@classic-homes/auth 0.1.23 → 0.1.24

package/dist/svelte/index.js

@@ -1,4 +1,25 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
 // src/core/config.ts
+function getConfig() {
+  if (!config) {
+    throw new Error(
+      '@classic-homes/auth not initialized. Call initAuth({ baseUrl: "..." }) before using auth services.'
+    );
+  }
+  return config;
+}
+function isInitialized() {
+  return config !== null;
+}
 function getDefaultStorage() {
   if (typeof window !== "undefined" && window.localStorage) {
     return {
@@ -15,6 +36,20 @@ function getDefaultStorage() {
     }
   };
 }
+function getStorage() {
+  const cfg = getConfig();
+  return cfg.storage ?? getDefaultStorage();
+}
+function getFetch() {
+  const cfg = getConfig();
+  return cfg.fetch ?? fetch;
+}
+var config;
+var init_config = __esm({
+  "src/core/config.ts"() {
+    config = null;
+  }
+});
 
 // src/core/jwt.ts
 function decodeJWT(token) {
@@ -30,13 +65,592 @@ function decodeJWT(token) {
     return null;
   }
 }
+var init_jwt = __esm({
+  "src/core/jwt.ts"() {
+  }
+});
+
+// src/core/client.ts
+function subscribeTokenRefresh(cb) {
+  refreshSubscribers.push(cb);
+}
+function onTokenRefreshed(token) {
+  refreshSubscribers.forEach((cb) => cb(token));
+  refreshSubscribers = [];
+}
+function getAccessToken() {
+  const config2 = getConfig();
+  const storage = getStorage();
+  const authData = storage.getItem(config2.storageKey ?? "classic_auth");
+  if (!authData) return null;
+  try {
+    const parsed = JSON.parse(authData);
+    return parsed.accessToken ?? null;
+  } catch {
+    return null;
+  }
+}
+function getRefreshToken() {
+  const config2 = getConfig();
+  const storage = getStorage();
+  const authData = storage.getItem(config2.storageKey ?? "classic_auth");
+  if (!authData) return null;
+  try {
+    const parsed = JSON.parse(authData);
+    return parsed.refreshToken ?? null;
+  } catch {
+    return null;
+  }
+}
+function getSessionToken() {
+  const storage = getStorage();
+  return storage.getItem("sessionToken");
+}
+function updateStoredTokens(accessToken, refreshToken) {
+  const config2 = getConfig();
+  const storage = getStorage();
+  const storageKey = config2.storageKey ?? "classic_auth";
+  const authData = storage.getItem(storageKey);
+  let parsed = {};
+  if (authData) {
+    try {
+      parsed = JSON.parse(authData);
+    } catch {
+    }
+  }
+  parsed.accessToken = accessToken;
+  parsed.refreshToken = refreshToken;
+  storage.setItem(storageKey, JSON.stringify(parsed));
+  Promise.resolve().then(() => (init_auth_svelte(), auth_svelte_exports)).then(({ authStore: authStore2 }) => {
+    authStore2.updateTokens(accessToken, refreshToken);
+  }).catch(() => {
+  });
+  config2.onTokenRefresh?.({ accessToken, refreshToken });
+}
+function clearStoredAuth() {
+  const config2 = getConfig();
+  const storage = getStorage();
+  storage.removeItem(config2.storageKey ?? "classic_auth");
+  storage.removeItem("sessionToken");
+}
+async function refreshAccessToken() {
+  const refreshToken = getRefreshToken();
+  const config2 = getConfig();
+  const fetchFn = getFetch();
+  if (!refreshToken) {
+    return false;
+  }
+  try {
+    const response = await fetchFn(`${config2.baseUrl}/auth/refresh`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ refreshToken })
+    });
+    if (response.ok) {
+      const apiResponse = await response.json();
+      const data = apiResponse.data;
+      const tokens = data && typeof data === "object" && "data" in data ? data.data : data;
+      if (tokens?.accessToken && tokens?.refreshToken) {
+        updateStoredTokens(tokens.accessToken, tokens.refreshToken);
+        onTokenRefreshed(tokens.accessToken);
+        return true;
+      }
+    }
+  } catch (error) {
+    config2.onAuthError?.(error instanceof Error ? error : new Error("Token refresh failed"));
+  }
+  return false;
+}
+function extractData(response) {
