@luminaryworks/auth-react 0.3.1

package/dist/index.js

@@ -0,0 +1,1043 @@
+(function(){if(typeof document==="undefined")return;var id="lw-auth-react-headless-login";if(document.getElementById(id))return;var s=document.createElement("style");s.id=id;s.textContent="/* src/HeadlessLoginPanel.module.scss */\n.HeadlessLoginPanel_module_panel {\n  --lw-auth-theme: #3a84ff;\n  --lw-auth-theme-deep: color-mix(in srgb, var(--lw-auth-theme) 72%, #000);\n  width: min(100%, 400px);\n  padding: 28px 28px 22px;\n  border-radius: 16px;\n  background: rgba(255, 255, 255, 0.96);\n  color: #14212b;\n  box-shadow: 0 24px 64px rgba(15, 23, 42, 0.28);\n  font-family:\n    \"Segoe UI\",\n    \"PingFang SC\",\n    \"Noto Sans SC\",\n    sans-serif;\n}\n.HeadlessLoginPanel_module_brand {\n  display: flex;\n  gap: 14px;\n  align-items: center;\n  margin-bottom: 12px;\n}\n.HeadlessLoginPanel_module_logo {\n  border-radius: 12px;\n  display: block;\n}\n.HeadlessLoginPanel_module_product {\n  margin: 0;\n  font-size: 13px;\n  font-weight: 650;\n  letter-spacing: 0.04em;\n  text-transform: uppercase;\n  color: var(--lw-auth-theme);\n}\n.HeadlessLoginPanel_module_title {\n  margin: 2px 0 0;\n  font-size: 22px;\n  font-weight: 700;\n  line-height: 1.25;\n}\n.HeadlessLoginPanel_module_subtitle {\n  margin: 0 0 18px;\n  font-size: 14px;\n  line-height: 1.5;\n  color: #4b5c68;\n}\n.HeadlessLoginPanel_module_form {\n  display: grid;\n  gap: 10px;\n}\n.HeadlessLoginPanel_module_socialStack {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 10px;\n  font-size: 12px;\n}\n.HeadlessLoginPanel_module_input {\n  width: 100%;\n  box-sizing: border-box;\n  border: 1px solid #c9d5de;\n  border-radius: 10px;\n  padding: 10px 12px;\n  font-size: 14px;\n  outline: none;\n  background: #f7fafc;\n}\n.HeadlessLoginPanel_module_input:focus {\n  border-color: var(--lw-auth-theme);\n}\n.HeadlessLoginPanel_module_input:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_passwordField {\n  position: relative;\n  display: flex;\n  align-items: center;\n}\n.HeadlessLoginPanel_module_passwordInput {\n  padding-right: 42px;\n}\n.HeadlessLoginPanel_module_passwordToggle {\n  position: absolute;\n  right: 4px;\n  top: 50%;\n  transform: translateY(-50%);\n  z-index: 1;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  width: 36px;\n  height: 36px;\n  border: none;\n  border-radius: 4px;\n  padding: 0;\n  color: #5a6b76;\n  background: transparent;\n  cursor: pointer;\n}\n.HeadlessLoginPanel_module_passwordToggle:hover:not(:disabled) {\n  color: var(--lw-auth-theme);\n  background: color-mix(in srgb, var(--lw-auth-theme) 12%, transparent);\n}\n.HeadlessLoginPanel_module_passwordToggle:focus-visible {\n  outline: 2px solid var(--lw-auth-theme);\n  outline-offset: 1px;\n}\n.HeadlessLoginPanel_module_passwordToggle:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_primaryBtn {\n  border: none;\n  border-radius: 10px;\n  padding: 11px 14px;\n  font-size: 14px;\n  font-weight: 650;\n  cursor: pointer;\n  color: #fff;\n  background:\n    linear-gradient(\n      135deg,\n      var(--lw-auth-theme) 0%,\n      var(--lw-auth-theme-deep) 100%);\n}\n.HeadlessLoginPanel_module_primaryBtn:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_socialBtn {\n  flex: 1 1 calc(50% - 5px);\n  min-width: min(140px, 100%);\n  display: flex;\n  align-items: center;\n  justify-content: center;\n  gap: 8px;\n  border: 1px solid #b7c9d4;\n  border-radius: 10px;\n  padding: 11px 10px;\n  font-size: 14px;\n  font-weight: 650;\n  cursor: pointer;\n  color: #14212b;\n  background: #fff;\n}\n.HeadlessLoginPanel_module_socialBtn:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_socialLogo {\n  flex-shrink: 0;\n  display: block;\n}\n.HeadlessLoginPanel_module_logoFallback {\n  width: 18px;\n  height: 18px;\n  border-radius: 4px;\n  background: color-mix(in srgb, var(--lw-auth-theme) 14%, #fff);\n  color: var(--lw-auth-theme-deep);\n  font-size: 11px;\n  font-weight: 700;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  flex-shrink: 0;\n}\n.HeadlessLoginPanel_module_cancelBtn {\n  margin-top: 10px;\n  width: 100%;\n  border: none;\n  background: transparent;\n  color: #5a6b76;\n  font-size: 13px;\n  cursor: pointer;\n  padding: 8px;\n}\n.HeadlessLoginPanel_module_cancelBtn:disabled {\n  opacity: 0.65;\n  cursor: not-allowed;\n}\n.HeadlessLoginPanel_module_divider {\n  display: flex;\n  align-items: center;\n  gap: 10px;\n  margin: 14px 0;\n  color: #90a0ab;\n}\n.HeadlessLoginPanel_module_dividerLine {\n  flex: 1;\n  height: 1px;\n  background: #d5e0e7;\n}\n.HeadlessLoginPanel_module_dividerText {\n  font-size: 12px;\n  text-transform: uppercase;\n  letter-spacing: 0.08em;\n}\n.HeadlessLoginPanel_module_hint {\n  margin: 10px 0 0;\n  font-size: 12px;\n  color: #6b7c87;\n  line-height: 1.45;\n}\n.HeadlessLoginPanel_module_error {\n  margin: 12px 0 0;\n  font-size: 13px;\n  color: #b42318;\n  line-height: 1.4;\n}\n.HeadlessLoginPanel_module_footer {\n  margin-top: 18px;\n  padding-top: 12px;\n  border-top: 1px solid #e4ebf0;\n  font-size: 12px;\n  color: #6b7c87;\n  display: flex;\n  gap: 8px;\n  justify-content: center;\n}\n/*# sourceMappingURL=index.css.map */";document.head.appendChild(s);})();
+'use strict';
+
+var oidcClientTs = require('oidc-client-ts');
+var react = require('react');
+var jsxRuntime = require('react/jsx-runtime');
+
+// src/types.ts
+function isIdpConfigured(config) {
+  return Boolean(config.issuer && config.clientId && config.redirectUri);
+}
+function resolveIssuer(env) {
+  const explicit = env.VITE_IDP_ISSUER ?? env.PUBLIC_IDP_ISSUER ?? env.IDP_ISSUER;
+  if (explicit) return explicit;
+  const gateway = env.VITE_AUTH_GATEWAY_URL ?? env.PUBLIC_AUTH_GATEWAY_URL ?? env.AUTH_GATEWAY_URL;
+  if (gateway) return `${gateway.replace(/\/$/, "")}/oidc`;
+  return void 0;
+}
+function resolveExperienceApiBase(env) {
+  const explicit = env.VITE_AUTH_EXPERIENCE_URL ?? env.PUBLIC_AUTH_EXPERIENCE_URL ?? env.AUTH_EXPERIENCE_URL;
+  if (explicit) return explicit.replace(/\/$/, "");
+  const gateway = env.VITE_AUTH_GATEWAY_URL ?? env.PUBLIC_AUTH_GATEWAY_URL ?? env.AUTH_GATEWAY_URL;
