@nexartis/sentinel-sdk 1.6.0

package/dist/sveltekit/pages/index.d.ts

@@ -0,0 +1,68 @@
+export interface MagicLinkResult {
+    success: boolean;
+    crossBrowser?: boolean;
+}
+/**
+ * Handles the magic link page load.
+ * TWO-STEP process: completePasswordless() → claimTokens()
+ *
+ * Usage in +page.server.ts:
+ * ```typescript
+ * import { handleMagicLink } from '@nexartis/sentinel-sdk/sveltekit/pages';
+ *
+ * export const load: PageServerLoad = async (event) => {
+ *   return handleMagicLink(event);
+ * };
+ * ```
+ */
+export declare function handleMagicLink(event: {
+    url: URL;
+    fetch: typeof globalThis.fetch;
+    cookies: any;
+    platform?: any;
+}): Promise<never>;
+/**
+ * Handles the email verification page load.
+ *
+ * **Breaking change (v1.1):** Now requires `cookies` on the event object
+ * (previously only needed `url`, `fetch`, `platform`).
+ *
+ * Usage in +page.server.ts:
+ * ```typescript
+ * import { handleVerifyEmail } from '@nexartis/sentinel-sdk/sveltekit/pages';
+ *
+ * export const load: PageServerLoad = async (event) => {
+ *   return handleVerifyEmail(event);
+ * };
+ * ```
+ */
+export declare function handleVerifyEmail(event: {
+    url: URL;
+    fetch: typeof globalThis.fetch;
+    cookies: any;
+    platform?: any;
+}): Promise<never>;
+/**
+ * Handles the verified intermediate page load.
+ * Reads tokens from short-lived httpOnly cookies (set by handleVerifyEmail),
+ * validates the access token, then establishes the session.
+ *
+ * **Breaking change (v1.1):** Now requires `fetch` and `platform` on the event
+ * object (previously only needed `url` and `cookies`) for server-side token validation.
+ *
+ * Usage in +page.server.ts:
+ * ```typescript
+ * import { handleVerified } from '@nexartis/sentinel-sdk/sveltekit/pages';
+ *
+ * export const load: PageServerLoad = async (event) => {
+ *   return handleVerified(event);
+ * };
+ * ```
+ */
+export declare function handleVerified(event: {
+    url: URL;
+    cookies: any;
+    fetch: typeof globalThis.fetch;
+    platform?: any;
+}): Promise<never>;
+//# sourceMappingURL=index.d.ts.map

package/dist/sveltekit/pages/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/sveltekit/pages/index.ts"],"names":[],"mappings":"AA0BA,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC5C,GAAG,EAAE,GAAG,CAAC;IACT,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC/B,OAAO,EAAE,GAAG,CAAC;IACb,QAAQ,CAAC,EAAE,GAAG,CAAC;CACf,GAAG,OAAO,CAAC,KAAK,CAAC,CAwDjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC9C,GAAG,EAAE,GAAG,CAAC;IACT,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC/B,OAAO,EAAE,GAAG,CAAC;IACb,QAAQ,CAAC,EAAE,GAAG,CAAC;CACf,GAAG,OAAO,CAAC,KAAK,CAAC,CA2CjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE;IAC3C,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,GAAG,CAAC;IACb,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC/B,QAAQ,CAAC,EAAE,GAAG,CAAC;CACf,GAAG,OAAO,CAAC,KAAK,CAAC,CAgDjB"}

package/dist/sveltekit/pages/index.js

@@ -0,0 +1,207 @@
+// src/sveltekit/pages/index.ts
+import { redirect } from '@sveltejs/kit';
+import { SentinelClient } from '../../core/client.js';
+import { setSessionCookies, COOKIE_NAMES, COOKIE_OPTIONS } from '../cookies.js';
+import { getConfigFromPlatform, clearLoginCookies } from '../utils.js';
+import { validateToken } from '../../core/auth-utils.js';
+/** Sanitise a redirect path to prevent open-redirect via env misconfiguration. */
+function safeRedirectPath(raw) {
+    const path = (raw || '/').trim();
+    if (/^[/\\]{2}/.test(path) || /^[a-z][a-z0-9+.-]*:/i.test(path))
+        return '/';
+    return path.startsWith('/') ? path : '/';
+}
+/**
+ * Detects SvelteKit redirects using ALL THREE methods.
+ * CRITICAL: SvelteKit's Redirect object is NOT an instance of Response.
