@classic-homes/auth 0.1.0

package/dist/index.js

@@ -0,0 +1,1197 @@
+// src/core/config.ts
+var config = null;
+function initAuth(options) {
+  config = {
+    ...options,
+    storageKey: options.storageKey ?? "classic_auth"
+  };
+}
+function getConfig() {
+  if (!config) {
+    throw new Error(
+      '@classic-homes/auth not initialized. Call initAuth({ baseUrl: "..." }) before using auth services.'
+    );
+  }
+  return config;
+}
+function isInitialized() {
+  return config !== null;
+}
+function resetConfig() {
+  config = null;
+}
+function getDefaultStorage() {
+  if (typeof window !== "undefined" && window.localStorage) {
+    return {
+      getItem: (key) => localStorage.getItem(key),
+      setItem: (key, value) => localStorage.setItem(key, value),
+      removeItem: (key) => localStorage.removeItem(key)
+    };
+  }
+  return {
+    getItem: () => null,
+    setItem: () => {
+    },
+    removeItem: () => {
+    }
+  };
+}
+function getStorage() {
+  const cfg = getConfig();
+  return cfg.storage ?? getDefaultStorage();
+}
+function getFetch() {
+  const cfg = getConfig();
+  return cfg.fetch ?? fetch;
+}
+
+// src/core/client.ts
+var isRefreshing = false;
+var refreshSubscribers = [];
+function subscribeTokenRefresh(cb) {
+  refreshSubscribers.push(cb);
+}
+function onTokenRefreshed(token) {
+  refreshSubscribers.forEach((cb) => cb(token));
+  refreshSubscribers = [];
+}
+function getAccessToken() {
+  const config2 = getConfig();
+  const storage = getStorage();
+  const authData = storage.getItem(config2.storageKey ?? "classic_auth");
+  if (!authData) return null;
+  try {
+    const parsed = JSON.parse(authData);
+    return parsed.accessToken ?? null;
+  } catch {
+    return null;
+  }
+}
+function getRefreshToken() {
+  const config2 = getConfig();
+  const storage = getStorage();
+  const authData = storage.getItem(config2.storageKey ?? "classic_auth");
+  if (!authData) return null;
+  try {
+    const parsed = JSON.parse(authData);
+    return parsed.refreshToken ?? null;
+  } catch {
+    return null;
+  }
+}
+function getSessionToken() {
+  const storage = getStorage();
+  return storage.getItem("sessionToken");
+}
+function updateStoredTokens(accessToken, refreshToken) {
+  const config2 = getConfig();
+  const storage = getStorage();
+  const storageKey = config2.storageKey ?? "classic_auth";
+  const authData = storage.getItem(storageKey);
+  let parsed = {};
+  if (authData) {
+    try {
+      parsed = JSON.parse(authData);
+    } catch {
+    }
+  }
+  parsed.accessToken = accessToken;
+  parsed.refreshToken = refreshToken;
+  storage.setItem(storageKey, JSON.stringify(parsed));
+  config2.onTokenRefresh?.({ accessToken, refreshToken });
+}
+function clearStoredAuth() {
+  const config2 = getConfig();
+  const storage = getStorage();
+  storage.removeItem(config2.storageKey ?? "classic_auth");
+  storage.removeItem("sessionToken");
+}
+async function refreshAccessToken() {
+  const refreshToken = getRefreshToken();
+  const config2 = getConfig();
+  const fetchFn = getFetch();
+  if (!refreshToken) {
+    return false;
+  }
+  try {
+    const response = await fetchFn(`${config2.baseUrl}/auth/refresh`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ refreshToken })
+    });
+    if (response.ok) {
+      const apiResponse = await response.json();
+      const data = apiResponse.data;
+      const tokens = data && typeof data === "object" && "data" in data ? data.data : data;
+      if (tokens?.accessToken && tokens?.refreshToken) {
+        updateStoredTokens(tokens.accessToken, tokens.refreshToken);
+        onTokenRefreshed(tokens.accessToken);
+        return true;
+      }
+    }
+  } catch (error) {
+    config2.onAuthError?.(error instanceof Error ? error : new Error("Token refresh failed"));
+  }
+  return false;
+}
+function extractData(response) {
+  if (response && typeof response === "object" && "data" in response) {
+    const dataField = response.data;
+    if (dataField && typeof dataField === "object" && "data" in dataField) {
+      return dataField.data;
+    }
+    if (dataField !== void 0) {
+      return dataField;
+    }
+  }
+  return response;
+}