+  if (gateway) return gateway.replace(/\/$/, "");
+  const issuer = resolveIssuer(env);
+  if (!issuer) return void 0;
+  return issuer.replace(/\/$/, "").replace(/\/oidc$/i, "");
+}
+function readIdpConfigFromEnv(env) {
+  const redirectUri = env.VITE_IDP_REDIRECT_URI ?? env.PUBLIC_IDP_REDIRECT_URI ?? "";
+  return {
+    issuer: resolveIssuer(env),
+    clientId: env.VITE_IDP_CLIENT_ID ?? env.PUBLIC_IDP_CLIENT_ID,
+    redirectUri,
+    popupRedirectUri: env.VITE_IDP_POPUP_REDIRECT_URI ?? env.PUBLIC_IDP_POPUP_REDIRECT_URI ?? redirectUri,
+    postLogoutRedirectUri: env.VITE_IDP_POST_LOGOUT_URI ?? env.PUBLIC_IDP_POST_LOGOUT_URI,
+    scopes: env.VITE_IDP_SCOPES ?? env.PUBLIC_IDP_SCOPES ?? "openid profile email offline_access",
+    audience: env.VITE_IDP_AUDIENCE ?? env.PUBLIC_IDP_AUDIENCE,
+    tokenStorageKey: env.VITE_IDP_TOKEN_KEY ?? "luminary_access_token",
+    experienceApiBase: resolveExperienceApiBase(env)
+  };
+}
+var manager = null;
+function storageKey(config) {
+  return config.tokenStorageKey ?? "luminary_access_token";
+}
+function popupRedirectUri(config) {
+  return config.popupRedirectUri ?? config.redirectUri;
+}
+function sharedStateStore() {
+  return new oidcClientTs.WebStorageStateStore({ store: window.localStorage });
+}
+function clientSettings(config) {
+  const resource = config.audience?.trim() || void 0;
+  return {
+    authority: config.issuer.replace(/\/$/, ""),
+    metadataUrl: resolveOidcMetadataUrl(config),
+    client_id: config.clientId,
+    redirect_uri: config.redirectUri,
+    post_logout_redirect_uri: config.postLogoutRedirectUri ?? config.redirectUri,
+    response_type: "code",
+    scope: config.scopes ?? "openid profile email offline_access",
+    stateStore: sharedStateStore(),
+    extraQueryParams: resource ? { resource } : void 0,
+    extraTokenParams: resource ? { resource } : void 0
+  };
+}
+function userManagerSettings(config) {
+  const resource = config.audience?.trim() || void 0;
+  return {
+    ...clientSettings(config),
+    popup_redirect_uri: popupRedirectUri(config),
+    automaticSilentRenew: true,
+    loadUserInfo: !resource,
+    userStore: sharedStateStore()
+  };
+}
+function createUserManager(config) {
+  if (manager) return manager;
+  manager = new oidcClientTs.UserManager(userManagerSettings(config));
+  return manager;
+}
+function resolveOidcMetadataUrl(config) {
+  const proxyBase = config.experienceApiBase?.replace(/\/$/, "");
+  if (!proxyBase) return void 0;
+  try {
+    if (new URL(proxyBase).origin === new URL(config.issuer).origin) return void 0;
+  } catch {
+    return void 0;
+  }
+  return `${proxyBase}/oidc/.well-known/openid-configuration`;
+}
+function resetUserManager() {
+  manager = null;
+}
+function signInArgs(config, options) {
+  const normalized = typeof options === "string" ? { returnUrl: options } : options ?? {};
+  const resource = config.audience?.trim();
+  const extraQueryParams = {};
+  if (resource) extraQueryParams.resource = resource;
+  if (normalized.directSignIn) extraQueryParams.direct_sign_in = normalized.directSignIn;
+  return {
+    state: normalized.returnUrl ? { returnUrl: normalized.returnUrl } : void 0,
+    extraQueryParams: Object.keys(extraQueryParams).length ? extraQueryParams : void 0
+  };
+}
+async function signInRedirect(config, returnUrlOrOptions) {
+  resetUserManager();
+  const um = createUserManager(config);
+  await um.signinRedirect(signInArgs(config, returnUrlOrOptions));
+}
+async function prepareSignInRequestUrl(config, returnUrlOrOptions) {
+  resetUserManager();
+  createUserManager(config);
+  const client = new oidcClientTs.OidcClient(clientSettings(config));
+  const args = signInArgs(config, returnUrlOrOptions);
+  const request = await client.createSigninRequest({
+    state: args.state,
+    extraQueryParams: {
+      ...args.extraQueryParams ?? {},
+      prompt: "login"
+    }
+  });
+  return request.url;
+}
+async function signInPopup(config, returnUrlOrOptions) {
+  resetUserManager();
+  const um = createUserManager(config);
+  const user = await um.signinPopup(signInArgs(config, returnUrlOrOptions));
+  const session = toSession(user);
+  if (!session.accessToken) {
+    throw new Error("IdP did not return access_token (check audience / API resource)");
+  }
+  assertJwtAccessToken(session.accessToken);
+  localStorage.setItem(storageKey(config), session.accessToken);
+  const stateReturnUrl = typeof user.state === "object" && user.state && "returnUrl" in user.state ? String(user.state.returnUrl ?? "") : void 0;
+  return { session, returnUrl: stateReturnUrl || void 0 };
+}
+async function handleSignInCallback(config) {
+  const um = createUserManager(config);
+  const user = await um.signinRedirectCallback();
+  const session = toSession(user);
+  assertJwtAccessToken(session.accessToken);
+  localStorage.setItem(storageKey(config), session.accessToken);
+  const returnUrl = typeof user.state === "object" && user.state && "returnUrl" in user.state ? String(user.state.returnUrl ?? "") : void 0;
+  return { session, returnUrl: returnUrl || void 0 };
+}
+async function handleSignInPopupCallback(config) {
+  const um = createUserManager(config);
+  await um.signinPopupCallback();
+}
+function isOidcPopupWindow() {
+  try {
+    return Boolean(window.opener && window.opener !== window);
+  } catch {
+    return false;
+  }
+}
+async function signOutRedirect(config) {
+  localStorage.removeItem(storageKey(config));
+  const um = createUserManager(config);
+  await um.signoutRedirect();
+}
+function getStoredAccessToken(config) {
+  return localStorage.getItem(storageKey(config));
+}
+function clearStoredSession(config) {
+  localStorage.removeItem(storageKey(config));
+}
+function toSession(user) {
+  return {
+    accessToken: user.access_token,
+    idToken: user.id_token,
+    expiresAt: user.expires_at ? user.expires_at * 1e3 : void 0,
+    profile: user.profile
+  };
+}
+function assertJwtAccessToken(accessToken) {
+  if (accessToken.split(".").length !== 3) {
+    throw new Error(
+      "Received non-JWT access_token. Pass resource (audience) on authorize/token and register the API resource at the IdP."
