@jmruthers/pace-core 0.6.10 → 0.6.11

package/dist/index.js

@@ -1,68 +1,41 @@
-export { ALL_PERMISSIONS, EVENT_APP_PERMISSIONS, GLOBAL_PERMISSIONS, NavigationGuard, ORGANISATION_PERMISSIONS, PAGE_PERMISSIONS, PagePermissionGuard, RBACErrorCode, RPCFunction, createRBACExpressMiddleware, createRBACMiddleware, isValidPermission, useResourcePermissions, useRoleManagement, withAccessLevelGuard, withPermissionGuard, withRoleGuard } from './chunk-W46INAVW.js';
-export { AddressField, AppSwitcher, Avatar, Badge, Calendar, ContextSelector, DEFAULT_APP_PORT_MAP, DatePickerWithTimezone, ErrorBoundary, ErrorBoundaryProvider, FileDisplay, FileUpload, Footer, Form, FormField, Header, LoginForm, NavigationMenu, PaceAppLayout, PaceLoginPage, PasswordChangeForm, ProtectedRoute, PublicPageFooter, PublicPageHeader, PublicPageLayout, PublicPageProvider, SessionRestorationLoader, Switch, Tabs, TabsContent, TabsList, TabsTrigger, Textarea, Toast, ToastAction, ToastClose, ToastDescription, ToastProvider, ToastTitle, ToastViewport, Toaster, UserMenu, buildAppUrl, getAllAppPorts, getAppPort, useAccessibleApps, useFileReference, useFileReferenceById, useFileReferenceForRecord, useFilesByCategory } from './chunk-TFIPNIPE.js';
-export { AccessDenied, SECURE_CLIENT_SYMBOL, SecureSupabaseClient, createSecureClient, fromSupabaseClient, isSecureClient, useEvents, useRBAC, useSecureSupabase, warnIfInsecureClient } from './chunk-X5EAU5G7.js';
-import { Dialog, DialogContent, DialogHeader } from './chunk-MPY44PWB.js';
-export { Checkbox, ColumnFactory, DataTable, Dialog, DialogBody, DialogClose, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogPortal, DialogTitle, DialogTrigger, Input, Label, Progress, Select, SelectContent, SelectGroup, SelectItem, SelectLabel, SelectSeparator, SelectTrigger, SelectValue, Table, TableBody, TableCaption, TableCell, TableFooter, TableHead, TableHeader, TableRow, average, count, exportToCSV, exportToCSVWithTableRows, generateCSVContent, max, min, sum } from './chunk-MPY44PWB.js';
-import { Card, Button } from './chunk-KYURMOQM.js';
-export { Alert, AlertDescription, AlertTitle, Button, Card, CardActions, CardContent, CardDescription, CardFooter, CardHeader, CardTitle, Tooltip, TooltipContent, TooltipProvider, TooltipRoot, TooltipTrigger, useAccessLevel, useCan, useMultiplePermissions, usePermissions, useResolvedScope } from './chunk-KYURMOQM.js';
-export { clearPublicEventCache, clearPublicLogoCache, extractEventCodeFromPath, generatePublicRoutePath, getPublicEventCacheStats, getPublicLogoCacheStats, useFormDialog, useOrganisationPermissions, usePublicEvent, usePublicEventCode, usePublicEventLogo, usePublicRouteParams, useZodForm } from './chunk-66R6RLUZ.js';
-import { generateFilePath, generateUniqueFileName, extractFileMetadata, uploadFile, getPublicUrl, getSignedUrl, deleteFile, downloadFile, listFiles, archiveFile } from './chunk-FBZ7U3ID.js';
-export { APP_PATH_MAPPING, DEFAULT_FILE_SIZE_LIMIT, FILE_SIZE_LIMITS, STORAGE_CONFIG, archiveFile, clearPublicFileDisplayCache, deleteFile, downloadFile, extractFileMetadata, generateFilePath, generateFileUrlsBatch, generateUniqueFileName, getBucketName, getFileSizeLimit, getPublicFileDisplayCacheStats, getPublicUrl, getSignedUrl, listFiles, uploadFile, useEventTheme, usePublicFileDisplay, validateFileSize } from './chunk-FBZ7U3ID.js';
-export { applyPalette, clearPalette, parseAndNormalizeEventColours } from './chunk-JJEYZ3DX.js';
-export { useOrganisationSecurity } from './chunk-KPYQWGFQ.js';
-export { useToast } from './chunk-BCTXBU6U.js';
-export { useAppConfig, useIsPublicPage, usePublicPageContext } from './chunk-3GWSPISD.js';
+export { ALL_PERMISSIONS, EVENT_APP_PERMISSIONS, GLOBAL_PERMISSIONS, NavigationGuard, ORGANISATION_PERMISSIONS, PAGE_PERMISSIONS, PagePermissionGuard, RBACErrorCode, RPCFunction, createRBACExpressMiddleware, createRBACMiddleware, isValidPermission, useResourcePermissions, useRoleManagement, withAccessLevelGuard, withPermissionGuard, withRoleGuard } from './chunk-YYTWKVHO.js';
