@eminuckan/spine 0.3.9 → 0.3.10

package/dist/server-BJTz5-BE.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-BJTz5-BE.mjs","names":["getSetCookieValues","escapeRegExp","joseErrors"],"sources":["../src/http/response.ts","../src/auth/authorization-parameters.ts","../src/auth/oauth-security.ts","../src/auth/callback-errors.ts","../src/auth/oauth-recovery.server.ts","../src/auth/auth.server.ts","../src/auth/route-protection.server.ts","../src/auth/token-refresh.server.ts"],"sourcesContent":["/**\n * HTTP response helpers that stay framework-agnostic.\n */\n\nexport interface RedirectResponseInit {\n  headers?: HeadersInit;\n  status?: number;\n}\n\n/**\n * Create a redirect response without relying on a router/framework helper.\n */\nexport function createRedirectResponse(\n  location: string,\n  init: RedirectResponseInit = {}\n): Response {\n  const headers = new Headers(init.headers);\n  headers.set('Location', location);\n\n  return new Response(null, {\n    status: init.status ?? 302,\n    headers,\n  });\n}\n","import type { LoginOptions } from './types';\n\nconst RESERVED_AUTHORIZATION_PARAMETER_NAMES = new Set([\n  'client_id',\n  'code_challenge',\n  'code_challenge_method',\n  'kc_action',\n  'nonce',\n  'prompt',\n  'redirect_uri',\n  'response_mode',\n  'response_type',\n  'scope',\n  'state',\n]);\n\nconst DEFAULT_EXTRA_AUTHORIZATION_PARAMETER_NAMES = new Set([\n  'acr_values',\n  'kc_idp_hint',\n  'login_hint',\n  'ui_locales',\n]);\n\nfunction isAllowedExtraAuthorizationParameter(\n  key: string,\n  allowedNames: Set<string>,\n  allowedPrefixes: string[]\n): boolean {\n  const normalized = key.toLowerCase();\n  return allowedNames.has(normalized) || allowedPrefixes.some((prefix) => normalized.startsWith(prefix));\n}\n\nexport function sanitizeExtraAuthorizationParameters(\n  params: LoginOptions['extraAuthParams'] | undefined,\n  options: Pick<LoginOptions, 'extraAuthParamNames' | 'extraAuthParamPrefixes'> = {}\n): Record<string, string> {\n  if (!params) {\n    return {};\n  }\n\n  const allowedNames = new Set([\n    ...DEFAULT_EXTRA_AUTHORIZATION_PARAMETER_NAMES,\n    ...(options.extraAuthParamNames ?? []).map((name) => name.trim().toLowerCase()).filter(Boolean),\n  ]);\n  const allowedPrefixes = (options.extraAuthParamPrefixes ?? [])\n    .map((prefix) => prefix.trim().toLowerCase())\n    .filter(Boolean);\n  const sanitized: Record<string, string> = {};\n\n  for (const [key, value] of Object.entries(params)) {\n    const normalizedKey = key.trim();\n    if (\n      normalizedKey.length === 0 ||\n      RESERVED_AUTHORIZATION_PARAMETER_NAMES.has(normalizedKey.toLowerCase()) ||\n      !isAllowedExtraAuthorizationParameter(normalizedKey, allowedNames, allowedPrefixes) ||\n      value === null ||\n      value === undefined\n    ) {\n      continue;\n    }\n\n    const normalizedValue = String(value).trim();\n    if (normalizedValue.length === 0) {\n      continue;\n    }\n\n    sanitized[normalizedKey] = normalizedValue;\n  }\n\n  return sanitized;\n}\n\nexport function normalizePublicAuthorizationStateContext(\n  context: LoginOptions['publicStateContext']\n): Record<string, string> | null {\n  if (!context) {\n    return null;\n  }\n\n  const normalized: Record<string, string> = {};\n\n  for (const [key, value] of Object.entries(context)) {\n    const normalizedKey = key.trim();\n    if (\n      normalizedKey.length === 0 ||\n      RESERVED_AUTHORIZATION_PARAMETER_NAMES.has(normalizedKey.toLowerCase()) ||\n      value === null ||\n      value === undefined\n    ) {\n      continue;\n    }\n\n    const normalizedValue = String(value).trim();\n    if (normalizedValue.length === 0) {\n      continue;\n    }\n\n    normalized[normalizedKey] = normalizedValue;\n  }\n\n  return Object.keys(normalized).length > 0 ? normalized : null;\n}\n\nexport function buildAuthorizationState(\n  baseState: string,\n  publicStateContext: LoginOptions['publicStateContext']\n): string {\n  const normalizedContext = normalizePublicAuthorizationStateContext(publicStateContext);\n  if (!normalizedContext) {\n    return baseState;\n  }\n\n  return `${baseState}.${Buffer.from(JSON.stringify(normalizedContext), 'utf8').toString('base64url')}`;\n}\n","const AUTH_FLOW_PATHS = new Set(['/auth/login', '/auth/callback', '/auth/logout']);\n\nfunction isAuthFlowPath(path: string): boolean {\n  const normalized = path.split('#')[0].split('?')[0].replace(/\\/+$/, '') || '/';\n  return AUTH_FLOW_PATHS.has(normalized);\n}\n\nfunction hasUnsafeAuthorityPrefix(value: string): boolean {\n  const normalized = value.trimStart();\n  return (\n    normalized.startsWith('//') ||\n    normalized.startsWith('/\\\\') ||\n    normalized.startsWith('\\\\')\n  );\n}\n\nfunction hasUnsafeEncodedAuthorityPrefix(value: string): boolean {\n  const queryOrFragmentIndex = value.search(/[?#]/);\n  let decoded = queryOrFragmentIndex === -1\n    ? value\n    : value.slice(0, queryOrFragmentIndex);\n\n  for (let attempt = 0; attempt < 3; attempt += 1) {\n    if (hasUnsafeAuthorityPrefix(decoded)) {\n      return true;\n    }\n\n    try {\n      const next = decodeURIComponent(decoded);\n      if (next === decoded) {\n        return false;\n      }\n      decoded = next;\n    } catch {\n      return true;\n    }\n  }\n\n  return hasUnsafeAuthorityPrefix(decoded);\n}\n\n/**\n * Normalize a post-authentication destination to a path on the current origin.\n *\n * Local paths and same-origin absolute URLs are supported for compatibility.\n * Network-path references, backslash authority variants, encoded authority\n * variants, non-HTTP schemes, and authentication loop targets are rejected.\n */\nexport function sanitizeOAuthReturnUrl(\n  returnUrl: string | null | undefined,\n  request: Request,\n): string | null {\n  if (!returnUrl || hasUnsafeEncodedAuthorityPrefix(returnUrl)) {\n    return null;\n  }\n\n  try {\n    const requestOrigin = new URL(request.url).origin;\n    const isLocalPath = returnUrl.startsWith('/') && !returnUrl.startsWith('//');\n    const candidateUrl = isLocalPath\n      ? new URL(returnUrl, requestOrigin)\n      : new URL(returnUrl);\n\n    if (candidateUrl.origin !== requestOrigin) {\n      return null;\n    }\n\n    const safePath = `${candidateUrl.pathname}${candidateUrl.search}${candidateUrl.hash}`;\n    return isAuthFlowPath(safePath) ? null : safePath;\n  } catch {\n    return null;\n  }\n}\n\ntype TemporaryAuthCookieOptions = {\n  maxAge: number;\n};\n\n/** Serialize a short-lived, server-only authentication cookie. */\nexport function serializeTemporaryAuthCookie(\n  name: string,\n  value: string,\n  options: TemporaryAuthCookieOptions,\n): string {\n  const segments = [\n    `${name}=${encodeURIComponent(value)}`,\n    'Path=/',\n    'HttpOnly',\n    'SameSite=Lax',\n    `Max-Age=${options.maxAge}`,\n  ];\n\n  if (process.env.NODE_ENV === 'production') {\n    segments.push('Secure');\n  }\n\n  return segments.join('; ');\n}\n","/**\n * Public, framework-neutral OAuth callback failure contract.\n *\n * This module is server-only.  The callback error deliberately exposes a\n * stable code and cleanup headers, but never exposes callback parameters,\n * provider descriptions, or an underlying error message.\n */\n\nexport type OAuthCallbackFailureCode =\n  | 'stale_transaction'\n  | 'state_mismatch'\n  | 'malformed_callback'\n  | 'application_action_failed'\n  | 'token_exchange_failed'\n  | 'session_creation_failed'\n  | 'storage_error'\n  | 'configuration_error';\n\nexport const OAuthCallbackFailureCodes = {\n  StaleTransaction: 'stale_transaction',\n  StateMismatch: 'state_mismatch',\n  MalformedCallback: 'malformed_callback',\n  ApplicationActionFailed: 'application_action_failed',\n  TokenExchangeFailed: 'token_exchange_failed',\n  SessionCreationFailed: 'session_creation_failed',\n  StorageError: 'storage_error',\n  ConfigurationError: 'configuration_error',\n} as const satisfies Record<\n  string,\n  OAuthCallbackFailureCode\n>;\n\nconst OAUTH_CALLBACK_ERROR_BRAND = Symbol.for(\n  '@eminuckan/spine/OAuthCallbackError',\n);\n\nfunction isOAuthCallbackFailureCode(value: unknown): value is OAuthCallbackFailureCode {\n  return typeof value === 'string' && Object.values(OAuthCallbackFailureCodes).includes(\n    value as OAuthCallbackFailureCode,\n  );\n}\n\nfunction isHeadersLike(value: unknown): value is Headers {\n  return value !== null && typeof value === 'object' &&\n    typeof (value as Headers).get === 'function' &&\n    typeof (value as Headers).append === 'function';\n}\n\nfunction getSetCookieValues(headers: Headers): string[] {\n  const getSetCookie = (headers as Headers & {\n    getSetCookie?: () => string[];\n  }).getSetCookie;\n  if (getSetCookie) {\n    return getSetCookie.call(headers);\n  }\n\n  return Array.from(headers).reduce<string[]>((cookies, [name, value]) => {\n    if (name.toLowerCase() === 'set-cookie') {\n      cookies.push(value);\n    }\n    return cookies;\n  }, []);\n}\n\n/**\n * A callback failure that consumers can classify without parsing messages.\n *\n * The message is intentionally constant.  Consumers should branch on\n * `code`, not on `message`, and should merge `cleanupHeaders` (or the\n * lossless `cleanupSetCookies` values) with any response they create using\n * repeated `Set-Cookie` appends.\n */\nexport class OAuthCallbackError extends Error {\n  readonly code: OAuthCallbackFailureCode;\n  readonly cleanupHeaders: Headers;\n  readonly cleanupSetCookies: readonly string[];\n\n  constructor(\n    code: OAuthCallbackFailureCode,\n    cleanupHeaders: HeadersInit = {},\n  ) {\n    super('Authentication failed');\n    this.name = 'OAuthCallbackError';\n    this.code = code;\n    this.cleanupHeaders = new Headers(cleanupHeaders);\n    this.cleanupSetCookies = getSetCookieValues(this.cleanupHeaders);\n\n    Object.defineProperty(this, OAUTH_CALLBACK_ERROR_BRAND, {\n      configurable: false,\n      enumerable: false,\n      value: true,\n      writable: false,\n    });\n  }\n}\n\n/**\n * Cross-package-copy safe type guard for callback failures.\n */\nexport function isOAuthCallbackError(error: unknown): error is OAuthCallbackError {\n  if (error instanceof OAuthCallbackError) {\n    return true;\n  }\n\n  if (error === null || typeof error !== 'object') {\n    return false;\n  }\n\n  const candidate = error as Record<PropertyKey, unknown>;\n  return candidate[OAUTH_CALLBACK_ERROR_BRAND] === true &&\n    isOAuthCallbackFailureCode(candidate.code) &&\n    isHeadersLike(candidate.cleanupHeaders);\n}\n\n/**\n * Only a normal authorization callback whose local transaction is absent or\n * expired may be retried.  All other callback failures fail closed.\n */\nexport function isRecoverableOAuthCallbackError(error: unknown): boolean {\n  return isOAuthCallbackError(error) && error.code === 'stale_transaction';\n}\n","/**\n * Server-only recovery intent for stale OAuth callbacks.\n *\n * A recovery intent is an opaque, HttpOnly cookie backed by a separate Redis\n * record. Consumers must atomically consume it with the typed stale callback\n * error; the client never supplies a boolean budget or a return URL.\n */\n\nimport {\n  consumeOAuthRecoveryRecord,\n  createOAuthRecoveryRecord,\n  deleteOAuthRecoveryRecord,\n  AUTH_ERROR_COOKIE_PREFIX,\n} from './redis-session-storage.server';\nimport {\n  isRecoverableOAuthCallbackError,\n} from './callback-errors';\nimport { sanitizeOAuthReturnUrl } from './oauth-security';\nimport {\n  OAUTH_RECOVERY_TTL_MS,\n  OAUTH_RECOVERY_TTL_SECONDS,\n} from './oauth-state-config';\nimport type { OAuthState } from './types';\nimport { logger } from '../logging';\n\nexport const OAUTH_RECOVERY_COOKIE_NAME = `${AUTH_ERROR_COOKIE_PREFIX}_oauth_recovery`;\nexport { OAUTH_RECOVERY_TTL_SECONDS };\n\nexport interface OAuthRecoveryIntent {\n  /** The sanitized destination originally supplied to login(). */\n  readonly returnUrl: string;\n}\n\nexport interface OAuthRecoveryConsumeResult {\n  /** A server-record-backed destination, or null when recovery is unavailable. */\n  readonly intent: OAuthRecoveryIntent | null;\n  /** Always clear the one-shot ticket cookie in the adapter response. */\n  readonly cleanupHeaders: Headers;\n  /** Lossless repeated Set-Cookie values for runtimes without getSetCookie(). */\n  readonly cleanupSetCookies: readonly string[];\n}\n\nexport interface OAuthRecoveryLoginResult {\n  readonly ticket: string;\n  readonly cookie: string;\n}\n\nfunction escapeRegExp(value: string): string {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\nfunction getCookieValue(request: Request): string | null {\n  const cookies = request.headers.get('Cookie');\n  if (!cookies) {\n    return null;\n  }\n\n  const cookieRegex = new RegExp(\n    `(?:^|;\\\\s*)${escapeRegExp(OAUTH_RECOVERY_COOKIE_NAME)}=([^;]*)`,\n  );\n  const rawValue = cookies.match(cookieRegex)?.[1];\n  if (!rawValue) {\n    return null;\n  }\n\n  try {\n    const value = decodeURIComponent(rawValue);\n    return value.length > 0 ? value : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction hasCookie(request: Request): boolean {\n  const cookies = request.headers.get('Cookie');\n  if (!cookies) {\n    return false;\n  }\n\n  return cookies.split(';').some((part) => {\n    const separator = part.indexOf('=');\n    return separator > 0 &&\n      part.slice(0, separator).trim() === OAUTH_RECOVERY_COOKIE_NAME;\n  });\n}\n\nconst SAFE_FALLBACK_COOKIE_PATH = '/';\n\nfunction normalizeCookiePath(pathname: string): string {\n  const candidate = pathname.trim();\n  const hasUnsafeCharacter = Array.from(candidate).some((character) => {\n    const code = character.charCodeAt(0);\n    return code <= 0x1f || code === 0x7f || character === ';';\n  });\n  if (\n    candidate.length === 0 ||\n    !candidate.startsWith('/') ||\n    candidate.startsWith('//') ||\n    hasUnsafeCharacter\n  ) {\n    return SAFE_FALLBACK_COOKIE_PATH;\n  }\n\n  return candidate;\n}\n\n/**\n * Resolve the callback cookie path from a configured redirect URI or the\n * actual callback request. Unsafe path values fall back to `/` rather than\n * being interpolated into a Set-Cookie header.\n */\nexport function getOAuthRecoveryCookiePath(\n  source: Request | URL | string,\n): string {\n  try {\n    const url = source instanceof Request\n      ? new URL(source.url)\n      : source instanceof URL\n        ? source\n        : new URL(\n          source,\n          source.startsWith('/') ? 'http://spine.local' : undefined,\n        );\n    return normalizeCookiePath(url.pathname);\n  } catch {\n    return SAFE_FALLBACK_COOKIE_PATH;\n  }\n}\n\nfunction serializeRecoveryCookie(\n  ticket: string,\n  maxAge: number,\n  callbackPath: string,\n): string {\n  const segments = [\n    `${OAUTH_RECOVERY_COOKIE_NAME}=${encodeURIComponent(ticket)}`,\n    `Path=${callbackPath}`,\n    'HttpOnly',\n    'SameSite=Lax',\n    `Max-Age=${maxAge}`,\n  ];\n\n  if (process.env.NODE_ENV === 'production') {\n    segments.push('Secure');\n  }\n\n  return segments.join('; ');\n}\n\nfunction appendRecoveryCookieClear(headers: Headers, callbackPath: string): void {\n  headers.append(\n    'Set-Cookie',\n    serializeRecoveryCookie('', 0, callbackPath),\n  );\n}\n\nfunction getSetCookieValues(headers: Headers): string[] {\n  const getSetCookie = (headers as Headers & {\n    getSetCookie?: () => string[];\n  }).getSetCookie;\n  if (getSetCookie) {\n    return getSetCookie.call(headers);\n  }\n\n  return Array.from(headers)\n    .filter(([name]) => name.toLowerCase() === 'set-cookie')\n    .map(([, value]) => value);\n}\n\n/**\n * Build a lossless ticket-clear header using a callback request, URL, or\n * configured redirect URI as the cookie-path source.\n */\nexport function clearOAuthRecoveryIntentHeaders(\n  source: Request | URL | string,\n): Headers {\n  const headers = new Headers();\n  appendRecoveryCookieClear(headers, getOAuthRecoveryCookiePath(source));\n  return headers;\n}\n\nfunction hasNonEmptyParam(url: URL, name: string): boolean {\n  return url.searchParams.get(name)?.trim().length ? true : false;\n}\n\n/**\n * This check is intentionally stricter than the callback error code.  It\n * prevents recovery for provider errors, malformed callbacks, and account\n * actions even if an adapter accidentally calls the consume helper there.\n */\nexport function isOAuthRecoveryEligibleCallback(request: Request): boolean {\n  const url = new URL(request.url);\n  return hasNonEmptyParam(url, 'code') &&\n    hasNonEmptyParam(url, 'state') &&\n    !url.searchParams.has('error') &&\n    !url.searchParams.has('kc_action') &&\n    !url.searchParams.has('kc_action_status');\n}\n\nfunction isRecoveryRecord(value: unknown): value is {\n  state: string;\n  returnUrl: string;\n  createdAt: number;\n} {\n  if (value === null || typeof value !== 'object') {\n    return false;\n  }\n\n  const record = value as Partial<OAuthState>;\n  return typeof record.state === 'string' &&\n    record.state.length > 0 &&\n    typeof record.returnUrl === 'string' &&\n    typeof record.createdAt === 'number' &&\n    Number.isFinite(record.createdAt);\n}\n\nfunction getCallbackState(request: Request): string | null {\n  const value = new URL(request.url).searchParams.get('state');\n  return value && value.trim().length > 0 ? value : null;\n}\n\n/**\n * Create the opaque ticket cookie for an ordinary login transaction.\n * Application-action transactions deliberately do not receive a recovery\n * ticket and therefore cannot enter the automatic recovery path.\n */\nexport async function createOAuthRecoveryForLogin(\n  request: Request,\n  state: Pick<OAuthState, 'state' | 'returnUrl'>,\n  redirectUri: string,\n): Promise<OAuthRecoveryLoginResult> {\n  const returnUrl = sanitizeOAuthReturnUrl(state.returnUrl, request) ?? '/';\n  const callbackPath = getOAuthRecoveryCookiePath(redirectUri);\n  const ticket = await createOAuthRecoveryRecord({\n    state: state.state,\n    returnUrl,\n    createdAt: Date.now(),\n  });\n\n  return {\n    ticket,\n    cookie: serializeRecoveryCookie(\n      ticket,\n      OAUTH_RECOVERY_TTL_SECONDS,\n      callbackPath,\n    ),\n  };\n}\n\n/**\n * Delete an unconsumed ticket during terminal/successful callback cleanup.\n * The caller owns error classification and should still clear the browser\n * cookie if deletion fails.\n */\nexport async function discardOAuthRecoveryForRequest(request: Request): Promise<Headers> {\n  const ticket = getCookieValue(request);\n  const headers = new Headers();\n  if (!hasCookie(request)) {\n    return headers;\n  }\n\n  if (ticket) {\n    await deleteOAuthRecoveryRecord(ticket);\n  }\n  appendRecoveryCookieClear(headers, getOAuthRecoveryCookiePath(request));\n  return headers;\n}\n\n/**\n * Atomically consume a stale-flow recovery intent.\n *\n * The typed error and the callback shape are both checked server-side.  Redis\n * compares the callback state and deletes only on an exact match, so a\n * mismatch cannot burn a valid ticket while a replay or concurrent loser\n * cannot retry.\n */\nexport async function consumeOAuthRecoveryIntent(\n  request: Request,\n  callbackError: unknown,\n): Promise<OAuthRecoveryConsumeResult> {\n  const cleanupHeaders = clearOAuthRecoveryIntentHeaders(request);\n  const cleanupSetCookies = getSetCookieValues(cleanupHeaders);\n\n  if (\n    !isRecoverableOAuthCallbackError(callbackError) ||\n    !isOAuthRecoveryEligibleCallback(request)\n  ) {\n    return { intent: null, cleanupHeaders, cleanupSetCookies };\n  }\n\n  const ticket = getCookieValue(request);\n  const callbackState = getCallbackState(request);\n  if (!ticket || !callbackState) {\n    return { intent: null, cleanupHeaders, cleanupSetCookies };\n  }\n\n  let record: unknown;\n  try {\n    record = await consumeOAuthRecoveryRecord(ticket, callbackState);\n  } catch (error) {\n    logger.warn('OAuth recovery record could not be consumed', {\n      errorType: error instanceof Error ? error.name : 'UnknownError',\n    });\n    return { intent: null, cleanupHeaders, cleanupSetCookies };\n  }\n\n  if (!isRecoveryRecord(record)) {\n    return { intent: null, cleanupHeaders, cleanupSetCookies };\n  }\n\n  const age = Date.now() - record.createdAt;\n  if (age < 0 || age > OAUTH_RECOVERY_TTL_MS) {\n    return { intent: null, cleanupHeaders, cleanupSetCookies };\n  }\n\n  const returnUrl = sanitizeOAuthReturnUrl(record.returnUrl, request);\n  if (!returnUrl) {\n    return { intent: null, cleanupHeaders, cleanupSetCookies };\n  }\n\n  return {\n    intent: { returnUrl },\n    cleanupHeaders,\n    cleanupSetCookies,\n  };\n}\n","/**\n * OpenID Connect Authentication Server Module\n *\n * Handles:\n * - Login flow (PKCE)\n * - Token exchange\n * - Token refresh\n * - Logout\n * - Session management\n */\n\nimport * as oidc from 'openid-client';\nimport { createRemoteJWKSet, errors as joseErrors, jwtVerify } from 'jose';\n\nimport {\n  createAuthSession,\n  getAuthSession,\n  updateAuthSession,\n  destroyAuthSession,\n  isSessionValid,\n  listAuthSessionDataForUser,\n  destroyAuthSessionsByIdentitySession,\n  destroyAuthSessionsBySid,\n  destroyAuthSessionsForUser,\n  createOAuthState,\n  getOAuthState,\n  deleteOAuthState,\n  deleteOAuthRecoveryRecord,\n  AUTH_ERROR_COOKIE_PREFIX,\n} from './redis-session-storage.server';\nimport type { \n  AuthConfig, \n  AuthClaimMapping,\n  UserInfo, \n  SessionData, \n  OAuthState,\n  TokenRefreshResult,\n  LoginOptions,\n  ApplicationType,\n  OidcClientAuthMethod,\n  BackChannelLogoutResult,\n  FrontChannelLogoutResult,\n  AuthError\n} from './types';\nimport { logger } from '../logging';\nimport { createRedirectResponse } from '../http/response';\nimport {\n  buildAuthorizationState,\n  sanitizeExtraAuthorizationParameters,\n} from './authorization-parameters';\nimport {\n  sanitizeOAuthReturnUrl,\n  serializeTemporaryAuthCookie,\n} from './oauth-security';\nimport {\n  OAuthCallbackError,\n  OAuthCallbackFailureCodes,\n  isOAuthCallbackError,\n  type OAuthCallbackFailureCode,\n} from './callback-errors';\nimport { OAUTH_STATE_TTL_MS, OAUTH_STATE_TTL_SECONDS } from './oauth-state-config';\nimport {\n  clearOAuthRecoveryIntentHeaders,\n  createOAuthRecoveryForLogin,\n  discardOAuthRecoveryForRequest,\n  isOAuthRecoveryEligibleCallback,\n} from './oauth-recovery.server';\n\ntype OidcTokenResponse = oidc.TokenEndpointResponse & oidc.TokenEndpointResponseHelpers;\ntype LogoutScope = 'identity' | 'local' | 'all';\n\n// ============================================================================\n// Configuration\n// ============================================================================\n\n/**\n * Get effective hasLandingPage setting based on config\n */\nfunction getEffectiveHasLandingPage(config: AuthConfig): boolean {\n  // Explicit setting takes precedence\n  if (config.hasLandingPage !