+    );
+  }
+}
+async function getCurrentUser(config) {
+  const um = createUserManager(config);
+  const user = await um.getUser();
+  if (!user || user.expired) return null;
+  return toSession(user);
+}
+
+// src/experience-client.ts
+function experienceUrl(apiBase, path) {
+  return `${apiBase.replace(/\/$/, "")}/api/experience${path}`;
+}
+async function experienceFetch(apiBase, path, init) {
+  const res = await fetch(experienceUrl(apiBase, path), {
+    credentials: "include",
+    ...init,
+    headers: {
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      ...init.headers ?? {}
+    }
+  });
+  const text = await res.text();
+  let data = null;
+  if (text) {
+    try {
+      data = JSON.parse(text);
+    } catch {
+      data = text;
+    }
+  }
+  if (!res.ok) {
+    const msg = data && typeof data === "object" && data !== null && "message" in data ? String(data.message) : `Experience API ${res.status}`;
+    throw new Error(msg);
+  }
+  return data;
+}
+function guessIdentifierType(identifier) {
+  if (identifier.includes("@")) return "email";
+  if (/^\+?\d{6,}$/.test(identifier.trim())) return "phone";
+  return "username";
+}
+function sameOriginAuthorizeUrl(authorizeUrl, apiBase) {
+  const u = new URL(authorizeUrl);
+  const base = new URL(apiBase);
+  if (u.origin === base.origin) return authorizeUrl;
+  return `${base.origin}${u.pathname}${u.search}${u.hash}`;
+}
+async function bootstrapOidcInteraction(input) {
+  if (!input.issuer || !input.clientId || !input.redirectUri) return;
+  if (typeof document === "undefined") return;
+  const config = {
+    issuer: input.issuer,
+    clientId: input.clientId,
+    redirectUri: input.redirectUri,
+    audience: input.audience,
+    scopes: input.scopes,
+    experienceApiBase: input.apiBase
+  };
+  const signinUrl = await prepareSignInRequestUrl(config, {
+    returnUrl: input.returnUrl
+  });
+  const authorizeUrl = sameOriginAuthorizeUrl(signinUrl, input.apiBase);
+  await new Promise((resolve) => {
+    const iframe = document.createElement("iframe");
+    iframe.setAttribute("aria-hidden", "true");
+    iframe.tabIndex = -1;
+    iframe.style.cssText = "position:absolute;width:0;height:0;border:0;visibility:hidden";
+    let settled = false;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      iframe.remove();
+      resolve();
+    };
+    iframe.addEventListener("load", () => {
+      window.setTimeout(finish, 400);
+    });
+    iframe.src = authorizeUrl;
+    document.body.appendChild(iframe);
+    window.setTimeout(finish, 2500);
+  });
+}
+async function experiencePasswordSignIn(input) {
+  const { apiBase, identifier, password } = input;
+  await bootstrapOidcInteraction(input);
+  const primary = input.identifierType ?? guessIdentifierType(identifier);
+  const alternates = primary === "phone" ? [primary] : primary === "email" ? ["email", "username"] : ["username", "email"];
+  let lastError;
+  for (const identifierType of alternates) {
+    try {
+      await experienceFetch(apiBase, "", {
+        method: "PUT",
+        body: JSON.stringify({ interactionEvent: "SignIn" })
+      });
+      const verified = await experienceFetch(
+        apiBase,
+        "/verification/password",
+        {
+          method: "POST",
+          body: JSON.stringify({
+            identifier: { type: identifierType, value: identifier },
+            password
+          })
+        }
+      );
+      const verificationId = verified?.verificationId;
+      if (!verificationId) {
+        throw new Error("Experience API did not return verificationId");
+      }
+      await experienceFetch(apiBase, "/identification", {
+        method: "POST",
+        body: JSON.stringify({ verificationId })
+      });
+      const submitted = await experienceFetch(apiBase, "/submit", {
+        method: "POST",
+        body: JSON.stringify({})
+      });
+      return { redirectTo: submitted?.redirectTo, raw: submitted };
+    } catch (e) {
+      lastError = e instanceof Error ? e : new Error(String(e));
+    }
+  }
+  throw lastError ?? new Error("Experience password sign-in failed");
+}
+async function fetchSocialConnectors(input) {
+  const url = new URL(`${input.apiBase.replace(/\/$/, "")}/api/.well-known/sign-in-exp`);
+  if (input.appId?.trim()) url.searchParams.set("appId", input.appId.trim());
+  const res = await fetch(url.toString(), {
+    // Public metadata — omit cookies so browsers do not require credentialed CORS.