+  if (response && typeof response === "object" && "data" in response) {
+    const dataField = response.data;
+    if (dataField && typeof dataField === "object" && "data" in dataField) {
+      return dataField.data;
+    }
+    if (dataField !== void 0) {
+      return dataField;
+    }
+  }
+  return response;
+}
+async function apiRequest(endpoint, options = {}) {
+  const { authenticated = false, customFetch, body, ...fetchOptions } = options;
+  const config2 = getConfig();
+  const fetchFn = customFetch ?? getFetch();
+  const url = endpoint.startsWith("http") ? endpoint : `${config2.baseUrl}${endpoint}`;
+  const headers = {
+    "Content-Type": "application/json",
+    ...fetchOptions.headers
+  };
+  if (authenticated) {
+    const accessToken = getAccessToken();
+    const sessionToken = getSessionToken();
+    if (accessToken) {
+      headers["Authorization"] = `Bearer ${accessToken}`;
+    }
+    if (sessionToken) {
+      headers["X-Session-Token"] = sessionToken;
+    }
+  }
+  try {
+    const response = await fetchFn(url, {
+      ...fetchOptions,
+      headers,
+      body: body ? JSON.stringify(body) : void 0
+    });
+    if (response.status === 401 && authenticated && typeof window !== "undefined") {
+      if (!isRefreshing) {
+        isRefreshing = true;
+        const refreshed = await refreshAccessToken();
+        isRefreshing = false;
+        if (refreshed) {
+          return apiRequest(endpoint, options);
+        } else {
+          clearStoredAuth();
+          config2.onLogout?.();
+          throw new Error("Authentication failed. Please sign in again.");
+        }
+      } else {
+        return new Promise((resolve, reject) => {
+          subscribeTokenRefresh(() => {
+            apiRequest(endpoint, options).then(resolve).catch(reject);
+          });
+        });
+      }
+    }
+    const data = await response.json();
+    if (!response.ok) {
+      const dataObj = data;
+      const errorMessage = data.error?.message || (typeof dataObj.message === "string" ? dataObj.message : void 0) || data.meta?.message || (typeof dataObj.detail === "string" ? dataObj.detail : void 0) || "Request failed";
+      const error = new Error(errorMessage);
+      config2.onAuthError?.(error);
+      throw error;
+    }
+    return data;
+  } catch (error) {
+    if (error instanceof Error) {
+      throw error;
+    }
+    throw new Error("API request failed");
+  }
+}
+var isRefreshing, refreshSubscribers, api;
+var init_client = __esm({
+  "src/core/client.ts"() {
+    init_config();
+    isRefreshing = false;
+    refreshSubscribers = [];
+    api = {
+      get: (endpoint, authenticated = false, customFetch) => apiRequest(endpoint, { method: "GET", authenticated, customFetch }),
+      post: (endpoint, body, authenticated = false, customFetch) => apiRequest(endpoint, {
+        method: "POST",
+        body,
+        authenticated,
+        customFetch
+      }),
+      put: (endpoint, body, authenticated = false, customFetch) => apiRequest(endpoint, {
+        method: "PUT",
+        body,
+        authenticated,
+        customFetch
+      }),
+      patch: (endpoint, body, authenticated = false, customFetch) => apiRequest(endpoint, {
+        method: "PATCH",
+        body,
+        authenticated,
+        customFetch
+      }),
+      delete: (endpoint, authenticated = false, customFetch, body) => apiRequest(endpoint, {
+        method: "DELETE",
+        body,
+        authenticated,
+        customFetch
+      })
+    };
+  }
+});
+
+// src/core/api.ts
+var authApi;
+var init_api = __esm({
+  "src/core/api.ts"() {
+    init_client();
+    init_config();
+    authApi = {
+      // ============================================================================
+      // Authentication
+      // ============================================================================
+      /**
+       * Login with username and password.
