@realtek/core-theme-live 0.0.350 → 0.0.352

package/dist-lib/{addFormApi-CBQMzD3U.cjs → addFormApi-A-Gcp8mL.cjs}

@@ -1,2 +1,2 @@
-const e=require("./rolldown-runtime-Chgba0Kb.cjs"),t=require("./authApi-Cc4tyoJN.cjs"),n=require("./formGroupsCache-Bbz-28ws.cjs");var r=e.t({createModuleRecord:()=>c,fetchFormGroupsPayload:()=>o,getFormGroups:()=>s});function i(e){let t=e?.data??e;return Array.isArray(t)?t:Array.isArray(t?.groups)?t.groups:Array.isArray(e?.groups)?e.groups:[]}function a({module:e,id:n,action:r,clientId:i,region:a,group:o,view:s}={}){let c=new URLSearchParams({module:e});return n&&c.set(`id`,n),r&&c.set(`action`,r),i&&c.set(`clientId`,i),a&&c.set(`region`,a),o&&c.set(`group`,o),s&&c.set(`view`,s),`${t.x}/admin/form-groups?${c.toString()}`}async function o(e={}){if(!e.module)throw Error(`module is required to fetch form groups`);let r=a(e);return n.t(r,async()=>{let e=await t.a(),n=await fetch(r,{method:`GET`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${e}`}});if(!n.ok)throw Error(`API ${n.status}: ${n.statusText}`);return n.json()})}async function s(e={}){return i(await o(e))}async function c(e,r){let i=await t.a(),a=await fetch(`${t.x}/module/create?module=${encodeURIComponent(e)}`,{method:`POST`,headers:{Authorization:`Bearer ${i}`},body:r}),{logout:o}=await Promise.resolve().then(()=>require("./authApi-Cc4tyoJN.cjs")).then(e=>e.n);a.status===401&&o(),n.r();let s=(a.headers.get(`content-type`)||``).includes(`application/json`)?await a.json():await a.text();if(!a.ok){let e=Error(s?.error||s?.message||`API ${a.status}: ${a.statusText}`);throw e.status=a.status,e.data=s,e}return s}Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return c}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return s}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return r}});
-//# sourceMappingURL=addFormApi-CBQMzD3U.cjs.map
+const e=require("./rolldown-runtime-Chgba0Kb.cjs"),t=require("./authApi-alaedMzE.cjs"),n=require("./formGroupsCache-Bbz-28ws.cjs");var r=e.t({createModuleRecord:()=>c,fetchFormGroupsPayload:()=>o,getFormGroups:()=>s});function i(e){let t=e?.data??e;return Array.isArray(t)?t:Array.isArray(t?.groups)?t.groups:Array.isArray(e?.groups)?e.groups:[]}function a({module:e,id:n,action:r,clientId:i,region:a,group:o,view:s}={}){let c=new URLSearchParams({module:e});return n&&c.set(`id`,n),r&&c.set(`action`,r),i&&c.set(`clientId`,i),a&&c.set(`region`,a),o&&c.set(`group`,o),s&&c.set(`view`,s),`${t.x}/admin/form-groups?${c.toString()}`}async function o(e={}){if(!e.module)throw Error(`module is required to fetch form groups`);let r=a(e);return n.t(r,async()=>{let e=await t.a(),n=await fetch(r,{method:`GET`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${e}`}});if(!n.ok)throw Error(`API ${n.status}: ${n.statusText}`);return n.json()})}async function s(e={}){return i(await o(e))}async function c(e,r){let i=await t.a(),a=await fetch(`${t.x}/module/create?module=${encodeURIComponent(e)}`,{method:`POST`,headers:{Authorization:`Bearer ${i}`},body:r}),{logout:o}=await Promise.resolve().then(()=>require("./authApi-alaedMzE.cjs")).then(e=>e.n);a.status===401&&o(),n.r();let s=(a.headers.get(`content-type`)||``).includes(`application/json`)?await a.json():await a.text();if(!a.ok){let e=Error(s?.error||s?.message||`API ${a.status}: ${a.statusText}`);throw e.status=a.status,e.data=s,e}return s}Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return c}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return s}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return r}});
+//# sourceMappingURL=addFormApi-A-Gcp8mL.cjs.map

package/dist-lib/{addFormApi-CBQMzD3U.cjs.map → addFormApi-A-Gcp8mL.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"addFormApi-CBQMzD3U.cjs","names":[],"sources":["../src/services/addFormApi.js"],"sourcesContent":["import { ensureToken, fetchJsonWithAuth } from './authApi';\nimport { AUTH_URL, JOBS_URL } from './apiConfig';\nimport { fetchFormGroupsCached, invalidateFormGroupsCache } from './formGroupsCache';\n\n// ── Form Groups ───────────────────────────────────────────────────────────────\n\nfunction extractFormGroups(json) {\n  const payload = json?.data ?? json;\n  if (Array.isArray(payload)) return payload;\n  if (Array.isArray(payload?.groups)) return payload.groups;\n  if (Array.isArray(json?.groups)) return json.groups;\n  return [];\n}\n\n/**\n * formGroupsUrl — the canonical URL for one form-groups query. Built in a fixed\n * parameter order so two callers asking the same question produce the same\n * string, which is what makes them shareable (see formGroupsCache).\n */\nfunction formGroupsUrl({ module, id, action, clientId, region, group, view } = {}) {\n  const params = new URLSearchParams({ module });\n  if (id) params.set('id', id);\n  if (action) params.set('action', action);\n  if (clientId) params.set('clientId', clientId);\n  if (region) params.set('region', region);\n  if (group) params.set('group', group);\n  if (view) params.set('view', view);\n  return `${AUTH_URL}/admin/form-groups?${params.toString()}`;\n}\n\n/**\n * fetchFormGroupsPayload — the RAW payload for one query, shared between every\n * caller that asks for it (see formGroupsCache for why). Returns the whole\n * envelope, so a caller that needs `recordMeta` and one that needs only the\n * groups array still cost ONE request between them.\n */\nexport async function fetchFormGroupsPayload(options = {}) {\n  if (!options.module) throw new Error('module is required to fetch form groups');\n  const url = formGroupsUrl(options);\n  return fetchFormGroupsCached(url, async () => {\n    const token = await ensureToken();\n    const res = await fetch(url, {\n      method: 'GET',\n      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },\n    });\n    if (!res.ok) throw new Error(`API ${res.status}: ${res.statusText}`);\n    return res.json();\n  });\n}\n\nexport async function getFormGroups(options = {}) {\n  return extractFormGroups(await fetchFormGroupsPayload(options));\n}\n\nexport async function getCandidateFormGroups(options = {}) {\n  return getFormGroups({ module: 'candidates', ...options });\n}\n\nexport async function getMentionUsers(search = '') {\n  const { apiGetWithAuth } = await import('./authApi');\n  const params = search ? `?search=${encodeURIComponent(search)}` : '';\n  return apiGetWithAuth(JOBS_URL, `/users/any${params}`);\n}\n\n// ── Create Records ────────────────────────────────────────────────────────────\n// Routes through the Auth gateway which injects tenant context from JWT\n// and proxies to the correct downstream service based on module name.\n\nexport async function createModuleRecord(moduleName, formData) {\n  // ensureToken (not getStoredToken) so a missing/expired session throws a\n  // clear \"Authentication required\" error instead of silently sending the\n  // request with no Authorization header (which the gateway rejects as 401).\n  // NOTE: do NOT set Content-Type here — the browser must add the multipart\n  // boundary itself. Only the Authorization header is set manually.\n  const token = await ensureToken();\n\n  const res = await fetch(\n    `${AUTH_URL}/module/create?module=${encodeURIComponent(moduleName)}`,\n    { method: 'POST', headers: { Authorization: `Bearer ${token}` }, body: formData },\n  );\n\n  const { logout } = await import('./authApi');\n  if (res.status === 401) logout();\n\n  // A save is exactly the moment a cached form-groups payload stops describing\n  // the record — invalidate before the caller can navigate and read one back.\n  invalidateFormGroupsCache();\n\n  const contentType = res.headers.get('content-type') || '';\n  const data = contentType.includes('application/json') ? await res.json() : await res.text();\n\n  if (!res.ok) {\n    const error = new Error(data?.error || data?.message || `API ${res.status}: ${res.statusText}`);\n    error.status = res.status;\n    error.data = data;\n    throw error;\n  }\n\n  return data;\n}\n"],"mappings":"0NAMA,SAAS,EAAkB,EAAM,CAC/B,IAAM,EAAU,GAAM,MAAQ,EAI9B,OAHI,MAAM,QAAQ,CAAO,EAAU,EAC/B,MAAM,QAAQ,GAAS,MAAM,EAAU,EAAQ,OAC/C,MAAM,QAAQ,GAAM,MAAM,EAAU,EAAK,OACtC,CAAC,CACV,CAOA,SAAS,EAAc,CAAE,SAAQ,KAAI,SAAQ,WAAU,SAAQ,QAAO,QAAS,CAAC,EAAG,CACjF,IAAM,EAAS,IAAI,gBAAgB,CAAE,QAAO,CAAC,EAO7C,OANI,GAAI,EAAO,IAAI,KAAM,CAAE,EACvB,GAAQ,EAAO,IAAI,SAAU,CAAM,EACnC,GAAU,EAAO,IAAI,WAAY,CAAQ,EACzC,GAAQ,EAAO,IAAI,SAAU,CAAM,EACnC,GAAO,EAAO,IAAI,QAAS,CAAK,EAChC,GAAM,EAAO,IAAI,OAAQ,CAAI,EAC1B,GAAG,EAAA,EAAS,qBAAqB,EAAO,SAAS,GAC1D,CAQA,eAAsB,EAAuB,EAAU,CAAC,EAAG,CACzD,GAAI,CAAC,EAAQ,OAAQ,MAAU,MAAM,yCAAyC,EAC9E,IAAM,EAAM,EAAc,CAAO,EACjC,OAAO,EAAA,EAAsB,EAAK,SAAY,CAC5C,IAAM,EAAQ,MAAM,EAAA,EAAY,EAC1B,EAAM,MAAM,MAAM,EAAK,CAC3B,OAAQ,MACR,QAAS,CAAE,eAAgB,mBAAoB,cAAe,UAAU,GAAQ,CAClF,CAAC,EACD,GAAI,CAAC,EAAI,GAAI,MAAU,MAAM,OAAO,EAAI,OAAO,IAAI,EAAI,YAAY,EACnE,OAAO,EAAI,KAAK,CAClB,CAAC,CACH,CAEA,eAAsB,EAAc,EAAU,CAAC,EAAG,CAChD,OAAO,EAAkB,MAAM,EAAuB,CAAO,CAAC,CAChE,CAgBA,eAAsB,EAAmB,EAAY,EAAU,CAM7D,IAAM,EAAQ,MAAM,EAAA,EAAY,EAE1B,EAAM,MAAM,MAChB,GAAG,EAAA,EAAS,wBAAwB,mBAAmB,CAAU,IACjE,CAAE,OAAQ,OAAQ,QAAS,CAAE,cAAe,UAAU,GAAQ,EAAG,KAAM,CAAS,CAClF,EAEM,CAAE,UAAW,MAAA,QAAA,QAAA,CAAA,CAAA,SAAA,QAAM,wBAAA,CAAA,CAAA,CAAA,KAAA,GAAA,EAAA,CAAA,EACrB,EAAI,SAAW,KAAK,EAAO,EAI/B,EAAA,EAA0B,EAG1B,IAAM,GADc,EAAI,QAAQ,IAAI,cAAc,GAAK,GAAA,CAC9B,SAAS,kBAAkB,EAAI,MAAM,EAAI,KAAK,EAAI,MAAM,EAAI,KAAK,EAE1F,GAAI,CAAC,EAAI,GAAI,CACX,IAAM,EAAY,MAAM,GAAM,OAAS,GAAM,SAAW,OAAO,EAAI,OAAO,IAAI,EAAI,YAAY,EAG9F,KAFA,GAAM,OAAS,EAAI,OACnB,EAAM,KAAO,EACP,CACR,CAEA,OAAO,CACT"}
+{"version":3,"file":"addFormApi-A-Gcp8mL.cjs","names":[],"sources":["../src/services/addFormApi.js"],"sourcesContent":["import { ensureToken, fetchJsonWithAuth } from './authApi';\nimport { AUTH_URL, JOBS_URL } from './apiConfig';\nimport { fetchFormGroupsCached, invalidateFormGroupsCache } from './formGroupsCache';\n\n// ── Form Groups ───────────────────────────────────────────────────────────────\n\nfunction extractFormGroups(json) {\n  const payload = json?.data ?? json;\n  if (Array.isArray(payload)) return payload;\n  if (Array.isArray(payload?.groups)) return payload.groups;\n  if (Array.isArray(json?.groups)) return json.groups;\n  return [];\n}\n\n/**\n * formGroupsUrl — the canonical URL for one form-groups query. Built in a fixed\n * parameter order so two callers asking the same question produce the same\n * string, which is what makes them shareable (see formGroupsCache).\n */\nfunction formGroupsUrl({ module, id, action, clientId, region, group, view } = {}) {\n  const params = new URLSearchParams({ module });\n  if (id) params.set('id', id);\n  if (action) params.set('action', action);\n  if (clientId) params.set('clientId', clientId);\n  if (region) params.set('region', region);\n  if (group) params.set('group', group);\n  if (view) params.set('view', view);\n  return `${AUTH_URL}/admin/form-groups?${params.toString()}`;\n}\n\n/**\n * fetchFormGroupsPayload — the RAW payload for one query, shared between every\n * caller that asks for it (see formGroupsCache for why). Returns the whole\n * envelope, so a caller that needs `recordMeta` and one that needs only the\n * groups array still cost ONE request between them.\n */\nexport async function fetchFormGroupsPayload(options = {}) {\n  if (!options.module) throw new Error('module is required to fetch form groups');\n  const url = formGroupsUrl(options);\n  return fetchFormGroupsCached(url, async () => {\n    const token = await ensureToken();\n    const res = await fetch(url, {\n      method: 'GET',\n      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },\n    });\n    if (!res.ok) throw new Error(`API ${res.status}: ${res.statusText}`);\n    return res.json();\n  });\n}\n\nexport async function getFormGroups(options = {}) {\n  return extractFormGroups(await fetchFormGroupsPayload(options));\n}\n\nexport async function getCandidateFormGroups(options = {}) {\n  return getFormGroups({ module: 'candidates', ...options });\n}\n\nexport async function getMentionUsers(search = '') {\n  const { apiGetWithAuth } = await import('./authApi');\n  const params = search ? `?search=${encodeURIComponent(search)}` : '';\n  return apiGetWithAuth(JOBS_URL, `/users/any${params}`);\n}\n\n// ── Create Records ────────────────────────────────────────────────────────────\n// Routes through the Auth gateway which injects tenant context from JWT\n// and proxies to the correct downstream service based on module name.\n\nexport async function createModuleRecord(moduleName, formData) {\n  // ensureToken (not getStoredToken) so a missing/expired session throws a\n  // clear \"Authentication required\" error instead of silently sending the\n  // request with no Authorization header (which the gateway rejects as 401).\n  // NOTE: do NOT set Content-Type here — the browser must add the multipart\n  // boundary itself. Only the Authorization header is set manually.\n  const token = await ensureToken();\n\n  const res = await fetch(\n    `${AUTH_URL}/module/create?module=${encodeURIComponent(moduleName)}`,\n    { method: 'POST', headers: { Authorization: `Bearer ${token}` }, body: formData },\n  );\n\n  const { logout } = await import('./authApi');\n  if (res.status === 401) logout();\n\n  // A save is exactly the moment a cached form-groups payload stops describing\n  // the record — invalidate before the caller can navigate and read one back.\n  invalidateFormGroupsCache();\n\n  const contentType = res.headers.get('content-type') || '';\n  const data = contentType.includes('application/json') ? await res.json() : await res.text();\n\n  if (!res.ok) {\n    const error = new Error(data?.error || data?.message || `API ${res.status}: ${res.statusText}`);\n    error.status = res.status;\n    error.data = data;\n    throw error;\n  }\n\n  return data;\n}\n"],"mappings":"0NAMA,SAAS,EAAkB,EAAM,CAC/B,IAAM,EAAU,GAAM,MAAQ,EAI9B,OAHI,MAAM,QAAQ,CAAO,EAAU,EAC/B,MAAM,QAAQ,GAAS,MAAM,EAAU,EAAQ,OAC/C,MAAM,QAAQ,GAAM,MAAM,EAAU,EAAK,OACtC,CAAC,CACV,CAOA,SAAS,EAAc,CAAE,SAAQ,KAAI,SAAQ,WAAU,SAAQ,QAAO,QAAS,CAAC,EAAG,CACjF,IAAM,EAAS,IAAI,gBAAgB,CAAE,QAAO,CAAC,EAO7C,OANI,GAAI,EAAO,IAAI,KAAM,CAAE,EACvB,GAAQ,EAAO,IAAI,SAAU,CAAM,EACnC,GAAU,EAAO,IAAI,WAAY,CAAQ,EACzC,GAAQ,EAAO,IAAI,SAAU,CAAM,EACnC,GAAO,EAAO,IAAI,QAAS,CAAK,EAChC,GAAM,EAAO,IAAI,OAAQ,CAAI,EAC1B,GAAG,EAAA,EAAS,qBAAqB,EAAO,SAAS,GAC1D,CAQA,eAAsB,EAAuB,EAAU,CAAC,EAAG,CACzD,GAAI,CAAC,EAAQ,OAAQ,MAAU,MAAM,yCAAyC,EAC9E,IAAM,EAAM,EAAc,CAAO,EACjC,OAAO,EAAA,EAAsB,EAAK,SAAY,CAC5C,IAAM,EAAQ,MAAM,EAAA,EAAY,EAC1B,EAAM,MAAM,MAAM,EAAK,CAC3B,OAAQ,MACR,QAAS,CAAE,eAAgB,mBAAoB,cAAe,UAAU,GAAQ,CAClF,CAAC,EACD,GAAI,CAAC,EAAI,GAAI,MAAU,MAAM,OAAO,EAAI,OAAO,IAAI,EAAI,YAAY,EACnE,OAAO,EAAI,KAAK,CAClB,CAAC,CACH,CAEA,eAAsB,EAAc,EAAU,CAAC,EAAG,CAChD,OAAO,EAAkB,MAAM,EAAuB,CAAO,CAAC,CAChE,CAgBA,eAAsB,EAAmB,EAAY,EAAU,CAM7D,IAAM,EAAQ,MAAM,EAAA,EAAY,EAE1B,EAAM,MAAM,MAChB,GAAG,EAAA,EAAS,wBAAwB,mBAAmB,CAAU,IACjE,CAAE,OAAQ,OAAQ,QAAS,CAAE,cAAe,UAAU,GAAQ,EAAG,KAAM,CAAS,CAClF,EAEM,CAAE,UAAW,MAAA,QAAA,QAAA,CAAA,CAAA,SAAA,QAAM,wBAAA,CAAA,CAAA,CAAA,KAAA,GAAA,EAAA,CAAA,EACrB,EAAI,SAAW,KAAK,EAAO,EAI/B,EAAA,EAA0B,EAG1B,IAAM,GADc,EAAI,QAAQ,IAAI,cAAc,GAAK,GAAA,CAC9B,SAAS,kBAAkB,EAAI,MAAM,EAAI,KAAK,EAAI,MAAM,EAAI,KAAK,EAE1F,GAAI,CAAC,EAAI,GAAI,CACX,IAAM,EAAY,MAAM,GAAM,OAAS,GAAM,SAAW,OAAO,EAAI,OAAO,IAAI,EAAI,YAAY,EAG9F,KAFA,GAAM,OAAS,EAAI,OACnB,EAAM,KAAO,EACP,CACR,CAEA,OAAO,CACT"}

package/dist-lib/{addFormApi-Zit8-4MN.js → addFormApi-BcDCGOPc.js}

@@ -1,5 +1,5 @@
 import { t as e } from "./rolldown-runtime-Dy4uBu1J.js";
-import { a as t, x as n } from "./authApi-CpZdvX9i.js";
+import { a as t, x as n } from "./authApi-D4JWuiiT.js";
 import { r, t as i } from "./formGroupsCache-JeC59oNe.js";
 //#region src/services/addFormApi.js
 var a = /* @__PURE__ */ e({
@@ -38,7 +38,7 @@ async function u(e, i) {
 		method: "POST",
 		headers: { Authorization: `Bearer ${a}` },
 		body: i
-	}), { logout: s } = await import("./authApi-CpZdvX9i.js").then((e) => e.n);
+	}), { logout: s } = await import("./authApi-D4JWuiiT.js").then((e) => e.n);
 	o.status === 401 && s(), r();
 	let c = (o.headers.get("content-type") || "").includes("application/json") ? await o.json() : await o.text();
 	if (!o.ok) {
@@ -50,4 +50,4 @@ async function u(e, i) {
 //#endregion
 export { u as n, l as r, a as t };
 
