@lilaquadrat/frontend 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 lilaquadrat
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,132 @@
+# @lilaquadrat/frontend
+
+Shared frontend libraries for lilaquadrat applications.
+
+The package is ESM-only and ships TypeScript declarations. Its public API is
+defined exclusively by exports from `src/index.ts`.
+
+## Resize
+
+The Vue-compatible resize singleton publishes `resized` and `media` events on
+`window`, tracks the viewport height in `--vh`, and reads the active media name
+from the visible child of `#mediadetection`.
+
+```ts
+import resize, { useResize } from '@lilaquadrat/frontend/resize';
+
+const { media, realHeight, resized } = useResize();
+```
+
+Vue `2.7` and Vue `3` are supported as peer dependencies.
+
+`resize` is the shared singleton and is also the default export. Importing it in
+a browser immediately initializes viewport height and listens for native resize
+events. `useResize()` returns Vue refs: `media` is the current visible media
+class, `realHeight` is the visual viewport height, and `resized` changes after
+each update so components can react to it. Its `plugin` property is the shared
+singleton for advanced use such as setting `debounceTime` or calling `trigger`.
+
+Add a `#mediadetection` element containing children whose class names are the
+media labels. CSS must show exactly one child with `display: block`; that class
+becomes `media`. The singleton sets `--vh` on `document.documentElement` and
+dispatches `resized` after every update and `media` only when the media class
+changes. Both events are dispatched on `window`.
+
+## Auth
+
+`auth` is framework-independent. It owns the Keycloak lifecycle and token
+refreshing; the application owns its own user, permission, and routing state.
+
+`keycloak-js` remains an application dependency. Its client instance conforms
+to the exported `KeycloakClient` interface without this package importing it.
+
+### Setup
+
+```ts
+import { createAuth } from '@lilaquadrat/frontend/auth';
+import Keycloak from 'keycloak-js';
+
+const auth = createAuth({
+  createKeycloak: (configuration) => new Keycloak(configuration),
+  callbacks: {
+    setToken: (token) => store.commit('setAuthToken', token),
+    isSessionLoaded: () => Boolean(store.state.authToken),
+    onAuthenticated: () => store.dispatch('loadCurrentUser'),
+    onUnauthenticated: () => store.dispatch('clearCurrentUser'),
+    onError: (error) => logger.error(error),
+  },
+});
+
+await auth.init({ development: false, keycloakConfig });
+```
+
+`createAuth(options)` constructs the service and infers the type of
+`keycloakConfig` from `createKeycloak`. Use `new Auth(options)` only when an
+explicit class instance is required.
+
+`AuthOptions.callbacks.setToken` is required and receives every token update,
+including `null` after logout or a token failure. `isSessionLoaded` should
+return `true` after the application has loaded the user and permissions. This
+prevents `onAuthenticated` from loading the same session repeatedly.
+
+`onAuthenticated` loads application-specific authenticated state. It is called
+after a successful authentication check. `onUnauthenticated` clears that state.
+`onError` receives failed automatic token refreshes triggered by Keycloak.
+
+`AuthOptions.createKeycloak` builds a client from the value passed as
+`keycloakConfig` to `init`. `origin` defaults to `window.location.origin` and
+is used to create Keycloak redirect URLs. Provide it explicitly in tests or
+non-browser environments. `developmentToken` defaults to `DEVTOKEN`.
+
+### Lifecycle
+
+`auth.init({ development, keycloakConfig })` must run before protected content
+is displayed. In production it initializes Keycloak with silent SSO checking,
+then calls `checkAuth`. Host `silent-check-sso.html` at the application origin.
+In development mode no Keycloak client is created and `developmentToken` is
+stored through `setToken`.
+
+`auth.checkAuth()` verifies the active session, refreshes its token, and runs
+`onAuthenticated` if `isSessionLoaded` is absent or returns `false`. Use it in
+an app-specific route guard; redirect to the login route when it rejects.
