@jmruthers/pace-core 0.5.191 → 0.6.1

package/dist/{chunk-OETXORNB.js → chunk-3XTALGJF.js}

@@ -1,11 +1,11 @@
 import {
   useEventService,
+  useOrganisations,
   useUnifiedAuth
-} from "./chunk-6LTQQAT6.js";
+} from "./chunk-BYFSK72L.js";
 import {
-  ContextValidator,
-  isSuperAdmin
-} from "./chunk-ROXMHMY2.js";
+  ContextValidator
+} from "./chunk-KNC55RTG.js";
 import {
   getCurrentAppName,
   performanceBudgetMonitor
@@ -114,30 +114,45 @@ function useResolvedScope({
         let appConfig = null;
         if (supabase && appName2) {
           try {
-            const cached = appConfigCache.get(appName2);
-            const now = Date.now();
-            if (cached && now - cached.timestamp < CACHE_TTL) {
-              appId = cached.appId;
-              appConfig = cached.appConfig;
+            const { data: session } = await supabase.auth.getSession();
+            if (!session?.session) {
+              log.debug(`Skipping app resolution for "${appName2}" - user not authenticated`);
             } else {
-              const { data: app, error: error2 } = await supabase.from("rbac_apps").select("id, name, requires_event, is_active").eq("name", appName2).eq("is_active", true).single();
-              if (error2) {
-                const { data: inactiveApp } = await supabase.from("rbac_apps").select("id, name, is_active").eq("name", appName2).single();
-                if (inactiveApp) {
-                  log.error(`App "${appName2}" exists but is inactive (is_active: ${inactiveApp.is_active})`);
-                  appId = void 0;
-                } else {
-                  log.error(`App "${appName2}" not found in rbac_apps table`);
-                  appId = void 0;
+              const cached = appConfigCache.get(appName2);
+              const now = Date.now();
+              if (cached && now - cached.timestamp < CACHE_TTL) {
+                appId = cached.appId;
+                appConfig = cached.appConfig;
+              } else {
+                const { data: app, error: error2 } = await supabase.from("rbac_apps").select("id, name, requires_event, is_active").eq("name", appName2).eq("is_active", true).single();
+                if (error2) {
+                  if (error2.code === "406" || error2.code === "PGRST116" || error2.message?.includes("406")) {
+                    log.debug(`App resolution blocked by RLS for "${appName2}" - user may not be authenticated`);
+                    appId = void 0;
+                  } else {
+                    const { data: inactiveApp } = await supabase.from("rbac_apps").select("id, name, is_active").eq("name", appName2).single();
+                    if (inactiveApp) {
+                      log.error(`App "${appName2}" exists but is inactive (is_active: ${inactiveApp.is_active})`);
+                      appId = void 0;
+                    } else {
+                      log.error(`App "${appName2}" not found in rbac_apps table`, { error: error2 });
+                      appId = void 0;
+                    }
+                  }
+                } else if (app) {
+                  appId = app.id;
+                  appConfig = { requires_event: app.requires_event ?? false };
+                  appConfigCache.set(appName2, { appId, appConfig, timestamp: now });
                 }
-              } else if (app) {
-                appId = app.id;
-                appConfig = { requires_event: app.requires_event ?? false };
-                appConfigCache.set(appName2, { appId, appConfig, timestamp: now });
               }
             }
           } catch (error2) {
-            log.error("Unexpected error resolving app config:", error2);
+            const errorMessage = error2 instanceof Error ? error2.message : String(error2);
+            if (!errorMessage.includes("406") && !errorMessage.includes("PGRST116")) {
+              log.error("Unexpected error resolving app config:", error2);
+            } else {
+              log.debug("App resolution skipped - authentication required");
+            }
           }
         }
         const initialScope = {
@@ -399,7 +414,6 @@ function PublicPageProvider({ children, appName }) {
       return null;
     }
     const client = createClient(supabaseUrl, supabaseKey);
-    logger.info("PublicPageProvider", "Supabase client created successfully for public pages");
     return client;
   }, [supabaseUrl, supabaseKey]);
   const contextValue = {
@@ -481,124 +495,185 @@ function useAppConfig() {
   }
 }
 
-// src/rbac/hooks/useSuperAdminBypass.ts
-import { useEffect as useEffect2, useMemo as useMemo5, useRef as useRef3, useState as useState2 } from "react";
-
-// src/utils/context/superAdminOverride.ts
-var log2 = createLogger("superAdminOverride");
-async function setSuperAdminOverrideFlag({
-  supabase,
-  enabled,
-  reason = "client_request"
-}) {
-  if (!supabase) {
-    return;
-  }
-  try {
-    const { error } = await supabase.rpc("set_super_admin_override", {
-      p_enabled: enabled,
-      p_reason: reason
-    });
-    if (error) {
-      log2.error("Failed to toggle super admin override", {
-        enabled,
-        reason,
-        error: error.message
-      });
-    } else {
-      log2.debug("Super admin override flag updated", { enabled, reason });
-    }
-  } catch (rpcError) {
-    log2.error("Unexpected error toggling super admin override", {
-      enabled,
-      reason,
-      error: rpcError instanceof Error ? rpcError.message : rpcError
-    });
-  }
-}
-
-// src/rbac/hooks/useSuperAdminBypass.ts
-var log3 = createLogger("useSuperAdminBypass");
-function useSafeUnifiedAuth() {
-  try {
-    return useUnifiedAuth();
-  } catch (error) {
-    log3.debug("useSuperAdminBypass", "UnifiedAuthProvider not available, falling back to defaults", {
-      error: error instanceof Error ? error.message : error
-    });
-    return null;
-  }
-}
-function useSuperAdminBypass() {
-  const authContext = useSafeUnifiedAuth();
-  const user = authContext?.user ?? null;
-  const supabase = authContext?.supabase ?? null;
-  const metadataHint = Boolean(user?.app_metadata?.is_super_admin) || Boolean(user?.user_metadata?.is_super_admin);
-  const [isSuperAdminState, setIsSuperAdminState] = useState2(metadataHint);
-  const [hasVerified, setHasVerified] = useState2(!user?.id);
-  const [isLoading, setIsLoading] = useState2(!!user?.id);
-  const [error, setError] = useState2(null);
-  const lastOverrideValueRef = useRef3(null);
+// src/hooks/useOrganisationSecurity.ts
+import { useCallback, useMemo as useMemo5, useEffect as useEffect2, useState as useState2 } from "react";
+var useOrganisationSecurity = () => {
+  const { user, session, supabase } = useUnifiedAuth();
+  const { selectedOrganisation, getUserRole, validateOrganisationAccess: validateAccess } = useOrganisations();
+  const [isSuperAdmin, setIsSuperAdmin] = useState2(false);
+  const [isCheckingSuperAdmin, setIsCheckingSuperAdmin] = useState2(false);
   useEffect2(() => {
-    if (!user?.id) {
-      setIsSuperAdminState(false);
-      setHasVerified(true);
-      setIsLoading(false);
-      setError(null);
+    if (!user || !session || !supabase) {
+      setIsSuperAdmin(false);
       return;
     }
-    let cancelled = false;
-    setIsLoading(true);
-    setError(null);
-    isSuperAdmin(user.id).then((result) => {
-      if (cancelled) {
-        return;
+    const checkSuperAdmin = async () => {
+      setIsCheckingSuperAdmin(true);
+      try {
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        const { data, error } = await supabase.from("rbac_global_roles").select("role").eq("user_id", user.id).eq("role", "super_admin").lte("valid_from", now).or(`valid_to.is.null,valid_to.gte.${now}`).limit(1);
+        setIsSuperAdmin(!error && data && data.length > 0);
+      } catch (error) {
+        logger.error("useOrganisationSecurity", "Error checking super admin status:", error);
+        setIsSuperAdmin(false);
+      } finally {
+        setIsCheckingSuperAdmin(false);
       }
-      setIsSuperAdminState(result);
-      setHasVerified(true);
-    }).catch((err) => {
-      if (cancelled) {
-        return;
+    };
+    checkSuperAdmin();
+  }, [user, session, supabase]);
+  const superAdminContext = useMemo5(() => {
+    return {
+      isSuperAdmin,
+      hasGlobalAccess: isSuperAdmin,
+      canManageAllOrganisations: isSuperAdmin
+    };
+  }, [isSuperAdmin]);
+  const validateOrganisationAccess = useCallback(async (orgId) => {
+    if (!user || !session || !supabase) return false;
+    try {
+      if (superAdminContext.isSuperAdmin) {
+        return true;
       }
-      const normalisedError = err instanceof Error ? err : new Error("Failed to resolve super admin status");
-      setError(normalisedError);
-      setIsSuperAdminState(false);
-      setHasVerified(false);
-      log3.error("Unable to verify super admin status", normalisedError);
-    }).finally(() => {
-      if (!cancelled) {
-        setIsLoading(false);
+      const { data, error } = await supabase.from("rbac_organisation_roles").select("id").eq("user_id", user.id).eq("organisation_id", orgId).eq("status", "active").is("revoked_at", null).in("role", ["org_admin", "leader", "member"]).single();
+      if (error) {
+        logger.error("useOrganisationSecurity", "Error validating organisation access:", error);
+        return false;
       }
-    });
-    return () => {
-      cancelled = true;
-    };
-  }, [user?.id]);
-  const shouldBypass = hasVerified && isSuperAdminState;
-  useEffect2(() => {
-    if (!supabase) {
-      return;
+      return !!data;
+    } catch (error) {
+      logger.error("useOrganisationSecurity", "Exception validating organisation access:", error);
+      return false;
     }
