@classic-homes/auth 0.1.24 → 0.1.26

package/dist/core/index.js

@@ -1,1279 +1,3 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-
-// src/core/config.ts
-function initAuth(options) {
-  config = {
-    ...options,
-    storageKey: options.storageKey ?? "classic_auth"
-  };
-}
-function getConfig() {
-  if (!config) {
-    throw new Error(
-      '@classic-homes/auth not initialized. Call initAuth({ baseUrl: "..." }) before using auth services.'
-    );
-  }
-  return config;
-}
-function isInitialized() {
-  return config !== null;
-}
-function resetConfig() {
-  config = null;
-}
-function getDefaultStorage() {
-  if (typeof window !== "undefined" && window.localStorage) {
-    return {
-      getItem: (key) => localStorage.getItem(key),
-      setItem: (key, value) => localStorage.setItem(key, value),
-      removeItem: (key) => localStorage.removeItem(key)
-    };
-  }
-  return {
-    getItem: () => null,
-    setItem: () => {
-    },
-    removeItem: () => {
-    }
-  };
-}
-function getStorage() {
-  const cfg = getConfig();
-  return cfg.storage ?? getDefaultStorage();
-}
-function getFetch() {
-  const cfg = getConfig();
-  return cfg.fetch ?? fetch;
-}
-var config;
-var init_config = __esm({
-  "src/core/config.ts"() {
-    config = null;
-  }
-});
-
-// src/core/jwt.ts
-function decodeJWT(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3) {
-      return null;
-    }
-    const payload = parts[1];
-    const decoded = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
-    return JSON.parse(decoded);
-  } catch {
-    return null;
-  }
-}
-function isTokenExpired(token) {
-  const payload = decodeJWT(token);
-  if (!payload || !payload.exp) {
-    return true;
-  }
-  return payload.exp * 1e3 < Date.now();
-}
-function getTokenRemainingTime(token) {
-  const payload = decodeJWT(token);
-  if (!payload || !payload.exp) {
-    return 0;
-  }
-  const remainingMs = payload.exp * 1e3 - Date.now();
-  return Math.max(0, remainingMs);
-}
-function getTokenExpiration(token) {
-  const payload = decodeJWT(token);
-  if (!payload || !payload.exp) {
-    return null;
-  }
-  return new Date(payload.exp * 1e3);
-}
-function extractClaims(token, claims) {
-  const payload = decodeJWT(token);
-  if (!payload) {
-    return null;
-  }
-  const result = {};
-  for (const claim of claims) {
-    if (claim in payload) {
-      result[claim] = payload[claim];
-    }
-  }
-  return result;
-}
-var init_jwt = __esm({
-  "src/core/jwt.ts"() {
-  }
-});
-
-// src/core/api.ts
-var authApi;
-var init_api = __esm({
-  "src/core/api.ts"() {
-    init_client();
-    init_config();
-    authApi = {
-      // ============================================================================
-      // Authentication
-      // ============================================================================
-      /**
-       * Login with username and password.
-       */
-      async login(credentials) {
-        const response = await api.post("/auth/login", credentials);
-        return extractData(response);
-      },
-      /**
-       * Logout the current user.
-       * Returns SSO logout URL if applicable for SSO users.
-       */
-      async logout() {
-        try {
-          const response = await api.post("/auth/logout", {}, true);
-          return extractData(response);
-        } catch {
-          return { success: true };
-        }
-      },
-      /**
-       * Register a new user.
-       */
-      async register(data) {
-        const response = await api.post("/auth/register", data);
-        return extractData(response);
-      },
-      /**
-       * Request a password reset email.
-       */
-      async forgotPassword(email) {
-        await api.post("/auth/forgot-password", { email });
-      },
-      /**
-       * Reset password with a token.
-       */
-      async resetPassword(token, newPassword) {
-        await api.post("/auth/reset-password", { token, newPassword });
-      },
-      /**
-       * Refresh the access token.
-       */
-      async refreshToken(refreshToken) {
-        const response = await api.post("/auth/refresh", { refreshToken });
-        return extractData(response);
-      },
-      /**
-       * Initiate SSO login by redirecting to the SSO provider.
-       * @param options.callbackUrl - The URL where the SSO provider should redirect after auth
-       * @param options.redirectUrl - The final URL to redirect to after processing the callback
-       */
-      initiateSSOLogin(options) {
-        if (typeof window === "undefined") return;
-        const config2 = getConfig();
-        const authorizeUrl = config2.sso?.authorizeUrl ?? `${config2.baseUrl}/auth/sso/authorize`;
-        const params = new URLSearchParams();
-        if (options?.callbackUrl) {
-          params.set("callback", options.callbackUrl);
-        }
-        if (options?.redirectUrl) {
-          params.set("redirect", options.redirectUrl);
-        }
-        const url = params.toString() ? `${authorizeUrl}?${params}` : authorizeUrl;
-        window.location.href = url;
-      },
-      // ============================================================================
-      // Profile
-      // ============================================================================
-      /**
-       * Get the current user's profile.
