@xyd-js/plugin-access-control 0.0.0-build-8804789-20260430104829

package/dist/index.js

@@ -0,0 +1,1200 @@
+// src/access.ts
+function matchPattern(pattern, path) {
+  const regexStr = pattern.replace(/\*\*/g, "___GLOBSTAR___").replace(/\*/g, "[^/]*").replace(/___GLOBSTAR___/g, ".*");
+  const regex = new RegExp(`^${regexStr}$`);
+  return regex.test(path);
+}
+function resolvePageAccess(pagePath, metadata, config) {
+  const normalizedPath = pagePath.startsWith("/") ? pagePath : `/${pagePath}`;
+  if (metadata.public === true) {
+    return "public";
+  }
+  if (metadata.public === false) {
+    if (metadata.accessGroups?.length) {
+      return metadata.accessGroups.join(",");
+    }
+    return "authenticated";
+  }
+  if (config.rules) {
+    for (const rule of config.rules) {
+      if (matchPattern(rule.match, normalizedPath)) {
+        if (rule.access === "public") {
+          return "public";
+        }
+        if (rule.groups?.length) {
+          return rule.groups.join(",");
+        }
+        return "authenticated";
+      }
+    }
+  }
+  return config.defaultAccess === "protected" ? "authenticated" : "public";
+}
+function evaluateAccess(pagePath, accessMap, userGroups) {
+  const access = accessMap[pagePath];
+  if (!access || access === "public") {
+    return { allowed: true, reason: `access:public` };
+  }
+  if (access === "authenticated") {
+    return {
+      allowed: userGroups.length > 0 || false,
+      reason: "access:authenticated"
+    };
+  }
+  const requiredGroups = access.split(",");
+  const hasGroup = requiredGroups.some((g) => userGroups.includes(g));
+  return {
+    allowed: hasGroup,
+    reason: `access:groups:${access}`
+  };
+}
+function buildAccessMap(pagePathMapping, metadataMap, config) {
+  const accessMap = {};
+  for (const pagePath of Object.keys(pagePathMapping)) {
+    const metadata = metadataMap[pagePath] || {};
+    accessMap[pagePath] = resolvePageAccess(pagePath, metadata, config);
+  }
+  return accessMap;
+}
+
+// src/devOnly.ts
+function isDevEnvironment() {
+  if (typeof window === "undefined") {
+    return process.env.NODE_ENV !== "production";
+  }
+  try {
+    return !!import.meta.env?.DEV;
+  } catch {
+    return false;
+  }
+}
+function isAuthBypassed() {
+  if (!isDevEnvironment()) return false;
+  return process.env.XYD_AUTH_BYPASS === "1" || process.env.XYD_AUTH_BYPASS === "true";
+}
+
+// src/virtual.ts
+var VIRTUAL_SETTINGS_ID = "virtual:xyd-access-control-settings";
+var RESOLVED_SETTINGS_ID = "\0" + VIRTUAL_SETTINGS_ID;
+var VIRTUAL_GUARD_ID = "virtual:xyd-access-control-guard";
+var RESOLVED_GUARD_ID = "\0" + VIRTUAL_GUARD_ID;
+var VIRTUAL_PAGES_ID = "virtual:xyd-plugin-pages";
+var RESOLVED_PAGES_ID = "\0" + VIRTUAL_PAGES_ID;
+function virtualAccessControlSettingsPlugin(config, buildAccessMap2) {
+  let cachedAccessMap = null;
+  function getAccessMap() {
+    if (!cachedAccessMap) {
+      cachedAccessMap = buildAccessMap2(config);
+    }
+    return cachedAccessMap;
+  }
+  return {
+    name: "xyd-plugin-access-control-virtual-settings",
+    resolveId(id) {
+      if (id === VIRTUAL_SETTINGS_ID) return RESOLVED_SETTINGS_ID;
+      if (id === VIRTUAL_GUARD_ID) return RESOLVED_GUARD_ID;
+      if (id === VIRTUAL_PAGES_ID) return RESOLVED_PAGES_ID;
+      return null;
+    },
+    load(id) {
+      if (id === RESOLVED_SETTINGS_ID) {
+        const isBypassed = isAuthBypassed();
+        const safeConfig = sanitizeConfig(config);
+        const accessMap = isBypassed ? {} : getAccessMap();
+        if (isBypassed) {
+          console.log("[xyd:access-control] Auth bypass enabled (XYD_AUTH_BYPASS). All pages are public.");
+        }
+        return `
+export const accessControlConfig = ${JSON.stringify(safeConfig)};
+export const accessMap = ${JSON.stringify(accessMap)};
+`;
+      }
+      if (id === RESOLVED_GUARD_ID) {
+        return [
+          `export { default as AuthGuard, useAuth } from "@xyd-js/plugin-access-control/AuthGuard";`,
+          `export { AccessControlProvider, useAccessControl } from "@xyd-js/plugin-access-control/AccessControlContext";`
+        ].join("\n");
+      }
+      if (id === RESOLVED_PAGES_ID) {
+        const pluginPages = globalThis.__xydPluginPages || [];
+        const imports = [];
+        const entries = [];
+        pluginPages.forEach((page, i) => {
+          const dist = page.dist || page._pluginPkg;
+          if (dist) {
+            imports.push(`import Page${i}, * as PageMod${i} from "${dist}";`);
+            entries.push(`  "${page.route}": { component: Page${i}, seoTags: PageMod${i}.seoTags, shadowCss: PageMod${i}.shadowCss }`);
+          }
+        });
+        return [
+          ...imports,
+          `export { AccessControlProvider } from "@xyd-js/plugin-access-control/AccessControlContext";`,
+          `export const pluginPages = {`,
+          entries.join(",\n"),
+          `};`
+        ].join("\n");
+      }
+      return null;
+    },
+    // Invalidate cached access map when settings change (dev HMR)
+    handleHotUpdate() {
+      cachedAccessMap = null;
+    }
+  };
+}
+function sanitizeConfig(config) {
+  const safe = { ...config };
+  if (safe.provider) {
+    const provider = { ...safe.provider };
+    if ("secret" in provider) {
+      provider.secret = void 0;
+    }
+    safe.provider = provider;
+  }
+  return safe;
+}
+
+// src/scripts/authPrehydration.ts
+function generateAuthPrehydrationScript(cookieName, groupsClaim) {
+  const script = `(function(){var n="%%COOKIE_NAME%%";var t=null;try{t=localStorage.getItem(n)}catch(e){}if(!t){var c=document.cookie.split(";");for(var i=0;i<c.length;i++){var p=c[i].trim().split("=");if(p[0]===n||p[0]===n+"-state"){t=decodeURIComponent(p.slice(1).join("="));break}}}var a=false;var g=[];if(t){try{var d=JSON.parse(atob(t.split(".")[1]));if(d.exp&&d.exp*1000>Date.now()){a=true;g=d["%%GROUPS_CLAIM%%"]||[]}}catch(e){}}window.__xydAuthState={authenticated:a,groups:g,token:a?t:null};document.documentElement.setAttribute("data-auth",a?"authenticated":"anonymous")})();`;
+  return script.replace(/%%COOKIE_NAME%%/g, cookieName).replace(/%%GROUPS_CLAIM%%/g, groupsClaim);
+}
+
+// src/middleware/shared.ts
+function generateMiddlewareCore(config, accessMap) {
+  const loginUrl = "loginUrl" in config.provider ? config.provider.loginUrl : "";
+  const cookieName = config.session?.cookieName || "xyd-auth-token";