+async function apiRequest(endpoint, options = {}) {
+  const { authenticated = false, customFetch, body, ...fetchOptions } = options;
+  const config2 = getConfig();
+  const fetchFn = customFetch ?? getFetch();
+  const url = endpoint.startsWith("http") ? endpoint : `${config2.baseUrl}${endpoint}`;
+  const headers = {
+    "Content-Type": "application/json",
+    ...fetchOptions.headers
+  };
+  if (authenticated) {
+    const accessToken = getAccessToken();
+    const sessionToken = getSessionToken();
+    if (accessToken) {
+      headers["Authorization"] = `Bearer ${accessToken}`;
+    }
+    if (sessionToken) {
+      headers["X-Session-Token"] = sessionToken;
+    }
+  }
+  try {
+    const response = await fetchFn(url, {
+      ...fetchOptions,
+      headers,
+      body: body ? JSON.stringify(body) : void 0
+    });
+    if (response.status === 401 && authenticated && typeof window !== "undefined") {
+      if (!isRefreshing) {
+        isRefreshing = true;
+        const refreshed = await refreshAccessToken();
+        isRefreshing = false;
+        if (refreshed) {
+          return apiRequest(endpoint, options);
+        } else {
+          clearStoredAuth();
+          config2.onLogout?.();
+          throw new Error("Authentication failed. Please sign in again.");
+        }
+      } else {
+        return new Promise((resolve, reject) => {
+          subscribeTokenRefresh(() => {
+            apiRequest(endpoint, options).then(resolve).catch(reject);
+          });
+        });
+      }
+    }
+    const data = await response.json();
+    if (!response.ok) {
+      const dataObj = data;
+      const errorMessage = data.error?.message || (typeof dataObj.message === "string" ? dataObj.message : void 0) || data.meta?.message || (typeof dataObj.detail === "string" ? dataObj.detail : void 0) || "Request failed";
+      const error = new Error(errorMessage);
+      config2.onAuthError?.(error);
+      throw error;
+    }
+    return data;
+  } catch (error) {
+    if (error instanceof Error) {
+      throw error;
+    }
+    throw new Error("API request failed");
+  }
+}
+var api = {
+  get: (endpoint, authenticated = false, customFetch) => apiRequest(endpoint, { method: "GET", authenticated, customFetch }),
+  post: (endpoint, body, authenticated = false, customFetch) => apiRequest(endpoint, {
+    method: "POST",
+    body,
+    authenticated,
+    customFetch
+  }),
+  put: (endpoint, body, authenticated = false, customFetch) => apiRequest(endpoint, {
+    method: "PUT",
+    body,
+    authenticated,
+    customFetch
+  }),
+  patch: (endpoint, body, authenticated = false, customFetch) => apiRequest(endpoint, {
+    method: "PATCH",
+    body,
+    authenticated,
+    customFetch
+  }),
+  delete: (endpoint, authenticated = false, customFetch, body) => apiRequest(endpoint, {
+    method: "DELETE",
+    body,
+    authenticated,
+    customFetch
+  })
+};
+
+// src/core/api.ts
+var authApi = {
+  // ============================================================================
+  // Authentication
+  // ============================================================================
+  /**
+   * Login with username and password.
+   */
+  async login(credentials) {
+    const response = await api.post("/auth/login", credentials);
+    return extractData(response);
+  },
+  /**
+   * Logout the current user.
+   */
+  async logout() {
+    await api.post("/auth/logout", {}, true);
+  },
+  /**
+   * Register a new user.
+   */
+  async register(data) {
+    const response = await api.post("/auth/register", data);
+    return extractData(response);
+  },
+  /**
+   * Request a password reset email.
+   */
+  async forgotPassword(email) {
+    await api.post("/auth/forgot-password", { email });
+  },
+  /**
+   * Reset password with a token.
+   */
+  async resetPassword(token, newPassword) {
+    await api.post("/auth/reset-password", { token, newPassword });
+  },
+  /**
+   * Refresh the access token.
+   */
+  async refreshToken(refreshToken) {
+    const response = await api.post("/auth/refresh", { refreshToken });
+    return extractData(response);
+  },
+  /**
+   * Initiate SSO login by redirecting to the SSO provider.