-       */
-      async getProfile(customFetch) {
-        const response = await api.get("/auth/profile", true, customFetch);
-        return response;
-      },
-      /**
-       * Update the current user's profile.
-       */
-      async updateProfile(data) {
-        const response = await api.put("/auth/profile", data, true);
-        return extractData(response);
-      },
-      /**
-       * Change the current user's password.
-       */
-      async changePassword(data) {
-        await api.put("/auth/change-password", data, true);
-      },
-      // ============================================================================
-      // Email Verification
-      // ============================================================================
-      /**
-       * Resend email verification.
-       */
-      async resendVerification() {
-        await api.post("/auth/resend-verification", {}, true);
-      },
-      /**
-       * Verify email with a token.
-       */
-      async verifyEmail(token) {
-        const response = await api.post("/auth/verify-email", {
-          token
-        });
-        return extractData(response);
-      },
-      // ============================================================================
-      // Session Management
-      // ============================================================================
-      /**
-       * Get all active sessions.
-       */
-      async getSessions(customFetch) {
-        const response = await api.get(
-          "/auth/sessions",
-          true,
-          customFetch
-        );
-        return response;
-      },
-      /**
-       * Revoke a specific session.
-       */
-      async revokeSession(sessionId) {
-        await api.delete(`/auth/sessions/${sessionId}`, true);
-      },
-      /**
-       * Revoke all sessions except the current one.
-       */
-      async revokeAllSessions() {
-        await api.delete("/auth/sessions", true);
-      },
-      // ============================================================================
-      // API Key Management
-      // ============================================================================
-      /**
-       * Get all API keys.
-       */
-      async getApiKeys(customFetch) {
-        const response = await api.get("/auth/api-keys", true, customFetch);
-        return response;
-      },
-      /**
-       * Create a new API key.
-       */
-      async createApiKey(data) {
-        const response = await api.post("/auth/api-keys", data, true);
-        return extractData(response);
-      },
-      /**
-       * Revoke an API key.
-       */
-      async revokeApiKey(keyId) {
-        await api.delete(`/auth/api-keys/${keyId}`, true);
-      },
-      /**
-       * Update an API key's name.
-       */
-      async updateApiKey(keyId, data) {
-        await api.put(`/auth/api-keys/${keyId}`, data, true);
-      },
-      // ============================================================================
-      // MFA Management
-      // ============================================================================
-      /**
-       * Get MFA status for the current user.
-       */
-      async getMFAStatus() {
-        const response = await api.get("/auth/mfa/status", true);
-        return response;
-      },
-      /**
-       * Setup MFA (get QR code and backup codes).
-       */
-      async setupMFA() {
-        const response = await api.post("/auth/mfa-setup", {}, true);
-        return extractData(response);
-      },
-      /**
-       * Verify MFA setup with a code.
-       */
-      async verifyMFASetup(code) {
-        await api.post("/auth/mfa/verify", { code }, true);
-      },
-      /**
-       * Disable MFA.
-       */
-      async disableMFA(password) {
-        await api.delete("/auth/mfa", true, void 0, { password });
-      },
-      /**
-       * Regenerate MFA backup codes.
-       */
-      async regenerateBackupCodes(password) {
-        const response = await api.post(
-          "/auth/mfa/regenerate-backup-codes",
-          { password },
-          true
-        );
-        return extractData(response);
-      },
-      /**
-       * Verify MFA challenge during login.
-       */
-      async verifyMFAChallenge(data) {
-        const config2 = getConfig();
-        const fetchFn = config2.fetch ?? fetch;
-        const requestBody = {
-          code: data.code,
-          type: data.method === "backup" ? "backup" : "totp",
-          trustDevice: data.trustDevice
-        };
-        const response = await fetchFn(`${config2.baseUrl}/auth/mfa/challenge`, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            Authorization: `Bearer ${data.mfaToken}`
-          },
-          body: JSON.stringify(requestBody)
-        });
-        if (!response.ok) {
-          const error = await response.json().catch(() => ({ message: "Verification failed" }));
-          throw new Error(error.error?.message || error.message || "Invalid verification code");
-        }
-        const result = await response.json();
-        return extractData(result);
-      },
-      // ============================================================================
-      // Device Management
-      // ============================================================================
-      /**
-       * Get all devices.