+  const groupsClaim = "groupsClaim" in config.provider ? config.provider.groupsClaim || "groups" : "groups";
+  const defaultAccess = config.defaultAccess || "public";
+  return `
+const ACCESS_MAP = ${JSON.stringify(accessMap)};
+const LOGIN_URL = ${JSON.stringify(loginUrl)};
+const COOKIE_NAME = ${JSON.stringify(cookieName)};
+const GROUPS_CLAIM = ${JSON.stringify(groupsClaim)};
+const DEFAULT_ACCESS = ${JSON.stringify(defaultAccess)};
+
+function parseCookies(cookieHeader) {
+  const cookies = {};
+  if (!cookieHeader) return cookies;
+  cookieHeader.split(";").forEach(function(c) {
+    const parts = c.trim().split("=");
+    if (parts.length >= 2) {
+      cookies[parts[0]] = decodeURIComponent(parts.slice(1).join("="));
+    }
+  });
+  return cookies;
+}
+
+function decodeJWTPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    return JSON.parse(atob(parts[1]));
+  } catch {
+    return null;
+  }
+}
+
+function handleAuthRequest(request) {
+  const url = new URL(request.url);
+  const path = url.pathname;
+
+  // Skip asset requests
+  if (path.startsWith("/assets/") || path.match(/\\.[a-z0-9]+$/i)) {
+    return null; // pass through
+  }
+
+  // Check access requirement
+  const access = ACCESS_MAP[path] || DEFAULT_ACCESS;
+  if (access === "public") return null; // pass through
+
+  // Check auth cookie
+  const cookies = parseCookies(request.headers.get("cookie"));
+  const token = cookies[COOKIE_NAME];
+
+  if (!token) {
+    const redirectUrl = LOGIN_URL
+      ? LOGIN_URL + (LOGIN_URL.includes("?") ? "&" : "?") + "redirect=" + encodeURIComponent(url.href)
+      : null;
+    return { status: 302, redirect: redirectUrl };
+  }
+
+  // Decode and validate token
+  const payload = decodeJWTPayload(token);
+  if (!payload || (payload.exp && payload.exp * 1000 < Date.now())) {
+    const redirectUrl = LOGIN_URL
+      ? LOGIN_URL + (LOGIN_URL.includes("?") ? "&" : "?") + "redirect=" + encodeURIComponent(url.href)
+      : null;
+    return { status: 302, redirect: redirectUrl };
+  }
+
+  // Check group access
+  if (access !== "authenticated") {
+    const requiredGroups = access.split(",");
+    const userGroups = payload[GROUPS_CLAIM] || [];
+    const hasAccess = requiredGroups.some(function(g) { return userGroups.includes(g); });
+    if (!hasAccess) {
+      return { status: 404 };
+    }
+  }
+
+  return null; // pass through - authorized
+}
+`;
+}
+
+// src/middleware/netlify.ts
+async function generateNetlifyEdge(config, outputDir) {
+  const { writeFileSync, mkdirSync, readFileSync, existsSync } = await import("fs");
+  const { join } = await import("path");
+  const projectRoot = join(outputDir, "../..");
+  const edgeFnDir = join(projectRoot, "netlify/edge-functions");
+  mkdirSync(edgeFnDir, { recursive: true });
+  const accessMap = globalThis.__xydAccessMap || {};
+  const middlewareCore = generateMiddlewareCore(config, accessMap);
+  const edgeFunction = `
+${middlewareCore}
+
+export default async function handler(request) {
+  const result = handleAuthRequest(request);
+
+  if (!result) return; // pass through to static files
+
+  if (result.redirect) {
+    return Response.redirect(result.redirect, 302);
+  }
+
+  if (result.status === 404) {
+    return new Response("Not Found", { status: 404 });
+  }
+}
+
+export const config = { path: "/*" };
+`;
+  writeFileSync(join(edgeFnDir, "access-control.js"), edgeFunction, "utf-8");
+  const tomlPath = join(projectRoot, "netlify.toml");
+  const declaration = `
+[[edge_functions]]
+  function = "access-control"
+  path = "/*"
+`;
+  if (existsSync(tomlPath)) {
+    const existing = readFileSync(tomlPath, "utf-8");
+    if (!existing.includes('function = "access-control"')) {
+      writeFileSync(tomlPath, existing + "\n" + declaration, "utf-8");
+    }
+  } else {
+    writeFileSync(tomlPath, declaration, "utf-8");
+  }
+}
+
+// src/middleware/vercel.ts
+async function generateVercelMiddleware(config, outputDir) {
+  const { writeFileSync } = await import("fs");
+  const { join } = await import("path");
+  const projectRoot = join(outputDir, "../..");
+  const accessMap = globalThis.__xydAccessMap || {};
+  const middlewareCore = generateMiddlewareCore(config, accessMap);
+  const middleware = `
+${middlewareCore}
+
+export default function middleware(request) {
+  const result = handleAuthRequest(request);
+
+  if (!result) return; // pass through
+
+  if (result.redirect) {
+    return new Response(null, {
+      status: 302,
+      headers: { Location: result.redirect },
+    });
+  }
+
+  if (result.status === 404) {
+    return new Response("Not Found", { status: 404 });
+  }
+}
+`;
+  writeFileSync(join(projectRoot, "middleware.js"), middleware, "utf-8");
+}
+
+// src/middleware/cloudflare.ts
+async function generateCloudflareMiddleware(config, outputDir) {
+  const { writeFileSync, mkdirSync } = await import("fs");
+  const { join } = await import("path");
+  const functionsDir = join(outputDir, "functions");
+  mkdirSync(functionsDir, { recursive: true });
+  const accessMap = globalThis.__xydAccessMap || {};
+  const middlewareCore = generateMiddlewareCore(config, accessMap);
+  const middleware = `
+${middlewareCore}
+
+export async function onRequest(context) {
+  const result = handleAuthRequest(context.request);
+
+  if (!result) return context.next(); // pass through to static files
+
+  if (result.redirect) {
+    return Response.redirect(result.redirect, 302);
+  }
+
+  if (result.status === 404) {
+    return new Response("Not Found", { status: 404 });
+  }
+}
+`;
+  writeFileSync(join(functionsDir, "_middleware.js"), middleware, "utf-8");
+}
+
+// src/middleware/node.ts
+async function generateNodeServer(config, outputDir) {
+  const { writeFileSync } = await import("fs");
+  const { join } = await import("path");
+  const accessMap = globalThis.__xydAccessMap || {};
+  const cookieName = config.session?.cookieName || "xyd-auth-token";
+  const maxAge = config.session?.maxAge || 86400;
+  const groupsClaim = "groupsClaim" in config.provider ? config.provider.groupsClaim || "groups" : "groups";
+  const loginUrl = "loginUrl" in config.provider ? config.provider.loginUrl || "/login" : "/login";
+  const secret = "secret" in config.provider ? config.provider.secret || "" : "";
+  const imp = "import";
+  const server = `#!/usr/bin/env node
+/**
+ * Auto-generated by xyd build with deploy.platform: "node-edge"
+ * Standalone access control server with JWT signature verification.