+export { AddressField, AppSwitcher, Avatar, Badge, Calendar, ContextSelector, DEFAULT_APP_PORT_MAP, DatePickerWithTimezone, ErrorBoundary, ErrorBoundaryProvider, FileDisplay, FileUpload, Footer, Form, FormField, Header, LoginForm, NavigationMenu, PaceAppLayout, PaceLoginPage, PasswordChangeForm, ProtectedRoute, PublicPageFooter, PublicPageHeader, PublicPageLayout, PublicPageProvider, SessionRestorationLoader, Switch, Tabs, TabsContent, TabsList, TabsTrigger, Textarea, Toast, ToastAction, ToastClose, ToastDescription, ToastProvider, ToastTitle, ToastViewport, Toaster, UserMenu, buildAppUrl, getAllAppPorts, getAppPort, useAccessibleApps, useFileReference, useFileReferenceById, useFileReferenceForRecord, useFilesByCategory } from './chunk-KJXRL3XE.js';
+export { AccessDenied, SECURE_CLIENT_SYMBOL, SecureSupabaseClient, createSecureClient, fromSupabaseClient, isSecureClient, useRBAC, useSecureSupabase, warnIfInsecureClient } from './chunk-PCSHBLPB.js';
+import { Dialog, DialogContent, DialogHeader } from './chunk-2OEVOGGR.js';
+export { Checkbox, ColumnFactory, DataTable, Dialog, DialogBody, DialogClose, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogPortal, DialogTitle, DialogTrigger, Input, Label, Progress, Select, SelectContent, SelectGroup, SelectItem, SelectLabel, SelectSeparator, SelectTrigger, SelectValue, Table, TableBody, TableCaption, TableCell, TableFooter, TableHead, TableHeader, TableRow, average, count, exportToCSV, exportToCSVWithTableRows, generateCSVContent, max, min, sum } from './chunk-2OEVOGGR.js';
+import { Card, Button } from './chunk-V7FTM2LU.js';
+export { Alert, AlertDescription, AlertTitle, Button, Card, CardActions, CardContent, CardDescription, CardFooter, CardHeader, CardTitle, Tooltip, TooltipContent, TooltipProvider, TooltipRoot, TooltipTrigger, useAccessLevel, useCan, useMultiplePermissions, usePermissions, useResolvedScope } from './chunk-V7FTM2LU.js';
+export { clearPublicEventCache, clearPublicLogoCache, extractEventCodeFromPath, generatePublicRoutePath, getPublicEventCacheStats, getPublicLogoCacheStats, useFormDialog, useOrganisationPermissions, usePublicEvent, usePublicEventCode, usePublicEventLogo, usePublicRouteParams, useZodForm } from './chunk-YFTFFJIV.js';
+import { generateFilePath, generateUniqueFileName, extractFileMetadata, uploadFile, getPublicUrl, getSignedUrl, deleteFile, downloadFile, listFiles, archiveFile } from './chunk-J2KQK6DG.js';
+export { APP_PATH_MAPPING, DEFAULT_FILE_SIZE_LIMIT, FILE_SIZE_LIMITS, STORAGE_CONFIG, archiveFile, clearPublicFileDisplayCache, deleteFile, downloadFile, extractFileMetadata, generateFilePath, generateFileUrlsBatch, generateUniqueFileName, getBucketName, getFileSizeLimit, getPublicFileDisplayCacheStats, getPublicUrl, getSignedUrl, listFiles, uploadFile, useEventTheme, usePublicFileDisplay, validateFileSize } from './chunk-J2KQK6DG.js';
+export { useEvents, useOptionalEvents, useOrganisationSecurity } from './chunk-WY6Y7KC3.js';
+export { useToast } from './chunk-ENLXB7GP.js';
+export { useAppConfig, useIsPublicPage, usePublicPageContext } from './chunk-L5LFKKLJ.js';
 import './chunk-C7NSAPTL.js';
-import { OrganisationServiceContext, UnifiedAuthContext, OrganisationServiceProvider } from './chunk-Y4PF6HIM.js';
-export { EventServiceProvider, InactivityServiceProvider, OrganisationServiceProvider, UnifiedAuthProvider, useAuthService, useEventService, useInactivityService, useOrganisationService, useOrganisations, useSessionRestoration, useUnifiedAuth } from './chunk-Y4PF6HIM.js';
-export { CACHE_PATTERNS, RBACCache, RBACEngine, clearInFlightRequests, createRBACConfig, createRBACEngine, disablePerformanceMonitoring, enablePerformanceMonitoring, getAccessLevel, getInFlightRequestCount, getPerformanceMetrics, getPerformanceSummary, getPermissionMap, getRBACConfig, getRBACLogger, getRoleContext, hasAllPermissions, hasAnyPermission, isDebugMode, isDevelopmentMode, isPerformanceMonitoringEnabled, isPermitted, isPermittedCached, isRBACInitialized, rbacCache, recordAuditEvent, recordPermissionCheck, resetPerformanceMetrics, resolveAppContext, setupRBAC } from './chunk-LNHFAF4X.js';
-export { RBACAuditManager, createAuditManager, emitAuditEvent, getGlobalAuditManager, setGlobalAuditManager } from './chunk-NIU6DPQV.js';
+export { EventServiceProvider, InactivityServiceProvider, OrganisationServiceProvider, UnifiedAuthProvider, useAuthService, useEventService, useInactivityService, useOrganisationService, useOrganisations, useSessionRestoration, useUnifiedAuth } from './chunk-4R3T5ENU.js';
+export { applyPalette, clearPalette, parseAndNormalizeEventColours } from './chunk-D6BMFMQZ.js';