-       */
-      async getDevices(customFetch) {
-        const response = await api.get(
-          "/auth/devices",
-          true,
-          customFetch
-        );
-        return response;
-      },
-      /**
-       * Trust a device.
-       */
-      async trustDevice(deviceId) {
-        await api.put(`/auth/devices/${deviceId}/trust`, {}, true);
-      },
-      /**
-       * Revoke device trust.
-       */
-      async revokeDevice(deviceId) {
-        await api.delete(`/auth/devices/${deviceId}/revoke`, true);
-      },
-      /**
-       * Remove a device completely.
-       */
-      async removeDevice(deviceId) {
-        await api.delete(`/auth/devices/${deviceId}`, true);
-      },
-      /**
-       * Approve a device with a token.
-       */
-      async approveDevice(token) {
-        const response = await api.post("/auth/device/approve", {
-          token
-        });
-        return extractData(response);
-      },
-      /**
-       * Block a device with a token.
-       */
-      async blockDevice(token) {
-        const response = await api.post("/auth/device/block", {
-          token
-        });
-        return extractData(response);
-      },
-      // ============================================================================
-      // Preferences
-      // ============================================================================
-      /**
-       * Get user preferences.
-       */
-      async getPreferences(customFetch) {
-        const response = await api.get(
-          "/auth/preferences",
-          true,
-          customFetch
-        );
-        if (response && typeof response === "object" && "preferences" in response) {
-          return response.preferences;
-        }
-        return response ?? {};
-      },
-      /**
-       * Update user preferences.
-       */
-      async updatePreferences(data) {
-        await api.put("/auth/preferences", data, true);
-      },
-      // ============================================================================
-      // SSO / Linked Accounts
-      // ============================================================================
-      /**
-       * Get SSO linked accounts.
-       */
-      async getSSOAccounts(customFetch) {
-        const response = await api.get(
-          "/auth/sso/accounts",
-          true,
-          customFetch
-        );
-        if (response && typeof response === "object" && "accounts" in response) {
-          return response.accounts;
-        }
-        return Array.isArray(response) ? response : [];
-      },
-      /**
-       * Unlink an SSO account.
-       */
-      async unlinkSSOAccount(provider, password) {
-        await api.delete("/auth/sso/unlink", true, void 0, { provider, password });
-      },
-      /**
-       * Link an SSO account (redirects to SSO provider).
-       */
-      async linkSSOAccount(provider = "authentik") {
-        if (typeof window === "undefined") return;
-        const accessToken = getAccessToken();
-        if (!accessToken) {
-          throw new Error("Not authenticated");
-        }
-        const config2 = getConfig();
-        const params = new URLSearchParams({
-          token: accessToken,
-          provider
-        });
-        window.location.href = `${config2.baseUrl}/auth/sso/link?${params.toString()}`;
-      },
-      // ============================================================================
-      // Security Events
-      // ============================================================================
-      /**
-       * Get security event history.
-       */
-      async getSecurityEvents(params, customFetch) {
-        const queryParams = new URLSearchParams();
-        if (params?.page) queryParams.append("page", params.page.toString());
-        if (params?.limit) queryParams.append("limit", params.limit.toString());
-        if (params?.type) queryParams.append("type", params.type);
-        const response = await api.get(`/auth/security/events?${queryParams.toString()}`, true, customFetch);
-        return extractData(response);
-      }
-    };
-  }
-});
-
-// src/svelte/stores/auth.svelte.ts
-var auth_svelte_exports = {};
-__export(auth_svelte_exports, {
-  authActions: () => authActions,
-  authStore: () => authStore,
-  currentUser: () => currentUser,
-  isAuthenticated: () => isAuthenticated
-});
-function getStorageKey() {
-  return isInitialized() ? getConfig().storageKey ?? "classic_auth" : "classic_auth";
-}
-function getStorageAdapter() {
-  return isInitialized() ? getStorage() : getDefaultStorage();
-}
-function loadAuthFromStorage() {
-  try {
-    const storage = getStorageAdapter();
-    const data = storage.getItem(getStorageKey());
-    if (!data) {
-      return {
-        accessToken: null,
-        refreshToken: null,
-        user: null,
-        isAuthenticated: false
-      };
-    }
-    const parsed = JSON.parse(data);
-    return {
-      accessToken: parsed.accessToken ?? null,
-      refreshToken: parsed.refreshToken ?? null,
-      user: parsed.user ?? null,
-      isAuthenticated: !!parsed.accessToken && !!parsed.user
-    };
-  } catch {
-    return {
-      accessToken: null,
-      refreshToken: null,
-      user: null,
-      isAuthenticated: false
-    };
-  }
-}
-function saveAuthToStorage(state) {
-  try {
-    const storage = getStorageAdapter();
-    const key = getStorageKey();
-    if (!state.accessToken) {
-      storage.removeItem(key);
-    } else {
-      storage.setItem(key, JSON.stringify(state));
-    }
-  } catch {
-  }
-}
-var AuthStore, authStore, authActions, isAuthenticated, currentUser;
-var init_auth_svelte = __esm({
-  "src/svelte/stores/auth.svelte.ts"() {
-    init_config();
-    init_jwt();
-    init_api();
-    AuthStore = class {
-      constructor() {
-        this.subscribers = /* @__PURE__ */ new Set();
-        this.state = loadAuthFromStorage();
-      }
-      /**
-       * Subscribe to state changes (Svelte store contract).
