Request, state: Pick<OAuthState, 'state' | 'returnUrl'>, redirectUri: string, cookieState?: string): Promise<OAuthRecoveryLoginResult>;
 /**
  * Delete an unconsumed ticket during terminal/successful callback cleanup.
  * The caller owns error classification and should still clear the browser

package/dist/auth/oauth-recovery.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-recovery.server.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-recovery.server.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,OAAO,EAEL,0BAA0B,EAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,eAAO,MAAM,0BAA0B,QAA+C,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,CAAC;AAEtC,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IACzC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC5C,uEAAuE;IACvE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AA6DD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,OAAO,GAAG,GAAG,GAAG,MAAM,GAC7B,MAAM,CAcR;AA0CD;;;GAGG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,OAAO,GAAG,GAAG,GAAG,MAAM,GAC7B,OAAO,CAIT;AAMD;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAOzE;AAwBD;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,WAAW,CAAC,EAC9C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,wBAAwB,CAAC,CAiBnC;AAED;;;;GAIG;AACH,wBAAsB,8BAA8B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAYvF;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,0BAA0B,CAAC,CA8CrC"}
+{"version":3,"file":"oauth-recovery.server.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-recovery.server.ts"],"names":[],"mappings":"AAiBA,OAAO,EAEL,0BAA0B,EAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,EAGL,0BAA0B,EAG3B,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,0BAA0B,EAAE,CAAC;AACtC,OAAO,EAAE,0BAA0B,EAAE,CAAC;AAEtC,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IACzC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC5C,oFAAoF;IACpF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAgCD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,OAAO,GAAG,GAAG,GAAG,MAAM,GAC7B,MAAM,CAcR;AAgDD;;;GAGG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,OAAO,GAAG,GAAG,GAAG,MAAM,EAC9B,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAUT;AAMD;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CASzE;AAmBD;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,WAAW,CAAC,EAC9C,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAqBnC;AAED;;;;GAIG;AACH,wBAAsB,8BAA8B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBvF;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,0BAA0B,CAAC,CAkDrC"}

package/dist/auth/oauth-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-security.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-security.ts"],"names":[],"mappings":"AAyCA;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,EAAE,OAAO,GACf,MAAM,GAAG,IAAI,CAqBf;AAED,KAAK,0BAA0B,GAAG;IAChC,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,kEAAkE;AAClE,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,0BAA0B,GAClC,MAAM,CAcR"}
+{"version":3,"file":"oauth-security.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-security.ts"],"names":[],"mappings":"AA0CA;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,EAAE,OAAO,GACf,MAAM,GAAG,IAAI,CAqBf;AAED,KAAK,0BAA0B,GAAG;IAChC,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,kEAAkE;AAClE,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,0BAA0B,GAClC,MAAM,CAcR"}

package/dist/auth/oauth-transaction-cookies.server.d.ts

@@ -0,0 +1,18 @@
+export declare const OAUTH_STATE_COOKIE_NAME: string;
+export declare const OAUTH_RECOVERY_COOKIE_NAME: string;
+export declare const MAX_PENDING_OAUTH_TRANSACTIONS = 8;
+export interface OAuthTransactionCookie {
+    readonly name: string | null;
+    readonly value: string | null;
+    readonly present: boolean;
+    readonly malformed: boolean;
+    readonly scoped: boolean;
+}
+/** Hash the exact wire state so public context never becomes a cookie name. */
+export declare function getScopedOAuthCookieName(baseName: string, state: string): string;
+export declare function getOAuthCallbackState(request: Request): string | null;
+/** A present but invalid scoped cookie must never fall back to the singleton. */
+export declare function readOAuthTransactionCookie(request: Request, baseName: string, state: string | null, allowLegacy?: boolean): OAuthTransactionCookie;
+/** Bound browser growth without evicting another tab's pending transaction. */
+export declare function assertOAuthTransactionCapacity(request: Request): void;
+//# sourceMappingURL=oauth-transaction-cookies.server.d.ts.map

package/dist/auth/oauth-transaction-cookies.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-transaction-cookies.server.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-transaction-cookies.server.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,uBAAuB,QAA+C,CAAC;AACpF,eAAO,MAAM,0BAA0B,QAA+C,CAAC;AACvF,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAQhD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,+EAA+E;AAC/E,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAShF;AAOD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAGrE;AAoBD,iFAAiF;AACjF,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,WAAW,UAAO,GACjB,sBAAsB,CA4BxB;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAUrE"}