-    if (lastOverrideValueRef.current === shouldBypass) {
-      return;
+  }, [user, session, supabase, superAdminContext.isSuperAdmin]);
+  const hasMinimumRole = useCallback((minRole, orgId) => {
+    if (superAdminContext.isSuperAdmin) {
+      return true;
     }
-    lastOverrideValueRef.current = shouldBypass;
-    setSuperAdminOverrideFlag({
-      supabase,
-      enabled: shouldBypass,
-      reason: "pace-core-super-admin-bypass"
-    }).catch(() => {
-    });
-  }, [supabase, shouldBypass]);
-  return useMemo5(
-    () => ({
-      isSuperAdmin: shouldBypass,
-      isLoading,
-      error
-    }),
-    [shouldBypass, isLoading, error]
-  );
-}
+    const targetOrgId = orgId || selectedOrganisation?.id;
+    if (!targetOrgId) return false;
+    const userRole = getUserRole(targetOrgId);
+    const roleHierarchy = ["supporter", "member", "leader", "org_admin"];
+    const userRoleIndex = roleHierarchy.indexOf(userRole);
+    const minRoleIndex = roleHierarchy.indexOf(minRole);
+    return userRoleIndex >= minRoleIndex;
+  }, [selectedOrganisation, getUserRole, superAdminContext.isSuperAdmin]);
+  const canAccessChildOrganisations = useCallback((orgId) => {
+    if (superAdminContext.isSuperAdmin) {
+      return true;
+    }
+    const targetOrgId = orgId || selectedOrganisation?.id;
+    if (!targetOrgId) return false;
+    const userRole = getUserRole(targetOrgId);
+    return userRole === "org_admin";
+  }, [selectedOrganisation, getUserRole, superAdminContext.isSuperAdmin]);
+  const hasPermission = useCallback(async (permission, orgId) => {
+    if (superAdminContext.isSuperAdmin) {
+      return true;
+    }
+    const targetOrgId = orgId || selectedOrganisation?.id;
+    if (!targetOrgId || !user) return false;
+    try {
+      const { isPermittedCached } = await import("./api-N774RPUA.js");
+      const scope = {
+        organisationId: targetOrgId,
+        eventId: user.user_metadata?.eventId || user.app_metadata?.eventId,
+        appId: user.user_metadata?.appId || user.app_metadata?.appId
+      };
+      return await isPermittedCached({
+        userId: user.id,
+        scope,
+        permission
+      });
+    } catch (error) {
+      logger.error("useOrganisationSecurity", "Exception checking permission:", error);
+      return false;
+    }
+  }, [selectedOrganisation, user, superAdminContext.isSuperAdmin]);
+  const getUserPermissions = useCallback(async (orgId) => {
+    if (superAdminContext.isSuperAdmin) {
+      return ["*"];
+    }
+    const targetOrgId = orgId || selectedOrganisation?.id;
+    if (!targetOrgId || !user) return [];
+    try {
+      const { getPermissionMap } = await import("./api-N774RPUA.js");
+      const scope = {
+        organisationId: targetOrgId,
+        eventId: user.user_metadata?.eventId || user.app_metadata?.eventId,
+        appId: user.user_metadata?.appId || user.app_metadata?.appId
+      };
+      const permissionMap = await getPermissionMap({
+        userId: user.id,
+        scope
+      });
+      const allPermissions = Object.entries(permissionMap).filter(([, allowed]) => allowed).map(([permission]) => permission);
+      return [...new Set(allPermissions)];
+    } catch (error) {
+      logger.error("useOrganisationSecurity", "Exception getting user permissions:", error);
+      return [];
+    }
+  }, [selectedOrganisation, user, getUserRole, superAdminContext.isSuperAdmin]);
+  const logOrganisationAccess = useCallback(async (action, details) => {
+    if (!user || !selectedOrganisation) return;
+    try {
+      if (selectedOrganisation.id) {
+        const { emitAuditEvent } = await import("./audit-B5P6FFIR.js");
+        await emitAuditEvent({
+          type: "permission_check",
+          userId: user.id,
+          organisationId: selectedOrganisation.id,
+          permission: action,
+          decision: true,
+          // Assume access was granted if we're logging it
+          source: "api",
+          duration_ms: 0,
+          // No actual permission check performed here
+          metadata: details || {}
+        });
+      }
+    } catch (error) {
+      logger.error("useOrganisationSecurity", "Error logging organisation access:", error);
+    }
+  }, [user, selectedOrganisation]);
+  const ensureOrganisationAccess = useCallback(async (orgId) => {
+    const hasAccess = await validateOrganisationAccess(orgId);
+    if (!hasAccess) {
+      const error = new Error(`User does not have access to organisation ${orgId}`);
+      error.name = "OrganisationSecurityError";
+      error.code = "ACCESS_DENIED";
+      error.organisationId = orgId;
+      error.userId = user?.id;
+      throw error;
+    }
+  }, [validateOrganisationAccess, user]);
+  const validateUserAccess = useCallback(async (userId, orgId) => {
+    if (!supabase) return false;
+    try {
+      if (superAdminContext.isSuperAdmin) {
+        return true;
+      }
+      if (userId !== user?.id) {
+        return false;
+      }
+      return await validateOrganisationAccess(orgId);
+    } catch (error) {
+      logger.error("useOrganisationSecurity", "Exception validating user access:", error);
+      return false;
+    }
+  }, [supabase, superAdminContext.isSuperAdmin, user, validateOrganisationAccess]);
+  return {
+    superAdminContext,
+    validateOrganisationAccess,
+    hasMinimumRole,
+    canAccessChildOrganisations,
+    hasPermission,
+    getUserPermissions,
+    logOrganisationAccess,
+    ensureOrganisationAccess,
+    validateUserAccess
+  };
+};
 
 export {
   useEvents,
@@ -609,6 +684,6 @@ export {
   usePublicPageContext,
   useIsPublicPage,
   useAppConfig,
-  useSuperAdminBypass
+  useOrganisationSecurity
 };
-//# sourceMappingURL=chunk-OETXORNB.js.map
+//# sourceMappingURL=chunk-3XTALGJF.js.map

package/dist/chunk-3XTALGJF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hooks/useEvents.ts","../src/rbac/hooks/useResolvedScope.ts","../src/components/ErrorBoundary/ErrorBoundary.tsx","../src/components/PublicLayout/PublicPageProvider.tsx","../src/hooks/useAppConfig.ts","../src/hooks/useOrganisationSecurity.ts"],"sourcesContent":["/**\n * @file Event Hook\n * @package @jmruthers/pace-core\n * @module Hooks\n * @since 0.1.0\n *\n * Convenience hook for accessing event context.\n * This hook provides a simple interface for working with events.\n * \n * Note: This is a convenience wrapper around the EventService.\n * For better performance, consider using useEventService directly.\n */\n\nimport { useMemo, useRef } from 'react';\nimport { useEventService } from './services/useEventService';\nimport { Event } from '../types/event';\n\nexport interface EventContextType {\n  events: Event[];\n  selectedEvent: Event | null;\n  isLoading: boolean;\n  error: Error | null;\n  setSelectedEvent: (event: Event | null) => void;\n  refreshEvents: () => Promise<void>;\n  clearEventSelection: () => Promise<void>;\n}\n\n/**\n * Hook to access event context\n * \n * @returns Event context with events, selected event, and helper methods\n * @throws {Error} If used outside EventServiceProvider\n * \n * @example\n * ```tsx\n * function MyComponent() {\n *   const { events, selectedEvent, setSelectedEvent } = useEvents();\n *   \n *   return (\n *     <div>\n *       {events.map(event => (\n *         <button key={event.id} onClick={() => setSelectedEvent(event)}>\n *           {event.event_name}\n *         </button>\n *       ))}\n *     </div>\n *   );\n * }\n * ```\n */\nexport function useEvents(): EventContextType {\n  const eventService = useEventService();\n\n  // Get current state - service subscription will trigger re-renders when state changes\n  const rawEvents = eventService.getEvents();\n  const selectedEvent = eventService.getSelectedEvent();\n  const isLoading = eventService.isLoading();\n  const error = eventService.getError();\n\n  // Use refs to track previous values and only create new array reference when events actually change\n  const prevEventsRef = useRef<Event[]>([]);\n  const prevEventsIdsRef = useRef<string>('');\n  \n  // Compare event IDs to detect actual changes (more efficient than deep comparison)\n  // Do this outside useMemo to avoid dependency on rawEvents array\n  const currentEventsIds = rawEvents.map(e => e.event_id || e.id).join(',');\n  const eventsChanged = currentEventsIds !== prevEventsIdsRef.current;\n  \n  // Only create new array reference when events actually changed\n  // Update refs synchronously, then memoize based on the ID string\n  if (eventsChanged) {\n    prevEventsRef.current = rawEvents;\n    prevEventsIdsRef.current = currentEventsIds;\n  }\n  \n  // Return stable array reference - only changes when event IDs change\n  const events = useMemo(() => {\n    return prevEventsRef.current;\n  }, [currentEventsIds]);\n\n  // Memoize callbacks to prevent unnecessary re-renders in child components\n  const setSelectedEventCallback = useMemo(\n    () => (event: Event | null) => eventService.setSelectedEvent(event),\n    [eventService]\n  );\n  const refreshEventsCallback = useMemo(\n    () => () => eventService.refreshEvents(),\n    [eventService]\n  );\n  const clearEventSelectionCallback = useMemo(\n    () => () => eventService.clearEventSelection(),\n    [eventService]\n  );\n\n  // Memoize the return object - only recreate when actual values change\n  return useMemo(() => ({\n    events,\n    selectedEvent,\n    isLoading,\n    error,\n    setSelectedEvent: setSelectedEventCallback,\n    refreshEvents: refreshEventsCallback,\n    clearEventSelection: clearEventSelectionCallback,\n  }), [events, selectedEvent?.event_id, isLoading, error?.message, setSelectedEventCallback, refreshEventsCallback, clearEventSelectionCallback]);\n}\n\n","/**\n * @file useResolvedScope Hook\n * @package @jmruthers/pace-core\n * @module RBAC/Hooks\n * @since 1.0.0\n * \n * Shared hook for resolving RBAC scope from various contexts.