@fluixi/auth 1.0.0-alpha.83 → 1.0.0-alpha.85

package/dist/client.cjs

@@ -1 +1,136 @@
-"use strict";var f=Object.defineProperty;var b=Object.getOwnPropertyDescriptor;var y=Object.getOwnPropertyNames;var x=Object.prototype.hasOwnProperty;var O=(s,n)=>{for(var r in n)f(s,r,{get:n[r],enumerable:!0})},Q=(s,n,r,u)=>{if(n&&typeof n=="object"||typeof n=="function")for(let t of y(n))!x.call(s,t)&&t!==r&&f(s,t,{get:()=>n[t],enumerable:!(u=b(n,t))||u.enumerable});return s};var v=s=>Q(f({},"__esModule",{value:!0}),s);var L={};O(L,{createAuthHooks:()=>D});module.exports=v(L);var o=require("@fluixi/core"),k=require("@fluixi/dom");var h="auth";function D(s){let n=s.session,r=(0,o.createIsomorphicStore)("auth",{server:()=>(0,k.getLocals)()[h]??{user:null,session:null},client:async()=>n?{user:n.user(),session:null}:P(await s.client.getSession()),fallback:{user:null,session:null}});if(n){let e=()=>r.set({user:n.user(),session:null});e(),(0,o.createRoot)(()=>(0,o.createEffect)(e))}let u=async()=>{r.set(n?{user:n.user(),session:null}:P(await s.client.getSession()))},t=n?((...e)=>n.login?.(...e)??Promise.resolve()):async e=>{await s.client.signIn.email(e),await u()},g=n?()=>n.logout?.()??Promise.resolve():async()=>{await s.client.signOut(),r.set({user:null,session:null})},a=e=>(s.navigate??(i=>o.env.window?.location.assign(i)))(e),p=()=>n?.permissions?.(),l=e=>n?.can?.(e)??!1,c=()=>{if(n?.roles)return n.roles();let e=r.fields.user()?.role;return e?[e]:[]},d=e=>!(e?.role&&!c().includes(e.role)||e?.roles&&!e.roles.some(i=>c().includes(i))||e?.permission!==void 0&&!l(e.permission));function w(e){return()=>l(e.perform)?e.children:e.fallback??null}function U(e){return()=>r.fields.user()&&d(e)?e.children:e.fallback??null}function A(e,i){return S=>{let m=r.fields.user();if(i?.guestOnly){if(m)return a(s.homePath??"/"),null}else{if(!m)return a(s.loginPath??"/login"),null;if(!d(i))return a(s.forbiddenPath??"/403"),null}return e(S)}}return{useUser:()=>r.fields.user,useSession:()=>r.fields.session,useAuth:()=>({user:r.fields.user,session:r.fields.session,isAuthenticated:()=>r.fields.user()!==null,roles:c,can:l,signIn:t,signOut:g}),useSignIn:()=>t,useSignOut:()=>g,usePermissions:()=>p,useCan:()=>l,Can:w,Protect:U,refresh:u,protectedRoute:A,store:r}}function P(s){return{user:s.data?.user??null,session:s.data?.session??null}}
+/*! @fluixi/auth v1.0.0-alpha.85 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client.ts
+var client_exports = {};
+__export(client_exports, {
+  createAuthHooks: () => createAuthHooks
+});
+module.exports = __toCommonJS(client_exports);
+var import_core = require("@fluixi/core");
+var import_dom = require("@fluixi/dom");
+
+// src/types.ts
+var AUTH_LOCALS_KEY = "auth";
+
+// src/client.ts
+function createAuthHooks(options) {
+  const sess = options.session;
+  const store = (0, import_core.createIsomorphicStore)("auth", {
+    // Server: read what authMiddleware put on locals → serialized for the client to seed.
+    server: () => (0, import_dom.getLocals)()[AUTH_LOCALS_KEY] ?? { user: null, session: null },
+    // SPA cold load: from the provided session, else the Better Auth client.