package/dist/auth/redis-session-storage.server.d.ts

@@ -1,16 +1,30 @@
-/**
- * Redis Session Storage Server Module
- *
- * Redis-backed session storage for authentication.
- * Provides secure session management with automatic expiration,
- * without depending on a framework-specific session implementation.
- */
 import type { AuthSessionSummary, SessionData, OAuthState } from './types';
 export declare const AUTH_ERROR_COOKIE_PREFIX: string;
 export declare function createAuthSession(request: Request, sessionData: Partial<SessionData>): Promise<Headers>;
-export declare function getAuthSession(request: Request): Promise<SessionData>;
+export declare function getAuthSession(request: Request, options?: {
+    throwOnError?: boolean;
+}): Promise<SessionData>;
+/** Internal refresh coordination. The owner is never derived from client input. */
+export declare function acquireAuthSessionRefreshLock(sessionId: string, owner: string, ttlMs: number): Promise<boolean>;
+export declare function releaseAuthSessionRefreshLock(sessionId: string, owner: string): Promise<void>;
+type RefreshedSessionFields = Pick<SessionData, 'accessToken' | 'refreshToken' | 'idToken' | 'expiresAt' | 'lastActivity'>;
+export declare function hasSameAuthTokenGeneration(current: SessionData, expected: SessionData): boolean;
+/** Delete only the rejected generation while its refresh lease is still owned. */
+export declare function invalidateAuthSessionRefreshGeneration(expected: SessionData & {
+    sessionId: string;
+}, owner: string): Promise<'invalidated' | 'missing' | 'changed' | 'lock-lost'>;
+/**
+ * Merge tokens with the latest session and atomically compare the encrypted
+ * snapshot and lease owner. Redis never needs the session encryption key.
+ * A concurrent logout or replacement token generation cannot be overwritten.
+ */
+export declare function saveRefreshedAuthSession(expected: SessionData & {
+    sessionId: string;
+}, owner: string, updates: RefreshedSessionFields): Promise<'updated' | 'missing' | 'changed' | 'lock-lost'>;
 export declare function updateAuthSession(request: Request, updates: Partial<SessionData>): Promise<Headers>;
 export declare function destroyAuthSession(request: Request): Promise<Headers>;
+/** Cookie cleanup after a generation was already invalidated atomically. */
+export declare function clearAuthSessionCookie(): Headers;
 export declare function getCurrentAuthSessionId(request: Request): Promise<string | null>;
 export declare function getAuthSessionById(sessionId: string): Promise<SessionData | null>;
 export declare function listAuthSessionDataForUser(userId: string): Promise<Array<{
@@ -34,7 +48,7 @@ export declare function createOAuthState(state: OAuthState): Promise<string>;
 export declare function getOAuthState(stateId: string, options?: {
     readonly throwOnMalformed?: boolean;
 }): Promise<OAuthState | null>;
-export declare function deleteOAuthState(stateId: string): Promise<void>;
+export declare function deleteOAuthState(stateId: string, expectedState?: string): Promise<void>;
 export interface OAuthRecoveryRecord {
     state: string;
     returnUrl: string;
@@ -55,4 +69,5 @@ export declare function consumeOAuthRecoveryRecord(ticket: string, expectedState
 export declare function deleteOAuthRecoveryRecord(ticket: string): Promise<void>;
 export declare function cleanupExpiredOAuthStates(): Promise<number>;
 export declare function closeRedisConnection(): Promise<void>;
+export {};
 //# sourceMappingURL=redis-session-storage.server.d.ts.map

package/dist/auth/redis-session-storage.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis-session-storage.server.d.ts","sourceRoot":"","sources":["../../src/auth/redis-session-storage.server.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAyD3E,eAAO,MAAM,wBAAwB,QAAgE,CAAC;AA+ctG,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,GAChC,OAAO,CAAC,OAAO,CAAC,CAqBlB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CA4B3E;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAS3E;AAED,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEtF;AAED,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAGvF;AAED,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAAC,CAG1D;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAM/B;AAED,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAOjG;AAED,wBAAsB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQhF;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAWhF;AAED,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAW3E;AAED,wBAAsB,iCAAiC,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAW7F;AAED,wBAAsB,oCAAoC,CAAC,MAAM,EAAE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CAclB;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAQ/E;AAsCD,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAYvE;AAMD,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CASzE;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,GAChD,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAoB5B;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIrE;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAmBD;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAgCrC;AAED,wBAAsB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7E;AAED,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CAejE;AAMD,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAM1D"}
+{"version":3,"file":"redis-session-storage.server.d.ts","sourceRoot":"","sources":["../../src/auth/redis-session-storage.server.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AA2D3E,eAAO,MAAM,wBAAwB,QAAgE,CAAC;AAkdtG,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,GAChC,OAAO,CAAC,OAAO,CAAC,CAqBlB;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GACvC,OAAO,CAAC,WAAW,CAAC,CA4BtB;AAED,mFAAmF;AACnF,wBAAsB,6BAA6B,CACjD,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wBAAsB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnG;AAED,KAAK,sBAAsB,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,GAAG,cAAc,GAAG,SAAS,GAAG,WAAW,GAAG,cAAc,CAAC,CAAC;AAE3H,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAK/F;AAED,kFAAkF;AAClF,wBAAsB,sCAAsC,CAC1D,QAAQ,EAAE,WAAW,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC7C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC,CAuB9D;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,WAAW,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC7C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC,CA6B1D;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAO3E;AAED,4EAA4E;AAC5E,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEtF;AAED,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAGvF;AAED,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAAC,CAG1D;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAM/B;AAED,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAOjG;AAED,wBAAsB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQhF;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAWhF;AAED,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAW3E;AAED,wBAAsB,iCAAiC,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAW7F;AAED,wBAAsB,oCAAoC,CAAC,MAAM,EAAE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CAclB;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAQ/E;AAeD,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAYvE;AAMD,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CASzE;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,GAChD,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAoB5B;AAcD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS7F;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAkBD;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAgCrC;AAED,wBAAsB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7E;AAED,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CAejE;AAMD,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAM1D"}