== undefined) {\n    return config.hasLandingPage;\n  }\n  \n  // Determine by application type\n  switch (config.applicationType) {\n    case 'no-landing-page':\n    case 'dashboard':\n      return false; // Dashboard has no landing page\n    case 'landing-page':\n    case 'tenant-app':\n      return true; // Tenant app has landing page\n    default:\n      return true; // Default to having a landing page\n  }\n}\n\n/**\n * Create OAuth configuration from environment variables\n */\nfunction createAuthConfig(): AuthConfig {\n  const requiredEnvVars = {\n    authority: process.env.OIDC_AUTHORITY,\n    clientId: process.env.OIDC_CLIENT_ID,\n    redirectUri: process.env.OIDC_REDIRECT_URI,\n  };\n\n  for (const [key, value] of Object.entries(requiredEnvVars)) {\n    if (!value) {\n      throw new Error(`Missing required environment variable: OIDC_${key.toUpperCase()}`);\n    }\n  }\n\n  // Parse application type from env\n  const appTypeEnv = process.env.OIDC_APPLICATION_TYPE?.toLowerCase();\n  let applicationType: ApplicationType = 'custom';\n  if (appTypeEnv === 'no-landing-page' || appTypeEnv === 'no_landing_page') {\n    applicationType = 'no-landing-page';\n  } else if (appTypeEnv === 'landing-page' || appTypeEnv === 'landing_page') {\n    applicationType = 'landing-page';\n  } else if (appTypeEnv === 'dashboard') {\n    applicationType = 'dashboard';\n  } else if (appTypeEnv === 'tenant-app' || appTypeEnv === 'tenant_app') {\n    applicationType = 'tenant-app';\n  }\n\n  const clientAuthMethod = parseOidcClientAuthMethod(\n    process.env.OIDC_CLIENT_AUTH_METHOD,\n    process.env.OIDC_CLIENT_SECRET ? 'client_secret_post' : 'none'\n  );\n\n  const hasLandingPage = process.env.OIDC_HAS_LANDING_PAGE !== undefined\n    ? process.env.OIDC_HAS_LANDING_PAGE === 'true'\n    : undefined;\n\n  return {\n    authority: requiredEnvVars.authority!,\n    clientId: requiredEnvVars.clientId!,\n    clientSecret: process.env.OIDC_CLIENT_SECRET,\n    clientAuthMethod,\n    redirectUri: requiredEnvVars.redirectUri!,\n    scope: process.env.OIDC_SCOPE || 'openid profile email api',\n    postLogoutRedirectUri: process.env.OIDC_POST_LOGOUT_REDIRECT_URI,\n    applicationType,\n    hasLandingPage,\n  };\n}\n\nfunction parseOidcClientAuthMethod(\n  value: string | undefined,\n  fallback: OidcClientAuthMethod\n): OidcClientAuthMethod {\n  const normalized = value?.trim().toLowerCase();\n\n  switch (normalized) {\n    case undefined:\n    case '':\n      return fallback;\n    case 'none':\n      return 'none';\n    case 'client_secret_post':\n    case 'post':\n      return 'client_secret_post';\n    case 'client_secret_basic':\n    case 'basic':\n      return 'client_secret_basic';\n    default:\n      throw new Error(`Unsupported OIDC_CLIENT_AUTH_METHOD: ${value}`);\n  }\n}\n\nlet OIDC_CONFIG: AuthConfig | null = null;\n\nfunction getAuthConfig(): AuthConfig {\n  if (!OIDC_CONFIG) {\n    OIDC_CONFIG = createAuthConfig();\n  }\n  return OIDC_CONFIG;\n}\n\n// ============================================================================\n// OAuth Discovery Cache\n// ============================================================================\n\nlet authServerCache: {\n  configuration: oidc.Configuration;\n  cachedAt: number;\n} | null = null;\n\nconst CACHE_TTL = 60 * 60 * 1000; // 1 hour\nconst jwksCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\nconst INVALID_LOGOUT_TOKEN_JOSE_ERROR_CODES = new Set([\n  joseErrors.JOSEAlgNotAllowed.code,\n  joseErrors.JOSENotSupported.code,\n  joseErrors.JWKSNoMatchingKey.code,\n  joseErrors.JWSInvalid.code,\n  joseErrors.JWSSignatureVerificationFailed.code,\n  joseErrors.JWTClaimValidationFailed.code,\n  joseErrors.JWTExpired.code,\n  joseErrors.JWTInvalid.code,\n]);\n\nclass InvalidBackChannelLogoutTokenError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'InvalidBackChannelLogoutTokenError';\n  }\n}\n\nfunction isInvalidBackChannelLogoutTokenError(error: unknown): boolean {\n  if (error instanceof InvalidBackChannelLogoutTokenError) {\n    return true;\n  }\n\n  return error instanceof joseErrors.JOSEError &&\n    INVALID_LOGOUT_TOKEN_JOSE_ERROR_CODES.has(error.code);\n}\n\nfunction normalizeIssuer(value: string | undefined): string | null {\n  const normalized = value?.trim().replace(/\\/+$/, '');\n  return normalized && normalized.length > 0 ? normalized : null;\n}\n\nfunction getJwtClaims(token: string | undefined): Record<string, unknown> | null {\n  if (!token) {\n    return null;\n  }\n\n  try {\n    const [, payload] = token.split('.');\n    if (!payload) {\n      return null;\n    }\n\n    return JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nfunction getJwtIssuer(token: string | undefined): string | null {\n  const issuer = getJwtClaims(token)?.iss;\n  return typeof issuer === 'string' ? normalizeIssuer(issuer) : null;\n}\n\nfunction canUseIdTokenHint(idToken: string | undefined, expectedIssuer: string): boolean {\n  if (!idToken) {\n    return false;\n  }\n\n  const tokenIssuer = getJwtIssuer(idToken);\n  return tokenIssuer !== null && tokenIssuer === normalizeIssuer(expectedIssuer);\n}\n\nfunction appendApplicationInitiatedActionResult(\n  returnUrl: string,\n  action: string | null | undefined,\n  status: string | null | undefined\n): string {\n  if (!action && !status) {\n    return returnUrl;\n  }\n\n  try {\n    const isRelative = returnUrl.startsWith('/') && !returnUrl.startsWith('//');\n    const url = new URL(returnUrl, isRelative ? 'http://spine.local' : undefined);\n\n    if (action) {\n      url.searchParams.set('kc_action', action);\n    }\n\n    if (status) {\n      url.searchParams.set('kc_action_status', status);\n    }\n\n    return isRelative ? `${url.pathname}${url.search}${url.hash}` : url.toString();\n  } catch {\n    const params = new URLSearchParams();\n    if (action) params.set('kc_action', action);\n    if (status) params.set('kc_action_status', status);\n    const separator = returnUrl.includes('?') ? '&' : '?';\n    return `${returnUrl}${separator}${params.toString()}`;\n  }\n}\n\nexport function createAuthorizationResponseUrl(requestUrl: string, redirectUri: string): URL {\n  const incomingUrl = new URL(requestUrl);\n  const authorizationResponseUrl = new URL(redirectUri);\n  authorizationResponseUrl.search = incomingUrl.search;\n  authorizationResponseUrl.hash = \"\";\n  return authorizationResponseUrl;\n}\n\nfunction isLocalInsecureIssuer(authority: string): boolean {\n  try {\n    const issuer = new URL(authority);\n    return (\n      issuer.protocol === 'http:' &&\n      ['localhost', '127.0.0.1', '::1', '[::1]'].includes(issuer.hostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction shouldAllowInsecureOidcRequests(authority: string): boolean {\n  if (process.env.NODE_ENV === 'production') {\n    return false;\n  }\n\n  if (process.env.OIDC_ALLOW_INSECURE_REQUESTS === 'true') {\n    return true;\n  }\n\n  return isLocalInsecureIssuer(authority);\n}\n\nfunction getDiscoveryOptions(): oidc.DiscoveryRequestOptions {\n  const config = getAuthConfig();\n\n  return shouldAllowInsecureOidcRequests(config.authority)\n    ? { algorithm: 'oidc', execute: [oidc.allowInsecureRequests] }\n    : { algorithm: 'oidc' };\n}\n\nfunction getClientMetadata(config: AuthConfig): string | undefined {\n  return config.clientAuthMethod === 'none' ? undefined : config.clientSecret;\n}\n\nfunction getClientAuthentication(config: AuthConfig): oidc.ClientAuth {\n  switch (config.clientAuthMethod) {\n    case 'client_secret_basic':\n      if (!config.clientSecret) {\n        throw new Error('OIDC_CLIENT_SECRET is required for client_secret_basic authentication');\n      }\n\n      return oidc.ClientSecretBasic(config.clientSecret);\n    case 'client_secret_post':\n      if (!config.clientSecret) {\n        throw new Error('OIDC_CLIENT_SECRET is required for client_secret_post authentication');\n      }\n\n      return oidc.ClientSecretPost(config.clientSecret);\n    case 'none':\n    default:\n      return oidc.None();\n  }\n}\n\nfunction getOAuthErrorMessage(error: unknown): string {\n  if (error instanceof oidc.ResponseBodyError) {\n    return error.error_description || error.error || error.message;\n  }\n\n  if (error instanceof Error) {\n    return error.message;\n  }\n\n  return 'Unknown error';\n}\n\nfunction getLogoutScope(url: URL): LogoutScope {\n  const requestedScope =\n    url.searchParams.get('logout') ??\n    url.searchParams.get('logout_scope') ??\n    url.searchParams.get('scope');\n  const normalized = requestedScope?.trim().toLowerCase();\n\n  if (\n    normalized === 'local' ||\n    normalized === 'application' ||\n    normalized === 'app' ||\n    normalized === 'current-device'\n  ) {\n    return 'local';\n  }\n\n  if (\n    normalized === 'all' ||\n    normalized === 'all-local' ||\n    normalized === 'all-devices' ||\n    normalized === 'everywhere'\n  ) {\n    return 'all';\n  }\n\n  if (url.searchParams.get('local_only') === 'true' || url.searchParams.get('client_id_only') === 'true') {\n    return 'local';\n  }\n\n  return 'identity';\n}\n\nfunction getAbsoluteRedirectUrl(request: Request, redirectUrl: string): string {\n  if (/^https?:\\/\\//i.test(redirectUrl)) {\n    return redirectUrl;\n  }\n\n  return new URL(redirectUrl, new URL(request.url).origin).toString();\n}\n\nasync function revokeTokenBestEffort(\n  configuration: oidc.Configuration,\n  token: string | undefined,\n  tokenTypeHint: 'access_token' | 'refresh_token'\n): Promise<void> {\n  if (!token) {\n    return;\n  }\n\n  try {\n    await oidc.tokenRevocation(configuration, token, {\n      token_type_hint: tokenTypeHint,\n    });\n  } catch (error) {\n    logger.warn('OIDC token revocation failed', {\n      tokenTypeHint,\n      error: getOAuthErrorMessage(error),\n    });\n  }\n}\n\nasync function revokeSessionTokensBestEffort(sessionData: SessionData): Promise<void> {\n  if (!sessionData.refreshToken && !sessionData.accessToken) {\n    return;\n  }\n\n  try {\n    const configuration = await getOAuthConfig();\n    await revokeTokenBestEffort(configuration, sessionData.refreshToken, 'refresh_token');\n    await revokeTokenBestEffort(configuration, sessionData.accessToken, 'access_token');\n  } catch (error) {\n    logger.warn('Skipping OIDC token revocation because provider configuration is unavailable', {\n      error: getOAuthErrorMessage(error),\n    });\n  }\n}\n\nasync function revokeAndDestroyAllUserSessionsBestEffort(userId: string): Promise<number> {\n  const sessions = await listAuthSessionDataForUser(userId);\n\n  try {\n    const configuration = await getOAuthConfig();\n    for (const { data } of sessions) {\n      await revokeTokenBestEffort(configuration, data.refreshToken, 'refresh_token');\n      await revokeTokenBestEffort(configuration, data.accessToken, 'access_token');\n    }\n  } catch (error) {\n    logger.warn('Skipping all-session token revocation because provider configuration is unavailable', {\n      error: getOAuthErrorMessage(error),\n    });\n  }\n\n  return await destroyAuthSessionsForUser(userId);\n}\n\nfunction getClaimsFromTokenResponse(tokenResult: OidcTokenResponse): Record<string, unknown> {\n  const claims = tokenResult.claims();\n\n  if (claims) {\n    return claims as Record<string, unknown>;\n  }\n\n  return getJwtClaims(tokenResult.id_token) ?? {};\n}\n\n/**\n * Get OIDC configuration with caching.\n */\nasync function getOAuthConfig(): Promise<oidc.Configuration> {\n  const config = getAuthConfig();\n  const now = Date.now();\n\n  if (authServerCache && now - authServerCache.cachedAt < CACHE_TTL) {\n    return authServerCache.configuration;\n  }\n\n  try {\n    const configuration = await oidc.discovery(\n      new URL(config.authority),\n      config.clientId,\n      getClientMetadata(config),\n      getClientAuthentication(config),\n      getDiscoveryOptions()\n    );\n\n    authServerCache = {\n      configuration,\n      cachedAt: now,\n    };\n\n    logger.info('OIDC discovery completed successfully', {\n      issuer: configuration.serverMetadata().issuer,\n      clientId: config.clientId,\n      clientAuthMethod: config.clientAuthMethod,\n    });\n    return configuration;\n  } catch (error) {\n    logger.error('OIDC discovery failed', undefined, {\n      authority: config.authority,\n      clientId: config.clientId,\n      errorType: error instanceof Error ? error.name : 'UnknownError',\n    });\n    throw new Error('OIDC discovery failed');\n  }\n}\n\nfunction getJwks(jwksUri: string): ReturnType<typeof createRemoteJWKSet> {\n  const cachedJwks = jwksCache.get(jwksUri);\n  if (cachedJwks) {\n    return cachedJwks;\n  }\n\n  const jwks = createRemoteJWKSet(new URL(jwksUri));\n  jwksCache.set(jwksUri, jwks);\n  return jwks;\n}\n\nasync function getLogoutTokenFromRequest(request: Request): Promise<string | null> {\n  const contentType = request.headers.get('content-type') ?? '';\n\n  if (contentType.includes('application/json')) {\n    const body = await request.json().catch(() => null) as { logout_token?: unknown } | null;\n    return typeof body?.logout_token === 'string' ? body.logout_token : null;\n  }\n\n  const formData = await request.formData().catch(() => null);\n  const logoutToken = formData?.get('logout_token');\n  return typeof logoutToken === 'string' ? logoutToken : null;\n}\n\nfunction validateBackChannelLogoutClaims(payload: Record<string, unknown>, clientId: string): {\n  issuer?: string;\n  subject?: string;\n  sid?: string;\n} {\n  const events = payload.events;\n  const hasBackChannelEvent =\n    events &&\n    typeof events === 'object' &&\n    !Array.isArray(events) &&\n    'http://schemas.openid.net/event/backchannel-logout' in events;\n\n  if (!hasBackChannelEvent) {\n    throw new InvalidBackChannelLogoutTokenError(\n      'Invalid back-channel logout token: missing back-channel logout event'\n    );\n  }\n\n  if ('nonce' in payload) {\n    throw new InvalidBackChannelLogoutTokenError(\n      'Invalid back-channel logout token: nonce is not allowed'\n    );\n  }\n\n  const audience = payload.aud;\n  const hasClientAudience = Array.isArray(audience)\n    ? audience.includes(clientId)\n    : audience === clientId;\n\n  if (!hasClientAudience) {\n    throw new InvalidBackChannelLogoutTokenError(\n      'Invalid back-channel logout token: audience mismatch'\n    );\n  }\n\n  const subject = typeof payload.sub === 'string' ? payload.sub : undefined;\n  const sid = typeof payload.sid === 'string' ? payload.sid : undefined;\n\n  if (!subject && !sid) {\n    throw new InvalidBackChannelLogoutTokenError(\n      'Invalid back-channel logout token: subject or sid is required'\n    );\n  }\n\n  return {\n    issuer: typeof payload.iss === 'string' ? payload.iss : undefined,\n    subject,\n    sid,\n  };\n}\n\n// ============================================================================\n// Claim Extraction\n// ============================================================================\n\nconst DEFAULT_AUTH_CLAIM_MAPPING: Required<AuthClaimMapping> = {\n  subject: ['sub'],\n  name: ['name', 'preferred_username', 'email'],\n  email: ['email'],\n  givenName: ['given_name', 'givenName'],\n  familyName: ['family_name', 'familyName'],\n  picture: ['picture', 'avatar_url'],\n  locale: ['locale'],\n  zoneinfo: ['zoneinfo'],\n  updatedAt: ['updated_at'],\n  tenantIds: ['tenant_ids'],\n  tenantRoles: ['tenant_roles'],\n  permissions: ['app_perms', 'permissions', 'scope'],\n  isOnboarded: ['is_onboarded'],\n};\n\nlet authClaimMapping: Required<AuthClaimMapping> = {\n  ...DEFAULT_AUTH_CLAIM_MAPPING,\n};\n\nfunction normalizeClaimKeys(keys?: string[]): string[] {\n  if (!Array.isArray(keys)) {\n    return [];\n  }\n\n  return Array.from(\n    new Set(\n      keys\n        .map((key) => key.trim())\n        .filter((key) => key.length > 0)\n    )\n  );\n}\n\n/**\n * Configure claim mapping so different providers/backends can project their\n * own claim names onto the shared auth/session primitives.\n */\nexport function configureAuthClaimMapping(mapping: AuthClaimMapping): void {\n  authClaimMapping = {\n    subject: mapping.subject !== undefined ? normalizeClaimKeys(mapping.subject) : DEFAULT_AUTH_CLAIM_MAPPING.subject,\n    name: mapping.name !== undefined ? normalizeClaimKeys(mapping.name) : DEFAULT_AUTH_CLAIM_MAPPING.name,\n    email: mapping.email !== undefined ? normalizeClaimKeys(mapping.email) : DEFAULT_AUTH_CLAIM_MAPPING.email,\n    givenName: mapping.givenName !== undefined ? normalizeClaimKeys(mapping.givenName) : DEFAULT_AUTH_CLAIM_MAPPING.givenName,\n    familyName: mapping.familyName !== undefined ? normalizeClaimKeys(mapping.familyName) : DEFAULT_AUTH_CLAIM_MAPPING.familyName,\n    picture: mapping.picture !== undefined ? normalizeClaimKeys(mapping.picture) : DEFAULT_AUTH_CLAIM_MAPPING.picture,\n    locale: mapping.locale !== undefined ? normalizeClaimKeys(mapping.locale) : DEFAULT_AUTH_CLAIM_MAPPING.locale,\n    zoneinfo: mapping.zoneinfo !== undefined ? normalizeClaimKeys(mapping.zoneinfo) : DEFAULT_AUTH_CLAIM_MAPPING.zoneinfo,\n    updatedAt: mapping.updatedAt !== undefined ? normalizeClaimKeys(mapping.updatedAt) : DEFAULT_AUTH_CLAIM_MAPPING.updatedAt,\n    tenantIds: mapping.tenantIds !== undefined ? normalizeClaimKeys(mapping.tenantIds) : DEFAULT_AUTH_CLAIM_MAPPING.tenantIds,\n    tenantRoles: mapping.tenantRoles !== undefined ? normalizeClaimKeys(mapping.tenantRoles) : DEFAULT_AUTH_CLAIM_MAPPING.tenantRoles,\n    permissions: mapping.permissions !== undefined ? normalizeClaimKeys(mapping.permissions) : DEFAULT_AUTH_CLAIM_MAPPING.permissions,\n    isOnboarded: mapping.isOnboarded !== undefined ? normalizeClaimKeys(mapping.isOnboarded) : DEFAULT_AUTH_CLAIM_MAPPING.isOnboarded,\n  };\n}\n\n/**\n * Reset claim mapping to the built-in defaults.\n */\nexport function resetAuthClaimMapping(): void {\n  authClaimMapping = {\n    ...DEFAULT_AUTH_CLAIM_MAPPING,\n  };\n}\n\nfunction getConfiguredAuthClaimMapping(): Required<AuthClaimMapping> {\n  return authClaimMapping;\n}\n\nfunction getFirstClaimValue(\n  claims: Record<string, unknown>,\n  claimKeys: string[]\n): { key?: string; value?: unknown } {\n  for (const claimKey of claimKeys) {\n    if (claimKey in claims) {\n      return {\n        key: claimKey,\n        value: claims[claimKey],\n      };\n    }\n  }\n\n  return {};\n}\n\nfunction getStringClaim(claims: Record<string, unknown>, claimKeys: string[]): string | undefined {\n  const { value } = getFirstClaimValue(claims, claimKeys);\n\n  if (typeof value === 'string') {\n    const trimmed = value.trim();\n    return trimmed.length > 0 ? trimmed : undefined;\n  }\n\n  if (typeof value === 'number' || typeof value === 'boolean') {\n    return `${value}`;\n  }\n\n  return undefined;\n}\n\nfunction getNumberClaim(claims: Record<string, unknown>, claimKeys: string[]): number | undefined {\n  const { value } = getFirstClaimValue(claims, claimKeys);\n\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    return value;\n  }\n\n  if (typeof value === 'string') {\n    const parsed = Number(value);\n    return Number.isFinite(parsed) ? parsed : undefined;\n  }\n\n  return undefined;\n}\n\nfunction getBooleanClaim(\n  claims: Record<string, unknown>,\n  claimKeys: string[],\n  defaultValue = false\n): boolean {\n  const { value } = getFirstClaimValue(claims, claimKeys);\n\n  if (typeof value === 'boolean') {\n    return value;\n  }\n\n  if (typeof value === 'string') {\n    return value.toLowerCase() === 'true';\n  }\n\n  return defaultValue;\n}\n\n/**\n * Parse JSON safely\n */\nfunction parseJson(value: string): unknown {\n  try {\n    return JSON.parse(value);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Convert value to string array\n */\nfunction toStringArray(value: unknown): string[] {\n  if (!value) return [];\n\n  if (Array.isArray(value)) {\n    return value\n      .map((item) => (typeof item === 'string' ? item.trim() : `${item}`.trim()))\n      .filter((item) => item.length > 0);\n  }\n\n  if (typeof value === 'string') {\n    const trimmed = value.trim();\n    if (!trimmed) return [];\n\n    if (trimmed.startsWith('[')) {\n      const parsed = parseJson(trimmed);\n      if (Array.isArray(parsed)) {\n        return parsed\n          .map((item) => (typeof item === 'string' ? item.trim() : `${item}`.trim()))\n          .filter((item) => item.length > 0);\n      }\n    }\n\n    if (trimmed.includes(',')) {\n      return trimmed\n        .split(',')\n        .map((item) => item.trim())\n        .filter((item) => item.length > 0);\n    }\n\n    return [trimmed];\n  }\n\n  return [];\n}\n\nfunction toScopeArray(value: unknown): string[] {\n  if (typeof value === 'string') {\n    return value\n      .trim()\n      .split(/\\s+/)\n      .filter((item) => item.length > 0);\n  }\n\n  return toStringArray(value);\n}\n\n/**\n * Extract user info from ID token claims\n */\nexport function extractUserInfo(claims: Record<string, unknown>): {\n  tenants: string[];\n  currentTenant?: string;\n  isOnboarded: boolean;\n  tenantRoles: Record<string, string[]>;\n  permissions: string[];\n} {\n  const claimMapping = getConfiguredAuthClaimMapping();\n\n  // Extract tenant IDs\n  let tenants: string[] = [];\n  const { value: rawTenantIds } = getFirstClaimValue(claims, claimMapping.tenantIds);\n  if (rawTenantIds !