@eminuckan/spine 0.3.11 → 0.3.12

package/dist/server.mjs

@@ -8,11 +8,11 @@ import { t as isApiClientError } from "./types-DqCXinAk.mjs";
 import { a as withRetry, c as handleApiError, i as isRetryableError, l as ErrorCodes, n as createRetryFetch, o as ApiError, r as fetchWithTimeout, s as ErrorHandler, t as calculateBackoffDelay } from "./api-client-CB7XZaMg.mjs";
 import { a as getIdentitySignalRClient, i as createIdentitySignalRClient, n as SignalRClient, o as initializeSignalR, r as cleanupSignalR, t as IdentitySignalRClient } from "./signalr-C-TA8nEE.mjs";
 import { i as invalidationHelpers, n as createQueryClient, r as createQueryKeyFactory, t as cachePresets } from "./query-client-_xB300gc.mjs";
-import { C as listCurrentUserAuthSessions, D as OAUTH_RECOVERY_TTL_SECONDS, S as listAuthSessionsForUser, T as updateAuthSession, _ as getAuthSessionById, a as createAuthSession, b as isSessionValid, c as deleteOAuthRecoveryRecord, d as destroyAuthSessionById, f as destroyAuthSessionsByIdentitySession, g as getAuthSession, h as destroyAuthSessionsForUser, i as consumeOAuthRecoveryRecord, l as deleteOAuthState, m as destroyAuthSessionsBySid, n as cleanupExpiredOAuthStates, o as createOAuthRecoveryRecord, p as destroyAuthSessionsBySessionState, r as closeRedisConnection, s as createOAuthState, t as AUTH_ERROR_COOKIE_PREFIX, u as destroyAuthSession, v as getCurrentAuthSessionId, w as requireAuthSession, x as listAuthSessionDataForUser, y as getOAuthState } from "./redis-session-storage.server-DLJ0B7-C.mjs";
-import { A as resetAuthClaimMapping, C as handleCallback, D as logout, E as login, F as isOAuthRecoveryEligibleCallback, I as OAuthCallbackError, L as OAuthCallbackFailureCodes, M as clearOAuthRecoveryIntentHeaders, N as consumeOAuthRecoveryIntent, O as refreshTokens, P as getOAuthRecoveryCookiePath, R as isOAuthCallbackError, S as handleBackChannelLogout, T as hasAuthError, _ as createAuthorizationResponseUrl, a as configureRouteProtection, b as getAuthError, c as protectRoute, d as resetRouteProtectionConfig, f as shouldRefreshToken, g as configureAuthClaimMapping, h as clearAuthServerCache, i as authRoute, j as OAUTH_RECOVERY_COOKIE_NAME, k as requireAuth, l as protectedRoute, m as clearAuthErrorHeaders, n as isTokenExpiredResponse, o as onboardingRoute, p as subscriptionRoute, r as shouldAttemptTokenRefresh, s as policyRoute, t as attemptTokenRefresh, u as publicRoute, v as extractUserInfo, w as handleFrontChannelLogout, x as getUser, y as getAccessToken, z as isRecoverableOAuthCallbackError } from "./server-349jPF7J.mjs";
+import { A as saveRefreshedAuthSession, C as invalidateAuthSessionRefreshGeneration, D as listCurrentUserAuthSessions, E as listAuthSessionsForUser, O as releaseAuthSessionRefreshLock, P as OAUTH_RECOVERY_TTL_SECONDS, S as hasSameAuthTokenGeneration, T as listAuthSessionDataForUser, _ as destroyAuthSessionsForUser, a as closeRedisConnection, b as getCurrentAuthSessionId, c as createOAuthRecoveryRecord, d as deleteOAuthState, f as destroyAuthSession, g as destroyAuthSessionsBySid, h as destroyAuthSessionsBySessionState, i as clearAuthSessionCookie, j as updateAuthSession, k as requireAuthSession, l as createOAuthState, m as destroyAuthSessionsByIdentitySession, n as acquireAuthSessionRefreshLock, o as consumeOAuthRecoveryRecord, p as destroyAuthSessionById, r as cleanupExpiredOAuthStates, s as createAuthSession, t as AUTH_ERROR_COOKIE_PREFIX, u as deleteOAuthRecoveryRecord, v as getAuthSession, w as isSessionValid, x as getOAuthState, y as getAuthSessionById } from "./redis-session-storage.server--i4vhYxs.mjs";
+import { A as resetAuthClaimMapping, C as handleCallback, D as logout, E as login, F as OAUTH_RECOVERY_COOKIE_NAME, I as OAuthCallbackError, L as OAuthCallbackFailureCodes, M as consumeOAuthRecoveryIntent, N as getOAuthRecoveryCookiePath, O as refreshTokens, P as isOAuthRecoveryEligibleCallback, R as isOAuthCallbackError, S as handleBackChannelLogout, T as hasAuthError, _ as createAuthorizationResponseUrl, a as configureRouteProtection, b as getAuthError, c as protectRoute, d as resetRouteProtectionConfig, f as shouldRefreshToken, g as configureAuthClaimMapping, h as clearAuthServerCache, i as authRoute, j as clearOAuthRecoveryIntentHeaders, k as requireAuth, l as protectedRoute, m as clearAuthErrorHeaders, n as isTokenExpiredResponse, o as onboardingRoute, p as subscriptionRoute, r as shouldAttemptTokenRefresh, s as policyRoute, t as attemptTokenRefresh, u as publicRoute, v as extractUserInfo, w as handleFrontChannelLogout, x as getUser, y as getAccessToken, z as isRecoverableOAuthCallbackError } from "./server-W3MUOcah.mjs";
 import { clearActiveTenant, clearCurrentTenant, configureIdentityContextFetcher, configureTenantCookie, configureTenantResolution, getActiveTenant, getAvailableTenants, getCurrentTenant, getTenantFromIdentityContext, initializeTenant, isTenantMember, resetTenantCookieConfig, resetTenantResolutionConfig, setActiveTenant, setCurrentTenant } from "./tenant/server.mjs";
 import { clearIdentityContextCache, configureIdentityAPIFetcher, configurePermissionFetcher, contextToUserInfo, fetchIdentityContext, fetchUserPermissions, getIdentityContext, hasContextVersionChanged, updateContextVersion } from "./identity/server.mjs";
-import { n as createFetchMiddleware, r as createAPIConfigFactory, t as createApiClient } from "./server-pnsLybIH.mjs";
+import { n as createFetchMiddleware, r as createAPIConfigFactory, t as createApiClient } from "./server-iCmy3RW8.mjs";
 //#region src/permissions/route-protection.server.ts
 const DEFAULT_UNAUTHORIZED_RESPONSE = () => new Response("Unauthorized", {
 	status: 401,
@@ -85,6 +85,6 @@ function withPermission(permission, loader, options) {
 	};
 }
 //#endregion
-export { AUTH_ERROR_COOKIE_PREFIX, ApiError, ErrorCodes, ErrorHandler, IdentityContextProvider, IdentitySignalRClient, LOG_LEVEL_PRIORITY, LogLevel, Logger, OAUTH_RECOVERY_COOKIE_NAME, OAUTH_RECOVERY_TTL_SECONDS, OAuthCallbackError, OAuthCallbackFailureCodes, PERMISSION_MODULES, PermissionChecker, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, SignalRClient, TenantProvider, attemptTokenRefresh, authRoute, cachePresets, calculateBackoffDelay, checkPermission, cleanupExpiredOAuthStates, cleanupSignalR, clearActiveTenant, clearAuthErrorHeaders, clearAuthServerCache, clearCurrentTenant, clearIdentityContextCache, clearOAuthRecoveryIntentHeaders, closeRedisConnection, configureAuthClaimMapping, configureIdentityAPIFetcher, configureIdentityContextFetcher, configureIdentityEndpoints, configureIdentityStore, configurePermissionFetcher, configurePermissionRouteProtection, configureRouteProtection, configureTenantClient, configureTenantCookie, configureTenantEndpoints, configureTenantResolution, consumeOAuthRecoveryIntent, consumeOAuthRecoveryRecord, contextToUserInfo, createAPIConfigFactory, createApiClient, createAuthSession, createAuthorizationResponseUrl, createFetchMiddleware, createIdentitySignalRClient, createLogger, createOAuthRecoveryRecord, createOAuthState, createQueryClient, createQueryKeyFactory, createRetryFetch, defaultLoggerConfig, deleteOAuthRecoveryRecord, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, evaluateAccessRequirement, extractUserInfo, fetchIdentityContext, fetchUserPermissions, fetchWithTimeout, getAccessToken, getActiveTenant, getAuthError, getAuthSession, getAuthSessionById, getAvailableTenants, getCurrentAuthSessionId, getCurrentTenant, getIdentityContext, getIdentitySignalRClient, getOAuthRecoveryCookiePath, getOAuthState, getPermissionChecker, getPermissions, getTenantCookieName, getTenantFromIdentityContext, getUser, handleApiError, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, hasContextVersionChanged, initialIdentityContext, initializePermissions, initializeSignalR, initializeTenant, initializeTenantStore, invalidationHelpers, isApiClientError, isOAuthCallbackError, isOAuthRecoveryEligibleCallback, isRecoverableOAuthCallbackError, isRetryableError, isSessionValid, isTenantMember, isTokenExpiredResponse, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, logger, login, logout, normalizeIdentityContextPayload, normalizeIdentityPermissionsPayload, normalizeTenantDataPayload, normalizeTenantSwitchPayload, onboardingRoute, policyRoute, protectRoute, protectedRoute, publicRoute, refreshTokens, requireAuth, requireAuthSession, requirePermission, resetAuthClaimMapping, resetIdentityStoreConfig, resetPermissionRouteProtection, resetRouteProtectionConfig, resetTenantClientConfig, resetTenantCookieConfig, resetTenantResolutionConfig, setActiveTenant, setCurrentTenant, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession, updateContextVersion, useAllPermissions, useCurrentOrganization, useCurrentTenant, useCurrentTenantData, useHasEntitlement, useHasModulePermission, useHasPermission, useHasPermissions, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useModulePermission, useOrganization, usePermission, usePermissionChecker, usePermissionStore, usePermissions, useTenant, useTenantData, useTenantStore, useTenantSwitcher, useUserPermissions, useUserTenants, withPermission, withRetry };
+export { AUTH_ERROR_COOKIE_PREFIX, ApiError, ErrorCodes, ErrorHandler, IdentityContextProvider, IdentitySignalRClient, LOG_LEVEL_PRIORITY, LogLevel, Logger, OAUTH_RECOVERY_COOKIE_NAME, OAUTH_RECOVERY_TTL_SECONDS, OAuthCallbackError, OAuthCallbackFailureCodes, PERMISSION_MODULES, PermissionChecker, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, SignalRClient, TenantProvider, acquireAuthSessionRefreshLock, attemptTokenRefresh, authRoute, cachePresets, calculateBackoffDelay, checkPermission, cleanupExpiredOAuthStates, cleanupSignalR, clearActiveTenant, clearAuthErrorHeaders, clearAuthServerCache, clearAuthSessionCookie, clearCurrentTenant, clearIdentityContextCache, clearOAuthRecoveryIntentHeaders, closeRedisConnection, configureAuthClaimMapping, configureIdentityAPIFetcher, configureIdentityContextFetcher, configureIdentityEndpoints, configureIdentityStore, configurePermissionFetcher, configurePermissionRouteProtection, configureRouteProtection, configureTenantClient, configureTenantCookie, configureTenantEndpoints, configureTenantResolution, consumeOAuthRecoveryIntent, consumeOAuthRecoveryRecord, contextToUserInfo, createAPIConfigFactory, createApiClient, createAuthSession, createAuthorizationResponseUrl, createFetchMiddleware, createIdentitySignalRClient, createLogger, createOAuthRecoveryRecord, createOAuthState, createQueryClient, createQueryKeyFactory, createRetryFetch, defaultLoggerConfig, deleteOAuthRecoveryRecord, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, evaluateAccessRequirement, extractUserInfo, fetchIdentityContext, fetchUserPermissions, fetchWithTimeout, getAccessToken, getActiveTenant, getAuthError, getAuthSession, getAuthSessionById, getAvailableTenants, getCurrentAuthSessionId, getCurrentTenant, getIdentityContext, getIdentitySignalRClient, getOAuthRecoveryCookiePath, getOAuthState, getPermissionChecker, getPermissions, getTenantCookieName, getTenantFromIdentityContext, getUser, handleApiError, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, hasContextVersionChanged, hasSameAuthTokenGeneration, initialIdentityContext, initializePermissions, initializeSignalR, initializeTenant, initializeTenantStore, invalidateAuthSessionRefreshGeneration, invalidationHelpers, isApiClientError, isOAuthCallbackError, isOAuthRecoveryEligibleCallback, isRecoverableOAuthCallbackError, isRetryableError, isSessionValid, isTenantMember, isTokenExpiredResponse, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, logger, login, logout, normalizeIdentityContextPayload, normalizeIdentityPermissionsPayload, normalizeTenantDataPayload, normalizeTenantSwitchPayload, onboardingRoute, policyRoute, protectRoute, protectedRoute, publicRoute, refreshTokens, releaseAuthSessionRefreshLock, requireAuth, requireAuthSession, requirePermission, resetAuthClaimMapping, resetIdentityStoreConfig, resetPermissionRouteProtection, resetRouteProtectionConfig, resetTenantClientConfig, resetTenantCookieConfig, resetTenantResolutionConfig, saveRefreshedAuthSession, setActiveTenant, setCurrentTenant, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession, updateContextVersion, useAllPermissions, useCurrentOrganization, useCurrentTenant, useCurrentTenantData, useHasEntitlement, useHasModulePermission, useHasPermission, useHasPermissions, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useModulePermission, useOrganization, usePermission, usePermissionChecker, usePermissionStore, usePermissions, useTenant, useTenantData, useTenantStore, useTenantSwitcher, useUserPermissions, useUserTenants, withPermission, withRetry };
 
 //# sourceMappingURL=server.mjs.map

package/dist/tanstack-start/server.mjs

@@ -8,10 +8,10 @@ import { t as isApiClientError } from "../types-DqCXinAk.mjs";
 import { a as withRetry, c as handleApiError, i as isRetryableError, l as ErrorCodes, n as createRetryFetch, o as ApiError, r as fetchWithTimeout, s as ErrorHandler, t as calculateBackoffDelay } from "../api-client-CB7XZaMg.mjs";