+   */
+  initiateSSOLogin() {
+    if (typeof window === "undefined") return;
+    const config2 = getConfig();
+    const authorizeUrl = config2.sso?.authorizeUrl ?? `${config2.baseUrl}/auth/sso/authorize`;
+    window.location.href = authorizeUrl;
+  },
+  // ============================================================================
+  // Profile
+  // ============================================================================
+  /**
+   * Get the current user's profile.
+   */
+  async getProfile(customFetch) {
+    const response = await api.get("/auth/profile", true, customFetch);
+    return response;
+  },
+  /**
+   * Update the current user's profile.
+   */
+  async updateProfile(data) {
+    const response = await api.put("/auth/profile", data, true);
+    return extractData(response);
+  },
+  /**
+   * Change the current user's password.
+   */
+  async changePassword(data) {
+    await api.put("/auth/change-password", data, true);
+  },
+  // ============================================================================
+  // Email Verification
+  // ============================================================================
+  /**
+   * Resend email verification.
+   */
+  async resendVerification() {
+    await api.post("/auth/resend-verification", {}, true);
+  },
+  /**
+   * Verify email with a token.
+   */
+  async verifyEmail(token) {
+    const response = await api.post("/auth/verify-email", {
+      token
+    });
+    return extractData(response);
+  },
+  // ============================================================================
+  // Session Management
+  // ============================================================================
+  /**
+   * Get all active sessions.
+   */
+  async getSessions(customFetch) {
+    const response = await api.get(
+      "/auth/sessions",
+      true,
+      customFetch
+    );
+    return response;
+  },
+  /**
+   * Revoke a specific session.
+   */
+  async revokeSession(sessionId) {
+    await api.delete(`/auth/sessions/${sessionId}`, true);
+  },
+  /**
+   * Revoke all sessions except the current one.
+   */
+  async revokeAllSessions() {
+    await api.delete("/auth/sessions", true);
+  },
+  // ============================================================================
+  // API Key Management
+  // ============================================================================
+  /**
+   * Get all API keys.
+   */
+  async getApiKeys(customFetch) {
+    const response = await api.get("/auth/api-keys", true, customFetch);
+    return response;
+  },
+  /**
+   * Create a new API key.
+   */
+  async createApiKey(data) {
+    const response = await api.post("/auth/api-keys", data, true);
+    return extractData(response);
+  },
+  /**
+   * Revoke an API key.
+   */
+  async revokeApiKey(keyId) {
+    await api.delete(`/auth/api-keys/${keyId}`, true);
+  },
+  /**
+   * Update an API key's name.
+   */
+  async updateApiKey(keyId, data) {
+    await api.put(`/auth/api-keys/${keyId}`, data, true);
+  },
+  // ============================================================================
+  // MFA Management
+  // ============================================================================
+  /**
+   * Get MFA status for the current user.
+   */
+  async getMFAStatus() {
+    const response = await api.get("/auth/mfa/status", true);
+    return response;
+  },
+  /**
+   * Setup MFA (get QR code and backup codes).
+   */
+  async setupMFA() {
+    const response = await api.post("/auth/mfa-setup", {}, true);
+    return extractData(response);
+  },
+  /**
+   * Verify MFA setup with a code.
+   */
+  async verifyMFASetup(code) {
+    await api.post("/auth/mfa/verify", { code }, true);
+  },
+  /**
+   * Disable MFA.
+   */
+  async disableMFA(password) {
+    await api.delete("/auth/mfa", true, void 0, { password });
+  },
+  /**
+   * Regenerate MFA backup codes.
+   */
+  async regenerateBackupCodes(password) {
+    const response = await api.post(
+      "/auth/mfa/regenerate-backup-codes",
+      { password },
+      true
+    );
+    return extractData(response);
+  },
+  /**
+   * Verify MFA challenge during login.
+   */
+  async verifyMFAChallenge(data) {
+    const config2 = getConfig();
+    const fetchFn = config2.fetch ?? fetch;
+    const requestBody = {
+      code: data.code,
+      type: data.method === "backup" ? "backup" : "totp",
+      trustDevice: data.trustDevice
+    };
+    const response = await fetchFn(`${config2.baseUrl}/auth/mfa/challenge`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${data.mfaToken}`
+      },
+      body: JSON.stringify(requestBody)
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ message: "Verification failed" }));
+      throw new Error(error.error?.message || error.message || "Invalid verification code");
+    }
+    const result = await response.json();
+    return extractData(result);
+  },
+  // ============================================================================
+  // Device Management
+  // ============================================================================
+  /**
+   * Get all devices.