== undefined) {\n    if (typeof rawTenantIds === 'string' && rawTenantIds.trim().startsWith('[')) {\n      const parsed = parseJson(rawTenantIds.trim());\n      if (Array.isArray(parsed)) {\n        tenants = parsed\n          .map((id) => (typeof id === 'string' ? id.trim() : `${id}`.trim()))\n          .filter((id) => id.length > 0);\n      }\n    } else {\n      tenants = toStringArray(rawTenantIds);\n    }\n  }\n\n  // Extract tenant roles\n  const tenantRoles: Record<string, string[]> = {};\n  const { value: rawRoles } = getFirstClaimValue(claims, claimMapping.tenantRoles);\n  if (rawRoles !== undefined) {\n    let parsedRoles: unknown = rawRoles;\n\n    if (typeof rawRoles === 'string' && rawRoles.trim().startsWith('{')) {\n      parsedRoles = parseJson(rawRoles.trim()) ?? rawRoles;\n    }\n\n    if (parsedRoles && typeof parsedRoles === 'object' && !Array.isArray(parsedRoles)) {\n      for (const [tenantId, roleValue] of Object.entries(parsedRoles as Record<string, unknown>)) {\n        const roleIds = toStringArray(roleValue);\n        if (roleIds.length > 0) {\n          tenantRoles[tenantId] = roleIds;\n        }\n      }\n    }\n  }\n\n  // Extract permissions\n  const permissionClaim = getFirstClaimValue(claims, claimMapping.permissions);\n  const permissions =\n    permissionClaim.key === 'scope'\n      ? toScopeArray(permissionClaim.value)\n      : toStringArray(permissionClaim.value);\n\n  // Extract onboarding status\n  const isOnboarded = getBooleanClaim(claims, claimMapping.isOnboarded);\n\n  return { tenants, isOnboarded, tenantRoles, permissions };\n}\n\n// ============================================================================\n// Session Data Creation\n// ============================================================================\n\n/**\n * Create session data from token result\n */\nasync function createSessionData(\n  tokenResult: OidcTokenResponse,\n  claims: Record<string, unknown>\n): Promise<Partial<SessionData>> {\n  const claimMapping = getConfiguredAuthClaimMapping();\n  const baseUser: UserInfo = {\n    sub: getStringClaim(claims, claimMapping.subject) || 'unknown',\n    name: getStringClaim(claims, claimMapping.name) || getStringClaim(claims, claimMapping.email) || 'User',\n    email: getStringClaim(claims, claimMapping.email),\n    givenName: getStringClaim(claims, claimMapping.givenName),\n    familyName: getStringClaim(claims, claimMapping.familyName),\n    picture: getStringClaim(claims, claimMapping.picture),\n    locale: getStringClaim(claims, claimMapping.locale),\n    zoneinfo: getStringClaim(claims, claimMapping.zoneinfo),\n    updated_at: getNumberClaim(claims, claimMapping.updatedAt),\n  };\n\n  const expiresAt = tokenResult.expires_in\n    ? Date.now() + tokenResult.expires_in * 1000\n    : undefined;\n  const now = Date.now();\n  const sessionState = (tokenResult as Record<string, unknown>).session_state;\n\n  return {\n    userId: baseUser.sub,\n    accessToken: tokenResult.access_token,\n    refreshToken: tokenResult.refresh_token,\n    idToken: tokenResult.id_token,\n    expiresAt,\n    issuer: getStringClaim(claims, ['iss']),\n    sid: getStringClaim(claims, ['sid']),\n    sessionState: typeof sessionState === 'string' ? sessionState : undefined,\n    clientId: getAuthConfig().clientId,\n    user: baseUser,\n    createdAt: now,\n    lastActivity: now,\n  };\n}\n\n// ============================================================================\n// Auth Error Handling\n// ============================================================================\n\n// Auth error cookie names - unique per application to prevent conflicts\nconst AUTH_ERROR_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_auth_error`;\nconst AUTH_ERROR_DESC_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_auth_error_desc`;\nconst OAUTH_STATE_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_oauth_state_id`;\nconst LOGOUT_RETURN_URL_COOKIE = 'logout_return_url';\n\n/**\n * Check if there's an auth error in cookies\n * \n * This should be called by apps (especially those without landing pages like Dashboard)\n * BEFORE starting OAuth flow to prevent redirect loops.\n * \n * @example\n * ```ts\n * // In dashboard's index route loader\n * const authError = getAuthError(request);\n * if (authError) {\n *   return { authError }; // Show error to user\n * }\n * // No error, proceed with session check\n * const user = await getUser(request);\n * if (!user) {\n *   return login(request);\n * }\n * ```\n */\nexport function getAuthError(request: Request): AuthError | null {\n  const cookies = request.headers.get('Cookie');\n  if (!cookies) return null;\n  \n  // Parse auth_error cookie (app-specific)\n  const errorRegex = new RegExp(`${AUTH_ERROR_COOKIE}=([^;]+)`);\n  const errorMatch = cookies.match(errorRegex);\n  if (!errorMatch) return null;\n  \n  const error = decodeURIComponent(errorMatch[1]);\n  if (!error) return null;\n  \n  // Parse auth_error_description cookie (app-specific)\n  const descRegex = new RegExp(`${AUTH_ERROR_DESC_COOKIE}=([^;]+)`);\n  const descMatch = cookies.match(descRegex);\n  const description = descMatch ? decodeURIComponent(descMatch[1]) : undefined;\n  \n  return { error, description };\n}\n\n/**\n * Clear auth error cookies\n * \n * Call this after displaying the error to the user\n */\nexport function clearAuthErrorHeaders(): Headers {\n  const headers = new Headers();\n  headers.append(\n    'Set-Cookie',\n    serializeTemporaryAuthCookie(AUTH_ERROR_COOKIE, '', { maxAge: 0 }),\n  );\n  headers.append(\n    'Set-Cookie',\n    serializeTemporaryAuthCookie(AUTH_ERROR_DESC_COOKIE, '', { maxAge: 0 }),\n  );\n  return headers;\n}\n\n/**\n * Check if request has auth error (quick check without parsing)\n */\nexport function hasAuthError(request: Request): boolean {\n  const cookies = request.headers.get('Cookie');\n  return cookies?.includes(`${AUTH_ERROR_COOKIE}=`) ?? false;\n}\n\ntype OAuthCallbackStage =\n  | 'configuration'\n  | 'provider'\n  | 'state'\n  | 'application_action'\n  | 'token_exchange'\n  | 'session_creation'\n  | 'storage';\n\nfunction escapeRegExp(value: string): string {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\nfunction getOAuthStateIdFromRequest(request: Request): string | null {\n  const cookies = request.headers.get('Cookie');\n  if (!cookies) {\n    return null;\n  }\n\n  const cookieRegex = new RegExp(\n    `(?:^|;\\\\s*)${escapeRegExp(OAUTH_STATE_COOKIE)}=([^;]*)`,\n  );\n  const cookieValue = cookies.match(cookieRegex)?.[1];\n  if (!cookieValue) {\n    return null;\n  }\n\n  try {\n    const stateId = decodeURIComponent(cookieValue);\n    return stateId.length > 0 ? stateId : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction hasNonEmptyCallbackValue(value: string | null): value is string {\n  return value !== null && value.trim().length > 0;\n}\n\nfunction appendHeadersPreservingSetCookie(target: Headers, source: HeadersInit): void {\n  const sourceHeaders = new Headers(source);\n  const getSetCookie = (sourceHeaders as Headers & {\n    getSetCookie?: () => string[];\n  }).getSetCookie;\n  const setCookies = getSetCookie?.call(sourceHeaders) ?? Array.from(sourceHeaders)\n    .filter(([name]) => name.toLowerCase() === 'set-cookie')\n    .map(([, value]) => value);\n\n  if (setCookies.length > 0) {\n    for (const cookie of setCookies) {\n      target.append('Set-Cookie', cookie);\n    }\n  } else {\n    const setCookie = sourceHeaders.get('Set-Cookie');\n    if (setCookie) {\n      target.append('Set-Cookie', setCookie);\n    }\n  }\n\n  for (const [name, value] of sourceHeaders) {\n    if (name.toLowerCase() !== 'set-cookie') {\n      target.set(name, value);\n    }\n  }\n}\n\nfunction appendOAuthStateCookieClear(headers: Headers): void {\n  headers.append(\n    'Set-Cookie',\n    serializeTemporaryAuthCookie(OAUTH_STATE_COOKIE, '', { maxAge: 0 }),\n  );\n}\n\nfunction isUsableOAuthState(\n  state: OAuthState | null,\n  requireNonce: boolean,\n): state is OAuthState {\n  return state !== null &&\n    typeof state.state === 'string' &&\n    state.state.length > 0 &&\n    typeof state.codeVerifier === 'string' &&\n    state.codeVerifier.length > 0 &&\n    (state.nonce === undefined\n      ? !requireNonce\n      : typeof state.nonce === 'string' && state.nonce.length > 0) &&\n    typeof state.createdAt === 'number' &&\n    Number.isFinite(state.createdAt) &&\n    (state.returnUrl === undefined || typeof state.returnUrl === 'string') &&\n    (state.kcAction === undefined || typeof state.kcAction === 'string');\n}\n\nfunction getCallbackFailureCode(\n  error: unknown,\n  stage: OAuthCallbackStage,\n): OAuthCallbackFailureCode {\n  if (isOAuthCallbackError(error)) {\n    return error.code;\n  }\n\n  switch (stage) {\n    case 'configuration':\n      return OAuthCallbackFailureCodes.ConfigurationError;\n    case 'state':\n    case 'storage':\n      return OAuthCallbackFailureCodes.StorageError;\n    case 'application_action':\n      return OAuthCallbackFailureCodes.ApplicationActionFailed;\n    case 'token_exchange':\n      return OAuthCallbackFailureCodes.TokenExchangeFailed;\n    case 'session_creation':\n      return OAuthCallbackFailureCodes.SessionCreationFailed;\n    case 'provider':\n    default:\n      return OAuthCallbackFailureCodes.StorageError;\n  }\n}\n\nasync function createOAuthCallbackFailure(\n  request: Request,\n  stateId: string | null,\n  failureCode: OAuthCallbackFailureCode,\n): Promise<OAuthCallbackError> {\n  const cleanupHeaders = new Headers();\n  let cleanupError: unknown;\n  const preserveRecoveryTicket =\n    failureCode === OAuthCallbackFailureCodes.StaleTransaction &&\n    isOAuthRecoveryEligibleCallback(request);\n\n  if (stateId) {\n    try {\n      await deleteOAuthState(stateId);\n    } catch (error) {\n      cleanupError = error;\n    }\n  }\n\n  try {\n    const sessionHeaders = await destroyAuthSession(request);\n    appendHeadersPreservingSetCookie(cleanupHeaders, sessionHeaders);\n  } catch (error) {\n    cleanupError ??= error;\n  }\n\n  if (!preserveRecoveryTicket || cleanupError) {\n    try {\n      const recoveryHeaders = await discardOAuthRecoveryForRequest(request);\n      appendHeadersPreservingSetCookie(cleanupHeaders, recoveryHeaders);\n    } catch (error) {\n      cleanupError ??= error;\n      appendHeadersPreservingSetCookie(\n        cleanupHeaders,\n        clearOAuthRecoveryIntentHeaders(request),\n      );\n    }\n  }\n\n  appendOAuthStateCookieClear(cleanupHeaders);\n\n  const effectiveFailureCode = cleanupError\n    ? OAuthCallbackFailureCodes.StorageError\n    : failureCode;\n\n  if (cleanupError) {\n    logger.warn('OAuth callback cleanup failed', {\n      failureCode: effectiveFailureCode,\n      errorType: cleanupError instanceof Error ? cleanupError.name : 'UnknownError',\n    });\n  }\n\n  return new OAuthCallbackError(effectiveFailureCode, cleanupHeaders);\n}\n\n// ============================================================================\n// Auth Functions\n// ============================================================================\n\n/**\n * Initiate OAuth login flow\n * \n * @param request - The incoming request\n * @param returnUrlOrOptions - Either a return URL string or LoginOptions object\n */\nexport async function login(\n  request: Request, \n  returnUrlOrOptions?: string | LoginOptions\n): Promise<Response> {\n  let oauthStateId: string | null = null;\n  let recoveryTicket: string | null = null;\n  let recoveryCookie: string | null = null;\n\n  try {\n    const config = getAuthConfig();\n    \n    // Parse options\n    const options: LoginOptions = typeof returnUrlOrOptions === 'string' \n      ? { returnUrl: returnUrlOrOptions }\n      : returnUrlOrOptions || {};\n    const returnUrl = sanitizeOAuthReturnUrl(options.returnUrl, request) ?? '/';\n\n    // Check for auth_error cookie to prevent redirect loops\n    const cookies = request.headers.get('Cookie');\n    const hasError = cookies?.includes(`${AUTH_ERROR_COOKIE}=`);\n    if (hasError) {\n      logger.warn('Auth error cookie detected, preventing redirect loop');\n      // Clear the error cookie and redirect to home\n      const headers = new Headers();\n      headers.append(\n        'Set-Cookie',\n        serializeTemporaryAuthCookie(AUTH_ERROR_COOKIE, '', { maxAge: 0 }),\n      );\n      // Use redirectUri to get correct base URL with port\n      const redirectUri = new URL(config.redirectUri);\n      const baseUrl = redirectUri.origin;\n      return createRedirectResponse(baseUrl, { headers });\n    }\n\n    const oidcConfig = await getOAuthConfig();\n\n    // Generate PKCE challenge\n    const codeVerifier = oidc.randomPKCECodeVerifier();\n    const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);\n\n    const extraAuthParams = sanitizeExtraAuthorizationParameters(options.extraAuthParams, options);\n\n    // Generate secure state and nonce. The state may carry a non-secret UI\n    // hint for Keycloak themes, but callback validation still compares the\n    // exact value stored server-side.\n    const state = buildAuthorizationState(oidc.randomState(), options.publicStateContext);\n    const nonce = oidc.randomNonce();\n\n    // Create OAuth state object\n    const oauthState: OAuthState = {\n      state,\n      codeVerifier,\n      nonce,\n      returnUrl,\n      kcAction: options.kcAction,\n      createdAt: Date.now(),\n    };\n\n    logger.info('Creating OAuth state', {\n      hasReturnUrl: Boolean(options.returnUrl),\n      prompt: options.prompt,\n      hasKcAction: Boolean(options.kcAction),\n      extraAuthParamKeys: Object.keys(extraAuthParams),\n    });\n\n    // Store OAuth state in Redis\n    oauthStateId = await createOAuthState(oauthState);\n\n    if (!options.kcAction) {\n      const recovery = await createOAuthRecoveryForLogin(request, {\n        state,\n        returnUrl,\n      }, config.redirectUri);\n      recoveryTicket = recovery.ticket;\n      recoveryCookie = recovery.cookie;\n    }\n\n    const authorizationParameters: Record<string, string> = {\n      redirect_uri: config.redirectUri,\n      scope: config.scope,\n      state,\n      nonce,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n      ...extraAuthParams,\n    };\n\n    if (options.prompt) {\n      authorizationParameters.prompt = options.prompt;\n    }\n\n    if (options.kcAction) {\n      authorizationParameters.kc_action = options.kcAction;\n    }\n\n    const authorizationUrl = oidc.buildAuthorizationUrl(oidcConfig, authorizationParameters);\n\n    // Store stateId in cookie for callback (app-specific to prevent conflicts)\n    const headers = new Headers();\n    headers.append(\n      'Set-Cookie',\n      serializeTemporaryAuthCookie(OAUTH_STATE_COOKIE, oauthStateId, {\n        maxAge: OAUTH_STATE_TTL_SECONDS,\n      }),\n    );\n\n    if (recoveryCookie) {\n      headers.append('Set-Cookie', recoveryCookie);\n    }\n\n    logger.info('OIDC authorization flow initiated', {\n      clientId: config.clientId,\n      redirectUri: config.redirectUri,\n      scope: config.scope,\n      authorizationEndpoint: oidcConfig.serverMetadata().authorization_endpoint,\n      hasStateId: true,\n      prompt: options.prompt,\n      hasKcAction: Boolean(options.kcAction),\n    });\n\n    return createRedirectResponse(authorizationUrl.toString(), { headers });\n  } catch (error) {\n    if (oauthStateId) {\n      try {\n        await deleteOAuthState(oauthStateId);\n      } catch (cleanupError) {\n        logger.warn('OAuth login state cleanup failed', {\n          errorType: cleanupError instanceof Error ? cleanupError.name : 'UnknownError',\n        });\n      }\n    }\n\n    if (recoveryTicket) {\n      try {\n        await deleteOAuthRecoveryRecord(recoveryTicket);\n      } catch (cleanupError) {\n        logger.warn('OAuth recovery intent cleanup failed', {\n          errorType: cleanupError instanceof Error ? cleanupError.name : 'UnknownError',\n        });\n      }\n    }\n\n    logger.error('Failed to initiate OAuth login', undefined, {\n      errorType: error instanceof Error ? error.name : 'UnknownError',\n    });\n    throw new Error('Login failed');\n  }\n}\n\n/**\n * Handle OAuth callback\n * \n * Handles OAuth authorization response including success and error cases.\n * \n * Error Handling:\n * - `access_denied`: User doesn't have access to this application\n *   - For apps with landing page: Redirect home with error cookie\n *   - For apps without landing page: Redirect home with error cookie (must handle specially)\n * - `login_required`: No active identity session\n *   - Redirect to home to start fresh login\n */\nexport async function handleCallback(request: Request): Promise<Response> {\n  let stateId: string | null = null;\n  let callbackStage: OAuthCallbackStage = 'configuration';\n\n  try {\n    stateId = getOAuthStateIdFromRequest(request);\n    const config = getAuthConfig();\n    const hasLandingPage = getEffectiveHasLandingPage(config);\n    const requiresNonce = config.scope.split(/\\s+/).includes('openid');\n    const url = new URL(request.url);\n    const code = url.searchParams.get('code');\n    const state = url.searchParams.get('state');\n    const error = url.searchParams.get('error');\n    const errorDescription = url.searchParams.get('error_description');\n    const kcAction = url.searchParams.get('kc_action');\n    const kcActionStatus = url.searchParams.get('kc_action_status');\n    const hasCode = hasNonEmptyCallbackValue(code);\n    const hasState = hasNonEmptyCallbackValue(state);\n    const hasApplicationAction = Boolean(\n      hasNonEmptyCallbackValue(kcAction) ||\n      hasNonEmptyCallbackValue(kcActionStatus),\n    );\n\n    logger.info('OIDC callback received', {\n      hasCode,\n      hasState,\n      hasError: Boolean(error),\n      hasErrorDescription: Boolean(errorDescription),\n      hasKcAction: hasNonEmptyCallbackValue(kcAction),\n      hasKcActionStatus: hasNonEmptyCallbackValue(kcActionStatus),\n      clientId: config.clientId,\n      redirectUri: config.redirectUri,\n    });\n\n    // Handle OAuth errors\n    if (error) {\n      if (kcActionStatus && hasState) {\n        callbackStage = 'state';\n        if (stateId) {\n          const oauthState = await getOAuthState(stateId, { throwOnMalformed: true });\n          const stateAge = oauthState ? Date.now() - oauthState.createdAt : Number.POSITIVE_INFINITY;\n\n          if (\n            oauthState &&\n            isUsableOAuthState(oauthState, requiresNonce) &&\n            oauthState.state === state &&\n            stateAge <= OAUTH_STATE_TTL_MS\n          ) {\n            callbackStage = 'storage';\n            await deleteOAuthState(stateId);\n            const recoveryHeaders = await discardOAuthRecoveryForRequest(request);\n            callbackStage = 'application_action';\n            const headers = new Headers();\n            appendOAuthStateCookieClear(headers);\n            appendHeadersPreservingSetCookie(headers, recoveryHeaders);\n\n            const redirectUrl = appendApplicationInitiatedActionResult(\n              sanitizeOAuthReturnUrl(oauthState.returnUrl, request) ?? '/',\n              kcAction || oauthState.kcAction,\n              kcActionStatus\n            );\n\n            logger.info('Application initiated action returned with OAuth error', {\n              hasError: Boolean(error),\n              hasErrorDescription: Boolean(errorDescription),\n              hasKcAction: Boolean(kcAction || oauthState.kcAction),\n              hasKcActionStatus: Boolean(kcActionStatus),\n            });\n\n            return createRedirectResponse(redirectUrl, { headers });\n          }\n        }\n      }\n\n      logger.error('OAuth callback error', undefined, { \n        hasError: Boolean(error),\n        hasErrorDescription: Boolean(errorDescription),\n        clientId: config.clientId,\n        applicationType: config.applicationType,\n        hasLandingPage\n      });\n      \n      // Handle access_denied specially - user doesn't have access to this app\n      // This can happen when identity cookie is valid but user has no access to this client\n      if (error === 'access_denied') {\n        logger.warn('Access denied for this application', { clientId: config.clientId });\n        // Clear any existing session and redirect to home without triggering new login\n        callbackStage = 'storage';\n        if (stateId) {\n          await