 import { a as getIdentitySignalRClient, i as createIdentitySignalRClient, n as SignalRClient, o as initializeSignalR, r as cleanupSignalR, t as IdentitySignalRClient } from "../signalr-C-TA8nEE.mjs";
 import { i as invalidationHelpers, n as createQueryClient, r as createQueryKeyFactory, t as cachePresets } from "../query-client-_xB300gc.mjs";
-import { C as listCurrentUserAuthSessions, D as OAUTH_RECOVERY_TTL_SECONDS, S as listAuthSessionsForUser, T as updateAuthSession, _ as getAuthSessionById, a as createAuthSession, b as isSessionValid, c as deleteOAuthRecoveryRecord, d as destroyAuthSessionById, f as destroyAuthSessionsByIdentitySession, g as getAuthSession, h as destroyAuthSessionsForUser, i as consumeOAuthRecoveryRecord, l as deleteOAuthState, m as destroyAuthSessionsBySid, n as cleanupExpiredOAuthStates, o as createOAuthRecoveryRecord, p as destroyAuthSessionsBySessionState, r as closeRedisConnection, s as createOAuthState, t as AUTH_ERROR_COOKIE_PREFIX, u as destroyAuthSession, v as getCurrentAuthSessionId, w as requireAuthSession, x as listAuthSessionDataForUser, y as getOAuthState } from "../redis-session-storage.server-DLJ0B7-C.mjs";
-import { A as resetAuthClaimMapping, C as handleCallback, D as logout, E as login, F as isOAuthRecoveryEligibleCallback, I as OAuthCallbackError, L as OAuthCallbackFailureCodes, M as clearOAuthRecoveryIntentHeaders, N as consumeOAuthRecoveryIntent, O as refreshTokens, P as getOAuthRecoveryCookiePath, R as isOAuthCallbackError, S as handleBackChannelLogout, T as hasAuthError, _ as createAuthorizationResponseUrl, a as configureRouteProtection, b as getAuthError, c as protectRoute, d as resetRouteProtectionConfig, f as shouldRefreshToken, g as configureAuthClaimMapping, h as clearAuthServerCache, i as authRoute, j as OAUTH_RECOVERY_COOKIE_NAME, k as requireAuth, l as protectedRoute, m as clearAuthErrorHeaders, n as isTokenExpiredResponse, o as onboardingRoute, p as subscriptionRoute, r as shouldAttemptTokenRefresh, s as policyRoute, t as attemptTokenRefresh, u as publicRoute, v as extractUserInfo, w as handleFrontChannelLogout, x as getUser, y as getAccessToken, z as isRecoverableOAuthCallbackError } from "../server-349jPF7J.mjs";
+import { A as saveRefreshedAuthSession, C as invalidateAuthSessionRefreshGeneration, D as listCurrentUserAuthSessions, E as listAuthSessionsForUser, O as releaseAuthSessionRefreshLock, P as OAUTH_RECOVERY_TTL_SECONDS, S as hasSameAuthTokenGeneration, T as listAuthSessionDataForUser, _ as destroyAuthSessionsForUser, a as closeRedisConnection, b as getCurrentAuthSessionId, c as createOAuthRecoveryRecord, d as deleteOAuthState, f as destroyAuthSession, g as destroyAuthSessionsBySid, h as destroyAuthSessionsBySessionState, i as clearAuthSessionCookie, j as updateAuthSession, k as requireAuthSession, l as createOAuthState, m as destroyAuthSessionsByIdentitySession, n as acquireAuthSessionRefreshLock, o as consumeOAuthRecoveryRecord, p as destroyAuthSessionById, r as cleanupExpiredOAuthStates, s as createAuthSession, t as AUTH_ERROR_COOKIE_PREFIX, u as deleteOAuthRecoveryRecord, v as getAuthSession, w as isSessionValid, x as getOAuthState, y as getAuthSessionById } from "../redis-session-storage.server--i4vhYxs.mjs";
+import { A as resetAuthClaimMapping, C as handleCallback, D as logout, E as login, F as OAUTH_RECOVERY_COOKIE_NAME, I as OAuthCallbackError, L as OAuthCallbackFailureCodes, M as consumeOAuthRecoveryIntent, N as getOAuthRecoveryCookiePath, O as refreshTokens, P as isOAuthRecoveryEligibleCallback, R as isOAuthCallbackError, S as handleBackChannelLogout, T as hasAuthError, _ as createAuthorizationResponseUrl, a as configureRouteProtection, b as getAuthError, c as protectRoute, d as resetRouteProtectionConfig, f as shouldRefreshToken, g as configureAuthClaimMapping, h as clearAuthServerCache, i as authRoute, j as clearOAuthRecoveryIntentHeaders, k as requireAuth, l as protectedRoute, m as clearAuthErrorHeaders, n as isTokenExpiredResponse, o as onboardingRoute, p as subscriptionRoute, r as shouldAttemptTokenRefresh, s as policyRoute, t as attemptTokenRefresh, u as publicRoute, v as extractUserInfo, w as handleFrontChannelLogout, x as getUser, y as getAccessToken, z as isRecoverableOAuthCallbackError } from "../server-W3MUOcah.mjs";
 import { clearActiveTenant, clearCurrentTenant, configureIdentityContextFetcher, configureTenantCookie, configureTenantResolution, getActiveTenant, getAvailableTenants, getCurrentTenant, getTenantFromIdentityContext, initializeTenant, isTenantMember, resetTenantCookieConfig, resetTenantResolutionConfig, setActiveTenant, setCurrentTenant } from "../tenant/server.mjs";
 import { clearIdentityContextCache, configureIdentityAPIFetcher, configurePermissionFetcher, contextToUserInfo, fetchIdentityContext, fetchUserPermissions, getIdentityContext, hasContextVersionChanged, updateContextVersion } from "../identity/server.mjs";
-import { n as createFetchMiddleware, r as createAPIConfigFactory, t as createApiClient } from "../server-pnsLybIH.mjs";
+import { n as createFetchMiddleware, r as createAPIConfigFactory, t as createApiClient } from "../server-iCmy3RW8.mjs";
 import { checkPermission, configurePermissionRouteProtection, requirePermission, resetPermissionRouteProtection, withPermission } from "../server.mjs";
-export { AUTH_ERROR_COOKIE_PREFIX, ApiError, ErrorCodes, ErrorHandler, IdentityContextProvider, IdentitySignalRClient, LOG_LEVEL_PRIORITY, LogLevel, Logger, OAUTH_RECOVERY_COOKIE_NAME, OAUTH_RECOVERY_TTL_SECONDS, OAuthCallbackError, OAuthCallbackFailureCodes, PERMISSION_MODULES, PermissionChecker, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, SignalRClient, TenantProvider, attemptTokenRefresh, authRoute, cachePresets, calculateBackoffDelay, checkPermission, cleanupExpiredOAuthStates, cleanupSignalR, clearActiveTenant, clearAuthErrorHeaders, clearAuthServerCache, clearCurrentTenant, clearIdentityContextCache, clearOAuthRecoveryIntentHeaders, closeRedisConnection, configureAuthClaimMapping, configureIdentityAPIFetcher, configureIdentityContextFetcher, configureIdentityEndpoints, configureIdentityStore, configurePermissionFetcher, configurePermissionRouteProtection, configureRouteProtection, configureTenantClient, configureTenantCookie, configureTenantEndpoints, configureTenantResolution, consumeOAuthRecoveryIntent, consumeOAuthRecoveryRecord, contextToUserInfo, createAPIConfigFactory, createApiClient, createAuthSession, createAuthorizationResponseUrl, createFetchMiddleware, createIdentitySignalRClient, createLogger, createOAuthRecoveryRecord, createOAuthState, createQueryClient, createQueryKeyFactory, createRetryFetch, defaultLoggerConfig, deleteOAuthRecoveryRecord, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, evaluateAccessRequirement, extractUserInfo, fetchIdentityContext, fetchUserPermissions, fetchWithTimeout, getAccessToken, getActiveTenant, getAuthError, getAuthSession, getAuthSessionById, getAvailableTenants, getCurrentAuthSessionId, getCurrentTenant, getIdentityContext, getIdentitySignalRClient, getOAuthRecoveryCookiePath, getOAuthState, getPermissionChecker, getPermissions, getTenantCookieName, getTenantFromIdentityContext, getUser, handleApiError, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, hasContextVersionChanged, initialIdentityContext, initializePermissions, initializeSignalR, initializeTenant, initializeTenantStore, invalidationHelpers, isApiClientError, isOAuthCallbackError, isOAuthRecoveryEligibleCallback, isRecoverableOAuthCallbackError, isRetryableError, isSessionValid, isTenantMember, isTokenExpiredResponse, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, logger, login, logout, normalizeIdentityContextPayload, normalizeIdentityPermissionsPayload, normalizeTenantDataPayload, normalizeTenantSwitchPayload, onboardingRoute, policyRoute, protectRoute, protectedRoute, publicRoute, refreshTokens, requireAuth, requireAuthSession, requirePermission, resetAuthClaimMapping, resetIdentityStoreConfig, resetPermissionRouteProtection, resetRouteProtectionConfig, resetTenantClientConfig, resetTenantCookieConfig, resetTenantResolutionConfig, setActiveTenant, setCurrentTenant, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession, updateContextVersion, useAllPermissions, useCurrentOrganization, useCurrentTenant, useCurrentTenantData, useHasEntitlement, useHasModulePermission, useHasPermission, useHasPermissions, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useModulePermission, useOrganization, usePermission, usePermissionChecker, usePermissionStore, usePermissions, useTenant, useTenantData, useTenantStore, useTenantSwitcher, useUserPermissions, useUserTenants, withPermission, withRetry };
+export { AUTH_ERROR_COOKIE_PREFIX, ApiError, ErrorCodes, ErrorHandler, IdentityContextProvider, IdentitySignalRClient, LOG_LEVEL_PRIORITY, LogLevel, Logger, OAUTH_RECOVERY_COOKIE_NAME, OAUTH_RECOVERY_TTL_SECONDS, OAuthCallbackError, OAuthCallbackFailureCodes, PERMISSION_MODULES, PermissionChecker, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, SignalRClient, TenantProvider, acquireAuthSessionRefreshLock, attemptTokenRefresh, authRoute, cachePresets, calculateBackoffDelay, checkPermission, cleanupExpiredOAuthStates, cleanupSignalR, clearActiveTenant, clearAuthErrorHeaders, clearAuthServerCache, clearAuthSessionCookie, clearCurrentTenant, clearIdentityContextCache, clearOAuthRecoveryIntentHeaders, closeRedisConnection, configureAuthClaimMapping, configureIdentityAPIFetcher, configureIdentityContextFetcher, configureIdentityEndpoints, configureIdentityStore, configurePermissionFetcher, configurePermissionRouteProtection, configureRouteProtection, configureTenantClient, configureTenantCookie, configureTenantEndpoints, configureTenantResolution, consumeOAuthRecoveryIntent, consumeOAuthRecoveryRecord, contextToUserInfo, createAPIConfigFactory, createApiClient, createAuthSession, createAuthorizationResponseUrl, createFetchMiddleware, createIdentitySignalRClient, createLogger, createOAuthRecoveryRecord, createOAuthState, createQueryClient, createQueryKeyFactory, createRetryFetch, defaultLoggerConfig, deleteOAuthRecoveryRecord, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, evaluateAccessRequirement, extractUserInfo, fetchIdentityContext, fetchUserPermissions, fetchWithTimeout, getAccessToken, getActiveTenant, getAuthError, getAuthSession, getAuthSessionById, getAvailableTenants, getCurrentAuthSessionId, getCurrentTenant, getIdentityContext, getIdentitySignalRClient, getOAuthRecoveryCookiePath, getOAuthState, getPermissionChecker, getPermissions, getTenantCookieName, getTenantFromIdentityContext, getUser, handleApiError, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, hasContextVersionChanged, hasSameAuthTokenGeneration, initialIdentityContext, initializePermissions, initializeSignalR, initializeTenant, initializeTenantStore, invalidateAuthSessionRefreshGeneration, invalidationHelpers, isApiClientError, isOAuthCallbackError, isOAuthRecoveryEligibleCallback, isRecoverableOAuthCallbackError, isRetryableError, isSessionValid, isTenantMember, isTokenExpiredResponse, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, logger, login, logout, normalizeIdentityContextPayload, normalizeIdentityPermissionsPayload, normalizeTenantDataPayload, normalizeTenantSwitchPayload, onboardingRoute, policyRoute, protectRoute, protectedRoute, publicRoute, refreshTokens, releaseAuthSessionRefreshLock, requireAuth, requireAuthSession, requirePermission, resetAuthClaimMapping, resetIdentityStoreConfig, resetPermissionRouteProtection, resetRouteProtectionConfig, resetTenantClientConfig, resetTenantCookieConfig, resetTenantResolutionConfig, saveRefreshedAuthSession, setActiveTenant, setCurrentTenant, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession, updateContextVersion, useAllPermissions, useCurrentOrganization, useCurrentTenant, useCurrentTenantData, useHasEntitlement, useHasModulePermission, useHasPermission, useHasPermissions, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useModulePermission, useOrganization, usePermission, usePermissionChecker, usePermissionStore, usePermissions, useTenant, useTenantData, useTenantStore, useTenantSwitcher, useUserPermissions, useUserTenants, withPermission, withRetry };

package/dist/tenant/server.mjs

@@ -1,10 +1,11 @@
-import { g as getAuthSession } from "../redis-session-storage.server-DLJ0B7-C.mjs";
+import { v as getAuthSession } from "../redis-session-storage.server--i4vhYxs.mjs";
+import { env } from "node:process";
 //#region src/tenant/tenant-cookie.server.ts
 const DEFAULT_TENANT_COOKIE_CONFIG = {
 	name: "__spine_tenant",
 	maxAge: 3600 * 24 * 365,
 	path: "/",
-	secure: process.env.NODE_ENV === "production",
+	secure: env.NODE_ENV === "production",
 	httpOnly: false,
 	sameSite: "Lax"
 };