+    credentials: "omit",
+    headers: { Accept: "application/json" }
+  });
+  if (!res.ok) {
+    throw new Error(`sign-in-exp ${res.status}`);
+  }
+  const data = await res.json();
+  return (data.socialConnectors ?? []).filter(
+    (c) => Boolean(c?.id && c?.target)
+  ).map((c) => ({
+    id: c.id,
+    target: c.target,
+    name: localizeName(c.name) || titleCase(c.target),
+    logo: c.logo
+  }));
+}
+function localizeName(name) {
+  if (!name) return "";
+  if (typeof name === "string") return name;
+  return name["zh-CN"] || name.en || Object.values(name)[0] || "";
+}
+function titleCase(target) {
+  if (!target) return "";
+  return target.charAt(0).toUpperCase() + target.slice(1);
+}
+
+// src/auth-gate.ts
+var AuthGateCoordinator = class {
+  phase = "idle";
+  lastError;
+  /** Cached for useSyncExternalStore — must keep referential equality when unchanged. */
+  snapshot = { phase: "idle", blocked: false };
+  config = {};
+  flight = null;
+  reauthWaiters = [];
+  listeners = /* @__PURE__ */ new Set();
+  configure(config) {
+    this.config = { ...this.config, ...config };
+  }
+  getSnapshot = () => this.snapshot;
+  subscribe = (listener) => {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  };
+  emit() {
+    for (const listener of this.listeners) listener();
+  }
+  setPhase(phase, lastError) {
+    if (this.phase === phase && this.lastError === lastError) return;
+    this.phase = phase;
+    this.lastError = lastError;
+    this.snapshot = {
+      phase,
+      blocked: phase !== "idle",
+      lastError
+    };
+    this.emit();
+  }
+  /** Await while a recovery is in flight (pause outbound API traffic). */
+  async waitIfBlocked() {
+    if (!this.flight) return;
+    await this.flight;
+  }
+  /**
+   * Single-flight 401 handler.
+   * Concurrent callers share one recovery; all receive the same disposition.
+   */
+  handleUnauthorized(errorMessage) {
+    if (this.flight) return this.flight;
+    this.flight = this.runRecovery(errorMessage).finally(() => {
+      this.flight = null;
+    });
+    return this.flight;
+  }
+  /** Open reauth UI without a preceding 401 (cold start / deep link). */
+  requestReauth(errorMessage) {
+    return this.handleUnauthorized(errorMessage);
+  }
+  /** Product calls after popup / Headless login restored the session. */
+  completeReauth() {
+    if (this.phase !== "reauth") return;
+    const waiters = this.reauthWaiters.splice(0, this.reauthWaiters.length);
+    this.setPhase("idle");
+    this.config.onSettled?.(true);
+    for (const w of waiters) w.resolve("retry");
+  }
+  /** User dismissed reauth; fail queued recovery waiters. */
+  cancelReauth(errorMessage) {
+    if (this.phase !== "reauth") return;
+    const waiters = this.reauthWaiters.splice(0, this.reauthWaiters.length);
+    this.setPhase("idle", errorMessage);
+    this.config.onSettled?.(false);
+    for (const w of waiters) w.resolve("fail");
+  }
+  async runRecovery(errorMessage) {
+    this.lastError = errorMessage;
+    if (this.config.tryRefresh) {
+      this.setPhase("refreshing", errorMessage);
+      try {
+        const ok = await this.config.tryRefresh();
+        if (ok) {
+          this.setPhase("idle");
+          this.config.onSettled?.(true);
+          return "retry";
+        }
+      } catch (e) {
+        this.lastError = e instanceof Error ? e.message : String(e);
+      }
+    }
+    this.setPhase("reauth", this.lastError);
+    this.config.onReauthRequired?.();
+    return new Promise((resolve) => {
+      this.reauthWaiters.push({ resolve });
+    });
+  }
+};
+var authGate = new AuthGateCoordinator();
+async function withAuthGateRetry(execute, options) {
+  if (options?.bypass) return execute();
+  await authGate.waitIfBlocked();
+  try {
+    return await execute();
+  } catch (error) {
+    if (!(options?.isUnauthorized ?? defaultIsUnauthorized)(error)) throw error;
+    const disposition = await authGate.handleUnauthorized(messageOf(error));
+    if (disposition !== "retry") throw error;
+    return execute();
+  }
+}
+function defaultIsUnauthorized(error) {
+  if (!error || typeof error !== "object") return false;
+  const e = error;
+  return e.status === 401 || e.statusCode === 401 || e.response?.status === 401;
+}
+function messageOf(error) {
+  if (error instanceof Error) return error.message;
+  if (error && typeof error === "object" && "message" in error) {
+    const m = error.message;
+    return typeof m === "string" ? m : void 0;
+  }
+  return void 0;
+}
+var LuminaryAuthContext = react.createContext(null);
+function LuminaryAuthProvider({ config: configProp, children }) {
+  const config = react.useMemo(() => configProp ?? {}, [configProp]);
+  const configured = isIdpConfigured(config);
+  const [session, setSession] = react.useState(null);
+  const [loading, setLoading] = react.useState(configured);
+  const refreshSession = react.useCallback(async () => {
+    if (!configured) {
+      setSession(null);
+      setLoading(false);
+      return;
+    }
+    setLoading(true);
+    try {
+      const current = await getCurrentUser(config);
+      setSession(current);
+    } catch {
+      setSession(null);
+    } finally {
+      setLoading(false);
+    }
+  }, [config, configured]);
+  react.useEffect(() => {
+    void refreshSession();
+  }, [refreshSession]);
+  const login = react.useCallback(
+    async (returnUrl) => {
+      if (!configured) throw new Error("IdP not configured");
+      await signInRedirect(config, returnUrl);
+    },
+    [config, configured]
+  );
+  const loginPopup = react.useCallback(
+    async (returnUrl) => {
+      if (!configured) throw new Error("IdP not configured");
+      const { session: next } = await signInPopup(config, returnUrl);
+      setSession(next);
+      return next;
+    },
+    [config, configured]
+  );