\n * This hook is used by both DataTable and PagePermissionGuard to ensure\n * consistent scope resolution logic.\n */\n\nimport { useEffect, useState, useRef, useMemo } from 'react';\nimport { SupabaseClient } from '@supabase/supabase-js';\nimport type { Database } from '../../types/database';\nimport type { Scope } from '../types';\nimport { ContextValidator } from '../utils/contextValidator';\nimport type { AppConfig } from '../utils/contextValidator';\nimport { getCurrentAppName } from '../../utils/app/appNameResolver';\nimport { createLogger } from '../../utils/core/logger';\n\nconst log = createLogger('useResolvedScope');\n\n// Cache app config to avoid repeated database queries\n// App config rarely changes during a session, so we can cache it\nconst appConfigCache = new Map<string, { appId: string; appConfig: AppConfig; timestamp: number }>();\nconst CACHE_TTL = 5 * 60 * 1000; // 5 minutes\n\n// Export function to clear cache (for testing)\nexport function clearAppConfigCache(): void {\n  appConfigCache.clear();\n}\n\nexport interface UseResolvedScopeOptions {\n  /** Supabase client instance */\n  supabase: SupabaseClient<Database> | null;\n  /** Selected organisation ID */\n  selectedOrganisationId: string | null;\n  /** Selected event ID */\n  selectedEventId: string | null;\n}\n\nexport interface UseResolvedScopeReturn {\n  /** Resolved scope, or null if not yet resolved */\n  resolvedScope: Scope | null;\n  /** Whether the scope resolution is in progress */\n  isLoading: boolean;\n  /** Error if scope resolution failed */\n  error: Error | null;\n}\n\n/**\n * Resolves RBAC scope from organisation and event context\n * \n * This hook handles the complex logic of determining the correct RBAC scope\n * based on available context (organisation, event, app). It ensures consistent\n * scope resolution across the application.\n * \n * @param options - Hook options\n * @returns Resolved scope and loading state\n * \n * @example\n * ```tsx\n * const { resolvedScope, isLoading } = useResolvedScope({\n *   supabase,\n *   selectedOrganisationId,\n *   selectedEventId\n * });\n * \n * if (isLoading) return <Loading />;\n * if (!resolvedScope) return <Error />;\n * \n * const permission = useCan(userId, resolvedScope, permission);\n * ```\n */\nexport function useResolvedScope({\n  supabase,\n  selectedOrganisationId,\n  selectedEventId\n}: UseResolvedScopeOptions): UseResolvedScopeReturn {\n  const [resolvedScope, setResolvedScope] = useState<Scope | null>(null);\n  const [isLoading, setIsLoading] = useState(true);\n  const [error, setError] = useState<Error | null>(null);\n  \n  // Use a ref to track the stable scope and only update it when it actually changes\n  const stableScopeRef = useRef<{ organisationId: string; appId: string; eventId: string | undefined }>({ \n    organisationId: '', \n    appId: '', \n    eventId: undefined \n  });\n  \n  // Update stable scope ref in useEffect to avoid updates during render\n  // For PORTAL, allow scopes without organisationId\n  useEffect(() => {\n    if (resolvedScope) {\n      const newScope = {\n        organisationId: resolvedScope.organisationId || '',\n        appId: resolvedScope.appId || '',\n        eventId: resolvedScope.eventId\n      };\n      \n      // Only update if the scope has actually changed\n      if (stableScopeRef.current.organisationId !== newScope.organisationId ||\n          stableScopeRef.current.eventId !== newScope.eventId ||\n          stableScopeRef.current.appId !== newScope.appId) {\n        stableScopeRef.current = {\n          organisationId: newScope.organisationId,\n          appId: newScope.appId,\n          eventId: newScope.eventId\n        };\n      }\n    } else {\n      // Reset to empty scope when no resolved scope\n      stableScopeRef.current = { organisationId: '', appId: '', eventId: undefined };\n    }\n  }, [resolvedScope]);\n  \n  // Get app name to check if it's PORTAL (needed for return logic)\n  const appName = getCurrentAppName();\n  \n  const stableScope = stableScopeRef.current;\n  \n  useEffect(() => {\n    let cancelled = false;\n    \n    const resolveScope = async () => {\n      // OPTIMIZATION: If all inputs are null/undefined, immediately return empty scope\n      // This indicates pre-filtered mode where we don't need to resolve scope\n      if (!supabase && !selectedOrganisationId && !selectedEventId) {\n        if (!cancelled) {\n          setResolvedScope(null);\n          setIsLoading(false);\n          setError(null);\n        }\n        return;\n      }\n      \n      setIsLoading(true);\n      setError(null);\n      \n      try {\n        // Get app name and config\n        const appName = getCurrentAppName();\n        let appId: string | undefined = undefined;\n        let appConfig: AppConfig | null = null;\n        \n        // Try to resolve app config from database (with caching)\n        // Only query if user is authenticated (RLS policies require authentication)\n        if (supabase && appName) {\n          try {\n            // Check if user is authenticated before querying (RLS requires auth)\n            // HTTP 406 errors are expected when not authenticated, so we skip the query\n            const { data: session } = await supabase.auth.getSession();\n            if (!session?.session) {\n              // User not authenticated - skip app resolution, will retry after login\n              // This is expected on login pages, so don't log as error\n              log.debug(`Skipping app resolution for \"${appName}\" - user not authenticated`);\n            } else {\n              // Check cache first\n              const cached = appConfigCache.get(appName);\n              const now = Date.now();\n              if (cached && (now - cached.timestamp) < CACHE_TTL) {\n                appId = cached.appId;\n                appConfig = cached.appConfig;\n              } else {\n                // Cache miss or expired - fetch from database\n                const { data: app, error } = await supabase\n                  .from('rbac_apps')\n                  .select('id, name, requires_event, is_active')\n                  .eq('name', appName)\n                  .eq('is_active', true)\n                  .single() as { data: { id: string; name: string; requires_event: boolean; is_active: boolean } | null; error: any };\n                \n                if (error) {\n                  // HTTP 406 is expected when not authenticated (RLS blocks query)\n                  // Don't log as error if it's a 406 - this is expected behavior\n                  if (error.code === '406' || error.code === 'PGRST116' || error.message?.includes('406')) {\n                    log.debug(`App resolution blocked by RLS for \"${appName}\" - user may not be authenticated`);\n                    // Don't cache - will retry after authentication\n                    appId = undefined;\n                  } else {\n                    // Check if app exists but is inactive\n                    const { data: inactiveApp } = await supabase\n                      .from('rbac_apps')\n                      .select('id, name, is_active')\n                      .eq('name', appName)\n                      .single() as { data: { id: string; name: string; is_active: boolean } | null };\n                    \n                    if (inactiveApp) {\n                      log.error(`App \"${appName}\" exists but is inactive (is_active: ${inactiveApp.is_active})`);\n                      // Don't cache inactive apps - set appId to undefined\n                      appId = undefined;\n                    } else {\n                      log.error(`App \"${appName}\" not found in rbac_apps table`, { error });\n                      // Don't cache missing apps - set appId to undefined\n                      appId = undefined;\n                    }\n                  }\n                } else if (app) {\n                  appId = app.id;\n                  appConfig = { requires_event: app.requires_event ?? false };\n                  // Only cache successful lookups of active apps\n                  appConfigCache.set(appName, { appId, appConfig, timestamp: now });\n                }\n              }\n            }\n          } catch (error) {\n            // Handle network errors or other unexpected errors gracefully\n            // Don't log 406 errors as they're expected when not authenticated\n            const errorMessage = error instanceof Error ? error.message : String(error);\n            if (!errorMessage.includes('406') && !errorMessage.includes('PGRST116')) {\n              log.error('Unexpected error resolving app config:', error);\n            } else {\n              log.debug('App resolution skipped - authentication required');\n            }\n          }\n        }\n\n        // Build initial scope from available context\n        // For event-required apps: Only use eventId (org will be derived)\n        // For org-required apps: Only use organisationId (event is optional)\n        const initialScope: Scope = {\n          organisationId: appConfig?.requires_event ? undefined : (selectedOrganisationId || undefined),\n          eventId: selectedEventId || undefined,\n          appId: appId\n        };\n\n        // Use ContextValidator to resolve required context\n        // For PORTAL, always allow scope resolution even if appConfig is null\n        const validation = await ContextValidator.resolveRequiredContext(\n          initialScope,\n          appConfig,\n          appName || undefined,\n          supabase\n        );\n\n        if (!validation.isValid) {\n          // For