package/dist/auth/route-protection.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-protection.server.d.ts","sourceRoot":"","sources":["../../src/auth/route-protection.server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAazD;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAmD3E;AAoCD;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qEAAqE;IACrE,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB,CAAC,gBAAgB,GAAG,2BAA2B;IACpF,kBAAkB,EAAE,CAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,KACnB,OAAO,CAAC,2BAA2B,GAAG,gBAAgB,CAAC,CAAC;CAC9D;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,gBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/D,gBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChG;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,6BAA6B,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACzF;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,0BAA0B,GAAG,gBAAgB,CAAC;CACvD;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,8BAA8B,CAAC,gBAAgB,GAAG,2BAA2B;IAC5F,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;IAC5B,kBAAkB,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACjF,gBAAgB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C,gBAAgB,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,kCAAkC,CAAC,gBAAgB,GAAG,2BAA2B,CAChG,SAAQ,8BAA8B,CAAC,gBAAgB,CAAC;IACxD,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB,CAAC,gBAAgB,GAAG,2BAA2B;IACnF,eAAe,CAAC,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,YAAY,CAAC,EAAE,CACb,OAAO,EAAE,8BAA8B,CAAC,gBAAgB,CAAC,KACtD,OAAO,CAAC,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5F,gBAAgB,CAAC,EAAE,CACjB,OAAO,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAC1D,OAAO,CAAC,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5F,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,MAAM,CAAC;IAC/D,4BAA4B,CAAC,EAAE,CAC7B,OAAO,EAAE,6BAA6B,KACnC,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACjC;AAID;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,gBAAgB,GAAG,2BAA2B,EACrF,MAAM,EAAE,qBAAqB,CAAC,gBAAgB,CAAC,GAC9C,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAmJD;;GAEG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,eAAe,EAC3B,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,CAiFZ;AAMD;;GAEG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,EAC3B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACD,CAAC;AAE/C;;GAEG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,EACzB,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACqC,CAAC;AAEpF;;GAEG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,EAC3B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACuC,CAAC;AAEtF;;GAEG;AACH,eAAO,MAAM,cAAc,GAhBD,CAAC,WAChB,OAAO,YACN,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eAcP,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,EAC/B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACoD,CAAC;AAEnG;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,CAAC,EACjC,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACsD,CAAC"}
+{"version":3,"file":"route-protection.server.d.ts","sourceRoot":"","sources":["../../src/auth/route-protection.server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAczD;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAuB3E;AA2CD;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qEAAqE;IACrE,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB,CAAC,gBAAgB,GAAG,2BAA2B;IACpF,kBAAkB,EAAE,CAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,KACnB,OAAO,CAAC,2BAA2B,GAAG,gBAAgB,CAAC,CAAC;CAC9D;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,gBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/D,gBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChG;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,6BAA6B,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACzF;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,0BAA0B,GAAG,gBAAgB,CAAC;CACvD;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,8BAA8B,CAAC,gBAAgB,GAAG,2BAA2B;IAC5F,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;IAC5B,kBAAkB,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACjF,gBAAgB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C,gBAAgB,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,kCAAkC,CAAC,gBAAgB,GAAG,2BAA2B,CAChG,SAAQ,8BAA8B,CAAC,gBAAgB,CAAC;IACxD,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB,CAAC,gBAAgB,GAAG,2BAA2B;IACnF,eAAe,CAAC,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,YAAY,CAAC,EAAE,CACb,OAAO,EAAE,8BAA8B,CAAC,gBAAgB,CAAC,KACtD,OAAO,CAAC,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5F,gBAAgB,CAAC,EAAE,CACjB,OAAO,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAC1D,OAAO,CAAC,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5F,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,MAAM,CAAC;IAC/D,4BAA4B,CAAC,EAAE,CAC7B,OAAO,EAAE,6BAA6B,KACnC,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACjC;AAID;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,gBAAgB,GAAG,2BAA2B,EACrF,MAAM,EAAE,qBAAqB,CAAC,gBAAgB,CAAC,GAC9C,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAmJD;;GAEG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,eAAe,EAC3B,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,CAiFZ;AAMD;;GAEG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,EAC3B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACD,CAAC;AAE/C;;GAEG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,EACzB,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACqC,CAAC;AAEpF;;GAEG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,EAC3B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACuC,CAAC;AAEtF;;GAEG;AACH,eAAO,MAAM,cAAc,GAhBD,CAAC,WAChB,OAAO,YACN,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eAcP,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,EAC/B,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACoD,CAAC;AAEnG;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,CAAC,EACjC,SAAS,OAAO,EAChB,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eACsD,CAAC"}