-       */
-      subscribe(subscriber) {
-        this.subscribers.add(subscriber);
-        subscriber(this.state);
-        return () => this.subscribers.delete(subscriber);
-      }
-      notify() {
-        this.subscribers.forEach((sub) => sub(this.state));
-      }
-      // Getters for direct access
-      get accessToken() {
-        return this.state.accessToken;
-      }
-      get refreshToken() {
-        return this.state.refreshToken;
-      }
-      get user() {
-        return this.state.user;
-      }
-      get isAuthenticated() {
-        return this.state.isAuthenticated;
-      }
-      /**
-       * Get the current auth state snapshot.
-       */
-      getState() {
-        return { ...this.state };
-      }
-      /**
-       * Set auth data after successful login.
-       */
-      setAuth(accessToken, refreshToken, user, sessionToken) {
-        const jwtPayload = decodeJWT(accessToken);
-        const userWithPermissions = {
-          ...user,
-          permissions: user.permissions || jwtPayload?.permissions || [],
-          roles: user.roles || jwtPayload?.roles || (user.role ? [user.role] : [])
-        };
-        this.state = {
-          accessToken,
-          refreshToken,
-          user: userWithPermissions,
-          isAuthenticated: true
-        };
-        saveAuthToStorage(this.state);
-        if (sessionToken && typeof window !== "undefined") {
-          getStorageAdapter().setItem("sessionToken", sessionToken);
-        }
-        if (typeof window !== "undefined") {
-          window.dispatchEvent(
-            new CustomEvent("auth:login", {
-              detail: { user: userWithPermissions }
-            })
-          );
-        }
-        this.notify();
-      }
-      /**
-       * Update tokens (e.g., after refresh).
-       */
-      updateTokens(accessToken, refreshToken) {
-        const jwtPayload = decodeJWT(accessToken);
-        const updatedUser = this.state.user ? {
-          ...this.state.user,
-          permissions: jwtPayload?.permissions || this.state.user.permissions || [],
-          roles: jwtPayload?.roles || this.state.user.roles || (this.state.user.role ? [this.state.user.role] : [])
-        } : null;
-        this.state = {
-          ...this.state,
-          accessToken,
-          refreshToken,
-          user: updatedUser
-        };
-        saveAuthToStorage(this.state);
-        if (typeof window !== "undefined") {
-          window.dispatchEvent(new CustomEvent("auth:token-refresh"));
-        }
-        this.notify();
-      }
-      /**
-       * Update user data (e.g., after profile update).
-       */
-      updateUser(user) {
-        const jwtPayload = this.state.accessToken ? decodeJWT(this.state.accessToken) : null;
-        const updatedUser = {
-          ...user,
-          permissions: user.permissions || jwtPayload?.permissions || [],
-          roles: user.roles || jwtPayload?.roles || (user.role ? [user.role] : [])
-        };
-        this.state = {
-          ...this.state,
-          user: updatedUser
-        };
-        saveAuthToStorage(this.state);
-        if (typeof window !== "undefined") {
-          window.dispatchEvent(
-            new CustomEvent("auth:profile-update", {
-              detail: { user: updatedUser }
-            })
-          );
-        }
-        this.notify();
-      }
-      /**
-       * Clear auth state (logout).
-       */
-      logout() {
-        this.state = {
-          accessToken: null,
-          refreshToken: null,
-          user: null,
-          isAuthenticated: false
-        };
-        const storage = getStorageAdapter();
-        storage.removeItem(getStorageKey());
-        storage.removeItem("sessionToken");
-        if (typeof window !== "undefined") {
-          window.dispatchEvent(new CustomEvent("auth:logout"));
-        }
-        if (isInitialized()) {
-          getConfig().onLogout?.();
-        }
-        this.notify();
-      }
-      /**
-       * Logout with SSO support.
-       * Calls the logout API and returns the SSO logout URL if applicable.
-       * Clears local state regardless of API response.