+    client: async () => sess ? { user: sess.user(), session: null } : normalize(await options.client.getSession()),
+    fallback: { user: null, session: null }
+  });
+  if (sess) {
+    const apply = () => store.set({ user: sess.user(), session: null });
+    apply();
+    (0, import_core.createRoot)(() => (0, import_core.createEffect)(apply));
+  }
+  const refresh = async () => {
+    store.set(sess ? { user: sess.user(), session: null } : normalize(await options.client.getSession()));
+  };
+  const signIn = sess ? ((...args) => sess.login?.(...args) ?? Promise.resolve()) : async (creds) => {
+    await options.client.signIn.email(creds);
+    await refresh();
+  };
+  const signOut = sess ? () => sess.logout?.() ?? Promise.resolve() : async () => {
+    await options.client.signOut();
+    store.set({ user: null, session: null });
+  };
+  const go = (to, opts) => {
+    const fromRoute = typeof opts?.handler === "function" ? opts.handler() : void 0;
+    const fromHooks = typeof options.navigate === "function" ? options.navigate : typeof options.navigate?.handler === "function" ? (
+      // Called, not passed along. Handing back the factory made `fn(to)` build a
+      // navigate function and return it, so the redirect silently did nothing.
+      options.navigate.handler()
+    ) : void 0;
+    const fn = fromRoute ?? fromHooks;
+    if (fn) {
+      const navigateOptions = opts?.options ?? (typeof options.navigate === "object" ? options.navigate?.options : void 0);
+      if (navigateOptions) fn(to, navigateOptions);
+      else fn(to);
+      return;
+    }
+    import_core.env.window?.location.assign(to);
+  };
+  const permissions = () => sess?.permissions?.();
+  const can = (query) => sess?.can?.(query) ?? false;
+  const roleList = () => {
+    if (sess?.roles) return sess.roles();
+    const r = store.fields.user()?.role;
+    return r ? [r] : [];
+  };
+  const passesRole = (opts) => {
+    if (opts?.role && !roleList().includes(opts.role)) return false;
+    if (opts?.roles && !opts.roles.some((r) => roleList().includes(r))) return false;
+    if (opts?.permission !== void 0 && !can(opts.permission)) return false;
+    return true;
+  };
+  function Can(props) {
+    return () => can(props.perform) ? props.children : props.fallback ?? null;
+  }
+  function Protect(props) {
+    return () => {
+      if (!store.fields.user()) return props.fallback ?? null;
+      return passesRole(props) ? props.children : props.fallback ?? null;
+    };
+  }
+  function protectedRoute(Comp, opts) {
+    return (props) => {
+      const user = store.fields.user();
+      if (opts?.guestOnly) {
+        if (user) return go(options.homePath ?? "/", opts?.navigator), null;
+      } else {
+        if (!user) return go(options.loginPath ?? "/login", opts?.navigator), null;
+        if (!passesRole(opts)) return go(options.forbiddenPath ?? "/403"), null;
+      }
+      return Comp(props);
+    };
+  }
+  return {
+    useUser: () => store.fields.user,
+    useSession: () => store.fields.session,
+    useAuth: () => ({
+      user: store.fields.user,
+      session: store.fields.session,
+      isAuthenticated: () => store.fields.user() !== null,
+      roles: roleList,
+      can,
+      signIn,
+      signOut
+    }),
+    useSignIn: () => signIn,
+    useSignOut: () => signOut,
+    /** Reactive accessor for the active permission set (UI affordance only). */
+    usePermissions: () => permissions,
+    /** Returns `can(check)`: `false` unless the session provides RBAC. */
+    useCan: () => can,
+    Can,
+    Protect,
+    refresh,
+    protectedRoute,
+    store
+  };
+}
+function normalize(r) {
+  return { user: r.data?.user ?? null, session: r.data?.session ?? null };
+}

package/dist/client.d.ts

@@ -5,12 +5,13 @@ export interface ProtectedRouteOptions<Q = (p: any) => boolean> {
     role?: string;
     /** Require ANY of these roles. */
     roles?: string[];
-    /** Require a permission — your access matcher's query (default: a predicate). */
+    /** Require a permission: your access matcher's query (default: a predicate). */
     permission?: Q;
+    navigator?: Partial<Navigator>;
 }
 /**
  * Any reactive session with a `user` accessor (e.g. @fluixi/session's createSession).