+
+`auth.refreshToken(force)` returns an access token and synchronizes it through
+`setToken`. Concurrent refreshes share one request. Pass `true` after a 401 to
+force a refresh even if the current token has more than 30 seconds remaining.
+
+`auth.authorize()` starts Keycloak login, and `auth.register()` starts
+registration. Both return to `/login/callback`. `auth.logout()` clears host
+state before starting Keycloak logout. `auth.getAuthHeader()` returns the last
+stored bearer token; `auth.getFreshAuthHeader()` refreshes before returning it.
+
+`setAuthTokenRefresher(refresher)` registers an application-wide refresh
+function. `refreshAuthToken(force)` invokes the function registered by the most
+recent `auth.init`; use it only in HTTP helpers that cannot receive an `Auth`
+instance. Prefer `auth.getFreshAuthHeader()` when an instance is available.
+
+### Types
+
+`AuthCallbacks` defines the host-state callbacks described above.
+`AuthOptions<T>` defines service construction. `AuthInitOptions<T>` defines the
+per-initialization development flag and Keycloak configuration. `KeycloakClient`
+is the minimal client contract. `KeycloakRedirectOptions` and
+`KeycloakSilentCheckOptions` describe the redirect and silent-session options
+passed to that client. All type definitions are exported from the package root
+and `@lilaquadrat/frontend/auth`.
+
+## Install
+
+```sh
+yarn add @lilaquadrat/frontend
+```
+
+## Development
+
+```sh
+yarn build
+yarn typecheck
+yarn lint
+yarn test
+```
+
+`yarn prepack` runs all validation before the package is packed or published.

package/dist/auth.d.ts

@@ -0,0 +1,194 @@
+import type { AuthInitOptions } from './interfaces/AuthInitOptions.js';
+import type { AuthOptions } from './interfaces/AuthOptions.js';
+import type { KeycloakClient } from './interfaces/KeycloakClient.js';
+/**
+ * Framework-independent Keycloak authentication.
+ *
+ * The service manages Keycloak and tokens. The host application provides state
+ * callbacks, so this module works with Vue, React, Angular, or no UI framework.
+ *
+ * @example
+ * ```ts
+ * import Keycloak from 'keycloak-js';
+ * import { createAuth } from '@lilaquadrat/frontend/auth';
+ *
+ * const auth = createAuth({
+ *   createKeycloak: (configuration) => new Keycloak(configuration),
+ *   callbacks: {
+ *     setToken: (token) => apiClient.setToken(token),
+ *     isSessionLoaded: () => session.loaded,
+ *     onAuthenticated: () => session.loadCurrentUser(),
+ *     onUnauthenticated: () => session.clear(),
+ *     onError: (error) => logger.error(error),
+ *   },
+ * });
+ *
+ * await auth.init({ development: false, keycloakConfig });
+ * ```
+ */
+export type { AuthCallbacks, } from './interfaces/AuthCallbacks.js';
+export type { AuthInitOptions, } from './interfaces/AuthInitOptions.js';
+export type { AuthOptions, } from './interfaces/AuthOptions.js';
+export type { KeycloakClient, } from './interfaces/KeycloakClient.js';
+export type { KeycloakRedirectOptions } from './interfaces/KeycloakRedirectOptions.js';
+export type { KeycloakSilentCheckOptions } from './interfaces/KeycloakSilentCheckOptions.js';
+type AuthTokenRefresher = (force?: boolean) => Promise<string>;
+/**
+ * Registers the function used by {@link refreshAuthToken} to obtain the current access token.
+ *
+ * Most applications do not call this directly: `Auth.init` registers its own
+ * refresh method. Register a custom refresher only when an HTTP integration is
+ * initialized before the `Auth` instance.
+ *
+ * @example
+ * ```ts
+ * setAuthTokenRefresher((force) => auth.refreshToken(force));
+ * ```
+ */
+export declare function setAuthTokenRefresher(refresher: AuthTokenRefresher): void;
+/**
+ * Refreshes the access token through the most recently initialized `Auth` instance.
