@octabits-io/nuxt-ui-kit 0.2.1 → 0.3.1

package/README.md

@@ -72,6 +72,19 @@ code. Register them under your app's own names with one-line re-exports:
 export { default } from '@octabits-io/nuxt-ui-kit/components/SubSidebar.vue'
 ```
 
+**Tailwind setup (required):** the kit's SFCs live in `node_modules`, which
+Tailwind v4's automatic source detection skips — utility classes used only in
+kit markup (e.g. `SubSidebar`'s default `w-[240px]`) would silently be missing
+from your build. Import the kit's stylesheet, which registers the components
+via `@source` (same mechanism `@nuxt/ui` uses):
+
+```css
+/* app/assets/css/main.css */
+@import "tailwindcss";
+@import "@nuxt/ui";
+@import "@octabits-io/nuxt-ui-kit/styles.css";
+```
+
 ## Wiring examples (Nuxt)
 
 ### Auth + API client

package/dist/api/index.d.ts

@@ -0,0 +1,65 @@
+import { UserManager } from "oidc-client-ts";
+import { Treaty } from "@elysiajs/eden";
+import { Elysia } from "elysia";
+//#region src/api/client.d.ts
+type AnyElysia = Elysia<any, any, any, any, any, any, any>;
+interface ResolveApiBaseUrlOptions {
+  /**
+   * The explicitly configured URL, first-match-wins — e.g.
+   * `__APP_CONFIG__.API_URL || runtimeConfig.public.apiUrl`. Falsy → fallback.
+   */
+  configuredUrl: string | null | undefined;
+  /** Build-time production flag (`import.meta.env.PROD`). */
+  isProductionBuild: boolean;
+  /** Dev fallback becomes `http://localhost:<port>`. */
+  devFallbackPort: number;
+  /** Production fallback origin. Default `window.location.origin`. */
+  origin?: string;
+}
+/**
+ * Resolve the API base URL: configured value, else the page origin in
+ * production builds (same-host ingress), else a localhost dev port.
+ */
+declare function resolveApiBaseUrl(options: ResolveApiBaseUrlOptions): string;
+/**
+ * Bearer-token provider backed by the OIDC session: resolves to the current
+ * access token, or `null` when there is no non-expired session.
+ */
+declare function createAccessTokenProvider(getUserManager: () => UserManager): () => Promise<string | null>;
+interface TreatyClientFactoryOptions {
+  /** Resolve (and memoize, if desired) the base URL at first client use. */
+  getBaseUrl: () => string;
+  /** Bearer token per request; `null` sends no Authorization header. */
+  getAccessToken: () => Promise<string | null>;
+  /**
+   * Eden Treaty's auto-Date parsing on responses. Default `false`: with the
+   * default `true`, any `YYYY-MM-DD` string in a response is silently
+   * converted to a `Date` object, which then JSON-serializes back as a full
+   * ISO datetime on the next request — breaking server-side "plain ISO date
+   * string" validation. Keep the wire contract string-typed unless the API
+   * genuinely round-trips Date objects.
+   */
+  parseDate?: boolean;
+  /**
+   * Additional header source(s), applied after the bearer injector — a later
+   * entry wins on key collision, so consumers can add or override headers
+   * without losing the Authorization injection.
+   */
+  headers?: Treaty.Config['headers'];
+  /** Extra Treaty config (fetcher, onRequest, …), applied last. */
+  treatyConfig?: Omit<Treaty.Config, 'headers' | 'parseDate'>;
+}
+/**
+ * Lazily-created Eden Treaty client singleton with OIDC bearer injection.
+ *
+ * ```ts
+ * const getClient = createTreatyClientFactory<App>({ getBaseUrl, getAccessToken })
+ * export function useApi() {
+ *   const client = getClient()
+ *   return { api: client.api, client }
+ * }
+ * ```
+ */
+declare function createTreatyClientFactory<App extends AnyElysia>(options: TreatyClientFactoryOptions): () => Treaty.Create<App>;
+//#endregion
+export { type ResolveApiBaseUrlOptions, type TreatyClientFactoryOptions, createAccessTokenProvider, createTreatyClientFactory, resolveApiBaseUrl };

package/dist/api/index.js

@@ -0,0 +1,51 @@
+import { treaty } from "@elysiajs/eden";
+//#region src/api/client.ts
+/**
+* Resolve the API base URL: configured value, else the page origin in
+* production builds (same-host ingress), else a localhost dev port.
