@corespec/vite-plugin-api-auto-login 0.1.0 → 0.2.0

package/README.md

@@ -46,80 +46,104 @@ Values still come from `API_AUTO_LOGIN_USERNAME` and `API_AUTO_LOGIN_PASSWORD`;
 only the outgoing form field names change. Names must be non-empty and distinct.
 The `User-Agent` header is unaffected.
 
-Use `formFields` only with the default strategy; it cannot be combined with
-`request` or `createAuthRequest`. When constructing the exported strategy directly,
-use `new FormDataAuthRequest(config, { username: 'email' })`.
-The `FormFieldNames` type is exported for reusable mappings.
+Use `formFields` only with the default request; it cannot be combined with a custom
+`request`. The exported `createFormDataRequest(config, fields)` function returns
+a request callback for consumers who want to compose the default behavior.
 
 ## Customizing the login request
 
-Use `createAuthRequest(config)` to create a `AuthRequest` strategy for each
-Vite server initialization. The strategy controls the URL, HTTP method, headers,
-and body. A class can keep any additional configuration it needs:
+Pass a function that receives the parsed configuration and returns the URL and
+Undici fetch options. It can return a promise. Create a fresh request body each
+time the callback runs:
 
 ```ts
 import { defineConfig } from 'vite'
-import {
-  viteAPIAutoLogin,
-  type PluginEnv,
-  type AuthRequest,
-  type AuthRequestOptions,
-} from '@corespec/vite-plugin-api-auto-login'
-
-class JsonAuthRequest implements AuthRequest {
-  create(config: Readonly<PluginEnv>): AuthRequestOptions {
-    if (!config.loginUrl || !config.username || !config.password) {
-      throw new Error('JSON login requires an endpoint, username, and password')
-    }
-
-    return {
-      url: config.loginUrl,
-      init: {
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({
-          username: config.username,
-          password: config.password,
-        }),
-      },
-    }
-  }
-}
+import { viteAPIAutoLogin } from '@corespec/vite-plugin-api-auto-login'
 
 export default defineConfig({
-  plugins: [viteAPIAutoLogin({ createAuthRequest: () => new JsonAuthRequest() })],
+  plugins: [
+    viteAPIAutoLogin({
+      request: (config) => {
+        if (!config.loginUrl || !config.username || !config.password) {
+          throw new Error('JSON login requires an endpoint, username, and password')
+        }
+        return {
+          url: config.loginUrl,
+          init: {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+              email: config.username,
+              password: config.password,
+            }),
+          },
+        }
+      },
+    }),
+  ],
 })
 ```
 
-The factory receives the readonly parsed configuration and runs once per
-`configureServer` invocation, not once per request. Return a fresh instance to
-keep mutable strategy state separate between servers. Factory errors are logged
-and prevent middleware registration for that server. The factory is synchronous.
+The callback runs lazily when a login is needed. Concurrent requests share one
+login through RxJS, and each Vite server has its own token cache. JWTs are reused
+until their `exp` timestamp; opaque tokens and tokens without readable expiry are
+not cached between completed logins. Errors are logged and requests continue;
+the next request can attempt authentication again. There are no automatic retries.
 
-Use `request: new JsonAuthRequest()` for
-shared strategy instances. Supply either `request` or `createAuthRequest`, never
-both; TypeScript and runtime validation enforce this.
+Custom callbacks validate their own requirements and may omit the default login
+variables. Without a callback, the default sends a multipart POST with the mapped
+username/password fields and a `User-Agent` header.
 
-`create` can return a promise. It runs whenever a new token is needed, so create
-a fresh body for each call. Concurrent login requests are deduplicated, and
-valid JWT tokens are cached until their `exp` timestamp. Tokens without a
-readable JWT expiry are not cached.
+`init` supports Undici options including `signal` and `redirect`. The plugin
+combines your signal with its lifecycle cancellation and manages `dispatcher`
+through the TLS configuration. The response must be successful JSON containing
+a non-empty `token` string.
 
-Without this option, `FormDataAuthRequest` sends a multipart POST
-with `username` and `password` fields and a `User-Agent` header. This class is also exported
-for consumers that want to extend the default request.
+## Cookie options
 
-The `init` object supports Undici fetch options, including `signal` and
-`redirect`. The plugin manages `dispatcher` through its TLS configuration.
-The response must still be successful HTTP JSON containing a non-empty
-`token` string. Custom strategies validate their own authentication requirements and can omit
-all three default login variables.
+```ts
+viteAPIAutoLogin({
+  cookie: {
+    path: '/api',
+    sameSite: 'strict',
+    secure: false,
+    httpOnly: true,
+  },
+})
+```
+
+Defaults preserve the original behavior: `path: '/'`, `sameSite: 'lax'`,
+`secure: false`, and `httpOnly: false`. `sameSite` accepts `lax`, `strict`, or
+`none`; `none` requires `secure: true`. Enable `httpOnly` when your frontend does
+not need JavaScript access to the cookie. `secure` cookies require HTTPS in the
+normal browser cookie model.
+
+The name still comes from `API_AUTO_LOGIN_COOKIE_NAME`. Cookie `path` controls
+where the browser sends the cookie, not which page requests trigger login.
+Cookies are serialized with `cookie` and appended without replacing existing
+`Set-Cookie` headers. Disconnected responses unsubscribe without continuing the
+middleware chain. When the last waiting response disconnects, the login is aborted;
+a later request starts a fresh login. Vite shutdown also cancels pending authentication.
+
+## Migrating from the class-based API
+
+Version `0.2.0` changes the public API under the project's pre-1.0 versioning policy:
+
+- Replace `request: instance` with `request: (config) => instance.create(config)`,
+  or inline the request construction as shown above.
+- Replace `createAuthRequest` with a `request(config)` callback. The callback runs
+  per login, rather than once during server configuration.
+- Replace `PluginConfig.fromEnv(env)` with `loadPluginConfig(env)`.
+- Replace `new FormDataAuthRequest(config, fields)` with
+  `createFormDataRequest(config, fields)`. Call the returned function with `config`.
+- `AuthRequest` is now a function type; `AuthRequestFactory` is removed.
+- `AuthCookieOptions` is exported for reusable cookie configuration.
 