deleteOAuthState(stateId);\n        }\n        const headers = await destroyAuthSession(request);\n        appendOAuthStateCookieClear(headers);\n        const recoveryHeaders = await discardOAuthRecoveryForRequest(request);\n        appendHeadersPreservingSetCookie(headers, recoveryHeaders);\n        // Set error cookies to:\n        // 1. Prevent redirect loop (auth_error)\n        // 2. Allow UI to show appropriate message (auth_error_type, auth_error_description)\n        headers.append(\n          'Set-Cookie',\n          serializeTemporaryAuthCookie(AUTH_ERROR_COOKIE, 'access_denied', { maxAge: 300 }),\n        );\n        headers.append(\n          'Set-Cookie',\n          serializeTemporaryAuthCookie(\n            AUTH_ERROR_DESC_COOKIE,\n            'You do not have access to this application.',\n            { maxAge: 300 },\n          ),\n        );\n        // Use redirectUri to get the correct base URL with port\n        // request.url.origin can lose the port in some cases\n        const redirectUri = new URL(config.redirectUri);\n        const baseUrl = redirectUri.origin;\n        logger.info('Redirecting to /auth/login to show access_denied error', { \n          hasLandingPage,\n          baseUrl,\n          configRedirectUri: config.redirectUri\n        });\n        // Redirect to /auth/login so user immediately sees the access denied page\n        // instead of landing page (which doesn't show the error)\n        return createRedirectResponse(`${baseUrl}/auth/login`, { headers });\n      }\n      \n      // Handle login_required - session expired or user not logged in\n      if (error === 'login_required') {\n        logger.info('Login required, user session may have expired');\n        callbackStage = 'storage';\n        if (stateId) {\n          await deleteOAuthState(stateId);\n        }\n        const headers = await destroyAuthSession(request);\n        appendOAuthStateCookieClear(headers);\n        const recoveryHeaders = await discardOAuthRecoveryForRequest(request);\n        appendHeadersPreservingSetCookie(headers, recoveryHeaders);\n        // Use redirectUri to get correct base URL with port\n        const redirectUri = new URL(config.redirectUri);\n        const baseUrl = redirectUri.origin;\n        return createRedirectResponse(baseUrl, { headers });\n      }\n      \n      // Handle other errors\n      callbackStage = 'storage';\n      if (stateId) {\n        await deleteOAuthState(stateId);\n      }\n      const headers = await destroyAuthSession(request);\n      appendOAuthStateCookieClear(headers);\n      const recoveryHeaders = await discardOAuthRecoveryForRequest(request);\n      appendHeadersPreservingSetCookie(headers, recoveryHeaders);\n      headers.append(\n        'Set-Cookie',\n        serializeTemporaryAuthCookie(AUTH_ERROR_COOKIE, error, { maxAge: 300 }),\n      );\n      // Use redirectUri to get correct base URL with port\n      const redirectUri = new URL(config.redirectUri);\n      const baseUrl = redirectUri.origin;\n      return createRedirectResponse(baseUrl, { headers });\n    }\n\n    // Callback syntax is checked before looking up local state. A callback\n    // without a state parameter is malformed, never a recoverable stale flow.\n    if (!hasState) {\n      callbackStage = hasApplicationAction ? 'application_action' : 'state';\n      throw new OAuthCallbackError(\n        hasApplicationAction\n          ? OAuthCallbackFailureCodes.ApplicationActionFailed\n          : OAuthCallbackFailureCodes.MalformedCallback,\n      );\n    }\n\n    if (!hasCode && !hasApplicationAction) {\n      callbackStage = 'state';\n      throw new OAuthCallbackError(OAuthCallbackFailureCodes.MalformedCallback);\n    }\n\n    if (!stateId) {\n      callbackStage = hasApplicationAction ? 'application_action' : 'state';\n      throw new OAuthCallbackError(\n        hasApplicationAction\n          ? OAuthCallbackFailureCodes.ApplicationActionFailed\n          : OAuthCallbackFailureCodes.StaleTransaction,\n      );\n    }\n\n    // Retrieve OAuth state from Redis\n    callbackStage = 'state';\n    const oauthState = await getOAuthState(stateId, { throwOnMalformed: true });\n\n    if (!oauthState) {\n      throw new OAuthCallbackError(\n        hasApplicationAction\n          ? OAuthCallbackFailureCodes.ApplicationActionFailed\n          : OAuthCallbackFailureCodes.StaleTransaction,\n      );\n    }\n\n    if (!isUsableOAuthState(oauthState, requiresNonce)) {\n      throw new OAuthCallbackError(OAuthCallbackFailureCodes.StorageError);\n    }\n\n    if (oauthState.state !== state) {\n      throw new OAuthCallbackError(OAuthCallbackFailureCodes.StateMismatch);\n    }\n\n    const isApplicationAction = Boolean(\n      hasApplicationAction || oauthState.kcAction,\n    );\n    const stateAge = Date.now() - oauthState.createdAt;\n    if (stateAge > OAUTH_STATE_TTL_MS) {\n      throw new OAuthCallbackError(\n        isApplicationAction\n          ? OAuthCallbackFailureCodes.ApplicationActionFailed\n          : OAuthCallbackFailureCodes.StaleTransaction,\n      );\n    }\n\n    if (!hasCode) {\n      if (kcActionStatus) {\n        callbackStage = 'storage';\n        await deleteOAuthState(stateId);\n        const recoveryHeaders = await discardOAuthRecoveryForRequest(request);\n        callbackStage = 'application_action';\n        const headers = new Headers();\n        appendOAuthStateCookieClear(headers);\n        appendHeadersPreservingSetCookie(headers, recoveryHeaders);\n\n        const redirectUrl = appendApplicationInitiatedActionResult(\n          sanitizeOAuthReturnUrl(oauthState.returnUrl, request) ?? '/',\n          kcAction || oauthState.kcAction,\n          kcActionStatus\n        );\n\n        logger.info('Application initiated action returned without authorization code', {\n          hasKcAction: Boolean(kcAction || oauthState.kcAction),\n          hasKcActionStatus: Boolean(kcActionStatus),\n        });\n\n        return createRedirectResponse(redirectUrl, { headers });\n      }\n\n      throw new OAuthCallbackError(\n        isApplicationAction\n          ? OAuthCallbackFailureCodes.ApplicationActionFailed\n          : OAuthCallbackFailureCodes.MalformedCallback,\n      );\n    }\n\n    logger.info('Initiating token exchange');\n\n    callbackStage = 'configuration';\n    const oidcConfig = await getOAuthConfig();\n    const authorizationResponseUrl = createAuthorizationResponseUrl(request.url, config.redirectUri);\n    callbackStage = 'token_exchange';\n    const tokenResult = await oidc.authorizationCodeGrant(oidcConfig, authorizationResponseUrl, {\n      pkceCodeVerifier: oauthState.codeVerifier,\n      expectedState: oauthState.state,\n      expectedNonce: oauthState.nonce,\n      idTokenExpected: config.scope.split(/\\s+/).includes('openid'),\n    });\n\n    logger.info('Token exchange completed successfully');\n\n    callbackStage = 'session_creation';\n    const claims = getClaimsFromTokenResponse(tokenResult);\n\n    // Create session data\n    const newSessionData = await createSessionData(tokenResult, claims);\n\n    // Create new session\n    callbackStage = 'session_creation';\n    const sessionHeaders = await createAuthSession(request, newSessionData);\n\n    // Clean up OAuth state from Redis\n    callbackStage = 'storage';\n    await deleteOAuthState(stateId);\n    const recoveryHeaders = await discardOAuthRecoveryForRequest(request);\n\n    // Combine headers and clear OAuth state cookie (app-specific)\n    const headers = new Headers();\n    appendHeadersPreservingSetCookie(headers, sessionHeaders);\n    appendOAuthStateCookieClear(headers);\n    appendHeadersPreservingSetCookie(headers, recoveryHeaders);\n\n    logger.info('OAuth callback processed successfully');\n\n    // Redirect to return URL or default location\n    const redirectUrl = appendApplicationInitiatedActionResult(\n      sanitizeOAuthReturnUrl(oauthState.returnUrl, request) ?? '/',\n      kcAction || oauthState.kcAction,\n      kcActionStatus\n    );\n    return createRedirectResponse(redirectUrl, { headers });\n  } catch (error) {\n    const failureCode = getCallbackFailureCode(error, callbackStage);\n    logger.error('OAuth callback failed', undefined, {\n      failureCode,\n      errorType: error instanceof Error ? error.name : 'UnknownError',\n    });\n\n    throw await createOAuthCallbackFailure(request, stateId, failureCode);\n  }\n}\n\n/**\n * Logout user.\n *\n * Default logout follows OIDC RP-Initiated Logout and ends the identity\n * provider session. Automatic/session-expiry cleanup can request\n * `/auth/logout?logout=local` to clear only this app's Redis session without\n * bouncing the browser through the identity provider or revoking SSO tokens.\n */\nexport async function logout(request: Request): Promise<Response> {\n  try {\n    const config = getAuthConfig();\n    const url = new URL(request.url);\n    \n    const logoutScope = getLogoutScope(url);\n    const returnUrl = sanitizeOAuthReturnUrl(url.searchParams.get('returnUrl'), request);\n    \n    logger.info('Logout initiated', { \n      clientId: config.clientId,\n      logoutScope,\n    });\n    \n    const sessionData = await getAuthSession(request);\n    const idToken = sessionData.idToken;\n\n    if (logoutScope === 'local') {\n      // Local logout is RP-only cleanup. Tokens are server-side and become\n      // unreachable once the Redis session is destroyed; revoking the refresh\n      // token can also terminate the Keycloak SSO session for this user.\n      const headers = await destroyAuthSession(request);\n      const redirectUrl = returnUrl || '/';\n      const absoluteRedirectUrl = getAbsoluteRedirectUrl(request, redirectUrl);\n\n      headers.append(\n        'Set-Cookie',\n        serializeTemporaryAuthCookie(LOGOUT_RETURN_URL_COOKIE, '', { maxAge: 0 }),\n      );\n      logger.info('Local application logout completed', { hasReturnUrl: Boolean(returnUrl) });\n      return createRedirectResponse(absoluteRedirectUrl, { headers });\n    }\n\n    const sessionHeaders = new Headers();\n\n    if (logoutScope === 'all' && sessionData.userId) {\n      await revokeAndDestroyAllUserSessionsBestEffort(sessionData.userId);\n      sessionHeaders.append(\n        'Set-Cookie',\n        serializeTemporaryAuthCookie(LOGOUT_RETURN_URL_COOKIE, '', { maxAge: 0 }),\n      );\n      const expiredHeaders = await destroyAuthSession(request);\n      expiredHeaders.forEach((value, key) => sessionHeaders.append(key, value));\n    } else {\n      await revokeSessionTokensBestEffort(sessionData);\n      const expiredHeaders = await destroyAuthSession(request);\n      expiredHeaders.forEach((value, key) => sessionHeaders.append(key, value));\n    }\n\n    const headers = new Headers(sessionHeaders);\n\n    // Store returnUrl in cookie if provided for the post-logout landing redirect.\n    if (returnUrl) {\n      headers.append(\n        'Set-Cookie',\n        serializeTemporaryAuthCookie(LOGOUT_RETURN_URL_COOKIE, returnUrl, { maxAge: 300 }),\n      );\n    } else {\n      headers.append(\n        'Set-Cookie',\n        serializeTemporaryAuthCookie(LOGOUT_RETURN_URL_COOKIE, '', { maxAge: 0 }),\n      );\n    }\n\n    try {\n      const oidcConfig = await getOAuthConfig();\n      const serverMetadata = oidcConfig.serverMetadata();\n      const logoutParameters: Record<string, string> = {};\n      const expectedIssuer = serverMetadata.issuer ?? config.authority;\n\n      if (idToken && canUseIdTokenHint(idToken, expectedIssuer)) {\n        logoutParameters.id_token_hint = idToken;\n      } else if (idToken) {\n        logger.warn('Skipping id_token_hint because the session token issuer does not match the active OIDC provider', {\n          tokenIssuer: getJwtIssuer(idToken),\n          expectedIssuer: normalizeIssuer(expectedIssuer),\n          clientId: config.clientId,\n        });\n      }\n\n      if (config.postLogoutRedirectUri) {\n        logoutParameters.post_logout_redirect_uri = config.postLogoutRedirectUri;\n      }\n\n      const endSessionUrl = oidc.buildEndSessionUrl(oidcConfig, logoutParameters);\n      logger.info('RP-Initiated Logout redirect created', {\n        endSessionEndpoint: serverMetadata.end_session_endpoint,\n        hasIdTokenHint: Boolean(logoutParameters.id_token_hint),\n      });\n\n      return createRedirectResponse(endSessionUrl.toString(), { headers });\n    } catch (error) {\n      logger.warn('OIDC end_session endpoint unavailable, falling back to local redirect', {\n        error: getOAuthErrorMessage(error),\n      });\n    }\n\n    // Fallback redirect\n    const registeredPath = config.postLogoutRedirectUri || '/';\n    const finalRedirectUrl = getAbsoluteRedirectUrl(request, registeredPath);\n\n    logger.info('Logout completed', { hasConfiguredRedirect: Boolean(config.postLogoutRedirectUri) });\n    return createRedirectResponse(finalRedirectUrl, { headers });\n  } catch (error) {\n    logger.error('Logout failed', error instanceof Error ? error : undefined);\n    const headers = await destroyAuthSession(request);\n    return createRedirectResponse('/', { headers });\n  }\n}\n\n/**\n * Handle an OIDC Back-Channel Logout request from Keycloak or another OP.\n *\n * Configure the client Backchannel logout URL to this endpoint. The logout\n * token is signature-verified against the provider JWKS, issuer/audience are\n * checked, and all matching local Redis sessions are destroyed by `sid` first,\n * falling back to `sub` when the OP omits a session id.\n */\nexport async function handleBackChannelLogout(request: Request): Promise<Response> {\n  if (request.method !== 'POST') {\n    return Response.json({ error: 'method_not_allowed' }, { status: 405 });\n  }\n\n  try {\n    const config = getAuthConfig();\n    const oidcConfig = await getOAuthConfig();\n    const serverMetadata = oidcConfig.serverMetadata();\n    const logoutToken = await getLogoutTokenFromRequest(request);\n\n    if (!logoutToken) {\n      return Response.json({ error: 'missing_logout_token' }, { status: 400 });\n    }\n\n    if (!serverMetadata.jwks_uri) {\n      throw new Error('OIDC provider does not expose jwks_uri');\n    }\n\n    const { payload } = await jwtVerify(logoutToken, getJwks(serverMetadata.jwks_uri), {\n      issuer: serverMetadata.issuer ?? config.authority,\n      audience: config.clientId,\n      clockTolerance: 60,\n    });\n\n    const claims = validateBackChannelLogoutClaims(payload as Record<string, unknown>, config.clientId);\n    const destroyedSessions = await destroyAuthSessionsByIdentitySession({\n      sid: claims.sid,\n      userId: claims.subject,\n    });\n    const result: BackChannelLogoutResult = {\n      destroyedSessions,\n      issuer: claims.issuer,\n      subject: claims.subject,\n      sid: claims.sid,\n    };\n\n    logger.info('Back-channel logout processed', { ...result });\n    return Response.json({ success: true, ...result });\n  } catch (error) {\n    if (isInvalidBackChannelLogoutTokenError(error)) {\n      logger.warn('Back-channel logout token rejected', {\n        error: getOAuthErrorMessage(error),\n        errorCode: error instanceof joseErrors.JOSEError ? error.code : undefined,\n      });\n    } else {\n      logger.error('Back-channel logout failed', error instanceof Error ? error : undefined);\n    }\n\n    return Response.json(\n      { error: 'invalid_logout_token', error_description: getOAuthErrorMessage(error) },\n      { status: 400 }\n    );\n  }\n}\n\n/**\n * Handle OIDC Front-Channel Logout iframe/browser requests.\n *\n * Front-channel logout cannot carry a signed logout token, so this validates the\n * issuer and applies local cleanup only when a `sid` is present.\n */\nexport async function handleFrontChannelLogout(request: Request): Promise<Response> {\n  try {\n    const config = getAuthConfig();\n    const oidcConfig = await getOAuthConfig();\n    const serverMetadata = oidcConfig.serverMetadata();\n    const url = new URL(request.url);\n    const issuer = url.searchParams.get('iss');\n    const sid = url.searchParams.get('sid');\n    const expectedIssuer = normalizeIssuer(serverMetadata.issuer ?? config.authority);\n\n    if (!issuer || normalizeIssuer(issuer) !== expectedIssuer) {\n      return new Response(null, { status: 204 });\n    }\n\n    const destroyedSessions = sid ? await destroyAuthSessionsBySid(sid) : 0;\n    const result: FrontChannelLogoutResult = {\n      destroyedSessions,\n      issuer,\n      sid: sid ?? undefined,\n    };\n\n    logger.info('Front-channel logout processed', { ...result });\n    return new Response(null, {\n      status: 204,\n      headers: {\n        'Cache-Control': 'no-store',\n      },\n    });\n  } catch (error) {\n    logger.warn('Front-channel logout ignored', {\n      error: getOAuthErrorMessage(error),\n    });\n\n    return new Response(null, { status: 204 });\n  }\n}\n\nfunction getAccessTokenExpiry(accessToken: string | undefined): number | null {\n  if (!accessToken) {\n    return null;\n  }\n\n  try {\n    const [, encodedPayload] = accessToken.split('.');\n    if (!encodedPayload) {\n      return null;\n    }\n\n    const payload = JSON.parse(\n      Buffer.from(encodedPayload, 'base64url').toString('utf8'),\n    ) as { exp?: unknown };\n\n    return typeof payload.exp === 'number' && Number.isFinite(payload.exp)\n      ? payload.exp * 1000\n      : null;\n  } catch {\n    // Opaque access tokens are valid provider contracts too; only reject a\n    // token here when it exposes a readable, already-expired JWT `exp` claim.\n    return null;\n  }\n}\n\nfunction isSessionExpired(sessionData: { accessToken?: string; expiresAt?: number }): boolean {\n  const now = Date.now();\n  if (typeof sessionData.expiresAt === 'number' && (!Number.isFinite(sessionData.expiresAt) || now >= sessionData.expiresAt)) {\n    return true;\n  }\n\n  const accessTokenExpiry = getAccessTokenExpiry(sessionData.accessToken);\n  return accessTokenExpiry !== null && now >= accessTokenExpiry;\n}\n\n/**\n * Get current user from session\n */\nexport async function getUser(request: Request): Promise<UserInfo | null> {\n  try {\n    const sessionData = await getAuthSession(request);\n\n    if (!sessionData.user || !sessionData.accessToken || isSessionExpired(sessionData)) {\n      return null;\n    }\n\n    return sessionData.user;\n  } catch (error) {\n    logger.error('Failed to get user', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\n/**\n * Require authenticated user (throws redirect to login if not authenticated)\n */\nexport async function requireAuth(request: Request): Promise<UserInfo> {\n  const user = await getUser(request);\n\n  if (!user) {\n    const url = new URL(request.url);\n    const returnUrl = `${url.pathname}${url.search}`;\n    logger.info('No user found, starting OAuth flow', { hasReturnUrl: true });\n    throw await login(request, returnUrl);\n  }\n\n  return user;\n}\n\n/**\n * Get access token from session\n */\nexport async function getAccessToken(request: Request): Promise<string | null> {\n  try {\n    const sessionData = await getAuthSession(request);\n    return sessionData.accessToken || null;\n  } catch (error) {\n    logger.error('Failed to get access token', error instanceof Error ? error : undefined);\n    return null;\n  }\n}\n\n/**\n * Refresh tokens\n */\nexport async function refreshTokens(\n  request: Request,\n  refreshToken?: string\n): Promise<TokenRefreshResult> {\n  try {\n    const sessionData = await getAuthSession(request);\n\n    // Refresh tokens are only authoritative when they are attached to an\n    // existing Redis session. In particular, never create a new session from\n    // a caller that has no signed session cookie.\n    if (!sessionData.sessionId) {\n      logger.warn('Cannot refresh tokens without an active Redis session');\n      return { success: false, error: 'No active session', shouldLogout: true };\n    }\n\n    const sessionRefreshToken = sessionData.refreshToken;\n    if (!sessionRefreshToken) {\n      logger.warn('No refresh token available');\n      return { success: false, error: 'No refresh token available', shouldLogout: true };\n    }\n\n    if (refreshToken && refreshToken !== sessionRefreshToken) {\n      logger.warn('Rejected refresh token that does not match the active Redis session');\n      return { success: false, error: 'Refresh token does not match active session', shouldLogout: true };\n    }\n\n    const tokenToRefresh = sessionRefreshToken;\n\n    logger.info('Initiating token refresh');\n\n    const oidcConfig = await getOAuthConfig();\n    const refreshResult = await oidc.refreshTokenGrant(oidcConfig, tokenToRefresh);\n\n    logger.info('Token refresh successful');\n\n    if (!refreshResult.access_token) {\n      logger.error('Token refresh returned no access token');\n      return { success: false, error: 'No access token in refresh response', shouldLogout: true };\n    }\n\n    const newRefreshToken = refreshResult.refresh_token || tokenToRefresh;\n    const expiresAt = refreshResult.expires_in\n      ? Date.now() + refreshResult.expires_in * 1000\n      : sessionData.expiresAt;\n\n    // Update session\n    await updateAuthSession(request, {\n      accessToken: refreshResult.access_token,\n      refreshToken: newRefreshToken,\n      idToken: refreshResult.id_token,\n      expiresAt,\n      lastActivity: Date.now(),\n    });\n\n    return {\n      success: true,\n      tokens: {\n        access_token: refreshResult.access_token,\n        refresh_token: newRefreshToken,\n        id_token: refreshResult.id_token,\n        expires_in: refreshResult.expires_in,\n      },\n    };\n  } catch (error) {\n    logger.error('Token refresh failed with exception', error instanceof Error ? error : undefined);\n\n    return {\n      success: false,\n      error: getOAuthErrorMessage(error),\n      // A failed refresh leaves the current access token untrusted. Callers\n      // must clear the local session instead of continuing with stale auth.