@nominalso/vibe-auth 0.2.0

package/dist/index.js

@@ -0,0 +1,695 @@
+'use client';
+
+// src/config.ts
+var DEFAULT_TIMEOUTS = {
+  silentIframeMs: 1e4,
+  silentFlowCapMs: 15e3,
+  oauthCompletionMs: 15e3,
+  popupMs: 12e4,
+  previewPrimingMs: 8e3,
+  previewPrimingPollMs: 250
+};
+function resolveConfig(config) {
+  const callbackPath = config.callbackPath ?? "/silent-callback";
+  const prefix = config.storageKeyPrefix ?? "nominal";
+  const silentFlowCapMs = config.timeouts?.silentFlowCapMs ?? DEFAULT_TIMEOUTS.silentFlowCapMs;
+  const lockWaitMs = config.timeouts?.lockWaitMs ?? 2 * silentFlowCapMs + 5e3;
+  return {
+    supabase: config.supabase,
+    provider: config.provider,
+    callbackPath,
+    timeouts: {
+      silentIframeMs: config.timeouts?.silentIframeMs ?? DEFAULT_TIMEOUTS.silentIframeMs,
+      silentFlowCapMs,
+      lockWaitMs,
+      oauthCompletionMs: config.timeouts?.oauthCompletionMs ?? DEFAULT_TIMEOUTS.oauthCompletionMs,
+      popupMs: config.timeouts?.popupMs ?? DEFAULT_TIMEOUTS.popupMs,
+      previewPrimingMs: config.timeouts?.previewPrimingMs ?? DEFAULT_TIMEOUTS.previewPrimingMs,
+      previewPrimingPollMs: config.timeouts?.previewPrimingPollMs ?? DEFAULT_TIMEOUTS.previewPrimingPollMs
+    },
+    lockName: `${prefix}-silent-sso`,
+    boundUserKey: `${prefix}-sso-bound-user`
+  };
+}
+function assertPkce(supabase) {
+  try {
+    const flowType = supabase.auth.flowType;
+    if (flowType !== "pkce") {
+      console.error(
+        `[vibe-auth] Supabase client is not configured with { auth: { flowType: 'pkce' } } (got: ${String(flowType)}). This is a security control, not a preference \u2014 with implicit flow the OAuth redirect carries a live access_token/refresh_token in the URL, so an attacker-controlled redirect target yields a full session. Fix the app's createClient(...) call before shipping.`
+      );
+    }
+  } catch {
+  }
+}
+
+// src/authMessage.ts
+var RESULT_MESSAGE_TYPE = "silent-auth-result";
+
+// src/silentAuth.ts
+var AuthResultKind = /* @__PURE__ */ ((AuthResultKind2) => {
+  AuthResultKind2["Code"] = "code";
+  return AuthResultKind2;
+})(AuthResultKind || {});
+function parseCallbackMessage(data) {
+  if (!data || data.type !== RESULT_MESSAGE_TYPE) return null;
+  if (data.code) return { kind: "code" /* Code */, code: data.code };
+  if (data.accessToken || data.refreshToken) {
+    console.warn("[vibe-auth] ignoring implicit-flow token payload; PKCE expects ?code=");
+  }
+  return null;
+}
+function createSilentAuth(config, getHostPrincipal) {
+  const { supabase, provider, callbackPath, timeouts, lockName, boundUserKey } = config;
+  async function getSessionUserId() {
+    const { data } = await supabase.auth.getSession();
+    return data.session?.user?.id ?? null;
+  }
+  async function hasValidSession() {
+    return await getSessionUserId() !== null;
+  }
+  function readBoundMarker() {
+    if (typeof window === "undefined") return null;
+    try {
+      return JSON.parse(localStorage.getItem(boundUserKey) ?? "null");
+    } catch {
+      return null;
+    }
+  }
+  function isBoundTo(principal) {
+    const m = readBoundMarker();
+    return m?.userId === principal.userId && m?.tenant === principal.tenant;
+  }
+  function writeBoundMarker({ userId, tenant }) {
+    if (typeof window === "undefined") return;
+    localStorage.setItem(boundUserKey, JSON.stringify({ userId, tenant, at: Date.now() }));
+  }
+  async function completeWithResult(result, priorUserId = null) {
+    const { error } = await supabase.auth.exchangeCodeForSession(result.code);
+    if (error) {
+      const sessionUserId = await getSessionUserId();
+      if (sessionUserId === null) return false;