+*/
+function resolveApiBaseUrl(options) {
+	if (options.configuredUrl) return options.configuredUrl;
+	return options.isProductionBuild ? options.origin ?? window.location.origin : `http://localhost:${options.devFallbackPort}`;
+}
+/**
+* Bearer-token provider backed by the OIDC session: resolves to the current
+* access token, or `null` when there is no non-expired session.
+*/
+function createAccessTokenProvider(getUserManager) {
+	return async function getAccessToken() {
+		const user = await getUserManager().getUser();
+		if (!user || user.expired) return null;
+		return user.access_token;
+	};
+}
+/**
+* Lazily-created Eden Treaty client singleton with OIDC bearer injection.
+*
+* ```ts
+* const getClient = createTreatyClientFactory<App>({ getBaseUrl, getAccessToken })
+* export function useApi() {
+*   const client = getClient()
+*   return { api: client.api, client }
+* }
+* ```
+*/
+function createTreatyClientFactory(options) {
+	let client = null;
+	return function getClient() {
+		if (client) return client;
+		const bearerInjector = async () => {
+			const token = await options.getAccessToken();
+			if (token) return { authorization: `Bearer ${token}` };
+		};
+		const extraHeaders = options.headers === void 0 ? [] : Array.isArray(options.headers) ? options.headers : [options.headers];
+		client = treaty(options.getBaseUrl(), {
+			parseDate: options.parseDate ?? false,
+			headers: [bearerInjector, ...extraHeaders],
+			...options.treatyConfig
+		});
+		return client;
+	};
+}
+//#endregion
+export { createAccessTokenProvider, createTreatyClientFactory, resolveApiBaseUrl };

package/dist/auth/index.d.ts

@@ -0,0 +1,240 @@
+import { ComputedRef, Ref } from "vue";
+import { UserManager, UserManagerSettings, UserProfile } from "oidc-client-ts";
+//#region src/auth/oidc.d.ts
+/** Issuer + client id, resolved at first use (client-side runtime config). */
+interface OidcClientConfig {
+  issuerUrl: string;
+  clientId: string;
+}
+interface UserManagerFactoryOptions {
+  /**
+   * Resolve the issuer/client pair lazily — typically from a runtime-injected
+   * config object (e.g. a K8s-entrypoint `window.__APP_CONFIG__`) falling back
+   * to the app's build-time config.
+   */
+  getConfig: () => OidcClientConfig;
+  /** OAuth scopes requested on the initial signin. */
+  scope: string;
+  /**
+   * Scopes sent on the refresh-token grant when the IdP restricts them to a
+   * subset of the signin scopes (see `ZITADEL_REFRESH_TOKEN_ALLOWED_SCOPE`).
+   */
+  refreshTokenAllowedScope?: string;
+  /** Path the IdP redirects back to after signin. Default `/auth/callback`. */
+  redirectPath?: string;
+  /** Path the IdP redirects to after logout. Default `/login`. */
+  postLogoutRedirectPath?: string;
+  /** Default `true`. */
+  automaticSilentRenew?: boolean;
+  /** Raw oidc-client-ts settings escape hatch, applied last. */
+  settings?: Partial<UserManagerSettings>;
+  /** Called when issuer/client resolve empty. Default `console.error`. */
+  onMissingConfig?: (message: string) => void;
+}
+/**
+ * Lazily-created `UserManager` singleton bound to `window.localStorage`.
+ * Call the returned getter from plugins/stores/composables — the manager is
+ * constructed on first call (client-side only; requires `window`).
+ */
+declare function createUserManagerFactory(options: UserManagerFactoryOptions): () => UserManager;
+type StaleKeyStorage = Pick<Storage, 'length' | 'key' | 'removeItem'>;
+/**
+ * Remove any `oidc.user:` storage keys that don't belong to the current
+ * authority+clientId — leftovers from environment switches would otherwise
+ * shadow or bloat the session storage.