+   */
+  async getDevices(customFetch) {
+    const response = await api.get(
+      "/auth/devices",
+      true,
+      customFetch
+    );
+    return response;
+  },
+  /**
+   * Trust a device.
+   */
+  async trustDevice(deviceId) {
+    await api.put(`/auth/devices/${deviceId}/trust`, {}, true);
+  },
+  /**
+   * Revoke device trust.
+   */
+  async revokeDevice(deviceId) {
+    await api.delete(`/auth/devices/${deviceId}/revoke`, true);
+  },
+  /**
+   * Remove a device completely.
+   */
+  async removeDevice(deviceId) {
+    await api.delete(`/auth/devices/${deviceId}`, true);
+  },
+  /**
+   * Approve a device with a token.
+   */
+  async approveDevice(token) {
+    const response = await api.post("/auth/device/approve", {
+      token
+    });
+    return extractData(response);
+  },
+  /**
+   * Block a device with a token.
+   */
+  async blockDevice(token) {
+    const response = await api.post("/auth/device/block", {
+      token
+    });
+    return extractData(response);
+  },
+  // ============================================================================
+  // Preferences
+  // ============================================================================
+  /**
+   * Get user preferences.
+   */
+  async getPreferences(customFetch) {
+    const response = await api.get(
+      "/auth/preferences",
+      true,
+      customFetch
+    );
+    if (response && typeof response === "object" && "preferences" in response) {
+      return response.preferences;
+    }
+    return response ?? {};
+  },
+  /**
+   * Update user preferences.
+   */
+  async updatePreferences(data) {
+    await api.put("/auth/preferences", data, true);
+  },
+  // ============================================================================
+  // SSO / Linked Accounts
+  // ============================================================================
+  /**
+   * Get SSO linked accounts.
+   */
+  async getSSOAccounts(customFetch) {
+    const response = await api.get(
+      "/auth/sso/accounts",
+      true,
+      customFetch
+    );
+    if (response && typeof response === "object" && "accounts" in response) {
+      return response.accounts;
+    }
+    return Array.isArray(response) ? response : [];
+  },
+  /**
+   * Unlink an SSO account.
+   */
+  async unlinkSSOAccount(provider, password) {
+    await api.delete("/auth/sso/unlink", true, void 0, { provider, password });
+  },
+  /**
+   * Link an SSO account (redirects to SSO provider).
+   */
+  async linkSSOAccount(provider = "authentik") {
+    if (typeof window === "undefined") return;
+    const accessToken = getAccessToken();
+    if (!accessToken) {
+      throw new Error("Not authenticated");
+    }
+    const config2 = getConfig();
+    const params = new URLSearchParams({
+      token: accessToken,
+      provider
+    });
+    window.location.href = `${config2.baseUrl}/auth/sso/link?${params.toString()}`;
+  },
+  // ============================================================================
+  // Security Events
+  // ============================================================================
+  /**
+   * Get security event history.
+   */
+  async getSecurityEvents(params, customFetch) {
+    const queryParams = new URLSearchParams();
+    if (params?.page) queryParams.append("page", params.page.toString());
+    if (params?.limit) queryParams.append("limit", params.limit.toString());
+    if (params?.type) queryParams.append("type", params.type);
+    const response = await api.get(`/auth/security/events?${queryParams.toString()}`, true, customFetch);
+    return extractData(response);
+  }
+};
+
+// src/core/service.ts
+var AuthService = class {
+  // ============================================================================
+  // Authentication
+  // ============================================================================
+  /**
+   * Login with username and password.
+   */
+  async login(credentials) {
+    return await authApi.login(credentials);
+  }
+  /**
+   * Logout the current user.
+   */
+  async logout() {
+    await authApi.logout();
+  }
+  /**
+   * Register a new user.
+   */
+  async register(data) {
+    return await authApi.register(data);
+  }
+  /**
+   * Request a password reset email.
+   */
+  async forgotPassword(email) {
+    await authApi.forgotPassword(email);
+  }
+  /**
+   * Reset password with a token.