+      if (priorUserId !== null && sessionUserId === priorUserId) return false;
+    }
+    const host = getHostPrincipal?.();
+    if (host) writeBoundMarker(host);
+    return true;
+  }
+  function runHiddenAuthFrame(url) {
+    return new Promise((resolve) => {
+      const expectedOrigin = window.location.origin;
+      let settled = false;
+      const iframe = document.createElement("iframe");
+      iframe.style.display = "none";
+      iframe.setAttribute("aria-hidden", "true");
+      const cleanup = () => {
+        window.removeEventListener("message", onMessage);
+        window.clearTimeout(timer);
+        if (iframe.parentNode) iframe.parentNode.removeChild(iframe);
+      };
+      const finish = (result) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        resolve(result);
+      };
+      const onMessage = (event) => {
+        if (event.origin !== expectedOrigin) return;
+        if (event.source !== iframe.contentWindow) return;
+        const data = event.data;
+        if (!data || data.type !== RESULT_MESSAGE_TYPE) return;
+        finish(parseCallbackMessage(data));
+      };
+      const timer = window.setTimeout(() => finish(null), timeouts.silentIframeMs);
+      window.addEventListener("message", onMessage);
+      iframe.src = url;
+      document.body.appendChild(iframe);
+    });
+  }
+  let inFlightSilentSignIn = null;
+  function trySilentSignIn() {
+    if (inFlightSilentSignIn) return inFlightSilentSignIn;
+    let expired = false;
+    inFlightSilentSignIn = Promise.race([
+      runTrySilentSignIn(() => expired),
+      new Promise(
+        (resolve) => setTimeout(() => {
+          expired = true;
+          resolve(false);
+        }, timeouts.silentFlowCapMs)
+      )
+    ]).finally(() => {
+      inFlightSilentSignIn = null;
+    });
+    return inFlightSilentSignIn;
+  }
+  async function runTrySilentSignIn(isExpired) {
+    if (typeof window === "undefined") return false;
+    const priorUserId = await getSessionUserId();
+    const redirectTo = `${window.location.origin}${callbackPath}`;
+    const { data, error } = await supabase.auth.signInWithOAuth({
+      provider,
+      options: {
+        redirectTo,
+        scopes: "openid profile email",
+        skipBrowserRedirect: true,
+        // gives us the URL instead of redirecting
+        queryParams: { prompt: "none" }
+        // provider returns a result or error, no UI
+      }
+    });
+    if (error || !data?.url) return false;
+    const result = await runHiddenAuthFrame(data.url);
+    if (!result) return false;
+    if (isExpired()) return false;
+    const ok = await completeWithResult(result, priorUserId);
+    if (ok && isExpired()) {
+      await supabase.auth.signOut();
+      return false;
+    }
+    return ok;
+  }
+  async function withSsoLock(fn, fallback) {
+    const locks = navigator.locks;
+    if (!locks?.request) {
+      if (await fn()) return true;
+      return fallback();
+    }
+    const controller = new AbortController();
+    const timer = window.setTimeout(() => controller.abort(), timeouts.lockWaitMs);
+    try {
+      return await locks.request(lockName, { signal: controller.signal }, fn);
+    } catch {
+      return fallback();
+    } finally {
+      window.clearTimeout(timer);
+    }
+  }
+  async function ensureSession() {
+    if (typeof window === "undefined") return false;
+    if (await hasValidSession()) return true;
+    return withSsoLock(
+      async () => {
+        if (await hasValidSession()) return true;
+        if (await trySilentSignIn()) return true;
+        return hasValidSession();
+      },
+      // Lock unavailable/aborted: a sibling may still have succeeded meanwhile.