-       */
-      async logoutWithSSO() {
-        try {
-          const response = await authApi.logout();
-          this.logout();
-          if (response?.ssoLogout && response?.logoutUrl) {
-            return { ssoLogoutUrl: response.logoutUrl };
-          }
-        } catch {
-          this.logout();
-        }
-        return {};
-      }
-      /**
-       * Check if user has a specific permission.
-       */
-      hasPermission(permission) {
-        return this.state.user?.permissions?.includes(permission) ?? false;
-      }
-      /**
-       * Check if user has a specific role.
-       */
-      hasRole(role) {
-        return this.state.user?.roles?.includes(role) ?? false;
-      }
-      /**
-       * Check if user has any of the specified roles.
-       */
-      hasAnyRole(roles) {
-        return roles.some((role) => this.state.user?.roles?.includes(role)) ?? false;
-      }
-      /**
-       * Check if user has all of the specified roles.
-       */
-      hasAllRoles(roles) {
-        return roles.every((role) => this.state.user?.roles?.includes(role)) ?? false;
-      }
-      /**
-       * Check if user has any of the specified permissions.
-       */
-      hasAnyPermission(permissions) {
-        return permissions.some((perm) => this.state.user?.permissions?.includes(perm)) ?? false;
-      }
-      /**
-       * Check if user has all of the specified permissions.
-       */
-      hasAllPermissions(permissions) {
-        return permissions.every((perm) => this.state.user?.permissions?.includes(perm)) ?? false;
-      }
-      /**
-       * Re-hydrate state from storage (useful after config changes).
-       */
-      rehydrate() {
-        this.state = loadAuthFromStorage();
-        this.notify();
-      }
-    };
-    authStore = new AuthStore();
-    authActions = {
-      setAuth: (accessToken, refreshToken, user, sessionToken) => authStore.setAuth(accessToken, refreshToken, user, sessionToken),
-      updateTokens: (accessToken, refreshToken) => authStore.updateTokens(accessToken, refreshToken),
-      updateUser: (user) => authStore.updateUser(user),
-      logout: () => authStore.logout(),
-      logoutWithSSO: () => authStore.logoutWithSSO(),
-      hasPermission: (permission) => authStore.hasPermission(permission),
-      hasRole: (role) => authStore.hasRole(role),
-      hasAnyRole: (roles) => authStore.hasAnyRole(roles),
-      hasAllRoles: (roles) => authStore.hasAllRoles(roles),
-      hasAnyPermission: (permissions) => authStore.hasAnyPermission(permissions),
-      hasAllPermissions: (permissions) => authStore.hasAllPermissions(permissions),
-      rehydrate: () => authStore.rehydrate()
-    };
-    isAuthenticated = {
-      subscribe: (subscriber) => {
-        return authStore.subscribe((state) => subscriber(state.isAuthenticated));
-      }
-    };
-    currentUser = {
-      subscribe: (subscriber) => {
-        return authStore.subscribe((state) => subscriber(state.user));
-      }
-    };
-  }
-});
-
-// src/core/client.ts
-function subscribeTokenRefresh(cb) {
-  refreshSubscribers.push(cb);
-}
-function onTokenRefreshed(token) {
-  refreshSubscribers.forEach((cb) => cb(token));
-  refreshSubscribers = [];
-}
-function getAccessToken() {
-  const config2 = getConfig();
-  const storage = getStorage();
-  const authData = storage.getItem(config2.storageKey ?? "classic_auth");
-  if (!authData) return null;
-  try {
-    const parsed = JSON.parse(authData);
-    return parsed.accessToken ?? null;
-  } catch {
-    return null;
-  }
-}
-function getRefreshToken() {
-  const config2 = getConfig();
-  const storage = getStorage();
-  const authData = storage.getItem(config2.storageKey ?? "classic_auth");
-  if (!authData) return null;
-  try {
-    const parsed = JSON.parse(authData);
-    return parsed.refreshToken ?? null;
-  } catch {
-    return null;
-  }
-}
-function getSessionToken() {
-  const storage = getStorage();
-  return storage.getItem("sessionToken");
-}
-function updateStoredTokens(accessToken, refreshToken) {
-  const config2 = getConfig();
-  const storage = getStorage();
-  const storageKey = config2.storageKey ?? "classic_auth";
-  const authData = storage.getItem(storageKey);
-  let parsed = {};
-  if (authData) {
-    try {
-      parsed = JSON.parse(authData);
-    } catch {
-    }
-  }
-  parsed.accessToken = accessToken;
-  parsed.refreshToken = refreshToken;
-  storage.setItem(storageKey, JSON.stringify(parsed));
-  Promise.resolve().then(() => (init_auth_svelte(), auth_svelte_exports)).then(({ authStore: authStore2 }) => {
-    authStore2.updateTokens(accessToken, refreshToken);
-  }).catch(() => {
-  });
-  config2.onTokenRefresh?.({ accessToken, refreshToken });
-}
-function clearStoredAuth() {
-  const config2 = getConfig();
-  const storage = getStorage();
-  storage.removeItem(config2.storageKey ?? "classic_auth");
-  storage.removeItem("sessionToken");
-}
-async function refreshAccessToken() {
-  const refreshToken = getRefreshToken();
-  const config2 = getConfig();
-  const fetchFn = getFetch();
-  if (!refreshToken) {
-    return false;
-  }
-  try {