+ */
+declare function removeStaleOidcKeys(authority: string, clientId: string, storage?: StaleKeyStorage): void;
+/** Refresh tokens fail unrecoverably with these OIDC error codes — user must re-auth. */
+declare function isUnrecoverableRenewError(message: string): boolean;
+interface LoginRedirectorOptions {
+  getUserManager: () => UserManager;
+  /** Fallback login page for when `signinRedirect` itself fails. Default `/login`. */
+  loginPath?: string;
+  /**
+   * Paths where redirecting to login would loop (the login/callback pages
+   * themselves). Default: `loginPath` and anything under `/auth/`.
+   */
+  isAuthRoute?: (path: string) => boolean;
+  /** Default `console.error`. */
+  log?: (message: string, detail?: unknown) => void;
+}
+/**
+ * Build a `redirectToLogin()` that starts an OIDC signin redirect carrying the
+ * current path as returnUrl state, with a plain `/login?redirect=` navigation
+ * fallback when the IdP redirect cannot even be started. No-ops on auth routes.
+ */
+declare function createLoginRedirector(options: LoginRedirectorOptions): () => Promise<void>;
+/**
+ * A user-facing session event the app should surface (toast/banner). The kit
+ * classifies; presentation and copy stay in the app.
+ *
+ * - `renew-failed` — silent renew failed recoverably (next renew may succeed).
+ * - `session-expired` — the session is gone; a login redirect follows.
+ */
+type SessionNotice = {
+  kind: 'renew-failed';
+  error: Error;
+} | {
+  kind: 'session-expired';
+  error?: Error;
+};
+interface SessionLifecycleHandlers {
+  /** Start re-authentication (typically from {@link createLoginRedirector}). */
+  redirectToLogin: () => void | Promise<void>;
+  /** Surface a notice to the user (toast). Optional — omit for headless use. */
+  notify?: (notice: SessionNotice) => void;
+  /** Clear app-side session state (e.g. reset the auth store's user). */
+  onSessionLost?: () => void;
+  /** Default `console.warn`. */
+  log?: (message: string, detail?: unknown) => void;
+}
+/**
+ * Wire oidc-client-ts session events to app callbacks:
+ *
+ * - silent-renew error → `notify` (`renew-failed`, or `session-expired` when the
+ *   error is unrecoverable — see {@link isUnrecoverableRenewError}); an
+ *   unrecoverable error also triggers the login redirect
+ * - access token expired without renewal → `notify(session-expired)` +
+ *   `onSessionLost` + login redirect
+ * - back-channel signout at the IdP → `onSessionLost` + login redirect (no notice
+ *   — the user initiated it elsewhere)
+ *
+ * Returns a detach function.
+ */
+declare function attachSessionLifecycleHandlers(userManager: UserManager, handlers: SessionLifecycleHandlers): () => void;
+//#endregion
+//#region src/auth/zitadel.d.ts
+/**
+ * Zitadel scope presets for {@link createUserManagerFactory}.
+ *
+ * The URN scopes request the resource-owner (organization) claim and the
+ * project role grants; `offline_access` requests a refresh token.
+ */
+declare const ZITADEL_ORG_PROJECT_SCOPE = "openid profile email urn:zitadel:iam:user:resourceowner urn:zitadel:iam:org:project:roles offline_access";
+/**
+ * Zitadel only accepts standard OIDC scopes on the refresh-token grant —
+ * sending `offline_access` or the `urn:zitadel:*` scopes returns
+ * `invalid_scope` even though they were granted at the initial auth. The
+ * URN-based claims still need to land in the refreshed access token; that
+ * depends on "Assert Roles on Authentication" being enabled at the Zitadel
+ * project level.
+ */
+declare const ZITADEL_REFRESH_TOKEN_ALLOWED_SCOPE = "openid profile email";
+//#endregion
+//#region src/auth/bypass.d.ts
+type BypassStorage = Pick<Storage, 'getItem' | 'setItem'>;
+interface AuthBypassProfile {
+  sub: string;
+  email: string;
+  name: string;
+}
+interface SeedAuthBypassOptions {
+  /** The shared secret the API accepts as a Bearer token. Falsy → no-op. */
+  bypassSecret: string | null | undefined;
+  issuerUrl: string;
+  clientId: string;
+  /**
+   * MUST be the build-time production flag (e.g. `import.meta.env.PROD`).