package/dist/tenant/server.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"server.mjs","names":[],"sources":["../../src/tenant/tenant-cookie.server.ts","../../src/tenant/tenant.server.ts"],"sourcesContent":["/**\n * Tenant Cookie Server Module\n * \n * Cookie-based tenant storage.\n */\n\nexport type TenantCookieSameSite = 'Strict' | 'Lax' | 'None';\n\nexport interface TenantCookieConfig {\n  name?: string;\n  maxAge?: number;\n  path?: string;\n  secure?: boolean;\n  httpOnly?: boolean;\n  sameSite?: TenantCookieSameSite;\n}\n\nconst DEFAULT_TENANT_COOKIE_CONFIG: Required<TenantCookieConfig> = {\n  name: '__spine_tenant',\n  maxAge: 60 * 60 * 24 * 365,\n  path: '/',\n  secure: process.env.NODE_ENV === 'production',\n  httpOnly: false,\n  sameSite: 'Lax',\n};\n\nlet tenantCookieConfig: Required<TenantCookieConfig> = {\n  ...DEFAULT_TENANT_COOKIE_CONFIG,\n};\n\nfunction getTenantCookieConfig(): Required<TenantCookieConfig> {\n  return tenantCookieConfig;\n}\n\nfunction readCookieValue(cookieHeader: string, name: string): string | null {\n  for (const segment of cookieHeader.split(';')) {\n    const [rawName, ...rawValue] = segment.split('=');\n    if (rawName?.trim() !== name || rawValue.length === 0) {\n      continue;\n    }\n\n    return decodeURIComponent(rawValue.join('='));\n  }\n\n  return null;\n}\n\n/**\n * Read the active tenant selector from the cookie.\n *\n * This is intentionally a raw cookie helper. Call `getCurrentTenant` from the\n * tenant server module before using the value in an authorization-sensitive\n * server operation.\n */\nexport async function getActiveTenant(request: Request): Promise<string | null> {\n  const config = getTenantCookieConfig();\n  const cookies = request.headers.get('Cookie');\n  if (!cookies) return null;\n\n  return readCookieValue(cookies, config.name);\n}\n\n/**\n * Set active tenant cookie value\n */\nexport async function setActiveTenant(tenantId: string): Promise<string> {\n  const config = getTenantCookieConfig();\n  const secure = config.secure ? '; Secure' : '';\n  const httpOnly = config.httpOnly ? '; HttpOnly' : '';\n  return `${config.name}=${encodeURIComponent(tenantId)}; Path=${config.path}${httpOnly}; SameSite=${config.sameSite}; Max-Age=${config.maxAge}${secure}`;\n}\n\n/**\n * Clear active tenant cookie value\n */\nexport async function clearActiveTenant(): Promise<string> {\n  const config = getTenantCookieConfig();\n  const secure = config.secure ? '; Secure' : '';\n  const httpOnly = config.httpOnly ? '; HttpOnly' : '';\n  return `${config.name}=; Path=${config.path}${httpOnly}; SameSite=${config.sameSite}; Max-Age=0${secure}`;\n}\n\n/**\n * Configure tenant cookie name\n */\nexport function configureTenantCookie(config: TenantCookieConfig): void {\n  tenantCookieConfig = {\n    ...tenantCookieConfig,\n    ...config,\n  };\n}\n\n/**\n * Reset tenant cookie config back to defaults.\n */\nexport function resetTenantCookieConfig(): void {\n  tenantCookieConfig = {\n    ...DEFAULT_TENANT_COOKIE_CONFIG,\n  };\n}\n","/**\n * Tenant Server Module\n * \n * Server-side tenant management.\n */\n\nimport { getAuthSession } from '../auth/redis-session-storage.server';\nimport { getActiveTenant, setActiveTenant, clearActiveTenant } from './tenant-cookie.server';\nimport type { SessionData } from '../auth/types';\n\n/**\n * Identity context fetcher type (to avoid circular dependency)\n */\nexport type IdentityContextFetcher = (request: Request) => Promise<{\n  memberships?: Array<{ tenantId?: string; id?: string; [key: string]: unknown }>;\n  [key: string]: unknown;\n} | null>;\n\nexport interface TenantResolutionContext {\n  request: Request;\n  session: SessionData;\n  identityContext: Awaited<ReturnType<IdentityContextFetcher>>;\n}\n\nexport interface TenantResolutionConfig {\n  identityContextFetcher?: IdentityContextFetcher;\n  resolveInitialTenant?: (context: TenantResolutionContext) => Promise<string | null> | string | null;\n  resolveAvailableTenants?: (context: TenantResolutionContext) => Promise<string[]> | string[];\n}\n\nlet identityContextFetcher: IdentityContextFetcher | null = null;\nconst identityContextResolutionRequests = new WeakSet<Request>();\nlet resolveInitialTenant: NonNullable<TenantResolutionConfig['resolveInitialTenant']> =\n  ({ identityContext }) => {\n    const membership = identityContext?.memberships?.[0];\n    return membership?.tenantId ?? membership?.id ?? null;\n  };\nlet resolveAvailableTenants: NonNullable<TenantResolutionConfig['resolveAvailableTenants']> =\n  ({ identityContext }) =>\n    identityContext?.memberships\n      ?.map((membership) => membership.tenantId ?? membership.id)\n      .filter((tenantId): tenantId is string => Boolean(tenantId)) ?? [];\n\n/**\n * Configure identity context fetcher\n */\nexport function configureIdentityContextFetcher(fetcher: IdentityContextFetcher): void {\n  identityContextFetcher = fetcher;\n}\n\n/**\n * Configure tenant resolution for custom backend identity contracts.\n */\nexport function configureTenantResolution(config: TenantResolutionConfig): void {\n  if (config.identityContextFetcher) {\n    identityContextFetcher = config.identityContextFetcher;\n  }\n  if (config.resolveInitialTenant) {\n    resolveInitialTenant = config.resolveInitialTenant;\n  }\n  if (config.resolveAvailableTenants) {\n    resolveAvailableTenants = config.resolveAvailableTenants;\n  }\n}\n\nexport function resetTenantResolutionConfig(): void {\n  identityContextFetcher = null;\n  resolveInitialTenant = ({ identityContext }) => {\n    const membership = identityContext?.memberships?.[0];\n    return membership?.tenantId ?? membership?.id ?? null;\n  };\n  resolveAvailableTenants = ({ identityContext }) =>\n    identityContext?.memberships\n      ?.map((membership) => membership.tenantId ?? membership.id)\n      .filter((tenantId): tenantId is string => Boolean(tenantId)) ?? [];\n}\n\nfunction isIdentityContextResolutionInProgress(request: Request): boolean {\n  return identityContextResolutionRequests.has(request);\n}\n\nasync function fetchConfiguredIdentityContext(\n  request: Request,\n): Promise<Awaited<ReturnType<IdentityContextFetcher>>> {\n  const fetcher = identityContextFetcher;\n  if (!fetcher || isIdentityContextResolutionInProgress(request)) {\n    return null;\n  }\n\n  identityContextResolutionRequests.add(request);\n  try {\n    return await fetcher(request);\n  } finally {\n    identityContextResolutionRequests.delete(request);\n  }\n}\n\n/**\n * Get current active tenant from cookie\n */\nexport async function getCurrentTenant(\n  request: Request,\n  requestedTenantId?: string,\n): Promise<string | null> {\n  // Identity fetchers commonly build their request through the same tenant\n  // resolver. A nested selector is not authorization evidence and must not\n  // recurse into another membership fetch.\n  if (isIdentityContextResolutionInProgress(request)) {\n    return null;\n  }\n\n  try {\n    if (requestedTenantId) {\n      return await isTenantMember(request, requestedTenantId) ? requestedTenantId : null;\n    }\n\n    const tenantFromCookie = await getActiveTenant(request);\n    if (tenantFromCookie && await isTenantMember(request, tenantFromCookie)) {\n      return tenantFromCookie;\n    }\n\n    return null;\n  } catch (error) {\n    console.error('Error getting current tenant:', error);\n    return null;\n  }\n}\n\n/**\n * Get tenant from identity context\n */\nexport async function getTenantFromIdentityContext(request: Request): Promise<string | null> {\n  if (isIdentityContextResolutionInProgress(request)) {\n    return null;\n  }\n\n  try {\n    const sessionData = await getAuthSession(request);\n    if (!sessionData?.user?.sub) {\n      return null;\n    }\n\n    if (typeof sessionData.expiresAt === 'number' && Date.now() >= sessionData.expiresAt) {\n      return null;\n    }\n\n    if (!identityContextFetcher) {\n      console.warn('Identity context fetcher not configured');\n      return null;\n    }\n\n    const context = await fetchConfiguredIdentityContext(request);\n    return resolveInitialTenant({ request, session: sessionData, identityContext: context });\n  } catch (error) {\n    console.error('Error getting tenant from identity context:', error);\n    return null;\n  }\n}\n\n/**\n * Get available tenants from identity context\n */\nexport async function getAvailableTenants(request: Request): Promise<string[]> {\n  if (isIdentityContextResolutionInProgress(request)) {\n    return [];\n  }\n\n  try {\n    const sessionData = await getAuthSession(request);\n    if (!sessionData?.user?.sub) {\n      return [];\n    }\n\n    if (typeof sessionData.expiresAt === 'number' && Date.now() >= sessionData.expiresAt) {\n      return [];\n    }\n\n    if (!identityContextFetcher) {\n      console.warn('Identity context fetcher not configured');\n      return [];\n    }\n\n    const context = await fetchConfiguredIdentityContext(request);\n    return resolveAvailableTenants({ request, session: sessionData, identityContext: context });\n  } catch (error) {\n    console.error('Error getting available tenants:', error);\n    return [];\n  }\n}\n\n/**\n * Validate a tenant selector against the current identity membership set.\n *\n * Cookies and request options are selectors only; this check is the boundary\n * before a tenant ID is used in a server-authoritative operation such as an\n * API header or a session-backed tenant switch.\n */\nexport async function isTenantMember(request: Request, tenantId: string): Promise<boolean> {\n  if (!tenantId || isIdentityContextResolutionInProgress(request)) {\n    return false;\n  }\n\n  const availableTenants = await getAvailableTenants(request);\n  return availableTenants.includes(tenantId);\n}\n\n/**\n * Set current active tenant\n */\nexport async function setCurrentTenant(\n  request: Request,\n  tenantId: string\n): Promise<{ headers: Headers; success: boolean; error?: string }> {\n  try {\n    const sessionData = await getAuthSession(request);\n\n    if (!sessionData.user) {\n      return { headers: new Headers(), success: false, error: 'No active session' };\n    }\n\n    if (!await isTenantMember(request, tenantId)) {\n      return {\n        headers: new Headers(),\n        success: false,\n        error: 'Tenant is not available for the active user',\n      };\n    }\n\n    const cookieValue = await setActiveTenant(tenantId);\n    const headers = new Headers();\n    headers.append('Set-Cookie', cookieValue);\n\n    return { headers, success: true };\n  } catch (error) {\n    console.error('Failed to set current tenant:', error);\n    return {\n      headers: new Headers(),\n      success: false,\n      error: error instanceof Error ? error.message : 'Unknown error',\n    };\n  }\n}\n\n/**\n * Initialize tenant on first login\n */\nexport async function initializeTenant(\n  request: Request\n): Promise<{ headers: Headers; tenantId: string } | null> {\n  try {\n    const sessionData = await getAuthSession(request);\n    if (!sessionData?.user) {\n      return null;\n    }\n\n    // Check if tenant is already set in cookie\n    const currentTenant = await getCurrentTenant(request);\n    if (currentTenant) {\n      return null;\n    }\n\n    // Get tenant from identity context\n    const tenantId = await getTenantFromIdentityContext(request);\n\n    if (tenantId) {\n      const cookieValue = await setActiveTenant(tenantId);\n      const headers = new Headers();\n      headers.append('Set-Cookie', cookieValue);\n      return { headers, tenantId };\n    }\n\n    return null;\n  } catch (error) {\n    console.error('Failed to initialize tenant:', error);\n    return null;\n  }\n}\n\n/**\n * Clear current tenant\n */\nexport async function clearCurrentTenant(): Promise<Headers> {\n  const cookieValue = await clearActiveTenant();\n  const headers = new Headers();\n  headers.append('Set-Cookie', cookieValue);\n  return