package/dist/auth/server.mjs

@@ -1,3 +1,3 @@
-import { C as listCurrentUserAuthSessions, D as OAUTH_RECOVERY_TTL_SECONDS, S as listAuthSessionsForUser, T as updateAuthSession, _ as getAuthSessionById, a as createAuthSession, b as isSessionValid, c as deleteOAuthRecoveryRecord, d as destroyAuthSessionById, f as destroyAuthSessionsByIdentitySession, g as getAuthSession, h as destroyAuthSessionsForUser, i as consumeOAuthRecoveryRecord, l as deleteOAuthState, m as destroyAuthSessionsBySid, n as cleanupExpiredOAuthStates, o as createOAuthRecoveryRecord, p as destroyAuthSessionsBySessionState, r as closeRedisConnection, s as createOAuthState, t as AUTH_ERROR_COOKIE_PREFIX, u as destroyAuthSession, v as getCurrentAuthSessionId, w as requireAuthSession, x as listAuthSessionDataForUser, y as getOAuthState } from "../redis-session-storage.server-DLJ0B7-C.mjs";
-import { A as resetAuthClaimMapping, C as handleCallback, D as logout, E as login, F as isOAuthRecoveryEligibleCallback, I as OAuthCallbackError, L as OAuthCallbackFailureCodes, M as clearOAuthRecoveryIntentHeaders, N as consumeOAuthRecoveryIntent, O as refreshTokens, P as getOAuthRecoveryCookiePath, R as isOAuthCallbackError, S as handleBackChannelLogout, T as hasAuthError, _ as createAuthorizationResponseUrl, a as configureRouteProtection, b as getAuthError, c as protectRoute, d as resetRouteProtectionConfig, f as shouldRefreshToken, g as configureAuthClaimMapping, h as clearAuthServerCache, i as authRoute, j as OAUTH_RECOVERY_COOKIE_NAME, k as requireAuth, l as protectedRoute, m as clearAuthErrorHeaders, n as isTokenExpiredResponse, o as onboardingRoute, p as subscriptionRoute, r as shouldAttemptTokenRefresh, s as policyRoute, t as attemptTokenRefresh, u as publicRoute, v as extractUserInfo, w as handleFrontChannelLogout, x as getUser, y as getAccessToken, z as isRecoverableOAuthCallbackError } from "../server-349jPF7J.mjs";
-export { AUTH_ERROR_COOKIE_PREFIX, OAUTH_RECOVERY_COOKIE_NAME, OAUTH_RECOVERY_TTL_SECONDS, OAuthCallbackError, OAuthCallbackFailureCodes, attemptTokenRefresh, authRoute, cleanupExpiredOAuthStates, clearAuthErrorHeaders, clearAuthServerCache, clearOAuthRecoveryIntentHeaders, closeRedisConnection, configureAuthClaimMapping, configureRouteProtection, consumeOAuthRecoveryIntent, consumeOAuthRecoveryRecord, createAuthSession, createAuthorizationResponseUrl, createOAuthRecoveryRecord, createOAuthState, deleteOAuthRecoveryRecord, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, extractUserInfo, getAccessToken, getAuthError, getAuthSession, getAuthSessionById, getCurrentAuthSessionId, getOAuthRecoveryCookiePath, getOAuthState, getUser, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, isOAuthCallbackError, isOAuthRecoveryEligibleCallback, isRecoverableOAuthCallbackError, isSessionValid, isTokenExpiredResponse, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, login, logout, onboardingRoute, policyRoute, protectRoute, protectedRoute, publicRoute, refreshTokens, requireAuth, requireAuthSession, resetAuthClaimMapping, resetRouteProtectionConfig, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession };
+import { A as saveRefreshedAuthSession, C as invalidateAuthSessionRefreshGeneration, D as listCurrentUserAuthSessions, E as listAuthSessionsForUser, O as releaseAuthSessionRefreshLock, P as OAUTH_RECOVERY_TTL_SECONDS, S as hasSameAuthTokenGeneration, T as listAuthSessionDataForUser, _ as destroyAuthSessionsForUser, a as closeRedisConnection, b as getCurrentAuthSessionId, c as createOAuthRecoveryRecord, d as deleteOAuthState, f as destroyAuthSession, g as destroyAuthSessionsBySid, h as destroyAuthSessionsBySessionState, i as clearAuthSessionCookie, j as updateAuthSession, k as requireAuthSession, l as createOAuthState, m as destroyAuthSessionsByIdentitySession, n as acquireAuthSessionRefreshLock, o as consumeOAuthRecoveryRecord, p as destroyAuthSessionById, r as cleanupExpiredOAuthStates, s as createAuthSession, t as AUTH_ERROR_COOKIE_PREFIX, u as deleteOAuthRecoveryRecord, v as getAuthSession, w as isSessionValid, x as getOAuthState, y as getAuthSessionById } from "../redis-session-storage.server--i4vhYxs.mjs";
+import { A as resetAuthClaimMapping, C as handleCallback, D as logout, E as login, F as OAUTH_RECOVERY_COOKIE_NAME, I as OAuthCallbackError, L as OAuthCallbackFailureCodes, M as consumeOAuthRecoveryIntent, N as getOAuthRecoveryCookiePath, O as refreshTokens, P as isOAuthRecoveryEligibleCallback, R as isOAuthCallbackError, S as handleBackChannelLogout, T as hasAuthError, _ as createAuthorizationResponseUrl, a as configureRouteProtection, b as getAuthError, c as protectRoute, d as resetRouteProtectionConfig, f as shouldRefreshToken, g as configureAuthClaimMapping, h as clearAuthServerCache, i as authRoute, j as clearOAuthRecoveryIntentHeaders, k as requireAuth, l as protectedRoute, m as clearAuthErrorHeaders, n as isTokenExpiredResponse, o as onboardingRoute, p as subscriptionRoute, r as shouldAttemptTokenRefresh, s as policyRoute, t as attemptTokenRefresh, u as publicRoute, v as extractUserInfo, w as handleFrontChannelLogout, x as getUser, y as getAccessToken, z as isRecoverableOAuthCallbackError } from "../server-W3MUOcah.mjs";
+export { AUTH_ERROR_COOKIE_PREFIX, OAUTH_RECOVERY_COOKIE_NAME, OAUTH_RECOVERY_TTL_SECONDS, OAuthCallbackError, OAuthCallbackFailureCodes, acquireAuthSessionRefreshLock, attemptTokenRefresh, authRoute, cleanupExpiredOAuthStates, clearAuthErrorHeaders, clearAuthServerCache, clearAuthSessionCookie, clearOAuthRecoveryIntentHeaders, closeRedisConnection, configureAuthClaimMapping, configureRouteProtection, consumeOAuthRecoveryIntent, consumeOAuthRecoveryRecord, createAuthSession, createAuthorizationResponseUrl, createOAuthRecoveryRecord, createOAuthState, deleteOAuthRecoveryRecord, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, extractUserInfo, getAccessToken, getAuthError, getAuthSession, getAuthSessionById, getCurrentAuthSessionId, getOAuthRecoveryCookiePath, getOAuthState, getUser, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, hasSameAuthTokenGeneration, invalidateAuthSessionRefreshGeneration, isOAuthCallbackError, isOAuthRecoveryEligibleCallback, isRecoverableOAuthCallbackError, isSessionValid, isTokenExpiredResponse, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, login, logout, onboardingRoute, policyRoute, protectRoute, protectedRoute, publicRoute, refreshTokens, releaseAuthSessionRefreshLock, requireAuth, requireAuthSession, resetAuthClaimMapping, resetRouteProtectionConfig, saveRefreshedAuthSession, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession };

package/dist/auth/token-expiry.d.ts

@@ -0,0 +1,6 @@
+/** JWT expiry is a scheduling hint; session authority still comes from Redis. */
+export declare function getTokenExpiry(session: {
+    accessToken?: string;
+    expiresAt?: number;
+}): number | null;
+//# sourceMappingURL=token-expiry.d.ts.map

package/dist/auth/token-expiry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-expiry.d.ts","sourceRoot":"","sources":["../../src/auth/token-expiry.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,OAAO,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAkBnG"}

package/dist/auth/token-refresh.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-refresh.server.d.ts","sourceRoot":"","sources":["../../src/auth/token-refresh.server.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAGlD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAyDvF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAElE;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAEvF"}
+{"version":3,"file":"token-refresh.server.d.ts","sourceRoot":"","sources":["../../src/auth/token-refresh.server.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAGlD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA4CvF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAElE;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAEvF"}

package/dist/auth/types.d.ts

@@ -158,6 +158,8 @@ export interface TokenRefreshResult {
     };
     error?: string;
     shouldLogout?: boolean;
+    /** Redis cleanup already completed; automatic logout must only clear cookies. */
+    sessionInvalidated?: boolean;
 }
 /**
  * Route protection levels

package/dist/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,cAAc,GACd,WAAW,GACX,YAAY,GACZ,QAAQ,CAAC;AAEb,MAAM,MAAM,oBAAoB,GAC5B,MAAM,GACN,oBAAoB,GACpB,qBAAqB,CAAC;AAE1B;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IAEd;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAElC;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB,QAAQ,GACR,MAAM,GACN,QAAQ;AACV,oEAAoE;GAClE,qBAAqB;AACvB,oEAAoE;GAClE,uBAAuB,CAAC;AAE5B;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAEvE,MAAM,MAAM,+BAA+B,GAAG,MAAM,CAClD,MAAM,EACN,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAC7C,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,GAAG,QAAQ,CAAC;IACpE;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAC/E;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,+BAA+B,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,cAAc,GACd,WAAW,GACX,YAAY,GACZ,QAAQ,CAAC;AAEb,MAAM,MAAM,oBAAoB,GAC5B,MAAM,GACN,oBAAoB,GACpB,qBAAqB,CAAC;AAE1B;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IAEd;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAElC;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB,QAAQ,GACR,MAAM,GACN,QAAQ;AACV,oEAAoE;GAClE,qBAAqB;AACvB,oEAAoE;GAClE,uBAAuB,CAAC;AAE5B;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAEvE,MAAM,MAAM,+BAA+B,GAAG,MAAM,CAClD,MAAM,EACN,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAC7C,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,GAAG,QAAQ,CAAC;IACpE;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAC/E;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,+BAA+B,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/dist/react-router/server.mjs