+   */
+  async resetPassword(token, newPassword) {
+    await authApi.resetPassword(token, newPassword);
+  }
+  /**
+   * Change the current user's password.
+   */
+  async changePassword(currentPassword, newPassword) {
+    await authApi.changePassword({ currentPassword, newPassword });
+  }
+  /**
+   * Refresh the access token.
+   */
+  async refreshToken(refreshToken) {
+    return await authApi.refreshToken(refreshToken);
+  }
+  /**
+   * Initiate SSO login (redirects to SSO provider).
+   */
+  initiateSSOLogin() {
+    authApi.initiateSSOLogin();
+  }
+  // ============================================================================
+  // Profile
+  // ============================================================================
+  /**
+   * Get the current user's profile.
+   */
+  async getProfile(customFetch) {
+    return await authApi.getProfile(customFetch);
+  }
+  /**
+   * Update the current user's profile.
+   */
+  async updateProfile(data) {
+    return await authApi.updateProfile(data);
+  }
+  /**
+   * Resend email verification.
+   */
+  async resendVerification() {
+    await authApi.resendVerification();
+  }
+  /**
+   * Verify email with a token.
+   */
+  async verifyEmail(token) {
+    return await authApi.verifyEmail(token);
+  }
+  // ============================================================================
+  // Session Management
+  // ============================================================================
+  /**
+   * Get all active sessions.
+   */
+  async getSessions(customFetch) {
+    return await authApi.getSessions(customFetch);
+  }
+  /**
+   * Revoke a specific session.
+   */
+  async revokeSession(sessionId) {
+    await authApi.revokeSession(sessionId);
+  }
+  /**
+   * Revoke all sessions except the current one.
+   */
+  async revokeAllSessions() {
+    await authApi.revokeAllSessions();
+  }
+  // ============================================================================
+  // API Key Management
+  // ============================================================================
+  /**
+   * Get all API keys.
+   */
+  async getApiKeys(customFetch) {
+    return await authApi.getApiKeys(customFetch);
+  }
+  /**
+   * Create a new API key.
+   */
+  async createApiKey(data) {
+    return await authApi.createApiKey(data);
+  }
+  /**
+   * Revoke an API key.
+   */
+  async revokeApiKey(keyId) {
+    await authApi.revokeApiKey(keyId);
+  }
+  /**
+   * Update an API key's name.
+   */
+  async updateApiKey(keyId, name) {
+    await authApi.updateApiKey(keyId, { name });
+  }
+  // ============================================================================
+  // MFA Management
+  // ============================================================================
+  /**
+   * Get MFA status for the current user.
+   */
+  async getMFAStatus() {
+    return await authApi.getMFAStatus();
+  }
+  /**
+   * Setup MFA (get QR code and backup codes).
+   */
+  async setupMFA() {
+    return await authApi.setupMFA();
+  }
+  /**
+   * Verify MFA setup with a code.
+   */
+  async verifyMFASetup(code) {
+    await authApi.verifyMFASetup(code);
+  }
+  /**
+   * Disable MFA.
+   */
+  async disableMFA(password) {
+    await authApi.disableMFA(password);
+  }
+  /**
+   * Regenerate MFA backup codes.
+   */
+  async regenerateBackupCodes(password) {
+    return await authApi.regenerateBackupCodes(password);
+  }
+  /**
+   * Verify MFA challenge during login.
+   */
+  async verifyMFAChallenge(data) {
+    return await authApi.verifyMFAChallenge(data);
+  }
+  // ============================================================================
+  // Device Management
+  // ============================================================================
+  /**
+   * Get all devices.
+   */
+  async getDevices(customFetch) {
+    return await authApi.getDevices(customFetch);
+  }
+  /**
+   * Trust a device.
+   */
+  async trustDevice(deviceId) {
+    await authApi.trustDevice(deviceId);
+  }
+  /**
+   * Revoke device trust.
+   */
+  async revokeDevice(deviceId) {
+    await authApi.revokeDevice(deviceId);
+  }
+  /**
+   * Remove a device completely.
+   */
+  async removeDevice(deviceId) {
+    await authApi.removeDevice(deviceId);
+  }
+  /**
+   * Approve a device with a token.
+   */
+  async approveDevice(token) {
+    return await authApi.approveDevice(token);
+  }
+  /**
+   * Block a device with a token.