\n      shouldLogout: true,\n    };\n  }\n}\n\n// Re-export session validation\nexport { isSessionValid };\n\n/**\n * Clear auth server cache (useful for testing)\n */\nexport function clearAuthServerCache(): void {\n  authServerCache = null;\n  jwksCache.clear();\n}\n","/**\n * Route Protection Server Module\n * \n * Provides route protection utilities for different authentication levels.\n */\n\nimport { getUser, requireAuth, refreshTokens, login, logout } from './auth.server';\nimport { getAuthSession } from './redis-session-storage.server';\nimport type { ProtectionLevel, UserInfo } from './types';\nimport { logger } from '../logging';\nimport { createRedirectResponse } from '../http/response';\n\n// Refresh shortly before expiry. Keep this below common 5-minute access-token\n// lifetimes so a freshly issued token does not refresh again immediately.\nconst REFRESH_THRESHOLD = resolveRefreshThreshold();\n\nfunction resolveRefreshThreshold(): number {\n  const configured = Number(process.env.OIDC_REFRESH_THRESHOLD_MS);\n  return Number.isFinite(configured) && configured > 0 ? configured : 60_000;\n}\n\n/**\n * Check if token needs refresh\n */\nexport async function shouldRefreshToken(request: Request): Promise<boolean> {\n  try {\n    const sessionData = await getAuthSession(request);\n    const now = Date.now();\n    const sessionExpired =\n      typeof sessionData.expiresAt === 'number' && now >= sessionData.expiresAt;\n\n    if (!sessionData.refreshToken || sessionData.refreshToken.length === 0) {\n      if (sessionExpired) {\n        logger.info('Token expired and no refresh token, forcing local application logout');\n        const logoutRequest = await createAutomaticLogoutRequest(request, 'expired-no-refresh-token');\n        throw await logout(logoutRequest);\n      }\n      return false;\n    }\n\n    if (!sessionData.expiresAt || !sessionData.accessToken) {\n      return false;\n    }\n\n    // Check JWT expiry\n    let jwtExpiry: number | null = null;\n    try {\n      const tokenParts = sessionData.accessToken.split('.');\n      if (tokenParts.length === 3) {\n        const payload = JSON.parse(Buffer.from(tokenParts[1], 'base64').toString());\n        if (payload.exp) {\n          jwtExpiry = payload.exp * 1000;\n        }\n      }\n    } catch {\n      // Ignore JWT decode errors\n    }\n\n    const earliestExpiry = jwtExpiry && jwtExpiry < sessionData.expiresAt \n      ? jwtExpiry \n      : sessionData.expiresAt;\n    const timeUntilEarliestExpiry = earliestExpiry - now;\n\n    return timeUntilEarliestExpiry <= REFRESH_THRESHOLD;\n  } catch (error) {\n    // A redirect is the security boundary for expired sessions. Never turn it\n    // into a `false` result, otherwise protected loaders can continue with the\n    // stale Redis session after automatic logout was requested.\n    if (error instanceof Response) {\n      throw error;\n    }\n\n    logger.error('Error checking token refresh', error instanceof Error ? error : undefined);\n    throw error;\n  }\n}\n\n/**\n * Auto-refresh tokens if needed\n */\nasync function autoRefreshTokens(request: Request): Promise<void> {\n  try {\n    const needsRefresh = await shouldRefreshToken(request);\n\n    if (needsRefresh) {\n      logger.info('Auto-refreshing tokens due to expiry');\n      const result = await refreshTokens(request);\n\n      if (result.success && result.tokens?.access_token) {\n        logger.info('Auto-refresh completed successfully');\n      } else {\n        logger.error('Auto-refresh failed', undefined, {\n          error: result.error ?? 'Refresh response did not include an access token',\n        });\n\n        // Any failed refresh must fail closed. Keeping the expired session\n        // usable (even when a provider error is classified as transient) lets\n        // callers continue with an access token that the provider rejected.\n        logger.error('Refresh token unusable, forcing local application logout');\n        const logoutRequest = await createAutomaticLogoutRequest(request, 'refresh-failed');\n        throw await logout(logoutRequest);\n      }\n    }\n  } catch (error) {\n    if (error instanceof Response && error.status >= 300 && error.status < 400) {\n      throw error;\n    }\n    throw error;\n  }\n}\n\n/**\n * Identity context check configuration\n */\nexport interface DefaultRouteIdentityContext {\n  hasAnyMembership: boolean;\n  hasEntitlement?: boolean;\n  /** @deprecated Use hasEntitlement or app-specific fields instead. */\n  hasSubscription: boolean;\n  isOnboarded: boolean;\n}\n\nexport interface IdentityContextChecker<TIdentityContext = DefaultRouteIdentityContext> {\n  getIdentityContext: (\n    request: Request,\n    userId: string,\n    forceRefresh?: boolean\n  ) => Promise<DefaultRouteIdentityContext & TIdentityContext>;\n}\n\n/**\n * Tenant checker configuration\n */\nexport interface TenantChecker {\n  getCurrentTenant: (request: Request) => Promise<string | null>;\n  initializeTenant: (request: Request) => Promise<{ headers: Headers; tenantId: string } | null>;\n}\n\n/**\n * Legacy subscription checker configuration\n *\n * @deprecated Put entitlement policy in resolveRoute or app-level route loaders.\n */\nexport interface SubscriptionChecker {\n  checkTenantSubscriptionStatus: (request: Request, tenantId: string) => Promise<boolean>;\n}\n\nexport interface RouteProtectionRedirect {\n  location: string;\n  headers?: HeadersInit;\n  status?: number;\n}\n\nexport interface AutomaticLogoutRequestContext {\n  request: Request;\n  reason: 'expired-no-refresh-token' | 'refresh-failed';\n}\n\nexport interface LoginReturnUrlContext {\n  request: Request;\n  currentPath: string;\n  protection: ProtectionLevel;\n}\n\nexport interface RouteProtectionResolverContext<TIdentityContext = DefaultRouteIdentityContext> {\n  request: Request;\n  user: UserInfo;\n  currentPath: string;\n  protection: ProtectionLevel;\n  getIdentityContext: (forceRefresh?: boolean) => Promise<TIdentityContext | null>;\n  getCurrentTenant: () => Promise<string | null>;\n  initializeTenant: () => Promise<{ headers: Headers; tenantId: string } | null>;\n}\n\nexport interface RouteProtectionErrorHandlerContext<TIdentityContext = DefaultRouteIdentityContext>\n  extends RouteProtectionResolverContext<TIdentityContext> {\n  error: unknown;\n}\n\n/**\n * Route protection configuration\n */\nexport interface RouteProtectionConfig<TIdentityContext = DefaultRouteIdentityContext> {\n  identityChecker?: IdentityContextChecker<TIdentityContext>;\n  tenantChecker?: TenantChecker;\n  subscriptionChecker?: SubscriptionChecker;\n  resolveRoute?: (\n    context: RouteProtectionResolverContext<TIdentityContext>\n  ) => Promise<RouteProtectionRedirect | null | void> | RouteProtectionRedirect | null | void;\n  handleRouteError?: (\n    context: RouteProtectionErrorHandlerContext<TIdentityContext>\n  ) => Promise<RouteProtectionRedirect | null | void> | RouteProtectionRedirect | null | void;\n  getLoginReturnUrl?: (context: LoginReturnUrlContext) => string;\n  createAutomaticLogoutRequest?: (\n    context: AutomaticLogoutRequestContext\n  ) => Promise<Request> | Request;\n}\n\nlet protectionConfig: RouteProtectionConfig<any> = {};\n\n/**\n * Configure route protection with identity, tenant, and app policy checkers\n */\nexport function configureRouteProtection<TIdentityContext = DefaultRouteIdentityContext>(\n  config: RouteProtectionConfig<TIdentityContext>\n): void {\n  protectionConfig = config;\n}\n\n/**\n * Reset route protection to its built-in defaults.\n */\nexport function resetRouteProtectionConfig(): void {\n  protectionConfig = {};\n}\n\nfunction createRedirectFromConfig(redirect: RouteProtectionRedirect): Response {\n  return createRedirectResponse(redirect.location, {\n    headers: redirect.headers,\n    status: redirect.status,\n  });\n}\n\nfunction getLoginReturnUrl(\n  request: Request,\n  currentPath: string,\n  protection: ProtectionLevel\n): string {\n  if (protectionConfig.getLoginReturnUrl) {\n    return protectionConfig.getLoginReturnUrl({\n      request,\n      currentPath,\n      protection,\n    });\n  }\n\n  switch (protection) {\n    case 'onboarding-required':\n    case 'subscription-required':\n    case 'public':\n    case 'auth':\n    default: {\n      const url = new URL(request.url);\n      return url.pathname === '/' ? '/' : `${url.pathname}${url.search}`;\n    }\n  }\n}\n\nasync function createAutomaticLogoutRequest(\n  request: Request,\n  reason: AutomaticLogoutRequestContext['reason']\n): Promise<Request> {\n  if (protectionConfig.createAutomaticLogoutRequest) {\n    return protectionConfig.createAutomaticLogoutRequest({ request, reason });\n  }\n\n  const logoutUrl = new URL(request.url);\n  logoutUrl.pathname = '/auth/logout';\n  logoutUrl.searchParams.set('logout', 'local');\n\n  return new Request(logoutUrl.toString(), {\n    headers: request.headers,\n  });\n}\n\nfunction createRouteResolverContext(\n  request: Request,\n  user: UserInfo,\n  currentPath: string,\n  protection: ProtectionLevel\n): RouteProtectionResolverContext<any> {\n  let identityContextPromise: Promise<any | null> | null = null;\n  let currentTenantPromise: Promise<string | null> | null = null;\n  let initializeTenantPromise: Promise<{ headers: Headers; tenantId: string } | null> | null = null;\n\n  return {\n    request,\n    user,\n    currentPath,\n    protection,\n    getIdentityContext: async (forceRefresh = false) => {\n      if (!protectionConfig.identityChecker) {\n        return null;\n      }\n\n      if (forceRefresh) {\n        return protectionConfig.identityChecker.getIdentityContext(request, user.sub, true);\n      }\n\n      if (!identityContextPromise) {\n        identityContextPromise = protectionConfig.identityChecker.getIdentityContext(request, user.sub);\n      }\n\n      return identityContextPromise;\n    },\n    getCurrentTenant: async () => {\n      if (!protectionConfig.tenantChecker) {\n        return null;\n      }\n\n      if (!currentTenantPromise) {\n        currentTenantPromise = protectionConfig.tenantChecker.getCurrentTenant(request);\n      }\n\n      return currentTenantPromise;\n    },\n    initializeTenant: async () => {\n      if (!protectionConfig.tenantChecker) {\n        return null;\n      }\n\n      if (!initializeTenantPromise) {\n        initializeTenantPromise = protectionConfig.tenantChecker.initializeTenant(request);\n      }\n\n      return initializeTenantPromise;\n    },\n  };\n}\n\nasync function applyConfiguredRouteResolution(\n  request: Request,\n  user: UserInfo,\n  currentPath: string,\n  protection: ProtectionLevel\n): Promise<boolean> {\n  if (!protectionConfig.resolveRoute) {\n    return false;\n  }\n\n  const context = createRouteResolverContext(request, user, currentPath, protection);\n\n  try {\n    const result = await protectionConfig.resolveRoute(context);\n    if (result) {\n      throw createRedirectFromConfig(result);\n    }\n\n    return true;\n  } catch (error) {\n    if (error instanceof Response && error.status >= 300 && error.status < 400) {\n      throw error;\n    }\n\n    if (!protectionConfig.handleRouteError) {\n      throw error;\n    }\n\n    const recovery = await protectionConfig.handleRouteError({\n      ...context,\n      error,\n    });\n\n    if (recovery) {\n      throw createRedirectFromConfig(recovery);\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Main route protection function\n */\nexport async function protectRoute<T>(\n  request: Request,\n  protection: ProtectionLevel,\n  loaderFn: (user?: UserInfo) => Promise<T> | T\n): Promise<T> {\n  const url = new URL(request.url);\n\n  switch (protection) {\n    case 'public':\n      try {\n        await autoRefreshTokens(request);\n        const user = await getUser(request);\n        return loaderFn(user ?? undefined);\n      } catch (error) {\n        if (error instanceof Response && error.status >= 300 && error.status < 400) {\n          throw error;\n        }\n        return loaderFn(undefined);\n      }\n\n    case 'auth':\n    case 'policy':\n      try {\n        await autoRefreshTokens(request);\n        const user = await requireAuth(request);\n        await applyConfiguredRouteResolution(request, user, url.pathname, protection);\n        return loaderFn(user);\n      } catch (error) {\n        if (error instanceof Response && error.status >= 300 && error.status < 400) {\n          throw error;\n        }\n        throw await login(request, getLoginReturnUrl(request, url.pathname, protection));\n      }\n\n    case 'onboarding-required':\n      try {\n        await autoRefreshTokens(request);\n        const user = await requireAuth(request);\n\n        await applyConfiguredRouteResolution(\n          request,\n          user,\n          url.pathname,\n          'onboarding-required'\n        );\n\n        return loaderFn(user);\n      } catch (error) {\n        if (error instanceof Response && error.status >= 300 && error.status < 400) {\n          throw error;\n        }\n        throw await login(request, getLoginReturnUrl(request, url.pathname, 'onboarding-required'));\n      }\n\n    case 'subscription-required':\n      try {\n        await autoRefreshTokens(request);\n        const user = await requireAuth(request);\n\n        await applyConfiguredRouteResolution(\n          request,\n          user,\n          url.pathname,\n          'subscription-required'\n        );\n\n        // Initialize tenant if needed\n        if (protectionConfig.tenantChecker) {\n          const currentTenant = await protectionConfig.tenantChecker.getCurrentTenant(request);\n          if (!currentTenant) {\n            await protectionConfig.tenantChecker.initializeTenant(request);\n          }\n        }\n\n        return loaderFn(user);\n      } catch (error) {\n        if (error instanceof Response && error.status >= 300 && error.status < 400) {\n          throw error;\n        }\n        throw await login(request, getLoginReturnUrl(request, url.pathname, 'subscription-required'));\n      }\n\n    default:\n      throw new Error(`Unknown protection level: ${protection}`);\n  }\n}\n\n// ============================================================================\n// Convenience Functions\n// ============================================================================\n\n/**\n * Public route (optional auth)\n */\nexport const publicRoute = <T>(\n  request: Request,\n  loaderFn: (user?: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'public', loaderFn);\n\n/**\n * Auth-protected route\n */\nexport const authRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'auth', loaderFn as (user?: UserInfo) => Promise<T> | T);\n\n/**\n * Generic policy-protected route. Apps define policy in configureRouteProtection.\n */\nexport const policyRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'policy', loaderFn as (user?: UserInfo) => Promise<T> | T);\n\n/**\n * Alias for auth-protected routes.\n */\nexport const protectedRoute = authRoute;\n\n/**\n * Setup policy route\n *\n * @deprecated Use policyRoute with configureRouteProtection instead.\n */\nexport const onboardingRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'onboarding-required', loaderFn as (user?: UserInfo) => Promise<T> | T);\n\n/**\n * Entitlement policy route\n *\n * @deprecated Use policyRoute with configureRouteProtection instead.\n */\nexport const subscriptionRoute = <T>(\n  request: Request,\n  loaderFn: (user: UserInfo) => Promise<T> | T\n) => protectRoute(request, 'subscription-required', loaderFn as (user?: UserInfo) => Promise<T> | T);\n","/**\n * Token Refresh Server Module\n */\n\nimport { refreshTokens } from './auth.server';\nimport { getAuthSession } from './redis-session-storage.server';\nimport type { TokenRefreshResult } from './types';\nimport { logger } from '../logging';\n\n/**\n * Attempt to refresh the access token\n */\nexport async function attemptTokenRefresh(request: Request): Promise<TokenRefreshResult> {\n  try {\n    logger.info('Attempting token refresh due to 401 response');\n\n    const sessionData = await getAuthSession(request);\n\n    if (!sessionData.refreshToken) {\n      logger.warn('No refresh token available in session');\n      return {\n        success: false,\n        error: 'No refresh token available',\n        shouldLogout: true,\n      };\n    }\n\n    const refreshResult = await refreshTokens(request, sessionData.refreshToken);\n\n    if (!refreshResult.success) {\n      logger.error('Token refresh failed', undefined, {\n        error: refreshResult.error,\n        shouldLogout: refreshResult.shouldLogout,\n      });\n\n      return {\n        success: false,\n        error: refreshResult.error,\n        // A failed provider refresh must never leave the caller authorized by\n        // the stale access token, even when the provider error was not marked\n        // as a permanent logout condition.\n        shouldLogout: true,\n      };\n    }\n\n    const tokens = refreshResult.tokens;\n    if (!tokens || !tokens.access_token) {\n      logger.error('Token refresh succeeded but no access token returned');\n      return {\n        success: false,\n        error: 'No access token in refresh response',\n        shouldLogout: true,\n      };\n    }\n\n    logger.info('Token refresh successful');\n\n    return {\n      success: true,\n      newAccessToken: tokens.access_token,\n    };\n  } catch (error) {\n    logger.error('Token refresh attempt failed', error instanceof Error ? error : undefined);\n    return {\n      success: false,\n      error: error instanceof Error ? error.message : 'Unknown error',\n      shouldLogout: true,\n    };\n  }\n}\n\n/**\n * Check if a response indicates token expiration\n */\nexport function isTokenExpiredResponse(response: Response): boolean {\n  return response.status === 401;\n}\n\n/**\n * Check if token refresh should be attempted\n */\nexport function shouldAttemptTokenRefresh(response: Response, hasAuth: boolean): boolean {\n  return hasAuth && isTokenExpiredResponse(response);\n}\n"],"mappings":";;;;;;;;AAYA,SAAgB,uBACd,UACA,OAA6B,CAAC,GACpB;CACV,MAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;CACxC,QAAQ,IAAI,YAAY,QAAQ;CAEhC,OAAO,IAAI,SAAS,MAAM;EACxB,QAAQ,KAAK,UAAU;EACvB;CACF,CAAC;AACH;;;ACrBA,MAAM,yDAAyC,IAAI,IAAI;CACrD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,8DAA8C,IAAI,IAAI;CAC1D;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,qCACP,KACA,cACA,iBACS;CACT,MAAM,aAAa,IAAI,YAAY;CACnC,OAAO,aAAa,IAAI,UAAU,KAAK,gBAAgB,MAAM,WAAW,WAAW,WAAW,MAAM,CAAC;AACvG;AAEA,SAAgB,qCACd,QACA,UAAgF,CAAC,GACzD;CACxB,IAAI,CAAC,QACH,OAAO,CAAC;CAGV,MAAM,+BAAe,IAAI,IAAI,CAC3B,GAAG,6CACH,IAAI,QAAQ,uBAAuB,CAAC,EAAA,CAAG,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,OAAO,CAChG,CAAC;CACD,MAAM,mBAAmB,QAAQ,0BAA0B,CAAC,EAAA,CACzD,KAAK,WAAW,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAC5C,OAAO,OAAO;CACjB,MAAM,YAAoC,CAAC;CAE3C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;EACjD,MAAM,gBAAgB,IAAI,KAAK;EAC/B,IACE,cAAc,WAAW,KACzB,uCAAuC,IAAI,cAAc,YAAY,CAAC,KACtE,CAAC,qCAAqC,eAAe,cAAc,eAAe,KAClF,UAAU,QACV,UAAU,KAAA,GAEV;EAGF,MAAM,kBAAkB,OAAO,KAAK,CAAC,CAAC,KAAK;EAC3C,IAAI,gBAAgB,WAAW,GAC7B;EAGF,UAAU,iBAAiB;CAC7B;CAEA,OAAO;AACT;AAEA,SAAgB,yCACd,SAC+B;CAC/B,IAAI,CAAC,SACH,OAAO;CAGT,MAAM,aAAqC,CAAC;CAE5C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;EAClD,MAAM,gBAAgB,IAAI,KAAK;EAC/B,IACE,cAAc,WAAW,KACzB,uCAAuC,IAAI,cAAc,YAAY,CAAC,KACtE,UAAU,QACV,UAAU,KAAA,GAEV;EAGF,MAAM,kBAAkB,OAAO,KAAK,CAAC,CAAC,KAAK;EAC3C,IAAI,gBAAgB,WAAW,GAC7B;EAGF,WAAW,iBAAiB;CAC9B;CAEA,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,SAAS,IAAI,aAAa;AAC3D;AAEA,SAAgB,wBACd,WACA,oBACQ;CACR,MAAM,oBAAoB,yCAAyC,kBAAkB;CACrF,IAAI,CAAC,mBACH,OAAO;CAGT,OAAO,GAAG,UAAU,GAAG,OAAO,KAAK,KAAK,UAAU,iBAAiB,GAAG,MAAM,CAAC,CAAC,SAAS,WAAW;AACpG;;;ACjHA,MAAM,kCAAkB,IAAI,IAAI;CAAC;CAAe;CAAkB;AAAc,CAAC;AAEjF,SAAS,eAAe,MAAuB;CAC7C,MAAM,aAAa,KAAK,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,QAAQ,EAAE,KAAK;CAC3E,OAAO,gBAAgB,IAAI,UAAU;AACvC;AAEA,SAAS,yBAAyB,OAAwB;CACxD,MAAM,aAAa,MAAM,UAAU;CACnC,OACE,WAAW,WAAW,IAAI,KAC1B,WAAW,WAAW,KAAK,KAC3B,WAAW,WAAW,IAAI;AAE9B;AAEA,SAAS,gCAAgC,OAAwB;CAC/D,MAAM,uBAAuB,MAAM,OAAO,MAAM;CAChD,IAAI,UAAU,yBAAyB,KACnC,QACA,MAAM,MAAM,GAAG,oBAAoB;CAEvC,KAAK,IAAI,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;EAC/C,IAAI,yBAAyB,OAAO,GAClC,OAAO;EAGT,IAAI;GACF,MAAM,OAAO,mBAAmB,OAAO;GACvC,IAAI,SAAS,SACX,OAAO;GAET,UAAU;EACZ,QAAQ;GACN,OAAO;EACT;CACF;CAEA,OAAO,yBAAyB,OAAO;AACzC;;;;;;;;AASA,SAAgB,uBACd,WACA,SACe;CACf,IAAI,CAAC,aAAa,gCAAgC,SAAS,GACzD,OAAO;CAGT,IAAI;EACF,MAAM,gBAAgB,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC;EAE3C,MAAM,eADc,UAAU,WAAW,GAAG,KAAK,CAAC,UAAU,WAAW,IAAI,IAEvE,IAAI,IAAI,WAAW,aAAa,IAChC,IAAI,IAAI,SAAS;EAErB,IAAI,aAAa,WAAW,eAC1B,OAAO;EAGT,MAAM,WAAW,GAAG,aAAa,WAAW,aAAa,SAAS,aAAa;EAC/E,OAAO,eAAe,QAAQ,IAAI,OAAO;CAC3C,QAAQ;EACN,OAAO;CACT;AACF;;AAOA,SAAgB,6BACd,MACA,OACA,SACQ;CACR,MAAM,WAAW;EACf,GAAG,KAAK,GAAG,mBAAmB,KAAK;EACnC;EACA;EACA;EACA,WAAW,QAAQ;CACrB;CAEA,IAAI,QAAQ,IAAI,aAAa,cAC3B,SAAS,KAAK,QAAQ;CAGxB,OAAO,SAAS,KAAK,IAAI;AAC3B;;;AC/EA,MAAa,4BAA4B;CACvC,kBAAkB;CAClB,eAAe;CACf,mBAAmB;CACnB,yBAAyB;CACzB,qBAAqB;CACrB,uBAAuB;CACvB,cAAc;CACd,oBAAoB;AACtB;AAKA,MAAM,6BAA6B,OAAO,IACxC,qCACF;AAEA,SAAS,2BAA2B,OAAmD;CACrF,OAAO,OAAO,UAAU,YAAY,OAAO,OAAO,yBAAyB,CAAC,CAAC,SAC3E,KACF;AACF;AAEA,SAAS,cAAc,OAAkC;CACvD,OAAO,UAAU,QAAQ,OAAO,UAAU,YACxC,OAAQ,MAAkB,QAAQ,cAClC,OAAQ,MAAkB,WAAW;AACzC;AAEA,SAASA,qBAAmB,SAA4B;CACtD,MAAM,eAAgB,QAEnB;CACH,IAAI,cACF,OAAO,aAAa,KAAK,OAAO;CAGlC,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,QAAkB,SAAS,CAAC,MAAM,WAAW;EACtE,IAAI,KAAK,YAAY,MAAM,cACzB,QAAQ,KAAK,KAAK;EAEpB,OAAO;CACT,GAAG,CAAC,CAAC;AACP;;;;;;;;;AAUA,IAAa,qBAAb,cAAwC,MAAM;CAC5C;CACA;CACA;CAEA,YACE,MACA,iBAA8B,CAAC,GAC/B;EACA,MAAM,uBAAuB;EAC7B,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,iBAAiB,IAAI,QAAQ,cAAc;EAChD,KAAK,oBAAoBA,qBAAmB,KAAK,cAAc;EAE/D,OAAO,eAAe,MAAM,4BAA4B;GACtD,cAAc;GACd,YAAY;GACZ,OAAO;GACP,UAAU;EACZ,CAAC;CACH;AACF;;;;AAKA,SAAgB,qBAAqB,OAA6C;CAChF,IAAI,iBAAiB,oBACnB,OAAO;CAGT,IAAI,UAAU,QAAQ,OAAO,UAAU,UACrC,OAAO;CAGT,MAAM,YAAY;CAClB,OAAO,UAAU,gCAAgC,QAC/C,2BAA2B,UAAU,IAAI,KACzC,cAAc,UAAU,cAAc;AAC1C;;;;;AAMA,SAAgB,gCAAgC,OAAyB;CACvE,OAAO,qBAAqB,KAAK,KAAK,MAAM,SAAS;AACvD;;;;;;;;;;AC/FA,MAAa,6BAA6B,GAAG,yBAAyB;AAsBtE,SAASC,eAAa,OAAuB;CAC3C,OAAO,MAAM,QAAQ,uBAAuB,MAAM;AACpD;AAEA,SAAS,eAAe,SAAiC;CACvD,MAAM,UAAU,QAAQ,QAAQ,IAAI,QAAQ;CAC5C,IAAI,CAAC,SACH,OAAO;CAGT,MAAM,cAAc,IAAI,OACtB,cAAcA,eAAa,0BAA0B,EAAE,SACzD;CACA,MAAM,WAAW,QAAQ,MAAM,WAAW,CAAC,GAAG;CAC9C,IAAI,CAAC,UACH,OAAO;CAGT,IAAI;EACF,MAAM,QAAQ,mBAAmB,QAAQ;EACzC,OAAO,MAAM,SAAS,IAAI,QAAQ;CACpC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,UAAU,SAA2B;CAC5C,MAAM,UAAU,QAAQ,QAAQ,IAAI,QAAQ;CAC5C,IAAI,CAAC,SACH,OAAO;CAGT,OAAO,QAAQ,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS;EACvC,MAAM,YAAY,KAAK,QAAQ,GAAG;EAClC,OAAO,YAAY,KACjB,KAAK,MAAM,GAAG,SAAS,CAAC,CAAC,KAAK,MAAM;CACxC,CAAC;AACH;AAEA,MAAM,4BAA4B;AAElC,SAAS,oBAAoB,UAA0B;CACrD,MAAM,YAAY,SAAS,KAAK;CAChC,MAAM,qBAAqB,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,cAAc;EACnE,MAAM,OAAO,UAAU,WAAW,CAAC;EACnC,OAAO,QAAQ,MAAQ,SAAS,OAAQ,cAAc;CACxD,CAAC;CACD,IACE,UAAU,WAAW,KACrB,CAAC,UAAU,WAAW,GAAG,KACzB,UAAU,WAAW,IAAI,KACzB,oBAEA,OAAO;CAGT,OAAO;AACT;;;;;;AAOA,SAAgB,2BACd,QACQ;CACR,IAAI;EASF,OAAO,qBARK,kBAAkB,UAC1B,IAAI,IAAI,OAAO,GAAG,IAClB,kBAAkB,MAChB,SACA,IAAI,IACJ,QACA,OAAO,WAAW,GAAG,IAAI,uBAAuB,KAAA,CAClD,EAAA,CAC2B,QAAQ;CACzC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,wBACP,QACA,QACA,cACQ;CACR,MAAM,WAAW;EACf,GAAG,2BAA2B,GAAG,mBAAmB,MAAM;EAC1D,QAAQ;EACR;EACA;EACA,WAAW;CACb;CAEA,IAAI,QAAQ,IAAI,aAAa,cAC3B,SAAS,KAAK,QAAQ;CAGxB,OAAO,SAAS,KAAK,IAAI;AAC3B;AAEA,SAAS,0BAA0B,SAAkB,cAA4B;CAC/E,QAAQ,OACN,cACA,wBAAwB,IAAI,GAAG,YAAY,CAC7C;AACF;AAEA,SAAS,mBAAmB,SAA4B;CACtD,MAAM,eAAgB,QAEnB;CACH,IAAI,cACF,OAAO,aAAa,KAAK,OAAO;CAGlC,OAAO,MAAM,KAAK,OAAO,CAAC,CACvB,QAAQ,CAAC,UAAU,KAAK,YAAY,MAAM,YAAY,CAAC,CACvD,KAAK,GAAG,WAAW,KAAK;AAC7B;;;;;AAMA,SAAgB,gCACd,QACS;CACT,MAAM,UAAU,IAAI,QAAQ;CAC5B,0BAA0B,SAAS,2BAA2B,MAAM,CAAC;CACrE,OAAO;AACT;AAEA,SAAS,iBAAiB,KAAU,MAAuB;CACzD,OAAO,IAAI,aAAa,IAAI,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,SAAS,OAAO;AAC5D;;;;;;AAOA,SAAgB,gCAAgC,SAA2B;CACzE,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAC/B,OAAO,iBAAiB,KAAK,MAAM,KACjC,iBAAiB,KAAK,OAAO,KAC7B,CAAC,IAAI,aAAa,IAAI,OAAO,KAC7B,CAAC,IAAI,aAAa,IAAI,WAAW,KACjC,CAAC,IAAI,aAAa,IAAI,kBAAkB;AAC5C;AAEA,SAAS,iBAAiB,OAIxB;CACA,IAAI,UAAU,QAAQ,OAAO,UAAU,UACrC,OAAO;CAGT,MAAM,SAAS;CACf,OAAO,OAAO,OAAO,UAAU,YAC7B,OAAO,MAAM,SAAS,KACtB,OAAO,OAAO,cAAc,YAC5B,OAAO,OAAO,cAAc,YAC5B,OAAO,SAAS,OAAO,SAAS;AACpC;AAEA,SAAS,iBAAiB,SAAiC;CACzD,MAAM,QAAQ,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,aAAa,IAAI,OAAO;CAC3D,OAAO,SAAS,MAAM,KAAK,CAAC,CAAC,SAAS,IAAI,QAAQ;AACpD;;;;;;AAOA,eAAsB,4BACpB,SACA,OACA,aACmC;CACnC,MAAM,YAAY,uBAAuB,MAAM,WAAW,OAAO,KAAK;CACtE,MAAM,eAAe,2BAA2B,WAAW;CAC3D,MAAM,SAAS,MAAM,0BAA0B;EAC7C,OAAO,MAAM;EACb;EACA,WAAW,KAAK,IAAI;CACtB,CAAC;CAED,OAAO;EACL;EACA,QAAQ,wBACN,QACA,4BACA,YACF;CACF;AACF;;;;;;AAOA,eAAsB,+BAA+B,SAAoC;CACvF,MAAM,SAAS,eAAe,OAAO;CACrC,MAAM,UAAU,IAAI,QAAQ;CAC5B,IAAI,CAAC,UAAU,OAAO,GACpB,OAAO;CAGT,IAAI,QACF,MAAM,0BAA0B,MAAM;CAExC,0BAA0B,SAAS,2BAA2B,OAAO,CAAC;CACtE,OAAO;AACT;;;;;;;;;AAUA,eAAsB,2BACpB,SACA,eACqC;CACrC,MAAM,iBAAiB,gCAAgC,OAAO;CAC9D,MAAM,oBAAoB,mBAAmB,cAAc;CAE3D,IACE,CAAC,gCAAgC,aAAa,KAC9C,CAAC,gCAAgC,OAAO,GAExC,OAAO;EAAE,QAAQ;EAAM;EAAgB;CAAkB;CAG3D,MAAM,SAAS,eAAe,OAAO;CACrC,MAAM,gBAAgB,iBAAiB,OAAO;CAC9C,IAAI,CAAC,UAAU,CAAC,eACd,OAAO;EAAE,QAAQ;EAAM;EAAgB;CAAkB;CAG3D,IAAI;CACJ,IAAI;EACF,SAAS,MAAM,2BAA2B,QAAQ,aAAa;CACjE,SAAS,OAAO;EACd,OAAO,KAAK,+CAA+C,EACzD,WAAW,iBAAiB,QAAQ,MAAM,OAAO,eACnD,CAAC;EACD,OAAO;GAAE,QAAQ;GAAM;GAAgB;EAAkB;CAC3D;CAEA,IAAI,CAAC,iBAAiB,MAAM,GAC1B,OAAO;EAAE,QAAQ;EAAM;EAAgB;CAAkB;CAG3D,MAAM,MAAM,KAAK,IAAI,IAAI,OAAO;CAChC,IAAI,MAAM,KAAK,MAAM,uBACnB,OAAO;EAAE,QAAQ;EAAM;EAAgB;CAAkB;CAG3D,MAAM,YAAY,uBAAuB,OAAO,WAAW,OAAO;CAClE,IAAI,CAAC,WACH,OAAO;EAAE,QAAQ;EAAM;EAAgB;CAAkB;CAG3D,OAAO;EACL,QAAQ,EAAE,UAAU;EACpB;EACA;CACF;AACF;;;;;;;;;;;;;;;;ACvPA,SAAS,2BAA2B,QAA6B;CAE/D,IAAI,OAAO,mBAAmB,KAAA,GAC5B,OAAO,OAAO;CAIhB,QAAQ,OAAO,iBAAf;EACE,KAAK;EACL,KAAK,aACH,OAAO;EACT,KAAK;EACL,KAAK,cACH,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;AAKA,SAAS,mBAA+B;CACtC,MAAM,kBAAkB;EACtB,WAAW,QAAQ,IAAI;EACvB,UAAU,QAAQ,IAAI;EACtB,aAAa,QAAQ,IAAI;CAC3B;CAEA,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,eAAe,GACvD,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,+CAA+C,IAAI,YAAY,GAAG;CAKtF,MAAM,aAAa,QAAQ,IAAI,uBAAuB,YAAY;CAClE,IAAI,kBAAmC;CACvC,IAAI,eAAe,qBAAqB,eAAe,mBACrD,kBAAkB;MACb,IAAI,eAAe,kBAAkB,eAAe,gBACzD,kBAAkB;MACb,IAAI,eAAe,aACxB,kBAAkB;MACb,IAAI,eAAe,gBAAgB,eAAe,cACvD,kBAAkB;CAGpB,MAAM,mBAAmB,0BACvB,QAAQ,IAAI,yBACZ,QAAQ,IAAI,qBAAqB,uBAAuB,MAC1D;CAEA,MAAM,iBAAiB,QAAQ,IAAI,0BAA0B,KAAA,IACzD,QAAQ,IAAI,0BAA0B,SACtC,KAAA;CAEJ,OAAO;EACL,WAAW,gBAAgB;EAC3B,UAAU,gBAAgB;EAC1B,cAAc,QAAQ,IAAI;EAC1B;EACA,aAAa,gBAAgB;EAC7B,OAAO,QAAQ,IAAI,cAAc;EACjC,uBAAuB,QAAQ,IAAI;EACnC;EACA;CACF;AACF;AAEA,SAAS,0BACP,OACA,UACsB;CAGtB,QAFmB,OAAO,KAAK,CAAC,CAAC,YAAY,GAE7C;EACE,KAAK,KAAA;EACL,KAAK,IACH,OAAO;EACT,KAAK,QACH,OAAO;EACT,KAAK;EACL,KAAK,QACH,OAAO;EACT,KAAK;EACL,KAAK,SACH,OAAO;EACT,SACE,MAAM,IAAI,MAAM,wCAAwC,OAAO;CACnE;AACF;AAEA,IAAI,cAAiC;AAErC,SAAS,gBAA4B;CACnC,IAAI,CAAC,aACH,cAAc,iBAAiB;CAEjC,OAAO;AACT;AAMA,IAAI,kBAGO;AAEX,MAAM,YAAY,OAAU;AAC5B,MAAM,4BAAY,IAAI,IAAmD;AAEzE,MAAM,wDAAwC,IAAI,IAAI;CACpDC,OAAW,kBAAkB;CAC7BA,OAAW,iBAAiB;CAC5BA,OAAW,kBAAkB;CAC7BA,OAAW,WAAW;CACtBA,OAAW,+BAA+B;CAC1CA,OAAW,yBAAyB;CACpCA,OAAW,WAAW;CACtBA,OAAW,WAAW;AACxB,CAAC;AAED,IAAM,qCAAN,cAAiD,MAAM;CACrD,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;AAEA,SAAS,qCAAqC,OAAyB;CACrE,IAAI,iBAAiB,oCACnB,OAAO;CAGT,OAAO,iBAAiBA,OAAW,aACjC,sCAAsC,IAAI,MAAM,IAAI;AACxD;AAEA,SAAS,gBAAgB,OAA0C;CACjE,MAAM,aAAa,OAAO,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE;CACnD,OAAO,cAAc,WAAW,SAAS,IAAI,aAAa;AAC5D;AAEA,SAAS,aAAa,OAA2D;CAC/E,IAAI,CAAC,OACH,OAAO;CAGT,IAAI;EACF,MAAM,GAAG,WAAW,MAAM,MAAM,GAAG;EACnC,IAAI,CAAC,SACH,OAAO;EAGT,OAAO,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;CACtE,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,aAAa,OAA0C;CAC9D,MAAM,SAAS,aAAa,KAAK,CAAC,EAAE;CACpC,OAAO,OAAO,WAAW,WAAW,gBAAgB,MAAM,IAAI;AAChE;AAEA,SAAS,kBAAkB,SAA6B,gBAAiC;CACvF,IAAI,CAAC,SACH,OAAO;CAGT,MAAM,cAAc,aAAa,OAAO;CACxC,OAAO,gBAAgB,QAAQ,gBAAgB,gBAAgB,cAAc;AAC/E;AAEA,SAAS,uCACP,WACA,QACA,QACQ;CACR,IAAI,CAAC,UAAU,CAAC,QACd,OAAO;CAGT,IAAI;EACF,MAAM,aAAa,UAAU,WAAW,GAAG,KAAK,CAAC,UAAU,WAAW,IAAI;EAC1E,MAAM,MAAM,IAAI,IAAI,WAAW,aAAa,uBAAuB,KAAA,CAAS;EAE5E,IAAI,QACF,IAAI,aAAa,IAAI,aAAa,MAAM;EAG1C,IAAI,QACF,IAAI,aAAa,IAAI,oBAAoB,MAAM;EAGjD,OAAO,aAAa,GAAG,IAAI,WAAW,IAAI,SAAS,IAAI,SAAS,IAAI,SAAS;CAC/E,QAAQ;EACN,MAAM,SAAS,IAAI,gBAAgB;EACnC,IAAI,QAAQ,OAAO,IAAI,aAAa,MAAM;EAC1C,IAAI,QAAQ,OAAO,IAAI,oBAAoB,MAAM;EAEjD,OAAO,GAAG,YADQ,UAAU,SAAS,GAAG,IAAI,MAAM,MAChB,OAAO,SAAS;CACpD;AACF;AAEA,SAAgB,+BAA+B,YAAoB,aAA0B;CAC3F,MAAM,cAAc,IAAI,IAAI,UAAU;CACtC,MAAM,2BAA2B,IAAI,IAAI,WAAW;CACpD,yBAAyB,SAAS,YAAY;CAC9C,yBAAyB,OAAO;CAChC,OAAO;AACT;AAEA,SAAS,sBAAsB,WAA4B;CACzD,IAAI;EACF,MAAM,SAAS,IAAI,IAAI,SAAS;EAChC,OACE,OAAO,aAAa,WACpB;GAAC;GAAa;GAAa;GAAO;EAAO,CAAC,CAAC,SAAS,OAAO,QAAQ;CAEvE,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,gCAAgC,WAA4B;CACnE,IAAI,QAAQ,IAAI,aAAa,cAC3B,OAAO;CAGT,IAAI,QAAQ,IAAI,iCAAiC,QAC/C,OAAO;CAGT,OAAO,sBAAsB,SAAS;AACxC;AAEA,SAAS,sBAAoD;CAG3D,OAAO,gCAFQ,cAE6B,CAAC,CAAC,SAAS,IACnD;EAAE,WAAW;EAAQ,SAAS,CAAC,KAAK,qBAAqB;CAAE,IAC3D,EAAE,WAAW,OAAO;AAC1B;AAEA,SAAS,kBAAkB,QAAwC;CACjE,OAAO,OAAO,qBAAqB,SAAS,KAAA,IAAY,OAAO;AACjE;AAEA,SAAS,wBAAwB,QAAqC;CACpE,QAAQ,OAAO,kBAAf;EACE,KAAK;GACH,IAAI,CAAC,OAAO,cACV,MAAM,IAAI,MAAM,uEAAuE;GAGzF,OAAO,KAAK,kBAAkB,OAAO,YAAY;EACnD,KAAK;GACH,IAAI,CAAC,OAAO,cACV,MAAM,IAAI,MAAM,sEAAsE;GAGxF,OAAO,KAAK,iBAAiB,OAAO,YAAY;EAElD,SACE,OAAO,KAAK,KAAK;CACrB;AACF;AAEA,SAAS,qBAAqB,OAAwB;CACpD,IAAI,iBAAiB,KAAK,mBACxB,OAAO,MAAM,qBAAqB,MAAM,SAAS,MAAM;CAGzD,IAAI,iBAAiB,OACnB,OAAO,MAAM;CAGf,OAAO;AACT;AAEA,SAAS,eAAe,KAAuB;CAK7C,MAAM,cAHJ,IAAI,aAAa,IAAI,QAAQ,KAC7B,IAAI,aAAa,IAAI,cAAc,KACnC,IAAI,aAAa,IAAI,OAAO,EAAA,EACK,KAAK,CAAC,CAAC,YAAY;CAEtD,IACE,eAAe,WACf,eAAe,iBACf,eAAe,SACf,eAAe,kBAEf,OAAO;CAGT,IACE,eAAe,SACf,eAAe,eACf,eAAe,iBACf,eAAe,cAEf,OAAO;CAGT,IAAI,IAAI,aAAa,IAAI,YAAY,MAAM,UAAU,IAAI,aAAa,IAAI,gBAAgB,MAAM,QAC9F,OAAO;CAGT,OAAO;AACT;AAEA,SAAS,uBAAuB,SAAkB,aAA6B;CAC7E,IAAI,gBAAgB,KAAK,WAAW,GAClC,OAAO;CAGT,OAAO,IAAI,IAAI,aAAa,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;AACpE;AAEA,eAAe,sBACb,eACA,OACA,eACe;CACf,IAAI,CAAC,OACH;CAGF,IAAI;EACF,MAAM,KAAK,gBAAgB,eAAe,OAAO,EAC/C,iBAAiB,cACnB,CAAC;CACH,SAAS,OAAO;EACd,OAAO,KAAK,gCAAgC;GAC1C;GACA,OAAO,qBAAqB,KAAK;EACnC,CAAC;CACH;AACF;AAEA,eAAe,8BAA8B,aAAyC;CACpF,IAAI,CAAC,YAAY,gBAAgB,CAAC,YAAY,aAC5C;CAGF,IAAI;EACF,MAAM,gBAAgB,MAAM,eAAe;EAC3C,MAAM,sBAAsB,eAAe,YAAY,cAAc,eAAe;EACpF,MAAM,sBAAsB,eAAe,YAAY,aAAa,cAAc;CACpF,SAAS,OAAO;EACd,OAAO,KAAK,gFAAgF,EAC1F,OAAO,qBAAqB,KAAK,EACnC,CAAC;CACH;AACF;AAEA,eAAe,0CAA0C,QAAiC;CACxF,MAAM,WAAW,MAAM,2BAA2B,MAAM;CAExD,IAAI;EACF,MAAM,gBAAgB,MAAM,eAAe;EAC3C,KAAK,MAAM,EAAE,UAAU,UAAU;GAC/B,MAAM,sBAAsB,eAAe,KAAK,cAAc,eAAe;GAC7E,MAAM,sBAAsB,eAAe,KAAK,aAAa,cAAc;EAC7E;CACF,SAAS,OAAO;EACd,OAAO,KAAK,uFAAuF,EACjG,OAAO,qBAAqB,KAAK,EACnC,CAAC;CACH;CAEA,OAAO,MAAM,2BAA2B,MAAM;AAChD;AAEA,SAAS,2BAA2B,aAAyD;CAC3F,MAAM,SAAS,YAAY,OAAO;CAElC,IAAI,QACF,OAAO;CAGT,OAAO,aAAa,YAAY,QAAQ,KAAK,CAAC;AAChD;;;;AAKA,eAAe,iBAA8C;CAC3D,MAAM,SAAS,cAAc;CAC7B,MAAM,MAAM,KAAK,IAAI;CAErB,IAAI,mBAAmB,MAAM,gBAAgB,WAAW,WACtD,OAAO,gBAAgB;CAGzB,IAAI;EACF,MAAM,gBAAgB,MAAM,KAAK,UAC/B,IAAI,IAAI,OAAO,SAAS,GACxB,OAAO,UACP,kBAAkB,MAAM,GACxB,wBAAwB,MAAM,GAC9B,oBAAoB,CACtB;EAEA,kBAAkB;GAChB;GACA,UAAU;EACZ;EAEA,OAAO,KAAK,yCAAyC;GACnD,QAAQ,cAAc,eAAe,CAAC,CAAC;GACvC,UAAU,OAAO;GACjB,kBAAkB,OAAO;EAC3B,CAAC;EACD,OAAO;CACT,SAAS,OAAO;EACd,OAAO,MAAM,yBAAyB,KAAA,GAAW;GAC/C,WAAW,OAAO;GAClB,UAAU,OAAO;GACjB,WAAW,iBAAiB,QAAQ,MAAM,OAAO;EACnD,CAAC;EACD,MAAM,IAAI,MAAM,uBAAuB;CACzC;AACF;AAEA,SAAS,QAAQ,SAAwD;CACvE,MAAM,aAAa,UAAU,IAAI,OAAO;CACxC,IAAI,YACF,OAAO;CAGT,MAAM,OAAO,mBAAmB,IAAI,IAAI,OAAO,CAAC;CAChD,UAAU,IAAI,SAAS,IAAI;CAC3B,OAAO;AACT;AAEA,eAAe,0BAA0B,SAA0C;CAGjF,KAFoB,QAAQ,QAAQ,IAAI,cAAc,KAAK,GAAA,CAE3C,SAAS,kBAAkB,GAAG;EAC5C,MAAM,OAAO,MAAM,QAAQ,KAAK,CAAC,CAAC,YAAY,IAAI;EAClD,OAAO,OAAO,MAAM,iBAAiB,WAAW,KAAK,eAAe;CACtE;CAGA,MAAM,eAAc,MADG,QAAQ,SAAS,CAAC,CAAC,YAAY,IAAI,EAAA,EAC5B,IAAI,cAAc;CAChD,OAAO,OAAO,gBAAgB,WAAW,cAAc;AACzD;AAEA,SAAS,gCAAgC,SAAkC,UAIzE;CACA,MAAM,SAAS,QAAQ;CAOvB,IAAI,EALF,UACA,OAAO,WAAW,YAClB,CAAC,MAAM,QAAQ,MAAM,KACrB,wDAAwD,SAGxD,MAAM,IAAI,mCACR,sEACF;CAGF,IAAI,WAAW,SACb,MAAM,IAAI,mCACR,yDACF;CAGF,MAAM,WAAW,QAAQ;CAKzB,IAAI,EAJsB,MAAM,QAAQ,QAAQ,IAC5C,SAAS,SAAS,QAAQ,IAC1B,aAAa,WAGf,MAAM,IAAI,mCACR,sDACF;CAGF,MAAM,UAAU,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM,KAAA;CAChE,MAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM,KAAA;CAE5D,IAAI,CAAC,WAAW,CAAC,KACf,MAAM,IAAI,mCACR,+DACF;CAGF,OAAO;EACL,QAAQ,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM,KAAA;EACxD;EACA;CACF;AACF;AAMA,MAAM,6BAAyD;CAC7D,SAAS,CAAC,KAAK;CACf,MAAM;EAAC;EAAQ;EAAsB;CAAO;CAC5C,OAAO,CAAC,OAAO;CACf,WAAW,CAAC,cAAc,WAAW;CACrC,YAAY,CAAC,eAAe,YAAY;CACxC,SAAS,CAAC,WAAW,YAAY;CACjC,QAAQ,CAAC,QAAQ;CACjB,UAAU,CAAC,UAAU;CACrB,WAAW,CAAC,YAAY;CACxB,WAAW,CAAC,YAAY;CACxB,aAAa,CAAC,cAAc;CAC5B,aAAa;EAAC;EAAa;EAAe;CAAO;CACjD,aAAa,CAAC,cAAc;AAC9B;AAEA,IAAI,mBAA+C,EACjD,GAAG,2BACL;AAEA,SAAS,mBAAmB,MAA2B;CACrD,IAAI,CAAC,MAAM,QAAQ,IAAI,GACrB,OAAO,CAAC;CAGV,OAAO,MAAM,KACX,IAAI,IACF,KACG,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CACxB,QAAQ,QAAQ,IAAI,SAAS,CAAC,CACnC,CACF;AACF;;;;;AAMA,SAAgB,0BAA0B,SAAiC;CACzE,mBAAmB;EACjB,SAAS,QAAQ,YAAY,KAAA,IAAY,mBAAmB,QAAQ,OAAO,IAAI,2BAA2B;EAC1G,MAAM,QAAQ,SAAS,KAAA,IAAY,mBAAmB,QAAQ,IAAI,IAAI,2BAA2B;EACjG,OAAO,QAAQ,UAAU,KAAA,IAAY,mBAAmB,QAAQ,KAAK,IAAI,2BAA2B;EACpG,WAAW,QAAQ,cAAc,KAAA,IAAY,mBAAmB,QAAQ,SAAS,IAAI,2BAA2B;EAChH,YAAY,QAAQ,eAAe,KAAA,IAAY,mBAAmB,QAAQ,UAAU,IAAI,2BAA2B;EACnH,SAAS,QAAQ,YAAY,KAAA,IAAY,mBAAmB,QAAQ,OAAO,IAAI,2BAA2B;EAC1G,QAAQ,QAAQ,WAAW,KAAA,IAAY,mBAAmB,QAAQ,MAAM,IAAI,2BAA2B;EACvG,UAAU,QAAQ,aAAa,KAAA,IAAY,mBAAmB,QAAQ,QAAQ,IAAI,2BAA2B;EAC7G,WAAW,QAAQ,cAAc,KAAA,IAAY,mBAAmB,QAAQ,SAAS,IAAI,2BAA2B;EAChH,WAAW,QAAQ,cAAc,KAAA,IAAY,mBAAmB,QAAQ,SAAS,IAAI,2BAA2B;EAChH,aAAa,QAAQ,gBAAgB,KAAA,IAAY,mBAAmB,QAAQ,WAAW,IAAI,2BAA2B;EACtH,aAAa,QAAQ,gBAAgB,KAAA,IAAY,mBAAmB,QAAQ,WAAW,IAAI,2BAA2B;EACtH,aAAa,QAAQ,gBAAgB,KAAA,IAAY,mBAAmB,QAAQ,WAAW,IAAI,2BAA2B;CACxH;AACF;;;;AAKA,SAAgB,wBAA8B;CAC5C,mBAAmB,EACjB,GAAG,2BACL;AACF;AAEA,SAAS,gCAA4D;CACnE,OAAO;AACT;AAEA,SAAS,mBACP,QACA,WACmC;CACnC,KAAK,MAAM,YAAY,WACrB,IAAI,YAAY,QACd,OAAO;EACL,KAAK;EACL,OAAO,OAAO;CAChB;CAIJ,OAAO,CAAC;AACV;AAEA,SAAS,eAAe,QAAiC,WAAyC;CAChG,MAAM,EAAE,UAAU,mBAAmB,QAAQ,SAAS;CAEtD,IAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,UAAU,MAAM,KAAK;EAC3B,OAAO,QAAQ,SAAS,IAAI,UAAU,KAAA;CACxC;CAEA,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,WAChD,OAAO,GAAG;AAId;AAEA,SAAS,eAAe,QAAiC,WAAyC;CAChG,MAAM,EAAE,UAAU,mBAAmB,QAAQ,SAAS;CAEtD,IAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GACpD,OAAO;CAGT,IAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,SAAS,OAAO,KAAK;EAC3B,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,KAAA;CAC5C;AAGF;AAEA,SAAS,gBACP,QACA,WACA,eAAe,OACN;CACT,MAAM,EAAE,UAAU,mBAAmB,QAAQ,SAAS;CAEtD,IAAI,OAAO,UAAU,WACnB,OAAO;CAGT,IAAI,OAAO,UAAU,UACnB,OAAO,MAAM,YAAY,MAAM;CAGjC,OAAO;AACT;;;;AAKA,SAAS,UAAU,OAAwB;CACzC,IAAI;EACF,OAAO,KAAK,MAAM,KAAK;CACzB,QAAQ;EACN,OAAO;CACT;AACF;;;;AAKA,SAAS,cAAc,OAA0B;CAC/C,IAAI,CAAC,OAAO,OAAO,CAAC;CAEpB,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MACJ,KAAK,SAAU,OAAO,SAAS,WAAW,KAAK,KAAK,IAAI,GAAG,OAAO,KAAK,CAAE,CAAC,CAC1E,QAAQ,SAAS,KAAK,SAAS,CAAC;CAGrC,IAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,UAAU,MAAM,KAAK;EAC3B,IAAI,CAAC,SAAS,OAAO,CAAC;EAEtB,IAAI,QAAQ,WAAW,GAAG,GAAG;GAC3B,MAAM,SAAS,UAAU,OAAO;GAChC,IAAI,MAAM,QAAQ,MAAM,GACtB,OAAO,OACJ,KAAK,SAAU,OAAO,SAAS,WAAW,KAAK,KAAK,IAAI,GAAG,OAAO,KAAK,CAAE,CAAC,CAC1E,QAAQ,SAAS,KAAK,SAAS,CAAC;EAEvC;EAEA,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,QACJ,MAAM,GAAG,CAAC,CACV,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,CAC1B,QAAQ,SAAS,KAAK,SAAS,CAAC;EAGrC,OAAO,CAAC,OAAO;CACjB;CAEA,OAAO,CAAC;AACV;AAEA,SAAS,aAAa,OAA0B;CAC9C,IAAI,OAAO,UAAU,UACnB,OAAO,MACJ,KAAK,CAAC,CACN,MAAM,KAAK,CAAC,CACZ,QAAQ,SAAS,KAAK,SAAS,CAAC;CAGrC,OAAO,cAAc,KAAK;AAC5B;;;;AAKA,SAAgB,gBAAgB,QAM9B;CACA,MAAM,eAAe,8BAA8B;CAGnD,IAAI,UAAoB,CAAC;CACzB,MAAM,EAAE,OAAO,iBAAiB,mBAAmB,QAAQ,aAAa,SAAS;CACjF,IAAI,iBAAiB,KAAA,GACnB,IAAI,OAAO,iBAAiB,YAAY,aAAa,KAAK,CAAC,CAAC,WAAW,GAAG,GAAG;EAC3E,MAAM,SAAS,UAAU,aAAa,KAAK,CAAC;EAC5C,IAAI,MAAM,QAAQ,MAAM,GACtB,UAAU,OACP,KAAK,OAAQ,OAAO,OAAO,WAAW,GAAG,KAAK,IAAI,GAAG,KAAK,KAAK,CAAE,CAAC,CAClE,QAAQ,OAAO,GAAG,SAAS,CAAC;CAEnC,OACE,UAAU,cAAc,YAAY;CAKxC,MAAM,cAAwC,CAAC;CAC/C,MAAM,EAAE,OAAO,aAAa,mBAAmB,QAAQ,aAAa,WAAW;CAC/E,IAAI,aAAa,KAAA,GAAW;EAC1B,IAAI,cAAuB;EAE3B,IAAI,OAAO,aAAa,YAAY,SAAS,KAAK,CAAC,CAAC,WAAW,GAAG,GAChE,cAAc,UAAU,SAAS,KAAK,CAAC,KAAK;EAG9C,IAAI,eAAe,OAAO,gBAAgB,YAAY,CAAC,MAAM,QAAQ,WAAW,GAC9E,KAAK,MAAM,CAAC,UAAU,cAAc,OAAO,QAAQ,WAAsC,GAAG;GAC1F,MAAM,UAAU,cAAc,SAAS;GACvC,IAAI,QAAQ,SAAS,GACnB,YAAY,YAAY;EAE5B;CAEJ;CAGA,MAAM,kBAAkB,mBAAmB,QAAQ,aAAa,WAAW;CAC3E,MAAM,cACJ,gBAAgB,QAAQ,UACpB,aAAa,gBAAgB,KAAK,IAClC,cAAc,gBAAgB,KAAK;CAGzC,MAAM,cAAc,gBAAgB,QAAQ,aAAa,WAAW;CAEpE,OAAO;EAAE;EAAS;EAAa;EAAa;CAAY;AAC1D;;;;AASA,eAAe,kBACb,aACA,QAC+B;CAC/B,MAAM,eAAe,8BAA8B;CACnD,MAAM,WAAqB;EACzB,KAAK,eAAe,QAAQ,aAAa,OAAO,KAAK;EACrD,MAAM,eAAe,QAAQ,aAAa,IAAI,KAAK,eAAe,QAAQ,aAAa,KAAK,KAAK;EACjG,OAAO,eAAe,QAAQ,aAAa,KAAK;EAChD,WAAW,eAAe,QAAQ,aAAa,SAAS;EACxD,YAAY,eAAe,QAAQ,aAAa,UAAU;EAC1D,SAAS,eAAe,QAAQ,aAAa,OAAO;EACpD,QAAQ,eAAe,QAAQ,aAAa,MAAM;EAClD,UAAU,eAAe,QAAQ,aAAa,QAAQ;EACtD,YAAY,eAAe,QAAQ,aAAa,SAAS;CAC3D;CAEA,MAAM,YAAY,YAAY,aAC1B,KAAK,IAAI,IAAI,YAAY,aAAa,MACtC,KAAA;CACJ,MAAM,MAAM,KAAK,IAAI;CACrB,MAAM,eAAgB,YAAwC;CAE9D,OAAO;EACL,QAAQ,SAAS;EACjB,aAAa,YAAY;EACzB,cAAc,YAAY;EAC1B,SAAS,YAAY;EACrB;EACA,QAAQ,eAAe,QAAQ,CAAC,KAAK,CAAC;EACtC,KAAK,eAAe,QAAQ,CAAC,KAAK,CAAC;EACnC,cAAc,OAAO,iBAAiB,WAAW,eAAe,KAAA;EAChE,UAAU,cAAc,CAAC,CAAC;EAC1B,MAAM;EACN,WAAW;EACX,cAAc;CAChB;AACF;AAOA,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,yBAAyB,GAAG,yBAAyB;AAC3D,MAAM,qBAAqB,GAAG,yBAAyB;AACvD,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;AAsBjC,SAAgB,aAAa,SAAoC;CAC/D,MAAM,UAAU,QAAQ,QAAQ,IAAI,QAAQ;CAC5C,IAAI,CAAC,SAAS,OAAO;CAGrB,MAAM,aAAa,IAAI,OAAO,GAAG,kBAAkB,SAAS;CAC5D,MAAM,aAAa,QAAQ,MAAM,UAAU;CAC3C,IAAI,CAAC,YAAY,OAAO;CAExB,MAAM,QAAQ,mBAAmB,WAAW,EAAE;CAC9C,IAAI,CAAC,OAAO,OAAO;CAGnB,MAAM,YAAY,IAAI,OAAO,GAAG,uBAAuB,SAAS;CAChE,MAAM,YAAY,QAAQ,MAAM,SAAS;CAGzC,OAAO;EAAE;EAAO,aAFI,YAAY,mBAAmB,UAAU,EAAE,IAAI,KAAA;CAEvC;AAC9B;;;;;;AAOA,SAAgB,wBAAiC;CAC/C,MAAM,UAAU,IAAI,QAAQ;CAC5B,QAAQ,OACN,cACA,6BAA6B,mBAAmB,IAAI,EAAE,QAAQ,EAAE,CAAC,CACnE;CACA,QAAQ,OACN,cACA,6BAA6B,wBAAwB,IAAI,EAAE,QAAQ,EAAE,CAAC,CACxE;CACA,OAAO;AACT;;;;AAKA,SAAgB,aAAa,SAA2B;CAEtD,OADgB,QAAQ,QAAQ,IAAI,QACvB,CAAC,EAAE,SAAS,GAAG,kBAAkB,EAAE,KAAK;AACvD;AAWA,SAAS,aAAa,OAAuB;CAC3C,OAAO,MAAM,QAAQ,uBAAuB,MAAM;AACpD;AAEA,SAAS,2BAA2B,SAAiC;CACnE,MAAM,UAAU,QAAQ,QAAQ,IAAI,QAAQ;CAC5C,IAAI,CAAC,SACH,OAAO;CAGT,MAAM,cAAc,IAAI,OACtB,cAAc,aAAa,kBAAkB,EAAE,SACjD;CACA,MAAM,cAAc,QAAQ,MAAM,WAAW,CAAC,GAAG;CACjD,IAAI,CAAC,aACH,OAAO;CAGT,IAAI;EACF,MAAM,UAAU,mBAAmB,WAAW;EAC9C,OAAO,QAAQ,SAAS,IAAI,UAAU;CACxC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,yBAAyB,OAAuC;CACvE,OAAO,UAAU,QAAQ,MAAM,KAAK,CAAC,CAAC,SAAS;AACjD;AAEA,SAAS,iCAAiC,QAAiB,QAA2B;CACpF,MAAM,gBAAgB,IAAI,QAAQ,MAAM;CAIxC,MAAM,aAHgB,cAEnB,cAC8B,KAAK,aAAa,KAAK,MAAM,KAAK,aAAa,CAAC,CAC9E,QAAQ,CAAC,UAAU,KAAK,YAAY,MAAM,YAAY,CAAC,CACvD,KAAK,GAAG,WAAW,KAAK;CAE3B,IAAI,WAAW,SAAS,GACtB,KAAK,MAAM,UAAU,YACnB,OAAO,OAAO,cAAc,MAAM;MAE/B;EACL,MAAM,YAAY,cAAc,IAAI,YAAY;EAChD,IAAI,WACF,OAAO,OAAO,cAAc,SAAS;CAEzC;CAEA,KAAK,MAAM,CAAC,MAAM,UAAU,eAC1B,IAAI,KAAK,YAAY,MAAM,cACzB,OAAO,IAAI,MAAM,KAAK;AAG5B;AAEA,SAAS,4BAA4B,SAAwB;CAC3D,QAAQ,OACN,cACA,6BAA6B,oBAAoB,IAAI,EAAE,QAAQ,EAAE,CAAC,CACpE;AACF;AAEA,SAAS,mBACP,OACA,cACqB;CACrB,OAAO,UAAU,QACf,OAAO,MAAM,UAAU,YACvB,MAAM,MAAM,SAAS,KACrB,OAAO,MAAM,iBAAiB,YAC9B,MAAM,aAAa,SAAS,MAC3B,MAAM,UAAU,KAAA,IACb,CAAC,eACD,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,MAC5D,OAAO,MAAM,cAAc,YAC3B,OAAO,SAAS,MAAM,SAAS,MAC9B,MAAM,cAAc,KAAA,KAAa,OAAO,MAAM,cAAc,cAC5D,MAAM,aAAa,KAAA,KAAa,OAAO,MAAM,aAAa;AAC/D;AAEA,SAAS,uBACP,OACA,OAC0B;CAC1B,IAAI,qBAAqB,KAAK,GAC5B,OAAO,MAAM;CAGf,QAAQ,OAAR;EACE,KAAK,iBACH,OAAO,0BAA0B;EACnC,KAAK;EACL,KAAK,WACH,OAAO,0BAA0B;EACnC,KAAK,sBACH,OAAO,0BAA0B;EACnC,KAAK,kBACH,OAAO,0BAA0B;EACnC,KAAK,oBACH,OAAO,0BAA0B;EAEnC,SACE,OAAO,0BAA0B;CACrC;AACF;AAEA,eAAe,2BACb,SACA,SACA,aAC6B;CAC7B,MAAM,iBAAiB,IAAI,QAAQ;CACnC,IAAI;CACJ,MAAM,yBACJ,gBAAgB,0BAA0B,oBAC1C,gCAAgC,OAAO;CAEzC,IAAI,SACF,IAAI;EACF,MAAM,iBAAiB,OAAO;CAChC,SAAS,OAAO;EACd,eAAe;CACjB;CAGF,IAAI;EAEF,iCAAiC,gBAAgB,MADpB,mBAAmB,OAAO,CACQ;CACjE,SAAS,OAAO;EACd,iBAAiB;CACnB;CAEA,IAAI,CAAC,0BAA0B,cAC7B,IAAI;EAEF,iCAAiC,gBAAgB,MADnB,+BAA+B,OAAO,CACJ;CAClE,SAAS,OAAO;EACd,iBAAiB;EACjB,iCACE,gBACA,gCAAgC,OAAO,CACzC;CACF;CAGF,4BAA4B,cAAc;CAE1C,MAAM,uBAAuB,eACzB,0BAA0B,eAC1B;CAEJ,IAAI,cACF,OAAO,KAAK,iCAAiC;EAC3C,aAAa;EACb,WAAW,wBAAwB,QAAQ,aAAa,OAAO;CACjE,CAAC;CAGH,OAAO,IAAI,mBAAmB,sBAAsB,cAAc;AACpE;;;;;;;AAYA,eAAsB,MACpB,SACA,oBACmB;CACnB,IAAI,eAA8B;CAClC,IAAI,iBAAgC;CACpC,IAAI,iBAAgC;CAEpC,IAAI;EACF,MAAM,SAAS,cAAc;EAG7B,MAAM,UAAwB,OAAO,uBAAuB,WACxD,EAAE,WAAW,mBAAmB,IAChC,sBAAsB,CAAC;EAC3B,MAAM,YAAY,uBAAuB,QAAQ,WAAW,OAAO,KAAK;EAKxE,IAFgB,QAAQ,QAAQ,IAAI,QACb,CAAC,EAAE,SAAS,GAAG,kBAAkB,EAAE,GAC5C;GACZ,OAAO,KAAK,sDAAsD;GAElE,MAAM,UAAU,IAAI,QAAQ;GAC5B,QAAQ,OACN,cACA,6BAA6B,mBAAmB,IAAI,EAAE,QAAQ,EAAE,CAAC,CACnE;GAGA,MAAM,UAAU,IADQ,IAAI,OAAO,WACT,CAAC,CAAC;GAC5B,OAAO,uBAAuB,SAAS,EAAE,QAAQ,CAAC;EACpD;EAEA,MAAM,aAAa,MAAM,eAAe;EAGxC,MAAM,eAAe,KAAK,uBAAuB;EACjD,MAAM,gBAAgB,MAAM,KAAK,2BAA2B,YAAY;EAExE,MAAM,kBAAkB,qCAAqC,QAAQ,iBAAiB,OAAO;EAK7F,MAAM,QAAQ,wBAAwB,KAAK,YAAY,GAAG,QAAQ,kBAAkB;EACpF,MAAM,QAAQ,KAAK,YAAY;EAG/B,MAAM,aAAyB;GAC7B;GACA;GACA;GACA;GACA,UAAU,QAAQ;GAClB,WAAW,KAAK,IAAI;EACtB;EAEA,OAAO,KAAK,wBAAwB;GAClC,cAAc,QAAQ,QAAQ,SAAS;GACvC,QAAQ,QAAQ;GAChB,aAAa,QAAQ,QAAQ,QAAQ;GACrC,oBAAoB,OAAO,KAAK,eAAe;EACjD,CAAC;EAGD,eAAe,MAAM,iBAAiB,UAAU;EAEhD,IAAI,CAAC,QAAQ,UAAU;GACrB,MAAM,WAAW,MAAM,4BAA4B,SAAS;IAC1D;IACA;GACF,GAAG,OAAO,WAAW;GACrB,iBAAiB,SAAS;GAC1B,iBAAiB,SAAS;EAC5B;EAEA,MAAM,0BAAkD;GACtD,cAAc,OAAO;GACrB,OAAO,OAAO;GACd;GACA;GACA,gBAAgB;GAChB,uBAAuB;GACvB,GAAG;EACL;EAEA,IAAI,QAAQ,QACV,wBAAwB,SAAS,QAAQ;EAG3C,IAAI,QAAQ,UACV,wBAAwB,YAAY,QAAQ;EAG9C,MAAM,mBAAmB,KAAK,sBAAsB,YAAY,uBAAuB;EAGvF,MAAM,UAAU,IAAI,QAAQ;EAC5B,QAAQ,OACN,cACA,6BAA6B,oBAAoB,cAAc,EAC7D,QAAQ,wBACV,CAAC,CACH;EAEA,IAAI,gBACF,QAAQ,OAAO,cAAc,cAAc;EAG7C,OAAO,KAAK,qCAAqC;GAC/C,UAAU,OAAO;GACjB,aAAa,OAAO;GACpB,OAAO,OAAO;GACd,uBAAuB,WAAW,eAAe,CAAC,CAAC;GACnD,YAAY;GACZ,QAAQ,QAAQ;GAChB,aAAa,QAAQ,QAAQ,QAAQ;EACvC,CAAC;EAED,OAAO,uBAAuB,iBAAiB,SAAS,GAAG,EAAE,QAAQ,CAAC;CACxE,SAAS,OAAO;EACd,IAAI,cACF,IAAI;GACF,MAAM,iBAAiB,YAAY;EACrC,SAAS,cAAc;GACrB,OAAO,KAAK,oCAAoC,EAC9C,WAAW,wBAAwB,QAAQ,aAAa,OAAO,eACjE,CAAC;EACH;EAGF,IAAI,gBACF,IAAI;GACF,MAAM,0BAA0B,cAAc;EAChD,SAAS,cAAc;GACrB,OAAO,KAAK,wCAAwC,EAClD,WAAW,wBAAwB,QAAQ,aAAa,OAAO,eACjE,CAAC;EACH;EAGF,OAAO,MAAM,kCAAkC,KAAA,GAAW,EACxD,WAAW,iBAAiB,QAAQ,MAAM,OAAO,eACnD,CAAC;EACD,MAAM,IAAI,MAAM,cAAc;CAChC;AACF;;;;;;;;;;;;;AAcA,eAAsB,eAAe,SAAqC;CACxE,IAAI,UAAyB;CAC7B,IAAI,gBAAoC;CAExC,IAAI;EACF,UAAU,2BAA2B,OAAO;EAC5C,MAAM,SAAS,cAAc;EAC7B,MAAM,iBAAiB,2BAA2B,MAAM;EACxD,MAAM,gBAAgB,OAAO,MAAM,MAAM,KAAK,CAAC,CAAC,SAAS,QAAQ;EACjE,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAC/B,MAAM,OAAO,IAAI,aAAa,IAAI,MAAM;EACxC,MAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;EAC1C,MAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;EAC1C,MAAM,mBAAmB,IAAI,aAAa,IAAI,mBAAmB;EACjE,MAAM,WAAW,IAAI,aAAa,IAAI,WAAW;EACjD,MAAM,iBAAiB,IAAI,aAAa,IAAI,kBAAkB;EAC9D,MAAM,UAAU,yBAAyB,IAAI;EAC7C,MAAM,WAAW,yBAAyB,KAAK;EAC/C,MAAM,uBAAuB,QAC3B,yBAAyB,QAAQ,KACjC,yBAAyB,cAAc,CACzC;EAEA,OAAO,KAAK,0BAA0B;GACpC;GACA;GACA,UAAU,QAAQ,KAAK;GACvB,qBAAqB,QAAQ,gBAAgB;GAC7C,aAAa,yBAAyB,QAAQ;GAC9C,mBAAmB,yBAAyB,cAAc;GAC1D,UAAU,OAAO;GACjB,aAAa,OAAO;EACtB,CAAC;EAGD,IAAI,OAAO;GACT,IAAI,kBAAkB,UAAU;IAC9B,gBAAgB;IAChB,IAAI,SAAS;KACX,MAAM,aAAa,MAAM,cAAc,SAAS,EAAE,kBAAkB,KAAK,CAAC;KAC1E,MAAM,WAAW,aAAa,KAAK,IAAI,IAAI,WAAW,YAAY,OAAO;KAEzE,IACE,cACA,mBAAmB,YAAY,aAAa,KAC5C,WAAW,UAAU,SACrB,YAAY,oBACZ;MACA,gBAAgB;MAChB,MAAM,iBAAiB,OAAO;MAC9B,MAAM,kBAAkB,MAAM,+BAA+B,OAAO;MACpE,gBAAgB;MAChB,MAAM,UAAU,IAAI,QAAQ;MAC5B,4BAA4B,OAAO;MACnC,iCAAiC,SAAS,eAAe;MAEzD,MAAM,cAAc,uCAClB,uBAAuB,WAAW,WAAW,OAAO,KAAK,KACzD,YAAY,WAAW,UACvB,cACF;MAEA,OAAO,KAAK,0DAA0D;OACpE,UAAU,QAAQ,KAAK;OACvB,qBAAqB,QAAQ,gBAAgB;OAC7C,aAAa,QAAQ,YAAY,WAAW,QAAQ;OACpD,mBAAmB,QAAQ,cAAc;MAC3C,CAAC;MAED,OAAO,uBAAuB,aAAa,EAAE,QAAQ,CAAC;KACxD;IACF;GACF;GAEA,OAAO,MAAM,wBAAwB,KAAA,GAAW;IAC9C,UAAU,QAAQ,KAAK;IACvB,qBAAqB,QAAQ,gBAAgB;IAC7C,UAAU,OAAO;IACjB,iBAAiB,OAAO;IACxB;GACF,CAAC;GAID,IAAI,UAAU,iBAAiB;IAC7B,OAAO,KAAK,sCAAsC,EAAE,UAAU,OAAO,SAAS,CAAC;IAE/E,gBAAgB;IAChB,IAAI,SACF,MAAM,iBAAiB,OAAO;IAEhC,MAAM,UAAU,MAAM,mBAAmB,OAAO;IAChD,4BAA4B,OAAO;IAEnC,iCAAiC,SAAS,MADZ,+BAA+B,OAAO,CACX;IAIzD,QAAQ,OACN,cACA,6BAA6B,mBAAmB,iBAAiB,EAAE,QAAQ,IAAI,CAAC,CAClF;IACA,QAAQ,OACN,cACA,6BACE,wBACA,+CACA,EAAE,QAAQ,IAAI,CAChB,CACF;IAIA,MAAM,UAAU,IADQ,IAAI,OAAO,WACT,CAAC,CAAC;IAC5B,OAAO,KAAK,0DAA0D;KACpE;KACA;KACA,mBAAmB,OAAO;IAC5B,CAAC;IAGD,OAAO,uBAAuB,GAAG,QAAQ,cAAc,EAAE,QAAQ,CAAC;GACpE;GAGA,IAAI,UAAU,kBAAkB;IAC9B,OAAO,KAAK,+CAA+C;IAC3D,gBAAgB;IAChB,IAAI,SACF,MAAM,iBAAiB,OAAO;IAEhC,MAAM,UAAU,MAAM,mBAAmB,OAAO;IAChD,4BAA4B,OAAO;IAEnC,iCAAiC,SAAS,MADZ,+BAA+B,OAAO,CACX;IAGzD,MAAM,UAAU,IADQ,IAAI,OAAO,WACT,CAAC,CAAC;IAC5B,OAAO,uBAAuB,SAAS,EAAE,QAAQ,CAAC;GACpD;GAGA,gBAAgB;GAChB,IAAI,SACF,MAAM,iBAAiB,OAAO;GAEhC,MAAM,UAAU,MAAM,mBAAmB,OAAO;GAChD,4BAA4B,OAAO;GAEnC,iCAAiC,SAAS,MADZ,+BAA+B,OAAO,CACX;GACzD,QAAQ,OACN,cACA,6BAA6B,mBAAmB,OAAO,EAAE,QAAQ,IAAI,CAAC,CACxE;GAGA,MAAM,UAAU,IADQ,IAAI,OAAO,WACT,CAAC,CAAC;GAC5B,OAAO,uBAAuB,SAAS,EAAE,QAAQ,CAAC;EACpD;EAIA,IAAI,CAAC,UAAU;GACb,gBAAgB,uBAAuB,uBAAuB;GAC9D,MAAM,IAAI,mBACR,uBACI,0BAA0B,0BAC1B,0BAA0B,iBAChC;EACF;EAEA,IAAI,CAAC,WAAW,CAAC,sBAAsB;GACrC,gBAAgB;GAChB,MAAM,IAAI,mBAAmB,0BAA0B,iBAAiB;EAC1E;EAEA,IAAI,CAAC,SAAS;GACZ,gBAAgB,uBAAuB,uBAAuB;GAC9D,MAAM,IAAI,mBACR,uBACI,0BAA0B,0BAC1B,0BAA0B,gBAChC;EACF;EAGA,gBAAgB;EAChB,MAAM,aAAa,MAAM,cAAc,SAAS,EAAE,kBAAkB,KAAK,CAAC;EAE1E,IAAI,CAAC,YACH,MAAM,IAAI,mBACR,uBACI,0BAA0B,0BAC1B,0BAA0B,gBAChC;EAGF,IAAI,CAAC,mBAAmB,YAAY,aAAa,GAC/C,MAAM,IAAI,mBAAmB,0BAA0B,YAAY;EAGrE,IAAI,WAAW,UAAU,OACvB,MAAM,IAAI,mBAAmB,0BAA0B,aAAa;EAGtE,MAAM,sBAAsB,QAC1B,wBAAwB,WAAW,QACrC;EAEA,IADiB,KAAK,IAAI,IAAI,WAAW,YAC1B,oBACb,MAAM,IAAI,mBACR,sBACI,0BAA0B,0BAC1B,0BAA0B,gBAChC;EAGF,IAAI,CAAC,SAAS;GACZ,IAAI,gBAAgB;IAClB,gBAAgB;IAChB,MAAM,iBAAiB,OAAO;IAC9B,MAAM,kBAAkB,MAAM,+BAA+B,OAAO;IACpE,gBAAgB;IAChB,MAAM,UAAU,IAAI,QAAQ;IAC5B,4BAA4B,OAAO;IACnC,iCAAiC,SAAS,eAAe;IAEzD,MAAM,cAAc,uCAClB,uBAAuB,WAAW,WAAW,OAAO,KAAK,KACzD,YAAY,WAAW,UACvB,cACF;IAEA,OAAO,KAAK,oEAAoE;KAC9E,aAAa,QAAQ,YAAY,WAAW,QAAQ;KACpD,mBAAmB,QAAQ,cAAc;IAC3C,CAAC;IAED,OAAO,uBAAuB,aAAa,EAAE,QAAQ,CAAC;GACxD;GAEA,MAAM,IAAI,mBACR,sBACI,0BAA0B,0BAC1B,0BAA0B,iBAChC;EACF;EAEA,OAAO,KAAK,2BAA2B;EAEvC,gBAAgB;EAChB,MAAM,aAAa,MAAM,eAAe;EACxC,MAAM,2BAA2B,+BAA+B,QAAQ,KAAK,OAAO,WAAW;EAC/F,gBAAgB;EAChB,MAAM,cAAc,MAAM,KAAK,uBAAuB,YAAY,0BAA0B;GAC1F,kBAAkB,WAAW;GAC7B,eAAe,WAAW;GAC1B,eAAe,WAAW;GAC1B,iBAAiB,OAAO,MAAM,MAAM,KAAK,CAAC,CAAC,SAAS,QAAQ;EAC9D,CAAC;EAED,OAAO,KAAK,uCAAuC;EAEnD,gBAAgB;EAIhB,MAAM,iBAAiB,MAAM,kBAAkB,aAHhC,2BAA2B,WAGuB,CAAC;EAGlE,gBAAgB;EAChB,MAAM,iBAAiB,MAAM,kBAAkB,SAAS,cAAc;EAGtE,gBAAgB;EAChB,MAAM,iBAAiB,OAAO;EAC9B,MAAM,kBAAkB,MAAM,+BAA+B,OAAO;EAGpE,MAAM,UAAU,IAAI,QAAQ;EAC5B,iCAAiC,SAAS,cAAc;EACxD,4BAA4B,OAAO;EACnC,iCAAiC,SAAS,eAAe;EAEzD,OAAO,KAAK,uCAAuC;EAQnD,OAAO,uBALa,uCAClB,uBAAuB,WAAW,WAAW,OAAO,KAAK,KACzD,YAAY,WAAW,UACvB,cAEsC,GAAG,EAAE,QAAQ,CAAC;CACxD,SAAS,OAAO;EACd,MAAM,cAAc,uBAAuB,OAAO,aAAa;EAC/D,OAAO,MAAM,yBAAyB,KAAA,GAAW;GAC/C;GACA,WAAW,iBAAiB,QAAQ,MAAM,OAAO;EACnD,CAAC;EAED,MAAM,MAAM,2BAA2B,SAAS,SAAS,WAAW;CACtE;AACF;;;;;;;;;AAUA,eAAsB,OAAO,SAAqC;CAChE,IAAI;EACF,MAAM,SAAS,cAAc;EAC7B,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAE/B,MAAM,cAAc,eAAe,GAAG;EACtC,MAAM,YAAY,uBAAuB,IAAI,aAAa,IAAI,WAAW,GAAG,OAAO;EAEnF,OAAO,KAAK,oBAAoB;GAC9B,UAAU,OAAO;GACjB;EACF,CAAC;EAED,MAAM,cAAc,MAAM,eAAe,OAAO;EAChD,MAAM,UAAU,YAAY;EAE5B,IAAI,gBAAgB,SAAS;GAI3B,MAAM,UAAU,MAAM,mBAAmB,OAAO;GAEhD,MAAM,sBAAsB,uBAAuB,SAD/B,aAAa,GACsC;GAEvE,QAAQ,OACN,cACA,6BAA6B,0BAA0B,IAAI,EAAE,QAAQ,EAAE,CAAC,CAC1E;GACA,OAAO,KAAK,sCAAsC,EAAE,cAAc,QAAQ,SAAS,EAAE,CAAC;GACtF,OAAO,uBAAuB,qBAAqB,EAAE,QAAQ,CAAC;EAChE;EAEA,MAAM,iBAAiB,IAAI,QAAQ;EAEnC,IAAI,gBAAgB,SAAS,YAAY,QAAQ;GAC/C,MAAM,0CAA0C,YAAY,MAAM;GAClE,eAAe,OACb,cACA,6BAA6B,0BAA0B,IAAI,EAAE,QAAQ,EAAE,CAAC,CAC1E;GAEA,CAAA,MAD6B,mBAAmB,OAAO,EAAA,CACxC,SAAS,OAAO,QAAQ,eAAe,OAAO,KAAK,KAAK,CAAC;EAC1E,OAAO;GACL,MAAM,8BAA8B,WAAW;GAE/C,CAAA,MAD6B,mBAAmB,OAAO,EAAA,CACxC,SAAS,OAAO,QAAQ,eAAe,OAAO,KAAK,KAAK,CAAC;EAC1E;EAEA,MAAM,UAAU,IAAI,QAAQ,cAAc;EAG1C,IAAI,WACF,QAAQ,OACN,cACA,6BAA6B,0BAA0B,WAAW,EAAE,QAAQ,IAAI,CAAC,CACnF;OAEA,QAAQ,OACN,cACA,6BAA6B,0BAA0B,IAAI,EAAE,QAAQ,EAAE,CAAC,CAC1E;EAGF,IAAI;GACF,MAAM,aAAa,MAAM,eAAe;GACxC,MAAM,iBAAiB,WAAW,eAAe;GACjD,MAAM,mBAA2C,CAAC;GAClD,MAAM,iBAAiB,eAAe,UAAU,OAAO;GAEvD,IAAI,WAAW,kBAAkB,SAAS,cAAc,GACtD,iBAAiB,gBAAgB;QAC5B,IAAI,SACT,OAAO,KAAK,mGAAmG;IAC7G,aAAa,aAAa,OAAO;IACjC,gBAAgB,gBAAgB,cAAc;IAC9C,UAAU,OAAO;GACnB,CAAC;GAGH,IAAI,OAAO,uBACT,iBAAiB,2BAA2B,OAAO;GAGrD,MAAM,gBAAgB,KAAK,mBAAmB,YAAY,gBAAgB;GAC1E,OAAO,KAAK,wCAAwC;IAClD,oBAAoB,eAAe;IACnC,gBAAgB,QAAQ,iBAAiB,aAAa;GACxD,CAAC;GAED,OAAO,uBAAuB,cAAc,SAAS,GAAG,EAAE,QAAQ,CAAC;EACrE,SAAS,OAAO;GACd,OAAO,KAAK,yEAAyE,EACnF,OAAO,qBAAqB,KAAK,EACnC,CAAC;EACH;EAIA,MAAM,mBAAmB,uBAAuB,SADzB,OAAO,yBAAyB,GACgB;EAEvE,OAAO,KAAK,oBAAoB,EAAE,uBAAuB,QAAQ,OAAO,qBAAqB,EAAE,CAAC;EAChG,OAAO,uBAAuB,kBAAkB,EAAE,QAAQ,CAAC;CAC7D,SAAS,OAAO;EACd,OAAO,MAAM,iBAAiB,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EAExE,OAAO,uBAAuB,KAAK,EAAE,SAAA,MADf,mBAAmB,OAAO,EACH,CAAC;CAChD;AACF;;;;;;;;;AAUA,eAAsB,wBAAwB,SAAqC;CACjF,IAAI,QAAQ,WAAW,QACrB,OAAO,SAAS,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;CAGvE,IAAI;EACF,MAAM,SAAS,cAAc;EAE7B,MAAM,kBAAiB,MADE,eAAe,EAAA,CACN,eAAe;EACjD,MAAM,cAAc,MAAM,0BAA0B,OAAO;EAE3D,IAAI,CAAC,aACH,OAAO,SAAS,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;EAGzE,IAAI,CAAC,eAAe,UAClB,MAAM,IAAI,MAAM,wCAAwC;EAG1D,MAAM,EAAE,YAAY,MAAM,UAAU,aAAa,QAAQ,eAAe,QAAQ,GAAG;GACjF,QAAQ,eAAe,UAAU,OAAO;GACxC,UAAU,OAAO;GACjB,gBAAgB;EAClB,CAAC;EAED,MAAM,SAAS,gCAAgC,SAAoC,OAAO,QAAQ;EAKlG,MAAM,SAAkC;GACtC,mBAAA,MAL8B,qCAAqC;IACnE,KAAK,OAAO;IACZ,QAAQ,OAAO;GACjB,CAAC;GAGC,QAAQ,OAAO;GACf,SAAS,OAAO;GAChB,KAAK,OAAO;EACd;EAEA,OAAO,KAAK,iCAAiC,EAAE,GAAG,OAAO,CAAC;EAC1D,OAAO,SAAS,KAAK;GAAE,SAAS;GAAM,GAAG;EAAO,CAAC;CACnD,SAAS,OAAO;EACd,IAAI,qCAAqC,KAAK,GAC5C,OAAO,KAAK,sCAAsC;GAChD,OAAO,qBAAqB,KAAK;GACjC,WAAW,iBAAiBA,OAAW,YAAY,MAAM,OAAO,KAAA;EAClE,CAAC;OAED,OAAO,MAAM,8BAA8B,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EAGvF,OAAO,SAAS,KACd;GAAE,OAAO;GAAwB,mBAAmB,qBAAqB,KAAK;EAAE,GAChF,EAAE,QAAQ,IAAI,CAChB;CACF;AACF;;;;;;;AAQA,eAAsB,yBAAyB,SAAqC;CAClF,IAAI;EACF,MAAM,SAAS,cAAc;EAE7B,MAAM,kBAAiB,MADE,eAAe,EAAA,CACN,eAAe;EACjD,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAC/B,MAAM,SAAS,IAAI,aAAa,IAAI,KAAK;EACzC,MAAM,MAAM,IAAI,aAAa,IAAI,KAAK;EACtC,MAAM,iBAAiB,gBAAgB,eAAe,UAAU,OAAO,SAAS;EAEhF,IAAI,CAAC,UAAU,gBAAgB,MAAM,MAAM,gBACzC,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;EAI3C,MAAM,SAAmC;GACvC,mBAFwB,MAAM,MAAM,yBAAyB,GAAG,IAAI;GAGpE;GACA,KAAK,OAAO,KAAA;EACd;EAEA,OAAO,KAAK,kCAAkC,EAAE,GAAG,OAAO,CAAC;EAC3D,OAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,SAAS,EACP,iBAAiB,WACnB;EACF,CAAC;CACH,SAAS,OAAO;EACd,OAAO,KAAK,gCAAgC,EAC1C,OAAO,qBAAqB,KAAK,EACnC,CAAC;EAED,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;CAC3C;AACF;AAEA,SAAS,qBAAqB,aAAgD;CAC5E,IAAI,CAAC,aACH,OAAO;CAGT,IAAI;EACF,MAAM,GAAG,kBAAkB,YAAY,MAAM,GAAG;EAChD,IAAI,CAAC,gBACH,OAAO;EAGT,MAAM,UAAU,KAAK,MACnB,OAAO,KAAK,gBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,CAC1D;EAEA,OAAO,OAAO,QAAQ,QAAQ,YAAY,OAAO,SAAS,QAAQ,GAAG,IACjE,QAAQ,MAAM,MACd;CACN,QAAQ;EAGN,OAAO;CACT;AACF;AAEA,SAAS,iBAAiB,aAAoE;CAC5F,MAAM,MAAM,KAAK,IAAI;CACrB,IAAI,OAAO,YAAY,cAAc,aAAa,CAAC,OAAO,SAAS,YAAY,SAAS,KAAK,OAAO,YAAY,YAC9G,OAAO;CAGT,MAAM,oBAAoB,qBAAqB,YAAY,WAAW;CACtE,OAAO,sBAAsB,QAAQ,OAAO;AAC9C;;;;AAKA,eAAsB,QAAQ,SAA4C;CACxE,IAAI;EACF,MAAM,cAAc,MAAM,eAAe,OAAO;EAEhD,IAAI,CAAC,YAAY,QAAQ,CAAC,YAAY,eAAe,iBAAiB,WAAW,GAC/E,OAAO;EAGT,OAAO,YAAY;CACrB,SAAS,OAAO;EACd,OAAO,MAAM,sBAAsB,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EAC7E,OAAO;CACT;AACF;;;;AAKA,eAAsB,YAAY,SAAqC;CACrE,MAAM,OAAO,MAAM,QAAQ,OAAO;CAElC,IAAI,CAAC,MAAM;EACT,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAC/B,MAAM,YAAY,GAAG,IAAI,WAAW,IAAI;EACxC,OAAO,KAAK,sCAAsC,EAAE,cAAc,KAAK,CAAC;EACxE,MAAM,MAAM,MAAM,SAAS,SAAS;CACtC;CAEA,OAAO;AACT;;;;AAKA,eAAsB,eAAe,SAA0C;CAC7E,IAAI;EAEF,QAAO,MADmB,eAAe,OAAO,EAAA,CAC7B,eAAe;CACpC,SAAS,OAAO;EACd,OAAO,MAAM,8BAA8B,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EACrF,OAAO;CACT;AACF;;;;AAKA,eAAsB,cACpB,SACA,cAC6B;CAC7B,IAAI;EACF,MAAM,cAAc,MAAM,eAAe,OAAO;EAKhD,IAAI,CAAC,YAAY,WAAW;GAC1B,OAAO,KAAK,uDAAuD;GACnE,OAAO;IAAE,SAAS;IAAO,OAAO;IAAqB,cAAc;GAAK;EAC1E;EAEA,MAAM,sBAAsB,YAAY;EACxC,IAAI,CAAC,qBAAqB;GACxB,OAAO,KAAK,4BAA4B;GACxC,OAAO;IAAE,SAAS;IAAO,OAAO;IAA8B,cAAc;GAAK;EACnF;EAEA,IAAI,gBAAgB,iBAAiB,qBAAqB;GACxD,OAAO,KAAK,qEAAqE;GACjF,OAAO;IAAE,SAAS;IAAO,OAAO;IAA+C,cAAc;GAAK;EACpG;EAEA,MAAM,iBAAiB;EAEvB,OAAO,KAAK,0BAA0B;EAEtC,MAAM,aAAa,MAAM,eAAe;EACxC,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,YAAY,cAAc;EAE7E,OAAO,KAAK,0BAA0B;EAEtC,IAAI,CAAC,cAAc,cAAc;GAC/B,OAAO,MAAM,wCAAwC;GACrD,OAAO;IAAE,SAAS;IAAO,OAAO;IAAuC,cAAc;GAAK;EAC5F;EAEA,MAAM,kBAAkB,cAAc,iBAAiB;EACvD,MAAM,YAAY,cAAc,aAC5B,KAAK,IAAI,IAAI,cAAc,aAAa,MACxC,YAAY;EAGhB,MAAM,kBAAkB,SAAS;GAC/B,aAAa,cAAc;GAC3B,cAAc;GACd,SAAS,cAAc;GACvB;GACA,cAAc,KAAK,IAAI;EACzB,CAAC;EAED,OAAO;GACL,SAAS;GACT,QAAQ;IACN,cAAc,cAAc;IAC5B,eAAe;IACf,UAAU,cAAc;IACxB,YAAY,cAAc;GAC5B;EACF;CACF,SAAS,OAAO;EACd,OAAO,MAAM,uCAAuC,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EAE9F,OAAO;GACL,SAAS;GACT,OAAO,qBAAqB,KAAK;GAGjC,cAAc;EAChB;CACF;AACF;;;;AAQA,SAAgB,uBAA6B;CAC3C,kBAAkB;CAClB,UAAU,MAAM;AAClB;;;;;;;;ACt8DA,MAAM,oBAAoB,wBAAwB;AAElD,SAAS,0BAAkC;CACzC,MAAM,aAAa,OAAO,QAAQ,IAAI,yBAAyB;CAC/D,OAAO,OAAO,SAAS,UAAU,KAAK,aAAa,IAAI,aAAa;AACtE;;;;AAKA,eAAsB,mBAAmB,SAAoC;CAC3E,IAAI;EACF,MAAM,cAAc,MAAM,eAAe,OAAO;EAChD,MAAM,MAAM,KAAK,IAAI;EACrB,MAAM,iBACJ,OAAO,YAAY,cAAc,YAAY,OAAO,YAAY;EAElE,IAAI,CAAC,YAAY,gBAAgB,YAAY,aAAa,WAAW,GAAG;GACtE,IAAI,gBAAgB;IAClB,OAAO,KAAK,sEAAsE;IAElF,MAAM,MAAM,OAAO,MADS,6BAA6B,SAAS,0BAA0B,CAC5D;GAClC;GACA,OAAO;EACT;EAEA,IAAI,CAAC,YAAY,aAAa,CAAC,YAAY,aACzC,OAAO;EAIT,IAAI,YAA2B;EAC/B,IAAI;GACF,MAAM,aAAa,YAAY,YAAY,MAAM,GAAG;GACpD,IAAI,WAAW,WAAW,GAAG;IAC3B,MAAM,UAAU,KAAK,MAAM,OAAO,KAAK,WAAW,IAAI,QAAQ,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,QAAQ,KACV,YAAY,QAAQ,MAAM;GAE9B;EACF,QAAQ,CAER;EAOA,QALuB,aAAa,YAAY,YAAY,YACxD,YACA,YAAY,aACiC,OAEf;CACpC,SAAS,OAAO;EAId,IAAI,iBAAiB,UACnB,MAAM;EAGR,OAAO,MAAM,gCAAgC,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EACvF,MAAM;CACR;AACF;;;;AAKA,eAAe,kBAAkB,SAAiC;CAChE,IAAI;EAGF,IAAI,MAFuB,mBAAmB,OAAO,GAEnC;GAChB,OAAO,KAAK,sCAAsC;GAClD,MAAM,SAAS,MAAM,cAAc,OAAO;GAE1C,IAAI,OAAO,WAAW,OAAO,QAAQ,cACnC,OAAO,KAAK,qCAAqC;QAC5C;IACL,OAAO,MAAM,uBAAuB,KAAA,GAAW,EAC7C,OAAO,OAAO,SAAS,mDACzB,CAAC;IAKD,OAAO,MAAM,0DAA0D;IAEvE,MAAM,MAAM,OAAO,MADS,6BAA6B,SAAS,gBAAgB,CAClD;GAClC;EACF;CACF,SAAS,OAAO;EACd,IAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,KACrE,MAAM;EAER,MAAM;CACR;AACF;AAyFA,IAAI,mBAA+C,CAAC;;;;AAKpD,SAAgB,yBACd,QACM;CACN,mBAAmB;AACrB;;;;AAKA,SAAgB,6BAAmC;CACjD,mBAAmB,CAAC;AACtB;AAEA,SAAS,yBAAyB,UAA6C;CAC7E,OAAO,uBAAuB,SAAS,UAAU;EAC/C,SAAS,SAAS;EAClB,QAAQ,SAAS;CACnB,CAAC;AACH;AAEA,SAAS,kBACP,SACA,aACA,YACQ;CACR,IAAI,iBAAiB,mBACnB,OAAO,iBAAiB,kBAAkB;EACxC;EACA;EACA;CACF,CAAC;CAGH,QAAQ,YAAR;EAKE,SAAS;GACP,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;GAC/B,OAAO,IAAI,aAAa,MAAM,MAAM,GAAG,IAAI,WAAW,IAAI;EAC5D;CACF;AACF;AAEA,eAAe,6BACb,SACA,QACkB;CAClB,IAAI,iBAAiB,8BACnB,OAAO,iBAAiB,6BAA6B;EAAE;EAAS;CAAO,CAAC;CAG1E,MAAM,YAAY,IAAI,IAAI,QAAQ,GAAG;CACrC,UAAU,WAAW;CACrB,UAAU,aAAa,IAAI,UAAU,OAAO;CAE5C,OAAO,IAAI,QAAQ,UAAU,SAAS,GAAG,EACvC,SAAS,QAAQ,QACnB,CAAC;AACH;AAEA,SAAS,2BACP,SACA,MACA,aACA,YACqC;CACrC,IAAI,yBAAqD;CACzD,IAAI,uBAAsD;CAC1D,IAAI,0BAAyF;CAE7F,OAAO;EACL;EACA;EACA;EACA;EACA,oBAAoB,OAAO,eAAe,UAAU;GAClD,IAAI,CAAC,iBAAiB,iBACpB,OAAO;GAGT,IAAI,cACF,OAAO,iBAAiB,gBAAgB,mBAAmB,SAAS,KAAK,KAAK,IAAI;GAGpF,IAAI,CAAC,wBACH,yBAAyB,iBAAiB,gBAAgB,mBAAmB,SAAS,KAAK,GAAG;GAGhG,OAAO;EACT;EACA,kBAAkB,YAAY;GAC5B,IAAI,CAAC,iBAAiB,eACpB,OAAO;GAGT,IAAI,CAAC,sBACH,uBAAuB,iBAAiB,cAAc,iBAAiB,OAAO;GAGhF,OAAO;EACT;EACA,kBAAkB,YAAY;GAC5B,IAAI,CAAC,iBAAiB,eACpB,OAAO;GAGT,IAAI,CAAC,yBACH,0BAA0B,iBAAiB,cAAc,iBAAiB,OAAO;GAGnF,OAAO;EACT;CACF;AACF;AAEA,eAAe,+BACb,SACA,MACA,aACA,YACkB;CAClB,IAAI,CAAC,iBAAiB,cACpB,OAAO;CAGT,MAAM,UAAU,2BAA2B,SAAS,MAAM,aAAa,UAAU;CAEjF,IAAI;EACF,MAAM,SAAS,MAAM,iBAAiB,aAAa,OAAO;EAC1D,IAAI,QACF,MAAM,yBAAyB,MAAM;EAGvC,OAAO;CACT,SAAS,OAAO;EACd,IAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,KACrE,MAAM;EAGR,IAAI,CAAC,iBAAiB,kBACpB,MAAM;EAGR,MAAM,WAAW,MAAM,iBAAiB,iBAAiB;GACvD,GAAG;GACH;EACF,CAAC;EAED,IAAI,UACF,MAAM,yBAAyB,QAAQ;EAGzC,MAAM;CACR;AACF;;;;AAKA,eAAsB,aACpB,SACA,YACA,UACY;CACZ,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAE/B,QAAQ,YAAR;EACE,KAAK,UACH,IAAI;GACF,MAAM,kBAAkB,OAAO;GAE/B,OAAO,SAAS,MADG,QAAQ,OAAO,KACV,KAAA,CAAS;EACnC,SAAS,OAAO;GACd,IAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,KACrE,MAAM;GAER,OAAO,SAAS,KAAA,CAAS;EAC3B;EAEF,KAAK;EACL,KAAK,UACH,IAAI;GACF,MAAM,kBAAkB,OAAO;GAC/B,MAAM,OAAO,MAAM,YAAY,OAAO;GACtC,MAAM,+BAA+B,SAAS,MAAM,IAAI,UAAU,UAAU;GAC5E,OAAO,SAAS,IAAI;EACtB,SAAS,OAAO;GACd,IAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,KACrE,MAAM;GAER,MAAM,MAAM,MAAM,SAAS,kBAAkB,SAAS,IAAI,UAAU,UAAU,CAAC;EACjF;EAEF,KAAK,uBACH,IAAI;GACF,MAAM,kBAAkB,OAAO;GAC/B,MAAM,OAAO,MAAM,YAAY,OAAO;GAEtC,MAAM,+BACJ,SACA,MACA,IAAI,UACJ,qBACF;GAEA,OAAO,SAAS,IAAI;EACtB,SAAS,OAAO;GACd,IAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,KACrE,MAAM;GAER,MAAM,MAAM,MAAM,SAAS,kBAAkB,SAAS,IAAI,UAAU,qBAAqB,CAAC;EAC5F;EAEF,KAAK,yBACH,IAAI;GACF,MAAM,kBAAkB,OAAO;GAC/B,MAAM,OAAO,MAAM,YAAY,OAAO;GAEtC,MAAM,+BACJ,SACA,MACA,IAAI,UACJ,uBACF;GAGA,IAAI,iBAAiB;QAEf,CAAC,MADuB,iBAAiB,cAAc,iBAAiB,OAAO,GAEjF,MAAM,iBAAiB,cAAc,iBAAiB,OAAO;GAAA;GAIjE,OAAO,SAAS,IAAI;EACtB,SAAS,OAAO;GACd,IAAI,iBAAiB,YAAY,MAAM,UAAU,OAAO,MAAM,SAAS,KACrE,MAAM;GAER,MAAM,MAAM,MAAM,SAAS,kBAAkB,SAAS,IAAI,UAAU,uBAAuB,CAAC;EAC9F;EAEF,SACE,MAAM,IAAI,MAAM,6BAA6B,YAAY;CAC7D;AACF;;;;AASA,MAAa,eACX,SACA,aACG,aAAa,SAAS,UAAU,QAAQ;;;;AAK7C,MAAa,aACX,SACA,aACG,aAAa,SAAS,QAAQ,QAA+C;;;;AAKlF,MAAa,eACX,SACA,aACG,aAAa,SAAS,UAAU,QAA+C;;;;AAKpF,MAAa,iBAAiB;;;;;;AAO9B,MAAa,mBACX,SACA,aACG,aAAa,SAAS,uBAAuB,QAA+C;;;;;;AAOjG,MAAa,qBACX,SACA,aACG,aAAa,SAAS,yBAAyB,QAA+C;;;;;;;;;AC1enG,eAAsB,oBAAoB,SAA+C;CACvF,IAAI;EACF,OAAO,KAAK,8CAA8C;EAE1D,MAAM,cAAc,MAAM,eAAe,OAAO;EAEhD,IAAI,CAAC,YAAY,cAAc;GAC7B,OAAO,KAAK,uCAAuC;GACnD,OAAO;IACL,SAAS;IACT,OAAO;IACP,cAAc;GAChB;EACF;EAEA,MAAM,gBAAgB,MAAM,cAAc,SAAS,YAAY,YAAY;EAE3E,IAAI,CAAC,cAAc,SAAS;GAC1B,OAAO,MAAM,wBAAwB,KAAA,GAAW;IAC9C,OAAO,cAAc;IACrB,cAAc,cAAc;GAC9B,CAAC;GAED,OAAO;IACL,SAAS;IACT,OAAO,cAAc;IAIrB,cAAc;GAChB;EACF;EAEA,MAAM,SAAS,cAAc;EAC7B,IAAI,CAAC,UAAU,CAAC,OAAO,cAAc;GACnC,OAAO,MAAM,sDAAsD;GACnE,OAAO;IACL,SAAS;IACT,OAAO;IACP,cAAc;GAChB;EACF;EAEA,OAAO,KAAK,0BAA0B;EAEtC,OAAO;GACL,SAAS;GACT,gBAAgB,OAAO;EACzB;CACF,SAAS,OAAO;EACd,OAAO,MAAM,gCAAgC,iBAAiB,QAAQ,QAAQ,KAAA,CAAS;EACvF,OAAO;GACL,SAAS;GACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU;GAChD,cAAc;EAChB;CACF;AACF;;;;AAKA,SAAgB,uBAAuB,UAA6B;CAClE,OAAO,SAAS,WAAW;AAC7B;;;;AAKA,SAAgB,0BAA0B,UAAoB,SAA2B;CACvF,OAAO,WAAW,uBAAuB,QAAQ;AACnD"}

package/dist/server.mjs

@@ -8,8 +8,8 @@ import { t as isApiClientError } from "./types-DqCXinAk.mjs";
 import { a as withRetry, c as handleApiError, i as isRetryableError, l as ErrorCodes, n as createRetryFetch, o as ApiError, r as fetchWithTimeout, s as ErrorHandler, t as calculateBackoffDelay } from "./api-client-CB7XZaMg.mjs";
 import { a as getIdentitySignalRClient, i as createIdentitySignalRClient, n as SignalRClient, o as initializeSignalR, r as cleanupSignalR, t as IdentitySignalRClient } from "./signalr-C-TA8nEE.mjs";
 import { i as invalidationHelpers, n as createQueryClient, r as createQueryKeyFactory, t as cachePresets } from "./query-client-_xB300gc.mjs";
-import { S as updateAuthSession, _ as isSessionValid, a as createOAuthState, b as listCurrentUserAuthSessions, c as destroyAuthSessionById, d as destroyAuthSessionsBySid, f as destroyAuthSessionsForUser, g as getOAuthState, h as getCurrentAuthSessionId, i as createAuthSession, l as destroyAuthSessionsByIdentitySession, m as getAuthSessionById, n as cleanupExpiredOAuthStates, o as deleteOAuthState, p as getAuthSession, r as closeRedisConnection, s as destroyAuthSession, t as AUTH_ERROR_COOKIE_PREFIX, u as destroyAuthSessionsBySessionState, v as listAuthSessionDataForUser, x as requireAuthSession, y as listAuthSessionsForUser } from "./redis-session-storage.server-CI_IYIn8.mjs";
-import { A as resetAuthClaimMapping, C as handleCallback, D as logout, E as login, M as OAuthCallbackFailureCodes, N as isOAuthCallbackError, O as refreshTokens, P as isRecoverableOAuthCallbackError, S as handleBackChannelLogout, T as hasAuthError, _ as createAuthorizationResponseUrl, a as configureRouteProtection, b as getAuthError, c as protectRoute, d as resetRouteProtectionConfig, f as shouldRefreshToken, g as configureAuthClaimMapping, h as clearAuthServerCache, i as authRoute, j as OAuthCallbackError, k as requireAuth, l as protectedRoute, m as clearAuthErrorHeaders, n as isTokenExpiredResponse, o as onboardingRoute, p as subscriptionRoute, r as shouldAttemptTokenRefresh, s as policyRoute, t as attemptTokenRefresh, u as publicRoute, v as extractUserInfo, w as handleFrontChannelLogout, x as getUser, y as getAccessToken } from "./server-Cw86FdT-.mjs";
+import { C as listCurrentUserAuthSessions, D as OAUTH_RECOVERY_TTL_SECONDS, S as listAuthSessionsForUser, T as updateAuthSession, _ as getAuthSessionById, a as createAuthSession, b as isSessionValid, c as deleteOAuthRecoveryRecord, d as destroyAuthSessionById, f as destroyAuthSessionsByIdentitySession, g as getAuthSession, h as destroyAuthSessionsForUser, i as consumeOAuthRecoveryRecord, l as deleteOAuthState, m as destroyAuthSessionsBySid, n as cleanupExpiredOAuthStates, o as createOAuthRecoveryRecord, p as destroyAuthSessionsBySessionState, r as closeRedisConnection, s as createOAuthState, t as AUTH_ERROR_COOKIE_PREFIX, u as destroyAuthSession, v as getCurrentAuthSessionId, w as requireAuthSession, x as listAuthSessionDataForUser, y as getOAuthState } from "./redis-session-storage.server-DLJ0B7-C.mjs";
+import { A as resetAuthClaimMapping, C as handleCallback, D as logout, E as login, F as OAuthCallbackError, I as OAuthCallbackFailureCodes, L as isOAuthCallbackError, M as clearOAuthRecoveryIntentHeaders, N as consumeOAuthRecoveryIntent, O as refreshTokens, P as getOAuthRecoveryCookiePath, R as isRecoverableOAuthCallbackError, S as handleBackChannelLogout, T as hasAuthError, _ as createAuthorizationResponseUrl, a as configureRouteProtection, b as getAuthError, c as protectRoute, d as resetRouteProtectionConfig, f as shouldRefreshToken, g as configureAuthClaimMapping, h as clearAuthServerCache, i as authRoute, j as OAUTH_RECOVERY_COOKIE_NAME, k as requireAuth, l as protectedRoute, m as clearAuthErrorHeaders, n as isTokenExpiredResponse, o as onboardingRoute, p as subscriptionRoute, r as shouldAttemptTokenRefresh, s as policyRoute, t as attemptTokenRefresh, u as publicRoute, v as extractUserInfo, w as handleFrontChannelLogout, x as getUser, y as getAccessToken } from "./server-BJTz5-BE.mjs";
 import { clearActiveTenant, clearCurrentTenant, configureIdentityContextFetcher, configureTenantCookie, configureTenantResolution, getActiveTenant, getAvailableTenants, getCurrentTenant, getTenantFromIdentityContext, initializeTenant, isTenantMember, resetTenantCookieConfig, resetTenantResolutionConfig, setActiveTenant, setCurrentTenant } from "./tenant/server.mjs";