+ *
+ * Use this in HTTP clients that cannot receive an `Auth` instance directly. Pass
+ * `true` only when a request was rejected and must force an immediate refresh.
+ *
+ * @example
+ * ```ts
+ * const token = await refreshAuthToken(response.status === 401);
+ * ```
+ */
+export declare function refreshAuthToken(force?: boolean): Promise<string | undefined>;
+/**
+ * Framework-independent Keycloak authentication service.
+ *
+ * Construct it with {@link createAuth}, then call {@link Auth.init} before using
+ * route guards, API clients, or any other authenticated application feature.
+ *
+ * @example
+ * ```ts
+ * const auth = new Auth({ callbacks, createKeycloak, origin: 'https://app.example.com' });
+ * await auth.init({ development: false, keycloakConfig });
+ * ```
+ */
+export declare class Auth<KeycloakConfiguration = unknown> {
+    /** Indicates whether the service currently holds an authenticated token. */
+    authenticated: boolean;
+    /** Indicates whether `checkAuth` is currently checking or loading a session. */
+    inProgress: boolean;
+    /** The most recently acquired access token, if authentication succeeded. */
+    token?: string;
+    /** The initialized Keycloak client. It is available after production `init`. */
+    keycloak?: KeycloakClient;
+    private readonly callbacks;
+    private readonly createKeycloak?;
+    private readonly developmentToken;
+    private readonly origin?;
+    private development;
+    private refreshPromise?;
+    private refreshForced;
+    /** Creates an auth service. Prefer {@link createAuth} for inferred configuration types. */
+    constructor(options: AuthOptions<KeycloakConfiguration>);
+    /**
+     * Initializes development authentication or a Keycloak client, then verifies the session.
+     *
+     * Production mode requires both `keycloakConfig` and `createKeycloak`. The application must
+     * host `silent-check-sso.html` at its origin for Keycloak silent session checking.
+     *
+     * @example
+     * ```ts
+     * await auth.init({ development: import.meta.env.DEV, keycloakConfig });
+     * ```
+     */
+    init(options: AuthInitOptions<KeycloakConfiguration>): Promise<boolean>;
+    /**
+     * Refreshes the Keycloak token and stores it through `callbacks.setToken`.
+     *
+     * Concurrent calls share one request. A forced refresh waits for an active normal refresh,
+     * then starts an independent request with Keycloak's `-1` minimum validity.
+     *
+     * @example
+     * ```ts
+     * const token = await auth.refreshToken();
+     * const retryToken = await auth.refreshToken(true);
+     * ```
+     */
+    refreshToken(force?: boolean): Promise<string>;
+    /**
+     * Verifies the current session and runs `onAuthenticated` when host data is not loaded.
+     *
+     * Call this from application startup or an app-specific route guard. It rejects with
+     * `NOT_AUTHENTICATED` when no active Keycloak session exists.
+     *
+     * @example
+     * ```ts
+     * try {
+     *   await auth.checkAuth();
+     * } catch {
+     *   router.navigate('/login');
+     * }
+     * ```
+     */
+    checkAuth(): Promise<boolean>;
+    /**
+     * Redirects the browser to Keycloak's login flow and returns to `/login/callback`.
+     *
+     * @example
+     * ```ts
+     * await auth.authorize();
+     * ```
+     */
+    authorize(): Promise<unknown> | unknown;
+    /**
+     * Redirects the browser to Keycloak's registration flow and returns to `/login/callback`.
+     *
+     * @example
+     * ```ts
+     * await auth.register();
+     * ```
+     */
+    register(): Promise<unknown> | unknown;
+    /**
+     * Clears host authentication state, then redirects the browser to Keycloak's logout flow.