+ *
+ * Usage:
+ *   node server.mjs
+ *   # or: PORT=8080 node server.mjs
+ */
+${imp} { createServer } from "node:http";
+${imp} { createHmac } from "node:crypto";
+${imp} { readFileSync, existsSync } from "node:fs";
+${imp} { join, extname } from "node:path";
+${imp} { fileURLToPath } from "node:url";
+
+const __dirname = fileURLToPath(new URL(".", import.meta.url));
+const PORT = parseInt(process.env.PORT || "3000", 10);
+const STATIC_DIR = __dirname;
+const COOKIE_NAME = ${JSON.stringify(cookieName)};
+const MAX_AGE = ${maxAge};
+const GROUPS_CLAIM = ${JSON.stringify(groupsClaim)};
+const LOGIN_URL = ${JSON.stringify(loginUrl)};
+const JWT_SECRET = process.env.AUTH_SECRET || ${JSON.stringify(secret.startsWith("$") ? "" : secret)};
+const ACCESS_MAP = ${JSON.stringify(accessMap)};
+
+const MIME = {
+  ".html":"text/html",".js":"application/javascript",".css":"text/css",
+  ".json":"application/json",".svg":"image/svg+xml",".png":"image/png",
+  ".jpg":"image/jpeg",".ico":"image/x-icon",".woff":"font/woff",
+  ".woff2":"font/woff2",".ttf":"font/ttf",".map":"application/json",
+};
+
+function parseCookies(h) {
+  const c = {};
+  if (!h) return c;
+  h.split(";").forEach(s => { const [k,...v] = s.trim().split("="); c[k] = decodeURIComponent(v.join("=")); });
+  return c;
+}
+
+function verifyJWT(token) {
+  try {
+    const [header, payload, signature] = token.split(".");
+    if (!header || !payload || !signature) return null;
+    if (JWT_SECRET) {
+      const expected = createHmac("sha256", JWT_SECRET).update(header + "." + payload).digest("base64url");
+      if (signature !== expected) return null;
+    }
+    const decoded = JSON.parse(Buffer.from(payload, "base64url").toString());
+    if (decoded.exp && decoded.exp * 1000 < Date.now()) return null;
+    return decoded;
+  } catch { return null; }
+}
+
+function checkAccess(pathname, cookies) {
+  const access = ACCESS_MAP[pathname] || ACCESS_MAP[pathname.replace(/\\/$/, "")] || null;
+  if (!access || access === "public") return { ok: true };
+  const token = cookies[COOKIE_NAME];
+  if (!token) return { ok: false, reason: "no-token" };
+  const payload = verifyJWT(token);
+  if (!payload) return { ok: false, reason: "invalid-token" };
+  if (access === "authenticated") return { ok: true, user: payload };
+  const userGroups = payload[GROUPS_CLAIM] || [];
+  if (access.split(",").some(g => userGroups.includes(g))) return { ok: true, user: payload };
+  return { ok: false, reason: "insufficient-groups" };
+}
+
+function serve(res, filePath) {
+  try {
+    if (!existsSync(filePath)) { res.writeHead(404); res.end("Not Found"); return; }
+    const ext = extname(filePath);
+    res.writeHead(200, { "Content-Type": MIME[ext] || "application/octet-stream" });
+    res.end(readFileSync(filePath));
+  } catch {
+    if (!res.headersSent) { res.writeHead(500); }
+    res.end("Error");
+  }
+}
+
+const server = createServer((req, res) => {
+  const url = new URL(req.url, "http://localhost:" + PORT);
+  const path = url.pathname;
+  const cookies = parseCookies(req.headers.cookie);
+
+  // Static assets
+  if (path.startsWith("/assets/") || path.match(/\\.\\w+$/)) {
+    return serve(res, join(STATIC_DIR, path));
+  }
+
+  // Test login \u2014 DEVELOPMENT ONLY. Disabled in production.
+  if (path === "/auth/test-login") {
+    if (process.env.NODE_ENV === "production" && !process.env.XYD_TEST_LOGIN) {
+      res.writeHead(404); res.end("Not Found"); return;
+    }
+    const groups = (url.searchParams.get("groups") || "").split(",").filter(Boolean);
+    const redirect = url.searchParams.get("redirect") || "/";
+    if (!JWT_SECRET) { res.writeHead(500); res.end("AUTH_SECRET not set"); return; }
+    const header = Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })).toString("base64url");
+    const payload = Buffer.from(JSON.stringify({
+      sub: groups.includes("admin") ? "admin" : "user",
+      [GROUPS_CLAIM]: groups,
+      exp: Math.floor(Date.now() / 1000) + MAX_AGE,
+      iat: Math.floor(Date.now() / 1000),
+    })).toString("base64url");
+    const sig = createHmac("sha256", JWT_SECRET).update(header + "." + payload).digest("base64url");
+    res.writeHead(302, {
+      Location: redirect,
+      "Set-Cookie": COOKIE_NAME + "=" + header + "." + payload + "." + sig + "; Path=/; Max-Age=" + MAX_AGE + "; SameSite=Lax",
+    });
+    res.end(); return;
+  }
+
+  // JWT callback: external auth service POSTs or GETs a token
+  // Accepts: ?token=JWT&redirect=/page or POST body with token field
+  if (path === "/auth/jwt-callback" || path === ${JSON.stringify("callbackPath" in config.provider ? config.provider.callbackPath || "/auth/jwt-callback" : "/auth/jwt-callback")}) {
+    let token = url.searchParams.get("token") || url.searchParams.get("fern_token") || "";
+    const redirect = url.searchParams.get("redirect") || url.searchParams.get("state") || "/";
+
+    if (token) {
+      const verified = verifyJWT(token);
+      if (!verified) {
+        res.writeHead(401); res.end("Invalid or expired token"); return;
+      }
+      res.writeHead(302, {
+        Location: redirect,
+        "Set-Cookie": COOKIE_NAME + "=" + token + "; Path=/; Max-Age=" + MAX_AGE + "; SameSite=Lax",
+      });
+      res.end(); return;
+    }
+
+    // No token in query \u2014 serve the callback HTML page (handles hash fragment client-side)
+    let fp = join(STATIC_DIR, path, "index.html");
+    if (!existsSync(fp)) fp = join(STATIC_DIR, "index.html");
+    return serve(res, fp);
+  }
+
+  // Logout
+  if (path === "/auth/logout") {
+    res.writeHead(302, {
+      Location: "/",
+      "Set-Cookie": COOKIE_NAME + "=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT",
+    });
+    res.end(); return;
+  }
+
+  // Protected content chunks
+  if (path.startsWith("/__xyd_protected_content/")) {
+    const r = checkAccess("/protected", cookies);
+    if (!r.ok) { res.writeHead(401); res.end("Unauthorized"); return; }
+    return serve(res, join(STATIC_DIR, path));
+  }
+
+  // Access check
+  const result = checkAccess(path, cookies);
+  if (!result.ok) {
+    // Always redirect to /login (xyd login page), not directly to the external auth URL.