+   */
+  async blockDevice(token) {
+    return await authApi.blockDevice(token);
+  }
+  // ============================================================================
+  // Preferences
+  // ============================================================================
+  /**
+   * Get user preferences.
+   */
+  async getPreferences(customFetch) {
+    return await authApi.getPreferences(customFetch);
+  }
+  /**
+   * Update user preferences.
+   */
+  async updatePreferences(data) {
+    await authApi.updatePreferences(data);
+  }
+  // ============================================================================
+  // SSO / Linked Accounts
+  // ============================================================================
+  /**
+   * Get SSO linked accounts.
+   */
+  async getLinkedAccounts(customFetch) {
+    return await authApi.getSSOAccounts(customFetch);
+  }
+  /**
+   * Link an SSO account (redirects to SSO provider).
+   */
+  async linkAccount(provider = "authentik") {
+    await authApi.linkSSOAccount(provider);
+  }
+  /**
+   * Unlink an SSO account.
+   */
+  async unlinkAccount(provider, password) {
+    await authApi.unlinkSSOAccount(provider, password);
+  }
+  // ============================================================================
+  // Security Events
+  // ============================================================================
+  /**
+   * Get security event history.
+   */
+  async getSecurityEvents(params, customFetch) {
+    return await authApi.getSecurityEvents(params, customFetch);
+  }
+};
+var authService = new AuthService();
+
+// src/core/jwt.ts
+function decodeJWT(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+      return null;
+    }
+    const payload = parts[1];
+    const decoded = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
+    return JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+}
+function isTokenExpired(token) {
+  const payload = decodeJWT(token);
+  if (!payload || !payload.exp) {
+    return true;
+  }
+  return payload.exp * 1e3 < Date.now();
+}
+function getTokenRemainingTime(token) {
+  const payload = decodeJWT(token);
+  if (!payload || !payload.exp) {
+    return 0;
+  }
+  const remainingMs = payload.exp * 1e3 - Date.now();
+  return Math.max(0, remainingMs);
+}
+function getTokenExpiration(token) {
+  const payload = decodeJWT(token);
+  if (!payload || !payload.exp) {
+    return null;
+  }
+  return new Date(payload.exp * 1e3);
+}
+function extractClaims(token, claims) {
+  const payload = decodeJWT(token);
+  if (!payload) {
+    return null;
+  }
+  const result = {};
+  for (const claim of claims) {
+    if (claim in payload) {
+      result[claim] = payload[claim];
+    }
+  }
+  return result;
+}
+
+// src/svelte/stores/auth.svelte.ts
+function getStorageKey() {
+  return isInitialized() ? getConfig().storageKey ?? "classic_auth" : "classic_auth";
+}
+function getStorageAdapter() {
+  return isInitialized() ? getStorage() : getDefaultStorage();
+}
+function loadAuthFromStorage() {
+  try {
+    const storage = getStorageAdapter();
+    const data = storage.getItem(getStorageKey());
+    if (!data) {
+      return {
+        accessToken: null,
+        refreshToken: null,
+        user: null,
+        isAuthenticated: false
+      };
+    }
+    const parsed = JSON.parse(data);
+    return {
+      accessToken: parsed.accessToken ?? null,
+      refreshToken: parsed.refreshToken ?? null,
+      user: parsed.user ?? null,
+      isAuthenticated: !!parsed.accessToken && !!parsed.user
+    };
+  } catch {
+    return {
+      accessToken: null,
+      refreshToken: null,
+      user: null,
+      isAuthenticated: false
+    };
+  }
+}
+function saveAuthToStorage(state) {
+  try {
+    const storage = getStorageAdapter();
+    const key = getStorageKey();
+    if (!state.accessToken) {
+      storage.removeItem(key);
+    } else {
+      storage.setItem(key, JSON.stringify(state));
+    }
+  } catch {
+  }
+}
+var AuthStore = class {
+  constructor() {
+    this.subscribers = /* @__PURE__ */ new Set();
+    this.state = loadAuthFromStorage();
+  }
+  /**
+   * Subscribe to state changes (Svelte store contract).