+ */
+function isRedirectError(error) {
+    return (error instanceof Response ||
+        (error !== null && typeof error === 'object' && error.constructor?.name === 'Redirect') ||
+        (error !== null && typeof error === 'object' && 'status' in error && 'location' in error));
+}
+/**
+ * Handles the magic link page load.
+ * TWO-STEP process: completePasswordless() → claimTokens()
+ *
+ * Usage in +page.server.ts:
+ * ```typescript
+ * import { handleMagicLink } from '@nexartis/sentinel-sdk/sveltekit/pages';
+ *
+ * export const load: PageServerLoad = async (event) => {
+ *   return handleMagicLink(event);
+ * };
+ * ```
+ */
+export async function handleMagicLink(event) {
+    const magicToken = event.url.searchParams.get('token');
+    if (!magicToken) {
+        throw redirect(302, '/auth?error=invalid_link');
+    }
+    const config = getConfigFromPlatform(event.platform);
+    const sentinel = new SentinelClient(config, event.fetch);
+    try {
+        // Step 1: Complete the passwordless login (marks token as used)
+        const result = await sentinel.completePasswordless(magicToken);
+        if (result.code === 0 || result.success) {
+            // completePasswordless() only returns { code, message }
+            // It does NOT return tokens - those must be claimed separately
+            const transactionId = event.cookies.get('login_transaction_id');
+            const clientToken = event.cookies.get('login_client_token');
+            const rememberMe = event.cookies.get('login_remember_me') === 'true';
+            // Check if this is the same browser that initiated the login
+            if (!transactionId || !clientToken) {
+                // Different browser - show success message
+                throw redirect(302, '/auth?success=magic_link_clicked');
+            }
+            // Same browser - claim tokens immediately
+            // Step 2: Claim the tokens
+            const claimResult = await sentinel.claimTokens(transactionId, clientToken);
+            if (claimResult.code === 0 || claimResult.success) {
+                if (claimResult.access_token && claimResult.refresh_token) {
+                    const postAuthRedirect = safeRedirectPath(event.platform?.env?.SENTINEL_POST_AUTH_REDIRECT);
+                    setSessionCookies(event.cookies, claimResult.access_token, claimResult.refresh_token, rememberMe);
+                    clearLoginCookies(event.cookies);
+                    throw redirect(303, postAuthRedirect);
+                }
+                else {
+                    throw redirect(302, '/auth?error=no_tokens');
+                }
+            }
+            else {
+                throw redirect(302, '/auth?error=claim_failed');
+            }
+        }
+        else {
+            throw redirect(302, '/auth?error=magic_link_failed');
+        }
+    }
+    catch (error) {
+        // CRITICAL: Detect redirects using ALL three methods
+        if (isRedirectError(error)) {
+            throw error; // Re-throw immediately
+        }
+        console.error('Magic link error:', error);
+        throw redirect(302, '/auth?error=magic_link_failed');
+    }
+}
+/**
+ * Handles the email verification page load.
+ *
+ * **Breaking change (v1.1):** Now requires `cookies` on the event object
+ * (previously only needed `url`, `fetch`, `platform`).
+ *
+ * Usage in +page.server.ts:
+ * ```typescript
+ * import { handleVerifyEmail } from '@nexartis/sentinel-sdk/sveltekit/pages';
+ *
+ * export const load: PageServerLoad = async (event) => {
+ *   return handleVerifyEmail(event);
+ * };
+ * ```
+ */
+export async function handleVerifyEmail(event) {
+    const token = event.url.searchParams.get('token');
+    if (!token) {
+        throw redirect(302, '/auth?error=invalid_link');
+    }
+    const config = getConfigFromPlatform(event.platform);
+    const sentinel = new SentinelClient(config, event.fetch);
+    try {
+        const result = await sentinel.verifyEmail(token);
+        if (result.code === 0 || result.success) {
+            if (result.access_token && result.refresh_token) {
+                // SEC-001 fix: Set tokens in short-lived httpOnly cookies (NOT URL params).
+                // These are consumed immediately by handleVerified on /auth/verified.