+   * When `true` the seed is refused unconditionally — a leaked runtime env var
+   * cannot enable the bypass in a production build.
+   */
+  isProductionBuild: boolean;
+  /** Identity baked into the fake session. */
+  profile?: AuthBypassProfile;
+  /** Fake session lifetime. Default 86400 (24h). */
+  sessionTtlSeconds?: number;
+  storage?: BypassStorage;
+  /** Default `console.warn`. */
+  warn?: (message: string) => void;
+}
+/**
+ * Dev/E2E auth bypass: seed storage with a fake oidc-client-ts user whose
+ * `access_token` is the bypass secret, so the app considers the session
+ * authenticated and the API client sends the secret as Bearer.
+ *
+ * Call from a plugin that runs before the OIDC plugin. Skips seeding when a
+ * valid (non-expired) session already exists; overwrites corrupt entries.
+ * Returns whether a session was seeded.
+ */
+declare function seedAuthBypassSession(options: SeedAuthBypassOptions): boolean;
+//#endregion
+//#region src/auth/session.d.ts
+/** Default mapped shape of the authenticated user. */
+interface AuthSessionUser {
+  id: string;
+  email: string;
+  name: string | null;
+  picture: string | null;
+}
+interface AuthSessionCoreOptions<TUser> {
+  getUserManager: () => UserManager;
+  /** Map OIDC profile claims to the app's user shape. */
+  mapUser: (profile: UserProfile) => TUser;
+  /** Default `console.warn`. */
+  log?: (message: string, detail?: unknown) => void;
+}
+interface AuthSessionCore<TUser> {
+  user: Ref<TUser | null>;
+  initialized: Ref<boolean>;
+  loading: Ref<boolean>;
+  isAuthenticated: ComputedRef<boolean>;
+  /** Restore the session from storage, silently renewing an expired token. */
+  checkAuth: () => Promise<void>;
+  /** Start the signin redirect, carrying `returnUrl` as state. */
+  login: (returnUrl?: string) => Promise<void>;
+  /** Complete the signin redirect; returns the returnUrl state (default `/`). */
+  handleCallback: () => Promise<string>;
+  /** Clear the local session and redirect to the IdP's logout endpoint. */
+  logout: () => Promise<void>;
+}
+declare function defaultAuthUserMapper(profile: UserProfile): AuthSessionUser;
+/**
+ * Reactive OIDC session state + actions — the setup body of an auth store.
+ * Wrap it in the app's own store so naming and registration stay app-owned:
+ *
+ * ```ts
+ * export const useAuthStore = defineStore('auth', () =>
+ *   createAuthSessionCore({ getUserManager, mapUser: defaultAuthUserMapper }),
+ * )
+ * ```
+ */
+declare function createAuthSessionCore<TUser = AuthSessionUser>(options: AuthSessionCoreOptions<TUser>): AuthSessionCore<TUser>;
+//#endregion
+//#region src/auth/guard.d.ts
+/** The route fields the guard needs — structurally satisfied by a Nuxt route. */
+interface GuardRoute {
+  path: string;
+  fullPath: string;
+}
+interface AuthGuardOptions<TRoute extends GuardRoute = GuardRoute> {
+  /**
+   * Ensure the session is restored and report whether the user is
+   * authenticated — typically `checkAuth()` once, then `isAuthenticated`.
+   */
+  ensureAuthenticated: () => Promise<boolean> | boolean;
+  /** Routes reachable without auth. Default: `/login` and `/auth/*`. */
+  isPublicRoute?: (to: TRoute) => boolean;
+  /** Build the login redirect target. Default `/login?redirect=<returnTo>`. */
+  loginRedirect?: (returnTo: string) => string;
+  /**
+   * Per-app policy hook that runs once the user is authenticated — tenant/org
+   * validation, role gates, acceptance gates. Return a path to redirect to,
+   * or nothing to let the navigation through.