- * The RBAC accessors (`roles` / `permissions` / `can`) are optional — provide them (as
+ * The RBAC accessors (`roles` / `permissions` / `can`) are optional, provide them (as
  * createSession's `access` config does) to unlock `<Can>`, `usePermissions`, and
  * permission-gated routes. They are a UI affordance only; the server enforces authz.
  */
@@ -22,13 +23,24 @@ export interface SessionLike<U = AuthUser, P = unknown, Q = (p: P) => boolean> {
     permissions?: () => P | undefined;
     can?: (query: Q) => boolean;
 }
+export interface NavigateOptions {
+    /** Replace the current history entry instead of pushing a new one. */
+    replace?: boolean;
+    /** Opaque history state to attach. */
+    state?: unknown;
+    transition?: unknown;
+}
+export interface Navigator {
+    handler: () => (to: string, opts?: any) => void;
+    options?: NavigateOptions;
+}
 export interface AuthHooksOptions<U = AuthUser, P = unknown, Q = (p: P) => boolean> {
     /** A Better Auth client (`createAuthClient(...)`). Mutually exclusive with `session`. */
     client?: BetterAuthClient;
-    /** An existing reactive session — the framework syncs it into the hooks for you. */
+    /** An existing reactive session: the framework syncs it into the hooks for you. */
     session?: SessionLike<U, P, Q>;
     /** Navigate for `protectedRoute` redirects (default: `window.location.assign`). */
-    navigate?: (to: string) => void;
+    navigate?: ((to: string, opts?: NavigateOptions) => void) | Navigator;
     loginPath?: string;
     homePath?: string;
     forbiddenPath?: string;
@@ -57,7 +69,7 @@ export declare function createAuthHooks<U = AuthUser, P = unknown, Q = (p: P) =>
     useSignOut: () => () => Promise<unknown>;
     /** Reactive accessor for the active permission set (UI affordance only). */
     usePermissions: () => () => P | undefined;
-    /** Returns `can(check)` — `false` unless the session provides RBAC. */
+    /** Returns `can(check)`: `false` unless the session provides RBAC. */
     useCan: () => (query: Q) => boolean;
     Can: (props: {
         perform: Q;

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAeA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,KAAK,OAAO;IAC5D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+BAA+B;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,iFAAiF;IACjF,UAAU,CAAC,EAAE,CAAC,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO;IAC3E,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAClC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO;IAChF,yFAAyF;IACzF,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,mFAAmF;IACnF,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,eAAe,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO,EAC9E,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;;;;;;;qBA6Cb,MAAM,EAAE;qBADT,CAAC,KAAG,OAAO;2BAjBhB,GAAG,EAAE,kCACF;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE;;;gCAD5D,GAAG,EAAE,kCACF;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE;;IA2EzE,4EAA4E;gCA5DtD,CAAC,GAAG,SAAS;IA8DnC,uEAAuE;0BA7DrD,CAAC,KAAG,OAAO;iBAcX;QAAE,OAAO,EAAE,CAAC,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE;qBAKjD;QACtB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,UAAU,CAAC,EAAE,CAAC,CAAC;QACf,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC;KACnB;mBA/CyB,OAAO,CAAC,IAAI,CAAC;qBAsDf,KAAK,QAAQ,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,SAAS,qBAAqB,CAAC,CAAC,CAAC,MACrF,OAAO,KAAK;;EAoCvB;AAMD,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAeA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAGpB,MAAM,WAAW,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,KAAK,OAAO;IAC5D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+BAA+B;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gFAAgF;IAChF,UAAU,CAAC,EAAE,CAAC,CAAC;IAEf,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO;IAC3E,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAClC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,sCAAsC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AACD,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO;IAChF,yFAAyF;IACzF,