headers;\n}\n"],"mappings":";;AAiBA,MAAM,+BAA6D;CACjE,MAAM;CACN,QAAQ,OAAU,KAAK;CACvB,MAAM;CACN,QAAQ,QAAQ,IAAI,aAAa;CACjC,UAAU;CACV,UAAU;AACZ;AAEA,IAAI,qBAAmD,EACrD,GAAG,6BACL;AAEA,SAAS,wBAAsD;CAC7D,OAAO;AACT;AAEA,SAAS,gBAAgB,cAAsB,MAA6B;CAC1E,KAAK,MAAM,WAAW,aAAa,MAAM,GAAG,GAAG;EAC7C,MAAM,CAAC,SAAS,GAAG,YAAY,QAAQ,MAAM,GAAG;EAChD,IAAI,SAAS,KAAK,MAAM,QAAQ,SAAS,WAAW,GAClD;EAGF,OAAO,mBAAmB,SAAS,KAAK,GAAG,CAAC;CAC9C;CAEA,OAAO;AACT;;;;;;;;AASA,eAAsB,gBAAgB,SAA0C;CAC9E,MAAM,SAAS,sBAAsB;CACrC,MAAM,UAAU,QAAQ,QAAQ,IAAI,QAAQ;CAC5C,IAAI,CAAC,SAAS,OAAO;CAErB,OAAO,gBAAgB,SAAS,OAAO,IAAI;AAC7C;;;;AAKA,eAAsB,gBAAgB,UAAmC;CACvE,MAAM,SAAS,sBAAsB;CACrC,MAAM,SAAS,OAAO,SAAS,aAAa;CAC5C,MAAM,WAAW,OAAO,WAAW,eAAe;CAClD,OAAO,GAAG,OAAO,KAAK,GAAG,mBAAmB,QAAQ,EAAE,SAAS,OAAO,OAAO,SAAS,aAAa,OAAO,SAAS,YAAY,OAAO,SAAS;AACjJ;;;;AAKA,eAAsB,oBAAqC;CACzD,MAAM,SAAS,sBAAsB;CACrC,MAAM,SAAS,OAAO,SAAS,aAAa;CAC5C,MAAM,WAAW,OAAO,WAAW,eAAe;CAClD,OAAO,GAAG,OAAO,KAAK,UAAU,OAAO,OAAO,SAAS,aAAa,OAAO,SAAS,aAAa;AACnG;;;;AAKA,SAAgB,sBAAsB,QAAkC;CACtE,qBAAqB;EACnB,GAAG;EACH,GAAG;CACL;AACF;;;;AAKA,SAAgB,0BAAgC;CAC9C,qBAAqB,EACnB,GAAG,6BACL;AACF;;;;;;;;ACrEA,IAAI,yBAAwD;AAC5D,MAAM,oDAAoC,IAAI,QAAiB;AAC/D,IAAI,wBACD,EAAE,sBAAsB;CACvB,MAAM,aAAa,iBAAiB,cAAc;CAClD,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD;AACF,IAAI,2BACD,EAAE,sBACD,iBAAiB,aACb,KAAK,eAAe,WAAW,YAAY,WAAW,EAAE,CAAC,CAC1D,QAAQ,aAAiC,QAAQ,QAAQ,CAAC,KAAK,CAAC;;;;AAKvE,SAAgB,gCAAgC,SAAuC;CACrF,yBAAyB;AAC3B;;;;AAKA,SAAgB,0BAA0B,QAAsC;CAC9E,IAAI,OAAO,wBACT,yBAAyB,OAAO;CAElC,IAAI,OAAO,sBACT,uBAAuB,OAAO;CAEhC,IAAI,OAAO,yBACT,0BAA0B,OAAO;AAErC;AAEA,SAAgB,8BAAoC;CAClD,yBAAyB;CACzB,wBAAwB,EAAE,sBAAsB;EAC9C,MAAM,aAAa,iBAAiB,cAAc;EAClD,OAAO,YAAY,YAAY,YAAY,MAAM;CACnD;CACA,2BAA2B,EAAE,sBAC3B,iBAAiB,aACb,KAAK,eAAe,WAAW,YAAY,WAAW,EAAE,CAAC,CAC1D,QAAQ,aAAiC,QAAQ,QAAQ,CAAC,KAAK,CAAC;AACvE;AAEA,SAAS,sCAAsC,SAA2B;CACxE,OAAO,kCAAkC,IAAI,OAAO;AACtD;AAEA,eAAe,+BACb,SACsD;CACtD,MAAM,UAAU;CAChB,IAAI,CAAC,WAAW,sCAAsC,OAAO,GAC3D,OAAO;CAGT,kCAAkC,IAAI,OAAO;CAC7C,IAAI;EACF,OAAO,MAAM,QAAQ,OAAO;CAC9B,UAAU;EACR,kCAAkC,OAAO,OAAO;CAClD;AACF;;;;AAKA,eAAsB,iBACpB,SACA,mBACwB;CAIxB,IAAI,sCAAsC,OAAO,GAC/C,OAAO;CAGT,IAAI;EACF,IAAI,mBACF,OAAO,MAAM,eAAe,SAAS,iBAAiB,IAAI,oBAAoB;EAGhF,MAAM,mBAAmB,MAAM,gBAAgB,OAAO;EACtD,IAAI,oBAAoB,MAAM,eAAe,SAAS,gBAAgB,GACpE,OAAO;EAGT,OAAO;CACT,SAAS,OAAO;EACd,QAAQ,MAAM,iCAAiC,KAAK;EACpD,OAAO;CACT;AACF;;;;AAKA,eAAsB,6BAA6B,SAA0C;CAC3F,IAAI,sCAAsC,OAAO,GAC/C,OAAO;CAGT,IAAI;EACF,MAAM,cAAc,MAAM,eAAe,OAAO;EAChD,IAAI,CAAC,aAAa,MAAM,KACtB,OAAO;EAGT,IAAI,OAAO,YAAY,cAAc,YAAY,KAAK,IAAI,KAAK,YAAY,WACzE,OAAO;EAGT,IAAI,CAAC,wBAAwB;GAC3B,QAAQ,KAAK,yCAAyC;GACtD,OAAO;EACT;EAEA,MAAM,UAAU,MAAM,+BAA+B,OAAO;EAC5D,OAAO,qBAAqB;GAAE;GAAS,SAAS;GAAa,iBAAiB;EAAQ,CAAC;CACzF,SAAS,OAAO;EACd,QAAQ,MAAM,+CAA+C,KAAK;EAClE,OAAO;CACT;AACF;;;;AAKA,eAAsB,oBAAoB,SAAqC;CAC7E,IAAI,sCAAsC,OAAO,GAC/C,OAAO,CAAC;CAGV,IAAI;EACF,MAAM,cAAc,MAAM,eAAe,OAAO;EAChD,IAAI,CAAC,aAAa,MAAM,KACtB,OAAO,CAAC;EAGV,IAAI,OAAO,YAAY,cAAc,YAAY,KAAK,IAAI,KAAK,YAAY,WACzE,OAAO,CAAC;EAGV,IAAI,CAAC,wBAAwB;GAC3B,QAAQ,KAAK,yCAAyC;GACtD,OAAO,CAAC;EACV;EAEA,MAAM,UAAU,MAAM,+BAA+B,OAAO;EAC5D,OAAO,wBAAwB;GAAE;GAAS,SAAS;GAAa,iBAAiB;EAAQ,CAAC;CAC5F,SAAS,OAAO;EACd,QAAQ,MAAM,oCAAoC,KAAK;EACvD,OAAO,CAAC;CACV;AACF;;;;;;;;AASA,eAAsB,eAAe,SAAkB,UAAoC;CACzF,IAAI,CAAC,YAAY,sCAAsC,OAAO,GAC5D,OAAO;CAIT,QAAO,MADwB,oBAAoB,OAAO,EAAA,CAClC,SAAS,QAAQ;AAC3C;;;;AAKA,eAAsB,iBACpB,SACA,UACiE;CACjE,IAAI;EAGF,IAAI,EAAC,MAFqB,eAAe,OAAO,EAAA,CAE/B,MACf,OAAO;GAAE,SAAS,IAAI,QAAQ;GAAG,SAAS;GAAO,OAAO;EAAoB;EAG9E,IAAI,CAAC,MAAM,eAAe,SAAS,QAAQ,GACzC,OAAO;GACL,SAAS,IAAI,QAAQ;GACrB,SAAS;GACT,OAAO;EACT;EAGF,MAAM,cAAc,MAAM,gBAAgB,QAAQ;EAClD,MAAM,UAAU,IAAI,QAAQ;EAC5B,QAAQ,OAAO,cAAc,WAAW;EAExC,OAAO;GAAE;GAAS,SAAS;EAAK;CAClC,SAAS,OAAO;EACd,QAAQ,MAAM,iCAAiC,KAAK;EACpD,OAAO;GACL,SAAS,IAAI,QAAQ;GACrB,SAAS;GACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU;EAClD;CACF;AACF;;;;AAKA,eAAsB,iBACpB,SACwD;CACxD,IAAI;EAEF,IAAI,EAAC,MADqB,eAAe,OAAO,EAAA,EAC9B,MAChB,OAAO;EAKT,IAAI,MADwB,iBAAiB,OAAO,GAElD,OAAO;EAIT,MAAM,WAAW,MAAM,6BAA6B,OAAO;EAE3D,IAAI,UAAU;GACZ,MAAM,cAAc,MAAM,gBAAgB,QAAQ;GAClD,MAAM,UAAU,IAAI,QAAQ;GAC5B,QAAQ,OAAO,cAAc,WAAW;GACxC,OAAO;IAAE;IAAS;GAAS;EAC7B;EAEA,OAAO;CACT,SAAS,OAAO;EACd,QAAQ,MAAM,gCAAgC,KAAK;EACnD,OAAO;CACT;AACF;;;;AAKA,eAAsB,qBAAuC;CAC3D,MAAM,cAAc,MAAM,kBAAkB;CAC5C,MAAM,UAAU,IAAI,QAAQ;CAC5B,QAAQ,OAAO,cAAc,WAAW;CACxC,OAAO;AACT"}
+{"version":3,"file":"server.mjs","names":["spineRuntimeEnv"],"sources":["../../src/tenant/tenant-cookie.server.ts","../../src/tenant/tenant.server.ts"],"sourcesContent":["import { env as spineRuntimeEnv } from 'node:process';\n/**\n * Tenant Cookie Server Module\n * \n * Cookie-based tenant storage.\n */\n\nexport type TenantCookieSameSite = 'Strict' | 'Lax' | 'None';\n\nexport interface TenantCookieConfig {\n  name?: string;\n  maxAge?: number;\n  path?: string;\n  secure?: boolean;\n  httpOnly?: boolean;\n  sameSite?: TenantCookieSameSite;\n}\n\nconst DEFAULT_TENANT_COOKIE_CONFIG: Required<TenantCookieConfig> = {\n  name: '__spine_tenant',\n  maxAge: 60 * 60 * 24 * 365,\n  path: '/',\n  secure: spineRuntimeEnv.NODE_ENV === 'production',\n  httpOnly: false,\n  sameSite: 'Lax',\n};\n\nlet tenantCookieConfig: Required<TenantCookieConfig> = {\n  ...DEFAULT_TENANT_COOKIE_CONFIG,\n};\n\nfunction getTenantCookieConfig(): Required<TenantCookieConfig> {\n  return tenantCookieConfig;\n}\n\nfunction readCookieValue(cookieHeader: string, name: string): string | null {\n  for (const segment of cookieHeader.split(';')) {\n    const [rawName, ...rawValue] = segment.split('=');\n    if (rawName?.trim() !== name || rawValue.length === 0) {\n      continue;\n    }\n\n    return decodeURIComponent(rawValue.join('='));\n  }\n\n  return null;\n}\n\n/**\n * Read the active tenant selector from the cookie.\n *\n * This is intentionally a raw cookie helper. Call `getCurrentTenant` from the\n * tenant server module before using the value in an authorization-sensitive\n * server operation.\n */\nexport async function getActiveTenant(request: Request): Promise<string | null> {\n  const config = getTenantCookieConfig();\n  const cookies = request.headers.get('Cookie');\n  if (!cookies) return null;\n\n  return readCookieValue(cookies, config.name);\n}\n\n/**\n * Set active tenant cookie value\n */\nexport async function setActiveTenant(tenantId: string): Promise<string> {\n  const config = getTenantCookieConfig();\n  const secure = config.secure ? '; Secure' : '';\n  const httpOnly = config.httpOnly ? '; HttpOnly' : '';\n  return `${config.name}=${encodeURIComponent(tenantId)}; Path=${config.path}${httpOnly}; SameSite=${config.sameSite}; Max-Age=${config.maxAge}${secure}`;\n}\n\n/**\n * Clear active tenant cookie value\n */\nexport async function clearActiveTenant(): Promise<string> {\n  const config = getTenantCookieConfig();\n  const secure = config.secure ? '; Secure' : '';\n  const httpOnly = config.httpOnly ? '; HttpOnly' : '';\n  return `${config.name}=; Path=${config.path}${httpOnly}; SameSite=${config.sameSite}; Max-Age=0${secure}`;\n}\n\n/**\n * Configure tenant cookie name\n */\nexport function configureTenantCookie(config: TenantCookieConfig): void {\n  tenantCookieConfig = {\n    ...tenantCookieConfig,\n    ...config,\n  };\n}\n\n/**\n * Reset tenant cookie config back to defaults.\n */\nexport function resetTenantCookieConfig(): void {\n  tenantCookieConfig = {\n    ...DEFAULT_TENANT_COOKIE_CONFIG,\n  };\n}\n","/**\n * Tenant Server Module\n * \n * Server-side tenant management.\n */\n\nimport { getAuthSession } from '../auth/redis-session-storage.server';\nimport { getActiveTenant, setActiveTenant, clearActiveTenant } from './tenant-cookie.server';\nimport type { SessionData } from '../auth/types';\n\n/**\n * Identity context fetcher type (to avoid circular dependency)\n */\nexport type IdentityContextFetcher = (request: Request) => Promise<{\n  memberships?: Array<{ tenantId?: string; id?: string; [key: string]: unknown }>;\n  [key: string]: unknown;\n} | null>;\n\nexport interface TenantResolutionContext {\n  request: Request;\n  session: SessionData;\n  identityContext: Awaited<ReturnType<IdentityContextFetcher>>;\n}\n\nexport interface TenantResolutionConfig {\n  identityContextFetcher?: IdentityContextFetcher;\n  resolveInitialTenant?: (context: TenantResolutionContext) => Promise<string | null> | string | null;\n  resolveAvailableTenants?: (context: TenantResolutionContext) => Promise<string[]> | string[];\n}\n\nlet identityContextFetcher: IdentityContextFetcher | null = null;\nconst identityContextResolutionRequests = new WeakSet<Request>();\nlet resolveInitialTenant: NonNullable<TenantResolutionConfig['resolveInitialTenant']> =\n  ({ identityContext }) => {\n    const membership = identityContext?.memberships?.[0];\n    return membership?.tenantId ?? membership?.id ?? null;\n  };\nlet resolveAvailableTenants: NonNullable<TenantResolutionConfig['resolveAvailableTenants']> =\n  ({ identityContext }) =>\n    identityContext?.memberships\n      ?.map((membership) => membership.tenantId ?? membership.id)\n      .filter((tenantId): tenantId is string => Boolean(tenantId)) ?? [];\n\n/**\n * Configure identity context fetcher\n */\nexport function configureIdentityContextFetcher(fetcher: IdentityContextFetcher): void {\n  identityContextFetcher = fetcher;\n}\n\n/**\n * Configure tenant resolution for custom backend identity contracts.\n */\nexport function configureTenantResolution(config: TenantResolutionConfig): void {\n  if (config.identityContextFetcher) {\n    identityContextFetcher = config.identityContextFetcher;\n  }\n  if (config.resolveInitialTenant) {\n    resolveInitialTenant = config.resolveInitialTenant;\n  }\n  if (config.resolveAvailableTenants) {\n    resolveAvailableTenants = config.resolveAvailableTenants;\n  }\n}\n\nexport function resetTenantResolutionConfig(): void {\n  identityContextFetcher = null;\n  resolveInitialTenant = ({ identityContext }) => {\n    const membership = identityContext?.memberships?.[0];\n    return membership?.tenantId ?? membership?.id ?? null;\n  };\n  resolveAvailableTenants = ({ identityContext }) =>\n    identityContext?.memberships\n      ?.map((membership) => membership.tenantId ?? membership.id)\n      .filter((tenantId): tenantId is string => Boolean(tenantId)) ?? [];\n}\n\nfunction isIdentityContextResolutionInProgress(request: Request): boolean {\n  return identityContextResolutionRequests.has(request);\n}\n\nasync function fetchConfiguredIdentityContext(\n  request: Request,\n): Promise<Awaited<ReturnType<IdentityContextFetcher>>> {\n  const fetcher = identityContextFetcher;\n  if (!fetcher || isIdentityContextResolutionInProgress(request)) {\n    return null;\n  }\n\n  identityContextResolutionRequests.add(request);\n  try {\n    return await fetcher(request);\n  } finally {\n    identityContextResolutionRequests.delete(request);\n  }\n}\n\n/**\n * Get current active tenant from cookie\n */\nexport async function getCurrentTenant(\n  request: Request,\n  requestedTenantId?: string,\n): Promise<string | null> {\n  // Identity fetchers commonly build their request through the same tenant\n  // resolver. A nested selector is not authorization evidence and must not\n  // recurse into another membership fetch.\n  if (isIdentityContextResolutionInProgress(request)) {\n    return null;\n  }\n\n  try {\n    if (requestedTenantId) {\n      return await isTenantMember(request, requestedTenantId) ? requestedTenantId : null;\n    }\n\n    const tenantFromCookie = await getActiveTenant(request);\n    if (tenantFromCookie && await isTenantMember(request, tenantFromCookie)) {\n      return tenantFromCookie;\n    }\n\n    return null;\n  } catch (error) {\n    console.error('Error getting current tenant:', error);\n    return null;\n  }\n}\n\n/**\n * Get tenant from identity context\n */\nexport async function getTenantFromIdentityContext(request: Request): Promise<string | null> {\n  if (isIdentityContextResolutionInProgress(request)) {\n    return null;\n  }\n\n  try {\n    const sessionData = await getAuthSession(request);\n    if (!sessionData?.user?.sub) {\n      return null;\n    }\n\n    if (typeof sessionData.expiresAt === 'number' && Date.now() >= sessionData.expiresAt) {\n      return null;\n    }\n\n    if (!identityContextFetcher) {\n      console.warn('Identity context fetcher not configured');\n      return null;\n    }\n\n    const context = await fetchConfiguredIdentityContext(request);\n    return resolveInitialTenant({ request, session: sessionData, identityContext: context });\n  } catch (error) {\n    console.error('Error getting tenant from identity context:', error);\n    return null;\n  }\n}\n\n/**\n * Get available tenants from identity context\n */\nexport async function getAvailableTenants(request: Request): Promise<string[]> {\n  if (isIdentityContextResolutionInProgress(request)) {\n    return [];\n  }\n\n  try {\n    const sessionData = await getAuthSession(request);\n    if (!sessionData?.user?.sub) {\n      return [];\n    }\n\n    if (typeof sessionData.expiresAt === 'number' && Date.now() >= sessionData.expiresAt) {\n      return [];\n    }\n\n    if (!identityContextFetcher) {\n      console.warn('Identity context fetcher not configured');\n      return [];\n    }\n\n    const context = await fetchConfiguredIdentityContext(request);\n    return resolveAvailableTenants({ request, session: sessionData, identityContext: context });\n  } catch (error) {\n    console.error('Error getting available tenants:', error);\n    return [];\n  }\n}\n\n/**\n * Validate a tenant selector against the current identity membership set.\n *\n * Cookies and request options are selectors only; this check is the boundary\n * before a tenant ID is used in a server-authoritative operation such as an\n * API header or a session-backed tenant switch.