+      hasValidSession
+    );
+  }
+  async function rebindSession(principal) {
+    if (typeof window === "undefined") return false;
+    const siblingRebound = async () => {
+      const m = readBoundMarker();
+      return m?.userId === principal.userId && m?.tenant === principal.tenant && Date.now() - (m.at ?? 0) < timeouts.lockWaitMs && await hasValidSession();
+    };
+    return withSsoLock(
+      async () => {
+        if (await siblingRebound()) return true;
+        const ok = await trySilentSignIn();
+        if (ok) writeBoundMarker(principal);
+        return ok;
+      },
+      // Reached on lock-wait abort — i.e. we gave up while a sibling may
+      // STILL be mid-flow, about to succeed and write the marker. Returning
+      // false here makes the caller signOut(), which would destroy that
+      // near-complete session, so grant one grace period before concluding
+      // failure.
+      async () => {
+        if (await siblingRebound()) return true;
+        await new Promise((r) => setTimeout(r, timeouts.silentFlowCapMs));
+        return siblingRebound();
+      }
+    );
+  }
+  function clearBoundUser() {
+    if (typeof window === "undefined") return;
+    localStorage.removeItem(boundUserKey);
+  }
+  return {
+    hasValidSession,
+    trySilentSignIn,
+    ensureSession,
+    rebindSession,
+    isBoundTo,
+    clearBoundUser,
+    completeWithResult
+  };
+}
+
+// src/previewToken.ts
+var PREVIEW_HOST_SUFFIX = ".lovable.app";
+var SANDBOX_HOST_SUFFIX = ".lovableproject.com";
+var capturedToken = null;
+function capturePreviewToken() {
+  if (typeof window === "undefined") return;
+  if (!window.location.hostname.endsWith(PREVIEW_HOST_SUFFIX)) return;
+  if (capturedToken) return;
+  try {
+    const token = new URLSearchParams(window.location.search).get("__lovable_token");
+    if (token) capturedToken = token;
+  } catch {
+  }
+}
+function isLovableHostedHost() {
+  if (typeof window === "undefined") return false;
+  const h = window.location.hostname;
+  return h.endsWith(PREVIEW_HOST_SUFFIX) || h.endsWith(SANDBOX_HOST_SUFFIX);
+}
+function getPreviewPrimingUrl() {
+  if (!isLovableHostedHost()) return null;
+  if (window.location.hostname.endsWith(PREVIEW_HOST_SUFFIX) && capturedToken) {
+    return `${window.location.origin}/?__lovable_token=${encodeURIComponent(capturedToken)}`;
+  }
+  return `${window.location.origin}/`;
+}
+capturePreviewToken();
+
+// src/signInResult.ts
+var SignInKind = /* @__PURE__ */ ((SignInKind2) => {
+  SignInKind2["Authenticated"] = "authenticated";
+  SignInKind2["Redirecting"] = "redirecting";
+  SignInKind2["Failed"] = "failed";
+  return SignInKind2;
+})(SignInKind || {});
+var SignInFailureReason = /* @__PURE__ */ ((SignInFailureReason2) => {
+  SignInFailureReason2["PopupBlocked"] = "popup-blocked";
+  SignInFailureReason2["OauthError"] = "oauth-error";
+  SignInFailureReason2["PopupClosed"] = "popup-closed";
+  SignInFailureReason2["ExchangeFailed"] = "exchange-failed";
+  SignInFailureReason2["Unsupported"] = "unsupported";
+  SignInFailureReason2["Unexpected"] = "unexpected";
+  return SignInFailureReason2;
+})(SignInFailureReason || {});
+
+// src/interactive.ts
+function createInteractiveAuth(config, silentAuth) {
+  const { supabase, provider, callbackPath, timeouts } = config;
+  function waitForPopupResult(popup) {
+    return new Promise((resolve) => {
+      const expectedOrigin = window.location.origin;
+      let settled = false;
+      const finish = (result) => {
+        if (settled) return;
+        settled = true;
+        window.removeEventListener("message", onMessage);
+        window.clearInterval(closedPoll);
+        resolve(result);
+      };
+      const onMessage = (event) => {
+        if (event.origin !== expectedOrigin) return;