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,mFAAmF;IACnF,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,mFAAmF;IACnF,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,eAAe,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,eAAe,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO,EAC9E,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;;;;;;;qBAkFb,MAAM,EAAE;qBADT,CAAC,KAAG,OAAO;2BAtDhB,GAAG,EAAE,kCACF;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE;;;gCAD5D,GAAG,EAAE,kCACF;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE;;IAgHzE,4EAA4E;gCA5DtD,CAAC,GAAG,SAAS;IA8DnC,sEAAsE;0BA7DpD,CAAC,KAAG,OAAO;iBAcX;QAAE,OAAO,EAAE,CAAC,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE;qBAKjD;QACtB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,UAAU,CAAC,EAAE,CAAC,CAAC;QACf,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC;KACnB;mBApFyB,OAAO,CAAC,IAAI,CAAC;qBA2Ff,KAAK,QAAQ,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,SAAS,qBAAqB,CAAC,CAAC,CAAC,MACrF,OAAO,KAAK;;EAoCvB;AAMD,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/dist/client.js

@@ -1,15 +1,15 @@
 /**
- * @fluixi/auth/client — the reactive client hooks.
+ * @fluixi/auth/client: the reactive client hooks.
  *
  * The session is an isomorphic store: resolved on the server from `locals.auth`
  * (serialized into the page) and seeded synchronously on the client → no auth flash, no
  * post-hydration refetch. Two ways to drive it:
- *   • `{ client }` — a Better Auth client.
- *   • `{ session }` — an existing reactive session (e.g. @fluixi/session's createSession or
+ *   • `{ client }`: a Better Auth client.
+ *   • `{ session }`: an existing reactive session (e.g. @fluixi/session's createSession or
  *     any `{ user(), login?, logout? }`). The framework OWNS the reactive sync, so apps stop
  *     hand-writing a `createEffect` to mirror their store into the auth hooks.
  *
- * Client-only deps: fluixi + @fluixi/dom's pure `getLocals` — never @fluixi/server.
+ * Client-only deps: fluixi + @fluixi/dom's pure `getLocals`, never @fluixi/server.
  */
 import { createIsomorphicStore, createEffect, createRoot, env } from '@fluixi/core';
 import { getLocals } from '@fluixi/dom';
@@ -46,7 +46,42 @@ export function createAuthHooks(options) {
             await options.client.signOut();
             store.set({ user: null, session: null });
         };
-    const go = (to) => (options.navigate ?? ((t) => env.window?.location.assign(t)))(to);
+    /**
+     * Send the visitor somewhere else.
+     *
+     * The route's own `navigator` wins, then the one given to `createAuthHooks`, then a
+     * document load. A handler is a factory rather than a function: `useNavigate` has to
+     * run inside the component being rendered, so it is called here, at the redirect,
+     * instead of when the hooks were built.
+     *
+     * Without a handler this assigns `location`, which loads a document and rebuilds the
+     * whole app. That is right for an app with no client router and wrong for one that
+     * has it, which is what the option exists to fix.
+     */
+    const go = (to, opts) => {
+        const fromRoute = typeof opts?.handler === 'function' ? opts.handler() : undefined;
+        const fromHooks = typeof options.navigate === 'function'
+            ? options.navigate
+            : typeof options.navigate?.handler === 'function'
+                ? // Called, not passed along. Handing back the factory made `fn(to)` build a
+                    // navigate function and return it, so the redirect silently did nothing.
+                    options.navigate.handler()
+                : undefined;
+        const fn = fromRoute ?? fromHooks;
+        if (fn) {
+            const navigateOptions = opts?.options ??
+                (typeof options.navigate === 'object' ? options.navigate?.options : undefined);
+            // Only when there are some. Deciding on the handler's arity instead dropped them
+            // for anything declaring the parameter optional, which `useNavigate` does; passing
+            // `undefined` regardless would change the call every handler sees.