+export { CACHE_PATTERNS, RBACCache, RBACEngine, clearInFlightRequests, createRBACConfig, createRBACEngine, disablePerformanceMonitoring, enablePerformanceMonitoring, getAccessLevel, getInFlightRequestCount, getPerformanceMetrics, getPerformanceSummary, getPermissionMap, getRBACConfig, getRBACLogger, getRoleContext, hasAllPermissions, hasAnyPermission, isDebugMode, isDevelopmentMode, isPerformanceMonitoringEnabled, isPermitted, isPermittedCached, isRBACInitialized, rbacCache, recordAuditEvent, recordPermissionCheck, resetPerformanceMetrics, resolveAppContext, setupRBAC } from './chunk-7A6IMHH2.js';
+export { RBACAuditManager, createAuditManager, emitAuditEvent, getGlobalAuditManager, setGlobalAuditManager } from './chunk-QRYSEPHB.js';
 export { FileCategory } from './chunk-6QYDGKQY.js';
 import './chunk-4SXLQIZO.js';
-export { createBaseClient, emailSchema, formatCompactNumber, formatCurrency, formatDate, formatDateTime, formatFileSize, formatNumber, formatPercent, formatTime, getAppConfig, getCurrentAppId, getCurrentAppName, nameSchema, passwordSchema, phoneSchema, sanitizeFormData, sanitizeUserInput, setAppConfig, urlSchema, useSessionTracking } from './chunk-KSNLMI7N.js';
-export { formatInTimeZone, formatTimeInTimeZone, fromZonedTime, getTimeZoneDifference, getTimezoneAbbreviation, getUserTimeZone, roundToNearestMinutes, toZonedTime } from './chunk-FN52B75D.js';
+export { createBaseClient, emailSchema, getAppConfig, getCurrentAppId, getCurrentAppName, nameSchema, passwordSchema, phoneSchema, sanitizeFormData, sanitizeUserInput, setAppConfig, urlSchema, useSessionTracking } from './chunk-2DL2WSOE.js';
+export { formatCompactNumber, formatCurrency, formatDate, formatDateTime, formatFileSize, formatInTimeZone, formatNumber, formatPercent, formatTime, formatTimeInTimeZone, fromZonedTime, getTimeZoneDifference, getTimezoneAbbreviation, getUserTimeZone, roundToNearestMinutes, toZonedTime } from './chunk-XOJME5T7.js';
 export { sanitizeHtml } from './chunk-DDMPHZ3D.js';
 import { cn } from './chunk-UZNAFKGW.js';
 export { LoadingSpinner, cn } from './chunk-UZNAFKGW.js';
-import './chunk-7YDC7LMU.js';
+import './chunk-XPFVT3GN.js';
 import './chunk-RMLY6KB5.js';
 import { logger } from './chunk-BTHN5MKC.js';
 export { LogLevel, Logger, createLogger, logger } from './chunk-BTHN5MKC.js';
+export { err, isErr, isOk, ok } from './chunk-44CNXN4P.js';
+import './chunk-CU2BU2MQ.js';
 export { getAllStylePaths, getStylePath, styleConfig } from './chunk-UH3NTO3F.js';
 import './chunk-3RG5ZIWI.js';
-import { useContext, useState, useEffect, useCallback, useRef } from 'react';
-import { jsx, Fragment, jsxs } from 'react/jsx-runtime';
+import { useState, useEffect, useCallback, useRef } from 'react';
 import { AlertTriangle, Clock } from 'lucide-react';
+import { jsx, jsxs } from 'react/jsx-runtime';
 export { z } from 'zod';
 
-function OrganisationProvider({
-  children,
-  requireOrganisationContext: _requireOrganisationContext,
-  autoSelectPrimaryOrganisation: _autoSelectPrimaryOrganisation,
-  onOrganisationChange: _onOrganisationChange
-}) {
-  const existingOrganisationService = useContext(OrganisationServiceContext);
-  const authContext = useContext(UnifiedAuthContext);
-  if (existingOrganisationService) {
-    return /* @__PURE__ */ jsx(Fragment, { children });
-  }
-  if (!authContext) {
-    throw new Error("OrganisationProvider must be used inside UnifiedAuthProvider, or OrganisationServiceProvider must be provided separately");
-  }
-  const { supabase, user, session } = authContext;
-  if (!supabase) {
-    throw new Error("OrganisationProvider: No supabase client available from UnifiedAuthProvider");
-  }
-  return /* @__PURE__ */ jsx(
-    OrganisationServiceProvider,
-    {
-      supabaseClient: supabase,
-      user,
-      session,
-      children
-    }
-  );
-}
 function InactivityWarningModal({
   isOpen,
   timeRemaining,
@@ -151,6 +124,67 @@ function throttle(func, limit) {
     }
   };
 }
+function scheduleInactivityTimers(timeoutRef, warningTimeoutRef, countdownIntervalRef, lastActivityRef, idleTimeoutMs, warnBeforeMs, setIsIdle, setShowWarning, setTimeRemaining, onIdleRef, onWarningRef, clearTimers) {
+  clearTimers();
+  const warningTime = idleTimeoutMs - warnBeforeMs;
+  if (warningTime > 0) {