+   */
+  afterAuthenticated?: (to: TRoute) => Promise<string | undefined | void> | string | undefined | void;
+}
+/**
+ * Build the body of a global auth route-middleware. The returned handler
+ * yields a redirect target path or `undefined` to allow navigation; the app's
+ * middleware maps that onto its router:
+ *
+ * ```ts
+ * export default defineNuxtRouteMiddleware(async (to) => {
+ *   const target = await guard(to)
+ *   if (target) return navigateTo(target)
+ * })
+ * ```
+ */
+declare function createAuthGuard<TRoute extends GuardRoute = GuardRoute>(options: AuthGuardOptions<TRoute>): (to: TRoute) => Promise<string | undefined>;
+//#endregion
+export { type AuthBypassProfile, type AuthGuardOptions, type AuthSessionCore, type AuthSessionCoreOptions, type AuthSessionUser, type GuardRoute, type LoginRedirectorOptions, type OidcClientConfig, type SeedAuthBypassOptions, type SessionLifecycleHandlers, type SessionNotice, type UserManagerFactoryOptions, ZITADEL_ORG_PROJECT_SCOPE, ZITADEL_REFRESH_TOKEN_ALLOWED_SCOPE, attachSessionLifecycleHandlers, createAuthGuard, createAuthSessionCore, createLoginRedirector, createUserManagerFactory, defaultAuthUserMapper, isUnrecoverableRenewError, removeStaleOidcKeys, seedAuthBypassSession };

package/dist/auth/index.js

@@ -0,0 +1,273 @@
+import { computed, ref } from "vue";
+import { UserManager, WebStorageStateStore } from "oidc-client-ts";
+//#region src/auth/oidc.ts
+/**
+* Lazily-created `UserManager` singleton bound to `window.localStorage`.
+* Call the returned getter from plugins/stores/composables — the manager is
+* constructed on first call (client-side only; requires `window`).
+*/
+function createUserManagerFactory(options) {
+	let userManager = null;
+	return function getUserManager() {
+		if (userManager) return userManager;
+		const { issuerUrl, clientId } = options.getConfig();
+		if (!issuerUrl || !clientId) (options.onMissingConfig ?? console.error)("Missing OIDC issuer URL or client id in runtime config");
+		userManager = new UserManager({
+			authority: issuerUrl,
+			client_id: clientId,
+			redirect_uri: `${window.location.origin}${options.redirectPath ?? "/auth/callback"}`,
+			post_logout_redirect_uri: `${window.location.origin}${options.postLogoutRedirectPath ?? "/login"}`,
+			response_type: "code",
+			scope: options.scope,
+			automaticSilentRenew: options.automaticSilentRenew ?? true,
+			...options.refreshTokenAllowedScope ? { refreshTokenAllowedScope: options.refreshTokenAllowedScope } : {},
+			userStore: new WebStorageStateStore({ store: window.localStorage }),
+			...options.settings
+		});
+		return userManager;
+	};
+}
+/**
+* Remove any `oidc.user:` storage keys that don't belong to the current
+* authority+clientId — leftovers from environment switches would otherwise
+* shadow or bloat the session storage.
+*/
+function removeStaleOidcKeys(authority, clientId, storage = globalThis.localStorage) {
+	const currentKey = `oidc.user:${authority}:${clientId}`;
+	for (let i = storage.length - 1; i >= 0; i--) {
+		const key = storage.key(i);
+		if (key && key.startsWith("oidc.user:") && key !== currentKey) storage.removeItem(key);
+	}
+}
+/** Refresh tokens fail unrecoverably with these OIDC error codes — user must re-auth. */
+function isUnrecoverableRenewError(message) {
+	return message.includes("login_required") || message.includes("invalid_grant") || message.includes("interaction_required") || message.includes("consent_required");
+}
+/**
+* Build a `redirectToLogin()` that starts an OIDC signin redirect carrying the
+* current path as returnUrl state, with a plain `/login?redirect=` navigation
+* fallback when the IdP redirect cannot even be started. No-ops on auth routes.
+*/
+function createLoginRedirector(options) {
+	const loginPath = options.loginPath ?? "/login";
+	const isAuthRoute = options.isAuthRoute ?? ((path) => path === loginPath || path.startsWith("/auth/"));
+	return async function redirectToLogin() {
+		const path = window.location.pathname;
+		if (isAuthRoute(path)) return;
+		const returnUrl = path + window.location.search;
+		try {
+			await options.getUserManager().signinRedirect({ state: returnUrl });
+		} catch (err) {
+			(options.log ?? console.error)("[oidc] signinRedirect failed, falling back to login navigation", err);
+			window.location.href = `${loginPath}?redirect=${encodeURIComponent(returnUrl)}`;
+		}
+	};
+}
+/**
+* Wire oidc-client-ts session events to app callbacks:
+*
+* - silent-renew error → `notify` (`renew-failed`, or `session-expired` when the
+*   error is unrecoverable — see {@link isUnrecoverableRenewError}); an
+*   unrecoverable error also triggers the login redirect
+* - access token expired without renewal → `notify(session-expired)` +
+*   `onSessionLost` + login redirect
+* - back-channel signout at the IdP → `onSessionLost` + login redirect (no notice
+*   — the user initiated it elsewhere)
+*
+* Returns a detach function.