+            if (navigateOptions)
+                fn(to, navigateOptions);
+            else
+                fn(to);
+            return;
+        }
+        env.window?.location.assign(to);
+    };
     // ── RBAC surface (driven by the bound session's access config) ────────────────
     const permissions = () => sess?.permissions?.();
     const can = (query) => sess?.can?.(query) ?? false;
@@ -82,11 +117,11 @@ export function createAuthHooks(options) {
             const user = store.fields.user();
             if (opts?.guestOnly) {
                 if (user)
-                    return go(options.homePath ?? '/'), null;
+                    return go(options.homePath ?? '/', opts?.navigator), null;
             }
             else {
                 if (!user)
-                    return go(options.loginPath ?? '/login'), null;
+                    return go(options.loginPath ?? '/login', opts?.navigator), null;
                 if (!passesRole(opts))
                     return go(options.forbiddenPath ?? '/403'), null;
             }
@@ -109,7 +144,7 @@ export function createAuthHooks(options) {
         useSignOut: () => signOut,
         /** Reactive accessor for the active permission set (UI affordance only). */
         usePermissions: () => permissions,
-        /** Returns `can(check)` — `false` unless the session provides RBAC. */
+        /** Returns `can(check)`: `false` unless the session provides RBAC. */
         useCan: () => can,
         Can,
         Protect,

package/dist/client.mjs

@@ -1 +1,116 @@
-import{createIsomorphicStore as U,createEffect as A,createRoot as S,env as b}from"@fluixi/core";import{getLocals as y}from"@fluixi/dom";var d="auth";function D(s){let n=s.session,r=U("auth",{server:()=>y()[d]??{user:null,session:null},client:async()=>n?{user:n.user(),session:null}:m(await s.client.getSession()),fallback:{user:null,session:null}});if(n){let e=()=>r.set({user:n.user(),session:null});e(),S(()=>A(e))}let l=async()=>{r.set(n?{user:n.user(),session:null}:m(await s.client.getSession()))},a=n?((...e)=>n.login?.(...e)??Promise.resolve()):async e=>{await s.client.signIn.email(e),await l()},c=n?()=>n.logout?.()??Promise.resolve():async()=>{await s.client.signOut(),r.set({user:null,session:null})},i=e=>(s.navigate??(t=>b.window?.location.assign(t)))(e),h=()=>n?.permissions?.(),o=e=>n?.can?.(e)??!1,u=()=>{if(n?.roles)return n.roles();let e=r.fields.user()?.role;return e?[e]:[]},f=e=>!(e?.role&&!u().includes(e.role)||e?.roles&&!e.roles.some(t=>u().includes(t))||e?.permission!==void 0&&!o(e.permission));function P(e){return()=>o(e.perform)?e.children:e.fallback??null}function k(e){return()=>r.fields.user()&&f(e)?e.children:e.fallback??null}function p(e,t){return w=>{let g=r.fields.user();if(t?.guestOnly){if(g)return i(s.homePath??"/"),null}else{if(!g)return i(s.loginPath??"/login"),null;if(!f(t))return i(s.forbiddenPath??"/403"),null}return e(w)}}return{useUser:()=>r.fields.user,useSession:()=>r.fields.session,useAuth:()=>({user:r.fields.user,session:r.fields.session,isAuthenticated:()=>r.fields.user()!==null,roles:u,can:o,signIn:a,signOut:c}),useSignIn:()=>a,useSignOut:()=>c,usePermissions:()=>h,useCan:()=>o,Can:P,Protect:k,refresh:l,protectedRoute:p,store:r}}function m(s){return{user:s.data?.user??null,session:s.data?.session??null}}export{D as createAuthHooks};
+/*! @fluixi/auth v1.0.0-alpha.85 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+
+// src/client.ts
+import { createIsomorphicStore, createEffect, createRoot, env } from "@fluixi/core";
+import { getLocals } from "@fluixi/dom";
+
+// src/types.ts
+var AUTH_LOCALS_KEY = "auth";
+
+// src/client.ts
+function createAuthHooks(options) {
+  const sess = options.session;
+  const store = createIsomorphicStore("auth", {
+    // Server: read what authMiddleware put on locals → serialized for the client to seed.