+    // The login page UI handles redirecting to the external provider.
+    const redir = "/login?redirect=" + encodeURIComponent(path);
+    console.log("[access-control] " + path + " \u2192 302 (" + result.reason + ")");
+    res.writeHead(302, { Location: redir }); res.end(); return;
+  }
+
+  if (result.user) console.log("[access-control] " + path + " \u2192 200 (user: " + result.user.sub + ")");
+  else console.log("[access-control] " + path + " \u2192 200 (public)");
+
+  // Serve page
+  let fp = join(STATIC_DIR, path, "index.html");
+  if (!existsSync(fp)) fp = join(STATIC_DIR, path + ".html");
+  if (!existsSync(fp)) fp = join(STATIC_DIR, "index.html");
+  serve(res, fp);
+});
+
+server.listen(PORT, () => {
+  console.log("\\n  xyd access-control server running at http://localhost:" + PORT);
+  console.log("  Callback: /auth/jwt-callback?token=JWT&redirect=/");
+  console.log("  Logout:   /auth/logout");
+  if (process.env.NODE_ENV !== "production" || process.env.XYD_TEST_LOGIN) {
+    console.log("  Test:     /auth/test-login?groups=admin&redirect=/  (dev only)");
+  }
+  console.log("");
+});
+`;
+  writeFileSync(join(outputDir, "server.mjs"), server, "utf-8");
+}
+
+// src/content.ts
+function protectedContentPlugin(config, buildAccessMap2) {
+  let cachedAccessMap = null;
+  function getAccessMap() {
+    if (!cachedAccessMap) {
+      cachedAccessMap = buildAccessMap2(config);
+    }
+    return cachedAccessMap;
+  }
+  return {
+    name: "xyd-plugin-access-control-protected-content",
+    configureServer(server) {
+      server.middlewares.use((req, res, next) => {
+        const url = req.url?.split("?")[0] || "";
+        if (url.startsWith("/assets/") || url.startsWith("/@") || url.startsWith("/__") || url.startsWith("/node_modules/") || url.includes(".") || url === "/login" || url.startsWith("/auth/")) {
+          return next();
+        }
+        const am = getAccessMap();
+        const slug = url.replace(/^\//, "");
+        const access = am["/" + slug] || am[slug];
+        if (!access || access === "public") {
+          return next();
+        }
+        const cookieHeader = req.headers.cookie || "";
+        const cookieName = config.session?.cookieName || "xyd-auth-token";
+        const hasToken = cookieHeader.includes(`${cookieName}=`);
+        const isBypassed = isAuthBypassed();
+        if (!hasToken && !isBypassed) {
+          const redirect = "/login?redirect=" + encodeURIComponent(req.url || "/");
+          res.writeHead(302, { Location: redirect });
+          res.end();
+          return;
+        }
+        next();
+      });
+      server.middlewares.use(async (req, res, next) => {
+        if (!req.url?.startsWith("/__xyd_protected_content/")) {
+          return next();
+        }
+        const slug = decodeURIComponent(
+          req.url.replace("/__xyd_protected_content/", "").replace(/\.js$/, "")
+        );
+        const am = getAccessMap();
+        const pageAccess = am["/" + slug] || am[slug];
+        if (!pageAccess || pageAccess === "public") {
+          res.statusCode = 404;
+          res.end("Not found");
+          return;
+        }
+        const cookieHeader = req.headers.cookie || "";
+        const hasAuthToken = cookieHeader.includes("xyd-auth-token=");
+        const isBypassed = isAuthBypassed();
+        if (!hasAuthToken && !isBypassed) {
+          res.statusCode = 401;
+          res.end("Unauthorized");
+          return;
+        }
+        const pagePath = globalThis.__xydPagePathMapping?.[slug];
+        if (!pagePath) {
+          res.statusCode = 404;
+          res.end("Page not found");
+          return;
+        }
+        try {
+          const { ContentFS } = await import("@xyd-js/content");
+          const { markdownPlugins } = await import("@xyd-js/content/md");
+          const settings = globalThis.__xydSettings;
+          const mdPlugins = await markdownPlugins({ maxDepth: 2 }, settings);
+          const remarkPlugins = [...mdPlugins.remarkPlugins];
+          const rehypePlugins = [...mdPlugins.rehypePlugins];
+          if (globalThis.__xydUserMarkdownPlugins?.remark?.length) {
+            remarkPlugins.push(globalThis.__xydUserMarkdownPlugins.remark);
+          }
+          if (globalThis.__xydUserMarkdownPlugins?.rehype?.length) {
+            rehypePlugins.push(globalThis.__xydUserMarkdownPlugins.rehype);
+          }
+          const contentFs = new ContentFS(
+            settings,
+            remarkPlugins,
+            rehypePlugins,
+            mdPlugins.recmaPlugins,
+            globalThis.__xydUserMarkdownPlugins?.remarkRehypeHandlers || {}
+          );
+          const code = await contentFs.compile(pagePath);
+          res.setHeader("Content-Type", "application/javascript");
+          res.setHeader("Cache-Control", "no-store");
+          res.end(code);
+        } catch (e) {
+          console.error(
+            "[xyd:access-control] Failed to compile protected content:",
+            e
+          );
+          res.statusCode = 500;
+          res.end("Internal error");
+        }
+      });
+    },
+    async closeBundle() {
+      const { writeFileSync, mkdirSync } = await import("fs");
+      const { join } = await import("path");
+      const outputDir = join(
+        process.cwd(),
+        ".xyd/build/client/__xyd_protected_content"
+      );
+      mkdirSync(outputDir, { recursive: true });
+      const pagePathMapping = globalThis.__xydPagePathMapping || {};
+      for (const [slug, access] of Object.entries(getAccessMap())) {
+        if (access === "public") continue;
+        const normalizedSlug = slug.startsWith("/") ? slug.slice(1) : slug;
+        const pagePath = pagePathMapping[normalizedSlug] || pagePathMapping[slug];
+        if (!pagePath) continue;
+        try {
+          const { ContentFS } = await import("@xyd-js/content");
+          const { markdownPlugins } = await import("@xyd-js/content/md");
+          const settings = globalThis.__xydSettings;
+          const mdPlugins = await markdownPlugins({ maxDepth: 2 }, settings);
+          const remarkPlugins = [...mdPlugins.remarkPlugins];
+          const rehypePlugins = [...mdPlugins.rehypePlugins];
+          if (globalThis.__xydUserMarkdownPlugins?.remark?.length) {
+            remarkPlugins.push(globalThis.__xydUserMarkdownPlugins.remark);
+          }
+          if (globalThis.__xydUserMarkdownPlugins?.rehype?.length) {
+            rehypePlugins.push(globalThis.__xydUserMarkdownPlugins.rehype);
+          }
+          const contentFs = new ContentFS(