+*/
+function attachSessionLifecycleHandlers(userManager, handlers) {
+	const log = handlers.log ?? console.warn;
+	const onSilentRenewError = (error) => {
+		log("[oidc] silent token renew failed:", error);
+		const unrecoverable = isUnrecoverableRenewError(error.message);
+		handlers.notify?.(unrecoverable ? {
+			kind: "session-expired",
+			error
+		} : {
+			kind: "renew-failed",
+			error
+		});
+		if (unrecoverable) handlers.redirectToLogin();
+	};
+	const onAccessTokenExpired = () => {
+		log("[oidc] access token expired without silent renewal");
+		handlers.notify?.({ kind: "session-expired" });
+		handlers.onSessionLost?.();
+		handlers.redirectToLogin();
+	};
+	const onUserSignedOut = () => {
+		log("[oidc] user signed out at IdP (back-channel)");
+		handlers.onSessionLost?.();
+		handlers.redirectToLogin();
+	};
+	userManager.events.addSilentRenewError(onSilentRenewError);
+	userManager.events.addAccessTokenExpired(onAccessTokenExpired);
+	userManager.events.addUserSignedOut(onUserSignedOut);
+	return () => {
+		userManager.events.removeSilentRenewError(onSilentRenewError);
+		userManager.events.removeAccessTokenExpired(onAccessTokenExpired);
+		userManager.events.removeUserSignedOut(onUserSignedOut);
+	};
+}
+//#endregion
+//#region src/auth/zitadel.ts
+/**
+* Zitadel scope presets for {@link createUserManagerFactory}.
+*
+* The URN scopes request the resource-owner (organization) claim and the
+* project role grants; `offline_access` requests a refresh token.
+*/
+const ZITADEL_ORG_PROJECT_SCOPE = "openid profile email urn:zitadel:iam:user:resourceowner urn:zitadel:iam:org:project:roles offline_access";
+/**
+* Zitadel only accepts standard OIDC scopes on the refresh-token grant —
+* sending `offline_access` or the `urn:zitadel:*` scopes returns
+* `invalid_scope` even though they were granted at the initial auth. The
+* URN-based claims still need to land in the refreshed access token; that
+* depends on "Assert Roles on Authentication" being enabled at the Zitadel
+* project level.
+*/
+const ZITADEL_REFRESH_TOKEN_ALLOWED_SCOPE = "openid profile email";
+//#endregion
+//#region src/auth/bypass.ts
+/**
+* Dev/E2E auth bypass: seed storage with a fake oidc-client-ts user whose
+* `access_token` is the bypass secret, so the app considers the session
+* authenticated and the API client sends the secret as Bearer.
+*
+* Call from a plugin that runs before the OIDC plugin. Skips seeding when a
+* valid (non-expired) session already exists; overwrites corrupt entries.
+* Returns whether a session was seeded.
+*/
+function seedAuthBypassSession(options) {
+	if (options.isProductionBuild) return false;
+	if (!options.bypassSecret) return false;
+	const storage = options.storage ?? globalThis.localStorage;
+	const storageKey = `oidc.user:${options.issuerUrl}:${options.clientId}`;
+	const existing = storage.getItem(storageKey);
+	if (existing) try {
+		if ((JSON.parse(existing).expires_at ?? 0) > Date.now() / 1e3) return false;
+	} catch {}
+	(options.warn ?? console.warn)("[auth-bypass] Seeding storage with bypass token for dev/E2E testing");
+	storage.setItem(storageKey, JSON.stringify({
+		access_token: options.bypassSecret,
+		token_type: "Bearer",
+		expires_at: Math.floor(Date.now() / 1e3) + (options.sessionTtlSeconds ?? 86400),
+		profile: options.profile ?? {
+			sub: "e2e-test-user",
+			email: "e2e@example.test",
+			name: "E2E Test User"
+		},
+		scope: "openid profile email"
+	}));
+	return true;
+}
+//#endregion
+//#region src/auth/session.ts
+function defaultAuthUserMapper(profile) {
+	return {
+		id: profile.sub,
+		email: profile.email ?? "",
+		name: profile.name ?? null,
+		picture: profile.picture ?? null
+	};
+}
+/**
+* Reactive OIDC session state + actions — the setup body of an auth store.