+     *
+     * @example
+     * ```ts
+     * await auth.logout();
+     * ```
+     */
+    logout(): Promise<unknown> | unknown;
+    /**
+     * Returns an HTTP `Authorization` header using the most recently stored token.
+     *
+     * @example
+     * ```ts
+     * await fetch('/api/me', { headers: auth.getAuthHeader() });
+     * ```
+     */
+    getAuthHeader(): {
+        Authorization: string;
+    };
+    /**
+     * Refreshes the token and returns an HTTP `Authorization` header with the fresh value.
+     *
+     * @example
+     * ```ts
+     * await fetch('/api/me', { headers: await auth.getFreshAuthHeader() });
+     * ```
+     */
+    getFreshAuthHeader(): Promise<{
+        Authorization: string;
+    }>;
+    private clearAuthentication;
+    private requireKeycloak;
+    private requireOrigin;
+}
+/**
+ * Creates a framework-independent `Auth` service with inferred Keycloak configuration types.
+ *
+ * @example
+ * ```ts
+ * const auth = createAuth({ callbacks, createKeycloak: (configuration) => new Keycloak(configuration) });
+ * ```
+ */
+export declare function createAuth<KeycloakConfiguration>(options: AuthOptions<KeycloakConfiguration>): Auth<KeycloakConfiguration>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,YAAY,EACV,aAAa,GACd,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,eAAe,GAChB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,WAAW,GACZ,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,cAAc,GACf,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACvF,YAAY,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAE7F,KAAK,kBAAkB,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAI/D;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,kBAAkB,GAAG,IAAI,CAEzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE3E;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,IAAI,CAAC,qBAAqB,GAAG,OAAO;IAC/C,4EAA4E;IAC5E,aAAa,UAAS;IAEtB,gFAAgF;IAChF,UAAU,UAAS;IAEnB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,gFAAgF;IAChF,QAAQ,CAAC,EAAE,cAAc,CAAC;IAE1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAA2D;IAC3F,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,cAAc,CAAC,CAAkB;IACzC,OAAO,CAAC,aAAa,CAAS;IAE9B,2FAA2F;gBAC/E,OAAO,EAAE,WAAW,CAAC,qBAAqB,CAAC;IAOvD;;;;;;;;;;OAUG;IACG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,qBAAqB,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAmC7E;;;;;;;;;;;OAWG;IACG,YAAY,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;IAwClD;;;;;;;;;;;;;;OAcG;IACG,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IA0BnC;;;;;;;OAOG;IACH,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO;IAIvC;;;;;;;OAOG;IACH,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO;IAItC;;;;;;;OAOG;IACH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO;IAMpC;;;;;;;OAOG;IACH,aAAa,IAAI;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE;IAI1C;;;;;;;OAOG;IACG,kBAAkB,IAAI,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAI9D,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,aAAa;CAItB;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,qBAAqB,EAAE,OAAO,EAAE,WAAW,CAAC,qBAAqB,CAAC,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAE1H"}

package/dist/auth.js

@@ -0,0 +1,280 @@
+let authTokenRefresher;
+/**
+ * Registers the function used by {@link refreshAuthToken} to obtain the current access token.
+ *
+ * Most applications do not call this directly: `Auth.init` registers its own
+ * refresh method. Register a custom refresher only when an HTTP integration is
+ * initialized before the `Auth` instance.
+ *
+ * @example
+ * ```ts
+ * setAuthTokenRefresher((force) => auth.refreshToken(force));
+ * ```
+ */
+export function setAuthTokenRefresher(refresher) {
+    authTokenRefresher = refresher;
+}
+/**
+ * Refreshes the access token through the most recently initialized `Auth` instance.
+ *
+ * Use this in HTTP clients that cannot receive an `Auth` instance directly. Pass
+ * `true` only when a request was rejected and must force an immediate refresh.
+ *
+ * @example
+ * ```ts
+ * const token = await refreshAuthToken(response.status === 401);
+ * ```
+ */
+export function refreshAuthToken(force = false) {
+    return Promise.resolve(authTokenRefresher?.(force));
+}
+/**
+ * Framework-independent Keycloak authentication service.