+            settings,
+            remarkPlugins,
+            rehypePlugins,
+            mdPlugins.recmaPlugins,
+            globalThis.__xydUserMarkdownPlugins?.remarkRehypeHandlers || {}
+          );
+          const code = await contentFs.compile(pagePath);
+          const fileName = `${encodeURIComponent(normalizedSlug)}.js`;
+          writeFileSync(join(outputDir, fileName), code, "utf-8");
+        } catch (e) {
+          console.error(
+            `[xyd:access-control] Failed to compile protected page ${slug}:`,
+            e
+          );
+        }
+      }
+    }
+  };
+}
+
+// src/components/LoginPage.tsx
+import React2 from "react";
+
+// src/components/AccessControlContext.tsx
+import React, { createContext, useContext, useEffect, useState, useCallback } from "react";
+var AccessControlCtx = createContext(null);
+function useAccessControl() {
+  const ctx = useContext(AccessControlCtx);
+  if (!ctx) {
+    throw new Error("useAccessControl must be used inside <AccessControlProvider>");
+  }
+  return ctx;
+}
+function AccessControlProvider({ children }) {
+  const [config, setConfig] = useState(null);
+  const [error, setError] = useState("");
+  const [ready, setReady] = useState(false);
+  useEffect(() => {
+    const globalConfig = window.__xydAccessControlSettings?.accessControlConfig;
+    if (globalConfig) {
+      setConfig(globalConfig);
+      setReady(true);
+      return;
+    }
+    import("virtual:xyd-access-control-settings").then((mod) => {
+      setConfig(mod.accessControlConfig);
+      setReady(true);
+    }).catch(() => setReady(true));
+  }, []);
+  const providerType = config?.provider?.type || "jwt";
+  const loginUrl = config?.provider?.loginUrl || "";
+  const authorizationUrl = config?.provider?.authorizationUrl || "";
+  const hasExternalAuth = providerType === "oauth" ? !!authorizationUrl : !!loginUrl && loginUrl !== "/login";
+  const loginConfig = typeof config?.login === "string" ? {} : config?.login || {};
+  const title = loginConfig.title || "Sign in to access documentation";
+  const description = loginConfig.description || "";
+  const logo = loginConfig.logo || "";
+  const backgroundImage = loginConfig.backgroundImage || "";
+  const params = typeof window !== "undefined" ? new URLSearchParams(window.location.search) : null;
+  const redirectUrl = params?.get("redirect") || "/";
+  const storeTokenAndRedirect = useCallback((token) => {
+    const cookieName = config?.session?.cookieName || "xyd-auth-token";
+    localStorage.setItem(cookieName, token);
+    document.cookie = `${cookieName}=${token}; path=/; max-age=86400; SameSite=Lax`;
+    window.location.href = redirectUrl;
+  }, [config, redirectUrl]);
+  const signInWithOAuth = useCallback(() => {
+    if (!authorizationUrl) {
+      setError("No OAuth authorization URL configured");
+      return;
+    }
+    const callbackPath = config?.provider?.callbackPath || "/auth/callback";
+    const redirectUri = window.location.origin + callbackPath;
+    const scopes = config?.provider?.scopes || [];
+    const clientId = config?.provider?.clientId || "";
+    const oauthParams = new URLSearchParams({
+      client_id: clientId,
+      redirect_uri: redirectUri,
+      response_type: "code",
+      scope: scopes.join(" "),
+      state: redirectUrl
+    });
+    window.location.href = `${authorizationUrl}?${oauthParams.toString()}`;
+  }, [config, authorizationUrl, redirectUrl]);
+  const signInWithRedirect = useCallback(() => {
+    if (!loginUrl || loginUrl === "/login") {
+      setError("No external login URL configured");
+      return;
+    }
+    const sep = loginUrl.includes("?") ? "&" : "?";
+    window.location.href = `${loginUrl}${sep}redirect=${encodeURIComponent(redirectUrl)}`;
+  }, [loginUrl, redirectUrl]);
+  const signInWithGroups = useCallback((groups) => {
+    const hasDeploy = !!config?.deploy;
+    if (hasDeploy) {
+      const groupsParam = groups.length ? `&groups=${groups.join(",")}` : "";
+      window.location.href = `/auth/test-login?redirect=${encodeURIComponent(redirectUrl)}${groupsParam}`;
+      return;
+    }
+    if (!isDevEnvironment()) {
+      setError("Test login is only available in development mode.");
+      return;
+    }
+    const header = btoa(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+    const payload = btoa(JSON.stringify({
+      sub: "test-user",
+      groups,
+      exp: Math.floor(Date.now() / 1e3) + 86400,
+      iat: Math.floor(Date.now() / 1e3)
+    }));
+    storeTokenAndRedirect(`${header}.${payload}.dGVzdA`);
+  }, [config, redirectUrl, storeTokenAndRedirect]);
+  const signInAsUser = useCallback(() => signInWithGroups([]), [signInWithGroups]);
+  const signInAsAdmin = useCallback(() => signInWithGroups(["admin"]), [signInWithGroups]);
+  const value = {
+    config,
+    ready,
+    error,
+    clearError: () => setError(""),
+    signInWithOAuth,
+    signInWithRedirect,
+    signInAsUser,
+    signInAsAdmin,
+    signInWithGroups,
+    providerType,
+    hasExternalAuth,
+    title,
+    description,
+    logo,
+    backgroundImage,
+    redirectUrl
+  };
+  return /* @__PURE__ */ React.createElement(AccessControlCtx.Provider, { value }, children);
+}
+
+// src/components/LoginPage.tsx
+function LoginPage() {
+  return /* @__PURE__ */ React2.createElement(AccessControlProvider, null, /* @__PURE__ */ React2.createElement(LoginPageUI, null));
+}
+function LoginPageUI() {
+  const {
+    providerType,
+    hasExternalAuth,
+    title,
+    description,
+    logo,
+    backgroundImage,
+    error,
+    signInWithOAuth,
+    signInWithRedirect,
+    signInAsUser,
+    signInAsAdmin
+  } = useAccessControl();
+  const handleSignIn = () => {
+    if (providerType === "oauth") signInWithOAuth();
+    else signInWithRedirect();
+  };
+  const bgOverride = backgroundImage ? { backgroundImage: `url(${backgroundImage})`, backgroundSize: "cover", backgroundPosition: "center", background: "none" } : void 0;
+  return /* @__PURE__ */ React2.createElement("div", { className: "xyd-login-page", style: bgOverride }, /* @__PURE__ */ React2.createElement("div", { part: "card" }, logo && /* @__PURE__ */ React2.createElement("img", { part: "logo", src: logo, alt: "" }), /* @__PURE__ */ React2.createElement("h1", { part: "title" }, title), description && /* @__PURE__ */ React2.createElement("p", { part: "description" }, description), error && /* @__PURE__ */ React2.createElement("p", { part: "error" }, error), hasExternalAuth ? /* @__PURE__ */ React2.createElement("button", { part: "button", onClick: handleSignIn }, "Sign in") : /* @__PURE__ */ React2.createElement("div", { part: "actions" }, /* @__PURE__ */ React2.createElement("button", { part: "button", onClick: signInAsUser }, "Sign in as User"), /* @__PURE__ */ React2.createElement("button", { part: "button", "data-kind": "secondary", onClick: signInAsAdmin }, "Sign in as Admin"))));