-//# sourceMappingURL=addFormApi-Zit8-4MN.js.map
+//# sourceMappingURL=addFormApi-BcDCGOPc.js.map

package/dist-lib/{addFormApi-Zit8-4MN.js.map → addFormApi-BcDCGOPc.js.map}

@@ -1 +1 @@
-{"version":3,"file":"addFormApi-Zit8-4MN.js","names":[],"sources":["../src/services/addFormApi.js"],"sourcesContent":["import { ensureToken, fetchJsonWithAuth } from './authApi';\nimport { AUTH_URL, JOBS_URL } from './apiConfig';\nimport { fetchFormGroupsCached, invalidateFormGroupsCache } from './formGroupsCache';\n\n// ── Form Groups ───────────────────────────────────────────────────────────────\n\nfunction extractFormGroups(json) {\n  const payload = json?.data ?? json;\n  if (Array.isArray(payload)) return payload;\n  if (Array.isArray(payload?.groups)) return payload.groups;\n  if (Array.isArray(json?.groups)) return json.groups;\n  return [];\n}\n\n/**\n * formGroupsUrl — the canonical URL for one form-groups query. Built in a fixed\n * parameter order so two callers asking the same question produce the same\n * string, which is what makes them shareable (see formGroupsCache).\n */\nfunction formGroupsUrl({ module, id, action, clientId, region, group, view } = {}) {\n  const params = new URLSearchParams({ module });\n  if (id) params.set('id', id);\n  if (action) params.set('action', action);\n  if (clientId) params.set('clientId', clientId);\n  if (region) params.set('region', region);\n  if (group) params.set('group', group);\n  if (view) params.set('view', view);\n  return `${AUTH_URL}/admin/form-groups?${params.toString()}`;\n}\n\n/**\n * fetchFormGroupsPayload — the RAW payload for one query, shared between every\n * caller that asks for it (see formGroupsCache for why). Returns the whole\n * envelope, so a caller that needs `recordMeta` and one that needs only the\n * groups array still cost ONE request between them.\n */\nexport async function fetchFormGroupsPayload(options = {}) {\n  if (!options.module) throw new Error('module is required to fetch form groups');\n  const url = formGroupsUrl(options);\n  return fetchFormGroupsCached(url, async () => {\n    const token = await ensureToken();\n    const res = await fetch(url, {\n      method: 'GET',\n      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },\n    });\n    if (!res.ok) throw new Error(`API ${res.status}: ${res.statusText}`);\n    return res.json();\n  });\n}\n\nexport async function getFormGroups(options = {}) {\n  return extractFormGroups(await fetchFormGroupsPayload(options));\n}\n\nexport async function getCandidateFormGroups(options = {}) {\n  return getFormGroups({ module: 'candidates', ...options });\n}\n\nexport async function getMentionUsers(search = '') {\n  const { apiGetWithAuth } = await import('./authApi');\n  const params = search ? `?search=${encodeURIComponent(search)}` : '';\n  return apiGetWithAuth(JOBS_URL, `/users/any${params}`);\n}\n\n// ── Create Records ────────────────────────────────────────────────────────────\n// Routes through the Auth gateway which injects tenant context from JWT\n// and proxies to the correct downstream service based on module name.\n\nexport async function createModuleRecord(moduleName, formData) {\n  // ensureToken (not getStoredToken) so a missing/expired session throws a\n  // clear \"Authentication required\" error instead of silently sending the\n  // request with no Authorization header (which the gateway rejects as 401).\n  // NOTE: do NOT set Content-Type here — the browser must add the multipart\n  // boundary itself. Only the Authorization header is set manually.\n  const token = await ensureToken();\n\n  const res = await fetch(\n    `${AUTH_URL}/module/create?module=${encodeURIComponent(moduleName)}`,\n    { method: 'POST', headers: { Authorization: `Bearer ${token}` }, body: formData },\n  );\n\n  const { logout } = await import('./authApi');\n  if (res.status === 401) logout();\n\n  // A save is exactly the moment a cached form-groups payload stops describing\n  // the record — invalidate before the caller can navigate and read one back.\n  invalidateFormGroupsCache();\n\n  const contentType = res.headers.get('content-type') || '';\n  const data = contentType.includes('application/json') ? await res.json() : await res.text();\n\n  if (!res.ok) {\n    const error = new Error(data?.error || data?.message || `API ${res.status}: ${res.statusText}`);\n    error.status = res.status;\n    error.data = data;\n    throw error;\n  }\n\n  return data;\n}\n"],"mappings":";;;;;;;;;AAMA,SAAS,EAAkB,GAAM;CAC/B,IAAM,IAAU,GAAM,QAAQ;CAI9B,OAHI,MAAM,QAAQ,CAAO,IAAU,IAC/B,MAAM,QAAQ,GAAS,MAAM,IAAU,EAAQ,SAC/C,MAAM,QAAQ,GAAM,MAAM,IAAU,EAAK,SACtC,CAAC;AACV;AAOA,SAAS,EAAc,EAAE,WAAQ,OAAI,WAAQ,aAAU,WAAQ,UAAO,YAAS,CAAC,GAAG;CACjF,IAAM,IAAS,IAAI,gBAAgB,EAAE,UAAO,CAAC;CAO7C,OANI,KAAI,EAAO,IAAI,MAAM,CAAE,GACvB,KAAQ,EAAO,IAAI,UAAU,CAAM,GACnC,KAAU,EAAO,IAAI,YAAY,CAAQ,GACzC,KAAQ,EAAO,IAAI,UAAU,CAAM,GACnC,KAAO,EAAO,IAAI,SAAS,CAAK,GAChC,KAAM,EAAO,IAAI,QAAQ,CAAI,GAC1B,GAAG,EAAS,qBAAqB,EAAO,SAAS;AAC1D;AAQA,eAAsB,EAAuB,IAAU,CAAC,GAAG;CACzD,IAAI,CAAC,EAAQ,QAAQ,MAAU,MAAM,yCAAyC;CAC9E,IAAM,IAAM,EAAc,CAAO;CACjC,OAAO,EAAsB,GAAK,YAAY;EAC5C,IAAM,IAAQ,MAAM,EAAY,GAC1B,IAAM,MAAM,MAAM,GAAK;GAC3B,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAoB,eAAe,UAAU;GAAQ;EAClF,CAAC;EACD,IAAI,CAAC,EAAI,IAAI,MAAU,MAAM,OAAO,EAAI,OAAO,IAAI,EAAI,YAAY;EACnE,OAAO,EAAI,KAAK;CAClB,CAAC;AACH;AAEA,eAAsB,EAAc,IAAU,CAAC,GAAG;CAChD,OAAO,EAAkB,MAAM,EAAuB,CAAO,CAAC;AAChE;AAgBA,eAAsB,EAAmB,GAAY,GAAU;CAM7D,IAAM,IAAQ,MAAM,EAAY,GAE1B,IAAM,MAAM,MAChB,GAAG,EAAS,wBAAwB,mBAAmB,CAAU,KACjE;EAAE,QAAQ;EAAQ,SAAS,EAAE,eAAe,UAAU,IAAQ;EAAG,MAAM;CAAS,CAClF,GAEM,EAAE,cAAW,MAAM,OAAO,wBAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAKhC,AAJI,EAAI,WAAW,OAAK,EAAO,GAI/B,EAA0B;CAG1B,IAAM,KADc,EAAI,QAAQ,IAAI,cAAc,KAAK,GAAA,CAC9B,SAAS,kBAAkB,IAAI,MAAM,EAAI,KAAK,IAAI,MAAM,EAAI,KAAK;CAE1F,IAAI,CAAC,EAAI,IAAI;EACX,IAAM,IAAY,MAAM,GAAM,SAAS,GAAM,WAAW,OAAO,EAAI,OAAO,IAAI,EAAI,YAAY;EAG9F,MAFA,EAAM,SAAS,EAAI,QACnB,EAAM,OAAO,GACP;CACR;CAEA,OAAO;AACT"}
+{"version":3,"file":"addFormApi-BcDCGOPc.js","names":[],"sources":["../src/services/addFormApi.js"],"sourcesContent":["import { ensureToken, fetchJsonWithAuth } from './authApi';\nimport { AUTH_URL, JOBS_URL } from './apiConfig';\nimport { fetchFormGroupsCached, invalidateFormGroupsCache } from './formGroupsCache';\n\n// ── Form Groups ───────────────────────────────────────────────────────────────\n\nfunction extractFormGroups(json) {\n  const payload = json?.data ?? json;\n  if (Array.isArray(payload)) return payload;\n  if (Array.isArray(payload?.groups)) return payload.groups;\n  if (Array.isArray(json?.groups)) return json.groups;\n  return [];\n}\n\n/**\n * formGroupsUrl — the canonical URL for one form-groups query. Built in a fixed\n * parameter order so two callers asking the same question produce the same\n * string, which is what makes them shareable (see formGroupsCache).\n */\nfunction formGroupsUrl({ module, id, action, clientId, region, group, view } = {}) {\n  const params = new URLSearchParams({ module });\n  if (id) params.set('id', id);\n  if (action) params.set('action', action);\n  if (clientId) params.set('clientId', clientId);\n  if (region) params.set('region', region);\n  if (group) params.set('group', group);\n  if (view) params.set('view', view);\n  return `${AUTH_URL}/admin/form-groups?${params.toString()}`;\n}\n\n/**\n * fetchFormGroupsPayload — the RAW payload for one query, shared between every\n * caller that asks for it (see formGroupsCache for why). Returns the whole\n * envelope, so a caller that needs `recordMeta` and one that needs only the\n * groups array still cost ONE request between them.\n */\nexport async function fetchFormGroupsPayload(options = {}) {\n  if (!options.module) throw new Error('module is required to fetch form groups');\n  const url = formGroupsUrl(options);\n  return fetchFormGroupsCached(url, async () => {\n    const token = await ensureToken();\n    const res = await fetch(url, {\n      method: 'GET',\n      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },\n    });\n    if (!res.ok) throw new Error(`API ${res.status}: ${res.statusText}`);\n    return res.json();\n  });\n}\n\nexport async function getFormGroups(options = {}) {\n  return extractFormGroups(await fetchFormGroupsPayload(options));\n}\n\nexport async function getCandidateFormGroups(options = {}) {\n  return getFormGroups({ module: 'candidates', ...options });\n}\n\nexport async function getMentionUsers(search = '') {\n  const { apiGetWithAuth } = await import('./authApi');\n  const params = search ? `?search=${encodeURIComponent(search)}` : '';\n  return apiGetWithAuth(JOBS_URL, `/users/any${params}`);\n}\n\n// ── Create Records ────────────────────────────────────────────────────────────\n// Routes through the Auth gateway which injects tenant context from JWT\n// and proxies to the correct downstream service based on module name.\n\nexport async function createModuleRecord(moduleName, formData) {\n  // ensureToken (not getStoredToken) so a missing/expired session throws a\n  // clear \"Authentication required\" error instead of silently sending the\n  // request with no Authorization header (which the gateway rejects as 401).\n  // NOTE: do NOT set Content-Type here — the browser must add the multipart\n  // boundary itself. Only the Authorization header is set manually.\n  const token = await ensureToken();\n\n  const res = await fetch(\n    `${AUTH_URL}/module/create?module=${encodeURIComponent(moduleName)}`,\n    { method: 'POST', headers: { Authorization: `Bearer ${token}` }, body: formData },\n  );\n\n  const { logout } = await import('./authApi');\n  if (res.status === 401) logout();\n\n  // A save is exactly the moment a cached form-groups payload stops describing\n  // the record — invalidate before the caller can navigate and read one back.\n  invalidateFormGroupsCache();\n\n  const contentType = res.headers.get('content-type') || '';\n  const data = contentType.includes('application/json') ? await res.json() : await res.text();\n\n  if (!res.ok) {\n    const error = new Error(data?.error || data?.message || `API ${res.status}: ${res.statusText}`);\n    error.status = res.status;\n    error.data = data;\n    throw error;\n  }\n\n  return data;\n}\n"],"mappings":";;;;;;;;;AAMA,SAAS,EAAkB,GAAM;CAC/B,IAAM,IAAU,GAAM,QAAQ;CAI9B,OAHI,MAAM,QAAQ,CAAO,IAAU,IAC/B,MAAM,QAAQ,GAAS,MAAM,IAAU,EAAQ,SAC/C,MAAM,QAAQ,GAAM,MAAM,IAAU,EAAK,SACtC,CAAC;AACV;AAOA,SAAS,EAAc,EAAE,WAAQ,OAAI,WAAQ,aAAU,WAAQ,UAAO,YAAS,CAAC,GAAG;CACjF,IAAM,IAAS,IAAI,gBAAgB,EAAE,UAAO,CAAC;CAO7C,OANI,KAAI,EAAO,IAAI,MAAM,CAAE,GACvB,KAAQ,EAAO,IAAI,UAAU,CAAM,GACnC,KAAU,EAAO,IAAI,YAAY,CAAQ,GACzC,KAAQ,EAAO,IAAI,UAAU,CAAM,GACnC,KAAO,EAAO,IAAI,SAAS,CAAK,GAChC,KAAM,EAAO,IAAI,QAAQ,CAAI,GAC1B,GAAG,EAAS,qBAAqB,EAAO,SAAS;AAC1D;AAQA,eAAsB,EAAuB,IAAU,CAAC,GAAG;CACzD,IAAI,CAAC,EAAQ,QAAQ,MAAU,MAAM,yCAAyC;CAC9E,IAAM,IAAM,EAAc,CAAO;CACjC,OAAO,EAAsB,GAAK,YAAY;EAC5C,IAAM,IAAQ,MAAM,EAAY,GAC1B,IAAM,MAAM,MAAM,GAAK;GAC3B,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAoB,eAAe,UAAU;GAAQ;EAClF,CAAC;EACD,IAAI,CAAC,EAAI,IAAI,MAAU,MAAM,OAAO,EAAI,OAAO,IAAI,EAAI,YAAY;EACnE,OAAO,EAAI,KAAK;CAClB,CAAC;AACH;AAEA,eAAsB,EAAc,IAAU,CAAC,GAAG;CAChD,OAAO,EAAkB,MAAM,EAAuB,CAAO,CAAC;AAChE;AAgBA,eAAsB,EAAmB,GAAY,GAAU;CAM7D,IAAM,IAAQ,MAAM,EAAY,GAE1B,IAAM,MAAM,MAChB,GAAG,EAAS,wBAAwB,mBAAmB,CAAU,KACjE;EAAE,QAAQ;EAAQ,SAAS,EAAE,eAAe,UAAU,IAAQ;EAAG,MAAM;CAAS,CAClF,GAEM,EAAE,cAAW,MAAM,OAAO,wBAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAKhC,AAJI,EAAI,WAAW,OAAK,EAAO,GAI/B,EAA0B;CAG1B,IAAM,KADc,EAAI,QAAQ,IAAI,cAAc,KAAK,GAAA,CAC9B,SAAS,kBAAkB,IAAI,MAAM,EAAI,KAAK,IAAI,MAAM,EAAI,KAAK;CAE1F,IAAI,CAAC,EAAI,IAAI;EACX,IAAM,IAAY,MAAM,GAAM,SAAS,GAAM,WAAW,OAAO,EAAI,OAAO,IAAI,EAAI,YAAY;EAG9F,MAFA,EAAM,SAAS,EAAI,QACnB,EAAM,OAAO,GACP;CACR;CAEA,OAAO;AACT"}

package/dist-lib/{authApi-CpZdvX9i.js → authApi-D4JWuiiT.js}

@@ -32,7 +32,7 @@ function i(e, ...t) {
 var a = () => {
 	let e = n("VITE_GATEWAY_URL");
 	return e ? String(e).replace(/\/+$/, "") : "";
-}, o = i("VITE_CORE_URL", () => a() ? a() + "/becoretheme" : ""), s = i("VITE_ZINNEXT_URL", () => a() ? a() + "/bezinnext" : ""), c = i("VITE_PYOPS_URL", () => a() ? a() + "/pyops/v1" : ""), ee = r("VITE_GATEWAY_URL"), l = i("VITE_AUTH_URL", () => String(o) ? String(o) + "/v1" : ""), u = i("VITE_JOBS_URL", () => String(o) ? String(o) + "/jobs/v1" : ""), d = i("VITE_SUBMISSIONS_URL", () => String(o) ? String(o) + "/submissions/v1" : ""), f = i("VITE_CANDIDATES_URL", () => String(o) ? String(o) + "/candidates/v1" : ""), p = i("VITE_ADMIN_API_URL", () => n("VITE_AUTH_URL") || (String(o) ? String(o) + "/v1" : "")), m = r("VITE_ADMIN_APP_ID", () => n("VITE_APP_ID") || "zinnext-dev-api-v1"), te = r("VITE_APP_ID");
+}, o = i("VITE_CORE_URL", () => a() ? a() + "/becoretheme" : ""), s = i("VITE_ZINNEXT_URL", () => a() ? a() + "/bezinnext" : ""), c = i("VITE_PYOPS_URL", () => a() ? a() + "/pyops/v1" : ""), ee = r("VITE_GATEWAY_URL"), l = i("VITE_AUTH_URL", () => String(o) ? String(o) + "/v1" : ""), u = i("VITE_JOBS_URL", () => String(o) ? String(o) + "/jobs/v1" : ""), d = i("VITE_SUBMISSIONS_URL", () => String(o) ? String(o) + "/submissions/v1" : ""), f = i("VITE_CANDIDATES_URL", () => String(o) ? String(o) + "/candidates/v1" : ""), p = i("VITE_ADMIN_API_URL", () => n("VITE_AUTH_URL") || (String(o) ? String(o) + "/v1" : "")), te = r("VITE_ADMIN_APP_ID", () => n("VITE_APP_ID") || "zinnext-dev-api-v1"), m = r("VITE_APP_ID");
 function h(e = {}) {
 	let t = n("VITE_APP_ID");
 	return t ? {
@@ -86,23 +86,23 @@ function re(e = {}) {
 var ie = /* @__PURE__ */ e({
 	apiGetWithAuth: () => $,
 	clearAuthTokenOverride: () => E,
-	clearSelectedProject: () => H,
+	clearSelectedProject: () => B,
 	ensureToken: () => G,
 	fetchJsonWithAuth: () => Z,
-	getActingIdentity: () => z,
-	getCurrentRoleName: () => I,
-	getSelectedProject: () => V,
-	getStoredToken: () => N,
-	getStoredUser: () => P,
-	getUserRoles: () => L,
+	getActingIdentity: () => L,
+	getCurrentRoleName: () => P,
+	getSelectedProject: () => z,
+	getStoredToken: () => j,
+	getStoredUser: () => M,
+	getUserRoles: () => F,
 	invalidateGetCache: () => J,
-	isTester: () => R,
-	login: () => U,
-	logout: () => F,
+	isTester: () => I,
+	login: () => V,
+	logout: () => N,
 	refreshAccessToken: () => W,
 	setAuthTokenOverride: () => T,
-	setSelectedProject: () => B
-}), _ = "authToken", v = "authUser", y = "authLoginSession", b = "ct_project_id", x = "ct_project_name", ae = [
+	setSelectedProject: () => R
+}), _ = "authToken", v = "authUser", ae = "authLoginSession", y = "ct_project_id", b = "ct_project_name", x = [
 	"access_token",
 	"refresh_token",
 	"id_token",
@@ -135,10 +135,10 @@ function E() {
 function D(e) {
 	return e?.token ?? e?.access_token ?? e?.accessToken ?? e?.jwt ?? e?.data?.token ?? e?.data?.access_token ?? e?.data?.accessToken ?? e?.data?.jwt;
 }
-function O(e) {
+function oe(e) {
 	return e?.user ?? e?.data?.user ?? e?.data?.profile ?? null;
 }
-function k(e, t = "") {
+function O(e, t = "") {
 	let n = [
 		e?.message,
 		e?.error,
@@ -150,10 +150,10 @@ function k(e, t = "") {
 	for (let e of n) if (typeof e == "string" && e.trim()) return e.trim();
 	return t;
 }
-function A(e) {
+function se(e) {
 	return e?.status === !1 || e?.success === !1 || e?.data?.status === !1 || e?.data?.success === !1;
 }
-function j(e) {
+function k(e) {
 	if (!e || typeof e != "string") return null;
 	try {
 		let t = e.split(".")[1];
@@ -164,25 +164,23 @@ function j(e) {
 		return null;
 	}
 }
-function M(e, t) {
+function A(e, t) {
 	t != null && localStorage.setItem(e, JSON.stringify(t));
 }
-function oe(e, t) {
+function ce(e, t) {
 	return t?.menus ?? e?.menus ?? {
 		menu: t?.menu ?? e?.menu,
 		footermenu: t?.footermenu ?? e?.footermenu
 	};
 }
-function se(e, t, n) {
-	let r = e?.data ?? e, i = j(t) ?? {}, a = oe(e, r), o = n?.userName ?? n?.name ?? r?.userName ?? r?.name ?? i.userName ?? i.name ?? i.preferred_username ?? i.email, s = n?.preferred_Username ?? n?.preferred_username ?? r?.preferred_Username ?? r?.preferred_username ?? i.preferred_Username ?? i.preferred_username ?? i.email ?? o, c = n?.email ?? r?.email ?? i.email ?? s;
-	localStorage.setItem("access_token", t), r?.refresh_token && localStorage.setItem("refresh_token", r.refresh_token), r?.id_token !== void 0 && localStorage.setItem("id_token", r.id_token), r?.token_type && localStorage.setItem("token_type", r.token_type), r?.expires_in !== void 0 && localStorage.setItem("expires_in", String(r.expires_in)), r?.refresh_expires_in !== void 0 && localStorage.setItem("refresh_expires_in", String(r.refresh_expires_in)), o && localStorage.setItem("userName", o), s && localStorage.setItem("preferred_Username", s), c && localStorage.setItem("user_Email", c), (r?.roleId ?? i.role_id) && localStorage.setItem("roleId", r?.roleId ?? i.role_id), r?.companyName && localStorage.setItem("companyName", r.companyName), i.userId !== void 0 && localStorage.setItem("userId", String(i.userId)), i.tenantId && localStorage.setItem("tenantId", i.tenantId), i.businessId && localStorage.setItem("businessId", i.businessId), i.businessUnitId && localStorage.setItem("businessUnitId", i.businessUnitId), M("menu", a.menu), M("footermenu", a.footermenu), M("menuPermission", r?.menuPermission), M("default_values", r?.default_values);
+function le(e, t, n) {
+	let r = e?.data ?? e, i = k(t) ?? {}, a = ce(e, r), o = n?.userName ?? n?.name ?? r?.userName ?? r?.name ?? i.userName ?? i.name ?? i.preferred_username ?? i.email, s = n?.preferred_Username ?? n?.preferred_username ?? r?.preferred_Username ?? r?.preferred_username ?? i.preferred_Username ?? i.preferred_username ?? i.email ?? o, c = n?.email ?? r?.email ?? i.email ?? s;
+	localStorage.setItem("access_token", t), r?.refresh_token && localStorage.setItem("refresh_token", r.refresh_token), r?.id_token !== void 0 && localStorage.setItem("id_token", r.id_token), r?.token_type && localStorage.setItem("token_type", r.token_type), r?.expires_in !== void 0 && localStorage.setItem("expires_in", String(r.expires_in)), r?.refresh_expires_in !== void 0 && localStorage.setItem("refresh_expires_in", String(r.refresh_expires_in)), o && localStorage.setItem("userName", o), s && localStorage.setItem("preferred_Username", s), c && localStorage.setItem("user_Email", c), (r?.roleId ?? i.role_id) && localStorage.setItem("roleId", r?.roleId ?? i.role_id), r?.companyName && localStorage.setItem("companyName", r.companyName), i.userId !== void 0 && localStorage.setItem("userId", String(i.userId)), i.tenantId && localStorage.setItem("tenantId", i.tenantId), i.businessId && localStorage.setItem("businessId", i.businessId), i.businessUnitId && localStorage.setItem("businessUnitId", i.businessUnitId), A("menu", a.menu), A("footermenu", a.footermenu), A("menuPermission", r?.menuPermission), A("default_values", r?.default_values);
 }
-function N() {
-	if (w) return w;
-	let e = localStorage.getItem(_), t = sessionStorage.getItem(y) === "1";
-	return e && t ? e : null;
+function j() {
+	return w || localStorage.getItem(_);
 }
-function P() {
+function M() {
 	try {
 		let e = localStorage.getItem(v);
 		if (e) return JSON.parse(e);
@@ -194,17 +192,17 @@ function P() {
 		roleId: localStorage.getItem("roleId")
 	};
 }
-function F() {
-	J(), localStorage.removeItem(_), localStorage.removeItem(v), ae.forEach((e) => localStorage.removeItem(e)), sessionStorage.removeItem(y), window.dispatchEvent(new Event("auth:logout"));
+function N() {
+	J(), localStorage.removeItem(_), localStorage.removeItem(v), x.forEach((e) => localStorage.removeItem(e)), sessionStorage.removeItem(ae), window.dispatchEvent(new Event("auth:logout"));
 }
-function I() {
+function P() {
 	let e = String(localStorage.getItem("roleId") ?? "").trim().toLowerCase();
 	if (e) return e;
-	let t = j(N()) ?? {};
+	let t = k(j()) ?? {};
 	return String(t.role ?? t.roleName ?? t.role_name ?? t.role_id ?? t.roleId ?? "").trim().toLowerCase();
 }
-function L() {
-	let e = j(N() ?? localStorage.getItem(_)), t = /* @__PURE__ */ new Set(), n = I();
+function F() {
+	let e = k(j() ?? localStorage.getItem(_)), t = /* @__PURE__ */ new Set(), n = P();
 	return n && t.add(n), e && ((e?.realm_access?.roles ?? []).forEach((e) => t.add(e)), Object.values(e?.resource_access ?? {}).forEach((e) => {
 		(e?.roles ?? []).forEach((e) => t.add(e));
 	}), [
@@ -215,11 +213,11 @@ function L() {
 		e && t.add(e);
 	})), Array.from(t).map((e) => String(e).toLowerCase());
 }
-function R() {
-	return I() === "tester" || L().includes("tester");
+function I() {
+	return P() === "tester" || F().includes("tester");
 }
-function z() {
-	let e = j(N() ?? localStorage.getItem(_)) ?? {}, t = (e) => {
+function L() {
+	let e = k(j() ?? localStorage.getItem(_)) ?? {}, t = (e) => {
 		if (e == null || e === "") return;
 		let t = Number(e);
 		return Number.isFinite(t) ? t : void 0;
@@ -229,37 +227,37 @@ function z() {
 		userId: t(e.userId ?? e.user_id)
 	};
 }
-function B(e) {
-	e && (localStorage.setItem(b, String(e.id)), localStorage.setItem(x, String(e.name)));
+function R(e) {
+	e && (localStorage.setItem(y, String(e.id)), localStorage.setItem(b, String(e.name)));
 }
-function V() {
-	let e = localStorage.getItem(b), t = localStorage.getItem(x);
+function z() {
+	let e = localStorage.getItem(y), t = localStorage.getItem(b);
 	return !e || !t ? null : {
 		id: Number(e),
 		name: t
 	};
 }
-function H() {
-	localStorage.removeItem(b), localStorage.removeItem(x);
+function B() {
+	localStorage.removeItem(y), localStorage.removeItem(b);
 }
-async function U(e) {
+async function V(e) {
 	return S || (S = fetch(`${l}/login`, {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify(e)
 	}).then(async (e) => {
 		let t = await e.json();
-		if (!e.ok || A(t)) {
-			let n = Error(k(t, `Login failed: ${e.status}`));
+		if (!e.ok || se(t)) {
+			let n = Error(O(t, `Login failed: ${e.status}`));
 			throw n.status = e.status, n.response = t, n;
 		}
 		let n = D(t);
 		if (!n) {
-			let n = Error(k(t, "No token in login response"));
+			let n = Error(O(t, "No token in login response"));
 			throw n.status = e.status, n.response = t, n;
 		}
-		let r = O(t);
-		return localStorage.setItem(_, n), sessionStorage.setItem(y, "1"), r && localStorage.setItem(v, JSON.stringify(r)), se(t, n, r), window.dispatchEvent(new Event("auth:login")), {
+		let r = oe(t);
+		return localStorage.setItem(_, n), r && localStorage.setItem(v, JSON.stringify(r)), le(t, n, r), window.dispatchEvent(new Event("auth:login")), {
 			token: n,
 			user: r,
 			response: t
@@ -268,11 +266,11 @@ async function U(e) {
 		S = null;
 	}), S);
 }
-function ce(e, t = 30) {
-	let n = j(e), r = Number(n?.exp);
+function H(e, t = 30) {
+	let n = k(e), r = Number(n?.exp);
 	return !Number.isFinite(r) || r <= 0 ? !1 : r * 1e3 <= Date.now() + t * 1e3;
 }
-function le(e) {
+function U(e) {
 	let t = D(e);
 	if (!t) return "";
 	localStorage.setItem(_, t), localStorage.setItem("access_token", t);
@@ -301,7 +299,7 @@ async function W() {
 			let t = Error(n?.error ?? n?.message ?? `Token refresh failed: ${e.status}`);
 			throw t.status = e.status, t;
 		}
-		let r = le(n);
+		let r = U(n);
 		if (!r) {
 			let e = /* @__PURE__ */ Error("Token refresh response did not contain an access token");
 			throw e.status = 401, e;
@@ -312,8 +310,8 @@ async function W() {
 	}), C;
 }
 async function G() {
-	let e = N();
-	if (e && !ce(e)) return e;
+	let e = j();
+	if (e && !H(e)) return e;
 	if (localStorage.getItem("refresh_token")) try {
 		return await W();
 	} catch {}
@@ -385,7 +383,7 @@ async function Q(e, t = {}) {
 	if (r.status === 401 && localStorage.getItem("refresh_token")) try {
 		await W(), r = await n();
 	} catch {}
-	r.status === 401 && F();
+	r.status === 401 && N();
 	let i = await r.text(), a = {};
 	if (i) try {
 		a = JSON.parse(i);
@@ -403,6 +401,6 @@ async function $(e, t) {
 	return n.data ?? n;
 }
 //#endregion
-export { ne as A, o as C, d as D, c as E, s as O, f as S, u as T, B as _, G as a, te as b, I as c, P as d, L as f, T as g, F as h, H as i, h as j, re as k, V as l, U as m, ie as n, Z as o, R as p, E as r, z as s, $ as t, N as u, p as v, ee as w, l as x, m as y };
+export { ne as A, o as C, d as D, c as E, s as O, f as S, u as T, R as _, G as a, m as b, P as c, M as d, F as f, T as g, N as h, B as i, h as j, re as k, z as l, V as m, ie as n, Z as o, I as p, E as r, L as s, $ as t, j as u, p as v, ee as w, l as x, te as y };
 