+       */
+      async login(credentials) {
+        const response = await api.post("/auth/login", credentials);
+        return extractData(response);
+      },
+      /**
+       * Logout the current user.
+       * Returns SSO logout URL if applicable for SSO users.
+       */
+      async logout() {
+        try {
+          const response = await api.post("/auth/logout", {}, true);
+          return extractData(response);
+        } catch {
+          return { success: true };
+        }
+      },
+      /**
+       * Register a new user.
+       */
+      async register(data) {
+        const response = await api.post("/auth/register", data);
+        return extractData(response);
+      },
+      /**
+       * Request a password reset email.
+       */
+      async forgotPassword(email) {
+        await api.post("/auth/forgot-password", { email });
+      },
+      /**
+       * Reset password with a token.
+       */
+      async resetPassword(token, newPassword) {
+        await api.post("/auth/reset-password", { token, newPassword });
+      },
+      /**
+       * Refresh the access token.
+       */
+      async refreshToken(refreshToken) {
+        const response = await api.post("/auth/refresh", { refreshToken });
+        return extractData(response);
+      },
+      /**
+       * Initiate SSO login by redirecting to the SSO provider.
+       * @param options.callbackUrl - The URL where the SSO provider should redirect after auth
+       * @param options.redirectUrl - The final URL to redirect to after processing the callback
+       */
+      initiateSSOLogin(options) {
+        if (typeof window === "undefined") return;
+        const config2 = getConfig();
+        const authorizeUrl = config2.sso?.authorizeUrl ?? `${config2.baseUrl}/auth/sso/authorize`;
+        const params = new URLSearchParams();
+        if (options?.callbackUrl) {
+          params.set("callback", options.callbackUrl);
+        }
+        if (options?.redirectUrl) {
+          params.set("redirect", options.redirectUrl);
+        }
+        const url = params.toString() ? `${authorizeUrl}?${params}` : authorizeUrl;
+        window.location.href = url;
+      },
+      // ============================================================================
+      // Profile
+      // ============================================================================
+      /**
+       * Get the current user's profile.
+       */
+      async getProfile(customFetch) {
+        const response = await api.get("/auth/profile", true, customFetch);
+        return response;
+      },
+      /**
+       * Update the current user's profile.
+       */
+      async updateProfile(data) {
+        const response = await api.put("/auth/profile", data, true);
+        return extractData(response);
+      },
+      /**
+       * Change the current user's password.
+       */
+      async changePassword(data) {
+        await api.put("/auth/change-password", data, true);
+      },
+      // ============================================================================
+      // Email Verification
+      // ============================================================================
+      /**
+       * Resend email verification.
+       */
+      async resendVerification() {
+        await api.post("/auth/resend-verification", {}, true);
+      },
+      /**
+       * Verify email with a token.
+       */
+      async verifyEmail(token) {
+        const response = await api.post("/auth/verify-email", {
+          token
+        });
+        return extractData(response);
+      },
+      // ============================================================================
+      // Session Management
+      // ============================================================================
+      /**
+       * Get all active sessions.
+       */
+      async getSessions(customFetch) {
+        const response = await api.get(
+          "/auth/sessions",
+          true,
+          customFetch
+        );
+        return response;
+      },
+      /**
+       * Revoke a specific session.
+       */
+      async revokeSession(sessionId) {
+        await api.delete(`/auth/sessions/${sessionId}`, true);
+      },
+      /**
+       * Revoke all sessions except the current one.
+       */
+      async revokeAllSessions() {
+        await api.delete("/auth/sessions", true);
+      },
+      // ============================================================================
+      // API Key Management
+      // ============================================================================
+      /**
+       * Get all API keys.
+       */
+      async getApiKeys(customFetch) {
+        const response = await api.get("/auth/api-keys", true, customFetch);
+        return response;
+      },
+      /**
+       * Create a new API key.
+       */
+      async createApiKey(data) {
+        const response = await api.post("/auth/api-keys", data, true);
+        return extractData(response);
+      },
+      /**
+       * Revoke an API key.