PORTAL/ADMIN apps, allow scope without org/event even if validation fails\n          if (appName === 'PORTAL' || appName === 'ADMIN') {\n            if (!cancelled) {\n              // For PORTAL/ADMIN, we need at least an appId. If we don't have it from the query,\n              // we'll set it to undefined and let the component handle it (it can use contextAppId)\n              const optionalContextScope: Scope = {\n                organisationId: undefined,\n                eventId: undefined,\n                appId: appId || undefined // appId might be undefined if query failed, that's OK\n              };\n              setResolvedScope(optionalContextScope);\n              setError(null);\n              setIsLoading(false);\n            }\n            return;\n          }\n          \n          // For event-required apps: if validation fails but we have an eventId, return scope with eventId\n          // The organisation will be derived later during permission checks\n          if (appConfig?.requires_event && selectedEventId) {\n            if (!cancelled) {\n              const eventScope: Scope = {\n                organisationId: undefined, // Will be derived from event during permission check\n                eventId: selectedEventId,\n                appId: appId || undefined\n              };\n              setResolvedScope(eventScope);\n              setError(null); // Don't set error - let permission check handle derivation\n              setIsLoading(false);\n            }\n            return;\n          }\n          \n          if (!cancelled) {\n            setResolvedScope(null);\n            setError(validation.error || new Error('Context validation failed'));\n            setIsLoading(false);\n          }\n          return;\n        }\n\n        // Set resolved scope\n        if (!cancelled) {\n          setResolvedScope(validation.resolvedScope);\n          setError(null);\n          setIsLoading(false);\n        }\n      } catch (err) {\n        if (!cancelled) {\n          setError(err as Error);\n          setIsLoading(false);\n        }\n      }\n    };\n\n    resolveScope();\n    \n    return () => {\n      cancelled = true;\n    };\n  }, [selectedOrganisationId, selectedEventId, supabase]);\n  \n  // Return scope if it has appId (for PORTAL/ADMIN) or organisationId (for other apps)\n  // For PORTAL/ADMIN, always return a scope (even if empty) so components can use contextAppId\n  const allowsOptionalContexts = appName === 'PORTAL' || appName === 'ADMIN';\n  const hasValidScope = allowsOptionalContexts\n    ? true // PORTAL/ADMIN always have valid scope (even without org/event/appId)\n    : (stableScope.appId || stableScope.organisationId);\n  \n  // CRITICAL FIX: Memoize finalScope to prevent creating new object references on every render\n  // This prevents infinite loops in useCan and other hooks that depend on scope equality\n  const finalScope: Scope | null = useMemo(() => {\n    if (!hasValidScope) {\n      return allowsOptionalContexts ? {} : null;\n    }\n    \n    // Build scope object only with defined values to ensure stable reference\n    const scope: Scope = {};\n    if (stableScope.organisationId) {\n      scope.organisationId = stableScope.organisationId;\n    }\n    if (stableScope.eventId) {\n      scope.eventId = stableScope.eventId;\n    }\n    if (stableScope.appId) {\n      scope.appId = stableScope.appId;\n    }\n    \n    return scope;\n  }, [hasValidScope, allowsOptionalContexts, stableScope.organisationId, stableScope.eventId, stableScope.appId]);\n  \n  return {\n    resolvedScope: finalScope,\n    isLoading,\n    error\n  };\n}\n","/**\n * @file Error Boundary Component\n * @package @jmruthers/pace-core\n * @module Components/ErrorBoundary\n * @since 0.1.0\n *\n * A comprehensive error boundary component that catches JavaScript errors in child components\n * and provides fallback UI with retry functionality and error reporting.\n *\n * Features:\n * - Catches JavaScript errors in component tree\n * - Custom fallback UI with retry functionality\n * - Error reporting and logging\n * - Performance monitoring integration\n * - Retry mechanism with configurable attempts\n * - Development mode error details\n * - Accessibility compliant error display\n * - Component-specific error tracking\n * - Error ID generation for tracking\n *\n * @example\n * ```tsx\n * // Basic error boundary\n * <ErrorBoundary>\n *   <MyComponent />\n * </ErrorBoundary>\n * \n * // Error boundary with custom fallback\n * <ErrorBoundary\n *   componentName=\"UserProfile\"\n *   fallback={<div>Something went wrong loading the profile.</div>}\n *   onError={(error, errorInfo, errorId) => {\n *     console.log('Error caught:', errorId, error);\n *   }}\n * >\n *   <UserProfile />\n * </ErrorBoundary>\n * \n * // Error boundary with retry functionality\n * <ErrorBoundary\n *   componentName=\"DataTable\"\n *   maxRetries={3}\n *   enableRetry={true}\n *   enableReporting={true}\n *   onError={(error, errorInfo, errorId) => {\n *     // Send to error reporting service\n *     errorReportingService.report({ error, errorInfo, errorId });\n *   }}\n * >\n *   <DataTable data={data} />\n * </ErrorBoundary>\n * \n * // Wrapping multiple components\n * <ErrorBoundary componentName=\"App\">\n *   <Header />\n *   <ErrorBoundary componentName=\"MainContent\">\n *     <MainContent />\n *   </ErrorBoundary>\n *   <Footer />\n * </ErrorBoundary>\n * ```\n *\n * @accessibility\n * - WCAG 2.1 AA compliant\n * - Proper ARIA role=\"alert\" for error announcements\n * - Screen reader friendly error messages\n * - Keyboard accessible retry buttons\n * - High contrast error styling\n * - Clear error identification\n *\n * @performance\n * - Efficient error state management\n * - Performance monitoring integration\n * - Minimal impact on normal rendering\n * - Configurable error reporting\n *\n * @dependencies\n * - React 19+ - Component lifecycle\n * - Performance monitoring utilities\n * - Tailwind CSS - Styling\n */\n\nimport React, { Component, ReactNode } from 'react';\nimport { performanceBudgetMonitor } from '../../utils/performance/performanceBudgets';\nimport { logger } from '../../utils/core/logger';\n\n/**\n * State interface for the ErrorBoundary component\n * @public\n */\nexport interface ErrorBoundaryState {\n  /** Whether an error has been caught */\n  hasError: boolean;\n  /** The error that was caught */\n  error?: Error;\n  /** Additional error information from React */\n  errorInfo?: React.ErrorInfo;\n  /** Unique identifier for the error */\n  errorId?: string;\n  /** Number of retry attempts made */\n  retryCount: number;\n}\n\n/**\n * Props interface for the ErrorBoundary component\n * @public\n */\nexport interface ErrorBoundaryProps {\n  /** Child components to wrap with error boundary */\n  children: ReactNode;\n  /** Name of the component for error reporting */\n  componentName?: string;\n  /** Custom fallback UI to display when error occurs */\n  fallback?: ReactNode;\n  /** Callback function called when an error is caught */\n  onError?: (error: Error, errorInfo: React.ErrorInfo, errorId: string) => void;\n  /** Maximum number of retry attempts */\n  maxRetries?: number;\n  /** Whether to enable retry functionality */\n  enableRetry?: boolean;\n  /** Whether to enable error reporting */\n  enableReporting?: boolean;\n}\n\n/**\n * ErrorBoundary component\n * Catches JavaScript errors in child components and provides fallback UI\n * \n * @example\n * ```tsx\n * <ErrorBoundary\n *   componentName=\"MyComponent\"\n *   maxRetries={3}\n *   onError={(error, errorInfo, errorId) => {\n *     console.log('Error caught:', errorId);\n *   }}\n * >\n *   <MyComponent />\n * </ErrorBoundary>\n * ```\n */\nexport class ErrorBoundary extends Component<ErrorBoundaryProps, ErrorBoundaryState> {\n  private retryTimeoutId: NodeJS.Timeout | null = null;\n\n  constructor(props: ErrorBoundaryProps) {\n    super(props);\n    this.state = { \n      hasError: false, \n      retryCount: 0 \n    };\n  }\n\n  static getDerivedStateFromError(error: Error): Partial<ErrorBoundaryState> {\n    const errorId = `error_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;\n    return { \n      hasError: true, \n      error,\n      errorId \n    };\n  }\n\n  componentDidCatch(error: Error, errorInfo: React.ErrorInfo) {\n    const { componentName = 'Unknown Component', onError, enableReporting = true } = this.props;\n    const errorId = this.state.errorId!;\n    \n    this.setState({ errorInfo });\n    \n    // Enhanced logging with component name and error ID\n    logger.error('ErrorBoundary', `[${componentName}] Caught error ${errorId}:`, error, errorInfo);\n    \n    // Performance monitoring - track error occurrence\n    performanceBudgetMonitor.measure('ERROR_BOUNDARY_TRIGGER', 1, {\n      componentName,\n      errorId,\n      errorMessage: error.message,\n      stack: error.stack?.substring(0, 200), // Truncated stack trace\n    });\n\n    // Report error if enabled\n    if (enableReporting) {\n      this.reportError(errorId, componentName);\n    }\n    \n    // Call custom error handler if provided\n    if (onError) {\n      onError(error, errorInfo, errorId);\n    }\n  }\n\n  private reportError = (errorId: string, componentName: string) => {\n    // In production, this would send to error reporting service\n    if (import.meta.env.MODE === 'production') {\n      // Example: Send to error reporting service\n      // errorReportingService.report({ error, errorInfo, errorId, componentName });\n      logger.warn('ErrorBoundary', 'Error reporting would be triggered in production:', { errorId, componentName });\n    }\n  };\n\n  private handleRetry = () => {\n    const { maxRetries = 3 } = this.props;\n    const { retryCount } = this.state;\n\n    if (retryCount < maxRetries) {\n      logger.debug('ErrorBoundary', `Retrying component render (attempt ${retryCount + 1}/${maxRetries})`);\n      \n      this.setState(prevState => ({\n        hasError: false,\n        error: undefined,\n        errorInfo: undefined,\n        errorId: undefined,\n        retryCount: prevState.retryCount + 1\n      }));\n    }\n  };\n\n  componentWillUnmount() {\n    if (this.retryTimeoutId) {\n      clearTimeout(this.retryTimeoutId);\n    }\n  }\n\n  render() {\n    if (this.state.hasError) {\n      const { \n        componentName = 'Component', \n        fallback, \n        enableRetry = true, \n        maxRetries = 3 \n      } = this.props;\n      const { retryCount, errorId } = this.state;\n\n      // Use custom fallback if provided\n      if (fallback) {\n        return fallback;\n      }\n\n      // Enhanced error UI with retry functionality\n      return (\n        <div \n          role=\"alert\" \n          className=\"p-6 bg-destructive/10 border border-destructive/20 rounded-lg\"\n          data-error-boundary={errorId}\n        >\n          <div className=\"flex items-start gap-3\">\n            <div className=\"flex-shrink-0\">\n              <svg className=\"w-5 h-5 text-destructive\" viewBox=\"0 0 20 20\" fill=\"currentColor\">\n                <path fillRule=\"evenodd\" d=\"M18 10a8 8 0 11-16 0 8 8 0 0116 0zm-7 4a1 1 0 11-2 0 1 1 0 012 0zm-1-9a1 1 0 00-1 1v4a1 1 0 102 0V6a1 1 0 00-1-1z\" clipRule=\"evenodd\" />\n              </svg>\n            </div>\n            <div className=\"flex-1 min-w-0\">\n              <h3 className=\"text-destructive\">\n                Error in {componentName}\n              </h3>\n              <p className=\"text-destructive/80\">\n                {this.state.error?.message || 'An unexpected error occurred.'}\n              </p>\n              \n              {enableRetry && retryCount < maxRetries && (\n                <div className=\"flex gap-3 mb-4\">\n                  <button\n                    onClick={this.handleRetry}\n                    className=\"px-4 py-2 bg-destructive text-destructive-foreground rounded-md hover:bg-destructive/90 transition-colors text-sm font-medium\"\n                  >\n                    Retry ({retryCount + 1}/{maxRetries})\n                  </button>\n                  <button\n                    onClick={() => window.location.reload()}\n                    className=\"px-4 py-2 bg-sec-600 text-main-50 rounded-md hover:bg-sec-700 transition-colors text-sm font-medium\"\n                  >\n                    Reload Page\n                  </button>\n                </div>\n              )}\n\n              {retryCount >= maxRetries && (\n                <div className=\"mb-4 p-3 bg-acc-50 border border-acc-200 rounded-md\">\n                  <p className=\"text-acc-800\">\n                    Maximum retry attempts reached. Please reload the page or contact support.\n                  </p>\n                  <button\n                    onClick={() => window.location.reload()}\n                    className=\"mt-2 px-3 py-1 bg-acc-600 text-main-50 rounded text-sm hover:bg-acc-700\"\n                  >\n                    Reload Page\n                  </button>\n                </div>\n              )}\n\n              {import.meta.env.MODE === 'development' && this.state.error && (\n                <details className=\"text-sm text-destructive/70\">\n                  <summary className=\"cursor-pointer font-medium mb-2\">\n                    Error Details (Development)\n                  </summary>\n                  <div className=\"bg-destructive/5 p-3 rounded border\">\n                    <p className=\"font-mono\">Error ID: {errorId}</p>\n                    <pre className=\"whitespace-pre-wrap text-xs overflow-auto max-h-32\">\n                      {this.state.error.toString()}\n                      {this.state.errorInfo?.componentStack}\n                    </pre>\n                  </div>\n                </details>\n              )}\n            </div>\n          </div>\n        </div>\n      );\n    }\n\n    return this.props.children;\n  }\n}\n\nexport default ErrorBoundary;\n","/**\n * @file Public Page Provider\n * @package @jmruthers/pace-core\n * @module Components/PublicLayout\n * @since 1.0.0\n *\n * A completely isolated provider for public pages that doesn't trigger\n * any authentication context. This ensures public pages work independently\n * of the main application's authentication system.\n *\n * Features:\n * - No authentication required\n * - No organisation context\n * - No event context\n * - Completely isolated from main app context\n * - Environment variable access for public data\n * - Error boundary integration\n *\n * @example\n * ```tsx\n * import { PublicPageProvider } from '@jmruthers/pace-core';\n * \n * const APP_NAME = 'CORE';\n * \n * function PublicApp() {\n *   return (\n *     <PublicPageProvider appName={APP_NAME}>\n *       <Routes>\n *         <Route path=\"/events/:eventCode/recipe-grid-report\" element={<PublicRecipePage />} />\n *       </Routes>\n *     </PublicPageProvider>\n *   );\n * }\n * ```\n */\n\nimport React, { createContext, useContext, ReactNode, useMemo } from 'react';\nimport { createClient } from '@supabase/supabase-js';\nimport type { Database } from '../../types/database';\nimport { ErrorBoundary } from '../ErrorBoundary';\nimport { logger } from '../../utils/core/logger';\n\ninterface PublicPageContextType {\n  isPublicPage: true;\n  supabase: ReturnType<typeof createClient<Database>> | null;\n  appName: string | null;\n  environment: {\n    supabaseUrl: string | null;\n    supabaseKey: string | null;\n  };\n}\n\nexport const PublicPageContext = createContext<PublicPageContextType | undefined>(undefined);\n\nexport interface PublicPageProviderProps {\n  children: ReactNode;\n  /** Application name for logo display and branding. Should match the APP_NAME constant used in App.tsx */\n  appName?: string;\n}\n\n/**\n * Provider for public pages that completely isolates them from authentication context\n * \n * This provider:\n * - Does not initialize any authentication providers\n * - Provides environment variables for public data access\n * - Includes error boundary for graceful error handling\n * - Is completely separate from the main app context\n * - Provides appName for consistent logo display\n */\nexport function PublicPageProvider({ children, appName }: PublicPageProviderProps) {\n  // Get environment variables for public data access\n  // Handle both Vite (import.meta.env) and Node.js (process.env) environments\n  const getEnvVar = (key: string): string | undefined => {\n    // Check Vite environment first (browser)\n    if (typeof import.meta !== 'undefined' && import.meta.env) {\n      const env = import.meta.env as Record<string, string | undefined>;\n      return env[key];\n    }\n    // Check Node.js environment (server-side)\n    if (typeof process !== 'undefined' && process.env) {\n      return process.env[key];\n    }\n    return undefined;\n  };\n\n  const supabaseUrl = getEnvVar('VITE_SUPABASE_URL') || \n                     getEnvVar('NEXT_PUBLIC_SUPABASE_URL') || \n                     null;\n                     \n  const supabaseKey = getEnvVar('VITE_SUPABASE_PUBLISHABLE_KEY') || \n                     getEnvVar('NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY') ||\n                     getEnvVar('VITE_SUPABASE_ANON_KEY') ||\n                     getEnvVar('NEXT_PUBLIC_SUPABASE_ANON_KEY') || \n                     null;\n\n  // Create Supabase client if environment variables are available\n  // Note: VITE_SUPABASE_PUBLISHABLE_KEY should be your publishable key (sb_publishable_...)\n  const supabase = useMemo(() => {\n    if (!supabaseUrl || !supabaseKey) {\n      logger.warn('PublicPageProvider', 'Missing Supabase environment variables. Please ensure VITE_SUPABASE_URL and VITE_SUPABASE_PUBLISHABLE_KEY are set in your environment.');\n      return null;\n    }\n    const client = createClient<Database>(supabaseUrl, supabaseKey);\n    return client;\n  }, [supabaseUrl, supabaseKey]);\n\n  const contextValue: PublicPageContextType = {\n    isPublicPage: true,\n    supabase,\n    appName: appName || null,\n    environment: {\n      supabaseUrl,\n      supabaseKey\n    }\n  };\n\n  return (\n    <PublicPageContext.Provider value={contextValue}>\n      <ErrorBoundary componentName=\"PublicPageProvider\">\n        {children}\n      </ErrorBoundary>\n    </PublicPageContext.Provider>\n  );\n}\n\n/**\n * Hook to access public page context\n * \n * @returns Public page context with environment variables\n */\nexport function usePublicPageContext(): PublicPageContextType {\n  const context = useContext(PublicPageContext);\n  \n  if (!context) {\n    throw new Error('usePublicPageContext must be used within a PublicPageProvider');\n  }\n  \n  return context;\n}\n\n/**\n * Hook to check if we're in a public page context\n * \n * @returns True if we're in a public page context\n */\nexport function useIsPublicPage(): boolean {\n  const context = useContext(PublicPageContext);\n  return context !== undefined;\n}\n","/**\n * @file useAppConfig Hook\n * @package @jmruthers/pace-core\n * @module Hooks/useAppConfig\n * @since 0.4.0\n *\n * Hook for accessing app configuration like direct access support and event requirements.\n * This is a convenience hook that extracts app config from the UnifiedAuthProvider.\n *\n * @example\n * ```tsx\n * function MyComponent() {\n *   const { supportsDirectAccess, requiresEvent, isLoading } = useAppConfig();\n *   \n *   if (isLoading) return <div>Loading...