+                event.cookies.set(COOKIE_NAMES.VERIFY_ACCESS_TOKEN, result.access_token, COOKIE_OPTIONS.VERIFY_TOKEN);
+                event.cookies.set(COOKIE_NAMES.VERIFY_REFRESH_TOKEN, result.refresh_token, COOKIE_OPTIONS.VERIFY_TOKEN);
+                throw redirect(303, '/auth/verified');
+            }
+            else {
+                // Success but no tokens — clear any stale verify cookies from prior attempts
+                event.cookies.delete(COOKIE_NAMES.VERIFY_ACCESS_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });
+                event.cookies.delete(COOKIE_NAMES.VERIFY_REFRESH_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });
+                throw redirect(302, '/auth?verified=true');
+            }
+        }
+        else {
+            // Clear any stale verify cookies from prior attempts
+            event.cookies.delete(COOKIE_NAMES.VERIFY_ACCESS_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });
+            event.cookies.delete(COOKIE_NAMES.VERIFY_REFRESH_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });
+            throw redirect(302, '/auth?error=verification_failed');
+        }
+    }
+    catch (error) {
+        if (isRedirectError(error)) {
+            throw error;
+        }
+        // Clear any stale verify cookies on error
+        event.cookies.delete(COOKIE_NAMES.VERIFY_ACCESS_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });
+        event.cookies.delete(COOKIE_NAMES.VERIFY_REFRESH_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });
+        console.error('Email verification error:', error);
+        throw redirect(302, '/auth?error=verification_failed');
+    }
+}
+/**
+ * Handles the verified intermediate page load.
+ * Reads tokens from short-lived httpOnly cookies (set by handleVerifyEmail),
+ * validates the access token, then establishes the session.
+ *
+ * **Breaking change (v1.1):** Now requires `fetch` and `platform` on the event
+ * object (previously only needed `url` and `cookies`) for server-side token validation.
+ *
+ * Usage in +page.server.ts:
+ * ```typescript
+ * import { handleVerified } from '@nexartis/sentinel-sdk/sveltekit/pages';
+ *
+ * export const load: PageServerLoad = async (event) => {
+ *   return handleVerified(event);
+ * };
+ * ```
+ */
+export async function handleVerified(event) {
+    const accessToken = event.cookies.get(COOKIE_NAMES.VERIFY_ACCESS_TOKEN);
+    const refreshToken = event.cookies.get(COOKIE_NAMES.VERIFY_REFRESH_TOKEN);
+    // Sanitize redirect target to prevent open-redirect attacks.
+    // Only allow relative paths starting with a single '/'. Reject protocol-relative
+    // URLs ('//evil.com'), absolute URLs ('https://evil.com'), backslash variants
+    // ('/\evil.com' which some user agents normalise to '//evil.com'), percent-encoded
+    // backslashes ('%5c' / '%5C' which browsers may decode and normalise the same way),
+    // and bare strings.
+    const rawRedirect = event.url.searchParams.get('redirect') || '/';
+    const redirectTo = (rawRedirect.startsWith('/') && !rawRedirect.startsWith('//') && !rawRedirect.includes('\\') && !rawRedirect.toLowerCase().includes('%5c')) ? rawRedirect : '/';
+    if (!accessToken || !refreshToken) {
+        // Clear any partial verify cookies to avoid stale state within the TTL
+        event.cookies.delete(COOKIE_NAMES.VERIFY_ACCESS_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });
+        event.cookies.delete(COOKIE_NAMES.VERIFY_REFRESH_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });
+        throw redirect(302, '/auth?error=invalid_verification');
+    }
+    // SEC-002 fix: Validate the token before consuming the cookies.
+    // On transient network/API failures, leave cookies intact so the user can
+    // retry within the 60s TTL without re-running the entire verification flow.
+    const config = getConfigFromPlatform(event.platform);
+    let decoded;
+    try {
+        decoded = await validateToken(accessToken, event.fetch, config);
+    }
+    catch {
+        // Transient error — preserve cookies for retry
+        throw redirect(302, '/auth?error=verification_error');
+    }
+    if (!decoded) {
+        // Definitively invalid token — clear cookies, no point retrying
+        event.cookies.delete(COOKIE_NAMES.VERIFY_ACCESS_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });
+        event.cookies.delete(COOKIE_NAMES.VERIFY_REFRESH_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });
+        throw redirect(302, '/auth?error=invalid_verification');
+    }
+    // Consume single-use verification cookies after successful validation
+    event.cookies.delete(COOKIE_NAMES.VERIFY_ACCESS_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });
+    event.cookies.delete(COOKIE_NAMES.VERIFY_REFRESH_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });
+    // rememberMe=true is intentional: email verification proves device trust.