@@ -8,10 +8,10 @@ import { t as isApiClientError } from "../types-DqCXinAk.mjs";
 import { a as withRetry, c as handleApiError, i as isRetryableError, l as ErrorCodes, n as createRetryFetch, o as ApiError, r as fetchWithTimeout, s as ErrorHandler, t as calculateBackoffDelay } from "../api-client-CB7XZaMg.mjs";
 import { a as getIdentitySignalRClient, i as createIdentitySignalRClient, n as SignalRClient, o as initializeSignalR, r as cleanupSignalR, t as IdentitySignalRClient } from "../signalr-C-TA8nEE.mjs";
 import { i as invalidationHelpers, n as createQueryClient, r as createQueryKeyFactory, t as cachePresets } from "../query-client-_xB300gc.mjs";
-import { C as listCurrentUserAuthSessions, D as OAUTH_RECOVERY_TTL_SECONDS, S as listAuthSessionsForUser, T as updateAuthSession, _ as getAuthSessionById, a as createAuthSession, b as isSessionValid, c as deleteOAuthRecoveryRecord, d as destroyAuthSessionById, f as destroyAuthSessionsByIdentitySession, g as getAuthSession, h as destroyAuthSessionsForUser, i as consumeOAuthRecoveryRecord, l as deleteOAuthState, m as destroyAuthSessionsBySid, n as cleanupExpiredOAuthStates, o as createOAuthRecoveryRecord, p as destroyAuthSessionsBySessionState, r as closeRedisConnection, s as createOAuthState, t as AUTH_ERROR_COOKIE_PREFIX, u as destroyAuthSession, v as getCurrentAuthSessionId, w as requireAuthSession, x as listAuthSessionDataForUser, y as getOAuthState } from "../redis-session-storage.server-DLJ0B7-C.mjs";
-import { A as resetAuthClaimMapping, C as handleCallback, D as logout, E as login, F as isOAuthRecoveryEligibleCallback, I as OAuthCallbackError, L as OAuthCallbackFailureCodes, M as clearOAuthRecoveryIntentHeaders, N as consumeOAuthRecoveryIntent, O as refreshTokens, P as getOAuthRecoveryCookiePath, R as isOAuthCallbackError, S as handleBackChannelLogout, T as hasAuthError, _ as createAuthorizationResponseUrl, a as configureRouteProtection, b as getAuthError, c as protectRoute, d as resetRouteProtectionConfig, f as shouldRefreshToken, g as configureAuthClaimMapping, h as clearAuthServerCache, i as authRoute, j as OAUTH_RECOVERY_COOKIE_NAME, k as requireAuth, l as protectedRoute, m as clearAuthErrorHeaders, n as isTokenExpiredResponse, o as onboardingRoute, p as subscriptionRoute, r as shouldAttemptTokenRefresh, s as policyRoute, t as attemptTokenRefresh, u as publicRoute, v as extractUserInfo, w as handleFrontChannelLogout, x as getUser, y as getAccessToken, z as isRecoverableOAuthCallbackError } from "../server-349jPF7J.mjs";
+import { A as saveRefreshedAuthSession, C as invalidateAuthSessionRefreshGeneration, D as listCurrentUserAuthSessions, E as listAuthSessionsForUser, O as releaseAuthSessionRefreshLock, P as OAUTH_RECOVERY_TTL_SECONDS, S as hasSameAuthTokenGeneration, T as listAuthSessionDataForUser, _ as destroyAuthSessionsForUser, a as closeRedisConnection, b as getCurrentAuthSessionId, c as createOAuthRecoveryRecord, d as deleteOAuthState, f as destroyAuthSession, g as destroyAuthSessionsBySid, h as destroyAuthSessionsBySessionState, i as clearAuthSessionCookie, j as updateAuthSession, k as requireAuthSession, l as createOAuthState, m as destroyAuthSessionsByIdentitySession, n as acquireAuthSessionRefreshLock, o as consumeOAuthRecoveryRecord, p as destroyAuthSessionById, r as cleanupExpiredOAuthStates, s as createAuthSession, t as AUTH_ERROR_COOKIE_PREFIX, u as deleteOAuthRecoveryRecord, v as getAuthSession, w as isSessionValid, x as getOAuthState, y as getAuthSessionById } from "../redis-session-storage.server--i4vhYxs.mjs";
+import { A as resetAuthClaimMapping, C as handleCallback, D as logout, E as login, F as OAUTH_RECOVERY_COOKIE_NAME, I as OAuthCallbackError, L as OAuthCallbackFailureCodes, M as consumeOAuthRecoveryIntent, N as getOAuthRecoveryCookiePath, O as refreshTokens, P as isOAuthRecoveryEligibleCallback, R as isOAuthCallbackError, S as handleBackChannelLogout, T as hasAuthError, _ as createAuthorizationResponseUrl, a as configureRouteProtection, b as getAuthError, c as protectRoute, d as resetRouteProtectionConfig, f as shouldRefreshToken, g as configureAuthClaimMapping, h as clearAuthServerCache, i as authRoute, j as clearOAuthRecoveryIntentHeaders, k as requireAuth, l as protectedRoute, m as clearAuthErrorHeaders, n as isTokenExpiredResponse, o as onboardingRoute, p as subscriptionRoute, r as shouldAttemptTokenRefresh, s as policyRoute, t as attemptTokenRefresh, u as publicRoute, v as extractUserInfo, w as handleFrontChannelLogout, x as getUser, y as getAccessToken, z as isRecoverableOAuthCallbackError } from "../server-W3MUOcah.mjs";