 ## Environment variables
 
 Define these variables in your Vite environment files, such as `.env.local`, `.env.development`, or another file in `envDir` that Vite loads for the current mode.
 
-Required by the default `FormDataAuthRequest` strategy only:
+Required by the default form-data request only:
 
 | Variable                   | Description                                                                                  |
 | -------------------------- | -------------------------------------------------------------------------------------------- |
@@ -137,17 +161,13 @@ Optional variables:
 
 ## Configuration parsing
 
-`PluginConfig.fromEnv(env)` converts the environment values returned by Vite's
-`loadEnv` into readonly configuration properties. It applies the shared defaults
-and parses the TLS flag. Use this named factory instead of constructing
-`PluginConfig` directly.
+`loadPluginConfig(env)` converts the environment values returned by Vite's
+`loadEnv` into a frozen configuration object. It applies shared defaults and
+parses the TLS flag.
 
 Login URL, username, and password are optional in the shared configuration.
-`FormDataAuthRequest` validates them when the plugin creates the default
-strategy and whenever it builds a request. A custom strategy or factory is
-responsible for validating the fields it uses.
-
-The login variables deliberately avoid the `VITE_` prefix so they remain on the server with Vite's default configuration. Do not add `API_AUTO_LOGIN_` to Vite's `envPrefix`, as this would expose credentials to client code.
+`createFormDataRequest` validates them when constructing the default callback.
+Custom request callbacks validate their own requirements.
 
 ## Vue + MSW example
 
@@ -189,7 +209,7 @@ Local environment overrides (`.env.local` and `.env.*.local`) are ignored by Git
 Use `@/` for imports from `src/`, including imports in tests:
 
 ```ts
-import { PluginConfig } from '@/config/PluginConfig'
+import { loadPluginConfig } from '@/config/loadPluginConfig'
 ```
 
 TypeScript and Vite/Vitest resolve this alias locally. The declaration build
@@ -230,10 +250,9 @@ Release setup:
    as the repository Actions secret `NPM_TOKEN`. Use a stage-only token; CI does
    not need to bypass 2FA. Keep local tokens in an ignored `.env` file.
 2. Run `npm ci`, `npm run check`, and `npm run example:build`.
-3. The renamed package's initial release uses the tag
-   `@corespec/vite-plugin-api-auto-login@0.1.0`, preserving the old package's
-   `v0.1.0` tag. For later releases, use `npm run release` or an explicit
-   bump command described in CONTRIBUTING.md.
+3. Use `npm run release` or an explicit bump command described in CONTRIBUTING.md.
+   Releases use version tags such as `v0.2.0`. Historical release tags were removed
+   during the repository history reset; published npm versions remain available.
 4. Push the release commit and tag with `git push --follow-tags`. The Publish
    workflow checks, builds, and stages the package with provenance. The npm
    token is available only to its staging step.
@@ -242,7 +261,7 @@ Release setup:
    A successful staging workflow does not mean the version is publicly available.
 
 To retry an existing tag, manually run the Publish workflow and supply that tag
-(for example `v0.1.0`). It checks out the tagged source and verifies the version.
+(for example `v0.2.0`). It checks out the tagged source and verifies the version.
 
 Trusted publishing can replace the token after configuring owner `core-spec-tech`,
 repository `vite-plugin-api-auto-login`, and workflow `publish.yml` in npm's package

package/dist/auth/AuthRequest.d.ts

@@ -4,7 +4,5 @@ export type AuthRequestOptions = {
     url: string | URL;
     init: Omit<RequestInit, 'dispatcher'>;
 };
-export interface AuthRequest {
-    create(config: Readonly<PluginEnv>): AuthRequestOptions | Promise<AuthRequestOptions>;
-}
+export type AuthRequest = (config: Readonly<PluginEnv>) => AuthRequestOptions | Promise<AuthRequestOptions>;
 //# sourceMappingURL=AuthRequest.d.ts.map

package/dist/auth/AuthRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthRequest.d.ts","sourceRoot":"","sources":["../../src/auth/AuthRequest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAEzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;IACjB,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;CACtC,CAAA;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;CACtF"}
+{"version":3,"file":"AuthRequest.d.ts","sourceRoot":"","sources":["../../src/auth/AuthRequest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AACzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;IACjB,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,WAAW,GAAG,CACxB,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,KACxB,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA"}

package/dist/auth/createFormDataRequest.d.ts

@@ -0,0 +1,4 @@
+import type { FormFieldNames, PluginEnv } from '../config/types.js';
+import type { AuthRequest } from './AuthRequest.js';
+export declare function createFormDataRequest(config: Readonly<PluginEnv>, fields?: Readonly<FormFieldNames>): AuthRequest;
+//# sourceMappingURL=createFormDataRequest.d.ts.map

package/dist/auth/createFormDataRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createFormDataRequest.d.ts","sourceRoot":"","sources":["../../src/auth/createFormDataRequest.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAErD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAC3B,MAAM,GAAE,QAAQ,CAAC,cAAc,CAAM,GACpC,WAAW,CAkBb"}

package/dist/auth/createTokenStream.d.ts

@@ -0,0 +1,14 @@
+import type { Observable } from 'rxjs';
+import { fetch as undiciFetch } from 'undici';
+import type { Dispatcher } from 'undici';
+import type { PluginEnv } from '../config/types.js';
+import type { AuthRequest } from './AuthRequest.js';
+type TokenStreamDependencies = {
+    request?: AuthRequest;
+    fetch?: typeof undiciFetch;
+    createDispatcher?: () => Dispatcher;
+    signal?: AbortSignal;
+};
+export declare function createTokenStream(config: Readonly<PluginEnv>, dependencies?: TokenStreamDependencies): Observable<string>;
+export {};
+//# sourceMappingURL=createTokenStream.d.ts.map