+        if (event.source !== popup) return;
+        const data = event.data;
+        if (!data || data.type !== RESULT_MESSAGE_TYPE) return;
+        finish(parseCallbackMessage(data));
+      };
+      window.addEventListener("message", onMessage);
+      const closedPoll = window.setInterval(() => {
+        if (popup.closed) finish(null);
+      }, 500);
+    });
+  }
+  function primePopupForPreview(popup) {
+    const url = getPreviewPrimingUrl();
+    if (!url) return Promise.resolve();
+    return new Promise((resolve) => {
+      let settled = false;
+      const expectedOrigin = window.location.origin;
+      const finish = () => {
+        if (settled) return;
+        settled = true;
+        window.clearInterval(poll);
+        window.clearTimeout(timer);
+        resolve();
+      };
+      const timer = window.setTimeout(finish, timeouts.previewPrimingMs);
+      const poll = window.setInterval(() => {
+        if (popup.closed) return finish();
+        try {
+          if (popup.location.origin !== expectedOrigin) return;
+          if (popup.document.readyState !== "complete") return;
+          finish();
+        } catch {
+        }
+      }, timeouts.previewPrimingPollMs);
+      try {
+        popup.location.href = url;
+      } catch {
+        finish();
+      }
+    });
+  }
+  async function signInInteractive() {
+    const popupRef = { current: null };
+    try {
+      return await attemptSignIn((p) => popupRef.current = p);
+    } catch (err) {
+      console.error("[vibe-auth] signInInteractive failed unexpectedly:", err);
+      popupRef.current?.close();
+      return { kind: "failed" /* Failed */, reason: "unexpected" /* Unexpected */ };
+    }
+  }
+  async function attemptSignIn(trackPopup) {
+    if (typeof window === "undefined")
+      return { kind: "failed" /* Failed */, reason: "unsupported" /* Unsupported */ };
+    if (window.self === window.top) {
+      const { error } = await supabase.auth.signInWithOAuth({
+        provider,
+        options: {
+          redirectTo: `${window.location.origin}${callbackPath}`,
+          scopes: "openid profile email"
+        }
+      });
+      if (error) return { kind: "failed" /* Failed */, reason: "oauth-error" /* OauthError */ };
+      return { kind: "redirecting" /* Redirecting */ };
+    }
+    const popup = window.open("about:blank", "nominal-signin", "width=520,height=680");
+    if (!popup) return { kind: "failed" /* Failed */, reason: "popup-blocked" /* PopupBlocked */ };
+    trackPopup(popup);
+    let expired = false;
+    let flowTimer;
+    const timeout = new Promise((resolve) => {
+      flowTimer = window.setTimeout(() => {
+        expired = true;
+        popup.close();
+        resolve({ kind: "failed" /* Failed */, reason: "popup-closed" /* PopupClosed */ });
+      }, timeouts.popupMs);
+    });
+    const flow = (async () => {
+      await primePopupForPreview(popup).catch(() => void 0);
+      if (expired || popup.closed)
+        return { kind: "failed" /* Failed */, reason: "popup-closed" /* PopupClosed */ };
+      const { data, error } = await supabase.auth.signInWithOAuth({
+        provider,
+        options: {
+          redirectTo: `${window.location.origin}${callbackPath}`,
+          scopes: "openid profile email",
+          skipBrowserRedirect: true
+          // we navigate the popup ourselves
+        }
+      });
+      if (expired || popup.closed)
+        return { kind: "failed" /* Failed */, reason: "popup-closed" /* PopupClosed */ };
+      if (error || !data?.url) {
+        popup.close();
+        return { kind: "failed" /* Failed */, reason: "oauth-error" /* OauthError */ };
+      }
+      popup.location.href = data.url;
+      const result = await waitForPopupResult(popup);
+      if (expired || !result)