-//# sourceMappingURL=authApi-CpZdvX9i.js.map
+//# sourceMappingURL=authApi-D4JWuiiT.js.map

package/dist-lib/authApi-D4JWuiiT.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authApi-D4JWuiiT.js","names":[],"sources":["../src/services/apiConfig.js","../src/services/authApi.js"],"sourcesContent":["// Central API base URLs.\n//\n// When CORE-THEME runs standalone (npm run dev), the values come from\n// src/services/.env (Vite VITE_* vars, baked in at build time).\n//\n// When CORE-THEME is consumed as the published @realtek/core-theme package,\n// host apps can override these values at RUNTIME by setting\n// `window.__CORE_THEME_CONFIG__` before the app renders:\n//\n//   <script>\n//     window.__CORE_THEME_CONFIG__ = {\n//       VITE_CORE_URL:    'http://host:9010/becoretheme', // common platform\n//       VITE_ZINNEXT_URL: 'http://host:9011/bezinnext',   // app-specific\n//       VITE_PYOPS_URL:   'http://host:9010/pyops/v1',    // AI actions\n//       VITE_APP_ID:      'zinnext',  // sent as the `X-App-Id` header on every call\n//     };\n//   </script>\n//\n// Priority: runtime window config  >  build-time .env fallback.\n\nconst BUILD_TIME_FALLBACK = {\n  VITE_AUTH_URL: import.meta.env.VITE_AUTH_URL,\n  VITE_ADMIN_API_URL: import.meta.env.VITE_ADMIN_API_URL,\n  VITE_ADMIN_APP_ID: import.meta.env.VITE_ADMIN_APP_ID,\n  VITE_SUBMISSIONS_URL: import.meta.env.VITE_SUBMISSIONS_URL,\n  VITE_JOBS_URL: import.meta.env.VITE_JOBS_URL,\n  VITE_CANDIDATES_URL: import.meta.env.VITE_CANDIDATES_URL,\n  VITE_PYOPS_URL: import.meta.env.VITE_PYOPS_URL,\n  VITE_APP_ID: import.meta.env.VITE_APP_ID,\n};\n\nfunction resolve(key) {\n  if (\n    typeof window !== 'undefined' &&\n    window.__CORE_THEME_CONFIG__ &&\n    window.__CORE_THEME_CONFIG__[key] != null\n  ) {\n    return window.__CORE_THEME_CONFIG__[key];\n  }\n  return BUILD_TIME_FALLBACK[key];\n}\n\nfunction runtimeValue(key, fallback = '') {\n  return {\n    toString: () => resolve(key) || (typeof fallback === 'function' ? fallback() : fallback),\n    valueOf: () => resolve(key) || (typeof fallback === 'function' ? fallback() : fallback),\n    [Symbol.toPrimitive]: () => resolve(key) || (typeof fallback === 'function' ? fallback() : fallback),\n  };\n}\n\n// These are intentionally dynamic. Many service files use them inside template\n// literals (`${AUTH_URL}/path`) or pass them to helpers that later build a URL.\n// ── Three backends, one gateway ────────────────────────────────────────────────\n//\n// The frontend now talks to THREE logical services, all served by the one\n// BE-CORE-THEME gateway:\n//\n//   VITE_CORE_URL     → becoretheme : the common platform (auth, jobs, candidates,\n//                                     submissions — everything both apps share)\n//   VITE_ZINNEXT_URL  → bezinnext   : zinnext-only features\n//   VITE_PYOPS_URL    → pyops       : the Python service (unchanged)\n//\n// A host configures these three (or just VITE_GATEWAY_URL and let them derive).\n// The four legacy per-domain constants below (AUTH_URL/JOBS_URL/SUBMISSIONS_URL/\n// CANDIDATES_URL) still exist so the many existing service files keep working —\n// they now resolve to origin sub-namespaces UNDER becoretheme. That sub-path is\n// what keeps the 6 dual-called paths (/notes via auth vs jobs, /delete via\n// candidates vs jobs, …) reaching the right backend; a flat URL could not.\n//\n// Precedence for each value: explicit VITE_*_URL > derived from CORE/ZINNEXT/\n// gateway > legacy direct fallback.\n\n// baseFrom returns the first non-empty of: explicit key, one of the fallbacks.\nfunction firstConfigured(explicitKey, ...fallbacks) {\n  return runtimeValue(explicitKey, () => {\n    for (const f of fallbacks) {\n      const v = typeof f === 'function' ? f() : f;\n      if (v) return String(v).replace(/\\/+$/, '');\n    }\n    return '';\n  });\n}\nconst gw = () => { const g = resolve('VITE_GATEWAY_URL'); return g ? String(g).replace(/\\/+$/, '') : ''; };\n\n// The three services. becoretheme/bezinnext default to gateway sub-paths.\nexport const CORE_URL = firstConfigured('VITE_CORE_URL', () => (gw() ? gw() + '/becoretheme' : ''));\nexport const ZINNEXT_URL = firstConfigured('VITE_ZINNEXT_URL', () => (gw() ? gw() + '/bezinnext' : ''));\n// AI actions go to the Python service, reached through the same gateway host.\nexport const PYOPS_URL = firstConfigured('VITE_PYOPS_URL', () => (gw() ? gw() + '/pyops/v1' : ''));\nexport const GATEWAY_URL = runtimeValue('VITE_GATEWAY_URL');\n\n// Legacy per-domain constants — now origin sub-namespaces under becoretheme.\n// An explicit VITE_*_URL still overrides, for pointing one backend elsewhere.\nexport const AUTH_URL = firstConfigured('VITE_AUTH_URL',\n  () => (String(CORE_URL) ? String(CORE_URL) + '/v1' : ''));\nexport const JOBS_URL = firstConfigured('VITE_JOBS_URL',\n  () => (String(CORE_URL) ? String(CORE_URL) + '/jobs/v1' : ''));\nexport const SUBMISSIONS_URL = firstConfigured('VITE_SUBMISSIONS_URL',\n  () => (String(CORE_URL) ? String(CORE_URL) + '/submissions/v1' : ''));\nexport const CANDIDATES_URL = firstConfigured('VITE_CANDIDATES_URL',\n  () => (String(CORE_URL) ? String(CORE_URL) + '/candidates/v1' : ''));\n\n// Admin calls ride the auth namespace under becoretheme (gateway routes\n// /v1/admin/* to the common platform), so this tracks AUTH_URL.\nexport const ADMIN_API_URL = firstConfigured('VITE_ADMIN_API_URL',\n  () => resolve('VITE_AUTH_URL') || (String(CORE_URL) ? String(CORE_URL) + '/v1' : ''));\nexport const ADMIN_APP_ID = runtimeValue('VITE_ADMIN_APP_ID', () => resolve('VITE_APP_ID') || 'zinnext-dev-api-v1');\n\n// App identifier sent as the `X-App-Id` header on every API request (e.g.\n// 'zinnext', 'lms'). Configured in ONE place — the host's window config (or the\n// build-time .env fallback) — and applied to all calls via the interceptor below.\nexport const APP_ID = runtimeValue('VITE_APP_ID');\n\n// Helper for code that builds headers explicitly: merges `X-App-Id` into a\n// header object without clobbering anything else. (The interceptor below already\n// covers existing calls; this is just a convenience for new code.)\nexport function withAppId(headers = {}) {\n  const appId = resolve('VITE_APP_ID');\n  return appId ? { 'X-App-Id': appId, ...headers } : { ...headers };\n}\n\nexport function withAdminAppId(headers = {}) {\n  const appId = resolve('VITE_ADMIN_APP_ID') || resolve('VITE_APP_ID') || 'zinnext-dev-api-v1';\n  return appId ? { 'X-App-Id': appId, ...headers } : { ...headers };\n}\n\n// ── X-App-Id interceptor ──────────────────────────────────────────────────────\n//\n// Rather than editing every inline `headers: {...}` across the service files\n// (and risking new calls forgetting it), we patch `fetch` ONCE so every request\n// to a configured API base URL carries `X-App-Id`. This is scoped strictly to the\n// four API origins, so third-party/asset requests are never touched, and any\n// caller that already set `X-App-Id` explicitly is left as-is.\nfunction installAppIdInterceptor() {\n  if (typeof window === 'undefined' || typeof window.fetch !== 'function') return;\n  // Guard against double-patching (repeated imports / Vite HMR).\n  if (window.__CORE_THEME_APP_ID_PATCHED__) return;\n\n  const apiBaseUrls = [AUTH_URL, ADMIN_API_URL, SUBMISSIONS_URL, JOBS_URL, CANDIDATES_URL, PYOPS_URL];\n  const originalFetch = window.fetch.bind(window);\n\n  const urlOf = (input) => {\n    if (typeof input === 'string') return input;\n    if (input instanceof URL) return input.href;\n    if (input && typeof input.url === 'string') return input.url; // Request object\n    return '';\n  };\n  const isApiRequest = (url) =>\n    !!url && apiBaseUrls.some((base) => {\n      const value = String(base);\n      return value && url.startsWith(value);\n    });\n\n  window.fetch = function patchedFetch(input, init) {\n    try {\n      const url = urlOf(input);\n      const isAdminRequest = String(ADMIN_API_URL) && url.startsWith(String(ADMIN_API_URL));\n      const appId = isAdminRequest\n        ? (resolve('VITE_ADMIN_APP_ID') || resolve('VITE_APP_ID') || 'zinnext-dev-api-v1')\n        : resolve('VITE_APP_ID');\n      if (appId && isApiRequest(url)) {\n        const isRequestObj = typeof Request !== 'undefined' && input instanceof Request;\n        const headers = new Headers(\n          (init && init.headers) || (isRequestObj ? input.headers : undefined),\n        );\n        if (!headers.has('X-App-Id')) headers.set('X-App-Id', appId);\n        if (isRequestObj && !(init && init.headers)) {\n          return originalFetch(new Request(input, { headers }), init);\n        }\n        return originalFetch(input, { ...(init || {}), headers });\n      }\n    } catch {\n      // Any unexpected argument shape: fall through to the untouched request.\n    }\n    return originalFetch(input, init);\n  };\n\n  window.__CORE_THEME_APP_ID_PATCHED__ = true;\n}\n\ninstallAppIdInterceptor();\n\n// Optional JS helper (alternative to the index.html <script>). Because the\n// exports above are resolved when this module first loads, call this BEFORE the\n// first import of @realtek/core-theme — e.g. in the host's index.html, not in\n// main.jsx (which runs after imports are evaluated). The index.html <script>\n// approach is the reliable one.\nexport function configureCoreTheme(config = {}) {\n  if (typeof window === 'undefined') return;\n  window.__CORE_THEME_CONFIG__ = { ...(window.__CORE_THEME_CONFIG__ || {}), ...config };\n  installAppIdInterceptor();\n}\n","import { AUTH_URL, withAppId } from './apiConfig';\n\nconst AUTH_TOKEN_KEY = 'authToken';\nconst AUTH_USER_KEY = 'authUser';\nconst AUTH_LOGIN_SESSION_KEY = 'authLoginSession';\nconst CT_PROJECT_ID_KEY = 'ct_project_id';\nconst CT_PROJECT_NAME_KEY = 'ct_project_name';\nconst LOGIN_STORAGE_KEYS = [\n  'access_token', 'refresh_token', 'id_token', 'token_type', 'expires_in',\n  'refresh_expires_in', 'menu', 'footermenu', 'menuPermission', 'default_values',\n  'roleId', 'companyName', 'preferred_Username', 'user_Email', 'userName',\n  'userId', 'tenantId', 'businessId', 'businessUnitId', 'activeKey',\n  'ct_project_id', 'ct_project_name',\n];\n\nlet loginPromise = null;\nlet refreshPromise = null;\nlet runtimeAuthToken = null;\n\nexport function setAuthTokenOverride(token) {\n  runtimeAuthToken = typeof token === 'string' && token.trim() ? token.trim() : null;\n}\n\nexport function clearAuthTokenOverride() {\n  runtimeAuthToken = null;\n}\n\nfunction extractToken(json) {\n  return (\n    json?.token ?? json?.access_token ?? json?.accessToken ?? json?.jwt ??\n    json?.data?.token ?? json?.data?.access_token ?? json?.data?.accessToken ?? json?.data?.jwt\n  );\n}\n\nfunction extractUser(json) {\n  return json?.user ?? json?.data?.user ?? json?.data?.profile ?? null;\n}\n\nfunction extractLoginErrorMessage(json, fallback = '') {\n  const candidates = [\n    json?.message,\n    json?.error,\n    json?.data?.message,\n    json?.data?.error,\n    json?.error?.message,\n    json?.data?.error?.message,\n  ];\n\n  for (const candidate of candidates) {\n    if (typeof candidate === 'string' && candidate.trim()) {\n      return candidate.trim();\n    }\n  }\n\n  return fallback;\n}\n\nfunction isLoginFailureResponse(json) {\n  return json?.status === false || json?.success === false || json?.data?.status === false || json?.data?.success === false;\n}\n\nfunction decodeJwtPayload(token) {\n  if (!token || typeof token !== 'string') return null;\n  try {\n    const payload = token.split('.')[1];\n    if (!payload) return null;\n    const normalized = payload.replace(/-/g, '+').replace(/_/g, '/');\n    return JSON.parse(atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=')));\n  } catch {\n    return null;\n  }\n}\n\nfunction setLocalStorageJson(key, value) {\n  if (value === undefined || value === null) return;\n  localStorage.setItem(key, JSON.stringify(value));\n}\n\nfunction getLoginMenus(json, data) {\n  return data?.menus ?? json?.menus ?? {\n    menu: data?.menu ?? json?.menu,\n    footermenu: data?.footermenu ?? json?.footermenu,\n  };\n}\n\nfunction persistLoginResponse(json, token, user) {\n  const data = json?.data ?? json;\n  const tokenPayload = decodeJwtPayload(token) ?? {};\n  const menus = getLoginMenus(json, data);\n  const userName = (\n    user?.userName ?? user?.name ?? data?.userName ?? data?.name ??\n    tokenPayload.userName ?? tokenPayload.name ?? tokenPayload.preferred_username ?? tokenPayload.email\n  );\n  const preferredUsername = (\n    user?.preferred_Username ?? user?.preferred_username ??\n    data?.preferred_Username ?? data?.preferred_username ??\n    tokenPayload.preferred_Username ?? tokenPayload.preferred_username ??\n    tokenPayload.email ?? userName\n  );\n  const userEmail = user?.email ?? data?.email ?? tokenPayload.email ?? preferredUsername;\n\n  localStorage.setItem('access_token', token);\n  if (data?.refresh_token) localStorage.setItem('refresh_token', data.refresh_token);\n  if (data?.id_token !== undefined) localStorage.setItem('id_token', data.id_token);\n  if (data?.token_type) localStorage.setItem('token_type', data.token_type);\n  if (data?.expires_in !== undefined) localStorage.setItem('expires_in', String(data.expires_in));\n  if (data?.refresh_expires_in !== undefined) localStorage.setItem('refresh_expires_in', String(data.refresh_expires_in));\n  if (userName) localStorage.setItem('userName', userName);\n  if (preferredUsername) localStorage.setItem('preferred_Username', preferredUsername);\n  if (userEmail) localStorage.setItem('user_Email', userEmail);\n  if (data?.roleId ?? tokenPayload.role_id) localStorage.setItem('roleId', data?.roleId ?? tokenPayload.role_id);\n  if (data?.companyName) localStorage.setItem('companyName', data.companyName);\n  if (tokenPayload.userId !== undefined) localStorage.setItem('userId', String(tokenPayload.userId));\n  if (tokenPayload.tenantId) localStorage.setItem('tenantId', tokenPayload.tenantId);\n  if (tokenPayload.businessId) localStorage.setItem('businessId', tokenPayload.businessId);\n  if (tokenPayload.businessUnitId) localStorage.setItem('businessUnitId', tokenPayload.businessUnitId);\n\n  setLocalStorageJson('menu', menus.menu);\n  setLocalStorageJson('footermenu', menus.footermenu);\n  setLocalStorageJson('menuPermission', data?.menuPermission);\n  setLocalStorageJson('default_values', data?.default_values);\n}\n\n// ── Token & Session ──────────────────────────────────────────────────────────\n\nexport function getStoredToken() {\n  if (runtimeAuthToken) return runtimeAuthToken;\n\n  // Authentication must be shared across browser tabs. `sessionStorage` is\n  // isolated per tab, so requiring authLoginSession here made a newly opened\n  // tab look logged out even though the valid token already existed in\n  // localStorage. The token (and refresh token) are the shared session source.\n  return localStorage.getItem(AUTH_TOKEN_KEY);\n}\n\nexport function getStoredUser() {\n  try {\n    const stored = localStorage.getItem(AUTH_USER_KEY);\n    if (stored) return JSON.parse(stored);\n  } catch {\n    // Fall through to the legacy login fields below.\n  }\n  return {\n    userId: localStorage.getItem('userId'),\n    username: localStorage.getItem('userName') || localStorage.getItem('preferred_Username'),\n    email: localStorage.getItem('user_Email'),\n    roleId: localStorage.getItem('roleId'),\n  };\n}\n\nexport function logout() {\n  // No response may outlive the session that was entitled to it.\n  invalidateGetCache();\n  localStorage.removeItem(AUTH_TOKEN_KEY);\n  localStorage.removeItem(AUTH_USER_KEY);\n  LOGIN_STORAGE_KEYS.forEach((key) => localStorage.removeItem(key));\n  sessionStorage.removeItem(AUTH_LOGIN_SESSION_KEY);\n  window.dispatchEvent(new Event('auth:logout'));\n}\n\n// ── Role Helpers ─────────────────────────────────────────────────────────────\n\nexport function getCurrentRoleName() {\n  const stored = String(localStorage.getItem('roleId') ?? '').trim().toLowerCase();\n  if (stored) return stored;\n  const payload = decodeJwtPayload(getStoredToken()) ?? {};\n  return String(payload.role ?? payload.roleName ?? payload.role_name ?? payload.role_id ?? payload.roleId ?? '').trim().toLowerCase();\n}\n\nexport function getUserRoles() {\n  const token = getStoredToken() ?? localStorage.getItem(AUTH_TOKEN_KEY);\n  const payload = decodeJwtPayload(token);\n  const roles = new Set();\n  const stored = getCurrentRoleName();\n  if (stored) roles.add(stored);\n  if (payload) {\n    (payload?.realm_access?.roles ?? []).forEach((role) => roles.add(role));\n    Object.values(payload?.resource_access ?? {}).forEach((client) => {\n      (client?.roles ?? []).forEach((role) => roles.add(role));\n    });\n    [payload?.role, payload?.roleName, payload?.role_name].forEach((role) => {\n      if (role) roles.add(role);\n    });\n  }\n  return Array.from(roles).map((role) => String(role).toLowerCase());\n}\n\nexport function isTester() {\n  return getCurrentRoleName() === 'tester' || getUserRoles().includes('tester');\n}\n\n// getActingIdentity returns the numeric {roleId, userId} of the logged-in user,\n// read from the auth token (falling back to the stored roleId). Used to evaluate\n// admin-configured field autoValueRules for UX only — the gateway re-evaluates\n// the same rules from the token and has the final say, so nothing here is a\n// security boundary.\nexport function getActingIdentity() {\n  const payload = decodeJwtPayload(getStoredToken() ?? localStorage.getItem(AUTH_TOKEN_KEY)) ?? {};\n  const num = (value) => {\n    if (value === undefined || value === null || value === '') return undefined;\n    const parsed = Number(value);\n    return Number.isFinite(parsed) ? parsed : undefined;\n  };\n  return {\n    roleId: num(payload.role_id ?? payload.roleId) ?? num(localStorage.getItem('roleId')),\n    userId: num(payload.userId ?? payload.user_id),\n  };\n}\n\n// ── Project Context ───────────────────────────────────────────────────────────\n\nexport function setSelectedProject(project) {\n  if (!project) return;\n  localStorage.setItem(CT_PROJECT_ID_KEY, String(project.id));\n  localStorage.setItem(CT_PROJECT_NAME_KEY, String(project.name));\n}\n\nexport function getSelectedProject() {\n  const id = localStorage.getItem(CT_PROJECT_ID_KEY);\n  const name = localStorage.getItem(CT_PROJECT_NAME_KEY);\n  if (!id || !name) return null;\n  return { id: Number(id), name };\n}\n\nexport function clearSelectedProject() {\n  localStorage.removeItem(CT_PROJECT_ID_KEY);\n  localStorage.removeItem(CT_PROJECT_NAME_KEY);\n}\n\n// ── Login ────────────────────────────────────────────────────────────────────\n\nexport async function login(credentials) {\n  if (loginPromise) return loginPromise;\n\n  loginPromise = fetch(`${AUTH_URL}/login`, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(credentials),\n  })\n    .then(async (res) => {\n      const json = await res.json();\n      if (!res.ok || isLoginFailureResponse(json)) {\n        const error = new Error(\n          extractLoginErrorMessage(json, `Login failed: ${res.status}`),\n        );\n        error.status = res.status;\n        error.response = json;\n        throw error;\n      }\n\n      const token = extractToken(json);\n      if (!token) {\n        const error = new Error(\n          extractLoginErrorMessage(json, 'No token in login response'),\n        );\n        error.status = res.status;\n        error.response = json;\n        throw error;\n      }\n      const user = extractUser(json);\n      localStorage.setItem(AUTH_TOKEN_KEY, token);\n      if (user) localStorage.setItem(AUTH_USER_KEY, JSON.stringify(user));\n      persistLoginResponse(json, token, user);\n      // Let any mounted AuthGuard re-check and reveal the protected content.\n      window.dispatchEvent(new Event('auth:login'));\n      return { token, user, response: json };\n    })\n    .finally(() => { loginPromise = null; });\n\n  return loginPromise;\n}\n\nfunction tokenExpiresSoon(token, skewSeconds = 30) {\n  const payload = decodeJwtPayload(token);\n  const exp = Number(payload?.exp);\n  if (!Number.isFinite(exp) || exp <= 0) return false;\n  return exp * 1000 <= Date.now() + skewSeconds * 1000;\n}\n\nfunction persistRefreshedAccessToken(json) {\n  const token = extractToken(json);\n  if (!token) return '';\n  localStorage.setItem(AUTH_TOKEN_KEY, token);\n  localStorage.setItem('access_token', token);\n  const data = json?.data ?? json;\n  const expiresIn = data?.expires_in ?? data?.accessTokenExpiresIn;\n  if (expiresIn !