package/dist/auth/createTokenStream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createTokenStream.d.ts","sourceRoot":"","sources":["../../src/auth/createTokenStream.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AACtC,OAAO,EAAS,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAA;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAExC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAIrD,KAAK,uBAAuB,GAAG;IAC7B,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,KAAK,CAAC,EAAE,OAAO,WAAW,CAAA;IAC1B,gBAAgB,CAAC,EAAE,MAAM,UAAU,CAAA;IACnC,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,CAAA;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAC3B,YAAY,GAAE,uBAA4B,GACzC,UAAU,CAAC,MAAM,CAAC,CAoDpB"}

package/dist/config/loadPluginConfig.d.ts

@@ -0,0 +1,5 @@
+import type { PluginEnv, PluginEnvInput } from './types.js';
+export declare const DEFAULT_COOKIE_NAME = "your_token_name";
+export declare const DEFAULT_USER_AGENT = "vite";
+export declare function loadPluginConfig(env: PluginEnvInput): Readonly<PluginEnv>;
+//# sourceMappingURL=loadPluginConfig.d.ts.map

package/dist/config/loadPluginConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadPluginConfig.d.ts","sourceRoot":"","sources":["../../src/config/loadPluginConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAE/D,eAAO,MAAM,mBAAmB,oBAAoB,CAAA;AACpD,eAAO,MAAM,kBAAkB,SAAS,CAAA;AAExC,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,CASzE"}

package/dist/config/types.d.ts

@@ -8,22 +8,23 @@ export type PluginEnv = {
     userAgent: string;
 };
 export type PluginEnvInput = Readonly<Record<string, string | undefined>>;
-export type AuthRequestFactory = (config: Readonly<PluginEnv>) => AuthRequest;
 export type FormFieldNames = {
     username?: string;
     password?: string;
 };
+export type AuthCookieOptions = {
+    path?: string;
+    sameSite?: 'lax' | 'strict' | 'none';
+    secure?: boolean;
+    httpOnly?: boolean;
+};
 export type AutoLoginOptions = {
+    cookie?: AuthCookieOptions;
+} & ({
     formFields?: FormFieldNames;
     request?: never;
-    createAuthRequest?: never;
 } | {
     formFields?: never;
     request: AuthRequest;
-    createAuthRequest?: never;
-} | {
-    formFields?: never;
-    request?: never;
-    createAuthRequest: AuthRequestFactory;
-};
+});
 //# sourceMappingURL=types.d.ts.map

package/dist/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAErD,MAAM,MAAM,SAAS,GAAG;IACtB,gBAAgB,EAAE,OAAO,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;AAEzE,MAAM,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,WAAW,CAAA;AAE7E,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,UAAU,CAAC,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IAAC,iBAAiB,CAAC,EAAE,KAAK,CAAA;CAAE,GAC3E;IAAE,UAAU,CAAC,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,iBAAiB,CAAC,EAAE,KAAK,CAAA;CAAE,GACvE;IAAE,UAAU,CAAC,EAAE,KAAK,CAAC;IAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IAAC,iBAAiB,EAAE,kBAAkB,CAAA;CAAE,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAErD,MAAM,MAAM,SAAS,GAAG;IACtB,gBAAgB,EAAE,OAAO,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;AAEzE,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAAE,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAAE,GAAG,CAC9D;IAAE,UAAU,CAAC,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,UAAU,CAAC,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAChG,CAAA"}

package/dist/http/isHtmlDocumentRequest.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingMessage } from 'node:http';
+export declare function isHtmlDocumentRequest(req: IncomingMessage): boolean;
+//# sourceMappingURL=isHtmlDocumentRequest.d.ts.map

package/dist/http/isHtmlDocumentRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isHtmlDocumentRequest.d.ts","sourceRoot":"","sources":["../../src/http/isHtmlDocumentRequest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAEhD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAKnE"}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { viteAPIAutoLogin } from './plugin.js';
-export { FormDataAuthRequest } from './auth/FormDataAuthRequest.js';
+export { createFormDataRequest } from './auth/createFormDataRequest.js';
+export { loadPluginConfig } from './config/loadPluginConfig.js';
 export type { AuthRequest, AuthRequestOptions } from './auth/AuthRequest.js';
-export type { AutoLoginOptions, PluginEnv, AuthRequestFactory, FormFieldNames, } from './config/types.js';
-export { PluginConfig } from './config/PluginConfig.js';
+export type { AutoLoginOptions, PluginEnv, FormFieldNames, AuthCookieOptions } from './config/types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACzE,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,kBAAkB,EAClB,cAAc,GACf,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACzE,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/middleware/createAutoLoginMiddleware.d.ts

@@ -0,0 +1,5 @@
+import type { Observable } from 'rxjs';
+import type { Connect, Logger } from 'vite';
+import type { AuthCookieOptions, PluginEnv } from '../config/types.js';
+export declare function createAutoLoginMiddleware(config: Readonly<PluginEnv>, cookie: Required<AuthCookieOptions>, token$: Observable<string>, logger: Pick<Logger, 'error'>, signal: AbortSignal): Connect.NextHandleFunction;
+//# sourceMappingURL=createAutoLoginMiddleware.d.ts.map

package/dist/middleware/createAutoLoginMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createAutoLoginMiddleware.d.ts","sourceRoot":"","sources":["../../src/middleware/createAutoLoginMiddleware.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AACtC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAE3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAIlE,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAC3B,MAAM,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EACnC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,kBAAkB,CA0C5B"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAMlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAGtD,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,gBAAqB,GAAG,MAAM,CAoCvE"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAOlC,OAAO,KAAK,EAAqB,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAGzE,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,gBAAqB,GAAG,MAAM,CAoDvE"}