\n */\nexport async function isTenantMember(request: Request, tenantId: string): Promise<boolean> {\n  if (!tenantId || isIdentityContextResolutionInProgress(request)) {\n    return false;\n  }\n\n  const availableTenants = await getAvailableTenants(request);\n  return availableTenants.includes(tenantId);\n}\n\n/**\n * Set current active tenant\n */\nexport async function setCurrentTenant(\n  request: Request,\n  tenantId: string\n): Promise<{ headers: Headers; success: boolean; error?: string }> {\n  try {\n    const sessionData = await getAuthSession(request);\n\n    if (!sessionData.user) {\n      return { headers: new Headers(), success: false, error: 'No active session' };\n    }\n\n    if (!await isTenantMember(request, tenantId)) {\n      return {\n        headers: new Headers(),\n        success: false,\n        error: 'Tenant is not available for the active user',\n      };\n    }\n\n    const cookieValue = await setActiveTenant(tenantId);\n    const headers = new Headers();\n    headers.append('Set-Cookie', cookieValue);\n\n    return { headers, success: true };\n  } catch (error) {\n    console.error('Failed to set current tenant:', error);\n    return {\n      headers: new Headers(),\n      success: false,\n      error: error instanceof Error ? error.message : 'Unknown error',\n    };\n  }\n}\n\n/**\n * Initialize tenant on first login\n */\nexport async function initializeTenant(\n  request: Request\n): Promise<{ headers: Headers; tenantId: string } | null> {\n  try {\n    const sessionData = await getAuthSession(request);\n    if (!sessionData?.user) {\n      return null;\n    }\n\n    // Check if tenant is already set in cookie\n    const currentTenant = await getCurrentTenant(request);\n    if (currentTenant) {\n      return null;\n    }\n\n    // Get tenant from identity context\n    const tenantId = await getTenantFromIdentityContext(request);\n\n    if (tenantId) {\n      const cookieValue = await setActiveTenant(tenantId);\n      const headers = new Headers();\n      headers.append('Set-Cookie', cookieValue);\n      return { headers, tenantId };\n    }\n\n    return null;\n  } catch (error) {\n    console.error('Failed to initialize tenant:', error);\n    return null;\n  }\n}\n\n/**\n * Clear current tenant\n */\nexport async function clearCurrentTenant(): Promise<Headers> {\n  const cookieValue = await clearActiveTenant();\n  const headers = new Headers();\n  headers.append('Set-Cookie', cookieValue);\n  return headers;\n}\n"],"mappings":";;;AAkBA,MAAM,+BAA6D;CACjE,MAAM;CACN,QAAQ,OAAU,KAAK;CACvB,MAAM;CACN,QAAQA,IAAgB,aAAa;CACrC,UAAU;CACV,UAAU;AACZ;AAEA,IAAI,qBAAmD,EACrD,GAAG,6BACL;AAEA,SAAS,wBAAsD;CAC7D,OAAO;AACT;AAEA,SAAS,gBAAgB,cAAsB,MAA6B;CAC1E,KAAK,MAAM,WAAW,aAAa,MAAM,GAAG,GAAG;EAC7C,MAAM,CAAC,SAAS,GAAG,YAAY,QAAQ,MAAM,GAAG;EAChD,IAAI,SAAS,KAAK,MAAM,QAAQ,SAAS,WAAW,GAClD;EAGF,OAAO,mBAAmB,SAAS,KAAK,GAAG,CAAC;CAC9C;CAEA,OAAO;AACT;;;;;;;;AASA,eAAsB,gBAAgB,SAA0C;CAC9E,MAAM,SAAS,sBAAsB;CACrC,MAAM,UAAU,QAAQ,QAAQ,IAAI,QAAQ;CAC5C,IAAI,CAAC,SAAS,OAAO;CAErB,OAAO,gBAAgB,SAAS,OAAO,IAAI;AAC7C;;;;AAKA,eAAsB,gBAAgB,UAAmC;CACvE,MAAM,SAAS,sBAAsB;CACrC,MAAM,SAAS,OAAO,SAAS,aAAa;CAC5C,MAAM,WAAW,OAAO,WAAW,eAAe;CAClD,OAAO,GAAG,OAAO,KAAK,GAAG,mBAAmB,QAAQ,EAAE,SAAS,OAAO,OAAO,SAAS,aAAa,OAAO,SAAS,YAAY,OAAO,SAAS;AACjJ;;;;AAKA,eAAsB,oBAAqC;CACzD,MAAM,SAAS,sBAAsB;CACrC,MAAM,SAAS,OAAO,SAAS,aAAa;CAC5C,MAAM,WAAW,OAAO,WAAW,eAAe;CAClD,OAAO,GAAG,OAAO,KAAK,UAAU,OAAO,OAAO,SAAS,aAAa,OAAO,SAAS,aAAa;AACnG;;;;AAKA,SAAgB,sBAAsB,QAAkC;CACtE,qBAAqB;EACnB,GAAG;EACH,GAAG;CACL;AACF;;;;AAKA,SAAgB,0BAAgC;CAC9C,qBAAqB,EACnB,GAAG,6BACL;AACF;;;;;;;;ACtEA,IAAI,yBAAwD;AAC5D,MAAM,oDAAoC,IAAI,QAAiB;AAC/D,IAAI,wBACD,EAAE,sBAAsB;CACvB,MAAM,aAAa,iBAAiB,cAAc;CAClD,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD;AACF,IAAI,2BACD,EAAE,sBACD,iBAAiB,aACb,KAAK,eAAe,WAAW,YAAY,WAAW,EAAE,CAAC,CAC1D,QAAQ,aAAiC,QAAQ,QAAQ,CAAC,KAAK,CAAC;;;;AAKvE,SAAgB,gCAAgC,SAAuC;CACrF,yBAAyB;AAC3B;;;;AAKA,SAAgB,0BAA0B,QAAsC;CAC9E,IAAI,OAAO,wBACT,yBAAyB,OAAO;CAElC,IAAI,OAAO,sBACT,uBAAuB,OAAO;CAEhC,IAAI,OAAO,yBACT,0BAA0B,OAAO;AAErC;AAEA,SAAgB,8BAAoC;CAClD,yBAAyB;CACzB,wBAAwB,EAAE,sBAAsB;EAC9C,MAAM,aAAa,iBAAiB,cAAc;EAClD,OAAO,YAAY,YAAY,YAAY,MAAM;CACnD;CACA,2BAA2B,EAAE,sBAC3B,iBAAiB,aACb,KAAK,eAAe,WAAW,YAAY,WAAW,EAAE,CAAC,CAC1D,QAAQ,aAAiC,QAAQ,QAAQ,CAAC,KAAK,CAAC;AACvE;AAEA,SAAS,sCAAsC,SAA2B;CACxE,OAAO,kCAAkC,IAAI,OAAO;AACtD;AAEA,eAAe,+BACb,SACsD;CACtD,MAAM,UAAU;CAChB,IAAI,CAAC,WAAW,sCAAsC,OAAO,GAC3D,OAAO;CAGT,kCAAkC,IAAI,OAAO;CAC7C,IAAI;EACF,OAAO,MAAM,QAAQ,OAAO;CAC9B,UAAU;EACR,kCAAkC,OAAO,OAAO;CAClD;AACF;;;;AAKA,eAAsB,iBACpB,SACA,mBACwB;CAIxB,IAAI,sCAAsC,OAAO,GAC/C,OAAO;CAGT,IAAI;EACF,IAAI,mBACF,OAAO,MAAM,eAAe,SAAS,iBAAiB,IAAI,oBAAoB;EAGhF,MAAM,mBAAmB,MAAM,gBAAgB,OAAO;EACtD,IAAI,oBAAoB,MAAM,eAAe,SAAS,gBAAgB,GACpE,OAAO;EAGT,OAAO;CACT,SAAS,OAAO;EACd,QAAQ,MAAM,iCAAiC,KAAK;EACpD,OAAO;CACT;AACF;;;;AAKA,eAAsB,6BAA6B,SAA0C;CAC3F,IAAI,sCAAsC,OAAO,GAC/C,OAAO;CAGT,IAAI;EACF,MAAM,cAAc,MAAM,eAAe,OAAO;EAChD,IAAI,CAAC,aAAa,MAAM,KACtB,OAAO;EAGT,IAAI,OAAO,YAAY,cAAc,YAAY,KAAK,IAAI,KAAK,YAAY,WACzE,OAAO;EAGT,IAAI,CAAC,wBAAwB;GAC3B,QAAQ,KAAK,yCAAyC;GACtD,OAAO;EACT;EAEA,MAAM,UAAU,MAAM,+BAA+B,OAAO;EAC5D,OAAO,qBAAqB;GAAE;GAAS,SAAS;GAAa,iBAAiB;EAAQ,CAAC;CACzF,SAAS,OAAO;EACd,QAAQ,MAAM,+CAA+C,KAAK;EAClE,OAAO;CACT;AACF;;;;AAKA,eAAsB,oBAAoB,SAAqC;CAC7E,IAAI,sCAAsC,OAAO,GAC/C,OAAO,CAAC;CAGV,IAAI;EACF,MAAM,cAAc,MAAM,eAAe,OAAO;EAChD,IAAI,CAAC,aAAa,MAAM,KACtB,OAAO,CAAC;EAGV,IAAI,OAAO,YAAY,cAAc,YAAY,KAAK,IAAI,KAAK,YAAY,WACzE,OAAO,CAAC;EAGV,IAAI,CAAC,wBAAwB;GAC3B,QAAQ,KAAK,yCAAyC;GACtD,OAAO,CAAC;EACV;EAEA,MAAM,UAAU,MAAM,+BAA+B,OAAO;EAC5D,OAAO,wBAAwB;GAAE;GAAS,SAAS;GAAa,iBAAiB;EAAQ,CAAC;CAC5F,SAAS,OAAO;EACd,QAAQ,MAAM,oCAAoC,KAAK;EACvD,OAAO,CAAC;CACV;AACF;;;;;;;;AASA,eAAsB,eAAe,SAAkB,UAAoC;CACzF,IAAI,CAAC,YAAY,sCAAsC,OAAO,GAC5D,OAAO;CAIT,QAAO,MADwB,oBAAoB,OAAO,EAAA,CAClC,SAAS,QAAQ;AAC3C;;;;AAKA,eAAsB,iBACpB,SACA,UACiE;CACjE,IAAI;EAGF,IAAI,EAAC,MAFqB,eAAe,OAAO,EAAA,CAE/B,MACf,OAAO;GAAE,SAAS,IAAI,QAAQ;GAAG,SAAS;GAAO,OAAO;EAAoB;EAG9E,IAAI,CAAC,MAAM,eAAe,SAAS,QAAQ,GACzC,OAAO;GACL,SAAS,IAAI,QAAQ;GACrB,SAAS;GACT,OAAO;EACT;EAGF,MAAM,cAAc,MAAM,gBAAgB,QAAQ;EAClD,MAAM,UAAU,IAAI,QAAQ;EAC5B,QAAQ,OAAO,cAAc,WAAW;EAExC,OAAO;GAAE;GAAS,SAAS;EAAK;CAClC,SAAS,OAAO;EACd,QAAQ,MAAM,iCAAiC,KAAK;EACpD,OAAO;GACL,SAAS,IAAI,QAAQ;GACrB,SAAS;GACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU;EAClD;CACF;AACF;;;;AAKA,eAAsB,iBACpB,SACwD;CACxD,IAAI;EAEF,IAAI,EAAC,MADqB,eAAe,OAAO,EAAA,EAC9B,MAChB,OAAO;EAKT,IAAI,MADwB,iBAAiB,OAAO,GAElD,OAAO;EAIT,MAAM,WAAW,MAAM,6BAA6B,OAAO;EAE3D,IAAI,UAAU;GACZ,MAAM,cAAc,MAAM,gBAAgB,QAAQ;GAClD,MAAM,UAAU,IAAI,QAAQ;GAC5B,QAAQ,OAAO,cAAc,WAAW;GACxC,OAAO;IAAE;IAAS;GAAS;EAC7B;EAEA,OAAO;CACT,SAAS,OAAO;EACd,QAAQ,MAAM,gCAAgC,KAAK;EACnD,OAAO;CACT;AACF;;;;AAKA,eAAsB,qBAAuC;CAC3D,MAAM,cAAc,MAAM,kBAAkB;CAC5C,MAAM,UAAU,IAAI,QAAQ;CAC5B,QAAQ,OAAO,cAAc,WAAW;CACxC,OAAO;AACT"}

package/dist/tenant/tenant-cookie.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-cookie.server.d.ts","sourceRoot":"","sources":["../../src/tenant/tenant-cookie.server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAE7D,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CACjC;AAgCD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAM9E;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKvE;AAED;;GAEG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAKzD;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAKtE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAI9C"}
+{"version":3,"file":"tenant-cookie.server.d.ts","sourceRoot":"","sources":["../../src/tenant/tenant-cookie.server.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAEH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAE7D,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CACjC;AAgCD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAM9E;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKvE;AAED;;GAEG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAKzD;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAKtE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAI9C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eminuckan/spine",
-  "version": "0.3.11",
+  "version": "0.3.12",
   "description": "Framework-agnostic SaaS primitives for auth, identity, multi-tenancy, permissions, and API access.",
   "type": "module",
   "main": "./dist/index.mjs",

package/dist/redis-session-storage.server-DLJ0B7-C.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"redis-session-storage.server-DLJ0B7-C.mjs","names":["resolvePositiveIntegerEnv"],"sources":["../src/auth/oauth-state-config.ts","../src/auth/redis-session-storage.server.ts"],"sourcesContent":["const DEFAULT_OAUTH_STATE_TTL_SECONDS = 10 * 60;\nconst DEFAULT_OAUTH_RECOVERY_TTL_SECONDS = 30 * 60;\n\nfunction resolvePositiveIntegerEnv(name: string, defaultValue: number): number {\n  const value = process.env[name]?.trim();\n  if (!value) {\n    return defaultValue;\n  }\n\n  const parsed = Number(value);\n  if (!Number.isSafeInteger(parsed) || parsed <= 0) {\n    throw new Error(`${name} must be a positive integer.`);\n  }\n\n  return parsed;\n}\n\n/**\n * OAuth state lifetime shared by Redis expiry and callback age validation.\n * This module is internal and is not part of a package export entry point.\n */\nexport const OAUTH_STATE_TTL_SECONDS = resolvePositiveIntegerEnv(\n  'OAUTH_STATE_TTL',\n  DEFAULT_OAUTH_STATE_TTL_SECONDS,\n);\n\nexport const OAUTH_STATE_TTL_MS = OAUTH_STATE_TTL_SECONDS * 1000;\n\n/**\n * Lifetime for the server-side recovery ticket.  It deliberately outlives\n * the primary OAuth transaction so an IdP callback that arrives after state\n * expiry can still recover once, while remaining short-lived.\n */\nexport const OAUTH_RECOVERY_TTL_SECONDS = Math.max(\n  DEFAULT_OAUTH_RECOVERY_TTL_SECONDS,\n  OAUTH_STATE_TTL_SECONDS + 60,\n);\n\nexport const OAUTH_RECOVERY_TTL_MS = OAUTH_RECOVERY_TTL_SECONDS * 1000;\n","/**\n * Redis Session Storage Server Module\n *\n * Redis-backed session storage for authentication.\n * Provides secure session management with automatic expiration,\n * without depending on a framework-specific session implementation.\n */\n\nimport Redis from 'ioredis';\nimport { createCipheriv, createDecipheriv, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';\nimport type { AuthSessionSummary, SessionData, OAuthState } from './types';\nimport {\n  OAUTH_RECOVERY_TTL_SECONDS,\n  OAUTH_STATE_TTL_SECONDS,\n} from './oauth-state-config';\nimport { logger } from '../logging';\n\n// ============================================================================\n// Redis Client Setup\n// ============================================================================\n\nlet redis: Redis | null = null;\n\nfunction getRedis(): Redis {\n  if (!redis) {\n    redis = new Redis(process.env.REDIS_URL || 'redis://localhost:6379');\n\n    redis.on('error', (err) => {\n      logger.error('Redis Client Error', err);\n    });\n\n    redis.on('connect', () => {\n      logger.info('Redis connected successfully');\n    });\n  }\n  return redis;\n}\n\n// ============================================================================\n// Redis Key Patterns\n// ============================================================================\n\nconst KEY_PREFIX = process.env.REDIS_KEY_PREFIX || '';\n\nconst REDIS_KEYS = {\n  oauthState: (stateId: string) => `${KEY_PREFIX}oauth:state:${stateId}`,\n  oauthRecovery: (ticket: string) => `${KEY_PREFIX}oauth:recovery:${ticket}`,\n  session: (sessionId: string) => `${KEY_PREFIX}session:${sessionId}`,\n  sessionByUser: (userId: string) => `${KEY_PREFIX}session:index:user:${userId}`,\n  sessionBySid: (sid: string) => `${KEY_PREFIX}session:index:sid:${sid}`,\n  sessionBySessionState: (sessionState: string) => `${KEY_PREFIX}session:index:session_state:${sessionState}`,\n};\n\nconst DEFAULT_SESSION_SECRET = 'default-secret-change-in-production';\nconst DEFAULT_SESSION_TTL = 60 * 60 * 24 * 7;\n\nconst SESSION_TTL = resolvePositiveIntegerEnv('SESSION_DEFAULT_TTL', resolvePositiveIntegerEnv('SESSION_TTL', DEFAULT_SESSION_TTL));\n\nconst SESSION_COOKIE_NAME = process.env.SESSION_COOKIE_NAME || '__session_id';\nconst SESSION_SECRET = resolveSessionSecret();\nconst SESSION_COOKIE_SECURE = resolveCookieSecure();\nconst SESSION_COOKIE_PATH = '/';\nconst SESSION_COOKIE_SAME_SITE = resolveCookieSameSite();\nconst SESSION_COOKIE_DOMAIN = process.env.SESSION_COOKIE_DOMAIN?.trim();\nconst SESSION_ENCRYPTION_ENABLED = resolveSessionEncryptionEnabled();\nconst SESSION_ENCRYPTION_KEY = resolveSessionEncryptionKey(SESSION_ENCRYPTION_ENABLED);\n\nexport const AUTH_ERROR_COOKIE_PREFIX = SESSION_COOKIE_NAME.replace('_session', '').replace('__', '');\n\nfunction resolveBooleanEnv(name: string, defaultValue: boolean): boolean {\n  const value = process.env[name]?.trim().toLowerCase();\n  if (!value) {\n    return defaultValue;\n  }\n\n  if (['1', 'true', 'yes', 'on'].includes(value)) {\n    return true;\n  }\n\n  if (['0', 'false', 'no', 'off'].includes(value)) {\n    return false;\n  }\n\n  throw new Error(`${name} must be a boolean value.`);\n}\n\nfunction resolvePositiveIntegerEnv(name: string, defaultValue: number): number {\n  const value = process.env[name]?.trim();\n  if (!value) {\n    return defaultValue;\n  }\n\n  const parsed = Number(value);\n  if (!Number.isSafeInteger(parsed) || parsed <= 0) {\n    throw new Error(`${name} must be a positive integer.