+       */
+      async revokeApiKey(keyId) {
+        await api.delete(`/auth/api-keys/${keyId}`, true);
+      },
+      /**
+       * Update an API key's name.
+       */
+      async updateApiKey(keyId, data) {
+        await api.put(`/auth/api-keys/${keyId}`, data, true);
+      },
+      // ============================================================================
+      // MFA Management
+      // ============================================================================
+      /**
+       * Get MFA status for the current user.
+       */
+      async getMFAStatus() {
+        const response = await api.get("/auth/mfa/status", true);
+        return response;
+      },
+      /**
+       * Setup MFA (get QR code and backup codes).
+       */
+      async setupMFA() {
+        const response = await api.post("/auth/mfa-setup", {}, true);
+        return extractData(response);
+      },
+      /**
+       * Verify MFA setup with a code.
+       */
+      async verifyMFASetup(code) {
+        await api.post("/auth/mfa/verify", { code }, true);
+      },
+      /**
+       * Disable MFA.
+       */
+      async disableMFA(password) {
+        await api.delete("/auth/mfa", true, void 0, { password });
+      },
+      /**
+       * Regenerate MFA backup codes.
+       */
+      async regenerateBackupCodes(password) {
+        const response = await api.post(
+          "/auth/mfa/regenerate-backup-codes",
+          { password },
+          true
+        );
+        return extractData(response);
+      },
+      /**
+       * Verify MFA challenge during login.
+       */
+      async verifyMFAChallenge(data) {
+        const config2 = getConfig();
+        const fetchFn = config2.fetch ?? fetch;
+        const requestBody = {
+          code: data.code,
+          type: data.method === "backup" ? "backup" : "totp",
+          trustDevice: data.trustDevice
+        };
+        const response = await fetchFn(`${config2.baseUrl}/auth/mfa/challenge`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${data.mfaToken}`
+          },
+          body: JSON.stringify(requestBody)
+        });
+        if (!response.ok) {
+          const error = await response.json().catch(() => ({ message: "Verification failed" }));
+          throw new Error(error.error?.message || error.message || "Invalid verification code");
+        }
+        const result = await response.json();
+        return extractData(result);
+      },
+      // ============================================================================
+      // Device Management
+      // ============================================================================
+      /**
+       * Get all devices.
+       */
+      async getDevices(customFetch) {
+        const response = await api.get(
+          "/auth/devices",
+          true,
+          customFetch
+        );
+        return response;
+      },
+      /**
+       * Trust a device.
+       */
+      async trustDevice(deviceId) {
+        await api.put(`/auth/devices/${deviceId}/trust`, {}, true);
+      },
+      /**
+       * Revoke device trust.
+       */
+      async revokeDevice(deviceId) {
+        await api.delete(`/auth/devices/${deviceId}/revoke`, true);
+      },
+      /**
+       * Remove a device completely.
+       */
+      async removeDevice(deviceId) {
+        await api.delete(`/auth/devices/${deviceId}`, true);
+      },
+      /**
+       * Approve a device with a token.
+       */
+      async approveDevice(token) {
+        const response = await api.post("/auth/device/approve", {
+          token
+        });
+        return extractData(response);
+      },
+      /**
+       * Block a device with a token.
+       */
+      async blockDevice(token) {
+        const response = await api.post("/auth/device/block", {
+          token
+        });
+        return extractData(response);
+      },
+      // ============================================================================
+      // Preferences
+      // ============================================================================
+      /**
+       * Get user preferences.
+       */
+      async getPreferences(customFetch) {
+        const response = await api.get(
+          "/auth/preferences",
+          true,
+          customFetch
+        );
+        if (response && typeof response === "object" && "preferences" in response) {
+          return response.preferences;
+        }
+        return response ?? {};
+      },
+      /**
+       * Update user preferences.
+       */
+      async updatePreferences(data) {
+        await api.put("/auth/preferences", data, true);
+      },
+      // ============================================================================
+      // SSO / Linked Accounts
+      // ============================================================================
+      /**
+       * Get SSO linked accounts.