== undefined) localStorage.setItem('expires_in', String(expiresIn));\n  return token;\n}\n\nexport async function refreshAccessToken() {\n  if (refreshPromise) return refreshPromise;\n  const refreshToken = String(localStorage.getItem('refresh_token') ?? '').trim();\n  if (!refreshToken) {\n    const error = new Error('Session expired');\n    error.status = 401;\n    throw error;\n  }\n  refreshPromise = fetch(`${AUTH_URL}/generate-refresh-token`, {\n    method: 'POST',\n    headers: withAppId({ 'Content-Type': 'application/json' }),\n    body: JSON.stringify({ refresh_token: refreshToken }),\n  }).then(async (res) => {\n    const text = await res.text();\n    let json = {};\n    if (text) { try { json = JSON.parse(text); } catch { json = { error: text }; } }\n    if (!res.ok) {\n      const error = new Error(json?.error ?? json?.message ?? `Token refresh failed: ${res.status}`);\n      error.status = res.status;\n      throw error;\n    }\n    const token = persistRefreshedAccessToken(json);\n    if (!token) { const error = new Error('Token refresh response did not contain an access token'); error.status = 401; throw error; }\n    return token;\n  }).finally(() => { refreshPromise = null; });\n  return refreshPromise;\n}\n\n// ── HTTP Helpers (exported for use by other service files) ───────────────────\n\nexport async function ensureToken() {\n  const token = getStoredToken();\n  if (token && !tokenExpiresSoon(token)) return token;\n  if (localStorage.getItem('refresh_token')) {\n    try { return await refreshAccessToken(); } catch { /* handled by request retry/logout */ }\n  }\n  if (token) return token;\n  const error = new Error('Authentication required');\n  error.status = 401;\n  throw error;\n}\n\nasync function authHeaders() {\n  const token = await ensureToken();\n  // Normal application API calls must always target the currently selected\n  // project database. Do not let the global fetch interceptor infer this from\n  // the URL because AUTH_URL and ADMIN_API_URL may point to the same service.\n  // Explicit X-App-Id wins in the backend middleware and keeps runtime module\n  // data/master dropdowns scoped to VITE_APP_ID.\n  return withAppId({\n    'Content-Type': 'application/json',\n    Authorization: `Bearer ${token}`,\n  });\n}\n\n// ── GET in-flight coalescing ────────────────────────────────────────────────\n//\n// A page routinely asks for the SAME data several times over, because the parts\n// that need it are independent and none of them can know the others exist. Six\n// form fields that look up the same collection issue six identical requests;\n// the header and the body of a detail page each fetch the same record. Measured\n// on an ORDINARY edit form: 13 requests for 8 distinct URLs, one of them fired\n// six times.\n//\n// The honest fix is not to make each caller aware of the others — that couples\n// components that have no business knowing about each other, and breaks the\n// moment a new one is added. It is to make the REQUEST idempotent: a GET that\n// is already in the air is JOINED rather than reissued.\n//\n// Deliberately in-flight ONLY, with no time-to-live:\n//   • It cannot serve stale data. The answer a joiner receives is the answer to\n//     a request that had not yet returned when it asked — by definition no\n//     staler than issuing its own.\n//   • It needs no invalidation, so a write can never be shadowed by a cache\n//     entry, and no caller has to remember to clear anything.\n// A TTL would catch a few more (a child mounting just after its parent's fetch\n// resolved) at the cost of a staleness window on every endpoint in the app.\n// `formGroupsCache` already makes that trade deliberately for one endpoint it\n// understands; this layer, which knows nothing about what it is fetching,\n// should not make it for everything.\n//\n// Each joiner gets its OWN deep copy of the payload. Callers legitimately mutate\n// what they receive (dropdownApi attaches `recordMeta` to the groups array), and\n// handing several callers one shared object would turn a saved request into a\n// cross-component data bug — far worse than the duplicate it removed.\n//\n// A SHORT TIME-TO-LIVE sits on top of the coalescing, because not every\n// duplicate overlaps: a child that mounts just after its parent's fetch\n// resolved asks a moment too late to join it. That is the remaining half of the\n// \"same data, fetched again\" problem, and it is the half a pure in-flight join\n// cannot reach.\n//\n// This part CAN serve stale data, so it is bounded hard:\n//   • a few seconds only — long enough to cover one page's mount burst, short\n//     enough that no realistic user action fits inside it;\n//   • ANY non-GET clears the whole GET cache. A write is the one event that\n//     makes previously-fetched data wrong, so nothing a user saves can be\n//     shadowed by a stale entry;\n//   • logging out clears it too, so no response outlives the session that was\n//     entitled to it.\n// This mirrors the trade `formGroupsCache` already makes deliberately for one\n// endpoint; the difference is that the invalidation here is automatic rather\n// than something each caller has to remember.\nconst GET_TTL_MS = 4000;\n\nconst inFlightGets = new Map(); // url -> Promise<json>\nconst settledGets = new Map();  // url -> { at, json }\n\n// Cleared on every write and on logout — see the note above.\nexport function invalidateGetCache() {\n  settledGets.clear();\n}\n\nfunction clonePayload(json) {\n  // structuredClone is present in every browser this app supports and in Node\n  // 17+. Falling back to a JSON round-trip keeps older test environments\n  // working; both produce a copy no other caller can observe.\n  try {\n    return typeof structuredClone === 'function' ? structuredClone(json) : JSON.parse(JSON.stringify(json));\n  } catch {\n    // Non-cloneable payload (rare). Sharing the original is still correct for\n    // every caller that does not mutate, and is better than failing the call.\n    return json;\n  }\n}\n\nfunction isGet(options) {\n  const method = (options?.method ?? 'GET').toUpperCase();\n  return method === 'GET';\n}\n\nexport async function fetchJsonWithAuth(baseUrl, path = '', options = {}) {\n  if (path && typeof path === 'object') {\n    options = path;\n    path = '';\n  }\n\n  const url = `${baseUrl}${path || ''}`;\n  if (isGet(options)) {\n    const pending = inFlightGets.get(url);\n    if (pending) return clonePayload(await pending);\n    const settled = settledGets.get(url);\n    if (settled && Date.now() - settled.at < GET_TTL_MS) return clonePayload(settled.json);\n    // Expired: drop it now rather than leaving the map to grow for the rest of\n    // the session on a long-lived page.\n    if (settled) settledGets.delete(url);\n  }\n\n  if (!isGet(options)) {\n    // A write invalidates BEFORE it runs and again after it settles: before, so\n    // a GET fired concurrently with the save cannot repopulate the cache from\n    // pre-write state; after, so anything read during the write is dropped too.\n    invalidateGetCache();\n    try {\n      return await performFetch(url, options);\n    } finally {\n      invalidateGetCache();\n    }\n  }\n\n  const run = performFetch(url, options);\n  inFlightGets.set(url, run);\n  try {\n    // The ORIGINATING caller is cloned too, so no caller can tell whether it\n    // issued the request or joined one — otherwise a mutation would be safe or\n    // unsafe depending on render order, which is the worst kind of bug.\n    const json = await run;\n    settledGets.set(url, { at: Date.now(), json });\n    return clonePayload(json);\n  } finally {\n    // Cleared on success AND failure: a failed GET must not be inherited by\n    // anyone who asks next, they retry for real.\n    inFlightGets.delete(url);\n  }\n}\n\nasync function performFetch(url, options = {}) {\n  const doRequest = async () => {\n    const headers = await authHeaders();\n    return fetch(url, { ...options, headers: { ...headers, ...options.headers } });\n  };\n\n  let res = await doRequest();\n  if (res.status === 401 && localStorage.getItem('refresh_token')) {\n    try {\n      await refreshAccessToken();\n      res = await doRequest();\n    } catch {\n      // Only logout if the retry is still unauthorized.\n    }\n  }\n  if (res.status === 401) logout();\n\n  const text = await res.text();\n  let json = {};\n  if (text) {\n    try { json = JSON.parse(text); } catch { json = { error: text }; }\n  }\n  if (!res.ok) {\n    const responseError = json?.error ?? json?.message;\n    const detail = typeof responseError === 'string'\n      ? responseError\n      : responseError && Object.keys(responseError).length > 0\n        ? JSON.stringify(responseError)\n        : '';\n    const error = new Error(detail || `API ${res.status}: ${res.statusText}`);\n    error.status = res.status;\n    error.response = json;\n    throw error;\n  }\n  return json;\n}\n\nexport async function apiGetWithAuth(baseUrl, path) {\n  const json = await fetchJsonWithAuth(baseUrl, path);\n  return json.data ?? json;\n}\n"],"mappings":";;AAoBA,IAAM,IAAsB;CAC1B,eAAA,KAAA;CACA,oBAAA,KAAA;CACA,mBAAA,KAAA;CACA,sBAAA,KAAA;CACA,eAAA,KAAA;CACA,qBAAA,KAAA;CACA,gBAAA,KAAA;CACA,aAAA,KAAA;AACF;AAEA,SAAS,EAAQ,GAAK;CAQpB,OANE,OAAO,SAAW,OAClB,OAAO,yBACP,OAAO,sBAAsB,MAAQ,OAE9B,OAAO,sBAAsB,KAE/B,EAAoB;AAC7B;AAEA,SAAS,EAAa,GAAK,IAAW,IAAI;CACxC,OAAO;EACL,gBAAgB,EAAQ,CAAG,MAAM,OAAO,KAAa,aAAa,EAAS,IAAI;EAC/E,eAAe,EAAQ,CAAG,MAAM,OAAO,KAAa,aAAa,EAAS,IAAI;GAC7E,OAAO,oBAAoB,EAAQ,CAAG,MAAM,OAAO,KAAa,aAAa,EAAS,IAAI;CAC7F;AACF;AAyBA,SAAS,EAAgB,GAAa,GAAG,GAAW;CAClD,OAAO,EAAa,SAAmB;EACrC,KAAK,IAAM,KAAK,GAAW;GACzB,IAAM,IAAI,OAAO,KAAM,aAAa,EAAE,IAAI;GAC1C,IAAI,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,QAAQ,QAAQ,EAAE;EAC5C;EACA,OAAO;CACT,CAAC;AACH;AACA,IAAM,UAAW;CAAE,IAAM,IAAI,EAAQ,kBAAkB;CAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,QAAQ,EAAE,IAAI;AAAI,GAG5F,IAAW,EAAgB,uBAAwB,EAAG,IAAI,EAAG,IAAI,iBAAiB,EAAG,GACrF,IAAc,EAAgB,0BAA2B,EAAG,IAAI,EAAG,IAAI,eAAe,EAAG,GAEzF,IAAY,EAAgB,wBAAyB,EAAG,IAAI,EAAG,IAAI,cAAc,EAAG,GACpF,KAAc,EAAa,kBAAkB,GAI7C,IAAW,EAAgB,uBAC/B,OAAO,CAAQ,IAAI,OAAO,CAAQ,IAAI,QAAQ,EAAG,GAC7C,IAAW,EAAgB,uBAC/B,OAAO,CAAQ,IAAI,OAAO,CAAQ,IAAI,aAAa,EAAG,GAClD,IAAkB,EAAgB,8BACtC,OAAO,CAAQ,IAAI,OAAO,CAAQ,IAAI,oBAAoB,EAAG,GACzD,IAAiB,EAAgB,6BACrC,OAAO,CAAQ,IAAI,OAAO,CAAQ,IAAI,mBAAmB,EAAG,GAIxD,IAAgB,EAAgB,4BACrC,EAAQ,eAAe,MAAM,OAAO,CAAQ,IAAI,OAAO,CAAQ,IAAI,QAAQ,GAAG,GACzE,KAAe,EAAa,2BAA2B,EAAQ,aAAa,KAAK,oBAAoB,GAKrG,IAAS,EAAa,aAAa;AAKhD,SAAgB,EAAU,IAAU,CAAC,GAAG;CACtC,IAAM,IAAQ,EAAQ,aAAa;CACnC,OAAO,IAAQ;EAAE,YAAY;EAAO,GAAG;CAAQ,IAAI,EAAE,GAAG,EAAQ;AAClE;AAEA,SAAgB,GAAe,IAAU,CAAC,GAAG;CAC3C,IAAM,IAAQ,EAAQ,mBAAmB,KAAK,EAAQ,aAAa,KAAK;CACxE,OAAO,IAAQ;EAAE,YAAY;EAAO,GAAG;CAAQ,IAAI,EAAE,GAAG,EAAQ;AAClE;AASA,SAAS,IAA0B;CAGjC,IAFI,OAAO,SAAW,OAAe,OAAO,OAAO,SAAU,cAEzD,OAAO,+BAA+B;CAE1C,IAAM,IAAc;EAAC;EAAU;EAAe;EAAiB;EAAU;EAAgB;CAAS,GAC5F,IAAgB,OAAO,MAAM,KAAK,MAAM,GAExC,KAAS,MACT,OAAO,KAAU,WAAiB,IAClC,aAAiB,MAAY,EAAM,OACnC,KAAS,OAAO,EAAM,OAAQ,WAAiB,EAAM,MAClD,IAEH,KAAgB,MACpB,CAAC,CAAC,KAAO,EAAY,MAAM,MAAS;EAClC,IAAM,IAAQ,OAAO,CAAI;EACzB,OAAO,KAAS,EAAI,WAAW,CAAK;CACtC,CAAC;CA0BH,AAxBA,OAAO,QAAQ,SAAsB,GAAO,GAAM;EAChD,IAAI;GACF,IAAM,IAAM,EAAM,CAAK,GAEjB,IADiB,OAAO,CAAa,KAAK,EAAI,WAAW,OAAO,CAAa,CAAC,IAE/E,EAAQ,mBAAmB,KAAK,EAAQ,aAAa,KAAK,uBAC3D,EAAQ,aAAa;GACzB,IAAI,KAAS,EAAa,CAAG,GAAG;IAC9B,IAAM,IAAe,OAAO,UAAY,OAAe,aAAiB,SAClE,IAAU,IAAI,QACjB,KAAQ,EAAK,YAAa,IAAe,EAAM,UAAU,KAAA,EAC5D;IAKA,OAJK,EAAQ,IAAI,UAAU,KAAG,EAAQ,IAAI,YAAY,CAAK,GACvD,KAAgB,EAAE,KAAQ,EAAK,WAC1B,EAAc,IAAI,QAAQ,GAAO,EAAE,WAAQ,CAAC,GAAG,CAAI,IAErD,EAAc,GAAO;KAAE,GAAI,KAAQ,CAAC;KAAI;IAAQ,CAAC;GAC1D;EACF,QAAQ,CAER;EACA,OAAO,EAAc,GAAO,CAAI;CAClC,GAEA,OAAO,gCAAgC;AACzC;AAEA,EAAwB;AAOxB,SAAgB,GAAmB,IAAS,CAAC,GAAG;CAC1C,OAAO,SAAW,QACtB,OAAO,wBAAwB;EAAE,GAAI,OAAO,yBAAyB,CAAC;EAAI,GAAG;CAAO,GACpF,EAAwB;AAC1B;;;;;;;;;;;;;;;;;;;;;;IC7LM,IAAiB,aACjB,IAAgB,YAChB,KAAyB,oBACzB,IAAoB,iBACpB,IAAsB,mBACtB,IAAqB;CACzB;CAAgB;CAAiB;CAAY;CAAc;CAC3D;CAAsB;CAAQ;CAAc;CAAkB;CAC9D;CAAU;CAAe;CAAsB;CAAc;CAC7D;CAAU;CAAY;CAAc;CAAkB;CACtD;CAAiB;AACnB,GAEI,IAAe,MACf,IAAiB,MACjB,IAAmB;AAEvB,SAAgB,EAAqB,GAAO;CAC1C,IAAmB,OAAO,KAAU,YAAY,EAAM,KAAK,IAAI,EAAM,KAAK,IAAI;AAChF;AAEA,SAAgB,IAAyB;CACvC,IAAmB;AACrB;AAEA,SAAS,EAAa,GAAM;CAC1B,OACE,GAAM,SAAS,GAAM,gBAAgB,GAAM,eAAe,GAAM,OAChE,GAAM,MAAM,SAAS,GAAM,MAAM,gBAAgB,GAAM,MAAM,eAAe,GAAM,MAAM;AAE5F;AAEA,SAAS,GAAY,GAAM;CACzB,OAAO,GAAM,QAAQ,GAAM,MAAM,QAAQ,GAAM,MAAM,WAAW;AAClE;AAEA,SAAS,EAAyB,GAAM,IAAW,IAAI;CACrD,IAAM,IAAa;EACjB,GAAM;EACN,GAAM;EACN,GAAM,MAAM;EACZ,GAAM,MAAM;EACZ,GAAM,OAAO;EACb,GAAM,MAAM,OAAO;CACrB;CAEA,KAAK,IAAM,KAAa,GACtB,IAAI,OAAO,KAAc,YAAY,EAAU,KAAK,GAClD,OAAO,EAAU,KAAK;CAI1B,OAAO;AACT;AAEA,SAAS,GAAuB,GAAM;CACpC,OAAO,GAAM,WAAW,MAAS,GAAM,YAAY,MAAS,GAAM,MAAM,WAAW,MAAS,GAAM,MAAM,YAAY;AACtH;AAEA,SAAS,EAAiB,GAAO;CAC/B,IAAI,CAAC,KAAS,OAAO,KAAU,UAAU,OAAO;CAChD,IAAI;EACF,IAAM,IAAU,EAAM,MAAM,GAAG,CAAC,CAAC;EACjC,IAAI,CAAC,GAAS,OAAO;EACrB,IAAM,IAAa,EAAQ,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;EAC/D,OAAO,KAAK,MAAM,KAAK,EAAW,OAAO,KAAK,KAAK,EAAW,SAAS,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;CACtF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,EAAoB,GAAK,GAAO;CACnC,KAAiC,QACrC,aAAa,QAAQ,GAAK,KAAK,UAAU,CAAK,CAAC;AACjD;AAEA,SAAS,GAAc,GAAM,GAAM;CACjC,OAAO,GAAM,SAAS,GAAM,SAAS;EACnC,MAAM,GAAM,QAAQ,GAAM;EAC1B,YAAY,GAAM,cAAc,GAAM;CACxC;AACF;AAEA,SAAS,GAAqB,GAAM,GAAO,GAAM;CAC/C,IAAM,IAAO,GAAM,QAAQ,GACrB,IAAe,EAAiB,CAAK,KAAK,CAAC,GAC3C,IAAQ,GAAc,GAAM,CAAI,GAChC,IACJ,GAAM,YAAY,GAAM,QAAQ,GAAM,YAAY,GAAM,QACxD,EAAa,YAAY,EAAa,QAAQ,EAAa,sBAAsB,EAAa,OAE1F,IACJ,GAAM,sBAAsB,GAAM,sBAClC,GAAM,sBAAsB,GAAM,sBAClC,EAAa,sBAAsB,EAAa,sBAChD,EAAa,SAAS,GAElB,IAAY,GAAM,SAAS,GAAM,SAAS,EAAa,SAAS;CAqBtE,AAnBA,aAAa,QAAQ,gBAAgB,CAAK,GACtC,GAAM,iBAAe,aAAa,QAAQ,iBAAiB,EAAK,aAAa,GAC7E,GAAM,aAAa,KAAA,KAAW,aAAa,QAAQ,YAAY,EAAK,QAAQ,GAC5E,GAAM,cAAY,aAAa,QAAQ,cAAc,EAAK,UAAU,GACpE,GAAM,eAAe,KAAA,KAAW,aAAa,QAAQ,cAAc,OAAO,EAAK,UAAU,CAAC,GAC1F,GAAM,uBAAuB,KAAA,KAAW,aAAa,QAAQ,sBAAsB,OAAO,EAAK,kBAAkB,CAAC,GAClH,KAAU,aAAa,QAAQ,YAAY,CAAQ,GACnD,KAAmB,aAAa,QAAQ,sBAAsB,CAAiB,GAC/E,KAAW,aAAa,QAAQ,cAAc,CAAS,IACvD,GAAM,UAAU,EAAa,YAAS,aAAa,QAAQ,UAAU,GAAM,UAAU,EAAa,OAAO,GACzG,GAAM,eAAa,aAAa,QAAQ,eAAe,EAAK,WAAW,GACvE,EAAa,WAAW,KAAA,KAAW,aAAa,QAAQ,UAAU,OAAO,EAAa,MAAM,CAAC,GAC7F,EAAa,YAAU,aAAa,QAAQ,YAAY,EAAa,QAAQ,GAC7E,EAAa,cAAY,aAAa,QAAQ,cAAc,EAAa,UAAU,GACnF,EAAa,kBAAgB,aAAa,QAAQ,kBAAkB,EAAa,cAAc,GAEnG,EAAoB,QAAQ,EAAM,IAAI,GACtC,EAAoB,cAAc,EAAM,UAAU,GAClD,EAAoB,kBAAkB,GAAM,cAAc,GAC1D,EAAoB,kBAAkB,GAAM,cAAc;AAC5D;AAIA,SAAgB,IAAiB;CAO/B,OANI,KAMG,aAAa,QAAQ,CAAc;AAC5C;AAEA,SAAgB,IAAgB;CAC9B,IAAI;EACF,IAAM,IAAS,aAAa,QAAQ,CAAa;EACjD,IAAI,GAAQ,OAAO,KAAK,MAAM,CAAM;CACtC,QAAQ,CAER;CACA,OAAO;EACL,QAAQ,aAAa,QAAQ,QAAQ;EACrC,UAAU,aAAa,QAAQ,UAAU,KAAK,aAAa,QAAQ,oBAAoB;EACvF,OAAO,aAAa,QAAQ,YAAY;EACxC,QAAQ,aAAa,QAAQ,QAAQ;CACvC;AACF;AAEA,SAAgB,IAAS;CAOvB,AALA,EAAmB,GACnB,aAAa,WAAW,CAAc,GACtC,aAAa,WAAW,CAAa,GACrC,EAAmB,SAAS,MAAQ,aAAa,WAAW,CAAG,CAAC,GAChE,eAAe,WAAW,EAAsB,GAChD,OAAO,cAAc,IAAI,MAAM,aAAa,CAAC;AAC/C;AAIA,SAAgB,IAAqB;CACnC,IAAM,IAAS,OAAO,aAAa,QAAQ,QAAQ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY;CAC/E,IAAI,GAAQ,OAAO;CACnB,IAAM,IAAU,EAAiB,EAAe,CAAC,KAAK,CAAC;CACvD,OAAO,OAAO,EAAQ,QAAQ,EAAQ,YAAY,EAAQ,aAAa,EAAQ,WAAW,EAAQ,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY;AACrI;AAEA,SAAgB,IAAe;CAE7B,IAAM,IAAU,EADF,EAAe,KAAK,aAAa,QAAQ,CAAc,CAC/B,GAChC,oBAAQ,IAAI,IAAI,GAChB,IAAS,EAAmB;CAWlC,OAVI,KAAQ,EAAM,IAAI,CAAM,GACxB,OACD,GAAS,cAAc,SAAS,CAAC,EAAA,CAAG,SAAS,MAAS,EAAM,IAAI,CAAI,CAAC,GACtE,OAAO,OAAO,GAAS,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,MAAW;EAChE,CAAC,GAAQ,SAAS,CAAC,EAAA,CAAG,SAAS,MAAS,EAAM,IAAI,CAAI,CAAC;CACzD,CAAC,GACD;EAAC,GAAS;EAAM,GAAS;EAAU,GAAS;CAAS,CAAC,CAAC,SAAS,MAAS;EACvE,AAAI,KAAM,EAAM,IAAI,CAAI;CAC1B,CAAC,IAEI,MAAM,KAAK,CAAK,CAAC,CAAC,KAAK,MAAS,OAAO,CAAI,CAAC,CAAC,YAAY,CAAC;AACnE;AAEA,SAAgB,IAAW;CACzB,OAAO,EAAmB,MAAM,YAAY,EAAa,CAAC,CAAC,SAAS,QAAQ;AAC9E;AAOA,SAAgB,IAAoB;CAClC,IAAM,IAAU,EAAiB,EAAe,KAAK,aAAa,QAAQ,CAAc,CAAC,KAAK,CAAC,GACzF,KAAO,MAAU;EACrB,IAAI,KAAiC,QAAQ,MAAU,IAAI;EAC3D,IAAM,IAAS,OAAO,CAAK;EAC3B,OAAO,OAAO,SAAS,CAAM,IAAI,IAAS,KAAA;CAC5C;CACA,OAAO;EACL,QAAQ,EAAI,EAAQ,WAAW,EAAQ,MAAM,KAAK,EAAI,aAAa,QAAQ,QAAQ,CAAC;EACpF,QAAQ,EAAI,EAAQ,UAAU,EAAQ,OAAO;CAC/C;AACF;AAIA,SAAgB,EAAmB,GAAS;CACrC,MACL,aAAa,QAAQ,GAAmB,OAAO,EAAQ,EAAE,CAAC,GAC1D,aAAa,QAAQ,GAAqB,OAAO,EAAQ,IAAI,CAAC;AAChE;AAEA,SAAgB,IAAqB;CACnC,IAAM,IAAK,aAAa,QAAQ,CAAiB,GAC3C,IAAO,aAAa,QAAQ,CAAmB;CAErD,OADI,CAAC,KAAM,CAAC,IAAa,OAClB;EAAE,IAAI,OAAO,CAAE;EAAG;CAAK;AAChC;AAEA,SAAgB,IAAuB;CAErC,AADA,aAAa,WAAW,CAAiB,GACzC,aAAa,WAAW,CAAmB;AAC7C;AAIA,eAAsB,EAAM,GAAa;CAsCvC,OArCI,MAEJ,IAAe,MAAM,GAAG,EAAS,SAAS;EACxC,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU,CAAW;CAClC,CAAC,CAAC,CACC,KAAK,OAAO,MAAQ;EACnB,IAAM,IAAO,MAAM,EAAI,KAAK;EAC5B,IAAI,CAAC,EAAI,MAAM,GAAuB,CAAI,GAAG;GAC3C,IAAM,IAAY,MAChB,EAAyB,GAAM,iBAAiB,EAAI,QAAQ,CAC9D;GAGA,MAFA,EAAM,SAAS,EAAI,QACnB,EAAM,WAAW,GACX;EACR;EAEA,IAAM,IAAQ,EAAa,CAAI;EAC/B,IAAI,CAAC,GAAO;GACV,IAAM,IAAY,MAChB,EAAyB,GAAM,4BAA4B,CAC7D;GAGA,MAFA,EAAM,SAAS,EAAI,QACnB,EAAM,WAAW,GACX;EACR;EACA,IAAM,IAAO,GAAY,CAAI;EAM7B,OALA,aAAa,QAAQ,GAAgB,CAAK,GACtC,KAAM,aAAa,QAAQ,GAAe,KAAK,UAAU,CAAI,CAAC,GAClE,GAAqB,GAAM,GAAO,CAAI,GAEtC,OAAO,cAAc,IAAI,MAAM,YAAY,CAAC,GACrC;GAAE;GAAO;GAAM,UAAU;EAAK;CACvC,CAAC,CAAC,CACD,cAAc;EAAE,IAAe;CAAM,CAAC,GAElC;AACT;AAEA,SAAS,EAAiB,GAAO,IAAc,IAAI;CACjD,IAAM,IAAU,EAAiB,CAAK,GAChC,IAAM,OAAO,GAAS,GAAG;CAE/B,OADI,CAAC,OAAO,SAAS,CAAG,KAAK,KAAO,IAAU,KACvC,IAAM,OAAQ,KAAK,IAAI,IAAI,IAAc;AAClD;AAEA,SAAS,EAA4B,GAAM;CACzC,IAAM,IAAQ,EAAa,CAAI;CAC/B,IAAI,CAAC,GAAO,OAAO;CAEnB,AADA,aAAa,QAAQ,GAAgB,CAAK,GAC1C,aAAa,QAAQ,gBAAgB,CAAK;CAC1C,IAAM,IAAO,GAAM,QAAQ,GACrB,IAAY,GAAM,cAAc,GAAM;CAE5C,OADI,MAAc,KAAA,KAAW,aAAa,QAAQ,cAAc,OAAO,CAAS,CAAC,GAC1E;AACT;AAEA,eAAsB,IAAqB;CACzC,IAAI,GAAgB,OAAO;CAC3B,IAAM,IAAe,OAAO,aAAa,QAAQ,eAAe,KAAK,EAAE,CAAC,CAAC,KAAK;CAC9E,IAAI,CAAC,GAAc;EACjB,IAAM,IAAQ,gBAAI,MAAM,iBAAiB;EAEzC,MADA,EAAM,SAAS,KACT;CACR;CAkBA,OAjBA,IAAiB,MAAM,GAAG,EAAS,0BAA0B;EAC3D,QAAQ;EACR,SAAS,EAAU,EAAE,gBAAgB,mBAAmB,CAAC;EACzD,MAAM,KAAK,UAAU,EAAE,eAAe,EAAa,CAAC;CACtD,CAAC,CAAC,CAAC,KAAK,OAAO,MAAQ;EACrB,IAAM,IAAO,MAAM,EAAI,KAAK,GACxB,IAAO,CAAC;EACZ,IAAI,GAAQ,IAAI;GAAE,IAAO,KAAK,MAAM,CAAI;EAAG,QAAQ;GAAE,IAAO,EAAE,OAAO,EAAK;EAAG;EAC7E,IAAI,CAAC,EAAI,IAAI;GACX,IAAM,IAAY,MAAM,GAAM,SAAS,GAAM,WAAW,yBAAyB,EAAI,QAAQ;GAE7F,MADA,EAAM,SAAS,EAAI,QACb;EACR;EACA,IAAM,IAAQ,EAA4B,CAAI;EAC9C,IAAI,CAAC,GAAO;GAAE,IAAM,IAAQ,gBAAI,MAAM,wDAAwD;GAAuB,MAApB,EAAM,SAAS,KAAW;EAAO;EAClI,OAAO;CACT,CAAC,CAAC,CAAC,cAAc;EAAE,IAAiB;CAAM,CAAC,GACpC;AACT;AAIA,eAAsB,IAAc;CAClC,IAAM,IAAQ,EAAe;CAC7B,IAAI,KAAS,CAAC,EAAiB,CAAK,GAAG,OAAO;CAC9C,IAAI,aAAa,QAAQ,eAAe,GACtC,IAAI;EAAE,OAAO,MAAM,EAAmB;CAAG,QAAQ,CAAwC;CAE3F,IAAI,GAAO,OAAO;CAClB,IAAM,IAAQ,gBAAI,MAAM,yBAAyB;CAEjD,MADA,EAAM,SAAS,KACT;AACR;AAEA,eAAe,KAAc;CAO3B,OAAO,EAAU;EACf,gBAAgB;EAChB,eAAe,UAAU,MARP,EAAY;CAShC,CAAC;AACH;AAkDA,IAAM,KAAa,KAEb,oBAAe,IAAI,IAAI,GACvB,oBAAc,IAAI,IAAI;AAG5B,SAAgB,IAAqB;CACnC,EAAY,MAAM;AACpB;AAEA,SAAS,EAAa,GAAM;CAI1B,IAAI;EACF,OAAO,OAAO,mBAAoB,aAAa,gBAAgB,CAAI,IAAI,KAAK,MAAM,KAAK,UAAU,CAAI,CAAC;CACxG,QAAQ;EAGN,OAAO;CACT;AACF;AAEA,SAAS,EAAM,GAAS;CAEtB,QADgB,GAAS,UAAU,MAAA,CAAO,YACnC,MAAW;AACpB;AAEA,eAAsB,EAAkB,GAAS,IAAO,IAAI,IAAU,CAAC,GAAG;CACxE,AAAI,KAAQ,OAAO,KAAS,aAC1B,IAAU,GACV,IAAO;CAGT,IAAM,IAAM,GAAG,IAAU,KAAQ;CACjC,IAAI,EAAM,CAAO,GAAG;EAClB,IAAM,IAAU,EAAa,IAAI,CAAG;EACpC,IAAI,GAAS,OAAO,EAAa,MAAM,CAAO;EAC9C,IAAM,IAAU,EAAY,IAAI,CAAG;EACnC,IAAI,KAAW,KAAK,IAAI,IAAI,EAAQ,KAAK,IAAY,OAAO,EAAa,EAAQ,IAAI;EAGrF,AAAI,KAAS,EAAY,OAAO,CAAG;CACrC;CAEA,IAAI,CAAC,EAAM,CAAO,GAAG;EAInB,EAAmB;EACnB,IAAI;GACF,OAAO,MAAM,EAAa,GAAK,CAAO;EACxC,UAAU;GACR,EAAmB;EACrB;CACF;CAEA,IAAM,IAAM,EAAa,GAAK,CAAO;CACrC,EAAa,IAAI,GAAK,CAAG;CACzB,IAAI;EAIF,IAAM,IAAO,MAAM;EAEnB,OADA,EAAY,IAAI,GAAK;GAAE,IAAI,KAAK,IAAI;GAAG;EAAK,CAAC,GACtC,EAAa,CAAI;CAC1B,UAAU;EAGR,EAAa,OAAO,CAAG;CACzB;AACF;AAEA,eAAe,EAAa,GAAK,IAAU,CAAC,GAAG;CAC7C,IAAM,IAAY,YAAY;EAC5B,IAAM,IAAU,MAAM,GAAY;EAClC,OAAO,MAAM,GAAK;GAAE,GAAG;GAAS,SAAS;IAAE,GAAG;IAAS,GAAG,EAAQ;GAAQ;EAAE,CAAC;CAC/E,GAEI,IAAM,MAAM,EAAU;CAC1B,IAAI,EAAI,WAAW,OAAO,aAAa,QAAQ,eAAe,GAC5D,IAAI;EAEF,AADA,MAAM,EAAmB,GACzB,IAAM,MAAM,EAAU;CACxB,QAAQ,CAER;CAEF,AAAI,EAAI,WAAW,OAAK,EAAO;CAE/B,IAAM,IAAO,MAAM,EAAI,KAAK,GACxB,IAAO,CAAC;CACZ,IAAI,GACF,IAAI;EAAE,IAAO,KAAK,MAAM,CAAI;CAAG,QAAQ;EAAE,IAAO,EAAE,OAAO,EAAK;CAAG;CAEnE,IAAI,CAAC,EAAI,IAAI;EACX,IAAM,IAAgB,GAAM,SAAS,GAAM,SACrC,IAAS,OAAO,KAAkB,WACpC,IACA,KAAiB,OAAO,KAAK,CAAa,CAAC,CAAC,SAAS,IACnD,KAAK,UAAU,CAAa,IAC5B,IACA,IAAY,MAAM,KAAU,OAAO,EAAI,OAAO,IAAI,EAAI,YAAY;EAGxE,MAFA,EAAM,SAAS,EAAI,QACnB,EAAM,WAAW,GACX;CACR;CACA,OAAO;AACT;AAEA,eAAsB,EAAe,GAAS,GAAM;CAClD,IAAM,IAAO,MAAM,EAAkB,GAAS,CAAI;CAClD,OAAO,EAAK,QAAQ;AACtB"}