package/dist/vite-plugin-api-auto-login.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("vite"),t=require("undici"),n=require("jose");var r=class{fields;constructor(e,t={}){if(this.fields={username:t.username??`username`,password:t.password??`password`},!this.fields.username.trim()||!this.fields.password.trim()||this.fields.username===this.fields.password)throw Error(`Form field names must be non-empty and distinct`);e&&this.validate(e)}create(e){let{username:n,password:r,loginUrl:i}=this.validate(e),a=new t.FormData;return a.set(this.fields.username,n),a.set(this.fields.password,r),{url:i,init:{method:`POST`,headers:{"User-Agent":e.userAgent},body:a}}}validate(e){let{loginUrl:t,username:n,password:r}=e;if(!t||!n||!r)throw Error(`Missing required env vars: API_AUTO_LOGIN_LOGIN_URL, API_AUTO_LOGIN_USERNAME, API_AUTO_LOGIN_PASSWORD`);return{loginUrl:t,username:n,password:r}}},i=`vite-plugin-api-auto-login`,a=class e{allowInsecureTls;cookieName;username;loginUrl;password;userAgent;static fromEnv(t){return new e(t)}constructor(e){this.allowInsecureTls=e.API_AUTO_LOGIN_ALLOW_INSECURE_TLS===`true`,this.cookieName=e.API_AUTO_LOGIN_COOKIE_NAME??`your_token_name`,this.username=e.API_AUTO_LOGIN_USERNAME,this.loginUrl=e.API_AUTO_LOGIN_LOGIN_URL,this.password=e.API_AUTO_LOGIN_PASSWORD,this.userAgent=e.API_AUTO_LOGIN_USER_AGENT??`vite`}},o=class{env;request;fetchImpl;dispatcher;cachedToken;pendingLogin;constructor(e,n={}){this.env=e,this.request=n.request??new r,this.fetchImpl=n.fetch??t.fetch,e.allowInsecureTls&&(this.dispatcher=n.createDispatcher?.()??new t.Agent({connect:{rejectUnauthorized:!1}}))}async getToken(){return this.cachedToken?.expiresAt!==void 0&&this.cachedToken.expiresAt>Date.now()?this.cachedToken.value:(this.pendingLogin??=this.requestToken().then(e=>(this.cachedToken=e,e.value)).finally(()=>{this.pendingLogin=void 0}),this.pendingLogin)}async requestToken(){let{url:e,init:t}=await this.request.create(this.env),n=await this.fetchImpl(e,{...t,dispatcher:this.dispatcher});if(!n.ok)throw Error(`Login request failed with status ${n.status}`);let r=await n.json();if(typeof r.token!=`string`||r.token.length===0)throw Error(`Login response did not include a token`);return{expiresAt:this.parseJwtExpiry(r.token),value:r.token}}parseJwtExpiry(e){try{let{exp:t}=(0,n.decodeJwt)(e);return typeof t==`number`?t*1e3:void 0}catch{return}}},s=class{response;constructor(e){this.response=e}setAuthCookie(e,t){let n=`${e}=${t}; Path=/; SameSite=Lax`,r=this.response.getHeader(`Set-Cookie`);if(!r){this.response.setHeader(`Set-Cookie`,n);return}let i;i=Array.isArray(r)?r:[String(r)],this.response.setHeader(`Set-Cookie`,[...i,n])}},c=`text/html`,l=class{static matches(e){return e.headers.upgrade?.toLowerCase()===`websocket`||e.method!==`GET`&&e.method!==`HEAD`?!1:e.headers.accept?.includes(c)??!1}},u=class{config;logger;request;session;constructor(e,t,n){this.config=e,this.logger=t,this.request=n}handle=async(e,t,n)=>{if(!l.matches(e))n();else{try{this.session??=new o(this.config,{request:this.request});let e=await this.session.getToken();new s(t).setAuthCookie(this.config.cookieName,e)}catch(e){let t=e instanceof Error?e.message:String(e),n=this.config.loginUrl?` (${this.config.loginUrl})`:``;this.logger.error(`[${i}] ${t}${n}`)}n()}}};function d(t={}){if(t.request!==void 0&&t.createAuthRequest!==void 0)throw Error(`Use either request or createAuthRequest, not both`);if(t.formFields!==void 0&&(t.request!==void 0||t.createAuthRequest!==void 0))throw Error(`Use formFields only with the default request strategy`);return{name:i,apply:`serve`,configureServer(n){let{mode:o,envDir:s,logger:c}=n.config;try{let i=a.fromEnv((0,e.loadEnv)(o,s,`API_AUTO_LOGIN_`)),l=t.request;if(t.createAuthRequest?l=t.createAuthRequest(i):l||=new r(i,t.formFields),!l||typeof l.create!=`function`)throw Error(`Token request must provide a create method`);let d=new u(i,c,l);n.middlewares.use(d.handle)}catch(e){c.error(`[${i}] ${e instanceof Error?e.message:String(e)}`)}}}}exports.FormDataAuthRequest=r,exports.PluginConfig=a,exports.viteAPIAutoLogin=d;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("cookie"),t=require("vite"),n=require("undici"),r=require("jose"),i=require("rxjs");function a(e,t={}){let r=t.username??`username`,i=t.password??