+    warningTimeoutRef.current = setTimeout(() => {
+      setShowWarning(true);
+      onWarningRef.current?.();
+    }, warningTime);
+  }
+  timeoutRef.current = setTimeout(() => {
+    setIsIdle(true);
+    onIdleRef.current?.();
+  }, idleTimeoutMs);
+  countdownIntervalRef.current = setInterval(() => {
+    const elapsed = Date.now() - lastActivityRef.current;
+    const remaining = Math.max(0, idleTimeoutMs - elapsed);
+    setTimeRemaining(remaining);
+    if (remaining === 0) clearTimers();
+  }, 1e3);
+}
+function useInactivityCrossTabSync(storageKey, channelName, onRemoteActivity) {
+  const channelRef = useRef(null);
+  const onRemoteActivityRef = useRef(onRemoteActivity);
+  useEffect(() => {
+    onRemoteActivityRef.current = onRemoteActivity;
+  }, [onRemoteActivity]);
+  useEffect(() => {
+    if (typeof BroadcastChannel === "undefined") return;
+    channelRef.current = new BroadcastChannel(channelName);
+    channelRef.current.onmessage = (event) => {
+      if (event.data?.type === "activity") {
+        onRemoteActivityRef.current(event.data.timestamp);
+      }
+    };
+    return () => {
+      channelRef.current?.close();
+      channelRef.current = null;
+    };
+  }, [channelName]);
+  const getLastActivityFromStorage = useCallback(() => {
+    try {
+      const s = localStorage.getItem(storageKey);
+      return s ? parseInt(s, 10) : null;
+    } catch {
+      return null;
+    }
+  }, [storageKey]);
+  const broadcastActivity = useCallback((timestamp) => {
+    try {
+      localStorage.setItem(storageKey, String(timestamp));
+      channelRef.current?.postMessage({ type: "activity", timestamp });
+    } catch (error) {
+      logger.warn("useInactivityTracker", "Failed to persist/broadcast activity:", error);
+    }
+  }, [storageKey]);
+  const closeChannel = useCallback(() => {
+    channelRef.current?.close();
+    channelRef.current = null;
+  }, []);
+  return { getLastActivityFromStorage, broadcastActivity, closeChannel };
+}
 function useInactivityTracker({
   idleTimeoutMs = 30 * 60 * 1e3,
   // 30 minutes
@@ -179,7 +213,17 @@ function useInactivityTracker({
   const warningTimeoutRef = useRef(null);
   const countdownIntervalRef = useRef(null);
   const lastActivityRef = useRef(Date.now());
-  const channelRef = useRef(null);
+  const remoteActivityRef = useRef(() => {
+  });
+  const handleRemoteActivity = useCallback((timestamp) => {
+    lastActivityRef.current = timestamp;
+    remoteActivityRef.current();
+  }, []);
+  const { getLastActivityFromStorage, broadcastActivity, closeChannel } = useInactivityCrossTabSync(
+    storageKey,
+    channelName,
+    handleRemoteActivity
+  );
   const throttledResetActivityRef = useRef(null);
   const onIdleRef = useRef(onIdle);
   const onWarningRef = useRef(onWarning);
@@ -207,45 +251,27 @@ function useInactivityTracker({
     if (!enabled) return;
     const now = Date.now();
     lastActivityRef.current = now;
-    clearTimers();
     setIsIdle(false);
     setShowWarning(false);
     setTimeRemaining(idleTimeoutMs);
-    if (!skipActivityCallback) {
-      onActivityRef.current?.();
-    }
-    const warningTime = idleTimeoutMs - warnBeforeMs;
-    if (warningTime > 0) {
-      warningTimeoutRef.current = setTimeout(() => {
-        setShowWarning(true);
-        onWarningRef.current?.();
-      }, warningTime);
-    }
-    timeoutRef.current = setTimeout(() => {
-      setIsIdle(true);
-      onIdleRef.current?.();
-    }, idleTimeoutMs);
-    countdownIntervalRef.current = setInterval(() => {
-      const elapsed = Date.now() - lastActivityRef.current;
-      const remaining = Math.max(0, idleTimeoutMs - elapsed);
-      setTimeRemaining(remaining);
-      if (remaining === 0) {
-        clearTimers();
-      }
-    }, 1e3);
-    try {
-      localStorage.setItem(storageKey, now.toString());
-    } catch (error) {
-      logger.warn("useInactivityTracker", "Failed to persist activity time:", error);
-    }
-    try {
-      if (channelRef.current) {
-        channelRef.current.postMessage({ type: "activity", timestamp: now });
-      }
-    } catch (error) {
-      logger.warn("useInactivityTracker", "Failed to broadcast activity:", error);
-    }
-  }, [enabled, idleTimeoutMs, warnBeforeMs, storageKey, clearTimers]);