+  const logout = react.useCallback(async () => {
+    if (!configured) {
+      clearStoredSession(config);
+      setSession(null);
+      return;
+    }
+    setSession(null);
+    await signOutRedirect(config);
+  }, [config, configured]);
+  const completeCallback = react.useCallback(async () => {
+    if (!configured) throw new Error("IdP not configured");
+    const { session: next, returnUrl } = await handleSignInCallback(config);
+    setSession(next);
+    return { returnUrl };
+  }, [config, configured]);
+  const value = react.useMemo(
+    () => ({
+      configured,
+      session,
+      accessToken: session?.accessToken ?? (configured ? getStoredAccessToken(config) : null),
+      loading,
+      login,
+      loginPopup,
+      logout,
+      completeCallback,
+      refreshSession
+    }),
+    [configured, session, loading, login, loginPopup, logout, completeCallback, refreshSession, config]
+  );
+  return /* @__PURE__ */ jsxRuntime.jsx(LuminaryAuthContext.Provider, { value, children });
+}
+function useLuminaryAuth() {
+  const ctx = react.useContext(LuminaryAuthContext);
+  if (!ctx) throw new Error("useLuminaryAuth must be used within LuminaryAuthProvider");
+  return ctx;
+}
+
+// src/HeadlessLoginPanel.module.scss
+var HeadlessLoginPanel_module_default = {
+  panel: "HeadlessLoginPanel_module_panel",
+  brand: "HeadlessLoginPanel_module_brand",
+  logo: "HeadlessLoginPanel_module_logo",
+  product: "HeadlessLoginPanel_module_product",
+  title: "HeadlessLoginPanel_module_title",
+  subtitle: "HeadlessLoginPanel_module_subtitle",
+  form: "HeadlessLoginPanel_module_form",
+  socialStack: "HeadlessLoginPanel_module_socialStack",
+  input: "HeadlessLoginPanel_module_input",
+  passwordField: "HeadlessLoginPanel_module_passwordField",
+  passwordInput: "HeadlessLoginPanel_module_passwordInput",
+  passwordToggle: "HeadlessLoginPanel_module_passwordToggle",
+  primaryBtn: "HeadlessLoginPanel_module_primaryBtn",
+  socialBtn: "HeadlessLoginPanel_module_socialBtn",
+  socialLogo: "HeadlessLoginPanel_module_socialLogo",
+  logoFallback: "HeadlessLoginPanel_module_logoFallback",
+  cancelBtn: "HeadlessLoginPanel_module_cancelBtn",
+  divider: "HeadlessLoginPanel_module_divider",
+  dividerLine: "HeadlessLoginPanel_module_dividerLine",
+  dividerText: "HeadlessLoginPanel_module_dividerText",
+  hint: "HeadlessLoginPanel_module_hint",
+  error: "HeadlessLoginPanel_module_error",
+  footer: "HeadlessLoginPanel_module_footer"
+};
+var DEFAULT_LOGIN_THEME_COLOR = "#3a84ff";
+var defaults = {
+  title: "Sign in",
+  subtitle: "Use your LuminaryWorks unified account",
+  identifierPlaceholder: "Email or username",
+  passwordPlaceholder: "Password",
+  submitPassword: "Sign in with password",
+  submitSso: "Continue with unified account",
+  submitGoogle: "Google",
+  submitGithub: "GitHub",
+  socialDivider: "or",
+  hint: "Social providers open directly. Password uses your LuminaryWorks account.",
+  cancel: "Cancel",
+  experienceUnavailable: "Password sign-in is unavailable; use a social provider instead.",
+  showPassword: "Show password",
+  hidePassword: "Hide password"
+};
+var FALLBACK_SOCIAL = [
+  { id: "google", target: "google", name: "Google" },
+  { id: "github", target: "github", name: "GitHub" }
+];
+function resolveSieBase(config) {
+  const explicit = config.experienceApiBase?.trim();
+  if (explicit) return explicit.replace(/\/$/, "");
+  if (config.issuer) {
+    try {
+      return new URL(config.issuer).origin;
+    } catch {
+    }
+  }
+  return void 0;
+}
+function labelFor(connector, labels) {
+  if (connector.target === "google" && labels.submitGoogle) return labels.submitGoogle;
+  if (connector.target === "github" && labels.submitGithub) return labels.submitGithub;
+  return connector.name;
+}
+function cx(...parts) {
+  return parts.filter(Boolean).join(" ");
+}
+function HeadlessLoginPanel({
+  config,
+  productName,
+  logoSrc,
+  labels: labelsProp,
+  returnUrl,
+  mode = "popup",
+  showSocialConnectors = true,
+  socialProviders = "auto",
+  showCancel,
+  onCancel,
+  onOidcSession,
+  onExperienceRedirect,
+  footer,
+  className,
+  style,
+  themeColor = DEFAULT_LOGIN_THEME_COLOR
+}) {
+  const labels = { ...defaults, ...labelsProp };
+  const configured = isIdpConfigured(config);
+  const [identifier, setIdentifier] = react.useState("");
+  const [password, setPassword] = react.useState("");
+  const [passwordVisible, setPasswordVisible] = react.useState(false);
+  const panelStyle = {
+    ...style,
+    ["--lw-auth-theme"]: themeColor || DEFAULT_LOGIN_THEME_COLOR
+  };
+  const [loading, setLoading] = react.useState(null);
+  const [error, setError] = react.useState("");
+  const [connectors, setConnectors] = react.useState([]);
+  const socialEnabled = showSocialConnectors !== false && !(Array.isArray(socialProviders) && socialProviders.length === 0);
+  react.useEffect(() => {
+    const resetBusy = () => setLoading(null);
+    window.addEventListener("pageshow", resetBusy);
+    window.addEventListener("popstate", resetBusy);
+    return () => {
+      window.removeEventListener("pageshow", resetBusy);
+      window.removeEventListener("popstate", resetBusy);
+    };
+  }, []);
+  react.useEffect(() => {
+    if (!socialEnabled) {
+      setConnectors([]);
+      return;
+    }
+    let cancelled = false;
+    const sieBase = resolveSieBase(config);
+    const allowlist = socialProviders === "auto" || socialProviders === void 0 ? null : new Set(socialProviders.map((t) => t.toLowerCase()));
+    const apply = (list) => {
+      const filtered = allowlist ? list.filter((c) => allowlist.has(c.target.toLowerCase())) : list;
+      if (!cancelled) setConnectors(filtered);
+    };
+    if (!sieBase) {
+      apply(
+        allowlist ? FALLBACK_SOCIAL.filter((c) => allowlist.has(c.target)) : FALLBACK_SOCIAL
+      );