`password`;if(!r.trim()||!i.trim()||r===i)throw Error(`Form field names must be non-empty and distinct`);return o(e),e=>{let{loginUrl:t,username:a,password:s}=o(e),c=new n.FormData;return c.set(r,a),c.set(i,s),{url:t,init:{method:`POST`,headers:{"User-Agent":e.userAgent},body:c}}}}function o(e){let{loginUrl:t,username:n,password:r}=e;if(!t||!n||!r)throw Error(`Missing required env vars: API_AUTO_LOGIN_LOGIN_URL, API_AUTO_LOGIN_USERNAME, API_AUTO_LOGIN_PASSWORD`);return{loginUrl:t,username:n,password:r}}function s(e,t={}){let r=t.request??a(e),o=t.fetch??n.fetch,s;return(0,i.defer)(()=>{if(t.signal?.aborted)return i.EMPTY;if(s?.expiresAt!==void 0&&s.expiresAt>Date.now())return(0,i.of)(s.value);let a=new AbortController,l;return e.allowInsecureTls&&(l=t.createDispatcher?.()??new n.Agent({connect:{rejectUnauthorized:!1}})),(0,i.defer)(()=>(0,i.from)(Promise.resolve(r(e)))).pipe((0,i.switchMap)(({url:e,init:n})=>{let r=[a.signal];return n.signal&&r.push(n.signal),t.signal&&r.push(t.signal),(0,i.from)(o(e,{...n,dispatcher:l,signal:AbortSignal.any(r)}))}),(0,i.switchMap)(e=>{if(!e.ok)throw Error(`Login request failed with status ${e.status}`);return(0,i.from)(e.json())}),(0,i.map)(c),(0,i.tap)(e=>{s=e}),(0,i.map)(e=>e.value),(0,i.takeUntil)(t.signal?(0,i.fromEvent)(t.signal,`abort`):i.EMPTY),(0,i.finalize)(()=>{a.abort(),l&&l.destroy().catch(()=>{})}))}).pipe((0,i.share)({connector:()=>new i.ReplaySubject(1),resetOnError:!0,resetOnComplete:!0,resetOnRefCountZero:!0}))}function c(e){if(!e||typeof e!=`object`||!(`token`in e)||typeof e.token!=`string`||e.token.length===0)throw Error(`Login response did not include a token`);let t=e.token;try{let{exp:e}=(0,r.decodeJwt)(t);return{value:t,expiresAt:typeof e==`number`?e*1e3:void 0}}catch{return{value:t}}}var l=`vite-plugin-api-auto-login`;function u(e){return Object.freeze({allowInsecureTls:e.API_AUTO_LOGIN_ALLOW_INSECURE_TLS===`true`,cookieName:e.API_AUTO_LOGIN_COOKIE_NAME??`your_token_name`,username:e.API_AUTO_LOGIN_USERNAME,loginUrl:e.API_AUTO_LOGIN_LOGIN_URL,password:e.API_AUTO_LOGIN_PASSWORD,userAgent:e.API_AUTO_LOGIN_USER_AGENT??`vite`})}function d(e){let t=e.method===`GET`||e.method===`HEAD`,n=e.headers.accept?.includes(`text/html`)??!1,r=e.headers.upgrade?.toLowerCase()===`websocket`;return t&&n&&!r}function f(t,n,r,a,o){return(s,c,u)=>{if(o.aborted||c.destroyed||c.writableEnded)return;let f=new i.Subscription,p=()=>f.unsubscribe(),m=()=>{o.aborted||c.destroyed||c.writableEnded||f.closed||u()};c.once(`close`,p),o.addEventListener(`abort`,p,{once:!0}),f.add(()=>{c.off(`close`,p),o.removeEventListener(`abort`,p)}),f.add((0,i.of)(s).pipe((0,i.filter)(d),(0,i.switchMap)(()=>r),(0,i.take)(1),(0,i.map)(r=>(0,e.stringifySetCookie)({...n,name:t.cookieName,value:r})),(0,i.tap)(e=>{c.headersSent||c.destroyed||c.writableEnded||c.appendHeader(`Set-Cookie`,e)})).subscribe({error:e=>{let n=e instanceof Error?e.message:String(e),r=t.loginUrl?` (${t.loginUrl})`:``;a.error(`[${l}] ${n}${r}`),m(),f.unsubscribe()},complete:()=>{m(),f.unsubscribe()}}))}}function p(n={}){if(`createAuthRequest`in n)throw Error(`createAuthRequest was removed; use request(config) instead`);if(n.request!==void 0&&typeof n.request!=`function`)throw Error(`request must be a function: request(config)`);if(n.formFields!==void 0&&n.request!==void 0)throw Error(`Use formFields only with the default request`);let r={path:n.cookie?.path??`/`,sameSite:n.cookie?.sameSite??`lax`,secure:n.cookie?.secure??!1,httpOnly:n.cookie?.httpOnly??!1};if(r.sameSite===`none`&&!r.secure)throw Error(`cookie.sameSite "none" requires cookie.secure to be true`);(0,e.stringifySetCookie)({...r,name:`validation`,value:``});let i=new Set;return{name:l,apply:`serve`,configureServer(o){let{mode:c,envDir:d,logger:p}=o.config;try{let l=u((0,t.loadEnv)(c,d,`API_AUTO_LOGIN_`));(0,e.stringifySetCookie)({...r,name:l.cookieName,value:``});let m=n.request??a(l,n.formFields),h=new AbortController,g=()=>{h.abort(),o.httpServer?.off(`close`,g),i.delete(g)};i.add(g),o.httpServer?.once(`close`,g);let _=s(l,{request:m,signal:h.signal});o.middlewares.use(f(l,r,_,p,h.signal))}catch(e){p.error(`[${l}] ${e instanceof Error?e.message:String(e)}`)}},closeBundle(){for(let e of i)e()}}}exports.createFormDataRequest=a,exports.loadPluginConfig=u,exports.viteAPIAutoLogin=p;