+    if (!skipActivityCallback) onActivityRef.current?.();
+    scheduleInactivityTimers(
+      timeoutRef,
+      warningTimeoutRef,
+      countdownIntervalRef,
+      lastActivityRef,
+      idleTimeoutMs,
+      warnBeforeMs,
+      setIsIdle,
+      setShowWarning,
+      setTimeRemaining,
+      onIdleRef,
+      onWarningRef,
+      clearTimers
+    );
+    broadcastActivity(now);
+  }, [enabled, idleTimeoutMs, warnBeforeMs, broadcastActivity, clearTimers]);
+  remoteActivityRef.current = resetActivity;
   const startTracking = useCallback(() => {
     if (!enabled) return;
     setIsTracking(false);
@@ -254,41 +280,23 @@ function useInactivityTracker({
     setTimeRemaining(idleTimeoutMs);
     clearTimers();
     setIsTracking(true);
-    try {
-      if (typeof BroadcastChannel !== "undefined") {
-        channelRef.current = new BroadcastChannel(channelName);
-        channelRef.current.onmessage = (event) => {
-          if (event.data.type === "activity") {
-            lastActivityRef.current = event.data.timestamp;
-            resetActivity();
-          }
-        };
-      }
-    } catch (error) {
-      logger.warn("useInactivityTracker", "Failed to set up cross-tab communication:", error);
-    }
-    try {
-      const persistedTime = localStorage.getItem(storageKey);
-      if (persistedTime) {
-        const persistedTimestamp = parseInt(persistedTime, 10);
-        const elapsed = Date.now() - persistedTimestamp;
-        if (elapsed < idleTimeoutMs) {
-          lastActivityRef.current = persistedTimestamp;
-          const remaining = idleTimeoutMs - elapsed;
-          setTimeRemaining(remaining);
-          if (remaining <= warnBeforeMs) {
-            setShowWarning(true);
-            onWarningRef.current?.();
-          }
-          if (remaining <= 0) {
-            setIsIdle(true);
-            onIdleRef.current?.();
-            return;
-          }
+    const persistedTime = getLastActivityFromStorage();
+    if (persistedTime != null) {
+      const elapsed = Date.now() - persistedTime;
+      if (elapsed < idleTimeoutMs) {
+        lastActivityRef.current = persistedTime;
+        const remaining = idleTimeoutMs - elapsed;
+        setTimeRemaining(remaining);
+        if (remaining <= warnBeforeMs) {
+          setShowWarning(true);
+          onWarningRef.current?.();
+        }
+        if (remaining <= 0) {
+          setIsIdle(true);
+          onIdleRef.current?.();
+          return;
         }
       }
-    } catch (error) {
-      logger.warn("useInactivityTracker", "Failed to check persisted activity time:", error);
     }
     if (throttledResetActivityRef.current) {
       ACTIVITY_EVENTS.forEach((event) => {
@@ -310,12 +318,9 @@ function useInactivityTracker({
         throttledResetActivityRef.current = null;
       }
       clearTimers();
-      if (channelRef.current) {
-        channelRef.current.close();
-        channelRef.current = null;
-      }
+      closeChannel();
     };
-  }, [enabled, channelName, storageKey, idleTimeoutMs, warnBeforeMs, resetActivity, clearTimers]);
+  }, [enabled, idleTimeoutMs, warnBeforeMs, getLastActivityFromStorage, resetActivity, clearTimers, closeChannel]);
   const stopTracking = useCallback(() => {
     setIsTracking(false);
     clearTimers();
@@ -325,11 +330,8 @@ function useInactivityTracker({
       });
       throttledResetActivityRef.current = null;
     }
-    if (channelRef.current) {
-      channelRef.current.close();
-      channelRef.current = null;
-    }
-  }, [clearTimers]);
+    closeChannel();
+  }, [clearTimers, closeChannel]);
   useEffect(() => {
     if (enabled) {
       const cleanup = startTracking();
@@ -342,11 +344,9 @@ function useInactivityTracker({
   useEffect(() => {
     return () => {
       clearTimers();
-      if (channelRef.current) {
-        channelRef.current.close();
-      }
+      closeChannel();
     };
-  }, [clearTimers]);
+  }, [clearTimers, closeChannel]);
   return {
     isIdle,
     timeRemaining,
@@ -359,221 +359,197 @@ function useInactivityTracker({
 }
 
 // src/utils/security/secureDataAccess.ts
-var createSecureDataAccess = (supabase, organisationId, isSuperAdmin = false) => {
-  const validateOrganisationContext = (orgId) => {
-    if (!orgId) {
-      throw new Error("Organisation context is required for secure data access");