+ *
+ * Construct it with {@link createAuth}, then call {@link Auth.init} before using
+ * route guards, API clients, or any other authenticated application feature.
+ *
+ * @example
+ * ```ts
+ * const auth = new Auth({ callbacks, createKeycloak, origin: 'https://app.example.com' });
+ * await auth.init({ development: false, keycloakConfig });
+ * ```
+ */
+export class Auth {
+    /** Indicates whether the service currently holds an authenticated token. */
+    authenticated = false;
+    /** Indicates whether `checkAuth` is currently checking or loading a session. */
+    inProgress = false;
+    /** The most recently acquired access token, if authentication succeeded. */
+    token;
+    /** The initialized Keycloak client. It is available after production `init`. */
+    keycloak;
+    callbacks;
+    createKeycloak;
+    developmentToken;
+    origin;
+    development = false;
+    refreshPromise;
+    refreshForced = false;
+    /** Creates an auth service. Prefer {@link createAuth} for inferred configuration types. */
+    constructor(options) {
+        this.callbacks = options.callbacks;
+        this.createKeycloak = options.createKeycloak;
+        this.developmentToken = options.developmentToken ?? 'DEVTOKEN';
+        this.origin = options.origin ?? (typeof window === 'undefined' ? undefined : window.location.origin);
+    }
+    /**
+     * Initializes development authentication or a Keycloak client, then verifies the session.
+     *
+     * Production mode requires both `keycloakConfig` and `createKeycloak`. The application must
+     * host `silent-check-sso.html` at its origin for Keycloak silent session checking.
+     *
+     * @example
+     * ```ts
+     * await auth.init({ development: import.meta.env.DEV, keycloakConfig });
+     * ```
+     */
+    async init(options) {
+        this.development = options.development;
+        if (this.development) {
+            setAuthTokenRefresher((force) => this.refreshToken(force));
+            return this.checkAuth();
+        }
+        if (options.keycloakConfig === undefined)
+            throw new Error('KEYCLOAK_CONFIG_MISSING');
+        if (!this.createKeycloak)
+            throw new Error('KEYCLOAK_FACTORY_MISSING');
+        if (!this.origin)
+            throw new Error('BROWSER_ORIGIN_MISSING');
+        this.keycloak = this.createKeycloak(options.keycloakConfig);
+        this.keycloak.onAuthLogout = () => this.clearAuthentication();
+        this.keycloak.onTokenExpired = () => {
+            void this.refreshToken().catch((error) => {
+                this.callbacks.onError?.(error);
+                this.keycloak?.clearToken();
+                this.clearAuthentication();
+            });
+        };
+        setAuthTokenRefresher((force) => this.refreshToken(force));
+        await this.keycloak.init({
+            onLoad: 'check-sso',
+            flow: 'standard',
+            pkceMethod: 'S256',
+            scope: 'profile',
+            silentCheckSsoRedirectUri: `${this.origin}/silent-check-sso.html`,
+            silentCheckSsoFallback: true,
+        });
+        return this.checkAuth();
+    }
+    /**
+     * Refreshes the Keycloak token and stores it through `callbacks.setToken`.
+     *
+     * Concurrent calls share one request. A forced refresh waits for an active normal refresh,
+     * then starts an independent request with Keycloak's `-1` minimum validity.
+     *
+     * @example
+     * ```ts
+     * const token = await auth.refreshToken();
+     * const retryToken = await auth.refreshToken(true);
+     * ```
+     */
+    async refreshToken(force = false) {
+        if (this.development)
+            return this.developmentToken;
+        const keycloak = this.keycloak;
+        if (!keycloak?.authenticated)
+            throw new Error('NOT_AUTHENTICATED');
+        if (this.refreshPromise) {
+            if (!force || this.refreshForced)
+                return this.refreshPromise;
+            try {
+                await this.refreshPromise;
+            }
+            catch {
+                // A forced refresh gets an independent result after the active request settles.