+    server: () => getLocals()[AUTH_LOCALS_KEY] ?? { user: null, session: null },
+    // SPA cold load: from the provided session, else the Better Auth client.
+    client: async () => sess ? { user: sess.user(), session: null } : normalize(await options.client.getSession()),
+    fallback: { user: null, session: null }
+  });
+  if (sess) {
+    const apply = () => store.set({ user: sess.user(), session: null });
+    apply();
+    createRoot(() => createEffect(apply));
+  }
+  const refresh = async () => {
+    store.set(sess ? { user: sess.user(), session: null } : normalize(await options.client.getSession()));
+  };
+  const signIn = sess ? ((...args) => sess.login?.(...args) ?? Promise.resolve()) : async (creds) => {
+    await options.client.signIn.email(creds);
+    await refresh();
+  };
+  const signOut = sess ? () => sess.logout?.() ?? Promise.resolve() : async () => {
+    await options.client.signOut();
+    store.set({ user: null, session: null });
+  };
+  const go = (to, opts) => {
+    const fromRoute = typeof opts?.handler === "function" ? opts.handler() : void 0;
+    const fromHooks = typeof options.navigate === "function" ? options.navigate : typeof options.navigate?.handler === "function" ? (
+      // Called, not passed along. Handing back the factory made `fn(to)` build a
+      // navigate function and return it, so the redirect silently did nothing.
+      options.navigate.handler()
+    ) : void 0;
+    const fn = fromRoute ?? fromHooks;
+    if (fn) {
+      const navigateOptions = opts?.options ?? (typeof options.navigate === "object" ? options.navigate?.options : void 0);
+      if (navigateOptions) fn(to, navigateOptions);
+      else fn(to);
+      return;
+    }
+    env.window?.location.assign(to);
+  };
+  const permissions = () => sess?.permissions?.();
+  const can = (query) => sess?.can?.(query) ?? false;
+  const roleList = () => {
+    if (sess?.roles) return sess.roles();
+    const r = store.fields.user()?.role;
+    return r ? [r] : [];
+  };
+  const passesRole = (opts) => {
+    if (opts?.role && !roleList().includes(opts.role)) return false;
+    if (opts?.roles && !opts.roles.some((r) => roleList().includes(r))) return false;
+    if (opts?.permission !== void 0 && !can(opts.permission)) return false;
+    return true;
+  };
+  function Can(props) {
+    return () => can(props.perform) ? props.children : props.fallback ?? null;
+  }
+  function Protect(props) {
+    return () => {
+      if (!store.fields.user()) return props.fallback ?? null;
+      return passesRole(props) ? props.children : props.fallback ?? null;
+    };
+  }
+  function protectedRoute(Comp, opts) {
+    return (props) => {
+      const user = store.fields.user();
+      if (opts?.guestOnly) {
+        if (user) return go(options.homePath ?? "/", opts?.navigator), null;
+      } else {
+        if (!user) return go(options.loginPath ?? "/login", opts?.navigator), null;
+        if (!passesRole(opts)) return go(options.forbiddenPath ?? "/403"), null;
+      }
+      return Comp(props);
+    };
+  }
+  return {
+    useUser: () => store.fields.user,
+    useSession: () => store.fields.session,
+    useAuth: () => ({
+      user: store.fields.user,
+      session: store.fields.session,
+      isAuthenticated: () => store.fields.user() !== null,
+      roles: roleList,
+      can,
+      signIn,
+      signOut
+    }),
+    useSignIn: () => signIn,
+    useSignOut: () => signOut,
+    /** Reactive accessor for the active permission set (UI affordance only). */
+    usePermissions: () => permissions,