+    // The original registration form's rememberMe preference cannot be reliably
+    // carried through the async email verification flow. (ARCH-004)
+    setSessionCookies(event.cookies, accessToken, refreshToken, true);
+    // Redirect to destination
+    throw redirect(303, redirectTo);
+}
+//# sourceMappingURL=index.js.map

package/dist/sveltekit/pages/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/sveltekit/pages/index.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,kFAAkF;AAClF,SAAS,gBAAgB,CAAC,GAAuB;IAChD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAC5E,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,KAAc;IACtC,OAAO,CACN,KAAK,YAAY,QAAQ;QACzB,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAa,CAAC,WAAW,EAAE,IAAI,KAAK,UAAU,CAAC;QAChG,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,IAAI,UAAU,IAAI,KAAK,CAAC,CACzF,CAAC;AACH,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAKrC;IACA,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEvD,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAEzD,IAAI,CAAC;QACJ,gEAAgE;QAChE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAE/D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACzC,wDAAwD;YACxD,+DAA+D;YAE/D,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YAChE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,MAAM,CAAC;YAErE,6DAA6D;YAC7D,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpC,2CAA2C;gBAC3C,MAAM,QAAQ,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;YACzD,CAAC;YAED,0CAA0C;YAC1C,2BAA2B;YAC3B,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;YAE3E,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;gBACnD,IAAI,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;oBAC3D,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAC;oBAC5F,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;oBAClG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACjC,MAAM,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;gBACvC,CAAC;qBAAM,CAAC;oBACP,MAAM,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;gBAC9C,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,MAAM,QAAQ,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;YACjD,CAAC;QACF,CAAC;aAAM,CAAC;YACP,MAAM,QAAQ,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;QACtD,CAAC;IACF,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACzB,qDAAqD;QACrD,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,CAAC,CAAC,uBAAuB;QACrC,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,QAAQ,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;IACtD,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAKvC;IACA,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAElD,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,QAAQ,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAEzD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAEjD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACjD,4EAA4E;gBAC5E,sEAAsE;gBACtE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;gBACtG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;gBACxG,MAAM,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACP,6EAA6E;gBAC7E,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;gBACnG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;gBACpG,MAAM,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;YAC5C,CAAC;QACF,CAAC;aAAM,CAAC;YACP,qDAAqD;YACrD,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;YACnG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;YACpG,MAAM,QAAQ,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;QACxD,CAAC;IACF,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACzB,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,CAAC;QACb,CAAC;QAED,0CAA0C;QAC1C,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QACnG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QACpG,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,QAAQ,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IACxD,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAKpC;IACA,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC;IAC1E,6DAA6D;IAC7D,iFAAiF;IACjF,8EAA8E;IAC9E,mFAAmF;IACnF,oFAAoF;IACpF,oBAAoB;IACpB,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC;IAClE,MAAM,UAAU,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC;IAEnL,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,uEAAuE;QACvE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QACnG