+        return { kind: "failed" /* Failed */, reason: "popup-closed" /* PopupClosed */ };
+      const ok = await silentAuth.completeWithResult(result);
+      if (expired) {
+        void supabase.auth.signOut().catch(() => {
+        });
+        return { kind: "failed" /* Failed */, reason: "popup-closed" /* PopupClosed */ };
+      }
+      return ok ? { kind: "authenticated" /* Authenticated */ } : { kind: "failed" /* Failed */, reason: "exchange-failed" /* ExchangeFailed */ };
+    })();
+    try {
+      return await Promise.race([flow, timeout]);
+    } finally {
+      if (flowTimer !== void 0) window.clearTimeout(flowTimer);
+    }
+  }
+  return { signInInteractive };
+}
+
+// src/SilentCallback.tsx
+import { useEffect } from "react";
+function createCallbackHandler() {
+  const INITIAL_SEARCH = typeof window !== "undefined" ? window.location.search : "";
+  const INITIAL_HASH = typeof window !== "undefined" ? window.location.hash : "";
+  let posted = false;
+  function SilentCallback() {
+    useEffect(() => {
+      if (posted) return;
+      const target = window.opener ?? (window.parent !== window ? window.parent : null);
+      if (!target) {
+        posted = true;
+        window.location.replace(`/${INITIAL_SEARCH}${INITIAL_HASH}`);
+        return;
+      }
+      posted = true;
+      const params = new URLSearchParams(INITIAL_SEARCH);
+      const hash = new URLSearchParams(INITIAL_HASH.replace(/^#/, ""));
+      const code = params.get("code");
+      const error = params.get("error") ?? params.get("error_description") ?? hash.get("error") ?? hash.get("error_description");
+      target.postMessage(
+        { type: RESULT_MESSAGE_TYPE, code, error: code ? null : error },
+        window.location.origin
+        // never use '*'
+      );
+      if (window.opener) window.close();
+    }, []);
+    return null;
+  }
+  return { SilentCallback };
+}
+
+// src/AuthGate.tsx
+import { useEffect as useEffect2, useState } from "react";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+function createAuthGate(config, silentAuth, interactiveAuth, hostAuth) {
+  const { supabase, callbackPath, timeouts } = config;
+  const RETURNING_FROM_OAUTH = typeof window !== "undefined" && (new URLSearchParams(window.location.search).has("code") || window.location.hash.includes("access_token"));
+  const IS_CALLBACK_PATH = typeof window !== "undefined" && window.location.pathname === callbackPath;
+  function DefaultFullScreenLoader() {
+    return /* @__PURE__ */ jsx(
+      "div",
+      {
+        style: { display: "grid", placeItems: "center", height: "100vh", fontFamily: "sans-serif" },
+        children: "Signing you in\u2026"
+      }
+    );
+  }
+  function DefaultSignInScreen() {
+    const [pending, setPending] = useState(false);
+    const [failure, setFailure] = useState(null);
+    return /* @__PURE__ */ jsx(
+      "div",
+      {
+        style: { display: "grid", placeItems: "center", height: "100vh", fontFamily: "sans-serif" },
+        children: /* @__PURE__ */ jsxs("div", { style: { textAlign: "center" }, children: [
+          /* @__PURE__ */ jsx(
+            "button",
+            {
+              type: "button",
+              disabled: pending,
+              onClick: () => {
+                setPending(true);
+                setFailure(null);
+                void interactiveAuth.signInInteractive().then((result) => {
+                  setFailure(result.kind === "failed" /* Failed */ ? result.reason : null);
+                  if (result.kind !== "redirecting" /* Redirecting */) setPending(false);
+                });
+              },
+              children: pending ? "Opening sign-in\u2026" : "Sign in"
+            }
+          ),