-    const response = await fetchFn(`${config2.baseUrl}/auth/refresh`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify({ refreshToken })
-    });
-    if (response.ok) {
-      const apiResponse = await response.json();
-      const data = apiResponse.data;
-      const tokens = data && typeof data === "object" && "data" in data ? data.data : data;
-      if (tokens?.accessToken && tokens?.refreshToken) {
-        updateStoredTokens(tokens.accessToken, tokens.refreshToken);
-        onTokenRefreshed(tokens.accessToken);
-        return true;
-      }
-    }
-  } catch (error) {
-    config2.onAuthError?.(error instanceof Error ? error : new Error("Token refresh failed"));
-  }
-  return false;
-}
-function extractData(response) {
-  if (response && typeof response === "object" && "data" in response) {
-    const dataField = response.data;
-    if (dataField && typeof dataField === "object" && "data" in dataField) {
-      return dataField.data;
-    }
-    if (dataField !== void 0) {
-      return dataField;
-    }
-  }
-  return response;
-}
-async function apiRequest(endpoint, options = {}) {
-  const { authenticated = false, customFetch, body, ...fetchOptions } = options;
-  const config2 = getConfig();
-  const fetchFn = customFetch ?? getFetch();
-  const url = endpoint.startsWith("http") ? endpoint : `${config2.baseUrl}${endpoint}`;
-  const headers = {
-    "Content-Type": "application/json",
-    ...fetchOptions.headers
-  };
-  if (authenticated) {
-    const accessToken = getAccessToken();
-    const sessionToken = getSessionToken();
-    if (accessToken) {
-      headers["Authorization"] = `Bearer ${accessToken}`;
-    }
-    if (sessionToken) {
-      headers["X-Session-Token"] = sessionToken;
-    }
-  }
-  try {
-    const response = await fetchFn(url, {
-      ...fetchOptions,
-      headers,
-      body: body ? JSON.stringify(body) : void 0
-    });
-    if (response.status === 401 && authenticated && typeof window !== "undefined") {
-      if (!isRefreshing) {
-        isRefreshing = true;
-        const refreshed = await refreshAccessToken();
-        isRefreshing = false;
-        if (refreshed) {
-          return apiRequest(endpoint, options);
-        } else {
-          clearStoredAuth();
-          config2.onLogout?.();
-          throw new Error("Authentication failed. Please sign in again.");
-        }
-      } else {
-        return new Promise((resolve, reject) => {
-          subscribeTokenRefresh(() => {
-            apiRequest(endpoint, options).then(resolve).catch(reject);
-          });
-        });
-      }
-    }
-    const data = await response.json();
-    if (!response.ok) {
-      const dataObj = data;
-      const errorMessage = data.error?.message || (typeof dataObj.message === "string" ? dataObj.message : void 0) || data.meta?.message || (typeof dataObj.detail === "string" ? dataObj.detail : void 0) || "Request failed";
-      const error = new Error(errorMessage);
-      config2.onAuthError?.(error);
-      throw error;
-    }
-    return data;
-  } catch (error) {
-    if (error instanceof Error) {
-      throw error;
-    }
-    throw new Error("API request failed");
-  }
-}
-var isRefreshing, refreshSubscribers, api;
-var init_client = __esm({
-  "src/core/client.ts"() {
-    init_config();
-    isRefreshing = false;
-    refreshSubscribers = [];
-    api = {
-      get: (endpoint, authenticated = false, customFetch) => apiRequest(endpoint, { method: "GET", authenticated, customFetch }),
-      post: (endpoint, body, authenticated = false, customFetch) => apiRequest(endpoint, {
-        method: "POST",
-        body,
-        authenticated,
-        customFetch
-      }),
-      put: (endpoint, body, authenticated = false, customFetch) => apiRequest(endpoint, {
-        method: "PUT",
-        body,
-        authenticated,
-        customFetch
-      }),
-      patch: (endpoint, body, authenticated = false, customFetch) => apiRequest(endpoint, {
-        method: "PATCH",
-        body,
-        authenticated,
-        customFetch
-      }),
-      delete: (endpoint, authenticated = false, customFetch, body) => apiRequest(endpoint, {
-        method: "DELETE",
-        body,
-        authenticated,
-        customFetch
-      })
-    };
-  }
-});
-
-// src/core/index.ts
-init_config();
-init_client();
-init_api();
-
-// src/core/service.ts
-init_api();
-
-// src/core/guards.ts
-function isMfaChallengeResponse(response) {
-  return "requiresMFA" in response && response.requiresMFA === true || "mfaRequired" in response && response.mfaRequired === true;
-}
-function isLoginSuccessResponse(response) {
-  return "accessToken" in response && "user" in response && !isMfaChallengeResponse(response);
-}
-function getMfaToken(response) {
-  return response.mfaToken ?? response.mfaChallengeToken;
-}
-function getAvailableMethods(response) {
-  return response.availableMethods ?? ["totp"];
-}
-
-// src/core/service.ts
-var AuthService = class {
-  // ============================================================================
-  // Authentication
-  // ============================================================================
-  /**
-   * Login with username and password.