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QACpG,MAAM,QAAQ,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;IACzD,CAAC;IAED,gEAAgE;IAChE,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACR,+CAA+C;QAC/C,MAAM,QAAQ,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,gEAAgE;QAChE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QACnG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QACpG,MAAM,QAAQ,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;IACzD,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IACnG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAEpG,0EAA0E;IAC1E,4EAA4E;IAC5E,gEAAgE;IAChE,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IAElE,0BAA0B;IAC1B,MAAM,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AACjC,CAAC","sourcesContent":["// src/sveltekit/pages/index.ts\nimport { redirect } from '@sveltejs/kit';\nimport { SentinelClient } from '../../core/client.js';\nimport { setSessionCookies, COOKIE_NAMES, COOKIE_OPTIONS } from '../cookies.js';\nimport { getConfigFromPlatform, clearLoginCookies } from '../utils.js';\nimport { validateToken } from '../../core/auth-utils.js';\n\n/** Sanitise a redirect path to prevent open-redirect via env misconfiguration. */\nfunction safeRedirectPath(raw: string | undefined): string {\n\tconst path = (raw || '/').trim();\n\tif (/^[/\\\\]{2}/.test(path) || /^[a-z][a-z0-9+.-]*:/i.test(path)) return '/';\n\treturn path.startsWith('/') ? path : '/';\n}\n\n/**\n * Detects SvelteKit redirects using ALL THREE methods.\n * CRITICAL: SvelteKit's Redirect object is NOT an instance of Response.\n */\nfunction isRedirectError(error: unknown): boolean {\n\treturn (\n\t\terror instanceof Response ||\n\t\t(error !== null && typeof error === 'object' && (error as any).constructor?.name === 'Redirect') ||\n\t\t(error !== null && typeof error === 'object' && 'status' in error && 'location' in error)\n\t);\n}\n\nexport interface MagicLinkResult {\n\tsuccess: boolean;\n\tcrossBrowser?: boolean;\n}\n\n/**\n * Handles the magic link page load.\n * TWO-STEP process: completePasswordless() → claimTokens()\n * \n * Usage in +page.server.ts:\n * ```typescript\n * import { handleMagicLink } from '@nexartis/sentinel-sdk/sveltekit/pages';\n * \n * export const load: PageServerLoad = async (event) => {\n *   return handleMagicLink(event);\n * };\n * ```\n */\nexport async function handleMagicLink(event: {\n\turl: URL;\n\tfetch: typeof globalThis.fetch;\n\tcookies: any;\n\tplatform?: any;\n}): Promise<never> {\n\tconst magicToken = event.url.searchParams.get('token');\n\n\tif (!magicToken) {\n\t\tthrow redirect(302, '/auth?error=invalid_link');\n\t}\n\n\tconst config = getConfigFromPlatform(event.platform);\n\tconst sentinel = new SentinelClient(config, event.fetch);\n\n\ttry {\n\t\t// Step 1: Complete the passwordless login (marks token as used)\n\t\tconst result = await sentinel.completePasswordless(magicToken);\n\n\t\tif (result.code === 0 || result.success) {\n\t\t\t// completePasswordless() only returns { code, message }\n\t\t\t// It does NOT return tokens - those must be claimed separately\n\n\t\t\tconst transactionId = event.cookies.get('login_transaction_id');\n\t\t\tconst clientToken = event.cookies.get('login_client_token');\n\t\t\tconst rememberMe = event.cookies.get('login_remember_me') === 'true';\n\n\t\t\t// Check if this is the same browser that initiated the login\n\t\t\tif (!transactionId || !clientToken) {\n\t\t\t\t// Different browser - show success message\n\t\t\t\tthrow redirect(302, '/auth?success=magic_link_clicked');\n\t\t\t}\n\n\t\t\t// Same browser - claim tokens immediately\n\t\t\t// Step 2: Claim the tokens\n\t\t\tconst claimResult = await sentinel.claimTokens(transactionId, clientToken);\n\n\t\t\tif (claimResult.code === 0 || claimResult.success) {\n\t\t\t\tif (claimResult.access_token && claimResult.refresh_token) {\n\t\t\t\t\tconst postAuthRedirect = safeRedirectPath(event.platform?.env?.SENTINEL_POST_AUTH_REDIRECT);\n\t\t\t\t\tsetSessionCookies(event.cookies, claimResult.access_token, claimResult.refresh_token, rememberMe);\n\t\t\t\t\tclearLoginCookies(event.cookies);\n\t\t\t\t\tthrow redirect(303, postAuthRedirect);\n\t\t\t\t} else {\n\t\t\t\t\tthrow redirect(302, '/auth?error=no_tokens');\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tthrow redirect(302, '/auth?error=claim_failed');\n\t\t\t}\n\t\t} else {\n\t\t\tthrow redirect(302, '/auth?error=magic_link_failed');\n\t\t}\n\t} catch (error: unknown) {\n\t\t// CRITICAL: Detect redirects using ALL three methods\n\t\tif (isRedirectError(error)) {\n\t\t\tthrow error; // Re-throw immediately\n\t\t}\n\n\t\tconsole.error('Magic link error:', error);\n\t\tthrow redirect(302, '/auth?error=magic_link_failed');\n\t}\n}\n\n/**\n * Handles the email verification page load.