package/dist-lib/authApi-alaedMzE.cjs

@@ -0,0 +1,2 @@
+const e=require("./rolldown-runtime-Chgba0Kb.cjs");var t={VITE_AUTH_URL:void 0,VITE_ADMIN_API_URL:void 0,VITE_ADMIN_APP_ID:void 0,VITE_SUBMISSIONS_URL:void 0,VITE_JOBS_URL:void 0,VITE_CANDIDATES_URL:void 0,VITE_PYOPS_URL:void 0,VITE_APP_ID:void 0};function n(e){return typeof window<`u`&&window.__CORE_THEME_CONFIG__&&window.__CORE_THEME_CONFIG__[e]!=null?window.__CORE_THEME_CONFIG__[e]:t[e]}function r(e,t=``){return{toString:()=>n(e)||(typeof t==`function`?t():t),valueOf:()=>n(e)||(typeof t==`function`?t():t),[Symbol.toPrimitive]:()=>n(e)||(typeof t==`function`?t():t)}}function i(e,...t){return r(e,()=>{for(let e of t){let t=typeof e==`function`?e():e;if(t)return String(t).replace(/\/+$/,``)}return``})}var a=()=>{let e=n(`VITE_GATEWAY_URL`);return e?String(e).replace(/\/+$/,``):``},o=i(`VITE_CORE_URL`,()=>a()?a()+`/becoretheme`:``),s=i(`VITE_ZINNEXT_URL`,()=>a()?a()+`/bezinnext`:``),c=i(`VITE_PYOPS_URL`,()=>a()?a()+`/pyops/v1`:``),ee=r(`VITE_GATEWAY_URL`),l=i(`VITE_AUTH_URL`,()=>String(o)?String(o)+`/v1`:``),u=i(`VITE_JOBS_URL`,()=>String(o)?String(o)+`/jobs/v1`:``),d=i(`VITE_SUBMISSIONS_URL`,()=>String(o)?String(o)+`/submissions/v1`:``),f=i(`VITE_CANDIDATES_URL`,()=>String(o)?String(o)+`/candidates/v1`:``),p=i(`VITE_ADMIN_API_URL`,()=>n(`VITE_AUTH_URL`)||(String(o)?String(o)+`/v1`:``)),te=r(`VITE_ADMIN_APP_ID`,()=>n(`VITE_APP_ID`)||`zinnext-dev-api-v1`),m=r(`VITE_APP_ID`);function h(e={}){let t=n(`VITE_APP_ID`);return t?{"X-App-Id":t,...e}:{...e}}function ne(e={}){let t=n(`VITE_ADMIN_APP_ID`)||n(`VITE_APP_ID`)||`zinnext-dev-api-v1`;return t?{"X-App-Id":t,...e}:{...e}}function g(){if(typeof window>`u`||typeof window.fetch!=`function`||window.__CORE_THEME_APP_ID_PATCHED__)return;let e=[l,p,d,u,f,c],t=window.fetch.bind(window),r=e=>typeof e==`string`?e:e instanceof URL?e.href:e&&typeof e.url==`string`?e.url:``,i=t=>!!t&&e.some(e=>{let n=String(e);return n&&t.startsWith(n)});window.fetch=function(e,a){try{let o=r(e),s=String(p)&&o.startsWith(String(p))?n(`VITE_ADMIN_APP_ID`)||n(`VITE_APP_ID`)||`zinnext-dev-api-v1`:n(`VITE_APP_ID`);if(s&&i(o)){let n=typeof Request<`u`&&e instanceof Request,r=new Headers(a&&a.headers||(n?e.headers:void 0));return r.has(`X-App-Id`)||r.set(`X-App-Id`,s),n&&!(a&&a.headers)?t(new Request(e,{headers:r}),a):t(e,{...a||{},headers:r})}}catch{}return t(e,a)},window.__CORE_THEME_APP_ID_PATCHED__=!0}g();function re(e={}){typeof window>`u`||(window.__CORE_THEME_CONFIG__={...window.__CORE_THEME_CONFIG__||{},...e},g())}var ie=e.t({apiGetWithAuth:()=>$,clearAuthTokenOverride:()=>E,clearSelectedProject:()=>B,ensureToken:()=>G,fetchJsonWithAuth:()=>Z,getActingIdentity:()=>L,getCurrentRoleName:()=>P,getSelectedProject:()=>z,getStoredToken:()=>j,getStoredUser:()=>M,getUserRoles:()=>F,invalidateGetCache:()=>J,isTester:()=>I,login:()=>V,logout:()=>N,refreshAccessToken:()=>W,setAuthTokenOverride:()=>T,setSelectedProject:()=>R}),_=`authToken`,v=`authUser`,ae=`authLoginSession`,y=`ct_project_id`,b=`ct_project_name`,x=[`access_token`,`refresh_token`,`id_token`,`token_type`,`expires_in`,`refresh_expires_in`,`menu`,`footermenu`,`menuPermission`,`default_values`,`roleId`,`companyName`,`preferred_Username`,`user_Email`,`userName`,`userId`,`tenantId`,`businessId`,`businessUnitId`,`activeKey`,`ct_project_id`,`ct_project_name`],S=null,C=null,w=null;function T(e){w=typeof e==`string`&&e.trim()?e.trim():null}function E(){w=null}function D(e){return e?.token??e?.access_token??e?.accessToken??e?.jwt??e?.data?.token??e?.data?.access_token??e?.data?.accessToken??e?.data?.jwt}function oe(e){return e?.user??e?.data?.user??e?.data?.profile??null}function O(e,t=``){let n=[e?.message,e?.error,e?.data?.message,e?.data?.error,e?.error?.message,e?.data?.error?.message];for(let e of n)if(typeof e==`string`&&e.trim())return e.trim();return t}function se(e){return e?.status===!1||e?.success===!1||e?.data?.status===!1||e?.data?.success===!1}function k(e){if(!e||typeof e!=`string`)return null;try{let t=e.split(`.`)[1];if(!t)return null;let n=t.replace(/-/g,`+`).replace(/_/g,`/`);return JSON.parse(atob(n.padEnd(Math.ceil(n.length/4)*4,`=`)))}catch{return null}}function A(e,t){t!=null&&localStorage.setItem(e,JSON.stringify(t))}function ce(e,t){return t?.menus??e?.menus??{menu:t?.menu??e?.menu,footermenu:t?.footermenu??e?.footermenu}}function le(e,t,n){let r=e?.data??e,i=k(t)??{},a=ce(e,r),o=n?.userName??n?.name??r?.userName??r?.name??i.userName??i.name??i.preferred_username??i.email,s=n?.preferred_Username??n?.preferred_username??r?.preferred_Username??r?.preferred_username??i.preferred_Username??i.preferred_username??i.email??o,c=n?.email??r?.email??i.email??s;localStorage.setItem(`access_token`,t),r?.refresh_token&&localStorage.setItem(`refresh_token`,r.refresh_token),r?.id_token!==void 0&&localStorage.setItem(`id_token`,r.id_token),r?.token_type&&localStorage.setItem(`token_type`,r.token_type),r?.expires_in!==void 0&&localStorage.setItem(`expires_in`,String(r.expires_in)),r?.refresh_expires_in!==void 0&&localStorage.setItem(`refresh_expires_in`,String(r.refresh_expires_in)),o&&localStorage.setItem(`userName`,o),s&&localStorage.setItem(`preferred_Username`,s),c&&localStorage.setItem(`user_Email`,c),(r?.roleId??i.role_id)&&localStorage.setItem(`roleId`,r?.roleId??i.role_id),r?.companyName&&localStorage.setItem(`companyName`,r.companyName),i.userId!==void 0&&localStorage.setItem(`userId`,String(i.userId)),i.tenantId&&localStorage.setItem(`tenantId`,i.tenantId),i.businessId&&localStorage.setItem(`businessId`,i.businessId),i.businessUnitId&&localStorage.setItem(`businessUnitId`,i.businessUnitId),A(`menu`,a.menu),A(`footermenu`,a.footermenu),A(`menuPermission`,r?.menuPermission),A(`default_values`,r?.default_values)}function j(){return w||localStorage.getItem(_)}function M(){try{let e=localStorage.getItem(v);if(e)return JSON.parse(e)}catch{}return{userId:localStorage.getItem(`userId`),username:localStorage.getItem(`userName`)||localStorage.getItem(`preferred_Username`),email:localStorage.getItem(`user_Email`),roleId:localStorage.getItem(`roleId`)}}function N(){J(),localStorage.removeItem(_),localStorage.removeItem(v),x.forEach(e=>localStorage.removeItem(e)),sessionStorage.removeItem(ae),window.dispatchEvent(new Event(`auth:logout`))}function P(){let e=String(localStorage.getItem(`roleId`)??``).trim().toLowerCase();if(e)return e;let t=k(j())??{};return String(t.role??t.roleName??t.role_name??t.role_id??t.roleId??``).trim().toLowerCase()}function F(){let e=k(j()??localStorage.getItem(_)),t=new Set,n=P();return n&&t.add(n),e&&((e?.realm_access?.roles??[]).forEach(e=>t.add(e)),Object.values(e?.resource_access??{}).forEach(e=>{(e?.roles??[]).forEach(e=>t.add(e))}),[e?.role,e?.roleName,e?.role_name].forEach(e=>{e&&t.add(e)})),Array.from(t).map(e=>String(e).toLowerCase())}function I(){return P()===`tester`||F().includes(`tester`)}function L(){let e=k(j()??localStorage.getItem(_))??{},t=e=>{if(e==null||e===``)return;let t=Number(e);return Number.isFinite(t)?t:void 0};return{roleId:t(e.role_id??e.roleId)??t(localStorage.getItem(`roleId`)),userId:t(e.userId??e.user_id)}}function R(e){e&&(localStorage.setItem(y,String(e.id)),localStorage.setItem(b,String(e.name)))}function z(){let e=localStorage.getItem(y),t=localStorage.getItem(b);return!e||!t?null:{id:Number(e),name:t}}function B(){localStorage.removeItem(y),localStorage.removeItem(b)}async function V(e){return S||(S=fetch(`${l}/login`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify(e)}).then(async e=>{let t=await e.json();if(!e.ok||se(t)){let n=Error(O(t,`Login failed: ${e.status}`));throw n.status=e.status,n.response=t,n}let n=D(t);if(!n){let n=Error(O(t,`No token in login response`));throw n.status=e.status,n.response=t,n}let r=oe(t);return localStorage.setItem(_,n),r&&localStorage.setItem(v,JSON.stringify(r)),le(t,n,r),window.dispatchEvent(new Event(`auth:login`)),{token:n,user:r,response:t}}).finally(()=>{S=null}),S)}function H(e,t=30){let n=k(e),r=Number(n?.exp);return!Number.isFinite(r)||r<=0?!1:r*1e3<=Date.now()+t*1e3}function U(e){let t=D(e);if(!t)return``;localStorage.setItem(_,t),localStorage.setItem(`access_token`,t);let n=e?.data??e,r=n?.expires_in??n?.accessTokenExpiresIn;return r!==void 0&&localStorage.setItem(`expires_in`,String(r)),t}async function W(){if(C)return C;let e=String(localStorage.getItem(`refresh_token`)??``).trim();if(!e){let e=Error(`Session expired`);throw e.status=401,e}return C=fetch(`${l}/generate-refresh-token`,{method:`POST`,headers:h({"Content-Type":`application/json`}),body:JSON.stringify({refresh_token:e})}).then(async e=>{let t=await e.text(),n={};if(t)try{n=JSON.parse(t)}catch{n={error:t}}if(!e.ok){let t=Error(n?.error??n?.message??`Token refresh failed: ${e.status}`);throw t.status=e.status,t}let r=U(n);if(!r){let e=Error(`Token refresh response did not contain an access token`);throw e.status=401,e}return r}).finally(()=>{C=null}),C}async function G(){let e=j();if(e&&!H(e))return e;if(localStorage.getItem(`refresh_token`))try{return await W()}catch{}if(e)return e;let t=Error(`Authentication required`);throw t.status=401,t}async function ue(){return h({"Content-Type":`application/json`,Authorization:`Bearer ${await G()}`})}var de=4e3,K=new Map,q=new Map;function J(){q.clear()}function Y(e){try{return typeof structuredClone==`function`?structuredClone(e):JSON.parse(JSON.stringify(e))}catch{return e}}function X(e){return(e?.method??`GET`).toUpperCase()===`GET`}async function Z(e,t=``,n={}){t&&typeof t==`object`&&(n=t,t=``);let r=`${e}${t||``}`;if(X(n)){let e=K.get(r);if(e)return Y(await e);let t=q.get(r);if(t&&Date.now()-t.at<de)return Y(t.json);t&&q.delete(r)}if(!X(n)){J();try{return await Q(r,n)}finally{J()}}let i=Q(r,n);K.set(r,i);try{let e=await i;return q.set(r,{at:Date.now(),json:e}),Y(e)}finally{K.delete(r)}}async function Q(e,t={}){let n=async()=>{let n=await ue();return fetch(e,{...t,headers:{...n,...t.headers}})},r=await n();if(r.status===401&&localStorage.getItem(`refresh_token`))try{await W(),r=await n()}catch{}r.status===401&&N();let i=await r.text(),a={};if(i)try{a=JSON.parse(i)}catch{a={error:i}}if(!r.ok){let e=a?.error??a?.message,t=typeof e==`string`?e:e&&Object.keys(e).length>0?JSON.stringify(e):``,n=Error(t||`API ${r.status}: ${r.statusText}`);throw n.status=r.status,n.response=a,n}return a}async function $(e,t){let n=await Z(e,t);return n.data??n}Object.defineProperty(exports,"A",{enumerable:!0,get:function(){return ne}}),Object.defineProperty(exports,"C",{enumerable:!0,get:function(){return o}}),Object.defineProperty(exports,"D",{enumerable:!0,get:function(){return d}}),Object.defineProperty(exports,"E",{enumerable:!0,get:function(){return c}}),Object.defineProperty(exports,"O",{enumerable:!0,get:function(){return s}}),Object.defineProperty(exports,"S",{enumerable:!0,get:function(){return f}}),Object.defineProperty(exports,"T",{enumerable:!0,get:function(){return u}}),Object.defineProperty(exports,"_",{enumerable:!0,get:function(){return R}}),Object.defineProperty(exports,"a",{enumerable:!0,get:function(){return G}}),Object.defineProperty(exports,"b",{enumerable:!0,get:function(){return m}}),Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return P}}),Object.defineProperty(exports,"d",{enumerable:!0,get:function(){return M}}),Object.defineProperty(exports,"f",{enumerable:!0,get:function(){return F}}),Object.defineProperty(exports,"g",{enumerable:!0,get:function(){return T}}),Object.defineProperty(exports,"h",{enumerable:!0,get:function(){return N}}),Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return B}}),Object.defineProperty(exports,"j",{enumerable:!0,get:function(){return h}}),Object.defineProperty(exports,"k",{enumerable:!0,get:function(){return re}}),Object.defineProperty(exports,"l",{enumerable:!0,get:function(){return z}}),Object.defineProperty(exports,"m",{enumerable:!0,get:function(){return V}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return ie}}),Object.defineProperty(exports,"o",{enumerable:!0,get:function(){return Z}}),Object.defineProperty(exports,"p",{enumerable:!0,get:function(){return I}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return E}}),Object.defineProperty(exports,"s",{enumerable:!0,get:function(){return L}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return $}}),Object.defineProperty(exports,"u",{enumerable:!0,get:function(){return j}}),Object.defineProperty(exports,"v",{enumerable:!0,get:function(){return p}}),Object.defineProperty(exports,"w",{enumerable:!0,get:function(){return ee}}),Object.defineProperty(exports,"x",{enumerable:!0,get:function(){return l}}),Object.defineProperty(exports,"y",{enumerable:!0,get:function(){return te}});
+//# sourceMappingURL=authApi-alaedMzE.cjs.map