+       */
+      async getSSOAccounts(customFetch) {
+        const response = await api.get(
+          "/auth/sso/accounts",
+          true,
+          customFetch
+        );
+        if (response && typeof response === "object" && "accounts" in response) {
+          return response.accounts;
+        }
+        return Array.isArray(response) ? response : [];
+      },
+      /**
+       * Unlink an SSO account.
+       */
+      async unlinkSSOAccount(provider, password) {
+        await api.delete("/auth/sso/unlink", true, void 0, { provider, password });
+      },
+      /**
+       * Link an SSO account (redirects to SSO provider).
+       */
+      async linkSSOAccount(provider = "authentik") {
+        if (typeof window === "undefined") return;
+        const accessToken = getAccessToken();
+        if (!accessToken) {
+          throw new Error("Not authenticated");
+        }
+        const config2 = getConfig();
+        const params = new URLSearchParams({
+          token: accessToken,
+          provider
+        });
+        window.location.href = `${config2.baseUrl}/auth/sso/link?${params.toString()}`;
+      },
+      // ============================================================================
+      // Security Events
+      // ============================================================================
+      /**
+       * Get security event history.
+       */
+      async getSecurityEvents(params, customFetch) {
+        const queryParams = new URLSearchParams();
+        if (params?.page) queryParams.append("page", params.page.toString());
+        if (params?.limit) queryParams.append("limit", params.limit.toString());
+        if (params?.type) queryParams.append("type", params.type);
+        const response = await api.get(`/auth/security/events?${queryParams.toString()}`, true, customFetch);
+        return extractData(response);
+      }
+    };
+  }
+});
 
 // src/svelte/stores/auth.svelte.ts
+var auth_svelte_exports = {};
+__export(auth_svelte_exports, {
+  authActions: () => authActions,
+  authStore: () => authStore,
+  currentUser: () => currentUser,
+  isAuthenticated: () => isAuthenticated
+});
 function getStorageKey() {
-  return "classic_auth";
+  return isInitialized() ? getConfig().storageKey ?? "classic_auth" : "classic_auth";
 }
 function getStorageAdapter() {
-  return getDefaultStorage();
+  return isInitialized() ? getStorage() : getDefaultStorage();
 }
 function loadAuthFromStorage() {
   try {
@@ -78,204 +692,237 @@ function saveAuthToStorage(state) {
   } catch {
   }
 }
-var AuthStore = class {
-  constructor() {
-    this.subscribers = /* @__PURE__ */ new Set();
-    this.state = loadAuthFromStorage();
-  }
-  /**
-   * Subscribe to state changes (Svelte store contract).
-   */
-  subscribe(subscriber) {
-    this.subscribers.add(subscriber);
-    subscriber(this.state);
-    return () => this.subscribers.delete(subscriber);
-  }
-  notify() {
-    this.subscribers.forEach((sub) => sub(this.state));
-  }
-  // Getters for direct access
-  get accessToken() {
-    return this.state.accessToken;
-  }
-  get refreshToken() {
-    return this.state.refreshToken;
-  }
-  get user() {
-    return this.state.user;
-  }
-  get isAuthenticated() {
-    return this.state.isAuthenticated;
-  }
-  /**
-   * Get the current auth state snapshot.
-   */
-  getState() {
-    return { ...this.state };
-  }
-  /**
-   * Set auth data after successful login.
-   */
-  setAuth(accessToken, refreshToken, user, sessionToken) {
-    const jwtPayload = decodeJWT(accessToken);
-    const userWithPermissions = {
-      ...user,
-      permissions: user.permissions || jwtPayload?.permissions || [],
-      roles: user.roles || jwtPayload?.roles || (user.role ? [user.role] : [])
-    };
-    this.state = {
-      accessToken,
-      refreshToken,
-      user: userWithPermissions,
-      isAuthenticated: true
+var AuthStore, authStore, authActions, isAuthenticated, currentUser;
+var init_auth_svelte = __esm({
+  "src/svelte/stores/auth.svelte.ts"() {
+    init_config();
+    init_jwt();
+    init_api();
+    AuthStore = class {
+      constructor() {
+        this.subscribers = /* @__PURE__ */ new Set();
+        this.state = loadAuthFromStorage();
+      }
+      /**
+       * Subscribe to state changes (Svelte store contract).