\n * \n * **Breaking change (v1.1):** Now requires `cookies` on the event object\n * (previously only needed `url`, `fetch`, `platform`).\n *\n * Usage in +page.server.ts:\n * ```typescript\n * import { handleVerifyEmail } from '@nexartis/sentinel-sdk/sveltekit/pages';\n *\n * export const load: PageServerLoad = async (event) => {\n *   return handleVerifyEmail(event);\n * };\n * ```\n */\nexport async function handleVerifyEmail(event: {\n\turl: URL;\n\tfetch: typeof globalThis.fetch;\n\tcookies: any;\n\tplatform?: any;\n}): Promise<never> {\n\tconst token = event.url.searchParams.get('token');\n\n\tif (!token) {\n\t\tthrow redirect(302, '/auth?error=invalid_link');\n\t}\n\n\tconst config = getConfigFromPlatform(event.platform);\n\tconst sentinel = new SentinelClient(config, event.fetch);\n\n\ttry {\n\t\tconst result = await sentinel.verifyEmail(token);\n\n\t\tif (result.code === 0 || result.success) {\n\t\t\tif (result.access_token && result.refresh_token) {\n\t\t\t\t// SEC-001 fix: Set tokens in short-lived httpOnly cookies (NOT URL params).\n\t\t\t\t// These are consumed immediately by handleVerified on /auth/verified.\n\t\t\t\tevent.cookies.set(COOKIE_NAMES.VERIFY_ACCESS_TOKEN, result.access_token, COOKIE_OPTIONS.VERIFY_TOKEN);\n\t\t\t\tevent.cookies.set(COOKIE_NAMES.VERIFY_REFRESH_TOKEN, result.refresh_token, COOKIE_OPTIONS.VERIFY_TOKEN);\n\t\t\t\tthrow redirect(303, '/auth/verified');\n\t\t\t} else {\n\t\t\t\t// Success but no tokens — clear any stale verify cookies from prior attempts\n\t\t\t\tevent.cookies.delete(COOKIE_NAMES.VERIFY_ACCESS_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });\n\t\t\t\tevent.cookies.delete(COOKIE_NAMES.VERIFY_REFRESH_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });\n\t\t\t\tthrow redirect(302, '/auth?verified=true');\n\t\t\t}\n\t\t} else {\n\t\t\t// Clear any stale verify cookies from prior attempts\n\t\t\tevent.cookies.delete(COOKIE_NAMES.VERIFY_ACCESS_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });\n\t\t\tevent.cookies.delete(COOKIE_NAMES.VERIFY_REFRESH_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });\n\t\t\tthrow redirect(302, '/auth?error=verification_failed');\n\t\t}\n\t} catch (error: unknown) {\n\t\tif (isRedirectError(error)) {\n\t\t\tthrow error;\n\t\t}\n\n\t\t// Clear any stale verify cookies on error\n\t\tevent.cookies.delete(COOKIE_NAMES.VERIFY_ACCESS_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });\n\t\tevent.cookies.delete(COOKIE_NAMES.VERIFY_REFRESH_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });\n\t\tconsole.error('Email verification error:', error);\n\t\tthrow redirect(302, '/auth?error=verification_failed');\n\t}\n}\n\n/**\n * Handles the verified intermediate page load.\n * Reads tokens from short-lived httpOnly cookies (set by handleVerifyEmail),\n * validates the access token, then establishes the session.\n *\n * **Breaking change (v1.1):** Now requires `fetch` and `platform` on the event\n * object (previously only needed `url` and `cookies`) for server-side token validation.\n *\n * Usage in +page.server.ts:\n * ```typescript\n * import { handleVerified } from '@nexartis/sentinel-sdk/sveltekit/pages';\n *\n * export const load: PageServerLoad = async (event) => {\n *   return handleVerified(event);\n * };\n * ```\n */\nexport async function handleVerified(event: {\n\turl: URL;\n\tcookies: any;\n\tfetch: typeof globalThis.fetch;\n\tplatform?: any;\n}): Promise<never> {\n\tconst accessToken = event.cookies.get(COOKIE_NAMES.VERIFY_ACCESS_TOKEN);\n\tconst refreshToken = event.cookies.get(COOKIE_NAMES.VERIFY_REFRESH_TOKEN);\n\t// Sanitize redirect target to prevent open-redirect attacks.\n\t// Only allow relative paths starting with a single '/'. Reject protocol-relative\n\t// URLs ('//evil.com'), absolute URLs ('https://evil.com'), backslash variants\n\t// ('/\\evil.com' which some user agents normalise to '//evil.com'), percent-encoded\n\t// backslashes ('%5c' / '%5C' which browsers may decode and normalise the same way),\n\t// and bare strings.