package/dist/vite-plugin-api-auto-login.js

@@ -1,144 +1,164 @@
-import { loadEnv as e } from "vite";
-import { Agent as t, FormData as n, fetch as r } from "undici";
-import { decodeJwt as i } from "jose";
-// src/auth/FormDataAuthRequest.ts
-var a = class {
-	fields;
-	constructor(e, t = {}) {
-		if (this.fields = {
-			username: t.username ?? "username",
-			password: t.password ?? "password"
-		}, !this.fields.username.trim() || !this.fields.password.trim() || this.fields.username === this.fields.password) throw Error("Form field names must be non-empty and distinct");
-		e && this.validate(e);
-	}
-	create(e) {
-		let { username: t, password: r, loginUrl: i } = this.validate(e), a = new n();
-		return a.set(this.fields.username, t), a.set(this.fields.password, r), {
-			url: i,
+import { stringifySetCookie as e } from "cookie";
+import { loadEnv as t } from "vite";
+import { Agent as n, FormData as r, fetch as i } from "undici";
+import { decodeJwt as a } from "jose";
+import { EMPTY as o, ReplaySubject as s, Subscription as c, defer as l, filter as u, finalize as d, from as f, fromEvent as p, map as m, of as h, share as g, switchMap as _, take as v, takeUntil as y, tap as b } from "rxjs";
+// src/auth/createFormDataRequest.ts
+function x(e, t = {}) {
+	let n = t.username ?? "username", i = t.password ?? "password";
+	if (!n.trim() || !i.trim() || n === i) throw Error("Form field names must be non-empty and distinct");
+	return S(e), (e) => {
+		let { loginUrl: t, username: a, password: o } = S(e), s = new r();
+		return s.set(n, a), s.set(i, o), {
+			url: t,
 			init: {
 				method: "POST",
 				headers: { "User-Agent": e.userAgent },
-				body: a
+				body: s
 			}
 		};
-	}
-	validate(e) {
-		let { loginUrl: t, username: n, password: r } = e;
-		if (!t || !n || !r) throw Error("Missing required env vars: API_AUTO_LOGIN_LOGIN_URL, API_AUTO_LOGIN_USERNAME, API_AUTO_LOGIN_PASSWORD");
+	};
+}
+function S(e) {
+	let { loginUrl: t, username: n, password: r } = e;
+	if (!t || !n || !r) throw Error("Missing required env vars: API_AUTO_LOGIN_LOGIN_URL, API_AUTO_LOGIN_USERNAME, API_AUTO_LOGIN_PASSWORD");
+	return {
+		loginUrl: t,
+		username: n,
+		password: r
+	};
+}
+// src/auth/createTokenStream.ts
+function C(e, t = {}) {
+	let r = t.request ?? x(e), a = t.fetch ?? i, c;
+	return l(() => {
+		if (t.signal?.aborted) return o;
+		if (c?.expiresAt !== void 0 && c.expiresAt > Date.now()) return h(c.value);
+		let i = new AbortController(), s;
+		return e.allowInsecureTls && (s = t.createDispatcher?.() ?? new n({ connect: { rejectUnauthorized: !1 } })), l(() => f(Promise.resolve(r(e)))).pipe(_(({ url: e, init: n }) => {
+			let r = [i.signal];
+			return n.signal && r.push(n.signal), t.signal && r.push(t.signal), f(a(e, {
+				...n,
+				dispatcher: s,
+				signal: AbortSignal.any(r)
+			}));
+		}), _((e) => {
+			if (!e.ok) throw Error(`Login request failed with status ${e.status}`);
+			return f(e.json());
+		}), m(w), b((e) => {
+			c = e;
+		}), m((e) => e.value), y(t.signal ? p(t.signal, "abort") : o), d(() => {
+			i.abort(), s && s.destroy().catch(() => {});
+		}));
+	}).pipe(g({
+		connector: () => new s(1),
+		resetOnError: !0,
+		resetOnComplete: !0,
+		resetOnRefCountZero: !0
+	}));
+}
+function w(e) {
+	if (!e || typeof e != "object" || !("token" in e) || typeof e.token != "string" || e.token.length === 0) throw Error("Login response did not include a token");
+	let t = e.token;
+	try {
+		let { exp: e } = a(t);
 		return {
-			loginUrl: t,
-			username: n,
-			password: r
+			value: t,
+			expiresAt: typeof e == "number" ? e * 1e3 : void 0
 		};
+	} catch {
+		return { value: t };
 	}
-}, o = "vite-plugin-api-auto-login", s = class e {
-	allowInsecureTls;
-	cookieName;
-	username;
-	loginUrl;
-	password;
-	userAgent;
-	static fromEnv(t) {
-		return new e(t);
-	}
-	constructor(e) {
-		this.allowInsecureTls = e.API_AUTO_LOGIN_ALLOW_INSECURE_TLS === "true", this.cookieName = e.API_AUTO_LOGIN_COOKIE_NAME ?? "your_token_name", this.username = e.API_AUTO_LOGIN_USERNAME, this.loginUrl = e.API_AUTO_LOGIN_LOGIN_URL, this.password = e.API_AUTO_LOGIN_PASSWORD, this.userAgent = e.API_AUTO_LOGIN_USER_AGENT ?? "vite";
-	}
-}, c = class {
-	env;
-	request;
-	fetchImpl;
-	dispatcher;
-	cachedToken;
-	pendingLogin;
-	constructor(e, n = {}) {
-		this.env = e, this.request = n.request ?? new a(), this.fetchImpl = n.fetch ?? r, e.allowInsecureTls && (this.dispatcher = n.createDispatcher?.() ?? new t({ connect: { rejectUnauthorized: !1 } }));
-	}
-	async getToken() {
-		return this.cachedToken?.expiresAt !== void 0 && this.cachedToken.expiresAt > Date.now() ? this.cachedToken.value : (this.pendingLogin ??= this.requestToken().then((e) => (this.cachedToken = e, e.value)).finally(() => {
-			this.pendingLogin = void 0;
-		}), this.pendingLogin);
-	}
-	async requestToken() {
-		let { url: e, init: t } = await this.request.create(this.env), n = await this.fetchImpl(e, {
-			...t,
-			dispatcher: this.dispatcher
-		});
-		if (!n.ok) throw Error(`Login request failed with status ${n.status}`);
-		let r = await n.json();
-		if (typeof r.token != "string" || r.token.length === 0) throw Error("Login response did not include a token");
-		return {
-			expiresAt: this.parseJwtExpiry(r.token),
-			value: r.token
+}
+// src/constants.ts
+var T = "vite-plugin-api-auto-login";
+function E(e) {
+	return Object.freeze({
+		allowInsecureTls: e.API_AUTO_LOGIN_ALLOW_INSECURE_TLS === "true",
+		cookieName: e.API_AUTO_LOGIN_COOKIE_NAME ?? "your_token_name",
+		username: e.API_AUTO_LOGIN_USERNAME,