+   */
+  subscribe(subscriber) {
+    this.subscribers.add(subscriber);
+    subscriber(this.state);
+    return () => this.subscribers.delete(subscriber);
+  }
+  notify() {
+    this.subscribers.forEach((sub) => sub(this.state));
+  }
+  // Getters for direct access
+  get accessToken() {
+    return this.state.accessToken;
+  }
+  get refreshToken() {
+    return this.state.refreshToken;
+  }
+  get user() {
+    return this.state.user;
+  }
+  get isAuthenticated() {
+    return this.state.isAuthenticated;
+  }
+  /**
+   * Get the current auth state snapshot.
+   */
+  getState() {
+    return { ...this.state };
+  }
+  /**
+   * Set auth data after successful login.
+   */
+  setAuth(accessToken, refreshToken, user, sessionToken) {
+    const jwtPayload = decodeJWT(accessToken);
+    const userWithPermissions = {
+      ...user,
+      permissions: user.permissions || jwtPayload?.permissions || [],
+      roles: user.roles || jwtPayload?.roles || (user.role ? [user.role] : [])
+    };
+    this.state = {
+      accessToken,
+      refreshToken,
+      user: userWithPermissions,
+      isAuthenticated: true
+    };
+    saveAuthToStorage(this.state);
+    if (sessionToken && typeof window !== "undefined") {
+      getStorageAdapter().setItem("sessionToken", sessionToken);
+    }
+    if (typeof window !== "undefined") {
+      window.dispatchEvent(
+        new CustomEvent("auth:login", {
+          detail: { user: userWithPermissions }
+        })
+      );
+    }
+    this.notify();
+  }
+  /**
+   * Update tokens (e.g., after refresh).
+   */
+  updateTokens(accessToken, refreshToken) {
+    const jwtPayload = decodeJWT(accessToken);
+    const updatedUser = this.state.user ? {
+      ...this.state.user,
+      permissions: jwtPayload?.permissions || this.state.user.permissions || [],
+      roles: jwtPayload?.roles || this.state.user.roles || (this.state.user.role ? [this.state.user.role] : [])
+    } : null;
+    this.state = {
+      ...this.state,
+      accessToken,
+      refreshToken,
+      user: updatedUser
+    };
+    saveAuthToStorage(this.state);
+    if (typeof window !== "undefined") {
+      window.dispatchEvent(new CustomEvent("auth:token-refresh"));
+    }
+    this.notify();
+  }
+  /**
+   * Update user data (e.g., after profile update).
+   */
+  updateUser(user) {
+    const jwtPayload = this.state.accessToken ? decodeJWT(this.state.accessToken) : null;
+    const updatedUser = {
+      ...user,
+      permissions: user.permissions || jwtPayload?.permissions || [],
+      roles: user.roles || jwtPayload?.roles || (user.role ? [user.role] : [])
+    };
+    this.state = {
+      ...this.state,
+      user: updatedUser
+    };
+    saveAuthToStorage(this.state);
+    if (typeof window !== "undefined") {
+      window.dispatchEvent(
+        new CustomEvent("auth:profile-update", {
+          detail: { user: updatedUser }
+        })
+      );
+    }
+    this.notify();
+  }
+  /**
+   * Clear auth state (logout).
+   */
+  logout() {
+    this.state = {
+      accessToken: null,
+      refreshToken: null,
+      user: null,
+      isAuthenticated: false
+    };
+    const storage = getStorageAdapter();
+    storage.removeItem(getStorageKey());
+    storage.removeItem("sessionToken");
+    if (typeof window !== "undefined") {
+      window.dispatchEvent(new CustomEvent("auth:logout"));
+    }
+    if (isInitialized()) {
+      getConfig().onLogout?.();
+    }
+    this.notify();
+  }
+  /**
+   * Check if user has a specific permission.
+   */
+  hasPermission(permission) {
+    return this.state.user?.permissions?.includes(permission) ?? false;
+  }
+  /**
+   * Check if user has a specific role.
+   */
+  hasRole(role) {
+    return this.state.user?.roles?.includes(role) ?? false;
+  }
+  /**
+   * Check if user has any of the specified roles.
+   */
+  hasAnyRole(roles) {
+    return roles.some((role) => this.state.user?.roles?.includes(role)) ?? false;
+  }
+  /**
+   * Check if user has all of the specified roles.
+   */
+  hasAllRoles(roles) {
+    return roles.every((role) => this.state.user?.roles?.includes(role)) ?? false;
+  }
+  /**
+   * Check if user has any of the specified permissions.