+       */
+      subscribe(subscriber) {
+        this.subscribers.add(subscriber);
+        subscriber(this.state);
+        return () => this.subscribers.delete(subscriber);
+      }
+      notify() {
+        this.subscribers.forEach((sub) => sub(this.state));
+      }
+      // Getters for direct access
+      get accessToken() {
+        return this.state.accessToken;
+      }
+      get refreshToken() {
+        return this.state.refreshToken;
+      }
+      get user() {
+        return this.state.user;
+      }
+      get isAuthenticated() {
+        return this.state.isAuthenticated;
+      }
+      /**
+       * Get the current auth state snapshot.
+       */
+      getState() {
+        return { ...this.state };
+      }
+      /**
+       * Set auth data after successful login.
+       */
+      setAuth(accessToken, refreshToken, user, sessionToken) {
+        const jwtPayload = decodeJWT(accessToken);
+        const userWithPermissions = {
+          ...user,
+          permissions: user.permissions || jwtPayload?.permissions || [],
+          roles: user.roles || jwtPayload?.roles || (user.role ? [user.role] : [])
+        };
+        this.state = {
+          accessToken,
+          refreshToken,
+          user: userWithPermissions,
+          isAuthenticated: true
+        };
+        saveAuthToStorage(this.state);
+        if (sessionToken && typeof window !== "undefined") {
+          getStorageAdapter().setItem("sessionToken", sessionToken);
+        }
+        if (typeof window !== "undefined") {
+          window.dispatchEvent(
+            new CustomEvent("auth:login", {
+              detail: { user: userWithPermissions }
+            })
+          );
+        }
+        this.notify();
+      }
+      /**
+       * Update tokens (e.g., after refresh).
+       */
+      updateTokens(accessToken, refreshToken) {
+        const jwtPayload = decodeJWT(accessToken);
+        const updatedUser = this.state.user ? {
+          ...this.state.user,
+          permissions: jwtPayload?.permissions || this.state.user.permissions || [],
+          roles: jwtPayload?.roles || this.state.user.roles || (this.state.user.role ? [this.state.user.role] : [])
+        } : null;
+        this.state = {
+          ...this.state,
+          accessToken,
+          refreshToken,
+          user: updatedUser
+        };
+        saveAuthToStorage(this.state);
+        if (typeof window !== "undefined") {
+          window.dispatchEvent(new CustomEvent("auth:token-refresh"));
+        }
+        this.notify();
+      }
+      /**
+       * Update user data (e.g., after profile update).
+       */
+      updateUser(user) {
+        const jwtPayload = this.state.accessToken ? decodeJWT(this.state.accessToken) : null;
+        const updatedUser = {
+          ...user,
+          permissions: user.permissions || jwtPayload?.permissions || [],
+          roles: user.roles || jwtPayload?.roles || (user.role ? [user.role] : [])
+        };
+        this.state = {
+          ...this.state,
+          user: updatedUser
+        };
+        saveAuthToStorage(this.state);
+        if (typeof window !== "undefined") {
+          window.dispatchEvent(
+            new CustomEvent("auth:profile-update", {
+              detail: { user: updatedUser }
+            })
+          );
+        }
+        this.notify();
+      }
+      /**
+       * Clear auth state (logout).
+       */
+      logout() {
+        this.state = {
+          accessToken: null,
+          refreshToken: null,
+          user: null,
+          isAuthenticated: false
+        };
+        const storage = getStorageAdapter();
+        storage.removeItem(getStorageKey());
+        storage.removeItem("sessionToken");
+        if (typeof window !== "undefined") {
+          window.dispatchEvent(new CustomEvent("auth:logout"));
+        }
+        if (isInitialized()) {
+          getConfig().onLogout?.();
+        }
+        this.notify();
+      }
+      /**
+       * Logout with SSO support.
+       * Calls the logout API and returns the SSO logout URL if applicable.
+       * Clears local state regardless of API response.