-   * By default, automatically sets the auth state on successful login (unless MFA is required).
-   * @param credentials - Username and password
-   * @param options - Optional settings for login behavior
-   */
-  async login(credentials, options) {
-    const response = await authApi.login(credentials);
-    if (options?.autoSetAuth !== false && !isMfaChallengeResponse(response)) {
-      try {
-        const { authStore: authStore2 } = await Promise.resolve().then(() => (init_auth_svelte(), auth_svelte_exports));
-        authStore2.setAuth(
-          response.accessToken,
-          response.refreshToken,
-          response.user,
-          response.sessionToken
-        );
-      } catch {
-      }
-    }
-    return response;
-  }
-  /**
-   * Logout the current user.
-   * Returns SSO logout URL if applicable for SSO users.
-   */
-  async logout() {
-    return await authApi.logout();
-  }
-  /**
-   * Register a new user.
-   */
-  async register(data) {
-    return await authApi.register(data);
-  }
-  /**
-   * Request a password reset email.
-   */
-  async forgotPassword(email) {
-    await authApi.forgotPassword(email);
-  }
-  /**
-   * Reset password with a token.
-   */
-  async resetPassword(token, newPassword) {
-    await authApi.resetPassword(token, newPassword);
-  }
-  /**
-   * Change the current user's password.
-   */
-  async changePassword(currentPassword, newPassword) {
-    await authApi.changePassword({ currentPassword, newPassword });
-  }
-  /**
-   * Refresh the access token.
-   */
-  async refreshToken(refreshToken) {
-    return await authApi.refreshToken(refreshToken);
-  }
-  /**
-   * Initiate SSO login (redirects to SSO provider).
-   * @param options.callbackUrl - The URL where the SSO provider should redirect after auth
-   * @param options.redirectUrl - The final URL to redirect to after processing the callback
-   */
-  initiateSSOLogin(options) {
-    authApi.initiateSSOLogin(options);
-  }
-  // ============================================================================
-  // Profile
-  // ============================================================================
-  /**
-   * Get the current user's profile.
-   */
-  async getProfile(customFetch) {
-    return await authApi.getProfile(customFetch);
-  }
-  /**
-   * Update the current user's profile.
-   */
-  async updateProfile(data) {
-    return await authApi.updateProfile(data);
-  }
-  /**
-   * Resend email verification.
-   */
-  async resendVerification() {
-    await authApi.resendVerification();
-  }
-  /**
-   * Verify email with a token.
-   */
-  async verifyEmail(token) {
-    return await authApi.verifyEmail(token);
-  }
-  // ============================================================================
-  // Session Management
-  // ============================================================================
-  /**
-   * Get all active sessions.
-   */
-  async getSessions(customFetch) {
-    return await authApi.getSessions(customFetch);
-  }
-  /**
-   * Revoke a specific session.
-   */
-  async revokeSession(sessionId) {
-    await authApi.revokeSession(sessionId);
-  }
-  /**
-   * Revoke all sessions except the current one.
-   */
-  async revokeAllSessions() {
-    await authApi.revokeAllSessions();
-  }
-  // ============================================================================
-  // API Key Management
-  // ============================================================================
-  /**
-   * Get all API keys.
-   */
-  async getApiKeys(customFetch) {
-    return await authApi.getApiKeys(customFetch);
-  }
-  /**
-   * Create a new API key.
-   */
-  async createApiKey(data) {
-    return await authApi.createApiKey(data);
-  }
-  /**
-   * Revoke an API key.
-   */
-  async revokeApiKey(keyId) {
-    await authApi.revokeApiKey(keyId);
-  }
-  /**
-   * Update an API key's name.