`);\n  }\n\n  return parsed;\n}\n\nfunction resolveSessionSecret(): string {\n  const secret = process.env.SESSION_SECRET?.trim();\n  if (!secret || secret === DEFAULT_SESSION_SECRET) {\n    if (process.env.NODE_ENV === 'production') {\n      throw new Error('SESSION_SECRET must be set to a unique random value in production.');\n    }\n\n    return DEFAULT_SESSION_SECRET;\n  }\n\n  if (secret.length < 32) {\n    throw new Error('SESSION_SECRET must be at least 32 characters long.');\n  }\n\n  return secret;\n}\n\nfunction resolveCookieSecure(): boolean {\n  return resolveBooleanEnv('SESSION_COOKIE_SECURE', process.env.NODE_ENV === 'production');\n}\n\nfunction resolveCookieSameSite(): 'Lax' | 'Strict' | 'None' {\n  const value = process.env.SESSION_COOKIE_SAME_SITE?.trim().toLowerCase();\n  const sameSite = value === 'strict' ? 'Strict' : value === 'none' ? 'None' : 'Lax';\n\n  if (sameSite === 'None' && !SESSION_COOKIE_SECURE) {\n    throw new Error('SESSION_COOKIE_SAME_SITE=None requires SESSION_COOKIE_SECURE=true.');\n  }\n\n  return sameSite;\n}\n\nfunction resolveSessionEncryptionEnabled(): boolean {\n  const enabled = resolveBooleanEnv('SESSION_ENCRYPTION', process.env.NODE_ENV === 'production');\n  if (process.env.NODE_ENV === 'production' && !enabled) {\n    throw new Error('SESSION_ENCRYPTION cannot be disabled in production.');\n  }\n\n  return enabled;\n}\n\nfunction decodeBase64Url(value: string): Buffer {\n  const normalized = value.replace(/-/g, '+').replace(/_/g, '/');\n  const padded = normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), '=');\n  return Buffer.from(padded, 'base64');\n}\n\nfunction resolveSessionEncryptionKey(enabled: boolean): Buffer | null {\n  if (!enabled) {\n    return null;\n  }\n\n  const value = process.env.SESSION_ENCRYPTION_KEY?.trim();\n  if (!value) {\n    throw new Error('SESSION_ENCRYPTION_KEY is required when session encryption is enabled.');\n  }\n\n  const key = /^[0-9a-f]{64}$/i.test(value)\n    ? Buffer.from(value, 'hex')\n    : decodeBase64Url(value);\n\n  if (key.length !== 32) {\n    throw new Error('SESSION_ENCRYPTION_KEY must decode to exactly 32 bytes. Generate one with: openssl rand -base64 32');\n  }\n\n  return key;\n}\n\ntype SessionCookieOptions = {\n  maxAge: number;\n};\n\nfunction parseCookieHeader(cookieHeader: string | null): Record<string, string> {\n  if (!cookieHeader) {\n    return {};\n  }\n\n  return cookieHeader\n    .split(';')\n    .map((part) => part.trim())\n    .filter(Boolean)\n    .reduce<Record<string, string>>((cookies, part) => {\n      const separatorIndex = part.indexOf('=');\n      if (separatorIndex <= 0) {\n        return cookies;\n      }\n\n      const name = part.slice(0, separatorIndex).trim();\n      const value = part.slice(separatorIndex + 1).trim();\n      if (!name) {\n        return cookies;\n      }\n\n      cookies[name] = value;\n      return cookies;\n    }, {});\n}\n\nfunction createCookieSignature(value: string, secret: string): string {\n  return createHmac('sha256', secret).update(value).digest('base64url');\n}\n\nfunction safelyCompareValues(left: string, right: string): boolean {\n  const leftBuffer = Buffer.from(left);\n  const rightBuffer = Buffer.from(right);\n\n  if (leftBuffer.length !== rightBuffer.length) {\n    return false;\n  }\n\n  return timingSafeEqual(leftBuffer, rightBuffer);\n}\n\nfunction signSessionId(sessionId: string): string {\n  const signature = createCookieSignature(sessionId, SESSION_SECRET);\n  return `${sessionId}.${signature}`;\n}\n\nfunction unsignSessionId(cookieValue: string | undefined): string | null {\n  if (!cookieValue) {\n    return null;\n  }\n\n  let decodedValue: string;\n  try {\n    decodedValue = decodeURIComponent(cookieValue);\n  } catch {\n    return null;\n  }\n\n  const separatorIndex = decodedValue.lastIndexOf('.');\n  if (separatorIndex <= 0 || separatorIndex === decodedValue.length - 1) {\n    return null;\n  }\n\n  const sessionId = decodedValue.slice(0, separatorIndex);\n  const signature = decodedValue.slice(separatorIndex + 1);\n  const expectedSignature = createCookieSignature(sessionId, SESSION_SECRET);\n\n  return safelyCompareValues(signature, expectedSignature) ? sessionId : null;\n}\n\nfunction serializeSessionCookieValue(sessionId: string, options: SessionCookieOptions): string {\n  const signedValue = encodeURIComponent(signSessionId(sessionId));\n  const segments = [\n    `${SESSION_COOKIE_NAME}=${signedValue}`,\n    `Max-Age=${options.maxAge}`,\n    `Path=${SESSION_COOKIE_PATH}`,\n    `SameSite=${SESSION_COOKIE_SAME_SITE}`,\n    'HttpOnly',\n  ];\n\n  if (SESSION_COOKIE_DOMAIN) {\n    segments.push(`Domain=${SESSION_COOKIE_DOMAIN}`);\n  }\n\n  if (SESSION_COOKIE_SECURE) {\n    segments.push('Secure');\n  }\n\n  return segments.join('; ');\n}\n\nfunction serializeExpiredSessionCookie(): string {\n  const segments = [\n    `${SESSION_COOKIE_NAME}=`,\n    'Max-Age=0',\n    `Path=${SESSION_COOKIE_PATH}`,\n    `SameSite=${SESSION_COOKIE_SAME_SITE}`,\n    'HttpOnly',\n  ];\n\n  if (SESSION_COOKIE_DOMAIN) {\n    segments.push(`Domain=${SESSION_COOKIE_DOMAIN}`);\n  }\n\n  if (SESSION_COOKIE_SECURE) {\n    segments.push('Secure');\n  }\n\n  return segments.join('; ');\n}\n\nasync function getSessionIdFromRequest(request: Request): Promise<string | null> {\n  const cookies = parseCookieHeader(request.headers.get('Cookie'));\n  return unsignSessionId(cookies[SESSION_COOKIE_NAME]);\n}\n\nfunction getSessionIndexKeys(data: SessionData): string[] {\n  const keys = new Set<string>();\n\n  if (data.userId) {\n    keys.add(REDIS_KEYS.sessionByUser(data.userId));\n  }\n\n  if (data.sid) {\n    keys.add(REDIS_KEYS.sessionBySid(data.sid));\n  }\n\n  if (data.sessionState) {\n    keys.add(REDIS_KEYS.sessionBySessionState(data.sessionState));\n  }\n\n  return Array.from(keys);\n}\n\nasync function registerSessionIndexes(sessionId: string, data: SessionData): Promise<void> {\n  const indexKeys = getSessionIndexKeys(data);\n  if (indexKeys.length === 0) {\n    return;\n  }\n\n  const redisClient = getRedis();\n  const pipeline = redisClient.pipeline();\n\n  for (const indexKey of indexKeys) {\n    pipeline.sadd(indexKey, sessionId);\n    pipeline.expire(indexKey, SESSION_TTL);\n  }\n\n  await pipeline.exec();\n}\n\nasync function unregisterSessionIndexes(sessionId: string, data: SessionData): Promise<void> {\n  const indexKeys = getSessionIndexKeys(data);\n  if (indexKeys.length === 0) {\n    return;\n  }\n\n  const redisClient = getRedis();\n  const pipeline = redisClient.pipeline();\n\n  for (const indexKey of indexKeys) {\n    pipeline.srem(indexKey, sessionId);\n  }\n\n  await pipeline.exec();\n}\n\nfunction parseSessionData(sessionData: string | null): SessionData | null {\n  if (!sessionData) {\n    return null;\n  }\n\n  try {\n    return JSON.parse(decodeSessionData(sessionData)) as SessionData;\n  } catch (error) {\n    logger.error('Failed to parse session data', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\nfunction encodeSessionData(data: SessionData): string {\n  const plaintext = JSON.stringify(data);\n  if (!SESSION_ENCRYPTION_KEY) {\n    return plaintext;\n  }\n\n  const iv = randomBytes(12);\n  const cipher = createCipheriv('aes-256-gcm', SESSION_ENCRYPTION_KEY, iv);\n  const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);\n  const tag = cipher.getAuthTag();\n\n  return [\n    'enc:v1',\n    iv.toString('base64url'),\n    tag.toString('base64url'),\n    ciphertext.toString('base64url'),\n  ].join(':');\n}\n\nfunction decodeSessionData(value: string): string {\n  if (!value.startsWith('enc:v1:')) {\n    if (SESSION_ENCRYPTION_ENABLED) {\n      logger.warn('Reading legacy plaintext auth session payload while session encryption is enabled.');\n    }\n\n    return value;\n  }\n\n  if (!SESSION_ENCRYPTION_KEY) {\n    throw new Error('Cannot decrypt auth session payload because SESSION_ENCRYPTION_KEY is not configured.');\n  }\n\n  const [, version, ivValue, tagValue, ciphertextValue] = value.split(':');\n  if (version !== 'v1' || !ivValue || !tagValue || !ciphertextValue) {\n    throw new Error('Invalid encrypted auth session payload format.');\n  }\n\n  const decipher = createDecipheriv('aes-256-gcm', SESSION_ENCRYPTION_KEY, Buffer.from(ivValue, 'base64url'));\n  decipher.setAuthTag(Buffer.from(tagValue, 'base64url'));\n\n  return Buffer.concat([\n    decipher.update(Buffer.from(ciphertextValue, 'base64url')),\n    decipher.final(),\n  ]).toString('utf8');\n}\n\nasync function readSessionData(sessionId: string): Promise<SessionData | null> {\n  try {\n    const sessionData = await getRedis().get(REDIS_KEYS.session(sessionId));\n    if (!sessionData) {\n      logger.debug('Session not found in Redis', { sessionId });\n      return null;\n    }\n\n    await getRedis().expire(REDIS_KEYS.session(sessionId), SESSION_TTL);\n    return parseSessionData(sessionData);\n  } catch (error) {\n    logger.error('Failed to read session from Redis', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\nasync function writeSessionData(sessionId: string, data: SessionData): Promise<void> {\n  try {\n    const existingSessionData = parseSessionData(await getRedis().get(REDIS_KEYS.session(sessionId)));\n    if (existingSessionData) {\n      await unregisterSessionIndexes(sessionId, existingSessionData);\n    }\n\n    await getRedis().setex(REDIS_KEYS.session(sessionId), SESSION_TTL, encodeSessionData(data));\n    await registerSessionIndexes(sessionId, data);\n    logger.debug('Updated Redis session', { sessionId });\n  } catch (error) {\n    logger.error('Failed to update session in Redis', error instanceof Error ? error : undefined);\n    throw error;\n  }\n}\n\nasync function deleteSessionData(sessionId: string): Promise<void> {\n  try {\n    const existingSessionData = parseSessionData(await getRedis().get(REDIS_KEYS.session(sessionId)));\n    if (existingSessionData) {\n      await unregisterSessionIndexes(sessionId, existingSessionData);\n    }\n\n    await getRedis().del(REDIS_KEYS.session(sessionId));\n    logger.debug('Deleted Redis session', { sessionId });\n  } catch (error) {\n    logger.error('Failed to delete session from Redis', error instanceof Error ? error : undefined);\n  }\n}\n\nfunction mergeSessionData(existingData: SessionData, updates: Partial<SessionData>): SessionData {\n  const nextData = { ...existingData } as Record<string, unknown>;\n\n  Object.entries(updates).forEach(([key, value]) => {\n    if (value === undefined) {\n      delete nextData[key];\n      return;\n    }\n\n    nextData[key] = value;\n  });\n\n  return nextData as SessionData;\n}\n\nasync function getSessionIdsFromIndex(indexKey: string): Promise<string[]> {\n  const sessionIds = await getRedis().smembers(indexKey);\n  const activeSessionIds: string[] = [];\n  const staleSessionIds: string[] = [];\n\n  for (const sessionId of sessionIds) {\n    const exists = await getRedis().exists(REDIS_KEYS.session(sessionId));\n    if (exists) {\n      activeSessionIds.push(sessionId);\n    } else {\n      staleSessionIds.push(sessionId);\n    }\n  }\n\n  if (staleSessionIds.length > 0) {\n    await getRedis().srem(indexKey, ...staleSessionIds);\n  }\n\n  return activeSessionIds;\n}\n\nfunction toAuthSessionSummary(\n  sessionId: string,\n  session: SessionData,\n  currentSessionId?: string | null\n): AuthSessionSummary {\n  return {\n    sessionId,\n    userId: session.userId,\n    email: session.user?.email,\n    name: session.user?.name,\n    issuer: session.issuer,\n    sid: session.sid,\n    sessionState: session.sessionState,\n    clientId: session.clientId,\n    ipAddress: session.ipAddress,\n    userAgent: session.userAgent,\n    createdAt: session.createdAt,\n    lastActivity: session.lastActivity,\n    expiresAt: session.expiresAt,\n    isCurrent: currentSessionId ? sessionId === currentSessionId : undefined,\n  };\n}\n\nasync function listSessionDataByIds(sessionIds: string[]): Promise<Array<{ sessionId: string; data: SessionData }>> {\n  const sessions: Array<{ sessionId: string; data: SessionData }> = [];\n\n  for (const sessionId of sessionIds) {\n    const data = await readSessionData(sessionId);\n    if (data) {\n      sessions.push({ sessionId, data });\n    }\n  }\n\n  return sessions;\n}\n\nfunction getRequestIpAddress(request: Request): string | undefined {\n  const forwardedFor = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim();\n  return (\n    forwardedFor ||\n    request.headers.get('cf-connecting-ip')?.trim() ||\n    request.headers.get('x-real-ip')?.trim() ||\n    undefined\n  );\n}\n\n// ============================================================================\n// Session Helper Functions\n// ============================================================================\n\nexport async function createAuthSession(\n  request: Request,\n  sessionData: Partial<SessionData>\n): Promise<Headers> {\n  const currentSessionId = await getSessionIdFromRequest(request);\n  const nextSessionId = crypto.randomUUID();\n  const nextSessionData = mergeSessionData({}, {\n    ...sessionData,\n    sessionId: nextSessionId,\n    ipAddress: sessionData.ipAddress ?? getRequestIpAddress(request),\n    userAgent: sessionData.userAgent ?? request.headers.get('user-agent') ?? undefined,\n  });\n\n  logger.debug('Creating auth session', { dataKeys: Object.keys(sessionData) });\n\n  if (currentSessionId) {\n    await deleteSessionData(currentSessionId);\n  }\n\n  await writeSessionData(nextSessionId, nextSessionData);\n\n  return new Headers({\n    'Set-Cookie': serializeSessionCookieValue(nextSessionId, { maxAge: SESSION_TTL }),\n  });\n}\n\nexport async function getAuthSession(request: Request): Promise<SessionData> {\n  const sessionId = await getSessionIdFromRequest(request);\n  if (!sessionId) {\n    return {};\n  }\n\n  const session = await readSessionData(sessionId);\n  if (!session) {\n    return {};\n  }\n\n  return {\n    sessionId,\n    userId: session.userId,\n    accessToken: session.accessToken,\n    refreshToken: session.refreshToken,\n    idToken: session.idToken,\n    expiresAt: session.expiresAt,\n    issuer: session.issuer,\n    sid: session.sid,\n    sessionState: session.sessionState,\n    clientId: session.clientId,\n    ipAddress: session.ipAddress,\n    userAgent: session.userAgent,\n    user: session.user,\n    createdAt: session.createdAt,\n    lastActivity: session.lastActivity,\n  };\n}\n\nexport async function updateAuthSession(\n  request: Request,\n  updates: Partial<SessionData>\n): Promise<Headers> {\n  const currentSessionId = await getSessionIdFromRequest(request);\n  const currentSessionData = currentSessionId\n    ? (await readSessionData(currentSessionId)) ?? {}\n    : {};\n  const nextSessionId = currentSessionId ?? crypto.randomUUID();\n  const nextSessionData = mergeSessionData(currentSessionData, {\n    ...updates,\n    sessionId: nextSessionId,\n  });\n\n  await writeSessionData(nextSessionId, nextSessionData);\n\n  return new Headers({\n    'Set-Cookie': serializeSessionCookieValue(nextSessionId, { maxAge: SESSION_TTL }),\n  });\n}\n\nexport async function destroyAuthSession(request: Request): Promise<Headers> {\n  const sessionId = await getSessionIdFromRequest(request);\n  if (sessionId) {\n    await deleteSessionData(sessionId);\n  }\n\n  return new Headers({\n    'Set-Cookie': serializeExpiredSessionCookie(),\n  });\n}\n\nexport async function getCurrentAuthSessionId(request: Request): Promise<string | null> {\n  return await getSessionIdFromRequest(request);\n}\n\nexport async function getAuthSessionById(sessionId: string): Promise<SessionData | null> {\n  const session = await readSessionData(sessionId);\n  return session ? { ...session, sessionId } : null;\n}\n\nexport async function listAuthSessionDataForUser(\n  userId: string\n): Promise<Array<{ sessionId: string; data: SessionData }>> {\n  const sessionIds = await getSessionIdsFromIndex(REDIS_KEYS.sessionByUser(userId));\n  return await listSessionDataByIds(sessionIds);\n}\n\nexport async function listAuthSessionsForUser(\n  userId: string,\n  currentSessionId?: string | null\n): Promise<AuthSessionSummary[]> {\n  const sessions = await listAuthSessionDataForUser(userId);\n\n  return sessions\n    .map(({ sessionId, data }) => toAuthSessionSummary(sessionId, data, currentSessionId))\n    .sort((left, right) => (right.lastActivity ?? right.createdAt ?? 0) - (left.lastActivity ?? left.createdAt ?? 0));\n}\n\nexport async function listCurrentUserAuthSessions(request: Request): Promise<AuthSessionSummary[]> {\n  const currentSession = await getAuthSession(request);\n  if (!currentSession.userId) {\n    return [];\n  }\n\n  return await listAuthSessionsForUser(currentSession.userId, currentSession.sessionId);\n}\n\nexport async function destroyAuthSessionById(sessionId: string): Promise<boolean> {\n  const session = await readSessionData(sessionId);\n  if (!session) {\n    return false;\n  }\n\n  await deleteSessionData(sessionId);\n  return true;\n}\n\nexport async function destroyAuthSessionsForUser(userId: string): Promise<number> {\n  const sessionIds = await getSessionIdsFromIndex(REDIS_KEYS.sessionByUser(userId));\n  let destroyedSessions = 0;\n\n  for (const sessionId of sessionIds) {\n    if (await destroyAuthSessionById(sessionId)) {\n      destroyedSessions += 1;\n    }\n  }\n\n  return destroyedSessions;\n}\n\nexport async function destroyAuthSessionsBySid(sid: string): Promise<number> {\n  const sessionIds = await getSessionIdsFromIndex(REDIS_KEYS.sessionBySid(sid));\n  let destroyedSessions = 0;\n\n  for (const sessionId of sessionIds) {\n    if (await destroyAuthSessionById(sessionId)) {\n      destroyedSessions += 1;\n    }\n  }\n\n  return destroyedSessions;\n}\n\nexport async function destroyAuthSessionsBySessionState(sessionState: string): Promise<number> {\n  const sessionIds = await getSessionIdsFromIndex(REDIS_KEYS.sessionBySessionState(sessionState));\n  let destroyedSessions = 0;\n\n  for (const sessionId of sessionIds) {\n    if (await destroyAuthSessionById(sessionId)) {\n      destroyedSessions += 1;\n    }\n  }\n\n  return destroyedSessions;\n}\n\nexport async function destroyAuthSessionsByIdentitySession(params: {\n  sid?: string;\n  sessionState?: string;\n  userId?: string;\n}): Promise<number> {\n  if (params.sid) {\n    return await destroyAuthSessionsBySid(params.sid);\n  }\n\n  if (params.sessionState) {\n    return await destroyAuthSessionsBySessionState(params.sessionState);\n  }\n\n  if (params.userId) {\n    return await destroyAuthSessionsForUser(params.userId);\n  }\n\n  return 0;\n}\n\nexport async function requireAuthSession(request: Request): Promise<SessionData> {\n  const sessionData = await getAuthSession(request);\n\n  if (!sessionData.userId || !sessionData.user || !sessionData.accessToken || isSessionDataExpired(sessionData)) {\n    throw new Response('Unauthorized', { status: 401 });\n  }\n\n  return sessionData;\n}\n\nfunction getJwtExpiry(accessToken: string | undefined): number | null {\n  if (!accessToken) {\n    return null;\n  }\n\n  try {\n    const [, encodedPayload] = accessToken.split('.');\n    if (!encodedPayload) {\n      return null;\n    }\n\n    const payload = JSON.parse(\n      Buffer.from(encodedPayload, 'base64url').toString('utf8'),\n    ) as { exp?: unknown };\n\n    return typeof payload.exp === 'number' && Number.isFinite(payload.exp)\n      ? payload.exp * 1000\n      : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction isSessionDataExpired(sessionData: SessionData): boolean {\n  const now = Date.now();\n  if (\n    typeof sessionData.expiresAt === 'number' &&\n    (!Number.isFinite(sessionData.expiresAt) || now >= sessionData.expiresAt)\n  ) {\n    return true;\n  }\n\n  const jwtExpiry = getJwtExpiry(sessionData.accessToken);\n  return jwtExpiry !== null && now >= jwtExpiry;\n}\n\nexport async function isSessionValid(request: Request): Promise<boolean> {\n  try {\n    const sessionData = await getAuthSession(request);\n\n    if (!sessionData.user || !sessionData.accessToken || isSessionDataExpired(sessionData)) {\n      return false;\n    }\n\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n// ============================================================================\n// OAuth State Management\n// ============================================================================\n\nexport async function createOAuthState(state: OAuthState): Promise<string> {\n  const stateId = crypto.randomUUID();\n  const key = REDIS_KEYS.oauthState(stateId);\n\n  await getRedis().setex(key, OAUTH_STATE_TTL_SECONDS, JSON.stringify(state));\n\n  logger.debug('OAuth state created', { hasStateId: true, ttl: OAUTH_STATE_TTL_SECONDS });\n\n  return stateId;\n}\n\nexport async function getOAuthState(\n  stateId: string,\n  options?: { readonly throwOnMalformed?: boolean },\n): Promise<OAuthState | null> {\n  const key = REDIS_KEYS.oauthState(stateId);\n  const data = await getRedis().get(key);\n\n  if (!data) {\n    logger.warn('OAuth state not found or expired', { hasStateId: true });\n    return null;\n  }\n\n  try {\n    return JSON.parse(data);\n  } catch (error) {\n    logger.error('Failed to parse OAuth state', undefined, {\n      errorType: error instanceof Error ? error.name : 'UnknownError',\n    });\n    if (options?.throwOnMalformed) {\n      throw new Error('OAuth state storage failure');\n    }\n    return null;\n  }\n}\n\nexport async function deleteOAuthState(stateId: string): Promise<void> {\n  const key = REDIS_KEYS.oauthState(stateId);\n  await getRedis().del(key);\n  logger.debug('OAuth state deleted', { hasStateId: true });\n}\n\nexport interface OAuthRecoveryRecord {\n  state: string;\n  returnUrl: string;\n  createdAt: number;\n}\n\nconst CONSUME_OAUTH_RECOVERY_RECORD_SCRIPT = `\nlocal value = redis.call('GET', KEYS[1])\nif not value then\n  return nil\nend\nlocal ok, record = pcall(cjson.decode, value)\nif not ok or type(record) ~= 'table' or type(record.state) ~= 'string' then\n  redis.call('DEL', KEYS[1])\n  return '__invalid__'\nend\nif record.state ~= ARGV[1] then\n  return '__mismatch__'\nend\nredis.call('DEL', KEYS[1])\nreturn value\n`;\n\n/**\n * Store a short-lived recovery record under a separate opaque ticket.\n * The ticket is returned to the caller and is never logged or embedded with\n * callback state, return URLs, or provider data.\n */\nexport async function createOAuthRecoveryRecord(\n  record: OAuthRecoveryRecord,\n): Promise<string> {\n  const ticket = randomBytes(32).toString('base64url');\n  const key = REDIS_KEYS.oauthRecovery(ticket);\n\n  await getRedis().setex(\n    key,\n    OAUTH_RECOVERY_TTL_SECONDS,\n    JSON.stringify(record),\n  );\n\n  logger.debug('OAuth recovery record created', {\n    hasTicket: true,\n    ttl: OAUTH_RECOVERY_TTL_SECONDS,\n  });\n\n  return ticket;\n}\n\n/**\n * Atomically consume a recovery record.  The Redis script compares the exact\n * expected state before DEL, so mismatched callbacks leave the ticket intact\n * and concurrent exact-state requests can receive a record at most once.\n */\nexport async function consumeOAuthRecoveryRecord(\n  ticket: string,\n  expectedState: string,\n): Promise<OAuthRecoveryRecord | null> {\n  const key = REDIS_KEYS.oauthRecovery(ticket);\n  const value = await getRedis().eval(\n    CONSUME_OAUTH_RECOVERY_RECORD_SCRIPT,\n    1,\n    key,\n    expectedState,\n  );\n\n  if (value === '__mismatch__' || value === null || value === undefined) {\n    return null;\n  }\n\n  if (value === '__invalid__') {\n    logger.error('OAuth recovery record failed atomic validation', undefined, {\n      errorType: 'InvalidRecoveryRecord',\n    });\n    throw new Error('OAuth recovery storage failure');\n  }\n\n  if (typeof value !== 'string') {\n    throw new Error('OAuth recovery storage failure');\n  }\n\n  try {\n    return JSON.parse(value) as OAuthRecoveryRecord;\n  } catch (error) {\n    logger.error('Failed to parse OAuth recovery record', undefined, {\n      errorType: error instanceof Error ? error.name : 'UnknownError',\n    });\n    throw new Error('OAuth recovery storage failure');\n  }\n}\n\nexport async function deleteOAuthRecoveryRecord(ticket: string): Promise<void> {\n  await getRedis().del(REDIS_KEYS.oauthRecovery(ticket));\n  logger.debug('OAuth recovery record deleted', { hasTicket: true });\n}\n\nexport async function cleanupExpiredOAuthStates(): Promise<number> {\n  const pattern = REDIS_KEYS.oauthState('*');\n  const keys = await getRedis().keys(pattern);\n\n  let cleaned = 0;\n  for (const key of keys) {\n    const ttl = await getRedis().ttl(key);\n    if (ttl === -1) {\n      await getRedis().del(key);\n      cleaned++;\n    }\n  }\n\n  logger.info('OAuth state cleanup completed', { cleaned, total: keys.length });\n  return cleaned;\n}\n\n// ============================================================================\n// Cleanup\n// ============================================================================\n\nexport async function closeRedisConnection(): Promise<void> {\n  if (redis) {\n    await redis.quit();\n    redis = null;\n    logger.info('Redis connection closed');\n  }\n}\n"],"mappings":";;;;AAAA,MAAM,kCAAkC;AACxC,MAAM,qCAAqC;AAE3C,SAASA,4BAA0B,MAAc,cAA8B;CAC7E,MAAM,QAAQ,QAAQ,IAAI,KAAK,EAAE,KAAK;CACtC,IAAI,CAAC,OACH,OAAO;CAGT,MAAM,SAAS,OAAO,KAAK;CAC3B,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,UAAU,GAC7C,MAAM,IAAI,MAAM,GAAG,KAAK,6BAA6B;CAGvD,OAAO;AACT;;;;;AAMA,MAAa,0BAA0BA,4BACrC,mBACA,+BACF;AAEA,MAAa,qBAAqB,0BAA0B;;;;;;AAO5D,MAAa,6BAA6B,KAAK,IAC7C,oCACA,0BAA0B,EAC5B;AAEA,MAAa,wBAAwB,6BAA6B;;;;;;;;;;ACjBlE,IAAI,QAAsB;AAE1B,SAAS,WAAkB;CACzB,IAAI,CAAC,OAAO;EACV,QAAQ,IAAI,MAAM,QAAQ,IAAI,aAAa,wBAAwB;EAEnE,MAAM,GAAG,UAAU,QAAQ;GACzB,OAAO,MAAM,sBAAsB,GAAG;EACxC,CAAC;EAED,MAAM,GAAG,iBAAiB;GACxB,OAAO,KAAK,8BAA8B;EAC5C,CAAC;CACH;CACA,OAAO;AACT;AAMA,MAAM,aAAa,QAAQ,IAAI,oBAAoB;AAEnD,MAAM,aAAa;CACjB,aAAa,YAAoB,GAAG,WAAW,cAAc;CAC7D,gBAAgB,WAAmB,GAAG,WAAW,iBAAiB;CAClE,UAAU,cAAsB,GAAG,WAAW,UAAU;CACxD,gBAAgB,WAAmB,GAAG,WAAW,qBAAqB;CACtE,eAAe,QAAgB,GAAG,WAAW,oBAAoB;CACjE,wBAAwB,iBAAyB,GAAG,WAAW,8BAA8B;AAC/F;AAEA,MAAM,yBAAyB;AAG/B,MAAM,cAAc,0BAA0B,uBAAuB,0BAA0B,eAFnE,OAAU,KAAK,CAEsF,CAAC;AAElI,MAAM,sBAAsB,QAAQ,IAAI,uBAAuB;AAC/D,MAAM,iBAAiB,qBAAqB;AAC5C,MAAM,wBAAwB,oBAAoB;AAClD,MAAM,sBAAsB;AAC5B,MAAM,2BAA2B,sBAAsB;AACvD,MAAM,wBAAwB,QAAQ,IAAI,uBAAuB,KAAK;AACtE,MAAM,6BAA6B,gCAAgC;AACnE,MAAM,yBAAyB,4BAA4B,0BAA0B;AAErF,MAAa,2BAA2B,oBAAoB,QAAQ,YAAY,EAAE,CAAC,CAAC,QAAQ,MAAM,EAAE;AAEpG,SAAS,kBAAkB,MAAc,cAAgC;CACvE,MAAM,QAAQ,QAAQ,IAAI,KAAK,EAAE,KAAK,CAAC,CAAC,YAAY;CACpD,IAAI,CAAC,OACH,OAAO;CAGT,IAAI;EAAC;EAAK;EAAQ;EAAO;CAAI,CAAC,CAAC,SAAS,KAAK,GAC3C,OAAO;CAGT,IAAI;EAAC;EAAK;EAAS;EAAM;CAAK,CAAC,CAAC,SAAS,KAAK,GAC5C,OAAO;CAGT,MAAM,IAAI,MAAM,GAAG,KAAK,0BAA0B;AACpD;AAEA,SAAS,0BAA0B,MAAc,cAA8B;CAC7E,MAAM,QAAQ,QAAQ,IAAI,KAAK,EAAE,KAAK;CACtC,IAAI,CAAC,OACH,OAAO;CAGT,MAAM,SAAS,OAAO,KAAK;CAC3B,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,UAAU,GAC7C,MAAM,IAAI,MAAM,GAAG,KAAK,6BAA6B;CAGvD,OAAO;AACT;AAEA,SAAS,uBAA+B;CACtC,MAAM,SAAS,QAAQ,IAAI,gBAAgB,KAAK;CAChD,IAAI,CAAC,UAAU,WAAW,wBAAwB;EAChD,IAAI,QAAQ,IAAI,aAAa,cAC3B,MAAM,IAAI,MAAM,oEAAoE;EAGtF,OAAO;CACT;CAEA,IAAI,OAAO,SAAS,IAClB,MAAM,IAAI,MAAM,qDAAqD;CAGvE,OAAO;AACT;AAEA,SAAS,sBAA+B;CACtC,OAAO,kBAAkB,yBAAyB,QAAQ,IAAI,aAAa,YAAY;AACzF;AAEA,SAAS,wBAAmD;CAC1D,MAAM,QAAQ,QAAQ,IAAI,0BAA0B,KAAK,CAAC,CAAC,YAAY;CACvE,MAAM,WAAW,UAAU,WAAW,WAAW,UAAU,SAAS,SAAS;CAE7E,IAAI,aAAa,UAAU,CAAC,uBAC1B,MAAM,IAAI,MAAM,oEAAoE;CAGtF,OAAO;AACT;AAEA,SAAS,kCAA2C;CAClD,MAAM,UAAU,kBAAkB,sBAAsB,QAAQ,IAAI,aAAa,YAAY;CAC7F,IAAI,QAAQ,IAAI,aAAa,gBAAgB,CAAC,SAC5C,MAAM,IAAI,MAAM,sDAAsD;CAGxE,OAAO;AACT;AAEA,SAAS,gBAAgB,OAAuB;CAC9C,MAAM,aAAa,MAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;CAC7D,MAAM,SAAS,WAAW,OAAO,WAAW,UAAW,IAAK,WAAW,SAAS,KAAM,GAAI,GAAG;CAC7F,OAAO,OAAO,KAAK,QAAQ,QAAQ;AACrC;AAEA,SAAS,4BAA4B,SAAiC;CACpE,IAAI,CAAC,SACH,OAAO;CAGT,MAAM,QAAQ,QAAQ,IAAI,wBAAwB,KAAK;CACvD,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,wEAAwE;CAG1F,MAAM,MAAM,kBAAkB,KAAK,KAAK,IACpC,OAAO,KAAK,OAAO,KAAK,IACxB,gBAAgB,KAAK;CAEzB,IAAI,IAAI,WAAW,IACjB,MAAM,IAAI,MAAM,oGAAoG;CAGtH,OAAO;AACT;AAMA,SAAS,kBAAkB,cAAqD;CAC9E,IAAI,CAAC,cACH,OAAO,CAAC;CAGV,OAAO,aACJ,MAAM,GAAG,CAAC,CACV,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,CAC1B,OAAO,OAAO,CAAC,CACf,QAAgC,SAAS,SAAS;EACjD,MAAM,iBAAiB,KAAK,QAAQ,GAAG;EACvC,IAAI,kBAAkB,GACpB,OAAO;EAGT,MAAM,OAAO,KAAK,MAAM,GAAG,cAAc,CAAC,CAAC,KAAK;EAChD,MAAM,QAAQ,KAAK,MAAM,iBAAiB,CAAC,CAAC,CAAC,KAAK;EAClD,IAAI,CAAC,MACH,OAAO;EAGT,QAAQ,QAAQ;EAChB,OAAO;CACT,GAAG,CAAC,CAAC;AACT;AAEA,SAAS,sBAAsB,OAAe,QAAwB;CACpE,OAAO,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,WAAW;AACtE;AAEA,SAAS,oBAAoB,MAAc,OAAwB;CACjE,MAAM,aAAa,OAAO,KAAK,IAAI;CACnC,MAAM,cAAc,OAAO,KAAK,KAAK;CAErC,IAAI,WAAW,WAAW,YAAY,QACpC,OAAO;CAGT,OAAO,gBAAgB,YAAY,WAAW;AAChD;AAEA,SAAS,cAAc,WAA2B;CAEhD,OAAO,GAAG,UAAU,GADF,sBAAsB,WAAW,cACpB;AACjC;AAEA,SAAS,gBAAgB,aAAgD;CACvE,IAAI,CAAC,aACH,OAAO;CAGT,IAAI;CACJ,IAAI;EACF,eAAe,mBAAmB,WAAW;CAC/C,QAAQ;EACN,OAAO;CACT;CAEA,MAAM,iBAAiB,aAAa,YAAY,GAAG;CACnD,IAAI,kBAAkB,KAAK,mBAAmB,aAAa,SAAS,GAClE,OAAO;CAGT,MAAM,YAAY,aAAa,MAAM,GAAG,cAAc;CAItD,OAAO,oBAHW,aAAa,MAAM,iBAAiB,CAGnB,GAFT,sBAAsB,WAAW,cAEL,CAAC,IAAI,YAAY;AACzE;AAEA,SAAS,4BAA4B,WAAmB,SAAuC;CAC7F,MAAM,cAAc,mBAAmB,cAAc,SAAS,CAAC;CAC/D,MAAM,WAAW;EACf,GAAG,oBAAoB,GAAG;EAC1B,WAAW,QAAQ;EACnB,QAAQ;EACR,YAAY;EACZ;CACF;CAEA,IAAI,uBACF,SAAS,KAAK,UAAU,uBAAuB;CAGjD,IAAI,uBACF,SAAS,KAAK,QAAQ;CAGxB,OAAO,SAAS,KAAK,IAAI;AAC3B;AAEA,SAAS,gCAAwC;CAC/C,MAAM,WAAW;EACf,GAAG,oBAAoB;EACvB;EACA,QAAQ;EACR,YAAY;EACZ;CACF;CAEA,IAAI,uBACF,SAAS,KAAK,UAAU,uBAAuB;CAGjD,IAAI,uBACF,SAAS,KAAK,QAAQ;CAGxB,OAAO,SAAS,KAAK,IAAI;AAC3B;AAEA,eAAe,wBAAwB,SAA0C;CAE/E,OAAO,gBADS,kBAAkB,QAAQ,QAAQ,IAAI,QAAQ,CACjC,CAAC,CAAC,oBAAoB;AACrD;AAEA,SAAS,oBAAoB,MAA6B;CACxD,MAAM,uBAAO,IAAI,IAAY;CAE7B,IAAI,KAAK,QACP,KAAK,IAAI,WAAW,cAAc,KAAK,MAAM,CAAC;CAGhD,IAAI,KAAK,KACP,KAAK,IAAI,WAAW,aAAa,KAAK,GAAG,CAAC;CAG5C,IAAI,KAAK,cACP,KAAK,IAAI,WAAW,sBAAsB,KAAK,YAAY,CAAC;CAG9D,OAAO,MAAM,KAAK,IAAI;AACxB;AAEA,eAAe,uBAAuB,WAAmB,MAAkC;CACzF,MAAM,YAAY,oBAAoB,IAAI;CAC1C,IAAI,UAAU,WAAW,GACvB;CAIF,MAAM,WADc,SACO,CAAC,CAAC,SAAS;CAEtC,KAAK,MAAM,YAAY,WAAW;EAChC,SAAS,KAAK,UAAU,SAAS;EACjC,SAAS,OAAO,UAAU,WAAW;CACvC;CAEA,MAAM,SAAS,KAAK;AACtB;AAEA,eAAe,yBAAyB,WAAmB,MAAkC;CAC3F,MAAM,YAAY,oBAAoB,IAAI;CAC1C,IAAI,UAAU,WAAW,GACvB;CAIF,MAAM,WADc,SACO,CAAC,CAAC,SAAS;CAEtC,KAAK,MAAM,YAAY,WACrB,SAAS,KAAK,UAAU,SAAS;CAGnC,MAAM,SAAS,KAAK;AACtB;AAEA,SAAS,iBAAiB,aAAgD;CACxE,IAAI,CAAC,aACH,OAAO;CAGT,IAAI;EACF,OAAO,KAAK,MAAM,kBAAkB,WAAW,CAAC;CAClD,SAAS,OAAO;EACd,OAAO,MAAM,gCAAgC,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EACvF,OAAO;CACT;AACF;AAEA,SAAS,kBAAkB,MAA2B;CACpD,MAAM,YAAY,KAAK,UAAU,IAAI;CACrC,IAAI,CAAC,wBACH,OAAO;CAGT,MAAM,KAAK,YAAY,EAAE;CACzB,MAAM,SAAS,eAAe,eAAe,wBAAwB,EAAE;CACvE,MAAM,aAAa,OAAO,OAAO,CAAC,OAAO,OAAO,WAAW,MAAM,GAAG,OAAO,MAAM,CAAC,CAAC;CACnF,MAAM,MAAM,OAAO,WAAW;CAE9B,OAAO;EACL;EACA,GAAG,SAAS,WAAW;EACvB,IAAI,SAAS,WAAW;EACxB,WAAW,SAAS,WAAW;CACjC,CAAC,CAAC,KAAK,GAAG;AACZ;AAEA,SAAS,kBAAkB,OAAuB;CAChD,IAAI,CAAC,MAAM,WAAW,SAAS,GAAG;EAChC,IAAI,4BACF,OAAO,KAAK,oFAAoF;EAGlG,OAAO;CACT;CAEA,IAAI,CAAC,wBACH,MAAM,IAAI,MAAM,uFAAuF;CAGzG,MAAM,GAAG,SAAS,SAAS,UAAU,mBAAmB,MAAM,MAAM,GAAG;CACvE,IAAI,YAAY,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,iBAChD,MAAM,IAAI,MAAM,gDAAgD;CAGlE,MAAM,WAAW,iBAAiB,eAAe,wBAAwB,OAAO,KAAK,SAAS,WAAW,CAAC;CAC1G,SAAS,WAAW,OAAO,KAAK,UAAU,WAAW,CAAC;CAEtD,OAAO,OAAO,OAAO,CACnB,SAAS,OAAO,OAAO,KAAK,iBAAiB,WAAW,CAAC,GACzD,SAAS,MAAM,CACjB,CAAC,CAAC,CAAC,SAAS,MAAM;AACpB;AAEA,eAAe,gBAAgB,WAAgD;CAC7E,IAAI;EACF,MAAM,cAAc,MAAM,SAAS,CAAC,CAAC,IAAI,WAAW,QAAQ,SAAS,CAAC;EACtE,IAAI,CAAC,aAAa;GAChB,OAAO,MAAM,8BAA8B,EAAE,UAAU,CAAC;GACxD,OAAO;EACT;EAEA,MAAM,SAAS,CAAC,CAAC,OAAO,WAAW,QAAQ,SAAS,GAAG,WAAW;EAClE,OAAO,iBAAiB,WAAW;CACrC,SAAS,OAAO;EACd,OAAO,MAAM,qCAAqC,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EAC5F,OAAO;CACT;AACF;AAEA,eAAe,iBAAiB,WAAmB,MAAkC;CACnF,IAAI;EACF,MAAM,sBAAsB,iBAAiB,MAAM,SAAS,CAAC,CAAC,IAAI,WAAW,QAAQ,SAAS,CAAC,CAAC;EAChG,IAAI,qBACF,MAAM,yBAAyB,WAAW,mBAAmB;EAG/D,MAAM,SAAS,CAAC,CAAC,MAAM,WAAW,QAAQ,SAAS,GAAG,aAAa,kBAAkB,IAAI,CAAC;EAC1F,MAAM,uBAAuB,WAAW,IAAI;EAC5C,OAAO,MAAM,yBAAyB,EAAE,UAAU,CAAC;CACrD,SAAS,OAAO;EACd,OAAO,MAAM,qCAAqC,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EAC5F,MAAM;CACR;AACF;AAEA,eAAe,kBAAkB,WAAkC;CACjE,IAAI;EACF,MAAM,sBAAsB,iBAAiB,MAAM,SAAS,CAAC,CAAC,IAAI,WAAW,QAAQ,SAAS,CAAC,CAAC;EAChG,IAAI,qBACF,MAAM,yBAAyB,WAAW,mBAAmB;EAG/D,MAAM,SAAS,CAAC,CAAC,IAAI,WAAW,QAAQ,SAAS,CAAC;EAClD,OAAO,MAAM,yBAAyB,EAAE,UAAU,CAAC;CACrD,SAAS,OAAO;EACd,OAAO,MAAM,uCAAuC,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;CAChG;AACF;AAEA,SAAS,iBAAiB,cAA2B,SAA4C;CAC/F,MAAM,WAAW,EAAE,GAAG,aAAa;CAEnC,OAAO,QAAQ,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;EAChD,IAAI,UAAU,KAAA,GAAW;GACvB,OAAO,SAAS;GAChB;EACF;EAEA,SAAS,OAAO;CAClB,CAAC;CAED,OAAO;AACT;AAEA,eAAe,uBAAuB,UAAqC;CACzE,MAAM,aAAa,MAAM,SAAS,CAAC,CAAC,SAAS,QAAQ;CACrD,MAAM,mBAA6B,CAAC;CACpC,MAAM,kBAA4B,CAAC;CAEnC,KAAK,MAAM,aAAa,YAEtB,IAAI,MADiB,SAAS,CAAC,CAAC,OAAO,WAAW,QAAQ,SAAS,CAAC,GAElE,iBAAiB,KAAK,SAAS;MAE/B,gBAAgB,KAAK,SAAS;CAIlC,IAAI,gBAAgB,SAAS,GAC3B,MAAM,SAAS,CAAC,CAAC,KAAK,UAAU,GAAG,eAAe;CAGpD,OAAO;AACT;AAEA,SAAS,qBACP,WACA,SACA,kBACoB;CACpB,OAAO;EACL;EACA,QAAQ,QAAQ;EAChB,OAAO,QAAQ,MAAM;EACrB,MAAM,QAAQ,MAAM;EACpB,QAAQ,QAAQ;EAChB,KAAK,QAAQ;EACb,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,cAAc,QAAQ;EACtB,WAAW,QAAQ;EACnB,WAAW,mBAAmB,cAAc,mBAAmB,KAAA;CACjE;AACF;AAEA,eAAe,qBAAqB,YAAgF;CAClH,MAAM,WAA4D,CAAC;CAEnE,KAAK,MAAM,aAAa,YAAY;EAClC,MAAM,OAAO,MAAM,gBAAgB,SAAS;EAC5C,IAAI,MACF,SAAS,KAAK;GAAE;GAAW;EAAK,CAAC;CAErC;CAEA,OAAO;AACT;AAEA,SAAS,oBAAoB,SAAsC;CAEjE,OADqB,QAAQ,QAAQ,IAAI,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,KAG/E,QAAQ,QAAQ,IAAI,kBAAkB,CAAC,EAAE,KAAK,KAC9C,QAAQ,QAAQ,IAAI,WAAW,CAAC,EAAE,KAAK,KACvC,KAAA;AAEJ;AAMA,eAAsB,kBACpB,SACA,aACkB;CAClB,MAAM,mBAAmB,MAAM,wBAAwB,OAAO;CAC9D,MAAM,gBAAgB,OAAO,WAAW;CACxC,MAAM,kBAAkB,iBAAiB,CAAC,GAAG;EAC3C,GAAG;EACH,WAAW;EACX,WAAW,YAAY,aAAa,oBAAoB,OAAO;EAC/D,WAAW,YAAY,aAAa,QAAQ,QAAQ,IAAI,YAAY,KAAK,KAAA;CAC3E,CAAC;CAED,OAAO,MAAM,yBAAyB,EAAE,UAAU,OAAO,KAAK,WAAW,EAAE,CAAC;CAE5E,IAAI,kBACF,MAAM,kBAAkB,gBAAgB;CAG1C,MAAM,iBAAiB,eAAe,eAAe;CAErD,OAAO,IAAI,QAAQ,EACjB,cAAc,4BAA4B,eAAe,EAAE,QAAQ,YAAY,CAAC,EAClF,CAAC;AACH;AAEA,eAAsB,eAAe,SAAwC;CAC3E,MAAM,YAAY,MAAM,wBAAwB,OAAO;CACvD,IAAI,CAAC,WACH,OAAO,CAAC;CAGV,MAAM,UAAU,MAAM,gBAAgB,SAAS;CAC/C,IAAI,CAAC,SACH,OAAO,CAAC;CAGV,OAAO;EACL;EACA,QAAQ,QAAQ;EAChB,aAAa,QAAQ;EACrB,cAAc,QAAQ;EACtB,SAAS,QAAQ;EACjB,WAAW,QAAQ;EACnB,QAAQ,QAAQ;EAChB,KAAK,QAAQ;EACb,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,MAAM,QAAQ;EACd,WAAW,QAAQ;EACnB,cAAc,QAAQ;CACxB;AACF;AAEA,eAAsB,kBACpB,SACA,SACkB;CAClB,MAAM,mBAAmB,MAAM,wBAAwB,OAAO;CAC9D,MAAM,qBAAqB,mBACtB,MAAM,gBAAgB,gBAAgB,KAAM,CAAC,IAC9C,CAAC;CACL,MAAM,gBAAgB,oBAAoB,OAAO,WAAW;CAM5D,MAAM,iBAAiB,eALC,iBAAiB,oBAAoB;EAC3D,GAAG;EACH,WAAW;CACb,CAEoD,CAAC;CAErD,OAAO,IAAI,QAAQ,EACjB,cAAc,4BAA4B,eAAe,EAAE,QAAQ,YAAY,CAAC,EAClF,CAAC;AACH;AAEA,eAAsB,mBAAmB,SAAoC;CAC3E,MAAM,YAAY,MAAM,wBAAwB,OAAO;CACvD,IAAI,WACF,MAAM,kBAAkB,SAAS;CAGnC,OAAO,IAAI,QAAQ,EACjB,cAAc,8BAA8B,EAC9C,CAAC;AACH;AAEA,eAAsB,wBAAwB,SAA0C;CACtF,OAAO,MAAM,wBAAwB,OAAO;AAC9C;AAEA,eAAsB,mBAAmB,WAAgD;CACvF,MAAM,UAAU,MAAM,gBAAgB,SAAS;CAC/C,OAAO,UAAU;EAAE,GAAG;EAAS;CAAU,IAAI;AAC/C;AAEA,eAAsB,2BACpB,QAC0D;CAE1D,OAAO,MAAM,qBAAqB,MADT,uBAAuB,WAAW,cAAc,MAAM,CAAC,CACpC;AAC9C;AAEA,eAAsB,wBACpB,QACA,kBAC+B;CAG/B,QAAO,MAFgB,2BAA2B,MAAM,EAAA,CAGrD,KAAK,EAAE,WAAW,WAAW,qBAAqB,WAAW,MAAM,gBAAgB,CAAC,CAAC,CACrF,MAAM,MAAM,WAAW,MAAM,gBAAgB,MAAM,aAAa,MAAM,KAAK,gBAAgB,KAAK,aAAa,EAAE;AACpH;AAEA,eAAsB,4BAA4B,SAAiD;CACjG,MAAM,iBAAiB,MAAM,eAAe,OAAO;CACnD,IAAI,CAAC,eAAe,QAClB,OAAO,CAAC;CAGV,OAAO,MAAM,wBAAwB,eAAe,QAAQ,eAAe,SAAS;AACtF;AAEA,eAAsB,uBAAuB,WAAqC;CAEhF,IAAI,CAAC,MADiB,gBAAgB,SAAS,GAE7C,OAAO;CAGT,MAAM,kBAAkB,SAAS;CACjC,OAAO;AACT;AAEA,eAAsB,2BAA2B,QAAiC;CAChF,MAAM,aAAa,MAAM,uBAAuB,WAAW,cAAc,MAAM,CAAC;CAChF,IAAI,oBAAoB;CAExB,KAAK,MAAM,aAAa,YACtB,IAAI,MAAM,uBAAuB,SAAS,GACxC,qBAAqB;CAIzB,OAAO;AACT;AAEA,eAAsB,yBAAyB,KAA8B;CAC3E,MAAM,aAAa,MAAM,uBAAuB,WAAW,aAAa,GAAG,CAAC;CAC5E,IAAI,oBAAoB;CAExB,KAAK,MAAM,aAAa,YACtB,IAAI,MAAM,uBAAuB,SAAS,GACxC,qBAAqB;CAIzB,OAAO;AACT;AAEA,eAAsB,kCAAkC,cAAuC;CAC7F,MAAM,aAAa,MAAM,uBAAuB,WAAW,sBAAsB,YAAY,CAAC;CAC9F,IAAI,oBAAoB;CAExB,KAAK,MAAM,aAAa,YACtB,IAAI,MAAM,uBAAuB,SAAS,GACxC,qBAAqB;CAIzB,OAAO;AACT;AAEA,eAAsB,qCAAqC,QAIvC;CAClB,IAAI,OAAO,KACT,OAAO,MAAM,yBAAyB,OAAO,GAAG;CAGlD,IAAI,OAAO,cACT,OAAO,MAAM,kCAAkC,OAAO,YAAY;CAGpE,IAAI,OAAO,QACT,OAAO,MAAM,2BAA2B,OAAO,MAAM;CAGvD,OAAO;AACT;AAEA,eAAsB,mBAAmB,SAAwC;CAC/E,MAAM,cAAc,MAAM,eAAe,OAAO;CAEhD,IAAI,CAAC,YAAY,UAAU,CAAC,YAAY,QAAQ,CAAC,YAAY,eAAe,qBAAqB,WAAW,GAC1G,MAAM,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;CAGpD,OAAO;AACT;AAEA,SAAS,aAAa,aAAgD;CACpE,IAAI,CAAC,aACH,OAAO;CAGT,IAAI;EACF,MAAM,GAAG,kBAAkB,YAAY,MAAM,GAAG;EAChD,IAAI,CAAC,gBACH,OAAO;EAGT,MAAM,UAAU,KAAK,MACnB,OAAO,KAAK,gBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,CAC1D;EAEA,OAAO,OAAO,QAAQ,QAAQ,YAAY,OAAO,SAAS,QAAQ,GAAG,IACjE,QAAQ,MAAM,MACd;CACN,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,qBAAqB,aAAmC;CAC/D,MAAM,MAAM,KAAK,IAAI;CACrB,IACE,OAAO,YAAY,cAAc,aAChC,CAAC,OAAO,SAAS,YAAY,SAAS,KAAK,OAAO,YAAY,YAE/D,OAAO;CAGT,MAAM,YAAY,aAAa,YAAY,WAAW;CACtD,OAAO,cAAc,QAAQ,OAAO;AACtC;AAEA,eAAsB,eAAe,SAAoC;CACvE,IAAI;EACF,MAAM,cAAc,MAAM,eAAe,OAAO;EAEhD,IAAI,CAAC,YAAY,QAAQ,CAAC,YAAY,eAAe,qBAAqB,WAAW,GACnF,OAAO;EAGT,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;AAMA,eAAsB,iBAAiB,OAAoC;CACzE,MAAM,UAAU,OAAO,WAAW;CAClC,MAAM,MAAM,WAAW,WAAW,OAAO;CAEzC,MAAM,SAAS,CAAC,CAAC,MAAM,KAAK,yBAAyB,KAAK,UAAU,KAAK,CAAC;CAE1E,OAAO,MAAM,uBAAuB;EAAE,YAAY;EAAM,KAAK;CAAwB,CAAC;CAEtF,OAAO;AACT;AAEA,eAAsB,cACpB,SACA,SAC4B;CAC5B,MAAM,MAAM,WAAW,WAAW,OAAO;CACzC,MAAM,OAAO,MAAM,SAAS,CAAC,CAAC,IAAI,GAAG;CAErC,IAAI,CAAC,MAAM;EACT,OAAO,KAAK,oCAAoC,EAAE,YAAY,KAAK,CAAC;EACpE,OAAO;CACT;CAEA,IAAI;EACF,OAAO,KAAK,MAAM,IAAI;CACxB,SAAS,OAAO;EACd,OAAO,MAAM,+BAA+B,KAAA,GAAW,EACrD,WAAW,iBAAiB,QAAQ,MAAM,OAAO,eACnD,CAAC;EACD,IAAI,SAAS,kBACX,MAAM,IAAI,MAAM,6BAA6B;EAE/C,OAAO;CACT;AACF;AAEA,eAAsB,iBAAiB,SAAgC;CACrE,MAAM,MAAM,WAAW,WAAW,OAAO;CACzC,MAAM,SAAS,CAAC,CAAC,IAAI,GAAG;CACxB,OAAO,MAAM,uBAAuB,EAAE,YAAY,KAAK,CAAC;AAC1D;AAQA,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;AAsB7C,eAAsB,0BACpB,QACiB;CACjB,MAAM,SAAS,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CACnD,MAAM,MAAM,WAAW,cAAc,MAAM;CAE3C,MAAM,SAAS,CAAC,CAAC,MACf,KACA,4BACA,KAAK,UAAU,MAAM,CACvB;CAEA,OAAO,MAAM,iCAAiC;EAC5C,WAAW;EACX,KAAK;CACP,CAAC;CAED,OAAO;AACT;;;;;;AAOA,eAAsB,2BACpB,QACA,eACqC;CACrC,MAAM,MAAM,WAAW,cAAc,MAAM;CAC3C,MAAM,QAAQ,MAAM,SAAS,CAAC,CAAC,KAC7B,sCACA,GACA,KACA,aACF;CAEA,IAAI,UAAU,kBAAkB,UAAU,QAAQ,UAAU,KAAA,GAC1D,OAAO;CAGT,IAAI,UAAU,eAAe;EAC3B,OAAO,MAAM,kDAAkD,KAAA,GAAW,EACxE,WAAW,wBACb,CAAC;EACD,MAAM,IAAI,MAAM,gCAAgC;CAClD;CAEA,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,gCAAgC;CAGlD,IAAI;EACF,OAAO,KAAK,MAAM,KAAK;CACzB,SAAS,OAAO;EACd,OAAO,MAAM,yCAAyC,KAAA,GAAW,EAC/D,WAAW,iBAAiB,QAAQ,MAAM,OAAO,eACnD,CAAC;EACD,MAAM,IAAI,MAAM,gCAAgC;CAClD;AACF;AAEA,eAAsB,0BAA0B,QAA+B;CAC7E,MAAM,SAAS,CAAC,CAAC,IAAI,WAAW,cAAc,MAAM,CAAC;CACrD,OAAO,MAAM,iCAAiC,EAAE,WAAW,KAAK,CAAC;AACnE;AAEA,eAAsB,4BAA6C;CACjE,MAAM,UAAU,WAAW,WAAW,GAAG;CACzC,MAAM,OAAO,MAAM,SAAS,CAAC,CAAC,KAAK,OAAO;CAE1C,IAAI,UAAU;CACd,KAAK,MAAM,OAAO,MAEhB,IAAI,MADc,SAAS,CAAC,CAAC,IAAI,GAAG,MACxB,IAAI;EACd,MAAM,SAAS,CAAC,CAAC,IAAI,GAAG;EACxB;CACF;CAGF,OAAO,KAAK,iCAAiC;EAAE;EAAS,OAAO,KAAK;CAAO,CAAC;CAC5E,OAAO;AACT;AAMA,eAAsB,uBAAsC;CAC1D,IAAI,OAAO;EACT,MAAM,MAAM,KAAK;EACjB,QAAQ;EACR,OAAO,KAAK,yBAAyB;CACvC;AACF"}