</div>;\n *   \n *   return (\n *     <div>\n *       {supportsDirectAccess && (\n *         <div>This app supports direct access!</div>\n *       )}\n *       {requiresEvent && (\n *         <EventSelector />\n *       )}\n *     </div>\n *   );\n * }\n * ```\n */\n\nimport { useMemo, useContext } from 'react';\nimport { useUnifiedAuth } from '../providers/services/UnifiedAuthProvider';\nimport { useIsPublicPage, PublicPageContext } from '../components/PublicLayout/PublicPageProvider';\n\nexport interface UseAppConfigReturn {\n  supportsDirectAccess: boolean;\n  requiresEvent: boolean;\n  isLoading: boolean;\n  appName: string;\n}\n\n/**\n * Hook to access app configuration\n * Works in both authenticated and public contexts\n * @returns App configuration and loading state\n */\nexport function useAppConfig(): UseAppConfigReturn {\n  // Check if we're in a public page context first\n  const isPublicPage = useIsPublicPage();\n  \n  // Try to get appName from PublicPageContext (access context directly to avoid hook rule violations)\n  const publicPageContext = useContext(PublicPageContext);\n  const hasPublicContext = publicPageContext !== undefined;\n  const contextAppName = publicPageContext?.appName || null;\n  const getNodeEnvVar = (key: string): string | undefined =>\n    typeof process !== 'undefined' && process.env ? process.env[key] : undefined;\n  \n  if (isPublicPage) {\n    const getAppName = (): string => {\n      // When tests mock public mode without the provider, default to PACE\n      if (!hasPublicContext) {\n        return 'PACE';\n      }\n      \n      // Priority 1: Use appName from PublicPageContext (passed from App.tsx)\n      if (contextAppName) {\n        return contextAppName;\n      }\n      \n      // Priority 2: Check environment variables\n      if (typeof import.meta !== 'undefined' && (import.meta as any).env) {\n        const env = (import.meta as any).env;\n        return env.VITE_APP_NAME || \n               env.NEXT_PUBLIC_APP_NAME || \n               'PACE';\n      }\n      if (typeof import.meta !== 'undefined' && import.meta.env) {\n        return import.meta.env.VITE_APP_NAME || \n               import.meta.env.NEXT_PUBLIC_APP_NAME || \n               'PACE';\n      }\n      \n      const nodeEnvAppName =\n        getNodeEnvVar('VITE_APP_NAME') ||\n        getNodeEnvVar('NEXT_PUBLIC_APP_NAME');\n      if (nodeEnvAppName) {\n        return nodeEnvAppName;\n      }\n      \n      // Priority 3: Default fallback\n      return 'PACE';\n    };\n    \n    return useMemo(() => ({\n      supportsDirectAccess: false, // Public pages don't support direct access\n      requiresEvent: true, // Public pages always require an event\n      isLoading: false,\n      appName: getAppName()\n    }), [contextAppName, hasPublicContext]);\n  }\n  \n  // For authenticated pages, use UnifiedAuthProvider\n  try {\n    const { appConfig, appName } = useUnifiedAuth();\n    return useMemo(() => ({\n      supportsDirectAccess: !(appConfig?.requires_event ?? true),\n      requiresEvent: appConfig?.requires_event ?? true,\n      isLoading: appConfig === null,\n      appName\n    }), [appConfig?.requires_event, appName]);\n  } catch (error) {\n    // Fallback if UnifiedAuthProvider is not available\n    return useMemo(() => ({\n      supportsDirectAccess: false,\n      requiresEvent: true,\n      isLoading: false,\n      appName: contextAppName ||\n        getNodeEnvVar('VITE_APP_NAME') ||\n        getNodeEnvVar('NEXT_PUBLIC_APP_NAME') ||\n        'PACE'\n    }), [contextAppName]);\n  }\n} ","/**\n * @file Organisation Security Hook\n * @package @jmruthers/pace-core\n * @module Hooks/OrganisationSecurity\n * @since 0.4.0\n *\n * Security-focused hook for organisation access validation and super admin functionality.\n * Provides utilities for validating user access to organisations and checking permissions.\n */\n\nimport { useCallback, useMemo, useEffect, useState } from 'react';\nimport { useUnifiedAuth } from '../providers';\nimport { useOrganisations } from './useOrganisations';\n// Legacy useRBAC hook removed - use new RBAC system instead\nimport type { OrganisationSecurityError, SuperAdminContext } from '../types/organisation';\nimport type { Permission } from '../rbac/types';\nimport { logger } from '../utils/core/logger';\n\nexport interface OrganisationSecurityHook {\n  // Super admin context\n  superAdminContext: SuperAdminContext;\n  \n  // Access validation\n  validateOrganisationAccess: (orgId: string) => Promise<boolean>;\n  hasMinimumRole: (minRole: string, orgId?: string) => boolean;\n  canAccessChildOrganisations: (orgId?: string) => boolean;\n  \n  // Permission checks\n  hasPermission: (permission: string, orgId?: string) => Promise<boolean>;\n  getUserPermissions: (orgId?: string) => Promise<string[]>;\n  \n  // Audit logging\n  logOrganisationAccess: (action: string, details?: Record<string, unknown>) => Promise<void>;\n  \n  // Security utilities\n  ensureOrganisationAccess: (orgId: string) => Promise<void>;\n  validateUserAccess: (userId: string, orgId: string) => Promise<boolean>;\n}\n\nexport const useOrganisationSecurity = (): OrganisationSecurityHook => {\n  const { user, session, supabase } = useUnifiedAuth();\n  const { selectedOrganisation, getUserRole, validateOrganisationAccess: validateAccess } = useOrganisations();\n  \n  // Super admin status - query database for security (user_metadata can be spoofed)\n  const [isSuperAdmin, setIsSuperAdmin] = useState<boolean>(false);\n  const [isCheckingSuperAdmin, setIsCheckingSuperAdmin] = useState(false);\n\n  // Check super admin status from database\n  useEffect(() => {\n    if (!user || !session || !supabase) {\n      setIsSuperAdmin(false);\n      return;\n    }\n\n    const checkSuperAdmin = async () => {\n      setIsCheckingSuperAdmin(true);\n      try {\n        const now = new Date().toISOString();\n        const { data, error } = await supabase\n          .from('rbac_global_roles')\n          .select('role')\n          .eq('user_id', user.id)\n          .eq('role', 'super_admin')\n          .lte('valid_from', now)\n          .or(`valid_to.is.null,valid_to.gte.${now}`)\n          .limit(1);\n\n        setIsSuperAdmin(!error && data && data.length > 0);\n      } catch (error) {\n        logger.error('useOrganisationSecurity', 'Error checking super admin status:', error);\n        setIsSuperAdmin(false);\n      } finally {\n        setIsCheckingSuperAdmin(false);\n      }\n    };\n\n    checkSuperAdmin();\n  }, [user, session, supabase]);\n\n  // Super admin context\n  const superAdminContext = useMemo((): SuperAdminContext => {\n    return {\n      isSuperAdmin,\n      hasGlobalAccess: isSuperAdmin,\n      canManageAllOrganisations: isSuperAdmin\n    };\n  }, [isSuperAdmin]);\n\n  // Validate organisation access with database check\n  const validateOrganisationAccess = useCallback(async (orgId: string): Promise<boolean> => {\n    if (!user || !session || !supabase) return false;\n    \n    try {\n      // Super admin has access to all organisations\n      if (superAdminContext.isSuperAdmin) {\n        return true;\n      }\n\n      // Check organisation membership using consolidated rbac_organisation_roles table\n      const { data, error } = await supabase\n        .from('rbac_organisation_roles')\n        .select('id')\n        .eq('user_id', user.id)\n        .eq('organisation_id', orgId)\n        .eq('status', 'active')\n        .is('revoked_at', null)\n        .in('role', ['org_admin', 'leader', 'member']) // Only actual members, not supporters\n        .single();\n\n      if (error) {\n        logger.error('useOrganisationSecurity', 'Error validating organisation access:', error);\n        return false;\n      }\n\n      return !!data;\n    } catch (error) {\n      logger.error('useOrganisationSecurity', 'Exception validating organisation access:', error);\n      return false;\n    }\n  }, [user, session, supabase, superAdminContext.isSuperAdmin]);\n\n  // Check if user has minimum role\n  const hasMinimumRole = useCallback((minRole: string, orgId?: string): boolean => {\n    // Super admin has all roles\n    if (superAdminContext.isSuperAdmin) {\n      return true;\n    }\n\n    const targetOrgId = orgId || selectedOrganisation?.id;\n    if (!targetOrgId) return false;\n\n    const userRole = getUserRole(targetOrgId);\n    const roleHierarchy = ['supporter', 'member', 'leader', 'org_admin'];\n    \n    const userRoleIndex = roleHierarchy.indexOf(userRole);\n    const minRoleIndex = roleHierarchy.indexOf(minRole);\n    \n    return userRoleIndex >= minRoleIndex;\n  }, [selectedOrganisation, getUserRole, superAdminContext.isSuperAdmin]);\n\n  // Check if user can access child organisations\n  const canAccessChildOrganisations = useCallback((orgId?: string): boolean => {\n    // Super admin can access all organisations\n    if (superAdminContext.isSuperAdmin) {\n      return true;\n    }\n\n    const targetOrgId = orgId || selectedOrganisation?.id;\n    if (!targetOrgId) return false;\n\n    const userRole = getUserRole(targetOrgId);\n    return userRole === 'org_admin';\n  }, [selectedOrganisation, getUserRole, superAdminContext.isSuperAdmin]);\n\n  // Check specific permission using the new RBAC system\n  const hasPermission = useCallback(async (permission: string, orgId?: string): Promise<boolean> => {\n    // Super admin has all permissions\n    if (superAdminContext.isSuperAdmin) {\n      return true;\n    }\n\n    const targetOrgId = orgId || selectedOrganisation?.id;\n    if (!targetOrgId || !user) return false;\n\n    try {\n      // Use the new RBAC system with caching\n      const { isPermittedCached } = await import('../rbac/api');\n      \n      const scope = {\n        organisationId: targetOrgId,\n        