+       */
+      async logoutWithSSO() {
+        try {
+          const response = await authApi.logout();
+          this.logout();
+          if (response?.ssoLogout && response?.logoutUrl) {
+            return { ssoLogoutUrl: response.logoutUrl };
+          }
+        } catch {
+          this.logout();
+        }
+        return {};
+      }
+      /**
+       * Check if user has a specific permission.
+       */
+      hasPermission(permission) {
+        return this.state.user?.permissions?.includes(permission) ?? false;
+      }
+      /**
+       * Check if user has a specific role.
+       */
+      hasRole(role) {
+        return this.state.user?.roles?.includes(role) ?? false;
+      }
+      /**
+       * Check if user has any of the specified roles.
+       */
+      hasAnyRole(roles) {
+        return roles.some((role) => this.state.user?.roles?.includes(role)) ?? false;
+      }
+      /**
+       * Check if user has all of the specified roles.
+       */
+      hasAllRoles(roles) {
+        return roles.every((role) => this.state.user?.roles?.includes(role)) ?? false;
+      }
+      /**
+       * Check if user has any of the specified permissions.
+       */
+      hasAnyPermission(permissions) {
+        return permissions.some((perm) => this.state.user?.permissions?.includes(perm)) ?? false;
+      }
+      /**
+       * Check if user has all of the specified permissions.
+       */
+      hasAllPermissions(permissions) {
+        return permissions.every((perm) => this.state.user?.permissions?.includes(perm)) ?? false;
+      }
+      /**
+       * Re-hydrate state from storage (useful after config changes).
+       */
+      rehydrate() {
+        this.state = loadAuthFromStorage();
+        this.notify();
+      }
     };
-    saveAuthToStorage(this.state);
-    if (sessionToken && typeof window !== "undefined") {
-      getStorageAdapter().setItem("sessionToken", sessionToken);
-    }
-    if (typeof window !== "undefined") {
-      window.dispatchEvent(
-        new CustomEvent("auth:login", {
-          detail: { user: userWithPermissions }
-        })
-      );
-    }
-    this.notify();
-  }
-  /**
-   * Update tokens (e.g., after refresh).
-   */
-  updateTokens(accessToken, refreshToken) {
-    const jwtPayload = decodeJWT(accessToken);
-    const updatedUser = this.state.user ? {
-      ...this.state.user,
-      permissions: jwtPayload?.permissions || this.state.user.permissions || [],
-      roles: jwtPayload?.roles || this.state.user.roles || (this.state.user.role ? [this.state.user.role] : [])
-    } : null;
-    this.state = {
-      ...this.state,
-      accessToken,
-      refreshToken,
-      user: updatedUser
-    };
-    saveAuthToStorage(this.state);
-    if (typeof window !== "undefined") {
-      window.dispatchEvent(new CustomEvent("auth:token-refresh"));
-    }
-    this.notify();
-  }
-  /**
-   * Update user data (e.g., after profile update).
-   */
-  updateUser(user) {
-    const jwtPayload = this.state.accessToken ? decodeJWT(this.state.accessToken) : null;
-    const updatedUser = {
-      ...user,
-      permissions: user.permissions || jwtPayload?.permissions || [],
-      roles: user.roles || jwtPayload?.roles || (user.role ? [user.role] : [])
+    authStore = new AuthStore();
+    authActions = {
+      setAuth: (accessToken, refreshToken, user, sessionToken) => authStore.setAuth(accessToken, refreshToken, user, sessionToken),
+      updateTokens: (accessToken, refreshToken) => authStore.updateTokens(accessToken, refreshToken),
+      updateUser: (user) => authStore.updateUser(user),
+      logout: () => authStore.logout(),
+      logoutWithSSO: () => authStore.logoutWithSSO(),
+      hasPermission: (permission) => authStore.hasPermission(permission),
+      hasRole: (role) => authStore.hasRole(role),
+      hasAnyRole: (roles) => authStore.hasAnyRole(roles),
+      hasAllRoles: (roles) => authStore.hasAllRoles(roles),
+      hasAnyPermission: (permissions) => authStore.hasAnyPermission(permissions),
+      hasAllPermissions: (permissions) => authStore.hasAllPermissions(permissions),
+      rehydrate: () => authStore.rehydrate()
     };
-    this.state = {
-      ...this.state,
-      user: updatedUser
+    isAuthenticated = {
+      subscribe: (subscriber) => {
+        return authStore.subscribe((state) => subscriber(state.isAuthenticated));
+      }
     };
-    saveAuthToStorage(this.state);
-    if (typeof window !== "undefined") {
-      window.dispatchEvent(
-        new CustomEvent("auth:profile-update", {
-          detail: { user: updatedUser }
-        })
-      );
-    }
-    this.notify();
-  }
-  /**
-   * Clear auth state (logout).