-   */
-  async updateApiKey(keyId, name) {
-    await authApi.updateApiKey(keyId, { name });
-  }
-  // ============================================================================
-  // MFA Management
-  // ============================================================================
-  /**
-   * Get MFA status for the current user.
-   */
-  async getMFAStatus() {
-    return await authApi.getMFAStatus();
-  }
-  /**
-   * Setup MFA (get QR code and backup codes).
-   */
-  async setupMFA() {
-    return await authApi.setupMFA();
-  }
-  /**
-   * Verify MFA setup with a code.
-   */
-  async verifyMFASetup(code) {
-    await authApi.verifyMFASetup(code);
-  }
-  /**
-   * Disable MFA.
-   */
-  async disableMFA(password) {
-    await authApi.disableMFA(password);
-  }
-  /**
-   * Regenerate MFA backup codes.
-   */
-  async regenerateBackupCodes(password) {
-    return await authApi.regenerateBackupCodes(password);
-  }
-  /**
-   * Verify MFA challenge during login.
-   * By default, automatically sets the auth state on successful verification.
-   * @param data - MFA challenge data including token and code
-   * @param options - Optional settings for verification behavior
-   */
-  async verifyMFAChallenge(data, options) {
-    const response = await authApi.verifyMFAChallenge(data);
-    if (options?.autoSetAuth !== false) {
-      try {
-        const { authStore: authStore2 } = await Promise.resolve().then(() => (init_auth_svelte(), auth_svelte_exports));
-        authStore2.setAuth(
-          response.accessToken,
-          response.refreshToken,
-          response.user,
-          response.sessionToken
-        );
-      } catch {
-      }
-    }
-    return response;
-  }
-  // ============================================================================
-  // Device Management
-  // ============================================================================
-  /**
-   * Get all devices.
-   */
-  async getDevices(customFetch) {
-    return await authApi.getDevices(customFetch);
-  }
-  /**
-   * Trust a device.
-   */
-  async trustDevice(deviceId) {
-    await authApi.trustDevice(deviceId);
-  }
-  /**
-   * Revoke device trust.
-   */
-  async revokeDevice(deviceId) {
-    await authApi.revokeDevice(deviceId);
-  }
-  /**
-   * Remove a device completely.
-   */
-  async removeDevice(deviceId) {
-    await authApi.removeDevice(deviceId);
-  }
-  /**
-   * Approve a device with a token.
-   */
-  async approveDevice(token) {
-    return await authApi.approveDevice(token);
-  }
-  /**
-   * Block a device with a token.
-   */
-  async blockDevice(token) {
-    return await authApi.blockDevice(token);
-  }
-  // ============================================================================
-  // Preferences
-  // ============================================================================
-  /**
-   * Get user preferences.
-   */
-  async getPreferences(customFetch) {
-    return await authApi.getPreferences(customFetch);
-  }
-  /**
-   * Update user preferences.
-   */
-  async updatePreferences(data) {
-    await authApi.updatePreferences(data);
-  }
-  // ============================================================================
-  // SSO / Linked Accounts
-  // ============================================================================
-  /**
-   * Get SSO linked accounts.
-   */
-  async getLinkedAccounts(customFetch) {
-    return await authApi.getSSOAccounts(customFetch);
-  }
-  /**
-   * Link an SSO account (redirects to SSO provider).
-   */
-  async linkAccount(provider = "authentik") {
-    await authApi.linkSSOAccount(provider);
-  }
-  /**
-   * Unlink an SSO account.
-   */
-  async unlinkAccount(provider, password) {
-    await authApi.unlinkSSOAccount(provider, password);
-  }
-  // ============================================================================
-  // Security Events
-  // ============================================================================
-  /**
-   * Get security event history.
-   */
-  async getSecurityEvents(params, customFetch) {
-    return await authApi.getSecurityEvents(params, customFetch);
-  }
-};
-var authService = new AuthService();
-
-// src/core/index.ts
-init_jwt();
-
-export { AuthService, api, apiRequest, authApi, authService, clearStoredAuth, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getConfig, getDefaultStorage, getFetch, getMfaToken, getRefreshToken, getSessionToken, getStorage, getTokenExpiration, getTokenRemainingTime, initAuth, isInitialized, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, resetConfig, updateStoredTokens };
+export { AuthService, authService, getAvailableMethods, getMfaToken, isLoginSuccessResponse, isMfaChallengeResponse } from '../chunk-MY664247.js';
+export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from '../chunk-MI4B4ZRK.js';
+export { decodeJWT, extractClaims, getConfig, getDefaultStorage, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-DCGC6CNV.js';