 import { clearActiveTenant, clearCurrentTenant, configureIdentityContextFetcher, configureTenantCookie, configureTenantResolution, getActiveTenant, getAvailableTenants, getCurrentTenant, getTenantFromIdentityContext, initializeTenant, isTenantMember, resetTenantCookieConfig, resetTenantResolutionConfig, setActiveTenant, setCurrentTenant } from "../tenant/server.mjs";
 import { clearIdentityContextCache, configureIdentityAPIFetcher, configurePermissionFetcher, contextToUserInfo, fetchIdentityContext, fetchUserPermissions, getIdentityContext, hasContextVersionChanged, updateContextVersion } from "../identity/server.mjs";
-import { n as createFetchMiddleware, r as createAPIConfigFactory, t as createApiClient } from "../server-pnsLybIH.mjs";
+import { n as createFetchMiddleware, r as createAPIConfigFactory, t as createApiClient } from "../server-iCmy3RW8.mjs";
 import { checkPermission, configurePermissionRouteProtection, requirePermission, resetPermissionRouteProtection, withPermission } from "../server.mjs";
-export { AUTH_ERROR_COOKIE_PREFIX, ApiError, ErrorCodes, ErrorHandler, IdentityContextProvider, IdentitySignalRClient, LOG_LEVEL_PRIORITY, LogLevel, Logger, OAUTH_RECOVERY_COOKIE_NAME, OAUTH_RECOVERY_TTL_SECONDS, OAuthCallbackError, OAuthCallbackFailureCodes, PERMISSION_MODULES, PermissionChecker, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, SignalRClient, TenantProvider, attemptTokenRefresh, authRoute, cachePresets, calculateBackoffDelay, checkPermission, cleanupExpiredOAuthStates, cleanupSignalR, clearActiveTenant, clearAuthErrorHeaders, clearAuthServerCache, clearCurrentTenant, clearIdentityContextCache, clearOAuthRecoveryIntentHeaders, closeRedisConnection, configureAuthClaimMapping, configureIdentityAPIFetcher, configureIdentityContextFetcher, configureIdentityEndpoints, configureIdentityStore, configurePermissionFetcher, configurePermissionRouteProtection, configureRouteProtection, configureTenantClient, configureTenantCookie, configureTenantEndpoints, configureTenantResolution, consumeOAuthRecoveryIntent, consumeOAuthRecoveryRecord, contextToUserInfo, createAPIConfigFactory, createApiClient, createAuthSession, createAuthorizationResponseUrl, createFetchMiddleware, createIdentitySignalRClient, createLogger, createOAuthRecoveryRecord, createOAuthState, createQueryClient, createQueryKeyFactory, createRetryFetch, defaultLoggerConfig, deleteOAuthRecoveryRecord, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, evaluateAccessRequirement, extractUserInfo, fetchIdentityContext, fetchUserPermissions, fetchWithTimeout, getAccessToken, getActiveTenant, getAuthError, getAuthSession, getAuthSessionById, getAvailableTenants, getCurrentAuthSessionId, getCurrentTenant, getIdentityContext, getIdentitySignalRClient, getOAuthRecoveryCookiePath, getOAuthState, getPermissionChecker, getPermissions, getTenantCookieName, getTenantFromIdentityContext, getUser, handleApiError, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, hasContextVersionChanged, initialIdentityContext, initializePermissions, initializeSignalR, initializeTenant, initializeTenantStore, invalidationHelpers, isApiClientError, isOAuthCallbackError, isOAuthRecoveryEligibleCallback, isRecoverableOAuthCallbackError, isRetryableError, isSessionValid, isTenantMember, isTokenExpiredResponse, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, logger, login, logout, normalizeIdentityContextPayload, normalizeIdentityPermissionsPayload, normalizeTenantDataPayload, normalizeTenantSwitchPayload, onboardingRoute, policyRoute, protectRoute, protectedRoute, publicRoute, refreshTokens, requireAuth, requireAuthSession, requirePermission, resetAuthClaimMapping, resetIdentityStoreConfig, resetPermissionRouteProtection, resetRouteProtectionConfig, resetTenantClientConfig, resetTenantCookieConfig, resetTenantResolutionConfig, setActiveTenant, setCurrentTenant, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession, updateContextVersion, useAllPermissions, useCurrentOrganization, useCurrentTenant, useCurrentTenantData, useHasEntitlement, useHasModulePermission, useHasPermission, useHasPermissions, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useModulePermission, useOrganization, usePermission, usePermissionChecker, usePermissionStore, usePermissions, useTenant, useTenantData, useTenantStore, useTenantSwitcher, useUserPermissions, useUserTenants, withPermission, withRetry };