+   */
+  hasAnyPermission(permissions) {
+    return permissions.some((perm) => this.state.user?.permissions?.includes(perm)) ?? false;
+  }
+  /**
+   * Check if user has all of the specified permissions.
+   */
+  hasAllPermissions(permissions) {
+    return permissions.every((perm) => this.state.user?.permissions?.includes(perm)) ?? false;
+  }
+  /**
+   * Re-hydrate state from storage (useful after config changes).
+   */
+  rehydrate() {
+    this.state = loadAuthFromStorage();
+    this.notify();
+  }
+};
+var authStore = new AuthStore();
+var authActions = {
+  setAuth: (accessToken, refreshToken, user, sessionToken) => authStore.setAuth(accessToken, refreshToken, user, sessionToken),
+  updateTokens: (accessToken, refreshToken) => authStore.updateTokens(accessToken, refreshToken),
+  updateUser: (user) => authStore.updateUser(user),
+  logout: () => authStore.logout(),
+  hasPermission: (permission) => authStore.hasPermission(permission),
+  hasRole: (role) => authStore.hasRole(role),
+  hasAnyRole: (roles) => authStore.hasAnyRole(roles),
+  hasAllRoles: (roles) => authStore.hasAllRoles(roles),
+  hasAnyPermission: (permissions) => authStore.hasAnyPermission(permissions),
+  hasAllPermissions: (permissions) => authStore.hasAllPermissions(permissions),
+  rehydrate: () => authStore.rehydrate()
+};
+var isAuthenticated = {
+  subscribe: (subscriber) => {
+    return authStore.subscribe((state) => subscriber(state.isAuthenticated));
+  }
+};
+var currentUser = {
+  subscribe: (subscriber) => {
+    return authStore.subscribe((state) => subscriber(state.user));
+  }
+};
+
+// src/svelte/guards/auth-guard.ts
+function checkAuth(options = {}) {
+  const { roles, permissions, requireAllRoles, requireAllPermissions } = options;
+  if (!authStore.isAuthenticated) {
+    return {
+      allowed: false,
+      reason: "not_authenticated",
+      redirectTo: "/login"
+    };
+  }
+  if (roles && roles.length > 0) {
+    const hasRoles = requireAllRoles ? authStore.hasAllRoles(roles) : authStore.hasAnyRole(roles);
+    if (!hasRoles) {
+      return {
+        allowed: false,
+        reason: "missing_role",
+        redirectTo: "/unauthorized"
+      };
+    }
+  }
+  if (permissions && permissions.length > 0) {
+    const hasPermissions = requireAllPermissions ? authStore.hasAllPermissions(permissions) : authStore.hasAnyPermission(permissions);
+    if (!hasPermissions) {
+      return {
+        allowed: false,
+        reason: "missing_permission",
+        redirectTo: "/unauthorized"
+      };
+    }
+  }
+  return { allowed: true };
+}
+function createAuthGuard(options = {}) {
+  return (onDenied) => {
+    const result = checkAuth(options);
+    if (!result.allowed) {
+      onDenied(result.redirectTo ?? "/login", result.reason ?? "not_authenticated");
+      return false;
+    }
+    return true;
+  };
+}
+function requireAuth() {
+  return checkAuth();
+}
+function requireRole(roles, requireAll = false) {
+  const roleArray = Array.isArray(roles) ? roles : [roles];
+  return checkAuth({ roles: roleArray, requireAllRoles: requireAll });
+}
+function requirePermission(permissions, requireAll = false) {
+  const permArray = Array.isArray(permissions) ? permissions : [permissions];
+  return checkAuth({ permissions: permArray, requireAllPermissions: requireAll });
+}
+function protectedLoad(options, loadFn) {
+  return async (event) => {
+    const result = checkAuth(options);
+    if (!result.allowed) {
+      return { redirect: result.redirectTo ?? "/login" };
+    }
+    return loadFn(event);
+  };
+}
+
+export { AuthService, api, apiRequest, authActions, authApi, authService, authStore, checkAuth, clearStoredAuth, createAuthGuard, currentUser, decodeJWT, extractClaims, extractData, getAccessToken, getConfig, getDefaultStorage, getFetch, getRefreshToken, getSessionToken, getStorage, getTokenExpiration, getTokenRemainingTime, initAuth, isAuthenticated, isInitialized, isTokenExpired, protectedLoad, requireAuth, requirePermission, requireRole, resetConfig, updateStoredTokens };