package/dist-lib/authApi-alaedMzE.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authApi-alaedMzE.cjs","names":[],"sources":["../src/services/apiConfig.js","../src/services/authApi.js"],"sourcesContent":["// Central API base URLs.\n//\n// When CORE-THEME runs standalone (npm run dev), the values come from\n// src/services/.env (Vite VITE_* vars, baked in at build time).\n//\n// When CORE-THEME is consumed as the published @realtek/core-theme package,\n// host apps can override these values at RUNTIME by setting\n// `window.__CORE_THEME_CONFIG__` before the app renders:\n//\n//   <script>\n//     window.__CORE_THEME_CONFIG__ = {\n//       VITE_CORE_URL:    'http://host:9010/becoretheme', // common platform\n//       VITE_ZINNEXT_URL: 'http://host:9011/bezinnext',   // app-specific\n//       VITE_PYOPS_URL:   'http://host:9010/pyops/v1',    // AI actions\n//       VITE_APP_ID:      'zinnext',  // sent as the `X-App-Id` header on every call\n//     };\n//   </script>\n//\n// Priority: runtime window config  >  build-time .env fallback.\n\nconst BUILD_TIME_FALLBACK = {\n  VITE_AUTH_URL: import.meta.env.VITE_AUTH_URL,\n  VITE_ADMIN_API_URL: import.meta.env.VITE_ADMIN_API_URL,\n  VITE_ADMIN_APP_ID: import.meta.env.VITE_ADMIN_APP_ID,\n  VITE_SUBMISSIONS_URL: import.meta.env.VITE_SUBMISSIONS_URL,\n  VITE_JOBS_URL: import.meta.env.VITE_JOBS_URL,\n  VITE_CANDIDATES_URL: import.meta.env.VITE_CANDIDATES_URL,\n  VITE_PYOPS_URL: import.meta.env.VITE_PYOPS_URL,\n  VITE_APP_ID: import.meta.env.VITE_APP_ID,\n};\n\nfunction resolve(key) {\n  if (\n    typeof window !== 'undefined' &&\n    window.__CORE_THEME_CONFIG__ &&\n    window.__CORE_THEME_CONFIG__[key] != null\n  ) {\n    return window.__CORE_THEME_CONFIG__[key];\n  }\n  return BUILD_TIME_FALLBACK[key];\n}\n\nfunction runtimeValue(key, fallback = '') {\n  return {\n    toString: () => resolve(key) || (typeof fallback === 'function' ? fallback() : fallback),\n    valueOf: () => resolve(key) || (typeof fallback === 'function' ? fallback() : fallback),\n    [Symbol.toPrimitive]: () => resolve(key) || (typeof fallback === 'function' ? fallback() : fallback),\n  };\n}\n\n// These are intentionally dynamic. Many service files use them inside template\n// literals (`${AUTH_URL}/path`) or pass them to helpers that later build a URL.\n// ── Three backends, one gateway ────────────────────────────────────────────────\n//\n// The frontend now talks to THREE logical services, all served by the one\n// BE-CORE-THEME gateway:\n//\n//   VITE_CORE_URL     → becoretheme : the common platform (auth, jobs, candidates,\n//                                     submissions — everything both apps share)\n//   VITE_ZINNEXT_URL  → bezinnext   : zinnext-only features\n//   VITE_PYOPS_URL    → pyops       : the Python service (unchanged)\n//\n// A host configures these three (or just VITE_GATEWAY_URL and let them derive).\n// The four legacy per-domain constants below (AUTH_URL/JOBS_URL/SUBMISSIONS_URL/\n// CANDIDATES_URL) still exist so the many existing service files keep working —\n// they now resolve to origin sub-namespaces UNDER becoretheme. That sub-path is\n// what keeps the 6 dual-called paths (/notes via auth vs jobs, /delete via\n// candidates vs jobs, …) reaching the right backend; a flat URL could not.\n//\n// Precedence for each value: explicit VITE_*_URL > derived from CORE/ZINNEXT/\n// gateway > legacy direct fallback.\n\n// baseFrom returns the first non-empty of: explicit key, one of the fallbacks.\nfunction firstConfigured(explicitKey, ...fallbacks) {\n  return runtimeValue(explicitKey, () => {\n    for (const f of fallbacks) {\n      const v = typeof f === 'function' ? f() : f;\n      if (v) return String(v).replace(/\\/+$/, '');\n    }\n    return '';\n  });\n}\nconst gw = () => { const g = resolve('VITE_GATEWAY_URL'); return g ? String(g).replace(/\\/+$/, '') : ''; };\n\n// The three services. becoretheme/bezinnext default to gateway sub-paths.\nexport const CORE_URL = firstConfigured('VITE_CORE_URL', () => (gw() ? gw() + '/becoretheme' : ''));\nexport const ZINNEXT_URL = firstConfigured('VITE_ZINNEXT_URL', () => (gw() ? gw() + '/bezinnext' : ''));\n// AI actions go to the Python service, reached through the same gateway host.\nexport const PYOPS_URL = firstConfigured('VITE_PYOPS_URL', () => (gw() ? gw() + '/pyops/v1' : ''));\nexport const GATEWAY_URL = runtimeValue('VITE_GATEWAY_URL');\n\n// Legacy per-domain constants — now origin sub-namespaces under becoretheme.\n// An explicit VITE_*_URL still overrides, for pointing one backend elsewhere.\nexport const AUTH_URL = firstConfigured('VITE_AUTH_URL',\n  () => (String(CORE_URL) ? String(CORE_URL) + '/v1' : ''));\nexport const JOBS_URL = firstConfigured('VITE_JOBS_URL',\n  () => (String(CORE_URL) ? String(CORE_URL) + '/jobs/v1' : ''));\nexport const SUBMISSIONS_URL = firstConfigured('VITE_SUBMISSIONS_URL',\n  () => (String(CORE_URL) ? String(CORE_URL) + '/submissions/v1' : ''));\nexport const CANDIDATES_URL = firstConfigured('VITE_CANDIDATES_URL',\n  () => (String(CORE_URL) ? String(CORE_URL) + '/candidates/v1' : ''));\n\n// Admin calls ride the auth namespace under becoretheme (gateway routes\n// /v1/admin/* to the common platform), so this tracks AUTH_URL.\nexport const ADMIN_API_URL = firstConfigured('VITE_ADMIN_API_URL',\n  () => resolve('VITE_AUTH_URL') || (String(CORE_URL) ? String(CORE_URL) + '/v1' : ''));\nexport const ADMIN_APP_ID = runtimeValue('VITE_ADMIN_APP_ID', () => resolve('VITE_APP_ID') || 'zinnext-dev-api-v1');\n\n// App identifier sent as the `X-App-Id` header on every API request (e.g.\n// 'zinnext', 'lms'). Configured in ONE place — the host's window config (or the\n// build-time .env fallback) — and applied to all calls via the interceptor below.\nexport const APP_ID = runtimeValue('VITE_APP_ID');\n\n// Helper for code that builds headers explicitly: merges `X-App-Id` into a\n// header object without clobbering anything else. (The interceptor below already\n// covers existing calls; this is just a convenience for new code.)\nexport function withAppId(headers = {}) {\n  const appId = resolve('VITE_APP_ID');\n  return appId ? { 'X-App-Id': appId, ...headers } : { ...headers };\n}\n\nexport function withAdminAppId(headers = {}) {\n  const appId = resolve('VITE_ADMIN_APP_ID') || resolve('VITE_APP_ID') || 'zinnext-dev-api-v1';\n  return appId ? { 'X-App-Id': appId, ...headers } : { ...headers };\n}\n\n// ── X-App-Id interceptor ──────────────────────────────────────────────────────\n//\n// Rather than editing every inline `headers: {...}` across the service files\n// (and risking new calls forgetting it), we patch `fetch` ONCE so every request\n// to a configured API base URL carries `X-App-Id`. This is scoped strictly to the\n// four API origins, so third-party/asset requests are never touched, and any\n// caller that already set `X-App-Id` explicitly is left as-is.\nfunction installAppIdInterceptor() {\n  if (typeof window === 'undefined' || typeof window.fetch !== 'function') return;\n  // Guard against double-patching (repeated imports / Vite HMR).\n  if (window.__CORE_THEME_APP_ID_PATCHED__) return;\n\n  const apiBaseUrls = [AUTH_URL, ADMIN_API_URL, SUBMISSIONS_URL, JOBS_URL, CANDIDATES_URL, PYOPS_URL];\n  const originalFetch = window.fetch.bind(window);\n\n  const urlOf = (input) => {\n    if (typeof input === 'string') return input;\n    if (input instanceof URL) return input.href;\n    if (input && typeof input.url === 'string') return input.url; // Request object\n    return '';\n  };\n  const isApiRequest = (url) =>\n    !!url && apiBaseUrls.some((base) => {\n      const value = String(base);\n      return value && url.startsWith(value);\n    });\n\n  window.fetch = function patchedFetch(input, init) {\n    try {\n      const url = urlOf(input);\n      const isAdminRequest = String(ADMIN_API_URL) && url.startsWith(String(ADMIN_API_URL));\n      const appId = isAdminRequest\n        ? (resolve('VITE_ADMIN_APP_ID') || resolve('VITE_APP_ID') || 'zinnext-dev-api-v1')\n        : resolve('VITE_APP_ID');\n      if (appId && isApiRequest(url)) {\n        const isRequestObj = typeof Request !== 'undefined' && input instanceof Request;\n        const headers = new Headers(\n          (init && init.headers) || (isRequestObj ? input.headers : undefined),\n        );\n        if (!headers.has('X-App-Id')) headers.set('X-App-Id', appId);\n        if (isRequestObj && !(init && init.headers)) {\n          return originalFetch(new Request(input, { headers }), init);\n        }\n        return originalFetch(input, { ...(init || {}), headers });\n      }\n    } catch {\n      // Any unexpected argument shape: fall through to the untouched request.\n    }\n    return originalFetch(input, init);\n  };\n\n  window.__CORE_THEME_APP_ID_PATCHED__ = true;\n}\n\ninstallAppIdInterceptor();\n\n// Optional JS helper (alternative to the index.html <script>). Because the\n// exports above are resolved when this module first loads, call this BEFORE the\n// first import of @realtek/core-theme — e.g. in the host's index.html, not in\n// main.jsx (which runs after imports are evaluated). The index.html <script>\n// approach is the reliable one.\nexport function configureCoreTheme(config = {}) {\n  if (typeof window === 'undefined') return;\n  window.__CORE_THEME_CONFIG__ = { ...(window.__CORE_THEME_CONFIG__ || {}), ...config };\n  installAppIdInterceptor();\n}\n","import { AUTH_URL, withAppId } from './apiConfig';\n\nconst AUTH_TOKEN_KEY = 'authToken';\nconst AUTH_USER_KEY = 'authUser';\nconst AUTH_LOGIN_SESSION_KEY = 'authLoginSession';\nconst CT_PROJECT_ID_KEY = 'ct_project_id';\nconst CT_PROJECT_NAME_KEY = 'ct_project_name';\nconst LOGIN_STORAGE_KEYS = [\n  'access_token', 'refresh_token', 'id_token', 'token_type', 'expires_in',\n  'refresh_expires_in', 'menu', 'footermenu', 'menuPermission', 'default_values',\n  'roleId', 'companyName', 'preferred_Username', 'user_Email', 'userName',\n  'userId', 'tenantId', 'businessId', 'businessUnitId', 'activeKey',\n  'ct_project_id', 'ct_project_name',\n];\n\nlet loginPromise = null;\nlet refreshPromise = null;\nlet runtimeAuthToken = null;\n\nexport function setAuthTokenOverride(token) {\n  runtimeAuthToken = typeof token === 'string' && token.trim() ? token.trim() : null;\n}\n\nexport function clearAuthTokenOverride() {\n  runtimeAuthToken = null;\n}\n\nfunction extractToken(json) {\n  return (\n    json?.token ?? json?.access_token ?? json?.accessToken ?? json?.jwt ??\n    json?.data?.token ?? json?.data?.access_token ?? json?.data?.accessToken ?? json?.data?.jwt\n  );\n}\n\nfunction extractUser(json) {\n  return json?.user ?? json?.data?.user ?? json?.data?.profile ?? null;\n}\n\nfunction extractLoginErrorMessage(json, fallback = '') {\n  const candidates = [\n    json?.message,\n    json?.error,\n    json?.data?.message,\n    json?.data?.error,\n    json?.error?.message,\n    json?.data?.error?.message,\n  ];\n\n  for (const candidate of candidates) {\n    if (typeof candidate === 'string' && candidate.trim()) {\n      return candidate.trim();\n    }\n  }\n\n  return fallback;\n}\n\nfunction isLoginFailureResponse(json) {\n  return json?.status === false || json?.success === false || json?.data?.status === false || json?.data?.success === false;\n}\n\nfunction decodeJwtPayload(token) {\n  if (!token || typeof token !== 'string') return null;\n  try {\n    const payload = token.split('.')[1];\n    if (!payload) return null;\n    const normalized = payload.replace(/-/g, '+').replace(/_/g, '/');\n    return JSON.parse(atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=')));\n  } catch {\n    return null;\n  }\n}\n\nfunction setLocalStorageJson(key, value) {\n  if (value === undefined || value === null) return;\n  localStorage.setItem(key, JSON.stringify(value));\n}\n\nfunction getLoginMenus(json, data) {\n  return data?.menus ?? json?.menus ?? {\n    menu: data?.menu ?? json?.menu,\n    footermenu: data?.footermenu ?? json?.footermenu,\n  };\n}\n\nfunction persistLoginResponse(json, token, user) {\n  const data = json?.data ?? json;\n  const tokenPayload = decodeJwtPayload(token) ?? {};\n  const menus = getLoginMenus(json, data);\n  const userName = (\n    user?.userName ?? user?.name ?? data?.userName ?? data?.name ??\n    tokenPayload.userName ?? tokenPayload.name ?? tokenPayload.preferred_username ?? tokenPayload.email\n  );\n  const preferredUsername = (\n    user?.preferred_Username ?? user?.preferred_username ??\n    data?.preferred_Username ?? data?.preferred_username ??\n    tokenPayload.preferred_Username ?? tokenPayload.preferred_username ??\n    tokenPayload.email ?? userName\n  );\n  const userEmail = user?.email ?? data?.email ?? tokenPayload.email ?? preferredUsername;\n\n  localStorage.setItem('access_token', token);\n  if (data?.refresh_token) localStorage.setItem('refresh_token', data.refresh_token);\n  if (data?.id_token !== undefined) localStorage.setItem('id_token', data.id_token);\n  if (data?.token_type) localStorage.setItem('token_type', data.token_type);\n  if (data?.expires_in !== undefined) localStorage.setItem('expires_in', String(data.expires_in));\n  if (data?.refresh_expires_in !== undefined) localStorage.setItem('refresh_expires_in', String(data.refresh_expires_in));\n  if (userName) localStorage.setItem('userName', userName);\n  if (preferredUsername) localStorage.setItem('preferred_Username', preferredUsername);\n  if (userEmail) localStorage.setItem('user_Email', userEmail);\n  if (data?.roleId ?? tokenPayload.role_id) localStorage.setItem('roleId', data?.roleId ?? tokenPayload.role_id);\n  if (data?.companyName) localStorage.setItem('companyName', data.companyName);\n  if (tokenPayload.userId !