+      return;
+    }
+    void fetchSocialConnectors({ apiBase: sieBase, appId: config.clientId }).then((list) => {
+      if (list.length) {
+        apply(list);
+        return;
+      }
+      apply(
+        allowlist ? FALLBACK_SOCIAL.filter((c) => allowlist.has(c.target)) : FALLBACK_SOCIAL
+      );
+    }).catch(() => {
+      apply(
+        allowlist ? FALLBACK_SOCIAL.filter((c) => allowlist.has(c.target)) : FALLBACK_SOCIAL
+      );
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [config.clientId, config.experienceApiBase, config.issuer, socialEnabled, socialProviders]);
+  const runOidc = async (directSignIn) => {
+    if (!configured) throw new Error("IdP not configured");
+    if (mode === "redirect") {
+      await signInRedirect(config, { returnUrl, directSignIn });
+      return;
+    }
+    const { session, returnUrl: next } = await signInPopup(config, { returnUrl, directSignIn });
+    await onOidcSession?.(session, next);
+  };
+  const runSocial = async (target) => {
+    setError("");
+    setLoading(target);
+    try {
+      await runOidc(`social:${target}`);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+      setLoading(null);
+    }
+  };
+  const followExperienceRedirect = (redirectTo) => {
+    if (onExperienceRedirect) {
+      onExperienceRedirect(redirectTo);
+      return;
+    }
+    window.location.assign(redirectTo);
+  };
+  const runPassword = async (event) => {
+    event.preventDefault();
+    if (!configured) return;
+    setError("");
+    setLoading("password");
+    try {
+      const apiBase = config.experienceApiBase?.trim();
+      if (!apiBase) {
+        throw new Error(labels.experienceUnavailable);
+      }
+      const result = await experiencePasswordSignIn({
+        apiBase,
+        identifier: identifier.trim(),
+        password,
+        issuer: config.issuer,
+        clientId: config.clientId,
+        redirectUri: config.redirectUri,
+        audience: config.audience,
+        scopes: config.scopes,
+        returnUrl
+      });
+      if (result.redirectTo) {
+        followExperienceRedirect(result.redirectTo);
+        return;
+      }
+      throw new Error("Experience API did not return redirectTo");
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+      setLoading(null);
+    }
+  };
+  const busy = loading !== null;
+  const showSocial = socialEnabled && connectors.length > 0;
+  const showHint = Boolean(labelsProp?.hint) || showSocial;
+  return /* @__PURE__ */ jsxRuntime.jsxs("div", { className: cx(HeadlessLoginPanel_module_default.panel, className), style: panelStyle, children: [
+    /* @__PURE__ */ jsxRuntime.jsxs("header", { className: HeadlessLoginPanel_module_default.brand, children: [
+      logoSrc ? /* @__PURE__ */ jsxRuntime.jsx("img", { src: logoSrc, alt: "", width: 48, height: 48, className: HeadlessLoginPanel_module_default.logo }) : null,
+      /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
+        /* @__PURE__ */ jsxRuntime.jsx("p", { className: HeadlessLoginPanel_module_default.product, children: productName }),
+        /* @__PURE__ */ jsxRuntime.jsx("h2", { className: HeadlessLoginPanel_module_default.title, children: labels.title })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxRuntime.jsx("p", { className: HeadlessLoginPanel_module_default.subtitle, children: labels.subtitle }),
+    configured ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+      /* @__PURE__ */ jsxRuntime.jsxs("form", { onSubmit: (e) => void runPassword(e), className: HeadlessLoginPanel_module_default.form, children: [
+        /* @__PURE__ */ jsxRuntime.jsx(
+          "input",
+          {
+            type: "text",
+            name: "identifier",
+            autoComplete: "username",
+            placeholder: labels.identifierPlaceholder,
+            value: identifier,
+            onChange: (e) => setIdentifier(e.target.value),
+            className: HeadlessLoginPanel_module_default.input,
+            disabled: busy
+          }
+        ),
+        /* @__PURE__ */ jsxRuntime.jsxs("div", { className: HeadlessLoginPanel_module_default.passwordField, children: [
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "input",
+            {
+              type: passwordVisible ? "text" : "password",
+              name: "password",
+              autoComplete: "current-password",
+              placeholder: labels.passwordPlaceholder,
+              value: password,
+              onChange: (e) => setPassword(e.target.value),
+              className: cx(HeadlessLoginPanel_module_default.input, HeadlessLoginPanel_module_default.passwordInput),
+              disabled: busy
+            }
+          ),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "button",
+            {
+              type: "button",
+              className: HeadlessLoginPanel_module_default.passwordToggle,
+              disabled: busy,
+              "aria-label": passwordVisible ? labels.hidePassword : labels.showPassword,
+              "aria-pressed": passwordVisible,
+              onClick: () => setPasswordVisible((v) => !v),
+              children: /* @__PURE__ */ jsxRuntime.jsx(PasswordVisibilityIcon, { visible: passwordVisible })
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", className: HeadlessLoginPanel_module_default.primaryBtn, disabled: busy || !identifier || !password, children: loading === "password" ? "\u2026" : labels.submitPassword })
+      ] }),
+      showHint ? /* @__PURE__ */ jsxRuntime.jsx("p", { className: HeadlessLoginPanel_module_default.hint, children: labels.hint }) : null,
+      showSocial ? /* @__PURE__ */ jsxRuntime.jsxs("div", { className: HeadlessLoginPanel_module_default.divider, "aria-hidden": true, children: [
+        /* @__PURE__ */ jsxRuntime.jsx("span", { className: HeadlessLoginPanel_module_default.dividerLine }),