+            }
+            return this.refreshToken(true);
+        }
+        const refreshPromise = keycloak.updateToken(force ? -1 : 30).then(() => {
+            if (!keycloak.token)
+                throw new Error('TOKEN_MISSING');
+            this.token = keycloak.token;
+            this.authenticated = true;
+            this.callbacks.setToken(keycloak.token);
+            return keycloak.token;
+        });
+        this.refreshPromise = refreshPromise;
+        this.refreshForced = force;
+        try {
+            return await refreshPromise;
+        }
+        finally {
+            if (this.refreshPromise === refreshPromise) {
+                this.refreshPromise = undefined;
+                this.refreshForced = false;
+            }
+        }
+    }
+    /**
+     * Verifies the current session and runs `onAuthenticated` when host data is not loaded.
+     *
+     * Call this from application startup or an app-specific route guard. It rejects with
+     * `NOT_AUTHENTICATED` when no active Keycloak session exists.
+     *
+     * @example
+     * ```ts
+     * try {
+     *   await auth.checkAuth();
+     * } catch {
+     *   router.navigate('/login');
+     * }
+     * ```
+     */
+    async checkAuth() {
+        this.inProgress = true;
+        try {
+            if (this.development) {
+                this.token = this.developmentToken;
+                this.authenticated = true;
+                this.callbacks.setToken(this.developmentToken);
+                await this.callbacks.onAuthenticated?.();
+                return true;
+            }
+            if (!this.keycloak?.authenticated)
+                throw new Error('NOT_AUTHENTICATED');
+            await this.refreshToken();
+            if (!this.callbacks.isSessionLoaded?.()) {
+                await this.callbacks.onAuthenticated?.();
+            }
+            return true;
+        }
+        finally {
+            this.inProgress = false;
+        }
+    }
+    /**
+     * Redirects the browser to Keycloak's login flow and returns to `/login/callback`.
+     *
+     * @example
+     * ```ts
+     * await auth.authorize();
+     * ```
+     */
+    authorize() {
+        return this.requireKeycloak().login({ redirectUri: `${this.requireOrigin()}/login/callback` });
+    }
+    /**
+     * Redirects the browser to Keycloak's registration flow and returns to `/login/callback`.
+     *
+     * @example
+     * ```ts
+     * await auth.register();
+     * ```
+     */
+    register() {
+        return this.requireKeycloak().register({ redirectUri: `${this.requireOrigin()}/login/callback` });
+    }
+    /**
+     * Clears host authentication state, then redirects the browser to Keycloak's logout flow.
+     *
+     * @example
+     * ```ts
+     * await auth.logout();
+     * ```
+     */
+    logout() {
+        const keycloak = this.requireKeycloak();
+        this.clearAuthentication();
+        return keycloak.logout({ redirectUri: this.requireOrigin() });
+    }
+    /**
+     * Returns an HTTP `Authorization` header using the most recently stored token.
+     *
+     * @example
+     * ```ts
+     * await fetch('/api/me', { headers: auth.getAuthHeader() });
+     * ```
+     */
+    getAuthHeader() {
+        return { Authorization: `Bearer ${this.token ?? ''}` };
+    }
+    /**
+     * Refreshes the token and returns an HTTP `Authorization` header with the fresh value.
+     *
+     * @example
+     * ```ts
+     * await fetch('/api/me', { headers: await auth.getFreshAuthHeader() });
+     * ```
+     */
+    async getFreshAuthHeader() {
+        return { Authorization: `Bearer ${await this.refreshToken()}` };
+    }
+    clearAuthentication() {
+        this.token = undefined;
+        this.authenticated = false;
+        this.callbacks.setToken(null);
+        void this.callbacks.onUnauthenticated?.();
+    }
+    requireKeycloak() {
+        if (!this.keycloak)
+            throw new Error('AUTH_NOT_INITIALIZED');
+        return this.keycloak;
+    }
+    requireOrigin() {
+        if (!this.origin)
+            throw new Error('BROWSER_ORIGIN_MISSING');
+        return this.origin;
+    }
+}
+/**
+ * Creates a framework-independent `Auth` service with inferred Keycloak configuration types.