+}
+
+// src/components/AuthCallbackPage.tsx
+import React3, { useEffect as useEffect2, useState as useState2 } from "react";
+function AuthCallbackPage() {
+  const [error, setError] = useState2("");
+  useEffect2(() => {
+    if (typeof window === "undefined") return;
+    import("virtual:xyd-access-control-settings").then((mod) => {
+      const config = mod.accessControlConfig;
+      handleCallback(config);
+    }).catch(() => {
+      handleCallback(null);
+    });
+  }, []);
+  function storeTokenAndRedirect(token, groups, redirect, cookieName) {
+    localStorage.setItem(cookieName, token);
+    document.cookie = `${cookieName}=${token}; path=/; max-age=86400; SameSite=Lax`;
+    window.__xydAuthState = {
+      authenticated: true,
+      groups,
+      token
+    };
+    document.documentElement.setAttribute("data-auth", "authenticated");
+    window.location.href = redirect;
+  }
+  async function handleCallback(config) {
+    const params = new URLSearchParams(window.location.search);
+    const hash = window.location.hash.slice(1);
+    const code = params.get("code");
+    const state = params.get("state") || "/";
+    const cookieName = config?.session?.cookieName || "xyd-auth-token";
+    const groupsClaim = config?.provider?.groupsClaim || "groups";
+    if (code && config?.provider?.type === "oauth") {
+      try {
+        await handleOAuthCallback(code, state, config, cookieName, groupsClaim);
+      } catch (e) {
+        setError(e instanceof Error ? e.message : "OAuth authentication failed");
+      }
+      return;
+    }
+    const token = params.get("token") || hash;
+    const redirect = params.get("redirect") || state;
+    if (token) {
+      try {
+        handleJWTCallback(token, redirect, cookieName, groupsClaim);
+      } catch (e) {
+        setError(e instanceof Error ? e.message : "JWT authentication failed");
+      }
+      return;
+    }
+    setError("No authentication data found in callback URL.");
+  }
+  function handleJWTCallback(hash, redirect, cookieName, groupsClaim) {
+    const parts = hash.split(".");
+    if (parts.length !== 3) throw new Error("Invalid JWT format");
+    const payload = JSON.parse(atob(parts[1]));
+    if (payload.exp && payload.exp * 1e3 < Date.now()) {
+      throw new Error("Token has expired");
+    }
+    storeTokenAndRedirect(hash, payload[groupsClaim] || [], redirect, cookieName);
+  }
+  async function handleOAuthCallback(code, redirect, config, cookieName, groupsClaim) {
+    const tokenUrl = config.provider.tokenUrl;
+    const userInfoUrl = config.provider.userInfoUrl;
+    const clientId = config.provider.clientId || "";
+    const callbackPath = config.provider.callbackPath || "/auth/callback";
+    const redirectUri = window.location.origin + callbackPath;
+    if (!tokenUrl) throw new Error("No token URL configured");
+    const tokenRes = await fetch(tokenUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        client_id: clientId,
+        redirect_uri: redirectUri
+      }).toString()
+    });
+    if (!tokenRes.ok) {
+      throw new Error(`Token exchange failed: ${tokenRes.status}`);
+    }
+    const tokenData = await tokenRes.json();
+    const accessToken = tokenData.access_token;
+    if (!accessToken) throw new Error("No access token in response");
+    let groups = [];
+    if (userInfoUrl) {
+      try {
+        const userRes = await fetch(userInfoUrl, {
+          headers: { Authorization: `Bearer ${accessToken}` }
+        });
+        if (userRes.ok) {
+          const userInfo = await userRes.json();
+          groups = userInfo[groupsClaim] || userInfo.roles || userInfo.groups || [];
+        }
+      } catch {
+      }
+    }
+    const header = btoa(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+    const payload = btoa(JSON.stringify({
+      sub: "oauth-user",
+      [groupsClaim]: groups,
+      exp: Math.floor(Date.now() / 1e3) + 86400,
+      iat: Math.floor(Date.now() / 1e3),
+      access_token: accessToken
+    }));
+    const sessionToken = `${header}.${payload}.oauth`;
+    storeTokenAndRedirect(sessionToken, groups, redirect, cookieName);
+  }
+  if (error) {
+    return /* @__PURE__ */ React3.createElement("div", { className: "xyd-callback-page" }, /* @__PURE__ */ React3.createElement("div", { part: "card" }, /* @__PURE__ */ React3.createElement("h2", { part: "title", "data-error": "" }, "Authentication Error"), /* @__PURE__ */ React3.createElement("p", { part: "message" }, error), /* @__PURE__ */ React3.createElement("button", { part: "button", onClick: () => window.location.href = "/" }, "Go to homepage")));
+  }
+  return /* @__PURE__ */ React3.createElement("div", { className: "xyd-callback-page" }, /* @__PURE__ */ React3.createElement("div", { part: "card" }, /* @__PURE__ */ React3.createElement("p", { part: "message" }, "Authenticating...")));
+}
+
+// src/styles/login.css
+var login_default = '@layer defaults {\n  .xyd-login-page {\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    position: fixed;\n    inset: 0;\n    overflow: hidden;\n    font-family: var(--font-body-family, system-ui, sans-serif);\n    background: radial-gradient(ellipse at 50% 50%, #f9b8d2 0%, #c6dff7 40%, #7ec8f0 100%);\n  }\n\n  .xyd-login-page [part="card"] {\n    display: flex;\n    flex-direction: column;\n    align-items: center;\n    width: 100%;\n    max-width: 350px;\n    padding: var(--xyd-padding-xxlarge, 44px);\n    background: rgba(255, 255, 255, 0.92);\n    border-radius: var(--xyd-border-radius-large, 16px);\n    box-shadow: 0 8px 32px rgba(0, 0, 0, 0.08);\n    backdrop-filter: blur(12px);\n  }\n\n  .xyd-login-page [part="logo"] {\n    max-height: 30px;\n    width: auto;\n    margin-bottom: var(--xyd-padding-xlarge, 30px);\n  }\n\n  .xyd-login-page [part="title"] {\n    font-size: var(--xyd-font-size-2xl, 32px);\n    font-weight: var(--xyd-font-weight-bold, 700);\n    line-height: var(--xyd-line-height-2xl, 48px);\n    margin: 0 0 var(--xyd-padding-small, 6px);\n    text-align: center;\n    color: var(--dark100, #000);\n  }\n\n  .xyd-login-page [part="description"] {\n    color: var(--dark48, #6e6e80);\n    font-size: var(--xyd-font-size-small, 