+        /* @__PURE__ */ jsxRuntime.jsx("span", { className: HeadlessLoginPanel_module_default.dividerText, children: labels.socialDivider }),
+        /* @__PURE__ */ jsxRuntime.jsx("span", { className: HeadlessLoginPanel_module_default.dividerLine })
+      ] }) : null,
+      showSocial ? /* @__PURE__ */ jsxRuntime.jsx("div", { className: HeadlessLoginPanel_module_default.socialStack, children: connectors.map((connector) => /* @__PURE__ */ jsxRuntime.jsxs(
+        "button",
+        {
+          type: "button",
+          className: HeadlessLoginPanel_module_default.socialBtn,
+          disabled: busy,
+          onClick: () => void runSocial(connector.target),
+          children: [
+            /* @__PURE__ */ jsxRuntime.jsx(SocialLogo, { connector }),
+            loading === connector.target ? "\u2026" : labelFor(connector, labels)
+          ]
+        },
+        connector.id
+      )) }) : null
+    ] }) : /* @__PURE__ */ jsxRuntime.jsx("p", { className: HeadlessLoginPanel_module_default.error, children: "IdP is not configured (issuer / clientId / redirectUri)." }),
+    error ? /* @__PURE__ */ jsxRuntime.jsx("p", { className: HeadlessLoginPanel_module_default.error, children: error }) : null,
+    showCancel ? /* @__PURE__ */ jsxRuntime.jsx("button", { type: "button", className: HeadlessLoginPanel_module_default.cancelBtn, disabled: busy, onClick: onCancel, children: labels.cancel }) : null,
+    footer ? /* @__PURE__ */ jsxRuntime.jsx("footer", { className: HeadlessLoginPanel_module_default.footer, children: footer }) : null
+  ] });
+}
+function SocialLogo({ connector }) {
+  if (connector.logo) {
+    return /* @__PURE__ */ jsxRuntime.jsx("img", { src: connector.logo, alt: "", width: 18, height: 18, className: HeadlessLoginPanel_module_default.socialLogo });
+  }
+  return /* @__PURE__ */ jsxRuntime.jsx("span", { className: HeadlessLoginPanel_module_default.logoFallback, "aria-hidden": true, children: connector.name.slice(0, 1).toUpperCase() });
+}
+function PasswordVisibilityIcon({ visible }) {
+  if (visible) {
+    return /* @__PURE__ */ jsxRuntime.jsx("svg", { width: "18", height: "18", viewBox: "0 0 1024 1024", fill: "currentColor", "aria-hidden": true, children: /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M942.2 486.2C847.4 286.5 704.1 186 512 186c-57.9 0-111.5 9.8-160.3 27.7l72.3 72.3C457 273.3 483.5 266 512 266c161.3 0 279.4 81.8 362.7 254-26.3 54.4-57.5 100.2-93.3 136.1l59.6 59.6C891.4 655.7 932.5 578.5 942.2 537.7a60.3 60.3 0 000-51.5zM336.6 278.6l-59.9-59.9C230.6 255.4 182.8 296.4 141.9 348.1 95.4 412.1 64.6 486.5 51.8 512a60.3 60.3 0 000 51.5C115.3 719.5 224.6 814.8 365.4 860.1l72.5-72.5C353.6 761.6 286.3 698.3 241.3 612.5 220.6 573.1 205 528.6 194.5 486.2c24.5-50.4 55.1-92.1 90.8-124.9l51.3-51.3zM606.6 556.6A112 112 0 01467.4 417.4L606.6 556.6zM508 624c-26.5 0-50.9-9.2-70.2-24.6l-59.9 59.9A175.3 175.3 0 00508 688c97.2 0 176-78.8 176-176 0-26.5-9.2-50.9-24.6-70.2l-59.9 59.9c15.4 19.3 24.6 43.7 24.6 70.2 0 61.9-50.1 112-112 112zM880 112L112 880l48 48 768-768z" }) });
+  }
+  return /* @__PURE__ */ jsxRuntime.jsxs("svg", { width: "18", height: "18", viewBox: "0 0 1024 1024", fill: "currentColor", "aria-hidden": true, children: [
+    /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M942.2 486.2C847.4 286.5 704.1 186 512 186c-192.2 0-335.4 100.5-430.2 300.3a60.3 60.3 0 000 51.5C176.6 737.5 319.9 838 512 838c192.2 0 335.4-100.5 430.2-300.3a60.3 60.3 0 000-51.5zM512 766c-161.3 0-279.4-81.8-362.7-254C232.6 339.8 350.7 258 512 258c161.3 0 279.4 81.8 362.7 254C791.5 684.2 673.4 766 512 766z" }),
+    /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M508 336c-97.2 0-176 78.8-176 176s78.8 176 176 176 176-78.8 176-176-78.8-176-176-176zm0 288c-61.9 0-112-50.1-112-112s50.1-112 112-112 112 50.1 112 112-50.1 112-112 112z" })
+  ] });
+}
+function ReauthOverlay({
+  config,
+  productName,
+  logoSrc,
+  labels,
+  returnUrl,
+  themeColor,
+  onOidcSession,
+  children,
+  dismissible = true,
+  onDismiss
+}) {
+  const snapshot = react.useSyncExternalStore(authGate.subscribe, authGate.getSnapshot, authGate.getSnapshot);
+  if (snapshot.phase === "idle") return null;
+  const resolvedReturnUrl = returnUrl ?? (() => {
+    if (typeof window === "undefined") return void 0;
+    const hash = window.location.hash.replace(/^#/, "");
+    if (!hash || hash.startsWith("/login") || hash.startsWith("/auth/")) return void 0;
+    return hash.startsWith("/") ? hash : `/${hash}`;
+  })();
+  const handleSession = async (session, next) => {
+    await onOidcSession(session, next);
+    authGate.completeReauth();
+  };
+  const handleCancel = () => {
+    onDismiss?.();
+    authGate.cancelReauth("cancelled");
+  };
+  return /* @__PURE__ */ jsxRuntime.jsx(
+    "div",
+    {
+      role: "dialog",
+      "aria-modal": "true",
+      "aria-label": productName,
+      style: backdropStyle,
+      onClick: dismissible ? handleCancel : void 0,
+      children: /* @__PURE__ */ jsxRuntime.jsx("div", { style: centerStyle, onClick: (e) => e.stopPropagation(), children: snapshot.phase === "refreshing" ? /* @__PURE__ */ jsxRuntime.jsxs("div", { style: spinnerCardStyle, children: [
+        /* @__PURE__ */ jsxRuntime.jsx("div", { style: spinnerStyle }),
+        /* @__PURE__ */ jsxRuntime.jsx("p", { style: { margin: 0, color: "#e8eef2" }, children: "Refreshing session\u2026" })
+      ] }) : children ? children : /* @__PURE__ */ jsxRuntime.jsx(
+        HeadlessLoginPanel,
+        {
+          config,
+          productName,
+          logoSrc,
+          themeColor,
+          labels: {
+            title: labels?.title ?? "Session expired",
+            subtitle: labels?.subtitle ?? "Sign in again to keep working \u2014 this page will not reload.",
+            ...labels
+          },
+          returnUrl: resolvedReturnUrl,
+          mode: "popup",