== undefined) localStorage.setItem('userId', String(tokenPayload.userId));\n  if (tokenPayload.tenantId) localStorage.setItem('tenantId', tokenPayload.tenantId);\n  if (tokenPayload.businessId) localStorage.setItem('businessId', tokenPayload.businessId);\n  if (tokenPayload.businessUnitId) localStorage.setItem('businessUnitId', tokenPayload.businessUnitId);\n\n  setLocalStorageJson('menu', menus.menu);\n  setLocalStorageJson('footermenu', menus.footermenu);\n  setLocalStorageJson('menuPermission', data?.menuPermission);\n  setLocalStorageJson('default_values', data?.default_values);\n}\n\n// ── Token & Session ──────────────────────────────────────────────────────────\n\nexport function getStoredToken() {\n  if (runtimeAuthToken) return runtimeAuthToken;\n\n  // Authentication must be shared across browser tabs. `sessionStorage` is\n  // isolated per tab, so requiring authLoginSession here made a newly opened\n  // tab look logged out even though the valid token already existed in\n  // localStorage. The token (and refresh token) are the shared session source.\n  return localStorage.getItem(AUTH_TOKEN_KEY);\n}\n\nexport function getStoredUser() {\n  try {\n    const stored = localStorage.getItem(AUTH_USER_KEY);\n    if (stored) return JSON.parse(stored);\n  } catch {\n    // Fall through to the legacy login fields below.\n  }\n  return {\n    userId: localStorage.getItem('userId'),\n    username: localStorage.getItem('userName') || localStorage.getItem('preferred_Username'),\n    email: localStorage.getItem('user_Email'),\n    roleId: localStorage.getItem('roleId'),\n  };\n}\n\nexport function logout() {\n  // No response may outlive the session that was entitled to it.\n  invalidateGetCache();\n  localStorage.removeItem(AUTH_TOKEN_KEY);\n  localStorage.removeItem(AUTH_USER_KEY);\n  LOGIN_STORAGE_KEYS.forEach((key) => localStorage.removeItem(key));\n  sessionStorage.removeItem(AUTH_LOGIN_SESSION_KEY);\n  window.dispatchEvent(new Event('auth:logout'));\n}\n\n// ── Role Helpers ─────────────────────────────────────────────────────────────\n\nexport function getCurrentRoleName() {\n  const stored = String(localStorage.getItem('roleId') ?? '').trim().toLowerCase();\n  if (stored) return stored;\n  const payload = decodeJwtPayload(getStoredToken()) ?? {};\n  return String(payload.role ?? payload.roleName ?? payload.role_name ?? payload.role_id ?? payload.roleId ?? '').trim().toLowerCase();\n}\n\nexport function getUserRoles() {\n  const token = getStoredToken() ?? localStorage.getItem(AUTH_TOKEN_KEY);\n  const payload = decodeJwtPayload(token);\n  const roles = new Set();\n  const stored = getCurrentRoleName();\n  if (stored) roles.add(stored);\n  if (payload) {\n    (payload?.realm_access?.roles ?? []).forEach((role) => roles.add(role));\n    Object.values(payload?.resource_access ?? {}).forEach((client) => {\n      (client?.roles ?? []).forEach((role) => roles.add(role));\n    });\n    [payload?.role, payload?.roleName, payload?.role_name].forEach((role) => {\n      if (role) roles.add(role);\n    });\n  }\n  return Array.from(roles).map((role) => String(role).toLowerCase());\n}\n\nexport function isTester() {\n  return getCurrentRoleName() === 'tester' || getUserRoles().includes('tester');\n}\n\n// getActingIdentity returns the numeric {roleId, userId} of the logged-in user,\n// read from the auth token (falling back to the stored roleId). Used to evaluate\n// admin-configured field autoValueRules for UX only — the gateway re-evaluates\n// the same rules from the token and has the final say, so nothing here is a\n// security boundary.\nexport function getActingIdentity() {\n  const payload = decodeJwtPayload(getStoredToken() ?? localStorage.getItem(AUTH_TOKEN_KEY)) ?? {};\n  const num = (value) => {\n    if (value === undefined || value === null || value === '') return undefined;\n    const parsed = Number(value);\n    return Number.isFinite(parsed) ? parsed : undefined;\n  };\n  return {\n    roleId: num(payload.role_id ?? payload.roleId) ?? num(localStorage.getItem('roleId')),\n    userId: num(payload.userId ?? payload.user_id),\n  };\n}\n\n// ── Project Context ───────────────────────────────────────────────────────────\n\nexport function setSelectedProject(project) {\n  if (!project) return;\n  localStorage.setItem(CT_PROJECT_ID_KEY, String(project.id));\n  localStorage.setItem(CT_PROJECT_NAME_KEY, String(project.name));\n}\n\nexport function getSelectedProject() {\n  const id = localStorage.getItem(CT_PROJECT_ID_KEY);\n  const name = localStorage.getItem(CT_PROJECT_NAME_KEY);\n  if (!id || !name) return null;\n  return { id: Number(id), name };\n}\n\nexport function clearSelectedProject() {\n  localStorage.removeItem(CT_PROJECT_ID_KEY);\n  localStorage.removeItem(CT_PROJECT_NAME_KEY);\n}\n\n// ── Login ────────────────────────────────────────────────────────────────────\n\nexport async function login(credentials) {\n  if (loginPromise) return loginPromise;\n\n  loginPromise = fetch(`${AUTH_URL}/login`, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(credentials),\n  })\n    .then(async (res) => {\n      const json = await res.json();\n      if (!res.ok || isLoginFailureResponse(json)) {\n        const error = new Error(\n          extractLoginErrorMessage(json, `Login failed: ${res.status}`),\n        );\n        error.status = res.status;\n        error.response = json;\n        throw error;\n      }\n\n      const token = extractToken(json);\n      if (!token) {\n        const error = new Error(\n          extractLoginErrorMessage(json, 'No token in login response'),\n        );\n        error.status = res.status;\n        error.response = json;\n        throw error;\n      }\n      const user = extractUser(json);\n      localStorage.setItem(AUTH_TOKEN_KEY, token);\n      if (user) localStorage.setItem(AUTH_USER_KEY, JSON.stringify(user));\n      persistLoginResponse(json, token, user);\n      // Let any mounted AuthGuard re-check and reveal the protected content.\n      window.dispatchEvent(new Event('auth:login'));\n      return { token, user, response: json };\n    })\n    .finally(() => { loginPromise = null; });\n\n  return loginPromise;\n}\n\nfunction tokenExpiresSoon(token, skewSeconds = 30) {\n  const payload = decodeJwtPayload(token);\n  const exp = Number(payload?.exp);\n  if (!Number.isFinite(exp) || exp <= 0) return false;\n  return exp * 1000 <= Date.now() + skewSeconds * 1000;\n}\n\nfunction persistRefreshedAccessToken(json) {\n  const token = extractToken(json);\n  if (!token) return '';\n  localStorage.setItem(AUTH_TOKEN_KEY, token);\n  localStorage.setItem('access_token', token);\n  const data = json?.data ?? json;\n  const expiresIn = data?.expires_in ?? data?.accessTokenExpiresIn;\n  if (expiresIn !== undefined) localStorage.setItem('expires_in', String(expiresIn));\n  return token;\n}\n\nexport async function refreshAccessToken() {\n  if (refreshPromise) return refreshPromise;\n  const refreshToken = String(localStorage.getItem('refresh_token') ?? '').trim();\n  if (!refreshToken) {\n    const error = new Error('Session expired');\n    error.status = 401;\n    throw error;\n  }\n  refreshPromise = fetch(`${AUTH_URL}/generate-refresh-token`, {\n    method: 'POST',\n    headers: withAppId({ 'Content-Type': 'application/json' }),\n    body: JSON.stringify({ refresh_token: refreshToken }),\n  }).then(async (res) => {\n    const text = await res.text();\n    let json = {};\n    if (text) { try { json = JSON.parse(text); } catch { json = { error: text }; } }\n    if (!res.ok) {\n      const error = new Error(json?.error ?? json?.message ?? `Token refresh failed: ${res.status}`);\n      error.status = res.status;\n      throw error;\n    }\n    const token = persistRefreshedAccessToken(json);\n    if (!token) { const error = new Error('Token refresh response did not contain an access token'); error.status = 401; throw error; }\n    return token;\n  }).finally(() => { refreshPromise = null; });\n  return refreshPromise;\n}\n\n// ── HTTP Helpers (exported for use by other service files) ───────────────────\n\nexport async function ensureToken() {\n  const token = getStoredToken();\n  if (token && !tokenExpiresSoon(token)) return token;\n  if (localStorage.getItem('refresh_token')) {\n    try { return await refreshAccessToken(); } catch { /* handled by request retry/logout */ }\n  }\n  if (token) return token;\n  const error = new Error('Authentication required');\n  error.status = 401;\n  throw error;\n}\n\nasync function authHeaders() {\n  const token = await ensureToken();\n  // Normal application API calls must always target the currently selected\n  // project database. Do not let the global fetch interceptor infer this from\n  // the URL because AUTH_URL and ADMIN_API_URL may point to the same service.\n  // Explicit X-App-Id wins in the backend middleware and keeps runtime module\n  // data/master dropdowns scoped to VITE_APP_ID.\n  return withAppId({\n    'Content-Type': 'application/json',\n    Authorization: `Bearer ${token}`,\n  });\n}\n\n// ── GET in-flight coalescing ────────────────────────────────────────────────\n//\n// A page routinely asks for the SAME data several times over, because the parts\n// that need it are independent and none of them can know the others exist. Six\n// form fields that look up the same collection issue six identical requests;\n// the header and the body of a detail page each fetch the same record. Measured\n// on an ORDINARY edit form: 13 requests for 8 distinct URLs, one of them fired\n// six times.\n//\n// The honest fix is not to make each caller aware of the others — that couples\n// components that have no business knowing about each other, and breaks the\n// moment a new one is added. It is to make the REQUEST idempotent: a GET that\n// is already in the air is JOINED rather than reissued.\n//\n// Deliberately in-flight ONLY, with no time-to-live:\n//   • It cannot serve stale data. The answer a joiner receives is the answer to\n//     a request that had not yet returned when it asked — by definition no\n//     staler than issuing its own.\n//   • It needs no invalidation, so a write can never be shadowed by a cache\n//     entry, and no caller has to remember to clear anything.\n// A TTL would catch a few more (a child mounting just after its parent's fetch\n// resolved) at the cost of a staleness window on every endpoint in the app.\n// `formGroupsCache` already makes that trade deliberately for one endpoint it\n// understands; this layer, which knows nothing about what it is fetching,\n// should not make it for everything.\n//\n// Each joiner gets its OWN deep copy of the payload. Callers legitimately mutate\n// what they receive (dropdownApi attaches `recordMeta` to the groups array), and\n// handing several callers one shared object would turn a saved request into a\n// cross-component data bug — far worse than the duplicate it removed.\n//\n// A SHORT TIME-TO-LIVE sits on top of the coalescing, because not every\n// duplicate overlaps: a child that mounts just after its parent's fetch\n// resolved asks a moment too late to join it. That is the remaining half of the\n// \"same data, fetched again\" problem, and it is the half a pure in-flight join\n// cannot reach.\n//\n// This part CAN serve stale data, so it is bounded hard:\n//   • a few seconds only — long enough to cover one page's mount burst, short\n//     enough that no realistic user action fits inside it;\n//   • ANY non-GET clears the whole GET cache. A write is the one event that\n//     makes previously-fetched data wrong, so nothing a user saves can be\n//     shadowed by a stale entry;\n//   • logging out clears it too, so no response outlives the session that was\n//     entitled to it.\n// This mirrors the trade `formGroupsCache` already makes deliberately for one\n// endpoint; the difference is that the invalidation here is automatic rather\n// than something each caller has to remember.\nconst GET_TTL_MS = 4000;\n\nconst inFlightGets = new Map(); // url -> Promise<json>\nconst settledGets = new Map();  // url -> { at, json }\n\n// Cleared on every write and on logout — see the note above.\nexport function invalidateGetCache() {\n  settledGets.clear();\n}\n\nfunction clonePayload(json) {\n  // structuredClone is present in every browser this app supports and in Node\n  // 17+. Falling back to a JSON round-trip keeps older test environments\n  // working; both produce a copy no other caller can observe.\n  try {\n    return typeof structuredClone === 'function' ? structuredClone(json) : JSON.parse(JSON.stringify(json));\n  } catch {\n    // Non-cloneable payload (rare). Sharing the original is still correct for\n    // every caller that does not mutate, and is better than failing the call.\n    return json;\n  }\n}\n\nfunction isGet(options) {\n  const method = (options?.method ?? 'GET').toUpperCase();\n  return method === 'GET';\n}\n\nexport async function fetchJsonWithAuth(baseUrl, path = '', options = {}) {\n  if (path && typeof path === 'object') {\n    options = path;\n    path = '';\n  }\n\n  const url = `${baseUrl}${path || ''}`;\n  if (isGet(options)) {\n    const pending = inFlightGets.get(url);\n    if (pending) return clonePayload(await pending);\n    const settled = settledGets.get(url);\n    if (settled && Date.now() - settled.at < GET_TTL_MS) return clonePayload(settled.json);\n    // Expired: drop it now rather than leaving the map to grow for the rest of\n    // the session on a long-lived page.