14px);\n    line-height: var(--xyd-line-height-small, 20px);\n    margin: 0 0 var(--xyd-padding-xxlarge, 44px);\n    text-align: center;\n  }\n\n  .xyd-login-page [part="error"] {\n    color: var(--xyd-text-color--error, #ef4444);\n    font-size: var(--xyd-font-size-xsmall, 12px);\n    line-height: var(--xyd-line-height-xsmall, 16px);\n    margin: 0 0 var(--xyd-padding-medium, 10px);\n  }\n\n  .xyd-login-page [part="form"] {\n    width: 100%;\n  }\n\n  .xyd-login-page [part="input"] {\n    width: 100%;\n    padding: var(--xyd-padding-medium, 10px) var(--xyd-padding-small, 6px);\n    font-size: var(--xyd-font-size-small, 14px);\n    line-height: var(--xyd-line-height-small, 20px);\n    font-family: inherit;\n    border: 1px solid var(--dark32, #ececf1);\n    border-radius: var(--xyd-border-radius-small, 4px);\n    margin-bottom: var(--xyd-padding-medium, 10px);\n    box-sizing: border-box;\n    outline: none;\n    background: var(--white, #fff);\n    color: var(--dark80, #111827);\n  }\n\n  .xyd-login-page [part="input"]:focus {\n    border-color: var(--dark48, #6e6e80);\n  }\n\n  .xyd-login-page [part="actions"] {\n    width: 100%;\n    display: flex;\n    flex-direction: column;\n    gap: var(--xyd-padding-small, 6px);\n  }\n\n  .xyd-login-page [part="button"] {\n    width: 100%;\n    padding: var(--xyd-padding-medium, 10px) var(--xyd-padding-large, 18px);\n    font-size: var(--xyd-font-size-small, 14px);\n    font-weight: var(--xyd-font-weight-medium, 500);\n    font-family: inherit;\n    background-color: var(--xyd-button-primary-bg, var(--color-primary, #111));\n    color: var(--xyd-button-primary-color, #fff);\n    border: 1px solid var(--xyd-button-primary-border, transparent);\n    border-radius: var(--xyd-button-border-radius, 6px);\n    cursor: pointer;\n    transition: background-color 0.15s linear;\n  }\n\n  .xyd-login-page [part="button"]:hover {\n    background-color: var(--xyd-button-primary-bg-hover, var(--color-primary--active, #333));\n  }\n\n  .xyd-login-page [part="button"][data-kind="secondary"] {\n    background-color: var(--xyd-button-secondary-bg, #f5f5f1);\n    color: var(--xyd-button-secondary-color, #111);\n    border: 1px solid var(--xyd-button-secondary-border, #ececf1);\n  }\n\n  .xyd-login-page [part="button"][data-kind="secondary"]:hover {\n    background-color: var(--xyd-button-secondary-bg-hover, #e5e5e1);\n  }\n}\n';
+
+// src/styles/callback.css
+var callback_default = '@layer defaults {\n  .xyd-callback-page {\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    position: fixed;\n    inset: 0;\n    overflow: hidden;\n    font-family: var(--font-body-family, system-ui, sans-serif);\n    background: radial-gradient(ellipse at 50% 50%, #f9b8d2 0%, #c6dff7 40%, #7ec8f0 100%);\n  }\n\n  .xyd-callback-page [part="card"] {\n    display: flex;\n    flex-direction: column;\n    align-items: center;\n    text-align: center;\n    max-width: 350px;\n    padding: var(--xyd-padding-xxlarge, 44px);\n    background: rgba(255, 255, 255, 0.92);\n    border-radius: var(--xyd-border-radius-large, 16px);\n    box-shadow: 0 8px 32px rgba(0, 0, 0, 0.08);\n    backdrop-filter: blur(12px);\n  }\n\n  .xyd-callback-page [part="title"] {\n    font-size: var(--xyd-font-size-xlarge, 22px);\n    font-weight: var(--xyd-font-weight-semibold, 600);\n    line-height: var(--xyd-line-height-xlarge, 36px);\n    margin: 0 0 var(--xyd-padding-small, 6px);\n    color: var(--dark100, #000);\n  }\n\n  .xyd-callback-page [part="title"][data-error] {\n    color: var(--xyd-text-color--error, #ef4444);\n  }\n\n  .xyd-callback-page [part="message"] {\n    color: var(--dark48, #6e6e80);\n    font-size: var(--xyd-font-size-small, 14px);\n    line-height: var(--xyd-line-height-small, 20px);\n  }\n\n  .xyd-callback-page [part="button"] {\n    margin-top: var(--xyd-padding-large, 18px);\n    padding: var(--xyd-padding-medium, 10px) var(--xyd-padding-large, 18px);\n    font-size: var(--xyd-font-size-small, 14px);\n    font-weight: var(--xyd-font-weight-medium, 500);\n    font-family: inherit;\n    background-color: var(--xyd-button-primary-bg, var(--color-primary, #111));\n    color: var(--xyd-button-primary-color, #fff);\n    border: 1px solid var(--xyd-button-primary-border, transparent);\n    border-radius: var(--xyd-button-border-radius, 6px);\n    cursor: pointer;\n  }\n\n  .xyd-callback-page [part="button"]:hover {\n    background-color: var(--xyd-button-primary-bg-hover, var(--color-primary--active, #333));\n  }\n}';
+
+// src/components/AuthGuard.tsx
+import React4, {
+  createContext as createContext2,
+  useContext as useContext2,
+  useEffect as useEffect3,
+  useState as useState3,
+  useMemo
+} from "react";
+var AuthContext = createContext2({
+  authenticated: false,
+  groups: [],
+  token: null
+});
+function buildLoginUrl(loginUrl, returnPath) {
+  const separator = loginUrl.includes("?") ? "&" : "?";
+  return `${loginUrl}${separator}redirect=${encodeURIComponent(returnPath)}`;
+}
+function AuthGuard({ children, accessMap, config }) {
+  const [authState, setAuthState] = useState3(() => {
+    if (typeof window !== "undefined" && window.__xydAuthState) {
+      return window.__xydAuthState;
+    }
+    return { authenticated: false, groups: [], token: null };
+  });
+  useEffect3(() => {
+    const handleStorage = (e) => {
+      const cookieName = config.session?.cookieName || "xyd-auth-token";
+      if (e.key === cookieName) {
+        if (e.newValue) {
+          try {
+            const payload = JSON.parse(atob(e.newValue.split(".")[1]));
+            setAuthState({
+              authenticated: true,
+              groups: payload.groups || [],
+              token: e.newValue
+            });
+          } catch {
+            setAuthState({ authenticated: false, groups: [], token: null });
+          }
+        } else {
+          setAuthState({ authenticated: false, groups: [], token: null });
+        }
+      }
+    };
+    window.addEventListener("storage", handleStorage);
+    return () => window.removeEventListener("storage", handleStorage);
+  }, [config.session?.cookieName]);
+  const value = useMemo(() => authState, [authState]);
+  return /* @__PURE__ */ React4.createElement(AuthContext.Provider, { value }, /* @__PURE__ */ React4.createElement(AuthEnforcer, { accessMap, config }, children));
+}
+function AuthEnforcer({
+  children,
+  accessMap,
+  config
+}) {
+  const authState = useContext2(AuthContext);
+  useEffect3(() => {
+    if (typeof window === "undefined") return;
+    const pathname = window.location.pathname;