+          showCancel: dismissible,
+          onCancel: handleCancel,
+          onOidcSession: handleSession
+        }
+      ) })
+    }
+  );
+}
+var backdropStyle = {
+  position: "fixed",
+  inset: 0,
+  zIndex: 1e4,
+  display: "flex",
+  alignItems: "center",
+  justifyContent: "center",
+  padding: 24,
+  background: "radial-gradient(1200px 600px at 20% 10%, rgba(56, 120, 150, 0.35), transparent 55%), rgba(10, 18, 24, 0.72)",
+  backdropFilter: "blur(6px)"
+};
+var centerStyle = {
+  width: "min(100%, 420px)"
+};
+var spinnerCardStyle = {
+  display: "grid",
+  justifyItems: "center",
+  gap: 14,
+  padding: 28,
+  borderRadius: 16,
+  background: "rgba(20, 32, 40, 0.88)"
+};
+var spinnerStyle = {
+  width: 36,
+  height: 36,
+  borderRadius: "50%",
+  border: "3px solid rgba(255,255,255,0.2)",
+  borderTopColor: "#7ec8e3",
+  animation: "luminary-auth-spin 0.8s linear infinite"
+};
+if (typeof document !== "undefined" && !document.getElementById("luminary-auth-spin-style")) {
+  const style = document.createElement("style");
+  style.id = "luminary-auth-spin-style";
+  style.textContent = `@keyframes luminary-auth-spin { to { transform: rotate(360deg); } }`;
+  document.head.appendChild(style);
+}
+var AuthGateContext = react.createContext(null);
+function AuthGateProvider({
+  children,
+  tryRefresh,
+  onReauthRequired,
+  onSettled,
+  overlay
+}) {
+  react.useEffect(() => {
+    authGate.configure({ tryRefresh, onReauthRequired, onSettled });
+  }, [tryRefresh, onReauthRequired, onSettled]);
+  const snapshot = react.useSyncExternalStore(authGate.subscribe, authGate.getSnapshot, authGate.getSnapshot);
+  const value = react.useMemo(
+    () => ({
+      snapshot,
+      requestReauth: (message) => authGate.requestReauth(message),
+      completeReauth: () => authGate.completeReauth(),
+      cancelReauth: (message) => authGate.cancelReauth(message)
+    }),
+    [snapshot]
+  );
+  return /* @__PURE__ */ jsxRuntime.jsxs(AuthGateContext.Provider, { value, children: [
+    children,
+    overlay ? /* @__PURE__ */ jsxRuntime.jsx(ReauthOverlay, { ...overlay }) : null
+  ] });
+}
+function useAuthGate() {
+  const ctx = react.useContext(AuthGateContext);
+  if (!ctx) throw new Error("useAuthGate must be used within AuthGateProvider");
+  return ctx;
+}
+function useAuthGateOptional() {
+  return react.useContext(AuthGateContext);
+}
+
+// src/post-login-path.ts
+var DEFAULT_UNSAFE = ["/login", "/auth", "/exception"];
+function normalizeAppPath(path, fallback) {
+  const raw = path.replace(/^#/, "").trim();
+  if (!raw) return fallback.startsWith("/") ? fallback : `/${fallback}`;
+  return raw.startsWith("/") ? raw : `/${raw}`;
+}
+function isUnsafeReturnPath(path, unsafePrefixes, fallback) {
+  const p = normalizeAppPath(path, fallback);
+  if (p === "/") return true;
+  return unsafePrefixes.some((prefix) => p === prefix || p.startsWith(`${prefix}/`) || p.startsWith(prefix));
+}
+function createPostLoginPathHelpers(options) {
+  const storageKey2 = options.storageKey;
+  const defaultPath = options.defaultPath?.startsWith("/") ? options.defaultPath : `/${options.defaultPath || "home"}`;
+  const unsafePrefixes = [...DEFAULT_UNSAFE, ...options.unsafePrefixes || []];
+  function rememberPostLoginPath(path) {
+    const normalized = normalizeAppPath(path, defaultPath);
+    if (isUnsafeReturnPath(normalized, unsafePrefixes, defaultPath)) return;
+    try {
+      sessionStorage.setItem(storageKey2, normalized);
+    } catch {
+    }
+  }
+  function peekPostLoginPath() {
+    try {
+      const v = sessionStorage.getItem(storageKey2);
+      if (!v || isUnsafeReturnPath(v, unsafePrefixes, defaultPath)) return void 0;
+      return normalizeAppPath(v, defaultPath);
+    } catch {
+      return void 0;
+    }
+  }
+  function consumePostLoginPath(fallback = defaultPath) {
+    const remembered = peekPostLoginPath();
+    try {
+      sessionStorage.removeItem(storageKey2);
+    } catch {
+    }
+    return remembered ?? normalizeAppPath(fallback, defaultPath);
+  }
+  return {
+    rememberPostLoginPath,
+    peekPostLoginPath,
+    consumePostLoginPath,
+    normalizeAppPath: (path) => normalizeAppPath(path, defaultPath),
+    isUnsafeReturnPath: (path) => isUnsafeReturnPath(path, unsafePrefixes, defaultPath)
+  };
+}
+
+exports.AuthGateProvider = AuthGateProvider;
+exports.DEFAULT_LOGIN_THEME_COLOR = DEFAULT_LOGIN_THEME_COLOR;
+exports.HeadlessLoginPanel = HeadlessLoginPanel;
+exports.LuminaryAuthProvider = LuminaryAuthProvider;
+exports.ReauthOverlay = ReauthOverlay;
+exports.authGate = authGate;
+exports.clearStoredSession = clearStoredSession;
+exports.createPostLoginPathHelpers = createPostLoginPathHelpers;
+exports.createUserManager = createUserManager;
+exports.experiencePasswordSignIn = experiencePasswordSignIn;
+exports.fetchSocialConnectors = fetchSocialConnectors;
+exports.getCurrentUser = getCurrentUser;
+exports.getStoredAccessToken = getStoredAccessToken;
+exports.handleSignInCallback = handleSignInCallback;
+exports.handleSignInPopupCallback = handleSignInPopupCallback;
+exports.isIdpConfigured = isIdpConfigured;
+exports.isOidcPopupWindow = isOidcPopupWindow;
+exports.prepareSignInRequestUrl = prepareSignInRequestUrl;
+exports.readIdpConfigFromEnv = readIdpConfigFromEnv;
+exports.resetUserManager = resetUserManager;
+exports.resolveExperienceApiBase = resolveExperienceApiBase;
+exports.resolveIssuer = resolveIssuer;
+exports.sameOriginAuthorizeUrl = sameOriginAuthorizeUrl;
+exports.signInPopup = signInPopup;
+exports.signInRedirect = signInRedirect;
+exports.signOutRedirect = signOutRedirect;
+exports.useAuthGate = useAuthGate;
+exports.useAuthGateOptional = useAuthGateOptional;
+exports.useLuminaryAuth = useLuminaryAuth;
+exports.withAuthGateRetry = withAuthGateRetry;
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map