\n    if (settled) settledGets.delete(url);\n  }\n\n  if (!isGet(options)) {\n    // A write invalidates BEFORE it runs and again after it settles: before, so\n    // a GET fired concurrently with the save cannot repopulate the cache from\n    // pre-write state; after, so anything read during the write is dropped too.\n    invalidateGetCache();\n    try {\n      return await performFetch(url, options);\n    } finally {\n      invalidateGetCache();\n    }\n  }\n\n  const run = performFetch(url, options);\n  inFlightGets.set(url, run);\n  try {\n    // The ORIGINATING caller is cloned too, so no caller can tell whether it\n    // issued the request or joined one — otherwise a mutation would be safe or\n    // unsafe depending on render order, which is the worst kind of bug.\n    const json = await run;\n    settledGets.set(url, { at: Date.now(), json });\n    return clonePayload(json);\n  } finally {\n    // Cleared on success AND failure: a failed GET must not be inherited by\n    // anyone who asks next, they retry for real.\n    inFlightGets.delete(url);\n  }\n}\n\nasync function performFetch(url, options = {}) {\n  const doRequest = async () => {\n    const headers = await authHeaders();\n    return fetch(url, { ...options, headers: { ...headers, ...options.headers } });\n  };\n\n  let res = await doRequest();\n  if (res.status === 401 && localStorage.getItem('refresh_token')) {\n    try {\n      await refreshAccessToken();\n      res = await doRequest();\n    } catch {\n      // Only logout if the retry is still unauthorized.\n    }\n  }\n  if (res.status === 401) logout();\n\n  const text = await res.text();\n  let json = {};\n  if (text) {\n    try { json = JSON.parse(text); } catch { json = { error: text }; }\n  }\n  if (!res.ok) {\n    const responseError = json?.error ?? json?.message;\n    const detail = typeof responseError === 'string'\n      ? responseError\n      : responseError && Object.keys(responseError).length > 0\n        ? JSON.stringify(responseError)\n        : '';\n    const error = new Error(detail || `API ${res.status}: ${res.statusText}`);\n    error.status = res.status;\n    error.response = json;\n    throw error;\n  }\n  return json;\n}\n\nexport async function apiGetWithAuth(baseUrl, path) {\n  const json = await fetchJsonWithAuth(baseUrl, path);\n  return json.data ?? json;\n}\n"],"mappings":"mDAoBA,IAAM,EAAsB,CAC1B,cAAA,IAAA,GACA,mBAAA,IAAA,GACA,kBAAA,IAAA,GACA,qBAAA,IAAA,GACA,cAAA,IAAA,GACA,oBAAA,IAAA,GACA,eAAA,IAAA,GACA,YAAA,IAAA,EACF,EAEA,SAAS,EAAQ,EAAK,CAQpB,OANE,OAAO,OAAW,KAClB,OAAO,uBACP,OAAO,sBAAsB,IAAQ,KAE9B,OAAO,sBAAsB,GAE/B,EAAoB,EAC7B,CAEA,SAAS,EAAa,EAAK,EAAW,GAAI,CACxC,MAAO,CACL,aAAgB,EAAQ,CAAG,IAAM,OAAO,GAAa,WAAa,EAAS,EAAI,GAC/E,YAAe,EAAQ,CAAG,IAAM,OAAO,GAAa,WAAa,EAAS,EAAI,IAC7E,OAAO,iBAAoB,EAAQ,CAAG,IAAM,OAAO,GAAa,WAAa,EAAS,EAAI,EAC7F,CACF,CAyBA,SAAS,EAAgB,EAAa,GAAG,EAAW,CAClD,OAAO,EAAa,MAAmB,CACrC,IAAK,IAAM,KAAK,EAAW,CACzB,IAAM,EAAI,OAAO,GAAM,WAAa,EAAE,EAAI,EAC1C,GAAI,EAAG,OAAO,OAAO,CAAC,CAAC,CAAC,QAAQ,OAAQ,EAAE,CAC5C,CACA,MAAO,EACT,CAAC,CACH,CACA,IAAM,MAAW,CAAE,IAAM,EAAI,EAAQ,kBAAkB,EAAG,OAAO,EAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,OAAQ,EAAE,EAAI,EAAI,EAG5F,EAAW,EAAgB,oBAAwB,EAAG,EAAI,EAAG,EAAI,eAAiB,EAAG,EACrF,EAAc,EAAgB,uBAA2B,EAAG,EAAI,EAAG,EAAI,aAAe,EAAG,EAEzF,EAAY,EAAgB,qBAAyB,EAAG,EAAI,EAAG,EAAI,YAAc,EAAG,EACpF,GAAc,EAAa,kBAAkB,EAI7C,EAAW,EAAgB,oBAC/B,OAAO,CAAQ,EAAI,OAAO,CAAQ,EAAI,MAAQ,EAAG,EAC7C,EAAW,EAAgB,oBAC/B,OAAO,CAAQ,EAAI,OAAO,CAAQ,EAAI,WAAa,EAAG,EAClD,EAAkB,EAAgB,2BACtC,OAAO,CAAQ,EAAI,OAAO,CAAQ,EAAI,kBAAoB,EAAG,EACzD,EAAiB,EAAgB,0BACrC,OAAO,CAAQ,EAAI,OAAO,CAAQ,EAAI,iBAAmB,EAAG,EAIxD,EAAgB,EAAgB,yBACrC,EAAQ,eAAe,IAAM,OAAO,CAAQ,EAAI,OAAO,CAAQ,EAAI,MAAQ,GAAG,EACzE,GAAe,EAAa,wBAA2B,EAAQ,aAAa,GAAK,oBAAoB,EAKrG,EAAS,EAAa,aAAa,EAKhD,SAAgB,EAAU,EAAU,CAAC,EAAG,CACtC,IAAM,EAAQ,EAAQ,aAAa,EACnC,OAAO,EAAQ,CAAE,WAAY,EAAO,GAAG,CAAQ,EAAI,CAAE,GAAG,CAAQ,CAClE,CAEA,SAAgB,GAAe,EAAU,CAAC,EAAG,CAC3C,IAAM,EAAQ,EAAQ,mBAAmB,GAAK,EAAQ,aAAa,GAAK,qBACxE,OAAO,EAAQ,CAAE,WAAY,EAAO,GAAG,CAAQ,EAAI,CAAE,GAAG,CAAQ,CAClE,CASA,SAAS,GAA0B,CAGjC,GAFI,OAAO,OAAW,KAAe,OAAO,OAAO,OAAU,YAEzD,OAAO,8BAA+B,OAE1C,IAAM,EAAc,CAAC,EAAU,EAAe,EAAiB,EAAU,EAAgB,CAAS,EAC5F,EAAgB,OAAO,MAAM,KAAK,MAAM,EAExC,EAAS,GACT,OAAO,GAAU,SAAiB,EAClC,aAAiB,IAAY,EAAM,KACnC,GAAS,OAAO,EAAM,KAAQ,SAAiB,EAAM,IAClD,GAEH,EAAgB,GACpB,CAAC,CAAC,GAAO,EAAY,KAAM,GAAS,CAClC,IAAM,EAAQ,OAAO,CAAI,EACzB,OAAO,GAAS,EAAI,WAAW,CAAK,CACtC,CAAC,EAEH,OAAO,MAAQ,SAAsB,EAAO,EAAM,CAChD,GAAI,CACF,IAAM,EAAM,EAAM,CAAK,EAEjB,EADiB,OAAO,CAAa,GAAK,EAAI,WAAW,OAAO,CAAa,CAAC,EAE/E,EAAQ,mBAAmB,GAAK,EAAQ,aAAa,GAAK,qBAC3D,EAAQ,aAAa,EACzB,GAAI,GAAS,EAAa,CAAG,EAAG,CAC9B,IAAM,EAAe,OAAO,QAAY,KAAe,aAAiB,QAClE,EAAU,IAAI,QACjB,GAAQ,EAAK,UAAa,EAAe,EAAM,QAAU,IAAA,GAC5D,EAKA,OAJK,EAAQ,IAAI,UAAU,GAAG,EAAQ,IAAI,WAAY,CAAK,EACvD,GAAgB,EAAE,GAAQ,EAAK,SAC1B,EAAc,IAAI,QAAQ,EAAO,CAAE,SAAQ,CAAC,EAAG,CAAI,EAErD,EAAc,EAAO,CAAE,GAAI,GAAQ,CAAC,EAAI,SAAQ,CAAC,CAC1D,CACF,MAAQ,CAER,CACA,OAAO,EAAc,EAAO,CAAI,CAClC,EAEA,OAAO,8BAAgC,EACzC,CAEA,EAAwB,EAOxB,SAAgB,GAAmB,EAAS,CAAC,EAAG,CAC1C,OAAO,OAAW,MACtB,OAAO,sBAAwB,CAAE,GAAI,OAAO,uBAAyB,CAAC,EAAI,GAAG,CAAO,EACpF,EAAwB,EAC1B,0ZC7LM,EAAiB,YACjB,EAAgB,WAChB,GAAyB,mBACzB,EAAoB,gBACpB,EAAsB,kBACtB,EAAqB,CACzB,eAAgB,gBAAiB,WAAY,aAAc,aAC3D,qBAAsB,OAAQ,aAAc,iBAAkB,iBAC9D,SAAU,cAAe,qBAAsB,aAAc,WAC7D,SAAU,WAAY,aAAc,iBAAkB,YACtD,gBAAiB,iBACnB,EAEI,EAAe,KACf,EAAiB,KACjB,EAAmB,KAEvB,SAAgB,EAAqB,EAAO,CAC1C,EAAmB,OAAO,GAAU,UAAY,EAAM,KAAK,EAAI,EAAM,KAAK,EAAI,IAChF,CAEA,SAAgB,GAAyB,CACvC,EAAmB,IACrB,CAEA,SAAS,EAAa,EAAM,CAC1B,OACE,GAAM,OAAS,GAAM,cAAgB,GAAM,aAAe,GAAM,KAChE,GAAM,MAAM,OAAS,GAAM,MAAM,cAAgB,GAAM,MAAM,aAAe,GAAM,MAAM,GAE5F,CAEA,SAAS,GAAY,EAAM,CACzB,OAAO,GAAM,MAAQ,GAAM,MAAM,MAAQ,GAAM,MAAM,SAAW,IAClE,CAEA,SAAS,EAAyB,EAAM,EAAW,GAAI,CACrD,IAAM,EAAa,CACjB,GAAM,QACN,GAAM,MACN,GAAM,MAAM,QACZ,GAAM,MAAM,MACZ,GAAM,OAAO,QACb,GAAM,MAAM,OAAO,OACrB,EAEA,IAAK,IAAM,KAAa,EACtB,GAAI,OAAO,GAAc,UAAY,EAAU,KAAK,EAClD,OAAO,EAAU,KAAK,EAI1B,OAAO,CACT,CAEA,SAAS,GAAuB,EAAM,CACpC,OAAO,GAAM,SAAW,IAAS,GAAM,UAAY,IAAS,GAAM,MAAM,SAAW,IAAS,GAAM,MAAM,UAAY,EACtH,CAEA,SAAS,EAAiB,EAAO,CAC/B,GAAI,CAAC,GAAS,OAAO,GAAU,SAAU,OAAO,KAChD,GAAI,CACF,IAAM,EAAU,EAAM,MAAM,GAAG,CAAC,CAAC,GACjC,GAAI,CAAC,EAAS,OAAO,KACrB,IAAM,EAAa,EAAQ,QAAQ,KAAM,GAAG,CAAC,CAAC,QAAQ,KAAM,GAAG,EAC/D,OAAO,KAAK,MAAM,KAAK,EAAW,OAAO,KAAK,KAAK,EAAW,OAAS,CAAC,EAAI,EAAG,GAAG,CAAC,CAAC,CACtF,MAAQ,CACN,OAAO,IACT,CACF,CAEA,SAAS,EAAoB,EAAK,EAAO,CACnC,GAAiC,MACrC,aAAa,QAAQ,EAAK,KAAK,UAAU,CAAK,CAAC,CACjD,CAEA,SAAS,GAAc,EAAM,EAAM,CACjC,OAAO,GAAM,OAAS,GAAM,OAAS,CACnC,KAAM,GAAM,MAAQ,GAAM,KAC1B,WAAY,GAAM,YAAc,GAAM,UACxC,CACF,CAEA,SAAS,GAAqB,EAAM,EAAO,EAAM,CAC/C,IAAM,EAAO,GAAM,MAAQ,EACrB,EAAe,EAAiB,CAAK,GAAK,CAAC,EAC3C,EAAQ,GAAc,EAAM,CAAI,EAChC,EACJ,GAAM,UAAY,GAAM,MAAQ,GAAM,UAAY,GAAM,MACxD,EAAa,UAAY,EAAa,MAAQ,EAAa,oBAAsB,EAAa,MAE1F,EACJ,GAAM,oBAAsB,GAAM,oBAClC,GAAM,oBAAsB,GAAM,oBAClC,EAAa,oBAAsB,EAAa,oBAChD,EAAa,OAAS,EAElB,EAAY,GAAM,OAAS,GAAM,OAAS,EAAa,OAAS,EAEtE,aAAa,QAAQ,eAAgB,CAAK,EACtC,GAAM,eAAe,aAAa,QAAQ,gBAAiB,EAAK,aAAa,EAC7E,GAAM,WAAa,IAAA,IAAW,aAAa,QAAQ,WAAY,EAAK,QAAQ,EAC5E,GAAM,YAAY,aAAa,QAAQ,aAAc,EAAK,UAAU,EACpE,GAAM,aAAe,IAAA,IAAW,aAAa,QAAQ,aAAc,OAAO,EAAK,UAAU,CAAC,EAC1F,GAAM,qBAAuB,IAAA,IAAW,aAAa,QAAQ,qBAAsB,OAAO,EAAK,kBAAkB,CAAC,EAClH,GAAU,aAAa,QAAQ,WAAY,CAAQ,EACnD,GAAmB,aAAa,QAAQ,qBAAsB,CAAiB,EAC/E,GAAW,aAAa,QAAQ,aAAc,CAAS,GACvD,GAAM,QAAU,EAAa,UAAS,aAAa,QAAQ,SAAU,GAAM,QAAU,EAAa,OAAO,EACzG,GAAM,aAAa,aAAa,QAAQ,cAAe,EAAK,WAAW,EACvE,EAAa,SAAW,IAAA,IAAW,aAAa,QAAQ,SAAU,OAAO,EAAa,MAAM,CAAC,EAC7F,EAAa,UAAU,aAAa,QAAQ,WAAY,EAAa,QAAQ,EAC7E,EAAa,YAAY,aAAa,QAAQ,aAAc,EAAa,UAAU,EACnF,EAAa,gBAAgB,aAAa,QAAQ,iBAAkB,EAAa,cAAc,EAEnG,EAAoB,OAAQ,EAAM,IAAI,EACtC,EAAoB,aAAc,EAAM,UAAU,EAClD,EAAoB,iBAAkB,GAAM,cAAc,EAC1D,EAAoB,iBAAkB,GAAM,cAAc,CAC5D,CAIA,SAAgB,GAAiB,CAO/B,OANI,GAMG,aAAa,QAAQ,CAAc,CAC5C,CAEA,SAAgB,GAAgB,CAC9B,GAAI,CACF,IAAM,EAAS,aAAa,QAAQ,CAAa,EACjD,GAAI,EAAQ,OAAO,KAAK,MAAM,CAAM,CACtC,MAAQ,CAER,CACA,MAAO,CACL,OAAQ,aAAa,QAAQ,QAAQ,EACrC,SAAU,aAAa,QAAQ,UAAU,GAAK,aAAa,QAAQ,oBAAoB,EACvF,MAAO,aAAa,QAAQ,YAAY,EACxC,OAAQ,aAAa,QAAQ,QAAQ,CACvC,CACF,CAEA,SAAgB,GAAS,CAEvB,EAAmB,EACnB,aAAa,WAAW,CAAc,EACtC,aAAa,WAAW,CAAa,EACrC,EAAmB,QAAS,GAAQ,aAAa,WAAW,CAAG,CAAC,EAChE,eAAe,WAAW,EAAsB,EAChD,OAAO,cAAc,IAAI,MAAM,aAAa,CAAC,CAC/C,CAIA,SAAgB,GAAqB,CACnC,IAAM,EAAS,OAAO,aAAa,QAAQ,QAAQ,GAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,EAC/E,GAAI,EAAQ,OAAO,EACnB,IAAM,EAAU,EAAiB,EAAe,CAAC,GAAK,CAAC,EACvD,OAAO,OAAO,EAAQ,MAAQ,EAAQ,UAAY,EAAQ,WAAa,EAAQ,SAAW,EAAQ,QAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CACrI,CAEA,SAAgB,GAAe,CAE7B,IAAM,EAAU,EADF,EAAe,GAAK,aAAa,QAAQ,CAAc,CAC/B,EAChC,EAAQ,IAAI,IACZ,EAAS,EAAmB,EAWlC,OAVI,GAAQ,EAAM,IAAI,CAAM,EACxB,KACD,GAAS,cAAc,OAAS,CAAC,EAAA,CAAG,QAAS,GAAS,EAAM,IAAI,CAAI,CAAC,EACtE,OAAO,OAAO,GAAS,iBAAmB,CAAC,CAAC,CAAC,CAAC,QAAS,GAAW,EAC/D,GAAQ,OAAS,CAAC,EAAA,CAAG,QAAS,GAAS,EAAM,IAAI,CAAI,CAAC,CACzD,CAAC,EACD,CAAC,GAAS,KAAM,GAAS,SAAU,GAAS,SAAS,CAAC,CAAC,QAAS,GAAS,CACnE,GAAM,EAAM,IAAI,CAAI,CAC1B,CAAC,GAEI,MAAM,KAAK,CAAK,CAAC,CAAC,IAAK,GAAS,OAAO,CAAI,CAAC,CAAC,YAAY,CAAC,CACnE,CAEA,SAAgB,GAAW,CACzB,OAAO,EAAmB,IAAM,UAAY,EAAa,CAAC,CAAC,SAAS,QAAQ,CAC9E,CAOA,SAAgB,GAAoB,CAClC,IAAM,EAAU,EAAiB,EAAe,GAAK,aAAa,QAAQ,CAAc,CAAC,GAAK,CAAC,EACzF,EAAO,GAAU,CACrB,GAAI,GAAiC,MAAQ,IAAU,GAAI,OAC3D,IAAM,EAAS,OAAO,CAAK,EAC3B,OAAO,OAAO,SAAS,CAAM,EAAI,EAAS,IAAA,EAC5C,EACA,MAAO,CACL,OAAQ,EAAI,EAAQ,SAAW,EAAQ,MAAM,GAAK,EAAI,aAAa,QAAQ,QAAQ,CAAC,EACpF,OAAQ,EAAI,EAAQ,QAAU,EAAQ,OAAO,CAC/C,CACF,CAIA,SAAgB,EAAmB,EAAS,CACrC,IACL,aAAa,QAAQ,EAAmB,OAAO,EAAQ,EAAE,CAAC,EAC1D,aAAa,QAAQ,EAAqB,OAAO,EAAQ,IAAI,CAAC,EAChE,CAEA,SAAgB,GAAqB,CACnC,IAAM,EAAK,aAAa,QAAQ,CAAiB,EAC3C,EAAO,aAAa,QAAQ,CAAmB,EAErD,MADI,CAAC,GAAM,CAAC,EAAa,KAClB,CAAE,GAAI,OAAO,CAAE,EAAG,MAAK,CAChC,CAEA,SAAgB,GAAuB,CACrC,aAAa,WAAW,CAAiB,EACzC,aAAa,WAAW,CAAmB,CAC7C,CAIA,eAAsB,EAAM,EAAa,CAsCvC,OArCI,IAEJ,EAAe,MAAM,GAAG,EAAS,QAAS,CACxC,OAAQ,OACR,QAAS,CAAE,eAAgB,kBAAmB,EAC9C,KAAM,KAAK,UAAU,CAAW,CAClC,CAAC,CAAC,CACC,KAAK,KAAO,IAAQ,CACnB,IAAM,EAAO,MAAM,EAAI,KAAK,EAC5B,GAAI,CAAC,EAAI,IAAM,GAAuB,CAAI,EAAG,CAC3C,IAAM,EAAY,MAChB,EAAyB,EAAM,iBAAiB,EAAI,QAAQ,CAC9D,EAGA,KAFA,GAAM,OAAS,EAAI,OACnB,EAAM,SAAW,EACX,CACR,CAEA,IAAM,EAAQ,EAAa,CAAI,EAC/B,GAAI,CAAC,EAAO,CACV,IAAM,EAAY,MAChB,EAAyB,EAAM,4BAA4B,CAC7D,EAGA,KAFA,GAAM,OAAS,EAAI,OACnB,EAAM,SAAW,EACX,CACR,CACA,IAAM,EAAO,GAAY,CAAI,EAM7B,OALA,aAAa,QAAQ,EAAgB,CAAK,EACtC,GAAM,aAAa,QAAQ,EAAe,KAAK,UAAU,CAAI,CAAC,EAClE,GAAqB,EAAM,EAAO,CAAI,EAEtC,OAAO,cAAc,IAAI,MAAM,YAAY,CAAC,EACrC,CAAE,QAAO,OAAM,SAAU,CAAK,CACvC,CAAC,CAAC,CACD,YAAc,CAAE,EAAe,IAAM,CAAC,EAElC,EACT,CAEA,SAAS,EAAiB,EAAO,EAAc,GAAI,CACjD,IAAM,EAAU,EAAiB,CAAK,EAChC,EAAM,OAAO,GAAS,GAAG,EAE/B,MADI,CAAC,OAAO,SAAS,CAAG,GAAK,GAAO,EAAU,GACvC,EAAM,KAAQ,KAAK,IAAI,EAAI,EAAc,GAClD,CAEA,SAAS,EAA4B,EAAM,CACzC,IAAM,EAAQ,EAAa,CAAI,EAC/B,GAAI,CAAC,EAAO,MAAO,GACnB,aAAa,QAAQ,EAAgB,CAAK,EAC1C,aAAa,QAAQ,eAAgB,CAAK,EAC1C,IAAM,EAAO,GAAM,MAAQ,EACrB,EAAY,GAAM,YAAc,GAAM,qBAE5C,OADI,IAAc,IAAA,IAAW,aAAa,QAAQ,aAAc,OAAO,CAAS,CAAC,EAC1E,CACT,CAEA,eAAsB,GAAqB,CACzC,GAAI,EAAgB,OAAO,EAC3B,IAAM,EAAe,OAAO,aAAa,QAAQ,eAAe,GAAK,EAAE,CAAC,CAAC,KAAK,EAC9E,GAAI,CAAC,EAAc,CACjB,IAAM,EAAY,MAAM,iBAAiB,EAEzC,KADA,GAAM,OAAS,IACT,CACR,CAkBA,MAjBA,GAAiB,MAAM,GAAG,EAAS,yBAA0B,CAC3D,OAAQ,OACR,QAAS,EAAU,CAAE,eAAgB,kBAAmB,CAAC,EACzD,KAAM,KAAK,UAAU,CAAE,cAAe,CAAa,CAAC,CACtD,CAAC,CAAC,CAAC,KAAK,KAAO,IAAQ,CACrB,IAAM,EAAO,MAAM,EAAI,KAAK,EACxB,EAAO,CAAC,EACZ,GAAI,EAAQ,GAAI,CAAE,EAAO,KAAK,MAAM,CAAI,CAAG,MAAQ,CAAE,EAAO,CAAE,MAAO,CAAK,CAAG,CAC7E,GAAI,CAAC,EAAI,GAAI,CACX,IAAM,EAAY,MAAM,GAAM,OAAS,GAAM,SAAW,yBAAyB,EAAI,QAAQ,EAE7F,KADA,GAAM,OAAS,EAAI,OACb,CACR,CACA,IAAM,EAAQ,EAA4B,CAAI,EAC9C,GAAI,CAAC,EAAO,CAAE,IAAM,EAAY,MAAM,wDAAwD,EAAuB,KAApB,GAAM,OAAS,IAAW,CAAO,CAClI,OAAO,CACT,CAAC,CAAC,CAAC,YAAc,CAAE,EAAiB,IAAM,CAAC,EACpC,CACT,CAIA,eAAsB,GAAc,CAClC,IAAM,EAAQ,EAAe,EAC7B,GAAI,GAAS,CAAC,EAAiB,CAAK,EAAG,OAAO,EAC9C,GAAI,aAAa,QAAQ,eAAe,EACtC,GAAI,CAAE,OAAO,MAAM,EAAmB,CAAG,MAAQ,CAAwC,CAE3F,GAAI,EAAO,OAAO,EAClB,IAAM,EAAY,MAAM,yBAAyB,EAEjD,KADA,GAAM,OAAS,IACT,CACR,CAEA,eAAe,IAAc,CAO3B,OAAO,EAAU,CACf,eAAgB,mBAChB,cAAe,UAAU,MARP,EAAY,GAShC,CAAC,CACH,CAkDA,IAAM,GAAa,IAEb,EAAe,IAAI,IACnB,EAAc,IAAI,IAGxB,SAAgB,GAAqB,CACnC,EAAY,MAAM,CACpB,CAEA,SAAS,EAAa,EAAM,CAI1B,GAAI,CACF,OAAO,OAAO,iBAAoB,WAAa,gBAAgB,CAAI,EAAI,KAAK,MAAM,KAAK,UAAU,CAAI,CAAC,CACxG,MAAQ,CAGN,OAAO,CACT,CACF,CAEA,SAAS,EAAM,EAAS,CAEtB,OADgB,GAAS,QAAU,MAAA,CAAO,YACnC,IAAW,KACpB,CAEA,eAAsB,EAAkB,EAAS,EAAO,GAAI,EAAU,CAAC,EAAG,CACpE,GAAQ,OAAO,GAAS,WAC1B,EAAU,EACV,EAAO,IAGT,IAAM,EAAM,GAAG,IAAU,GAAQ,KACjC,GAAI,EAAM,CAAO,EAAG,CAClB,IAAM,EAAU,EAAa,IAAI,CAAG,EACpC,GAAI,EAAS,OAAO,EAAa,MAAM,CAAO,EAC9C,IAAM,EAAU,EAAY,IAAI,CAAG,EACnC,GAAI,GAAW,KAAK,IAAI,EAAI,EAAQ,GAAK,GAAY,OAAO,EAAa,EAAQ,IAAI,EAGjF,GAAS,EAAY,OAAO,CAAG,CACrC,CAEA,GAAI,CAAC,EAAM,CAAO,EAAG,CAInB,EAAmB,EACnB,GAAI,CACF,OAAO,MAAM,EAAa,EAAK,CAAO,CACxC,QAAU,CACR,EAAmB,CACrB,CACF,CAEA,IAAM,EAAM,EAAa,EAAK,CAAO,EACrC,EAAa,IAAI,EAAK,CAAG,EACzB,GAAI,CAIF,IAAM,EAAO,MAAM,EAEnB,OADA,EAAY,IAAI,EAAK,CAAE,GAAI,KAAK,IAAI,EAAG,MAAK,CAAC,EACtC,EAAa,CAAI,CAC1B,QAAU,CAGR,EAAa,OAAO,CAAG,CACzB,CACF,CAEA,eAAe,EAAa,EAAK,EAAU,CAAC,EAAG,CAC7C,IAAM,EAAY,SAAY,CAC5B,IAAM,EAAU,MAAM,GAAY,EAClC,OAAO,MAAM,EAAK,CAAE,GAAG,EAAS,QAAS,CAAE,GAAG,EAAS,GAAG,EAAQ,OAAQ,CAAE,CAAC,CAC/E,EAEI,EAAM,MAAM,EAAU,EAC1B,GAAI,EAAI,SAAW,KAAO,aAAa,QAAQ,eAAe,EAC5D,GAAI,CACF,MAAM,EAAmB,EACzB,EAAM,MAAM,EAAU,CACxB,MAAQ,CAER,CAEE,EAAI,SAAW,KAAK,EAAO,EAE/B,IAAM,EAAO,MAAM,EAAI,KAAK,EACxB,EAAO,CAAC,EACZ,GAAI,EACF,GAAI,CAAE,EAAO,KAAK,MAAM,CAAI,CAAG,MAAQ,CAAE,EAAO,CAAE,MAAO,CAAK,CAAG,CAEnE,GAAI,CAAC,EAAI,GAAI,CACX,IAAM,EAAgB,GAAM,OAAS,GAAM,QACrC,EAAS,OAAO,GAAkB,SACpC,EACA,GAAiB,OAAO,KAAK,CAAa,CAAC,CAAC,OAAS,EACnD,KAAK,UAAU,CAAa,EAC5B,GACA,EAAY,MAAM,GAAU,OAAO,EAAI,OAAO,IAAI,EAAI,YAAY,EAGxE,KAFA,GAAM,OAAS,EAAI,OACnB,EAAM,SAAW,EACX,CACR,CACA,OAAO,CACT,CAEA,eAAsB,EAAe,EAAS,EAAM,CAClD,IAAM,EAAO,MAAM,EAAkB,EAAS,CAAI,EAClD,OAAO,EAAK,MAAQ,CACtB"}