\n\tconst rawRedirect = event.url.searchParams.get('redirect') || '/';\n\tconst redirectTo = (rawRedirect.startsWith('/') && !rawRedirect.startsWith('//') && !rawRedirect.includes('\\\\') && !rawRedirect.toLowerCase().includes('%5c')) ? rawRedirect : '/';\n\n\tif (!accessToken || !refreshToken) {\n\t\t// Clear any partial verify cookies to avoid stale state within the TTL\n\t\tevent.cookies.delete(COOKIE_NAMES.VERIFY_ACCESS_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });\n\t\tevent.cookies.delete(COOKIE_NAMES.VERIFY_REFRESH_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });\n\t\tthrow redirect(302, '/auth?error=invalid_verification');\n\t}\n\n\t// SEC-002 fix: Validate the token before consuming the cookies.\n\t// On transient network/API failures, leave cookies intact so the user can\n\t// retry within the 60s TTL without re-running the entire verification flow.\n\tconst config = getConfigFromPlatform(event.platform);\n\tlet decoded;\n\ttry {\n\t\tdecoded = await validateToken(accessToken, event.fetch, config);\n\t} catch {\n\t\t// Transient error — preserve cookies for retry\n\t\tthrow redirect(302, '/auth?error=verification_error');\n\t}\n\tif (!decoded) {\n\t\t// Definitively invalid token — clear cookies, no point retrying\n\t\tevent.cookies.delete(COOKIE_NAMES.VERIFY_ACCESS_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });\n\t\tevent.cookies.delete(COOKIE_NAMES.VERIFY_REFRESH_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });\n\t\tthrow redirect(302, '/auth?error=invalid_verification');\n\t}\n\n\t// Consume single-use verification cookies after successful validation\n\tevent.cookies.delete(COOKIE_NAMES.VERIFY_ACCESS_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });\n\tevent.cookies.delete(COOKIE_NAMES.VERIFY_REFRESH_TOKEN, { path: COOKIE_OPTIONS.VERIFY_TOKEN.path });\n\n\t// rememberMe=true is intentional: email verification proves device trust.\n\t// The original registration form's rememberMe preference cannot be reliably\n\t// carried through the async email verification flow. (ARCH-004)\n\tsetSessionCookies(event.cookies, accessToken, refreshToken, true);\n\n\t// Redirect to destination\n\tthrow redirect(303, redirectTo);\n}\n\n"]}

package/dist/sveltekit/utils.d.ts

@@ -0,0 +1,17 @@
+import type { SentinelConfig } from '../core/types.js';
+/**
+ * Build SentinelConfig from platform environment variables.
+ * Shared across handlers and pages modules.
+ *
+ * Note: baseUrl may be empty here — that's expected. In Workers for Platforms
+ * deployments the cubi's createAuthHandle() (in hooks.server.ts) detects the
+ * request URL and writes it to platform.env.VITE_BASE_URL before the SDK's
+ * createSentinelHandle() runs. The SDK handle itself only reads the env var
+ * into a local config object and does NOT mutate platform.env.
+ */
+export declare function getConfigFromPlatform(platform?: any): SentinelConfig;
+/**
+ * Clear all login-flow cookies (transaction, client token, remember me, claim).
+ */
+export declare function clearLoginCookies(cookies: any): void;
+//# sourceMappingURL=utils.d.ts.map

package/dist/sveltekit/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/sveltekit/utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,cAAc,CAepE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,GAAG,GAAG,IAAI,CAKpD"}

package/dist/sveltekit/utils.js

@@ -0,0 +1,34 @@
+/**
+ * Build SentinelConfig from platform environment variables.
+ * Shared across handlers and pages modules.
+ *
+ * Note: baseUrl may be empty here — that's expected. In Workers for Platforms
+ * deployments the cubi's createAuthHandle() (in hooks.server.ts) detects the
+ * request URL and writes it to platform.env.VITE_BASE_URL before the SDK's
+ * createSentinelHandle() runs. The SDK handle itself only reads the env var
+ * into a local config object and does NOT mutate platform.env.
+ */
+export function getConfigFromPlatform(platform) {
+    let apiUrl = platform?.env?.SENTINEL_API_URL || '';
+    const baseUrl = platform?.env?.VITE_BASE_URL || '';
+    if (!apiUrl) {
+        throw new Error('SENTINEL_API_URL must be configured');
+    }
+    // Normalize: strip trailing slashes, then append /api if not already present
+    while (apiUrl.endsWith('/'))
+        apiUrl = apiUrl.slice(0, -1);
+    if (!apiUrl.endsWith('/api')) {
+        apiUrl = apiUrl + '/api';
+    }
+    return { apiUrl, baseUrl };
+}
+/**
+ * Clear all login-flow cookies (transaction, client token, remember me, claim).