+export { AUTH_ERROR_COOKIE_PREFIX, ApiError, ErrorCodes, ErrorHandler, IdentityContextProvider, IdentitySignalRClient, LOG_LEVEL_PRIORITY, LogLevel, Logger, OAUTH_RECOVERY_COOKIE_NAME, OAUTH_RECOVERY_TTL_SECONDS, OAuthCallbackError, OAuthCallbackFailureCodes, PERMISSION_MODULES, PermissionChecker, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, SignalRClient, TenantProvider, acquireAuthSessionRefreshLock, attemptTokenRefresh, authRoute, cachePresets, calculateBackoffDelay, checkPermission, cleanupExpiredOAuthStates, cleanupSignalR, clearActiveTenant, clearAuthErrorHeaders, clearAuthServerCache, clearAuthSessionCookie, clearCurrentTenant, clearIdentityContextCache, clearOAuthRecoveryIntentHeaders, closeRedisConnection, configureAuthClaimMapping, configureIdentityAPIFetcher, configureIdentityContextFetcher, configureIdentityEndpoints, configureIdentityStore, configurePermissionFetcher, configurePermissionRouteProtection, configureRouteProtection, configureTenantClient, configureTenantCookie, configureTenantEndpoints, configureTenantResolution, consumeOAuthRecoveryIntent, consumeOAuthRecoveryRecord, contextToUserInfo, createAPIConfigFactory, createApiClient, createAuthSession, createAuthorizationResponseUrl, createFetchMiddleware, createIdentitySignalRClient, createLogger, createOAuthRecoveryRecord, createOAuthState, createQueryClient, createQueryKeyFactory, createRetryFetch, defaultLoggerConfig, deleteOAuthRecoveryRecord, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, evaluateAccessRequirement, extractUserInfo, fetchIdentityContext, fetchUserPermissions, fetchWithTimeout, getAccessToken, getActiveTenant, getAuthError, getAuthSession, getAuthSessionById, getAvailableTenants, getCurrentAuthSessionId, getCurrentTenant, getIdentityContext, getIdentitySignalRClient, getOAuthRecoveryCookiePath, getOAuthState, getPermissionChecker, getPermissions, getTenantCookieName, getTenantFromIdentityContext, getUser, handleApiError, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, hasContextVersionChanged, hasSameAuthTokenGeneration, initialIdentityContext, initializePermissions, initializeSignalR, initializeTenant, initializeTenantStore, invalidateAuthSessionRefreshGeneration, invalidationHelpers, isApiClientError, isOAuthCallbackError, isOAuthRecoveryEligibleCallback, isRecoverableOAuthCallbackError, isRetryableError, isSessionValid, isTenantMember, isTokenExpiredResponse, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, logger, login, logout, normalizeIdentityContextPayload, normalizeIdentityPermissionsPayload, normalizeTenantDataPayload, normalizeTenantSwitchPayload, onboardingRoute, policyRoute, protectRoute, protectedRoute, publicRoute, refreshTokens, releaseAuthSessionRefreshLock, requireAuth, requireAuthSession, requirePermission, resetAuthClaimMapping, resetIdentityStoreConfig, resetPermissionRouteProtection, resetRouteProtectionConfig, resetTenantClientConfig, resetTenantCookieConfig, resetTenantResolutionConfig, saveRefreshedAuthSession, setActiveTenant, setCurrentTenant, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession, updateContextVersion, useAllPermissions, useCurrentOrganization, useCurrentTenant, useCurrentTenantData, useHasEntitlement, useHasModulePermission, useHasPermission, useHasPermissions, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useModulePermission, useOrganization, usePermission, usePermissionChecker, usePermissionStore, usePermissions, useTenant, useTenantData, useTenantStore, useTenantSwitcher, useUserPermissions, useUserTenants, withPermission, withRetry };