eventId: user.user_metadata?.eventId || user.app_metadata?.eventId,\n        appId: user.user_metadata?.appId || user.app_metadata?.appId,\n      };\n\n      return await isPermittedCached({\n        userId: user.id,\n        scope,\n        permission: permission as Permission\n      });\n    } catch (error) {\n      logger.error('useOrganisationSecurity', 'Exception checking permission:', error);\n      return false;\n    }\n  }, [selectedOrganisation, user, superAdminContext.isSuperAdmin]);\n\n  // Get user's permissions for organisation using the new RBAC system\n  const getUserPermissions = useCallback(async (orgId?: string): Promise<string[]> => {\n    // Super admin has all permissions\n    if (superAdminContext.isSuperAdmin) {\n      return ['*']; // All permissions\n    }\n\n    const targetOrgId = orgId || selectedOrganisation?.id;\n    if (!targetOrgId || !user) return [];\n\n    try {\n      // Use the new RBAC system\n      const { getPermissionMap } = await import('../rbac/api');\n      \n      const scope = {\n        organisationId: targetOrgId,\n        eventId: user.user_metadata?.eventId || user.app_metadata?.eventId,\n        appId: user.user_metadata?.appId || user.app_metadata?.appId,\n      };\n\n      const permissionMap = await getPermissionMap({\n        userId: user.id,\n        scope\n      });\n      \n      // Flatten all permissions from all pages\n      const allPermissions = Object.entries(permissionMap)\n        .filter(([, allowed]) => allowed)\n        .map(([permission]) => permission);\n      return [...new Set(allPermissions)]; // Remove duplicates\n    } catch (error) {\n      logger.error('useOrganisationSecurity', 'Exception getting user permissions:', error);\n      return [];\n    }\n  }, [selectedOrganisation, user, getUserRole, superAdminContext.isSuperAdmin]);\n\n  // Log organisation access for audit using the new RBAC audit system\n  const logOrganisationAccess = useCallback(async (action: string, details?: Record<string, unknown>): Promise<void> => {\n    if (!user || !selectedOrganisation) return;\n\n    try {\n      // Use the new RBAC audit system - only if we have a valid organisation ID\n      if (selectedOrganisation.id) {\n        const { emitAuditEvent } = await import('../rbac/audit');\n        \n        await emitAuditEvent({\n          type: 'permission_check',\n          userId: user.id,\n          organisationId: selectedOrganisation.id,\n          permission: action,\n          decision: true, // Assume access was granted if we're logging it\n          source: 'api',\n          duration_ms: 0, // No actual permission check performed here\n          metadata: details || {}\n        });\n      }\n    } catch (error) {\n      logger.error('useOrganisationSecurity', 'Error logging organisation access:', error);\n    }\n  }, [user, selectedOrganisation]);\n\n  // Ensure organisation access (throws if no access)\n  const ensureOrganisationAccess = useCallback(async (orgId: string): Promise<void> => {\n    const hasAccess = await validateOrganisationAccess(orgId);\n    \n    if (!hasAccess) {\n      const error = new Error(`User does not have access to organisation ${orgId}`) as OrganisationSecurityError;\n      error.name = 'OrganisationSecurityError';\n      error.code = 'ACCESS_DENIED';\n      error.organisationId = orgId;\n      error.userId = user?.id;\n      throw error;\n    }\n  }, [validateOrganisationAccess, user]);\n\n  // Validate user access (for admin functions)\n  const validateUserAccess = useCallback(async (userId: string, orgId: string): Promise<boolean> => {\n    if (!supabase) return false;\n\n    try {\n      // Super admin can validate any user\n      if (superAdminContext.isSuperAdmin) {\n        return true;\n      }\n\n      // Regular users can only validate their own access\n      if (userId !== user?.id) {\n        return false;\n      }\n\n      return await validateOrganisationAccess(orgId);\n    } catch (error) {\n      logger.error('useOrganisationSecurity', 'Exception validating user access:', error);\n      return false;\n    }\n  }, [supabase, superAdminContext.isSuperAdmin, user, validateOrganisationAccess]);\n\n  return {\n    superAdminContext,\n    validateOrganisationAccess,\n    hasMinimumRole,\n    canAccessChildOrganisations,\n    hasPermission,\n    getUserPermissions,\n    logOrganisationAccess,\n    ensureOrganisationAccess,\n    validateUserAccess\n  };\n}; "],"mappings":";;;;;;;;;;;;;;;;;;AAaA,SAAS,SAAS,cAAc;AAqCzB,SAAS,YAA8B;AAC5C,QAAM,eAAe,gBAAgB;AAGrC,QAAM,YAAY,aAAa,UAAU;AACzC,QAAM,gBAAgB,aAAa,iBAAiB;AACpD,QAAM,YAAY,aAAa,UAAU;AACzC,QAAM,QAAQ,aAAa,SAAS;AAGpC,QAAM,gBAAgB,OAAgB,CAAC,CAAC;AACxC,QAAM,mBAAmB,OAAe,EAAE;AAI1C,QAAM,mBAAmB,UAAU,IAAI,OAAK,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,GAAG;AACxE,QAAM,gBAAgB,qBAAqB,iBAAiB;AAI5D,MAAI,eAAe;AACjB,kBAAc,UAAU;AACxB,qBAAiB,UAAU;AAAA,EAC7B;AAGA,QAAM,SAAS,QAAQ,MAAM;AAC3B,WAAO,cAAc;AAAA,EACvB,GAAG,CAAC,gBAAgB,CAAC;AAGrB,QAAM,2BAA2B;AAAA,IAC/B,MAAM,CAAC,UAAwB,aAAa,iBAAiB,KAAK;AAAA,IAClE,CAAC,YAAY;AAAA,EACf;AACA,QAAM,wBAAwB;AAAA,IAC5B,MAAM,MAAM,aAAa,cAAc;AAAA,IACvC,CAAC,YAAY;AAAA,EACf;AACA,QAAM,8BAA8B;AAAA,IAClC,MAAM,MAAM,aAAa,oBAAoB;AAAA,IAC7C,CAAC,YAAY;AAAA,EACf;AAGA,SAAO,QAAQ,OAAO;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB;AAAA,IAClB,eAAe;AAAA,IACf,qBAAqB;AAAA,EACvB,IAAI,CAAC,QAAQ,eAAe,UAAU,WAAW,OAAO,SAAS,0BAA0B,uBAAuB,2BAA2B,CAAC;AAChJ;;;AC7FA,SAAS,WAAW,UAAU,UAAAA,SAAQ,WAAAC,gBAAe;AASrD,IAAM,MAAM,aAAa,kBAAkB;AAI3C,IAAM,iBAAiB,oBAAI,IAAwE;AACnG,IAAM,YAAY,IAAI,KAAK;AAiDpB,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AACF,GAAoD;AAClD,QAAM,CAAC,eAAe,gBAAgB,IAAI,SAAuB,IAAI;AACrE,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAC/C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAuB,IAAI;AAGrD,QAAM,iBAAiBC,QAA+E;AAAA,IACpG,gBAAgB;AAAA,IAChB,OAAO;AAAA,IACP,SAAS;AAAA,EACX,CAAC;AAID,YAAU,MAAM;AACd,QAAI,eAAe;AACjB,YAAM,WAAW;AAAA,QACf,gBAAgB,cAAc,kBAAkB;AAAA,QAChD,OAAO,cAAc,SAAS;AAAA,QAC9B,SAAS,cAAc;AAAA,MACzB;AAGA,UAAI,eAAe,QAAQ,mBAAmB,SAAS,kBACnD,eAAe,QAAQ,YAAY,SAAS,WAC5C,eAAe,QAAQ,UAAU,SAAS,OAAO;AACnD,uBAAe,UAAU;AAAA,UACvB,gBAAgB,SAAS;AAAA,UACzB,OAAO,SAAS;AAAA,UAChB,SAAS,SAAS;AAAA,QACpB;AAAA,MACF;AAAA,IACF,OAAO;AAEL,qBAAe,UAAU,EAAE,gBAAgB,IAAI,OAAO,IAAI,SAAS,OAAU;AAAA,IAC/E;AAAA,EACF,GAAG,CAAC,aAAa,CAAC;AAGlB,QAAM,UAAU,kBAAkB;AAElC,QAAM,cAAc,eAAe;AAEnC,YAAU,MAAM;AACd,QAAI,YAAY;AAEhB,UAAM,eAAe,YAAY;AAG/B,UAAI,CAAC,YAAY,CAAC,0BAA0B,CAAC,iBAAiB;AAC5D,YAAI,CAAC,WAAW;AACd,2BAAiB,IAAI;AACrB,uBAAa,KAAK;AAClB,mBAAS,IAAI;AAAA,QACf;AACA;AAAA,MACF;AAEA,mBAAa,IAAI;AACjB,eAAS,IAAI;AAEb,UAAI;AAEF,cAAMC,WAAU,kBAAkB;AAClC,YAAI,QAA4B;AAChC,YAAI,YAA8B;AAIlC,YAAI,YAAYA,UAAS;AACvB,cAAI;AAGF,kBAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,SAAS,KAAK,WAAW;AACzD,gBAAI,CAAC,SAAS,SAAS;AAGrB,kBAAI,MAAM,gCAAgCA,QAAO,4BAA4B;AAAA,YAC/E,OAAO;AAEL,oBAAM,SAAS,eAAe,IAAIA,QAAO;AACzC,oBAAM,MAAM,KAAK,IAAI;AACrB,kBAAI,UAAW,MAAM,OAAO,YAAa,WAAW;AAClD,wBAAQ,OAAO;AACf,4BAAY,OAAO;AAAA,cACrB,OAAO;AAEL,sBAAM,EAAE,MAAM,KAAK,OAAAC,OAAM,IAAI,MAAM,SAChC,KAAK,WAAW,EAChB,OAAO,qCAAqC,EAC5C,GAAG,QAAQD,QAAO,EAClB,GAAG,aAAa,IAAI,EACpB,OAAO;AAEV,oBAAIC,QAAO;AAGT,sBAAIA,OAAM,SAAS,SAASA,OAAM,SAAS,cAAcA,OAAM,SAAS,SAAS,KAAK,GAAG;AACvF,wBAAI,MAAM,sCAAsCD,QAAO,mCAAmC;AAE1F,4BAAQ;AAAA,kBACV,OAAO;AAEL,0BAAM,EAAE,MAAM,YAAY,IAAI,MAAM,SACjC,KAAK,WAAW,EAChB,OAAO,qBAAqB,EAC5B,GAAG,QAAQA,QAAO,EAClB,OAAO;AAEV,wBAAI,aAAa;AACf,0BAAI,MAAM,QAAQA,QAAO,wCAAwC,YAAY,SAAS,GAAG;AAEzF,8BAAQ;AAAA,oBACV,OAAO;AACL,0BAAI,MAAM,QAAQA,QAAO,kCAAkC,EAAE,OAAAC,OAAM,CAAC;AAEpE,8BAAQ;AAAA,oBACV;AAAA,kBACF;AAAA,gBACF,WAAW,KAAK;AACd,0BAAQ,IAAI;AACZ,8BAAY,EAAE,gBAAgB,IAAI,kBAAkB,MAAM;AAE1D,iCAAe,IAAID,UAAS,EAAE,OAAO,WAAW,WAAW,IAAI,CAAC;AAAA,gBAClE;AAAA,cACF;AAAA,YACF;AAAA,UACF,SAASC,QAAO;AAGd,kBAAM,eAAeA,kBAAiB,QAAQA,OAAM,UAAU,OAAOA,MAAK;AAC1E,gBAAI,CAAC,aAAa,SAAS,KAAK,KAAK,CAAC,aAAa,SAAS,UAAU,GAAG;AACvE,kBAAI,MAAM,0CAA0CA,MAAK;AAAA,YAC3D,OAAO;AACL,kBAAI,MAAM,kDAAkD;AAAA,YAC9D;AAAA,UACF;AAAA,QACF;AAKA,cAAM,eAAsB;AAAA,UAC1B,gBAAgB,WAAW,iBAAiB,SAAa,0BAA0B;AAAA,UACnF,SAAS,mBAAmB;AAAA,UAC5B;AAAA,QACF;AAIA,cAAM,aAAa,MAAM,iBAAiB;AAAA,UACxC;AAAA,UACA;AAAA,UACAD,YAAW;AAAA,UACX;AAAA,QACF;AAEA,YAAI,CAAC,WAAW,SAAS;AAEvB,cAAIA,aAAY,YAAYA,aAAY,SAAS;AAC/C,gBAAI,CAAC,WAAW;AAGd,oBAAM,uBAA8B;AAAA,gBAClC,gBAAgB;AAAA,gBAChB,SAAS;AAAA,gBACT,OAAO,SAAS;AAAA;AAAA,cAClB;AACA,+BAAiB,oBAAoB;AACrC,uBAAS,IAAI;AACb,2BAAa,KAAK;AAAA,YACpB;AACA;AAAA,UACF;AAIA,cAAI,WAAW,kBAAkB,iBAAiB;AAChD,gBAAI,CAAC,WAAW;AACd,oBAAM,aAAoB;AAAA,gBACxB,gBAAgB;AAAA;AAAA,gBAChB,SAAS;AAAA,gBACT,OAAO,SAAS;AAAA,cAClB;AACA,+BAAiB,UAAU;AAC3B,uBAAS,IAAI;AACb,2BAAa,KAAK;AAAA,YACpB;AACA;AAAA,UACF;AAEA,cAAI,CAAC,WAAW;AACd,6BAAiB,IAAI;AACrB,qBAAS,WAAW,SAAS,IAAI,MAAM,2BAA2B,CAAC;AACnE,yBAAa,KAAK;AAAA,UACpB;AACA;AAAA,QACF;AAGA,YAAI,CAAC,WAAW;AACd,2BAAiB,WAAW,aAAa;AACzC,mBAAS,IAAI;AACb,uBAAa,KAAK;AAAA,QACpB;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,CAAC,WAAW;AACd,mBAAS,GAAY;AACrB,uBAAa,KAAK;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAEA,iBAAa;AAEb,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,wBAAwB,iBAAiB,QAAQ,CAAC;AAItD,QAAM,yBAAyB,YAAY,YAAY,YAAY;AACnE,QAAM,gBAAgB,yBAClB,OACC,YAAY,SAAS,YAAY;AAItC,QAAM,aAA2BE,SAAQ,MAAM;AAC7C,QAAI,CAAC,eAAe;AAClB,aAAO,yBAAyB,CAAC,IAAI;AAAA,IACvC;AAGA,UAAM,QAAe,CAAC;AACtB,QAAI,YAAY,gBAAgB;AAC9B,YAAM,iBAAiB,YAAY;AAAA,IACrC;AACA,QAAI,YAAY,SAAS;AACvB,YAAM,UAAU,YAAY;AAAA,IAC9B;AACA,QAAI,YAAY,OAAO;AACrB,YAAM,QAAQ,YAAY;AAAA,IAC5B;AAEA,WAAO;AAAA,EACT,GAAG,CAAC,eAAe,wBAAwB,YAAY,gBAAgB,YAAY,SAAS,YAAY,KAAK,CAAC;AAE9G,SAAO;AAAA,IACL,eAAe;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACF;;;AC1PA,SAAgB,iBAA4B;AAoK5B,cAIF,YAJE;AAzGT,IAAM,gBAAN,cAA4B,UAAkD;AAAA,EAGnF,YAAY,OAA2B;AACrC,UAAM,KAAK;AAHb,SAAQ,iBAAwC;AA+ChD,SAAQ,cAAc,CAAC,SAAiB,kBAA0B;AAEhE,UAAI,YAAY,IAAI,SAAS,cAAc;AAGzC,eAAO,KAAK,iBAAiB,qDAAqD,EAAE,SAAS,cAAc,CAAC;AAAA,MAC9G;AAAA,IACF;AAEA,SAAQ,cAAc,MAAM;AAC1B,YAAM,EAAE,aAAa,EAAE,IAAI,KAAK;AAChC,YAAM,EAAE,WAAW,IAAI,KAAK;AAE5B,UAAI,aAAa,YAAY;AAC3B,eAAO,MAAM,iBAAiB,sCAAsC,aAAa,CAAC,IAAI,UAAU,GAAG;AAEnG,aAAK,SAAS,gBAAc;AAAA,UAC1B,UAAU;AAAA,UACV,OAAO;AAAA,UACP,WAAW;AAAA,UACX,SAAS;AAAA,UACT,YAAY,UAAU,aAAa;AAAA,QACrC,EAAE;AAAA,MACJ;AAAA,IACF;AAnEE,SAAK,QAAQ;AAAA,MACX,UAAU;AAAA,MACV,YAAY;AAAA,IACd;AAAA,EACF;AAAA,EAEA,OAAO,yBAAyB,OAA2C;AACzE,UAAM,UAAU,SAAS,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,GAAG,CAAC,CAAC;AAC9E,WAAO;AAAA,MACL,UAAU;AAAA,MACV;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,kBAAkB,OAAc,WAA4B;AAC1D,UAAM,EAAE,gBAAgB,qBAAqB,SAAS,kBAAkB,KAAK,IAAI,KAAK;AACtF,UAAM,UAAU,KAAK,MAAM;AAE3B,SAAK,SAAS,EAAE,UAAU,CAAC;AAG3B,WAAO,MAAM,iBAAiB,IAAI,aAAa,kBAAkB,OAAO,KAAK,OAAO,SAAS;AAG7F,6BAAyB,QAAQ,0BAA0B,GAAG;AAAA,MAC5D;AAAA,MACA;AAAA,MACA,cAAc,MAAM;AAAA,MACpB,OAAO,MAAM,OAAO,UAAU,GAAG,GAAG;AAAA;AAAA,IACtC,CAAC;AAGD,QAAI,iBAAiB;AACnB,WAAK,YAAY,SAAS,aAAa;AAAA,IACzC;AAGA,QAAI,SAAS;AACX,cAAQ,OAAO,WAAW,OAAO;AAAA,IACnC;AAAA,EACF;AAAA,EA4BA,uBAAuB;AACrB,QAAI,KAAK,gBAAgB;AACvB,mBAAa,KAAK,cAAc;AAAA,IAClC;AAAA,EACF;AAAA,EAEA,SAAS;AACP,QAAI,KAAK,MAAM,UAAU;AACvB,YAAM;AAAA,QACJ,gBAAgB;AAAA,QAChB;AAAA,QACA,cAAc;AAAA,QACd,aAAa;AAAA,MACf,IAAI,KAAK;AACT,YAAM,EAAE,YAAY,QAAQ,IAAI,KAAK;AAGrC,UAAI,UAAU;AACZ,eAAO;AAAA,MACT;AAGA,aACE;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,WAAU;AAAA,UACV,uBAAqB;AAAA,UAErB,+BAAC,SAAI,WAAU,0BACb;AAAA,gCAAC,SAAI,WAAU,iBACb,8BAAC,SAAI,WAAU,4BAA2B,SAAQ,aAAY,MAAK,gBACjE,8BAAC,UAAK,UAAS,WAAU,GAAE,qHAAoH,UAAS,WAAU,GACpK,GACF;AAAA,YACA,qBAAC,SAAI,WAAU,kBACb;AAAA,mCAAC,QAAG,WAAU,oBAAmB;AAAA;AAAA,gBACrB;AAAA,iBACZ;AAAA,cACA,oBAAC,OAAE,WAAU,uBACV,eAAK,MAAM,OAAO,WAAW,iCAChC;AAAA,cAEC,eAAe,aAAa,cAC3B,qBAAC,SAAI,WAAU,mBACb;AAAA;AAAA,kBAAC;AAAA;AAAA,oBACC,SAAS,KAAK;AAAA,oBACd,WAAU;AAAA,oBACX;AAAA;AAAA,sBACS,aAAa;AAAA,sBAAE;AAAA,sBAAE;AAAA,sBAAW;AAAA;AAAA;AAAA,gBACtC;AAAA,gBACA;AAAA,kBAAC;AAAA;AAAA,oBACC,SAAS,MAAM,OAAO,SAAS,OAAO;AAAA,oBACtC,WAAU;AAAA,oBACX;AAAA;AAAA,gBAED;AAAA,iBACF;AAAA,cAGD,cAAc,cACb,qBAAC,SAAI,WAAU,uDACb;AAAA,oCAAC,OAAE,WAAU,gBAAe,wFAE5B;AAAA,gBACA;AAAA,kBAAC;AAAA;AAAA,oBACC,SAAS,MAAM,OAAO,SAAS,OAAO;AAAA,oBACtC,WAAU;AAAA,oBACX;AAAA;AAAA,gBAED;AAAA,iBACF;AAAA,cAGD,YAAY,IAAI,SAAS,iBAAiB,KAAK,MAAM,SACpD,qBAAC,aAAQ,WAAU,+BACjB;AAAA,oCAAC,aAAQ,WAAU,mCAAkC,yCAErD;AAAA,gBACA,qBAAC,SAAI,WAAU,uCACb;AAAA,uCAAC,OAAE,WAAU,aAAY;AAAA;AAAA,oBAAW;AAAA,qBAAQ;AAAA,kBAC5C,qBAAC,SAAI,WAAU,sDACZ;AAAA,yBAAK,MAAM,MAAM,SAAS;AAAA,oBAC1B,KAAK,MAAM,WAAW;AAAA,qBACzB;AAAA,mBACF;AAAA,iBACF;AAAA,eAEJ;AAAA,aACF;AAAA;AAAA,MACF;AAAA,IAEJ;AAEA,WAAO,KAAK,MAAM;AAAA,EACpB;AACF;;;AClRA,SAAgB,eAAe,YAAuB,WAAAC,gBAAe;AACrE,SAAS,oBAAoB;AAkFvB,gBAAAC,YAAA;AAnEC,IAAM,oBAAoB,cAAiD,MAAS;AAkBpF,SAAS,mBAAmB,EAAE,UAAU,QAAQ,GAA4B;AAGjF,QAAM,YAAY,CAAC,QAAoC;AAErD,QAAI,OAAO,gBAAgB,eAAe,YAAY,KAAK;AACzD,YAAM,MAAM,YAAY;AACxB,aAAO,IAAI,GAAG;AAAA,IAChB;AAEA,QAAI,OAAO,YAAY,eAAe,QAAQ,KAAK;AACjD,aAAO,QAAQ,IAAI,GAAG;AAAA,IACxB;AACA,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,UAAU,mBAAmB,KAC9B,UAAU,0BAA0B,KACpC;AAEnB,QAAM,cAAc,UAAU,+BAA+B,KAC1C,UAAU,sCAAsC,KAChD,UAAU,wBAAwB,KAClC,UAAU,+BAA+B,KACzC;AAInB,QAAM,WAAWC,SAAQ,MAAM;AAC7B,QAAI,CAAC,eAAe,CAAC,aAAa;AAChC,aAAO,KAAK,sBAAsB,wIAAwI;AAC1K,aAAO;AAAA,IACT;AACA,UAAM,SAAS,aAAuB,aAAa,WAAW;AAC9D,WAAO;AAAA,EACT,GAAG,CAAC,aAAa,WAAW,CAAC;AAE7B,QAAM,eAAsC;AAAA,IAC1C,cAAc;AAAA,IACd;AAAA,IACA,SAAS,WAAW;AAAA,IACpB,aAAa;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SACE,gBAAAD,KAAC,kBAAkB,UAAlB,EAA2B,OAAO,cACjC,0BAAAA,KAAC,iBAAc,eAAc,sBAC1B,UACH,GACF;AAEJ;AAOO,SAAS,uBAA8C;AAC5D,QAAM,UAAU,WAAW,iBAAiB;AAE5C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AAEA,SAAO;AACT;AAOO,SAAS,kBAA2B;AACzC,QAAM,UAAU,WAAW,iBAAiB;AAC5C,SAAO,YAAY;AACrB;;;ACvHA,SAAS,WAAAE,UAAS,cAAAC,mBAAkB;AAgB7B,SAAS,eAAmC;AAEjD,QAAM,eAAe,gBAAgB;AAGrC,QAAM,oBAAoBC,YAAW,iBAAiB;AACtD,QAAM,mBAAmB,sBAAsB;AAC/C,QAAM,iBAAiB,mBAAmB,WAAW;AACrD,QAAM,gBAAgB,CAAC,QACrB,OAAO,YAAY,eAAe,QAAQ,MAAM,QAAQ,IAAI,GAAG,IAAI;AAErE,MAAI,cAAc;AAChB,UAAM,aAAa,MAAc;AAE/B,UAAI,CAAC,kBAAkB;AACrB,eAAO;AAAA,MACT;AAGA,UAAI,gBAAgB;AAClB,eAAO;AAAA,MACT;AAGA,UAAI,OAAO,gBAAgB,eAAgB,YAAoB,KAAK;AAClE,cAAM,MAAO,YAAoB;AACjC,eAAO,IAAI,iBACJ,IAAI,wBACJ;AAAA,MACT;AACA,UAAI,OAAO,gBAAgB,eAAe,YAAY,KAAK;AACzD,eAAO,YAAY,IAAI,iBAChB,YAAY,IAAI,wBAChB;AAAA,MACT;AAEA,YAAM,iBACJ,cAAc,eAAe,KAC7B,cAAc,sBAAsB;AACtC,UAAI,gBAAgB;AAClB,eAAO;AAAA,MACT;AAGA,aAAO;AAAA,IACT;AAEA,WAAOC,SAAQ,OAAO;AAAA,MACpB,sBAAsB;AAAA;AAAA,MACtB,eAAe;AAAA;AAAA,MACf,WAAW;AAAA,MACX,SAAS,WAAW;AAAA,IACtB,IAAI,CAAC,gBAAgB,gBAAgB,CAAC;AAAA,EACxC;AAGA,MAAI;AACF,UAAM,EAAE,WAAW,QAAQ,IAAI,eAAe;AAC9C,WAAOA,SAAQ,OAAO;AAAA,MACpB,sBAAsB,EAAE,WAAW,kBAAkB;AAAA,MACrD,eAAe,WAAW,kBAAkB;AAAA,MAC5C,WAAW,cAAc;AAAA,MACzB;AAAA,IACF,IAAI,CAAC,WAAW,gBAAgB,OAAO,CAAC;AAAA,EAC1C,SAAS,OAAO;AAEd,WAAOA,SAAQ,OAAO;AAAA,MACpB,sBAAsB;AAAA,MACtB,eAAe;AAAA,MACf,WAAW;AAAA,MACX,SAAS,kBACP,cAAc,eAAe,KAC7B,cAAc,sBAAsB,KACpC;AAAA,IACJ,IAAI,CAAC,cAAc,CAAC;AAAA,EACtB;AACF;;;AChHA,SAAS,aAAa,WAAAC,UAAS,aAAAC,YAAW,YAAAC,iBAAgB;AA6BnD,IAAM,0BAA0B,MAAgC;AACrE,QAAM,EAAE,MAAM,SAAS,SAAS,IAAI,eAAe;AACnD,QAAM,EAAE,sBAAsB,aAAa,4BAA4B,eAAe,IAAI,iBAAiB;AAG3G,QAAM,CAAC,cAAc,eAAe,IAAIC,UAAkB,KAAK;AAC/D,QAAM,CAAC,sBAAsB,uBAAuB,IAAIA,UAAS,KAAK;AAGtE,EAAAC,WAAU,MAAM;AACd,QAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU;AAClC,sBAAgB,KAAK;AACrB;AAAA,IACF;AAEA,UAAM,kBAAkB,YAAY;AAClC,8BAAwB,IAAI;AAC5B,UAAI;AACF,cAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,cAAM,EAAE,MAAM,MAAM,IAAI,MAAM,SAC3B,KAAK,mBAAmB,EACxB,OAAO,MAAM,EACb,GAAG,WAAW,KAAK,EAAE,EACrB,GAAG,QAAQ,aAAa,EACxB,IAAI,cAAc,GAAG,EACrB,GAAG,iCAAiC,GAAG,EAAE,EACzC,MAAM,CAAC;AAEV,wBAAgB,CAAC,SAAS,QAAQ,KAAK,SAAS,CAAC;AAAA,MACnD,SAAS,OAAO;AACd,eAAO,MAAM,2BAA2B,sCAAsC,KAAK;AACnF,wBAAgB,KAAK;AAAA,MACvB,UAAE;AACA,gCAAwB,KAAK;AAAA,MAC/B;AAAA,IACF;AAEA,oBAAgB;AAAA,EAClB,GAAG,CAAC,MAAM,SAAS,QAAQ,CAAC;AAG5B,QAAM,oBAAoBC,SAAQ,MAAyB;AACzD,WAAO;AAAA,MACL;AAAA,MACA,iBAAiB;AAAA,MACjB,2BAA2B;AAAA,IAC7B;AAAA,EACF,GAAG,CAAC,YAAY,CAAC;AAGjB,QAAM,6BAA6B,YAAY,OAAO,UAAoC;AACxF,QAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAU,QAAO;AAE3C,QAAI;AAEF,UAAI,kBAAkB,cAAc;AAClC,eAAO;AAAA,MACT;AAGA,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,SAC3B,KAAK,yBAAyB,EAC9B,OAAO,IAAI,EACX,GAAG,WAAW,KAAK,EAAE,EACrB,GAAG,mBAAmB,KAAK,EAC3B,GAAG,UAAU,QAAQ,EACrB,GAAG,cAAc,IAAI,EACrB,GAAG,QAAQ,CAAC,aAAa,UAAU,QAAQ,CAAC,EAC5C,OAAO;AAEV,UAAI,OAAO;AACT,eAAO,MAAM,2BAA2B,yCAAyC,KAAK;AACtF,eAAO;AAAA,MACT;AAEA,aAAO,CAAC,CAAC;AAAA,IACX,SAAS,OAAO;AACd,aAAO,MAAM,2BAA2B,6CAA6C,KAAK;AAC1F,aAAO;AAAA,IACT;AAAA,EACF,GAAG,CAAC,MAAM,SAAS,UAAU,kBAAkB,YAAY,CAAC;AAG5D,QAAM,iBAAiB,YAAY,CAAC,SAAiB,UAA4B;AAE/E,QAAI,kBAAkB,cAAc;AAClC,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,SAAS,sBAAsB;AACnD,QAAI,CAAC,YAAa,QAAO;AAEzB,UAAM,WAAW,YAAY,WAAW;AACxC,UAAM,gBAAgB,CAAC,aAAa,UAAU,UAAU,WAAW;AAEnE,UAAM,gBAAgB,cAAc,QAAQ,QAAQ;AACpD,UAAM,eAAe,cAAc,QAAQ,OAAO;AAElD,WAAO,iBAAiB;AAAA,EAC1B,GAAG,CAAC,sBAAsB,aAAa,kBAAkB,YAAY,CAAC;AAGtE,QAAM,8BAA8B,YAAY,CAAC,UAA4B;AAE3E,QAAI,kBAAkB,cAAc;AAClC,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,SAAS,sBAAsB;AACnD,QAAI,CAAC,YAAa,QAAO;AAEzB,UAAM,WAAW,YAAY,WAAW;AACxC,WAAO,aAAa;AAAA,EACtB,GAAG,CAAC,sBAAsB,aAAa,kBAAkB,YAAY,CAAC;AAGtE,QAAM,gBAAgB,YAAY,OAAO,YAAoB,UAAqC;AAEhG,QAAI,kBAAkB,cAAc;AAClC,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,SAAS,sBAAsB;AACnD,QAAI,CAAC,eAAe,CAAC,KAAM,QAAO;AAElC,QAAI;AAEF,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,mBAAa;AAExD,YAAM,QAAQ;AAAA,QACZ,gBAAgB;AAAA,QAChB,SAAS,KAAK,eAAe,WAAW,KAAK,cAAc;AAAA,QAC3D,OAAO,KAAK,eAAe,SAAS,KAAK,cAAc;AAAA,MACzD;AAEA,aAAO,MAAM,kBAAkB;AAAA,QAC7B,QAAQ,KAAK;AAAA,QACb;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,MAAM,2BAA2B,kCAAkC,KAAK;AAC/E,aAAO;AAAA,IACT;AAAA,EACF,GAAG,CAAC,sBAAsB,MAAM,kBAAkB,YAAY,CAAC;AAG/D,QAAM,qBAAqB,YAAY,OAAO,UAAsC;AAElF,QAAI,kBAAkB,cAAc;AAClC,aAAO,CAAC,GAAG;AAAA,IACb;AAEA,UAAM,cAAc,SAAS,sBAAsB;AACnD,QAAI,CAAC,eAAe,CAAC,KAAM,QAAO,CAAC;AAEnC,QAAI;AAEF,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,mBAAa;AAEvD,YAAM,QAAQ;AAAA,QACZ,gBAAgB;AAAA,QAChB,SAAS,KAAK,eAAe,WAAW,KAAK,cAAc;AAAA,QAC3D,OAAO,KAAK,eAAe,SAAS,KAAK,cAAc;AAAA,MACzD;AAEA,YAAM,gBAAgB,MAAM,iBAAiB;AAAA,QAC3C,QAAQ,KAAK;AAAA,QACb;AAAA,MACF,CAAC;AAGD,YAAM,iBAAiB,OAAO,QAAQ,aAAa,EAChD,OAAO,CAAC,CAAC,EAAE,OAAO,MAAM,OAAO,EAC/B,IAAI,CAAC,CAAC,UAAU,MAAM,UAAU;AACnC,aAAO,CAAC,GAAG,IAAI,IAAI,cAAc,CAAC;AAAA,IACpC,SAAS,OAAO;AACd,aAAO,MAAM,2BAA2B,uCAAuC,KAAK;AACpF,aAAO,CAAC;AAAA,IACV;AAAA,EACF,GAAG,CAAC,sBAAsB,MAAM,aAAa,kBAAkB,YAAY,CAAC;AAG5E,QAAM,wBAAwB,YAAY,OAAO,QAAgB,YAAqD;AACpH,QAAI,CAAC,QAAQ,CAAC,qBAAsB;AAEpC,QAAI;AAEF,UAAI,qBAAqB,IAAI;AAC3B,cAAM,EAAE,eAAe,IAAI,MAAM,OAAO,qBAAe;AAEvD,cAAM,eAAe;AAAA,UACnB,MAAM;AAAA,UACN,QAAQ,KAAK;AAAA,UACb,gBAAgB,qBAAqB;AAAA,UACrC,YAAY;AAAA,UACZ,UAAU;AAAA;AAAA,UACV,QAAQ;AAAA,UACR,aAAa;AAAA;AAAA,UACb,UAAU,WAAW,CAAC;AAAA,QACxB,CAAC;AAAA,MACH;AAAA,IACF,SAAS,OAAO;AACd,aAAO,MAAM,2BAA2B,sCAAsC,KAAK;AAAA,IACrF;AAAA,EACF,GAAG,CAAC,MAAM,oBAAoB,CAAC;AAG/B,QAAM,2BAA2B,YAAY,OAAO,UAAiC;AACnF,UAAM,YAAY,MAAM,2BAA2B,KAAK;AAExD,QAAI,CAAC,WAAW;AACd,YAAM,QAAQ,IAAI,MAAM,6CAA6C,KAAK,EAAE;AAC5E,YAAM,OAAO;AACb,YAAM,OAAO;AACb,YAAM,iBAAiB;AACvB,YAAM,SAAS,MAAM;AACrB,YAAM;AAAA,IACR;AAAA,EACF,GAAG,CAAC,4BAA4B,IAAI,CAAC;AAGrC,QAAM,qBAAqB,YAAY,OAAO,QAAgB,UAAoC;AAChG,QAAI,CAAC,SAAU,QAAO;AAEtB,QAAI;AAEF,UAAI,kBAAkB,cAAc;AAClC,eAAO;AAAA,MACT;AAGA,UAAI,WAAW,MAAM,IAAI;AACvB,eAAO;AAAA,MACT;AAEA,aAAO,MAAM,2BAA2B,KAAK;AAAA,IAC/C,SAAS,OAAO;AACd,aAAO,MAAM,2BAA2B,qCAAqC,KAAK;AAClF,aAAO;AAAA,IACT;AAAA,EACF,GAAG,CAAC,UAAU,kBAAkB,cAAc,MAAM,0BAA0B,CAAC;AAE/E,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":["useRef","useMemo","useRef","appName","error","useMemo","useMemo","jsx","useMemo","useMemo","useContext","useContext","useMemo","useMemo","useEffect","useState","useState","useEffect","useMemo"]}