-   */
-  logout() {
-    this.state = {
-      accessToken: null,
-      refreshToken: null,
-      user: null,
-      isAuthenticated: false
+    currentUser = {
+      subscribe: (subscriber) => {
+        return authStore.subscribe((state) => subscriber(state.user));
+      }
     };
-    const storage = getStorageAdapter();
-    storage.removeItem(getStorageKey());
-    storage.removeItem("sessionToken");
-    if (typeof window !== "undefined") {
-      window.dispatchEvent(new CustomEvent("auth:logout"));
-    }
-    this.notify();
-  }
-  /**
-   * Check if user has a specific permission.
-   */
-  hasPermission(permission) {
-    return this.state.user?.permissions?.includes(permission) ?? false;
-  }
-  /**
-   * Check if user has a specific role.
-   */
-  hasRole(role) {
-    return this.state.user?.roles?.includes(role) ?? false;
-  }
-  /**
-   * Check if user has any of the specified roles.
-   */
-  hasAnyRole(roles) {
-    return roles.some((role) => this.state.user?.roles?.includes(role)) ?? false;
   }
-  /**
-   * Check if user has all of the specified roles.
-   */
-  hasAllRoles(roles) {
-    return roles.every((role) => this.state.user?.roles?.includes(role)) ?? false;
-  }
-  /**
-   * Check if user has any of the specified permissions.
-   */
-  hasAnyPermission(permissions) {
-    return permissions.some((perm) => this.state.user?.permissions?.includes(perm)) ?? false;
-  }
-  /**
-   * Check if user has all of the specified permissions.
-   */
-  hasAllPermissions(permissions) {
-    return permissions.every((perm) => this.state.user?.permissions?.includes(perm)) ?? false;
-  }
-  /**
-   * Re-hydrate state from storage (useful after config changes).
-   */
-  rehydrate() {
-    this.state = loadAuthFromStorage();
-    this.notify();
-  }
-};
-var authStore = new AuthStore();
-var authActions = {
-  setAuth: (accessToken, refreshToken, user, sessionToken) => authStore.setAuth(accessToken, refreshToken, user, sessionToken),
-  updateTokens: (accessToken, refreshToken) => authStore.updateTokens(accessToken, refreshToken),
-  updateUser: (user) => authStore.updateUser(user),
-  logout: () => authStore.logout(),
-  hasPermission: (permission) => authStore.hasPermission(permission),
-  hasRole: (role) => authStore.hasRole(role),
-  hasAnyRole: (roles) => authStore.hasAnyRole(roles),
-  hasAllRoles: (roles) => authStore.hasAllRoles(roles),
-  hasAnyPermission: (permissions) => authStore.hasAnyPermission(permissions),
-  hasAllPermissions: (permissions) => authStore.hasAllPermissions(permissions),
-  rehydrate: () => authStore.rehydrate()
-};
-var isAuthenticated = {
-  subscribe: (subscriber) => {
-    return authStore.subscribe((state) => subscriber(state.isAuthenticated));
-  }
-};
-var currentUser = {
-  subscribe: (subscriber) => {
-    return authStore.subscribe((state) => subscriber(state.user));
-  }
-};
+});
+
+// src/svelte/index.ts
+init_auth_svelte();
 
 // src/svelte/guards/auth-guard.ts
+init_auth_svelte();
 function checkAuth(options = {}) {
   const { roles, permissions, requireAllRoles, requireAllPermissions } = options;
   if (!authStore.isAuthenticated) {