+          failure ? /* @__PURE__ */ jsx("p", { style: { fontSize: 12, marginTop: 8 }, children: failure === "popup-blocked" /* PopupBlocked */ ? "Your browser blocked the sign-in popup. Allow popups for this site and try again." : "Sign-in didn't complete. Please try again." }) : null
+        ] })
+      }
+    );
+  }
+  function AuthGate({ children, signInScreen, loader }) {
+    const [isCallback, setIsCallback] = useState(false);
+    const [status, setStatus] = useState("checking" /* Checking */);
+    useEffect2(() => {
+      if (IS_CALLBACK_PATH) setIsCallback(true);
+    }, []);
+    useEffect2(() => {
+      if (IS_CALLBACK_PATH) return;
+      let cancelled = false;
+      let oauthTimer;
+      let hostPrincipal;
+      let applyGen = 0;
+      let acceptPrincipalUpdates = !hostAuth?.isHostWired();
+      const applyPrincipal = async (principal) => {
+        hostPrincipal = principal;
+        const gen = ++applyGen;
+        setStatus("checking" /* Checking */);
+        const sessionOk = await silentAuth.hasValidSession().catch(() => false);
+        if (cancelled || gen !== applyGen) return;
+        if (sessionOk && silentAuth.isBoundTo(principal)) {
+          setStatus("authenticated" /* Authenticated */);
+          return;
+        }
+        const ok = await silentAuth.rebindSession(principal).catch(() => false);
+        if (cancelled || gen !== applyGen) return;
+        if (!ok) void supabase.auth.signOut().catch(() => {
+        });
+        setStatus(ok ? "authenticated" /* Authenticated */ : "unauthenticated" /* Unauthenticated */);
+      };
+      const openIfBound = async () => {
+        if (cancelled) return;
+        if (hostAuth?.isHostWired() && !hostPrincipal) return;
+        const gen = applyGen;
+        const principal = hostPrincipal;
+        if (principal) {
+          const sessionOk = await silentAuth.hasValidSession().catch(() => false);
+          if (cancelled || gen !== applyGen) return;
+          if (!(sessionOk && silentAuth.isBoundTo(principal))) return;
+        }
+        setStatus("authenticated" /* Authenticated */);
+      };
+      async function resolve() {
+        if (RETURNING_FROM_OAUTH) {
+          oauthTimer = window.setTimeout(() => {
+            if (!cancelled)
+              setStatus((s) => s === "checking" /* Checking */ ? "unauthenticated" /* Unauthenticated */ : s);
+          }, timeouts.oauthCompletionMs);
+          return;
+        }
+        if (hostAuth?.isHostWired()) {
+          acceptPrincipalUpdates = true;
+          const next = await hostAuth.waitForSeededPrincipal(timeouts.oauthCompletionMs);
+          if (cancelled) return;
+          if (next && applyGen === 0) await applyPrincipal(next);
+          if (applyGen === 0) setStatus("unauthenticated" /* Unauthenticated */);
+          return;
+        }
+        if (await silentAuth.ensureSession().catch(() => false)) {
+          if (!cancelled && !hostPrincipal) setStatus("authenticated" /* Authenticated */);
+          return;
+        }
+        if (!cancelled && !hostPrincipal) setStatus("unauthenticated" /* Unauthenticated */);
+      }
+      void resolve();
+      const unsubPrincipal = hostAuth?.onSeededPrincipal((next) => {
+        if (cancelled || !acceptPrincipalUpdates) return;
+        void applyPrincipal(next);
+      });
+      const onStorage = (e) => {
+        if (cancelled) return;
+        if (!e.key?.endsWith("-auth-token") || !e.newValue) return;
+        void openIfBound();
+      };
+      window.addEventListener("storage", onStorage);
+      const { data: sub } = supabase.auth.onAuthStateChange((event, session) => {
+        if (cancelled || event === "INITIAL_SESSION") return;
+        if (session) void openIfBound();
+        else setStatus((s) => s === "authenticated" /* Authenticated */ ? "unauthenticated" /* Unauthenticated */ : s);
+      });
+      return () => {