+    /** Returns `can(check)`: `false` unless the session provides RBAC. */
+    useCan: () => can,
+    Can,
+    Protect,
+    refresh,
+    protectedRoute,
+    store
+  };
+}
+function normalize(r) {
+  return { user: r.data?.user ?? null, session: r.data?.session ?? null };
+}
+export {
+  createAuthHooks
+};

package/dist/cookies.cjs

@@ -1 +1,72 @@
-"use strict";var r=Object.defineProperty;var c=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var g=Object.prototype.hasOwnProperty;var f=(t,n)=>{for(var o in n)r(t,o,{get:n[o],enumerable:!0})},m=(t,n,o,e)=>{if(n&&typeof n=="object"||typeof n=="function")for(let i of l(n))!g.call(t,i)&&i!==o&&r(t,i,{get:()=>n[i],enumerable:!(e=c(n,i))||e.enumerable});return t};var d=t=>m(r({},"__esModule",{value:!0}),t);var h={};f(h,{deleteCookie:()=>x,getCookie:()=>k,getCookies:()=>C,parseCookies:()=>s,serializeCookie:()=>u});module.exports=d(h);var a=require("@fluixi/server");function s(t){let n={};if(!t)return n;for(let o of t.split(";")){let e=o.indexOf("=");if(e<0)continue;let i=o.slice(0,e).trim();i&&(n[i]=decodeURIComponent(o.slice(e+1).trim()))}return n}function u(t,n,o={}){let e={path:"/",httpOnly:!0,secure:!0,sameSite:"lax",...o},i=`${t}=${encodeURIComponent(n)}`;return e.maxAge!=null&&(i+=`; Max-Age=${Math.floor(e.maxAge)}`),e.expires&&(i+=`; Expires=${e.expires.toUTCString()}`),e.domain&&(i+=`; Domain=${e.domain}`),i+=`; Path=${e.path}`,e.httpOnly&&(i+="; HttpOnly"),e.secure&&(i+="; Secure"),i+=`; SameSite=${e.sameSite[0].toUpperCase()}${e.sameSite.slice(1)}`,i}function x(t,n={}){return u(t,"",{...n,maxAge:0})}function p(){return(0,a.getRequestEvent)()?.request?.headers??null}function k(t){return s(p()?.get("cookie"))[t]??null}function C(){return s(p()?.get("cookie"))}
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/cookies.ts
+var cookies_exports = {};
+__export(cookies_exports, {
+  deleteCookie: () => deleteCookie,
+  getCookie: () => getCookie,
+  getCookies: () => getCookies,
+  parseCookies: () => parseCookies,
+  serializeCookie: () => serializeCookie
+});
+module.exports = __toCommonJS(cookies_exports);
+var import_server = require("@fluixi/server");
+function parseCookies(header) {
+  const out = {};
+  if (!header) return out;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0) continue;
+    const k = part.slice(0, eq).trim();
+    if (k) out[k] = decodeURIComponent(part.slice(eq + 1).trim());
+  }
+  return out;
+}
+function serializeCookie(name, value, opts = {}) {
+  const o = {
+    path: "/",
+    httpOnly: true,
+    secure: true,
+    sameSite: "lax",
+    ...opts
+  };
+  let s = `${name}=${encodeURIComponent(value)}`;
+  if (o.maxAge != null) s += `; Max-Age=${Math.floor(o.maxAge)}`;
+  if (o.expires) s += `; Expires=${o.expires.toUTCString()}`;
+  if (o.domain) s += `; Domain=${o.domain}`;
+  s += `; Path=${o.path}`;
+  if (o.httpOnly) s += "; HttpOnly";
+  if (o.secure) s += "; Secure";
+  s += `; SameSite=${o.sameSite[0].toUpperCase()}${o.sameSite.slice(1)}`;
+  return s;
+}
+function deleteCookie(name, opts = {}) {
+  return serializeCookie(name, "", { ...opts, maxAge: 0 });
+}
+function requestHeaders() {
+  const req = (0, import_server.getRequestEvent)()?.request;
+  return req?.headers ?? null;
+}
+function getCookie(name) {
+  return parseCookies(requestHeaders()?.get("cookie"))[name] ?? null;
+}
+function getCookies() {
+  return parseCookies(requestHeaders()?.get("cookie"));
+}

package/dist/cookies.js

@@ -1,5 +1,5 @@
 /**
- * Cookie API — proper, secure-by-default cookie management for auth (and anything else).