-    }
-    if (!isSuperAdmin && !orgId) {
-      throw new Error("Organisation context is mandatory for non-super admin users");
+var TABLES_WITH_ORGANISATION = [
+  "core_events",
+  "organisation_settings",
+  "rbac_event_app_roles",
+  "rbac_organisation_roles",
+  "organisation_audit_log",
+  "organisation_invitations",
+  "organisation_app_access",
+  "cake_meal",
+  "cake_mealtype",
+  "form_responses",
+  "form_response_values",
+  "forms",
+  "invoice",
+  "line_item",
+  "credit_balance",
+  "payment_method",
+  "form_contexts",
+  "form_field_config",
+  "form_fields",
+  "cake_delivery",
+  "cake_diettype",
+  "cake_diner",
+  "cake_dish",
+  "cake_item",
+  "cake_logistics",
+  "cake_mealplan",
+  "cake_package",
+  "cake_recipe",
+  "cake_supplier",
+  "cake_supply",
+  "cake_unit",
+  "event_app_access",
+  "base_application",
+  "base_questions"
+];
+function validateOrganisationContextImpl(orgId, isSuperAdmin) {
+  if (!orgId) {
+    throw new Error("Organisation context is required for secure data access");
+  }
+  if (!isSuperAdmin && !orgId) {
+    throw new Error("Organisation context is mandatory for non-super admin users");
+  }
+}
+function ensureOrganisationColumnImpl(table) {
+  return TABLES_WITH_ORGANISATION.includes(table);
+}
+function buildSecureQueryImpl(options, supabase, isSuperAdmin, organisationId, ensureOrganisationColumn, validateOrganisationContext) {
+  const { table, select, organisationId: orgId, filters, orderBy, limit, offset } = options;
+  validateOrganisationContext(orgId);
+  let query = supabase.from(table).select(select);
+  if (!isSuperAdmin && ensureOrganisationColumn(table)) {
+    query = query.eq("organisation_id", orgId);
+  }
+  if (filters) {
+    Object.entries(filters).forEach(([key, value]) => {
+      if (value !== void 0 && value !== null) {
+        const columnName = key.includes(".") ? key.split(".").pop() : key;
+        query = query.eq(columnName, value);
+      }
+    });
+  }
+  if (orderBy) {
+    const orderByColumn = orderBy.split(".").pop();
+    if (orderByColumn) query = query.order(orderByColumn);
+  }
+  if (limit) query = query.limit(limit);
+  if (offset) query = query.range(offset, offset + (limit || 10) - 1);
+  return query;
+}
+async function secureQueryImpl(ctx, options) {
+  const { table, select, organisationId: orgId, filters, orderBy, limit, offset } = options;
+  try {
+    const query = ctx.buildSecureQuery({
+      table,
+      select,
+      organisationId: orgId,
+      filters,
+      orderBy,
+      limit,
+      offset
+    });
+    const { data, error } = await query;
+    if (error) throw error;
+    if (Array.isArray(data)) return data;
+    return [];
+  } catch (error) {
+    throw error;
+  }
+}
+async function secureSingleQueryImpl(ctx, options) {
+  const { table, select, organisationId: orgId, filters, orderBy, limit, offset } = options;
+  try {
+    const query = ctx.buildSecureQuery({
+      table,
+      select,
+      organisationId: orgId,
+      filters,
+      orderBy,
+      limit,
+      offset
+    });
+    const { data, error } = await query.single();
+    if (error) {
+      if (error.code === "PGRST116") return null;
+      throw error;
     }
-  };
-  const ensureOrganisationColumn = (table) => {
-    const tablesWithOrganisation = [
-      "core_events",
-      "organisation_settings",
-      "rbac_event_app_roles",
-      "rbac_organisation_roles",
-      // SECURITY: Phase 2 additions - complete organisation table mapping
-      "organisation_audit_log",
-      "organisation_invitations",
-      "organisation_app_access",
-      // SECURITY: Emergency additions for Phase 1 fixes
-      "cake_meal",
-      "cake_mealtype",
-      // NOTE: core_person, pace_person, core_member, medi_profile, core_contact, core_consent, 
-      // core_identification, core_qualification are now person-scoped (not organisation-scoped) 
-      // and do NOT have organisation_id columns - removed from this list
-      // SECURITY: Phase 3A additions - medical and personal data
-      // NOTE: medi_condition, medi_diet, medi_action_plan, medi_profile_versions are now person-scoped
-      // (via medi_profile) - removed from this list
-      // core_identification_type remains organisation-scoped (lookup table)