+ */
+export function clearLoginCookies(cookies) {
+    cookies.delete('claim_transaction_id', { path: '/' });
+    cookies.delete('login_transaction_id', { path: '/' });
+    cookies.delete('login_client_token', { path: '/' });
+    cookies.delete('login_remember_me', { path: '/' });
+}
+//# sourceMappingURL=utils.js.map

package/dist/sveltekit/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/sveltekit/utils.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAc;IACnD,IAAI,MAAM,GAAG,QAAQ,EAAE,GAAG,EAAE,gBAAgB,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,QAAQ,EAAE,GAAG,EAAE,aAAa,IAAI,EAAE,CAAC;IAEnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxD,CAAC;IAED,6EAA6E;IAC7E,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAY;IAC7C,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IACtD,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IACtD,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;AACpD,CAAC","sourcesContent":["// src/sveltekit/utils.ts\nimport type { SentinelConfig } from '../core/types.js';\n\n/**\n * Build SentinelConfig from platform environment variables.\n * Shared across handlers and pages modules.\n *\n * Note: baseUrl may be empty here — that's expected. In Workers for Platforms\n * deployments the cubi's createAuthHandle() (in hooks.server.ts) detects the\n * request URL and writes it to platform.env.VITE_BASE_URL before the SDK's\n * createSentinelHandle() runs. The SDK handle itself only reads the env var\n * into a local config object and does NOT mutate platform.env.\n */\nexport function getConfigFromPlatform(platform?: any): SentinelConfig {\n\tlet apiUrl = platform?.env?.SENTINEL_API_URL || '';\n\tconst baseUrl = platform?.env?.VITE_BASE_URL || '';\n\n\tif (!apiUrl) {\n\t\tthrow new Error('SENTINEL_API_URL must be configured');\n\t}\n\n\t// Normalize: strip trailing slashes, then append /api if not already present\n\twhile (apiUrl.endsWith('/')) apiUrl = apiUrl.slice(0, -1);\n\tif (!apiUrl.endsWith('/api')) {\n\t\tapiUrl = apiUrl + '/api';\n\t}\n\n\treturn { apiUrl, baseUrl };\n}\n\n/**\n * Clear all login-flow cookies (transaction, client token, remember me, claim).\n */\nexport function clearLoginCookies(cookies: any): void {\n\tcookies.delete('claim_transaction_id', { path: '/' });\n\tcookies.delete('login_transaction_id', { path: '/' });\n\tcookies.delete('login_client_token', { path: '/' });\n\tcookies.delete('login_remember_me', { path: '/' });\n}\n\n"]}

package/package.json

@@ -0,0 +1,99 @@
+{
+  "name": "@nexartis/sentinel-sdk",
+  "version": "1.6.0",
+  "description": "Passwordless magic-link authentication SDK for SvelteKit — client for the hosted Nexartis Sentinel auth backend.",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Nexartis/sentinel-sdk.git"
+  },
+  "homepage": "https://github.com/Nexartis/sentinel-sdk#readme",
+  "bugs": {
+    "url": "https://github.com/Nexartis/sentinel-sdk/issues"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/core/index.js",
+  "types": "./dist/core/index.d.ts",
+  "exports": {
+    "./core": {
+      "types": "./dist/core/index.d.ts",
+      "import": "./dist/core/index.js"
+    },
+    "./sveltekit": {
+      "types": "./dist/sveltekit/index.d.ts",
+      "import": "./dist/sveltekit/index.js"
+    },
+    "./sveltekit/handlers": {
+      "types": "./dist/sveltekit/handlers/index.d.ts",
+      "import": "./dist/sveltekit/handlers/index.js"
+    },
+    "./sveltekit/client": {
+      "types": "./dist/sveltekit/client/index.d.ts",
+      "import": "./dist/sveltekit/client/index.js"
+    },
+    "./sveltekit/pages": {
+      "types": "./dist/sveltekit/pages/index.d.ts",
+      "import": "./dist/sveltekit/pages/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "check": "tsc --noEmit",
+    "dev": "tsc --watch",
+    "lint": "pnpm run check",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "validate": "pnpm run check && pnpm run test && pnpm run build",
+    "prepublishOnly": "pnpm run build"
+  },
+  "keywords": [
+    "sentinel",
+    "auth",
+    "authentication",
+    "sveltekit",
+    "svelte",
+    "passwordless",
+    "magic-link",
+    "jwt",
+    "nexartis"
+  ],
+  "author": "Nexartis",
+  "license": "Apache-2.0",
+  "peerDependencies": {
+    "@sveltejs/kit": "^2.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@sveltejs/kit": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@sveltejs/kit": "^2.66.0",
+    "svelte": "^5.56.3",
+    "typescript": "^5.0.0",
+    "vite": "^7.3.5",
+    "vitest": "^4.1.9"
+  },
+  "pnpm": {
+    "overrides": {
+      "cookie": "^1.0.0",
+      "svelte": ">=5.56.3",
+      "vite": "^7.3.5",
+      "esbuild": ">=0.28.1",
+      "picomatch": "^4.0.4",
+      "devalue": ">=5.8.1",
+      "postcss": ">=8.5.10"
+    }
+  },
+  "engines": {
+    "node": ">=20.0.0",
+    "pnpm": ">=10.0.0"
+  },
+  "packageManager": "pnpm@10.28.1"
+}