+        cancelled = true;
+        unsubPrincipal?.();
+        if (oauthTimer !== void 0) window.clearTimeout(oauthTimer);
+        sub.subscription.unsubscribe();
+        window.removeEventListener("storage", onStorage);
+      };
+    }, []);
+    if (isCallback) return /* @__PURE__ */ jsx(Fragment, { children });
+    if (status === "checking" /* Checking */) return loader ?? /* @__PURE__ */ jsx(DefaultFullScreenLoader, {});
+    if (status === "unauthenticated" /* Unauthenticated */) return signInScreen ?? /* @__PURE__ */ jsx(DefaultSignInScreen, {});
+    return /* @__PURE__ */ jsx(Fragment, { children });
+  }
+  return { AuthGate, DefaultSignInScreen };
+}
+
+// src/hostAuth.ts
+function createHostAuth(config, silentAuth) {
+  const { supabase } = config;
+  let principal;
+  let hostWired = false;
+  const seedListeners = /* @__PURE__ */ new Set();
+  function isHostWired() {
+    return hostWired;
+  }
+  function onSeededPrincipal(cb) {
+    seedListeners.add(cb);
+    return () => {
+      seedListeners.delete(cb);
+    };
+  }
+  function waitForSeededPrincipal(timeoutMs) {
+    if (principal) return Promise.resolve(principal);
+    return new Promise((resolve) => {
+      let settled = false;
+      const finish = (value) => {
+        if (settled) return;
+        settled = true;
+        window.clearTimeout(timer);
+        off();
+        resolve(value);
+      };
+      const timer = window.setTimeout(() => finish(null), timeoutMs);
+      const off = onSeededPrincipal((next) => finish(next));
+      if (principal) finish(principal);
+    });
+  }
+  function seedLastUserId(userId, tenant) {
+    principal = { userId, tenant };
+    for (const listener of [...seedListeners]) listener(principal);
+  }
+  function wireHostAuth(bridge) {
+    hostWired = true;
+    return bridge.onAuthChange((auth) => {
+      if (!auth.authenticated) {
+        principal = void 0;
+        silentAuth.clearBoundUser();
+        void supabase.auth.signOut().catch(() => {
+        });
+        return;
+      }
+      if (!auth.userId) return;
+      const tenant = auth.tenant ?? principal?.tenant;
+      if (!tenant) {
+        console.warn("[vibe-auth] AUTH_CHANGED authenticated without tenant; ignoring");
+        return;
+      }
+      if (principal?.userId === auth.userId && principal.tenant === tenant) return;
+      seedLastUserId(auth.userId, tenant);
+    });
+  }
+  return {
+    wireHostAuth,
+    seedLastUserId,
+    getPrincipal: () => principal,
+    isHostWired,
+    waitForSeededPrincipal,
+    onSeededPrincipal
+  };
+}
+
+// src/createVibeAuth.ts
+function createVibeAuth(userConfig) {
+  const config = resolveConfig(userConfig);
+  assertPkce(config.supabase);
+  let hostAuth;
+  const silentAuth = createSilentAuth(config, () => hostAuth.getPrincipal());
+  const interactiveAuth = createInteractiveAuth(config, silentAuth);
+  const { SilentCallback } = createCallbackHandler();
+  hostAuth = createHostAuth(config, silentAuth);
+  const { AuthGate, DefaultSignInScreen } = createAuthGate(
+    config,
+    silentAuth,
+    interactiveAuth,
+    hostAuth
+  );
+  const { wireHostAuth, seedLastUserId } = hostAuth;
+  return {
+    hasValidSession: silentAuth.hasValidSession,
+    rebindSession: silentAuth.rebindSession,
+    trySilentSignIn: silentAuth.trySilentSignIn,
+    ensureSession: silentAuth.ensureSession,
+    signInInteractive: interactiveAuth.signInInteractive,
+    clearBoundUser: silentAuth.clearBoundUser,
+    AuthGate,
+    DefaultSignInScreen,
+    SilentCallback,
+    wireHostAuth,
+    seedLastUserId,
+    RESULT_MESSAGE_TYPE,
+    callbackPath: config.callbackPath
+  };
+}
+export {
+  AuthResultKind,
+  RESULT_MESSAGE_TYPE,
+  SignInFailureReason,
+  SignInKind,
+  createVibeAuth
+};
+//# sourceMappingURL=index.js.map