-      "form_responses",
-      "form_response_values",
-      "forms",
-      // SECURITY: Phase 3B additions - remaining critical tables
-      "invoice",
-      "line_item",
-      "credit_balance",
-      "payment_method",
-      "form_contexts",
-      "form_field_config",
-      "form_fields",
-      "cake_delivery",
-      "cake_diettype",
-      "cake_diner",
-      "cake_dish",
-      "cake_item",
-      "cake_logistics",
-      "cake_mealplan",
-      "cake_package",
-      "cake_recipe",
-      "cake_supplier",
-      "cake_supply",
-      "cake_unit",
-      "event_app_access",
-      "base_application",
-      "base_questions"
-    ];
-    return tablesWithOrganisation.includes(table);
-  };
-  const buildSecureQuery = (options) => {
-    const { table, select, organisationId: orgId, filters, orderBy, limit, offset } = options;
-    validateOrganisationContext(orgId);
-    let query = supabase.from(table).select(select);
-    if (!isSuperAdmin && ensureOrganisationColumn(table)) {
-      query = query.eq("organisation_id", orgId);
+    if (data && typeof data === "object" && !("code" in data)) return data;
+    return null;
+  } catch (error) {
+    throw error;
+  }
+}
+async function secureInsertImpl(ctx, table, data, organisationId) {
+  ctx.validateOrganisationContext(organisationId);
+  try {
+    const insertData = { ...data, organisation_id: organisationId };
+    const { data: result, error } = await ctx.supabase.from(table).insert(insertData).select().single();
+    if (error) throw error;
+    return result;
+  } catch (error) {
+    throw error;
+  }
+}
+async function secureUpdateImpl(ctx, table, data, filters, organisationId) {
+  ctx.validateOrganisationContext(organisationId);
+  try {
+    let query = ctx.supabase.from(table).update(data);
+    if (!ctx.isSuperAdmin && ctx.ensureOrganisationColumn(table)) {
+      query = query.eq("organisation_id", organisationId);
     }
     if (filters) {
       Object.entries(filters).forEach(([key, value]) => {
-        if (value !== void 0 && value !== null) {
-          const columnName = key.includes(".") ? key.split(".").pop() : key;
-          query = query.eq(columnName, value);
-        }
+        if (value !== void 0 && value !== null) query = query.eq(key, value);
       });
     }
-    if (orderBy) {
-      const orderByColumn = orderBy.split(".").pop();
-      if (orderByColumn) {
-        query = query.order(orderByColumn);
-      }
-    }
-    if (limit) {
-      query = query.limit(limit);
-    }
-    if (offset) {
-      query = query.range(offset, offset + (limit || 10) - 1);
-    }
-    return query;
-  };
-  const secureQuery = async (options) => {
-    const { table, select, organisationId: orgId, filters, orderBy, limit, offset } = options;
-    try {
-      const query = buildSecureQuery({
-        table,
-        select,
-        organisationId: orgId,
-        filters,
-        orderBy,
-        limit,
-        offset
-      });
-      const { data, error } = await query;
-      if (error) {
-        throw error;
-      }
-      if (Array.isArray(data)) {
-        return data;
-      }
-      return [];
-    } catch (error) {
-      throw error;
+    const { data: result, error } = await query.select().single();
+    if (error) throw error;
+    return result;
+  } catch (error) {
+    throw error;
+  }
+}
+async function secureDeleteImpl(ctx, table, filters, organisationId) {
+  ctx.validateOrganisationContext(organisationId);
+  try {
+    let query = ctx.supabase.from(table).delete();
+    if (!ctx.isSuperAdmin && ctx.ensureOrganisationColumn(table)) {
+      query = query.eq("organisation_id", organisationId);
     }
-  };
-  const secureSingleQuery = async (options) => {
-    const { table, select, organisationId: orgId, filters, orderBy, limit, offset } = options;
-    try {
-      const query = buildSecureQuery({
-        table,
-        select,
-        organisationId: orgId,
-        filters,
-        orderBy,
-        limit,
-        offset
+    if (filters) {
+      Object.entries(filters).forEach(([key, value]) => {
+        if (value !== void 0 && value !== null) query = query.eq(key, value);
       });
-      const { data, error } = await query.single();
-      if (error) {
-        if (error.code === "PGRST116") {
-          return null;
-        }