+		loginUrl: e.API_AUTO_LOGIN_LOGIN_URL,
+		password: e.API_AUTO_LOGIN_PASSWORD,
+		userAgent: e.API_AUTO_LOGIN_USER_AGENT ?? "vite"
+	});
+}
+// src/http/isHtmlDocumentRequest.ts
+function D(e) {
+	let t = e.method === "GET" || e.method === "HEAD", n = e.headers.accept?.includes("text/html") ?? !1, r = e.headers.upgrade?.toLowerCase() === "websocket";
+	return t && n && !r;
+}
+// src/middleware/createAutoLoginMiddleware.ts
+function O(t, n, r, i, a) {
+	return (o, s, l) => {
+		if (a.aborted || s.destroyed || s.writableEnded) return;
+		let d = new c(), f = () => d.unsubscribe(), p = () => {
+			a.aborted || s.destroyed || s.writableEnded || d.closed || l();
 		};
-	}
-	parseJwtExpiry(e) {
-		try {
-			let { exp: t } = i(e);
-			return typeof t == "number" ? t * 1e3 : void 0;
-		} catch {
-			return;
-		}
-	}
-}, l = class {
-	response;
-	constructor(e) {
-		this.response = e;
-	}
-	setAuthCookie(e, t) {
-		let n = `${e}=${t}; Path=/; SameSite=Lax`, r = this.response.getHeader("Set-Cookie");
-		if (!r) {
-			this.response.setHeader("Set-Cookie", n);
-			return;
-		}
-		let i;
-		i = Array.isArray(r) ? r : [String(r)], this.response.setHeader("Set-Cookie", [...i, n]);
-	}
-}, u = "text/html", d = class {
-	static matches(e) {
-		return e.headers.upgrade?.toLowerCase() === "websocket" || e.method !== "GET" && e.method !== "HEAD" ? !1 : e.headers.accept?.includes(u) ?? !1;
-	}
-}, f = class {
-	config;
-	logger;
-	request;
-	session;
-	constructor(e, t, n) {
-		this.config = e, this.logger = t, this.request = n;
-	}
-	handle = async (e, t, n) => {
-		if (!d.matches(e)) n();
-		else {
-			try {
-				this.session ??= new c(this.config, { request: this.request });
-				let e = await this.session.getToken();
-				new l(t).setAuthCookie(this.config.cookieName, e);
-			} catch (e) {
-				let t = e instanceof Error ? e.message : String(e), n = this.config.loginUrl ? ` (${this.config.loginUrl})` : "";
-				this.logger.error(`[${o}] ${t}${n}`);
+		s.once("close", f), a.addEventListener("abort", f, { once: !0 }), d.add(() => {
+			s.off("close", f), a.removeEventListener("abort", f);
+		}), d.add(h(o).pipe(u(D), _(() => r), v(1), m((r) => e({
+			...n,
+			name: t.cookieName,
+			value: r
+		})), b((e) => {
+			s.headersSent || s.destroyed || s.writableEnded || s.appendHeader("Set-Cookie", e);
+		})).subscribe({
+			error: (e) => {
+				let n = e instanceof Error ? e.message : String(e), r = t.loginUrl ? ` (${t.loginUrl})` : "";
+				i.error(`[${T}] ${n}${r}`), p(), d.unsubscribe();
+			},
+			complete: () => {
+				p(), d.unsubscribe();
 			}
-			n();
-		}
+		}));
 	};
-};
+}
 // src/plugin.ts
-function p(t = {}) {
-	if (t.request !== void 0 && t.createAuthRequest !== void 0) throw Error("Use either request or createAuthRequest, not both");
-	if (t.formFields !== void 0 && (t.request !== void 0 || t.createAuthRequest !== void 0)) throw Error("Use formFields only with the default request strategy");
+function k(n = {}) {
+	if ("createAuthRequest" in n) throw Error("createAuthRequest was removed; use request(config) instead");
+	if (n.request !== void 0 && typeof n.request != "function") throw Error("request must be a function: request(config)");
+	if (n.formFields !== void 0 && n.request !== void 0) throw Error("Use formFields only with the default request");
+	let r = {
+		path: n.cookie?.path ?? "/",
+		sameSite: n.cookie?.sameSite ?? "lax",
+		secure: n.cookie?.secure ?? !1,
+		httpOnly: n.cookie?.httpOnly ?? !1
+	};
+	if (r.sameSite === "none" && !r.secure) throw Error("cookie.sameSite \"none\" requires cookie.secure to be true");
+	e({
+		...r,
+		name: "validation",
+		value: ""
+	});
+	let i = /* @__PURE__ */ new Set();
 	return {
-		name: o,
+		name: T,
 		apply: "serve",
-		configureServer(n) {
-			let { mode: r, envDir: i, logger: c } = n.config;
+		configureServer(a) {
+			let { mode: o, envDir: s, logger: c } = a.config;
 			try {
-				let o = s.fromEnv(e(r, i, "API_AUTO_LOGIN_")), l = t.request;
-				if (t.createAuthRequest ? l = t.createAuthRequest(o) : l ||= new a(o, t.formFields), !l || typeof l.create != "function") throw Error("Token request must provide a create method");
-				let u = new f(o, c, l);
-				n.middlewares.use(u.handle);
+				let l = E(t(o, s, "API_AUTO_LOGIN_"));
+				e({
+					...r,
+					name: l.cookieName,
+					value: ""
+				});
+				let u = n.request ?? x(l, n.formFields), d = new AbortController(), f = () => {
+					d.abort(), a.httpServer?.off("close", f), i.delete(f);
+				};
+				i.add(f), a.httpServer?.once("close", f);
+				let p = C(l, {
+					request: u,
+					signal: d.signal
+				});
+				a.middlewares.use(O(l, r, p, c, d.signal));
 			} catch (e) {
-				c.error(`[${o}] ${e instanceof Error ? e.message : String(e)}`);
+				c.error(`[${T}] ${e instanceof Error ? e.message : String(e)}`);
 			}
+		},
+		closeBundle() {
+			for (let e of i) e();
 		}
 	};
 }
-export { a as FormDataAuthRequest, s as PluginConfig, p as viteAPIAutoLogin };
+export { x as createFormDataRequest, E as loadPluginConfig, k as viteAPIAutoLogin };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corespec/vite-plugin-api-auto-login",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Reusable Vite plugin for API auto login during local development",
   "type": "module",
   "main": "./dist/vite-plugin-api-auto-login.cjs",
@@ -68,7 +68,9 @@
     "vue-tsc": "^3.3.14"
   },
   "dependencies": {
+    "cookie": "^2.0.2",
     "jose": "^6.2.15",
+    "rxjs": "^7.8.2",
     "undici": "^8.12.3"
   },
   "peerDependencies": {