+* Wrap it in the app's own store so naming and registration stay app-owned:
+*
+* ```ts
+* export const useAuthStore = defineStore('auth', () =>
+*   createAuthSessionCore({ getUserManager, mapUser: defaultAuthUserMapper }),
+* )
+* ```
+*/
+function createAuthSessionCore(options) {
+	const log = options.log ?? console.warn;
+	const user = ref(null);
+	const initialized = ref(false);
+	const loading = ref(false);
+	const isAuthenticated = computed(() => !!user.value);
+	async function checkAuth() {
+		loading.value = true;
+		try {
+			const um = options.getUserManager();
+			let oidcUser = await um.getUser();
+			if (oidcUser && oidcUser.expired && oidcUser.refresh_token) try {
+				oidcUser = await um.signinSilent();
+			} catch (err) {
+				log("[auth] signinSilent failed during checkAuth", err);
+				oidcUser = null;
+			}
+			if (oidcUser && !oidcUser.expired) user.value = options.mapUser(oidcUser.profile);
+			else user.value = null;
+		} catch {
+			user.value = null;
+		} finally {
+			initialized.value = true;
+			loading.value = false;
+		}
+	}
+	async function login(returnUrl) {
+		await options.getUserManager().signinRedirect({ state: returnUrl ?? "/" });
+	}
+	async function handleCallback() {
+		loading.value = true;
+		try {
+			const oidcUser = await options.getUserManager().signinRedirectCallback();
+			user.value = options.mapUser(oidcUser.profile);
+			return oidcUser.state || "/";
+		} finally {
+			initialized.value = true;
+			loading.value = false;
+		}
+	}
+	async function logout() {
+		loading.value = true;
+		try {
+			const manager = options.getUserManager();
+			const idTokenHint = (await manager.getUser())?.id_token;
+			await manager.removeUser();
+			user.value = null;
+			await manager.signoutRedirect(idTokenHint ? { id_token_hint: idTokenHint } : void 0);
+		} finally {
+			loading.value = false;
+		}
+	}
+	return {
+		user,
+		initialized,
+		loading,
+		isAuthenticated,
+		checkAuth,
+		login,
+		handleCallback,
+		logout
+	};
+}
+//#endregion
+//#region src/auth/guard.ts
+/**
+* Build the body of a global auth route-middleware. The returned handler
+* yields a redirect target path or `undefined` to allow navigation; the app's
+* middleware maps that onto its router:
+*
+* ```ts
+* export default defineNuxtRouteMiddleware(async (to) => {
+*   const target = await guard(to)
+*   if (target) return navigateTo(target)
+* })
+* ```
+*/
+function createAuthGuard(options) {
+	const isPublicRoute = options.isPublicRoute ?? ((to) => to.path === "/login" || to.path.startsWith("/auth/"));
+	const loginRedirect = options.loginRedirect ?? ((returnTo) => `/login?redirect=${encodeURIComponent(returnTo)}`);
+	return async function guard(to) {
+		if (isPublicRoute(to)) return void 0;
+		if (!await options.ensureAuthenticated()) return loginRedirect(to.fullPath);
+		const target = await options.afterAuthenticated?.(to);
+		return typeof target === "string" ? target : void 0;
+	};
+}
+//#endregion
+export { ZITADEL_ORG_PROJECT_SCOPE, ZITADEL_REFRESH_TOKEN_ALLOWED_SCOPE, attachSessionLifecycleHandlers, createAuthGuard, createAuthSessionCore, createLoginRedirector, createUserManagerFactory, defaultAuthUserMapper, isUnrecoverableRenewError, removeStaleOidcKeys, seedAuthBypassSession };