+    const pageAccess = accessMap[pathname];
+    if (!pageAccess || pageAccess === "public") return;
+    if (!authState.authenticated) {
+      const loginUrl = config.provider.loginUrl;
+      if (loginUrl) {
+        window.location.href = buildLoginUrl(loginUrl, pathname);
+      }
+      return;
+    }
+    if (pageAccess !== "authenticated") {
+      const requiredGroups = pageAccess.split(",");
+      const hasAccess = requiredGroups.some(
+        (g) => authState.groups.includes(g)
+      );
+      if (!hasAccess) {
+        if (config.unauthorizedBehavior === "404") {
+          window.location.href = "/404";
+        } else {
+          const loginUrl = config.provider.loginUrl;
+          if (loginUrl) {
+            window.location.href = buildLoginUrl(loginUrl, pathname);
+          }
+        }
+      }
+    }
+  }, [authState, accessMap, config]);
+  return /* @__PURE__ */ React4.createElement(React4.Fragment, null, children);
+}
+function useAuth() {
+  const state = useContext2(AuthContext);
+  return {
+    ...state,
+    login() {
+      console.warn("[xyd:access-control] login() called without config");
+    },
+    logout() {
+      if (typeof window === "undefined") return;
+      const cookieName = "xyd-auth-token";
+      localStorage.removeItem(cookieName);
+      document.cookie = `${cookieName}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/`;
+      document.cookie = `${cookieName}-state=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/`;
+      window.__xydAuthState = {
+        authenticated: false,
+        groups: [],
+        token: null
+      };
+      document.documentElement.setAttribute("data-auth", "anonymous");
+      window.location.reload();
+    }
+  };
+}
+
+// src/navigation.ts
+function filterSidebarGroups(sidebarGroups, accessMap, userGroups) {
+  return sidebarGroups.map((group) => ({
+    ...group,
+    items: filterItems(group.items, accessMap, userGroups)
+  })).filter((group) => group.items.length > 0);
+}
+function filterItems(items, accessMap, userGroups) {
+  return items.filter((item) => {
+    const href = item.href;
+    if (!href) return true;
+    const normalizedHref = href.startsWith("/") ? href : `/${href}`;
+    const access = accessMap[normalizedHref] || accessMap[href];
+    if (!access || access === "public") return true;
+    if (access === "authenticated") return userGroups.length > 0;
+    const requiredGroups = access.split(",");
+    return requiredGroups.some((g) => userGroups.includes(g));
+  }).map((item) => {
+    if (item.items?.length) {
+      return {
+        ...item,
+        items: filterItems(item.items, accessMap, userGroups)
+      };
+    }
+    return item;
+  });
+}
+function filterProtectedPaths(paths, accessMap) {
+  return paths.filter((p) => {
+    const normalizedPath = p.startsWith("/") ? p : `/${p}`;
+    const access = accessMap[normalizedPath] || accessMap[p];
+    return !access || access === "public";
+  });
+}
+
+// src/index.ts
+function edgeMiddlewarePlugin(config) {
+  return {
+    name: "xyd-plugin-access-control-deploy",
+    apply: "build",
+    async closeBundle() {
+      if (!config.deploy) return;
+      const outputDir = globalThis.__xydBuildOutputDir || process.cwd() + "/.xyd/build/client";
+      switch (config.deploy.platform) {
+        case "netlify-edge":
+          await generateNetlifyEdge(config, outputDir);
+          break;
+        case "vercel-edge":
+          await generateVercelMiddleware(config, outputDir);
+          break;
+        case "cloudflare-edge":
+          await generateCloudflareMiddleware(config, outputDir);
+          break;
+        case "node-edge":
+          await generateNodeServer(config, outputDir);
+          break;
+      }
+    }
+  };
+}
+function buildAccessMapFromGlobals(config) {
+  const pagePathMapping = globalThis.__xydPagePathMapping || {};
+  const accessMap = {};
+  for (const pagePath of Object.keys(pagePathMapping)) {
+    const access = resolvePageAccess(pagePath, {}, config);
+    accessMap[pagePath] = access;
+    const withSlash = pagePath.startsWith("/") ? pagePath : `/${pagePath}`;
+    accessMap[withSlash] = access;
+  }
+  globalThis.__xydAccessMap = accessMap;
+  return accessMap;
+}
+function AccessControlPlugin(pluginOptions) {
+  return (settings) => {
+    const config = pluginOptions;
+    const cookieName = config.session?.cookieName || "xyd-auth-token";
+    const groupsClaim = "groupsClaim" in config.provider ? config.provider.groupsClaim || "groups" : "groups";
+    const authCss = `[data-auth="anonymous"] [data-auth-protected]{display:none!important}
+${login_default}
+${callback_default}`;
+    const prehydrationScript = generateAuthPrehydrationScript(
+      cookieName,
+      groupsClaim
+    );
+    const head = [
+      ["style", {}, authCss],
+      ["script", {}, prehydrationScript]
+    ];
+    const vitePlugins = [
+      virtualAccessControlSettingsPlugin(config, buildAccessMapFromGlobals),
+      protectedContentPlugin(config, buildAccessMapFromGlobals)
+    ];
+    if (config.deploy) {
+      vitePlugins.push(edgeMiddlewarePlugin(config));
+    }
+    const callbackRoute = "callbackPath" in config.provider ? config.provider.callbackPath || "/auth/jwt-callback" : "/auth/jwt-callback";
+    const isCustomLogin = typeof config.login === "string";
+    const loginConfig = isCustomLogin ? {} : config.login || {};
+    return {
+      name: "plugin-access-control",
+      vite: vitePlugins,
+      head,
+      // Custom pages rendered inside the xyd theme layout
+      pages: [
+        {
+          route: "/login",
+          component: isCustomLogin ? LoginPage : LoginPage,
+          // component is resolved at runtime
+          dist: isCustomLogin ? config.login : "@xyd-js/plugin-access-control/LoginPage",
+          metadata: {
+            title: loginConfig.title || "Sign in",
+            description: loginConfig.description
+          },
+          public: true
+        },
+        {
+          route: callbackRoute,
+          component: AuthCallbackPage,
+          dist: "@xyd-js/plugin-access-control/AuthCallbackPage",
+          metadata: { title: "Authenticating" },
+          public: true
+        }
+      ]
+    };
+  };
+}
+export {
+  AccessControlProvider,
+  AuthCallbackPage,
+  AuthGuard,
+  LoginPage,
+  buildAccessMap,
+  AccessControlPlugin as default,
+  evaluateAccess,
+  filterProtectedPaths,
+  filterSidebarGroups,
+  resolvePageAccess,
+  useAccessControl,
+  useAuth
+};
+//# sourceMappingURL=index.js.map