package/dist/auth/AuthSession.d.ts

@@ -1,24 +0,0 @@
-import { fetch as undiciFetch } from 'undici';
-import type { Dispatcher } from 'undici';
-import type { PluginEnv } from '../config/types.js';
-import type { AuthRequest } from './AuthRequest.js';
-type FetchLike = typeof undiciFetch;
-type AuthSessionDependencies = {
-    request?: AuthRequest;
-    createDispatcher?: () => Dispatcher;
-    fetch?: FetchLike;
-};
-export declare class AuthSession {
-    private readonly env;
-    private readonly request;
-    private readonly fetchImpl;
-    private readonly dispatcher;
-    private cachedToken;
-    private pendingLogin;
-    constructor(env: PluginEnv, dependencies?: AuthSessionDependencies);
-    getToken(): Promise<string>;
-    private requestToken;
-    private parseJwtExpiry;
-}
-export {};
-//# sourceMappingURL=AuthSession.d.ts.map

package/dist/auth/AuthSession.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"AuthSession.d.ts","sourceRoot":"","sources":["../../src/auth/AuthSession.ts"],"names":[],"mappings":"AACA,OAAO,EAAS,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAA;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAExC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAOrD,KAAK,SAAS,GAAG,OAAO,WAAW,CAAA;AAEnC,KAAK,uBAAuB,GAAG;IAC7B,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,gBAAgB,CAAC,EAAE,MAAM,UAAU,CAAA;IACnC,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB,CAAA;AAED,qBAAa,WAAW;IAQpB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAPtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAW;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAwB;IACnD,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,YAAY,CAA6B;gBAG9B,GAAG,EAAE,SAAS,EAC/B,YAAY,GAAE,uBAA4B;IAUtC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;YAiBnB,YAAY;IAuB1B,OAAO,CAAC,cAAc;CASvB"}

package/dist/auth/FormDataAuthRequest.d.ts

@@ -1,9 +0,0 @@
-import type { FormFieldNames, PluginEnv } from '../config/types.js';
-import type { AuthRequest, AuthRequestOptions } from './AuthRequest.js';
-export declare class FormDataAuthRequest implements AuthRequest {
-    private readonly fields;
-    constructor(config?: Readonly<PluginEnv>, fields?: Readonly<FormFieldNames>);
-    create(config: Readonly<PluginEnv>): AuthRequestOptions;
-    private validate;
-}
-//# sourceMappingURL=FormDataAuthRequest.d.ts.map

package/dist/auth/FormDataAuthRequest.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"FormDataAuthRequest.d.ts","sourceRoot":"","sources":["../../src/auth/FormDataAuthRequest.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAEzE,qBAAa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;gBAErC,MAAM,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAE,QAAQ,CAAC,cAAc,CAAM;IAkB/E,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,kBAAkB;IAgBvD,OAAO,CAAC,QAAQ;CASjB"}

package/dist/config/PluginConfig.d.ts

@@ -1,14 +0,0 @@
-import type { PluginEnv, PluginEnvInput } from './types.js';
-export declare const DEFAULT_COOKIE_NAME = "your_token_name";
-export declare const DEFAULT_USER_AGENT = "vite";
-export declare class PluginConfig implements PluginEnv {
-    readonly allowInsecureTls: boolean;
-    readonly cookieName: string;
-    readonly username: string | undefined;
-    readonly loginUrl: string | undefined;
-    readonly password: string | undefined;
-    readonly userAgent: string;
-    static fromEnv(env: PluginEnvInput): PluginConfig;
-    private constructor();
-}
-//# sourceMappingURL=PluginConfig.d.ts.map

package/dist/config/PluginConfig.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"PluginConfig.d.ts","sourceRoot":"","sources":["../../src/config/PluginConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAE/D,eAAO,MAAM,mBAAmB,oBAAoB,CAAA;AACpD,eAAO,MAAM,kBAAkB,SAAS,CAAA;AAExC,qBAAa,YAAa,YAAW,SAAS;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAE1B,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,YAAY;IAIjD,OAAO;CAQR"}

package/dist/http/AuthResponse.d.ts

@@ -1,7 +0,0 @@
-import type { ServerResponse } from 'node:http';
-export declare class AuthResponse {
-    private readonly response;
-    constructor(response: ServerResponse);
-    setAuthCookie(cookieName: string, token: string): void;
-}
-//# sourceMappingURL=AuthResponse.d.ts.map

package/dist/http/AuthResponse.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"AuthResponse.d.ts","sourceRoot":"","sources":["../../src/http/AuthResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE/C,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,cAAc;IAErD,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;CAkBvD"}

package/dist/http/HtmlDocumentRequest.d.ts

@@ -1,5 +0,0 @@
-import type { IncomingMessage } from 'node:http';
-export declare class HtmlDocumentRequest {
-    static matches(req: IncomingMessage): boolean;
-}
-//# sourceMappingURL=HtmlDocumentRequest.d.ts.map

package/dist/http/HtmlDocumentRequest.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"HtmlDocumentRequest.d.ts","sourceRoot":"","sources":["../../src/http/HtmlDocumentRequest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAIhD,qBAAa,mBAAmB;IAC9B,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO;CAW9C"}

package/dist/middleware/AutoLoginMiddleware.d.ts

@@ -1,12 +0,0 @@
-import type { Connect, Logger } from 'vite';
-import type { AuthRequest } from '../auth/AuthRequest.js';
-import type { PluginEnv } from '../config/types.js';
-export declare class AutoLoginMiddleware {
-    private readonly config;
-    private readonly logger;
-    private readonly request;
-    private session;
-    constructor(config: PluginEnv, logger: Pick<Logger, 'error'>, request: AuthRequest);
-    readonly handle: Connect.NextHandleFunction;
-}
-//# sourceMappingURL=AutoLoginMiddleware.d.ts.map

package/dist/middleware/AutoLoginMiddleware.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"AutoLoginMiddleware.d.ts","sourceRoot":"","sources":["../../src/middleware/AutoLoginMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAG3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAK/C,qBAAa,mBAAmB;IAI5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,OAAO,CAAyB;gBAGrB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,WAAW;IAGvC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAiB1C;CACF"}