+ * Cookie API: proper, secure-by-default cookie management for auth (and anything else).
  * Parsing + request-scoped reads work standalone; `serializeCookie` builds a spec-compliant
  * `Set-Cookie` string with safe defaults (HttpOnly, Secure, SameSite=Lax, Path=/) that
  * middleware appends to its Response (`response.headers.append('set-cookie', …)`).

package/dist/cookies.mjs

@@ -1 +1,51 @@
-import{getRequestEvent as a}from"@fluixi/server";function r(n){let i={};if(!n)return i;for(let o of n.split(";")){let e=o.indexOf("=");if(e<0)continue;let t=o.slice(0,e).trim();t&&(i[t]=decodeURIComponent(o.slice(e+1).trim()))}return i}function u(n,i,o={}){let e={path:"/",httpOnly:!0,secure:!0,sameSite:"lax",...o},t=`${n}=${encodeURIComponent(i)}`;return e.maxAge!=null&&(t+=`; Max-Age=${Math.floor(e.maxAge)}`),e.expires&&(t+=`; Expires=${e.expires.toUTCString()}`),e.domain&&(t+=`; Domain=${e.domain}`),t+=`; Path=${e.path}`,e.httpOnly&&(t+="; HttpOnly"),e.secure&&(t+="; Secure"),t+=`; SameSite=${e.sameSite[0].toUpperCase()}${e.sameSite.slice(1)}`,t}function c(n,i={}){return u(n,"",{...i,maxAge:0})}function s(){return a()?.request?.headers??null}function l(n){return r(s()?.get("cookie"))[n]??null}function g(){return r(s()?.get("cookie"))}export{c as deleteCookie,l as getCookie,g as getCookies,r as parseCookies,u as serializeCookie};
+// src/cookies.ts
+import { getRequestEvent } from "@fluixi/server";
+function parseCookies(header) {
+  const out = {};
+  if (!header) return out;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0) continue;
+    const k = part.slice(0, eq).trim();
+    if (k) out[k] = decodeURIComponent(part.slice(eq + 1).trim());
+  }
+  return out;
+}
+function serializeCookie(name, value, opts = {}) {
+  const o = {
+    path: "/",
+    httpOnly: true,
+    secure: true,
+    sameSite: "lax",
+    ...opts
+  };
+  let s = `${name}=${encodeURIComponent(value)}`;
+  if (o.maxAge != null) s += `; Max-Age=${Math.floor(o.maxAge)}`;
+  if (o.expires) s += `; Expires=${o.expires.toUTCString()}`;
+  if (o.domain) s += `; Domain=${o.domain}`;
+  s += `; Path=${o.path}`;
+  if (o.httpOnly) s += "; HttpOnly";
+  if (o.secure) s += "; Secure";
+  s += `; SameSite=${o.sameSite[0].toUpperCase()}${o.sameSite.slice(1)}`;
+  return s;
+}
+function deleteCookie(name, opts = {}) {
+  return serializeCookie(name, "", { ...opts, maxAge: 0 });
+}
+function requestHeaders() {
+  const req = getRequestEvent()?.request;
+  return req?.headers ?? null;
+}
+function getCookie(name) {
+  return parseCookies(requestHeaders()?.get("cookie"))[name] ?? null;
+}
+function getCookies() {
+  return parseCookies(requestHeaders()?.get("cookie"));
+}
+export {
+  deleteCookie,
+  getCookie,
+  getCookies,
+  parseCookies,
+  serializeCookie
+};