-        throw error;
-      }
-      if (data && typeof data === "object" && !("code" in data)) {
-        return data;
-      }
-      return null;
-    } catch (error) {
-      throw error;
     }
-  };
-  const secureInsert = async (table, data, organisationId2) => {
-    validateOrganisationContext(organisationId2);
-    try {
-      const insertData = {
-        ...data,
-        organisation_id: organisationId2
-      };
-      const { data: result, error } = await supabase.from(table).insert(insertData).select().single();
-      if (error) {
-        throw error;
-      }
-      return result;
-    } catch (error) {
-      throw error;
-    }
-  };
-  const secureUpdate = async (table, data, filters, organisationId2) => {
-    validateOrganisationContext(organisationId2);
-    try {
-      let query = supabase.from(table).update(data);
-      if (!isSuperAdmin && ensureOrganisationColumn(table)) {
-        query = query.eq("organisation_id", organisationId2);
-      }
-      if (filters) {
-        Object.entries(filters).forEach(([key, value]) => {
-          if (value !== void 0 && value !== null) {
-            query = query.eq(key, value);
-          }
-        });
-      }
-      const { data: result, error } = await query.select().single();
-      if (error) {
-        throw error;
-      }
-      return result;
-    } catch (error) {
-      throw error;
-    }
-  };
-  const secureDelete = async (table, filters, organisationId2) => {
-    validateOrganisationContext(organisationId2);
-    try {
-      let query = supabase.from(table).delete();
-      if (!isSuperAdmin && ensureOrganisationColumn(table)) {
-        query = query.eq("organisation_id", organisationId2);
-      }
-      if (filters) {
-        Object.entries(filters).forEach(([key, value]) => {
-          if (value !== void 0 && value !== null) {
-            query = query.eq(key, value);
-          }
-        });
-      }
-      const { error } = await query;
-      if (error) {
-        throw error;
-      }
-      return true;
-    } catch (error) {
-      throw error;
-    }
-  };
-  const queryByOrganisation = async (table, select, organisationId2, filters) => {
-    return secureQuery({
-      table,
-      select,
-      organisationId: organisationId2,
-      filters
-    });
+    const { error } = await query;
+    if (error) throw error;
+    return true;
+  } catch (error) {
+    throw error;
+  }
+}
+async function queryByOrganisationImpl(ctx, table, select, organisationId, filters) {
+  return secureQueryImpl(ctx, { table, select, organisationId, filters });
+}
+var createSecureDataAccess = (supabase, organisationId, isSuperAdmin = false) => {
+  const validateOrganisationContext = (orgId) => validateOrganisationContextImpl(orgId, isSuperAdmin);
+  const ensureOrganisationColumn = ensureOrganisationColumnImpl;
+  const buildSecureQuery = (options) => buildSecureQueryImpl(
+    options,
+    supabase,
+    isSuperAdmin,
+    organisationId,
+    ensureOrganisationColumnImpl,
+    validateOrganisationContext
+  );
+  const ctx = {
+    supabase,
+    organisationId,
+    isSuperAdmin,
+    validateOrganisationContext,
+    ensureOrganisationColumn,
+    buildSecureQuery
   };
   return {
-    secureQuery,
-    secureSingleQuery,
-    secureInsert,
-    secureUpdate,
-    secureDelete,
-    queryByOrganisation,
+    secureQuery: (opts) => secureQueryImpl(ctx, opts),
+    secureSingleQuery: (opts) => secureSingleQueryImpl(ctx, opts),
+    secureInsert: (table, data, orgId) => secureInsertImpl(ctx, table, data, orgId),
+    secureUpdate: (table, data, filters, orgId) => secureUpdateImpl(ctx, table, data, filters, orgId),
+    secureDelete: (table, filters, orgId) => secureDeleteImpl(ctx, table, filters, orgId),
+    queryByOrganisation: (table, select, orgId, filters) => queryByOrganisationImpl(ctx, table, select, orgId, filters),
     validateOrganisationContext,
     ensureOrganisationColumn
   };
@@ -593,4 +569,4 @@ StorageUtils.downloadFile = downloadFile;
 StorageUtils.listFiles = listFiles;
 StorageUtils.archiveFile = archiveFile;
 
-export { InactivityWarningModal, OrganisationProvider, StorageUtils, createSecureDataAccess, useInactivityTracker };
+export { InactivityWarningModal, StorageUtils, createSecureDataAccess, useInactivityTracker };