+ *
+ * @example
+ * ```ts
+ * const auth = createAuth({ callbacks, createKeycloak: (configuration) => new Keycloak(configuration) });
+ * ```
+ */
+export function createAuth(options) {
+    return new Auth(options);
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAgDA,IAAI,kBAAkD,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAA6B;IACjE,kBAAkB,GAAG,SAAS,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAK,GAAG,KAAK;IAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,IAAI;IACf,4EAA4E;IAC5E,aAAa,GAAG,KAAK,CAAC;IAEtB,gFAAgF;IAChF,UAAU,GAAG,KAAK,CAAC;IAEnB,4EAA4E;IAC5E,KAAK,CAAU;IAEf,gFAAgF;IAChF,QAAQ,CAAkB;IAET,SAAS,CAAgB;IACzB,cAAc,CAA4D;IAC1E,gBAAgB,CAAS;IACzB,MAAM,CAAU;IACzB,WAAW,GAAG,KAAK,CAAC;IACpB,cAAc,CAAmB;IACjC,aAAa,GAAG,KAAK,CAAC;IAE9B,2FAA2F;IAC3F,YAAY,OAA2C;QACrD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,UAAU,CAAC;QAC/D,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvG,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,IAAI,CAAC,OAA+C;QACxD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QAEvC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,qBAAqB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,CAAC;QAED,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAE5D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,YAAY,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,cAAc,GAAG,GAAG,EAAE;YAClC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAChD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;gBAChC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;gBAC5B,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,qBAAqB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAE3D,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACvB,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,SAAS;YAChB,yBAAyB,EAAE,GAAG,IAAI,CAAC,MAAM,wBAAwB;YACjE,sBAAsB,EAAE,IAAI;SAC7B,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,KAAK;QAC9B,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC;QAEnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,QAAQ,EAAE,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAEnE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,aAAa;gBAAE,OAAO,IAAI,CAAC,cAAc,CAAC;YAE7D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,gFAAgF;YAClF,CAAC;YAED,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,cAAc,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;YACrE,IAAI,CAAC,QAAQ,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YAEtD,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;YAC5B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,QAAQ,CAAC,KAAK,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QAE3B,IAAI,CAAC;YACH,OAAO,MAAM,cAAc,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;gBAC3C,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;gBAChC,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QAEvB,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC;gBACnC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC1B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBAC/C,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC;gBACzC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAExE,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAE1B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,EAAE,CAAC;gBACxC,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC;YAC3C,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACjG,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACpG,CAAC;IAED;;;;;;;OAOG;IACH,MAAM;QACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;OAOG;IACH,aAAa;QACX,OAAO,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB;QACtB,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,CAAC;IAClE,CAAC;IAEO,mBAAmB;QACzB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,KAAK,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC;IAC5C,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAwB,OAA2C;IAC3F,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { default as resize } from './resize.js';
+export { Resize, useResize } from './resize.js';
+export { Auth, createAuth, refreshAuthToken, setAuthTokenRefresher } from './auth.js';
+export type { AuthCallbacks, AuthInitOptions, AuthOptions, KeycloakClient, KeycloakRedirectOptions, KeycloakSilentCheckOptions, } from './auth.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACtF,YAAY,EACV,aAAa,EACb,eAAe,EACf,WAAW,EACX,cAAc,EACd,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { default as resize } from './resize.js';
+export { Resize, useResize } from './resize.js';
+export { Auth, createAuth, refreshAuthToken, setAuthTokenRefresher } from './auth.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC"}