 import { clearIdentityContextCache, configureIdentityAPIFetcher, configurePermissionFetcher, contextToUserInfo, fetchIdentityContext, fetchUserPermissions, getIdentityContext, hasContextVersionChanged, updateContextVersion } from "./identity/server.mjs";
 import { n as createFetchMiddleware, r as createAPIConfigFactory, t as createApiClient } from "./server-pnsLybIH.mjs";
@@ -85,6 +85,6 @@ function withPermission(permission, loader, options) {
 	};
 }
 //#endregion
-export { AUTH_ERROR_COOKIE_PREFIX, ApiError, ErrorCodes, ErrorHandler, IdentityContextProvider, IdentitySignalRClient, LOG_LEVEL_PRIORITY, LogLevel, Logger, OAuthCallbackError, OAuthCallbackFailureCodes, PERMISSION_MODULES, PermissionChecker, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, SignalRClient, TenantProvider, attemptTokenRefresh, authRoute, cachePresets, calculateBackoffDelay, checkPermission, cleanupExpiredOAuthStates, cleanupSignalR, clearActiveTenant, clearAuthErrorHeaders, clearAuthServerCache, clearCurrentTenant, clearIdentityContextCache, closeRedisConnection, configureAuthClaimMapping, configureIdentityAPIFetcher, configureIdentityContextFetcher, configureIdentityEndpoints, configureIdentityStore, configurePermissionFetcher, configurePermissionRouteProtection, configureRouteProtection, configureTenantClient, configureTenantCookie, configureTenantEndpoints, configureTenantResolution, contextToUserInfo, createAPIConfigFactory, createApiClient, createAuthSession, createAuthorizationResponseUrl, createFetchMiddleware, createIdentitySignalRClient, createLogger, createOAuthState, createQueryClient, createQueryKeyFactory, createRetryFetch, defaultLoggerConfig, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, evaluateAccessRequirement, extractUserInfo, fetchIdentityContext, fetchUserPermissions, fetchWithTimeout, getAccessToken, getActiveTenant, getAuthError, getAuthSession, getAuthSessionById, getAvailableTenants, getCurrentAuthSessionId, getCurrentTenant, getIdentityContext, getIdentitySignalRClient, getOAuthState, getPermissionChecker, getPermissions, getTenantCookieName, getTenantFromIdentityContext, getUser, handleApiError, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, hasContextVersionChanged, initialIdentityContext, initializePermissions, initializeSignalR, initializeTenant, initializeTenantStore, invalidationHelpers, isApiClientError, isOAuthCallbackError, isRecoverableOAuthCallbackError, isRetryableError, isSessionValid, isTenantMember, isTokenExpiredResponse, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, logger, login, logout, normalizeIdentityContextPayload, normalizeIdentityPermissionsPayload, normalizeTenantDataPayload, normalizeTenantSwitchPayload, onboardingRoute, policyRoute, protectRoute, protectedRoute, publicRoute, refreshTokens, requireAuth, requireAuthSession, requirePermission, resetAuthClaimMapping, resetIdentityStoreConfig, resetPermissionRouteProtection, resetRouteProtectionConfig, resetTenantClientConfig, resetTenantCookieConfig, resetTenantResolutionConfig, setActiveTenant, setCurrentTenant, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession, updateContextVersion, useAllPermissions, useCurrentOrganization, useCurrentTenant, useCurrentTenantData, useHasEntitlement, useHasModulePermission, useHasPermission, useHasPermissions, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useModulePermission, useOrganization, usePermission, usePermissionChecker, usePermissionStore, usePermissions, useTenant, useTenantData, useTenantStore, useTenantSwitcher, useUserPermissions, useUserTenants, withPermission, withRetry };
+export { AUTH_ERROR_COOKIE_PREFIX, ApiError, ErrorCodes, ErrorHandler, IdentityContextProvider, IdentitySignalRClient, LOG_LEVEL_PRIORITY, LogLevel, Logger, OAUTH_RECOVERY_COOKIE_NAME, OAUTH_RECOVERY_TTL_SECONDS, OAuthCallbackError, OAuthCallbackFailureCodes, PERMISSION_MODULES, PermissionChecker, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, SignalRClient, TenantProvider, attemptTokenRefresh, authRoute, cachePresets, calculateBackoffDelay, checkPermission, cleanupExpiredOAuthStates, cleanupSignalR, clearActiveTenant, clearAuthErrorHeaders, clearAuthServerCache, clearCurrentTenant, clearIdentityContextCache, clearOAuthRecoveryIntentHeaders, closeRedisConnection, configureAuthClaimMapping, configureIdentityAPIFetcher, configureIdentityContextFetcher, configureIdentityEndpoints, configureIdentityStore, configurePermissionFetcher, configurePermissionRouteProtection, configureRouteProtection, configureTenantClient, configureTenantCookie, configureTenantEndpoints, configureTenantResolution, consumeOAuthRecoveryIntent, consumeOAuthRecoveryRecord, contextToUserInfo, createAPIConfigFactory, createApiClient, createAuthSession, createAuthorizationResponseUrl, createFetchMiddleware, createIdentitySignalRClient, createLogger, createOAuthRecoveryRecord, createOAuthState, createQueryClient, createQueryKeyFactory, createRetryFetch, defaultLoggerConfig, deleteOAuthRecoveryRecord, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, evaluateAccessRequirement, extractUserInfo, fetchIdentityContext, fetchUserPermissions, fetchWithTimeout, getAccessToken, getActiveTenant, getAuthError, getAuthSession, getAuthSessionById, getAvailableTenants, getCurrentAuthSessionId, getCurrentTenant, getIdentityContext, getIdentitySignalRClient, getOAuthRecoveryCookiePath, getOAuthState, getPermissionChecker, getPermissions, getTenantCookieName, getTenantFromIdentityContext, getUser, handleApiError, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, hasContextVersionChanged, initialIdentityContext, initializePermissions, initializeSignalR, initializeTenant, initializeTenantStore, invalidationHelpers, isApiClientError, isOAuthCallbackError, isRecoverableOAuthCallbackError, isRetryableError, isSessionValid, isTenantMember, isTokenExpiredResponse, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, logger, login, logout, normalizeIdentityContextPayload, normalizeIdentityPermissionsPayload, normalizeTenantDataPayload, normalizeTenantSwitchPayload, onboardingRoute, policyRoute, protectRoute, protectedRoute, publicRoute, refreshTokens, requireAuth, requireAuthSession, requirePermission, resetAuthClaimMapping, resetIdentityStoreConfig, resetPermissionRouteProtection, resetRouteProtectionConfig, resetTenantClientConfig, resetTenantCookieConfig, resetTenantResolutionConfig, setActiveTenant, setCurrentTenant, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession, updateContextVersion, useAllPermissions, useCurrentOrganization, useCurrentTenant, useCurrentTenantData, useHasEntitlement, useHasModulePermission, useHasPermission, useHasPermissions, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useModulePermission, useOrganization, usePermission, usePermissionChecker, usePermissionStore, usePermissions, useTenant, useTenantData, useTenantStore, useTenantSwitcher, useUserPermissions, useUserTenants, withPermission, withRetry };
 
 //# sourceMappingURL=server.mjs.map

package/dist/tanstack-start/server.mjs

@@ -8,10 +8,10 @@ import { t as isApiClientError } from "../types-DqCXinAk.mjs";
 import { a as withRetry, c as handleApiError, i as isRetryableError, l as ErrorCodes, n as createRetryFetch, o as ApiError, r as fetchWithTimeout, s as ErrorHandler, t as calculateBackoffDelay } from "../api-client-CB7XZaMg.mjs";
 import { a as getIdentitySignalRClient, i as createIdentitySignalRClient, n as SignalRClient, o as initializeSignalR, r as cleanupSignalR, t as IdentitySignalRClient } from "../signalr-C-TA8nEE.mjs";
 import { i as invalidationHelpers, n as createQueryClient, r as createQueryKeyFactory, t as cachePresets } from "../query-client-_xB300gc.mjs";
-import { S as updateAuthSession, _ as isSessionValid, a as createOAuthState, b as listCurrentUserAuthSessions, c as destroyAuthSessionById, d as destroyAuthSessionsBySid, f as destroyAuthSessionsForUser, g as getOAuthState, h as getCurrentAuthSessionId, i as createAuthSession, l as destroyAuthSessionsByIdentitySession, m as getAuthSessionById, n as cleanupExpiredOAuthStates, o as deleteOAuthState, p as getAuthSession, r as closeRedisConnection, s as destroyAuthSession, t as AUTH_ERROR_COOKIE_PREFIX, u as destroyAuthSessionsBySessionState, v as listAuthSessionDataForUser, x as requireAuthSession, y as listAuthSessionsForUser } from "../redis-session-storage.server-CI_IYIn8.mjs";
-import { A as resetAuthClaimMapping, C as handleCallback, D as logout, E as login, M as OAuthCallbackFailureCodes, N as isOAuthCallbackError, O as refreshTokens, P as isRecoverableOAuthCallbackError, S as handleBackChannelLogout, T as hasAuthError, _ as createAuthorizationResponseUrl, a as configureRouteProtection, b as getAuthError, c as protectRoute, d as resetRouteProtectionConfig, f as shouldRefreshToken, g as configureAuthClaimMapping, h as clearAuthServerCache, i as authRoute, j as OAuthCallbackError, k as requireAuth, l as protectedRoute, m as clearAuthErrorHeaders, n as isTokenExpiredResponse, o as onboardingRoute, p as subscriptionRoute, r as shouldAttemptTokenRefresh, s as policyRoute, t as attemptTokenRefresh, u as publicRoute, v as extractUserInfo, w as handleFrontChannelLogout, x as getUser, y as getAccessToken } from "../server-Cw86FdT-.mjs";
+import { C as listCurrentUserAuthSessions, D as OAUTH_RECOVERY_TTL_SECONDS, S as listAuthSessionsForUser, T as updateAuthSession, _ as getAuthSessionById, a as createAuthSession, b as isSessionValid, c as deleteOAuthRecoveryRecord, d as destroyAuthSessionById, f as destroyAuthSessionsByIdentitySession, g as getAuthSession, h as destroyAuthSessionsForUser, i as consumeOAuthRecoveryRecord, l as deleteOAuthState, m as destroyAuthSessionsBySid, n as cleanupExpiredOAuthStates, o as createOAuthRecoveryRecord, p as destroyAuthSessionsBySessionState, r as closeRedisConnection, s as createOAuthState, t as AUTH_ERROR_COOKIE_PREFIX, u as destroyAuthSession, v as getCurrentAuthSessionId, w as requireAuthSession, x as listAuthSessionDataForUser, y as getOAuthState } from "../redis-session-storage.server-DLJ0B7-C.mjs";
+import { A as resetAuthClaimMapping, C as handleCallback, D as logout, E as login, F as OAuthCallbackError, I as OAuthCallbackFailureCodes, L as isOAuthCallbackError, M as clearOAuthRecoveryIntentHeaders, N as consumeOAuthRecoveryIntent, O as refreshTokens, P as getOAuthRecoveryCookiePath, R as isRecoverableOAuthCallbackError, S as handleBackChannelLogout, T as hasAuthError, _ as createAuthorizationResponseUrl, a as configureRouteProtection, b as getAuthError, c as protectRoute, d as resetRouteProtectionConfig, f as shouldRefreshToken, g as configureAuthClaimMapping, h as clearAuthServerCache, i as authRoute, j as OAUTH_RECOVERY_COOKIE_NAME, k as requireAuth, l as protectedRoute, m as clearAuthErrorHeaders, n as isTokenExpiredResponse, o as onboardingRoute, p as subscriptionRoute, r as shouldAttemptTokenRefresh, s as policyRoute, t as attemptTokenRefresh, u as publicRoute, v as extractUserInfo, w as handleFrontChannelLogout, x as getUser, y as getAccessToken } from "../server-BJTz5-BE.mjs";
 import { clearActiveTenant, clearCurrentTenant, configureIdentityContextFetcher, configureTenantCookie, configureTenantResolution, getActiveTenant, getAvailableTenants, getCurrentTenant, getTenantFromIdentityContext, initializeTenant, isTenantMember, resetTenantCookieConfig, resetTenantResolutionConfig, setActiveTenant, setCurrentTenant } from "../tenant/server.mjs";
 import { clearIdentityContextCache, configureIdentityAPIFetcher, configurePermissionFetcher, contextToUserInfo, fetchIdentityContext, fetchUserPermissions, getIdentityContext, hasContextVersionChanged, updateContextVersion } from "../identity/server.mjs";
 import { n as createFetchMiddleware, r as createAPIConfigFactory, t as createApiClient } from "../server-pnsLybIH.mjs";
 import { checkPermission, configurePermissionRouteProtection, requirePermission, resetPermissionRouteProtection, withPermission } from "../server.mjs";
-export { AUTH_ERROR_COOKIE_PREFIX, ApiError, ErrorCodes, ErrorHandler, IdentityContextProvider, IdentitySignalRClient, LOG_LEVEL_PRIORITY, LogLevel, Logger, OAuthCallbackError, OAuthCallbackFailureCodes, PERMISSION_MODULES, PermissionChecker, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, SignalRClient, TenantProvider, attemptTokenRefresh, authRoute, cachePresets, calculateBackoffDelay, checkPermission, cleanupExpiredOAuthStates, cleanupSignalR, clearActiveTenant, clearAuthErrorHeaders, clearAuthServerCache, clearCurrentTenant, clearIdentityContextCache, closeRedisConnection, configureAuthClaimMapping, configureIdentityAPIFetcher, configureIdentityContextFetcher, configureIdentityEndpoints, configureIdentityStore, configurePermissionFetcher, configurePermissionRouteProtection, configureRouteProtection, configureTenantClient, configureTenantCookie, configureTenantEndpoints, configureTenantResolution, contextToUserInfo, createAPIConfigFactory, createApiClient, createAuthSession, createAuthorizationResponseUrl, createFetchMiddleware, createIdentitySignalRClient, createLogger, createOAuthState, createQueryClient, createQueryKeyFactory, createRetryFetch, defaultLoggerConfig, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, evaluateAccessRequirement, extractUserInfo, fetchIdentityContext, fetchUserPermissions, fetchWithTimeout, getAccessToken, getActiveTenant, getAuthError, getAuthSession, getAuthSessionById, getAvailableTenants, getCurrentAuthSessionId, getCurrentTenant, getIdentityContext, getIdentitySignalRClient, getOAuthState, getPermissionChecker, getPermissions, getTenantCookieName, getTenantFromIdentityContext, getUser, handleApiError, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, hasContextVersionChanged, initialIdentityContext, initializePermissions, initializeSignalR, initializeTenant, initializeTenantStore, invalidationHelpers, isApiClientError, isOAuthCallbackError, isRecoverableOAuthCallbackError, isRetryableError, isSessionValid, isTenantMember, isTokenExpiredResponse, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, logger, login, logout, normalizeIdentityContextPayload, normalizeIdentityPermissionsPayload, normalizeTenantDataPayload, normalizeTenantSwitchPayload, onboardingRoute, policyRoute, protectRoute, protectedRoute, publicRoute, refreshTokens, requireAuth, requireAuthSession, requirePermission, resetAuthClaimMapping, resetIdentityStoreConfig, resetPermissionRouteProtection, resetRouteProtectionConfig, resetTenantClientConfig, resetTenantCookieConfig, resetTenantResolutionConfig, setActiveTenant, setCurrentTenant, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession, updateContextVersion, useAllPermissions, useCurrentOrganization, useCurrentTenant, useCurrentTenantData, useHasEntitlement, useHasModulePermission, useHasPermission, useHasPermissions, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useModulePermission, useOrganization, usePermission, usePermissionChecker, usePermissionStore, usePermissions, useTenant, useTenantData, useTenantStore, useTenantSwitcher, useUserPermissions, useUserTenants, withPermission, withRetry };
+export { AUTH_ERROR_COOKIE_PREFIX, ApiError, ErrorCodes, ErrorHandler, IdentityContextProvider, IdentitySignalRClient, LOG_LEVEL_PRIORITY, LogLevel, Logger, OAUTH_RECOVERY_COOKIE_NAME, OAUTH_RECOVERY_TTL_SECONDS, OAuthCallbackError, OAuthCallbackFailureCodes, PERMISSION_MODULES, PermissionChecker, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, SignalRClient, TenantProvider, attemptTokenRefresh, authRoute, cachePresets, calculateBackoffDelay, checkPermission, cleanupExpiredOAuthStates, cleanupSignalR, clearActiveTenant, clearAuthErrorHeaders, clearAuthServerCache, clearCurrentTenant, clearIdentityContextCache, clearOAuthRecoveryIntentHeaders, closeRedisConnection, configureAuthClaimMapping, configureIdentityAPIFetcher, configureIdentityContextFetcher, configureIdentityEndpoints, configureIdentityStore, configurePermissionFetcher, configurePermissionRouteProtection, configureRouteProtection, configureTenantClient, configureTenantCookie, configureTenantEndpoints, configureTenantResolution, consumeOAuthRecoveryIntent, consumeOAuthRecoveryRecord, contextToUserInfo, createAPIConfigFactory, createApiClient, createAuthSession, createAuthorizationResponseUrl, createFetchMiddleware, createIdentitySignalRClient, createLogger, createOAuthRecoveryRecord, createOAuthState, createQueryClient, createQueryKeyFactory, createRetryFetch, defaultLoggerConfig, deleteOAuthRecoveryRecord, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, evaluateAccessRequirement, extractUserInfo, fetchIdentityContext, fetchUserPermissions, fetchWithTimeout, getAccessToken, getActiveTenant, getAuthError, getAuthSession, getAuthSessionById, getAvailableTenants, getCurrentAuthSessionId, getCurrentTenant, getIdentityContext, getIdentitySignalRClient, getOAuthRecoveryCookiePath, getOAuthState, getPermissionChecker, getPermissions, getTenantCookieName, getTenantFromIdentityContext, getUser, handleApiError, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, hasContextVersionChanged, initialIdentityContext, initializePermissions, initializeSignalR, initializeTenant, initializeTenantStore, invalidationHelpers, isApiClientError, isOAuthCallbackError, isRecoverableOAuthCallbackError, isRetryableError, isSessionValid, isTenantMember, isTokenExpiredResponse, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, logger, login, logout, normalizeIdentityContextPayload, normalizeIdentityPermissionsPayload, normalizeTenantDataPayload, normalizeTenantSwitchPayload, onboardingRoute, policyRoute, protectRoute, protectedRoute, publicRoute, refreshTokens, requireAuth, requireAuthSession, requirePermission, resetAuthClaimMapping, resetIdentityStoreConfig, resetPermissionRouteProtection, resetRouteProtectionConfig, resetTenantClientConfig, resetTenantCookieConfig, resetTenantResolutionConfig, setActiveTenant, setCurrentTenant, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession, updateContextVersion, useAllPermissions, useCurrentOrganization, useCurrentTenant, useCurrentTenantData, useHasEntitlement, useHasModulePermission, useHasPermission, useHasPermissions, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useModulePermission, useOrganization, usePermission, usePermissionChecker, usePermissionStore, usePermissions, useTenant, useTenantData, useTenantStore, useTenantSwitcher, useUserPermissions, useUserTenants, withPermission, withRetry };

package/dist/tenant/server.mjs

@@ -1,4 +1,4 @@
-import { p as getAuthSession } from "../redis-session-storage.server-CI_IYIn8.mjs";
+import { g as getAuthSession } from "../redis-session-storage.server-DLJ0B7-C.mjs";
 //#region src/tenant/tenant-cookie.server.ts
 const DEFAULT_TENANT_COOKIE_CONFIG = {
 	name: "__spine_tenant",

package/docs/adapters.md

@@ -77,14 +77,23 @@ export const Route = createFileRoute('/auth/callback')({
 
 For a normal callback with a non-empty `code` and `state`, a missing or
 expired local OAuth transaction is exposed as `OAuthCallbackError` with
-`isRecoverableOAuthCallbackError(error) === true`. The consuming adapter owns
-loop prevention: record a signed one-shot retry marker, start at most one new
-`login` flow, and render a terminal error on a second stale callback. Never
-retry state mismatches, malformed callbacks, provider/access errors,
-token-exchange failures, storage/configuration failures, or application
-actions. When handling a typed failure, append every value from
-`error.cleanupSetCookies` (or iterate `error.cleanupHeaders`) so repeated
-`Set-Cookie` headers are not collapsed.
+`isRecoverableOAuthCallbackError(error) === true`. The consuming adapter calls
+`consumeOAuthRecoveryIntent(request, error)` to atomically consume Spine's
+opaque, HttpOnly recovery ticket. A non-null `intent.returnUrl` is the
+original sanitized destination and may be passed to one fresh `login` flow;
+null means the ticket was omitted, mismatched, expired, replayed, or
+unavailable, so the adapter must terminate. Do not use a client boolean or
+callback query value as the retry budget or destination. Never retry state
+mismatches, malformed callbacks, provider/access errors, token-exchange
+failures, storage/configuration failures, or application actions. Append every
+value from `error.cleanupSetCookies` and
+`recovery.cleanupHeaders.getSetCookie()` (or iterate both headers) so repeated
+`Set-Cookie` headers are not collapsed. The recovery result also exposes the
+lossless `cleanupSetCookies` array; cleanup must precede replacement login
+cookies. If an adapter needs a standalone clear header, pass the actual
+callback request or configured redirect URI to `clearOAuthRecoveryIntentHeaders`
+or resolve its path with `getOAuthRecoveryCookiePath`; Spine never assumes a
+fixed `/auth/callback` pathname.
 
 Do not return `SessionData`, access tokens, refresh tokens, or raw request
 context from a server function or route. Keep tenant membership checks and

package/docs/module-reference.md

@@ -19,6 +19,11 @@ Key exports:
 - `OAuthCallbackFailureCodes`
 - `isOAuthCallbackError`
 - `isRecoverableOAuthCallbackError`
+- `consumeOAuthRecoveryIntent`
+- `clearOAuthRecoveryIntentHeaders`
+- `getOAuthRecoveryCookiePath`
+- `OAuthRecoveryIntent`
+- `OAuthRecoveryConsumeResult`
 - `logout`
 - `getUser`
 - `requireAuth`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eminuckan/spine",
-  "version": "0.3.9",
+  "version": "0.3.10",
   "description": "Framework-agnostic SaaS primitives for auth, identity, multi-tenancy, permissions, and API access.",
   "type": "module",
   "main": "./dist/index.mjs",